refactor(auth): 🔨 consolidate OAuth credential management into base classes

This commit refactors the OAuth credential setup and export functionality by moving all credential management logic from the credential_tool into the provider auth base classes. This follows the established pattern where auth classes own their credential lifecycle.

Key changes:
- Moved setup_credential(), build_env_lines(), export_credential_to_env(), list_credentials(), and delete_credential() methods from credential_tool.py into google_oauth_base.py, qwen_auth_base.py, and iflow_auth_base.py
- Introduced CredentialSetupResult dataclass for standardized return values from setup operations
- Added _post_auth_discovery() hook in google_oauth_base.py, with implementations in gemini_auth_base.py and antigravity_auth_base.py to perform tier/project discovery immediately after OAuth authentication
- Moved _discover_project_id() and _persist_project_metadata() from provider classes into their respective auth base classes (gemini_auth_base.py and antigravity_auth_base.py)
- Simplified credential_tool.py export functions to delegate to auth class methods instead of implementing logic inline
- Removed duplicate helper functions (_build_env_export_content, _get_credential_number_from_filename, etc.) that are now handled by auth classes
- Removed unused imports (re, time from credential_tool.py; asyncio from provider files)

This consolidation:
- Improves code organization by keeping credential management logic with authentication logic
- Eliminates code duplication across export functions
- Makes it easier for future OAuth providers to implement credential management by inheriting base functionality
- Ensures tier/project discovery happens during authentication rather than on first API request, improving user experience

BREAKING CHANGE: The internal API for credential management has changed. External code that directly imported helper functions like _build_env_export_content() from credential_tool.py will need to use the new auth class methods instead (e.g., auth_instance.build_env_lines()).

src/rotator_library/credential_tool.py

@@ -3,12 +3,11 @@
 import asyncio
 import json
 import os
-import re
 import time
 from pathlib import Path
 from dotenv import set_key, get_key
 
-# NOTE: Heavy imports (provider_factory, PROVIDER_PLUGINS) are deferred 
+# NOTE: Heavy imports (provider_factory, PROVIDER_PLUGINS) are deferred
 # to avoid 6-7 second delay before showing loading screen
 from rich.console import Console
 from rich.panel import Panel
@@ -26,12 +25,14 @@ console = Console()
 _provider_factory = None
 _provider_plugins = None
 
+
 def _ensure_providers_loaded():
     """Lazy load provider modules only when needed"""
     global _provider_factory, _provider_plugins
     if _provider_factory is None:
         from . import provider_factory as pf
         from .providers import PROVIDER_PLUGINS as pp
+
         _provider_factory = pf
         _provider_plugins = pp
     return _provider_factory, _provider_plugins
@@ -39,100 +40,35 @@ def _ensure_providers_loaded():
 
 def clear_screen():
     """
-    Cross-platform terminal clear that works robustly on both 
+    Cross-platform terminal clear that works robustly on both
     classic Windows conhost and modern terminals (Windows Terminal, Linux, Mac).
-    
+
     Uses native OS commands instead of ANSI escape sequences:
     - Windows (conhost & Windows Terminal): cls
     - Unix-like systems (Linux, Mac): clear
     """
-    os.system('cls' if os.name == 'nt' else 'clear')
+    os.system("cls" if os.name == "nt" else "clear")
 
 
-def _get_credential_number_from_filename(filename: str) -> int:
-    """
-    Extract credential number from filename like 'provider_oauth_1.json' -> 1
-    """
-    match = re.search(r'_oauth_(\d+)\.json$', filename)
-    if match:
-        return int(match.group(1))
-    return 1
-
-
-def _build_env_export_content(
-    provider_prefix: str,
-    cred_number: int,
-    creds: dict,
-    email: str,
-    extra_fields: dict = None,
-    include_client_creds: bool = True
-) -> tuple[list[str], str]:
-    """
-    Build .env content for OAuth credential export with numbered format.
-    Exports all fields from the JSON file as a 1-to-1 mirror.
-    
-    Args:
-        provider_prefix: Environment variable prefix (e.g., "ANTIGRAVITY", "GEMINI_CLI")
-        cred_number: Credential number for this export (1, 2, 3, etc.)
-        creds: The credential dictionary loaded from JSON
-        email: User email for comments
-        extra_fields: Optional dict of additional fields to include
-        include_client_creds: Whether to include client_id/secret (Google OAuth providers)
-    
-    Returns:
-        Tuple of (env_lines list, numbered_prefix string for display)
-    """
-    # Use numbered format: PROVIDER_N_ACCESS_TOKEN
-    numbered_prefix = f"{provider_prefix}_{cred_number}"
-    
-    env_lines = [
-        f"# {provider_prefix} Credential #{cred_number} for: {email}",
-        f"# Exported from: {provider_prefix.lower()}_oauth_{cred_number}.json",
-        f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
-        f"# ",
-        f"# To combine multiple credentials into one .env file, copy these lines",
-        f"# and ensure each credential has a unique number (1, 2, 3, etc.)",
-        "",
-        f"{numbered_prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
-        f"{numbered_prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
-        f"{numbered_prefix}_SCOPE={creds.get('scope', '')}",
-        f"{numbered_prefix}_TOKEN_TYPE={creds.get('token_type', 'Bearer')}",
-        f"{numbered_prefix}_ID_TOKEN={creds.get('id_token', '')}",
-        f"{numbered_prefix}_EXPIRY_DATE={creds.get('expiry_date', 0)}",
-    ]
-    
-    if include_client_creds:
-        env_lines.extend([
-            f"{numbered_prefix}_CLIENT_ID={creds.get('client_id', '')}",
-            f"{numbered_prefix}_CLIENT_SECRET={creds.get('client_secret', '')}",
-            f"{numbered_prefix}_TOKEN_URI={creds.get('token_uri', 'https://oauth2.googleapis.com/token')}",
-            f"{numbered_prefix}_UNIVERSE_DOMAIN={creds.get('universe_domain', 'googleapis.com')}",
-        ])
-    
-    env_lines.append(f"{numbered_prefix}_EMAIL={email}")
-    
-    # Add extra provider-specific fields
-    if extra_fields:
-        for key, value in extra_fields.items():
-            if value:  # Only add non-empty values
-                env_lines.append(f"{numbered_prefix}_{key}={value}")
-    
-    return env_lines, numbered_prefix
-
 def ensure_env_defaults():
     """
     Ensures the .env file exists and contains essential default values like PROXY_API_KEY.
     """
     if not ENV_FILE.is_file():
         ENV_FILE.touch()
-        console.print(f"Creating a new [bold yellow]{ENV_FILE.name}[/bold yellow] file...")
+        console.print(
+            f"Creating a new [bold yellow]{ENV_FILE.name}[/bold yellow] file..."
+        )
 
     # Check for PROXY_API_KEY, similar to setup_env.bat
     if get_key(str(ENV_FILE), "PROXY_API_KEY") is None:
         default_key = "VerysecretKey"
-        console.print(f"Adding default [bold cyan]PROXY_API_KEY[/bold cyan] to [bold yellow]{ENV_FILE.name}[/bold yellow]...")
+        console.print(
+            f"Adding default [bold cyan]PROXY_API_KEY[/bold cyan] to [bold yellow]{ENV_FILE.name}[/bold yellow]..."
+        )
         set_key(str(ENV_FILE), "PROXY_API_KEY", default_key)
 
+
 async def setup_api_key():
     """
     Interactively sets up a new API key for a provider.
@@ -144,41 +80,74 @@ async def setup_api_key():
 
