@stage-labs/metro 0.1.0-beta.146 → 0.1.0-beta.148

package/dist/route.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { agentsDir } from './local.js';
-const PROVIDERS = ['bedrock', 'openrouter', 'codex'];
+const PROVIDERS = ['bedrock', 'openrouter', 'codex', 'gemini'];
 export function currentRoute(dir = agentsDir()) {
     const path = join(dir, 'model.json');
     if (!existsSync(path))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.146",
+  "version": "0.1.0-beta.148",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.146",
+  "version": "0.1.0-beta.148",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -10,8 +10,12 @@ import {
   type Adaptations,
 } from './bedrock.js';
 import { anthropicHeaders, forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
-import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
-import { codexCount, codexMessages, freshCodexState, type CodexDeps } from './codex.js';
+import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
+import { codexCount, codexMessages, freshCodexState } from './codex.js';
+import { freshGeminiState, geminiCount, geminiMessages } from './gemini.js';
+import type { GeminiDeps } from './gemini.js';
+import type { CodexDeps } from './codex.js';
+import type { GeminiTokens } from './gemini-auth.js';
 import { OPENROUTER_BASE } from './openrouter.js';
 import { isRecord } from '@metro-labs/core/is-record';
 import { forgetServed, noteServed } from './served.js';
@@ -32,10 +36,12 @@ export interface GatewayDeps {
   bedrockBase?: string;
   openrouterBase?: string;
   codex?: Partial<CodexDeps>;
+  gemini?: Partial<GeminiDeps>;
 }
 
 const learned: Adaptations = freshAdaptations();
 const codexState = freshCodexState();
+const geminiState = freshGeminiState();
 
 export function resetGatewayState(): void {
   forgetServed();
@@ -43,12 +49,17 @@ export function resetGatewayState(): void {
   learned.fields.clear();
   learned.dropBetas = false;
   Object.assign(codexState, freshCodexState());
+  Object.assign(geminiState, freshGeminiState());
 }
 
 const saveCodexTokens = (tokens: CodexTokens): void => {
   writeModelConfig(setCodexAuth(readModelConfig(), tokens));
 };
 
+const saveGeminiTokens = (tokens: GeminiTokens): void => {
+  writeModelConfig(setGeminiAuth(readModelConfig(), tokens));
+};
+
 const keyOf = (req: IncomingMessage): string => {
   const raw = req.headers['x-metro-key'];
   return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
@@ -64,6 +75,8 @@ function modelsBody(cfg: ModelConfig): Record<string, unknown> {
     data.push({ id: `openrouter:${cfg.openrouter.model}`, display_name: `OpenRouter · ${cfg.openrouter.model}`, description: 'Through metro, billed to OpenRouter' });
   if (cfg.codex.model !== '')
     data.push({ id: `codex:${cfg.codex.model}`, display_name: `Codex · ${cfg.codex.model}`, description: 'Through metro, on your ChatGPT subscription' });
+  if (cfg.gemini.model !== '')
+    data.push({ id: `gemini:${cfg.gemini.model}`, display_name: `Gemini · ${cfg.gemini.model}`, description: 'Through metro, on your Google account' });
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
@@ -94,7 +107,7 @@ async function toAnthropic(
     throw new GatewayError(
       403,
       'permission_error',
-      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter or Codex on the Model page, or sign in on the Claude tab',
+      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter, Codex or Gemini on the Model page, or sign in on the Claude tab',
     );
   const watch = watchUpstream(res);
   const upstream = await fetch(url, {
@@ -156,6 +169,16 @@ function noteRefusal(provider: string, model: string, upstream: Response): void
   if (!upstream.ok) log.warn({ provider, model, status: upstream.status }, 'gateway: the provider refused the request');
 }
 
+async function toSubscription(req: IncomingMessage, res: ServerResponse, path: string, body: Record<string, unknown>, route: Route, cfg: ModelConfig, deps: GatewayDeps): Promise<void> {
+  if (route.provider === 'gemini') {
+    if (path === COUNT) geminiCount(res, body);
+    else await geminiMessages(req, res, body, route.model, cfg, { save: saveGeminiTokens, ...deps.gemini }, geminiState, watchUpstream(res));
+    return;
+  }
+  if (path === COUNT) codexCount(res, body);
+  else await codexMessages(req, res, body, route.model, cfg, { save: saveCodexTokens, ...deps.codex }, codexState, watchUpstream(res));
+}
+
 async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
   const cfg = deps.config();
   const raw = await readBody(req);
@@ -175,13 +198,8 @@ async function dispatch(req: IncomingMessage, res: ServerResponse, path: string,
     await toOpenRouter(req, res, body, route, cfg, deps);
     return;
   }
-  if (route.provider === 'codex') {
-    if (path === COUNT) {
-      codexCount(res, body);
-      return;
-    }
-    const codexDeps: CodexDeps = { save: saveCodexTokens, ...deps.codex };
-    await codexMessages(req, res, body, route.model, cfg, codexDeps, codexState, watchUpstream(res));
+  if (route.provider === 'codex' || route.provider === 'gemini') {
+    await toSubscription(req, res, path, body, route, cfg, deps);
     return;
   }
   await toAnthropic(req, res, raw, body, route, deps);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-auth.ts

