humanish 0.141.0 → 0.142.0

package/ARCHITECTURE.md

@@ -86,6 +86,7 @@ the analysis of the run:
 | `src/actors/`              | The actor contract, the registry and each actor's session code                                                                  | `src/actors/registry.ts`            |
 | `src/subject/`             | Subject provisioning over a `Shell`: clone, local tree, desktop CLI, serve                                                      | `src/subject/serve.ts`              |
 | `src/substrates/`          | Provider primitives: E2B in `e2b/`, Firecracker and Lima VMs in `local/`, the `Shell`                                           | `src/substrates/desktop-session.ts` |
+| `src/remote/`              | `--remote`: plan a run for a runner sandbox, launch and follow it there, copy it back                                           | `src/remote/launch.ts`              |
 | `src/run/`                 | Run lifecycle, bundle types, bundle guards, paths, status, receipts, reclaim                                                    | `src/run/run.ts`                    |
 | `src/verify/`              | `humanish verify`: evidence checks, share-safety grades, cost and rerun checks                                                  | `src/verify/verify.ts`              |
 | `src/evidence/`            | Redaction, screenshot checks and desktop recordings                                                                             | `src/evidence/redaction.ts`         |

package/CHANGELOG.md

@@ -8,6 +8,17 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.142.0: Remote runs, Gemini and GPT-6 analysis models, and a view-only live stream (2026-10-21)
+
+humanish 0.142.0 can run a study remotely: `humanish run <study> --remote` puts the study's own
+process in a sandbox, so a long study keeps going after this machine sleeps, and `observe --run
+<id>` reconnects to it. Study analysis can run on `gpt-6.1-sol` and `gpt-6-luna` as well as the
+default `gpt-6-astra`, and on Google's Gemini API with `humanish keys set gemini`. A hosted
+desktop's live stream is now view-only on the VNC server itself: before, anyone holding a
+participant's stream URL could type into that desktop.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.142.0)
+
 ## 0.141.0: A run says when it is writing findings, and email links no longer open a dialog (2026-10-21)
 
 humanish 0.141.0 says when a run is writing its findings: the CLI prints progress with the

package/README.md

@@ -242,6 +242,8 @@ beside Participants in Observer, with evidence links and separate participant
 feedback. You can explicitly select a restricted Codex account analyst with
 `npx humanish analyze --run latest --provider codex`; it uses remote inference,
 requires the qualified CLI and account login, and reports dollar cost as unknown.
+`npx humanish analyze --run latest --provider gemini --max-cost 2` sends the same
+evidence to Google's Gemini API instead, with the key from `npx humanish keys set gemini`.
 A study whose participant is a Codex `local-agent` uses that analyst by default. See the [analysis contract](docs/contracts/study-analysis.md) for
 coverage limits, estimated cost controls, corrections and sharing behavior.
 

package/dist/analysis/admission.d.ts

@@ -1,4 +1,10 @@
 import type { ModelRate } from "../run/pricing.js";
+/**
+ * How many times that expectation an API analyst writes. The OpenAI figures above come from its
+ * billed analyses. A gemini-3.8-flash analysis of one participant at high thinking wrote 24,246
+ * output tokens against 13,000 expected, so Gemini's expectation is doubled. That rests on one run.
+ */
+export declare const EXPECTED_OUTPUT_SCALE: Readonly<Record<"openai" | "gemini", number>>;
 /**
  * When admission refuses a request, in words, for the cap as the sentence names it: `$3`, or `this`
  * in the help of the option that sets it. Admission compares the smaller of the worst case and the
@@ -21,6 +27,8 @@ interface AnalysisRequestSize {
 export interface AnalysisRequests {
     cohorts: readonly AnalysisRequestSize[];
     mergeTextBytes: number;
+    /** The analyst's EXPECTED_OUTPUT_SCALE; 1 when omitted. */
+    outputScale?: number;
 }
 export interface AnalysisCostEstimate {
     inputTokens: number;

package/dist/analysis/admission.js

@@ -15,6 +15,15 @@ const FRAMING_TOKENS = 2048;
  */
 const EXPECTED_OUTPUT_TOKENS = 12_000;
 const EXPECTED_OUTPUT_TOKENS_PER_PARTICIPANT = 1_000;
+/**
+ * How many times that expectation an API analyst writes. The OpenAI figures above come from its
+ * billed analyses. A gemini-3.8-flash analysis of one participant at high thinking wrote 24,246
+ * output tokens against 13,000 expected, so Gemini's expectation is doubled. That rests on one run.
+ */
+export const EXPECTED_OUTPUT_SCALE = {
+    openai: 1,
+    gemini: 2,
+};
 /** Admission compares the expected cost times this margin with the cap. */
 const ADMISSION_MARGIN = 1.1;
 const MARGIN_PERCENT = Math.round((ADMISSION_MARGIN - 1) * 100);
@@ -38,12 +47,13 @@ function requestCost(rate, inputTokens, outputTokens) {
         outputTokens * rate.outputUsdPerToken * (long ? rate.longContext.outputMultiplier : 1));
 }
 /** One request's input and costs. `reportTokens` are earlier requests' reports it reads. */
-function estimateRequest(rate, size, reportTokens = 0) {
+function estimateRequest(rate, size, outputScale, reportTokens = 0) {
     const inputTokens = Math.ceil(size.textBytes / BYTES_PER_INPUT_TOKEN) +
         FRAMING_TOKENS +
         size.imageTokens +
         reportTokens;
-    const expectedOutputTokens = Math.min(size.outputAllowance, EXPECTED_OUTPUT_TOKENS + EXPECTED_OUTPUT_TOKENS_PER_PARTICIPANT * size.participants);
+    const expectedOutputTokens = Math.min(size.outputAllowance, outputScale *
+        (EXPECTED_OUTPUT_TOKENS + EXPECTED_OUTPUT_TOKENS_PER_PARTICIPANT * size.participants));
     return {
         inputTokens,
         expectedOutputTokens,
@@ -58,14 +68,15 @@ function estimateRequest(rate, size, reportTokens = 0) {
  */
 export function estimateAnalysisCost(rate, requests) {
     const { cohorts } = requests;
-    const estimates = cohorts.map((size) => estimateRequest(rate, size));
+    const scale = requests.outputScale ?? 1;
+    const estimates = cohorts.map((size) => estimateRequest(rate, size, scale));
     if (cohorts.length > 1)
         estimates.push(estimateRequest(rate, {
             textBytes: requests.mergeTextBytes,
             imageTokens: 0,
             participants: cohorts.reduce((total, size) => total + size.participants, 0),
             outputAllowance: Math.max(...cohorts.map((size) => size.outputAllowance)),
-        }, cohorts.reduce((total, size) => total + size.outputAllowance, 0)));
+        }, scale, cohorts.reduce((total, size) => total + size.outputAllowance, 0)));
     const sum = (key) => estimates.reduce((total, estimate) => total + estimate[key], 0);
     // Each request's cost is a whole number of micro-dollars, so rounding the sum to the nearest one
     // only removes the addition's float noise.

package/dist/analysis/automatic-config.d.ts

@@ -2,6 +2,9 @@ import type { StudyRoute } from "../study/plan.js";
 import type { AnalysisConfig } from "./types.js";
 export declare const DEFAULT_ANALYSIS_TIMEOUT_MS = 600000;
 export declare const DEFAULT_ANALYSIS_MODEL = "gpt-6-astra";
+/** The model a Gemini analysis uses when the study or command names none: Google's current
+ * stable Flash model. */
+export declare const DEFAULT_GEMINI_ANALYSIS_MODEL = "gemini-3.8-flash";
 interface StudyAnalysisSettings {
     model?: string;
     question?: string;
@@ -9,7 +12,7 @@ interface StudyAnalysisSettings {
 }
 /** The study's review.analysis: a provider selection for a separate review after a live run. */
 export type StudyAnalysis = StudyAnalysisSettings & ({
-    provider?: "openai";
+    provider?: "openai" | "gemini";
     maxCostUsd: number;
     maxOutputTokens?: number;
 } | {
@@ -37,7 +40,7 @@ export declare function resolveAutomaticAnalysis(raw: unknown, participant?: Ana
     message: string;
 };
 export interface AutomaticAnalysisBudget {
-    provider?: "openai" | "codex";
+    provider?: "openai" | "gemini" | "codex";
     billing?: "api-estimate" | "account-unknown";
     model: string;
     maxCostUsd: number | null;

