@sriinnu/runic 1.2.0 → 2.11.1

package/Sources/RunicCore/Providers/Gemini/GeminiStatusProbe.swift

@@ -1,836 +0,0 @@
-import Foundation
-#if canImport(FoundationNetworking)
-import FoundationNetworking
-#endif
-
-public struct GeminiModelQuota: Sendable {
-    public let modelId: String
-    public let percentLeft: Double
-    public let resetTime: Date?
-    public let resetDescription: String?
-}
-
-public struct GeminiStatusSnapshot: Sendable {
-    public let modelQuotas: [GeminiModelQuota]
-    public let rawText: String
-    public let accountEmail: String?
-    public let accountPlan: String?
-
-    // Convenience: lowest quota across all models (for icon display)
-    public var lowestPercentLeft: Double? {
-        self.modelQuotas.min(by: { $0.percentLeft < $1.percentLeft })?.percentLeft
-    }
-
-    // Legacy compatibility
-    public var dailyPercentLeft: Double? { self.lowestPercentLeft }
-    public var resetDescription: String? {
-        self.modelQuotas.min(by: { $0.percentLeft < $1.percentLeft })?.resetDescription
-    }
-
-    /// Converts Gemini quotas to a unified UsageSnapshot.
-    /// Prioritizes Pro and Flash tiers, then fills an optional tertiary slot with the next-most-constrained model.
-    public func toUsageSnapshot() -> UsageSnapshot {
-        let selected = Self.selectDisplayQuotas(self.modelQuotas)
-        let primaryQuota = selected.first
-        let secondaryQuota = selected.count > 1 ? selected[1] : nil
-        let tertiaryQuota = selected.count > 2 ? selected[2] : nil
-
-        let primary = Self.rateWindow(from: primaryQuota) ?? RateWindow(
-            usedPercent: 0,
-            windowMinutes: 1440,
-            resetsAt: nil,
-            resetDescription: nil,
-            label: nil)
-        let secondary = Self.rateWindow(from: secondaryQuota)
-        let tertiary = Self.rateWindow(from: tertiaryQuota)
-
-        let identity = ProviderIdentitySnapshot(
-            providerID: .gemini,
-            accountEmail: self.accountEmail,
-            accountOrganization: nil,
-            loginMethod: self.accountPlan)
-        return UsageSnapshot(
-            primary: primary,
-            secondary: secondary,
-            tertiary: tertiary,
-            updatedAt: Date(),
-            identity: identity)
-    }
-
-    private static func selectDisplayQuotas(_ quotas: [GeminiModelQuota]) -> [GeminiModelQuota] {
-        guard !quotas.isEmpty else { return [] }
-
-        let normalized = quotas.map { (quota: $0, lowerModelID: $0.modelId.lowercased()) }
-        let pro = normalized
-            .filter { $0.lowerModelID.contains("pro") }
-            .map(\.quota)
-            .min(by: { $0.percentLeft < $1.percentLeft })
-        let flash = normalized
-            .filter { $0.lowerModelID.contains("flash") }
-            .map(\.quota)
-            .min(by: { $0.percentLeft < $1.percentLeft })
-
-        var ordered: [GeminiModelQuota] = []
-        if let pro {
-            ordered.append(pro)
-        }
-        if let flash, !Self.containsModel(ordered, matching: flash) {
-            ordered.append(flash)
-        }
-
-        for quota in quotas.sorted(by: { lhs, rhs in
-            if lhs.percentLeft == rhs.percentLeft {
-                return lhs.modelId.localizedCaseInsensitiveCompare(rhs.modelId) == .orderedAscending
-            }
-            return lhs.percentLeft < rhs.percentLeft
-        }) where ordered.count < 3 {
-            guard !Self.containsModel(ordered, matching: quota) else { continue }
-            ordered.append(quota)
-        }
-
-        return Array(ordered.prefix(3))
-    }
-
-    private static func containsModel(_ quotas: [GeminiModelQuota], matching candidate: GeminiModelQuota) -> Bool {
-        let normalized = candidate.modelId
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .lowercased()
