Let Gemini clients use any provider

free/README.md

@@ -6,20 +6,21 @@ It covers **Claude, ChatGPT (Codex) and Kimi subscriptions** and **API keys** fo
 
 - CPA's dashboard, downloaded at build time from the latest panel release (pin one with `PANEL_VERSION`, and its checksum with `PANEL_SHA256`).
 - Claude and ChatGPT (Codex) OAuth logins from the dashboard's **OAuth Login** page (the same PKCE flows as CPA, Claude Code and the Codex CLI), with tokens refreshed automatically.
-- Kimi logins (kimi.com or kimi.ai) through Kimi's device sign-in, as in CPA. Claude Code and both OpenAI formats reach Kimi untranslated: ask for a Kimi model such as `kimi-k3` or `kimi-k2.8`. Requests name this gateway, as CPA's name CLIProxyAPI.
+- Kimi logins (kimi.com or kimi.ai) through Kimi's device sign-in, as in CPA. Claude Code and both OpenAI formats reach Kimi untranslated, and Gemini clients through Anthropic Messages: ask for a Kimi model such as `kimi-k3` or `kimi-k2.8`. Requests name this gateway, as CPA's name CLIProxyAPI.
 - Several logins per provider, used in turn, with a failing or rate-limited Claude or ChatGPT login skipped for the next. Upload, download, disable, edit and delete them under **Auth Files**, in CPA's auth-file format, so files move between the two installs.
 - CPA's YAML config, edited in the **Config Panel**. Client API keys live in `access.api-keys`, as in CPA.
 - `POST /v1/messages` and `POST /v1/messages/count_tokens`, streamed straight through to Anthropic.
 - API-key providers added under **AI Providers** (CPA's `api-keys` config): Claude, Gemini, Vertex AI, Codex, xAI and OpenAI-compatible endpoints such as OpenRouter. Model aliases, `prefix/model` routing, priorities, key weights (with the `weighted-round-robin` strategy) and excluded models work as in CPA, and a request moves on to the next key when one is rate limited or failing.
 - Codex CLI through a ChatGPT login, on `/backend-api/codex/responses` or `/v1/responses`. Other OpenAI Responses clients work too: their requests are adapted to what the ChatGPT endpoint takes, and a non-streaming request gets the final response as JSON.
 - Claude Code on an OpenAI-compatible key (OpenRouter and the like): ask for one of the provider's model aliases and the request goes out as Chat Completions, with the answer streamed back as Anthropic events, following CPA's Claude-to-OpenAI translator.
-- Vertex AI service accounts imported under **OAuth Login** (a Google Cloud key file and a region, as in CPA). The Durable Object signs in to Google with the key and refreshes the token hourly. Gemini clients use them as they are, and Claude Code through the Gemini translator below.
+- Vertex AI service accounts imported under **OAuth Login** (a Google Cloud key file and a region, as in CPA). The Durable Object signs in to Google with the key and refreshes the token hourly. Gemini clients use them as they are, and other clients through the translators below.
 - xAI keys take OpenAI Responses and Chat clients as they are, and Claude Code through the Claude-to-Responses translator below (for example `ANTHROPIC_MODEL=grok-4.5`).
 - Claude Code on a ChatGPT login or a Codex API key: ask for a ChatGPT model (for example `ANTHROPIC_MODEL=gpt-5.6-sol`) and the request is translated to OpenAI Responses and the answer streamed back as Anthropic events, with thinking, tool calls and images, following CPA's Claude-to-Codex translator.
 - Claude Code on a Gemini API key: ask for a Gemini model (for example `ANTHROPIC_MODEL=gemini-2.5-flash`) and the request goes out as Gemini `generateContent`, with thinking, tool calls and images, following CPA's Claude-to-Gemini translator. Unlike CPA, Google's default safety filters stay on; a blocked answer ends with a `refusal` stop reason.
 - OpenAI Chat clients (Cursor, Cline, the OpenAI SDKs and the like) on a Claude API key: ask `/v1/chat/completions` for a Claude model and the request goes out as Anthropic Messages, with reasoning effort, tool calls, images, files and prompt caching, and the answer comes back as Chat Completions, following CPA's OpenAI-to-Claude translator. Claude logins aren't offered to these clients, since without CPA's cloaking Anthropic accepts a subscription token from Claude Code only.
 - OpenAI Responses clients on a Claude API key, the same way, following CPA's Responses-to-Claude translator: reasoning, function and custom tool calls, images and files, streamed as Responses events or returned whole.
-- OpenAI Chat and Responses clients on any other provider too (a Gemini key, an OpenAI-compatible key, a Codex key or a ChatGPT login): the request is translated to Anthropic Messages and on to the provider's format, and the answer back the same way.
+- Gemini clients (the Gemini SDKs, Gemini CLI with an API key) on a Claude API key, following CPA's Gemini-to-Claude translator: function calls and results, images and files, thinking settings, streamed with or without `?alt=sse` or returned whole.
+- OpenAI Chat, Responses and Gemini clients on any other provider too (a Gemini key, an OpenAI-compatible key, a Codex key or a ChatGPT login): the request is translated to Anthropic Messages and on to the provider's format, and the answer back the same way.
 - Each client talks in its own format: Anthropic (`/v1/messages`), OpenAI Chat (`/v1/chat/completions`), OpenAI Responses (`/v1/responses`) and Gemini (`/v1beta/models/{model}:generateContent`). A request goes to a provider that takes the same format, apart from the translations above.
 - Model lists as in CPA: `GET /v1/models` (OpenAI's shape, or Anthropic's for Claude Code and the Anthropic SDKs), `GET /v1beta/models` and `GET /v1beta/models/{model}` list every model across the logins and API keys, and so does the dashboard's **Available Models**. A login or key with no model list of its own lists CPA's catalog for its provider, and a ChatGPT login the catalog for its plan. The catalog is refreshed from CPA's model catalog every three hours, with a built-in copy as fallback; it only decides what is listed, never where a request goes.
 - Usage and logs as in CPA: each login and API key shows its success and failure counts and the last 200 minutes in 10-minute buckets, and with **Logging to file** on, the **Logs** page shows a line per API request (the last 2,000). Lines hold the time, status, latency, client IP, path, provider and model, never request bodies or keys. Records are sent to the Durable Object in batches a few seconds apart.
@@ -28,7 +29,7 @@ It covers **Claude, ChatGPT (Codex) and Kimi subscriptions** and **API keys** fo
 
