Skip to content

fix: Gemini CLI exits 41 in AWF sandbox — missing API key and ~/.gemini dir#23695

Draft
Copilot wants to merge 6 commits intomainfrom
copilot/fix-gemini-cli-api-keys-issue
Draft

fix: Gemini CLI exits 41 in AWF sandbox — missing API key and ~/.gemini dir#23695
Copilot wants to merge 6 commits intomainfrom
copilot/fix-gemini-cli-api-keys-issue

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 31, 2026

Gemini CLI v0.65.0+ added a startup auth check that exits with code 41 when GEMINI_API_BASE_URL is set but no GEMINI_API_KEY is found. In AWF mode, the real key is intentionally excluded from the container (--exclude-env GEMINI_API_KEY) — held by the api-proxy sidecar — so the CLI always failed before making any API calls. Additionally, ~/.gemini/ doesn't exist in the container filesystem, causing an ENOENT when Gemini CLI attempts to save its project registry.

Changes

  • gemini_engine.go — When firewallEnabled, prepend to the container command:

    mkdir -p "$HOME/.gemini" && export GEMINI_API_KEY="${GEMINI_API_KEY:-gemini-api-key-placeholder}"

    The ${:-} idiom falls back to the placeholder only when the real key is absent (AWF-excluded case), preserving any non-secret engine.env override. When not firewalled, prepend just the mkdir to guard against ENOENT on fresh runners.

  • Constant — Placeholder value extracted as geminiAPIKeyPlaceholder for maintainability.

  • gemini_engine_test.go — Extended TestGeminiEngineFirewallIntegration to assert mkdir -p "$HOME/.gemini" and the placeholder GEMINI_API_KEY are present when firewalled, and absent when not.

  • smoke-gemini.lock.yml — Recompiled to reflect the updated container command.

