Skip to content

deleteCredentials throws on missing entry, causing re-auth error loops #21768

@nbardy

Description

@nbardy

Problem

KeychainTokenStorage.deleteCredentials() and FileTokenStorage.deleteCredentials() throw an error when the credential doesn't exist. This causes cascading "Failed to clear OAuth credentials" errors when re-auth tries to clear credentials that are already gone.

Common scenarios:

  • Double logout (/auth logout twice)
  • Auth-switch without prior login (clearing credentials that were never stored)
  • Token refresh race (keychain entry deleted externally between read and delete)

Expected behavior

Deleting non-existent credentials should be a no-op (idempotent), not an error. This matches standard idempotent-delete semantics and the behavior users expect from a "clear" operation.

Affected code

  • KeychainTokenStorage.deleteCredentials() — throws No credentials found for ${serverName}
  • FileTokenStorage.deleteCredentials() — throws No credentials found for ${serverName}

Environment

  • Affects all keychain users (macOS/Linux) for Google OAuth logout path
  • Affects GEMINI_FORCE_ENCRYPTED_FILE_STORAGE=true users for MCP token path

Metadata

Metadata

Assignees

No one assigned

    Labels

    priority/p1Important and should be addressed in the near term.

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions