fix(auth): validate request dry-runs without credentials

[ratovarius]

Description

Raw command and Docs append dry-runs currently load credentials before previewing, which can fail before local validation and touch broken credential files. Skip authentication for these dry-runs while keeping the existing executor validation and real-request authentication paths.

Offline preview requires a fresh cached Discovery document; initial or expired schema lookup can still fetch Discovery.

Fixes ratovarius#6.

Scope and dependencies

This is a reliability fix for request previewing, independent of #937: preventing authentication during dry-run and preserving files after a real authentication failure solve different problems. No other feature PR is required. Combining the current branch with #931 conflicts where both insert README sections; preserve both sections when refreshing the branch.

The only common code included from another contribution is the two-file Clippy fix proposed separately in #930. This PR contains its own copy, so it is self-contained against the current upstream base; it is not a zero-overlap diff. Prefer merging #930 first, then refreshing this branch to remove the duplicate. Each feature has its own changeset.

Validation

Twenty-two subprocess/fixture regressions passed. Tests check exact previews, no recorded network requests, unchanged credential/cache bytes and mtimes, validation errors before auth, and real-request auth controls.

Local independent agent review found no outstanding findings; upstream maintainer approval is still pending. Fresh combined validation with the other contributions passed 860 Rust tests, 86 Python tests, formatting, strict Clippy, and build.

Dry Run Output (synthetic fixture and placeholder IDs; no API request sent):

{
  "body": {
    "requests": [
      {
        "insertText": {
          "text": "Example"
        }
      }
    ]
  },
  "dry_run": true,
  "is_multipart_upload": false,
  "method": "POST",
  "query_params": [],
  "url": "https://example.invalid/v1/documents/example%2Ddocument:batchUpdate"
}

Limits

Other helpers that need live reads to construct their plans are unchanged. Tests use synthetic cached Discovery, isolated credentials, and local transport fixtures; the no-credentials ADC fallback control runs only where profile isolation is effective.

Checklist

• Follows AGENTS.md; no generated Google client crates.
• Formatting check passed.
• Required strict Clippy check passed.
• Added regression tests for accepted and rejected cases.
• Includes a changeset.

Synthetic HTTP regression

The synthetic HTTP trap now consumes the complete request body and explicitly uses blocking accepted sockets with a read timeout. This prevents platform-dependent early closes from hiding its intended 403 response. A regression splits headers/body across writes and verifies the server waits before responding. It failed before the fixture correction; all 22 subprocess/fixture tests and 20 repeated split-body executions passed afterward. This fixture correction changes tests only.

[changeset-bot]

🦋 Changeset detected

Latest commit: f380058

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[googleworkspace-bot]

/gemini review

[ratovarius]

Closing this proposal by author request to focus the initial upstream contribution on #937 (preserve saved credentials after authentication failures).

This work remains implemented and maintained in the public fork, https://github.com/ratovarius/cli, with tracking in ratovarius#6 and integration in ratovarius#10. Further development of this item will continue in the fork. This closure does not indicate rejection by upstream maintainers.