agentshim 0.16.0__tar.gz → 0.17.0__tar.gz

{agentshim-0.16.0 → agentshim-0.17.0}/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.17.0 (2026-10-15)
+
+### Added
+
+- `host_auth_plan(profile, env=, home=)` returns the `AuthPlan` that reproduces how the
+  CLI logs in by itself on a host: the first present credential source of any kind, plus
+  the host's endpoint variables exactly as set, so a confined copy given only the plan
+  sends the same credential to the same place. A host base URL is reproduced, not
+  validated, and a credential goes to the host's endpoint whatever its kind (Claude Code
+  sends `CLAUDE_CODE_OAUTH_TOKEN` to a custom `ANTHROPIC_BASE_URL`). It raises
+  `HostAuthUnplannableError`, whose `reason` (`HostAuthGap`) is `UNCLASSIFIED`,
+  `NO_CREDENTIAL`, `EXTERNAL_CREDENTIAL` or `SETTINGS_ENV`, when no plan can reproduce
+  the host's login.
+- `ExternalCredential`, a `CredentialSource` for a way the CLI logs in that no plan can
+  hand over, detected by variables, paths or settings keys. Claude declares a cloud
+  provider (`CLAUDE_CODE_USE_BEDROCK`, `_VERTEX`, `_FOUNDRY`), `apiKeyHelper`, and
+  Anthropic profiles at their documented places in its precedence; Gemini declares an
+  auth type selected in settings or by variable, and `.gemini/.env`.
+- `ProviderProfile.settings` (`SettingsSpec`): the settings files a CLI reads at start
+  that can change how it logs in, and the key of the block it applies over its
+  environment (Claude's `env`).
+
+### Changed
+
+- `CredentialSource` is now `EnvCredential | FileCredential | ExternalCredential`;
+  code that matched on two variants must handle the third. `plan_auth` never chooses an
+  `ExternalCredential` and names a present one in `AuthPlan.withheld`.
+
 ## 0.16.0 (2026-10-14)
 
 ### Added

{agentshim-0.16.0 → agentshim-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentshim
-Version: 0.16.0
+Version: 0.17.0
 Summary: Provider-agnostic coding-agent CLI shims
 License-Expression: MIT
 License-File: LICENSE

{agentshim-0.16.0 → agentshim-0.17.0}/agentshim/__init__.py

@@ -40,9 +40,12 @@ from .core import (
     EndpointSpec,
     EnvCredential,
     EventHandlerBase,
+    ExternalCredential,
     FailureKind,
     FileCredential,
     FlagsInstallation,
+    HostAuthGap,
+    HostAuthUnplannableError,
     HttpMcpServer,
     IdAllocator,
     InMemoryCheckpointStore,
@@ -88,6 +91,7 @@ from .core import (
     SessionStarted,
     SessionState,
     SessionStateError,
+    SettingsSpec,
     SkillInvoked,
     SkillScope,
     SkillsDiscovered,
@@ -123,6 +127,7 @@ from .core import (
     cost_usd,
     default_pricing,
     dialect_problems,
+    host_auth_plan,
     install_config_file,
     interactive_env,
     materialize,
@@ -166,7 +171,7 @@ from .providers.opencode import OpencodeProvider
 from .runtime import Agent
 from .session import Session, Turn, TurnTicket, map_mcp_servers
 
-__version__ = "0.16.0"
+__version__ = "0.17.0"
 
 __all__ = [
     "Agent",
@@ -219,10 +224,13 @@ __all__ = [
     "EndpointSpec",
     "EnvCredential",
     "EventHandlerBase",
+    "ExternalCredential",
     "FailureKind",
     "FileCredential",
     "FlagsInstallation",
     "GeminiProvider",
+    "HostAuthGap",
+    "HostAuthUnplannableError",
     "HostCommandExecutor",
     "HostProcess",
     "HttpMcpServer",
@@ -278,6 +286,7 @@ __all__ = [
     "SessionStarted",
     "SessionState",
     "SessionStateError",
+    "SettingsSpec",
     "SkillInvoked",
     "SkillScope",
     "SkillSignal",
@@ -322,6 +331,7 @@ __all__ = [
     "default_pricing",
     "dialect_problems",
     "get_provider",
+    "host_auth_plan",
     "install_config_file",
     "interactive_env",
     "map_mcp_servers",

