gemini_cli - Gemini 2.5 flash bad request 400 - missing thought_signature

[dehidehidehi]

Branch

main

Branch (if other)

No response

Version / Tag / Commit

main/build-20260527-1-af40b91

Provider(s) Affected

gemini_cli

Deployment Method

Docker

Operating System

Ubuntu 22.04

Python Version (if running from source)

No response

Bug Description

Hello,
It would seem the API for gemini 2.5 flash-lite has changed and those requests are now returning errors.

From the stdout logs:

Released credential env:...li/4 from gemini_cli/gemini-2.5-flash-lite (remaining concurrent: 0/2)
Acquiring credential for model gemini_cli/gemini-2.5-flash-lite. Tried: 3/4(4)
Acquired key ..._cli/3 for model gemini_cli/gemini-2.5-flash-lite (tier: None, priority: 999, selection: sequential, quota: 15/1500 [99%])
Attempting stream with credential ..._cli/3 (Attempt 1/2)
Stream connection established for credential ..._cli/3. Processing response.
Gemini CLI API error 400: {
  "error": {
    "code": 400,
    "message": "Function call is missing a thought_signature in functionCall parts. This is required for tools to work correctly, and missing thought_signature may lead to degraded model performance. Additional data, function call `default_api:glob` , position 2. Please refer to https://ai.google.dev/gemini-api/docs/thought-signatures for more details.",
    "status": "INVALID_ARGUMENT"
  }
}

API call failed for model gemini_cli/gemini-2.5-flash-lite with key ..._cli/3. Error: HTTPStatusError. See failures.log for details.
Released credential env:...li/3 from gemini_cli/gemini-2.5-flash-lite (remaining concurrent: 0/2)
All 4 credentials tried for gemini_cli/gemini-2.5-flash-lite

Error from failures.log:

{"timestamp": "2026-05-29T09:05:47.534723", "api_key_ending": "..._cli/3", "model": "gemini_cli/gemini-2.5-flash-lite", "attempt_number": 1, "error_type": "HTTPStatusError", "error_message": "Client error '400 Bad Request' for url 'https://daily-cloudcode-pa.sandbox.googleapis.com/v1internal:streamGenerateContent?alt=sse'\nFor more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400", "raw_response": "{\n  \"error\": {\n    \"code\": 400,\n    \"message\": \"Function call is missing a thought_signature in functionCall parts. This is required for tools to work correctly, and missing thought_signature may lead to degraded model performance. Additional data, function call `default_api:glob` , position 2. Please refer to https://ai.google.dev/gemini-api/docs/thought-signatures for more details.\",\n    \"status\": \"INVALID_ARGUMENT\"\n  }\n}\n", "request_headers": {"authorization": "Bearer 12345", "content-type": "application/json", "user-agent": "opencode/1.4.3 ai-sdk/provider-utils/4.0.21 runtime/bun/1.3.11", "x-parent-session-id": "ses_18d190127ffejVDfcFFpaY1xZv", "x-session-affinity": "ses_18d04a15affekVWnxS51rvVHaW", "connection": "keep-alive", "accept": "*/*", "host": "host.docker.internal:8000", "accept-encoding": "gzip, deflate, br, zstd", "content-length": "87541"}, "error_chain": null}                                                                                                                                               ~

Steps to Reproduce

You may setup this model with this ENV VAR:

GEMINI_CLI_MODELS='{
  "gemini-2.5-flash-lite": {
    "id": "gemini-2.5-flash-lite",
    "limit": { "context": 280000, "output": 64000 },
    "modalities": { "input": [ "image", "text", "video", "audio", "pdf" ], "output": [ "text" ] },
    "options": { "thinking_budget": 0 }
  }'

Expected Behavior

No error

Actual Behavior

Logs the error as showed in description.

Error Logs / Messages

Pre-submission Checklist

• I have searched existing issues to ensure this is not a duplicate

[mirrobot-agent]

@dehidehidehi Thank you for submitting this issue. I am now beginning my analysis and will report back shortly.

[mirrobot-agent]

Initial Analysis Report

Summary: The Gemini API now requires thoughtSignature on functionCall parts for all models (including Gemini 2.5), but the proxy only handles thoughtSignature for Gemini 3 models, causing a 400 error for Gemini 2.5 Flash models when tools are used in multi-turn conversations.

