@google/gemini-cli 0.64.0-preview.0 → 0.64.0-preview.1

package/bundle/docs/tools/mcp-server.md

@@ -326,17 +326,31 @@ This feature will not work in:
 
 <!-- prettier-ignore -->
 > [!IMPORTANT]
-> To protect against OAuth Identity Provider (IdP) mix-up attacks, Gemini CLI
-> validates the `iss` (issuer) parameter per
-> [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207). When an expected issuer is
-> discovered or configured, authorization servers **must** return the `iss`
-> parameter in the callback redirect matching the issuer URL. Responses missing
-> `iss` or with mismatched issuers are rejected with HTTP 400.
+> Gemini CLI validates the `iss` (issuer) parameter in OAuth authorization
+> responses per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207) and the MCP
+> specification:
+>
+> - Whenever the `iss` parameter is present in the callback redirect and an
+>   expected `issuer` is discovered or configured, `iss` **must** match the
+>   expected issuer URL.
+> - When the authorization server metadata sets
+>   `authorization_response_iss_parameter_supported: true`, the callback
+>   redirect **must** include the `iss` parameter.
+> - When the discovered authorization server metadata omits
+>   `authorization_response_iss_parameter_supported` or sets it to `false` (for
+>   example, providers that do not declare RFC 9207 support), callbacks without
+>   `iss` are accepted.
+> - When you configure `issuer` explicitly in `settings.json` and Gemini CLI
+>   doesn't discover authorization server metadata, the callback redirect
+>   **must** include the `iss` parameter. To accept callbacks without `iss` for
+>   such a server, set `authorizationResponseIssParameterSupported` to `false`
+>   in the `oauth` configuration.
 
 ##### Expected authorization callback example
 
-When the authorization server redirects the user back to Gemini CLI, the
-redirect URI must include the `iss` parameter:
+When the authorization server declares
+`authorization_response_iss_parameter_supported: true`, the redirect URI must
+include the `iss` parameter:
 
 ```http
 HTTP/1.1 302 Found
@@ -344,10 +358,14 @@ Location: http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE&iss=
 ```
 
 - **Valid response (accepted):** `iss` matches the configured or discovered
-  issuer (`https://auth.example.com`).
-- **Missing `iss` (rejected):**
-  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` (fails
-  with HTTP 400: `Missing issuer parameter in response`).
+  issuer (`https://auth.example.com`), or `iss` is omitted when the discovered
+  metadata doesn't set `authorization_response_iss_parameter_supported` to
+  `true`.
+- **Missing `iss` when required (rejected):**
+  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` when
+  `authorization_response_iss_parameter_supported` is `true`, or when `issuer`
+  is configured explicitly without discovered metadata (fails with HTTP 400:
+  `Missing issuer parameter in response`).
 - **Mismatched `iss` (rejected):** `iss` points to a different domain or
   includes userinfo (fails with HTTP 400: `Issuer mismatch`).
 