     # Verified list of LiteLLM providers with their friendly names and API key variables
     LITELLM_PROVIDERS = {
-        "OpenAI": "OPENAI_API_KEY", "Anthropic": "ANTHROPIC_API_KEY",
-        "Google AI Studio (Gemini)": "GEMINI_API_KEY", "Azure OpenAI": "AZURE_API_KEY",
-        "Vertex AI": "GOOGLE_API_KEY", "AWS Bedrock": "AWS_ACCESS_KEY_ID",
-        "Cohere": "COHERE_API_KEY", "Chutes": "CHUTES_API_KEY",
+        "OpenAI": "OPENAI_API_KEY",
+        "Anthropic": "ANTHROPIC_API_KEY",
+        "Google AI Studio (Gemini)": "GEMINI_API_KEY",
+        "Azure OpenAI": "AZURE_API_KEY",
+        "Vertex AI": "GOOGLE_API_KEY",
+        "AWS Bedrock": "AWS_ACCESS_KEY_ID",
+        "Cohere": "COHERE_API_KEY",
+        "Chutes": "CHUTES_API_KEY",
         "Mistral AI": "MISTRAL_API_KEY",
-        "Codestral (Mistral)": "CODESTRAL_API_KEY", "Groq": "GROQ_API_KEY",
-        "Perplexity": "PERPLEXITYAI_API_KEY", "xAI": "XAI_API_KEY",
-        "Together AI": "TOGETHERAI_API_KEY", "Fireworks AI": "FIREWORKS_AI_API_KEY",
-        "Replicate": "REPLICATE_API_KEY", "Hugging Face": "HUGGINGFACE_API_KEY",
-        "Anyscale": "ANYSCALE_API_KEY", "NVIDIA NIM": "NVIDIA_NIM_API_KEY",
-        "Deepseek": "DEEPSEEK_API_KEY", "AI21": "AI21_API_KEY",
-        "Cerebras": "CEREBRAS_API_KEY", "Moonshot": "MOONSHOT_API_KEY",
-        "Ollama": "OLLAMA_API_KEY", "Xinference": "XINFERENCE_API_KEY",
-        "Infinity": "INFINITY_API_KEY", "OpenRouter": "OPENROUTER_API_KEY",
-        "Deepinfra": "DEEPINFRA_API_KEY", "Cloudflare": "CLOUDFLARE_API_KEY",
-        "Baseten": "BASETEN_API_KEY", "Modal": "MODAL_API_KEY",
-        "Databricks": "DATABRICKS_API_KEY", "AWS SageMaker": "AWS_ACCESS_KEY_ID",
-        "IBM watsonx.ai": "WATSONX_APIKEY", "Predibase": "PREDIBASE_API_KEY",
-        "Clarifai": "CLARIFAI_API_KEY", "NLP Cloud": "NLP_CLOUD_API_KEY",
-        "Voyage AI": "VOYAGE_API_KEY", "Jina AI": "JINA_API_KEY",
-        "Hyperbolic": "HYPERBOLIC_API_KEY", "Morph": "MORPH_API_KEY",
-        "Lambda AI": "LAMBDA_API_KEY", "Novita AI": "NOVITA_API_KEY",
-        "Aleph Alpha": "ALEPH_ALPHA_API_KEY", "SambaNova": "SAMBANOVA_API_KEY",
-        "FriendliAI": "FRIENDLI_TOKEN", "Galadriel": "GALADRIEL_API_KEY",
-        "CompactifAI": "COMPACTIFAI_API_KEY", "Lemonade": "LEMONADE_API_KEY",
-        "GradientAI": "GRADIENTAI_API_KEY", "Featherless AI": "FEATHERLESS_AI_API_KEY",
-        "Nebius AI Studio": "NEBIUS_API_KEY", "Dashscope (Qwen)": "DASHSCOPE_API_KEY",
-        "Bytez": "BYTEZ_API_KEY", "Oracle OCI": "OCI_API_KEY",
-        "DataRobot": "DATAROBOT_API_KEY", "OVHCloud": "OVHCLOUD_API_KEY",
-        "Volcengine": "VOLCENGINE_API_KEY", "Snowflake": "SNOWFLAKE_API_KEY",
-        "Nscale": "NSCALE_API_KEY", "Recraft": "RECRAFT_API_KEY",
-        "v0": "V0_API_KEY", "Vercel": "VERCEL_AI_GATEWAY_API_KEY",
-        "Topaz": "TOPAZ_API_KEY", "ElevenLabs": "ELEVENLABS_API_KEY",
+        "Codestral (Mistral)": "CODESTRAL_API_KEY",
+        "Groq": "GROQ_API_KEY",
+        "Perplexity": "PERPLEXITYAI_API_KEY",
+        "xAI": "XAI_API_KEY",
+        "Together AI": "TOGETHERAI_API_KEY",
+        "Fireworks AI": "FIREWORKS_AI_API_KEY",
+        "Replicate": "REPLICATE_API_KEY",
+        "Hugging Face": "HUGGINGFACE_API_KEY",
+        "Anyscale": "ANYSCALE_API_KEY",
+        "NVIDIA NIM": "NVIDIA_NIM_API_KEY",
+        "Deepseek": "DEEPSEEK_API_KEY",
+        "AI21": "AI21_API_KEY",
+        "Cerebras": "CEREBRAS_API_KEY",
+        "Moonshot": "MOONSHOT_API_KEY",
+        "Ollama": "OLLAMA_API_KEY",
+        "Xinference": "XINFERENCE_API_KEY",
+        "Infinity": "INFINITY_API_KEY",
+        "OpenRouter": "OPENROUTER_API_KEY",
+        "Deepinfra": "DEEPINFRA_API_KEY",
+        "Cloudflare": "CLOUDFLARE_API_KEY",
+        "Baseten": "BASETEN_API_KEY",
+        "Modal": "MODAL_API_KEY",
+        "Databricks": "DATABRICKS_API_KEY",
+        "AWS SageMaker": "AWS_ACCESS_KEY_ID",
+        "IBM watsonx.ai": "WATSONX_APIKEY",
+        "Predibase": "PREDIBASE_API_KEY",
+        "Clarifai": "CLARIFAI_API_KEY",
+        "NLP Cloud": "NLP_CLOUD_API_KEY",
+        "Voyage AI": "VOYAGE_API_KEY",
+        "Jina AI": "JINA_API_KEY",
+        "Hyperbolic": "HYPERBOLIC_API_KEY",
+        "Morph": "MORPH_API_KEY",
+        "Lambda AI": "LAMBDA_API_KEY",
+        "Novita AI": "NOVITA_API_KEY",
+        "Aleph Alpha": "ALEPH_ALPHA_API_KEY",
+        "SambaNova": "SAMBANOVA_API_KEY",
+        "FriendliAI": "FRIENDLI_TOKEN",
+        "Galadriel": "GALADRIEL_API_KEY",
+        "CompactifAI": "COMPACTIFAI_API_KEY",
+        "Lemonade": "LEMONADE_API_KEY",
+        "GradientAI": "GRADIENTAI_API_KEY",
+        "Featherless AI": "FEATHERLESS_AI_API_KEY",
+        "Nebius AI Studio": "NEBIUS_API_KEY",
+        "Dashscope (Qwen)": "DASHSCOPE_API_KEY",
+        "Bytez": "BYTEZ_API_KEY",
+        "Oracle OCI": "OCI_API_KEY",
+        "DataRobot": "DATAROBOT_API_KEY",
+        "OVHCloud": "OVHCLOUD_API_KEY",
+        "Volcengine": "VOLCENGINE_API_KEY",
+        "Snowflake": "SNOWFLAKE_API_KEY",
+        "Nscale": "NSCALE_API_KEY",
+        "Recraft": "RECRAFT_API_KEY",
+        "v0": "V0_API_KEY",
+        "Vercel": "VERCEL_AI_GATEWAY_API_KEY",
+        "Topaz": "TOPAZ_API_KEY",
+        "ElevenLabs": "ELEVENLABS_API_KEY",
         "Deepgram": "DEEPGRAM_API_KEY",
-        "GitHub Models": "GITHUB_TOKEN", "GitHub Copilot": "GITHUB_COPILOT_API_KEY",
+        "GitHub Models": "GITHUB_TOKEN",
+        "GitHub Copilot": "GITHUB_COPILOT_API_KEY",
     }
 