{agentshim-0.16.0 → agentshim-0.17.0}/agentshim/core/__init__.py

@@ -15,8 +15,13 @@ from .auth import (
     CredentialSource,
     EndpointSpec,
     EnvCredential,
+    ExternalCredential,
     FileCredential,
+    HostAuthGap,
+    HostAuthUnplannableError,
+    SettingsSpec,
     StagedCredentialFile,
+    host_auth_plan,
     plan_auth,
 )
 from .checkpoints import Checkpoint, CheckpointStore, InMemoryCheckpointStore
@@ -153,9 +158,12 @@ __all__ = [
     "EndpointSpec",
     "EnvCredential",
     "EventHandlerBase",
+    "ExternalCredential",
     "FailureKind",
     "FileCredential",
     "FlagsInstallation",
+    "HostAuthGap",
+    "HostAuthUnplannableError",
     "HttpMcpServer",
     "IdAllocator",
     "InMemoryCheckpointStore",
@@ -201,6 +209,7 @@ __all__ = [
     "SessionStarted",
     "SessionState",
     "SessionStateError",
+    "SettingsSpec",
     "SkillInvoked",
     "SkillScope",
     "SkillSignal",
@@ -236,6 +245,7 @@ __all__ = [
     "cost_usd",
     "default_pricing",
     "dialect_problems",
+    "host_auth_plan",
     "install_config_file",
     "interactive_env",
     "materialize",

{agentshim-0.16.0 → agentshim-0.17.0}/agentshim/core/auth.py

@@ -16,6 +16,12 @@ exact environment variables and files to deliver. The caller delivers the
 plan and nothing more of the provider's ``auth_env_vars`` or ``auth_files``;
 the readiness probe then reports which kind of credential the CLI says it is
 using (``ProviderStatus.credential``), so the caller can confirm it.
+
+A caller with no policy of its own, that wants a confined copy of the CLI to
+log in exactly as the CLI would on the host, asks ``host_auth_plan`` instead:
+it applies the CLI's own precedence with every kind allowed and the host's
+endpoint as it is, and refuses (``HostAuthUnplannableError``) when the host
+CLI would log in some way a plan cannot reproduce.
 """
 
 from __future__ import annotations
@@ -85,7 +91,49 @@ class FileCredential:
         return self.classify(contents)
 
 
-CredentialSource = EnvCredential | FileCredential
+@dataclass(frozen=True)
+class ExternalCredential:
+    """A way the CLI logs in that no plan can hand to another copy of it.
+
+    A cloud provider selected by a variable (whose own credentials live in
+    other tools' state), a helper command named in a settings file, a
+    credential store outside the CLI's state root. It is declared at its place
+    in the precedence order so ``host_auth_plan`` knows when the host CLI would
+    use it; ``plan_auth`` never chooses it. It is present when any variable in
+    ``env`` is set, any home-relative path in ``paths`` exists, or any of the
+    profile's ``settings`` files has one of ``settings_keys`` at its top level.
+    """
+
+    label: str
+    env: tuple[str, ...] = ()
+    paths: tuple[str, ...] = ()
+    settings_keys: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        """Require some way to detect the credential."""
+        if not (self.env or self.paths or self.settings_keys):
+            msg = f"ExternalCredential {self.label!r} needs an env, paths or settings_keys entry"
+            raise ValueError(msg)
+
+
+CredentialSource = EnvCredential | FileCredential | ExternalCredential
+#: The sources a plan can hand over.
+_DeliverableSource = EnvCredential | FileCredential
+
+
+@dataclass(frozen=True)
+class SettingsSpec:
+    """The JSON settings files a CLI reads from its home when it starts.
+
+    ``files`` are home-relative paths. ``env_key`` names a top-level object
+    whose string entries the CLI applies over its own environment (Claude
+    Code's ``env``), or ``None`` when the CLI has no such block. Settings can
+    change which credential or endpoint the CLI uses, so ``host_auth_plan``
+    reads them; neither plan function delivers them.
+    """
+
+    files: tuple[str, ...]
+    env_key: str | None = None
 
 
 @dataclass(frozen=True)
@@ -170,6 +218,37 @@ class AuthUnavailableError(AgentShimError):
     """
 
