[awf] API Proxy / Agent: Gemini CLI fails with ENOENT project registry and missing auth when api-proxy enabled

[lpcox]

Problem

The Gemini CLI fails with exit code 41 when invoked through the AWF api-proxy with two compounding failures:

1. ENOENT: no such file or directory, rename '.../projects.json.tmp' -> '.../projects.json' — Gemini CLI cannot write its project registry during initialization.
2. Please set an Auth method ... GEMINI_API_KEY, GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_GENAI_USE_GCA — No authentication is configured despite the API proxy being enabled.

Log evidence:

[WARN] API proxy enabled but no API keys found in environment
Failed to save project registry: Error: ENOENT: no such file or directory,
  rename '.../projects.json.tmp' -> '.../projects.json'
Please set an Auth method in your settings.json or specify one of the following
  environment variables before running: GEMINI_API_KEY, GOOGLE_GENAI_USE_VERTEXAI,
  GOOGLE_GENAI_USE_GCA
[WARN] Command completed with exit code: 41

Context

• Original issue: Gemini CLI Failed: API proxy enabled but no API keys found in environment gh-aw#23655
• Failing run: https://github.com/doughgle/agentic-workflows-workshop/actions/runs/23786740249
• Engine: gemini, CLI version: v0.65.0, AWF: v0.65.0

Root Cause

Two separate issues:

1. Project registry ENOENT: The Gemini CLI attempts to write projects.json at ~/.gemini/ inside the agent container. In src/docker-manager.ts line 985–987, ~/.gemini is bind-mounted from the host (\$\{effectiveHome}/.gemini:/host\$\{effectiveHome}/.gemini:rw). If ~/.gemini/ does not exist on the host at workflow run time, the bind mount creates it as a directory, but Gemini CLI's tmp-file rename pattern fails because the directory structure inside may not match expectations (e.g., parent directory missing for projects.json.tmp).

2. No API key: When api-proxy is enabled, GEMINI_API_KEY is added to EXCLUDED_ENV_VARS (line 600 of src/docker-manager.ts), but GEMINI_API_BASE_URL is only set to the proxy when config.geminiApiKey is truthy (line 1657). If the key isn't available to the AWF process (only in GitHub Actions secrets), GEMINI_API_BASE_URL is not set, and the Gemini CLI finds no authentication method.

Proposed Solution

1. src/docker-manager.ts: Pre-create ~/.gemini/ directory on the host before mounting it (similar to how agent-session-state is created at lines 1867–1878). Ensure the directory exists before the compose config is generated.

2. src/docker-manager.ts: Decouple GEMINI_API_BASE_URL assignment from config.geminiApiKey presence. When --enable-api-proxy is active, always set GEMINI_API_BASE_URL to the proxy and always add GEMINI_API_KEY to EXCLUDED_ENV_VARS. The proxy returns 503 if the key isn't configured — a clear failure vs. a confusing auth error.

3. containers/api-proxy/server.js: Add the Gemini listener status to the API proxy enabled: info log (currently only shows OpenAI/Anthropic/Copilot).

4. Docs: Document that GEMINI_API_KEY must be accessible in the runner environment (not only as a GitHub Actions secret) when using --enable-api-proxy.

Generated by Firewall Issue Dispatcher · ● 1.6M · ◷

[github-actions]

👋 Hello! I noticed this issue might be related to a recently closed issue:

• [awf] agent-container: Gemini CLI ENOENT on project registry due to ~/.gemini ownership in chroot #1897 — [awf] agent-container: Gemini CLI ENOENT on project registry due to ~/.gemini ownership in chroot (closed as completed on Apr 11, 2026)

Both issues describe the same core failure pattern:

• ENOENT: no such file or directory, rename '.../projects.json.tmp' -> '.../projects.json'
• Gemini CLI auth failure (exit code 41) with --enable-api-proxy
• Same log sequence: [WARN] API proxy enabled but no API keys found in environment

If the fix from #1897 didn't fully resolve the problem (or regressed), it may be worth referencing that issue for context. Alternatively, if this issue covers additional scope (e.g., the GEMINI_API_BASE_URL decoupling from geminiApiKey presence), please clarify how it differs so it doesn't get treated as a re-open of the same bug.

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #1933 · ● 223.3K · ◷