diff --git a/CHANGELOG.md b/CHANGELOG.md
index 204fc93..c4925d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,28 @@
 
 All notable changes to Token Ghost are documented here. Versions follow [Semantic Versioning](https://semver.org).
 
+## [Unreleased]
+
+### Gemini
+- Show Pro / Flash / Flash Lite daily quotas from Code Assist `retrieveUserQuota` using Gemini CLI Google-login credentials.
+- Prefer macOS Keychain (`gemini-cli-oauth` / `main-account`) over legacy `oauth_creds.json`.
+- Default: refresh OAuth access tokens **in memory only** (no Keychain mutation). Opt in with `TOKEN_GHOST_GEMINI_WRITEBACK=1`.
+- Resolve OAuth client id/secret automatically from the installed `@google/gemini-cli` package (or env / creds fields) — no hard-coded client values.
+- On refresh failure, do not reuse a stale/short access token; surface a re-login hint instead.
+- Surface a clear setup hint when only API key / Vertex auth is configured.
+- Add bun's `~/.bun/bin` to the PATH bootstrap so a bun-installed `gemini` is found under SwiftBar.
+
+### Privacy / hardening
+- Document Keychain vs file credential handling and write-back opt-in accurately; cache file mode `600` when possible.
+- HTTP errors expose status codes only (no upstream bodies in menus / `--collect`).
+
+### Docs
+- Document Gemini data source, Google-login requirement, Keychain, env overrides, unofficial Claude TUI / Code Assist API limits, `v1.0.0` install pin vs Gemini branch, and Open Gemini menu action.
+
+### Cleanup
+- Remove unused severity helpers.
+- Ignore `_workspace/` artifacts.
+
 ## [1.0.0] - 2026-07-10
 
 First stable release.
diff --git a/README.ko.md b/README.ko.md
index e43bdeb..e941790 100644
--- a/README.ko.md
+++ b/README.ko.md
@@ -1,8 +1,8 @@
 # Token Ghost 👻
 
-**Claude Code**와 **Codex**의 사용 한도를 macOS 메뉴바에서 한눈에 보여주는 작은 플러그인입니다.
+**Claude Code**, **Codex**, **Gemini CLI**의 사용 한도를 macOS 메뉴바에서 한눈에 보여주는 작은 플러그인입니다.
 
-Token Ghost는 [SwiftBar](https://swiftbar.app) 위에서 동작합니다. SwiftBar가 메뉴바 앱이고, Token Ghost는 그 안에서 Claude/Codex 사용량을 읽어 표시하는 플러그인입니다.
+Token Ghost는 [SwiftBar](https://swiftbar.app) 위에서 동작합니다. SwiftBar가 메뉴바 앱이고, Token Ghost는 그 안에서 Claude/Codex/Gemini 사용량을 읽어 표시하는 플러그인입니다.
 
 > 🇺🇸 English guide: [README.md](README.md)
 
@@ -24,6 +24,11 @@ Checked 3m ago
 5 Hour:  🟩⬜️⬜️⬜️⬜️⬜️⬜️⬜️  12% (~8:28pm)
 Weekly:  🟩🟩🟩⬜️⬜️⬜️⬜️⬜️  35% (~Jul 17 6am)
 From session log, 40m ago
+
+💜 Gemini
+Pro:   🟩🟩⬜️⬜️⬜️⬜️⬜️⬜️  28% (~3:00am)
+Flash: 🟩⬜️⬜️⬜️⬜️⬜️⬜️⬜️  12% (~3:00am)
+From Code Assist, just now
 ```
 
 프로그레스바는 사용률이 오를수록 초록 → 노랑 → 주황 → 빨강으로 채워집니다. 각 항목은 리셋 시각을 `(~시각)`으로 보여주고, 도구별로 값이 얼마나 최신인지도 표시합니다.
@@ -36,11 +41,11 @@ Token Ghost는 **독립 앱이 아니라** SwiftBar 플러그인입니다:
 
 ```text
 SwiftBar          = 메뉴바에 글자를 띄워주는 macOS 앱
-Token Ghost       = Claude/Codex 사용량을 읽어 메뉴에 표시하는 플러그인
-Claude / Codex CLI = 사용 한도를 실제로 알고 있는 도구
+Token Ghost       = Claude/Codex/Gemini 사용량을 읽어 메뉴에 표시하는 플러그인
+Claude / Codex / Gemini CLI = 사용 한도를 실제로 알고 있는 도구
 ```
 
-즉, 터미널에서 Claude Code와 Codex가 이미 동작하는 상태여야 사용할 수 있습니다.
+즉, 터미널에서 각 CLI가 이미 동작하는 상태여야 사용할 수 있습니다.
 
 ### 숫자는 어디서 오나요
 
@@ -51,6 +56,8 @@ Claude / Codex CLI = 사용 한도를 실제로 알고 있는 도구
 - 메뉴에 데이터 나이(`From session log, 40m ago`)를 표시하고,
 - 리셋 시각이 지난 윈도우는 `0%`와 함께 **다음 리셋 예상 시각**(보고된 리셋 시각에 창 길이를 더해 계산)을 표시합니다. 예: `5 Hour: 0% (~3:18am)`. 다음 Codex 실행이 새 값을 기록하면 실제 값으로 갱신됩니다.
 
+**Gemini** — Gemini CLI를 **Google 계정으로 로그인**했을 때 생기는 OAuth로 Code Assist `retrieveUserQuota`를 호출합니다. 최신 Gemini CLI는 macOS Keychain(`gemini-cli-oauth` / `main-account`)에 두고, 예전 설치는 `~/.gemini/oauth_creds.json`을 쓸 수 있습니다. 결과는 Gemini CLI와 같이 **Pro / Flash / Flash Lite** 일일 버킷으로 합쳐 표시합니다. API 키·Vertex 인증은 로컬에 이 일일 바가 없어, `gemini`에서 `/auth` → **Login with Google**으로 바꿔야 합니다.
+
 ---
 
 ## 준비물
@@ -60,12 +67,14 @@ Claude / Codex CLI = 사용 한도를 실제로 알고 있는 도구
 - [SwiftBar](https://swiftbar.app)
 - Claude Code CLI 로그인 — Claude 사용량 표시에 필요
 - Codex CLI 로그인 — Codex 사용량 표시에 필요
+- Gemini CLI **Google 로그인** — Gemini Pro/Flash 일일 쿼터 표시에 필요
 
 Token Ghost는 대신 로그인해주지 않습니다. 각 CLI가 이미 동작하는지 확인하세요:
 
 ```bash
 codex login status   # Codex
 claude               # Claude Code: TUI가 열리며, 필요하면 /login으로 로그인
+gemini               # Gemini: /auth → Login with Google (Keychain 또는 oauth_creds.json)
 ```
 
 ---
@@ -78,6 +87,8 @@ claude               # Claude Code: TUI가 열리며, 필요하면 /login으로
 curl -fsSL https://raw.githubusercontent.com/zoeymakes/token-ghost/v1.0.0/install.sh | bash
 ```
 
