@google/gemini-cli 0.64.0-preview.0 → 0.64.0

package/bundle/{chunk-ZPLFLZQA.js → chunk-QCHFD56F.js}

@@ -31,7 +31,7 @@ import {
   partListUnionToString,
   require_strip_json_comments,
   sanitizeFilenamePart
-} from "./chunk-A4TO2DY2.js";
+} from "./chunk-PZ4GDG24.js";
 import {
   __commonJS,
   __require,
@@ -15246,7 +15246,13 @@ var SETTINGS_SCHEMA_DEFINITIONS = {
       oauth: {
         type: "object",
         description: "OAuth configuration for authenticating with the server.",
-        additionalProperties: true
+        additionalProperties: true,
+        properties: {
+          authorizationResponseIssParameterSupported: {
+            type: "boolean",
+            description: 'Whether the authorization server returns the "iss" parameter in the authorization response (RFC 9207). When true, callbacks without "iss" are rejected; when false, they are accepted. A provided "iss" is always validated. Overrides the "authorization_response_iss_parameter_supported" value discovered from server metadata.'
+          }
+        }
       },
       authProviderType: {
         type: "string",
@@ -15307,7 +15313,13 @@ var SETTINGS_SCHEMA_DEFINITIONS = {
       oauth: {
         type: "object",
         description: "OAuth configuration for authenticating with the server.",
-        additionalProperties: true
+        additionalProperties: true,
+        properties: {
+          authorizationResponseIssParameterSupported: {
+            type: "boolean",
+            description: 'Whether the authorization server returns the "iss" parameter in the authorization response (RFC 9207). When true, callbacks without "iss" are rejected; when false, they are accepted. A provided "iss" is always validated. Overrides the "authorization_response_iss_parameter_supported" value discovered from server metadata.'
+          }
+        }
       },
       authProviderType: {
         type: "string",

package/bundle/{chunk-Y2HXXBXI.js → chunk-QLNDNLK5.js}

@@ -1,7 +1,7 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   checkExhaustive
-} from "./chunk-6OFXOGEG.js";
+} from "./chunk-J7SXW2FI.js";
 import {
   __commonJS,
   __toESM

package/bundle/{chunk-2VN53SWW.js → chunk-QSLJVHXU.js}

@@ -1,7 +1,7 @@
 const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
 import {
   checkExhaustive
-} from "./chunk-A4TO2DY2.js";
+} from "./chunk-PZ4GDG24.js";
 import {
   __commonJS,
   __toESM

package/bundle/{chunk-U76XPSKR.js → chunk-V7G7CIBW.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   exitCli,
   require_source
-} from "./chunk-QUCRASYB.js";
+} from "./chunk-OQYJODOA.js";
 import {
   AppEvent,
   appEvents
@@ -63,15 +63,15 @@ import {
   stripUnsafeCharacters,
   toCodePoints,
   validateCustomTheme
-} from "./chunk-ZPLFLZQA.js";
+} from "./chunk-QCHFD56F.js";
 import {
   isDevelopment
-} from "./chunk-EFX5XL6M.js";
+} from "./chunk-5XKZL6EB.js";
 import {
   emptyIcon,
   mapCoreStatusToDisplayStatus,
   require_react
-} from "./chunk-2VN53SWW.js";
+} from "./chunk-QSLJVHXU.js";
 import {
   ALL_EDITORS,
   ApprovalMode,
@@ -239,7 +239,7 @@ import {
   tokenLimit,
   uiTelemetryService,
   unescapePath
-} from "./chunk-A4TO2DY2.js";
+} from "./chunk-PZ4GDG24.js";
 import {
   require_src
 } from "./chunk-L6PII3GR.js";
@@ -77751,7 +77751,7 @@ var authCommand = {
 import process29 from "node:process";
 
 // packages/cli/src/generated/git-commit.ts
-var GIT_COMMIT_INFO = "fb972b2f8";
+var GIT_COMMIT_INFO = "90997f398";
 
 // packages/cli/src/ui/utils/historyExportUtils.ts
 import * as fsPromises from "node:fs/promises";
@@ -81878,6 +81878,18 @@ var import_react74 = __toESM(require_react(), 1);
 
