fix: filter --use-keyring and --global-config from user global flags

These flags are managed by the extension and conflict with the auth
mode it chooses. Passing --use-keyring=false with --url breaks keyring
auth, and --global-config with --url causes the CLI to ignore the
keyring entirely.

Author: EhabY

package.json

@@ -150,7 +150,7 @@
 					]
 				},
 				"coder.globalFlags": {
-					"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item; values are passed verbatim and in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nNote that for `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here. The `--global-config` flag is explicitly ignored.",
+					"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item; values are passed verbatim and in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nNote that for `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here. The `--global-config` and `--use-keyring` flags are silently ignored as the extension manages them via `#coder.useKeyring#`.",
 					"type": "array",
 					"items": {
 						"type": "string"

src/cliConfig.ts

@@ -32,12 +32,29 @@ export function getGlobalFlags(
 			? ["--url", escapeCommandArg(auth.url)]
 			: ["--global-config", escapeCommandArg(auth.configDir)];
 
-	// Last takes precedence/overrides previous ones
-	return [
-		...getGlobalFlagsRaw(configs),
-		...authFlags,
-		...getHeaderArgs(configs),
-	];
+	const raw = getGlobalFlagsRaw(configs);
+	const filtered: string[] = [];
+	for (let i = 0; i < raw.length; i++) {
+		if (isFlag(raw[i], "--use-keyring")) {
+			continue;
+		}
+		if (isFlag(raw[i], "--global-config")) {
+			// Skip the next item too when the value is a separate entry.
+			if (raw[i] === "--global-config") {
+				i++;
+			}
+			continue;
+		}
+		filtered.push(raw[i]);
+	}
+
+	return [...filtered, ...authFlags, ...getHeaderArgs(configs)];
+}
+
+function isFlag(item: string, name: string): boolean {
+	return (
+		item === name || item.startsWith(`${name}=`) || item.startsWith(`${name} `)
+	);
 }
 
 /**

test/unit/cliConfig.test.ts

@@ -68,18 +68,72 @@ describe("cliConfig", () => {
 			]);
 		});
 
-		it("should not filter duplicate global-config flags, last takes precedence", () => {
+		it.each(["--use-keyring", "--use-keyring=false", "--use-keyring=true"])(
+			"should filter %s from global flags",
+			(managedFlag) => {
+				const config = new MockConfigurationProvider();
+				config.set("coder.globalFlags", [
+					"--verbose",
+					managedFlag,
+					"--disable-direct-connections",
+				]);
+
+				expect(getGlobalFlags(config, globalConfigAuth)).toStrictEqual([
+					"--verbose",
+					"--disable-direct-connections",
+					"--global-config",
+					'"/config/dir"',
+				]);
+			},
+		);
+
+		interface GlobalConfigCase {
+			scenario: string;
+			flags: string[];
+		}
+		it.each<GlobalConfigCase>([
+			{
+				scenario: "space-separated in one item",
+				flags: ["-v", "--global-config /path/to/ignored"],
+			},
+			{
+				scenario: "equals form",
+				flags: ["-v", "--global-config=/path/to/ignored"],
+			},
+			{
+				scenario: "separate items",
+				flags: ["-v", "--global-config", "/path/to/ignored"],
+			},
+		])(
+			"should filter --global-config ($scenario) in both auth modes",
+			({ flags }) => {
+				const urlAuth: CliAuth = {
+					mode: "url",
+					url: "https://dev.coder.com",
+				};
+				const config = new MockConfigurationProvider();
+				config.set("coder.globalFlags", flags);
+
+				expect(getGlobalFlags(config, globalConfigAuth)).toStrictEqual([
+					"-v",
+					"--global-config",
+					'"/config/dir"',
+				]);
+				expect(getGlobalFlags(config, urlAuth)).toStrictEqual([
+					"-v",
+					"--url",
+					'"https://dev.coder.com"',
+				]);
+			},
+		);
+
+		it("should not filter flags with similar prefixes", () => {
 			const config = new MockConfigurationProvider();
-			config.set("coder.globalFlags", [
-				"-v",
-				"--global-config /path/to/ignored",
-				"--disable-direct-connections",
-			]);
+			config.set("coder.globalFlags", ["--global-configs", "--use-keyrings"]);
 
 			expect(getGlobalFlags(config, globalConfigAuth)).toStrictEqual([
-				"-v",
-				"--global-config /path/to/ignored",
-				"--disable-direct-connections",
+				"--global-configs",
+				"--use-keyrings",
 				"--global-config",
 				'"/config/dir"',
 			]);