-        return quotas.contains {
-            $0.modelId
-                .trimmingCharacters(in: .whitespacesAndNewlines)
-                .lowercased() == normalized
-        }
-    }
-
-    private static func rateWindow(from quota: GeminiModelQuota?) -> RateWindow? {
-        guard let quota else { return nil }
-        return RateWindow(
-            usedPercent: max(0, min(100, 100 - quota.percentLeft)),
-            windowMinutes: 1440,
-            resetsAt: quota.resetTime,
-            resetDescription: quota.resetDescription,
-            label: self.formattedModelLabel(quota.modelId))
-    }
-
-    private static func formattedModelLabel(_ modelID: String) -> String? {
-        let trimmed = modelID.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return nil }
-
-        let lastPathComponent = trimmed.split(separator: "/").last.map(String.init) ?? trimmed
-        let normalized = lastPathComponent
-            .replacingOccurrences(of: "_", with: " ")
-            .replacingOccurrences(of: "-", with: " ")
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-        return normalized.isEmpty ? nil : normalized
-    }
-}
-
-public enum GeminiStatusProbeError: LocalizedError, Sendable, Equatable {
-    case geminiNotInstalled
-    case notLoggedIn
-    case unsupportedAuthType(String)
-    case parseFailed(String)
-    case timedOut
-    case apiError(String)
-
-    public var errorDescription: String? {
-        switch self {
-        case .geminiNotInstalled:
-            "Gemini CLI is not installed or not on PATH."
-        case .notLoggedIn:
-            "Not logged in to Gemini. Run 'gemini' in Terminal to authenticate."
-        case let .unsupportedAuthType(authType):
-            "Gemini \(authType) auth not supported. Use Google account (OAuth) instead."
-        case let .parseFailed(msg):
-            "Could not parse Gemini usage: \(msg)"
-        case .timedOut:
-            "Gemini quota API request timed out."
-        case let .apiError(msg):
-            "Gemini API error: \(msg)"
-        }
-    }
-}
-
-public enum GeminiAuthType: String, Sendable {
-    case oauthPersonal = "oauth-personal"
-    case apiKey = "api-key"
-    case vertexAI = "vertex-ai"
-    case unknown
-}
-
-/// User tier IDs returned from the Cloud Code Private API (loadCodeAssist).
-/// Maps to: google3/cloud/developer_experience/cloudcode/pa/service/usertier.go
-public enum GeminiUserTierId: String, Sendable {
-    case free = "free-tier"
-    case legacy = "legacy-tier"
-    case standard = "standard-tier"
-}
-
-public struct GeminiStatusProbe: Sendable {
-    public var timeout: TimeInterval = 10.0
-    public var homeDirectory: String
-    public var dataLoader: @Sendable (URLRequest) async throws -> (Data, URLResponse)
-    private static let log = RunicLog.logger("gemini-probe")
-    private static let quotaEndpoint = "https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota"
-    private static let loadCodeAssistEndpoint = "https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist"
-    private static let projectsEndpoint = "https://cloudresourcemanager.googleapis.com/v1/projects"
-    private static let credentialsPath = "/.gemini/oauth_creds.json"
-    private static let settingsPath = "/.gemini/settings.json"
-    private static let tokenRefreshEndpoint = "https://oauth2.googleapis.com/token"
-
-    public init(
-        timeout: TimeInterval = 10.0,
-        homeDirectory: String = NSHomeDirectory(),
-        dataLoader: @escaping @Sendable (URLRequest) async throws -> (Data, URLResponse) = { request in
-            try await URLSession.shared.data(for: request)
-        })
-    {
-        self.timeout = timeout
-        self.homeDirectory = homeDirectory
-        self.dataLoader = dataLoader
-    }
-
-    /// Reads the current Gemini auth type from settings.json