Issue Validation: Confirmed

Reproducibility Assessment: Reproducible

Root Cause Analysis:

Google's Gemini API has been updated to enforce thought_signature on functionCall parts for all models (not just Gemini 3). The proxy's thoughtSignature handling is gated behind an is_gemini_3 check, meaning Gemini 2.5 models are completely excluded from signature handling.

Two code paths need to be updated:

1. Response processing — _convert_chunk_to_openai at src/rotator_library/providers/gemini_cli_provider.py:1050:

   if is_gemini_3 and has_sig:
       sig = part["thoughtSignature"]
       if self._enable_signature_cache:
           self._signature_cache.store(tool_call_id, sig)
       if self._preserve_signatures_in_client:
           tool_call["thought_signature"] = sig

   This only stores/caches thoughtSignature values for Gemini 3. When a Gemini 2.5 model returns a thoughtSignature in its response, it is silently dropped. On the next turn, when the conversation history is sent back, the functionCall parts are missing their signatures.

2. Request building — _transform_messages at src/rotator_library/providers/gemini_cli_provider.py:793:

   if is_gemini_3:
       sig = tool_call.get("thought_signature")
       if not sig and tool_id and self._enable_signature_cache:
           sig = self._signature_cache.retrieve(tool_id)
       if sig:
           func_part["thoughtSignature"] = sig
       elif first_func_in_msg:
           func_part["thoughtSignature"] = "skip_thought_signature_validator"

   This only adds thoughtSignature to functionCall parts for Gemini 3. For Gemini 2.5 models, function calls in the history are sent without any signature, triggering the 400 error.

3. The _is_gemini_3 method at src/rotator_library/providers/gemini_cli_provider.py:474 only matches gemini-3-* / gemini-3.* models:

   def _is_gemini_3(self, model: str) -> bool:
       model_name = model.split("/")[-1].replace(":thinking", "")
       return model_name.startswith("gemini-3-") or model_name.startswith("gemini-3.")

The error specifically occurs on the second tool call in a conversation (the error says "position 2") because the first tool call's response included a thoughtSignature that wasn't preserved, so when the conversation history is replayed, the API rejects the request.

Related Issues:

• Missing thoughtSignature for first func call #17 — Previous thoughtSignature issue, but that was specific to Gemini 3 and was a warning, not a hard 400 error. This is a different manifestation of the same underlying mechanism now affecting Gemini 2.5 models.
• Invalid JSON payload received - Flash 2.5 #149 — Different issue (system_instruction JSON format error with Flash 2.5).

Suggested Labels: bug, provider:gemini_cli

Proposed Next Steps:

1. Create a new helper method (e.g., _needs_thought_signature(model)) that returns True for both Gemini 3 and Gemini 2.5 models:

   def _needs_thought_signature(self, model: str) -> bool:
       model_name = model.split("/")[-1].replace(":thinking", "")
       return (
           model_name.startswith("gemini-3-") or
           model_name.startswith("gemini-3.") or
           "gemini-2.5" in model_name
       )

2. Replace is_gemini_3 with the new helper in both _convert_chunk_to_openai (line ~1050) and _transform_messages (line ~793) for the thoughtSignature handling blocks only. Keep is_gemini_3 for Gemini 3-specific features (namespace prefixing, tool fix system instruction injection, strict schema enforcement) which should remain Gemini 3-only.

3. Test with multiple scenarios:

   • Gemini 2.5 Flash Lite with tools (reproduces this issue)
   • Gemini 2.5 Flash with tools
   • Gemini 2.5 Pro with tools
   • Gemini 3 models (regression test — should continue working)
   • Non-Gemini models (regression test — should be unaffected)

Missing Information: None — the issue report is thorough and includes all necessary details for reproduction.

This analysis was generated by an AI assistant.

[Mirrowel]

should be fixed in dev

[dehidehidehi]

Hello, I updated to latest dev build and am getting the same error as in the OP

[Mirrowel]

Hello, I updated to latest dev build and am getting the same error as in the OP

You are the OP.