 // packages/cli/src/ui/utils/rewindFileOps.ts
 import fs32 from "node:fs/promises";
+function isPartWithKey(part, key) {
+  return typeof part === "object" && part !== null && key in part;
+}
+function isToolResponseMessage(msg) {
+  if (msg.type !== "user" || !Array.isArray(msg.content) || msg.content.length === 0) {
+    return false;
+  }
+  const parts = msg.content;
+  return parts.some((p2) => isPartWithKey(p2, "functionResponse")) && parts.every(
+    (p2) => isPartWithKey(p2, "functionResponse") || isPartWithKey(p2, "inlineData") || isPartWithKey(p2, "fileData")
+  );
+}
 function calculateTurnStats(conversation, userMessage) {
   const msgIndex = conversation.messages.indexOf(userMessage);
   if (msgIndex === -1) return null;
@@ -81887,7 +81899,9 @@ function calculateTurnStats(conversation, userMessage) {
   let hasEdits = false;
   for (let i = msgIndex + 1; i < conversation.messages.length; i++) {
     const msg = conversation.messages[i];
-    if (msg.type === "user") break;
+    if (msg.type === "user" && !isToolResponseMessage(msg)) {
+      break;
+    }
     if (msg.type === "gemini" && msg.toolCalls) {
       for (const toolCall of msg.toolCalls) {
         const fileDiff = getFileDiffFromResultDisplay(toolCall.resultDisplay);
@@ -82246,7 +82260,9 @@ var RewindViewer = ({
     null
   );
   const interactions = (0, import_react76.useMemo)(
-    () => conversation.messages.filter((msg) => msg.type === "user"),
+    () => conversation.messages.filter(
+      (msg) => msg.type === "user" && !isToolResponseMessage(msg)
+    ),
     [conversation.messages]
   );
   const items = (0, import_react76.useMemo)(() => {
@@ -83532,7 +83548,7 @@ Use /mcp auth <server-name> to authenticate.`
         type: "info",
         text: `Starting OAuth authentication for MCP server '${serverName}'...`
       });
-      const { MCPOAuthProvider } = await import("./core-IUIZE6JW.js");
+      const { MCPOAuthProvider } = await import("./core-4P3HPH34.js");
       let oauthConfig = server.oauth;
       if (!oauthConfig) {
         oauthConfig = { enabled: false };

package/bundle/{chunk-UBGF6JU5.js → chunk-VOLZQW4I.js}

@@ -5,7 +5,7 @@ import {
   isTelemetrySdkInitialized,
   resetBrowserSession,
   shutdownTelemetry
-} from "./chunk-ZQW7OGUO.js";
+} from "./chunk-NR7L3FXV.js";
 
 // packages/cli/src/utils/cleanup.ts
 import { promises as fs } from "node:fs";

package/bundle/{chunk-VJYKQD5D.js → chunk-WLZT2COY.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   exitCli,
   require_source
-} from "./chunk-EDVFNWRG.js";
+} from "./chunk-ENBP32XB.js";
 import {
   DEFAULT_PORT,
   SERVER_START_WAIT_MS,
@@ -14,10 +14,10 @@ import {
   isServerRunning,
   resolveGemmaConfig,
   writeServerProcessInfo
-} from "./chunk-2NQXIWQK.js";
+} from "./chunk-PS4UL4AP.js";
 import {
   debugLogger
-} from "./chunk-6OFXOGEG.js";
+} from "./chunk-J7SXW2FI.js";
 import {
   __toESM
 } from "./chunk-34MYV7JD.js";

package/bundle/{cleanup-GGCB2LVD.js → cleanup-K7PKM5O3.js}

@@ -11,8 +11,8 @@ import {
   runSyncCleanup,
   setupSignalHandlers,
   setupTtyCheck
-} from "./chunk-SDWOC67Z.js";
-import "./chunk-6OFXOGEG.js";
+} from "./chunk-EV5MQULH.js";
+import "./chunk-J7SXW2FI.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";

package/bundle/{cleanup-JRDG3OTL.js → cleanup-NAOD2SQV.js}

@@ -11,8 +11,8 @@ import {
   runSyncCleanup,
   setupSignalHandlers,
   setupTtyCheck
-} from "./chunk-UBGF6JU5.js";
-import "./chunk-ZQW7OGUO.js";
+} from "./chunk-VOLZQW4I.js";
+import "./chunk-NR7L3FXV.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";