-    public static func currentAuthType(homeDirectory: String = NSHomeDirectory()) -> GeminiAuthType {
-        let settingsURL = URL(fileURLWithPath: homeDirectory + Self.settingsPath)
-
-        guard let data = try? Data(contentsOf: settingsURL),
-              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
-              let security = json["security"] as? [String: Any],
-              let auth = security["auth"] as? [String: Any],
-              let selectedType = auth["selectedType"] as? String
-        else {
-            return .unknown
-        }
-
-        return GeminiAuthType(rawValue: selectedType) ?? .unknown
-    }
-
-    public func fetch() async throws -> GeminiStatusSnapshot {
-        // Block explicitly unsupported auth types; allow unknown to try OAuth creds
-        let authType = Self.currentAuthType(homeDirectory: self.homeDirectory)
-        switch authType {
-        case .apiKey:
-            throw GeminiStatusProbeError.unsupportedAuthType("API key")
-        case .vertexAI:
-            throw GeminiStatusProbeError.unsupportedAuthType("Vertex AI")
-        case .oauthPersonal, .unknown:
-            break
-        }
-
-        let snap = try await Self.fetchViaAPI(
-            timeout: self.timeout,
-            homeDirectory: self.homeDirectory,
-            dataLoader: self.dataLoader)
-
-        Self.log.info("Gemini API fetch ok", metadata: [
-            "dailyPercentLeft": "\(snap.dailyPercentLeft ?? -1)",
-        ])
-        return snap
-    }
-
-    // MARK: - Direct API approach
-
-    private static func fetchViaAPI(
-        timeout: TimeInterval,
-        homeDirectory: String,
-        dataLoader: @escaping @Sendable (URLRequest) async throws -> (Data, URLResponse)) async throws
-        -> GeminiStatusSnapshot
-    {
-        let creds = try Self.loadCredentials(homeDirectory: homeDirectory)
-
-        let expiryStr = creds.expiryDate.map { "\($0)" } ?? "nil"
-        let hasRefresh = creds.refreshToken != nil
-        Self.log.debug("Token check", metadata: [
-            "expiry": expiryStr,
-            "hasRefresh": hasRefresh ? "1" : "0",
-            "now": "\(Date())",
-        ])
-
-        guard let storedAccessToken = creds.accessToken, !storedAccessToken.isEmpty else {
-            Self.log.error("No access token found")
-            throw GeminiStatusProbeError.notLoggedIn
-        }
-
-        var accessToken = storedAccessToken
-        if let expiry = creds.expiryDate, expiry < Date() {
-            Self.log.info("Token expired; attempting refresh", metadata: [
-                "expiry": "\(expiry)",
-            ])
-
-            guard let refreshToken = creds.refreshToken else {
-                Self.log.error("No refresh token available")
-                throw GeminiStatusProbeError.notLoggedIn
-            }
-
-            accessToken = try await Self.refreshAccessToken(
-                refreshToken: refreshToken,
-                timeout: timeout,
-                homeDirectory: homeDirectory,
-                dataLoader: dataLoader)
-        }
-
-        // Discover the Gemini project ID for accurate quota data
-        let projectId = try? await Self.discoverGeminiProjectId(
-            accessToken: accessToken,
-            timeout: timeout,
-            dataLoader: dataLoader)
-
-        guard let url = URL(string: Self.quotaEndpoint) else {
-            throw GeminiStatusProbeError.apiError("Invalid endpoint URL")
-        }
-
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-
-        // Include project ID if discovered for accurate quota
-        if let projectId {
-            request.httpBody = Data("{\"project\": \"\(projectId)\"}".utf8)
-        } else {
-            request.httpBody = Data("{}".utf8)
-        }
-        request.timeoutInterval = timeout
-
-        let (data, response) = try await dataLoader(request)