package/dist/analysis/automatic-config.js

@@ -7,6 +7,9 @@ import { scanEncodedText } from "../evidence/encoded-text.js";
 export const DEFAULT_ANALYSIS_TIMEOUT_MS = 600_000;
 const MAX_ANALYSIS_TIMEOUT_MS = 600_000;
 export const DEFAULT_ANALYSIS_MODEL = "gpt-6-astra";
+/** The model a Gemini analysis uses when the study or command names none: Google's current
+ * stable Flash model. */
+export const DEFAULT_GEMINI_ANALYSIS_MODEL = "gemini-3.8-flash";
 const FIELDS = new Set([
     "provider",
     "maxCostUsd",
@@ -60,8 +63,11 @@ export function resolveAutomaticAnalysis(raw, participant) {
         };
     }
     const value = raw;
-    if (value.provider !== undefined && value.provider !== "openai" && value.provider !== "codex") {
-        return { ok: false, message: "review.analysis.provider must be openai or codex." };
+    if (value.provider !== undefined &&
+        value.provider !== "openai" &&
+        value.provider !== "gemini" &&
+        value.provider !== "codex") {
+        return { ok: false, message: "review.analysis.provider must be openai, gemini or codex." };
     }
     if (value.provider === "codex") {
         const model = value.model === undefined ? CODEX_ANALYSIS_MODEL : value.model;
@@ -93,7 +99,12 @@ export function resolveAutomaticAnalysis(raw, participant) {
         };
     }
     const { maxCostUsd } = value;
-    const model = value.model === undefined ? DEFAULT_ANALYSIS_MODEL : value.model;
+    const vendor = value.provider === "gemini" ? "gemini" : "openai";
+    const model = value.model !== undefined
+        ? value.model
+        : vendor === "gemini"
+            ? DEFAULT_GEMINI_ANALYSIS_MODEL
+            : DEFAULT_ANALYSIS_MODEL;
     const question = value.question === undefined ? null : value.question;
     const timeoutMs = value.timeoutMs === undefined ? DEFAULT_ANALYSIS_TIMEOUT_MS : value.timeoutMs;
     const maxOutputTokens = value.maxOutputTokens === undefined
@@ -104,7 +115,7 @@ export function resolveAutomaticAnalysis(raw, participant) {
         maxCostUsd <= 0 ||
         maxCostUsd > 1000 ||
         typeof model !== "string" ||
-        !isSupportedAnalysisModel(model) ||
+        !isSupportedAnalysisModel(model, vendor) ||
         !validTimeout(timeoutMs) ||
         typeof maxOutputTokens !== "number" ||
         !Number.isSafeInteger(maxOutputTokens) ||
@@ -113,7 +124,7 @@ export function resolveAutomaticAnalysis(raw, participant) {
         !validQuestion(value.question)) {
         return {
             ok: false,
-            message: `review.analysis requires a positive maxCostUsd up to 1000, a supported analysis model, timeoutMs 1–${MAX_ANALYSIS_TIMEOUT_MS}, maxOutputTokens 256–${MAX_ANALYSIS_OUTPUT_TOKENS}, and an optional question of at most 4000 characters.`,
+            message: `review.analysis requires a positive maxCostUsd up to 1000, a supported ${vendor === "gemini" ? "Gemini" : "OpenAI"} analysis model, timeoutMs 1–${MAX_ANALYSIS_TIMEOUT_MS}, maxOutputTokens 256–${MAX_ANALYSIS_OUTPUT_TOKENS}, and an optional question of at most 4000 characters.`,
         };
     }
     if (question !== null && scanEncodedText(question).sensitive)
@@ -121,7 +132,8 @@ export function resolveAutomaticAnalysis(raw, participant) {
     return {
         ok: true,
         config: {
-            ...(value.provider === undefined ? {} : { provider: "openai" }),
+            // An omitted provider stays omitted: it is the OpenAI contract, and its hash predates the field.
+            ...(value.provider === undefined ? {} : { provider: vendor }),
             model,
             maxCostUsd,
             timeoutMs,
@@ -148,7 +160,9 @@ export function automaticAnalysisBudget(raw, route, participants, participant) {
     return {
         ...(config.provider === "codex"
             ? { provider: "codex", billing: "account-unknown" }
-            : {}),
+            : config.provider === "gemini"
+                ? { provider: "gemini" }
+                : {}),
         model: config.model,
         maxCostUsd: config.maxCostUsd,
         trigger: raw === undefined ? "default" : "explicit",
@@ -179,5 +193,6 @@ export function formatAutomaticAnalysisBudget(budget) {
     const refused = budget.refusedFromUsd === undefined || who === undefined
         ? `refused before it starts if ${rule}`
         : `refused before it starts for ${who} even with no evidence (expected $${budget.refusedFromUsd.toFixed(2)}), since ${rule}`;
-    return `After live runs: ${budget.trigger} analysis · ${budget.model}${range} · ${refused}; this is not a billing cap. Set review.analysis: false to disable.`;
+    const where = budget.provider === "gemini" ? " on Gemini, which sends the evidence to Google" : "";
+    return `After live runs: ${budget.trigger} analysis${where} · ${budget.model}${range} · ${refused}; this is not a billing cap. Set review.analysis: false to disable.`;
 }