     # Discover custom providers and add them to the list
@@ -186,37 +155,37 @@ async def setup_api_key():
     # qwen_code API key support is a fallback
     # iflow API key support is a feature
     _, PROVIDER_PLUGINS = _ensure_providers_loaded()
-    
+
     # Build a set of environment variables already in LITELLM_PROVIDERS
     # to avoid duplicates based on the actual API key names
     litellm_env_vars = set(LITELLM_PROVIDERS.values())
-    
+
     # Providers to exclude from API key list
     exclude_providers = {
-        'gemini_cli',  # OAuth-only
-        'antigravity',  # OAuth-only  
-        'qwen_code',  # API key is fallback, OAuth is primary - don't advertise
-        'openai_compatible',  # Base class, not a real provider
+        "gemini_cli",  # OAuth-only
+        "antigravity",  # OAuth-only
+        "qwen_code",  # API key is fallback, OAuth is primary - don't advertise
+        "openai_compatible",  # Base class, not a real provider
     }
-    
+
     discovered_providers = {}
     for provider_key in PROVIDER_PLUGINS.keys():
         if provider_key in exclude_providers:
             continue
-        
+
         # Create environment variable name
         env_var = provider_key.upper() + "_API_KEY"
-        
+
         # Check if this env var already exists in LITELLM_PROVIDERS
         # This catches duplicates like GEMINI_API_KEY, MISTRAL_API_KEY, etc.
         if env_var in litellm_env_vars:
             # Already in LITELLM_PROVIDERS with better name, skip this one
             continue
-        
+
         # Create display name for this custom provider
-        display_name = provider_key.replace('_', ' ').title()
+        display_name = provider_key.replace("_", " ").title()
         discovered_providers[display_name] = env_var
-    
+
     # LITELLM_PROVIDERS takes precedence (comes first in merge)
     combined_providers = {**LITELLM_PROVIDERS, **discovered_providers}
     provider_display_list = sorted(combined_providers.keys())
@@ -231,15 +200,19 @@ async def setup_api_key():
         else:
             provider_text.append(f"  {i + 1}. {provider_name}\n")
 
-    console.print(Panel(provider_text, title="Available Providers for API Key", style="bold blue"))
+    console.print(
+        Panel(provider_text, title="Available Providers for API Key", style="bold blue")
+    )
 
     choice = Prompt.ask(
-        Text.from_markup("[bold]Please select a provider or type [red]'b'[/red] to go back[/bold]"),
+        Text.from_markup(
+            "[bold]Please select a provider or type [red]'b'[/red] to go back[/bold]"
+        ),
         choices=[str(i + 1) for i in range(len(provider_display_list))] + ["b"],
-        show_choices=False
+        show_choices=False,
     )
 
-    if choice.lower() == 'b':
+    if choice.lower() == "b":
         return
 
     try:
@@ -256,54 +229,81 @@ async def setup_api_key():
                     for line in f:
                         line = line.strip()
                         if line.startswith(api_var_base) and "=" in line:
-                            existing_key_name, _, existing_key_value = line.partition("=")
+                            existing_key_name, _, existing_key_value = line.partition(
+                                "="
+                            )
                             if existing_key_value == api_key:
-                                warning_text = Text.from_markup(f"This API key already exists as [bold yellow]'{existing_key_name}'[/bold yellow]. Overwriting...")
-                                console.print(Panel(warning_text, style="bold yellow", title="Updating API Key"))
+                                warning_text = Text.from_markup(
+                                    f"This API key already exists as [bold yellow]'{existing_key_name}'[/bold yellow]. Overwriting..."
+                                )
+                                console.print(
+                                    Panel(
+                                        warning_text,
+                                        style="bold yellow",
+                                        title="Updating API Key",
+                                    )
+                                )
 
                                 set_key(str(ENV_FILE), existing_key_name, api_key)
 
-                                success_text = Text.from_markup(f"Successfully updated existing key [bold yellow]'{existing_key_name}'[/bold yellow].")
-                                console.print(Panel(success_text, style="bold green", title="Success"))
+                                success_text = Text.from_markup(
+                                    f"Successfully updated existing key [bold yellow]'{existing_key_name}'[/bold yellow]."
+                                )
+                                console.print(
+                                    Panel(
+                                        success_text,
+                                        style="bold green",
+                                        title="Success",
+                                    )
+                                )
                                 return
 
             # Special handling for AWS
             if display_name in ["AWS Bedrock", "AWS SageMaker"]:
-                console.print(Panel(
-                    Text.from_markup(
-                        "This provider requires both an Access Key ID and a Secret Access Key.\n"
-                        f"The key you entered will be saved as [bold yellow]{api_var_base}_1[/bold yellow].\n"
-                        "Please manually add the [bold cyan]AWS_SECRET_ACCESS_KEY_1[/bold cyan] to your .env file."
-                    ),
-                    title="[bold yellow]Additional Step Required[/bold yellow]",
-                    border_style="yellow"
-                ))
+                console.print(
+                    Panel(
+                        Text.from_markup(
+                            "This provider requires both an Access Key ID and a Secret Access Key.\n"
+                            f"The key you entered will be saved as [bold yellow]{api_var_base}_1[/bold yellow].\n"
+                            "Please manually add the [bold cyan]AWS_SECRET_ACCESS_KEY_1[/bold cyan] to your .env file."
+                        ),
+                        title="[bold yellow]Additional Step Required[/bold yellow]",
+                        border_style="yellow",
+                    )
+                )
 
             key_index = 1
             while True:
                 key_name = f"{api_var_base}_{key_index}"
                 if ENV_FILE.is_file():
-                     with open(ENV_FILE, "r") as f:
+                    with open(ENV_FILE, "r") as f:
                         if not any(line.startswith(f"{key_name}=") for line in f):
                             break
                 else:
                     break
                 key_index += 1
-            
+
             key_name = f"{api_var_base}_{key_index}"
             set_key(str(ENV_FILE), key_name, api_key)
-            
-            success_text = Text.from_markup(f"Successfully added {display_name} API key as [bold yellow]'{key_name}'[/bold yellow].")
+
+            success_text = Text.from_markup(
+                f"Successfully added {display_name} API key as [bold yellow]'{key_name}'[/bold yellow]."
+            )
             console.print(Panel(success_text, style="bold green", title="Success"))
 
         else:
             console.print("[bold red]Invalid choice. Please try again.[/bold red]")
     except ValueError:
-        console.print("[bold red]Invalid input. Please enter a number or 'b'.[/bold red]")
+        console.print(
+            "[bold red]Invalid input. Please enter a number or 'b'.[/bold red]"
+        )
+
 
 async def setup_new_credential(provider_name: str):
     """
     Interactively sets up a new OAuth credential for a given provider.
+
+    Delegates all credential management logic to the auth class's setup_credential() method.
     """
     try:
         provider_factory, _ = _ensure_providers_loaded()
@@ -315,668 +315,602 @@ async def setup_new_credential(provider_name: str):
             "gemini_cli": "Gemini CLI (OAuth)",
             "qwen_code": "Qwen Code (OAuth - also supports API keys)",
             "iflow": "iFlow (OAuth - also supports API keys)",
-            "antigravity": "Antigravity (OAuth)"
+            "antigravity": "Antigravity (OAuth)",
         }
-        display_name = oauth_friendly_names.get(provider_name, provider_name.replace('_', ' ').title())
-
-        # Pass provider metadata to auth classes for better display
-        temp_creds = {
-            "_proxy_metadata": {
-                "provider_name": provider_name,
-                "display_name": display_name
-            }
-        }
-        initialized_creds = await auth_instance.initialize_token(temp_creds)
-        
-        user_info = await auth_instance.get_user_info(initialized_creds)
-        email = user_info.get("email")
+        display_name = oauth_friendly_names.get(
+            provider_name, provider_name.replace("_", " ").title()
+        )
 