 
+class HostAuthGap(str, Enum):
+    """Why ``host_auth_plan`` cannot reproduce how the host CLI logs in.
+
+    ``UNCLASSIFIED``: the profile declares no credential sources. ``NO_CREDENTIAL``:
+    none of the declared sources is present, so the CLI either cannot log in
+    or does it some way agentshim does not know. ``EXTERNAL_CREDENTIAL``: the
+    CLI would use an ``ExternalCredential``. ``SETTINGS_ENV``: a settings file
+    sets a credential or endpoint variable of its own, so the environment the
+    CLI logs in with is not the caller's.
+    """
+
+    UNCLASSIFIED = "unclassified"
+    NO_CREDENTIAL = "no_credential"
+    EXTERNAL_CREDENTIAL = "external_credential"
+    SETTINGS_ENV = "settings_env"
+
+
+class HostAuthUnplannableError(AgentShimError):
+    """The host CLI's login cannot be reproduced by a plan; ``reason`` says why.
+
+    The message names the variables or files involved, never a value. A caller
+    that still wants the CLI logged in elsewhere has only the host's whole auth
+    state (``auth_env_vars`` and ``auth_files``) to hand over.
+    """
+
+    def __init__(self, reason: HostAuthGap, message: str) -> None:
+        """Record *reason* beside the message."""
+        super().__init__(message)
+        self.reason = reason
+
+
 def plan_auth(
     profile: ProviderProfile,
     policy: AuthPolicy,
@@ -205,10 +284,6 @@ def plan_auth(
             {name: env[name] for name in profile.endpoint.companion_env if _set(env, name)}
         )
 
-    delivered = set(delivered_env) | {staged.home_path for staged in files}
-    on_host = {name for name in _host_auth_names(profile) if _set(env, name)}
-    on_host |= {path for path in profile.auth_files if (home / path).is_file()}
-    on_host |= set(present)
     return AuthPlan(
         provider=profile.name,
         credential=kind,
@@ -216,7 +291,61 @@ def plan_auth(
         endpoint=policy.endpoint,
         env=MappingProxyType(delivered_env),
         files=files,
-        withheld=tuple(sorted(on_host - delivered)),
+        withheld=_withheld(profile, env, home, present, _delivered(delivered_env, files)),
+    )
+
+
+def host_auth_plan(profile: ProviderProfile, *, env: Mapping[str, str], home: Path) -> AuthPlan:
+    """Say how *profile*'s CLI logs in by itself on a host, as a plan a confined copy can use.
+
+    The CLI's own choice: the first present source in ``credential_sources``,
+    of any kind, at whatever endpoint *env* points it to. The plan delivers
+    that credential, and the host's endpoint variables (``EndpointSpec``
+    ``base_url_env`` and ``companion_env``) exactly as they are set, so a
+    confined copy given only the plan sends the same credential to the same
+    place. ``AuthPlan.endpoint`` is the host's base URL, or ``None`` for the
+    vendor's endpoint.
+
+    The host's base URL is reproduced, not validated: a value the CLI cannot
+    use fails the copy the same way it fails the host CLI (Claude Code fails
+    every request with "Invalid URL" and never falls back to its vendor). The
+    credential's kind is not checked against ``EndpointSpec.credentials``
+    either: what the CLI does with a credential and a custom endpoint is the
+    CLI's behaviour, and the copy reproduces it.
+
+    Raises:
+        HostAuthUnplannableError: the profile declares no credential sources,
+            none is present, the CLI would log in with an
+            ``ExternalCredential``, or a settings file sets a credential or
+            endpoint variable; ``reason`` is the matching ``HostAuthGap``.
+    """
+    if not profile.credential_sources:
+        msg = f"{profile.name} declares no credential sources agentshim can classify"
+        raise HostAuthUnplannableError(HostAuthGap.UNCLASSIFIED, msg)
+    settings = _read_settings(profile, home)
+    _refuse_settings_env(profile, settings)
+    chosen, kind = _host_choice(profile, env, home, settings)
+    delivered_env: dict[str, str] = {}
+    files: tuple[StagedCredentialFile, ...] = ()
+    if isinstance(chosen, EnvCredential):
+        delivered_env[chosen.name] = env[chosen.name]
+    else:
+        refreshable = kind is CredentialKind.SUBSCRIPTION
+        files = (StagedCredentialFile(home / chosen.path, chosen.path, refreshable),)
+    endpoint: str | None = None
+    if profile.endpoint is not None:
+        names = (profile.endpoint.base_url_env, *profile.endpoint.companion_env)
+        delivered_env.update({name: env[name] for name in names if _set(env, name)})
+        endpoint = delivered_env.get(profile.endpoint.base_url_env)
+    present = _present_names(profile, env, home, settings)
+    return AuthPlan(
+        provider=profile.name,
+        credential=kind,
+        source=_name(chosen),
+        endpoint=endpoint,
+        env=MappingProxyType(delivered_env),
+        files=files,
+        withheld=_withheld(profile, env, home, present, _delivered(delivered_env, files)),
     )
 
