clauderipple 0.6.0 → 0.8.0

package/dist/router/src/admin.js

@@ -8,32 +8,45 @@
 //   GET  /api/chatgpt-login  ChatGPT browser login state and credential status
 //   GET  /api/chatgpt-accounts?provider=   signed-in ChatGPT accounts, rotation state, quota (no tokens)
 //   PATCH/DELETE /api/chatgpt-accounts/:id rename, pause/resume, clear a cooldown; remove
-//   GET  /*             static files from packages/ui (the GUI itself)
+//   POST /api/google-login   begin a Google (Antigravity) browser sign-in; GET polls the state
+//   POST /api/google-login/code  paste the code when no loopback callback could be used
+//   GET  /api/google-accounts?provider=   signed-in Google accounts, rotation state (no tokens)
+//   PATCH/DELETE /api/google-accounts/:id rename, pause/resume, clear a cooldown; remove
+//   GET  /api/update    whether a newer version is published, and how this copy was installed
+//   POST /api/update    start `clauderipple update` in the background (it restarts this router)
+//   GET  /*           static files from packages/ui (the GUI itself)
 import crypto from "node:crypto";
 import fs from "node:fs";
 import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import http from "node:http";
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { homeDir, validate } from "./config.js";
 import { PRESETS } from "./presets.js";
 import { resolveCompatibleCaps } from "./compat.js";
 import { CHATGPT_FALLBACK_MODELS } from "./providers/chatgpt/catalog.js";
 import { measureModel, refusedByPlan } from "./capabilities.js";
+import { catalogEntry } from "./catalog.js";
 import { ClaudeCodeAuthStore, nativeAnthropicHeaders } from "./providers/anthropic.js";
 import { codexEnabled, codexHome } from "../../cli/src/codex.js";
 import { openBrowser } from "../../cli/src/browser.js";
 import { caTrusted, currentAppProxy } from "../../cli/src/picker.js";
 import { certPaths } from "../../cli/src/certs.js";
 import { desktopClaudeCodeDirs } from "../../cli/src/claude-auth.js";
-import { syncModelSlots } from "../../cli/src/settings.js";
+import { statusModEnabled, syncModelSlots } from "../../cli/src/settings.js";
 import { ClaudeOAuthSession } from "./providers/claude-oauth.js";
 import { readClaudeAuthFile } from "./providers/anthropic-token-file.js";
 import { listClaudeAccounts, removeClaudeAccount, renameClaudeAccount } from "./providers/anthropic-accounts.js";
 import { readChatGptAccounts, removeChatGptAccount, summarize as summarizeChatGptAccount, updateChatGptAccount } from "./providers/chatgpt/accounts.js";
+import { IMAGE_ASPECTS, IMAGE_BACKGROUNDS, IMAGE_FORMATS } from "./providers/chatgpt/index.js";
+import { ANTIGRAVITY_WARNING, staticAntigravityModels } from "./providers/google/antigravity.js";
+import { readGoogleAccounts, removeGoogleAccount, summarize as summarizeGoogleAccount, updateGoogleAccount } from "./providers/google/accounts.js";
+import { GoogleOAuthSession } from "./providers/google/login.js";
 const MAX_BODY = 1024 * 1024;
+/** `/api/image` carries reference images inline, so it gets more room than a config save. */
+const MAX_IMAGE_BODY = 32 * 1024 * 1024;
 const here = path.dirname(fileURLToPath(import.meta.url));
 const STARTED_AT = new Date().toISOString();
 // packages/router/src → packages/ui in a checkout; dist/router/src → dist/ui in an npm install,
@@ -79,6 +92,23 @@ const CHATGPT_DEFAULT_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 let chatgptLogin = { running: false };
 /** The Claude subscription sign-in in progress (or the last one), for GET /api/claude-oauth. */
 let claudeOAuth = null;
+/** The Google (Antigravity) sign-in in progress (or the last one), for GET /api/google-login. */
+let googleOAuth = null;
+/** When the GUI last started an update. It restarts this router, so a fresh process starts at 0. */
+let updateStartedAt = 0;
+const UPDATE_RUN_MS = 10 * 60 * 1000;
+/** The last line of `clauderipple update --check --json`, or null when it said something else. */
+export function parseUpdateCheck(output) {
+    try {
+        const check = JSON.parse(output.trim().split("\n").pop() ?? "");
+        if (typeof check.current !== "string" || typeof check.newer !== "boolean" || typeof check.kind !== "string")
+            return null;
+        return { current: check.current, latest: typeof check.latest === "string" ? check.latest : null, newer: check.newer, kind: check.kind };
+    }
+    catch {
+        return null;
+    }
+}
 /** Shared catalog for the GUI: model-specific values override provider defaults. */
 export function effortLevels(cfg) {
     const providers = {
@@ -107,6 +137,13 @@ export function effortLevels(cfg) {
             };
             continue;
         }
+        if (provider.type === "google") {
+            // Gemini exposes its ladder per model (the probe fills `effortLevels`); there is no
+            // provider-wide default, so the union of what the models declared is the fallback.