+> **참고:** 핀된 `v1.0.0` 설치는 Claude + Codex만 포함합니다. Gemini 지원은 이 브랜치 / 다음 릴리스에 있습니다. Gemini가 필요하면 로컬 체크아웃에서 `./install.sh`를 쓰거나 Gemini가 포함된 태그를 기다리세요.
+
 설치 스크립트 동작:
 
 ```text
@@ -104,7 +115,7 @@ SwiftBar가 자동으로 열립니다. **Plugin Folder**를 물어보면, 설치
 
 - **Refresh** — 지금 즉시 새로 수집 (Claude 캐시 TTL 무시).
 - **Setup guide** — 이 README 열기.
-- **Open Claude / Open Codex** — 해당 앱 또는 웹사이트 열기.
+- **Open Claude / Open Codex / Open Gemini** — 해당 앱 또는 웹사이트 열기.
 
 ---
 
@@ -116,6 +127,10 @@ SwiftBar가 자동으로 열립니다. **Plugin Folder**를 물어보면, 설치
 | --- | --- | --- |
 | `TOKEN_GHOST_CLAUDE_TTL_MIN` | `15` | Claude `/usage` 캡처 간격(분) |
 | `TOKEN_GHOST_PLUGIN_DIR` | SwiftBar 설정 폴더 | 플러그인 설치 위치 |
+| `TOKEN_GHOST_GEMINI_CLIENT_ID` / `TOKEN_GHOST_GEMINI_CLIENT_SECRET` | *(설치된 Gemini CLI에서 탐색)* | 토큰 갱신에만 쓰는 Gemini OAuth client 선택 오버라이드 |
+| `GEMINI_OAUTH_CLIENT_ID` / `GEMINI_OAUTH_CLIENT_SECRET` | *(동일)* | 위와 같은 Gemini OAuth client 오버라이드 별칭 |
+| `TOKEN_GHOST_GEMINI_WRITEBACK` | off | `1`이면 갱신된 OAuth 토큰을 Gemini CLI Keychain / `oauth_creds.json`에 다시 씀 (기본: 메모리만) |
+| `TOKEN_GHOST_GEMINI_KEYCHAIN_SERVICE` / `TOKEN_GHOST_GEMINI_KEYCHAIN_ACCOUNT` | `gemini-cli-oauth` / `main-account` | 읽기·선택적 write-back에 쓰는 Keychain id |
 
 ---
 
@@ -131,11 +146,13 @@ SwiftBar가 자동으로 열립니다. **Plugin Folder**를 물어보면, 설치
 
 ## 개인정보
 
-Token Ghost는 비밀번호, API Key, Access Token, 계정 인증정보를 **저장하지 않습니다**. 이미 설치된 `claude`, `codex` 도구에서 사용량만 읽어, 사용률과 리셋 시각만 아래에 캐시합니다:
+Token Ghost는 **자체 비밀번호 저장소를 만들지 않습니다**. 하는 일은:
 
-```text
-~/.cache/token-ghost/cache.json
-```
+- 이미 설치된 `claude`, `codex`, `gemini` 도구에서 사용량만 읽고,
+- 사용률·리셋 시각 등 비밀이 아닌 메타데이터만 `~/.cache/token-ghost/cache.json`에 캐시하며(가능하면 권한 `600`),
+- 메뉴나 캐시에 access token·refresh token·API key를 출력하지 않습니다.
+
+Gemini Google 로그인의 경우 access token이 만료되면 `retrieveUserQuota` 호출을 위해 **메모리에서만** 갱신합니다. 기본적으로 Gemini CLI Keychain이나 `oauth_creds.json`에는 다시 쓰지 않습니다(다른 앱 자격증명을 건드리지 않기 위함). 같은 저장소에 write-back이 필요하면 `TOKEN_GHOST_GEMINI_WRITEBACK=1`을 설정하세요.
 
 ---
 
@@ -168,7 +185,10 @@ curl -fsSL https://raw.githubusercontent.com/zoeymakes/token-ghost/main/uninstal
 
 - 독립 `.app`이 아니라 SwiftBar 플러그인입니다.
 - Codex 값은 Codex를 실제로 사용할 때만 갱신됩니다. 대신 데이터 나이를 표시하고, 리셋이 지난 윈도우는 예상 리셋 시각의 추정값으로 표시합니다.
-- Claude 값은 짧은 인터랙티브 캡처로 얻으며, 캡처 사이(15분 TTL)에는 캐시된 값과 나이를 보여줍니다.
+- Claude 값은 짧은 인터랙티브 `/usage` 캡처(Claude Code TUI 비공식 자동화)로 얻습니다. 첫 실행 시 workspace trust 프롬프트를 Enter로 자동 수락할 수 있으며, 캡처 사이(15분 TTL)에는 캐시된 값과 나이를 보여줍니다.
+- Gemini Pro/Flash 바는 Gemini CLI **Google 계정 OAuth**(Keychain 또는 `oauth_creds.json`)가 필요합니다. API 키·Vertex 인증으로는 일일 버킷을 표시할 수 없습니다.
+- Gemini 쿼터는 Google Code Assist `v1internal:retrieveUserQuota`(Gemini CLI가 쓰는 비공식에 가까운 API)로 가져옵니다. 예고 없이 바뀌거나 일부 개인 계정 등급을 거부할 수 있습니다.
+- 일부 개인 Google 계정 등급은 Gemini CLI OAuth로 Code Assist 쿼터를 더 이상 받지 못할 수 있습니다. Google이 거부하면 메뉴에 설정 안내로 표시합니다.
 - SwiftBar 메뉴는 텍스트 기반이라 프로그레스바는 컬러 사각형으로 표시합니다.
 
 ---
diff --git a/README.md b/README.md
index b0d14f6..5a0ce29 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # Token Ghost 👻
 
-A small macOS menu bar plugin that shows your **Claude Code** and **Codex** usage limits at a glance.
+A small macOS menu bar plugin that shows your **Claude Code**, **Codex**, and **Gemini CLI** usage limits at a glance.
 
-Token Ghost runs inside [SwiftBar](https://swiftbar.app). SwiftBar is the menu bar app; Token Ghost is the plugin that reads your Claude/Codex usage and renders it.
+Token Ghost runs inside [SwiftBar](https://swiftbar.app). SwiftBar is the menu bar app; Token Ghost is the plugin that reads your Claude/Codex/Gemini usage and renders it.
 
 > 🇰🇷 한국어 안내는 [README.ko.md](README.ko.md)를 참고하세요.
 
@@ -24,6 +24,11 @@ Checked 3m ago
 5 Hour:  🟩⬜️⬜️⬜️⬜️⬜️⬜️⬜️  12% (~8:28pm)
 Weekly:  🟩🟩🟩⬜️⬜️⬜️⬜️⬜️  35% (~Jul 17 6am)
 From session log, 40m ago
+
+💜 Gemini
+Pro:   🟩🟩⬜️⬜️⬜️⬜️⬜️⬜️  28% (~3:00am)
+Flash: 🟩⬜️⬜️⬜️⬜️⬜️⬜️⬜️  12% (~3:00am)
+From Code Assist, just now
 ```
 
 The bar fills green → yellow → orange → red as usage climbs. Every bucket shows its reset time as `(~time)`, and each tool shows how fresh its numbers are.
@@ -36,11 +41,11 @@ Token Ghost is **not a standalone app**. It is a plugin for SwiftBar:
 
 ```text
 SwiftBar      = the macOS menu bar app that displays text
-Token Ghost   = the plugin that reads Claude/Codex usage and prints the menu
-Claude / Codex CLI = the tools that actually know your usage limits
+Token Ghost   = the plugin that reads Claude/Codex/Gemini usage and prints the menu
+Claude / Codex / Gemini CLI = the tools that actually know your usage limits
 ```
 
-So it only works once Claude Code and Codex already work in your terminal.
+So it only works once those CLIs already work in your terminal.
 
