fix(auth): do not blindly default to API key auth (#3235)

Co-authored-by: matt korwel <matt.korwel@gmail.com>
Co-authored-by: N. Taylor Mullen <ntaylormullen@google.com>

packages/cli/src/ui/components/AuthDialog.test.tsx

@@ -5,7 +5,7 @@
  */
 
 import { render } from 'ink-testing-library';
-import { describe, it, expect, vi } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { AuthDialog } from './AuthDialog.js';
 import { LoadedSettings, SettingScope } from '../../config/settings.js';
 import { AuthType } from '@google/gemini-cli-core';
@@ -13,7 +13,21 @@ import { AuthType } from '@google/gemini-cli-core';
 describe('AuthDialog', () => {
   const wait = (ms = 50) => new Promise((resolve) => setTimeout(resolve, ms));
 
+  let originalEnv: NodeJS.ProcessEnv;
+
+  beforeEach(() => {
+    originalEnv = { ...process.env };
+    process.env.GEMINI_API_KEY = '';
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
   it('should show an error if the initial auth type is invalid', () => {
+    process.env.GEMINI_API_KEY = '';
+
     const settings: LoadedSettings = new LoadedSettings(
       {
         settings: {
@@ -41,6 +55,30 @@ describe('AuthDialog', () => {
     );
   });
 
+  it('should detect GEMINI_API_KEY environment variable', () => {
+    process.env.GEMINI_API_KEY = 'foobar';
+
+    const settings: LoadedSettings = new LoadedSettings(
+      {
+        settings: {
+          selectedAuthType: undefined,
+        },
+        path: '',
+      },
+      {
+        settings: {},
+        path: '',
+      },
+      [],
+    );
+
+    const { lastFrame } = render(
+      <AuthDialog onSelect={() => {}} settings={settings} />,
+    );
+
+    expect(lastFrame()).toContain('Existing API key detected (GEMINI_API_KEY)');
+  });
+
   it('should prevent exiting when no auth method is selected and show error message', async () => {
     const onSelect = vi.fn();
     const settings: LoadedSettings = new LoadedSettings(