+            const levels = [...new Set((provider.models ?? []).flatMap((model) => model.effortLevels ?? []))];
+            providers[name] = { default: levels, ...(Object.keys(modelLevels).length ? { models: modelLevels } : {}) };
+            continue;
+        }
         if (provider.type === "anthropic") {
             providers[name] = { default: ANTHROPIC_EFFORT_LEVELS };
             continue;
@@ -119,6 +156,21 @@ export function effortLevels(cfg) {
     }
     return { providers };
 }
+/** One routed model's ladder, from the provider that declares it — what the picker's effort menu
+ * should offer for it. Undefined when no provider declares the id: the menu is then left alone. */
+export function effortLevelsForModel(cfg, modelId) {
+    const catalog = effortLevels(cfg).providers;
+    for (const [name, provider] of Object.entries(cfg.providers)) {
+        if (provider.type === "anthropic")
+            continue;
+        const own = catalog[name];
+        if (own?.models?.[modelId])
+            return own.models[modelId];
+        if (own && provider.models?.some((model) => model.id === modelId))
+            return own.default;
+    }
+    return undefined;
+}
 const CLAUDE_MODEL_FALLBACK = [
     { id: "claude-fable-5-1", name: "Fable 5.1" },
     { id: "claude-opus-5-5", name: "Opus 5.5" },
@@ -225,13 +277,23 @@ export function chatgptSignedIn(mode) {
     const borrowed = fs.existsSync(path.join(os.homedir(), ".codex", "auth.json"));
     return mode === "own" ? own : mode === "borrow-codex" ? borrowed : own || borrowed;
 }
+/**
+ * An Antigravity provider is only as usable as its accounts: none signed in, or every one waiting on
+ * Google's verification page, answers nothing however reachable the host is.
+ */
+export function googleHealth(accounts) {
+    if (accounts.every((a) => a.state === "needs-login"))
+        return { needsLogin: true };
+    const inRotation = accounts.filter((a) => a.state !== "paused" && a.state !== "needs-login");
+    return inRotation.length > 0 && inRotation.every((a) => a.state === "needs-verification") ? { needsLogin: false, needsVerification: true } : { needsLogin: false };
+}
 async function buildStatus(deps, opts = {}) {
     const cfg = deps.config();
     const providers = {};
     // Keyed in the order the config lists them. Assigning inside the Promise.all callbacks ordered
     // them by whichever TCP check answered first, so the Health list reshuffled on every poll.
     const checked = await Promise.all(Object.entries(cfg.providers).map(async ([name, p]) => {
-        const url = p.type === "anthropic" ? "https://api.anthropic.com" : p.type === "chatgpt" ? (p.url ?? "https://chatgpt.com/backend-api") : p.url;
+        const url = p.type === "anthropic" ? "https://api.anthropic.com" : p.type === "chatgpt" ? (p.url ?? "https://chatgpt.com/backend-api") : p.type === "google" ? (p.url ?? "https://generativelanguage.googleapis.com") : p.url;
         let reachable = false;
         try {
             const u = new URL(url);
@@ -259,6 +321,7 @@ async function buildStatus(deps, opts = {}) {
                 // Reaching the host says nothing about being able to use it: a chatgpt provider with no
                 // credentials is not "connected", and calling it that sends the user off believing it works.
                 ...(p.type === "chatgpt" ? { needsLogin: !chatgptSignedIn(p.auth) } : {}),
+                ...(p.type === "google" && p.auth === "antigravity" ? googleHealth(deps.google?.().accounts?.()[name] ?? []) : {}),
                 ...(p.type === "anthropic"
                     ? {
                         authSource: p.auth === "claude-code" ? claudeAuthStore(deps).describeSource() : null,
@@ -349,6 +412,7 @@ async function buildStatus(deps, opts = {}) {
         credentials: deps.credentials?.() ?? {},
         picker,
         agentTitle: agentTitleHookEnabled(),
+        statusMod: statusModEnabled(),
         pickerModels: cfg.cli.extraModels.map((m) => m.name || m.model),
         uiRevision: uiRevision(),
     };
@@ -369,30 +433,50 @@ function pickerTrust() {
     pickerTrustMemo = { at: now, value };
     return value;
 }
-/** Run the ClaudeRipple CLI with the Node that installed us (`<home>/paths.json`, written by `install`). */
+/** The ClaudeRipple CLI and the Node that installed us (`<home>/paths.json`, written by `install`). */
+function cliInvocation() {
+    let node = process.execPath;
+    // Same walk either way; the extension says which layout this file was loaded from.
