gemini-cli - 💡(How to fix) Fix 403 PERMISSION_DENIED: cloudcode-pa.googleapis.com SERVICE_DISABLED on user project, account bound to inaccessible phantom project [1 comments, 2 participants]

Environment

• Gemini CLI version: 0.37.1
• OS: macOS Darwin 25.3.0
• Auth method: Login with Google (OAuth)
• Account: [email protected] (Google One AI Pro subscriber)

Problem

After OAuth authentication succeeds and the Pro subscription tier is correctly identified, all streamGenerateContent calls return 403.

The account is server-side bound to a "phantom project" (maximal-starlight-0j013) that the account has no IAM permissions on. When providing an accessible GCP project (micro-territory-486017-f4), the API returns SERVICE_DISABLED because cloudcode-pa.googleapis.com cannot be manually enabled (subject 110002 - private API).

Steps to Reproduce

1. Fresh install of gemini-cli 0.37.1
2. /auth → Login with Google → authenticate with [email protected]
3. Any prompt → Error: The caller does not have permission (403)

API Investigation

loadCodeAssist without project returns:

{
  "cloudaicompanionProject": "maximal-starlight-0j013",
  "gcpManaged": false,
  "paidTier": { "id": "g1-pro-tier" },
  "currentTier": { "id": "standard-tier" }
}

streamGenerateContent with maximal-starlight-0j013:

403: The caller does not have permission

(Account has zero IAM access on this project — getIamPolicy also returns 403)

streamGenerateContent with micro-territory-486017-f4 (only accessible project):

403: Cloud Code Private API has not been used in project micro-territory-486017-f4 before or it is disabled.
reason: SERVICE_DISABLED

Attempt to enable cloudcode-pa.googleapis.com via Service Usage API:

403: Permission denied to enable service [cloudcode-pa.googleapis.com]
subject: "110002"  ← private API, cannot be user-enabled

onboardUser with micro-territory-486017-f4 returns done: true successfully, but does NOT trigger service enablement.

Root Cause

The account [email protected] is server-side bound to maximal-starlight-0j013 (a project from a previously used account/session) but lacks IAM permissions on it. The only accessible project (micro-territory-486017-f4) cannot have cloudcode-pa.googleapis.com enabled because it is a private API (subject 110002).

This is identical to the issue described in #24425 ("stale cloudaicompanionProject binding to a phantom project").

Request

Please reset the server-side cloudaicompanionProject binding for account [email protected] so it correctly routes to the AI Pro flow without requiring a Cloud project with cloudcode-pa.googleapis.com pre-enabled.

Related Issues

• #24425
• #24517
• #10110