-
-        guard let httpResponse = response as? HTTPURLResponse else {
-            throw GeminiStatusProbeError.apiError("Invalid response")
-        }
-
-        if httpResponse.statusCode == 401 {
-            throw GeminiStatusProbeError.notLoggedIn
-        }
-
-        guard httpResponse.statusCode == 200 else {
-            throw GeminiStatusProbeError.apiError("HTTP \(httpResponse.statusCode)")
-        }
-
-        // Extract account info from JWT
-        let claims = Self.extractClaimsFromToken(creds.idToken)
-        let snapshot = try Self.parseAPIResponse(data, email: claims.email)
-
-        // Detect plan via loadCodeAssist API (most reliable method)
-        let userTier = await Self.fetchUserTier(
-            accessToken: accessToken,
-            timeout: timeout,
-            dataLoader: dataLoader)
-
-        // Plan display strings with tier mapping:
-        // - standard-tier: Paid subscription (AI Pro, AI Ultra, Code Assist
-        //   Standard/Enterprise, Developer Program Premium)
-        // - free-tier + hd claim: Workspace account (Gemini included free since Jan 2025)
-        // - free-tier: Personal free account (1000 req/day limit)
-        // - legacy-tier: Unknown legacy/grandfathered tier
-        // - nil (API failed): Leave blank (no display)
-        let plan: String? = switch (userTier, claims.hostedDomain) {
-        case (.standard, _):
-            "Paid"
-        case let (.free, .some(domain)):
-            { Self.log.info("Workspace account detected", metadata: ["domain": domain]); return "Workspace" }()
-        case (.free, .none):
-            { Self.log.info("Personal free account"); return "Free" }()
-        case (.legacy, _):
-            "Legacy"
-        case (.none, _):
-            { Self.log.info("Tier detection failed, leaving plan blank"); return nil }()
-        }
-
-        return GeminiStatusSnapshot(
-            modelQuotas: snapshot.modelQuotas,
-            rawText: snapshot.rawText,
-            accountEmail: snapshot.accountEmail,
-            accountPlan: plan)
-    }
-
-    private static func discoverGeminiProjectId(
-        accessToken: String,
-        timeout: TimeInterval,
-        dataLoader: @escaping @Sendable (URLRequest) async throws -> (Data, URLResponse)) async throws
-        -> String?
-    {
-        guard let url = URL(string: projectsEndpoint) else { return nil }
-
-        var request = URLRequest(url: url)
-        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
-        request.timeoutInterval = timeout
-
-        let (data, response) = try await dataLoader(request)
-
-        guard let httpResponse = response as? HTTPURLResponse, httpResponse.statusCode == 200 else {
-            return nil
-        }
-
-        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
-              let projects = json["projects"] as? [[String: Any]]
-        else {
-            return nil
-        }
-
-        // Look for Gemini API project (has "generative-language" label or "gen-lang-client" prefix)
-        for project in projects {
-            guard let projectId = project["projectId"] as? String else { continue }
-
-            // Check for gen-lang-client prefix (Gemini CLI projects)
-            if projectId.hasPrefix("gen-lang-client") {
-                return projectId
-            }
-
-            // Check for generative-language label
-            if let labels = project["labels"] as? [String: String],
-               labels["generative-language"] != nil
-            {
-                return projectId
-            }
-        }
-
-        return nil
-    }
-
-    private static func fetchUserTier(
-        accessToken: String,
-        timeout: TimeInterval,
-        dataLoader: @escaping @Sendable (URLRequest) async throws -> (Data, URLResponse)) async -> GeminiUserTierId?
