fix: update stale comments and add missing 6th test case

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/46aa116c-47a9-4f66-8e20-13cb6f683aab

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Author: Copilot

containers/api-proxy/server.js

@@ -1070,7 +1070,7 @@ if (require.main === module) {
       const contentLength = parseInt(req.headers['content-length'], 10) || 0;
       if (checkRateLimit(req, res, 'gemini', contentLength)) return;
 
-      // Strip any ?key= query parameter — the @google/genai SDK may append it to the URL.
+      // Strip any auth query params (?key=, ?apiKey=, ?api_key=) — the SDK may append them.
       // The proxy injects the real key via x-goog-api-key header instead.
       req.url = stripGeminiKeyParam(req.url);
 
@@ -1080,7 +1080,7 @@ if (require.main === module) {
     });
 
     geminiServer.on('upgrade', (req, socket, head) => {
-      // Strip any ?key= query parameter — the @google/genai SDK may append it to the URL.
+      // Strip any auth query params (?key=, ?apiKey=, ?api_key=) — the SDK may append them.
       req.url = stripGeminiKeyParam(req.url);
       proxyWebSocket(req, socket, head, GEMINI_API_TARGET, {
         'x-goog-api-key': GEMINI_API_KEY,

containers/api-proxy/server.test.js

@@ -564,6 +564,11 @@ describe('stripGeminiKeyParam', () => {
     expect(stripGeminiKeyParam('/v1/models/gemini-pro:generateContent?key=foo&apiKey=bar&api_key=baz&alt=json'))
       .toBe('/v1/models/gemini-pro:generateContent?alt=json');
   });
+
+  it('should handle path with only api_key= param, leaving no trailing ?', () => {
+    const result = stripGeminiKeyParam('/v1/generateContent?api_key=abc');
+    expect(result).toBe('/v1/generateContent');
+  });
 });
 
 // ── Helpers for proxyWebSocket tests ──────────────────────────────────────────