@oddessentials/agent-guild 0.10.0 → 0.12.0

package/src/manager/session.mjs

@@ -3,11 +3,11 @@
 // byte replay), and the sub-agents and model the coding tool has reported.
 
 import { EventEmitter } from 'node:events';
-import { execFile } from 'node:child_process';
 import crypto from 'node:crypto';
 import pty from 'node-pty';
 import headless from '@xterm/headless';
 import serializeAddon from '@xterm/addon-serialize';
+import { killWindowsTree } from './command-resolver.mjs';
 
 const { Terminal } = headless;
 const { SerializeAddon } = serializeAddon;
@@ -19,6 +19,10 @@ const MODEL_SOURCE_RANK = { args: 0, screen: 1, report: 2 };
 const SCREEN_SCAN_DELAY_MS = 400;
 const SCREEN_SCAN_MAX_DELAY_MS = 2000;
 const MAX_TOOL_SESSION_ID = 200;
+const REPORTING_STATES = new Set(['pending', 'active', 'unavailable', 'setup_required', 'unsupported']);
+const SHELL_EVENTS = new Set(['start', 'waiting', 'asked', 'background', 'end', 'running', 'reset']);
+const MAX_SHELLS = 256;
+const MAX_ENDED_TASKS = 256;
 
 /**
  * Colours reported to programs that query them (OSC 10/11/12), matching the
@@ -81,6 +85,13 @@ export class Session extends EventEmitter {
     this.activityIdleMs = opts.activityIdleMs ?? 2500;
     this.doneAgentLingerMs = opts.doneAgentLingerMs ?? 15000;
     this.killGraceMs = opts.killGraceMs ?? 4000;
+    this.reportingTimeoutMs = opts.reportingTimeoutMs ?? 30000;
+    this.reporting = REPORTING_STATES.has(opts.reporting?.state) ? { state: opts.reporting.state, reason: opts.reporting.reason ?? null } : null;
+    this._reportingTimer = null;
+    this.shellDisplayDelayMs = opts.shellDisplayDelayMs ?? 600;
+    this.shells = new Map();
+    this._shellSeq = 0;
+    this._endedTasks = new Set();
     this.createdAt = new Date().toISOString();
     this.exitedAt = null;
     this.status = 'running';
@@ -190,7 +201,9 @@ export class Session extends EventEmitter {
     clearTimeout(this._activityTimer);
     clearTimeout(this._killTimer);
     clearTimeout(this._scanTimer);
+    clearTimeout(this._reportingTimer);
     this._clearAgents();
+    this._clearShells();
     // Let the headless terminal finish parsing before announcing the exit so
     // any client attaching afterwards still sees the final screen.
     this.term.write('', () => {
@@ -260,6 +273,21 @@ export class Session extends EventEmitter {
     try { this.pty.write(data); } catch { /* process is exiting */ }
   }
 
+  input(data) {
+    this.write(data);
+    if (this.reporting?.state === 'pending' && !this._reportingTimer && typeof data === 'string' && /[\r\n]/.test(data)) {
+      this._reportingTimer = setTimeout(() => {
+        if (this.reporting?.state !== 'pending' || this.status !== 'running') return;
+        this.reporting = {
+          state: 'unavailable',
+          reason: `${this.provider.tool} has not run Agent Guild's reporting hooks yet. That is expected while it signs in or sets up; otherwise its hooks may be turned off, restricted by an administrator, or not trusted for this folder.`,
+        };
+        this._changed();
+      }, this.reportingTimeoutMs);
+      this._reportingTimer.unref?.();
+    }
+  }
+
   _reply(data) {
     this.write(data);
   }
@@ -302,9 +330,7 @@ export class Session extends EventEmitter {
     };
     const pid = this.pty.pid;
     if (!pid) return fallback();
-    execFile('taskkill', ['/PID', String(pid), '/T', '/F'], { windowsHide: true, timeout: 5000 }, (err) => {
-      if (err) fallback();
-    });
+    killWindowsTree(pid, (err) => { if (err) fallback(); });
   }
 