-    {
-        guard let url = URL(string: loadCodeAssistEndpoint) else {
-            self.log.warning("loadCodeAssist: invalid endpoint URL")
-            return nil
-        }
-
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        request.httpBody = Data("{\"metadata\":{\"ideType\":\"GEMINI_CLI\",\"pluginType\":\"GEMINI\"}}".utf8)
-        request.timeoutInterval = timeout
-
-        let data: Data
-        let response: URLResponse
-        do {
-            (data, response) = try await dataLoader(request)
-        } catch {
-            Self.log.warning("loadCodeAssist: request failed", metadata: ["error": "\(error)"])
-            return nil
-        }
-
-        guard let httpResponse = response as? HTTPURLResponse else {
-            Self.log.warning("loadCodeAssist: invalid response type")
-            return nil
-        }
-
-        guard httpResponse.statusCode == 200 else {
-            Self.log.warning("loadCodeAssist: HTTP error", metadata: [
-                "statusCode": "\(httpResponse.statusCode)",
-                "body": String(data: data, encoding: .utf8) ?? "<binary>",
-            ])
-            return nil
-        }
-
-        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
-            Self.log.warning("loadCodeAssist: failed to parse JSON", metadata: [
-                "body": String(data: data, encoding: .utf8) ?? "<binary>",
-            ])
-            return nil
-        }
-
-        guard let currentTier = json["currentTier"] as? [String: Any],
-              let tierId = currentTier["id"] as? String
-        else {
-            Self.log.warning("loadCodeAssist: no currentTier.id in response", metadata: [
-                "json": "\(json)",
-            ])
-            return nil
-        }
-
-        guard let tier = GeminiUserTierId(rawValue: tierId) else {
-            Self.log.warning("loadCodeAssist: unknown tier ID", metadata: ["tierId": tierId])
-            return nil
-        }
-
-        Self.log.info("loadCodeAssist: tier detected", metadata: ["tier": tierId])
-        return tier
-    }
-
-    private struct OAuthCredentials {
-        let accessToken: String?
-        let idToken: String?
-        let refreshToken: String?
-        let expiryDate: Date?
-    }
-
-    private struct OAuthClientCredentials {
-        let clientId: String
-        let clientSecret: String
-    }
-
-    private static func extractOAuthCredentials() -> OAuthClientCredentials? {
-        let env = ProcessInfo.processInfo.environment
-
-        // Find the gemini binary
-        guard let geminiPath = BinaryLocator.resolveGeminiBinary(
-            env: env,
-            loginPATH: LoginShellPathCache.shared.current)
-            ?? TTYCommandRunner.which("gemini")
-        else {
-            return nil
-        }
-
-        // Resolve symlinks to find the actual installation
-        let fm = FileManager.default
-        var realPath = geminiPath
-        if let resolved = try? fm.destinationOfSymbolicLink(atPath: geminiPath) {
-            if resolved.hasPrefix("/") {
-                realPath = resolved
-            } else {
-                realPath = (geminiPath as NSString).deletingLastPathComponent + "/" + resolved
-            }
-        }
-
-        // Navigate from bin/gemini to the oauth2.js file
-        // Homebrew path: .../libexec/lib/node_modules/@google/gemini-cli/node_modules/@google/gemini-cli-core/dist/src/code_assist/oauth2.js
-        // Bun/npm path: .../node_modules/@google/gemini-cli-core/dist/src/code_assist/oauth2.js (sibling package)
-        let binDir = (realPath as NSString).deletingLastPathComponent
-        let baseDir = (binDir as NSString).deletingLastPathComponent
-
-        let oauthSubpath =
-            "node_modules/@google/gemini-cli/node_modules/@google/gemini-cli-core/dist/src/code_assist/oauth2.js"
-        let oauthFile = "dist/src/code_assist/oauth2.js"
-        let possiblePaths = [
-            // Homebrew nested structure
-            "\(baseDir)/libexec/lib/\(oauthSubpath)",
-            "\(baseDir)/lib/\(oauthSubpath)",
-            // Bun/npm sibling structure: gemini-cli-core is a sibling to gemini-cli
-            "\(baseDir)/../gemini-cli-core/\(oauthFile)",
-            // npm nested inside gemini-cli
-            "\(baseDir)/node_modules/@google/gemini-cli-core/\(oauthFile)",
-        ]
-
-        for path in possiblePaths {
-            if let content = try? String(contentsOfFile: path, encoding: .utf8) {
-                return self.parseOAuthCredentials(from: content)
-            }
-        }
-
-        return nil
-    }
-
-    private static func parseOAuthCredentials(from content: String) -> OAuthClientCredentials? {
-        // Match: const OAUTH_CLIENT_ID = '...';
-        let clientIdPattern = #"OAUTH_CLIENT_ID\s*=\s*['"]([\w\-\.]+)['"]\s*;"#
-        let secretPattern = #"OAUTH_CLIENT_SECRET\s*=\s*['"]([\w\-]+)['"]\s*;"#
