Skip to content

Fix/auth url wrapping - #29460

Closed
anshumancodes wants to merge 6 commits into
google-gemini:mainfrom
anshumancodes:fix/auth-url-wrapping
Closed

Fix/auth url wrapping#29460
anshumancodes wants to merge 6 commits into
google-gemini:mainfrom
anshumancodes:fix/auth-url-wrapping

Conversation

@anshumancodes

@anshumancodes anshumancodes commented Sep 23, 2026

Copy link
Copy Markdown

Summary

Fixes an issue where long Google OAuth URLs could be truncated when wrapped by the terminal, causing authentication to fail with Error 400: invalid_request.

The OAuth URLs are now rendered using OSC 8 terminal hyperlinks so the complete URL remains intact even when the visible URL wraps across terminal lines.

Details

  • Added OSC 8 hyperlink support for bare HTTPS URLs in the CLI markdown rendering pipeline.
  • Wrapped the raw OAuth URL in an OSC 8 hyperlink before writing it directly to stdout.
  • Preserved the complete OAuth URL, including query parameters such as redirect_uri, response_type, and client_id, as the hyperlink target.
  • Updated the rendering flow documentation to clarify the interaction between sanitization, ANSI parsing, and OSC 8 sequences.
  • Added tests covering OSC 8 rendering and OAuth URL parameter preservation.

Related Issues

Fixes #29430

issue 29430

How to Validate

  1. Run the CLI and start the authentication flow:
gemini
  1. Run:
/auth

  1. Start the Google authentication flow.

  2. Use a narrow terminal width so that the OAuth URL wraps across multiple lines.

  3. Click the displayed OAuth URL.

  4. Verify that the browser receives the complete OAuth URL, including parameters such as redirect_uri, response_type, and client_id, rather than only the first wrapped line.

  5. Run the relevant tests:

npm test
  1. Verify that the URL rendering tests pass, including OSC 8 rendering and OAuth query parameter preservation.

Pre-Merge Checklist

  • Updated relevant documentation and README (if needed)

  • Added/updated tests (if needed)

  • Noted breaking changes (if any)

  • Validated on required platforms/methods:

    • MacOS

      • npm run
      • npx
      • Docker
      • Podman
      • Seatbelt

    • Windows

      • npm run
      • npx
      • Docker

    • Linux

      • npm run
      • npx
      • Docker

@anshumancodes
anshumancodes requested a review from a team as a code owner September 23, 2026 07:43
@github-actions github-actions Bot added the size/s A small PR label Sep 23, 2026
@github-actions

github-actions Bot commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown

📊 PR Size: size/M

  • Lines changed: 67
  • Additions: +62
  • Deletions: -5
  • Files changed: 4

@gemini-code-assist

gemini-code-assist Bot commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a usability issue where long OAuth URLs displayed in the CLI were being truncated by terminal word-wrapping, leading to authentication failures. By implementing OSC 8 terminal hyperlink sequences, the full URL is now preserved as a single clickable entity, ensuring that the entire query string is correctly passed to the browser regardless of terminal width.

Highlights

  • OSC 8 Hyperlink Implementation: Integrated OSC 8 terminal hyperlink sequences into the CLI markdown rendering pipeline to ensure long URLs remain clickable even when wrapped by the terminal.
  • OAuth URL Preservation: Updated the authentication flow to wrap Google OAuth URLs in OSC 8 sequences, preventing truncation issues that previously caused 'Error 400: invalid_request' during terminal wrapping.
  • Testing and Validation: Added comprehensive test cases to verify OSC 8 rendering and ensure that OAuth query parameters are correctly preserved in the hyperlink target.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Sep 23, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces OSC 8 terminal hyperlink escape sequences to wrap bare URLs in both the markdown parsing utility and the OAuth2 authorization flow, ensuring that full URLs remain clickable in terminal environments. The review feedback highlights two important issues: first, a potential terminal spoofing vulnerability in markdownParsingUtils.ts where raw, unsanitized URLs are interpolated into escape sequences, which should be mitigated by sanitizing control characters and checking for color support; second, the risk of printing raw escape sequences in non-TTY or color-disabled environments in oauth2.ts, which can be resolved by checking process.stdout.isTTY and NO_COLOR before outputting OSC 8 sequences.

Comment thread packages/cli/src/ui/utils/markdownParsingUtils.ts Outdated
Comment thread packages/core/src/code_assist/oauth2.ts
@gemini-cli gemini-cli Bot added priority/p1 Important and should be addressed in the near term. area/security Issues related to security labels Sep 23, 2026
@github-actions github-actions Bot added the size/m A medium sized PR label Sep 23, 2026
@gemini-cli

gemini-cli Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Hi there! Thank you for your interest in contributing to Gemini CLI.

To ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'.

This PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.

@github-actions github-actions Bot mentioned this pull request Oct 1, 2026
Open
@gemini-cli

gemini-cli Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

This pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.

@gemini-cli gemini-cli Bot closed this Oct 8, 2026
@github-actions github-actions Bot mentioned this pull request Oct 8, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

area/security Issues related to security priority/p1 Important and should be addressed in the near term. size/m A medium sized PR size/s A small PR status/pr-nudge-sent

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Access Blocked: Authorization Error

1 participant

@anshumancodes