fix(auth): prevent infinite verification and OAuth retry loops - #29655

Code Review

This pull request introduces several improvements to the authentication and validation flows, including deduplicating concurrent OAuth2 requests, bounding verification retries to prevent infinite loops, and ensuring parent re-renders do not reset the validation dialog timer. The review feedback suggests resetting the authentication retry counter when a new token is successfully acquired in oauth2-provider.ts, and wrapping the asynchronous onSelect call in a try/catch block in AuthDialog.tsx to handle potential errors gracefully.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces several improvements to the authentication and validation flows, including deduplicating concurrent OAuth2 authentication requests, bounding verification retries to prevent infinite loops, and preventing parent re-renders from resetting timers in the validation dialog. The feedback highlights a potential race condition in shouldRetryWithHeaders where concurrent 401/403 failures could independently increment the retry counter and exhaust the limit prematurely, suggesting a check to see if the token has already been updated or cleared by another request.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces several robustness improvements to the authentication and validation flows. Key changes include deduplicating concurrent interactive OAuth requests and gracefully handling concurrent token failures in OAuth2AuthProvider, adding a cancellation mechanism to the OAuth callback server, and bounding verification retries to a maximum of three attempts in both setupUser and retryWithBackoff to prevent infinite loops. Additionally, ValidationDialog now uses refs to prevent parent re-renders from resetting its transition timer, and error handling in AuthDialog has been improved to catch and forward errors thrown during selection. I have no further feedback to provide.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces several robustness improvements to the authentication and validation flows in the Gemini CLI. Key changes include coalescing concurrent token refresh and interactive auth requests in OAuth2AuthProvider to prevent duplicate flows, bounding verification retries to a maximum of three attempts in both setupUser and retryWithBackoff to prevent infinite loops, and using refs in ValidationDialog to prevent parent re-renders from resetting the success timer. Additionally, error handling has been enhanced in AuthDialog and useAuthCommand, a cancel mechanism has been added to startCallbackServer, and fallback metadata keys are now supported when classifying validation errors. Comprehensive unit tests have been added to verify these behaviors. I have no feedback to provide as there are no review comments to assess.

Code Review

This pull request improves the robustness of the authentication and validation flows by deduplicating concurrent interactive OAuth2 requests, bounding verification retries to prevent infinite loops, and using refs in the validation dialog to prevent parent re-renders from resetting timers. It also adds a cancel mechanism to the OAuth callback server. Feedback identifies a potential crash in the callback server's abort handler if server.close() is called on an already closed server, suggesting a check on server.listening before closing.

Code Review

This pull request improves the robustness of the authentication and validation flows. Key updates include deduplicating concurrent interactive OAuth2 requests, bounding verification retries to a maximum of three attempts to prevent infinite loops, and adding cancellation support to the OAuth callback server. Additionally, it optimizes React rendering in ValidationDialog and AppContainer by using refs and callbacks to prevent unnecessary timer resets, and refines error handling for validation and auth transitions. I have no feedback to provide.

_{Note: Security Review did not run due to the size of the PR.}