fix(core): preserve refresh_token in file-based cacheCredentials and …

[ProthamD]

Fixes #21691

Situation:
Upstream PR #26924 resolved the refresh_token overwrite issue for users with GEMINI_FORCE_ENCRYPTED_FILE_STORAGE=true. However, issue #21691 still persisted for users relying on the default file-based storage (cacheCredentials in oauth2.ts), causing refresh_token loss during Google access token rotation. Additionally, the deleteCredentials method threw an error if the credential didn't exist, leading to a cascading failure loop blocking re-authentication after session expiration.

Task:
Fix the file-based credentials cache to merge the new access token with the existing refresh token, and refactor the keychain token deletion to be idempotent.

Action:

• Modified cacheCredentials in oauth2.ts to read and parse the existing oauth_creds.json file. It now defensively merges the existing refresh_token (after verifying it's a non-empty string) with the new payload to prevent overwriting. Caught errors are correctly narrowed to ENOENT to prevent swallowing valid I/O exceptions.
• Updated deleteCredentials in KeychainTokenStorage to silently no-op when the credential to be deleted is missing, ensuring idempotent behaviour during session clear loops.
• Added comprehensive unit and regression tests in oauth2.test.ts and keychain-token-storage.test.ts to verify these behaviors.

Result:
Users on file-based storage will no longer lose their refresh_token during normal rotation cycles. The re-authentication flow is now stable since clearCredentials handles missing sessions gracefully without crashing. 53/53 tests pass.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses critical issues in the OAuth credential management flow. It ensures that file-based storage correctly merges new access tokens with existing refresh tokens rather than overwriting them, and improves the robustness of the keychain deletion process by making it idempotent. These changes stabilize the re-authentication cycle and prevent errors when clearing sessions.

Highlights

• Credential Persistence: Modified the file-based credential cache to preserve existing refresh tokens during OAuth token rotation, preventing accidental loss of authentication state.
• Idempotent Deletion: Refactored deleteCredentials to treat missing credentials as a successful no-op, preventing cascading failures during session clear loops.
• Testing: Added comprehensive unit and regression tests to verify token preservation and idempotent deletion behaviors.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces robust credential management handling. Specifically, it preserves the existing refresh_token in cacheCredentials when a token rotation event from Google omits it, and it treats missing credentials as a successful no-op in deleteCredentials within KeychainTokenStorage to ensure idempotency. Corresponding unit tests have been added and updated to verify these behaviors. I have no feedback to provide as there are no active review comments.

[github-actions]

📊 PR Size: size/M

• Lines changed: 205
• Additions: +193
• Deletions: -12
• Files changed: 4

[ProthamD]

hello @scidomino , if you have some time , could you please give this PR a review?

[scidomino]

I no longer work on GCLI.

[ProthamD]

Ohh okey