+    let cli = path.resolve(here, `../../cli/src/index${path.extname(fileURLToPath(import.meta.url))}`);
+    let runtimeEnv = {};
+    try {
+        const p = JSON.parse(fs.readFileSync(path.join(homeDir(), "paths.json"), "utf8"));
+        if (p.node)
+            node = p.node;
+        if (p.env)
+            runtimeEnv = p.env;
+        if (p.cli)
+            cli = p.cli;
+    }
+    catch {
+        /* not installed via the CLI: fall back to our own node + repo layout */
+    }
+    return { node, cli, env: { ...process.env, ...runtimeEnv, CLAUDERIPPLE_HOME: homeDir() } };
+}
 function runCli(args, timeout = 180_000) {
     return new Promise((resolveP) => {
-        let node = process.execPath;
-        // Same walk either way; the extension says which layout this file was loaded from.
-        let cli = path.resolve(here, `../../cli/src/index${path.extname(fileURLToPath(import.meta.url))}`);
-        let runtimeEnv = {};
-        try {
-            const p = JSON.parse(fs.readFileSync(path.join(homeDir(), "paths.json"), "utf8"));
-            if (p.node)
-                node = p.node;
-            if (p.env)
-                runtimeEnv = p.env;
-            if (p.cli)
-                cli = p.cli;
-        }
-        catch {
-            /* not installed via the CLI: fall back to our own node + repo layout */
-        }
-        execFile(node, [cli, ...args], { env: { ...process.env, ...runtimeEnv, CLAUDERIPPLE_HOME: homeDir() }, timeout }, (err, stdout, stderr) => {
+        const { node, cli, env } = cliInvocation();
+        execFile(node, [cli, ...args], { env, timeout }, (err, stdout, stderr) => {
             resolveP({ ok: !err, output: `${stdout}${stderr}${err ? `\n${err.message}` : ""}`.trim() });
         });
     });
 }
+/**
+ * Start the CLI in its own process group, writing to `log`. An update ends by restarting this
+ * router, and launchd stops a job by killing its whole process group — an ordinary child would die
+ * with the router halfway through the install that restarted it.
+ */
+function startCliDetached(args, log) {
+    const { node, cli, env } = cliInvocation();
+    fs.mkdirSync(path.dirname(log), { recursive: true });
+    const out = fs.openSync(log, "w");
+    try {
+        spawn(node, [cli, ...args], { env, detached: true, stdio: ["ignore", out, out], windowsHide: true }).unref();
+    }
+    finally {
+        fs.closeSync(out);
+    }
+}
 /**
  * Whether this provider can actually run a web search — measured capability, not an assumption from
  * the vendor name. The rule is the router's own (`Proxy.canRunServerTools`, mirrored here because
@@ -444,13 +528,51 @@ function syncModelSlotsForGui(cfg) {
         return `model slots were not written to settings.json: ${message}`;
     }
 }
-function readBody(req) {
+/**
+ * The body of `POST /api/image`, checked: `{prompt, aspect?, format?, background?, images?}`,
+ * `images` being `data:image/...;base64,` URLs. A string is the reason it was refused.
+ */
+export function parseImageRequest(raw) {
+    if (!raw || typeof raw !== "object")
+        return "expected a JSON object";
+    const body = raw;
+    if (typeof body.prompt !== "string" || !body.prompt.trim())
+        return "prompt is required";
+    const out = { prompt: body.prompt };
+    const pick = (key, allowed) => {
+        const value = body[key];
+        if (value === undefined)
+            return null;
+        if (typeof value !== "string" || !allowed.includes(value))
+            return `${key} must be one of ${allowed.join(", ")}`;
+        out[key] = value;
+        return null;
+    };
+    const refused = pick("aspect", IMAGE_ASPECTS) ?? pick("format", IMAGE_FORMATS) ?? pick("background", IMAGE_BACKGROUNDS);
+    if (refused)
+        return refused;
+    if (body.images !== undefined) {
+        if (!Array.isArray(body.images))
+            return "images must be a list of data: URLs";
+        const images = [];
+        for (const url of body.images) {
+            const m = typeof url === "string" ? /^data:(image\/[a-z0-9.+-]+);base64,([A-Za-z0-9+/=\s]+)$/i.exec(url) : null;
+            if (!m)
+                return "each image must be a data:image/...;base64, URL";
+            images.push({ mediaType: m[1].toLowerCase(), data: m[2].replace(/\s/g, "") });
+        }
+        if (images.length)
+            out.images = images;
+    }
+    return out;
+}
+function readBody(req, limit = MAX_BODY) {
     return new Promise((resolveP, reject) => {
         const chunks = [];
         let n = 0;
         req.on("data", (c) => {
             n += c.length;
-            if (n > MAX_BODY) {
+            if (n > limit) {
                 reject(new Error("body too large"));
                 req.destroy();
                 return;
@@ -524,7 +646,7 @@ async function probeAnthropicApiKey(apiKey, probeFetch = fetchWithTimeout) {
         if (response.ok)
             return { ok: true, auth: "ok", models };
         const detail = snippet(await response.text());
-        if (response.status === 400 && /model.{0,80}(not.?found|invalid|unsupported|does not exist)|unknown.{0,20}model/i.test(detail))
+        if (refusedForModel(response.status, detail))
             return { ok: true, auth: "ok", models };
         if (response.status === 402 || /insufficient|balance|credit|quota|billing/i.test(detail))
             return { ok: true, auth: "ok", models, error: `no-credits: ${response.status} ${detail}` };
@@ -543,6 +665,86 @@ function probeClaudeCodeAuth(deps) {
     const signedIn = accounts.length > 0 ? "oauth" : readClaudeAuthFile(homeDir())?.source ?? null;
     return { ok: source !== null || hasUsableAccount, auth: source !== null || hasUsableAccount ? "ok" : "missing", source, signedIn, accountCount: accounts.length, models: CLAUDE_MODEL_FALLBACK };
 }
+/** The reasoning levels a `GET /v1beta/models` entry says the model takes, or none to offer. */
+function googleEffortLevels(entry) {
+    // `thinking: true` is the listing's own flag that a model reasons. The Generative Language API
+    // documents no per-model effort ladder, so a thinking model is offered the Gemini-3 levels this
+    // router maps onto (translate.ts): a model that only knows a subset clamps server-side.
