fix(google): support gemini cli personal oauth#61260
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2231c27fb2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Greptile SummaryThis PR fixes personal Google account logins for the bundled Gemini CLI provider by detecting when the local Gemini CLI is configured in Notable concerns:
Confidence Score: 3/5Conditionally safe — the settings-file detection path is solid, but the GOOGLE_GENAI_USE_GCA env-var mapping needs verification against actual Gemini CLI semantics before merging. The fix logic and test coverage for the settings-file detection path are correct and well-structured. The two concerns — the readString untrimmed return that can silently mis-classify personal OAuth users, and the potentially inverted GOOGLE_GENAI_USE_GCA semantics — are both correctness risks for the exact scenario this PR aims to fix. If the env-var semantics are wrong, workspace users with that variable set would be misrouted. extensions/google/oauth.settings.ts (readString return value, GOOGLE_GENAI_USE_GCA mapping); extensions/google/oauth.test.ts (env-var test should be confirmed against upstream Gemini CLI docs) Prompt To Fix All With AIThis is a comment left during a code review.
Path: extensions/google/oauth.settings.ts
Line: 34-36
Comment:
**`readString` returns untrimmed value — comparison to `"oauth-personal"` may silently fail**
The guard `value.trim()` is used only for the truthiness check; the raw (potentially whitespace-padded) `value` is what gets returned. If a user's `~/.gemini/settings.json` contains `selectedType: "oauth-personal "` (trailing space), `resolveGeminiCliSelectedAuthType()` returns `"oauth-personal "`, the strict equality check in `isGeminiCliPersonalOAuth()` fails, and the call falls through to `resolveGoogleOAuthIdentity` — invoking `loadCodeAssist` for what is actually a personal OAuth user and re-introducing the 400 error this PR aims to fix.
Return the trimmed string consistently:
```suggestion
function readString(value: unknown): string | undefined {
return typeof value === "string" && value.trim() ? value.trim() : undefined;
}
```
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: extensions/google/oauth.settings.ts
Line: 55-58
Comment:
**`GOOGLE_GENAI_USE_GCA=true` mapped to `"oauth-personal"` — please verify against actual Gemini CLI semantics**
The variable name `GOOGLE_GENAI_USE_GCA` reads as "Use Google Cloud Assist" (GCA = Code Assist / enterprise workspace path). In the broader Gemini CLI ecosystem this flag is typically associated with *enabling* the Code Assist / project-backed auth flow, not the personal OAuth flow — the opposite of what this mapping implies.
If the actual `@google/gemini-cli` treats `GOOGLE_GENAI_USE_GCA=true` as "use Code Assist / workspace auth", any workspace user who has this env var set will be incorrectly routed through `resolveGooglePersonalOAuthIdentity`, silently skipping `loadCodeAssist` and producing a `projectId`-less credential that will break downstream project-scoped API calls.
The settings-file path (reading `security.auth.selectedType === "oauth-personal"`) is unambiguous. This env-var shortcut should be verified against the Gemini CLI source or docs before merging. If the intent is to detect the *absence* of Code Assist (personal OAuth when the flag is not set), the condition and the test description should be inverted.
How can I resolve this? If you propose a fix, please make it concise.Reviews (1): Last reviewed commit: "Update CHANGELOG.md" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
vincentkoc
force-pushed
the
fix/gemini-cli-personal-oauth
branch
from
0aa0b2e to
43ae20e
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 43ae20ee3a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ad15a7b1a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
vincentkoc
force-pushed
the
fix/gemini-cli-personal-oauth
branch
from
ad15a7b to
463de2a
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 463de2af23
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| readString(auth?.selectedType) ?? | ||
| readString(auth?.enforcedType) ?? | ||
| readString(settings.selectedAuthType) ?? | ||
| readString(settings.enforcedAuthType); |
There was a problem hiding this comment.
resolveGeminiCliSelectedAuthType currently checks selectedType before enforcedType, so a config that contains both values can ignore the required enterprise override and route OAuth through the wrong identity path. When enforcedType differs from selectedType, this can incorrectly skip (or force) Code Assist project discovery and produce invalid onboarding behavior for managed accounts.
Useful? React with 👍 / 👎.
1 participant
Summary
loadCodeAssist 400 Bad Request, so the bundled Gemini CLI provider is unusable for that auth mode.GOOGLE_GENAI_USE_GCA, skip Code Assist project discovery for that path, and only persistprojectIdmetadata when a workspace/project-backed login actually returned one.Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
Root Cause (if applicable)
loadCodeAssistafter token exchange.oauth-personalmode and uses settings/env to decide it.Regression Test Plan (if applicable)
extensions/google/oauth.test.tsloadCodeAssist, while workspace OAuth still does.extensions/google/oauth.test.ts.User-visible / Behavior Changes
Diagram (if applicable)
Security Impact (required)
Yes, explain risk + mitigation:Repro + Verification
Environment
google-gemini-cli~/.gemini/settings.jsonwithsecurity.auth.selectedType = "oauth-personal"Steps
Expected
loadCodeAssistcall.Actual
loadCodeAssistand personal OAuth logins failed with400 Bad Request.Evidence
Human Verification (required)
projectIdcredential storage shape.GOOGLE_GENAI_USE_GCA=trueoverride; missing settings file; no accidentalloadCodeAssistoronboardUsercalls in personal mode.Review Conversations
Compatibility / Migration
Risks and Mitigations