-
-        guard let clientIdRegex = try? NSRegularExpression(pattern: clientIdPattern),
-              let secretRegex = try? NSRegularExpression(pattern: secretPattern)
-        else {
-            return nil
-        }
-
-        let range = NSRange(content.startIndex..., in: content)
-
-        guard let clientIdMatch = clientIdRegex.firstMatch(in: content, range: range),
-              let clientIdRange = Range(clientIdMatch.range(at: 1), in: content),
-              let secretMatch = secretRegex.firstMatch(in: content, range: range),
-              let secretRange = Range(secretMatch.range(at: 1), in: content)
-        else {
-            return nil
-        }
-
-        let clientId = String(content[clientIdRange])
-        let clientSecret = String(content[secretRange])
-
-        return OAuthClientCredentials(clientId: clientId, clientSecret: clientSecret)
-    }
-
-    private static func refreshAccessToken(
-        refreshToken: String,
-        timeout: TimeInterval,
-        homeDirectory: String,
-        dataLoader: @escaping @Sendable (URLRequest) async throws -> (Data, URLResponse)) async throws
-        -> String
-    {
-        guard let url = URL(string: tokenRefreshEndpoint) else {
-            throw GeminiStatusProbeError.apiError("Invalid token refresh URL")
-        }
-
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("application/x-www-form-urlencoded", forHTTPHeaderField: "Content-Type")
-        request.timeoutInterval = timeout
-
-        guard let oauthCreds = Self.extractOAuthCredentials() else {
-            Self.log.error("Could not extract OAuth credentials from Gemini CLI")
-            throw GeminiStatusProbeError.apiError("Could not find Gemini CLI OAuth configuration")
-        }
-
-        let body = [
-            "client_id=\(oauthCreds.clientId)",
-            "client_secret=\(oauthCreds.clientSecret)",
-            "refresh_token=\(refreshToken)",
-            "grant_type=refresh_token",
-        ].joined(separator: "&")
-        request.httpBody = body.data(using: .utf8)
-
-        let (data, response) = try await dataLoader(request)
-
-        guard let httpResponse = response as? HTTPURLResponse else {
-            throw GeminiStatusProbeError.apiError("Invalid refresh response")
-        }
-
-        guard httpResponse.statusCode == 200 else {
-            Self.log.error("Token refresh failed", metadata: [
-                "statusCode": "\(httpResponse.statusCode)",
-            ])
-            throw GeminiStatusProbeError.notLoggedIn
-        }
-
-        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
-              let newAccessToken = json["access_token"] as? String
-        else {
-            throw GeminiStatusProbeError.parseFailed("Could not parse refresh response")
-        }
-
-        // Update stored credentials with new token
-        try Self.updateStoredCredentials(json, homeDirectory: homeDirectory)
-
-        Self.log.info("Token refreshed successfully")
-        return newAccessToken
-    }
-
-    private static func updateStoredCredentials(_ refreshResponse: [String: Any], homeDirectory: String) throws {
-        let credsURL = URL(fileURLWithPath: homeDirectory + Self.credentialsPath)
-
-        guard let existingCreds = try? Data(contentsOf: credsURL),
-              var json = try? JSONSerialization.jsonObject(with: existingCreds) as? [String: Any]
-        else {
-            return
-        }
-
-        // Update with new values from refresh response
-        if let accessToken = refreshResponse["access_token"] {
-            json["access_token"] = accessToken
-        }
-        if let expiresIn = refreshResponse["expires_in"] as? Double {
-            json["expiry_date"] = (Date().timeIntervalSince1970 + expiresIn) * 1000
-        }
-        if let idToken = refreshResponse["id_token"] {
-            json["id_token"] = idToken
-        }
-
-        let updatedData = try JSONSerialization.data(withJSONObject: json, options: [.prettyPrinted])
-        try updatedData.write(to: credsURL, options: .atomic)
-        try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: credsURL.path)
-    }
-
-    private static func loadCredentials(homeDirectory: String) throws -> OAuthCredentials {
-        let credsURL = URL(fileURLWithPath: homeDirectory + Self.credentialsPath)
-
-        guard FileManager.default.fileExists(atPath: credsURL.path) else {
-            throw GeminiStatusProbeError.notLoggedIn
-        }
-
-        let data = try Data(contentsOf: credsURL)
-        guard let json = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
-            throw GeminiStatusProbeError.parseFailed("Invalid credentials file")
-        }
-
-        let accessToken = json["access_token"] as? String
-        let idToken = json["id_token"] as? String
-        let refreshToken = json["refresh_token"] as? String
-
-        var expiryDate: Date?