@@ -0,0 +1,160 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+
+export const GEMINI_CLIENT_ID = '681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com';
+export const GEMINI_CLIENT_SECRET = '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';
+export const GEMINI_AUTH_BASE = 'https://accounts.google.com';
+export const GEMINI_TOKEN_BASE = 'https://oauth2.googleapis.com';
+export const GEMINI_REDIRECT = 'https://codeassist.google.com/authcode';
+const SCOPE = 'https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile';
+const PENDING_TTL_MS = 10 * 60_000;
+const EXPIRY_MARGIN_MS = 5 * 60_000;
+const DEFAULT_TTL_MS = 55 * 60_000;
+
+export interface GeminiTokens {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  email: string | null;
+  project: string;
+  tier: string | null;
+  savedAt: string;
+}
+
+export class GeminiAuthError extends Error {}
+
+interface Pending {
+  verifier: string;
+  at: number;
+}
+
+const pending = new Map<string, Pending>();
+
+const b64url = (buf: Buffer): string => buf.toString('base64url');
+
+export function newPkce(): { verifier: string; challenge: string } {
+  const verifier = b64url(randomBytes(32));
+  return { verifier, challenge: b64url(createHash('sha256').update(verifier).digest()) };
+}
+
+export function authorizeUrl(state: string, challenge: string, base = GEMINI_AUTH_BASE): string {
+  const params = new URLSearchParams({
+    client_id: GEMINI_CLIENT_ID,
+    redirect_uri: GEMINI_REDIRECT,
+    response_type: 'code',
+    scope: SCOPE,
+    access_type: 'offline',
+    prompt: 'consent',
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    state,
+  });
+  return `${base}/o/oauth2/v2/auth?${params.toString()}`;
+}
+
+function sweep(now: number): void {
+  for (const [state, entry] of pending) if (now - entry.at > PENDING_TTL_MS) pending.delete(state);
+}
+
+export function beginLogin(base = GEMINI_AUTH_BASE, now = Date.now()): { url: string; state: string } {
+  sweep(now);
+  const { verifier, challenge } = newPkce();
+  const state = b64url(randomBytes(16));
+  pending.set(state, { verifier, at: now });
+  return { url: authorizeUrl(state, challenge, base), state };
+}
+
+const text = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+const refusalIn = (body: Record<string, unknown>): string => text(body.error_description) ?? text(body.error) ?? 'Google answered without an access token';
+
+function grantedTokens(body: unknown, previous: GeminiTokens | null): { accessToken: string; refreshToken: string; ttl: number } {
+  if (!isRecord(body)) throw new GeminiAuthError('Google answered without tokens');
+  const accessToken = text(body.access_token);
+  if (accessToken === null) throw new GeminiAuthError(refusalIn(body));
+  const refreshToken = text(body.refresh_token) ?? previous?.refreshToken ?? '';
+  if (refreshToken === '') throw new GeminiAuthError('Google issued no refresh token; sign in again');
+  return { accessToken, refreshToken, ttl: typeof body.expires_in === 'number' ? body.expires_in * 1000 : DEFAULT_TTL_MS };
+}
+
+function tokensOf(body: unknown, previous: GeminiTokens | null, now: number): GeminiTokens {
+  const granted = grantedTokens(body, previous);
+  return {
+    accessToken: granted.accessToken,
+    refreshToken: granted.refreshToken,
+    expiresAt: now + granted.ttl,
+    email: previous?.email ?? null,
+    project: previous?.project ?? '',
+    tier: previous?.tier ?? null,
+    savedAt: new Date(now).toISOString(),
+  };
+}
+
+async function tokenCall(form: Record<string, string>, base: string, fetchImpl: typeof fetch): Promise<unknown> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${base}/token`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new GeminiAuthError(`could not reach Google: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok) throw new GeminiAuthError(isRecord(body) ? (text(body.error_description) ?? text(body.error) ?? `Google answered ${String(res.status)}`) : `Google answered ${String(res.status)}`);
+  return body;
+}
+
+export async function exchangeCode(code: string, state: string, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  sweep(now);
+  const entry = pending.get(state);
+  if (entry === undefined) throw new GeminiAuthError('that sign-in has expired; start it again');
+  pending.delete(state);
+  const trimmed = code.trim();
+  if (trimmed === '') throw new GeminiAuthError('paste the code Google showed');
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'authorization_code', code: trimmed, code_verifier: entry.verifier, redirect_uri: GEMINI_REDIRECT },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, null, now);
+}
+
+export async function refreshTokens(previous: GeminiTokens, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'refresh_token', refresh_token: previous.refreshToken },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, previous, now);
+}
+
+export const tokensStale = (tokens: GeminiTokens, now = Date.now()): boolean => tokens.expiresAt - EXPIRY_MARGIN_MS <= now;
+
+export async function userEmail(tokens: GeminiTokens, base = 'https://www.googleapis.com', fetchImpl: typeof fetch = fetch): Promise<string | null> {
+  try {
+    const res = await fetchImpl(`${base}/oauth2/v2/userinfo`, { headers: { authorization: `Bearer ${tokens.accessToken}` }, signal: AbortSignal.timeout(15_000) });
+    const body: unknown = await res.json().catch(() => null);
+    return res.ok && isRecord(body) ? text(body.email) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function tokensFromDisk(raw: unknown): GeminiTokens | null {
+  if (!isRecord(raw)) return null;
+  const accessToken = text(raw.accessToken);
+  const refreshToken = text(raw.refreshToken);
+  if (accessToken === null || refreshToken === null) return null;
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: typeof raw.expiresAt === 'number' ? raw.expiresAt : 0,
+    email: text(raw.email),
+    project: text(raw.project) ?? '',
+    tier: text(raw.tier),
+    savedAt: text(raw.savedAt) ?? '',
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-setup.ts