package/dist/analysis/automatic.js

@@ -3,6 +3,7 @@ import { resolveRunPath } from "../run/locate.js";
 import { refreshObserver, analyzeRun, readCompletedAnalysisSource, resolveAnalysisRun, } from "./service.js";
 import { preferLargerAnalysisOutput, ANALYSIS_PROMPT_VERSION } from "./execute.js";
 import { captureEvidence } from "./evidence.js";
+import { analysisApiKey } from "../keys/key-resolution.js";
 import { loadRunTraces } from "../run/stream-trace.js";
 import { hashAnalysisValue } from "./validation.js";
 import { refusedCost } from "./admission.js";
@@ -56,7 +57,11 @@ function statusReason(result) {
         return "AUTOMATIC_ANALYSIS_CANCELLED";
     return null;
 }
-function outcomeOf(result) {
+/** The skip reason for a missing API key, which names the key the selected analyst reads. */
+const keyMissingReason = (config) => config.provider === "gemini"
+    ? "AUTOMATIC_ANALYSIS_GEMINI_KEY_MISSING"
+    : "AUTOMATIC_ANALYSIS_KEY_MISSING";
+function outcomeOf(result, config) {
     if (result.error?.code === "ANALYSIS_PUBLICATION_FAILED")
         return { state: "failed", reason: "AUTOMATIC_ANALYSIS_PUBLICATION_FAILED", result };
     if (result.error?.code?.startsWith("analysis_codex_"))
@@ -67,7 +72,7 @@ function outcomeOf(result) {
     if (code === "ANALYSIS_CANCELLED")
         return { state: "cancelled", reason: "AUTOMATIC_ANALYSIS_CANCELLED", result };
     if (code === "ANALYSIS_API_KEY_MISSING")
-        return { ...skipped("AUTOMATIC_ANALYSIS_KEY_MISSING"), result };
+        return { ...skipped(keyMissingReason(config)), result };
     if (code === "ANALYSIS_BUSY")
         return { ...skipped("AUTOMATIC_ANALYSIS_BUSY"), result };
     if (code === "ANALYSIS_HISTORY_UNAVAILABLE")
@@ -158,7 +163,10 @@ export async function runAutomaticAnalysis(cwdInput, runId, configInput, deps =
     if (!prepared)
         return skipped("AUTOMATIC_ANALYSIS_SOURCE_UNAVAILABLE");
     cwd = physicalCwdOf(prepared);
-    const hasKey = Boolean((deps.apiKey ?? process.env.OPENAI_API_KEY)?.trim());
+    const hasKey = Boolean((deps.apiKey ??
+        (configInput.provider === "codex"
+            ? undefined
+            : analysisApiKey(configInput.provider ?? "openai", process.env)))?.trim());
     const source = await readAutomaticSource(cwd, prepared, structuredClone(configInput), deps, hasKey);
     if ("state" in source)
         return source;
@@ -225,9 +233,7 @@ export async function runAutomaticAnalysis(cwdInput, runId, configInput, deps =
         else if (deps.defaultRequest === true && (missingKey || !participantEvidence)) {
             outcome = signal.aborted
                 ? { state: "cancelled", reason: "AUTOMATIC_ANALYSIS_CANCELLED" }
-                : skipped(missingKey
-                    ? "AUTOMATIC_ANALYSIS_KEY_MISSING"
-                    : "AUTOMATIC_ANALYSIS_NO_PARTICIPANT_EVIDENCE");
+                : skipped(missingKey ? keyMissingReason(config) : "AUTOMATIC_ANALYSIS_NO_PARTICIPANT_EVIDENCE");
         }
         else {
             const result = await analyzeRun(cwd, runId, { config }, {
@@ -250,7 +256,7 @@ export async function runAutomaticAnalysis(cwdInput, runId, configInput, deps =
                     });
                 },
             });
-            outcome = outcomeOf(result);
+            outcome = outcomeOf(result, config);
         }
         if (cancellationFailed)
             outcome = {