   /**
@@ -317,6 +343,8 @@ export class Session extends EventEmitter {
     this.disposed = true;
     clearTimeout(this._activityTimer);
     clearTimeout(this._scanTimer);
+    clearTimeout(this._reportingTimer);
+    this._clearShells();
     for (const t of this._agentTimers.values()) clearTimeout(t);
     this.subscribers.clear();
     this.term.dispose();
@@ -339,12 +367,9 @@ export class Session extends EventEmitter {
   reportAgent(report, source = 'api') {
     if (!report || typeof report !== 'object') throw badRequest('agent report must be an object');
     if (this.status !== 'running') throw Object.assign(new Error('session has exited'), { status: 409 });
+    if (source === 'api') this._reportingHeard();
     if (report.finishForeground === true && report.agentId === undefined) {
-      // The tool is between turns, so no foreground agent can still be
-      // running; one that is never got its end event.
-      for (const agent of [...this.agents.values()]) {
-        if (agent.foreground && agent.status === 'working') this.reportAgent({ agentId: agent.id, status: 'done' }, source);
-      }
+      this._endForegroundShells(null);
       return null;
     }
     const id = String(report.agentId ?? report.agent ?? report.id ?? '').trim().slice(0, 128);
@@ -360,6 +385,7 @@ export class Session extends EventEmitter {
     }
     const now = new Date().toISOString();
     const existing = this.agents.get(id);
+    if (status === 'done') this._endForegroundShells(id);
     // A first report that already says done would only flash an icon:
     // Claude Code's internal helpers (prompt suggestions, side questions)
     // stop without ever having started here.
@@ -376,9 +402,6 @@ export class Session extends EventEmitter {
       kind: String(report.kind ?? existing?.kind ?? 'agent').slice(0, 40),
       status,
       detail: report.detail === undefined ? existing?.detail ?? '' : String(report.detail).slice(0, 200),
-      // The parent waits for a foreground agent, so a model reported while
-      // it works belongs to the agent, not to the session.
-      foreground: report.foreground === undefined ? existing?.foreground ?? false : report.foreground === true,
       startedAt: existing?.startedAt ?? now,
       updatedAt: now,
       source,
@@ -425,13 +448,142 @@ export class Session extends EventEmitter {
       const isAgent = report && typeof report === 'object' &&
         ((report.agentId ?? report.agent ?? report.id) !== undefined || report.finishForeground === true);
       if (isAgent) this.reportAgent(report, 'terminal');
-      else if (report?.toolSessionId !== undefined) this.reportToolSession(report);
-      else this.reportModel(report);
+      else if (report?.toolSessionId !== undefined) this.reportToolSession(report, 'terminal');
+      else this.reportModel(report, 'terminal');
     } catch (err) {
       this.emit('warning', `ignored in-band report: ${err.message}`);
     }
   }
 
