fix: restrict config discovery to home directory only

README.md

@@ -24,18 +24,18 @@ elastic --help
 ## Configuration
 
 The CLI looks for a config file in your home directory. The following file names
-are recognised (checked in this order):
+are checked (in this order):
 
 1. `.elasticrc`
 2. `.elasticrc.json`
 3. `.elasticrc.yaml`
 4. `.elasticrc.yml`
 
-You can also point to a config file explicitly with `--config-file <path>` or
-the `ELASTIC_CLI_CONFIG_FILE` environment variable. Precedence:
-`--config-file` > `ELASTIC_CLI_CONFIG_FILE` > home directory discovery.
+Place your config at `~/.elasticrc.yml` (recommended).
 
-JavaScript and TypeScript config files are not supported for security reasons.
+To use a config file in a different location, pass `--config-file <path>` or set
+the `ELASTIC_CLI_CONFIG_FILE` environment variable. The flag takes precedence
+over the environment variable.
 
 ```yaml
 current_context: local
@@ -119,7 +119,7 @@ elasticsearch:
 
 | Option | Description |
 |---|---|
-| `--config-file <path>` | Path to a config file, bypassing automatic discovery |
+| `--config-file <path>` | Path to a config file (default: `~/.elasticrc.yml`) |
 | `--use-context <name>` | Override the active context from the config file |
 | `--json` | Output results as JSON |
 

package.json

@@ -41,7 +41,6 @@
     "@elastic/transport": "^9.3.5",
     "cli-table3": "^0.6.5",
     "commander": "^14.0.3",
-    "cosmiconfig": "^9.0.1",
     "yaml": "^2.8.3",
     "zod": "^4.3.6"
   },

src/cli.ts

@@ -18,7 +18,7 @@ const program = new Command()
 program
   .name('elastic')
   .description('Interface with Elasticsearch, Elastic Serverless and Elastic Cloud APIs from the command line.')
-  .option('--config-file <path>', 'path to a config file, bypassing cosmiconfig discovery')
+  .option('--config-file <path>', 'path to a config file (default: ~/.elasticrc.yml)')
   .option('--use-context <name>', 'override the active context from the config file')
   .option('--json', 'output as JSON')