 
@@ -270,11 +399,14 @@ def _choose(
     allowed: frozenset[CredentialKind],
     env: Mapping[str, str],
     home: Path,
-) -> tuple[CredentialSource, CredentialKind, list[str]]:
+) -> tuple[_DeliverableSource, CredentialKind, list[str]]:
     """The first present allowed source, its kind, and every present source's name."""
-    chosen: tuple[CredentialSource, CredentialKind] | None = None
+    chosen: tuple[_DeliverableSource, CredentialKind] | None = None
     present: list[str] = []
     for source in profile.credential_sources:
+        if isinstance(source, ExternalCredential):
+            present += _external_found(profile, source, env, home)
+            continue
         kind = _present_kind(source, env, home)
         if kind is None:
             continue
@@ -286,8 +418,134 @@ def _choose(
     return chosen[0], chosen[1], present
 
 
+def _host_choice(
+    profile: ProviderProfile,
+    env: Mapping[str, str],
+    home: Path,
+    settings: Mapping[str, dict[str, Any]],
+) -> tuple[_DeliverableSource, CredentialKind]:
+    """The source the CLI itself would log in with: the first present one, of any kind."""
+    for source in profile.credential_sources:
+        if isinstance(source, ExternalCredential):
+            found = _external_found(profile, source, env, home, settings)
+            if found:
+                msg = (
+                    f"{profile.name} would log in with {source.label} "
+                    f"({', '.join(found)}), which no plan can hand to another copy of it"
+                )
+                raise HostAuthUnplannableError(HostAuthGap.EXTERNAL_CREDENTIAL, msg)
+            continue
+        kind = _present_kind(source, env, home)
+        if kind is not None:
+            return source, kind
+    wanted = ", ".join(
+        _name(source)
+        for source in profile.credential_sources
+        if not isinstance(source, ExternalCredential)
+    )
+    msg = f"no credential {profile.name} logs in with is present: none of {wanted}"
+    raise HostAuthUnplannableError(HostAuthGap.NO_CREDENTIAL, msg)
+
+
+def _read_settings(profile: ProviderProfile, home: Path) -> dict[str, dict[str, Any]]:
+    """Each of *profile*'s settings files that holds a JSON object, by path."""
+    out: dict[str, dict[str, Any]] = {}
+    for path in profile.settings.files if profile.settings is not None else ():
+        try:
+            data: Any = json.loads((home / path).read_bytes())
+        except (OSError, ValueError):
+            continue
+        if isinstance(data, dict):
+            out[path] = cast("dict[str, Any]", data)
+    return out
+
+
+def _refuse_settings_env(profile: ProviderProfile, settings: Mapping[str, dict[str, Any]]) -> None:
+    """Raise when a settings file's env block sets a variable the CLI logs in with."""
+    key = profile.settings.env_key if profile.settings is not None else None
+    if key is None:
+        return
+    names = _host_auth_names(profile) | _credential_env_names(profile)
+    for path, data in settings.items():
+        block: Any = data.get(key)
+        if not isinstance(block, dict):
+            continue
+        overridden = sorted(names & set(cast("dict[str, Any]", block)))
+        if overridden:
+            msg = (
+                f"{path} sets {', '.join(overridden)} in its {key!r} block, so "
+                f"{profile.name} does not log in with the caller's environment"
+            )
+            raise HostAuthUnplannableError(HostAuthGap.SETTINGS_ENV, msg)
+
+
+def _external_found(
+    profile: ProviderProfile,
+    source: ExternalCredential,
+    env: Mapping[str, str],
+    home: Path,
+    settings: Mapping[str, dict[str, Any]] | None = None,
+) -> list[str]:
+    """What of *source* is on the host: set variables, existing paths, settings keys."""
+    found = [name for name in source.env if _set(env, name)]
+    found += [path for path in source.paths if (home / path).exists()]
+    if source.settings_keys:
+        loaded = _read_settings(profile, home) if settings is None else settings
+        found += [
+            f"{key} in {path}"
+            for path, data in loaded.items()
+            for key in source.settings_keys
+            if key in data
+        ]
+    return found
+
+
+def _present_names(
+    profile: ProviderProfile,
+    env: Mapping[str, str],
+    home: Path,
+    settings: Mapping[str, dict[str, Any]],
+) -> list[str]:
+    """The names of every declared source present on the host."""
+    names: list[str] = []
+    for source in profile.credential_sources:
+        if isinstance(source, ExternalCredential):
+            names += _external_found(profile, source, env, home, settings)
+        elif _present_kind(source, env, home) is not None:
+            names.append(_name(source))
+    return names
+
+
+def _withheld(
+    profile: ProviderProfile,
+    env: Mapping[str, str],
+    home: Path,
+    present: list[str],
+    delivered: set[str],
+) -> tuple[str, ...]:
+    """The names of the host's auth state a plan delivering *delivered* leaves out."""
+    on_host = {name for name in _host_auth_names(profile) if _set(env, name)}
+    on_host |= {path for path in profile.auth_files if (home / path).is_file()}
+    on_host |= set(present)
+    return tuple(sorted(on_host - delivered))
+
+
+def _delivered(env: Mapping[str, str], files: tuple[StagedCredentialFile, ...]) -> set[str]:
+    return set(env) | {staged.home_path for staged in files}
+
+
+def _credential_env_names(profile: ProviderProfile) -> set[str]:
+    names: set[str] = set()
+    for source in profile.credential_sources:
+        if isinstance(source, EnvCredential):
+            names.add(source.name)
+        elif isinstance(source, ExternalCredential):
+            names.update(source.env)
+    return names
+
+
 def _present_kind(
-    source: CredentialSource, env: Mapping[str, str], home: Path
+    source: _DeliverableSource, env: Mapping[str, str], home: Path
 ) -> CredentialKind | None:
     if isinstance(source, EnvCredential):
         return source.kind if _set(env, source.name) else None
@@ -304,7 +562,7 @@ def _set(env: Mapping[str, str], name: str) -> bool:
     return bool(value and value.strip())
 