 Claude Code and Codex CLI request bodies are never parsed, so a Worker spends well under 1 ms of its 10 ms CPU budget even on a 600 KB Claude Code request (see the CPU test in `test/app.test.ts`). Requests that need a model rewritten or a body adapted are parsed once. Translated requests cost the most, about 4 to 6 ms for a 600 KB conversation; very long conversations translated can run past the free plan's 10 ms, which the Container install doesn't have.
 
-Not included yet: Gemini clients on other providers, Gemini and other OAuth logins, the Codex CLI's own model list (`/v1/models?client_version=`), and CPA's per-request detail logs. Deliberately left out: CPA's request cloaking and TLS fingerprint spoofing. Clients other than Claude Code may be refused by Anthropic when they use a subscription token.
+Not included yet: Gemini and other OAuth logins, the Codex CLI's own model list (`/v1/models?client_version=`), and CPA's per-request detail logs. Deliberately left out: CPA's request cloaking and TLS fingerprint spoofing. Clients other than Claude Code may be refused by Anthropic when they use a subscription token.
 
 ## Try it
 

free/src/app.ts

@@ -4,6 +4,7 @@ import { claudeToGemini, geminiClaudeMessage, GeminiClaudeStream } from "./claud
 import { chatClaudeMessage, ChatClaudeStream, claudeToChat } from "./claude-openai.ts";
 import { claudeEventStream, claudeMessage, ClaudeStream, claudeToResponses, type EventTranslator, type Json } from "./claude-responses.ts";
 import { chatCompletion, ChatStream, chatToClaude } from "./openai-claude.ts";
+import { geminiResponse, GeminiStream, geminiToClaude } from "./gemini-claude.ts";
 import { kimiUpstreamModel } from "./kimi-oauth.ts";
 import { responsesResponse, ResponsesStream, responsesToClaude } from "./responses-claude.ts";
 import { MANAGEMENT_PREFIX } from "./management.ts";
@@ -241,12 +242,6 @@ async function viaCodexLogin(request: Request, url: URL, config: AppConfig, text
   return collected(upstream);
 }
 
