From 0fa9a5408878a6af9d314ef55c2ea19a035f950c Mon Sep 17 00:00:00 2001
From: gemini-cli-robot <gemini-cli-robot@google.com>
Date: Thu, 22 Jan 2026 10:34:24 -0800
Subject: [PATCH] fix(patch): cherry-pick 87a0db2 to
 release/v0.26.0-preview.1-pr-17308 [CONFLICTS] (#17317)

Co-authored-by: Shreya Keshive <shreyakeshive@google.com>
---
 packages/cli/src/gemini.test.tsx | 2 ++
 packages/cli/src/gemini.tsx      | 8 ++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/cli/src/gemini.test.tsx b/packages/cli/src/gemini.test.tsx
index 896f89e3c8..4b54e11edc 100644
--- a/packages/cli/src/gemini.test.tsx
+++ b/packages/cli/src/gemini.test.tsx
@@ -1085,6 +1085,8 @@ describe('gemini.tsx main function exit codes', () => {
     vi.mocked(loadSandboxConfig).mockResolvedValue({} as any);
     vi.mocked(loadCliConfig).mockResolvedValue({
       refreshAuth: vi.fn().mockRejectedValue(new Error('Auth failed')),
+      getRemoteAdminSettings: vi.fn().mockReturnValue(undefined),
+      isInteractive: vi.fn().mockReturnValue(true),
     } as unknown as Config);
     vi.mocked(loadSettings).mockReturnValue(
       createMockSettings({
diff --git a/packages/cli/src/gemini.tsx b/packages/cli/src/gemini.tsx
index 733444fdba..1897eba0ff 100644
--- a/packages/cli/src/gemini.tsx
+++ b/packages/cli/src/gemini.tsx
@@ -373,6 +373,7 @@ export async function main() {
   // Refresh auth to fetch remote admin settings from CCPA and before entering
   // the sandbox because the sandbox will interfere with the Oauth2 web
   // redirect.
+  let initialAuthFailed = false;
   if (
     settings.merged.security.auth.selectedType &&
     !settings.merged.security.auth.useExternal
@@ -400,8 +401,7 @@ export async function main() {
       }
     } catch (err) {
       debugLogger.error('Error authenticating:', err);
-      await runExitCleanup();
-      process.exit(ExitCodes.FATAL_AUTHENTICATION_ERROR);
+      initialAuthFailed = true;
     }
   }
 
@@ -427,6 +427,10 @@ export async function main() {
     // another way to decouple refreshAuth from requiring a config.
 
     if (sandboxConfig) {
+      if (initialAuthFailed) {
+        await runExitCleanup();
+        process.exit(ExitCodes.FATAL_AUTHENTICATION_ERROR);
+      }
       let stdinData = '';
       if (!process.stdin.isTTY) {
         stdinData = await readStdin();