+  // ---- shells ------------------------------------------------------------
+
+  reportShell(report) {
+    if (!report || typeof report !== 'object') throw badRequest('shell report must be an object');
+    if (this.status !== 'running') throw Object.assign(new Error('session has exited'), { status: 409 });
+    if (!SHELL_EVENTS.has(report.shell)) throw badRequest(`shell must be one of ${[...SHELL_EVENTS].join(', ')}`);
+    const id = (value) => (typeof value === 'string' && value ? value.slice(0, 128) : null);
+    const key = id(report.key);
+    const task = id(report.task);
+    const match = typeof report.match === 'string' && /^[a-f0-9]{32}$/.test(report.match) ? report.match : null;
+    const agentId = id(report.agentId);
+    this._reportingHeard();
+
+    if (report.shell === 'reset') {
+      for (const shell of [...this.shells.values()]) this._endShell(shell);
+      return null;
+    }
+
+    if (report.shell === 'running') {
+      if (!Array.isArray(report.tasks)) throw badRequest('a running report needs a tasks array');
+      const running = new Set(report.tasks.slice(0, MAX_SHELLS).map(id).filter(Boolean));
+      for (const shell of [...this.shells.values()]) if (shell.task && !running.has(shell.task)) this._endShell(shell);
+      const known = new Set([...this.shells.values()].map((shell) => shell.task));
+      for (const each of running) if (!known.has(each) && !this._endedTasks.has(each)) this._addShell({ task: each }, { now: true });
+      return null;
+    }
+
+    if (report.shell === 'waiting' || report.shell === 'asked') {
+      // A permission request carries no call id, and a PreToolUse hook may have rewritten its command: it belongs to the
+      // agent's one foreground command with that command, else to its only one.
+      const candidates = [...this.shells.values()].filter((shell) => shell.agentId === agentId && this._foreground(shell) && !shell.waiting && !shell.asked);
+      const exact = match ? candidates.filter((shell) => shell.match === match) : [];
+      const shell = exact.length === 1 ? exact[0] : exact.length === 0 && candidates.length === 1 ? candidates[0] : null;
+      if (shell && report.shell === 'asked') {
+        shell.asked = true;
+      } else if (shell) {
+        clearTimeout(shell.timer);
+        shell.waiting = true;
+        this._setVisible(shell, false);
+      }
+      return null;
+    }
+
+    if (report.shell === 'end') {
+      if (!key && !task) throw badRequest('a shell end needs a key or a task');
+      if (task) this._rememberEnded(task);
+      const shell = (key && this._shellBy('key', key)) || (task && this._shellBy('task', task));
+      if (shell) this._endShell(shell);
+      return null;
+    }
+
+    if (!key) throw badRequest('a shell report needs a key');
+    if (report.shell === 'start') {
+      if (!this._shellBy('key', key)) this._addShell({ key, match, agentId, persist: report.persist === true });
+      return null;
+    }
+
+    if (!task) throw badRequest('a background report needs a task');
+    const shell = this._shellBy('key', key);
+    if (!shell) return null;
+    Object.assign(shell, { task, endsWithAgent: report.endsWithAgent === true });
+    if (shell.waiting) {
+      shell.waiting = false;
+      this._showAfterDelay(shell);
+    }
+    return null;
+  }
+
+  _addShell(fields, { now = false } = {}) {
+    if (this.shells.size >= MAX_SHELLS) {
+      this.emit('warning', `ignored a shell command: ${MAX_SHELLS} are already running`);
+      return;
+    }
+    const shell = {
+      id: `shell-${++this._shellSeq}`, key: null, match: null, agentId: null, persist: false, task: null,
+      endsWithAgent: false, waiting: false, asked: false, visible: false, timer: null, ...fields,
+    };
+    this.shells.set(shell.id, shell);
+    if (now) this._setVisible(shell, true);
+    else this._showAfterDelay(shell);
+  }
+
+  _showAfterDelay(shell) {
+    clearTimeout(shell.timer);
+    shell.timer = setTimeout(() => this._setVisible(shell, true), this.shellDisplayDelayMs);
+    shell.timer.unref?.();
+  }
+
+  _setVisible(shell, visible) {
+    if (shell.visible === visible) return;
+    shell.visible = visible;
+    this._changed();
+  }
+
+  _foreground(shell) {
+    return shell.task === null;
+  }
+
+  _shellBy(field, value) {
+    for (const shell of this.shells.values()) if (shell[field] === value) return shell;
+    return null;
+  }
+
+  // A turn's foreground commands end with it; a background command, or one Codex CLI keeps running, does not.
+  _endForegroundShells(agentId) {
+    for (const shell of [...this.shells.values()]) {
+      if (shell.agentId !== agentId) continue;
+      const lasting = this._foreground(shell) ? shell.persist && !shell.asked : !(agentId && shell.endsWithAgent);
+      if (!lasting) this._endShell(shell);
+    }
+  }
+
+  _rememberEnded(task) {
+    this._endedTasks.delete(task);
+    this._endedTasks.add(task);
+    if (this._endedTasks.size > MAX_ENDED_TASKS) this._endedTasks.delete(this._endedTasks.values().next().value);
+  }
+
+  _endShell(shell) {
+    clearTimeout(shell.timer);
+    if (shell.task) this._rememberEnded(shell.task);
+    if (this.shells.delete(shell.id) && shell.visible) this._changed();
+  }
+
+  _clearShells() {
+    for (const shell of this.shells.values()) clearTimeout(shell.timer);
+    this.shells.clear();
+  }
+
   // ---- model -------------------------------------------------------------
 
