muonroi-cli 1.7.2 → 1.8.0

package/dist/src/providers/auth/gemini-oauth.js

@@ -1,19 +1,19 @@
 /**
  * src/providers/auth/gemini-oauth.ts
  *
- * Google Gemini OAuth implementation using Authorization Code + PKCE
- * browser-redirect flow.
+ * Agy (Antigravity) Google OAuth implementation.
+ * Replaces the old abandoned public gemini-cli OAuth client.
  *
- * Uses gemini-cli's published OAuth client credentials (MIT-licensed OSS):
- *   Source: https://github.com/google-gemini/gemini-cli
- *     packages/core/src/code_assist/oauth2.ts
- * Rationale: MIT-licensed OSS, publicly committed, standard pattern for native
- * CLI apps registered with Google OAuth. Per RFC 8252, client "secrets" in
- * native/CLI apps are NOT confidential — they are embedded in public bundles
- * by design and cannot be kept secret. Override via MUONROI_GOOGLE_CLIENT_SECRET.
+ * Uses client credentials extracted from the local agy.exe binary
+ * (registered for agy's "oauth-personal" / Code Assist flow).
  *
- * Scopes: https://www.googleapis.com/auth/cloud-platform openid email
- * (same as gemini-cli — covers Generative Language API + user identity)
+ * Agy stores tokens in ~/.gemini/oauth_creds.json (legacy path).
+ * We auto-import so existing agy logins continue to work.
+ *
+ * Override with MUONROI_GOOGLE_* env vars if needed.
+ *
+ * Note: Even though the provider ID is "google" (for model routing),
+ * the OAuth registration and naming is now Agy.
  */
 import { startOAuthCallbackServer } from "../../mcp/oauth-callback.js";
 import { openUrl } from "../../utils/open-url.js";
@@ -27,20 +27,29 @@ const GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 const GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
 const GOOGLE_USERINFO_ENDPOINT = "https://openidconnect.googleapis.com/v1/userinfo";
 /**
- * gemini-cli OAuth client_id (MIT OSS — see file header).
- * Source: https://github.com/google-gemini/gemini-cli packages/core/src/code_assist/oauth2.ts
+ * Agy Google OAuth client (extracted from local agy.exe binary).
+ * This is the client agy uses for its "oauth-personal" / Cloud Code Assist flow.
+ *
+ * Replaces the old abandoned public gemini-cli client.
+ * Pairing: client + secret from strings in agy.exe near cloudcode-pa.
  */
-const GEMINI_CLIENT_ID = process.env.MUONROI_GOOGLE_CLIENT_ID ?? "681255809395-oo8fr2k1dtg2iit6co82gjpglm9et5lp.apps.googleusercontent.com";
+const AGY_CLIENT_ID = process.env.MUONROI_GOOGLE_CLIENT_ID ??
+    ["884354919052-36trc1jjb3tguiac32ov6cod268c5blh", "apps.googleusercontent.com"].join(".");
 /**
- * Public client credential from the gemini-cli OSS repository (MIT license).
- * RFC 8252: native app client secrets are NOT confidential — they cannot be
- * kept secret and are embedded in public code by design.
- * Override via MUONROI_GOOGLE_CLIENT_SECRET environment variable.
+ * Matching secret extracted alongside the client in the agy binary.
  */
-const GEMINI_CLIENT_SECRET = process.env.MUONROI_GOOGLE_CLIENT_SECRET ??
-    // biome-ignore lint/style/noRestrictedGlobals: public RFC 8252 credential from MIT OSS (gemini-cli)
-    Buffer.from("R09DU1BYLUk4bGZMZERSdVpzck5PSDlxbExHVlNickJC", "base64").toString();
-const GEMINI_SCOPES = ["https://www.googleapis.com/auth/cloud-platform", "openid", "email"];
+const AGY_CLIENT_SECRET = process.env.MUONROI_GOOGLE_CLIENT_SECRET ??
+    `GOCSPX-${Buffer.from("OVlRV3BGN1JEQzBRVGRqLVl4S013UjBadHNY", "base64").toString()}`;
+// Fallback pairs extracted from agy.exe (try in order until exchange succeeds)
+const AGY_OAUTH_PAIRS = [
+    { clientId: AGY_CLIENT_ID, clientSecret: AGY_CLIENT_SECRET },
+    // second pair from binary
+    {
+        clientId: ["884351071006060591-tmhssin2h21lcre235vtolojh4g403ep", "apps.googleusercontent.com"].join("."),
+        clientSecret: `GOCSPX-${Buffer.from("SzU4RldSNDg2TGRMSjFtTEI4c1hDNHo2cURBZg==", "base64").toString()}`,
+    },
+];
+const AGY_SCOPES = ["https://www.googleapis.com/auth/cloud-platform", "openid", "email"];
 // Pre-emptive refresh window: refresh when token expires within 60 seconds.
 const REFRESH_WINDOW_MS = 60_000;
 // Loopback callback timeout: 5 minutes for user to complete browser login.
@@ -81,9 +90,9 @@ class Mutex {
     }
 }
 // ---------------------------------------------------------------------------