@@ -0,0 +1,88 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { GeminiAuthError, type GeminiTokens } from './gemini-auth.js';
+
+export const CODE_ASSIST_BASE = 'https://cloudcode-pa.googleapis.com';
+const API = 'v1internal';
+const METADATA = { ideType: 'IDE_UNSPECIFIED', platform: 'PLATFORM_UNSPECIFIED', pluginType: 'GEMINI' };
+const FREE_TIER = 'free-tier';
+const POLL_MS = 5000;
+const POLL_MAX = 24;
+
+export interface Onboarded {
+  project: string;
+  tier: string | null;
+}
+
+const text = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+async function call(base: string, method: string, token: string, body: unknown, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${base}/${API}:${method}`, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new GeminiAuthError(`could not reach Google Code Assist: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const answer: unknown = await res.json().catch(() => null);
+  if (!res.ok) {
+    const detail = isRecord(answer) && isRecord(answer.error) ? text(answer.error.message) : null;
+    throw new GeminiAuthError(detail ?? `Google Code Assist answered ${String(res.status)} on ${method}`);
+  }
+  return isRecord(answer) ? answer : {};
+}
+
+const tierOf = (load: Record<string, unknown>): { id: string | null; name: string | null } => {
+  const tier = isRecord(load.paidTier) ? load.paidTier : isRecord(load.currentTier) ? load.currentTier : null;
+  return { id: tier === null ? null : text(tier.id), name: tier === null ? null : text(tier.name) };
+};
+
+async function waitOperation(base: string, token: string, first: Record<string, unknown>, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  let op = first;
+  for (let i = 0; op.done !== true && i < POLL_MAX; i += 1) {
+    const name = text(op.name);
+    if (name === null) break;
+    await new Promise((r) => setTimeout(r, POLL_MS));
+    const res = await fetchImpl(`${base}/${API}/${name}`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(30_000) });
+    const answer: unknown = await res.json().catch(() => null);
+    op = isRecord(answer) ? answer : {};
+  }
+  return op;
+}
+
+const REASONS: Record<string, string> = {
+  DASHER_USER: 'this is a Google Workspace account; the individual tier needs a personal Google account',
+  NON_USER_ACCOUNT: 'this is not a user account',
+  RESTRICTED_AGE: 'the account does not meet the age requirement',
+  UNSUPPORTED_LOCATION: 'Gemini Code Assist for individuals is not offered where this account is located',
+  UNKNOWN_LOCATION: 'Google could not tell where this account is located',
+  RESTRICTED_NETWORK: 'the network this box is on is restricted',
+  INELIGIBLE_ACCOUNT: 'Google marks this account as not eligible',
+};
+
+function refuseIneligible(load: Record<string, unknown>): void {
+  if (isRecord(load.currentTier) || !Array.isArray(load.ineligibleTiers)) return;
+  const tiers = load.ineligibleTiers.filter(isRecord);
+  if (tiers.length === 0) return;
+  const validation = tiers.find((t) => t.reasonCode === 'VALIDATION_REQUIRED' && text(t.validationUrl) !== null);
+  if (validation !== undefined) throw new GeminiAuthError(`Google asks you to validate the account first: open ${text(validation.validationUrl) ?? ''} and then connect again`);
+  const said = tiers.map((t) => `${text(t.reasonMessage) ?? 'not eligible'} [${text(t.reasonCode) ?? 'UNKNOWN'}: ${REASONS[text(t.reasonCode) ?? ''] ?? 'no known reason'}]`);
+  throw new GeminiAuthError(said.join('; '));
+}
+
+export async function onboard(tokens: GeminiTokens, base = CODE_ASSIST_BASE, fetchImpl: typeof fetch = fetch): Promise<Onboarded> {
+  const load = await call(base, 'loadCodeAssist', tokens.accessToken, { metadata: METADATA }, fetchImpl);
+  refuseIneligible(load);
+  const tier = tierOf(load);
+  const known = text(load.cloudaicompanionProject);
+  if (known !== null) return { project: known, tier: tier.name ?? tier.id };
+  const tierId = tier.id ?? FREE_TIER;
+  const op = await waitOperation(base, tokens.accessToken, await call(base, 'onboardUser', tokens.accessToken, { tierId, metadata: METADATA }, fetchImpl), fetchImpl);
+  const response = isRecord(op.response) ? op.response : {};
+  const project = isRecord(response.cloudaicompanionProject) ? text(response.cloudaicompanionProject.id) : null;
+  if (project === null) throw new GeminiAuthError('Google did not assign a Code Assist project to this account; sign in to https://geminicli.com once with the Gemini CLI, then try again');
+  return { project, tier: tier.name ?? tierId };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-stream.ts

@@ -0,0 +1,148 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { encodeSignature, newCallId, rememberSignature } from './gemini-translate.js';
+
+type Item = Record<string, unknown>;
+
+interface Open {
+  index: number;
+  kind: 'text' | 'thinking';
+  signature: string | null;
+}
+
+interface Usage {
+  input_tokens: number;
+  output_tokens: number;
+  cache_read_input_tokens: number;
+}
+
+const frame = (event: string, data: unknown): string => `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+const str = (value: unknown): string => (typeof value === 'string' ? value : '');
+const num = (value: unknown): number => (typeof value === 'number' ? value : 0);
+
+const STOP_OF: Record<string, string> = { STOP: 'end_turn', MAX_TOKENS: 'max_tokens' };
+const REFUSALS = new Set(['SAFETY', 'RECITATION', 'BLOCKLIST', 'PROHIBITED_CONTENT', 'SPII', 'MALFORMED_FUNCTION_CALL']);
+
+function usageOf(meta: Item): Usage {
+  const cached = num(meta.cachedContentTokenCount);