The security model is unchanged: --exclude-env GEMINI_API_KEY still prevents the real key from reaching the container; the api-proxy sidecar continues to handle actual LLM authentication.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw gFzAtgpEi 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linu1 /usr/bin/git g_.a GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw --ignore-path ../../../.pretti"prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw --ignore-path ../../../.pretti"prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build345303099/b234/importcfg -embedcfg /tmp/go-build345303099/b234/embedcfg -o /tmp/go-build427-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel x_amd64/compile /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json /color.go x_amd64/compile node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/archie.md x_amd64/compile /usr/bin/gh -json GO111MODULE 64/bin/go gh (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha ithub/workflows/archie.md -trimpath ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -p b/gh-aw/pkg/stylrev-parse -lang=go1.25 ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 1315195813 0/feature/plural/common.go 64/pkg/tool/linux_amd64/compile GOINSECURE 5519 bis 64/pkg/tool/linu--json env _.a wAClDFTbl util.test GOINSECURE til GOMODCACHE util.test (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha xterm-color x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git md GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git 4329-31132/test-git GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/asm n-dir/node 0-0n/jrpYP2NCpeGgit GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/go-build3945962421/b454/timeutil.test -importcfg /usr/bin/git -s -w -buildmode=exe git add .github/workflows/test.md -extld=gcc /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha GOMODCACHE go r,url,status,conclusion,workflowName,createdAt,startedAt,updated-test.short=true -json flow-12345 x_amd64/asm git rev-�� --show-toplevel x_amd64/asm /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE x_amd64/compile node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git 303099/b105/_pkggit g/console/accessrev-parse .cfg git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git ithub/workflows r9DB/JyLwAedChb8rev-parse ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -goversion go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build345303099/b198/importcfg -pack list�� -mod=readonly -e 64/bin/go -d x_amd64/vet 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha ./cmd/... ./pkg/... 64/bin/go -d x_amd64/vet 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --format go 64/bin/go -d 31dd6e7952395134-o 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha y -test.v=true /usr/bin/git -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git -C /tmp/gh-aw-test-runs/20260331-124329-31132/test-3707650099 rev-parse /usr/bin/git @{u} GO111MODULE x_amd64/compile git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha k/gh-aw/gh-aw/.github/workflows/blog-auditor.md go /usr/bin/git -json GO111MODULE x_amd64/asm git rev-�� --show-toplevel x_amd64/asm /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha 94162860be9ffcaeGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 9937335/b422/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE r: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility che/go-build/16/16cd4a5c5f3f40b6GOINSECURE GOPROXY r: $owner, name: $name) { hasDiscussionsEnabled } } GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-f -o /tmp/go-build244-f -trimpath 64/bin/go -p github.com/githu-C -lang=go1.25 go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha ck '**/*.cjs' '*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 9937335/b373/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/cli GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha /tmp/TestHashConsistency_GoAndJavaScript1877847586/001/test-inlined-imports-enabled-with-body-cogit go /usr/lib/git-core/git with-tools.md GO111MODULE 64/bin/go /usr/lib/git-core/git main�� nt/action/git/ref/tags/v999.999.999 --auto /usr/bin/git --detach GO111MODULE x_amd64/compile git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha p1X-/zueTnY1SGpUYknNOp1X- -trimpath /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -p crypto/internal/rev-parse -lang=go1.25 5962421/b406/importcfg -o 5962421/b406/embedcfg -trimpath ache/node/24.14.0/x64/bin/node -p hash/crc32 -lang=go1.25 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha 4329-31132/test-3707650099 -trimpath /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -I /tmp/go-build345rev-parse -I 5962421/b395/importcfg -o k/gh-aw/gh-aw/pkg/cli/access_log.go k/gh-aw/gh-aw/pkg/cli/actionlint.go 5962421/b448/styles.test -p net/netip -lang=go1.25 5962421/b448/styles.test (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a @v1.19.2/ast/ast.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE __/1wrbVKtAyYMA6rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE OT/XsnwPQlVgjjkPano75dw/KS7vWdv67GlQHo_qCXr1 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a @v1.19.2/scanner/context.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE dules/flatted/go/tmp/js-hash-test-576697548/test-hash.js GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a @v1.19.2/printer/color.go 64/pkg/tool/linux_amd64/compile on; \ echo "���node GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linu-importcfg GOINSECURE GOMOD GOMODCACHE 0XVD7GS/mRL0tEU7JbrieQ94-F8q env 1084279833/.github/workflows @v1.19.2/internal/errors/error.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build345303099/b138/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/[email protected]/deviceauth.go -o /tmp/go-build427-p -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel s/js_js.s /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git edOutput29941378git GO111MODULE x_amd64/compile git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha ty-test.md GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env rity2272825198/001 @v1.1.3/ascii/ascii.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE XYdJyvRLH1xm env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD wasm.s go env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env sm-opt -Oz (size-p GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha -json GO111MODULE $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha -json GO111MODULE $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 8A/RFr094xa-M6ehmK-ZS-f/-nXLG8d-CyxHzcGHNa9W env _.a [email protected]/ascii/equal_fold.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/asm env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-trimpath -o /tmp/go-build427-p -trimpath 64/bin/go -p github.com/githu-c -lang=go1.25 TER=$(wc -c < g (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-trimpath -o /tmp/go-build427-p -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3945962421/b404/cli.test /tmp/go-build3945962421/b404/cli.test -test.testlogfile=/tmp/go-build3945962421/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build345303099/b200/importcfg -pack -c "prettier" --che-p node 64/bin/go tierignore --write 64/bin/go go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build345303099/b247/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/[email protected]/internal/format/format.go -o /tmp/go-build427-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI changed the title [WIP] Fix Gemini CLI startup failure due to missing API keys fix: Gemini CLI exits 41 in AWF sandbox — missing API key and ~/.gemini dir Mar 31, 2026
Copilot AI requested a review from pelikhan March 31, 2026 12:58
@pelikhan pelikhan added the awf label Mar 31, 2026
@pelikhan pelikhan assigned lpcox and unassigned pelikhan and Copilot Mar 31, 2026
@pelikhan
Copy link
Copy Markdown
Collaborator

@lpcox review plz

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@pelikhan
Copy link
Copy Markdown
Collaborator

pelikhan commented Apr 2, 2026

@copilot review comments

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 2, 2026

@copilot review comments

No actionable review comments to address — all CI checks pass and both automated contribution checks report lgtm. The PR is ready for maintainer review.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

Hey @Copilot 👋 — great work tracking down and fixing this Gemini CLI v0.65.0+ compatibility break in the AWF sandbox! The root cause analysis is spot-on, and the fix is clean and surgical.