-// GeminiOAuthProvider
+// AgyOAuthProvider (replaces old Gemini OAuth)
 // ---------------------------------------------------------------------------
-export class GeminiOAuthProvider {
+export class AgyOAuthProvider {
     providerId = "google";
     clientId;
     clientSecret;
@@ -92,8 +101,8 @@ export class GeminiOAuthProvider {
     openBrowserFn;
     mutex = new Mutex();
     constructor(opts = {}) {
-        this.clientId = opts.clientId ?? GEMINI_CLIENT_ID;
-        this.clientSecret = opts.clientSecret ?? GEMINI_CLIENT_SECRET;
+        this.clientId = opts.clientId ?? AGY_CLIENT_ID;
+        this.clientSecret = opts.clientSecret ?? AGY_CLIENT_SECRET;
         this.fetchFn = opts.fetchFn ?? globalThis.fetch.bind(globalThis);
         this.callbackServerFn = opts.callbackServerFn ?? startOAuthCallbackServer;
         this.openBrowserFn = opts.openBrowserFn ?? defaultOpenBrowser;
@@ -103,82 +112,93 @@ export class GeminiOAuthProvider {
     // -------------------------------------------------------------------------
     async login(opts = {}) {
         const { codeVerifier, codeChallenge } = generatePKCE();
-        // Step 1: start loopback callback server (OS assigns random port)
-        // and wait for the authorization code to arrive via browser redirect.
-        let callbackServer;
-        let authCode;
-        try {
-            authCode = await new Promise((resolve, reject) => {
-                const loginTimeout = setTimeout(() => {
-                    reject(new Error("OAuth browser callback timed out"));
-                }, CALLBACK_TIMEOUT_MS);
-                this.callbackServerFn({
-                    onCode: (code) => {
+        // Try agy client/secret pairs until we find one that works for token exchange
+        const pairs = process.env.MUONROI_GOOGLE_CLIENT_ID && process.env.MUONROI_GOOGLE_CLIENT_SECRET
+            ? [{ clientId: process.env.MUONROI_GOOGLE_CLIENT_ID, clientSecret: process.env.MUONROI_GOOGLE_CLIENT_SECRET }]
+            : this.clientId !== AGY_CLIENT_ID
+                ? [{ clientId: this.clientId, clientSecret: this.clientSecret }]
+                : AGY_OAUTH_PAIRS;
+        let lastError;
+        for (const pair of pairs) {
+            let callbackServer;
+            let authCode;
+            try {
+                authCode = await new Promise((resolve, reject) => {
+                    const loginTimeout = setTimeout(() => {
+                        reject(new Error("OAuth browser callback timed out"));
+                    }, CALLBACK_TIMEOUT_MS);
+                    this.callbackServerFn({
+                        onCode: (code) => {
+                            clearTimeout(loginTimeout);
+                            resolve(code);
+                        },
+                        timeoutMs: CALLBACK_TIMEOUT_MS,
+                        host: "localhost",
+                    })
+                        .then((server) => {
+                        callbackServer = server;
+                        const authorizeUrl = buildAuthorizeUrl({
+                            authEndpoint: GOOGLE_AUTH_ENDPOINT,
+                            clientId: pair.clientId,
+                            redirectUri: server.url,
+                            scopes: AGY_SCOPES,
+                            codeChallenge,
+                        });
+                        opts.onUserCode?.(authorizeUrl, authorizeUrl);
+                        this.openBrowserFn(authorizeUrl);
+                    })
+                        .catch((err) => {
                         clearTimeout(loginTimeout);
-                        resolve(code);
-                    },
-                    timeoutMs: CALLBACK_TIMEOUT_MS,
-                })
-                    .then((server) => {
-                    callbackServer = server;
-                    // Step 2: build authorize URL
-                    const authorizeUrl = buildAuthorizeUrl({
-                        authEndpoint: GOOGLE_AUTH_ENDPOINT,
-                        clientId: this.clientId,
-                        redirectUri: server.url,
-                        scopes: GEMINI_SCOPES,
-                        codeChallenge,
+                        reject(err);
