fix(core): better error message for failed cloudshell-gca auth (#26079)

packages/core/src/code_assist/server.test.ts

@@ -644,6 +644,28 @@ describe('CodeAssistServer', () => {
     );
   });
 
+  it('should throw friendly error for 403 on cloudshell-gca project', async () => {
+    const { server } = createTestServer();
+    const mock403Error = {
+      response: {
+        status: 403,
+        data: {
+          error: {
+            message: 'Permission denied',
+          },
+        },
+      },
+    };
+    vi.spyOn(server, 'requestPost').mockRejectedValue(mock403Error);
+
+    await expect(
+      server.loadCodeAssist({
+        cloudaicompanionProject: 'cloudshell-gca',
+        metadata: {},
+      }),
+    ).rejects.toThrow(/Access to the default Cloud Shell Gemini project/);
+  });
+
   it('should call the listExperiments endpoint with metadata', async () => {
     const { server } = createTestServer();
     const mockResponse = {

packages/core/src/code_assist/server.ts

@@ -273,6 +273,16 @@ export class CodeAssistServer implements ContentGenerator {
         return {
           currentTier: { id: UserTierId.STANDARD },
         };
+      } else if (
+        isPermissionDeniedError(e) &&
+        req.cloudaicompanionProject === 'cloudshell-gca'
+      ) {
+        throw new Error(
+          'Access to the default Cloud Shell Gemini project was denied.\n' +
+            'Please set your own Google Cloud project by running:\n' +
+            'gcloud config set project [PROJECT_ID]\n' +
+            'or setting export GOOGLE_CLOUD_PROJECT=...',
+        );
       } else {
         throw e;
       }
@@ -572,3 +582,15 @@ function isVpcScAffectedUser(error: unknown): boolean {
   }
   return false;
 }
+
+function isPermissionDeniedError(error: unknown): boolean {
+  return (
+    !!error &&
+    typeof error === 'object' &&
+    'response' in error &&
+    !!error.response &&
+    typeof error.response === 'object' &&
+    'status' in error.response &&
+    error.response.status === 403
+  );
+}