@koreanhole/opencodex 3.2.6 → 3.2.8

package/AGENTS_INSTALL.md

@@ -26,7 +26,7 @@ To use Gemini instead, authenticate it through its official CLI and select the
 provider:
 
 ```bash
-gemini   # configure a Gemini Developer API or Vertex AI API key
+gemini   # complete the official OAuth login or configure an API key
 ocx provider add gemini-cli --set-default
 ocx start
 ocx codex sync
@@ -52,10 +52,14 @@ or through the documented default path; unrelated Codex settings are not changed
   mode-0600 request-scoped copy; remove that copy after the turn.
 - Do not import or replay Gemini OAuth/API-key material; the Gemini CLI remains
   the authentication authority.
-- Third-party use must use a Gemini Developer API key or Vertex AI GenAI API key.
-  Gemini CLI's official FAQ identifies third-party use of its personal Google
-  OAuth authentication as a terms violation. OAuth is not a supported
-  opencodex setup path.
+- Gemini headless turns support explicit Gemini Developer API, Vertex AI GenAI,
+  or the operator's existing Gemini CLI OAuth login. opencodex does not automate
+  OAuth login or copy OAuth tokens. OAuth reuse requires an account and tier
+  eligible for the installed CLI's service, and the operator remains responsible
+  for vendor terms.
+- Explicit process-environment API-key, Vertex, or gateway configuration takes
+  precedence over automatic OAuth selection. An explicit
+  `GOOGLE_GENAI_USE_GCA=true` selects OAuth.
 - The proxy writes under `$OPENCODEX_HOME` (default `~/.opencodex`) and may update
   the active opencodex Codex model catalog selected by `model_catalog_json`.
 
@@ -86,6 +90,7 @@ bun run verify:upstream
 bun run typecheck
 bun test tests/e2e/cline-only.test.ts
 bun run test:e2e:gemini
+bun run test:e2e:gemini-oauth
 bun run test:e2e:gemini-tool
 bun run test:e2e:gemini-reasoning
 bun run test:e2e:codex-restore
@@ -94,4 +99,6 @@ bun run test:e2e:codex-restore
 Report whether each evidence path used a deterministic fixture or a real
 vendor binary/account. The Gemini command above is a hard live gate: missing
 binaries, authentication, a Flash Lite model, or cleanup evidence must fail.
+The OAuth gate additionally removes API-key/Vertex environment values and the
+vendor `.env`.
 Never report a skipped or synthetic run as a real login.

package/README.md

@@ -31,8 +31,11 @@ npm install -g @google/gemini-cli
 gemini
 ```
 
-For third-party clients, use a Gemini Developer API key or Vertex AI GenAI API
-key. Do not use personal Google OAuth for third-party software.
+Gemini headless turns support an explicit Gemini Developer API key, Vertex AI
+GenAI configuration, or the operator's existing Gemini CLI OAuth login. opencodex
+does not automate Google OAuth. OAuth reuse requires an account and tier eligible
+for the installed Gemini CLI's service; explicit API-key or Vertex environment
+configuration takes precedence over automatic OAuth selection.
 
 ## Start
 
@@ -157,6 +160,7 @@ bun run typecheck
 bun test tests
 bun run test:e2e
 bun run test:e2e:gemini
+bun run test:e2e:gemini-oauth
 bun run test:e2e:gemini-slow
 bun run test:e2e:gemini-parent-tool
 bun run privacy:scan
@@ -168,6 +172,9 @@ a real Codex client and a real authenticated Gemini CLI. It runs both the minima
 completion and a 12-second pre-event slow-start regression. It fails, not skips,
 on a missing binary, authentication, Flash Lite model, response marker, timeout,
 or child cleanup assertion. `test:e2e:gemini-slow` runs only the slow-start case.
+`test:e2e:gemini-oauth` strips API-key and Vertex environment values, removes the
+vendor `.env`, and requires a real OAuth-backed completion through Codex and the
+installed Gemini CLI.
 
 Optional overrides are `CLINE_BIN_PATH`, `GEMINI_BIN_PATH`, and
 `CODEX_BIN_PATH`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@koreanhole/opencodex",
-  "version": "3.2.6",
+  "version": "3.2.8",
   "description": "Full opencodex runtime with Cline JSON and Gemini CLI headless provider adapters",
   "type": "module",
   "main": "./bin/package-main.mjs",
@@ -31,6 +31,7 @@
     "test": "bun test tests",
     "test:e2e": "bun test tests/e2e/cline-only.test.ts",
     "test:e2e:gemini": "bun test ./tests/e2e/gemini-codex.live.ts -t \"full-stack:\"",
+    "test:e2e:gemini-oauth": "bun test ./tests/e2e/gemini-codex.live.ts -t \"uses an existing Gemini CLI OAuth login without an API key\"",
     "test:e2e:gemini-slow": "bun test ./tests/e2e/gemini-codex.live.ts -t \"full-stack: a slow Gemini start\"",
     "test:e2e:gemini-tool": "bun test ./tests/e2e/gemini-codex.live.ts -t \"one short Gemini turn leaves the workspace unchanged\"",
     "test:e2e:gemini-multiturn": "bun test ./tests/e2e/gemini-codex.live.ts -t \"reuses a live Codex multi-turn session\"",