package/bundle/{cleanup-SSW6IXTR.js → cleanup-QRBWTWKF.js}

@@ -11,8 +11,8 @@ import {
   runSyncCleanup,
   setupSignalHandlers,
   setupTtyCheck
-} from "./chunk-UFQDAROY.js";
-import "./chunk-A4TO2DY2.js";
+} from "./chunk-HHALNKOO.js";
+import "./chunk-PZ4GDG24.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";

package/bundle/{core-IUIZE6JW.js → core-4P3HPH34.js}

@@ -68,6 +68,7 @@ import {
   COMPLETE_TASK_DISPLAY_NAME,
   COMPLETE_TASK_TOOL_NAME,
   CONFIRMATION_REQUIRED_PRIORITY,
+  CONTINUE_PROMPT_TEXT,
   CORE_TOOLS_FLAG_PRIORITY,
   CacheService,
   CanceledError,
@@ -267,6 +268,7 @@ import {
   INTEGRITY_FILENAME,
   INTEGRITY_KEY_FILENAME,
   INTERRUPTED_RESPONSE_PLACEHOLDER,
+  INTERRUPTED_TOOL_RESPONSE_ERROR,
   IdeClient,
   IdeConnectionEvent,
   IdeConnectionType,
@@ -555,6 +557,7 @@ import {
   authEvents,
   belongsInConfirmationQueue,
   buildG1Url,
+  buildInterruptedToolResponseParts,
   buildTodosReturnDisplay,
   buildToolResponseData,
   buildToolVisibilityContext,
@@ -578,6 +581,7 @@ import {
   cloneFunctionCall,
   cloneFunctionResponse,
   clonePart,
+  coalesceConsecutiveContents,
   coalesceConsecutiveRoles,
   computeModelAddedAndRemovedLines,
   concatenateInstructions,
@@ -646,6 +650,7 @@ import {
   enableMouseEvents,
   encodeTagName,
   ensureStableToolIds,
+  ensureTerminalUserTurn,
   enterAlternateScreen,
   escapePath,
   escapeShellArg,
@@ -1119,7 +1124,7 @@ import {
   wrapUntrusted,
   writeToStderr,
   writeToStdout
-} from "./chunk-A4TO2DY2.js";
+} from "./chunk-PZ4GDG24.js";
 import "./chunk-664ZODQF.js";
 import {
   SpanStatusCode,
@@ -1196,6 +1201,7 @@ export {
   COMPLETE_TASK_DISPLAY_NAME,
   COMPLETE_TASK_TOOL_NAME,
   CONFIRMATION_REQUIRED_PRIORITY,
+  CONTINUE_PROMPT_TEXT,
   CORE_TOOLS_FLAG_PRIORITY,
   CacheService,
   CanceledError,
@@ -1395,6 +1401,7 @@ export {
   INTEGRITY_FILENAME,
   INTEGRITY_KEY_FILENAME,
   INTERRUPTED_RESPONSE_PLACEHOLDER,
+  INTERRUPTED_TOOL_RESPONSE_ERROR,
   IdeClient,
   IdeConnectionEvent,
   IdeConnectionType,
@@ -1685,6 +1692,7 @@ export {
   authEvents,
   belongsInConfirmationQueue,
   buildG1Url,
+  buildInterruptedToolResponseParts,
   buildTodosReturnDisplay,
   buildToolResponseData,
   buildToolVisibilityContext,
@@ -1708,6 +1716,7 @@ export {
   cloneFunctionCall,
   cloneFunctionResponse,
   clonePart,
+  coalesceConsecutiveContents,
   coalesceConsecutiveRoles,
   computeModelAddedAndRemovedLines,
   concatenateInstructions,
@@ -1776,6 +1785,7 @@ export {
   enableMouseEvents,
   encodeTagName,
   ensureStableToolIds,
+  ensureTerminalUserTurn,
   enterAlternateScreen,
   escapePath,
   escapeShellArg,

