google-gemini / google-gemini/gemini-cli
bug: rejected OAuth client initialization promise is cached forever (negative caching until process restart)
- Dominant language
- TypeScript
- Stars
- 107k
- Forks
- 14.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 45
Description
## What happened?
`getOauthClient()` caches initialization **promises** keyed by auth type and never evicts on rejection. If the first initialization attempt fails (5-minute browser-login timeout, user cancellation at the consent prompt, transient network failure during token verification), every subsequent call for the rest of the process lifetime rethrows the stale rejection instantly — recovery requires restarting the CLI/SDK process even though the original cause (user ready to log in, network restored) has passed.
## Affected code
`packages/core/src/code_assist/oauth2.ts:431-439`:
```ts
export async function getOauthClient(
authType: AuthType,
config: Config,
): Promise {
if (!oauthClientPromises.has(authType)) {
oauthClientPromises.set(authType, initOauthClient(authType, config));
}
return oauthClientPromises.get(authType)!;
}
```
Nothing removes entries on rejection; `clearOauthClientCache()` is only invoked from `clearCachedCredentialFile()` and test reset paths.
## How can this be reproduced?
1. Start OAuth login but cancel at the browser step (or block network so `getTokenInfo` verification fails).
2. Retry `/auth` or any authenticated call.
3. Observed: immediate failure with the original error; no new login attempt is possible until restart.
## What did you expect to happen?
A failed initialization should not be sticky: drop the cached promise on rejection so the next call retries initialization.
## Suggested direction
```ts
const p = initOauthClient(authType, config).catch((e) => {
oauthClientPromises.delete(authType);
throw e;
});
oauthClientPromises.set(authType, p);
```
---
*Found by source audit on current `main` (commit `5411f113c`); platform-independent. No open issue/PR covering this was found (searched: oauth client cache failed retry).*
Contributor guide
Research direction
Start in packages/core/src/code_assist/oauth2.ts at getOauthClient, around lines 431-439, and reproduce the failed login or token-verification flow described in the issue. Verify that a rejected initialization is removed from the cache so a subsequent /auth or authenticated call starts a fresh initialization instead of rethrowing the original error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100