fix(electron): suppress verbose startup logs in Electron mode #374
Conversation
- Add quiet:true to dotenv config in Electron main process - Set AUTOMAKER_ELECTRON and AUTOMAKER_HIDE_API_KEY env vars - Suppress API key banner when spawned by Electron (auth is automatic) - Remove partial Anthropic key logging for security Fixes verbose dotenv injection messages and unnecessary API key banner in Electron console output while preserving web mode behavior. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>
📝 WalkthroughWalkthroughSecurity and logging enhancements suppress API key exposure by removing masked key displays from logs and adding environment flags (AUTOMAKER_ELECTRON, AUTOMAKER_HIDE_API_KEY) to indicate Electron execution context and suppress authentication banners in the backend. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Suggested labels
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @airplne, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refines the Electron application's startup experience and security posture. It streamlines the console output by quieting Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI Agents
In @apps/ui/src/main.ts:
- Around line 488-491: AUTOMAKER_ELECTRON is defined in the client but not used
by the server; either remove the AUTOMAKER_ELECTRON entry from the client config
in main.ts or add server-side consumption by reading
process.env.AUTOMAKER_ELECTRON and applying the appropriate behavior (e.g.,
similar to how AUTOMAKER_HIDE_API_KEY is handled in the auth logic) so the
server recognizes an Electron execution context; update the server auth/config
code to check process.env.AUTOMAKER_ELECTRON (and treat the string 'true'
accordingly) or delete the unused constant from the client to keep config
minimal.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
apps/server/src/routes/app-spec/common.tsapps/ui/src/main.ts
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Always import from shared packages (@automaker/*), never from old relative paths
Files:
apps/server/src/routes/app-spec/common.tsapps/ui/src/main.ts
apps/server/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use
createEventEmitter()fromlib/events.tsfor all server operations to emit events that stream to frontend via WebSocket
Files:
apps/server/src/routes/app-spec/common.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use
resolveModelString()from @automaker/model-resolver to convert model aliases (haiku, sonnet, opus) to full model names
Files:
apps/server/src/routes/app-spec/common.tsapps/ui/src/main.ts
🔇 Additional comments (2)
apps/server/src/routes/app-spec/common.ts (1)
38-38: Security improvement: API key redaction implemented correctly.Changing from logging the API key value to logging "SET"/"NOT SET" eliminates the risk of exposing sensitive credentials in logs while preserving debugging functionality.
apps/ui/src/main.ts (1)
50-50: LGTM: Dotenv quiet mode reduces startup verbosity.Adding
quiet: trueappropriately suppresses dotenv's injection messages, aligning with the PR objective to reduce verbose startup logs in Electron mode.
| // Indicate Electron execution context to server | ||
| AUTOMAKER_ELECTRON: 'true', | ||
| // Suppress API key banner in Electron (auth handled automatically) | ||
| AUTOMAKER_HIDE_API_KEY: 'true', |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify that AUTOMAKER_ELECTRON and AUTOMAKER_HIDE_API_KEY are consumed by the server.
# Search for AUTOMAKER_ELECTRON usage in server code
echo "=== Searching for AUTOMAKER_ELECTRON usage ==="
rg -n --type=ts --type=js -C3 'AUTOMAKER_ELECTRON' apps/server/
echo ""
echo "=== Searching for AUTOMAKER_HIDE_API_KEY usage ==="
rg -n --type=ts --type=js -C3 'AUTOMAKER_HIDE_API_KEY' apps/server/Repository: AutoMaker-Org/automaker
Length of output: 1597
Remove unused AUTOMAKER_ELECTRON environment variable or implement server-side consumption.
The AUTOMAKER_HIDE_API_KEY variable is properly consumed in apps/server/src/lib/auth.ts (line 134) to suppress the API key banner when set to 'true'. However, AUTOMAKER_ELECTRON is set in the client but is not referenced anywhere in the server code. Either implement server-side logic to consume this variable to recognize the Electron execution context, or remove the unused environment variable from the client configuration.
🤖 Prompt for AI Agents
In @apps/ui/src/main.ts around lines 488 - 491, AUTOMAKER_ELECTRON is defined in
the client but not used by the server; either remove the AUTOMAKER_ELECTRON
entry from the client config in main.ts or add server-side consumption by
reading process.env.AUTOMAKER_ELECTRON and applying the appropriate behavior
(e.g., similar to how AUTOMAKER_HIDE_API_KEY is handled in the auth logic) so
the server recognizes an Electron execution context; update the server
auth/config code to check process.env.AUTOMAKER_ELECTRON (and treat the string
'true' accordingly) or delete the unused constant from the client to keep config
minimal.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request effectively suppresses verbose startup logs in Electron mode and enhances security by removing partial API key logging. The changes are clear and well-implemented. I've added one suggestion to improve maintainability and further harden security by using constants for environment variable names, which will help prevent potential issues from typos across different parts of the application.
| AUTOMAKER_ELECTRON: 'true', | ||
| // Suppress API key banner in Electron (auth handled automatically) | ||
| AUTOMAKER_HIDE_API_KEY: 'true', |
There was a problem hiding this comment.
Using hardcoded strings for environment variable names like AUTOMAKER_ELECTRON and AUTOMAKER_HIDE_API_KEY is risky. A typo in AUTOMAKER_HIDE_API_KEY, for example, would cause the server to default to showing the API key in the logs, which is a security concern this PR aims to prevent.
To make this more robust, I recommend defining these keys as constants in a shared package (e.g., in a new constants file within @automaker/utils) and importing them both here and in the server code where they are read. This prevents typos and makes the code easier to maintain.
2 participants
Summary
quiet: trueto dotenv config in Electron main processAUTOMAKER_ELECTRONandAUTOMAKER_HIDE_API_KEYenv vars for serverTest plan
Files changed
apps/ui/src/main.ts(2 changes)apps/server/src/routes/app-spec/common.ts(1 change)🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
✏️ Tip: You can customize this high-level summary in your review settings.