fix: fix Gemini runner — Vertex auth, system prompt, custom commands, feedback MCP

[Gkrumbach07]

Summary

• Vertex AI auth fixed: map platform env vars (ANTHROPIC_VERTEX_PROJECT_ID → GOOGLE_CLOUD_PROJECT, CLOUD_ML_REGION → GOOGLE_CLOUD_LOCATION) in Gemini CLI subprocess env; validate credentials file exists at startup with a clear error
• System prompt: write .gemini/system.md using ${SubAgents}/${AgentSkills}/${AvailableTools} variable substitutions to preserve Gemini's default instructions, then append platform context (workspace paths, repos, git, workflow, rubric/correction command hints)
• Custom commands: /ambient:evaluate-rubric and /ambient:log-correction written to .gemini/commands/ambient/ at session setup
• Feedback MCP server: minimal stdlib stdio MCP server (feedback_server.py) exposing evaluate_rubric and log_correction tools backed by existing Langfuse logging; registered in .gemini/settings.json with Langfuse credentials injected via env block (bypasses the Gemini CLI subprocess env blocklist)
• add_dirs bug fixed: resolve_workspace_paths return value was silently dropped; now seeded into include_directories

Platform refactoring

Moved shared code out of individual bridges into the base layer:

• platform/auth.py: validate_vertex_credentials_file() — shared Vertex credential validation used by both Claude and Gemini auth modules
• bridge.py (base class): set_context(), _ensure_ready(), _setup_platform(), _refresh_credentials_if_stale() — identical in both bridges, now inherited; bridges only contain framework-specific code
• bridge.py: _async_safe_manager_shutdown() — the async-safe fire-and-forget manager shutdown pattern shared by both mark_dirty() implementations

Test plan

• Create a Gemini session with Vertex AI enabled — should connect and respond
• Verify /ambient:evaluate-rubric and /ambient:log-correction commands appear in Gemini CLI
• Run /ambient:log-correction — should log to Langfuse without "credentials missing" error
• Verify Claude sessions still work (no regression from base class refactor)

🤖 Generated with Claude Code

[github-actions]

Claude Code Review

Summary

PR #803 fixes Gemini CLI Vertex auth, adds system prompt support, custom slash commands, and a feedback MCP server. It also includes a solid refactor moving shared bridge code (credential refresh, lazy setup, async shutdown helper) into the `PlatformBridge` base class. The changes are well-structured and the logic is correct. Two issues stand out: an inverted dependency in the new platform layer and Langfuse credentials written to a file accessible to the agent.

Issues by Severity

Blocker Issues

None.

Critical Issues

None.

Major Issues

1. Inverted dependency: `platform/feedback.py` imports private symbols from a bridge-specific module

• File: `components/runners/ambient-runner/ambient_runner/platform/feedback.py:747-755`
• What: The platform layer (`platform/`) imports private implementation functions from `bridges/claude/`:
  ```python
  from ambient_runner.bridges.claude.corrections import (
  _get_session_context, # private
  _log_correction_to_langfuse, # private
  ...
  )
  from ambient_runner.bridges.claude.tools import _log_to_langfuse # private
  ```
• Which standard: Architecture violation — the platform layer should not depend on bridge-specific modules. `platform/` is the shared base that bridges build on top of; the dependency arrow should never point the other way.
• Impact: Any non-Claude bridge that uses `platform/feedback.py` silently pulls in Claude-specific code. Adding a third bridge without Claude installed would break feedback logging entirely.
• Fix: Move `_get_session_context`, `_log_correction_to_langfuse`, `_log_to_langfuse`, `CORRECTION_SOURCES`, and `CORRECTION_TYPES` into `platform/` (e.g. `platform/corrections.py`). Have the Claude bridge import from there instead of the reverse.

---

2. `LANGFUSE_SECRET_KEY` written in plaintext to workspace-accessible `.gemini/settings.json`

• File: `components/runners/ambient-runner/ambient_runner/bridges/gemini_cli/mcp.py:364-396`
• What: `_build_feedback_server_entry()` injects `LANGFUSE_PUBLIC_KEY` and `LANGFUSE_SECRET_KEY` into the MCP server `env` block, which lands in `{cwd_path}/.gemini/settings.json`. The Gemini CLI agent has file-reading tools and can access the entire workspace including this file.
• Which standard: Security standards — minimal credential exposure; the Gemini CLI's own subprocess env blocklist exists specifically to prevent the agent from seeing `LANGFUSE_*` keys. This workaround circumvents that intent by writing them to a file the agent can read.
• Impact: An adversarial or prompt-injected interaction could read `.gemini/settings.json` and exfiltrate `LANGFUSE_SECRET_KEY`.
• Fix (short-term): After `write_gemini_settings` returns, set `chmod 0o600` on the settings file:
  ```python
  settings_path = write_gemini_settings(cwd_path, settings)
  try:
  Path(settings_path).chmod(0o600)
  except OSError:
  pass
  ```
  Fix (long-term): Move the credentials file outside the agent-accessible workspace (e.g. `/run/secrets/ambient-feedback/`) and have the feedback server read from there, or inject only `LANGFUSE_ENABLED` into the settings env block and pass secrets via a separate mechanism.