 ### Where the numbers come from
 
@@ -51,6 +56,8 @@ So it only works once Claude Code and Codex already work in your terminal.
 - the menu shows the data age (`From session log, 40m ago`), and
 - once a window's reset time has passed, the bucket shows `0%` with the **projected next reset** (the reported reset rolled forward by the window length), e.g. `5 Hour: 0% (~3:18am)`, until the next Codex run writes fresh numbers.
 
+**Gemini** — read from Google Code Assist `retrieveUserQuota` using Gemini CLI Google-login credentials. On current Gemini CLI builds those live in the macOS Keychain (`gemini-cli-oauth` / `main-account`); older installs may still use `~/.gemini/oauth_creds.json`. Buckets are collapsed into **Pro / Flash / Flash Lite** (same grouping as Gemini CLI's model usage UI). API key and Vertex auth do **not** expose those local daily bars — switch to **Login with Google** via `/auth` inside `gemini`.
+
 ---
 
 ## Requirements
@@ -60,12 +67,14 @@ So it only works once Claude Code and Codex already work in your terminal.
 - [SwiftBar](https://swiftbar.app)
 - Claude Code CLI, logged in — required for Claude usage
 - Codex CLI, logged in — required for Codex usage
+- Gemini CLI, logged in with **Google** — required for Gemini Pro/Flash daily quotas
 
 Token Ghost never logs in for you. Check that each CLI already works:
 
 ```bash
 codex login status   # Codex
 claude               # Claude Code: opens the TUI; log in with /login if asked
+gemini               # Gemini: /auth → Login with Google (Keychain or oauth_creds.json)
 ```
 
 ---
@@ -78,6 +87,8 @@ Paste this into Terminal (no angle brackets):
 curl -fsSL https://raw.githubusercontent.com/zoeymakes/token-ghost/v1.0.0/install.sh | bash
 ```
 
+> **Note:** The pinned `v1.0.0` install is Claude + Codex only. Gemini support is in this branch / the next release — install from a local checkout (`./install.sh`) or wait for a tagged release that includes Gemini.
+
 What the installer does:
 
 ```text
@@ -104,7 +115,7 @@ SwiftBar opens automatically. If it asks for a **Plugin Folder**, the installer
 
 - **Refresh** — force a fresh capture now (bypasses the Claude cache TTL).
 - **Setup guide** — open this README.
-- **Open Claude / Open Codex** — launch the respective app or website.
+- **Open Claude / Open Codex / Open Gemini** — launch the respective app or website.
 
 ---
 
@@ -116,6 +127,10 @@ Environment variables (set them where SwiftBar can see them, or edit the plugin)
 | --- | --- | --- |
 | `TOKEN_GHOST_CLAUDE_TTL_MIN` | `15` | Minutes between Claude `/usage` captures |
 | `TOKEN_GHOST_PLUGIN_DIR` | SwiftBar's configured folder | Where the plugin is installed |
+| `TOKEN_GHOST_GEMINI_CLIENT_ID` / `TOKEN_GHOST_GEMINI_CLIENT_SECRET` | *(from installed Gemini CLI)* | Optional override for Gemini OAuth client used only when refreshing tokens |
+| `GEMINI_OAUTH_CLIENT_ID` / `GEMINI_OAUTH_CLIENT_SECRET` | *(same)* | Alternate names for the same Gemini OAuth client override |
+| `TOKEN_GHOST_GEMINI_WRITEBACK` | off | Set to `1` to write refreshed OAuth tokens back into Gemini CLI Keychain / `oauth_creds.json` (default: in-memory only) |
+| `TOKEN_GHOST_GEMINI_KEYCHAIN_SERVICE` / `TOKEN_GHOST_GEMINI_KEYCHAIN_ACCOUNT` | `gemini-cli-oauth` / `main-account` | Keychain ids used for both read and optional write-back |
 
 ---
 
@@ -131,11 +146,13 @@ Environment variables (set them where SwiftBar can see them, or edit the plugin)
 
 ## Privacy
 
-Token Ghost does **not** store passwords, API keys, access tokens, or account credentials. It reads usage from the already-installed `claude` and `codex` tools and caches only usage percentages and reset times at:
+Token Ghost does **not** invent its own password store. It:
 
-```text
-~/.cache/token-ghost/cache.json
-```
+- reads usage from the already-installed `claude`, `codex`, and `gemini` tooling,
+- caches only usage percentages, reset times, and similar non-secret metadata at `~/.cache/token-ghost/cache.json` (mode `600` when the filesystem allows),
+- never prints access tokens, refresh tokens, or API keys in the menu or cache.
+
+For Gemini Google login Token Ghost may **refresh** an expired OAuth access token in memory to call `retrieveUserQuota`. By default it does **not** write those refreshed tokens back into Gemini CLI's Keychain or `oauth_creds.json` (avoids mutating another app's credentials). Set `TOKEN_GHOST_GEMINI_WRITEBACK=1` if you want write-back to the same store the credentials were loaded from.
 
 ---
 
@@ -168,7 +185,10 @@ To remove the local cache too, from a downloaded copy:
 
 - Token Ghost is a SwiftBar plugin, not a standalone `.app`.
 - Codex numbers move only when Codex actually runs; the menu shows the data age and marks passed reset windows as projected estimates.
-- Claude usage comes from a short interactive capture; between captures (15 min TTL) the menu shows the cached value with its age.
+- Claude usage comes from a short interactive `/usage` capture (unofficial automation of the Claude Code TUI). On first launch that capture may auto-accept Claude's workspace-trust prompt with Enter; between captures (15 min TTL) the menu shows the cached value with its age.
+- Gemini Pro/Flash bars require Gemini CLI **Google account** OAuth (Keychain or `oauth_creds.json`). API key / Vertex auth cannot show those daily buckets.
+- Gemini quota is fetched via Google Code Assist's `v1internal:retrieveUserQuota` endpoint — the same private-ish API Gemini CLI uses. It can change or reject some personal account tiers without notice.
+- Some personal Google account tiers may no longer receive Code Assist quota through Gemini CLI OAuth; Token Ghost surfaces that as a setup error when Google returns it.
 - SwiftBar menus are text, so progress bars are drawn with colored squares.
 
