@stage-labs/metro 0.1.0-beta.145 → 0.1.0-beta.147

package/dist/route.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { agentsDir } from './local.js';
-const PROVIDERS = ['bedrock', 'openrouter', 'codex'];
+const PROVIDERS = ['bedrock', 'openrouter', 'codex', 'gemini'];
 export function currentRoute(dir = agentsDir()) {
     const path = join(dir, 'model.json');
     if (!existsSync(path))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.145",
+  "version": "0.1.0-beta.147",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.145",
+  "version": "0.1.0-beta.147",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agents/admin.ts

@@ -24,10 +24,6 @@ export interface OwnedAgent {
 
 export type DeletedAgent = OwnedAgent;
 
-export interface ResetAgentKey extends OwnedAgent {
-  key: string;
-}
-
 export function normalizeAgentName(raw: unknown): string {
   const name = typeof raw === 'string' ? raw.trim() : '';
   if (!AGENT_NAME_RE.test(name))

package/runtime/node_modules/@metro-labs/daemon/src/agents/api.ts

@@ -19,7 +19,6 @@ import {
 import {
   type AgentSummary,
   type DeletedAgent,
-  type ResetAgentKey,
 } from './admin.js';
 
 const PREFIX = '/api/agents';
@@ -30,10 +29,6 @@ export interface AgentApiDeps extends AccountApiDeps {
     subject: string,
     id: string,
   ) => Promise<DeletedAgent>;
-  resetKey: (
-    subject: string,
-    id: string,
-  ) => Promise<ResetAgentKey>;
   gatherAccounts: (allowed: Set<string>) => Promise<{
     accounts: Record<string, unknown[]>;
     unavailable: string[];
@@ -47,14 +42,12 @@ export interface AgentApiDeps extends AccountApiDeps {
 type Routable =
   | { kind: 'collection' }
   | { kind: 'agent'; id: string }
-  | { kind: 'key'; id: string }
   | { kind: 'accounts'; id: string; route: AccountRoute };
 
 type Target = Routable | { kind: 'unknown' } | null;
 
 function subTarget(id: string, rest: string[]): Target {
   if (rest.length === 0) return { kind: 'agent', id };
-  if (rest.length === 1 && rest[0] === 'key') return { kind: 'key', id };
   if (rest[0] !== 'accounts') return { kind: 'unknown' };
   const route = accountRoute(rest.slice(1));
   return route === null ? { kind: 'unknown' } : { kind: 'accounts', id, route };
@@ -145,26 +138,6 @@ async function handleList(
   sendJson(req, res, 200, { ...base, accounts, unavailable });
 }
 
-async function handleResetKey(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: AgentApiDeps,
-  session: ApiSession,
-  id: string,
-): Promise<void> {
-  const reset = await deps.resetKey(session.subject, id);
-  log.info(
-    { agent: reset.name, id: reset.id, owner: session.subject },
-    'agent-api: reset agent key',
-  );
-  sendJson(req, res, 200, {
-    id: reset.id,
-    name: reset.name,
-    reset: true,
-    ...credentials(reset.key),
-  });
-}
-
 async function handleDelete(
   req: IncomingMessage,
   res: ServerResponse,
@@ -190,11 +163,10 @@ async function routeAgent(
   tgt: AgentTarget,
 ): Promise<void> {
   try {
-    if (tgt.kind !== 'collection') requireAdmin(session);
-    if (tgt.kind === 'key') await handleResetKey(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'agent')
+    if (tgt.kind === 'agent') {
+      requireAdmin(session);
       await handleDelete(req, res, deps, session, tgt.id);
-    else await handleList(req, res, deps, session);
+    } else await handleList(req, res, deps, session);
   } catch (err) {
     apiFailure(req, res, err);
   }
@@ -203,7 +175,6 @@ async function routeAgent(
 const ALLOWED: Record<AgentTarget['kind'], string[]> = {
   collection: ['GET'],
   agent: ['DELETE'],
-  key: ['POST'],
 };
 