-// Formats a provider takes with translation: Claude, OpenAI Chat and Responses clients reach
-// every provider through Anthropic Messages.
-function servable(format: Format, kind: Candidate["credential"]["kind"]): boolean {
-  return takesNatively(kind, format) || format !== "gemini";
-}
-
 function parsedObject(text: string): Record<string, unknown> | null {
   try {
     const value: unknown = JSON.parse(text);
@@ -320,14 +315,20 @@ async function translatedClaude(request: Request, route: Route, config: AppConfi
   return Response.json(claudeMessage((await final.json()) as Record<string, unknown>, requested, translated.toolNames), { headers: { "cache-control": "no-store" } });
 }
 
-// An OpenAI Chat or Responses request: the body is translated to Anthropic Messages and sent
+// An OpenAI Chat, Responses or Gemini request: the body is translated to Anthropic Messages and sent
 // to a Claude API key, or translated on to the candidate's own format; the answer comes back
 // the same way, streamed or whole.
 async function viaClaudeMessages(request: Request, url: URL, route: Route & { format: Format }, config: AppConfig, candidate: Candidate, text: string): Promise<Response> {
   const client = parsedObject(text);
   if (client === null) return formatError(route.format, 400, "invalid_request_error", "The request body must be a JSON object.");
-  const requested = typeof client.model === "string" ? client.model : candidate.model;
-  const translated = route.format === "openai-response" ? responsesToClaude(client, candidate.model) : { ...chatToClaude(client, candidate.model), customTools: new Set<string>() };
+  const requested = route.geminiModel ?? (typeof client.model === "string" ? client.model : candidate.model);
+  if (route.geminiAction === "countTokens") return Response.json({ totalTokens: Math.ceil(text.length / 4) }, { headers: { "cache-control": "no-store" } });
+  const translated =
+    route.format === "openai-response"
+      ? responsesToClaude(client, candidate.model)
+      : route.format === "gemini"
+      ? { ...geminiToClaude(client, candidate.model, route.geminiAction === "streamGenerateContent"), customTools: new Set<string>() }
+      : { ...chatToClaude(client, candidate.model), customTools: new Set<string>() };
   let upstream: Response | null;
   if (NATIVE_FORMAT[candidate.credential.kind] === "claude") {
     // The client's own headers describe an OpenAI request, so none of them go upstream.
@@ -340,12 +341,24 @@ async function viaClaudeMessages(request: Request, url: URL, route: Route & { fo
   if (upstream === null) return formatError(route.format, 502, "api_error", "The upstream couldn't be reached.");
   if (!upstream.ok) return formatError(route.format, upstream.status, upstream.status === 429 ? "rate_limit_error" : "api_error", await upstreamMessage(upstream));
   if (translated.stream && upstream.body !== null) {
-    const translator: EventTranslator = route.format === "openai-response" ? new ResponsesStream(requested, translated.toolNames, translated.customTools) : new ChatStream(requested, translated.toolNames);
-    return new Response(claudeEventStream(upstream.body, translator), { headers: { "content-type": "text/event-stream; charset=utf-8", "cache-control": "no-cache" } });
+    // Gemini streams SSE only with ?alt=sse, and a JSON array otherwise.
+    const sse = route.format !== "gemini" || url.searchParams.get("alt") === "sse";
+    const translator: EventTranslator =
+      route.format === "openai-response"
+        ? new ResponsesStream(requested, translated.toolNames, translated.customTools)
+        : route.format === "gemini"
+        ? new GeminiStream(requested, translated.toolNames, sse)
+        : new ChatStream(requested, translated.toolNames);
+    return new Response(claudeEventStream(upstream.body, translator), { headers: { "content-type": sse ? "text/event-stream; charset=utf-8" : "application/json; charset=utf-8", "cache-control": "no-cache" } });
   }
   const final = parsedObject(await upstream.text());
   if (final === null) return formatError(route.format, 502, "api_error", "The upstream sent a response that isn't JSON.");
-  const answer = route.format === "openai-response" ? responsesResponse(final, requested, translated.toolNames, translated.customTools) : chatCompletion(final, requested, translated.toolNames);
+  const answer =
+    route.format === "openai-response"
+      ? responsesResponse(final, requested, translated.toolNames, translated.customTools)
+      : route.format === "gemini"
+      ? geminiResponse(final, requested, translated.toolNames)
+      : chatCompletion(final, requested, translated.toolNames);
   return Response.json(answer, { headers: { "cache-control": "no-store" } });
 }
 
