google-gemini / google-gemini/gemini-cli

bug: rejected OAuth client initialization promise is cached forever (negative caching until process restart)

Open Beginner friendly
#29,052 0 comments 0 reactions 0 assignees View on GitHub
area/security status/need-triage
Dominant language
TypeScript
Stars
107k
Forks
14.6k
Avg merge
2d 3h
Merged PRs (30d)
45

Description

## What happened?

`getOauthClient()` caches initialization **promises** keyed by auth type and never evicts on rejection. If the first initialization attempt fails (5-minute browser-login timeout, user cancellation at the consent prompt, transient network failure during token verification), every subsequent call for the rest of the process lifetime rethrows the stale rejection instantly — recovery requires restarting the CLI/SDK process even though the original cause (user ready to log in, network restored) has passed.

## Affected code

`packages/core/src/code_assist/oauth2.ts:431-439`:

```ts
export async function getOauthClient(
authType: AuthType,
config: Config,
): Promise {
if (!oauthClientPromises.has(authType)) {
oauthClientPromises.set(authType, initOauthClient(authType, config));
}
return oauthClientPromises.get(authType)!;
}
```

Nothing removes entries on rejection; `clearOauthClientCache()` is only invoked from `clearCachedCredentialFile()` and test reset paths.

## How can this be reproduced?

1. Start OAuth login but cancel at the browser step (or block network so `getTokenInfo` verification fails).
2. Retry `/auth` or any authenticated call.
3. Observed: immediate failure with the original error; no new login attempt is possible until restart.

## What did you expect to happen?

A failed initialization should not be sticky: drop the cached promise on rejection so the next call retries initialization.

## Suggested direction

```ts
const p = initOauthClient(authType, config).catch((e) => {
oauthClientPromises.delete(authType);
throw e;
});
oauthClientPromises.set(authType, p);
```

---

*Found by source audit on current `main` (commit `5411f113c`); platform-independent. No open issue/PR covering this was found (searched: oauth client cache failed retry).*

Contributor guide

Open the contributing guide

Research direction

Start in packages/core/src/code_assist/oauth2.ts at getOauthClient, around lines 431-439, and reproduce the failed login or token-verification flow described in the issue. Verify that a rejected initialization is removed from the cache so a subsequent /auth or authenticated call starts a fresh initialization instead of rethrowing the original error.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.