   /**
@@ -446,23 +598,21 @@ export class Session extends EventEmitter {
     this._changed();
   }
 
-  reportModel(report) {
+  reportModel(report, source = 'api') {
     if (!report || typeof report !== 'object') throw badRequest('model report must be an object');
     if (this.status !== 'running') throw Object.assign(new Error('session has exited'), { status: 409 });
+    if (source === 'api') this._reportingHeard();
     const name = String(report.model ?? '').trim().slice(0, 120);
     if (!name) throw badRequest('model is required');
     const displayName = report.displayName === undefined || report.displayName === null ? null : String(report.displayName).trim().slice(0, 80) || null;
-    // Gemini CLI fires BeforeModel for a sub-agent's requests too, with the
-    // sub-agent's model and nothing to tell them apart. While a foreground
-    // agent works its parent makes no request, so the report is the agent's.
-    if (this._foregroundAgentWorking()) return this.model;
     this.setModel({ name, displayName }, 'report');
     return this.model;
   }
 
-  reportToolSession(report) {
+  reportToolSession(report, source = 'api') {
     if (!report || typeof report !== 'object') throw badRequest('tool session report must be an object');
     if (this.status !== 'running') throw Object.assign(new Error('session has exited'), { status: 409 });
+    if (source === 'api') this._reportingHeard();
     const id = String(report.toolSessionId ?? '').trim();
     if (!id || id.length > MAX_TOOL_SESSION_ID || /\p{Cc}/u.test(id)) throw badRequest(`toolSessionId must be a printable id of at most ${MAX_TOOL_SESSION_ID} characters`);
     if (this.toolSessionId !== id) {
@@ -472,11 +622,17 @@ export class Session extends EventEmitter {
     return this.toolSessionId;
   }
 
-  _foregroundAgentWorking() {
-    for (const agent of this.agents.values()) {
-      if (agent.foreground && agent.status === 'working') return true;
-    }
-    return false;
+  reportHello() {
+    if (this.status !== 'running') throw Object.assign(new Error('session has exited'), { status: 409 });
+    this._reportingHeard();
+    return this.reporting;
+  }
+
+  _reportingHeard() {
+    clearTimeout(this._reportingTimer);
+    if (!this.reporting || this.reporting.state === 'active') return;
+    this.reporting = { state: 'active', reason: null };
+    this._changed();
   }
 
   /**
@@ -539,7 +695,9 @@ export class Session extends EventEmitter {
       attachedClients: this.subscribers.size,
       model: this.model,
       toolSessionId: this.toolSessionId,
+      reporting: this.reporting,
       agents: [...this.agents.values()],
+      shells: [...this.shells.values()].filter((s) => s.visible).map((s) => ({ id: s.id })),
     };
   }
 }

package/src/manager/usage.mjs

@@ -12,10 +12,6 @@ const RATE_LIMITED_TTL_MS = 5 * 60 * 1000;
 const CLAUDE_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 const CODEX_USAGE_URL = 'https://chatgpt.com/backend-api/wham/usage';
 const CLAUDE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
-const GEMINI_KEYCHAIN_SERVICE = 'gemini-cli-oauth';
-const GEMINI_KEYCHAIN_ACCOUNT = 'main-account';
-const GEMINI_CODE_ASSIST_URL = 'https://cloudcode-pa.googleapis.com/v1internal';
-const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
 
