From 820a4e3c92984195559c1de373c3f22a4c4bb6a1 Mon Sep 17 00:00:00 2001
From: Dev Randalpura <devrandalpura@google.com>
Date: Mon, 27 Apr 2026 16:05:08 -0500
Subject: [PATCH] fix(core): better error message for failed cloudshell-gca
 auth (#26079)

---
 packages/core/src/code_assist/server.test.ts | 22 ++++++++++++++++++++
 packages/core/src/code_assist/server.ts      | 22 ++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/packages/core/src/code_assist/server.test.ts b/packages/core/src/code_assist/server.test.ts
index 67c2cab67d..8e7f21c3b7 100644
--- a/packages/core/src/code_assist/server.test.ts
+++ b/packages/core/src/code_assist/server.test.ts
@@ -644,6 +644,28 @@ describe('CodeAssistServer', () => {
     );
   });
 
+  it('should throw friendly error for 403 on cloudshell-gca project', async () => {
+    const { server } = createTestServer();
+    const mock403Error = {
+      response: {
+        status: 403,
+        data: {
+          error: {
+            message: 'Permission denied',
+          },
+        },
+      },
+    };
+    vi.spyOn(server, 'requestPost').mockRejectedValue(mock403Error);
+
+    await expect(
+      server.loadCodeAssist({
+        cloudaicompanionProject: 'cloudshell-gca',
+        metadata: {},
+      }),
+    ).rejects.toThrow(/Access to the default Cloud Shell Gemini project/);
+  });
+
   it('should call the listExperiments endpoint with metadata', async () => {
     const { server } = createTestServer();
     const mockResponse = {
diff --git a/packages/core/src/code_assist/server.ts b/packages/core/src/code_assist/server.ts
index 4ed8328f3d..92fc558ebb 100644
--- a/packages/core/src/code_assist/server.ts
+++ b/packages/core/src/code_assist/server.ts
@@ -273,6 +273,16 @@ export class CodeAssistServer implements ContentGenerator {
         return {
           currentTier: { id: UserTierId.STANDARD },
         };
+      } else if (
+        isPermissionDeniedError(e) &&
+        req.cloudaicompanionProject === 'cloudshell-gca'
+      ) {
+        throw new Error(
+          'Access to the default Cloud Shell Gemini project was denied.\n' +
+            'Please set your own Google Cloud project by running:\n' +
+            'gcloud config set project [PROJECT_ID]\n' +
+            'or setting export GOOGLE_CLOUD_PROJECT=...',
+        );
       } else {
         throw e;
       }
@@ -572,3 +582,15 @@ function isVpcScAffectedUser(error: unknown): boolean {
   }
   return false;
 }
+
+function isPermissionDeniedError(error: unknown): boolean {
+  return (
+    !!error &&
+    typeof error === 'object' &&
+    'response' in error &&
+    !!error.response &&
+    typeof error.response === 'object' &&
+    'status' in error.response &&
+    error.response.status === 403
+  );
+}