The PR looks well-structured and ready for maintainer review. A few highlights worth calling out:

  • The \$\{GEMINI_API_KEY:-gemini-api-key-placeholder} idiom correctly falls back to the placeholder only when the real key is absent, preserving any non-secret engine.env override — that's the right approach.
  • The mkdir -p "$HOME/.gemini" guard is applied in both the firewalled and non-firewalled paths, which is thorough.
  • The updated TestGeminiEngineFirewallIntegration assertions cover both the firewalled case (placeholder key present, .gemini dir created) and the non-firewalled case (no placeholder, .gemini dir still created), which gives good confidence in the correctness of the fix.
  • The extracted geminiAPIKeyPlaceholder constant improves maintainability and is referenced consistently across the code and test.

The PR is focused, includes tests, has a clear description, introduces no new dependencies, and aligns directly with the project's Gemini engine work. This looks ready to merge. 🚀

Generated by Contribution Check ·

@pelikhan pelikhan added the water label Apr 2, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

🧪 Smoke Project is now testing project operations...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

📰 BREAKING: Smoke Copilot ARM64 is now investigating this pull request. Sources say the story is developing...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

⚠️ Smoke Gemini failed. Gemini encountered unexpected challenges...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

🧪 Smoke Temporary ID is now testing temporary ID functionality...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

Checkout Validation Results ✅ PASS

Task: "${{ inputs.task-description }}"

Check Result
Branch copilot/fix-gemini-cli-api-keys-issue
Workspace Clean (nothing to commit, working tree clean)
Remote origin → https://github.com/github/gh-aw.git
Git log Commit history available (3 commits visible)

Details

  • git status — workspace is clean, branch is up to date with origin/copilot/fix-gemini-cli-api-keys-issue
  • git branch --show-current — branch copilot/fix-gemini-cli-api-keys-issue is checked out
  • git remote -v — remote origin points to https://github.com/github/gh-aw.git
  • git log --oneline -3 — commit history is accessible

Overall: ✅ PASS — checkout is properly initialized and functional in the workflow_call context.

🔁 workflow_call smoke test by Smoke Workflow Call ·

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

Smoke Temporary ID completed successfully. Temporary ID validation passed.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

Smoke Project completed successfully. All project operations validated.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

ARM64 Smoke Test · §23896090657

Overall: PASS (1 infrastructure issue with Playwright log dir)

@pelikhan (author) @lpcox (assignee)

📰 BREAKING: Report filed by Smoke Copilot ARM64 ·

Copy link
Copy Markdown
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the Gemini CLI v0.65.0+ auth fix. The changes correctly handle two issues: (1) setting a placeholder GEMINI_API_KEY inside the AWF container to satisfy the startup auth check while the real key is held by the api-proxy sidecar, and (2) creating ~/.gemini/ to prevent ENOENT on project registry save. Both fixes are applied consistently for firewall-enabled and disabled modes. Logic is sound.

📰 BREAKING: Report filed by Smoke Copilot ARM64

// However, Gemini CLI v0.65.0+ performs a startup auth check and exits with code 41
// if no auth method is configured when GEMINI_API_BASE_URL (the api-proxy) is set.
// To satisfy this check, set a placeholder value for GEMINI_API_KEY inside the
// container — the real key is held by AWF's api-proxy sidecar which intercepts all
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The awfContainerSetup approach is clean — using \$\{GEMINI_API_KEY:-gemini-api-key-placeholder} ensures the placeholder only applies when the real key isn't already set, which is exactly the right behavior for the AWF sidecar pattern.

@@ -266,8 +284,11 @@ func (e *GeminiEngine) GetExecutionSteps(workflowData *WorkflowData, logFile str
ExcludeEnvVarNames: ComputeAWFExcludeEnvVarNames(workflowData, []string{"GEMINI_API_KEY"}),
})
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to add mkdir -p "$HOME/.gemini" in the non-firewall path too — consistent behavior regardless of execution mode.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

📰 VERDICT: Smoke Copilot ARM64 has concluded. All systems operational. This is a developing story. 🎤

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Gemini CLI Failed: API proxy enabled but no API keys found in environment

3 participants