Populate LLMSetupNote for Gemini CLI to warn on --tls-skip-verify no-op#5188
Merged
Populate LLMSetupNote for Gemini CLI to warn on --tls-skip-verify no-op#5188
Conversation
aponcedeleonch
previously approved these changes
May 5, 2026
The field was used in the GeminiCli struct literal but never defined on clientAppConfig. Move the note into warnTLSSkipVerify in pkg/llm/setup.go as a gemini-cli-specific branch, which already handles per-tool TLS warnings. Closes #5180
github-actions
Bot
added
size/XS
aponcedeleonch
approved these changes
May 5, 2026
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5188 +/- ##
==========================================
- Coverage 67.68% 67.65% -0.03%
==========================================
Files 606 606
Lines 61791 61797 +6
==========================================
- Hits 41823 41809 -14
- Misses 16809 16830 +21
+ Partials 3159 3158 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NODE_TLS_REJECT_UNAUTHORIZED is intentionally not written to Gemini CLI's settings during
thv llm setupbecause it would disable TLS verification for all of Gemini's HTTPS connections, not just the LLM gateway. Previously this meant --tls-skip-verify was silently accepted but had no effect on Gemini's own TLS settings, with no feedback to the user.Populate LLMSetupNote on the GeminiCli config entry with a message explaining the limitation and advising users to add self-signed certificates to the system trust store instead. The note is printed to stdout after each successful Gemini CLI configuration via the existing plumbing in configureDetectedTools.
Fixes #5180
Type of change
Test plan
task test)task test-e2e)task lint-fix)API Compatibility
v1beta1API, OR theapi-break-allowedlabel is applied and the migration guidance is described above.Changes
Does this introduce a user-facing change?
Implementation plan
Approved implementation plan
Special notes for reviewers