@@ -477,7 +490,7 @@ async function proxied(request: Request, url: URL, route: Route & { format: Form
   const claudeLogins = logins.filter((login) => login.provider === "claude");
   const codexLogins = logins.filter((login) => login.provider === "codex");
   // Claude clients with one Claude login and nothing else: stream the body through unread.
-  if (route.format === "claude" && claudeLogins.length === 1 && codexLogins.length === 0 && !table.vertexOAuth && !table.kimiOAuth && !table.credentials.some((credential) => servable("claude", credential.kind))) {
+  if (route.format === "claude" && claudeLogins.length === 1 && codexLogins.length === 0 && !table.vertexOAuth && !table.kimiOAuth && table.credentials.length === 0) {
     const only = loginCandidate(claudeLogins[0] as LoginEntry, "");
     const response = await viaClaudeLogin(request, url, config, undefined, loginName(only) ?? "");
     noteAttempt(trace, config, only, response.status);
@@ -491,7 +504,9 @@ async function proxied(request: Request, url: URL, route: Route & { format: Form
   if (model === null) return formatError(route.format, 400, "invalid_request_error", "The request needs a model.");
   trace.model = model;
   const found = candidates(table, model);
-  const usable = found.filter((candidate) => servable(route.format, candidate.credential.kind));
+  // Every client format reaches every provider: Claude requests are translated to the
+  // provider's format, and the others through Anthropic Messages.
+  const usable = [...found];
   // "prefix/model" picks the logins with that prefix; other names may use any login.
   const { prefix, model: bare } = splitModel(table, model);
   const loginsFor = (provider: LoginEntry["provider"]) => (provider === "claude" ? claudeLogins : codexLogins).filter((login) => prefix === "" || login.prefix === prefix).map((login) => loginCandidate(login, bare));
@@ -500,10 +515,11 @@ async function proxied(request: Request, url: URL, route: Route & { format: Form
   if (route.format === "openai-response" && (inDefaultFamily("codex", bare) || usable.length === 0)) usable.push(...loginsFor("codex"));
   // Claude Code or a Chat client asking for a ChatGPT model by name, e.g. ANTHROPIC_MODEL=gpt-5.6-sol.
   if ((route.format === "claude" || route.format === "openai") && inDefaultFamily("codex", bare)) usable.push(...loginsFor("codex"));
-  // Vertex service accounts take Gemini models, from Gemini clients and translated Claude ones.
-  if ((route.format === "gemini" || route.format === "claude") && table.vertexOAuth === true && inDefaultFamily("vertex", model)) usable.push(servedCandidate("vertex", model));
-  // Kimi logins take Kimi's models in Anthropic and both OpenAI formats, untranslated.
-  if (route.format !== "gemini" && table.kimiOAuth === true && inDefaultFamily("kimi", model)) usable.push(servedCandidate("kimi", kimiUpstreamModel(model)));
+  // Vertex service accounts take Gemini models, from any client, translated where needed.
+  if (table.vertexOAuth === true && inDefaultFamily("vertex", model)) usable.push(servedCandidate("vertex", model));
+  // Kimi logins take Kimi's models in Anthropic and both OpenAI formats untranslated, and
+  // Gemini clients through Anthropic Messages.
+  if (table.kimiOAuth === true && inDefaultFamily("kimi", model)) usable.push(servedCandidate("kimi", kimiUpstreamModel(model)));
   if (usable.length === 0) {
     if (route.format === "claude" && table.claudeOAuth) {
       const response = await viaClaudeLogin(request, url, config, text);
@@ -514,8 +530,6 @@ async function proxied(request: Request, url: URL, route: Route & { format: Form
     const reason =
       route.format !== "claude" && table.claudeOAuth && /^claude-/i.test(model)
         ? `Claude logins serve Claude Code only. To use ${model} from another client, add a Claude API key under AI Providers in the dashboard.`
-        : found.length > 0
-        ? `Model ${model} is served by a ${found[0]?.credential.kind} provider, which doesn't take this request format yet.`
         : `No provider is configured for model ${model}. Add one under AI Providers in the dashboard.`;
     return formatError(route.format, 400, "invalid_request_error", reason);
   }