feat: support Gemini CLI v1internal quota

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/dispatch.rs

@@ -4,6 +4,7 @@ use std::pin::Pin;
 use super::antigravity::refresh_antigravity_provider_quota_locally;
 use super::chatgpt_web::refresh_chatgpt_web_provider_quota_locally;
 use super::codex::refresh_codex_provider_quota_locally;
+use super::gemini_cli::refresh_gemini_cli_provider_quota_locally;
 use super::grok::refresh_grok_provider_quota_locally;
 use super::kiro::refresh_kiro_provider_quota_locally;
 use crate::handlers::admin::request::AdminAppState;
@@ -34,6 +35,10 @@ const PROVIDER_QUOTA_REFRESH_HANDLERS: &[(&str, ProviderQuotaRefreshHandler)] =
         refresh_chatgpt_web_provider_quota_locally_boxed,
     ),
     ("codex", refresh_codex_provider_quota_locally_boxed),
+    (
+        "gemini_cli",
+        refresh_gemini_cli_provider_quota_locally_boxed,
+    ),
     ("grok", refresh_grok_provider_quota_locally_boxed),
     ("kiro", refresh_kiro_provider_quota_locally_boxed),
 ];
@@ -104,6 +109,22 @@ fn refresh_codex_provider_quota_locally_boxed<'a>(
     ))
 }
 
+fn refresh_gemini_cli_provider_quota_locally_boxed<'a>(
+    state: &'a AdminAppState<'a>,
+    provider: &'a StoredProviderCatalogProvider,
+    endpoint: &'a StoredProviderCatalogEndpoint,
+    keys: Vec<StoredProviderCatalogKey>,
+    proxy_override: Option<ProxySnapshot>,
+) -> ProviderQuotaRefreshFuture<'a> {
+    Box::pin(refresh_gemini_cli_provider_quota_locally(
+        state,
+        provider,
+        endpoint,
+        keys,
+        proxy_override,
+    ))
+}
+
 fn refresh_kiro_provider_quota_locally_boxed<'a>(
     state: &'a AdminAppState<'a>,
     provider: &'a StoredProviderCatalogProvider,