+  return {
+    input_tokens: Math.max(0, num(meta.promptTokenCount) - cached),
+    output_tokens: num(meta.candidatesTokenCount) + num(meta.thoughtsTokenCount),
+    cache_read_input_tokens: cached,
+  };
+}
+
+export class GeminiStreamTranslator {
+  private next = 0;
+  private open: Open | null = null;
+  private started = false;
+  private done = false;
+  private toolCalls = 0;
+  private usage: Usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+  private stop = 'end_turn';
+  private refusal: string | null = null;
+  private readonly model: string;
+  private readonly restore: (name: string) => string;
+
+  constructor(model: string, restore: (name: string) => string = (name) => name) {
+    this.model = model;
+    this.restore = restore;
+  }
+
+  get finished(): boolean {
+    return this.done;
+  }
+
+  private start(): string {
+    if (this.started) return '';
+    this.started = true;
+    return frame('message_start', {
+      type: 'message_start',
+      message: { id: 'msg_gemini', type: 'message', role: 'assistant', model: this.model, content: [], stop_reason: null, stop_sequence: null, usage: { input_tokens: 0, output_tokens: 0 } },
+    });
+  }
+
+  private closeOpen(): string {
+    const block = this.open;
+    if (block === null) return '';
+    this.open = null;
+    const signature = block.kind === 'thinking' ? frame('content_block_delta', { type: 'content_block_delta', index: block.index, delta: { type: 'signature_delta', signature: encodeSignature(block.signature ?? '') } }) : '';
+    return signature + frame('content_block_stop', { type: 'content_block_stop', index: block.index });
+  }
+
+  private ensure(kind: Open['kind']): string {
+    if (this.open?.kind === kind) return '';
+    const closed = this.closeOpen();
+    this.open = { index: this.next, kind, signature: null };
+    this.next += 1;
+    const content = kind === 'text' ? { type: 'text', text: '' } : { type: 'thinking', thinking: '' };
+    return closed + frame('content_block_start', { type: 'content_block_start', index: this.open.index, content_block: content });
+  }
+
+  private textPart(part: Item): string {
+    const kind = part.thought === true ? 'thinking' : 'text';
+    const text = str(part.text);
+    let out = this.ensure(kind);
+    const block = this.open;
+    if (block !== null && str(part.thoughtSignature) !== '') block.signature = str(part.thoughtSignature);
+    if (text === '') return out;
+    const delta = kind === 'text' ? { type: 'text_delta', text } : { type: 'thinking_delta', thinking: text };
+    out += frame('content_block_delta', { type: 'content_block_delta', index: block?.index ?? 0, delta });
+    return out;
+  }
+
+  private callPart(call: Item, signature: string): string {
+    this.toolCalls += 1;
+    const id = str(call.id) || newCallId();
+    if (signature !== '') rememberSignature(id, signature);
+    const index = this.next;
+    this.next += 1;
+    return (
+      this.closeOpen() +
+      frame('content_block_start', { type: 'content_block_start', index, content_block: { type: 'tool_use', id, name: this.restore(str(call.name)), input: {} } }) +
+      frame('content_block_delta', { type: 'content_block_delta', index, delta: { type: 'input_json_delta', partial_json: JSON.stringify(isRecord(call.args) ? call.args : {}) } }) +
+      frame('content_block_stop', { type: 'content_block_stop', index })
+    );
+  }
+
+  private part(part: Item): string {
+    if (isRecord(part.functionCall)) return this.callPart(part.functionCall, str(part.thoughtSignature));
+    if (typeof part.text === 'string') return this.textPart(part);
+    return '';
+  }
+
+  private candidate(candidate: Item): string {
+    const content = isRecord(candidate.content) ? candidate.content : {};
+    const parts = Array.isArray(content.parts) ? content.parts.filter(isRecord) : [];
+    const out = parts.map((part) => this.part(part)).join('');
+    const finish = str(candidate.finishReason);
+    const stop = STOP_OF[finish];
+    if (stop !== undefined) this.stop = stop;
+    else if (REFUSALS.has(finish)) this.refusal = `Gemini stopped the answer (${finish})`;
+    return out;
+  }
+
+  push(data: Item): string {
+    if (this.done) return '';
+    const response = isRecord(data.response) ? data.response : data;
+    const out = this.start();
+    if (isRecord(response.usageMetadata)) this.usage = usageOf(response.usageMetadata);
+    const candidate = Array.isArray(response.candidates) ? response.candidates.find(isRecord) : undefined;
+    if (candidate !== undefined) return out + this.candidate(candidate);
+    const feedback = isRecord(response.promptFeedback) ? str(response.promptFeedback.blockReason) : '';
+    if (feedback !== '') this.refusal = `Gemini blocked the prompt (${feedback})`;
+    return out;
+  }
+
+  close(error?: string): string {
+    if (this.done) return '';
+    this.done = true;
+    let out = this.start() + this.closeOpen();
+    const failure = error ?? this.refusal;
+    if (failure !== null && failure !== undefined && this.toolCalls === 0 && this.next === 0)
+      return out + frame('error', { type: 'error', error: { type: 'api_error', message: failure } });
+    const stop = this.toolCalls > 0 ? 'tool_use' : this.stop;
+    out += frame('message_delta', { type: 'message_delta', delta: { stop_reason: stop, stop_sequence: null }, usage: this.usage });
+    out += frame('message_stop', { type: 'message_stop' });
+    return out;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-translate.ts

