← Back to PRs

#2657: fix: use TLS 1.2 for gemini-cli and google-antigravity OAuth requests via proxy

by PrentissLiu open 2026-01-27 08:12 View on GitHub →
extensions: google-antigravity-auth extensions: google-gemini-cli-auth
Problem: OAuth token exchange can fail behind certain local proxies because TLS 1.3 handshakes to oauth2.googleapis.com get reset (connection reset during handshake), causing the OAuth flow to fail. Fix: When proxy env vars are present (e.g. HTTP_PROXY / HTTPS_PROXY / ALL_PROXY), use undici ProxyAgent and cap TLS to TLSv1.2 via requestTls.maxVersion for: - google-gemini-cli-auth - google-antigravity-auth Impact: OAuth works reliably behind proxy setups that reset TLS 1.3 connections. <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR updates the Google OAuth flows in `extensions/google-antigravity-auth` and `extensions/google-gemini-cli-auth` to route requests through an undici `ProxyAgent` when proxy environment variables are present, and caps TLS to v1.2 via `requestTls.maxVersion`. The change is applied to the token exchange and follow-up Google API calls (userinfo + Code Assist endpoints) to improve reliability behind local proxies that reset TLS 1.3 handshakes. Main issues found: (1) `oauth.ts` contains a mis-indented `const response = await fetchWithProxy(...)` line inside `discoverProject`, likely failing formatting/lint checks, and (2) `ProxyAgent` is constructed at module load from unvalidated env vars, which can throw and prevent the extension from loading if the proxy URL is malformed. <h3>Confidence Score: 3/5</h3> - This PR is mostly safe to merge, but has one formatting regression and a potential module-load crash if proxy env vars are malformed. - The behavioral change is scoped to OAuth HTTP requests and only activates when proxy env vars are set, but ProxyAgent is constructed at import time from unvalidated env input (can throw), and `oauth.ts` has a mis-indented line that could break lint/format checks. - extensions/google-gemini-cli-auth/oauth.ts, extensions/google-antigravity-auth/index.ts <!-- greptile_other_comments_section --> <sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub> <!-- /greptile_comment -->

Most Similar PRs