 
-def _name(source: CredentialSource) -> str:
+def _name(source: _DeliverableSource) -> str:
     return source.name if isinstance(source, EnvCredential) else source.path
 
 
@@ -326,7 +584,8 @@ def _unavailable(
     wanted = [
         _name(source)
         for source in profile.credential_sources
-        if source.kind is None or source.kind in allowed
+        if not isinstance(source, ExternalCredential)
+        and (source.kind is None or source.kind in allowed)
     ]
     found = f"; present but not allowed: {', '.join(present)}" if present else ""
     return (

{agentshim-0.16.0 → agentshim-0.17.0}/agentshim/core/profile.py

@@ -16,7 +16,7 @@ from .permissions import NativeMode
 if TYPE_CHECKING:
     from collections.abc import Mapping
 
-    from .auth import CredentialSource, EndpointSpec
+    from .auth import CredentialSource, EndpointSpec, SettingsSpec
 
 
 class McpMechanism(Enum):
@@ -224,10 +224,16 @@ class ProviderProfile:
     supports_steer: bool = False
     #: The credentials the CLI can log in with, in the CLI's own precedence
     #: order (0.16.0+). ``plan_auth`` walks them to choose the one credential
-    #: a caller hands the CLI. Every variable is in ``auth_env_vars`` and every
-    #: file in ``credential_files``. Empty means the CLI's credentials cannot
-    #: be classified, so no credential policy can be enforced for it.
+    #: a caller hands the CLI, and ``host_auth_plan`` (0.17.0+) to find the
+    #: one the CLI would pick by itself. Every ``EnvCredential`` variable is in
+    #: ``auth_env_vars`` and every ``FileCredential`` file in
+    #: ``credential_files``; an ``ExternalCredential`` (0.17.0+) is a way to
+    #: log in that no plan can hand over. Empty means the CLI's credentials
+    #: cannot be classified, so no credential policy can be enforced for it.
     credential_sources: tuple[CredentialSource, ...] = ()
     #: How the CLI is pointed at another API endpoint, or ``None`` if it
     #: cannot be (0.16.0+).
     endpoint: EndpointSpec | None = None
+    #: The settings files the CLI reads at start that can change how it logs
+    #: in, or ``None`` if it has none (0.17.0+).
+    settings: SettingsSpec | None = None

