Gemini plugin: token refresh fails on Homebrew-installed gemini-cli (bundled builds)

[zac-li]

Summary

The Gemini plugin fails to refresh expired OAuth tokens when gemini-cli is installed via Homebrew, causing repeated "Gemini session expired" errors roughly every hour.

Root Cause

The plugin's loadOauthClientCreds() function searches for OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET in a file at a path like:

@google/gemini-cli-core/dist/src/code_assist/oauth2.js

However, Homebrew-installed gemini-cli (tested on v0.37.1) bundles all source into chunk files:

@google/gemini-cli/bundle/chunk-DZQZKSDY.js
@google/gemini-cli/bundle/chunk-7D745VGL.js
...

The individual oauth2.js file no longer exists. As a result, loadOauthClientCreds() returns null, refreshToken() bails out, and the plugin throws an error with an invalid command (gemini auth login doesn't exist either).

Reproduction

1. Install gemini-cli via Homebrew: brew install gemini-cli
2. Authenticate: run gemini and complete OAuth flow
3. Wait ~1 hour for the access token to expire
4. OpenUsage shows: Gemini session expired. Run gemini auth login to authenticate.

Suggested Fix

In loadOauthClientCreds(), add the Homebrew bundle directory as a candidate and search bundle/chunk-*.js files for the OAUTH_CLIENT_ID / OAUTH_CLIENT_SECRET patterns. For example:

/opt/homebrew/opt/gemini-cli/libexec/lib/node_modules/@google/gemini-cli/bundle/

Also, the error message references gemini auth login which is not a valid command — the Gemini CLI has no auth subcommand. The correct instruction is to just run gemini to re-trigger the OAuth flow.

Workaround

Create a shim file at the expected path with the client credentials extracted from the bundle:

mkdir -p /opt/homebrew/opt/gemini-cli/libexec/lib/node_modules/@google/gemini-cli/node_modules/@google/gemini-cli-core/dist/src/code_assist/

Then write oauth2.js there with the OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET values from the bundle chunks. This breaks on brew upgrade.

Environment

• macOS (Apple Silicon)
• gemini-cli v0.37.1 (Homebrew)
• OpenUsage latest

[Rich627]

Thanks for the detailed report! Fix is up in #401.

What changed:

• loadOauthClientCreds() now also scans /@google/gemini-cli/bundle/chunk-*.js under the Homebrew install roots. Chunk filenames are content-hashed (so they change every release), so we listDir and filter by chunk-*.js prefix rather than hardcoding filenames.
• Fixed the misleading error messages — gemini auth login isn't a real command. They now say "Run gemini and re-authenticate when prompted." to match the official flow.

Verified end-to-end on Homebrew gemini-cli v0.38.2 (Apple Silicon): forced expiry_date = 1, ran the plugin against real oauth2.googleapis.com/token, token refresh succeeded, quota fetch rendered Pro/Flash correctly.

Once the PR ships in a release you shouldn't need the workaround shim anymore. 🙏

[zac-li]

thanks 👍🏼