-        if not email:
-            console.print(Panel(f"Could not retrieve a unique identifier for {provider_name}. Aborting.", style="bold red", title="Error"))
+        # Call the auth class's setup_credential() method which handles the entire flow:
+        # - OAuth authentication
+        # - Email extraction for deduplication
+        # - File path determination (new or existing)
+        # - Credential file saving
+        # - Post-auth discovery (tier/project for Google OAuth providers)
+        result = await auth_instance.setup_credential(OAUTH_BASE_DIR)
+
+        if not result.success:
+            console.print(
+                Panel(
+                    f"Credential setup failed: {result.error}",
+                    style="bold red",
+                    title="Error",
+                )
+            )
             return
 
-        for cred_file in OAUTH_BASE_DIR.glob(f"{provider_name}_oauth_*.json"):
-            with open(cred_file, 'r') as f:
-                existing_creds = json.load(f)
-
-            metadata = existing_creds.get("_proxy_metadata", {})
-            if metadata.get("email") == email:
-                warning_text = Text.from_markup(f"Found existing credential for [bold cyan]'{email}'[/bold cyan] at [bold yellow]'{cred_file.name}'[/bold yellow]. Overwriting...")
-                console.print(Panel(warning_text, style="bold yellow", title="Updating Credential"))
+        # Display success message with details
+        if result.is_update:
+            success_text = Text.from_markup(
+                f"Successfully updated credential at [bold yellow]'{Path(result.file_path).name}'[/bold yellow] "
+                f"for user [bold cyan]'{result.email}'[/bold cyan]."
+            )
+        else:
+            success_text = Text.from_markup(
+                f"Successfully created new credential at [bold yellow]'{Path(result.file_path).name}'[/bold yellow] "
+                f"for user [bold cyan]'{result.email}'[/bold cyan]."
+            )
 
-                # Overwrite the existing file in-place
-                with open(cred_file, 'w') as f:
-                    json.dump(initialized_creds, f, indent=2)
+        # Add tier/project info if available (Google OAuth providers)
+        if hasattr(result, "tier") and result.tier:
+            success_text.append(f"\nTier: {result.tier}")
+        if hasattr(result, "project_id") and result.project_id:
+            success_text.append(f"\nProject: {result.project_id}")
 
-                success_text = Text.from_markup(f"Successfully updated credential at [bold yellow]'{cred_file.name}'[/bold yellow] for user [bold cyan]'{email}'[/bold cyan].")
-                console.print(Panel(success_text, style="bold green", title="Success"))
-                return
-
-        existing_files = list(OAUTH_BASE_DIR.glob(f"{provider_name}_oauth_*.json"))
-        next_num = 1
-        if existing_files:
-            nums = [int(re.search(r'_(\d+)\.json$', f.name).group(1)) for f in existing_files if re.search(r'_(\d+)\.json$', f.name)]
-            if nums:
-                next_num = max(nums) + 1
-        
-        new_filename = f"{provider_name}_oauth_{next_num}.json"
-        new_filepath = OAUTH_BASE_DIR / new_filename
-
-        with open(new_filepath, 'w') as f:
-            json.dump(initialized_creds, f, indent=2)
-
-        success_text = Text.from_markup(f"Successfully created new credential at [bold yellow]'{new_filepath.name}'[/bold yellow] for user [bold cyan]'{email}'[/bold cyan].")
         console.print(Panel(success_text, style="bold green", title="Success"))
 
     except Exception as e:
-        console.print(Panel(f"An error occurred during setup for {provider_name}: {e}", style="bold red", title="Error"))
+        console.print(
+            Panel(
+                f"An error occurred during setup for {provider_name}: {e}",
+                style="bold red",
+                title="Error",
+            )
+        )
 
 
 async def export_gemini_cli_to_env():
     """
     Export a Gemini CLI credential JSON file to .env format.
-    Uses numbered format (GEMINI_CLI_1_*, GEMINI_CLI_2_*) for multiple credential support.
+    Uses the auth class's build_env_lines() and list_credentials() methods.
     """
-    console.print(Panel("[bold cyan]Export Gemini CLI Credential to .env[/bold cyan]", expand=False))
+    console.print(
+        Panel(
+            "[bold cyan]Export Gemini CLI Credential to .env[/bold cyan]", expand=False
+        )
+    )
+
+    # Get auth instance for this provider
+    provider_factory, _ = _ensure_providers_loaded()
+    auth_class = provider_factory.get_provider_auth_class("gemini_cli")
+    auth_instance = auth_class()
 
-    # Find all gemini_cli credentials
-    gemini_cli_files = sorted(list(OAUTH_BASE_DIR.glob("gemini_cli_oauth_*.json")))
+    # List available credentials using auth class
+    credentials = auth_instance.list_credentials(OAUTH_BASE_DIR)
 
-    if not gemini_cli_files:
-        console.print(Panel("No Gemini CLI credentials found. Please add one first using 'Add OAuth Credential'.",
-                          style="bold red", title="No Credentials"))
+    if not credentials:
+        console.print(
+            Panel(
+                "No Gemini CLI credentials found. Please add one first using 'Add OAuth Credential'.",
+                style="bold red",
+                title="No Credentials",
+            )
+        )
         return
 
     # Display available credentials
     cred_text = Text()
-    for i, cred_file in enumerate(gemini_cli_files):
-        try:
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-            cred_text.append(f"  {i + 1}. {cred_file.name} ({email})\n")
-        except Exception as e:
-            cred_text.append(f"  {i + 1}. {cred_file.name} (error reading: {e})\n")
+    for i, cred_info in enumerate(credentials):
+        cred_text.append(
+            f"  {i + 1}. {Path(cred_info['file_path']).name} ({cred_info['email']})\n"
+        )
 
-    console.print(Panel(cred_text, title="Available Gemini CLI Credentials", style="bold blue"))
+    console.print(
+        Panel(cred_text, title="Available Gemini CLI Credentials", style="bold blue")
+    )
 
     choice = Prompt.ask(
-        Text.from_markup("[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"),
-        choices=[str(i + 1) for i in range(len(gemini_cli_files))] + ["b"],
-        show_choices=False
+        Text.from_markup(
+            "[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"
+        ),
+        choices=[str(i + 1) for i in range(len(credentials))] + ["b"],
+        show_choices=False,
     )
 
-    if choice.lower() == 'b':
+    if choice.lower() == "b":
         return
 
     try:
         choice_index = int(choice) - 1
-        if 0 <= choice_index < len(gemini_cli_files):
-            cred_file = gemini_cli_files[choice_index]
-
-            # Load the credential
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
+        if 0 <= choice_index < len(credentials):
+            cred_info = credentials[choice_index]
 
-            # Extract metadata
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-            project_id = creds.get("_proxy_metadata", {}).get("project_id", "")
-            tier = creds.get("_proxy_metadata", {}).get("tier", "")
-
-            # Get credential number from filename
-            cred_number = _get_credential_number_from_filename(cred_file.name)
-
-            # Generate .env file name with credential number
-            safe_email = email.replace("@", "_at_").replace(".", "_")
-            env_filename = f"gemini_cli_{cred_number}_{safe_email}.env"
-            env_filepath = OAUTH_BASE_DIR / env_filename
-
-            # Build extra fields
-            extra_fields = {}
-            if project_id:
-                extra_fields["PROJECT_ID"] = project_id
-            if tier:
-                extra_fields["TIER"] = tier
-
-            # Build .env content using helper
-            env_lines, numbered_prefix = _build_env_export_content(
-                provider_prefix="GEMINI_CLI",
-                cred_number=cred_number,
-                creds=creds,
-                email=email,
-                extra_fields=extra_fields,
-                include_client_creds=True
+            # Use auth class to export
+            env_path = auth_instance.export_credential_to_env(
+                cred_info["file_path"], OAUTH_BASE_DIR
             )
 