package/dist/analysis/execute.d.ts

@@ -1,9 +1,19 @@
 import { type AnalysisArtifact, type AnalysisConfig, type AnalysisInput } from "./types.js";
-import { type AnalysisFetch, type AnalysisProvider } from "./provider.js";
+import { type AnalysisApiVendor, type AnalysisFetch, type AnalysisProvider } from "./provider.js";
 import type { RejectedAnalysisOutput } from "./diagnostics.js";
 export declare const ANALYSIS_PROMPT_VERSION = "study-evidence-8";
-export declare const isSupportedAnalysisModel: (model: string) => boolean;
-/** The OpenAI output limit when a study omits maxOutputTokens, and the most it may ask for. */
+export declare const SUPPORTED_ANALYSIS_MODELS: readonly string[];
+/**
+ * Gemini models that completed a live analysis. Each model's page under
+ * ai.google.dev/gemini-api/docs/models (read 2026-10-21) also lists image input and JSON-schema
+ * output for gemini-3.5-flash-lite, gemini-3-flash-preview and gemini-4-argon; they join this list
+ * once a live analysis on each completes.
+ */
+export declare const GEMINI_ANALYSIS_MODELS: readonly string[];
+/** Whether the API analyst `provider` (omitted is OpenAI) analyzes with `model`. */
+export declare const isSupportedAnalysisModel: (model: string, provider?: AnalysisApiVendor) => boolean;
+/** The API output limit when a study omits maxOutputTokens, and the most it may ask for. Gemini 4
+ * returns at most 32,768 output tokens from one generateContent request. */
 export declare const DEFAULT_ANALYSIS_MAX_OUTPUT_TOKENS = 16384;
 export declare const MAX_ANALYSIS_OUTPUT_TOKENS = 32768;
 export interface AnalysisAdmission {
@@ -38,9 +48,10 @@ export interface AnalysisProgress {
  * Local admission estimate, not a provider-enforced billed-spend guarantee. No token-count API
  * call, credential, or network access. admission.ts holds the cost model: text at a calibrated
  * bytes-per-token ratio, the expected output, and the worst case that spends the whole output
- * allowance. Each high-detail image is priced from its PNG size by the vision guide's patch
- * formula (see image-tokens.ts), or at the 3,000-token ceiling when its size or the model's sizing
- * is unknown. Unknown models/rates fail closed rather than inheriting those assumptions.
+ * allowance. image-tokens.ts prices each image: on OpenAI from its PNG size by the vision guide's
+ * patch formula, or at the 3,000-token ceiling when its size or the model's sizing is unknown; on
+ * Gemini at the fixed high-resolution count. The rates are those of the day admission runs.
+ * Unknown models/rates fail closed rather than inheriting those assumptions.
  * Known-sensitive decoded text denies admission with analysis_input_sensitive or
  * analysis_question_sensitive. Neither error includes rejected input values.
  */