 export class UsageError extends Error {}
 
@@ -258,232 +254,6 @@ function codexWindows(limits) {
   return windows;
 }
 
-// ---- Gemini CLI -----------------------------------------------------------
-
-export function geminiCredentialsFile(env = process.env) {
-  return path.join(env.GEMINI_CLI_HOME || os.homedir(), '.gemini', 'oauth_creds.json');
-}
-
-export function geminiKeychainFile(env = process.env) {
-  return path.join(env.GEMINI_CLI_HOME || os.homedir(), '.gemini', 'gemini-credentials.json');
-}
-
-export function geminiFileKey({ hostname = os.hostname(), username = os.userInfo().username } = {}) {
-  return crypto.scryptSync(GEMINI_KEYCHAIN_SERVICE, `${hostname}-${username}-gemini-cli`, 32);
-}
-
-/**
- * The item Gemini CLI keeps in its own encrypted file when it does not use
- * the OS keychain: AES-256-GCM as iv:tag:ciphertext in hex, over a JSON
- * map of service to account to secret.
- */
-export async function readGeminiFileKeychain(file, { key = geminiFileKey() } = {}) {
-  let raw;
-  try {
-    raw = await fs.promises.readFile(file, 'utf8');
-  } catch {
-    return null;
-  }
-  try {
-    const [iv, tag, encrypted] = raw.trim().split(':').map((part) => Buffer.from(part, 'hex'));
-    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv, { authTagLength: 16 });
-    decipher.setAuthTag(tag);
-    const json = Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8');
-    return JSON.parse(json)?.[GEMINI_KEYCHAIN_SERVICE]?.[GEMINI_KEYCHAIN_ACCOUNT] ?? null;
-  } catch {
-    throw new UsageError(`Gemini CLI credentials file ${shortPath(file)} could not be decrypted`);
-  }
-}
-
-export function geminiKeychainLookup(platform) {
-  if (platform === 'darwin') return { file: 'security', args: ['find-generic-password', '-s', GEMINI_KEYCHAIN_SERVICE, '-a', GEMINI_KEYCHAIN_ACCOUNT, '-w'] };
-  // keytar stores libsecret items with the attributes "service" and "account".
-  if (platform === 'linux') return { file: 'secret-tool', args: ['lookup', 'service', GEMINI_KEYCHAIN_SERVICE, 'account', GEMINI_KEYCHAIN_ACCOUNT] };
-  return null;
-}
-
-/**
- * What the OS keychain holds for Gemini CLI: the item, or that it is
- * absent, that there is no keychain to ask (so the tool keeps its own
- * encrypted file instead), or that it is one this manager cannot read.
- */
-export async function readGeminiKeychainItem(platform) {
-  const spec = geminiKeychainLookup(platform);
-  if (!spec) return { status: platform === 'win32' ? 'unreadable' : 'unavailable' };
-  try {
-    const { stdout } = await runSpec(spec, { timeoutMs: 30000 });
-    return stdout.trim() ? { status: 'found', item: stdout } : { status: 'absent' };
-  } catch (err) {
-    // security exits 44 for a missing item; secret-tool exits 1 for one and
-    // says why on stderr when it has no Secret Service at all.
-    if (platform === 'darwin' && err.code === 44) return { status: 'absent' };
-    if (platform === 'linux' && err.code === 1 && !String(err.stderr || '').trim()) return { status: 'absent' };
-    return { status: 'unavailable' };
-  }
-}
-
-/** Gemini CLI's own storage choice, read from the environment the tool runs with. */
-export function geminiStorageMode(env = process.env) {
-  return { encrypted: env.GEMINI_FORCE_ENCRYPTED_FILE_STORAGE === 'true', fileStorage: env.GEMINI_FORCE_FILE_STORAGE === 'true' };
-}
-
-/**
- * Reads the sign-in from where Gemini CLI keeps it: oauth_creds.json, or
- * with GEMINI_FORCE_ENCRYPTED_FILE_STORAGE the OS keychain item, or its
- * encrypted file when GEMINI_FORCE_FILE_STORAGE is set or there is no
- * keychain. An absent item falls back to oauth_creds.json, as the tool
- * itself migrates it from there.
- */
