@koreanhole/opencodex 3.2.13 → 3.2.14

package/AGENTS_INSTALL.md

@@ -26,7 +26,7 @@ To use Gemini instead, authenticate it through its official CLI and select the
 provider:
 
 ```bash
-gemini   # complete the official OAuth login or configure an API key
+gemini   # complete the official OAuth login (no API key required) or configure an API key
 ocx provider add gemini-cli --set-default
 ocx start
 ocx codex sync

package/README.md

@@ -36,7 +36,10 @@ Gemini headless turns support an explicit Gemini Developer API key, Vertex AI
 GenAI configuration, or the operator's existing Gemini CLI OAuth login. opencodex
 does not automate Google OAuth. OAuth reuse requires an account and tier eligible
 for the installed Gemini CLI's service; explicit API-key or Vertex environment
-configuration takes precedence over automatic OAuth selection.
+configuration takes precedence over automatic OAuth selection. With no explicit
+environment authentication, OAuth is selected automatically, including logins
+stored in the vendor keychain or under a custom `GEMINI_CLI_HOME`; no API key is
+required.
 
 Cline 2.2.0 is the minimum supported release. Newer options are used only when
 the installed binary advertises them.
@@ -170,6 +173,7 @@ bun test tests
 bun run test:e2e
 bun run test:e2e:cline-live
 bun run test:e2e:gemini
+bun run test:e2e:gemini-oauth-only
 bun run test:e2e:gemini-slow
 bun run test:e2e:gemini-parent-tool
 bun run privacy:scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@koreanhole/opencodex",
-  "version": "3.2.13",
+  "version": "3.2.14",
   "description": "Full opencodex runtime with Cline 2.2.0+ JSON and Gemini CLI headless provider adapters",
   "type": "module",
   "main": "./bin/package-main.mjs",
@@ -32,6 +32,7 @@
     "test:e2e": "bun test tests/e2e/cline-only.test.ts",
     "test:e2e:cline-live": "bun test ./tests/e2e/cline-live.live.ts",
     "test:e2e:gemini": "bun test ./tests/e2e/gemini-codex.live.ts -t \"full-stack:\"",
+    "test:e2e:gemini-oauth-only": "bun test ./tests/e2e/gemini-oauth-only.test.ts",
     "test:e2e:gemini-slow": "bun test ./tests/e2e/gemini-codex.live.ts -t \"full-stack: a slow Gemini start\"",
     "test:e2e:gemini-tool": "bun test ./tests/e2e/gemini-codex.live.ts -t \"one short Gemini turn leaves the workspace unchanged\"",
     "test:e2e:gemini-multiturn": "bun test ./tests/e2e/gemini-codex.live.ts -t \"reuses a live Codex multi-turn session\"",

package/src/adapters/cli-agent/gemini/headless.ts

@@ -1,4 +1,5 @@
 import { spawn as nodeSpawn, type ChildProcess } from "node:child_process";
+import { existsSync } from "node:fs";
 import { link, lstat, mkdir, mkdtemp, readFile, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -47,6 +48,8 @@ const FORWARDED_ENV_KEYS = [
   "GOOGLE_CLOUD_LOCATION",
   "GOOGLE_APPLICATION_CREDENTIALS",
   "GOOGLE_GEMINI_BASE_URL",
+  "GEMINI_FORCE_ENCRYPTED_FILE_STORAGE",
+  "GEMINI_FORCE_FILE_STORAGE",
   "GEMINI_API_KEY_AUTH_MECHANISM",
   "GOOGLE_GENAI_API_VERSION",
   "GEMINI_SYSTEM_MD",
@@ -61,7 +64,7 @@ const FORWARDED_ENV_KEYS = [
 
 const AUTH_FILE_NAMES = ["oauth_creds.json", "google_accounts.json", ".env"] as const;
 const OAUTH_AUTH_FILE_NAMES = ["oauth_creds.json", "google_accounts.json"] as const;
-type GeminiHeadlessAuth = "oauth" | "environment" | "default";
+type GeminiHeadlessAuth = "oauth" | "environment";
 
 export interface GeminiHeadlessDeps extends CliAgentTurnDeps {
   env?: NodeJS.ProcessEnv;
@@ -98,6 +101,30 @@ function asString(value: unknown): string | undefined {
   return typeof value === "string" ? value : undefined;
 }
 
+function geminiHeadlessAuth(sourceEnv: NodeJS.ProcessEnv): GeminiHeadlessAuth {
+  if (enabled(sourceEnv.GOOGLE_GENAI_USE_GCA)) return "oauth";
+  if (
+    nonEmpty(sourceEnv.GEMINI_API_KEY)
+    || nonEmpty(sourceEnv.GOOGLE_API_KEY)
+    || enabled(sourceEnv.GOOGLE_GENAI_USE_VERTEXAI)
+    || nonEmpty(sourceEnv.GOOGLE_GEMINI_BASE_URL)
+  ) return "environment";
+  if (
+    existsSync(join(geminiVendorHome(sourceEnv), ".gemini", "oauth_creds.json"))
+    || enabled(sourceEnv.GEMINI_FORCE_ENCRYPTED_FILE_STORAGE)
+  ) return "oauth";
+  // Preserve the legacy vendor .env fallback when it is the only auth source.