-        if let expiryMs = json["expiry_date"] as? Double {
-            expiryDate = Date(timeIntervalSince1970: expiryMs / 1000)
-        }
-
-        return OAuthCredentials(
-            accessToken: accessToken,
-            idToken: idToken,
-            refreshToken: refreshToken,
-            expiryDate: expiryDate)
-    }
-
-    private struct TokenClaims {
-        let email: String?
-        let hostedDomain: String?
-    }
-
-    private static func extractClaimsFromToken(_ idToken: String?) -> TokenClaims {
-        guard let token = idToken else { return TokenClaims(email: nil, hostedDomain: nil) }
-
-        let parts = token.components(separatedBy: ".")
-        guard parts.count >= 2 else { return TokenClaims(email: nil, hostedDomain: nil) }
-
-        var payload = parts[1]
-            .replacingOccurrences(of: "-", with: "+")
-            .replacingOccurrences(of: "_", with: "/")
-
-        let remainder = payload.count % 4
-        if remainder > 0 {
-            payload += String(repeating: "=", count: 4 - remainder)
-        }
-
-        guard let data = Data(base64Encoded: payload, options: .ignoreUnknownCharacters),
-              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any]
-        else {
-            return TokenClaims(email: nil, hostedDomain: nil)
-        }
-
-        return TokenClaims(
-            email: json["email"] as? String,
-            hostedDomain: json["hd"] as? String)
-    }
-
-    private static func extractEmailFromToken(_ idToken: String?) -> String? {
-        self.extractClaimsFromToken(idToken).email
-    }
-
-    private struct QuotaBucket: Decodable {
-        let remainingFraction: Double?
-        let resetTime: String?
-        let modelId: String?
-        let tokenType: String?
-    }
-
-    private struct QuotaResponse: Decodable {
-        let buckets: [QuotaBucket]?
-    }
-
-    private static func parseAPIResponse(_ data: Data, email: String?) throws -> GeminiStatusSnapshot {
-        let decoder = JSONDecoder()
-        let response = try decoder.decode(QuotaResponse.self, from: data)
-
-        guard let buckets = response.buckets, !buckets.isEmpty else {
-            throw GeminiStatusProbeError.parseFailed("No quota buckets in response")
-        }
-
-        // Group quotas by model, keeping lowest per model (input tokens usually)
-        var modelQuotaMap: [String: (fraction: Double, resetString: String?)] = [:]
-
-        for bucket in buckets {
-            guard let modelId = bucket.modelId, let fraction = bucket.remainingFraction else { continue }
-
-            if let existing = modelQuotaMap[modelId] {
-                if fraction < existing.fraction {
-                    modelQuotaMap[modelId] = (fraction, bucket.resetTime)
-                }
-            } else {
-                modelQuotaMap[modelId] = (fraction, bucket.resetTime)
-            }
-        }
-
-        // Convert to sorted array (by model name for consistent ordering)
-        let quotas = modelQuotaMap
-            .sorted { $0.key < $1.key }
-            .map { modelId, info in
-                let resetDate = info.resetString.flatMap { Self.parseResetTime($0) }
-                return GeminiModelQuota(
-                    modelId: modelId,
-                    percentLeft: info.fraction * 100,
-                    resetTime: resetDate,
-                    resetDescription: info.resetString.flatMap { Self.formatResetTime($0) })
-            }
-
-        let rawText = String(data: data, encoding: .utf8) ?? ""
-
-        return GeminiStatusSnapshot(
-            modelQuotas: quotas,