 function methodAllowed(tgt: Routable, method: string | undefined): boolean {

package/runtime/node_modules/@metro-labs/daemon/src/agents/file-admin.ts

@@ -4,14 +4,13 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { isOrganizationId } from '@metro-labs/http/workos-token';
 import { ensureSecureDir, writeSecure } from '@metro-labs/core/secure-fs';
 import {
-  AgentAdminError,
   newApiKey,
+  AgentAdminError,
   normalizeAgentName,
   type AgentSummary,
   type CreatedAgent,
   type DeletedAgent,
   type OwnedAgent,
-  type ResetAgentKey,
 } from './admin.js';
 import type { AccountRef } from './account-attach.js';
 import {
@@ -24,7 +23,7 @@ import {
   type AgentFile,
 } from './files.js';
 import { newId } from '@metro-labs/core/ids';
-import { registerKey, rotateAgentKey, unregisterAgentKey } from './keys.js';
+import { registerKey, unregisterAgentKey } from './keys.js';
 import { MOVABLE_STATIONS, type LoadedAgent } from '../stations/materialize.js';
 import type { StationName } from '@metro-labs/core/station-names';
 import { normalizeAddress } from '@metro-labs/core/address';
@@ -144,19 +143,6 @@ export async function ensureLocalAgent(dir = agentsDir()): Promise<Ensured> {
   return 'created';
 }
 
-export async function localResetAgentKey(
-  subject: string,
-  id: string,
-  dir = agentsDir(),
-): Promise<ResetAgentKey> {
-  const stored = ownedOrThrow(subject, id, dir);
-  const key = newApiKey();
-  stored.file.key = key;
-  save(stored);
-  rotateAgentKey(id, key);
-  return Promise.resolve({ id, name: stored.file.name, key });
-}
-
 export async function localDeleteAgent(
   subject: string,
   id: string,

package/runtime/node_modules/@metro-labs/daemon/src/agents/keys.ts

@@ -30,11 +30,6 @@ export function unregisterAgentKey(agentId: string): void {
     if (id === agentId) agentIdByKeyHash.delete(hash);
 }
 
-export function rotateAgentKey(agentId: string, key: string | null): void {
-  unregisterAgentKey(agentId);
-  if (key !== null) registerKey(key, agentId);
-}
-
 export function agentIdForKey(token: string): string | undefined {
   if (token === '') return undefined;
   return agentIdByKeyHash.get(digest(token));

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -23,7 +23,7 @@ import { agentsDir, fileSource } from '../agents/files.js';
 import { syncPluginServers } from '../connectors/plugin-sync.js';
 import { readLocalConnectors } from '../connectors/store.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
-import { sessionRunning, stopSession, unwatchSession, watchSession } from '../claude/session.js';
+import { unwatchSession, watchSession } from '../claude/session.js';
 import { tryClaudeSetup } from '../claude/setup.js';
 import { applyLocalOwner } from './local-owner.js';
 import { installBearerSessions } from '../routes/bearer.js';
@@ -34,7 +34,6 @@ import { localSessionApis } from '../routes/local-mode.js';
 import type { SessionApis } from '../routes/session-apis.js';
 import {
   agentLiveness,
-  closeAgentSession,
   createMetroMcp,
 } from '../mcp/index.js';
 import { metroCall } from '../mcp/ctx.js';
@@ -116,12 +115,6 @@ function sessionApis(): SessionApis {
         exitCode = HOLD_EXIT;
         onShutdown();
       },
-      closeAgentSession,
-      restartClaudeSession: () => {
-        if (!sessionRunning()) return false;
-        stopSession();
-        return true;
-      },
       gatherAccounts: gatherAccountsForAgents,
       capabilities: accountStationCapabilities,
       liveness: agentLiveness,

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -10,8 +10,12 @@ import {
   type Adaptations,
 } from './bedrock.js';
 import { anthropicHeaders, forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
-import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
-import { codexCount, codexMessages, freshCodexState, type CodexDeps } from './codex.js';
+import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
+import { codexCount, codexMessages, freshCodexState } from './codex.js';
+import { freshGeminiState, geminiCount, geminiMessages } from './gemini.js';
+import type { GeminiDeps } from './gemini.js';
+import type { CodexDeps } from './codex.js';
+import type { GeminiTokens } from './gemini-auth.js';
 import { OPENROUTER_BASE } from './openrouter.js';
 import { isRecord } from '@metro-labs/core/is-record';
 import { forgetServed, noteServed } from './served.js';
@@ -32,10 +36,12 @@ export interface GatewayDeps {
   bedrockBase?: string;
   openrouterBase?: string;
   codex?: Partial<CodexDeps>;
+  gemini?: Partial<GeminiDeps>;
 }
 
