fix(gemini-cli): allowlist install hosts on the environment baseline - #1282
Open
stateofkate wants to merge 1 commit into
Open
fix(gemini-cli): allowlist install hosts on the environment baseline#1282stateofkate wants to merge 1 commit into
stateofkate wants to merge 1 commit into
Conversation
Harbor's `GeminiCli.install` bootstraps nvm, a Node runtime and the
`@google/gemini-cli` npm package during agent SETUP, which runs under the
`[environment]` network baseline. An agent-phase allowlist only takes effect
around `agent.run()`, so it can never cover the install.
On any task whose `[environment]` baseline is an allowlist, every gemini-cli
trial therefore died before consuming a token:
curl: (35) Recv failure: Connection reset by peer
Error: NVM failed to load
Observed across the gemini-3.7 backfill: 394 FAILED trials, all at
attempts=6/6 (retries exhausted, so nothing self-heals). The split was
perfectly bimodal per task -- 72 task versions all-fail, 45 all-ok, 0 mixed --
because the failing ones are allowlisted to `x.ai` alone, the host grok-build's
installer needs. Other agents on those same tasks are unaffected (grok-build
36 ok, claude-code 27 ok), since only gemini-cli fetches its runtime at setup.
claude-code and opencode already merge their install hosts into the
environment baseline for exactly this reason; gemini-cli was simply missing
the same arm. The host set is identical to opencode's (both use harbor's
shared `nvm_node_install_snippet`), so it is aliased rather than duplicated.
On a public baseline the merge is a no-op -- harbor ignores extra hosts there
-- so public-setup tasks keep their agent phase unchanged. No task content
changes, so no new task versions are cut and existing trials stay comparable.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Oddish previewCommit:
Vercel deployment URL: https://oddish-psey0xw0r.oddish.app Plan:
This comment is updated by the PR Preview workflow. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Harbor's
GeminiCli.installbootstraps nvm, a Node runtime, and the@google/gemini-clinpm package during agent setup, which runs under the[environment]network baseline. An agent-phase allowlist only applies aroundagent.run(), so it can never cover the install.On any task whose
[environment]baseline is an allowlist, every gemini-clitrial died before consuming a token:
curl: (35)is an actively reset connection — not DNS (6) or timeout (28).Evidence
From the gemini-3.7 backfill (
gemini-cli @ gemini/gemini-3.7-flash, k=5):All failures at
attempts=6/6— retries exhausted, nothing self-heals.The split is per task and perfectly bimodal: 72 task versions all-fail,
45 all-ok, 0 mixed. The failing ones declare
i.e. they were authored for
grok-buildand allowlist only what its installerneeds. Other agents on those same tasks are unaffected (
grok-build36 ok,claude-code27 ok) because only gemini-cli fetches its runtime at setup.Fix
claude-codeandopencodealready merge their install hosts into theenvironment baseline for exactly this reason — gemini-cli was missing the same
arm. Its host set is identical to opencode's (both use harbor's shared
nvm_node_install_snippet), so it is aliased rather than duplicated.there), so public-setup tasks keep their agent phase unchanged.
comparable within their version.
Tests
Two regression tests, mirroring the opencode precedent. Both were verified to
fail against unmodified
runner.py/model_hosts.py(AttributeError: module 'oddish.workers.harbor.runner' has no attribute '_gemini_cli_environment_hosts')before the fix was restored.
tests/test_harbor_runner.pyis otherwise unchanged: the suite has 2 failures(
test_restricted_cursor_gets_transport_hosts_and_web_hardening,test_run_harbor_trial_async_skips_temp_root_preflight_without_task_patch)that reproduce identically on clean
origin/stagingand are unrelated to thischange.