fix(acp/auth): prevent conflicting credentials on enterprise gateways and support optional API keys natively

[sripasg]

Summary

Configures the GATEWAY authentication mode to supply an empty string for apiKey instead of injecting a dummy placeholder, avoiding client instantiation errors while natively suppressing conflicting x-goog-api-key headers. Additionally, updates ACP session initialization to infer GATEWAY auth when custom proxy URLs are active, allowing sidecar agents to connect without needing placeholder environment variables.

Details

Why this happened:
Previously, initializing a session with the GATEWAY auth method without specifying an API key caused the underlying @google/genai SDK to throw a constructor initialization error.

To circumvent this, a placeholder key ('gateway-placeholder-key') was automatically injected. However, the SDK's internal WebAuth module unconditionally appended this placeholder as an x-goog-api-key header to outgoing network requests.

When enterprise AI API Gateways received both an OIDC authentication header (e.g., Authorization: Bearer <token>) and the invalid placeholder key, they prioritized validating the API key and rejected the requests. Furthermore, partner IDE sidecars initializing sessions via ACP were forced to provide dummy GEMINI_API_KEY environment variables to bypass the agent's default startup assertions.

Solution Implemented:

1. Pristine SDK Configuration: Configured createContentGeneratorConfig to supply an empty string (apiKey ?? '') when GATEWAY auth is used without an explicit key. This fulfills the SDK constructor's null check while preventing unwanted key injection.
2. Network Header Suppression: Updated createContentGenerator to pre-clear the x-goog-api-key base header (headers['x-goog-api-key'] = '') whenever GATEWAY auth runs with an empty string key. This triggers an early return inside the SDK's WebAuth interceptor, guaranteeing that outgoing requests heading to enterprise Gateways remain pristine.
3. Robust ACP Handshake: Refined acpSessionManager.ts to natively infer AuthType.GATEWAY if the environment configures a custom gateway URL (GOOGLE_GEMINI_BASE_URL). This cleanly bypasses default USE_GEMINI startup validations, eliminating the need for partner IDEs to inject dummy environment keys.

Related Issues

Fixes google-gemini/maintainers-gemini-cli#1663

How to Validate

No regressions in unit tests and get Partner IDEs to help validate.

Pre-Merge Checklist

• [NA] Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• [NA] Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[github-actions]

Size Change: +480 B (0%)

