Implement hierarchical .env resolution and sanitize production output - #48
Open
JuanKRuiz wants to merge 3 commits into
Open
Implement hierarchical .env resolution and sanitize production output#48JuanKRuiz wants to merge 3 commits into
JuanKRuiz wants to merge 3 commits into
Conversation
…emini-cli-extensions#18)" -m " - Implement multi-level .env resolution (from project root up to ~/.gemini/.env) to mitigate MCP sandbox isolation. - Remove hardcoded mcp-debug.log and diagnostic console logging from imageGenerator.ts to sanitize production output. - Update README.md with comprehensive .env configuration instructions and recommendations. Fixes gemini-cli-extensions#18"
… telemetry, and diagnostic logs from image generation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This Pull Request introduces a significant architectural improvement to handle environment variables securely, addressing the inherent limitations of the MCP sandbox environment within Gemini CLI, alongside a thorough cleanup of legacy telemetry.
🐛 Problem Context
Currently, the Gemini CLI orchestrator isolates MCP server child processes, preventing them from inheriting global OS environment variables (like
GEMINI_API_KEYdefined viaexportor system settings). The previous attempt to bypass this isolation forced users to hardcode sensitive API keys directly inside thegemini-extension.jsonmanifest. This severely violates Zero Trust principles and exposes developers to high risks of credential leaks via accidental version control commits (e.g., dotfiles sync).🚀 Features & Fixes
dotenv. The server now intelligently searches for .env files locally (./.env), within the Gemini CLI concealed config folder (~/.gemini/.env), and finally at the OS user root (~/.env), safely injecting keys into theprocess.envV8 memory block without compromising the sandbox.D:\Gemini\nanobanana\mcp-debug.log) and aggressiveconsole.errorlogs scattered throughout imageGenerator.ts. This cleans up standard IO output streams, preventing unnecessary disk I/O and standardizing cross-platform deployment.tmp/while isolating noisy dependencies likenode_modules.🔗 Related Issues
🧪 Testing Done
~/.gemini/.envand local project paths on Windows.mcp-debug.logfile creation upon image generation requests.npm run build).🛠️ Checklist
npm run format,npm run lint)CHANGELOG.md