-export async function readGeminiCredentials({
-  file = geminiCredentialsFile(),
-  keychainFile = geminiKeychainFile(),
-  platform = process.platform,
-  encrypted = false,
-  fileStorage = false,
-  readKeychain = readGeminiKeychainItem,
-  readFileKeychain = readGeminiFileKeychain,
-} = {}) {
-  let raw = null;
-  if (encrypted) {
-    const keychain = fileStorage ? { status: 'unavailable' } : await readKeychain(platform);
-    if (keychain.status === 'found') raw = keychain.item;
-    else if (keychain.status === 'unavailable') raw = await readFileKeychain(keychainFile);
-    else if (keychain.status === 'unreadable') throw new UsageError('Gemini CLI keeps its sign-in in the Windows Credential Manager, which cannot be read from here');
-  }
-  if (raw && raw.trim()) {
-    let item;
-    try { item = JSON.parse(raw); } catch { throw new UsageError('Gemini CLI credentials could not be parsed'); }
-    const token = item?.token ?? item;
-    if (typeof token?.accessToken !== 'string' || !token.accessToken) throw new UsageError('Gemini CLI credentials could not be parsed');
-    return { accessToken: token.accessToken, refreshToken: token.refreshToken || null, expiresAt: Number(token.expiresAt) || null, client: null };
-  }
-  let legacy;
-  try {
-    legacy = JSON.parse(await fs.promises.readFile(file, 'utf8'));
-  } catch {
-    throw notSignedIn(`Gemini CLI is not signed in on this machine (no "${GEMINI_KEYCHAIN_SERVICE}" keychain item or ${shortPath(file)})`);
-  }
-  if (typeof legacy?.access_token !== 'string' || !legacy.access_token) throw new UsageError('Gemini CLI credentials could not be parsed');
-  const client = typeof legacy.client_id === 'string' && typeof legacy.client_secret === 'string'
-    ? { id: legacy.client_id, secret: legacy.client_secret }
-    : null;
-  return { accessToken: legacy.access_token, refreshToken: legacy.refresh_token || null, expiresAt: Number(legacy.expiry_date) || null, client };
-}
-
-const geminiClients = new Map();
-
-/**
- * The OAuth client Gemini CLI signed the user in with, read from the
- * installed copy that `commandPath` starts. A refresh token can only be
- * refreshed with the client that issued it, and the client belongs to
- * Gemini CLI, so it is not kept here.
- */
-export function geminiOAuthClientFromInstall(commandPath) {
-  if (!commandPath) return null;
-  if (geminiClients.has(commandPath)) return geminiClients.get(commandPath);
-  let client = null;
-  try {
-    let start = fs.realpathSync(commandPath);
-    if (/\.(cmd|bat|ps1)$/i.test(start)) {
-      // npm's shims start node_modules/... relative to their own folder.
-      const refersToGemini = /node_modules[\\/]@google[\\/]gemini-cli/.test(fs.readFileSync(start, 'utf8'));
-      start = refersToGemini ? path.join(path.dirname(start), 'node_modules', '@google', 'gemini-cli') : null;
-    }
-    let dir = start && (fs.statSync(start).isDirectory() ? start : path.dirname(start));
-    for (let depth = 0; dir && depth < 8; depth++) {
-      let name = null;
-      try { name = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).name; } catch { /* keep climbing */ }
-      if (name === '@google/gemini-cli') break;
-      const parent = path.dirname(dir);
-      dir = parent === dir ? null : parent;
-    }
-    for (const sub of dir ? ['bundle', 'dist'] : []) {
-      let files = [];
-      try { files = fs.readdirSync(path.join(dir, sub)).filter((f) => f.endsWith('.js')); } catch { continue; }
-      for (const file of files) {
-        const text = fs.readFileSync(path.join(dir, sub, file), 'latin1');
-        const id = text.match(/OAUTH_CLIENT_ID\s*=\s*"([^"]+)"/)?.[1];
-        const secret = text.match(/OAUTH_CLIENT_SECRET\s*=\s*"([^"]+)"/)?.[1];