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/gemini_cli.rs

@@ -0,0 +1,258 @@
+use super::shared::{
+    build_provider_quota_execution_plan, build_quota_snapshot_payload,
+    default_provider_quota_execution_timeouts, execute_provider_quota_plan,
+    extract_execution_error_message, oauth_refresh_auto_removed_result,
+    persist_provider_quota_refresh_state, quota_key_auto_removed,
+    quota_refresh_success_invalid_state, ProviderQuotaExecutionOutcome,
+};
+use crate::handlers::admin::request::{AdminAppState, AdminGatewayProviderTransportSnapshot};
+use crate::GatewayError;
+use aether_admin::provider::quota::parse_gemini_cli_retrieve_user_quota_response;
+use aether_contracts::ProxySnapshot;
+use aether_data_contracts::repository::provider_catalog::{
+    StoredProviderCatalogEndpoint, StoredProviderCatalogKey, StoredProviderCatalogProvider,
+};
+use aether_provider_pool::build_gemini_cli_pool_quota_request;
+use serde_json::json;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+async fn execute_gemini_cli_quota_plan(
+    state: &AdminAppState<'_>,
+    transport: &AdminGatewayProviderTransportSnapshot,
+    authorization: (String, String),
+    project_id: &str,
+    proxy_override: Option<&ProxySnapshot>,
+) -> Result<ProviderQuotaExecutionOutcome, GatewayError> {
+    let proxy = match proxy_override {
+        Some(proxy) => Some(proxy.clone()),
+        None => {
+            state
+                .resolve_transport_proxy_snapshot_with_tunnel_affinity(transport)
+                .await
+        }
+    };
+    let timeouts = state
+        .resolve_transport_execution_timeouts(transport)
+        .or(Some(default_provider_quota_execution_timeouts(
+            proxy.as_ref(),
+        )));
+    let spec = build_gemini_cli_pool_quota_request(
+        &transport.key.id,
+        &transport.endpoint.base_url,
+        authorization,
+        project_id,
+    );
+    let plan = build_provider_quota_execution_plan(
+        transport,
+        spec,
+        proxy,
+        state.resolve_transport_profile(transport),
+        timeouts,
+    );
+
+    execute_provider_quota_plan(state, transport, plan, "gemini_cli").await
+}
+
+pub(crate) async fn refresh_gemini_cli_provider_quota_locally(
+    state: &AdminAppState<'_>,
+    provider: &StoredProviderCatalogProvider,
+    endpoint: &StoredProviderCatalogEndpoint,
+    keys: Vec<StoredProviderCatalogKey>,
+    proxy_override: Option<ProxySnapshot>,
+) -> Result<Option<serde_json::Value>, GatewayError> {
+    let mut results = Vec::new();
+    let mut success_count = 0usize;
+    let mut failed_count = 0usize;
+    let mut auto_removed_count = 0usize;
+
+    for key in keys {
+        let transport = match state
+            .read_provider_transport_snapshot(&provider.id, &endpoint.id, &key.id)
+            .await?
+        {
+            Some(transport) => transport,
+            None => {
+                failed_count += 1;
+                results.push(json!({
+                    "key_id": key.id,
+                    "key_name": key.name,
+                    "status": "error",
+                    "message": "Provider transport snapshot unavailable",
+                }));
+                continue;
+            }
+        };
+
+        let authorization = match state.resolve_local_oauth_header_auth(&transport).await? {
+            Some(auth) => auth,
+            _ => {
+                if quota_key_auto_removed(state, &key.id).await? {
+                    auto_removed_count += 1;
+                    results.push(oauth_refresh_auto_removed_result(&key));
+                    continue;
+                }
+                failed_count += 1;
+                results.push(json!({
+                    "key_id": key.id,
+                    "key_name": key.name,
+                    "status": "error",
+                    "message": "缺少 OAuth 认证信息，请先授权/刷新 Token",
+                }));
+                continue;
+            }
+        };
+
+        let Some(project_id) = crate::provider_transport::resolve_gemini_cli_project_id(&transport)
+        else {
+            failed_count += 1;
+            results.push(json!({
+                "key_id": key.id,
+                "key_name": key.name,
+                "status": "error",
+                "message": "缺少 Gemini CLI project_id，请先刷新模型或在 auth_config/upstream_metadata 中写入 project_id",
+            }));
+            continue;
+        };
+
+        let result = match execute_gemini_cli_quota_plan(
+            state,
+            &transport,
+            authorization,
+            &project_id,
+            proxy_override.as_ref(),
+        )
+        .await?
+        {
+            ProviderQuotaExecutionOutcome::Response(result) => result,
+            ProviderQuotaExecutionOutcome::Failure(detail) => {
+                failed_count += 1;
+                results.push(json!({
+                    "key_id": key.id,
+                    "key_name": key.name,
+                    "status": "error",
+                    "message": format!("retrieveUserQuota 请求执行失败: {detail}"),
+                    "status_code": 502,
+                }));
+                continue;
+            }
+        };
+
+        let now_unix_secs = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .ok()
+            .map(|duration| duration.as_secs())
+            .unwrap_or(0);
+        let mut metadata_update = None::<serde_json::Value>;
+        let (mut oauth_invalid_at_unix_secs, mut oauth_invalid_reason) =
+            quota_refresh_success_invalid_state(&key);
+        let mut status = "error".to_string();
+        let mut message = None::<String>;
+
+        if result.status_code == 200 {
+            if let Some(body_json) = result
+                .body
+                .as_ref()
+                .and_then(|body| body.json_body.as_ref())
+            {
+                metadata_update =
+                    parse_gemini_cli_retrieve_user_quota_response(body_json, now_unix_secs)
+                        .map(|metadata| json!({ "gemini_cli": metadata }));
+                if metadata_update.is_some() {
+                    status = "success".to_string();
+                } else {
+                    status = "no_metadata".to_string();
+                    message = Some("响应中未包含配额 buckets".to_string());
+                }
+            } else {
+                status = "no_metadata".to_string();
+                message = Some("响应中未包含配额信息".to_string());
+            }
+        } else {
+            let err_msg = extract_execution_error_message(&result);
+            message = Some(match err_msg.as_deref() {
+                Some(detail) if !detail.is_empty() => {
+                    format!(
+                        "retrieveUserQuota 返回状态码 {}: {}",
+                        result.status_code, detail
+                    )
+                }
+                _ => format!("retrieveUserQuota 返回状态码 {}", result.status_code),
+            });
+            if result.status_code == 403 {
+                let reason = err_msg
+                    .clone()
+                    .filter(|value| !value.trim().is_empty())
+                    .unwrap_or_else(|| "账户访问被禁止".to_string());
+                oauth_invalid_at_unix_secs = Some(now_unix_secs);
+                oauth_invalid_reason = Some(format!("账户访问被禁止: {reason}"));
+                metadata_update = Some(json!({
+                    "gemini_cli": {
+                        "is_forbidden": true,
+                        "forbidden_reason": reason,
+                        "forbidden_at": now_unix_secs,
+                        "updated_at": now_unix_secs,
+                    }
+                }));
+                status = "forbidden".to_string();
+            }
+        }
+
+        if !persist_provider_quota_refresh_state(
+            state,
+            &key.id,
+            metadata_update.as_ref(),
+            oauth_invalid_at_unix_secs,
+            oauth_invalid_reason,
+            None,
+        )
+        .await?
+        {
+            failed_count += 1;
+            results.push(json!({
+                "key_id": key.id,
+                "key_name": key.name,
+                "status": "error",
+                "message": "Key 状态写入失败",
+            }));
+            continue;
+        }
+
+        if status == "success" {
+            success_count += 1;
+        } else {
+            failed_count += 1;
+        }
+
+        let mut payload = serde_json::Map::new();
+        payload.insert("key_id".to_string(), json!(key.id));
+        payload.insert("key_name".to_string(), json!(key.name));
+        payload.insert("status".to_string(), json!(status));
+        if let Some(message) = message {
+            payload.insert("message".to_string(), json!(message));
+        }
+        if let Some(metadata) = metadata_update
+            .as_ref()
+            .and_then(|value| value.get("gemini_cli"))
+            .cloned()
+        {
+            payload.insert("metadata".to_string(), metadata);
+        }
+        if let Some(quota_snapshot) = build_quota_snapshot_payload(
+            "gemini_cli",
+            key.status_snapshot.as_ref(),
+            metadata_update.as_ref(),
+        ) {
+            payload.insert("quota_snapshot".to_string(), quota_snapshot);
+        }
+        results.push(serde_json::Value::Object(payload));
+    }
+
+    Ok(Some(json!({
+        "success": success_count,
+        "failed": failed_count,
+        "total": results.len(),
+        "results": results,
+        "message": format!("已处理 {} 个 Key", results.len()),
+        "auto_removed": auto_removed_count,
+    })))
+}