Minor Issues

3. Return type annotation mismatch on `setup_gemini_mcp`

• File: `components/runners/ambient-runner/ambient_runner/bridges/gemini_cli/mcp.py` (function signature)
• What: The function now always registers `ambient-feedback` and calls `write_gemini_settings`, so it always returns a non-`None` path. The annotation `-> Optional[str]` is misleading.
• Fix: Change to `-> str`.

---

4. Deferred import inconsistency in `_build_system_prompt`

• File: `components/runners/ambient-runner/ambient_runner/bridges/gemini_cli/system_prompt.py:688`
• What: `from ambient_runner.observability import is_langfuse_enabled` is a lazy import at the bottom of the function while all other platform imports in the same function are grouped at the top.
• Fix: Hoist it to the function-level import block alongside the other lazy imports.

---

5. `deploy-with-dispatch` always pins both images to `github.sha`

• File: `.github/workflows/components-build-deploy.yml` (new ConfigMap step in `deploy-with-dispatch`)
• What: Unlike the conditional step earlier in the workflow (which guards each sed substitution with `detect-changes` output checks), the new ConfigMap patch in `deploy-with-dispatch` always replaces both `vteam_claude_runner` and `vteam_state_sync` with the current SHA — even if only one was actually rebuilt. This mirrors the pre-existing `oc set env` pattern above it.
• Fix: Either guard each sed substitution with the same `detect-changes` conditionals, or add a comment documenting why unconditional patching is acceptable for the dispatch flow.

Positive Highlights

• Excellent base-class refactor: Consolidating `set_context`, `_ensure_ready`, `_setup_platform`, `_refresh_credentials_if_stale`, and shared state into `PlatformBridge.init` eliminates ~80 lines of duplicated code across two bridges and gives any future bridge a correct lifecycle for free.

• `_async_safe_manager_shutdown` consolidation: Single, well-documented implementation replacing identical copy-paste in both `mark_dirty()` methods. Using `create_task` + done-callback is the correct pattern for the within-loop case.

• `validate_vertex_credentials_file` consolidation: Consistent, early credential validation with the same error messages shared between Claude and Gemini auth modules — good for operators debugging misconfigured credentials.

• Env-var fallback in `session.py` is safe: The `if not env.get("GOOGLE_CLOUD_PROJECT")` guard correctly respects explicitly-set values and only fills in the alias when the var is absent.

• CI concurrency guard on prod deployment: `cancel-in-progress: false` in `prod-release-deploy.yaml` is the right setting — prod deployments must never be cancelled mid-flight.

• MCP server correctly routes logs to `stderr`: `logging.basicConfig(stream=sys.stderr)` in `feedback_server.py` is easy to get wrong and correctly done here since `stdout` is the JSON-RPC channel.

Recommendations

1. (Major — before merge) Refactor `platform/feedback.py` to eliminate the reverse-dependency on `bridges/claude/`. Move shared correction/logging internals to `platform/corrections.py` and have the Claude bridge import from there.

2. (Major — before merge or tracked as follow-up) Address the Langfuse credentials in `.gemini/settings.json`. At minimum, `chmod 0o600` the file immediately after writing it.

3. (Minor) Fix the `Optional[str]` return type on `setup_gemini_mcp`.

4. (Minor) Hoist the `is_langfuse_enabled` import to the function-level import block in `_build_system_prompt`.

5. (Minor) Document or conditionally guard the unconditional image pinning in the `deploy-with-dispatch` ConfigMap step.

---

🔍 View AI decision process (logs available for 90 days)

📋 View memory system files loaded (click to expand)

What Amber Loaded for Code Review

Amber automatically loaded these repository standards from the memory system:

1. CLAUDE.md - Master project instructions, development standards
2. backend-development.md - Go backend, K8s integration patterns
3. frontend-development.md - NextJS, Shadcn UI, React Query patterns
4. security-standards.md - Auth, RBAC, token handling
5. k8s-client-usage.md - User token vs service account patterns
6. error-handling.md - Consistent error patterns
7. react-query-usage.md - Data fetching patterns

Impact: This review used your repository's specific code quality standards, security patterns, and best practices from the memory system (PRs #359, #360) - not just generic code review guidelines.