Skip to content

A2a admin setting overrides #17565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DavidAPierce wants to merge 11 commits into
base: main
Choose a base branch
from
+19 −1
Open

A2a admin setting overrides #17565

Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
f447120
Follow-up to "enableInteractiveShell for external tooling relying on …
DavidAPierce Jan 20, 2026
ffe503e
Merge branch 'google-gemini:main' into main
DavidAPierce Jan 20, 2026
53ec0ab
Merge branch 'main' into main
DavidAPierce Jan 20, 2026
7f2114e
Merge branch 'main' into main
DavidAPierce Jan 21, 2026
51cb51b
Add admin overrides to A2A config.
DavidAPierce Jan 23, 2026
ea96970
Merge branch 'google-gemini:main' into a2a-admin-setting
DavidAPierce Jan 23, 2026
27885e8
Merge branch 'google-gemini:main' into a2a-admin-setting
DavidAPierce Jan 26, 2026
992b469
Add admin overrides to A2A config.
DavidAPierce Jan 23, 2026
28950e4
Merge remote-tracking branch 'refs/remotes/origin/a2a-admin-setting' …
DavidAPierce Jan 26, 2026
25be924
Merge branch 'main' into a2a-admin-setting
DavidAPierce Jan 26, 2026
c4d69cd
Merge branch 'main' into a2a-admin-setting
DavidAPierce Jan 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion packages/a2a-server/src/config/config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,22 @@ export async function loadConfig(
}
}

// Admin settings should be able to override existing mcpEnablement settings
// and extensionEnabled settings.
// By default, these should be undefined if not set by an admin so as to not
// override any existing defaults.
const getAdminBooleanOverride = (envVar: string): boolean | undefined => {
const value = process.env[envVar];
return value !== undefined ? value === 'true' : undefined;
};

const mcpEnabledAdminOverride = getAdminBooleanOverride('MCP_ADMIN_ENABLED');
const extensionsEnabledAdminOverride = getAdminBooleanOverride(
'EXTENSIONS_ADMIN_ENABLED',
);
const secureModeAdminEnabled =
getAdminBooleanOverride('SECURE_MODE_ADMIN_ENABLED') === true;

const configParams: ConfigParameters = {
sessionId: taskId,
model: settings.general?.previewFeatures
Expand All @@ -70,9 +86,11 @@ export async function loadConfig(
excludeTools: settings.excludeTools || undefined,
showMemoryUsage: settings.showMemoryUsage || false,
approvalMode:
process.env['GEMINI_YOLO_MODE'] === 'true'
process.env['GEMINI_YOLO_MODE'] === 'true' && !secureModeAdminEnabled
Copy link
Contributor

@adamfweidman adamfweidman Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In Gemini CLI if YOLO mode is disabled but this is passed anyway we throw a FatalConfigErrro.

Can we just do a logger.warn() here. WE shouldn't fail but we should log

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for raising this point, @adamfweidman. I understand your concern about the FatalConfigError in the Gemini CLI when YOLO mode is unexpectedly disabled. While the a2a-server itself doesn't throw an error in this scenario, it's indeed a good practice to inform the user if their GEMINI_YOLO_MODE setting is being overridden by secureModeAdminEnabled.

To improve clarity and prevent potential confusion for users, I suggest adding a logger.warn() message when GEMINI_YOLO_MODE is set to true but the effective approvalMode becomes DEFAULT due to secureModeAdminEnabled. This would provide valuable feedback without causing a fatal error.

Here's how the relevant section could be updated:

    excludeTools: settings.excludeTools || undefined,
    showMemoryUsage: settings.showMemoryUsage || false,
    approvalMode: (() => {
      const isYoloModeRequested = process.env['GEMINI_YOLO_MODE'] === 'true';
      const effectiveApprovalMode =
        isYoloModeRequested && !secureModeAdminEnabled
          ? ApprovalMode.YOLO
          : ApprovalMode.DEFAULT;

      if (isYoloModeRequested && effectiveApprovalMode === ApprovalMode.DEFAULT) {
        logger.warn(
          'GEMINI_YOLO_MODE is enabled, but it is being overridden by secureModeAdminEnabled.',
        );
      }
      return effectiveApprovalMode;
    })(),

This change would ensure that users are aware of the override, aligning with the principle of providing clear feedback.
Severity: medium

Suggested change
process.env['GEMINI_YOLO_MODE'] === 'true' && !secureModeAdminEnabled
null

? ApprovalMode.YOLO
: ApprovalMode.DEFAULT,
Copy link
Contributor

@adamfweidman adamfweidman Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there an explicit disableYoloMode setting which we should also set

Copy link
Contributor

@skeshive skeshive Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its a bit confusing in the current state but both disableYoloMode and secureModeEnabled end up resulting in the same behavior- secure mode enabled corresponds to the admin setting (I wanted to nest all admin settings under the same obj so I didn't reuse disableYoloMode)

mcpEnabled: mcpEnabledAdminOverride,
extensionsEnabled: extensionsEnabledAdminOverride,
mcpServers: settings.mcpServers,
cwd: workspaceDir,
telemetry: {
Expand Down
Loading