fix: read GEMINI_API_KEY from process.env instead of literal unexpanded shell string

1c12bfbcf31ccbbc0abb8e27f7ef8883eb3044a5 · 2026-05-30 21:21:51 -0700 · Steve Abrams

Line 28 used single-quoted '${GEMINI_API_KEY}' which is a literal string, not an env var expansion. All Gemini AI analysis calls were sending a garbage key and failing silently.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 1c12bfbcf31ccbbc0abb8e27f7ef8883eb3044a5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:21:51 2026 -0700

    fix: read GEMINI_API_KEY from process.env instead of literal unexpanded shell string
    
    Line 28 used single-quoted '${GEMINI_API_KEY}' which is a literal string, not an env var expansion. All Gemini AI analysis calls were sending a garbage key and failing silently.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 9cff179..9bffcf5 100644
--- a/server.js
+++ b/server.js
@@ -25,7 +25,7 @@ const SHOPIFY_HEADERS = {
 
 const SLACK_WEBHOOK = 'https://hooks.slack.com/services/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';
 
-const GEMINI_API_KEY = '${GEMINI_API_KEY}';
+const GEMINI_API_KEY = process.env.GEMINI_API_KEY || '';
 const GEMINI_ENDPOINT = 'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent';
 
 // Brewster / York trade portal credentials (same parent company, shared login)

← 008f261 security: strip hardcoded dw_admin DSN password -> env-first · back to Sku Check Skill · fix: bind to 127.0.0.1 (HOST-overridable) to avoid tailscale 7329227 →