Add environment subsition for auth blocks

[danielcooper]

Summary

Allows auth to be defined like:

  extensions:
    - name: example
      enabled: true
      type: streamable_http
      uri: https://example.com/mcp
      env_keys:
        - EXAMPLE_COM_SERVICE_TOKEN
      headers:
        Authorization: Bearer ${ EXAMPLE_COM_SERVICE_TOKEN }

Which is very useful if you’re sharing recipes with a team. We were previously relying on: #5282 and not defining extentions in recipes we shared.

Note: this is somewhat vibey, I don't know rust.

Type of Change

• Feature
• Bug fix
• Refactor / Code quality
• Performance improvement
• Documentation
• Tests
• Security fix
• Build / Release
• Other (specify below)

Testing

Unit test, tested manually with our workflow.

Related Issues

Relates to #ISSUE_ID
Discussion: LINK (if any)

Screenshots/Demos (for UX changes)

Before:

After:

Email:

[alexhancock]

@danielcooper Can you run a quick cargo fmt then push up again?

[Copilot]

Pull Request Overview

This PR adds environment variable substitution support for HTTP headers in StreamableHttp extension configurations. Header values can now reference environment variables using ${VAR} or $VAR syntax, with the variables being resolved from both direct envs config and keychain-stored env_keys.

• Implements a substitute_env_vars helper function supporting ${VAR} and $VAR syntax with optional whitespace
• Merges environment variables from multiple sources before substitution
• Adds comprehensive test coverage for the substitution functionality

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Compiling regex patterns on every function call is inefficient. The regex patterns are constant and should be compiled once using lazy_static! or OnceLock (already used elsewhere in this codebase) and stored as static variables to avoid recompilation overhead.

[Copilot]

Compiling regex patterns on every function call is inefficient. The regex patterns are constant and should be compiled once using lazy_static! or OnceLock (already used elsewhere in this codebase) and stored as static variables to avoid recompilation overhead.

[Copilot]

Unnecessary clone of result string. Since captures_iter only needs a reference and doesn't consume the string, you can pass &result directly without cloning.

Suggested change

	for cap in re_simple.captures_iter(&result.clone()) {
	for cap in re_simple.captures_iter(&result) {

[Copilot]

Using replace will substitute all occurrences of the matched pattern in the entire string, not just the current match. If the same variable appears multiple times (e.g., ${TOKEN} and ${TOKEN}), the second iteration will fail to find the pattern since it was already replaced. Use replacen with a count of 1 or track positions to replace only the specific occurrence.

Suggested change

	let mut result = value.to_string();
	// First handle ${VAR} syntax (with optional whitespace)
	let re_braces = regex::Regex::new(r"\$\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}")
	.expect("valid regex");
	for cap in re_braces.captures_iter(value) {
	if let Some(var_name) = cap.get(1) {
	if let Some(env_value) = env_map.get(var_name.as_str()) {
	result = result.replace(&cap[0], env_value);
	}
	}
	}
	// Then handle $VAR syntax (simple variable without braces)
	let re_simple =
	regex::Regex::new(r"\$([A-Za-z_][A-Za-z0-9_]*)").expect("valid regex");
	for cap in re_simple.captures_iter(&result.clone()) {
	if let Some(var_name) = cap.get(1) {
	// Only substitute if it wasn't already part of ${VAR} syntax
	if !value.contains(&format!("${{{}}}", var_name.as_str())) {
	if let Some(env_value) = env_map.get(var_name.as_str()) {
	result = result.replace(&cap[0], env_value);
	}
	}
	}
	}
	result
	// First handle ${VAR} syntax (with optional whitespace)
	let re_braces = regex::Regex::new(r"\$\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}")
	.expect("valid regex");
	let result = re_braces.replace_all(value, |caps: &regex::Captures| {
	let var_name = &caps[1];
	env_map.get(var_name).map(|v| v.as_str()).unwrap_or(caps.get(0).unwrap().as_str())
	});
	// Then handle $VAR syntax (simple variable without braces)
	let re_simple = regex::Regex::new(r"\$([A-Za-z_][A-Za-z0-9_]*)").expect("valid regex");
	// Only substitute $VAR if it wasn't already part of ${VAR} syntax in the original value
	let result = re_simple.replace_all(&result, |caps: &regex::Captures| {
	let var_name = &caps[1];
	// Only substitute if not present as ${VAR} in the original value
	if !value.contains(&format!("${{{}}}", var_name)) {
	env_map.get(var_name).map(|v| v.as_str()).unwrap_or(caps.get(0).unwrap().as_str())
	} else {
	caps.get(0).unwrap().as_str()
	}
	});
	result.into_owned()

[Copilot]

Using replace will substitute all occurrences of the matched pattern in the entire string, not just the current match. If the same variable appears multiple times (e.g., $TOKEN and $TOKEN), the second iteration will fail to find the pattern since it was already replaced. Use replacen with a count of 1 or track positions to replace only the specific occurrence.

Suggested change

	result = result.replace(&cap[0], env_value);
	result = result.replacen(&cap[0], env_value, 1);

[Copilot]

Compiling regex patterns on every test invocation is inefficient. The regex patterns are constant and should be compiled once using lazy_static! or OnceLock and stored as static variables to avoid recompilation overhead.

[Copilot]

Unnecessary clone of result string. Since captures_iter only needs a reference and doesn't consume the string, you can pass &result directly without cloning.

Suggested change

	for cap in re_simple.captures_iter(&result.clone()) {
	for cap in re_simple.captures_iter(&result) {

[Copilot]

Using replace will substitute all occurrences of the matched pattern in the entire string, not just the current match. If the same variable appears multiple times (e.g., ${TOKEN} and ${TOKEN}), the second iteration will fail to find the pattern since it was already replaced. Use replacen with a count of 1 or track positions to replace only the specific occurrence.

Suggested change

	result = result.replace(&cap[0], env_value);
	result = result.replacen(&cap[0], env_value, 1);

[Copilot]

Using replace will substitute all occurrences of the matched pattern in the entire string, not just the current match. If the same variable appears multiple times (e.g., $TOKEN and $TOKEN), the second iteration will fail to find the pattern since it was already replaced. Use replacen with a count of 1 or track positions to replace only the specific occurrence.

[Copilot]

The substitute_env_vars function is duplicated between the production code (line 362) and the test code (line 1569). Consider extracting this function to module-level scope or creating a shared helper module to eliminate code duplication and ensure consistent behavior.