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/mod.rs

@@ -2,6 +2,7 @@ pub(crate) mod antigravity;
 pub(crate) mod chatgpt_web;
 pub(crate) mod codex;
 pub(crate) mod dispatch;
+pub(crate) mod gemini_cli;
 pub(crate) mod grok;
 pub(crate) mod kiro;
 pub(crate) mod shared;

apps/aether-gateway/src/handlers/admin/provider/pool_admin/payloads.rs

@@ -781,6 +781,18 @@ fn admin_pool_build_grok_account_quota_from_snapshot(
 fn admin_pool_build_gemini_cli_account_quota_from_snapshot(
     quota_snapshot: &serde_json::Map<String, serde_json::Value>,
 ) -> Option<String> {
+    if let Some(credits) = quota_snapshot
+        .get("credits")
+        .and_then(serde_json::Value::as_object)
+    {
+        if let Some(remaining) = admin_pool_json_to_f64(credits.get("remaining")) {
+            return Some(format!(
+                "AI Credits 剩余 {}",
+                admin_pool_format_quota_value(remaining)
+            ));
+        }
+    }
+
     let now = chrono::Utc::now().timestamp();
     let mut active = admin_pool_quota_windows(quota_snapshot)
         .into_iter()

apps/aether-gateway/src/handlers/admin/provider/query/models/model_test.rs

@@ -2836,6 +2836,33 @@ async fn provider_query_execute_standard_test_candidate(
         upstream_is_stream,
         require_body_stream_field,
     );
+    if crate::provider_transport::is_gemini_cli_provider_transport(&transport)
+        && normalized_provider_api_format == "gemini:generate_content"
+    {
+        let Some(project_id) = crate::provider_transport::resolve_gemini_cli_project_id(&transport)
+        else {
+            return Ok(provider_query_skipped_execution_outcome(
+                provider_request_body,
+                "Gemini CLI project_id is unavailable for v1internal request",
+            ));
+        };
+        provider_request_body = match crate::provider_transport::build_gemini_cli_v1internal_request(
+            project_id.as_str(),
+            trace_id,
+            request_model,
+            &provider_request_body,
+        ) {
+            crate::provider_transport::GeminiCliRequestEnvelopeSupport::Supported(envelope) => {
+                envelope
+            }
+            crate::provider_transport::GeminiCliRequestEnvelopeSupport::Unsupported(_) => {
+                return Ok(provider_query_skipped_execution_outcome(
+                    provider_request_body,
+                    "Gemini CLI v1internal envelope could not be built",
+                ));
+            }
+        };
+    }
 
     let uses_vertex_query_auth =
         crate::provider_transport::uses_vertex_api_key_query_auth(&transport, provider_api_format);
@@ -2956,6 +2983,13 @@ async fn provider_query_execute_standard_test_candidate(
     request_headers
         .entry("content-type".to_string())
         .or_insert_with(|| "application/json".to_string());
+    if crate::provider_transport::is_gemini_cli_provider_transport(&transport)
+        && normalized_provider_api_format == "gemini:generate_content"
+    {
+        request_headers
+            .entry("user-agent".to_string())
+            .or_insert_with(|| crate::provider_transport::GEMINI_CLI_USER_AGENT.to_string());
+    }
     let protected_headers = if uses_vertex_query_auth {
         vec!["content-type"]
     } else {

apps/aether-gateway/src/handlers/admin/provider/query/models/model_test/tests.rs

@@ -51,6 +51,7 @@ fn sample_openai_image_transport(provider_type: &str) -> AdminGatewayProviderTra
             expires_at_unix_secs: None,
             proxy: None,
             fingerprint: None,
+            upstream_metadata: None,
             decrypted_api_key: String::new(),
             decrypted_auth_config: Some(
                 json!({