package/bundle/{dist-7L3BRW6V.js → core-ICFDSJL3.js}

@@ -68,6 +68,7 @@ import {
   COMPLETE_TASK_DISPLAY_NAME,
   COMPLETE_TASK_TOOL_NAME,
   CONFIRMATION_REQUIRED_PRIORITY,
+  CONTINUE_PROMPT_TEXT,
   CORE_TOOLS_FLAG_PRIORITY,
   CacheService,
   CanceledError,
@@ -267,6 +268,7 @@ import {
   INTEGRITY_FILENAME,
   INTEGRITY_KEY_FILENAME,
   INTERRUPTED_RESPONSE_PLACEHOLDER,
+  INTERRUPTED_TOOL_RESPONSE_ERROR,
   IdeClient,
   IdeConnectionEvent,
   IdeConnectionType,
@@ -555,6 +557,7 @@ import {
   authEvents,
   belongsInConfirmationQueue,
   buildG1Url,
+  buildInterruptedToolResponseParts,
   buildTodosReturnDisplay,
   buildToolResponseData,
   buildToolVisibilityContext,
@@ -578,6 +581,7 @@ import {
   cloneFunctionCall,
   cloneFunctionResponse,
   clonePart,
+  coalesceConsecutiveContents,
   coalesceConsecutiveRoles,
   computeModelAddedAndRemovedLines,
   concatenateInstructions,
@@ -646,6 +650,7 @@ import {
   enableMouseEvents,
   encodeTagName,
   ensureStableToolIds,
+  ensureTerminalUserTurn,
   enterAlternateScreen,
   escapePath,
   escapeShellArg,
@@ -1119,7 +1124,7 @@ import {
   wrapUntrusted,
   writeToStderr,
   writeToStdout
-} from "./chunk-ZQW7OGUO.js";
+} from "./chunk-J7SXW2FI.js";
 import "./chunk-664ZODQF.js";
 import {
   SpanStatusCode,
@@ -1196,6 +1201,7 @@ export {
   COMPLETE_TASK_DISPLAY_NAME,
   COMPLETE_TASK_TOOL_NAME,
   CONFIRMATION_REQUIRED_PRIORITY,
+  CONTINUE_PROMPT_TEXT,
   CORE_TOOLS_FLAG_PRIORITY,
   CacheService,
   CanceledError,
@@ -1395,6 +1401,7 @@ export {
   INTEGRITY_FILENAME,
   INTEGRITY_KEY_FILENAME,
   INTERRUPTED_RESPONSE_PLACEHOLDER,
+  INTERRUPTED_TOOL_RESPONSE_ERROR,
   IdeClient,
   IdeConnectionEvent,
   IdeConnectionType,
@@ -1685,6 +1692,7 @@ export {
   authEvents,
   belongsInConfirmationQueue,
   buildG1Url,
+  buildInterruptedToolResponseParts,
   buildTodosReturnDisplay,
   buildToolResponseData,
   buildToolVisibilityContext,
@@ -1708,6 +1716,7 @@ export {
   cloneFunctionCall,
   cloneFunctionResponse,
   clonePart,
+  coalesceConsecutiveContents,
   coalesceConsecutiveRoles,
   computeModelAddedAndRemovedLines,
   concatenateInstructions,
@@ -1776,6 +1785,7 @@ export {
   enableMouseEvents,
   encodeTagName,
   ensureStableToolIds,
+  ensureTerminalUserTurn,
   enterAlternateScreen,
   escapePath,
   escapeShellArg,

package/bundle/{devtoolsService-3SADPKKB.js → devtoolsService-4MGN7S5K.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   coreEvents,
   debugLogger
-} from "./chunk-A4TO2DY2.js";
+} from "./chunk-J7SXW2FI.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -4324,7 +4324,7 @@ async function toggleDevToolsPanel(config, isOpen, toggle, setOpen) {
     return;
   }
   try {
-    const { openBrowserSecurely, shouldLaunchBrowser } = await import("./core-IUIZE6JW.js");
+    const { openBrowserSecurely, shouldLaunchBrowser } = await import("./core-ICFDSJL3.js");
     const url = await startDevToolsServer(config);
     if (shouldLaunchBrowser()) {
       try {

package/bundle/{devtoolsService-MF6JKRUV.js → devtoolsService-7CS2YIL6.js}

@@ -2,7 +2,7 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   coreEvents,
   debugLogger
-} from "./chunk-6OFXOGEG.js";
+} from "./chunk-PZ4GDG24.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -4324,7 +4324,7 @@ async function toggleDevToolsPanel(config, isOpen, toggle, setOpen) {
     return;
   }
   try {
-    const { openBrowserSecurely, shouldLaunchBrowser } = await import("./core-6HRWFQZW.js");
+    const { openBrowserSecurely, shouldLaunchBrowser } = await import("./core-4P3HPH34.js");
     const url = await startDevToolsServer(config);
     if (shouldLaunchBrowser()) {
       try {