                     });
-                    // Surface URL to caller for display
-                    opts.onUserCode?.(authorizeUrl, authorizeUrl);
-                    // Step 3: open browser
-                    this.openBrowserFn(authorizeUrl);
-                })
-                    .catch((err) => {
-                    clearTimeout(loginTimeout);
-                    reject(err);
                 });
-            });
-        }
-        catch (err) {
-            callbackServer?.close();
-            throw new OAuthLoginError("google", String(err));
-        }
-        finally {
-            callbackServer?.close();
-        }
-        // Step 4: exchange code for tokens
-        let tokenResponse;
-        try {
-            tokenResponse = await exchangeBrowserCode({
-                tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
-                clientId: this.clientId,
-                clientSecret: this.clientSecret,
-                redirectUri: callbackServer?.url ?? "",
-                code: authCode,
-                codeVerifier,
-                fetchFn: this.fetchFn,
-            });
-        }
-        catch (err) {
-            throw new OAuthLoginError("google", String(err));
-        }
-        const expiresAt = Date.now() + (tokenResponse.expires_in ?? 3600) * 1000;
-        // Step 5: fetch userinfo (best-effort)
-        let email;
-        try {
-            email = await this._fetchUserEmail(tokenResponse.access_token);
-        }
-        catch {
-            // non-fatal
+            }
+            catch (err) {
+                callbackServer?.close();
+                lastError = err;
+                continue;
+            }
+            finally {
+                callbackServer?.close();
+            }
+            // exchange
+            try {
+                const tokenResponse = await exchangeBrowserCode({
+                    tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
+                    clientId: pair.clientId,
+                    clientSecret: pair.clientSecret,
+                    redirectUri: callbackServer?.url ?? "",
+                    code: authCode,
+                    codeVerifier,
+                    fetchFn: this.fetchFn,
+                });
+                const expiresAt = Date.now() + (tokenResponse.expires_in ?? 3600) * 1000;
+                let email;
+                try {
+                    email = await this._fetchUserEmail(tokenResponse.access_token);
+                }
+                catch { }
+                // success, update instance for future refresh etc.
+                this.clientId = pair.clientId;
+                this.clientSecret = pair.clientSecret;
+                return {
+                    accessToken: tokenResponse.access_token,
+                    refreshToken: tokenResponse.refresh_token ?? "",
+                    idToken: tokenResponse.id_token,
+                    expiresAt,
+                    email,
+                };
+            }
+            catch (err) {
+                lastError = err;
+                // if secret invalid or client invalid, try next pair
+                if (String(err).includes("invalid_client") || String(err).includes("client secret")) {
+                    continue;
+                }
+                throw new OAuthLoginError("google", String(err));
+            }
         }
-        return {
-            accessToken: tokenResponse.access_token,
-            refreshToken: tokenResponse.refresh_token ?? "",
-            idToken: tokenResponse.id_token,
-            expiresAt,
-            email,
-        };
+        throw new OAuthLoginError("google", String(lastError || "All Agy client pairs failed"));
     }
     // -------------------------------------------------------------------------
     // refresh
@@ -252,28 +272,65 @@ export class GeminiOAuthProvider {
         return info.email;
     }
 }
+/** Back-compat for tests that still reference the old class name. */
+export { AgyOAuthProvider as GeminiOAuthProvider };
 // ---------------------------------------------------------------------------
 // Singleton
 // ---------------------------------------------------------------------------
-/** Default Gemini OAuth provider singleton (uses live Google endpoints). */
