fix: restore gemini-acp provider, remove gemini_oauth (TOS violation)

The gemini_oauth provider reuses Gemini CLI's OAuth credentials to hit
Google's Code Assist API directly, which violates Google's TOS for
third-party tools and can lead to account suspension.

Replace it with gemini-acp, which uses the Gemini CLI's built-in ACP
mode (gemini --acp) — the legitimate third-party integration path.

Fixes #9113

Signed-off-by: Douwe Osinga <douwe@squareup.com>
This commit is contained in:
Douwe Osinga
2026-05-18 11:37:55 -04:00
parent 23a9d04b90
commit 7c133bd4f9
9 changed files with 169 additions and 1136 deletions
@@ -46,7 +46,7 @@ pub fn map_provider_name(provider: &str) -> &str {
"azure_openai" => "azure",
"aws_bedrock" => "amazon-bedrock",
"gcp_vertex_ai" => "google-vertex",
"gemini_oauth" => "google",
"gemini_acp" => "google",
"zhipu" => "zhipuai",
"novita" => "novita-ai",
"opencode_go" => "opencode-go",
+110
View File
@@ -0,0 +1,110 @@
use anyhow::Result;
use futures::future::BoxFuture;
use std::collections::HashMap;
use std::path::PathBuf;
use crate::acp::{
extension_configs_to_mcp_servers, AcpProvider, AcpProviderConfig, ACP_CURRENT_MODEL,
};
use crate::config::base::GeminiCliCommand;
use crate::config::search_path::SearchPaths;
use crate::config::{Config, GooseMode};
use crate::model::ModelConfig;
use crate::providers::acp_tooling::{acp_adapter_installed, acp_inventory_identity};
use crate::providers::base::{current_working_dir, ConfigKey, ProviderDef, ProviderMetadata};
use crate::providers::inventory::InventoryIdentityInput;
const GEMINI_ACP_PROVIDER_NAME: &str = "gemini-acp";
const GEMINI_ACP_DOC_URL: &str = "https://github.com/google-gemini/gemini-cli";
const GEMINI_ACP_DEFAULT_BINARY: &str = "gemini";
pub struct GeminiAcpProvider;
impl ProviderDef for GeminiAcpProvider {
type Provider = AcpProvider;
fn metadata() -> ProviderMetadata {
ProviderMetadata::new(
GEMINI_ACP_PROVIDER_NAME,
"Gemini CLI (ACP)",
"Use goose with your Google Gemini subscription via the Gemini CLI's ACP mode.",
ACP_CURRENT_MODEL,
vec![],
GEMINI_ACP_DOC_URL,
vec![ConfigKey::from_value_type::<GeminiCliCommand>(
false, false, false,
)],
)
.with_setup_steps(vec![
"Install the Gemini CLI: `npm install -g @google/gemini-cli`",
"Run `gemini` once to authenticate with your Google account",
"Set in your goose config file (`~/.config/goose/config.yaml` on macOS/Linux):\n GOOSE_PROVIDER: gemini-acp\n GOOSE_MODEL: current",
"Restart goose for changes to take effect",
])
}
fn from_env(
model: ModelConfig,
extensions: Vec<crate::config::ExtensionConfig>,
) -> BoxFuture<'static, Result<AcpProvider>> {
Self::from_env_with_working_dir(model, extensions, current_working_dir())
}
fn from_env_with_working_dir(
model: ModelConfig,
extensions: Vec<crate::config::ExtensionConfig>,
working_dir: PathBuf,
) -> BoxFuture<'static, Result<AcpProvider>> {
Box::pin(async move {
let config = Config::global();
let command: String = config.get_gemini_cli_command().unwrap_or_default().into();
let resolved_command = SearchPaths::builder().with_npm().resolve(&command)?;
let goose_mode = config.get_goose_mode().unwrap_or(GooseMode::Auto);
let mut args = vec!["--acp".to_string()];
if model.model_name != ACP_CURRENT_MODEL {
args.push("--model".to_string());
args.push(model.model_name.clone());
}
// Gemini CLI session modes:
// yolo – autonomous, no confirmations
// default – ask before risky actions
// auto_edit – auto-accept edits, prompt for risky ops
// plan – no tool execution
let mode_mapping = HashMap::from([
(GooseMode::Auto, "yolo".to_string()),
(GooseMode::Approve, "default".to_string()),
(GooseMode::SmartApprove, "auto_edit".to_string()),
(GooseMode::Chat, "plan".to_string()),
]);
let provider_config = AcpProviderConfig {
command: resolved_command,
args,
env: vec![],
env_remove: vec![],
work_dir: working_dir,
mcp_servers: extension_configs_to_mcp_servers(&extensions),
