Gemini CLI 无头 VPS 登录报 OAuth Premature close 深度排查与修复方案

# 假设 Gemini CLI 在 VPS 上绑定的回调端口为 8085
# 将 VPS 上的 8085 端口转发到本地开发机的 8085 端口
ssh -R 8085:127.0.0.1:8085 root@your_vps_ip

# 连上 VPS 后，在远程终端内执行
export NO_BROWSER=true
gemini-cli auth login

import socket
import ssl
import sys

def probe_google_oauth_socket():
    host = "oauth2.googleapis.com"
    port = 443
    print(f"[探针] 正在对 {host}:{port} 发起底层 TCP 握手...")

    try:
        # 1. 建立基础 TCP 连接
        sock = socket.create_connection((host, port), timeout=10)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
        print("[成功] 基础 TCP 握手成功建立。")

        # 2. 执行 TLS 封装
        context = ssl.create_default_context()
        tls_sock = context.wrap_socket(sock, server_hostname=host)
        print(f"[成功] TLS 握手通过！协商协议版本: {tls_sock.version()}, 加密套件: {tls_sock.cipher()[0]}")

        # 3. 发送标准 HTTP HEAD 探测帧
        probe_req = (
            f"HEAD /token HTTP/1.1\r\n"
            f"Host: {host}\r\n"
            f"User-Agent: Gemini-VPS-Diagnostic/1.0\r\n"
            f"Connection: close\r\n\r\n"
        )
        tls_sock.sendall(probe_req.encode())

        # 4. 接收响应数据，捕获是否遭遇提前切断
        response = tls_sock.recv(4096)
        status_line = response.decode('utf-8', errors='ignore').split('\r\n')[0]
        print(f"[探针响应] 收到首行: {status_line}")

        if "HTTP/1.1" in status_line or "HTTP/2" in status_line:
            print("[判定] VPS 到底层 OAuth 端点的网络通道健康，无 Premature close 风险。")
            return True
        else:
            print("[警告] 收到未知响应报文，可能存在中间人代理拦截。")
            return False

    except socket.timeout:
        print("[致命错误] 连接超时！说明 VPS 出口防火墙丢弃了发往 Google 的数据包。")
        return False
    except ssl.SSLError as e:
        print(f"[证书错误] TLS 协商失败: {e}")
        return False
    except ConnectionResetError:
        print("[致命错误] 收到 ConnectionResetError！这是 Premature close 的根本元凶：链路被中间节点强行掐断。")
        return False
    except Exception as e:
        print(f"[未知异常] {e}")
        return False

if __name__ == "__main__":
    probe_google_oauth_socket()

# 写入 /etc/profile 或容器环境变量
export OPENAI_BASE_URL="https://api.gpt345.com/v1"
export OPENAI_API_KEY="sk-gpt345-enterprise-api-key"

# 无需任何浏览器弹窗，无需 SSH 隧道映射，直接在脚本中高速调用
curl -s $OPENAI_BASE_URL/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gemini-3-8-flash",
    "messages": [{"role": "user", "content": "Ping test"}]
  }'