-            # Write to .env file
-            with open(env_filepath, 'w') as f:
-                f.write('\n'.join(env_lines))
-
-            success_text = Text.from_markup(
-                f"Successfully exported credential to [bold yellow]'{env_filepath}'[/bold yellow]\n\n"
-                f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
-                f"[bold]To use this credential:[/bold]\n"
-                f"1. Copy the contents to your main .env file, OR\n"
-                f"2. Source it: [bold cyan]source {env_filepath.name}[/bold cyan] (Linux/Mac)\n"
-                f"3. Or on Windows: [bold cyan]Get-Content {env_filepath.name} | ForEach-Object {{ $_ -replace '^([^#].*)$', 'set $1' }} | cmd[/bold cyan]\n\n"
-                f"[bold]To combine multiple credentials:[/bold]\n"
-                f"Copy lines from multiple .env files into one file.\n"
-                f"Each credential uses a unique number ({numbered_prefix}_*)."
-            )
-            console.print(Panel(success_text, style="bold green", title="Success"))
+            if env_path:
+                numbered_prefix = f"GEMINI_CLI_{cred_info['number']}"
+                success_text = Text.from_markup(
+                    f"Successfully exported credential to [bold yellow]'{Path(env_path).name}'[/bold yellow]\n\n"
+                    f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
+                    f"[bold]To use this credential:[/bold]\n"
+                    f"1. Copy the contents to your main .env file, OR\n"
+                    f"2. Source it: [bold cyan]source {Path(env_path).name}[/bold cyan] (Linux/Mac)\n"
+                    f"3. Or on Windows: [bold cyan]Get-Content {Path(env_path).name} | ForEach-Object {{ $_ -replace '^([^#].*)$', 'set $1' }} | cmd[/bold cyan]\n\n"
+                    f"[bold]To combine multiple credentials:[/bold]\n"
+                    f"Copy lines from multiple .env files into one file.\n"
+                    f"Each credential uses a unique number ({numbered_prefix}_*)."
+                )
+                console.print(Panel(success_text, style="bold green", title="Success"))
+            else:
+                console.print(
+                    Panel(
+                        "Failed to export credential", style="bold red", title="Error"
+                    )
+                )
         else:
             console.print("[bold red]Invalid choice. Please try again.[/bold red]")
     except ValueError:
-        console.print("[bold red]Invalid input. Please enter a number or 'b'.[/bold red]")
+        console.print(
+            "[bold red]Invalid input. Please enter a number or 'b'.[/bold red]"
+        )
     except Exception as e:
-        console.print(Panel(f"An error occurred during export: {e}", style="bold red", title="Error"))
+        console.print(
+            Panel(
+                f"An error occurred during export: {e}", style="bold red", title="Error"
+            )
+        )
 
 
 async def export_qwen_code_to_env():
     """
     Export a Qwen Code credential JSON file to .env format.
-    Generates one .env file per credential.
+    Uses the auth class's build_env_lines() and list_credentials() methods.
     """
-    console.print(Panel("[bold cyan]Export Qwen Code Credential to .env[/bold cyan]", expand=False))
+    console.print(
+        Panel(
+            "[bold cyan]Export Qwen Code Credential to .env[/bold cyan]", expand=False
+        )
+    )
 
-    # Find all qwen_code credentials
-    qwen_code_files = list(OAUTH_BASE_DIR.glob("qwen_code_oauth_*.json"))
+    # Get auth instance for this provider
+    provider_factory, _ = _ensure_providers_loaded()
+    auth_class = provider_factory.get_provider_auth_class("qwen_code")
+    auth_instance = auth_class()
 
-    if not qwen_code_files:
-        console.print(Panel("No Qwen Code credentials found. Please add one first using 'Add OAuth Credential'.",
-                          style="bold red", title="No Credentials"))
+    # List available credentials using auth class
+    credentials = auth_instance.list_credentials(OAUTH_BASE_DIR)
+
+    if not credentials:
+        console.print(
+            Panel(
+                "No Qwen Code credentials found. Please add one first using 'Add OAuth Credential'.",
+                style="bold red",
+                title="No Credentials",
+            )
+        )
         return
 
     # Display available credentials
     cred_text = Text()
-    for i, cred_file in enumerate(qwen_code_files):
-        try:
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-            cred_text.append(f"  {i + 1}. {cred_file.name} ({email})\n")
-        except Exception as e:
-            cred_text.append(f"  {i + 1}. {cred_file.name} (error reading: {e})\n")
+    for i, cred_info in enumerate(credentials):
+        cred_text.append(
+            f"  {i + 1}. {Path(cred_info['file_path']).name} ({cred_info['email']})\n"
+        )
 
-    console.print(Panel(cred_text, title="Available Qwen Code Credentials", style="bold blue"))
+    console.print(
+        Panel(cred_text, title="Available Qwen Code Credentials", style="bold blue")
+    )
 
     choice = Prompt.ask(
-        Text.from_markup("[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"),
-        choices=[str(i + 1) for i in range(len(qwen_code_files))] + ["b"],
-        show_choices=False
+        Text.from_markup(
+            "[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"
+        ),
+        choices=[str(i + 1) for i in range(len(credentials))] + ["b"],
+        show_choices=False,
     )
 
-    if choice.lower() == 'b':
+    if choice.lower() == "b":
         return
 
     try:
         choice_index = int(choice) - 1
-        if 0 <= choice_index < len(qwen_code_files):
-            cred_file = qwen_code_files[choice_index]
-
-            # Load the credential
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
+        if 0 <= choice_index < len(credentials):
+            cred_info = credentials[choice_index]
 
-            # Extract metadata
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-
-            # Get credential number from filename
-            cred_number = _get_credential_number_from_filename(cred_file.name)
-
-            # Generate .env file name with credential number
-            safe_email = email.replace("@", "_at_").replace(".", "_")
-            env_filename = f"qwen_code_{cred_number}_{safe_email}.env"
-            env_filepath = OAUTH_BASE_DIR / env_filename
-
-            # Use numbered format: QWEN_CODE_N_*
-            numbered_prefix = f"QWEN_CODE_{cred_number}"
-
-            # Build .env content (Qwen has different structure)
-            env_lines = [
-                f"# QWEN_CODE Credential #{cred_number} for: {email}",
-                f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
-                f"# ",
-                f"# To combine multiple credentials into one .env file, copy these lines",
-                f"# and ensure each credential has a unique number (1, 2, 3, etc.)",
-                "",
-                f"{numbered_prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
-                f"{numbered_prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
-                f"{numbered_prefix}_EXPIRY_DATE={creds.get('expiry_date', 0)}",
-                f"{numbered_prefix}_RESOURCE_URL={creds.get('resource_url', 'https://portal.qwen.ai/v1')}",
-                f"{numbered_prefix}_EMAIL={email}",
-            ]
-
-            # Write to .env file
-            with open(env_filepath, 'w') as f:
-                f.write('\n'.join(env_lines))
-
-            success_text = Text.from_markup(
-                f"Successfully exported credential to [bold yellow]'{env_filepath}'[/bold yellow]\n\n"
-                f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
-                f"[bold]To use this credential:[/bold]\n"
-                f"1. Copy the contents to your main .env file, OR\n"
-                f"2. Source it: [bold cyan]source {env_filepath.name}[/bold cyan] (Linux/Mac)\n\n"
-                f"[bold]To combine multiple credentials:[/bold]\n"
-                f"Copy lines from multiple .env files into one file.\n"
-                f"Each credential uses a unique number ({numbered_prefix}_*)."
+            # Use auth class to export
+            env_path = auth_instance.export_credential_to_env(
+                cred_info["file_path"], OAUTH_BASE_DIR
             )
-            console.print(Panel(success_text, style="bold green", title="Success"))
+
+            if env_path:
+                numbered_prefix = f"QWEN_CODE_{cred_info['number']}"
+                success_text = Text.from_markup(
+                    f"Successfully exported credential to [bold yellow]'{Path(env_path).name}'[/bold yellow]\n\n"
+                    f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
+                    f"[bold]To use this credential:[/bold]\n"
+                    f"1. Copy the contents to your main .env file, OR\n"
+                    f"2. Source it: [bold cyan]source {Path(env_path).name}[/bold cyan] (Linux/Mac)\n\n"
+                    f"[bold]To combine multiple credentials:[/bold]\n"
+                    f"Copy lines from multiple .env files into one file.\n"
+                    f"Each credential uses a unique number ({numbered_prefix}_*)."
+                )
+                console.print(Panel(success_text, style="bold green", title="Success"))
+            else:
+                console.print(
+                    Panel(
+                        "Failed to export credential", style="bold red", title="Error"
+                    )
+                )
         else:
             console.print("[bold red]Invalid choice. Please try again.[/bold red]")
     except ValueError:
-        console.print("[bold red]Invalid input. Please enter a number or 'b'.[/bold red]")
+        console.print(
+            "[bold red]Invalid input. Please enter a number or 'b'.[/bold red]"
+        )
     except Exception as e:
-        console.print(Panel(f"An error occurred during export: {e}", style="bold red", title="Error"))
+        console.print(
+            Panel(
+                f"An error occurred during export: {e}", style="bold red", title="Error"
+            )
+        )
 