 ---
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..e0cf1a2
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,20 @@
+# Security Policy
+
+## What Token Ghost touches
+
+Token Ghost is a local SwiftBar plugin. It never sends your prompts or project files to a Token Ghost server (there isn't one).
+
+| Surface | Behavior |
+| --- | --- |
+| Claude | Spawns a short local `claude` TUI session to capture `/usage`. May auto-accept the first-run workspace trust dialog with Enter. |
+| Codex | Reads local session logs under `~/.codex/sessions/`. |
+| Gemini | Reads Google OAuth tokens that Gemini CLI already stored (Keychain `gemini-cli-oauth` or `~/.gemini/oauth_creds.json`), may refresh the access token **in memory** to call Google Code Assist `retrieveUserQuota`. By default it does **not** write refreshed tokens back into Gemini CLI stores (`TOKEN_GHOST_GEMINI_WRITEBACK=1` opts in). |
+| Cache | Writes usage percentages / reset times to `~/.cache/token-ghost/cache.json` (mode `600` when possible). |
+
+OAuth client id/secret used for Gemini token refresh are discovered from the installed `@google/gemini-cli` package or optional environment overrides — they are not hard-coded in this repository.
+
+## Reporting a vulnerability
+
+Please open a private GitHub security advisory on the repository you cloned from, or email the maintainer listed on that repository. Include steps to reproduce and whether credentials or tokens can be exposed.
+
+Do not file public issues that include access tokens, refresh tokens, API keys, or keychain dumps.
diff --git a/token_ghost.py b/token_ghost.py
index 1e1dac7..1a06dab 100755
--- a/token_ghost.py
+++ b/token_ghost.py
@@ -9,8 +9,16 @@
   (~/.codex/sessions/**/*.jsonl). These update only when Codex actually runs,
   so the UI shows the data age and marks a bucket as "reset (est.)" once its
   reset time has passed.
-
-No credentials are printed. Cache lives at ~/.cache/token-ghost/cache.json.
+- Gemini CLI: Google Code Assist `retrieveUserQuota` via Gemini CLI Google
+  OAuth (macOS Keychain `gemini-cli-oauth` / `main-account`, or legacy
+  ~/.gemini/oauth_creds.json). Pro / Flash / Flash Lite daily buckets.
+  API-key and Vertex auth do not expose those bars.
+
+No credentials are printed in the menu. Usage cache lives at
+~/.cache/token-ghost/cache.json. By default Gemini token refresh stays
+in-memory (does not mutate Gemini CLI Keychain). Set
+TOKEN_GHOST_GEMINI_WRITEBACK=1 to write refreshed tokens back to the store
+they were loaded from (Keychain or oauth_creds.json).
 """
 from __future__ import annotations
 
@@ -22,15 +30,36 @@
 import shutil
 import signal
 import struct
+import subprocess
 import sys
 import termios
 import time
+import urllib.error
+import urllib.parse
+import urllib.request
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
 from pathlib import Path
 import fcntl
+import mmap
 
 CACHE_PATH = Path.home() / ".cache" / "token-ghost" / "cache.json"
+GEMINI_DIR = Path.home() / ".gemini"
+GEMINI_OAUTH_CREDS = GEMINI_DIR / "oauth_creds.json"
+GEMINI_SETTINGS = GEMINI_DIR / "settings.json"
+GEMINI_KEYCHAIN_SERVICE = "gemini-cli-oauth"
+GEMINI_KEYCHAIN_ACCOUNT = "main-account"
+CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com/v1internal"
+
+# OAuth client id/secret are discovered from the installed Gemini CLI (or env /
+# oauth_creds.json) — never hard-coded. Cached after the first successful lookup.
+_GEMINI_OAUTH_CLIENT_CACHE: tuple[str, str] | None = None
+_OAUTH_CLIENT_ID_RE = re.compile(
+    r"""OAUTH_CLIENT_ID\s*=\s*["']([^"']+\.apps\.googleusercontent\.com)["']"""
+)
+_OAUTH_CLIENT_SECRET_RE = re.compile(
+    r"""OAUTH_CLIENT_SECRET\s*=\s*["']([A-Za-z0-9_-]+)["']"""
+)
 
 # Capturing Claude /usage spawns an interactive session (~15s), too heavy for
 # every 5-minute SwiftBar tick. Cached values are reused until this TTL passes;
@@ -40,6 +69,14 @@
 except ValueError:
     CLAUDE_TTL_SECONDS = 15 * 60
 
+# Gemini quota needs a keychain read plus 1-2 Google API round trips (and maybe
+# a token refresh) — too heavy to redo on every SwiftBar tick. Reuse cached
+# values until this TTL passes; the Refresh menu action bypasses it with --force.
+try:
+    GEMINI_TTL_SECONDS = float(os.environ.get("TOKEN_GHOST_GEMINI_TTL_MIN", "5")) * 60
+except ValueError:
+    GEMINI_TTL_SECONDS = 5 * 60
+
 # SwiftBar launches plugins with a minimal PATH, unlike the user's Terminal.
 # Add the common macOS Node/Homebrew locations so `claude` and `codex` can be found.
 COMMON_BIN_DIRS = [
@@ -51,6 +88,7 @@
     "/sbin",
     str(Path.home() / ".npm-global" / "bin"),
     str(Path.home() / ".local" / "bin"),
+    str(Path.home() / ".bun" / "bin"),
 ]
 # nvm installs live under versioned directories; include them so nvm-managed
 # `claude`/`codex` binaries are found too (newest version first).
@@ -100,6 +138,14 @@ class CodexWeek:
     reset_text: str | None = None
 
 
+@dataclass
+class GeminiBucket:
+    used_percent: int | None = None
+    reset_text: str | None = None
+    reset_expired: bool = False
+    model_id: str | None = None
+
+
 def strip_ansi(text: str) -> str:
     return ANSI_RE.sub("", text).replace("\r", "\n")
 