+    return entry.thinking === true ? ["minimal", "low", "medium", "high"] : [];
+}
+/**
+ * `GET {base}/v1beta/models` with the key on `x-goog-api-key`, following `nextPageToken`.
+ *
+ * The auth check is the listing itself: Google answers a bad key with `400 API_KEY_INVALID` (or a
+ * 401/403), so there is no separate one-token request to make.
+ */
+async function probeGoogle(body, probeFetch = fetchWithTimeout) {
+    const apiKey = typeof body.apiKey === "string" && body.apiKey.length > 0 ? body.apiKey : (process.env.GEMINI_API_KEY ?? process.env.GOOGLE_API_KEY);
+    if (!apiKey)
+        return { ok: false, auth: "missing", models: [], error: "no API key; set one or GEMINI_API_KEY" };
+    const base = (typeof body.url === "string" && body.url ? body.url : "https://generativelanguage.googleapis.com").replace(/\/+$/, "");
+    const models = [];
+    let pageToken;
+    try {
+        // Bounded: a catalogue that keeps handing back a token must not spin the admin request forever.
+        for (let page = 0; page < 20; page++) {
+            const url = `${base}/v1beta/models?pageSize=1000${pageToken ? `&pageToken=${encodeURIComponent(pageToken)}` : ""}`;
+            const response = await probeFetch(url, { headers: { "x-goog-api-key": apiKey } });
+            if (response.status === 401 || response.status === 403)
+                return { ok: false, auth: "bad-key", models: [], error: `models endpoint returned ${response.status}` };
+            if (!response.ok) {
+                const detail = snippet(await response.text());
+                // A wrong key comes back 400 with `status: API_KEY_INVALID`; that is a bad key, not a bad base.
+                const badKey = /API_KEY_INVALID|API key not valid|invalid api key/i.test(detail);
+                return { ok: false, auth: badKey ? "bad-key" : response.status >= 500 ? "unreachable" : "unknown", models: [], error: `models endpoint returned ${response.status}: ${detail}` };
+            }
+            const parsed = await response.json();
+            for (const raw of Array.isArray(parsed.models) ? parsed.models : []) {
+                if (!raw || typeof raw !== "object")
+                    continue;
+                const entry = raw;
+                if (typeof entry.name !== "string")
+                    continue;
+                const id = entry.name.replace(/^models\//, "");
+                // Only models that can actually answer `generateContent` are worth listing; embedding and
+                // prediction models share the catalogue but cannot serve a turn.
+                const methods = Array.isArray(entry.supportedGenerationMethods) ? entry.supportedGenerationMethods : [];
+                if (!methods.some((method) => method === "generateContent"))
+                    continue;
+                const levels = googleEffortLevels(entry);
+                models.push({
+                    id,
+                    ...(typeof entry.displayName === "string" ? { name: entry.displayName } : {}),
+                    ...(typeof entry.inputTokenLimit === "number" && entry.inputTokenLimit > 0 ? { contextWindow: Math.floor(entry.inputTokenLimit) } : {}),
+                    ...(levels.length > 0 ? { effortLevels: levels } : {}),
+                });
+            }
+            pageToken = typeof parsed.nextPageToken === "string" && parsed.nextPageToken ? parsed.nextPageToken : undefined;
+            if (!pageToken)
+                break;
+        }
+        if (models.length === 0)
+            return { ok: true, auth: "ok", models, error: "no generateContent models listed" };
+        return { ok: true, auth: "ok", models };
+    }
+    catch (e) {
+        return { ok: false, auth: "unreachable", models, error: `models endpoint: ${errorText(e)}` };
+    }
+}
+/**
+ * `{type:"google", auth:"antigravity"}`: whether any Google account is signed in, and the model list
+ * Cloud Code Assist returns for it (falling back to the static list). No network call is made here
+ * beyond the catalogue the provider already serves; a signed-out state is the common answer.