package/dist/analysis/execute.js

@@ -1,20 +1,22 @@
 import { validCodexAnalysisConfig } from "./codex-config.js";
-import { HIGH_DETAIL_IMAGE_TOKEN_CEILING, highDetailImageTokens } from "./image-tokens.js";
-import { estimateAnalysisCost } from "./admission.js";
+import { INPUT_IMAGE_DATA_URL, highDetailImageTokens, imageTokenCeiling } from "./image-tokens.js";
+import { EXPECTED_OUTPUT_SCALE, estimateAnalysisCost } from "./admission.js";
 import { createHash, randomUUID } from "node:crypto";
-import { MODEL_RATES } from "../run/pricing.js";
+import { modelRate } from "../run/pricing.js";
 import { containsSensitive } from "../evidence/redaction.js";
 import { scanEncodedText } from "../evidence/encoded-text.js";
 import { ANALYSIS_ID_PATTERN, ANALYSIS_SCHEMA, } from "./types.js";
-import { INPUT_IMAGE_DATA_URL, createAnalysisProvider, } from "./provider.js";
+import { createAnalysisProvider, } from "./provider.js";
 import { hashAnalysisValue, analysisResultJsonSchema, validateAnalysisInputMetadata, } from "./validation.js";
 import { analysisCohorts, analysisRequestCount, EVIDENCE_LIMITS } from "./analysis-limits.js";
 import { checkMergedResponse, cohortInputs, mergePacket, mergeResultJsonSchema, } from "./cohorts.js";
-import { checkProviderAnalysis, codexWarnings, recordProviderUsage, } from "./responses.js";
+import { checkProviderAnalysis, codexWarnings, httpStatusWarning, recordProviderUsage, } from "./responses.js";
 import { mapWithConcurrency } from "../run/concurrency.js";
 export const ANALYSIS_PROMPT_VERSION = "study-evidence-8";
-const SUPPORTED_ANALYSIS_MODELS = Object.freeze([
+export const SUPPORTED_ANALYSIS_MODELS = Object.freeze([
     "gpt-6-astra",
+    "gpt-6.1-sol",
+    "gpt-6-luna",
     "gpt-5.5",
     "gpt-5.6",
     "gpt-5.6-sol",
@@ -22,8 +24,18 @@ const SUPPORTED_ANALYSIS_MODELS = Object.freeze([
     "gpt-5.6-luna",
 ]);
 const SUPPORTED_MODELS = new Set(SUPPORTED_ANALYSIS_MODELS);
-export const isSupportedAnalysisModel = (model) => SUPPORTED_MODELS.has(model);
-/** The OpenAI output limit when a study omits maxOutputTokens, and the most it may ask for. */
+/**
+ * Gemini models that completed a live analysis. Each model's page under
+ * ai.google.dev/gemini-api/docs/models (read 2026-10-21) also lists image input and JSON-schema
+ * output for gemini-3.5-flash-lite, gemini-3-flash-preview and gemini-4-argon; they join this list
+ * once a live analysis on each completes.
+ */
+export const GEMINI_ANALYSIS_MODELS = Object.freeze(["gemini-3.8-flash"]);
+const GEMINI_MODELS = new Set(GEMINI_ANALYSIS_MODELS);
+/** Whether the API analyst `provider` (omitted is OpenAI) analyzes with `model`. */
+export const isSupportedAnalysisModel = (model, provider = "openai") => (provider === "gemini" ? GEMINI_MODELS : SUPPORTED_MODELS).has(model);
+/** The API output limit when a study omits maxOutputTokens, and the most it may ask for. Gemini 4
+ * returns at most 32,768 output tokens from one generateContent request. */
 export const DEFAULT_ANALYSIS_MAX_OUTPUT_TOKENS = 16_384;
 export const MAX_ANALYSIS_OUTPUT_TOKENS = 32_768;
 const MAX_EVIDENCE_BYTES = 1024 * 1024;
@@ -154,9 +166,10 @@ function inputError(input) {
  * Local admission estimate, not a provider-enforced billed-spend guarantee. No token-count API
  * call, credential, or network access. admission.ts holds the cost model: text at a calibrated
  * bytes-per-token ratio, the expected output, and the worst case that spends the whole output
- * allowance. Each high-detail image is priced from its PNG size by the vision guide's patch
- * formula (see image-tokens.ts), or at the 3,000-token ceiling when its size or the model's sizing
- * is unknown. Unknown models/rates fail closed rather than inheriting those assumptions.
+ * allowance. image-tokens.ts prices each image: on OpenAI from its PNG size by the vision guide's
+ * patch formula, or at the 3,000-token ceiling when its size or the model's sizing is unknown; on
+ * Gemini at the fixed high-resolution count. The rates are those of the day admission runs.
+ * Unknown models/rates fail closed rather than inheriting those assumptions.
  * Known-sensitive decoded text denies admission with analysis_input_sensitive or
  * analysis_question_sensitive. Neither error includes rejected input values.
  */
@@ -175,8 +188,10 @@ export function estimateAnalysisAdmission(input, config) {
     });
     if ((config.provider === "codex"
         ? !validCodexAnalysisConfig(config)
-        : (config.provider !== undefined && config.provider !== "openai") ||
-            !SUPPORTED_MODELS.has(config.model) ||
+        : (config.provider !== undefined &&
+            config.provider !== "openai" &&
+            config.provider !== "gemini") ||
+            !isSupportedAnalysisModel(config.model, config.provider) ||
             !Number.isFinite(config.maxCostUsd) ||
             config.maxCostUsd <= 0 ||
             config.maxCostUsd > 1000 ||
@@ -209,7 +224,7 @@ export function estimateAnalysisAdmission(input, config) {
             ratesAsOf: null,
             requests,
         };
-    const rate = MODEL_RATES[config.model];
+    const rate = modelRate(config.model);
     if (!rate ||
         rate.placeholder ||
         !Number.isFinite(rate.inputUsdPerToken) ||
@@ -230,6 +245,7 @@ export function estimateAnalysisAdmission(input, config) {
         }),
         // Without reports: estimateAnalysisCost prices them at the cohorts' output allowances.
         mergeTextBytes: requestBytes(mergeRequest(input, config, [])),
+        outputScale: EXPECTED_OUTPUT_SCALE[config.provider ?? "openai"],
     });
     if (!Number.isFinite(cost.worstCaseCostUsd))
         return denied("analysis_rate_unknown");
@@ -284,7 +300,7 @@ const RANGE_BISECTIONS = 40;
 export function analysisCostRange(config, participants, preferLargerOutput = false) {
     if (config.provider === "codex")
         return undefined;
-    const rate = MODEL_RATES[config.model];
+    const rate = modelRate(config.model);
     if (!rate || rate.placeholder)
         return undefined;
     const covered = Math.min(participants, EVIDENCE_LIMITS.participants);
@@ -306,9 +322,10 @@ export function analysisCostRange(config, participants, preferLargerOutput = fal
             outputAllowance,
             textBytes: cohortPrompt +
                 share * (EVIDENCE_LIMITS.textBytes + EVIDENCE_LIMITS.evidence * ENTRY_STRUCTURE_BYTES),
-            imageTokens: share * EVIDENCE_LIMITS.captures * HIGH_DETAIL_IMAGE_TOKEN_CEILING,
+            imageTokens: share * EVIDENCE_LIMITS.captures * imageTokenCeiling(config.model),
         })),
         mergeTextBytes: mergePrompt + share * covered * ENTRY_STRUCTURE_BYTES,
+        outputScale: EXPECTED_OUTPUT_SCALE[config.provider ?? "openai"],
     });
     const admits = (share, allowance) => request(share, allowance).admittedCostUsd <= config.maxCostUsd;
     // Cost grows with the share, so admission admits each allowance up to one share of the limits.
@@ -415,6 +432,7 @@ async function analysisProvider(config, options) {
                 cliVersion: config.identity.cliVersion,
             }))
         : createAnalysisProvider({
+            vendor: config.provider ?? "openai",
             apiKey: options.apiKey,
             ...(options.fetch === undefined ? {} : { fetchFn: options.fetch }),
         });
@@ -534,8 +552,8 @@ export async function runAnalysis(input, config, options) {
         });
         responses.push(response);
         recordProviderUsage(artifact, config, responses);
-        for (const warning of codexWarnings(config, response))
-            if (!options.warnings?.includes(warning))
+        for (const warning of [...codexWarnings(config, response), httpStatusWarning(config, response)])
+            if (warning !== undefined && !options.warnings?.includes(warning))
                 options.warnings?.push(warning);
         if (response.status !== "completed")
             return {