session_mode_id: Some(mode_mapping[&goose_mode].clone()),
mode_mapping,
notification_callback: None,
};
let metadata = Self::metadata();
AcpProvider::connect(metadata.name, model, goose_mode, provider_config).await
})
}
fn supports_inventory_refresh() -> bool {
true
}
fn inventory_identity() -> Result<InventoryIdentityInput> {
acp_inventory_identity(GEMINI_ACP_PROVIDER_NAME, GEMINI_ACP_DEFAULT_BINARY)
}
fn inventory_configured() -> bool {
acp_adapter_installed(GEMINI_ACP_DEFAULT_BINARY)
}
}
+1 -1
View File
@@ -161,7 +161,7 @@ impl ProviderDef for GeminiCliProvider {
ProviderMetadata::new(
GEMINI_CLI_PROVIDER_NAME,
"Gemini CLI",
"[Deprecated: use gemini_oauth instead] Execute Gemini models via gemini CLI tool. Requires gemini CLI installed.",
"[Deprecated: use gemini-acp instead] Execute Gemini models via gemini CLI tool. Requires gemini CLI installed.",
GEMINI_CLI_DEFAULT_MODEL,
GEMINI_CLI_KNOWN_MODELS.to_vec(),
GEMINI_CLI_DOC_URL,
File diff suppressed because it is too large Load Diff
+2 -2
View File
@@ -22,8 +22,8 @@ use super::{
cursor_agent::CursorAgentProvider,
databricks::DatabricksProvider,
gcpvertexai::GcpVertexAIProvider,
gemini_acp::GeminiAcpProvider,
gemini_cli::GeminiCliProvider,
gemini_oauth::GeminiOAuthProvider,
githubcopilot::GithubCopilotProvider,
google::GoogleProvider,
kimicode::KimiCodeProvider,
@@ -69,8 +69,8 @@ async fn init_registry() -> RwLock<ProviderRegistry> {
registry.register::<CursorAgentProvider>(false);
registry.register::<DatabricksProvider>(true);
registry.register::<GcpVertexAIProvider>(false);
registry.register::<GeminiAcpProvider>(false);
registry.register::<GeminiCliProvider>(false);
registry.register::<GeminiOAuthProvider>(true);
registry.register::<GithubCopilotProvider>(false);
registry.register::<GoogleProvider>(true);
registry.register::<KimiCodeProvider>(true);
+1 -1
View File
@@ -24,8 +24,8 @@ pub mod errors;
pub mod formats;
mod gcpauth;
pub mod gcpvertexai;
pub mod gemini_acp;
pub mod gemini_cli;
pub mod gemini_oauth;
pub mod githubcopilot;
pub mod google;
pub mod http_status;
@@ -47,15 +47,13 @@ The first time you run it, goose will open a browser window for you to sign in w
The recommended model is `gpt-5.3-codex`, which is the default. You can also select `gpt-5.4` (OpenAI's latest omni model) or `gpt-5.2-codex` from the model picker.
## Gemini — via OAuth
## Gemini — via ACP
If you have a Google account with Gemini access, the `Gemini` (`gemini_oauth`) provider lets you use goose with your existing account. Just pick Gemini when setting up goose for the first time (or changing providers).
The first time you run it, goose will open a browser window for you to sign in with your Google account. After that, your session is cached locally.
If you have a Google account with Gemini access, the `Gemini CLI (ACP)` (`gemini-acp`) provider lets you use goose with your existing account via the Gemini CLI's ACP mode. Install the Gemini CLI (`npm install -g @google/gemini-cli`), run `gemini` once to authenticate, then select `gemini-acp` as your provider.
## What about the old CLI providers?
Goose previously supported `claude-code`, `codex`, and `gemini-cli` as "pass-through" CLI providers. These will be removed soon as ACP is the future!
goose previously supported `claude-code`, `codex`, and `gemini-cli` as "pass-through" CLI providers. These will be removed soon as ACP is the future!
## Quick reference
@@ -63,6 +61,6 @@ Goose previously supported `claude-code`, `codex`, and `gemini-cli` as "pass-thr
|---|---|---|---|
| Claude Code | `claude-acp` | `npm install -g @zed-industries/claude-agent-acp` | ✅ via MCP |
| ChatGPT Plus/Pro | `chatgpt_codex` | Nothing — OAuth sign-in | ✅ via MCP |
| Gemini | `gemini_oauth` | Nothing — OAuth sign-in | ✅ native |
| Gemini | `gemini-acp` | `npm install -g @google/gemini-cli` | ✅ via MCP |
Pick the one that matches what you're already paying for, and you're good to go.