[Mirrowel]

@mirrobot-agent try to figure out why it still happens. Switch to latest dev and try to figure out why this error might happen.
I don't expect much, since you can't test against live API(s), but try.

[mirrobot-agent]

@Mirrowel, I'm investigating why the thought_signature error persists on the latest dev branch. I'll switch to dev, analyze the current code, and report my findings.

[mirrobot-agent]

@Mirrowel, I've completed my investigation on the dev branch. Here's what I found.

Root Cause

The dev fix correctly added _needs_thought_signature() to cover gemini-2.5-* models, and correctly widened the if is_gemini_3: gates to if needs_thought_signature: in both _convert_chunk_to_openai and _transform_messages. However, the bypass logic is still incomplete.

The critical code is at src/rotator_library/providers/gemini_cli_provider.py:851-872:

if needs_thought_signature:
    sig = tool_call.get("thought_signature")
    if not sig and tool_id and self._enable_signature_cache:
        sig = self._signature_cache.retrieve(tool_id)

    if sig:
        func_part["thoughtSignature"] = sig
    elif first_func_in_msg:                          # <-- BUG: only the FIRST call gets the bypass
        func_part["thoughtSignature"] = "skip_thought_signature_validator"
    # Subsequent parallel calls: no signature field at all  <-- THIS IS THE GAP
    first_func_in_msg = False

Two problems combine to produce the 400:

Problem 1: Cache is likely empty for Gemini 2.5 Flash Lite

The signature cache is populated in _convert_chunk_to_openai (line ~1113) only if the API actually returns a thoughtSignature field in the response part. For gemini-2.5-flash-lite with thinking_budget: 0, the model likely does NOT include thoughtSignature in its functionCall response parts (since thinking is disabled). This means:

• has_sig is False at line 1059
• Nothing is stored in the cache
• All subsequent turn lookups from the cache return None

Problem 2: Bypass only applies to the first function call

Since the cache is empty (Problem 1), the proxy falls back to "skip_thought_signature_validator" for the first functionCall in each assistant message. Subsequent parallel function calls get NO thoughtSignature field at all (line 870: "Subsequent parallel calls: no signature field at all").

The error says default_api:glob, position 2 — this is the 3rd function call in a parts array (0-indexed). The first call got the bypass, but calls at positions 1 and 2 were sent without any thoughtSignature, triggering the 400.

The comment at line 849-850 ("Per Gemini docs: Only the FIRST parallel function call gets a signature") appears to be outdated — the Gemini API now enforces thoughtSignature on all functionCall parts, not just the first one.

Proposed Fix

Change lines 856-870 from:

if sig:
    func_part["thoughtSignature"] = sig
elif first_func_in_msg:
    func_part["thoughtSignature"] = "skip_thought_signature_validator"
    if is_gemini_3:
        lib_logger.debug(...)

To:

if sig:
    func_part["thoughtSignature"] = sig
else:
    func_part["thoughtSignature"] = "skip_thought_signature_validator"
    if is_gemini_3:
        lib_logger.debug(...)

This removes the elif first_func_in_msg guard so that all function calls without a real cached signature get the bypass value, not just the first one.

Risk assessment: This also changes behavior for Gemini 3 (where subsequent parallel calls previously had no thoughtSignature field). If Gemini 3 truly expects subsequent calls to omit the field, this could cause regressions. However, the API's error message ("Function call is missing a thought_signature") strongly suggests the field is now required on all calls. If you want to be safe, you could scope the change to only Gemini 2.5 models.

Summary of the dev fix vs remaining gap

Aspect	dev fix status
_needs_thought_signature() covers gemini-2.5-*	✅ Fixed
Response processing stores/caches signatures for 2.5	✅ Fixed
Request building uses needs_thought_signature gate	✅ Fixed
Bypass applies to all function calls, not just first	❌ Not fixed
Gemini 2.5 Flash Lite may not return signatures at all	❌ Expected behavior gap

This analysis was generated by an AI assistant.

[Mirrowel]

That is how thought signature works - only on first function call. I'll test locally against the api. Bruh.
All for a provider that has 2.5 weeks to live.

[dehidehidehi]

Hello, I updated to latest dev build and am getting the same error as in the OP

You are the OP.

Meaning original post?