fix: make ~/.gemini setup conditional on geminiApiKey#2282
Conversation
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Pull request overview
This PR makes Gemini-specific runtime behavior in AWF conditional on geminiApiKey, so non-Gemini runs (e.g., Copilot-only) don’t mount ~/.gemini, set Gemini proxy env vars, or emit Gemini-related entrypoint logs.
Changes:
- Gate
~/.geminibind mount,GEMINI_API_BASE_URL,GEMINI_API_KEYplaceholder, and newAWF_GEMINI_ENABLEDsignal onconfig.geminiApiKey. - Make
writeConfigs()only pre-create~/.geminiwhen Gemini is enabled. - Wrap the entrypoint’s
~/.geminiownership fix behindAWF_GEMINI_ENABLED, and update tests accordingly.
Show a summary per file
| File | Description |
|---|---|
| src/docker-manager.ts | Adds AWF_GEMINI_ENABLED and gates Gemini mounts/env configuration on geminiApiKey. |
| src/docker-manager.test.ts | Updates/extends tests to assert Gemini artifacts are absent without a Gemini key and present when configured. |
| containers/agent/entrypoint.sh | Runs ~/.gemini ownership fix only when AWF_GEMINI_ENABLED is set to avoid non-Gemini log noise. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
src/docker-manager.test.ts:3781
- Same restoration issue here: assigning
process.env.HOME = originalHomewhen originalHome is undefined sets HOME to the literal string "undefined". Restore by conditionally setting vs deleting HOME (and SUDO_USER) to avoid cross-test contamination.
process.env.HOME = originalHome;
if (originalSudoUser) {
process.env.SUDO_USER = originalSudoUser;
}
- Files reviewed: 3/3 changed files
- Comments generated: 2
|
|
||
| // Signal to entrypoint.sh that Gemini CLI is expected — only when geminiApiKey is configured. | ||
| // This guards the ~/.gemini ownership fix and avoids spurious Gemini-related log output in | ||
| // Copilot (or other non-Gemini) runs. |
| process.env.HOME = originalHome; | ||
| if (originalSudoUser) { | ||
| process.env.SUDO_USER = originalSudoUser; | ||
| } |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
@copilot address the review feedback |
Addressed both review items in f3e57ba:
|
|
Smoke Test Results Status: PASS
|
🤖 Smoke Test Results
PR: fix: make ~/.gemini setup conditional on geminiApiKey Overall: ✅ PASS
|
This comment has been minimized.
This comment has been minimized.
Chroot Version Comparison Results
Overall: ❌ Not all versions match — Python and Node.js differ between host and chroot environments.
|
|
fix: block Shocker container-escape syscalls in seccomp profile (CVE-2014-9357) Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
🔥 Smoke Test: Copilot BYOK — PASS
Running in BYOK offline mode ( Overall: PASS —
|
Gemini CLI artifacts (
~/.geminimount,GEMINI_API_KEYplaceholder,GEMINI_API_BASE_URL, ownership fix in entrypoint) were unconditionally applied to every AWF run, producing suspicious log entries like[entrypoint] Ensured ~/.gemini ownership for chroot userin Copilot-only runs that have no relationship to Gemini.Changes
generateDockerCompose()—~/.geminibind mount,GEMINI_API_BASE_URL, andGEMINI_API_KEYplaceholder are now gated onconfig.geminiApiKey. NewAWF_GEMINI_ENABLED=1env var signals Gemini is active.writeConfigs()—~/.geminihost directory pre-creation is conditional onconfig.geminiApiKey.entrypoint.sh—~/.geminiownership fix is now wrapped in[ -n "${AWF_GEMINI_ENABLED}" ], eliminating the log noise in non-Gemini runs.GEMINI_API_BASE_URL,GEMINI_API_KEY, and~/.geminimount are absent without a Gemini key; added coverage for theAWF_GEMINI_ENABLEDsignal and conditional~/.geminipre-creation.