 const learned: Adaptations = freshAdaptations();
 const codexState = freshCodexState();
+const geminiState = freshGeminiState();
 
 export function resetGatewayState(): void {
   forgetServed();
@@ -43,12 +49,17 @@ export function resetGatewayState(): void {
   learned.fields.clear();
   learned.dropBetas = false;
   Object.assign(codexState, freshCodexState());
+  Object.assign(geminiState, freshGeminiState());
 }
 
 const saveCodexTokens = (tokens: CodexTokens): void => {
   writeModelConfig(setCodexAuth(readModelConfig(), tokens));
 };
 
+const saveGeminiTokens = (tokens: GeminiTokens): void => {
+  writeModelConfig(setGeminiAuth(readModelConfig(), tokens));
+};
+
 const keyOf = (req: IncomingMessage): string => {
   const raw = req.headers['x-metro-key'];
   return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
@@ -64,6 +75,8 @@ function modelsBody(cfg: ModelConfig): Record<string, unknown> {
     data.push({ id: `openrouter:${cfg.openrouter.model}`, display_name: `OpenRouter · ${cfg.openrouter.model}`, description: 'Through metro, billed to OpenRouter' });
   if (cfg.codex.model !== '')
     data.push({ id: `codex:${cfg.codex.model}`, display_name: `Codex · ${cfg.codex.model}`, description: 'Through metro, on your ChatGPT subscription' });
+  if (cfg.gemini.model !== '')
+    data.push({ id: `gemini:${cfg.gemini.model}`, display_name: `Gemini · ${cfg.gemini.model}`, description: 'Through metro, on your Google account' });
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
@@ -94,7 +107,7 @@ async function toAnthropic(
     throw new GatewayError(
       403,
       'permission_error',
-      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter or Codex on the Model page, or sign in on the Claude tab',
+      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter, Codex or Gemini on the Model page, or sign in on the Claude tab',
     );
   const watch = watchUpstream(res);
   const upstream = await fetch(url, {
@@ -156,6 +169,16 @@ function noteRefusal(provider: string, model: string, upstream: Response): void
   if (!upstream.ok) log.warn({ provider, model, status: upstream.status }, 'gateway: the provider refused the request');
 }
 
+async function toSubscription(req: IncomingMessage, res: ServerResponse, path: string, body: Record<string, unknown>, route: Route, cfg: ModelConfig, deps: GatewayDeps): Promise<void> {
+  if (route.provider === 'gemini') {
+    if (path === COUNT) geminiCount(res, body);
+    else await geminiMessages(req, res, body, route.model, cfg, { save: saveGeminiTokens, ...deps.gemini }, geminiState, watchUpstream(res));
+    return;
+  }
+  if (path === COUNT) codexCount(res, body);
+  else await codexMessages(req, res, body, route.model, cfg, { save: saveCodexTokens, ...deps.codex }, codexState, watchUpstream(res));
+}
+
 async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
   const cfg = deps.config();
   const raw = await readBody(req);
@@ -175,13 +198,8 @@ async function dispatch(req: IncomingMessage, res: ServerResponse, path: string,
     await toOpenRouter(req, res, body, route, cfg, deps);
     return;
   }
-  if (route.provider === 'codex') {
-    if (path === COUNT) {
-      codexCount(res, body);
-      return;
-    }
-    const codexDeps: CodexDeps = { save: saveCodexTokens, ...deps.codex };
-    await codexMessages(req, res, body, route.model, cfg, codexDeps, codexState, watchUpstream(res));
+  if (route.provider === 'codex' || route.provider === 'gemini') {
+    await toSubscription(req, res, path, body, route, cfg, deps);
     return;
   }
   await toAnthropic(req, res, raw, body, route, deps);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-auth.ts