 
 async def export_iflow_to_env():
     """
     Export an iFlow credential JSON file to .env format.
-    Uses numbered format (IFLOW_1_*, IFLOW_2_*) for multiple credential support.
+    Uses the auth class's build_env_lines() and list_credentials() methods.
     """
-    console.print(Panel("[bold cyan]Export iFlow Credential to .env[/bold cyan]", expand=False))
+    console.print(
+        Panel("[bold cyan]Export iFlow Credential to .env[/bold cyan]", expand=False)
+    )
+
+    # Get auth instance for this provider
+    provider_factory, _ = _ensure_providers_loaded()
+    auth_class = provider_factory.get_provider_auth_class("iflow")
+    auth_instance = auth_class()
 
-    # Find all iflow credentials
-    iflow_files = sorted(list(OAUTH_BASE_DIR.glob("iflow_oauth_*.json")))
+    # List available credentials using auth class
+    credentials = auth_instance.list_credentials(OAUTH_BASE_DIR)
 
-    if not iflow_files:
-        console.print(Panel("No iFlow credentials found. Please add one first using 'Add OAuth Credential'.",
-                          style="bold red", title="No Credentials"))
+    if not credentials:
+        console.print(
+            Panel(
+                "No iFlow credentials found. Please add one first using 'Add OAuth Credential'.",
+                style="bold red",
+                title="No Credentials",
+            )
+        )
         return
 
     # Display available credentials
     cred_text = Text()
-    for i, cred_file in enumerate(iflow_files):
-        try:
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-            cred_text.append(f"  {i + 1}. {cred_file.name} ({email})\n")
-        except Exception as e:
-            cred_text.append(f"  {i + 1}. {cred_file.name} (error reading: {e})\n")
+    for i, cred_info in enumerate(credentials):
+        cred_text.append(
+            f"  {i + 1}. {Path(cred_info['file_path']).name} ({cred_info['email']})\n"
+        )
 
-    console.print(Panel(cred_text, title="Available iFlow Credentials", style="bold blue"))
+    console.print(
+        Panel(cred_text, title="Available iFlow Credentials", style="bold blue")
+    )
 
     choice = Prompt.ask(
-        Text.from_markup("[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"),
-        choices=[str(i + 1) for i in range(len(iflow_files))] + ["b"],
-        show_choices=False
+        Text.from_markup(
+            "[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"
+        ),
+        choices=[str(i + 1) for i in range(len(credentials))] + ["b"],
+        show_choices=False,
     )
 
-    if choice.lower() == 'b':
+    if choice.lower() == "b":
         return
 
     try:
         choice_index = int(choice) - 1
-        if 0 <= choice_index < len(iflow_files):
-            cred_file = iflow_files[choice_index]
-
-            # Load the credential
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
-
-            # Extract metadata
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-
-            # Get credential number from filename
-            cred_number = _get_credential_number_from_filename(cred_file.name)
-
-            # Generate .env file name with credential number
-            safe_email = email.replace("@", "_at_").replace(".", "_")
-            env_filename = f"iflow_{cred_number}_{safe_email}.env"
-            env_filepath = OAUTH_BASE_DIR / env_filename
-
-            # Use numbered format: IFLOW_N_*
-            numbered_prefix = f"IFLOW_{cred_number}"
-
-            # Build .env content (iFlow has different structure with API key)
-            env_lines = [
-                f"# IFLOW Credential #{cred_number} for: {email}",
-                f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
-                f"# ",
-                f"# To combine multiple credentials into one .env file, copy these lines",
-                f"# and ensure each credential has a unique number (1, 2, 3, etc.)",
-                "",
-                f"{numbered_prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
-                f"{numbered_prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
-                f"{numbered_prefix}_API_KEY={creds.get('api_key', '')}",
-                f"{numbered_prefix}_EXPIRY_DATE={creds.get('expiry_date', '')}",
-                f"{numbered_prefix}_EMAIL={email}",
-                f"{numbered_prefix}_TOKEN_TYPE={creds.get('token_type', 'Bearer')}",
-                f"{numbered_prefix}_SCOPE={creds.get('scope', 'read write')}",
-            ]
-
-            # Write to .env file
-            with open(env_filepath, 'w') as f:
-                f.write('\n'.join(env_lines))
+        if 0 <= choice_index < len(credentials):
+            cred_info = credentials[choice_index]
 
-            success_text = Text.from_markup(
-                f"Successfully exported credential to [bold yellow]'{env_filepath}'[/bold yellow]\n\n"
-                f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
-                f"[bold]To use this credential:[/bold]\n"
-                f"1. Copy the contents to your main .env file, OR\n"
-                f"2. Source it: [bold cyan]source {env_filepath.name}[/bold cyan] (Linux/Mac)\n\n"
-                f"[bold]To combine multiple credentials:[/bold]\n"
-                f"Copy lines from multiple .env files into one file.\n"
-                f"Each credential uses a unique number ({numbered_prefix}_*)."
+            # Use auth class to export
+            env_path = auth_instance.export_credential_to_env(
+                cred_info["file_path"], OAUTH_BASE_DIR
             )
-            console.print(Panel(success_text, style="bold green", title="Success"))
+
+            if env_path:
+                numbered_prefix = f"IFLOW_{cred_info['number']}"
+                success_text = Text.from_markup(
+                    f"Successfully exported credential to [bold yellow]'{Path(env_path).name}'[/bold yellow]\n\n"
+                    f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
+                    f"[bold]To use this credential:[/bold]\n"
+                    f"1. Copy the contents to your main .env file, OR\n"
+                    f"2. Source it: [bold cyan]source {Path(env_path).name}[/bold cyan] (Linux/Mac)\n\n"
+                    f"[bold]To combine multiple credentials:[/bold]\n"
+                    f"Copy lines from multiple .env files into one file.\n"
+                    f"Each credential uses a unique number ({numbered_prefix}_*)."
+                )
+                console.print(Panel(success_text, style="bold green", title="Success"))
+            else:
+                console.print(
+                    Panel(
+                        "Failed to export credential", style="bold red", title="Error"
+                    )
+                )
         else:
             console.print("[bold red]Invalid choice. Please try again.[/bold red]")
     except ValueError:
-        console.print("[bold red]Invalid input. Please enter a number or 'b'.[/bold red]")
+        console.print(
+            "[bold red]Invalid input. Please enter a number or 'b'.[/bold red]"
+        )
     except Exception as e:
-        console.print(Panel(f"An error occurred during export: {e}", style="bold red", title="Error"))
+        console.print(
+            Panel(
+                f"An error occurred during export: {e}", style="bold red", title="Error"
+            )
+        )
 
 
 async def export_antigravity_to_env():
     """
     Export an Antigravity credential JSON file to .env format.
-    Uses numbered format (ANTIGRAVITY_1_*, ANTIGRAVITY_2_*) for multiple credential support.
+    Uses the auth class's build_env_lines() and list_credentials() methods.
     """
-    console.print(Panel("[bold cyan]Export Antigravity Credential to .env[/bold cyan]", expand=False))
+    console.print(
+        Panel(
+            "[bold cyan]Export Antigravity Credential to .env[/bold cyan]", expand=False
+        )
+    )
+
+    # Get auth instance for this provider
+    provider_factory, _ = _ensure_providers_loaded()
+    auth_class = provider_factory.get_provider_auth_class("antigravity")
+    auth_instance = auth_class()
 