package/bundle/{devtoolsService-XZCKFZP5.js → devtoolsService-LKOU7QN7.js}

@@ -3,7 +3,7 @@ import {
   CoreEvent,
   coreEvents,
   debugLogger
-} from "./chunk-ZQW7OGUO.js";
+} from "./chunk-NR7L3FXV.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -4325,7 +4325,7 @@ async function toggleDevToolsPanel(config, isOpen, toggle, setOpen) {
     return;
   }
   try {
-    const { openBrowserSecurely, shouldLaunchBrowser } = await import("./dist-7L3BRW6V.js");
+    const { openBrowserSecurely, shouldLaunchBrowser } = await import("./dist-YMXCTNJD.js");
     const url = await startDevToolsServer(config);
     if (shouldLaunchBrowser()) {
       try {

package/bundle/{core-6HRWFQZW.js → dist-YMXCTNJD.js}

@@ -68,6 +68,7 @@ import {
   COMPLETE_TASK_DISPLAY_NAME,
   COMPLETE_TASK_TOOL_NAME,
   CONFIRMATION_REQUIRED_PRIORITY,
+  CONTINUE_PROMPT_TEXT,
   CORE_TOOLS_FLAG_PRIORITY,
   CacheService,
   CanceledError,
@@ -267,6 +268,7 @@ import {
   INTEGRITY_FILENAME,
   INTEGRITY_KEY_FILENAME,
   INTERRUPTED_RESPONSE_PLACEHOLDER,
+  INTERRUPTED_TOOL_RESPONSE_ERROR,
   IdeClient,
   IdeConnectionEvent,
   IdeConnectionType,
@@ -555,6 +557,7 @@ import {
   authEvents,
   belongsInConfirmationQueue,
   buildG1Url,
+  buildInterruptedToolResponseParts,
   buildTodosReturnDisplay,
   buildToolResponseData,
   buildToolVisibilityContext,
@@ -578,6 +581,7 @@ import {
   cloneFunctionCall,
   cloneFunctionResponse,
   clonePart,
+  coalesceConsecutiveContents,
   coalesceConsecutiveRoles,
   computeModelAddedAndRemovedLines,
   concatenateInstructions,
@@ -646,6 +650,7 @@ import {
   enableMouseEvents,
   encodeTagName,
   ensureStableToolIds,
+  ensureTerminalUserTurn,
   enterAlternateScreen,
   escapePath,
   escapeShellArg,
@@ -1119,7 +1124,7 @@ import {
   wrapUntrusted,
   writeToStderr,
   writeToStdout
-} from "./chunk-6OFXOGEG.js";
+} from "./chunk-NR7L3FXV.js";
 import "./chunk-664ZODQF.js";
 import {
   SpanStatusCode,
@@ -1196,6 +1201,7 @@ export {
   COMPLETE_TASK_DISPLAY_NAME,
   COMPLETE_TASK_TOOL_NAME,
   CONFIRMATION_REQUIRED_PRIORITY,
+  CONTINUE_PROMPT_TEXT,
   CORE_TOOLS_FLAG_PRIORITY,
   CacheService,
   CanceledError,
@@ -1395,6 +1401,7 @@ export {
   INTEGRITY_FILENAME,
   INTEGRITY_KEY_FILENAME,
   INTERRUPTED_RESPONSE_PLACEHOLDER,
+  INTERRUPTED_TOOL_RESPONSE_ERROR,
   IdeClient,
   IdeConnectionEvent,
   IdeConnectionType,
@@ -1685,6 +1692,7 @@ export {
   authEvents,
   belongsInConfirmationQueue,
   buildG1Url,
+  buildInterruptedToolResponseParts,
   buildTodosReturnDisplay,
   buildToolResponseData,
   buildToolVisibilityContext,
@@ -1708,6 +1716,7 @@ export {
   cloneFunctionCall,
   cloneFunctionResponse,
   clonePart,
+  coalesceConsecutiveContents,
   coalesceConsecutiveRoles,
   computeModelAddedAndRemovedLines,
   concatenateInstructions,
@@ -1776,6 +1785,7 @@ export {
   enableMouseEvents,
   encodeTagName,
   ensureStableToolIds,
+  ensureTerminalUserTurn,
   enterAlternateScreen,
   escapePath,
   escapeShellArg,

package/bundle/docs/tools/mcp-server.md

@@ -326,17 +326,31 @@ This feature will not work in:
 
