gemini-cli - 💡(How to fix) Fix [Bug] Authentication fails with 'Client network socket disconnected' under TUN proxy [1 comments, 2 participants]

When using `gemini auth login` on a Linux system (Ubuntu) with a system-level TUN mode proxy (e.g., Clash Verge), the authentication process fails at the final verification step. The browser OAuth redirect succeeds and the token is saved, but the CLI throws a socket disconnection error during the API check. Error Message:

TL;DR

Setting NODE_TLS_REJECT_UNAUTHORIZED=0 and using an IPv4 proxy or disabling IPv6 at the kernel level may resolve the authentication issue with gemini auth login on Linux systems with a TUN mode proxy.

Guidance

• Verify that the issue is indeed caused by an IPv6 leak or TLS rejection by checking the system's IPv6 configuration and the proxy settings.
• Try setting NODE_TLS_REJECT_UNAUTHORIZED=0 before running gemini auth login to disable strict TLS verification.
• Use an IPv4 application-level proxy to force the connection to go through the proxy, instead of relying on the system's IPv6 configuration.
• Consider disabling IPv6 at the kernel level as a more permanent solution, but be aware of potential implications for other system services.

Example

env NODE_TLS_REJECT_UNAUTHORIZED=0 gemini auth login

This command sets the environment variable to disable strict TLS verification for the duration of the command.

Notes

The provided workaround may have security implications, as it disables strict TLS verification. It is essential to understand the potential risks and consider alternative solutions that do not compromise security.

Recommendation

Apply the workaround by setting NODE_TLS_REJECT_UNAUTHORIZED=0 and using an IPv4 proxy, as it is a relatively simple and effective solution to the issue. However, it is crucial to weigh the security trade-offs and consider more permanent solutions that address the root cause of the problem.