-    # Find all antigravity credentials
-    antigravity_files = sorted(list(OAUTH_BASE_DIR.glob("antigravity_oauth_*.json")))
+    # List available credentials using auth class
+    credentials = auth_instance.list_credentials(OAUTH_BASE_DIR)
 
-    if not antigravity_files:
-        console.print(Panel("No Antigravity credentials found. Please add one first using 'Add OAuth Credential'.",
-                          style="bold red", title="No Credentials"))
+    if not credentials:
+        console.print(
+            Panel(
+                "No Antigravity credentials found. Please add one first using 'Add OAuth Credential'.",
+                style="bold red",
+                title="No Credentials",
+            )
+        )
         return
 
     # Display available credentials
     cred_text = Text()
-    for i, cred_file in enumerate(antigravity_files):
-        try:
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-            cred_text.append(f"  {i + 1}. {cred_file.name} ({email})\n")
-        except Exception as e:
-            cred_text.append(f"  {i + 1}. {cred_file.name} (error reading: {e})\n")
+    for i, cred_info in enumerate(credentials):
+        cred_text.append(
+            f"  {i + 1}. {Path(cred_info['file_path']).name} ({cred_info['email']})\n"
+        )
 
-    console.print(Panel(cred_text, title="Available Antigravity Credentials", style="bold blue"))
+    console.print(
+        Panel(cred_text, title="Available Antigravity Credentials", style="bold blue")
+    )
 
     choice = Prompt.ask(
-        Text.from_markup("[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"),
-        choices=[str(i + 1) for i in range(len(antigravity_files))] + ["b"],
-        show_choices=False
+        Text.from_markup(
+            "[bold]Please select a credential to export or type [red]'b'[/red] to go back[/bold]"
+        ),
+        choices=[str(i + 1) for i in range(len(credentials))] + ["b"],
+        show_choices=False,
     )
 
-    if choice.lower() == 'b':
+    if choice.lower() == "b":
         return
 
     try:
         choice_index = int(choice) - 1
-        if 0 <= choice_index < len(antigravity_files):
-            cred_file = antigravity_files[choice_index]
-
-            # Load the credential
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
+        if 0 <= choice_index < len(credentials):
+            cred_info = credentials[choice_index]
 
-            # Extract metadata
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-
-            # Get credential number from filename
-            cred_number = _get_credential_number_from_filename(cred_file.name)
-
-            # Generate .env file name with credential number
-            safe_email = email.replace("@", "_at_").replace(".", "_")
-            env_filename = f"antigravity_{cred_number}_{safe_email}.env"
-            env_filepath = OAUTH_BASE_DIR / env_filename
-
-            # Build .env content using helper
-            env_lines, numbered_prefix = _build_env_export_content(
-                provider_prefix="ANTIGRAVITY",
-                cred_number=cred_number,
-                creds=creds,
-                email=email,
-                extra_fields=None,
-                include_client_creds=True
+            # Use auth class to export
+            env_path = auth_instance.export_credential_to_env(
+                cred_info["file_path"], OAUTH_BASE_DIR
             )
 
-            # Write to .env file
-            with open(env_filepath, 'w') as f:
-                f.write('\n'.join(env_lines))
-
-            success_text = Text.from_markup(
-                f"Successfully exported credential to [bold yellow]'{env_filepath}'[/bold yellow]\n\n"
-                f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
-                f"[bold]To use this credential:[/bold]\n"
-                f"1. Copy the contents to your main .env file, OR\n"
-                f"2. Source it: [bold cyan]source {env_filepath.name}[/bold cyan] (Linux/Mac)\n"
-                f"3. Or on Windows: [bold cyan]Get-Content {env_filepath.name} | ForEach-Object {{ $_ -replace '^([^#].*)$', 'set $1' }} | cmd[/bold cyan]\n\n"
-                f"[bold]To combine multiple credentials:[/bold]\n"
-                f"Copy lines from multiple .env files into one file.\n"
-                f"Each credential uses a unique number ({numbered_prefix}_*)."
-            )
-            console.print(Panel(success_text, style="bold green", title="Success"))
+            if env_path:
+                numbered_prefix = f"ANTIGRAVITY_{cred_info['number']}"
+                success_text = Text.from_markup(
+                    f"Successfully exported credential to [bold yellow]'{Path(env_path).name}'[/bold yellow]\n\n"
+                    f"[bold]Environment variable prefix:[/bold] [cyan]{numbered_prefix}_*[/cyan]\n\n"
+                    f"[bold]To use this credential:[/bold]\n"
+                    f"1. Copy the contents to your main .env file, OR\n"
+                    f"2. Source it: [bold cyan]source {Path(env_path).name}[/bold cyan] (Linux/Mac)\n"
+                    f"3. Or on Windows: [bold cyan]Get-Content {Path(env_path).name} | ForEach-Object {{ $_ -replace '^([^#].*)$', 'set $1' }} | cmd[/bold cyan]\n\n"
+                    f"[bold]To combine multiple credentials:[/bold]\n"
+                    f"Copy lines from multiple .env files into one file.\n"
+                    f"Each credential uses a unique number ({numbered_prefix}_*)."
+                )
+                console.print(Panel(success_text, style="bold green", title="Success"))
+            else:
+                console.print(
+                    Panel(
+                        "Failed to export credential", style="bold red", title="Error"
+                    )
+                )
         else:
             console.print("[bold red]Invalid choice. Please try again.[/bold red]")
     except ValueError:
-        console.print("[bold red]Invalid input. Please enter a number or 'b'.[/bold red]")
+        console.print(
+            "[bold red]Invalid input. Please enter a number or 'b'.[/bold red]"
+        )
     except Exception as e:
-        console.print(Panel(f"An error occurred during export: {e}", style="bold red", title="Error"))
-
-
-def _build_gemini_cli_env_lines(creds: dict, cred_number: int) -> list[str]:
-    """Build .env lines for a Gemini CLI credential."""
-    email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-    project_id = creds.get("_proxy_metadata", {}).get("project_id", "")
-    tier = creds.get("_proxy_metadata", {}).get("tier", "")
-    
-    extra_fields = {}
-    if project_id:
-        extra_fields["PROJECT_ID"] = project_id
-    if tier:
-        extra_fields["TIER"] = tier
-    
-    env_lines, _ = _build_env_export_content(
-        provider_prefix="GEMINI_CLI",
-        cred_number=cred_number,
-        creds=creds,
-        email=email,
-        extra_fields=extra_fields,
-        include_client_creds=True
-    )
-    return env_lines
-
-
-def _build_qwen_code_env_lines(creds: dict, cred_number: int) -> list[str]:
-    """Build .env lines for a Qwen Code credential."""
-    email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-    numbered_prefix = f"QWEN_CODE_{cred_number}"
-    
-    env_lines = [
-        f"# QWEN_CODE Credential #{cred_number} for: {email}",
-        f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
-        "",
-        f"{numbered_prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
-        f"{numbered_prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
-        f"{numbered_prefix}_EXPIRY_DATE={creds.get('expiry_date', 0)}",
-        f"{numbered_prefix}_RESOURCE_URL={creds.get('resource_url', 'https://portal.qwen.ai/v1')}",
-        f"{numbered_prefix}_EMAIL={email}",
-    ]
-    return env_lines
-
-
-def _build_iflow_env_lines(creds: dict, cred_number: int) -> list[str]:
-    """Build .env lines for an iFlow credential."""
-    email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-    numbered_prefix = f"IFLOW_{cred_number}"
-    
-    env_lines = [
-        f"# IFLOW Credential #{cred_number} for: {email}",
-        f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
-        "",
-        f"{numbered_prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
-        f"{numbered_prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
-        f"{numbered_prefix}_API_KEY={creds.get('api_key', '')}",
-        f"{numbered_prefix}_EXPIRY_DATE={creds.get('expiry_date', '')}",
-        f"{numbered_prefix}_EMAIL={email}",
-        f"{numbered_prefix}_TOKEN_TYPE={creds.get('token_type', 'Bearer')}",
-        f"{numbered_prefix}_SCOPE={creds.get('scope', 'read write')}",
-    ]
-    return env_lines
-
-
-def _build_antigravity_env_lines(creds: dict, cred_number: int) -> list[str]:
-    """Build .env lines for an Antigravity credential."""
-    email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-    
-    env_lines, _ = _build_env_export_content(
-        provider_prefix="ANTIGRAVITY",
-        cred_number=cred_number,
-        creds=creds,
-        email=email,
-        extra_fields=None,
-        include_client_creds=True
-    )
-    return env_lines
+        console.print(
+            Panel(
+                f"An error occurred during export: {e}", style="bold red", title="Error"
+            )
+        )
 