package/dist/analysis/gemini-wire.d.ts

@@ -0,0 +1,8 @@
+import type { AnalysisWire } from "./provider.js";
+/**
+ * One stateless request: no tools, high thinking, JSON constrained to the schema, the standard
+ * service tier, and `store: false` so the request stays out of the project's request logs. Each
+ * capture goes at MEDIA_RESOLUTION_HIGH, the setting the media-resolution guide recommends for
+ * image analysis, after a text part naming its evidence key.
+ */
+export declare const geminiWire: AnalysisWire;

package/dist/analysis/gemini-wire.js

@@ -0,0 +1,165 @@
+// The Gemini API generateContent wire format of one analysis request
+// (ai.google.dev/api/generate-content, read 2026-10-21): what the request body says and how a
+// response becomes an AnalysisProviderResult. provider.ts owns the transport around it.
+import { isRecord } from "../run/type-guards.js";
+import { INPUT_IMAGE_DATA_URL } from "./image-tokens.js";
+const record = (value) => (isRecord(value) ? value : {});
+const count = (value) => Number.isSafeInteger(value) && value >= 0 && value <= 1e12;
+/**
+ * The response schema as Gemini accepts it, and the array limits it leaves out. Gemini refuses the
+ * analysis schemas with a 400 while they carry `maxItems`: its constrained decoder counts the
+ * states each nested array limit adds, and its structured-output guide names large nested
+ * `maxItems` as a cause of that refusal. So any Gemini model can return an array past its limit;
+ * validation.ts checks every response against the full schema and refuses that one as
+ * analysis_validation_failed_schema_invalid. The limits go to the model as instructions instead.
+ */
+function withoutArrayLimits(schema) {
+    const limits = [];
+    const strip = (value, path) => {
+        if (Array.isArray(value))
+            return value.map((item) => strip(item, path));
+        if (!isRecord(value))
+            return value;
+        if (typeof value.maxItems === "number")
+            limits.push(`${path || "the answer"}: ${value.maxItems}`);
+        return Object.fromEntries(Object.entries(value)
+            .filter(([key]) => key !== "maxItems")
+            .map(([key, child]) => [
+            key,
+            key === "properties" && isRecord(child)
+                ? Object.fromEntries(Object.entries(child).map(([name, field]) => [
+                    name,
+                    strip(field, path ? `${path}.${name}` : name),
+                ]))
+                : strip(child, key === "items" ? `${path}[]` : path),
+        ]));
+    };
+    return { schema: strip(schema, ""), limits };
+}
+/**
+ * Proto3 JSON leaves out a count that is zero, so an absent thoughts, candidates or cached count is
+ * 0. promptTokenCount is never zero for a request that carries evidence, so it must be present.
+ * Thoughts bill as output (ai.google.dev/gemini-api/docs/pricing: "Output price (including
+ * thinking tokens)"). totalTokenCount must equal the parts, or none of them is trusted.
+ */
+function usageOf(raw) {
+    const usage = record(record(raw).usageMetadata);
+    const counted = (key) => {
+        const value = usage[key] ?? 0;
+        return count(value) ? value : null;
+    };
+    const prompt = usage.promptTokenCount;
+    const toolPrompt = counted("toolUsePromptTokenCount");
+    const candidates = counted("candidatesTokenCount");
+    const thoughts = counted("thoughtsTokenCount");
+    const cached = counted("cachedContentTokenCount");
+    if (!count(prompt) ||
+        toolPrompt === null ||
+        candidates === null ||
+        thoughts === null ||
+        cached === null)
+        return null;
+    const input = prompt + toolPrompt;
+    const output = candidates + thoughts;
+    if (cached > input ||
+        (usage.totalTokenCount !== undefined && usage.totalTokenCount !== input + output))
+        return null;
+    return { input, output, ...(cached > 0 ? { cachedInput: cached } : {}) };
+}
+/** The finish reasons that end a candidate without a usable answer, by what they mean. The
+ * provider declined to answer: its safety, recitation, language, blocklist or policy filters. */
+const DECLINED = new Set([
+    "SAFETY",
+    "RECITATION",
+    "LANGUAGE",
+    "BLOCKLIST",
+    "PROHIBITED_CONTENT",
+    "SPII",
+    "IMAGE_SAFETY",
+    "IMAGE_PROHIBITED_CONTENT",
+    "IMAGE_RECITATION",
+    "ESCALATION",
+    "PUP_LIMITED_DISABLED",
+]);
+/** The answer stopped at the output limit, or at a long-decode hop this one request never
+ * follows. */
+const CUT_OFF = new Set(["MAX_TOKENS", "CONTINUATION"]);