+ */
+async function probeGoogleAntigravity(deps) {
+    const accounts = deps.google?.().accounts?.() ?? {};
+    const signedIn = Object.values(accounts).some((list) => list.length > 0) || readGoogleAccounts(homeDir()).length > 0;
+    if (!signedIn)
+        return { ok: false, auth: "missing", models: staticAntigravityModels(), error: "no Google account; run `clauderipple google-login`" };
+    const named = Object.keys(accounts)[0];
+    const models = named ? await deps.google?.().models?.(named).catch(() => null) ?? null : null;
+    return { ok: true, auth: "ok", models: models ?? staticAntigravityModels() };
+}
 function chatCompletionsUrl(base) {
     return `${base.replace(/\/+$/, "")}/chat/completions`;
 }
@@ -576,6 +778,15 @@ function parsedModels(value) {
 function snippet(text) {
     return text.replace(/\s+/g, " ").trim().slice(0, 200);
 }
+/**
+ * Whether a refused test request was refused for its model alone, which still shows the endpoint is
+ * right and the key was accepted. Anthropic's own wire says so with 404 not_found_error rather than
+ * 400 — abliteration.ai answers "Requested model was not found." (issue #42) — so 404 counts too,
+ * but only with a model named in the body: a bare 404 is a wrong URL.
+ */
+function refusedForModel(status, detail) {
+    return (status === 400 || status === 404) && /model.{0,80}(not.?found|invalid|unsupported|does not exist)|unknown.{0,20}model/i.test(detail);
+}
 /**
  * Fill each discovered model with the wire, endpoint and auth convention its preset declares for it.
  *
@@ -668,8 +879,8 @@ async function probeProvider(body, probeFetch = fetchWithTimeout) {
         if (response.ok)
             return { ok: true, auth: "ok", models, ...(modelsError ? { error: modelsError } : {}) };
         const detail = snippet(await response.text());
-        // A model-validation 400 still demonstrates that the endpoint reached the provider and the key was accepted.
-        if (response.status === 400 && /model.{0,80}(not.?found|invalid|unsupported|does not exist)|unknown.{0,20}model/i.test(detail)) {
+        // A model-validation refusal still demonstrates that the endpoint reached the provider and the key was accepted.
+        if (refusedForModel(response.status, detail)) {
             return { ok: true, auth: "ok", models, ...(modelsError ? { error: modelsError } : {}) };
         }
         // Key accepted but the account cannot pay: report auth ok so the user tops up instead of re-checking the key.
@@ -689,6 +900,8 @@ const MEASURE_JOBS = new Map();
  * (and its error strings) in memory for the life of the process. */
 const MEASURE_JOB_TTL_MS = 10 * 60 * 1000;
 const MEASURE_TIMEOUT_MS = 20_000;
+/** Models measured at once. One job is one provider and one key, so this is also its burst. */
+const MEASURE_CONCURRENCY = 4;
 async function measureFetchWithTimeout(url, init) {
     return fetch(url, { ...init, signal: AbortSignal.timeout(MEASURE_TIMEOUT_MS) });
 }
@@ -708,8 +921,12 @@ function sweepMeasureJobs() {
  * trying the list in catalogue order made it measure as `chat` and quietly overrule the `anthropic`
  * the preset recorded for it. A recorded wire is still only a starting point: it has to answer like
  * any other candidate, and the rest of the list is tried when it does not.
+ *
+ * `catalogWire` is the wire the public catalogue gives this model (catalog.ts). It goes first when
+ * the preset's own table says nothing about the model, so a model newer than that table is still
+ * settled in one request instead of walking the list.
  */
-function measureCandidates(p, modelId) {
+function measureCandidates(p, modelId, catalogWire) {
     const defaultWire = p.type === "anthropic-compatible" ? "anthropic"
         : p.type === "openai-compatible" ? (p.wire ?? "chat")
             : "chat";
@@ -749,6 +966,11 @@ function measureCandidates(p, modelId) {
             if (model.wire)
                 add({ wire: model.wire, url: model.url ?? p.url, ...(model.authHeader ? { authHeader: model.authHeader } : {}) });
     }
+    if (!known?.wire && catalogWire) {
+        const at = candidates.findIndex((c) => c.wire === catalogWire);
+        if (at > 0)
+            candidates.unshift(...candidates.splice(at, 1));
+    }
     return candidates;
 }
 /** The effort ladder this provider offers, before any per-model override narrows it. */
@@ -817,14 +1039,31 @@ async function runMeasureJob(jobId, providerName, models, deps) {
     const fetchImpl = deps.measureFetch ?? measureFetchWithTimeout;
     const headers = "headers" in provider ? provider.headers : undefined;
     const sessionHeader = "sessionHeader" in provider ? provider.sessionHeader : undefined;
-    for (const id of models) {
+    const preset = "preset" in provider ? provider.preset : undefined;
+    const catalog = deps.modelCatalog ? await deps.modelCatalog().catch(() => undefined) : undefined;
+    const measureOne = async (id) => {
+        const listed = catalogEntry(catalog, preset, id);
         // Per model, not once per job: the order depends on what the preset recorded for this id.