 <!-- prettier-ignore -->
 > [!IMPORTANT]
-> To protect against OAuth Identity Provider (IdP) mix-up attacks, Gemini CLI
-> validates the `iss` (issuer) parameter per
-> [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207). When an expected issuer is
-> discovered or configured, authorization servers **must** return the `iss`
-> parameter in the callback redirect matching the issuer URL. Responses missing
-> `iss` or with mismatched issuers are rejected with HTTP 400.
+> Gemini CLI validates the `iss` (issuer) parameter in OAuth authorization
+> responses per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207) and the MCP
+> specification:
+>
+> - Whenever the `iss` parameter is present in the callback redirect and an
+>   expected `issuer` is discovered or configured, `iss` **must** match the
+>   expected issuer URL.
+> - When the authorization server metadata sets
+>   `authorization_response_iss_parameter_supported: true`, the callback
+>   redirect **must** include the `iss` parameter.
+> - When the discovered authorization server metadata omits
+>   `authorization_response_iss_parameter_supported` or sets it to `false` (for
+>   example, providers that do not declare RFC 9207 support), callbacks without
+>   `iss` are accepted.
+> - When you configure `issuer` explicitly in `settings.json` and Gemini CLI
+>   doesn't discover authorization server metadata, the callback redirect
+>   **must** include the `iss` parameter. To accept callbacks without `iss` for
+>   such a server, set `authorizationResponseIssParameterSupported` to `false`
+>   in the `oauth` configuration.
 
 ##### Expected authorization callback example
 
-When the authorization server redirects the user back to Gemini CLI, the
-redirect URI must include the `iss` parameter:
+When the authorization server declares
+`authorization_response_iss_parameter_supported: true`, the redirect URI must
+include the `iss` parameter:
 
 ```http
 HTTP/1.1 302 Found
@@ -344,10 +358,14 @@ Location: http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE&iss=
 ```
 
 - **Valid response (accepted):** `iss` matches the configured or discovered
-  issuer (`https://auth.example.com`).
-- **Missing `iss` (rejected):**
-  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` (fails
-  with HTTP 400: `Missing issuer parameter in response`).
+  issuer (`https://auth.example.com`), or `iss` is omitted when the discovered
+  metadata doesn't set `authorization_response_iss_parameter_supported` to
+  `true`.
+- **Missing `iss` when required (rejected):**
+  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` when
+  `authorization_response_iss_parameter_supported` is `true`, or when `issuer`
+  is configured explicitly without discovered metadata (fails with HTTP 400:
+  `Missing issuer parameter in response`).
 - **Mismatched `iss` (rejected):** `iss` points to a different domain or
   includes userinfo (fails with HTTP 400: `Issuer mismatch`).
 
@@ -373,6 +391,12 @@ If your remote MCP server uses an authorization server with a known issuer URL:
 }
 ```
 
+With this configuration, Gemini CLI requires the `iss` parameter in the
+authorization callback. If the authorization server doesn't return `iss` in its
+redirects, add `"authorizationResponseIssParameterSupported": false` to the
+`oauth` block. Gemini CLI then accepts callbacks without `iss` while still
+rejecting any `iss` value that doesn't match the configured `issuer`.
+
 #### Managing OAuth authentication
 
 Use the `/mcp auth` command to manage OAuth authentication:
@@ -398,6 +422,11 @@ Use the `/mcp auth` command to manage OAuth authentication:
   if omitted)
 - **`issuer`** (string): Authorization server issuer URL (auto-discovered if
   omitted; validated per RFC 9207)
+- **`authorizationResponseIssParameterSupported`** (boolean): Whether the
+  authorization server returns the `iss` parameter in authorization responses
+  (RFC 9207). Auto-discovered from the authorization server metadata; defaults
+  to `true` when `issuer` is configured explicitly without discovered metadata.
+  Set to `false` to accept callbacks without `iss` for such a server.
 - **`tokenUrl`** (string): OAuth token endpoint (auto-discovered if omitted)
 - **`scopes`** (string[]): Required OAuth scopes
 - **`redirectUri`** (string): Custom redirect URI (defaults to an OS-assigned