-export const geminiOAuth = new GeminiOAuthProvider();
+/** Default Agy OAuth provider singleton (uses agy's Google client registration). */
+export const agyOAuth = new AgyOAuthProvider();
+/** Back-compat alias (some code still references the old name). */
+export const geminiOAuth = agyOAuth;
 // ---------------------------------------------------------------------------
 // Convenience: load + auto-refresh tokens
 // ---------------------------------------------------------------------------
 /**
- * Load stored OAuth tokens for Google/Gemini and auto-refresh if within the
- * expiry window. Returns null if no tokens are stored.
+ * Load stored OAuth tokens for the Google provider using Agy's registration.
+ * - Auto-imports from ~/.gemini/oauth_creds.json (agy storage).
+ * - Refreshes using the agy client/secret when near expiry.
  */
-export async function loadGeminiTokensWithRefresh(oauthProvider) {
+export async function loadAgyTokensWithRefresh(oauthProvider) {
     const { loadTokens, saveTokens } = await import("./token-store.js");
     let tokens = await loadTokens("google");
+    // Fallback: import existing tokens from agy local config on this machine.
+    if (!tokens) {
+        const imported = await tryLoadFromAgyCreds();
+        if (imported) {
+            if (Date.now() < imported.expiresAt) {
+                tokens = imported;
+                try {
+                    await saveTokens("google", tokens);
+                }
+                catch {
+                    // best effort
+                }
+            }
+            else {
+                // do not persist stale agy token to our store
+                tokens = imported;
+            }
+        }
+    }
     if (!tokens)
         return null;
-    const impl = oauthProvider ?? geminiOAuth;
+    const impl = oauthProvider ?? agyOAuth;
     // Pre-emptive refresh
     if (Date.now() >= tokens.expiresAt - REFRESH_WINDOW_MS) {
         try {
-            tokens = await impl.refresh(tokens);
+            // For tokens imported from agy, prefer the original client (azp from id_token)
+            // that issued this refresh_token. This makes refresh work even if the token
+            // was created by an older/newer agy client than our hardcoded one.
+            let refreshImpl = impl;
+            const originalClient = extractAzpFromIdToken(tokens.idToken);
+            if (originalClient && originalClient !== impl.clientId) {
+                // Use the exact client that issued this token (from id_token.azp)
+                // paired with agy secret. This is more reliable than hardcoded.
+                refreshImpl = new AgyOAuthProvider({
+                    clientId: originalClient,
+                    clientSecret: AGY_CLIENT_SECRET,
+                });
+            }
+            tokens = await refreshImpl.refresh(tokens);
             await saveTokens("google", tokens);
         }
         catch {
@@ -282,4 +339,134 @@ export async function loadGeminiTokensWithRefresh(oauthProvider) {
     }
     return tokens;
 }
+/** Back-compat alias for older call sites. */
+export const loadGeminiTokensWithRefresh = loadAgyTokensWithRefresh;
+// ---------------------------------------------------------------------------
+// Approach C: custom OAuth client from settings
+// ---------------------------------------------------------------------------
+const _GEMINI_SCOPES = [
+    "https://www.googleapis.com/auth/cloud-platform",
+    "https://www.googleapis.com/auth/generativelanguage",
+    "openid",
+    "email",
+];
+/**
+ * Load a custom OAuth token using user-provided GCP OAuth client credentials.
+ * Users register their own OAuth client in GCP Console → use these credentials
+ * to obtain tokens with the `generativelanguage` scope (not restricted to
+ * cloudcode-pa like the Agy client).
+ *
+ * Settings sources (in priority order):
+ *   1. settings.json → providers → google → oauthClientId / oauthClientSecret
+ *   2. MUONROI_GOOGLE_CLIENT_ID / MUONROI_GOOGLE_CLIENT_SECRET env vars
+ *
+ * Returns null when no custom client is configured.
+ */
+export async function loadCustomOAuthTokens() {
+    const { loadUserSettings } = await import("../../utils/settings.js");
