Gemini Dual-Path — OAuth + Paid API

Two endpoints, one adapter

Gemini-Pippa runs in two modes. OAuth path piggybacks the Gemini CLI's credentials at the Gemini CLI's OAuth session and hits the provider CLI's backend endpoint in a Cloud Code Assist envelope — free but tool-rate-limited ((known tool-call rate-limit issue)). Paid API key path uses a provider API key from environment config and hits the public Gemini API endpoint directly — no rate limits, ~$2/M input.

Runtime toggle

The mode switches at runtime via Admin Dashboard. Same adapter, two code paths. The visible 'auto-fallback' from OAuth → API on rate-limit is a sticky toggle (resets on server restart) so Council rounds keep flowing without silent degradation.

Wire format quirks

• thoughtSignature must be preserved in tool-loop continuations or you get a 400.
• System prompt is systemInstruction (camelCase), not system_instruction.
• Model role is 'model', not 'assistant'.
• Thinking config is thinkingLevel: 'HIGH' for 3.x models, thinkingBudget: N for 2.x.