feat(core): support custom base URL via env vars

[junaiddshaukat]

Summary

Adds support for configuring the Gemini and Vertex AI API base URLs via environment variables, while enforcing safe URL usage. This enables routing CLI traffic through proxies or custom gateways without changing code, and keeps the default behavior unchanged when env vars are not set.

Details

• Base URL resolution
  • For AuthType.USE_GEMINI and AuthType.USE_VERTEX_AI (and GATEWAY), we now resolve a baseUrl as:
    • Prefer config.baseUrl if provided (e.g., from gateway / higher-level config)
    • Otherwise read from:
      • GOOGLE_GEMINI_BASE_URL when not using Vertex AI
      • GOOGLE_VERTEX_BASE_URL when using Vertex AI
• Security / validation
  • Introduces validateBaseUrl(baseUrl: string) in contentGenerator.ts
  • Ensures the URL is well-formed
  • Requires https: for non-local hosts
  • Allows http: only for localhost, 127.0.0.1, and [::1] to support local development
• SDK wiring
  • The resolved, validated baseUrl is passed into GoogleGenAI via httpOptions.baseUrl
  • When no base URL is provided (no config override and no env var), behavior is unchanged

Touched files:

• packages/core/src/core/contentGenerator.ts
• packages/core/src/core/contentGenerator.test.ts

Related Issues

Fixes #6746

How to Validate

1. Unit tests (core only)
   npx vitest run packages/core/src/core/contentGenerator.test.ts
   Expected: all tests pass, including new cases for env-based baseUrl and validateBaseUrl.

2. Manual sanity check – default behavior
npm run build GEMINI_API_KEY=<your_key> npm start

• CLI should behave exactly as before (no custom base URL set).

3. Manual sanity check – custom Gemini base URL

npm run build GOOGLE_GEMINI_BASE_URL=https://generativelanguage.googleapis.com \ GEMINI_API_KEY=<your_key> \ npm start

• CLI should still work normally (explicit base URL matches default endpoint).

4. Optional: local proxy test

# run a local HTTP server on 8080 that logs requests GOOGLE_GEMINI_BASE_URL=http://localhost:8080 \ GEMINI_API_KEY=<your_key> \ npm start

• Requests should be routed to the local server (HTTP only allowed for localhost/127.0.0.1/[::1]).

5. Negative check: insecure non-local URL

Set GOOGLE_GEMINI_BASE_URL=http://evil-proxy.example.com and start the CLI.
Expected: startup fails with Custom base URL must use HTTPS unless it is localhost.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the core content generation module by allowing users to specify custom base URLs for Gemini and Vertex AI APIs through environment variables. This provides greater flexibility for routing API traffic through proxies or custom gateways without modifying the application code, while also incorporating robust URL validation to maintain security by enforcing HTTPS for external connections.

Highlights

• Environment Variable Support: Introduced support for configuring Gemini and Vertex AI API base URLs via GOOGLE_GEMINI_BASE_URL and GOOGLE_VERTEX_BASE_URL environment variables, enabling flexible routing through proxies or custom gateways.
• Secure URL Validation: Implemented a validateBaseUrl function to ensure custom base URLs are well-formed and secure, requiring HTTPS for non-local hosts while allowing HTTP only for localhost, 127.0.0.1, and [::1] for local development.
• Flexible Base URL Resolution: Established a clear priority for base URL resolution: config.baseUrl takes precedence, followed by environment variables, with the default API endpoint used if neither is provided.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces support for configuring the Gemini and Vertex AI API base URLs via environment variables, which is a valuable feature for routing traffic through proxies. The implementation includes security validation to ensure custom URLs are well-formed and use HTTPS for non-local hosts. The accompanying tests are comprehensive and cover the new functionality well.

[spencer426]

Thank you for the PR! I have a few suggestions to align with our development guidelines.

[spencer426]

LGTM

[anowardear062-svg]

Thanks for the update