Skip to content

fix: exclude API keys from agent when api-proxy is enabled #814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 2 commits into from
Feb 13, 2026
+13 −1
Merged

fix: exclude API keys from agent when api-proxy is enabled #814

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
faddec3
Initial plan
Claude Feb 13, 2026
25dbd6c
fix: exclude API keys from agent when api-proxy is enabled
Claude Feb 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion src/docker-manager.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,6 +320,14 @@ export function generateDockerCompose(
'SUDO_GID', // Sudo metadata
]);

// When api-proxy is enabled, exclude API keys from agent environment
// The keys are passed to the api-proxy sidecar only (not to the agent)
const willUseApiProxy = config.enableApiProxy && (config.openaiApiKey || config.anthropicApiKey);
if (willUseApiProxy) {
EXCLUDED_ENV_VARS.add('ANTHROPIC_API_KEY');
EXCLUDED_ENV_VARS.add('OPENAI_API_KEY');
}
Comment on lines +323 to +329
Copy link

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing test coverage: The changes introduce important security logic to exclude API keys from the agent environment when api-proxy is enabled. However, there are no tests verifying that ANTHROPIC_API_KEY and OPENAI_API_KEY are actually excluded from the agent environment when api-proxy is enabled.

Consider adding test cases that:

  1. Verify ANTHROPIC_API_KEY is NOT in agent.environment when api-proxy is enabled and anthropicApiKey is provided
  2. Verify OPENAI_API_KEY is NOT in agent.environment when api-proxy is enabled and openaiApiKey is provided
  3. Test the --env-all scenario to ensure API keys are excluded even when envAll is true

Copilot uses AI. Check for mistakes.
Comment on lines +325 to +329
Copy link

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition for willUseApiProxy (line 325) is inconsistent with the condition used to create the api-proxy service (line 917 and elsewhere). The willUseApiProxy check is:

config.enableApiProxy && (config.openaiApiKey || config.anthropicApiKey)

But the api-proxy service creation check is:

config.enableApiProxy && networkConfig.proxyIp && (config.openaiApiKey || config.anthropicApiKey)

This creates a discrepancy: if networkConfig.proxyIp is falsy, API keys would be excluded from the agent environment but no api-proxy service would be created. While proxyIp appears to always be set in practice (line 1099), the logic should be consistent. Consider adding the networkConfig.proxyIp check to the willUseApiProxy condition for consistency and defensive programming.

Copilot uses AI. Check for mistakes.

// Start with required/overridden environment variables
// Use the real user's home (not /root when running with sudo)
const homeDir = getRealUserHome();
Expand Down Expand Up @@ -386,7 +394,11 @@ export function generateDockerCompose(
if (process.env.GH_TOKEN) environment.GH_TOKEN = process.env.GH_TOKEN;
if (process.env.GITHUB_PERSONAL_ACCESS_TOKEN) environment.GITHUB_PERSONAL_ACCESS_TOKEN = process.env.GITHUB_PERSONAL_ACCESS_TOKEN;
// Anthropic API key for Claude Code
if (process.env.ANTHROPIC_API_KEY) environment.ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
// Only pass ANTHROPIC_API_KEY to agent when api-proxy is NOT enabled
// When api-proxy IS enabled, the key goes to the sidecar only (not to agent)
if (process.env.ANTHROPIC_API_KEY && !willUseApiProxy) {
environment.ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
}
Copy link

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistency: OPENAI_API_KEY is missing from the selective pass-through logic. While ANTHROPIC_API_KEY is conditionally passed to the agent only when api-proxy is NOT enabled (lines 397-401), there is no equivalent handling for OPENAI_API_KEY.

This creates an asymmetry where:

  • If api-proxy is disabled: ANTHROPIC_API_KEY is passed to agent, but OPENAI_API_KEY is not (unless using --env-all)
  • If api-proxy is enabled: Neither key should be passed (correctly handled for ANTHROPIC_API_KEY)

To maintain consistency with the api-proxy architecture and to support OpenAI usage without api-proxy, consider adding similar logic for OPENAI_API_KEY after line 401.

Suggested change
}
}
// OpenAI API key for OpenAI-based models
// Only pass OPENAI_API_KEY to agent when api-proxy is NOT enabled
// When api-proxy IS enabled, the key goes to the sidecar only (not to agent)
if (process.env.OPENAI_API_KEY && !willUseApiProxy) {
environment.OPENAI_API_KEY = process.env.OPENAI_API_KEY;
}

Copilot uses AI. Check for mistakes.
if (process.env.USER) environment.USER = process.env.USER;
if (process.env.TERM) environment.TERM = process.env.TERM;
if (process.env.XDG_CONFIG_HOME) environment.XDG_CONFIG_HOME = process.env.XDG_CONFIG_HOME;
Expand Down
Loading