@@ -0,0 +1,160 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+
+export const GEMINI_CLIENT_ID = '681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com';
+export const GEMINI_CLIENT_SECRET = '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';
+export const GEMINI_AUTH_BASE = 'https://accounts.google.com';
+export const GEMINI_TOKEN_BASE = 'https://oauth2.googleapis.com';
+export const GEMINI_REDIRECT = 'https://codeassist.google.com/authcode';
+const SCOPE = 'https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile';
+const PENDING_TTL_MS = 10 * 60_000;
+const EXPIRY_MARGIN_MS = 5 * 60_000;
+const DEFAULT_TTL_MS = 55 * 60_000;
+
+export interface GeminiTokens {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  email: string | null;
+  project: string;
+  tier: string | null;
+  savedAt: string;
+}
+
+export class GeminiAuthError extends Error {}
+
+interface Pending {
+  verifier: string;
+  at: number;
+}
+
+const pending = new Map<string, Pending>();
+
+const b64url = (buf: Buffer): string => buf.toString('base64url');
+
+export function newPkce(): { verifier: string; challenge: string } {
+  const verifier = b64url(randomBytes(32));
+  return { verifier, challenge: b64url(createHash('sha256').update(verifier).digest()) };
+}
+
+export function authorizeUrl(state: string, challenge: string, base = GEMINI_AUTH_BASE): string {
+  const params = new URLSearchParams({
+    client_id: GEMINI_CLIENT_ID,
+    redirect_uri: GEMINI_REDIRECT,
+    response_type: 'code',
+    scope: SCOPE,
+    access_type: 'offline',
+    prompt: 'consent',
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    state,
+  });
+  return `${base}/o/oauth2/v2/auth?${params.toString()}`;
+}
+
+function sweep(now: number): void {
+  for (const [state, entry] of pending) if (now - entry.at > PENDING_TTL_MS) pending.delete(state);
+}
+
+export function beginLogin(base = GEMINI_AUTH_BASE, now = Date.now()): { url: string; state: string } {
+  sweep(now);
+  const { verifier, challenge } = newPkce();
+  const state = b64url(randomBytes(16));
+  pending.set(state, { verifier, at: now });
+  return { url: authorizeUrl(state, challenge, base), state };
+}
+
+const text = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+const refusalIn = (body: Record<string, unknown>): string => text(body.error_description) ?? text(body.error) ?? 'Google answered without an access token';
+
+function grantedTokens(body: unknown, previous: GeminiTokens | null): { accessToken: string; refreshToken: string; ttl: number } {
+  if (!isRecord(body)) throw new GeminiAuthError('Google answered without tokens');
+  const accessToken = text(body.access_token);
+  if (accessToken === null) throw new GeminiAuthError(refusalIn(body));
+  const refreshToken = text(body.refresh_token) ?? previous?.refreshToken ?? '';
+  if (refreshToken === '') throw new GeminiAuthError('Google issued no refresh token; sign in again');
+  return { accessToken, refreshToken, ttl: typeof body.expires_in === 'number' ? body.expires_in * 1000 : DEFAULT_TTL_MS };
+}
+
+function tokensOf(body: unknown, previous: GeminiTokens | null, now: number): GeminiTokens {
+  const granted = grantedTokens(body, previous);
+  return {
+    accessToken: granted.accessToken,
+    refreshToken: granted.refreshToken,
+    expiresAt: now + granted.ttl,
+    email: previous?.email ?? null,
+    project: previous?.project ?? '',
+    tier: previous?.tier ?? null,
+    savedAt: new Date(now).toISOString(),
+  };
+}
+
+async function tokenCall(form: Record<string, string>, base: string, fetchImpl: typeof fetch): Promise<unknown> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${base}/token`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new GeminiAuthError(`could not reach Google: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok) throw new GeminiAuthError(isRecord(body) ? (text(body.error_description) ?? text(body.error) ?? `Google answered ${String(res.status)}`) : `Google answered ${String(res.status)}`);
+  return body;
+}
+
+export async function exchangeCode(code: string, state: string, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  sweep(now);
+  const entry = pending.get(state);
+  if (entry === undefined) throw new GeminiAuthError('that sign-in has expired; start it again');
+  pending.delete(state);
+  const trimmed = code.trim();
+  if (trimmed === '') throw new GeminiAuthError('paste the code Google showed');
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'authorization_code', code: trimmed, code_verifier: entry.verifier, redirect_uri: GEMINI_REDIRECT },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, null, now);
+}
+
+export async function refreshTokens(previous: GeminiTokens, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'refresh_token', refresh_token: previous.refreshToken },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, previous, now);
+}
+
+export const tokensStale = (tokens: GeminiTokens, now = Date.now()): boolean => tokens.expiresAt - EXPIRY_MARGIN_MS <= now;
+
+export async function userEmail(tokens: GeminiTokens, base = 'https://www.googleapis.com', fetchImpl: typeof fetch = fetch): Promise<string | null> {
+  try {
+    const res = await fetchImpl(`${base}/oauth2/v2/userinfo`, { headers: { authorization: `Bearer ${tokens.accessToken}` }, signal: AbortSignal.timeout(15_000) });
+    const body: unknown = await res.json().catch(() => null);
+    return res.ok && isRecord(body) ? text(body.email) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function tokensFromDisk(raw: unknown): GeminiTokens | null {
+  if (!isRecord(raw)) return null;
+  const accessToken = text(raw.accessToken);
+  const refreshToken = text(raw.refreshToken);
+  if (accessToken === null || refreshToken === null) return null;
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: typeof raw.expiresAt === 'number' ? raw.expiresAt : 0,
+    email: text(raw.email),
+    project: text(raw.project) ?? '',
+    tier: text(raw.tier),
+    savedAt: text(raw.savedAt) ?? '',
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-setup.ts