+/** One candidate whose only non-thought part is the JSON answer; anything else fails closed. */
+function parseGenerateContent(raw) {
+    const root = record(raw);
+    const base = { output: null, usage: usageOf(raw), dispatched: true };
+    if (record(root.promptFeedback).blockReason !== undefined)
+        return { ...base, status: "refused", errorCode: "refusal" };
+    const candidates = Array.isArray(root.candidates) ? root.candidates : [];
+    if (candidates.length !== 1)
+        return { ...base, status: "failed", errorCode: "invalid_response" };
+    const candidate = record(candidates[0]);
+    const reason = String(candidate.finishReason);
+    if (DECLINED.has(reason))
+        return { ...base, status: "refused", errorCode: "refusal" };
+    if (CUT_OFF.has(reason))
+        return { ...base, status: "incomplete", errorCode: "output_incomplete" };
+    const parts = record(candidate.content).parts;
+    // A thought summary is never part of the answer; thoughtSignature on a text part is metadata.
+    const answer = Array.isArray(parts) ? parts.filter((part) => record(part).thought !== true) : [];
+    const text = record(answer[0]).text;
+    if (reason !== "STOP" ||
+        answer.length !== 1 ||
+        typeof text !== "string" ||
+        Object.keys(record(answer[0])).some((key) => key !== "text" && key !== "thoughtSignature"))
+        return { ...base, status: "failed", errorCode: "invalid_response" };
+    try {
+        return { ...base, status: "completed", output: JSON.parse(text), errorCode: null };
+    }
+    catch {
+        return { ...base, status: "failed", errorCode: "invalid_response" };
+    }
+}
+/**
+ * One stateless request: no tools, high thinking, JSON constrained to the schema, the standard
+ * service tier, and `store: false` so the request stays out of the project's request logs. Each
+ * capture goes at MEDIA_RESOLUTION_HIGH, the setting the media-resolution guide recommends for
+ * image analysis, after a text part naming its evidence key.
+ */
+export const geminiWire = {
+    url: (model) => `https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(model)}:generateContent`,
+    headers: (apiKey) => ({ "x-goog-api-key": apiKey, "Content-Type": "application/json" }),
+    body: (request) => {
+        const { schema, limits } = withoutArrayLimits(request.schema);
+        const limitText = limits.length === 0
+            ? ""
+            : `\n\nThe response schema sent with this request omits its array limits. Keep each array at or under its limit, by field path: ${limits.join("; ")}.`;
+        return {
+            systemInstruction: { parts: [{ text: request.instructions + limitText }] },
+            contents: [
+                {
+                    // The API leaves role optional outside a multi-turn conversation.
+                    parts: [
+                        { text: request.evidence },
+                        ...request.images.flatMap((image) => {
+                            const [, type, data] = INPUT_IMAGE_DATA_URL.exec(image.dataUrl);
+                            return [
+                                { text: JSON.stringify({ captureEvidenceId: image.evidenceId }) },
+                                {
+                                    inlineData: { mimeType: `image/${type}`, data },
+                                    mediaResolution: { level: "MEDIA_RESOLUTION_HIGH" },
+                                },
+                            ];
+                        }),
+                    ],
+                },
+            ],
+            generationConfig: {
+                candidateCount: 1,
+                maxOutputTokens: request.maxOutputTokens,
+                thinkingConfig: { thinkingLevel: "HIGH" },
+                responseFormat: {
+                    text: { mimeType: "APPLICATION_JSON", schema },
+                },
+            },
+            serviceTier: "standard",
+            store: false,
+        };
+    },
+    parse: parseGenerateContent,
+};

package/dist/analysis/image-tokens.d.ts

@@ -1,3 +1,5 @@
-/** 2,500 patches × 1.2: what any image costs on these models when its size is unknown. */
-export declare const HIGH_DETAIL_IMAGE_TOKEN_CEILING = 3000;
+/** An input image the analysis providers accept; the groups are the image type and its base64 bytes. */
+export declare const INPUT_IMAGE_DATA_URL: RegExp;
+/** The most one image can cost on `model`, whatever its size. */
+export declare const imageTokenCeiling: (model: string) => number;
 export declare function highDetailImageTokens(model: string, dataUrl: string): number;