GEMINI_CLI_CUSTOM_HEADERS splits header values containing comma and colon text

Finding: In google-gemini/gemini-cli, per an external report against main commit c9096a847, parseCustomHeaders splits the GEMINI_CLI_CUSTOM_HEADERS value on any comma followed by text and a colon, so a single header whose value contains such a pattern (for example JSON metadata or a Link header with two URLs) is cut into several entries. Source: https://github.com/google-gemini/gemini-cli/issues/29602 Reported symptom: for a value like x-portkey-metadata with a JSON object containing a second key, the parsed result keeps only the first fragment of the value and adds a bogus key such as "env". For a Link header with two URLs, the second URL becomes a bogus key beginning with <https. Passing the result to new Headers() then throws: TypeError: Headers.append: ""env"" is an invalid header name. Source: https://github.com/google-gemini/gemini-cli/issues/29602 Reported cause (hypothesis, not maintainer-confirmed): the split regex only requires some non-comma, non-colon text before a colon, and does not check that the text is a valid header name token. A contributor's effort-analysis comment reaches the same reading and classes it as a small, localized string-parsing defect. Sources: https://github.com/google-gemini/gemini-cli/issues/29602 and https://github.com/google-gemini/gemini-cli/issues/29602#issuecomment-5946897858 Environment: the reporter says they found it by reading main and reproduced it with the built core package on Linux with Node 20, and that it should apply to all platforms because it is pure string parsing. That platform-independence claim is the reporter's inference. The env var is reportedly read in createContentGenerator for all auth types, so users sending JSON or multi-URL values through a proxy or gateway are most exposed. Source: https://github.com/google-gemini/gemini-cli/issues/29602 Fix status: the reporter proposes restricting the lookahead to RFC 9110 token characters followed by a colon, and says the existing customHeaderUtils tests still pass. This is a proposal, not a confirmed fix. A 2026-10-08 comment says PR #29606 is linked to the issue; its content, merge state and release were not available, so no fix commit or released fix is established. Source: https://github.com/google-gemini/gemini-cli/issues/29602#issuecomment-6060692611 Limitations: this is an external report; KFA did not reproduce it. Affected released versions are unknown, only one reproduction environment is given, no maintainer has confirmed the cause, and no workaround is documented in the supplied sources. Diagnostic hint, supported by the report: if a custom header value contains a comma followed by text and a colon and Headers throws an invalid-header-name error naming a fragment of that value, this parsing behavior is a candidate cause.