-            rawText: rawText,
-            accountEmail: email,
-            accountPlan: nil)
-    }
-
-    private static func parseResetTime(_ isoString: String) -> Date? {
-        let formatter = ISO8601DateFormatter()
-        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
-
-        if let date = formatter.date(from: isoString) {
-            return date
-        }
-        formatter.formatOptions = [.withInternetDateTime]
-        return formatter.date(from: isoString)
-    }
-
-    private static func formatResetTime(_ isoString: String) -> String {
-        guard let resetDate = parseResetTime(isoString) else {
-            return "Resets soon"
-        }
-
-        let now = Date()
-        let interval = resetDate.timeIntervalSince(now)
-
-        if interval <= 0 {
-            return "Resets soon"
-        }
-
-        let hours = Int(interval / 3600)
-        let minutes = Int((interval.truncatingRemainder(dividingBy: 3600)) / 60)
-
-        if hours > 0 {
-            return "Resets in \(hours)h \(minutes)m"
-        } else {
-            return "Resets in \(minutes)m"
-        }
-    }
-
-    // MARK: - Legacy CLI parsing (kept for fallback)
-
-    public static func parse(text: String) throws -> GeminiStatusSnapshot {
-        let clean = TextParsing.stripANSICodes(text)
-        guard !clean.isEmpty else { throw GeminiStatusProbeError.timedOut }
-
-        let quotas = Self.parseModelUsageTable(clean)
-
-        if quotas.isEmpty {
-            if clean.contains("Login with Google") || clean.contains("Use Gemini API key") {
-                throw GeminiStatusProbeError.notLoggedIn
-            }
-            if clean.contains("Waiting for auth"), !clean.contains("Usage") {
-                throw GeminiStatusProbeError.notLoggedIn
-            }
-            throw GeminiStatusProbeError.parseFailed("No usage data found in /stats output")
-        }
-
-        return GeminiStatusSnapshot(
-            modelQuotas: quotas,
-            rawText: text,
-            accountEmail: nil,
-            accountPlan: nil)
-    }
-
-    private static func parseModelUsageTable(_ text: String) -> [GeminiModelQuota] {
-        let lines = text.components(separatedBy: .newlines)
-        var quotas: [GeminiModelQuota] = []
-
-        let pattern = #"(gemini[-\w.]+)\s+[\d-]+\s+([0-9]+(?:\.[0-9]+)?)\s*%\s*\(([^)]+)\)"#
-        guard let regex = try? NSRegularExpression(pattern: pattern, options: [.caseInsensitive]) else {
-            return []
-        }
-
-        for line in lines {
-            let cleanLine = line.replacingOccurrences(of: "│", with: " ")
-            let range = NSRange(cleanLine.startIndex..<cleanLine.endIndex, in: cleanLine)
-            guard let match = regex.firstMatch(in: cleanLine, options: [], range: range),
-                  match.numberOfRanges >= 4 else { continue }
-
-            guard let modelRange = Range(match.range(at: 1), in: cleanLine),
-                  let pctRange = Range(match.range(at: 2), in: cleanLine),
-                  let pct = Double(cleanLine[pctRange])
-            else { continue }
-
-            let modelId = String(cleanLine[modelRange])
-            var resetDesc: String?
-            if let resetRange = Range(match.range(at: 3), in: cleanLine) {
-                resetDesc = String(cleanLine[resetRange]).trimmingCharacters(in: .whitespaces)
-            }
-
-            quotas.append(GeminiModelQuota(
-                modelId: modelId,
-                percentLeft: pct,
-                resetTime: nil,
-                resetDescription: resetDesc))
-        }
-
-        return quotas
-    }
-}