fix(cli): allow keychain auth for --list-sessions and non-interactive mode

[cocosheng-g]

Summary

Fixes a bug where --list-sessions and other commands bypassing the interactive UI would fail immediately if the GEMINI_API_KEY environment variable was not set, even if a valid key was saved in the internal keychain via /auth.

Details

The initial authentication validation logic in packages/cli was strictly checking the environment variable synchronously. This PR refactors validateAuthMethod to be asynchronous, allowing it to utilize the core loadApiKey() function to check the keychain. All callers of validateAuthMethod in the CLI have been updated to await the result.

Related Issues

Fixes #26906

How to Validate

1. Store an API key using the interactive /auth command (or ensure one is present in the internal keychain).
2. Unset the GEMINI_API_KEY environment variable.
3. Run gemini --list-sessions.
4. The command should successfully list sessions instead of crashing with an auth error.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an authentication issue where non-interactive CLI commands would fail if the GEMINI_API_KEY environment variable was not explicitly set, even if a valid key existed in the internal keychain. By refactoring the authentication validation logic to be asynchronous, the CLI can now reliably retrieve and validate keys from the keychain, improving the user experience for automated or scripted workflows.

Highlights

• Asynchronous Authentication Validation: Refactored the validateAuthMethod function to be asynchronous, enabling the CLI to check for API keys stored in the keychain when the GEMINI_API_KEY environment variable is missing.
• Improved Non-Interactive CLI Support: Updated commands like --list-sessions to correctly handle keychain-based authentication in non-interactive modes, preventing unnecessary failures.
• Codebase Updates: Updated all callers of validateAuthMethod and validateAuthMethodWithSettings to await the result, ensuring consistent asynchronous behavior across the CLI.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Size Change: +547 B (0%)