package/src/adapters/cli-agent/gemini/headless.ts

@@ -60,6 +60,8 @@ const FORWARDED_ENV_KEYS = [
 ] as const;
 
 const AUTH_FILE_NAMES = ["oauth_creds.json", "google_accounts.json", ".env"] as const;
+const OAUTH_AUTH_FILE_NAMES = ["oauth_creds.json", "google_accounts.json"] as const;
+type GeminiHeadlessAuth = "oauth" | "environment" | "default";
 
 export interface GeminiHeadlessDeps extends CliAgentTurnDeps {
   env?: NodeJS.ProcessEnv;
@@ -82,6 +84,10 @@ function nonEmpty(value: unknown): string | undefined {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 
+function enabled(value: unknown): boolean {
+  return nonEmpty(value)?.toLowerCase() === "true";
+}
+
 function asRecord(value: unknown): Record<string, unknown> | undefined {
   return value && typeof value === "object" && !Array.isArray(value)
     ? value as Record<string, unknown>
@@ -256,8 +262,12 @@ function geminiMcpSettings(
 function geminiSystemSettings(
   reasoning?: GeminiReasoningSelection,
   mcpServers?: Record<string, unknown>,
+  auth: GeminiHeadlessAuth = "default",
 ): string {
   const settings = JSON.parse(GEMINI_SYSTEM_SETTINGS) as Record<string, unknown>;
+  if (auth === "oauth") {
+    settings.security = { auth: { selectedType: "oauth-personal" } };
+  }
   settings.tools = { core: mcpServers ? ["mcp_opencodex_*"] : [] };
   settings.mcp = mcpServers
     ? { allowed: [GEMINI_MCP_SERVER_NAME], excluded: [] }
@@ -300,15 +310,34 @@ export async function stageGeminiHeadlessWorkspace(
   const catalog = options.catalog ?? [];
   const capturePath = catalog.length > 0 ? join(root, "tool-intents.ndjson") : undefined;
   const mcpServers = geminiMcpSettings(catalog, options.mcp, catalogPath, capturePath);
+  const sourceEnv = options.sourceEnv ?? process.env;
+  const realHome = nonEmpty(sourceEnv.HOME) ?? nonEmpty(sourceEnv.USERPROFILE) ?? homedir();
+  let oauthAvailable = false;
+  try {
+    await lstat(join(realHome, ".gemini", "oauth_creds.json"));
+    oauthAvailable = true;
+  } catch {
+    // No existing vendor OAuth login to reuse.
+  }
+  const auth: GeminiHeadlessAuth = enabled(sourceEnv.GOOGLE_GENAI_USE_GCA)
+    ? "oauth"
+    : nonEmpty(sourceEnv.GEMINI_API_KEY)
+      || nonEmpty(sourceEnv.GOOGLE_API_KEY)
+      || enabled(sourceEnv.GOOGLE_GENAI_USE_VERTEXAI)
+      || nonEmpty(sourceEnv.GOOGLE_GEMINI_BASE_URL)
+      ? "environment"
+      : oauthAvailable
+        ? "oauth"
+        : "default";
   const exclusive = options.root === undefined;
   const writeOptions = { encoding: "utf8" as const, mode: 0o600, ...(exclusive ? { flag: "wx" as const } : {}) };
   await mkdir(geminiConfigDir, { recursive: true, mode: 0o700 });
   await Promise.all([
-    writeFile(settingsPath, geminiSystemSettings(reasoning, mcpServers), writeOptions),
+    writeFile(settingsPath, geminiSystemSettings(reasoning, mcpServers, auth), writeOptions),
     writeFile(catalogPath, JSON.stringify(catalog), writeOptions),
     ...(capturePath ? [writeFile(capturePath, "", writeOptions)] : []),
   ]);
-  await linkGeminiAuth(geminiConfigDir, options.sourceEnv ?? process.env);
+  await linkGeminiAuth(geminiConfigDir, sourceEnv, auth);
   return {
     root,
     geminiHome,
@@ -319,10 +348,15 @@ export async function stageGeminiHeadlessWorkspace(
   };
 }
 
-async function linkGeminiAuth(targetDir: string, sourceEnv: NodeJS.ProcessEnv): Promise<void> {
+async function linkGeminiAuth(
+  targetDir: string,
+  sourceEnv: NodeJS.ProcessEnv,
+  auth: GeminiHeadlessAuth,
+): Promise<void> {
   const realHome = nonEmpty(sourceEnv.HOME) ?? nonEmpty(sourceEnv.USERPROFILE) ?? homedir();
   const realGemini = join(realHome, ".gemini");
-  await Promise.all(AUTH_FILE_NAMES.map(async name => {
+  const names = auth === "oauth" ? OAUTH_AUTH_FILE_NAMES : AUTH_FILE_NAMES;
+  await Promise.all(names.map(async name => {
     const target = join(realGemini, name);
     try {
       await lstat(target);