jackwener/OpenCLI · error · AuthRequiredError

Google session cookies (SID / SAPISID) missing

Error message

Google session cookies (SID / SAPISID) missing

What it means

An AuthRequiredError thrown by verifyGeminiIdentity when the browser has none of Google's session cookies (SID, SAPISID, or __Secure-1PSID). Without these cookies gemini.google.com requests are unauthenticated, so the library short-circuits and signals login is required.

Source

Thrown at clis/gemini/auth.js:12

import { AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
import { registerSiteAuthCommands } from '../_shared/site-auth.js';

async function hasGoogleSessionCookie(page) {
  const cookies = await page.getCookies({ url: 'https://gemini.google.com' });
  const names = new Set(cookies.map(c => c.name));
  return names.has('SID') || names.has('SAPISID') || names.has('__Secure-1PSID');
}

async function verifyGeminiIdentity(page) {
  if (!await hasGoogleSessionCookie(page)) {
    throw new AuthRequiredError('gemini.google.com', 'Google session cookies (SID / SAPISID) missing');
  }
  await page.goto('https://gemini.google.com/app');
  await page.wait(3);
  const probe = await page.evaluate(`
    (() => {
      const a = document.querySelector('a[aria-label^="Google Account:"]');
      if (!a) {
        return { kind: 'auth', detail: 'Gemini account link missing — not signed into Google' };
      }
      const label = a.getAttribute('aria-label') || '';
      const m = label.match(/Google Account:\\s*([^(]+?)\\s*\\(([^)]+)\\)/);
      if (!m) {
        return { kind: 'auth', detail: 'Gemini aria-label unparseable: ' + label };
      }
      return { ok: true, name: m[1].trim() };
    })()
  `);
  if (probe?.kind === 'auth') throw new AuthRequiredError('gemini.google.com', probe.detail);

View on GitHub (pinned to 49907e53dc)

Solutions

  1. Run `opencli gemini login` to complete Google sign-in in the automation browser
  2. Re-run the command with a persistent browser profile that retains Google cookies
  3. Log in to gemini.google.com manually in the automation browser profile
  4. Check that no proxy/extensions are stripping Google cookies

Example fix

// before
opencli gemini ask "hi"
// after
opencli gemini login   # establishes SID/SAPISID cookies
opencli gemini ask "hi"
Defensive patterns

Strategy: validation

Validate before calling

const cookies = await getCookies('https://gemini.google.com');
const names = new Set(cookies.map(c => c.name));
if (!(names.has('SID') || names.has('SAPISID') || names.has('__Secure-1PSID'))) {
  await runLoginFlow(); // opencli gemini login
}

Type guard

function hasGoogleSession(cookies) {
  const n = new Set(cookies.map(c => c.name));
  return n.has('SID') || n.has('SAPISID') || n.has('__Secure-1PSID');
}

Try / catch

try {
  await geminiAsk(prompt);
} catch (e) {
  if (e.name === 'AuthRequiredError' && /cookies/.test(e.message)) {
    await geminiLogin();      // interactive sign-in
    await geminiAsk(prompt);  // retry
  } else throw e;
}

Prevention

When it happens

Trigger: `hasGoogleSessionCookie(page)` returns false — the automation browser profile has no SID/SAPISID/__Secure-1PSID cookies when ask/auth commands run.

Common situations: Never logged in to Google in the automation browser; cookies expired or cleared; using a fresh/incognito profile; corporate proxy blocking accounts.google.com; logged out remotely.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/5ec47b874d5ca4c9. Report an issue: GitHub.