+  if (existsSync(join(geminiVendorHome(sourceEnv), ".gemini", ".env"))) return "environment";
+  return "oauth";
+}
+
+function geminiVendorHome(sourceEnv: NodeJS.ProcessEnv): string {
+  return nonEmpty(sourceEnv.GEMINI_CLI_HOME)
+    ?? nonEmpty(sourceEnv.HOME)
+    ?? nonEmpty(sourceEnv.USERPROFILE)
+    ?? homedir();
+}
+
 function safeMessage(value: unknown, fallback: string): string {
   const raw = typeof value === "string"
     ? value
@@ -134,6 +161,7 @@ export function buildGeminiHeadlessEnv(
     const value = nonEmpty(sourceEnv[key]);
     if (value) env[key] = value;
   }
+  if (geminiHeadlessAuth(sourceEnv) === "oauth") env.GOOGLE_GENAI_USE_GCA = "true";
   Object.assign(env, {
     GEMINI_CLI_TRUST_WORKSPACE: "true",
     GEMINI_CLI_NO_RELAUNCH: "1",
@@ -262,7 +290,7 @@ function geminiMcpSettings(
 function geminiSystemSettings(
   reasoning?: GeminiReasoningSelection,
   mcpServers?: Record<string, unknown>,
-  auth: GeminiHeadlessAuth = "default",
+  auth: GeminiHeadlessAuth = "oauth",
 ): string {
   const settings = JSON.parse(GEMINI_SYSTEM_SETTINGS) as Record<string, unknown>;
   if (auth === "oauth") {
@@ -311,24 +339,7 @@ export async function stageGeminiHeadlessWorkspace(
   const capturePath = catalog.length > 0 ? join(root, "tool-intents.ndjson") : undefined;
   const mcpServers = geminiMcpSettings(catalog, options.mcp, catalogPath, capturePath);
   const sourceEnv = options.sourceEnv ?? process.env;
-  const realHome = nonEmpty(sourceEnv.HOME) ?? nonEmpty(sourceEnv.USERPROFILE) ?? homedir();
-  let oauthAvailable = false;
-  try {
-    await lstat(join(realHome, ".gemini", "oauth_creds.json"));
-    oauthAvailable = true;
-  } catch {
-    // No existing vendor OAuth login to reuse.
-  }
-  const auth: GeminiHeadlessAuth = enabled(sourceEnv.GOOGLE_GENAI_USE_GCA)
-    ? "oauth"
-    : nonEmpty(sourceEnv.GEMINI_API_KEY)
-      || nonEmpty(sourceEnv.GOOGLE_API_KEY)
-      || enabled(sourceEnv.GOOGLE_GENAI_USE_VERTEXAI)
-      || nonEmpty(sourceEnv.GOOGLE_GEMINI_BASE_URL)
-      ? "environment"
-      : oauthAvailable
-        ? "oauth"
-        : "default";
+  const auth = geminiHeadlessAuth(sourceEnv);
   const exclusive = options.root === undefined;
   const writeOptions = { encoding: "utf8" as const, mode: 0o600, ...(exclusive ? { flag: "wx" as const } : {}) };
   await mkdir(geminiConfigDir, { recursive: true, mode: 0o700 });
@@ -353,8 +364,7 @@ async function linkGeminiAuth(
   sourceEnv: NodeJS.ProcessEnv,
   auth: GeminiHeadlessAuth,
 ): Promise<void> {
-  const realHome = nonEmpty(sourceEnv.HOME) ?? nonEmpty(sourceEnv.USERPROFILE) ?? homedir();
-  const realGemini = join(realHome, ".gemini");
+  const realGemini = join(geminiVendorHome(sourceEnv), ".gemini");
   const names = auth === "oauth" ? OAUTH_AUTH_FILE_NAMES : AUTH_FILE_NAMES;
   await Promise.all(names.map(async name => {
     const target = join(realGemini, name);

package/src/cli/index.ts

@@ -71,7 +71,7 @@ function help(): string {
     "  help                                   Show this help",
     "",
     "Providers: cline-cli, gemini-cli",
-    "Gemini authentication is managed by Gemini CLI (`gemini` or GEMINI_API_KEY).",
+    "Gemini authentication is managed by Gemini CLI (OAuth login or GEMINI_API_KEY).",
   ].join("\n");
 }
 
@@ -148,7 +148,7 @@ async function providerCommand(args: string[]): Promise<number> {
 async function loginCommand(args: string[]): Promise<number> {
   const provider = args.shift();
   if (provider === GEMINI_PROVIDER_ID) {
-    throw new ConfigError("Gemini authentication is managed by Gemini CLI. Run `gemini` to log in or set GEMINI_API_KEY for the CLI.");
+    throw new ConfigError("Gemini authentication is managed by Gemini CLI. Run `gemini` to log in with Google; no API key is required. Alternatively, set GEMINI_API_KEY for the CLI.");
   }
   if (provider !== CLINE_PROVIDER_ID) throw new ConfigError("Only `login cline-cli` is supported; authenticate Gemini through Gemini CLI.");
   const json = takeFlag(args, "--json");