fix: patch gaxios v7 Array.toString() stream corruption

gaxios v7.1.3 reads stream error bodies using Array.toString() which
joins Buffer chunks with commas, corrupting JSON error responses at
TCP chunk boundaries. This was introduced when google-auth-library was
upgraded from v9 to v10 in #18880, pulling in gaxios v7.

This adds a postinstall script that patches all gaxios v7 copies,
replacing response.toString() with response.join('') to concatenate
chunks without stray commas.

Author: gsquared94

package.json

@@ -55,7 +55,8 @@
     "telemetry": "node scripts/telemetry.js",
     "check:lockfile": "node scripts/check-lockfile.js",
     "clean": "node scripts/clean.js",
-    "pre-commit": "node scripts/pre-commit.js"
+    "pre-commit": "node scripts/pre-commit.js",
+    "postinstall": "node scripts/patch_gaxios.js"
   },
   "overrides": {
     "wrap-ansi": "9.0.2",

scripts/patch_gaxios.js

@@ -0,0 +1,94 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Postinstall patch for gaxios v7.x to fix the Array.toString() bug.
+ *
+ * In gaxios v7.x, the _request method reads stream error bodies like:
+ *   const response = [];
+ *   for await (const chunk of data) { response.push(chunk); }
+ *   translatedResponse.data = response.toString();
+ *
+ * Array.toString() joins elements with commas, corrupting the response body
+ * at TCP chunk boundaries. This patch replaces `response.toString()` with
+ * `response.join('')` which concatenates without commas.
+ *
+ * See: https://github.com/googleapis/gaxios/issues/XXX
+ */
+
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const rootDir = join(__dirname, '..');
+
+function patchFile(filePath) {
+  if (!existsSync(filePath)) return false;
+
+  const content = readFileSync(filePath, 'utf8');
+  const bugPattern = 'translatedResponse.data = response.toString()';
+
+  if (!content.includes(bugPattern)) return false;
+
+  const patched = content.replace(
+    bugPattern,
+    "translatedResponse.data = response.join('')",
+  );
+  writeFileSync(filePath, patched, 'utf8');
+  return true;
+}
+
+// Find and patch all gaxios v7 copies
+const gaxiosPaths = [
+  // packages/core workspace copy
+  join(rootDir, 'packages/core/node_modules/gaxios/build/cjs/src/gaxios.js'),
+  join(rootDir, 'packages/core/node_modules/gaxios/build/esm/src/gaxios.js'),
+  // @google/genai nested copy (root)
+  join(
+    rootDir,
+    'node_modules/@google/genai/node_modules/gaxios/build/cjs/src/gaxios.js',
+  ),
+  join(
+    rootDir,
+    'node_modules/@google/genai/node_modules/gaxios/build/esm/src/gaxios.js',
+  ),
+  // @google/genai nested copy (packages/core workspace)
+  join(
+    rootDir,
+    'packages/core/node_modules/@google/genai/node_modules/gaxios/build/cjs/src/gaxios.js',
+  ),
+  join(
+    rootDir,
+    'packages/core/node_modules/@google/genai/node_modules/gaxios/build/esm/src/gaxios.js',
+  ),
+  // Top-level (if ever hoisted)
+  join(rootDir, 'node_modules/gaxios/build/cjs/src/gaxios.js'),
+  join(rootDir, 'node_modules/gaxios/build/esm/src/gaxios.js'),
+  // Old gaxios layout (single build dir)
+  join(rootDir, 'packages/core/node_modules/gaxios/build/src/gaxios.js'),
+  join(
+    rootDir,
+    'node_modules/@google/genai/node_modules/gaxios/build/src/gaxios.js',
+  ),
+  join(rootDir, 'node_modules/gaxios/build/src/gaxios.js'),
+];
+
+let patchedCount = 0;
+for (const p of gaxiosPaths) {
+  if (patchFile(p)) {
+    patchedCount++;
+    console.log(`  ✓ Patched: ${p.replace(rootDir + '/', '')}`);
+  }
+}
+
+if (patchedCount > 0) {
+  console.log(
+    `\n  gaxios postinstall: patched ${patchedCount} file(s) — fixed Array.toString() stream corruption bug`,
+  );
+} else {
+  console.log('  gaxios postinstall: no files needed patching');
+}