@@ -0,0 +1,190 @@
+import { randomBytes } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { ToolNames } from './codex-translate.js';
+
+type Item = Record<string, unknown>;
+
+export const SIGNATURE_PREFIX = 'metro-gemini:';
+const IMAGE_NOTE = '[an image was attached here; this model cannot see it]';
+const SCHEMA_DROP = new Set(['$schema', '$id', 'additionalProperties', 'examples', 'default', 'title']);
+const SIGNATURES_MAX = 2000;
+
+const textOf = (value: unknown): string => (typeof value === 'string' ? value : '');
+
+const callSignatures = new Map<string, string>();
+
+export function rememberSignature(id: string, signature: string): void {
+  callSignatures.set(id, signature);
+  if (callSignatures.size > SIGNATURES_MAX) {
+    const first = callSignatures.keys().next().value;
+    if (first !== undefined) callSignatures.delete(first);
+  }
+}
+
+export const newCallId = (): string => `toolu_gm_${randomBytes(12).toString('base64url')}`;
+
+export const encodeSignature = (signature: string): string => `${SIGNATURE_PREFIX}${Buffer.from(signature).toString('base64url')}`;
+
+export function decodeSignature(signature: unknown): string | null {
+  if (typeof signature !== 'string' || !signature.startsWith(SIGNATURE_PREFIX)) return null;
+  const raw = Buffer.from(signature.slice(SIGNATURE_PREFIX.length), 'base64url').toString('utf8');
+  return raw === '' ? null : raw;
+}
+
+export function systemText(system: unknown): string {
+  if (typeof system === 'string') return system.trim();
+  if (!Array.isArray(system)) return '';
+  return system
+    .filter(isRecord)
+    .map((block) => textOf(block.text))
+    .filter((t) => t !== '')
+    .join('\n\n')
+    .trim();
+}
+
+function userPart(block: Item): Item | null {
+  if (block.type === 'text') return { text: textOf(block.text) };
+  if (block.type === 'image' && isRecord(block.source) && block.source.type === 'base64')
+    return { inlineData: { mimeType: textOf(block.source.media_type), data: textOf(block.source.data) } };
+  return null;
+}
+
+const partText = (part: Item): string => (part.type === 'text' ? textOf(part.text) : part.type === 'image' ? IMAGE_NOTE : '');
+
+function resultText(block: Item): string {
+  const content = block.content;
+  const text = typeof content === 'string' ? content : Array.isArray(content) ? content.filter(isRecord).map(partText).filter((t) => t !== '').join('\n') : '';
+  return block.is_error === true ? `[tool error] ${text}` : text;
+}
+
+function userParts(content: unknown, calls: Map<string, string>): Item[] {
+  if (typeof content === 'string') return content === '' ? [] : [{ text: content }];
+  if (!Array.isArray(content)) return [];
+  const out: Item[] = [];
+  for (const block of content.filter(isRecord)) {
+    if (block.type === 'tool_result') {
+      const id = textOf(block.tool_use_id);
+      out.push({ functionResponse: { id, name: calls.get(id) ?? 'tool', response: { result: resultText(block) } } });
+      continue;
+    }
+    const part = userPart(block);
+    if (part !== null) out.push(part);
+  }
+  return out;
+}
+
+function callPart(block: Item, names: ToolNames, calls: Map<string, string>): Item {
+  const id = textOf(block.id);
+  const name = names.alias(textOf(block.name));
+  calls.set(id, name);
+  const signature = callSignatures.get(id);
+  return { functionCall: { id, name, args: isRecord(block.input) ? block.input : {} }, ...(signature === undefined ? {} : { thoughtSignature: signature }) };
+}
+
+function assistantPart(block: Item, names: ToolNames, calls: Map<string, string>): Item | null {
+  if (block.type === 'text') return { text: textOf(block.text) };
+  if (block.type === 'tool_use') return callPart(block, names, calls);
+  if (block.type !== 'thinking') return null;
+  const signature = decodeSignature(block.signature);
+  return signature === null ? null : { text: textOf(block.thinking) || ' ', thought: true, thoughtSignature: signature };
+}
+
+function assistantParts(content: unknown, names: ToolNames, calls: Map<string, string>): Item[] {
+  if (typeof content === 'string') return content === '' ? [] : [{ text: content }];
+  if (!Array.isArray(content)) return [];
+  const out: Item[] = [];
+  for (const block of content.filter(isRecord)) {
+    const part = assistantPart(block, names, calls);
+    if (part !== null) out.push(part);
+  }
+  return out;
+}
+
+function appendTurn(out: Item[], role: string, parts: Item[]): void {
+  if (parts.length === 0) return;
+  const last = out.at(-1);
+  const held = last?.role === role && Array.isArray(last.parts) ? (last.parts as Item[]) : null;
+  if (held !== null) held.push(...parts);
+  else out.push({ role, parts });
+}
+
+export function contentsOf(messages: unknown, names = new ToolNames()): Item[] {
+  const out: Item[] = [];
+  if (!Array.isArray(messages)) return out;
+  const calls = new Map<string, string>();
+  for (const message of messages.filter(isRecord)) {
+    const model = message.role === 'assistant';
+    appendTurn(out, model ? 'model' : 'user', model ? assistantParts(message.content, names, calls) : userParts(message.content, calls));
+  }
+  return out;
+}
+
+export function cleanSchema(schema: unknown): unknown {
+  if (Array.isArray(schema)) return schema.map(cleanSchema);
+  if (!isRecord(schema)) return schema;
+  const out: Item = {};
+  for (const [key, value] of Object.entries(schema)) {
+    if (SCHEMA_DROP.has(key)) continue;
+    if (key === 'const') {
+      out.enum = [value];
+      continue;
+    }
+    out[key] = cleanSchema(value);
+  }
+  return out;
+}
+
+export function toolDeclarations(tools: unknown, names = new ToolNames()): Item[] {
+  if (!Array.isArray(tools)) return [];
+  return tools
+    .filter(isRecord)
+    .filter((tool) => typeof tool.name === 'string' && (tool.type === undefined || tool.type === 'custom'))
+    .map((tool) => ({
+      name: names.alias(textOf(tool.name)),
+      description: textOf(tool.description),
+      parameters: cleanSchema(isRecord(tool.input_schema) ? tool.input_schema : { type: 'object', properties: {} }),
+    }));
+}
+
+function toolConfig(choice: unknown, names: ToolNames): Item | null {
+  if (!isRecord(choice)) return null;
+  if (choice.type === 'any') return { functionCallingConfig: { mode: 'ANY' } };
+  if (choice.type === 'none') return { functionCallingConfig: { mode: 'NONE' } };
+  if (choice.type === 'tool') return { functionCallingConfig: { mode: 'ANY', allowedFunctionNames: [names.alias(textOf(choice.name))] } };
+  return null;
+}
+
+function generationConfig(body: Item): Item {
+  const out: Item = {};
+  if (typeof body.max_tokens === 'number') out.maxOutputTokens = body.max_tokens;
+  if (typeof body.temperature === 'number') out.temperature = body.temperature;
+  if (typeof body.top_p === 'number') out.topP = body.top_p;
+  if (isRecord(body.thinking) && body.thinking.type === 'enabled') out.thinkingConfig = { includeThoughts: true };
+  return out;
+}
+
+export interface GeminiRequest {
+  model: string;
+  project: string;
+  user_prompt_id: string;
+  request: Item;
+}
+
+export function toGeminiRequest(body: Item, model: string, project: string, promptId: string, names = new ToolNames()): GeminiRequest {
+  const system = systemText(body.system);
+  const declarations = toolDeclarations(body.tools, names);
+  const config = toolConfig(body.tool_choice, names);
+  return {
+    model,
+    project,
+    user_prompt_id: promptId,
+    request: {
+      contents: contentsOf(body.messages, names),
+      ...(system === '' ? {} : { systemInstruction: { role: 'user', parts: [{ text: system }] } }),
+      ...(declarations.length === 0 ? {} : { tools: [{ functionDeclarations: declarations }] }),
+      ...(config === null ? {} : { toolConfig: config }),
+      generationConfig: generationConfig(body),
+      session_id: promptId,
+    },
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini.ts