Total Size: 34.1 MB

Filename	Size	Change
./bundle/chunk-AVIWTPL7.js	0 B	-659 kB (removed)	🏆
./bundle/chunk-BYLHYSJA.js	0 B	-49.2 kB (removed)	🏆
./bundle/chunk-MGMD4LY3.js	0 B	-12.5 kB (removed)	🏆
./bundle/chunk-MNEQSJMN.js	0 B	-19.5 kB (removed)	🏆
./bundle/chunk-S3A7QBEB.js	0 B	-2.78 MB (removed)	🏆
./bundle/chunk-VFABT4TQ.js	0 B	-14.8 MB (removed)	🏆
./bundle/chunk-W3YQBVQE.js	0 B	-3.43 kB (removed)	🏆
./bundle/chunk-ZLHZDE2Y.js	0 B	-3.8 kB (removed)	🏆
./bundle/core-VUHPUM4F.js	0 B	-49.3 kB (removed)	🏆
./bundle/devtoolsService-JHJK43MU.js	0 B	-28 kB (removed)	🏆
./bundle/gemini-7XOUUJNB.js	0 B	-587 kB (removed)	🏆
./bundle/interactiveCli-GMWYK5SA.js	0 B	-1.3 MB (removed)	🏆
./bundle/liteRtServerManager-I43VLEYD.js	0 B	-2.11 kB (removed)	🏆
./bundle/oauth2-provider-5RVDCT7H.js	0 B	-9.16 kB (removed)	🏆
./bundle/chunk-7P4HQXGE.js	49.2 kB	+49.2 kB (new file)	🆕
./bundle/chunk-7SX2T3CY.js	19.5 kB	+19.5 kB (new file)	🆕
./bundle/chunk-7WICGDQW.js	3.8 kB	+3.8 kB (new file)	🆕
./bundle/chunk-JZ3ZTPVS.js	2.79 MB	+2.79 MB (new file)	🆕
./bundle/chunk-KPRLGNXC.js	12.5 kB	+12.5 kB (new file)	🆕
./bundle/chunk-UQ6J3GQR.js	14.8 MB	+14.8 MB (new file)	🆕
./bundle/chunk-X2J6JUAI.js	659 kB	+659 kB (new file)	🆕
./bundle/chunk-ZJSJBXVY.js	3.43 kB	+3.43 kB (new file)	🆕
./bundle/core-UC3WZGPU.js	49.3 kB	+49.3 kB (new file)	🆕
./bundle/devtoolsService-JRMQAWQZ.js	28 kB	+28 kB (new file)	🆕
./bundle/gemini-PNFAA6SN.js	587 kB	+587 kB (new file)	🆕
./bundle/interactiveCli-UV3CHSMR.js	1.3 MB	+1.3 MB (new file)	🆕
./bundle/liteRtServerManager-DPZFULUX.js	2.11 kB	+2.11 kB (new file)	🆕
./bundle/oauth2-provider-Z4BKUTUG.js	9.16 kB	+9.16 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size	Change
./bundle/bundled/third_party/index.js	8 MB	0 B
./bundle/chunk-34MYV7JD.js	2.45 kB	0 B
./bundle/chunk-5AUYMPVF.js	858 B	0 B
./bundle/chunk-5PS3AYFU.js	1.18 kB	0 B
./bundle/chunk-664ZODQF.js	124 kB	0 B
./bundle/chunk-DAHVX5MI.js	206 kB	0 B
./bundle/chunk-IUUIT4SU.js	56.5 kB	0 B
./bundle/chunk-N22WUHJE.js	1.97 MB	0 B
./bundle/chunk-RJTRUG2J.js	39.8 kB	0 B
./bundle/cleanup-SNVIYRI4.js	0 B	-932 B (removed)	🏆
./bundle/devtools-36NN55EP.js	696 kB	0 B
./bundle/dist-T73EYRDX.js	356 B	0 B
./bundle/events-XB7DADIJ.js	418 B	0 B
./bundle/examples/hooks/scripts/on-start.js	188 B	0 B
./bundle/examples/mcp-server/example.js	1.43 kB	0 B
./bundle/gemini.js	5.1 kB	0 B
./bundle/getMachineId-bsd-TXG52NKR.js	1.55 kB	0 B
./bundle/getMachineId-darwin-7OE4DDZ6.js	1.55 kB	0 B
./bundle/getMachineId-linux-SHIFKOOX.js	1.34 kB	0 B
./bundle/getMachineId-unsupported-5U5DOEYY.js	1.06 kB	0 B
./bundle/getMachineId-win-6KLLGOI4.js	1.72 kB	0 B
./bundle/memoryDiscovery-ALKMYAPP.js	980 B	0 B
./bundle/multipart-parser-KPBZEGQU.js	11.7 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js	222 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js	229 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js	13.4 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js	132 B	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B
./bundle/src-QVCVGIUX.js	47 kB	0 B
./bundle/start-BS4X2ZTP.js	0 B	-652 B (removed)	🏆
./bundle/tree-sitter-7U6MW5PS.js	274 kB	0 B
./bundle/tree-sitter-bash-34ZGLXVX.js	1.84 MB	0 B
./bundle/cleanup-3QYNZ6SF.js	932 B	+932 B (new file)	🆕
./bundle/start-4B5ZFRMF.js	652 B	+652 B (new file)	🆕

_{compressed-size-action}

[gemini-code-assist]

Code Review

This pull request converts validateAuthMethod and validateAuthMethodWithSettings into asynchronous functions to support the integration of loadApiKey from the core package. These changes are reflected across the CLI's authentication logic and UI components, with corresponding updates to the test suites to handle the new async behavior. Feedback was provided regarding AppContainer.tsx to avoid using an unsafe type assertion and ESLint disable by capturing the authentication type in a local variable before the asynchronous closure.

[cocosheng-g]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the authentication validation logic within the CLI to be asynchronous. The validateAuthMethod and validateAuthMethodWithSettings functions now return Promises, enabling the use of loadApiKey from the core package when the GEMINI_API_KEY environment variable is missing. These changes necessitated updates to the main CLI execution flow, React UI components, and hooks, as well as significant updates to the Vitest test suites to accommodate the async transitions. I have no feedback to provide.

_{Note: Security Review did not run due to the size of the PR.}

[devr0306]

/gemini review

[gemini-code-assist]

Code Review

This pull request transitions authentication validation to an asynchronous model to support dynamic API key loading, affecting core validation functions, UI components, and the main CLI entry point. The review feedback highlights critical omissions in error handling and potential race conditions within asynchronous flows in AppContainer.tsx, useAuth.ts, and AuthDialog.tsx. Implementing the suggested try...catch blocks and state validation checks is necessary to ensure UI stability and prevent unhandled promise rejections.

_{Note: Security Review did not run due to the size of the PR.}

[devr0306]

Please address bot comments but LGTM!