@@ -373,6 +391,12 @@ If your remote MCP server uses an authorization server with a known issuer URL:
 }
 ```
 
+With this configuration, Gemini CLI requires the `iss` parameter in the
+authorization callback. If the authorization server doesn't return `iss` in its
+redirects, add `"authorizationResponseIssParameterSupported": false` to the
+`oauth` block. Gemini CLI then accepts callbacks without `iss` while still
+rejecting any `iss` value that doesn't match the configured `issuer`.
+
 #### Managing OAuth authentication
 
 Use the `/mcp auth` command to manage OAuth authentication:
@@ -398,6 +422,11 @@ Use the `/mcp auth` command to manage OAuth authentication:
   if omitted)
 - **`issuer`** (string): Authorization server issuer URL (auto-discovered if
   omitted; validated per RFC 9207)
+- **`authorizationResponseIssParameterSupported`** (boolean): Whether the
+  authorization server returns the `iss` parameter in authorization responses
+  (RFC 9207). Auto-discovered from the authorization server metadata; defaults
+  to `true` when `issuer` is configured explicitly without discovered metadata.
+  Set to `false` to accept callbacks without `iss` for such a server.
 - **`tokenUrl`** (string): OAuth token endpoint (auto-discovered if omitted)
 - **`scopes`** (string[]): Required OAuth scopes
 - **`redirectUri`** (string): Custom redirect URI (defaults to an OS-assigned

package/bundle/{gemini-JPMMQ3KA.js → gemini-LHZDQRUM.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   startCommand,
   startServer
-} from "./chunk-MLSLNORV.js";
+} from "./chunk-EE4FVMPM.js";
 import {
   BuiltinCommandLoader,
   CommandService,
@@ -46,11 +46,11 @@ import {
   updateExtension,
   validateAuthMethod,
   validateContextFilePath
-} from "./chunk-EBP6K2WG.js";
+} from "./chunk-7OAPTXNW.js";
 import {
   exitCli,
   require_source
-} from "./chunk-ZOHM7BPT.js";
+} from "./chunk-ONZZ4MZP.js";
 import {
   appEvents
 } from "./chunk-5PS3AYFU.js";
@@ -88,11 +88,11 @@ import {
   resolveGemmaConfig,
   saveModelChange,
   stripAnsi
-} from "./chunk-HN74ORTP.js";
+} from "./chunk-L3JNREL2.js";
 import {
   RELAUNCH_EXIT_CODE
-} from "./chunk-VBVCLWLA.js";
-import "./chunk-NX7TO2DU.js";
+} from "./chunk-6JF3XGX6.js";
+import "./chunk-RQB6UOWL.js";
 import {
   cleanupCheckpoints,
   registerCleanup,
@@ -101,7 +101,7 @@ import {
   runExitCleanup,
   runSyncCleanup,
   setupSignalHandlers
-} from "./chunk-UBGF6JU5.js";
+} from "./chunk-4TPFLAND.js";
 import {
   ASK_USER_TOOL_NAME,
   ApprovalMode,
@@ -256,7 +256,7 @@ import {
   updatePolicy,
   writeToStderr,
   writeToStdout
-} from "./chunk-ZQW7OGUO.js";
+} from "./chunk-T7UXARRX.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -11527,7 +11527,7 @@ async function runNonInteractive({
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-XZCKFZP5.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-ZHFOHPIS.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -12037,7 +12037,7 @@ async function runNonInteractive2(params) {
       }
     });
     if (process.env["GEMINI_CLI_ACTIVITY_LOG_TARGET"]) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-XZCKFZP5.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-ZHFOHPIS.js");
       setupInitialActivityLogger(config);
     }
     const { stdout: workingStdout } = createWorkingStdio();
@@ -17418,7 +17418,7 @@ async function resolveSessionId(resumeArg, sessionIdArg, sessionFileArg) {
   }
 }
 async function startInteractiveUI(config, settings, startupWarnings, workspaceRoot = process.cwd(), resumedSessionData, initializationResult) {
-  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-UDWGRVJL.js");
+  const { startInteractiveUI: doStartUI } = await import("./interactiveCli-QCNSW3M7.js");
   await doStartUI(
     config,
     settings,
@@ -17627,7 +17627,7 @@ ${finalArgs[promptIndex + 1]}`;
     await config.storage.initialize();
     adminControlsListner.setConfig(config);
     if (config.isInteractive() && settings.merged.general.devtools) {
-      const { setupInitialActivityLogger } = await import("./devtoolsService-XZCKFZP5.js");
+      const { setupInitialActivityLogger } = await import("./devtoolsService-ZHFOHPIS.js");
       setupInitialActivityLogger(config);
     }
     registerTelemetryConfig(config);
@@ -17686,7 +17686,7 @@ ${finalArgs[promptIndex + 1]}`;
     const initAppHandle = startupProfiler.start("initialize_app");
     const initializationResult = await initializeApp(config, settings);
     initAppHandle?.end();
-    import("./liteRtServerManager-OVPUSK2T.js").then(({ LiteRtServerManager }) => {
+    import("./liteRtServerManager-2I4N5IEZ.js").then(({ LiteRtServerManager }) => {
       const mergedGemma = settings.merged.experimental?.gemmaModelRouter;
       if (!mergedGemma) return;
       const userGemma = settings.forScope("User" /* User */).settings.experimental?.gemmaModelRouter;