-        const candidates = measureCandidates(provider, id);
-        const measured = await measureModel(id, candidates, ladder, { fetch: fetchImpl, ...(sessionHeader ? { sessionHeader } : {}), ...(headers ? { headers } : {}) });
+        const candidates = measureCandidates(provider, id, listed?.wire);
+        // A ladder the catalogue states is taken as stated; the wire is still asked, once, because that
+        // one request is also what finds a model the plan refuses (403 FreeTierError, DataPolicyError).
+        const stated = ladder.length > 0 ? listed?.effortLevels : undefined;
+        const known = stated !== undefined;
+        const measured = await measureModel(id, candidates, known ? [] : ladder, { fetch: fetchImpl, ...(sessionHeader ? { sessionHeader } : {}), ...(headers ? { headers } : {}) });
+        if (stated && measured.wire)
+            measured.effortLevels = stated;
         job.results.push(measured);
         job.done++;
-        deps.log.info(`admin: measured ${providerName}/${id} -> ${measured.error ? `error ${measured.error}` : `wire ${measured.wire}${measured.effortLevels ? ` effort ${measured.effortLevels.join(",")}` : ""}`}`);
-    }
+        deps.log.info(`admin: measured ${providerName}/${id} -> ${measured.error ? `error ${measured.error}` : `wire ${measured.wire}${measured.effortLevels ? ` effort ${measured.effortLevels.join(",")}${known ? " (catalogue)" : ""}` : ""}`}`);
+    };
+    // Models are independent, so a few run at once and a slow upstream answer holds up only its own
+    // model. Levels inside one model stay sequential: a burst there invites 429s, and a level that
+    // meets one is kept rather than measured, which would quietly widen the ladder.
+    const queue = [...models];
+    await Promise.all(Array.from({ length: Math.min(MEASURE_CONCURRENCY, queue.length) }, async () => {
+        for (let id = queue.shift(); id !== undefined; id = queue.shift())
+            await measureOne(id);
+    }));
     try {
         const outcome = applyMeasurements(deps.configFile, job.results);
         if ("error" in outcome) {
@@ -1051,6 +1290,14 @@ export function startAdmin(deps) {
                     });
                     return;
                 }
+                if (probe.type === "google") {
+                    if (probe.auth === "antigravity") {
+                        sendJson(res, 200, await probeGoogleAntigravity(deps));
+                        return;
+                    }
+                    sendJson(res, 200, await probeGoogle({ apiKey: probe.apiKey, url: probe.url }, deps.probeFetch));
+                    return;
+                }
                 if ((probe.type !== "anthropic-compatible" && probe.type !== "openai-compatible") ||
                     typeof probe.url !== "string" ||
                     !/^https?:\/\//.test(probe.url) ||
@@ -1381,6 +1628,126 @@ export function startAdmin(deps) {
                 sendJson(res, r.ok ? 200 : 500, { ok: r.ok, output: r.output });
                 return;
             }
+            // Google (Antigravity) sign-in of our own (browser, PKCE, loopback callback). The GUI starts it
+            // and polls the state; tokens never leave the router and never appear in any response.
+            if (pathname === "/api/google-login" && method === "GET") {
+                const state = googleOAuth?.snapshot ?? { running: false, url: null, startedAt: null, finishedAt: null, ok: null, error: null, account: null, termsWarning: ANTIGRAVITY_WARNING };
+                sendJson(res, 200, state);
+                return;
+            }
+            if (pathname === "/api/google-login" && method === "POST") {
+                if (googleOAuth?.snapshot.running) {
+                    sendJson(res, 200, googleOAuth.snapshot);
+                    return;
+                }
+                const session = new GoogleOAuthSession({ home: homeDir(), ...(deps.googleOAuthFetch ? { fetch: deps.googleOAuthFetch } : {}), ...(deps.googleOAuthPort !== undefined ? { port: deps.googleOAuthPort } : {}) }, ANTIGRAVITY_WARNING);
+                googleOAuth = session;
+                let started;
+                try {
+                    started = await session.start();
+                }
+                catch (error) {
+                    sendJson(res, 500, { ...session.snapshot, error: error.message });
+                    return;
+                }
+                const opened = deps.openBrowser ? deps.openBrowser(started.url) : openBrowser(started.url);
+                deps.log.info(`admin: google sign-in via GUI -> started (browser ${opened ? "opened" : "not opened"})`);
+                void session.result.then(() => deps.log.info("admin: google sign-in via GUI -> ok"), (error) => deps.log.info(`admin: google sign-in via GUI -> failed: ${error.message}`));
+                sendJson(res, 200, { ...session.snapshot, opened, termsWarning: ANTIGRAVITY_WARNING });
+                return;
+            }
+            if (pathname === "/api/google-login/code" && method === "POST") {
+                const session = googleOAuth;
+                if (!session?.snapshot.running) {
+                    sendJson(res, 409, { error: "no Google sign-in is waiting for a code" });
+                    return;
+                }
+                let code = "";
+                try {
+                    code = String(JSON.parse((await readBody(req)).toString("utf8")).code ?? "");
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid JSON" });
+                    return;
+                }
+                await session.submitCode(code);
+                await session.result.catch(() => { });
+                sendJson(res, session.snapshot.ok ? 200 : 400, session.snapshot);
+                return;
+            }
+            if (pathname === "/api/google-login/cancel" && method === "POST") {
+                googleOAuth?.cancel();
+                sendJson(res, 200, googleOAuth?.snapshot ?? { running: false });
+                return;
+            }
+            if (pathname === "/api/google-logout" && method === "POST") {
+                const r = await (deps.runCli ?? runCli)(["google-logout"]);
+                deps.log.info(`admin: google-logout via GUI -> ${r.ok ? "ok" : "failed"}`);
+                sendJson(res, r.ok ? 200 : 500, { ok: r.ok, output: r.output });
+                return;
+            }
+            // Safe account metadata only: labels, emails, project ids and rotation state. Tokens stay in
+            // the router and are never serialized.