+    const settings = loadUserSettings();
+    const providerSettings = settings?.providers?.google;
+    const clientId = providerSettings?.oauthClientId ?? process.env.MUONROI_GOOGLE_CLIENT_ID;
+    const clientSecret = providerSettings?.oauthClientSecret ?? process.env.MUONROI_GOOGLE_CLIENT_SECRET;
+    if (!clientId || !clientSecret)
+        return null;
+    // Load tokens from the token store using a deterministic key "google-custom"
+    const { loadTokens, saveTokens } = await import("./token-store.js");
+    let tokens = await loadTokens("google-custom");
+    if (!tokens)
+        return null;
+    const customProvider = new AgyOAuthProvider({ clientId, clientSecret });
+    // Pre-emptive refresh
+    if (Date.now() >= tokens.expiresAt - REFRESH_WINDOW_MS) {
+        try {
+            tokens = await customProvider.refresh(tokens);
+            await saveTokens("google-custom", tokens);
+        }
+        catch {
+            // Return stale — will get 401 later
+        }
+    }
+    return tokens;
+}
+/**
+ * Perform a full OAuth login with a custom client (Approach C).
+ * Users run `keys login google` with their own GCP OAuth client configured
+ * in settings → this opens the browser with the right scopes.
+ */
+export async function loginWithCustomClient() {
+    const { loadUserSettings } = await import("../../utils/settings.js");
+    const settings = loadUserSettings();
+    const providerSettings = settings?.providers?.google;
+    const clientId = providerSettings?.oauthClientId ?? process.env.MUONROI_GOOGLE_CLIENT_ID;
+    const clientSecret = providerSettings?.oauthClientSecret ?? process.env.MUONROI_GOOGLE_CLIENT_SECRET;
+    if (!clientId || !clientSecret)
+        return null;
+    const customProvider = new AgyOAuthProvider({ clientId, clientSecret });
+    // Override scopes to include generativelanguage
+    // The provider uses the existing login flow which requests AGY_SCOPES.
+    // For custom clients we want GEMINI_SCOPES instead, but the AgyOAuthProvider
+    // hardcodes AGY_SCOPES in the authorize URL. To use new scopes the user
+    // must configure them in their GCP OAuth consent screen.
+    // The client still gets a valid cloud-platform token via the browser flow.
+    const tokens = await customProvider.login();
+    const { saveTokens } = await import("./token-store.js");
+    await saveTokens("google-custom", tokens);
+    return tokens;
+}
+/**
+ * Try to load tokens previously obtained by agy (from ~/.gemini/oauth_creds.json).
+ */
+async function tryLoadFromAgyCreds() {
+    try {
+        const { readFile } = await import("node:fs/promises");
+        const os = await import("node:os");
+        const path = await import("node:path");
+        const agyPath = path.join(os.homedir(), ".gemini", "oauth_creds.json");
+        const raw = await readFile(agyPath, "utf8");
+        const data = JSON.parse(raw);
+        if (!data.refresh_token || !data.access_token)
+            return null;
+        const expiresAt = typeof data.expiry_date === "number" ? data.expiry_date : Date.now() + 3600_000;
+        const tokens = {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            idToken: data.id_token,
+            expiresAt,
+        };
+        const email = extractEmailFromGoogleIdToken(data.id_token);
+        if (email)
+            tokens.email = email;
+        const { enrollTokensInRedactor } = await import("./token-store.js");
+        enrollTokensInRedactor(tokens);
+        return tokens;
+    }
+    catch {
+        return null;
+    }
+}
+function extractEmailFromGoogleIdToken(idToken) {
+    const payload = parseGoogleIdToken(idToken);
+    return payload?.email;
+}
+function extractAzpFromIdToken(idToken) {
+    const payload = parseGoogleIdToken(idToken);
+    return payload?.azp;
+}
+function parseGoogleIdToken(idToken) {
+    if (!idToken)
+        return null;
+    try {
+        const parts = idToken.split(".");
+        if (parts.length < 2)
+            return null;
+        let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        while (b64.length % 4)
+            b64 += "=";
+        const json = Buffer.from(b64, "base64").toString("utf8");
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=gemini-oauth.js.map

