From a61e9c5f253bb622b096977f0cf21a9c7b9fda00 Mon Sep 17 00:00:00 2001
From: Victor Fan <vsfan@google.com>
Date: Thu, 23 Jul 2026 17:10:58 -0700
Subject: [PATCH] prompt for which functions to update during
 functions:secrets:set

---
 src/commands/functions-secrets-set.ts | 32 +++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/src/commands/functions-secrets-set.ts b/src/commands/functions-secrets-set.ts
index cd586d2724c..48e63249efc 100644
--- a/src/commands/functions-secrets-set.ts
+++ b/src/commands/functions-secrets-set.ts
@@ -4,10 +4,11 @@ import * as tty from "tty";
 import { logger } from "../logger";
 import { FirebaseError } from "../error";
 import { ensureValidKey, ensureSecret, validateJsonSecret } from "../functions/secrets";
+import { isFirebaseManaged } from "../deploymentTool";
 import { Command } from "../command";
 import { requirePermissions } from "../requirePermissions";
 import { Options } from "../options";
-import { confirm } from "../prompt";
+import { confirm, checkbox, Choice } from "../prompt";
 import { logBullet, logSuccess, logWarning, readSecretValue } from "../utils";
 import { needProjectId, needProjectNumber } from "../projectUtils";
 import {
@@ -92,8 +93,9 @@ export const command = new Command("functions:secrets:set <KEY>")
     }
 
     let haveBackend = await backend.existingBackend({ projectId } as args.Context);
-    const endpointsToUpdate = backend
+    let endpointsToUpdate = backend
       .allEndpoints(haveBackend)
+      .filter((e) => isFirebaseManaged(e.labels ?? []))
       .filter((e) => secrets.inUse({ projectId, projectNumber }, secret, e));
 
     if (endpointsToUpdate.length === 0) {
@@ -120,6 +122,32 @@ export const command = new Command("functions:secrets:set <KEY>")
       return;
     }
 
+    if (endpointsToUpdate.length > 1) {
+      const choices = endpointsToUpdate.map((e): Choice<string> => {
+        const currentVersion = secrets.getSecretVersions(e)[secret.name];
+        return {
+          name: `${e.id}(${e.region}) - current secret version: ${currentVersion ?? "unknown"}`,
+          value: e.id,
+          checked: true,
+        };
+      });
+      const selectedEndpointIds = await checkbox<string>({
+        message:
+          "Which functions do you want to re-deploy?" +
+          "Press Space to select functions, then Enter to confirm your choices.",
+        choices: choices,
+      });
+      endpointsToUpdate = endpointsToUpdate.filter((e) => selectedEndpointIds.includes(e.id));
+    }
+    if (endpointsToUpdate.length === 0) {
+      logBullet(`No functions confirmed for automatic re-deployment.`);
+      logBullet(
+        "Please deploy your functions for the change to take effect by running:\n\t" +
+          clc.bold("firebase deploy --only functions"),
+      );
+      return;
+    }
+
     const updateOps = endpointsToUpdate.map(async (e) => {
       logBullet(`Updating function ${e.id}(${e.region})...`);
       const updated = await secrets.updateEndpointSecret(