+            if (pathname === "/api/google-accounts" && method === "GET") {
+                const all = deps.google?.().accounts?.() ?? {};
+                const wanted = new URL(url, "http://127.0.0.1").searchParams.get("provider");
+                const name = wanted && all[wanted] ? wanted : Object.keys(all)[0];
+                const accounts = name ? all[name] : readGoogleAccounts(homeDir()).map(summarizeGoogleAccount);
+                sendJson(res, 200, { provider: name ?? null, accounts });
+                return;
+            }
+            if (pathname.startsWith("/api/google-accounts/") && (method === "PATCH" || method === "DELETE")) {
+                let id;
+                try {
+                    id = decodeURIComponent(pathname.slice("/api/google-accounts/".length));
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid account id" });
+                    return;
+                }
+                if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)) {
+                    sendJson(res, 400, { error: "invalid account id" });
+                    return;
+                }
+                if (method === "DELETE") {
+                    if (!removeGoogleAccount(homeDir(), id)) {
+                        sendJson(res, 404, { error: "Google account not found" });
+                        return;
+                    }
+                    deps.log.info(`admin: removed Google account ${id.slice(0, 8)}`);
+                    sendJson(res, 200, { ok: true });
+                    return;
+                }
+                let change;
+                try {
+                    change = JSON.parse((await readBody(req)).toString("utf8"));
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid JSON" });
+                    return;
+                }
+                if ((change.label !== undefined && (typeof change.label !== "string" || !change.label.trim())) || (change.paused !== undefined && typeof change.paused !== "boolean")) {
+                    sendJson(res, 400, { error: "expected {label?: non-empty string, paused?: boolean, clearCooldown?: true, recheck?: true}" });
+                    return;
+                }
+                if (change.recheck === true) {
+                    const result = (await deps.google?.().recheckVerification?.(id)) ?? "unknown";
+                    deps.log.info(`admin: rechecked Google verification for ${id.slice(0, 8)} -> ${result}`);
+                    sendJson(res, 200, { ok: true, verification: result });
+                    return;
+                }
+                if (change.clearCooldown === true)
+                    deps.google?.().clearCooldown?.(id);
+                if (change.label !== undefined || change.paused !== undefined) {
+                    if (!updateGoogleAccount(homeDir(), id, { ...(typeof change.label === "string" ? { label: change.label } : {}), ...(typeof change.paused === "boolean" ? { paused: change.paused } : {}) })) {
+                        sendJson(res, 404, { error: "Google account not found" });
+                        return;
+                    }
+                }
+                deps.log.info(`admin: updated Google account ${id.slice(0, 8)}`);
+                sendJson(res, 200, { ok: true });
+                return;
+            }
             if (pathname === "/api/picker" && method === "POST") {
                 // Runs `clauderipple picker on|off` (keychain trust, app Config Library, config flag).
                 // macOS shows its keychain password dialog in the user's session; we never see the password.
@@ -1409,6 +1776,82 @@ export function startAdmin(deps) {
                 sendJson(res, r.ok ? 200 : 500, { ok: r.ok, output: r.output });
                 return;
             }
+            if (pathname === "/api/update" && (method === "GET" || method === "POST")) {
+                // The CLI answers both: it knows how this copy was installed, which decides what an update is
+                // (the tray asks it the same way). A POST checks again rather than trusting the page.