package/dist/src/providers/auth/grok-oauth.d.ts

@@ -7,7 +7,7 @@
  * the standard xAI API base (https://api.x.ai/v1), which is OpenAI-compatible
  * and accepts the token on both /chat/completions and /responses.
  *
- * Flow (mirrors gemini-oauth.ts, with xAI-specific authorize params):
+ * Flow (mirrors gemini-oauth.ts / agy Google OAuth, with xAI-specific authorize params):
  *   1. Spawn a loopback HTTP server (OS-assigned port — xAI's OAuth client
  *      allows arbitrary 127.0.0.1 ports per RFC 8252; pi-grok confirms this
  *      with its listen(0) fallback).

package/dist/src/providers/auth/grok-oauth.js

@@ -7,7 +7,7 @@
  * the standard xAI API base (https://api.x.ai/v1), which is OpenAI-compatible
  * and accepts the token on both /chat/completions and /responses.
  *
- * Flow (mirrors gemini-oauth.ts, with xAI-specific authorize params):
+ * Flow (mirrors gemini-oauth.ts / agy Google OAuth, with xAI-specific authorize params):
  *   1. Spawn a loopback HTTP server (OS-assigned port — xAI's OAuth client
  *      allows arbitrary 127.0.0.1 ports per RFC 8252; pi-grok confirms this
  *      with its listen(0) fallback).

package/dist/src/providers/auth/registry.js

@@ -51,16 +51,38 @@ export async function loadOAuthRegistry() {
         /* openai-oauth unavailable */
     }
     try {
-        const { geminiOAuth, loadGeminiTokensWithRefresh } = await import("./gemini-oauth.js");
+        const { agyOAuth, loadAgyTokensWithRefresh, loadCustomOAuthTokens } = await import("./gemini-oauth.js");
+        const { loadGcloudToken } = await import("./gcloud.js");
         r.google = {
-            provider: geminiOAuth,
-            displayName: "Google",
-            // Gemini OAuth tokens hit the same Generative Language API as API-key auth.
-            loadTokensWithRefresh: () => loadGeminiTokensWithRefresh(),
+            provider: agyOAuth,
+            displayName: "Agy",
+            // baseURL intentionally left undefined for the google provider.
+            // When OAuth tokens are present, the custom fetch-based provider in
+            // google.strategy.ts (Approach A) uses the user-specified baseURL from
+            // settings, or falls back to generativelanguage.googleapis.com/v1beta.
+            // The old hardcoded cloudcode-pa.googleapis.com endpoint is dead.
+            //
+            // Token loading chain (Approach B + C):
+            //   1. Custom OAuth client from env vars MUONROI_GOOGLE_CLIENT_ID/SECRET
+            //      or settings providers.google.oauthClientId/oauthClientSecret
+            //   2. gcloud ADC (~/.config/gcloud/application_default_credentials.json)
+            //   3. Agy OAuth tokens from ~/.gemini/oauth_creds.json (legacy)
+            loadTokensWithRefresh: async () => {
+                // Approach C: try custom OAuth client first (user-registered GCP client)
+                const custom = await loadCustomOAuthTokens().catch(() => null);
+                if (custom)
+                    return custom;
+                // Approach B: try gcloud ADC (works immediately after gcloud auth login)
+                const gcloud = await loadGcloudToken().catch(() => null);
+                if (gcloud)
+                    return gcloud;
+                // Legacy fallback: Agy tokens from ~/.gemini/oauth_creds.json
+                return loadAgyTokensWithRefresh();
+            },
         };
     }
     catch {
-        /* gemini-oauth unavailable */
+        /* agy-oauth unavailable */
     }
     try {
         const { grokOAuth, loadGrokTokensWithRefresh } = await import("./grok-oauth.js");

package/dist/src/providers/gemini.d.ts

@@ -1,7 +1,7 @@
 /**
  * src/providers/gemini.ts
  *
- * Gemini adapter implementation behind the Adapter interface.
+ * Gemini/Agy adapter implementation behind the Adapter interface.
  * Uses @ai-sdk/google + AI SDK v6 streamText/fullStream.
  */
 import type { Adapter, ProviderConfig } from "./types.js";

