fix: pass as_needed secret keys to broker for env-gather autodetect (#1447) - #1483
Conversation
…edKeys (#1447) When a harness has default_type: oauth-token (e.g. antigravity) and GEMINI_API_KEY is stored as an as_needed hub secret, autodetect could not see the key — it was filtered from ResolvedSecrets before the broker ran, so autodetect fell back to oauth-token (no env requirements), the hub's pass-2 was never asked for the key, and the agent started without credentials. Fix: add AvailableAsNeededKeys to the create-agent request. The hub populates it with the target key names of as_needed env-type secrets that were filtered out of ResolvedSecrets. The broker's autodetect includes these keys when probing for env-var-based auth types, closing the chicken-and-egg gap. Changes: - Add AvailableAsNeededKeys field to CreateAgentRequest (broker) and RemoteCreateAgentRequest (hub) - Extend resolveSecrets() to return filtered as_needed key names as a second return value - Populate req.AvailableAsNeededKeys in buildCreateRequest - Include AvailableAsNeededKeys in broker's resolvedEnvKeys for env-var autodetect - Add regression tests for both the fix and the pre-fix fallback
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request addresses an issue where deferred as_needed environment-type secrets were not considered by the broker's autodetect mechanism when selecting the authentication type. It introduces AvailableAsNeededKeys to pass these filtered secret keys from the Hub to the Runtime Broker, allowing correct auth type selection. The review feedback correctly points out two violations of the repository style guide in the new tests, where the legacy term grovePath was used instead of projectPath.
| "name": "test-agent-asneeded-autodetect", | ||
| "id": "agent-uuid-asneeded", | ||
| "gatherEnv": true, | ||
| "grovePath": "` + projectDir + `", |
There was a problem hiding this comment.
According to the repository style guide (line 6 and 99), the concept previously called "grove" has been renamed to "project" throughout the product. New code and tests should actively prefer project naming over legacy grove literals. Please use projectPath instead of grovePath in this test payload.
| "grovePath": "` + projectDir + `", | |
| "projectPath": "` + projectDir + `", |
References
- The konsep previously called 'grove' has been renamed to 'project' throughout the product. New code should prefer 'project' where feasible. (link)
| "name": "test-agent-no-asneeded", | ||
| "id": "agent-uuid-no-asneeded", | ||
| "gatherEnv": true, | ||
| "grovePath": "` + projectDir + `", |
There was a problem hiding this comment.
According to the repository style guide (line 6 and 99), the concept previously called "grove" has been renamed to "project" throughout the product. New code and tests should actively prefer project naming over legacy grove literals. Please use projectPath instead of grovePath in this test payload.
| "grovePath": "` + projectDir + `", | |
| "projectPath": "` + projectDir + `", |
References
- The konsep previously called 'grove' has been renamed to 'project' throughout the product. New code should prefer 'project' where feasible. (link)
Address Gemini review feedback on PR GoogleCloudPlatform#1483: our new test functions should use the canonical `projectPath` JSON key, not the legacy `grovePath`.
* docs: add npm registry/proxy section to custom-images guide Document the NPM_REGISTRY build arg and NPM_CONFIG_FILE BuildKit secret introduced in #1476, which enable image builds behind corporate proxies where registry.npmjs.org is blocked. Changelog: 2026-09-06 Other changelog items reviewed — no further docs impact: - #1478, #1480, #1483, #1481, #1479: internal fixes - #1482: host SA auto-detection (docs had no manual step to remove) - #1475: Azure DevOps URL parsing fix (no interface change) - #1474: UI fix; #1473: demo script fix * docs: add weekly release notes for Aug 31 - Sep 6, 2026 --------- Co-authored-by: Scion Agent (du-0906) <agent@scion.dev>
1 participant
Summary
Fixes env-gather autodetect chicken-and-egg bug where as_needed hub-level secrets (e.g. GEMINI_API_KEY) are invisible to the broker autodetect when the harness default_type does not require them (e.g. antigravity with default_type=oauth-token). The broker never reports the key as needed, so the hub never resolves it, and the agent starts without credentials.
Adds AvailableAsNeededKeys field to CreateAgentRequest so the hub can tell the broker which as_needed env-type secret targets exist. The broker includes these in the autodetect key set, enabling correct auth type selection.
Test plan