+49 -1
View File
@@ -50,6 +50,15 @@ Wraps [codex-acp](https://github.com/zed-industries/codex-acp), an ACP adapter f
- Active ChatGPT Plus/Pro subscription or OpenAI API credits
- Authenticated with your OpenAI account (`codex` CLI working)
### Gemini ACP
Uses the [Gemini CLI](https://github.com/google-gemini/gemini-cli)'s built-in ACP mode. Uses your existing Google Gemini subscription — no API key required.
**Requirements:**
- Node.js and npm
- Gemini CLI installed (`npm install -g @google/gemini-cli`)
- Authenticated with your Google account (run `gemini` once to sign in)
### Pi ACP
Wraps `pi-acp`, an ACP adapter for Pi. Uses your existing Pi installation.
@@ -160,6 +169,27 @@ Wraps `pi-acp`, an ACP adapter for Pi. Uses your existing Pi installation.
│ gpt-5.2-codex
```
### Gemini ACP
1. **Install the Gemini CLI**
```bash
npm install -g @google/gemini-cli
```
2. **Authenticate with Google**
Run `gemini` and follow the authentication prompts to sign in with your Google account.
3. **Configure goose**
Set the provider environment variable:
```bash
export GOOSE_PROVIDER=gemini-acp
```
Or configure through the goose CLI using `goose configure`.
### Pi ACP
1. **Install the Pi CLI and ACP adapter**
@@ -262,6 +292,24 @@ See [claude-agent-acp](https://github.com/agentclientprotocol/claude-agent-acp)
See [codex-acp](https://github.com/zed-industries/codex-acp) for approval policy and sandbox details.
### Gemini ACP Configuration
| Environment Variable | Description | Default |
|------------------------|----------------------------------|-----------|
| `GOOSE_PROVIDER` | Set to `gemini-acp` | None |
| `GOOSE_MODEL` | Model to use | `current` |
| `GOOSE_MODE` | Permission mode | `auto` |
| `GEMINI_CLI_COMMAND` | Path to the gemini CLI binary | `gemini` |
**goose mode → Gemini CLI session mode mapping:**
| goose mode | Gemini CLI mode | Description |
|-----------------|-----------------|----------------------------------------------------------------|
| `auto` | `yolo` | Autonomous, no confirmations |
| `approve` | `default` | Ask before risky actions |
| `smart_approve` | `auto_edit` | Auto-accept edits, prompt for risky operations |
| `chat` | `plan` | No tool execution |
### Pi ACP Configuration
| Environment Variable | Description | Default |
@@ -274,7 +322,7 @@ See [codex-acp](https://github.com/zed-industries/codex-acp) for approval policy
ACP providers depend on external binaries, so ensure:
- The ACP agent binary is installed and in your PATH (`amp-acp`, `claude-agent-acp`, `codex-acp`, `pi-acp`, or `copilot`)
- The ACP agent binary is installed and in your PATH (`amp-acp`, `claude-agent-acp`, `codex-acp`, `gemini`, `pi-acp`, or `copilot`)
- The underlying CLI tool is authenticated and working
- Subscription limits are not exceeded
- Node.js and npm are installed (for npm-distributed adapters)
+1 -1
View File
@@ -8,7 +8,7 @@ description: Use Claude Code, Codex, Cursor Agent, or Gemini CLI subscriptions i
# CLI Providers
:::warning Deprecated — Use ACP Providers
The Claude Code (`claude-code`), Codex (`codex`), and Gemini CLI (`gemini-cli`) providers are deprecated. Use the [ACP providers](/docs/guides/acp-providers) (`claude-acp`, `codex-acp`) instead, which support goose extensions via MCP and use the standardized Agent Client Protocol. For Gemini, use the `Gemini` (`gemini_oauth`) provider which authenticates via OAuth. CLI providers are kept for backward compatibility only.
The Claude Code (`claude-code`), Codex (`codex`), and Gemini CLI (`gemini-cli`) providers are deprecated. Use the [ACP providers](/docs/guides/acp-providers) (`claude-acp`, `codex-acp`, `gemini-acp`) instead, which support goose extensions via MCP and use the standardized Agent Client Protocol. CLI providers are kept for backward compatibility only.
:::
goose can make use of pass-through providers that integrate with existing CLI tools from Anthropic, OpenAI, Cursor, and Google. These providers allow you to use your existing Claude Code, Codex, Cursor Agent, and Google Gemini CLI subscriptions through goose's interface, adding session management, persistence, and workflow integration capabilities to these tools.