Total Size: 34.1 MB

Filename	Size	Change
./bundle/chunk-27P7JD2H.js	0 B	-19.5 kB (removed)	🏆
./bundle/chunk-IPDMLRKJ.js	0 B	-12.5 kB (removed)	🏆
./bundle/chunk-M2H4B6E2.js	0 B	-3.77 kB (removed)	🏆
./bundle/chunk-Q4JYN6SP.js	0 B	-3.43 kB (removed)	🏆
./bundle/chunk-RMLBDK2H.js	0 B	-2.78 MB (removed)	🏆
./bundle/chunk-UC3C6JAE.js	0 B	-658 kB (removed)	🏆
./bundle/chunk-UZILLJJA.js	0 B	-49.2 kB (removed)	🏆
./bundle/chunk-W6U2OIHJ.js	0 B	-16.8 MB (removed)	🏆
./bundle/core-XB4H5IOB.js	0 B	-49.1 kB (removed)	🏆
./bundle/devtoolsService-2D5P6OCE.js	0 B	-28 kB (removed)	🏆
./bundle/gemini-OK5SLEEZ.js	0 B	-584 kB (removed)	🏆
./bundle/interactiveCli-3QEOF54N.js	0 B	-1.3 MB (removed)	🏆
./bundle/liteRtServerManager-Y7H7LIGB.js	0 B	-2.08 kB (removed)	🏆
./bundle/oauth2-provider-SMY6E2IM.js	0 B	-9.12 kB (removed)	🏆
./bundle/chunk-CDSUFGPE.js	658 kB	+658 kB (new file)	🆕
./bundle/chunk-DV4ILZTI.js	2.78 MB	+2.78 MB (new file)	🆕
./bundle/chunk-EAEFASJ5.js	19.5 kB	+19.5 kB (new file)	🆕
./bundle/chunk-HIQDECNN.js	16.8 MB	+16.8 MB (new file)	🆕
./bundle/chunk-QWKLGUSY.js	12.5 kB	+12.5 kB (new file)	🆕
./bundle/chunk-R36Z7EA4.js	3.77 kB	+3.77 kB (new file)	🆕
./bundle/chunk-WZN7QZG6.js	3.43 kB	+3.43 kB (new file)	🆕
./bundle/chunk-XKXTVMYW.js	49.2 kB	+49.2 kB (new file)	🆕
./bundle/core-BGLJXBTM.js	49.1 kB	+49.1 kB (new file)	🆕
./bundle/devtoolsService-3QRJW5J2.js	28 kB	+28 kB (new file)	🆕
./bundle/gemini-YVPTGO4X.js	584 kB	+584 kB (new file)	🆕
./bundle/interactiveCli-YSBQ24JP.js	1.3 MB	+1.3 MB (new file)	🆕
./bundle/liteRtServerManager-DVQ7SIUL.js	2.08 kB	+2.08 kB (new file)	🆕
./bundle/oauth2-provider-DS22BSIJ.js	9.12 kB	+9.12 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size	Change
./bundle/bundled/third_party/index.js	8 MB	0 B
./bundle/chunk-34MYV7JD.js	2.45 kB	0 B
./bundle/chunk-5AUYMPVF.js	858 B	0 B
./bundle/chunk-5PS3AYFU.js	1.18 kB	0 B
./bundle/chunk-664ZODQF.js	124 kB	0 B
./bundle/chunk-DAHVX5MI.js	206 kB	0 B
./bundle/chunk-IUUIT4SU.js	56.5 kB	0 B
./bundle/chunk-RJTRUG2J.js	39.8 kB	0 B
./bundle/cleanup-NRJPX67E.js	0 B	-902 B (removed)	🏆
./bundle/devtools-36NN55EP.js	696 kB	0 B
./bundle/dist-T73EYRDX.js	356 B	0 B
./bundle/events-XB7DADIJ.js	418 B	0 B
./bundle/examples/hooks/scripts/on-start.js	188 B	0 B
./bundle/examples/mcp-server/example.js	1.43 kB	0 B
./bundle/gemini.js	5.07 kB	0 B
./bundle/getMachineId-bsd-TXG52NKR.js	1.55 kB	0 B
./bundle/getMachineId-darwin-7OE4DDZ6.js	1.55 kB	0 B
./bundle/getMachineId-linux-SHIFKOOX.js	1.34 kB	0 B
./bundle/getMachineId-unsupported-5U5DOEYY.js	1.06 kB	0 B
./bundle/getMachineId-win-6KLLGOI4.js	1.72 kB	0 B
./bundle/multipart-parser-KPBZEGQU.js	11.7 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js	222 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js	229 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js	13.4 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js	132 B	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B
./bundle/src-QVCVGIUX.js	47 kB	0 B
./bundle/start-7I55JO6Y.js	0 B	-622 B (removed)	🏆
./bundle/tree-sitter-7U6MW5PS.js	274 kB	0 B
./bundle/tree-sitter-bash-34ZGLXVX.js	1.84 MB	0 B
./bundle/cleanup-GYGLWKIP.js	902 B	+902 B (new file)	🆕
./bundle/start-CUKFTL3C.js	622 B	+622 B (new file)	🆕

_{compressed-size-action}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the handling of enterprise gateway authentication by removing reliance on placeholder API keys. By allowing empty strings for keys and explicitly suppressing the 'x-goog-api-key' header, the system now integrates more cleanly with enterprise gateways that enforce strict header validation. Additionally, the session initialization logic has been streamlined to detect gateway configurations automatically, simplifying the setup process for partner IDEs.

Highlights

• Gateway Authentication Refinement: Replaced the hardcoded 'gateway-placeholder-key' with an empty string for GATEWAY auth to prevent SDK initialization errors while avoiding unwanted header injection.
• Header Suppression: Implemented explicit clearing of the 'x-goog-api-key' header when using GATEWAY auth with an empty key to ensure compatibility with enterprise AI gateways.
• Improved ACP Initialization: Updated the session manager to automatically infer GATEWAY authentication when a custom base URL is present, removing the need for dummy environment variables.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the GATEWAY authentication logic to use an empty string instead of a placeholder for missing API keys and ensures the 'x-goog-api-key' header is correctly populated. It also introduces logic to automatically infer GATEWAY authentication when a custom base URL is detected. Feedback suggests centralizing the auth type inference logic in the core package to avoid duplication and ensure consistency across the application. Additionally, there is a concern that existing logic might convert the empty string API key back to undefined before it reaches the SDK constructor, which could prevent the fix from working as intended.

_{Note: Security Review is unavailable for this PR.}