-        if (id && secret) { client = { id, secret }; break; }
-      }
-      if (client) break;
-    }
-  } catch {
-    client = null;
-  }
-  geminiClients.set(commandPath, client);
-  return client;
-}
-
-async function refreshGoogleToken(refreshToken, client, fetchImpl) {
-  const body = new URLSearchParams({
-    client_id: client.id,
-    client_secret: client.secret,
-    refresh_token: refreshToken,
-    grant_type: 'refresh_token',
-  });
-  const res = await fetchImpl(GOOGLE_TOKEN_URL, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
-    body: body.toString(),
-    signal: AbortSignal.timeout(10000),
-  });
-  if (!res.ok) throw new UsageError('Gemini CLI sign-in could not be refreshed; run gemini once to sign in again');
-  const json = await res.json();
-  if (typeof json?.access_token !== 'string') throw new UsageError('Gemini CLI sign-in could not be refreshed; run gemini once to sign in again');
-  return { accessToken: json.access_token, expiresAt: Date.now() + (Number(json.expires_in) || 3600) * 1000 };
-}
-
-/**
- * Asks the Code Assist API the way Gemini CLI does: loadCodeAssist for the
- * account's project and tier (skipped when `project` is known), then
- * retrieveUserQuota for one bucket per model. Returns the refreshed token
- * and project too, so a caller can reuse them.
- */
-export async function fetchGeminiUsage({
-  accessToken, refreshToken = null, expiresAt = null, client = null, project = null, version = null, fetchImpl = fetch,
-} = {}) {
-  let token = { accessToken, expiresAt };
-  if (expiresAt && expiresAt < Date.now() + 60000) {
-    if (!refreshToken || !client) throw new UsageError('Gemini CLI sign-in has expired; run gemini once to refresh it');
-    token = await refreshGoogleToken(refreshToken, client, fetchImpl);
-  }
-  const headers = {
-    Authorization: `Bearer ${token.accessToken}`,
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-    'User-Agent': `GeminiCLI/${version || '0.62.0'} (agent-guild)`,
-  };
-  const post = async (method, body) => {
-    const res = await fetchImpl(`${GEMINI_CODE_ASSIST_URL}:${method}`, {
-      method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(10000),
-    });
-    if (!res.ok) throw httpUsageError(res.status, 'sign in again in Gemini CLI');
-    return res.json();
-  };
-  let plan = null;
-  let projectId = project;
-  if (!projectId) {
-    const loaded = await post('loadCodeAssist', {
-      metadata: { ideType: 'IDE_UNSPECIFIED', platform: 'PLATFORM_UNSPECIFIED', pluginType: 'GEMINI' },
-    });
-    const found = loaded?.cloudaicompanionProject;
-    projectId = typeof found === 'string' ? found : typeof found?.id === 'string' ? found.id : null;
-    // A paid tier is the effective subscription, as Gemini CLI reads it.
-    const tier = loaded?.paidTier?.id || loaded?.paidTier?.name ? loaded.paidTier : loaded?.currentTier;
-    plan = tier?.name ?? tier?.id ?? null;
-    if (!projectId) throw new UsageError('Gemini CLI has no Code Assist project yet; finish signing in with gemini first');
-  }
-  const quota = await post('retrieveUserQuota', { project: projectId });
-  const windows = [];
-  for (const bucket of Array.isArray(quota?.buckets) ? quota.buckets : []) {
-    if (!bucket?.modelId || typeof bucket.remainingFraction !== 'number') continue;
-    const used = clampPercent((1 - bucket.remainingFraction) * 100);
-    if (used !== null) windows.push({ label: String(bucket.modelId).slice(0, 40), usedPercent: used, resetsAt: toIso(bucket.resetTime) });
-  }
-  return { plan, windows, project: projectId, token };
-}
-
 // ---- any command that prints JSON ------------------------------------------
 