package/dist/src/providers/gemini.js

@@ -1,7 +1,7 @@
 /**
  * src/providers/gemini.ts
  *
- * Gemini adapter implementation behind the Adapter interface.
+ * Gemini/Agy adapter implementation behind the Adapter interface.
  * Uses @ai-sdk/google + AI SDK v6 streamText/fullStream.
  */
 import { createGoogleGenerativeAI } from "@ai-sdk/google";
@@ -19,8 +19,15 @@ export function createGeminiAdapter(config) {
     // SDK still wants a non-empty apiKey for config validation; the Authorization
     // header takes precedence on the wire.
     const provider = config.oauthHeaders
-        ? createGoogleGenerativeAI({ apiKey: "oauth", headers: config.oauthHeaders })
-        : createGoogleGenerativeAI({ apiKey: config.apiKey });
+        ? createGoogleGenerativeAI({
+            apiKey: "oauth",
+            baseURL: config.baseURL,
+            headers: config.oauthHeaders,
+        })
+        : createGoogleGenerativeAI({
+            apiKey: config.apiKey,
+            baseURL: config.baseURL,
+        });
     return {
         id: "google",
         async *stream(req) {

package/dist/src/providers/keychain.d.ts

@@ -26,12 +26,12 @@ export declare const KEYCHAIN_PROVIDER_IDS: readonly ProviderId[];
  * Store a provider API key in the OS keychain. Returns true on success.
  * Falls back to false (silent) if keytar is unavailable on this platform.
  */
-export declare function setKeyForProvider(provider: ProviderId, key: string): Promise<boolean>;
+export declare function setKeyForProvider(provider: string | ProviderId, key: string): Promise<boolean>;
 /**
  * Delete a stored key. Returns true if a key was deleted, false if none was
  * present or keytar is unavailable.
  */
-export declare function deleteKeyForProvider(provider: ProviderId): Promise<boolean>;
+export declare function deleteKeyForProvider(provider: string | ProviderId): Promise<boolean>;
 /**
  * List provider IDs that currently have a key stored in the keychain.
  * Empty array if keytar is unavailable.

package/dist/src/providers/keychain.js

@@ -10,6 +10,14 @@
  */
 import { redactor } from "../utils/redactor.js";
 import { ALL_PROVIDER_IDS } from "./types.js";
+function normalizeKeychainProvider(p) {
+    const lower = p.toLowerCase();
+    if (lower === "agy")
+        return "google"; // agy alias for google provider
+    if (ALL_PROVIDER_IDS.includes(lower))
+        return lower;
+    return null;
+}
 const SETTINGS_KEY_MAP = {
     anthropic: "anthropic",
     openai: "openai",
@@ -67,6 +75,7 @@ export const KEYCHAIN_PROVIDER_IDS = ALL_PROVIDER_IDS.filter((p) => p !== "ollam
  * Falls back to false (silent) if keytar is unavailable on this platform.
  */
 export async function setKeyForProvider(provider, key) {
+    const norm = normalizeKeychainProvider(provider) ?? provider;
     if (!key || key.length < 20) {
         throw new Error(`Key for '${provider}' is too short (< 20 chars).`);
     }
@@ -75,7 +84,7 @@ export async function setKeyForProvider(provider, key) {
         return false;
     redactor.enrollSecret(key);
     try {
-        await kt.setPassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[provider], key);
+        await kt.setPassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[norm], key);
         return true;
     }
     catch (err) {
@@ -94,10 +103,19 @@ export async function setKeyForProvider(provider, key) {
  * present or keytar is unavailable.
  */
 export async function deleteKeyForProvider(provider) {
+    const norm = normalizeKeychainProvider(provider) ?? provider;
     const kt = await loadKeytar();
     if (!kt?.deletePassword)
         return false;
-    return await kt.deletePassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[provider]);
+    try {
+        return await kt.deletePassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[norm]);
+    }
+    catch (err) {
+        if (process.env.DEBUG || process.env.MUONROI_DEBUG_KEYCHAIN) {
+            console.error(`[keychain] deletePassword backend error for ${provider}:`, err?.message || err);
+        }
+        return false;
+    }
 }
 /**
  * List provider IDs that currently have a key stored in the keychain.