agent executor error: request failed: Post "https://cloudcode-pa.googleapis.com/...

2026年04月21日 21:48 processing

错误信息

Trajectory ID: 00cda296-a2e6-4b6f-b6c1-3e77b66ee990 Error: agent executor error: request failed: Post "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse": oauth2: "unauthorized_client" "Unauthorized": request failed: Post "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse": oauth2: "unauthorized_client" "Unauthorized" (1) attached stack trace -- stack trace: | google3/third_party/gemini_coder/framework/executor/agentexecutor/agentexecutor.(*AgentExecutor).Run | third_party/gemini_coder/framework/executor/agentexecutor/agentexecutor.go:312 | [...repeated from below...] Wraps: (2) agent executor error Wraps: (3) tags: map[stream_receive_count:0 streaming_duration:0s] Wraps: (4) attached stack trace -- stack trace: | google3/third_party/gemini_coder/framework/generator/generator.(*streamResponseHandler).processStream | third_party/gemini_coder/framework/generator/stream_handler.go:329 | google3/third_party/gemini_coder/framework/generator/generator.(*PlannerGenerator).attemptGenerate | third_party/gemini_coder/framework/generator/planner_generator.go:451 | google3/third_party/gemini_coder/framework/generator/generator.(*PlannerGenerator).generateWithAPIRetry | third_party/gemini_coder/framework/generator/planner_generator.go:286 | google3/third_party/gemini_coder/framework/generator/generator.(*PlannerGenerator).generateWithModelOutputRetry | third_party/gemini_coder/framework/generator/planner_generator.go:148 | google3/third_party/gemini_coder/framework/generator/generator.(*PlannerGenerator).Generate | third_party/gemini_coder/framework/generator/planner_generator.go:91 | google3/third_party/gemini_coder/framework/executor/executor.(*Executor).executeLoop | third_party/gemini_coder/framework/executor/executor.go:358 | google3/third_party/gemini_coder/framework/executor/executor.(*Executor).Execute | third_party/gemini_coder/framework/executor/executor.go:278 | google3/third_party/gemini_coder/framework/executor/agentexecutor/agentexecutor.(*AgentExecutor).Run | third_party/gemini_coder/framework/executor/agentexecutor/agentexecutor.go:278 | google3/third_party/jetski/cortex/cortex.(*CascadeManager).executeHelper.func1 | third_party/jetski/cortex/cascade_manager.go:2027 | google3/third_party/jetski/cortex/utils/background.(*Pool).Go.func2 | third_party/jetski/cortex/utils/background.go:121 | google3/go/context/detach.Go.func1 | go/context/detach.go:247 | runtime.goexit | third_party/go/gc/src/runtime/asm_amd64.s:1774 Wraps: (5) request failed: Post "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse": oauth2: "unauthorized_client" "Unauthorized" Wraps: (6) request failed Wraps: (7) Post "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse" Wraps: (8) oauth2: "unauthorized_client" "Unauthorized" Error types: (1) *withstack.withStack (2) *errutil.withPrefix (3) *go_utils.withTags (4) *withstack.withStack (5) *errutil.withPrefix (6) *fmt.wrapError (7) *url.Error (8) *oauth2.RetrieveError

AI 解决方案

报错分析报告

1.错误翻译

原文：request failed: Post "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse": oauth2: "unauthorized_client" "Unauthorized"
译文：请求失败：POST "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse" 时，OAuth2 返回“unauthorized_client”（未授权客户端）“Unauthorized”（未授权）

2. 原因分析

根本原因：OAuth2客户端未获得授权（unauthorized_client），访问Google Cloud Code内部API的凭证无效或缺少权限。

具体位置：AgentExecutor执行中调用streamGenerateContent接口的身份验证环节（堆栈指向agentexecutor.go:312、stream_handler.go:329）；上下文是流式生成内容的API请求。

3.解决方案

#### 修复步骤

确认OAuth2客户端ID/密钥在[Google Cloud Console](https://console.cloud.google.com/apis/credentials)有效；

为客户端分配Cloud Code API访问权限（或对应IAM角色）；

用gcloud auth application-default print-access-token验证凭证能否生成有效令牌；

替换代码中无效凭证，使用授权客户端发送请求。

#### 示例代码（Go语言）

package main

import (
	"context"
	"net/http"

	"golang.org/x/oauth2"
	"golang.org/x/oauth2/google"
)

// 创建带OAuth2授权的HTTP客户端
func createAuthorizedClient(ctx context.Context, credJSON []byte) (*http.Client, error) {
	creds, err := google.CredentialsFromJSON(ctx, credJSON, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return nil, err
	}
	return oauth2.NewClient(ctx, creds.TokenSource), nil
}

// 发送授权请求
func sendStreamRequest(client *http.Client) error {
	resp, err := client.Post(
		"https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent?alt=sse",
		"application/json",
		nil,
	)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	// 处理响应逻辑...
	return nil
}

4. 预防措施

-凭证管理：用环境变量/密钥管理服务（如Vault、AWS Secrets Manager）存储OAuth2凭证，禁止硬编码；

✅ 权限校验：定期通过gcloud iam service-accounts get-iam-policy检查服务账号权限，用oauth2l工具验证令牌有效性。

推荐工具：gcloud CLI（验证凭证）、oauth2l（调试OAuth2令牌）、Sentry（监控认证错误）。

分析新问题查看更多