@@ -0,0 +1,196 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg } from '@metro-labs/core/log';
+import { refreshTokens, tokensStale, type GeminiTokens } from './gemini-auth.js';
+import { CODE_ASSIST_BASE } from './gemini-setup.js';
+import { GeminiStreamTranslator } from './gemini-stream.js';
+import { toGeminiRequest } from './gemini-translate.js';
+import { ToolNames } from './codex-translate.js';
+import { assembleMessage, SseParser } from './codex-stream.js';
+import { GatewayError, idleMessage, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
+import type { ModelConfig } from './model-config.js';
+import { UsageScanner } from './usage.js';
+
+const PING_MS = 25_000;
+const CLI_VERSION = '0.62.0';
+const STATUS_OF: Record<string, number> = { rate_limit_error: 429, invalid_request_error: 400, permission_error: 403, overloaded_error: 529 };
+
+export const KNOWN_GEMINI_MODELS = ['gemini-3.1-pro-preview', 'gemini-3-pro-preview', 'gemini-3-flash-preview', 'gemini-3.1-flash-lite', 'gemini-2.5-pro', 'gemini-2.5-flash'];
+
+export interface GeminiDeps {
+  base?: string;
+  tokenBase?: string;
+  fetchImpl?: typeof fetch;
+  save: (tokens: GeminiTokens) => void;
+}
+
+export interface GeminiState {
+  refreshing: Promise<GeminiTokens> | null;
+  latest: GeminiTokens | null;
+}
+
+export const freshGeminiState = (): GeminiState => ({ refreshing: null, latest: null });
+
+export const userAgent = (model: string): string => `GeminiCLI/${CLI_VERSION}/${model} (${process.platform}; ${process.arch}; metro)`;
+
+const newerThan = (a: GeminiTokens, b: GeminiTokens): boolean => Date.parse(a.savedAt) > Date.parse(b.savedAt);
+
+function refreshed(tokens: GeminiTokens, deps: GeminiDeps, state: GeminiState): Promise<GeminiTokens> {
+  const latest = state.latest;
+  if (latest !== null && newerThan(latest, tokens) && !tokensStale(latest)) return Promise.resolve(latest);
+  if (state.refreshing !== null) return state.refreshing;
+  const run = refreshTokens(tokens, deps.tokenBase, deps.fetchImpl)
+    .then((fresh) => {
+      deps.save(fresh);
+      state.latest = fresh;
+      return fresh;
+    })
+    .catch((err: unknown) => {
+      throw new GatewayError(403, 'permission_error', `Google sign-in expired (${errMsg(err)}): connect again on the Model page`);
+    })
+    .finally(() => {
+      state.refreshing = null;
+    });
+  state.refreshing = run;
+  return run;
+}
+
+export function currentGeminiTokens(cfg: ModelConfig, deps: GeminiDeps, state: GeminiState): Promise<GeminiTokens> {
+  const tokens = cfg.gemini.auth;
+  if (tokens === null) throw new GatewayError(400, 'invalid_request_error', 'Gemini is not connected: sign in with Google on the Model page.');
+  return tokensStale(tokens) ? refreshed(tokens, deps, state) : Promise.resolve(tokens);
+}
+
+function errorKind(status: number): string {
+  if (status === 401 || status === 403) return 'permission_error';
+  if (status === 429) return 'rate_limit_error';
+  if (status === 400 || status === 404) return 'invalid_request_error';
+  return 'api_error';
+}
+
+const promptIdOf = (req: IncomingMessage): string => {
+  const raw = req.headers['x-claude-code-session-id'];
+  const given = (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+  return given === '' ? 'metro' : given;
+};
+
+interface Call {
+  body: Record<string, unknown>;
+  model: string;
+  promptId: string;
+  watch: Watch;
+  deps: GeminiDeps;
+  names: ToolNames;
+}
+
+function send(call: Call, tokens: GeminiTokens, stream: boolean): Promise<Response> {
+  const request = toGeminiRequest(call.body, call.model, tokens.project, call.promptId, call.names);
+  const method = stream ? 'streamGenerateContent?alt=sse' : 'generateContent';
+  return (call.deps.fetchImpl ?? fetch)(`${call.deps.base ?? CODE_ASSIST_BASE}/v1internal:${method}`, {
+    method: 'POST',
+    headers: { authorization: `Bearer ${tokens.accessToken}`, 'content-type': 'application/json', 'user-agent': userAgent(call.model) },
+    body: JSON.stringify(request),
+    signal: call.watch.signal,
+    redirect: 'manual',
+  });
+}
+
+async function reach(call: Call, cfg: ModelConfig, state: GeminiState, stream: boolean): Promise<Response> {
+  let tokens = await currentGeminiTokens(cfg, call.deps, state);
+  let upstream = await send(call, tokens, stream);
+  if (upstream.status === 401) {
+    await upstream.body?.cancel();
+    tokens = await refreshed(tokens, call.deps, state);
+    upstream = await send(call, tokens, stream);
+  }
+  return upstream;
+}
+
+const parseData = (raw: string): Record<string, unknown> | null => {
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+};
+
+async function relayStream(upstream: Response, res: ServerResponse, call: Call): Promise<void> {
+  res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-store', connection: 'keep-alive' });
+  const translator = new GeminiStreamTranslator(call.model, (name) => call.names.restore(name));
+  const body = upstream.body;
+  if (body === null) {
+    res.end(translator.close());
+    return;
+  }
+  const ping = setInterval(() => res.write('event: ping\ndata: {"type":"ping"}\n\n'), PING_MS);
+  const scanner = new UsageScanner('gemini');
+  const emit = (frames: string): void => {
+    if (frames === '') return;
+    scanner.feed(frames);
+    res.write(frames);
+  };
+  try {
+    const parser = new SseParser();
+    const decoder = new TextDecoder();
+    const reader = body.getReader();
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      call.watch.touch();
+      for (const raw of parser.push(decoder.decode(value, { stream: true }))) {
+        const data = parseData(raw.data);
+        if (data !== null) emit(translator.push(data));
+      }
+    }
+    emit(translator.close());
+  } catch (err) {
+    if (!call.watch.idle()) throw err;
+    res.write(translator.finished ? '' : translator.close(idleMessage(call.watch.ms)));
+  } finally {
+    clearInterval(ping);
+    call.watch.stop();
+    res.end();
+    scanner.done();
+  }
+}
+
+async function relayWhole(upstream: Response, res: ServerResponse, call: Call): Promise<void> {
+  const translator = new GeminiStreamTranslator(call.model, (name) => call.names.restore(name));
+  const data = parseData(await upstream.text());
+  const frames = (data === null ? '' : translator.push(data)) + translator.close();
+  const scanner = new UsageScanner('gemini');
+  scanner.feed(frames);
+  scanner.done();
+  const message = assembleMessage(frames);
+  const kind = isRecord(message.error) ? String(message.error.type) : '';
+  res.writeHead(message.type === 'error' ? (STATUS_OF[kind] ?? 502) : 200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(message));
+}
+
+export async function geminiMessages(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  model: string,
+  cfg: ModelConfig,
+  deps: GeminiDeps,
+  state: GeminiState,
+  watch: Watch,
+): Promise<void> {
+  const stream = body.stream === true;
+  const call: Call = { body, model, promptId: promptIdOf(req), watch, deps, names: new ToolNames() };
+  const upstream = await reach(call, cfg, state, stream);
+  if (!upstream.ok) {
+    const text = await upstream.text();
+    sendError(res, providerStatus(upstream.status), errorKind(upstream.status), upstreamMessage(text, `Gemini answered ${String(upstream.status)}`));
+    return;
+  }
+  if (stream) await relayStream(upstream, res, call);
+  else await relayWhole(upstream, res, call);
+}
+
+export function geminiCount(res: ServerResponse, body: Record<string, unknown>): void {
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ input_tokens: Math.ceil(JSON.stringify(body).length / 4) }));
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -6,6 +6,9 @@ import { errMsg, log } from '@metro-labs/core/log';
 import { beginLogin, CodexAuthError, finishLogin, readCodexCliAuth } from './codex-auth.js';
 import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
 import { codexModels, currentTokens, freshCodexState } from './codex.js';
+import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, GeminiAuthError, userEmail } from './gemini-auth.js';
+import { onboard } from './gemini-setup.js';
+import { KNOWN_GEMINI_MODELS } from './gemini.js';
 import { openrouterCredits, openrouterModels, openrouterZdrModels } from './openrouter.js';
 import { anthropicModels, bedrockModels } from './provider-models.js';
 import { syncAvailableModelsQuietly, type SetupDeps } from '../claude/setup.js';
@@ -20,12 +23,14 @@ import {
   publicModelConfig,
   readModelConfig,
   setCodexAuth,
+  setGeminiAuth,
   writeModelConfig,
   type ModelConfig,
 } from './model-config.js';
 