@@ -406,6 +452,692 @@ def mtime(path: Path) -> float:
     return parsed
 
 
+def _gemini_auth_type() -> str | None:
+    try:
+        settings = json.loads(GEMINI_SETTINGS.read_text())
+    except Exception:
+        return None
+    auth = settings.get("security", {}).get("auth", {}) if isinstance(settings, dict) else {}
+    selected = auth.get("selectedType") if isinstance(auth, dict) else None
+    return str(selected) if selected else None
+
+
+def _gemini_tier_key(model_id: str) -> str | None:
+    mid = model_id.lower()
+    if "flash-lite" in mid or "flash_lite" in mid:
+        return "flash_lite"
+    if "flash" in mid:
+        return "flash"
+    if "pro" in mid:
+        return "pro"
+    return None
+
+
+def _http_json(method: str, url: str, *, headers: dict | None = None, body: dict | bytes | None = None, form: dict | None = None) -> dict:
+    data = None
+    req_headers = dict(headers or {})
+    if form is not None:
+        data = urllib.parse.urlencode(form).encode("utf-8")
+        req_headers.setdefault("Content-Type", "application/x-www-form-urlencoded")
+    elif body is not None:
+        data = json.dumps(body).encode("utf-8") if isinstance(body, dict) else body
+        req_headers.setdefault("Content-Type", "application/json")
+    req = urllib.request.Request(url, data=data, headers=req_headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=20) as resp:
+            raw = resp.read().decode("utf-8", "replace")
+    except urllib.error.HTTPError as exc:
+        # Do not attach upstream bodies — they can leak into menus / --collect output.
+        raise RuntimeError(f"HTTP {exc.code}") from exc
+    if not raw.strip():
+        return {}
+    parsed = json.loads(raw)
+    return parsed if isinstance(parsed, dict) else {}
+
+
+def _gemini_keychain_ids() -> tuple[str, str]:
+    """Resolve Keychain service/account (same for load and save)."""
+    service = os.environ.get("TOKEN_GHOST_GEMINI_KEYCHAIN_SERVICE") or GEMINI_KEYCHAIN_SERVICE
+    account = os.environ.get("TOKEN_GHOST_GEMINI_KEYCHAIN_ACCOUNT") or GEMINI_KEYCHAIN_ACCOUNT
+    return service, account
+
+
+def _gemini_writeback_enabled() -> bool:
+    """Whether Token Ghost may mutate Gemini CLI credential stores after refresh.
+
+    Default off: refreshing tokens for retrieveUserQuota stays in-process only.
+    Opt in with TOKEN_GHOST_GEMINI_WRITEBACK=1 to write back to Keychain/file.
+    """
+    return os.environ.get("TOKEN_GHOST_GEMINI_WRITEBACK", "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+
+
+def _normalize_gemini_oauth_creds(data: dict) -> dict | None:
+    """Normalize legacy file creds and keychain HybridTokenStorage payloads."""
+    if not isinstance(data, dict):
+        return None
+    # Legacy ~/.gemini/oauth_creds.json shape
+    if data.get("access_token") or data.get("refresh_token"):
+        return data
+    # Modern keychain shape: { serverName, token: { accessToken, refreshToken, expiresAt, ... } }
+    token = data.get("token")
+    if isinstance(token, dict) and (token.get("accessToken") or token.get("refreshToken")):
+        out: dict = {
+            "access_token": token.get("accessToken"),
+            "refresh_token": token.get("refreshToken"),
+            "token_type": token.get("tokenType") or "Bearer",
+            "scope": token.get("scope"),
+        }
+        expires_at = token.get("expiresAt")
+        if expires_at is not None:
+            try:
+                # Keychain may store ms or seconds; normalize to ms like google-auth.
+                value = float(expires_at)
+                out["expiry_date"] = int(value if value > 1e12 else value * 1000)
+            except (TypeError, ValueError):
+                pass
+        return out
+    return None
+
+
+def _gemini_creds_to_keychain_payload(creds: dict) -> dict:
+    """Build the HybridTokenStorage JSON Gemini CLI expects in the keychain."""
+    _, account = _gemini_keychain_ids()
+    return {
+        "serverName": account,
+        "token": {
+            "accessToken": creds.get("access_token"),
+            "refreshToken": creds.get("refresh_token") or None,
+            "tokenType": creds.get("token_type") or "Bearer",
+            "scope": creds.get("scope") or None,
+            "expiresAt": creds.get("expiry_date"),
+        },
+        "updatedAt": int(time.time() * 1000),
+    }
+
+
+def _load_gemini_oauth_from_keychain() -> dict | None:
+    """Read Gemini CLI OAuth from macOS Keychain (service gemini-cli-oauth).
+
+    Newer Gemini CLI versions migrate oauth_creds.json into the keychain.
+    """
+    if sys.platform != "darwin":
+        return None
+    service, account = _gemini_keychain_ids()
+    try:
+        result = subprocess.run(
+            [
+                "security",
+                "find-generic-password",
+                "-s",
+                service,
+                "-a",
+                account,
+                "-w",
+            ],
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+    except Exception:
+        return None
+    if result.returncode != 0:
+        return None
+    raw = (result.stdout or "").strip()
+    if not raw:
+        return None
+    try:
+        data = json.loads(raw)
+    except Exception:
+        return None
+    return _normalize_gemini_oauth_creds(data) if isinstance(data, dict) else None
+
+
+def _load_gemini_oauth_from_file() -> dict | None:
+    try:
+        data = json.loads(GEMINI_OAUTH_CREDS.read_text())
+    except Exception:
+        return None
+    return _normalize_gemini_oauth_creds(data) if isinstance(data, dict) else None
+
+
+def _gemini_token_long_enough(value: object) -> bool:
+    return isinstance(value, str) and len(value) >= 20
+
+
+def _gemini_creds_look_valid(creds: dict | None) -> bool:
+    """Reject obviously corrupt tokens (e.g. accidental test writes)."""
+    if not isinstance(creds, dict):
+        return False
+    access = creds.get("access_token")
+    refresh = creds.get("refresh_token")
+    # Real Google access/refresh tokens are long. A short access with a long
+    # refresh is still usable (force-refresh), so either may qualify.
+    if _gemini_token_long_enough(access) or _gemini_token_long_enough(refresh):
+        return True
+    return False
+
+
+def _load_gemini_oauth_creds() -> tuple[dict | None, str | None]:
+    """Load Gemini OAuth creds and report their store.
+
+    Prefer Keychain when it holds real credentials — that is Gemini CLI's
+    current source of truth. If Keychain is missing or corrupt, fall back to
+    legacy oauth_creds.json.
+    """
+    keychain = _load_gemini_oauth_from_keychain()
+    if _gemini_creds_look_valid(keychain):
+        return keychain, "keychain"
+    file_creds = _load_gemini_oauth_from_file()
+    if _gemini_creds_look_valid(file_creds):
+        return file_creds, "file"
+    return None, None
+
+
+def _save_gemini_oauth_to_file(creds: dict) -> None:
+    if not _gemini_creds_look_valid(creds):
+        return
+    try:
+        GEMINI_OAUTH_CREDS.parent.mkdir(parents=True, exist_ok=True)
+        payload = {
+            k: v
+            for k, v in creds.items()
+            if k in {"access_token", "refresh_token", "token_type", "scope", "expiry_date", "id_token"}
+            and v is not None
+        }
+        GEMINI_OAUTH_CREDS.write_text(json.dumps(payload, indent=2))
+        GEMINI_OAUTH_CREDS.chmod(0o600)
+    except Exception:
+        pass
+
+
+def _save_gemini_oauth_to_keychain(creds: dict) -> None:
+    if sys.platform != "darwin" or not _gemini_creds_look_valid(creds):
+        return
+    service, account = _gemini_keychain_ids()
+    payload = json.dumps(_gemini_creds_to_keychain_payload(creds), separators=(",", ":"))
+    try:
+        # -U updates an existing item; if missing, add a new one.
+        # NOTE: `security -w <payload>` puts the token in argv, so it's visible
+        # to other local users via `ps` for the life of this subprocess. This
+        # is a limitation of the `security` CLI (no stdin form for the value),
+        # not something we can avoid while writeback is opted into.
+        result = subprocess.run(
+            [
+                "security",
+                "add-generic-password",
+                "-U",
+                "-s",
+                service,
+                "-a",
+                account,
+                "-w",
+                payload,
+            ],
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+        if result.returncode == 0:
+            return
+        subprocess.run(