@@ -0,0 +1,67 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { GeminiAuthError, type GeminiTokens } from './gemini-auth.js';
+
+export const CODE_ASSIST_BASE = 'https://cloudcode-pa.googleapis.com';
+const API = 'v1internal';
+const METADATA = { ideType: 'IDE_UNSPECIFIED', platform: 'PLATFORM_UNSPECIFIED', pluginType: 'GEMINI' };
+const FREE_TIER = 'free-tier';
+const POLL_MS = 5000;
+const POLL_MAX = 24;
+
+export interface Onboarded {
+  project: string;
+  tier: string | null;
+}
+
+const text = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+async function call(base: string, method: string, token: string, body: unknown, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${base}/${API}:${method}`, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new GeminiAuthError(`could not reach Google Code Assist: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const answer: unknown = await res.json().catch(() => null);
+  if (!res.ok) {
+    const detail = isRecord(answer) && isRecord(answer.error) ? text(answer.error.message) : null;
+    throw new GeminiAuthError(detail ?? `Google Code Assist answered ${String(res.status)} on ${method}`);
+  }
+  return isRecord(answer) ? answer : {};
+}
+
+const tierOf = (load: Record<string, unknown>): { id: string | null; name: string | null } => {
+  const tier = isRecord(load.paidTier) ? load.paidTier : isRecord(load.currentTier) ? load.currentTier : null;
+  return { id: tier === null ? null : text(tier.id), name: tier === null ? null : text(tier.name) };
+};
+
+async function waitOperation(base: string, token: string, first: Record<string, unknown>, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  let op = first;
+  for (let i = 0; op.done !== true && i < POLL_MAX; i += 1) {
+    const name = text(op.name);
+    if (name === null) break;
+    await new Promise((r) => setTimeout(r, POLL_MS));
+    const res = await fetchImpl(`${base}/${API}/${name}`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(30_000) });
+    const answer: unknown = await res.json().catch(() => null);
+    op = isRecord(answer) ? answer : {};
+  }
+  return op;
+}
+
+export async function onboard(tokens: GeminiTokens, base = CODE_ASSIST_BASE, fetchImpl: typeof fetch = fetch): Promise<Onboarded> {
+  const load = await call(base, 'loadCodeAssist', tokens.accessToken, { metadata: METADATA }, fetchImpl);
+  const tier = tierOf(load);
+  const known = text(load.cloudaicompanionProject);
+  if (known !== null) return { project: known, tier: tier.name ?? tier.id };
+  const tierId = tier.id ?? FREE_TIER;
+  const op = await waitOperation(base, tokens.accessToken, await call(base, 'onboardUser', tokens.accessToken, { tierId, metadata: METADATA }, fetchImpl), fetchImpl);
+  const response = isRecord(op.response) ? op.response : {};
+  const project = isRecord(response.cloudaicompanionProject) ? text(response.cloudaicompanionProject.id) : null;
+  if (project === null) throw new GeminiAuthError('Google did not assign a Code Assist project to this account; sign in to https://geminicli.com once with the Gemini CLI, then try again');
+  return { project, tier: tier.name ?? tierId };
+}