 const PATH = '/api/model';
 const CODEX = '/api/model/codex/';
+const GEMINI = '/api/model/gemini/';
 const OPENROUTER = '/api/model/openrouter/';
 const ANTHROPIC = '/api/model/anthropic/';
 const BEDROCK = '/api/model/bedrock/';
@@ -44,6 +49,10 @@ export interface ModelApiDeps {
   fetchImpl?: typeof fetch;
   codexHome?: string;
   codexBase?: string;
+  geminiAuthBase?: string;
+  geminiTokenBase?: string;
+  geminiUserBase?: string;
+  geminiBase?: string;
   openrouterBase?: string;
   anthropicBase?: string;
   bedrockControlBase?: string;
@@ -89,7 +98,7 @@ async function settingsWithUsage(cfg: ModelConfig, deps: ModelApiDeps): Promise<
 }
 
 function asApiError(err: unknown): never {
-  if (err instanceof ModelConfigError || err instanceof CodexAuthError) throw new ApiError(err.message, 400);
+  if (err instanceof ModelConfigError || err instanceof CodexAuthError || err instanceof GeminiAuthError) throw new ApiError(err.message, 400);
   if (err instanceof GatewayError) throw new ApiError(err.message, err.status >= 400 && err.status < 500 ? 400 : 502);
   throw err;
 }
@@ -172,6 +181,37 @@ const CODEX_ROUTES: Record<string, Route> = {
   },
 };
 
+async function connectGemini(req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const body = await readJsonBody(req, BODY_MAX);
+  const code = isRecord(body) && typeof body.code === 'string' ? body.code : '';
+  const state = isRecord(body) && typeof body.state === 'string' ? body.state : '';
+  const tokens = await exchangeGeminiCode(code, state, deps.geminiTokenBase, deps.fetchImpl).catch(asApiError);
+  const email = await userEmail(tokens, deps.geminiUserBase, deps.fetchImpl);
+  const onboarded = await onboard(tokens, deps.geminiBase, deps.fetchImpl).catch(asApiError);
+  const cfg = setGeminiAuth(store.read(), { ...tokens, email, project: onboarded.project, tier: onboarded.tier });
+  store.write(cfg);
+  log.info({ tier: onboarded.tier }, 'model-api: Gemini connected');
+  return settingsBody(cfg);
+}
+
+const GEMINI_ROUTES: Record<string, Route> = {
+  login: {
+    method: 'POST',
+    run: (_req, deps) => Promise.resolve(beginGeminiLogin(deps.geminiAuthBase)),
+  },
+  code: { method: 'POST', run: connectGemini },
+  logout: {
+    method: 'POST',
+    run: (_req, _deps, store) => {
+      const cfg = setGeminiAuth(store.read(), null);
+      store.write(cfg);
+      log.info('model-api: Gemini disconnected');
+      return Promise.resolve(settingsBody(cfg));
+    },
+  },
+  models: { method: 'GET', run: () => Promise.resolve({ models: KNOWN_GEMINI_MODELS }) },
+};
+
 const OPENROUTER_ROUTES: Record<string, Route> = {
   models: {
     method: 'GET',
@@ -232,7 +272,7 @@ function codexRoute(rest: string, method: string | undefined): Route | number {
 }
 
 const mine = (path: string): boolean =>
-  path === PATH || path === BUNDLE || path === RESTORE || path.startsWith(CODEX) || path.startsWith(OPENROUTER) || path.startsWith(ANTHROPIC) || path.startsWith(BEDROCK);
+  path === PATH || path === BUNDLE || path === RESTORE || path.startsWith(CODEX) || path.startsWith(GEMINI) || path.startsWith(OPENROUTER) || path.startsWith(ANTHROPIC) || path.startsWith(BEDROCK);
 
 function routeFor(path: string, method: string | undefined): Route | number {
   if (path === PATH) return settingsRoute(method);
@@ -240,6 +280,7 @@ function routeFor(path: string, method: string | undefined): Route | number {
   if (path.startsWith(OPENROUTER)) return named(OPENROUTER_ROUTES, path.slice(OPENROUTER.length), method);
   if (path.startsWith(ANTHROPIC)) return named(ANTHROPIC_ROUTES, path.slice(ANTHROPIC.length), method);
   if (path.startsWith(BEDROCK)) return named(BEDROCK_ROUTES, path.slice(BEDROCK.length), method);
+  if (path.startsWith(GEMINI)) return named(GEMINI_ROUTES, path.slice(GEMINI.length), method);
   return codexRoute(path.slice(CODEX.length), method);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -3,8 +3,9 @@ import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
 import type { CodexTokens } from './codex-auth.js';
+import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
 
-export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex'] as const;
+export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
 export type Provider = (typeof PROVIDERS)[number];
 
 export interface AnthropicSettings {
@@ -29,6 +30,11 @@ export interface CodexSettings {
   auth: CodexTokens | null;
 }
 
+export interface GeminiSettings {
+  model: string;
+  auth: GeminiTokens | null;
+}
+
 export interface ModelConfig {
   version: 1;
   provider: Provider;
@@ -36,6 +42,7 @@ export interface ModelConfig {
   bedrock: BedrockSettings;
   openrouter: OpenRouterSettings;
   codex: CodexSettings;
+  gemini: GeminiSettings;
 }
 
 export interface Route {
@@ -47,7 +54,7 @@ export class ModelConfigError extends Error {}
 
 export const MODEL_FILE = 'model.json';
 const MAX_FIELD = 512;
-const PREFIX_RE = /^(anthropic|bedrock|openrouter|codex):(.+)$/;
+const PREFIX_RE = /^(anthropic|bedrock|openrouter|codex|gemini):(.+)$/;
 const SMALL_RE = /haiku/i;
 
 const empty = (): ModelConfig => ({
@@ -57,6 +64,7 @@ const empty = (): ModelConfig => ({
   bedrock: { region: '', apiKey: '', model: '' },
   openrouter: { apiKey: '', model: '', zdr: false },
   codex: { model: '', auth: null },
+  gemini: { model: '', auth: null },
 });
 