+            [
+                "security",
+                "delete-generic-password",
+                "-s",
+                service,
+                "-a",
+                account,
+            ],
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+        subprocess.run(
+            [
+                "security",
+                "add-generic-password",
+                "-s",
+                service,
+                "-a",
+                account,
+                "-w",
+                payload,
+            ],
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+    except Exception:
+        pass
+
+
+def _persist_gemini_oauth_creds(creds: dict, source: str | None) -> None:
+    """Optionally write refreshed tokens back to the store they were loaded from.
+
+    Default: no write-back (Token Ghost must not mutate Gemini CLI Keychain
+    unless the user opts in). TOKEN_GHOST_GEMINI_WRITEBACK=1 enables writing
+    to Keychain or oauth_creds.json matching `source`.
+    """
+    if not _gemini_writeback_enabled():
+        return
+    if source == "keychain":
+        _save_gemini_oauth_to_keychain(creds)
+    elif source == "file":
+        _save_gemini_oauth_to_file(creds)
+
+
+def _gemini_package_roots() -> list[Path]:
+    """Resolve installed @google/gemini-cli package directories from the `gemini` binary."""
+    roots: list[Path] = []
+    seen: set[str] = set()
+
+    def add(path: Path | None) -> None:
+        if path is None:
+            return
+        try:
+            resolved = path.resolve()
+        except OSError:
+            resolved = path
+        key = str(resolved)
+        if key in seen or not resolved.is_dir():
+            return
+        seen.add(key)
+        roots.append(resolved)
+
+    binary = shutil.which("gemini")
+    if binary:
+        bin_path = Path(binary)
+        try:
+            real = bin_path.resolve()
+        except OSError:
+            real = bin_path
+        # e.g. .../@google/gemini-cli/bundle/gemini.js → package root
+        for parent in [real.parent, *real.parents]:
+            pkg = parent / "package.json"
+            if pkg.is_file():
+                try:
+                    name = json.loads(pkg.read_text()).get("name")
+                except Exception:
+                    name = None
+                if name == "@google/gemini-cli":
+                    add(parent)
+                    break
+            if parent.name == "@google" and (parent / "gemini-cli").is_dir():
+                add(parent / "gemini-cli")
+                break
+
+    home = Path.home()
+    for candidate in [
+        home / ".bun" / "install" / "global" / "node_modules" / "@google" / "gemini-cli",
+        home / ".npm-global" / "lib" / "node_modules" / "@google" / "gemini-cli",
+        Path("/opt/homebrew/lib/node_modules/@google/gemini-cli"),
+        Path("/usr/local/lib/node_modules/@google/gemini-cli"),
+        Path("/opt/homebrew/opt/gemini-cli/libexec/lib/node_modules/@google/gemini-cli"),
+        Path("/usr/local/opt/gemini-cli/libexec/lib/node_modules/@google/gemini-cli"),
+    ]:
+        add(candidate)
+
+    # npm global prefix (best-effort)
+    for cmd in (["npm", "root", "-g"],):
+        try:
+            out = subprocess.run(cmd, capture_output=True, text=True, timeout=3, check=False)
+        except Exception:
+            continue
+        line = (out.stdout or "").strip().splitlines()
+        if not line:
+            continue
+        add(Path(line[0]) / "@google" / "gemini-cli")
+
+    return roots
+
+
+def _extract_oauth_client_from_bytes(data: bytes | str | memoryview) -> tuple[str, str] | None:
+    if isinstance(data, str):
+        text = data
+    else:
+        text = bytes(data).decode("utf-8", "ignore")
+    id_match = _OAUTH_CLIENT_ID_RE.search(text)
+    secret_match = _OAUTH_CLIENT_SECRET_RE.search(text)
+    if id_match and secret_match:
+        return id_match.group(1), secret_match.group(1)
+    return None
+
+
+def _extract_oauth_client_from_file(path: Path) -> tuple[str, str] | None:
+    try:
+        size = path.stat().st_size
+    except OSError:
+        return None
+    if size <= 0 or size > 64 * 1024 * 1024:
+        return None
+    try:
+        # Small sources (oauth2.js): read whole file. Large bundle chunks: mmap.
+        if size < 2 * 1024 * 1024:
+            return _extract_oauth_client_from_bytes(path.read_bytes())
+        with path.open("rb") as fh:
+            with mmap.mmap(fh.fileno(), 0, access=mmap.ACCESS_READ) as mm:
+                return _extract_oauth_client_from_bytes(mm)
+    except Exception:
+        return None
+
+
+def _scan_gemini_cli_for_oauth_client() -> tuple[str, str] | None:
+    """Pull OAUTH_CLIENT_ID/SECRET from the installed Gemini CLI package sources."""
+    preferred_names = ("oauth2.js", "oauth2.ts", "oauth2.mjs", "oauth2.cjs")
+    for root in _gemini_package_roots():
+        # Prefer dedicated oauth modules before scanning large bundle chunks.
+        hits: list[Path] = []
+        for name in preferred_names:
+            hits.extend(root.rglob(name))
+        for path in hits:
+            found = _extract_oauth_client_from_file(path)
+            if found:
+                return found
+
+        bundle = root / "bundle"
+        search_dirs = [bundle] if bundle.is_dir() else [root]
+        for search_dir in search_dirs:
+            for path in sorted(search_dir.rglob("*")):
+                if not path.is_file():
+                    continue
+                if path.suffix not in {".js", ".mjs", ".cjs", ".ts"}:
+                    continue
+                if path.name.endswith(".map"):
+                    continue
+                found = _extract_oauth_client_from_file(path)
+                if found:
+                    return found
+    return None
+
+
+def _gemini_oauth_client(creds: dict | None = None) -> tuple[str, str] | None:
+    """Resolve Gemini CLI OAuth client id/secret without hard-coding.
+
+    Order:
+    1. TOKEN_GHOST_GEMINI_CLIENT_* / GEMINI_OAUTH_CLIENT_* env overrides
+    2. client_id / client_secret fields inside oauth_creds.json (if present)
+    3. Regex extract from the installed @google/gemini-cli package
+    """
+    global _GEMINI_OAUTH_CLIENT_CACHE
+    if _GEMINI_OAUTH_CLIENT_CACHE:
+        return _GEMINI_OAUTH_CLIENT_CACHE
+
+    env_id = os.environ.get("TOKEN_GHOST_GEMINI_CLIENT_ID") or os.environ.get("GEMINI_OAUTH_CLIENT_ID")
+    env_secret = os.environ.get("TOKEN_GHOST_GEMINI_CLIENT_SECRET") or os.environ.get(
+        "GEMINI_OAUTH_CLIENT_SECRET"
+    )
+    if env_id and env_secret:
+        _GEMINI_OAUTH_CLIENT_CACHE = (env_id, env_secret)
+        return _GEMINI_OAUTH_CLIENT_CACHE
+
+    if creds:
+        cred_id = creds.get("client_id") or creds.get("clientId")
+        cred_secret = creds.get("client_secret") or creds.get("clientSecret")
+        if cred_id and cred_secret:
+            _GEMINI_OAUTH_CLIENT_CACHE = (str(cred_id), str(cred_secret))
+            return _GEMINI_OAUTH_CLIENT_CACHE
+
+    found = _scan_gemini_cli_for_oauth_client()
+    if found:
+        _GEMINI_OAUTH_CLIENT_CACHE = found
+        return _GEMINI_OAUTH_CLIENT_CACHE
+    return None
+
+
+def _gemini_access_token(creds: dict, source: str | None = None) -> str | None:
+    token = creds.get("access_token")
+    expiry_ms = creds.get("expiry_date")
+    refresh_token = creds.get("refresh_token")
+    # Refresh ~2 minutes before expiry (expiry_date is epoch milliseconds),
+    # or immediately when the access token looks corrupt/truncated.
+    needs_refresh = False
+    if not _gemini_token_long_enough(token):
+        needs_refresh = True
+    elif expiry_ms is not None:
+        try:
+            needs_refresh = float(expiry_ms) <= (time.time() * 1000) + 120_000
+        except (TypeError, ValueError):
+            needs_refresh = True
+
+    if token and _gemini_token_long_enough(token) and not needs_refresh:
+        return str(token)
+    if not _gemini_token_long_enough(refresh_token):
+        return None
+
+    client = _gemini_oauth_client(creds)
+    if not client:
+        return None
+    client_id, client_secret = client
+
+    try:
+        refreshed = _http_json(
+            "POST",
+            "https://oauth2.googleapis.com/token",
+            form={
+                "client_id": client_id,
+                "client_secret": client_secret,
+                "refresh_token": str(refresh_token),
+                "grant_type": "refresh_token",
+            },
+        )
+    except Exception:
+        # Never return a stale/short access token after a failed refresh.
+        return None
+
+    access = refreshed.get("access_token")
+    if not _gemini_token_long_enough(access):
+        return None
+    creds["access_token"] = access
+    if refreshed.get("refresh_token"):
+        creds["refresh_token"] = refreshed["refresh_token"]
+    if refreshed.get("id_token"):
+        creds["id_token"] = refreshed["id_token"]
+    expires_in = refreshed.get("expires_in")
+    if expires_in is not None:
+        try:
+            creds["expiry_date"] = int(time.time() * 1000) + int(expires_in) * 1000
+        except (TypeError, ValueError):
+            pass
+    _persist_gemini_oauth_creds(creds, source)
+    return str(access)
+
+
+def _code_assist_post(access_token: str, method: str, body: dict) -> dict:
+    return _http_json(
+        "POST",
+        f"{CODE_ASSIST_ENDPOINT}:{method}",
+        headers={"Authorization": f"Bearer {access_token}", "User-Agent": "token-ghost"},
+        body=body,
+    )
+
+
+def _gemini_project_id(access_token: str) -> str | None:
+    try:
+        data = _code_assist_post(
+            access_token,
+            "loadCodeAssist",
+            {
+                "metadata": {
+                    "ideType": "IDE_UNSPECIFIED",
+                    "platform": "PLATFORM_UNSPECIFIED",
+                    "pluginType": "GEMINI",
+                }
+            },
+        )
+    except Exception:
+        return None
+    project = data.get("cloudaicompanionProject") or data.get("cloudaicompanionProjectId")
+    return str(project) if project else None
+
+
+def parse_gemini_quota_buckets(buckets: list | None) -> dict:
+    """Collapse model buckets into Pro / Flash / Flash Lite like Gemini CLI."""
+    empty = {
+        "pro": asdict(GeminiBucket()),
+        "flash": asdict(GeminiBucket()),
+        "flash_lite": asdict(GeminiBucket()),
+    }
+    if not isinstance(buckets, list):
+        return empty
+
+    best: dict[str, dict] = {}
+    for bucket in buckets:
+        if not isinstance(bucket, dict):
+            continue
+        model_id = bucket.get("modelId") or bucket.get("model_id")
+        remaining = bucket.get("remainingFraction")
+        if remaining is None:
+            remaining = bucket.get("remaining_fraction")
+        if not model_id or remaining is None:
+            continue
+        tier = _gemini_tier_key(str(model_id))
+        if not tier:
+            continue
+        try:
+            remaining_f = float(remaining)
+        except (TypeError, ValueError):
+            continue
+        prev = best.get(tier)
+        if prev is None or remaining_f < prev["remaining"]:
+            best[tier] = {
+                "remaining": remaining_f,
+                "reset": bucket.get("resetTime") or bucket.get("reset_time"),
+                "model_id": str(model_id),
+            }
+
+    result = empty
+    for tier, info in best.items():
+        used = int(round(max(0.0, min(1.0, 1.0 - info["remaining"])) * 100))
+        reset_epoch = _parse_iso_timestamp(info["reset"] if isinstance(info["reset"], str) else None)
+        if reset_epoch is None and isinstance(info["reset"], (int, float)):
+            try:
+                reset_epoch = float(info["reset"])
+                if reset_epoch > 1e12:
+                    reset_epoch /= 1000.0
+            except Exception:
+                reset_epoch = None
+        expired = _epoch_is_past(reset_epoch)
+        # Daily windows: once past, roll forward by 24h for a projected next reset.
+        projected = _project_reset_epoch(reset_epoch, 24 * 60) if reset_epoch is not None else None
+        result[tier] = asdict(
+            GeminiBucket(
+                used_percent=0 if expired else used,
+                reset_text=_format_reset_epoch(projected, weekly=False),
+                reset_expired=expired,
+                model_id=info["model_id"],
+            )
+        )
+    return result
+
+
+def collect_gemini() -> dict:
+    """Read Gemini daily quotas from Code Assist (Gemini CLI Google login).
+
+    Needs Google OAuth credentials from macOS Keychain (`gemini-cli-oauth`) or
+    legacy ~/.gemini/oauth_creds.json. API-key / Vertex auth do not populate
+    Pro/Flash daily buckets — the menu shows a setup hint instead.
+    """
+    cli_missing = shutil.which("gemini") is None
+    auth_type = _gemini_auth_type()
+    empty = parse_gemini_quota_buckets(None)
+    empty["cli_missing"] = cli_missing
+    empty["auth_type"] = auth_type
+
+    creds, cred_source = _load_gemini_oauth_creds()
+    if not creds:
+        if auth_type == "gemini-api-key":
+            empty["error"] = (
+                "Currently signed in with API key — Pro/Flash daily bars need "
+                "Google login (/auth → Login with Google)"
+            )
+        elif auth_type == "vertex-ai":
+            empty["error"] = (
+                "Currently signed in with Vertex AI — Pro/Flash daily bars need "
+                "Google login (/auth → Login with Google)"
+            )
+        elif cli_missing:
+            empty["error"] = "gemini CLI not found"
+        else:
+            empty["error"] = "Gemini Google login required (run gemini, then /auth → Login with Google)"
+        return empty
+
+    access_token = _gemini_access_token(creds, source=cred_source)
+    if not access_token:
+        empty["error"] = "Gemini OAuth token missing or expired — re-login with /auth"
+        return empty
+
+    project_id = _gemini_project_id(access_token)
+    body: dict = {}
+    if project_id:
+        body["project"] = project_id
+
+    try:
+        quota = _code_assist_post(access_token, "retrieveUserQuota", body)
+    except Exception as exc:
+        msg = str(exc)
+        if "UNSUPPORTED_CLIENT" in msg or "IneligibleTier" in msg:
+            empty["error"] = (
+                "Gemini CLI Google login no longer serves quota for this account tier — "
+                "use a supported Workspace/Enterprise login or check Gemini CLI docs"
+            )
+        else:
+            # Prefer status code only — avoid dumping upstream error bodies into the menu.
+            code_match = re.search(r"HTTP\s+(\d{3})", msg)
+            code = code_match.group(1) if code_match else "error"
+            empty["error"] = f"Gemini quota request failed (HTTP {code})"
+        return empty
+
+    buckets = quota.get("buckets") if isinstance(quota, dict) else None
+    parsed = parse_gemini_quota_buckets(buckets if isinstance(buckets, list) else None)
+    parsed["cli_missing"] = cli_missing
+    parsed["auth_type"] = auth_type
+    parsed["cred_source"] = cred_source
+    parsed["project_id"] = project_id
+    parsed["source"] = "Code Assist retrieveUserQuota"
+    parsed["source_epoch"] = time.time()
+    if parsed["pro"]["used_percent"] is None and parsed["flash"]["used_percent"] is None:
+        parsed["error"] = "Gemini quota buckets empty — open gemini once after Google login"
+        return parsed
+    return parsed
+
+
+def _gemini_has_data(gemini: dict) -> bool:
+    return (
+        gemini.get("pro", {}).get("used_percent") is not None
+        or gemini.get("flash", {}).get("used_percent") is not None
+        or gemini.get("flash_lite", {}).get("used_percent") is not None
+    )
+
+
+def collect_gemini_cached(cache: dict, force: bool = False) -> dict:
+    """Return Gemini quota, hitting Code Assist only when the cached value is
+    missing or older than GEMINI_TTL_SECONDS (or on --force)."""
+    now = time.time()
+    cached = cache.get("gemini") or {}
+    cached_age = now - float(cached.get("collected_at") or 0)
+    if not force and _gemini_has_data(cached) and cached_age < GEMINI_TTL_SECONDS:
+        return cached
+
+    gemini = collect_gemini()
+    gemini["collected_at"] = now
+    if _gemini_has_data(gemini):
+        return gemini
+    if _gemini_has_data(cached):
+        # Keep the last good value (and its collected_at, so the next tick
+        # retries) instead of blanking the menu on one failed refresh.
+        return cached | {"error": gemini.get("error") or "Gemini quota refresh failed"}
+    return gemini
+
+
 def load_cache() -> dict:
     try:
         return json.loads(CACHE_PATH.read_text())
@@ -418,6 +1150,10 @@ def save_cache(data: dict) -> None:
     tmp = CACHE_PATH.with_suffix(".tmp")
     tmp.write_text(json.dumps(data, indent=2, ensure_ascii=False))
     tmp.replace(CACHE_PATH)
+    try:
+        CACHE_PATH.chmod(0o600)
+    except Exception:
+        pass
 