{agentshim-0.16.0 → agentshim-0.17.0}/agentshim/providers/claude/provider.py

@@ -9,7 +9,9 @@ from agentshim.core.auth import (
     CredentialKind,
     EndpointSpec,
     EnvCredential,
+    ExternalCredential,
     FileCredential,
+    SettingsSpec,
 )
 from agentshim.core.errors import FailureKind, ProviderCapabilityError, SessionResumeError
 from agentshim.core.mcp import HttpMcpServer, NoopInstallation, StdioMcpServer, install_config_file
@@ -110,16 +112,33 @@ PROFILE = ProviderProfile(
         ".claude.json",
     ),
     credential_files=(".claude/.credentials.json",),
-    # Precedence as ``claude auth status`` reports it: a bearer token beats an
-    # API key, which beats a subscription token (``claude setup-token``),
-    # which beats the stored Claude.ai login.
+    # Precedence as Claude Code documents it ("Authentication precedence",
+    # code.claude.com/docs/en/iam): a cloud provider selected by variable,
+    # then a bearer token, an API key, the ``apiKeyHelper`` setting, a
+    # subscription token (``claude setup-token``), an Anthropic profile or
+    # federation credential, and last the stored Claude.ai login. Checked
+    # against 2.1.300: ``apiKeyHelper`` beats CLAUDE_CODE_OAUTH_TOKEN.
     credential_sources=(
+        ExternalCredential(
+            "a cloud provider",
+            env=("CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY"),
+        ),
         EnvCredential("ANTHROPIC_AUTH_TOKEN", CredentialKind.API_KEY),
         EnvCredential("ANTHROPIC_API_KEY", CredentialKind.API_KEY),
+        ExternalCredential("an apiKeyHelper command", settings_keys=("apiKeyHelper",)),
         EnvCredential("CLAUDE_CODE_OAUTH_TOKEN", CredentialKind.SUBSCRIPTION),
+        ExternalCredential(
+            "an Anthropic profile or federation credential",
+            env=("ANTHROPIC_PROFILE", "ANTHROPIC_FEDERATION_RULE_ID"),
+            paths=(".config/anthropic/configs", ".config/anthropic/active_config"),
+        ),
         FileCredential(".claude/.credentials.json", kind=CredentialKind.SUBSCRIPTION),
     ),
     endpoint=EndpointSpec("ANTHROPIC_BASE_URL", companion_env=("ANTHROPIC_CUSTOM_HEADERS",)),
+    # User settings; the ``env`` block overrides the process environment
+    # (checked against 2.1.300: a settings ANTHROPIC_BASE_URL beats an
+    # exported one).
+    settings=SettingsSpec((".claude/settings.json", ".claude/settings.local.json"), env_key="env"),
     mcp_config_file=MCP_CONFIG_FILENAME,
 )
 

{agentshim-0.16.0 → agentshim-0.17.0}/agentshim/providers/gemini/provider.py

@@ -18,7 +18,13 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, Any
 
-from agentshim.core.auth import CredentialKind, EnvCredential, FileCredential
+from agentshim.core.auth import (
+    CredentialKind,
+    EnvCredential,
+    ExternalCredential,
+    FileCredential,
+    SettingsSpec,
+)
 from agentshim.core.errors import ProviderCapabilityError, SessionResumeError
 from agentshim.core.mcp import (
     HttpMcpServer,
@@ -82,11 +88,22 @@ PROFILE = ProviderProfile(
         ".gemini/.env",
     ),
     credential_files=(".gemini/oauth_creds.json",),
+    # Gemini CLI uses the auth type selected in settings (or by a
+    # GOOGLE_GENAI_USE_* variable) before any key in the environment, and
+    # loads a ``.gemini/.env`` into its environment; none of that is
+    # modelled, so any of it makes the host login unplannable.
     credential_sources=(
+        ExternalCredential(
+            "an auth type selected in settings, by variable, or in a .env file",
+            env=("GOOGLE_GENAI_USE_VERTEXAI", "GOOGLE_GENAI_USE_GCA"),
+            paths=(".gemini/.env",),
+            settings_keys=("security", "selectedAuthType"),
+        ),
         EnvCredential("GEMINI_API_KEY", CredentialKind.API_KEY),
         EnvCredential("GOOGLE_API_KEY", CredentialKind.API_KEY),
         FileCredential(".gemini/oauth_creds.json", kind=CredentialKind.SUBSCRIPTION),
     ),
+    settings=SettingsSpec((".gemini/settings.json",)),
     mcp_config_file=MCP_CONFIG_FILENAME,
 )
 

{agentshim-0.16.0 → agentshim-0.17.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentshim"
-version = "0.16.0"
+version = "0.17.0"
 description = "Provider-agnostic coding-agent CLI shims"
 readme = "README.md"
 license = "MIT"