+                const r = await (deps.runCli ?? runCli)(["update", "--check", "--json"], 30_000);
+                const check = parseUpdateCheck(r.output);
+                if (!check) {
+                    sendJson(res, 502, { error: "could not check for updates", output: r.output.slice(-2000) });
+                    return;
+                }
+                const running = updateStartedAt > 0 && Date.now() - updateStartedAt < UPDATE_RUN_MS;
+                if (method === "GET") {
+                    sendJson(res, 200, { ...check, running });
+                    return;
+                }
+                if (check.kind !== "script" && check.kind !== "npm") {
+                    sendJson(res, 409, { error: `this copy (${check.kind}) is not updated from here`, ...check });
+                    return;
+                }
+                if (!check.newer) {
+                    sendJson(res, 409, { error: "already the latest version", ...check });
+                    return;
+                }
+                if (running) {
+                    sendJson(res, 409, { error: "an update is already running", ...check, running });
+                    return;
+                }
+                updateStartedAt = Date.now();
+                const log = path.join(homeDir(), "logs", "update.log");
+                (deps.startCliDetached ?? startCliDetached)(["update"], log);
+                deps.log.info(`admin: update ${check.current} -> ${check.latest ?? "?"} started via GUI (output in ${log})`);
+                sendJson(res, 202, { started: true, ...check, log });
+                return;
+            }
+            if (pathname === "/api/image" && method === "POST") {
+                // The image itself is the response body, so `curl -o out.png` is the whole client. An error
+                // is JSON with a non-2xx status (`curl --fail-with-body` writes it to the same file).
+                if (!deps.image) {
+                    sendJson(res, 501, { error: "image generation not available" });
+                    return;
+                }
+                let parsed;
+                try {
+                    parsed = parseImageRequest(JSON.parse((await readBody(req, MAX_IMAGE_BODY)).toString("utf8")));
+                }
+                catch (e) {
+                    sendJson(res, 400, { error: /too large/.test(e.message) ? "body too large (reference images over 32 MB)" : "invalid JSON" });
+                    return;
+                }
+                if (typeof parsed === "string") {
+                    sendJson(res, 400, { error: parsed });
+                    return;
+                }
+                // A caller that gives up should not leave the generation running on the subscription.
+                const abort = new AbortController();
+                res.on("close", () => { if (!res.writableFinished)
+                    abort.abort(); });
+                const started = Date.now();
+                try {
+                    const image = await deps.image(parsed, abort.signal);
+                    deps.log.info(`admin: image ${image.size ?? "?"} ${image.quality ?? "?"} ${image.format}, ${parsed.images?.length ?? 0} reference(s), ${image.data.length} bytes in ${Date.now() - started} ms`);
+                    res.writeHead(200, {
+                        "content-type": `image/${image.format}`,
+                        "content-length": String(image.data.length),
+                        ...(image.size ? { "x-image-size": image.size } : {}),
+                        ...(image.quality ? { "x-image-quality": image.quality } : {}),
+                        ...(image.revisedPrompt ? { "x-revised-prompt": encodeURIComponent(image.revisedPrompt) } : {}),
+                    });
+                    res.end(image.data);
+                }
+                catch (e) {
+                    deps.log.warn(`admin: image failed after ${Date.now() - started} ms: ${e.message}`);
+                    if (!res.headersSent)
+                        sendJson(res, 502, { error: e.message });
+                }
+                return;
+            }
             if (pathname === "/api/agent-title" && method === "POST") {
                 // Registers/removes the PreToolUse hook that prefixes subagent titles with the real model.
                 let enabled;
@@ -1428,14 +1871,34 @@ export function startAdmin(deps) {
                 sendJson(res, r.ok ? 200 : 500, { ok: r.ok, output: r.output });
                 return;
             }
+            if (pathname === "/api/status-mod" && method === "POST") {
+                // Through the CLI, like agent-title: it knows where this install keeps packages/mod.
+                let enabled;
+                try {
+                    enabled = JSON.parse((await readBody(req)).toString("utf8")).enabled;
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid JSON" });
+                    return;
+                }
+                if (typeof enabled !== "boolean") {
+                    sendJson(res, 400, { error: "expected {enabled: boolean}" });
+                    return;
+                }
+                const r = await runCli(["mod", enabled ? "on" : "off"]);
+                deps.log.info(`admin: status mod ${enabled ? "on" : "off"} via GUI -> ${r.ok ? "ok" : "failed"}`);
+                sendJson(res, r.ok ? 200 : 500, { ok: r.ok, output: r.output });
+                return;
+            }
             if (pathname === "/api/requests" && method === "GET") {
                 const query = new URL(url, "http://x").searchParams;
                 const requested = Number(query.get("n") ?? 200);
                 const n = Number.isFinite(requested) ? Math.min(2000, Math.max(1, Math.floor(requested))) : 200;
                 const provider = query.get("provider") || undefined;
+                const session = query.get("session") || undefined;
                 const kindValue = query.get("kind");
                 const kind = kindValue === "messages" || kindValue === "count_tokens" || kindValue === "other" ? kindValue : undefined;
-                sendJson(res, 200, { requests: deps.requests.list(n, { ...(provider ? { provider } : {}), ...(kind ? { kind } : {}) }) });
+                sendJson(res, 200, { requests: deps.requests.list(n, { ...(provider ? { provider } : {}), ...(kind ? { kind } : {}), ...(session ? { session } : {}) }) });
                 return;
             }
             if (pathname === "/api/requests/summary" && method === "GET") {