 const isProvider = (value: unknown): value is Provider =>
@@ -89,6 +97,7 @@ export function parseModelConfig(raw: unknown): ModelConfig {
   const bedrock = isRecord(raw.bedrock) ? raw.bedrock : {};
   const openrouter = isRecord(raw.openrouter) ? raw.openrouter : {};
   const codex = isRecord(raw.codex) ? raw.codex : {};
+  const gemini = isRecord(raw.gemini) ? raw.gemini : {};
   return {
     version: 1,
     provider: isProvider(raw.provider) ? raw.provider : 'anthropic',
@@ -96,6 +105,7 @@ export function parseModelConfig(raw: unknown): ModelConfig {
     bedrock: { region: text(bedrock.region), apiKey: text(bedrock.apiKey), model: text(bedrock.model) },
     openrouter: { apiKey: text(openrouter.apiKey), model: text(openrouter.model), zdr: openrouter.zdr === true },
     codex: { model: text(codex.model), auth: tokensFromDisk(codex.auth) },
+    gemini: { model: text(gemini.model), auth: geminiTokensFromDisk(gemini.auth) },
   };
 }
 
@@ -130,6 +140,7 @@ export function applyModelUpdate(cfg: ModelConfig, patch: unknown): ModelConfig
   const bedrock = isRecord(patch.bedrock) ? patch.bedrock : {};
   const openrouter = isRecord(patch.openrouter) ? patch.openrouter : {};
   const codex = isRecord(patch.codex) ? patch.codex : {};
+  const gemini = isRecord(patch.gemini) ? patch.gemini : {};
   return {
     version: 1,
     provider,
@@ -148,11 +159,14 @@ export function applyModelUpdate(cfg: ModelConfig, patch: unknown): ModelConfig
       zdr: flag(openrouter, 'zdr', cfg.openrouter.zdr, 'OpenRouter zero data retention'),
     },
     codex: { model: field(codex, 'model', cfg.codex.model, 'Codex model'), auth: cfg.codex.auth },
+    gemini: { model: field(gemini, 'model', cfg.gemini.model, 'Gemini model'), auth: cfg.gemini.auth },
   };
 }
 
 export const setCodexAuth = (cfg: ModelConfig, auth: CodexTokens | null): ModelConfig => ({ ...cfg, codex: { ...cfg.codex, auth } });
 
+export const setGeminiAuth = (cfg: ModelConfig, auth: GeminiTokens | null): ModelConfig => ({ ...cfg, gemini: { ...cfg.gemini, auth } });
+
 const CHECKS: Record<Provider, [(cfg: ModelConfig) => boolean, string][]> = {
   anthropic: [],
   bedrock: [
@@ -167,6 +181,10 @@ const CHECKS: Record<Provider, [(cfg: ModelConfig) => boolean, string][]> = {
     [(cfg) => cfg.codex.auth === null, 'Codex is not connected: sign in with ChatGPT on the Model page.'],
     [(cfg) => cfg.codex.model === '', 'Codex needs a model id: choose one on the Model page.'],
   ],
+  gemini: [
+    [(cfg) => cfg.gemini.auth === null, 'Gemini is not connected: sign in with Google on the Model page.'],
+    [(cfg) => cfg.gemini.model === '', 'Gemini needs a model id: choose one on the Model page.'],
+  ],
 };
 
 export function notReady(cfg: ModelConfig, provider: Provider = cfg.provider): string | null {
@@ -175,6 +193,7 @@ export function notReady(cfg: ModelConfig, provider: Provider = cfg.provider): s
 
 export function publicModelConfig(cfg: ModelConfig): Record<string, unknown> {
   const auth = cfg.codex.auth;
+  const gemini = cfg.gemini.auth;
   return {
     provider: cfg.provider,
     ready: notReady(cfg) === null,
@@ -183,16 +202,22 @@ export function publicModelConfig(cfg: ModelConfig): Record<string, unknown> {
     bedrock: { region: cfg.bedrock.region, model: cfg.bedrock.model, hasKey: cfg.bedrock.apiKey !== '' },
     openrouter: { model: cfg.openrouter.model, hasKey: cfg.openrouter.apiKey !== '', zdr: cfg.openrouter.zdr },
     codex: { model: cfg.codex.model, signedIn: auth !== null, account: auth?.email ?? null, plan: auth?.plan ?? null },
+    gemini: { model: cfg.gemini.model, signedIn: gemini !== null, account: gemini?.email ?? null, plan: gemini?.tier ?? null },
   };
 }
 
 export const isSmallModel = (requested: string): boolean => SMALL_RE.test(requested);
 
+const DEFAULTS: Record<Provider, (requested: string, cfg: ModelConfig) => string> = {
+  openrouter: (requested, cfg) => (requested.includes('/') ? requested : cfg.openrouter.model),
+  bedrock: (requested, cfg) => (cfg.bedrock.model === '' ? requested : cfg.bedrock.model),
+  codex: (requested, cfg) => (requested.startsWith('gpt-') ? requested : cfg.codex.model),
+  gemini: (requested, cfg) => (requested.startsWith('gemini-') ? requested : cfg.gemini.model),
+  anthropic: (requested, cfg) => (cfg.anthropic.model === '' || isSmallModel(requested) ? requested : cfg.anthropic.model),
+};
+
 function defaultModelFor(provider: Provider, requested: string, cfg: ModelConfig): string {
-  if (provider === 'openrouter') return requested.includes('/') ? requested : cfg.openrouter.model;
-  if (provider === 'bedrock') return cfg.bedrock.model === '' ? requested : cfg.bedrock.model;
-  if (provider === 'codex') return requested.startsWith('gpt-') ? requested : cfg.codex.model;
-  return cfg.anthropic.model === '' || isSmallModel(requested) ? requested : cfg.anthropic.model;
+  return DEFAULTS[provider](requested, cfg);
 }
 
 export function resolveRoute(requested: string, cfg: ModelConfig): Route {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage.ts

@@ -1,4 +1,4 @@
-export type UsageProvider = 'anthropic' | 'codex' | 'openrouter' | 'bedrock';
+export type UsageProvider = 'anthropic' | 'codex' | 'openrouter' | 'bedrock' | 'gemini';
 
 export interface UsageWindow {
   label: string;

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.146"
+  "version": "0.1.0-beta.148"
 }