 export async function commandUsage({ command, args = [] }, env, platform = process.platform) {
@@ -532,9 +302,8 @@ export class UsageMonitor {
     this.platform = platform;
     this.fetchImpl = fetchImpl;
     this.ttlMs = ttlMs;
-    this.readers = { claude: readClaudeCredentials, codex: readCodexCredentials, gemini: readGeminiCredentials, ...readers };
+    this.readers = { claude: readClaudeCredentials, codex: readCodexCredentials, ...readers };
     this.cache = new Map();
-    this.gemini = new Map();
   }
 
   /** Snapshots for every account of every provider that has a usage source. */
@@ -553,7 +322,7 @@ export class UsageMonitor {
     const now = Date.now();
     if (entry?.inflight) return entry.inflight;
     if (entry && now - entry.at < entry.ttl) return Promise.resolve(entry.snapshot);
-    const inflight = this._fetch(provider, account, key).then((snapshot) => {
+    const inflight = this._fetch(provider, account).then((snapshot) => {
       const ttl = snapshot.rateLimited ? RATE_LIMITED_TTL_MS : this.ttlMs;
       this.cache.set(key, { snapshot, at: Date.now(), ttl });
       return snapshot;
@@ -562,7 +331,7 @@ export class UsageMonitor {
     return inflight;
   }
 
-  async _fetch(provider, account, key) {
+  async _fetch(provider, account) {
     const base = { providerId: provider.id, accountId: account.id, plan: null, windows: [], credits: null, signedIn: null, fetchedAt: new Date().toISOString(), error: null };
     const env = { ...this.env, ...provider.env, ...account.env };
     let signedIn = null;
@@ -580,30 +349,6 @@ export class UsageMonitor {
         const creds = await this.readers.codex({ file: codexAuthFile(env) });
         signedIn = true;
         result = await fetchCodexUsage({ ...creds, fetchImpl: this.fetchImpl });
-      } else if (provider.usage === 'gemini') {
-        const creds = await this.readers.gemini({
-          file: geminiCredentialsFile(env),
-          keychainFile: geminiKeychainFile(env),
-          platform: this.platform,
-          ...geminiStorageMode(env),
-        });
-        signedIn = true;
-        // The refreshed token, project and plan belong to one sign-in; a new
-        // sign-in (another account, or the same one again) starts over.
-        const signIn = creds.refreshToken || creds.accessToken;
-        const cached = this.gemini.get(key);
-        const known = cached?.signIn === signIn ? cached : {};
-        const fresh = known.token && known.token.expiresAt > Date.now() + 60000 ? known.token : null;
-        const { plan, windows, project, token } = await fetchGeminiUsage({
-          ...creds,
-          client: creds.client || geminiOAuthClientFromInstall(this.registry.resolve(provider)),
-          ...(fresh || {}),
-          project: env.GOOGLE_CLOUD_PROJECT || env.GOOGLE_CLOUD_PROJECT_ID || known.project || null,
-          version: this.registry.versions.get(provider.id)?.installed,
-          fetchImpl: this.fetchImpl,
-        });
-        this.gemini.set(key, { signIn, project, token, plan: plan ?? known.plan ?? null });
-        result = { plan: plan ?? known.plan ?? null, windows };
       } else {
         result = await commandUsage(provider.usage, env, this.platform);
       }