 
 def _claude_has_data(claude: dict) -> bool:
@@ -453,31 +1189,12 @@ def collect_all(force: bool = False) -> dict:
         "updated_at": time.strftime("%Y-%m-%d %H:%M:%S"),
         "claude": collect_claude_cached(cache, force=force),
         "codex": collect_codex(),
+        "gemini": collect_gemini_cached(cache, force=force),
     }
     save_cache(result)
     return result
 
 
-def severity_claude(used: int | None) -> str:
-    if used is None:
-        return "gray"
-    if used >= 90:
-        return "red"
-    if used >= 70:
-        return "orange"
-    return "green"
-
-
-def severity_codex_left(left: int | None) -> str:
-    if left is None:
-        return "gray"
-    if left <= 19:
-        return "red"
-    if left <= 49:
-        return "orange"
-    return "green"
-
-
 def pct(v: int | None, suffix: str = "%") -> str:
     return "?" if v is None else f"{v}{suffix}"
 
@@ -584,6 +1301,15 @@ def data_age_line(text: str) -> str:
     return text + style(color="#666666", size=11, active=False)
 
 
+def gemini_usage_line(label: str, bucket: dict) -> str:
+    used = bucket.get("used_percent")
+    if used is None:
+        return f"{label}: Not connected" + style(size=12)
+    if bucket.get("reset_expired"):
+        return usage_line(label, 0, reset_suffix(bucket.get("reset_text")))
+    return usage_line(label, used, reset_suffix(bucket.get("reset_text")))
+
+
 def setup_hint(tool: str, error: str | None) -> list[str]:
     """User-facing setup/help rows for missing or unreadable CLI state."""
     if not error:
@@ -597,6 +1323,15 @@ def setup_hint(tool: str, error: str | None) -> list[str]:
             "Run Claude setup in Terminal | bash='/bin/sh' param1='-lc' param2='command -v claude >/dev/null || npm install -g @anthropic-ai/claude-code; echo \"If Claude Code asks, log in with /login, then quit.\"; claude' terminal=true",
             "Copy install command | bash='/bin/sh' param1='-lc' param2='printf %s \"npm install -g @anthropic-ai/claude-code\" | pbcopy' terminal=false",
         ]
+    if tool == "gemini":
+        return [
+            "Gemini setup needed" + style(color="orange", size=12),
+            "Pro/Flash bars need Google account OAuth (not API key)" + style(size=12),
+            "1. Run: gemini" + style(size=12),
+            "2. /auth → Login with Google" + style(size=12),
+            "3. Quit, then Refresh this menu" + style(size=12),
+            "Switch Gemini to Google login | bash='/bin/sh' param1='-lc' param2='echo \"In Gemini: type /auth → choose Login with Google, then quit.\"; gemini' terminal=true",
+        ]
     return [
         "Codex setup needed" + style(color="orange", size=12),
         "To show Codex usage:" + style(size=12),
@@ -614,6 +1349,10 @@ def render_swiftbar(data: dict) -> str:
     codex = data.get("codex", {})
     five = codex.get("five_hour", {})
     codex_week = codex.get("week_all", {})
+    gemini = data.get("gemini", {})
+    gemini_pro = gemini.get("pro", {})
+    gemini_flash = gemini.get("flash", {})
+    gemini_flash_lite = gemini.get("flash_lite", {})
 
     current = session.get("used_percent")
     title = top_title(current)
@@ -645,6 +1384,26 @@ def render_swiftbar(data: dict) -> str:
             lines.append("Codex CLI not found — showing last session log" + style(color="orange", size=11, active=False))
         lines.extend(setup_hint("codex", codex.get("error")))
 
+    lines.append("💜 Gemini" + style(color="#111111", size=12))
+    has_gemini = (
+        gemini_pro.get("used_percent") is not None
+        or gemini_flash.get("used_percent") is not None
+        or gemini_flash_lite.get("used_percent") is not None
+    )
+    if gemini.get("error") and not has_gemini:
+        lines.extend(setup_hint("gemini", gemini.get("error")))
+    else:
+        lines.append(gemini_usage_line("Pro", gemini_pro))
+        lines.append(gemini_usage_line("Flash", gemini_flash))
+        if gemini_flash_lite.get("used_percent") is not None:
+            lines.append(gemini_usage_line("Flash Lite", gemini_flash_lite))
+        gemini_age = age_text(gemini.get("source_epoch"))
+        if gemini_age:
+            lines.append(data_age_line(f"From Code Assist, {gemini_age}"))
+        if gemini.get("cli_missing"):
+            lines.append("gemini CLI not found — showing OAuth quota" + style(color="orange", size=11, active=False))
+        lines.extend(setup_hint("gemini", gemini.get("error")))
+
     script_path = str(Path.home() / ".token-ghost" / "token_ghost.py")
     lines += [
         "---",
@@ -653,6 +1412,7 @@ def render_swiftbar(data: dict) -> str:
         "Setup guide | bash='/bin/sh' param1='-c' param2='open \"$HOME/.token-ghost/README.md\" 2>/dev/null || open https://github.com/zoeymakes/token-ghost#install' terminal=false",
         "Open Claude | bash='/bin/sh' param1='-c' param2='open -a Claude 2>/dev/null || open https://claude.ai' terminal=false",
         "Open Codex | bash='/bin/sh' param1='-c' param2='open -a Codex 2>/dev/null || open -a ChatGPT 2>/dev/null || open https://chatgpt.com/codex' terminal=false",
+        "Open Gemini | bash='/bin/sh' param1='-c' param2='open https://gemini.google.com' terminal=false",
     ]
     return "\n".join(lines)