 
 async def export_all_provider_credentials(provider_name: str):
     """
     Export all credentials for a specific provider to individual .env files.
+    Uses the auth class's list_credentials() and export_credential_to_env() methods.
     """
-    provider_config = {
-        "gemini_cli": ("GEMINI_CLI", _build_gemini_cli_env_lines),
-        "qwen_code": ("QWEN_CODE", _build_qwen_code_env_lines),
-        "iflow": ("IFLOW", _build_iflow_env_lines),
-        "antigravity": ("ANTIGRAVITY", _build_antigravity_env_lines),
-    }
-    
-    if provider_name not in provider_config:
+    # Get auth instance for this provider
+    provider_factory, _ = _ensure_providers_loaded()
+    try:
+        auth_class = provider_factory.get_provider_auth_class(provider_name)
+        auth_instance = auth_class()
+    except Exception:
         console.print(f"[bold red]Unknown provider: {provider_name}[/bold red]")
         return
-    
-    prefix, build_func = provider_config[provider_name]
-    display_name = prefix.replace("_", " ").title()
-    
-    console.print(Panel(f"[bold cyan]Export All {display_name} Credentials[/bold cyan]", expand=False))
-    
-    # Find all credentials for this provider
-    cred_files = sorted(list(OAUTH_BASE_DIR.glob(f"{provider_name}_oauth_*.json")))
-    
-    if not cred_files:
-        console.print(Panel(f"No {display_name} credentials found.", style="bold red", title="No Credentials"))
+
+    display_name = provider_name.replace("_", " ").title()
+
+    console.print(
+        Panel(
+            f"[bold cyan]Export All {display_name} Credentials[/bold cyan]",
+            expand=False,
+        )
+    )
+
+    # List all credentials using auth class
+    credentials = auth_instance.list_credentials(OAUTH_BASE_DIR)
+
+    if not credentials:
+        console.print(
+            Panel(
+                f"No {display_name} credentials found.",
+                style="bold red",
+                title="No Credentials",
+            )
+        )
         return
-    
+
     exported_count = 0
-    for cred_file in cred_files:
+    for cred_info in credentials:
         try:
-            with open(cred_file, 'r') as f:
-                creds = json.load(f)
-            
-            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
-            cred_number = _get_credential_number_from_filename(cred_file.name)
-            
-            # Generate .env file name
-            safe_email = email.replace("@", "_at_").replace(".", "_")
-            env_filename = f"{provider_name}_{cred_number}_{safe_email}.env"
-            env_filepath = OAUTH_BASE_DIR / env_filename
-            
-            # Build and write .env content
-            env_lines = build_func(creds, cred_number)
-            with open(env_filepath, 'w') as f:
-                f.write('\n'.join(env_lines))
-            
-            console.print(f"  ✓ Exported [cyan]{cred_file.name}[/cyan] → [yellow]{env_filename}[/yellow]")
-            exported_count += 1
-            
+            # Use auth class to export
+            env_path = auth_instance.export_credential_to_env(
+                cred_info["file_path"], OAUTH_BASE_DIR
+            )
+
+            if env_path:
+                console.print(
+                    f"  ✓ Exported [cyan]{Path(cred_info['file_path']).name}[/cyan] → [yellow]{Path(env_path).name}[/yellow]"
+                )
+                exported_count += 1
+            else:
+                console.print(
+                    f"  ✗ Failed to export {Path(cred_info['file_path']).name}"
+                )
+
         except Exception as e:
-            console.print(f"  ✗ Failed to export {cred_file.name}: {e}")
-    
-    console.print(Panel(
-        f"Successfully exported {exported_count}/{len(cred_files)} {display_name} credentials to individual .env files.",
-        style="bold green", title="Export Complete"
-    ))
+            console.print(
+                f"  ✗ Failed to export {Path(cred_info['file_path']).name}: {e}"
+            )
+
+    console.print(
+        Panel(
+            f"Successfully exported {exported_count}/{len(credentials)} {display_name} credentials to individual .env files.",
+            style="bold green",
+            title="Export Complete",
+        )
+    )
 
 
 async def combine_provider_credentials(provider_name: str):
     """
     Combine all credentials for a specific provider into a single .env file.
+    Uses the auth class's list_credentials() and build_env_lines() methods.
     """
-    provider_config = {
-        "gemini_cli": ("GEMINI_CLI", _build_gemini_cli_env_lines),
-        "qwen_code": ("QWEN_CODE", _build_qwen_code_env_lines),
-        "iflow": ("IFLOW", _build_iflow_env_lines),
-        "antigravity": ("ANTIGRAVITY", _build_antigravity_env_lines),
-    }
-    
-    if provider_name not in provider_config:
+    # Get auth instance for this provider
+    provider_factory, _ = _ensure_providers_loaded()
+    try:
+        auth_class = provider_factory.get_provider_auth_class(provider_name)
+        auth_instance = auth_class()
+    except Exception:
         console.print(f"[bold red]Unknown provider: {provider_name}[/bold red]")
         return
-    
-    prefix, build_func = provider_config[provider_name]
-    display_name = prefix.replace("_", " ").title()
-    
-    console.print(Panel(f"[bold cyan]Combine All {display_name} Credentials[/bold cyan]", expand=False))
-    
-    # Find all credentials for this provider
-    cred_files = sorted(list(OAUTH_BASE_DIR.glob(f"{provider_name}_oauth_*.json")))
-    
-    if not cred_files:
-        console.print(Panel(f"No {display_name} credentials found.", style="bold red", title="No Credentials"))
+
+    display_name = provider_name.replace("_", " ").title()
+
+    console.print(
+        Panel(
+            f"[bold cyan]Combine All {display_name} Credentials[/bold cyan]",
+            expand=False,
+        )
+    )
+
+    # List all credentials using auth class
+    credentials = auth_instance.list_credentials(OAUTH_BASE_DIR)
+
+    if not credentials:
+        console.print(
+            Panel(
+                f"No {display_name} credentials found.",
+                style="bold red",
+                title="No Credentials",
+            )
+        )
         return
-    
+
     combined_lines = [
         f"# Combined {display_name} Credentials",
         f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
-        f"# Total credentials: {len(cred_files)}",
+        f"# Total credentials: {len(credentials)}",
         "#",
         "# Copy all lines below into your main .env file",
         "",
     ]
-    
+
     combined_count = 0
-    for cred_file in cred_files:
+    for cred_info in credentials:
         try:
-            with open(cred_file, 'r') as f:
+            # Load credential file
+            with open(cred_info["file_path"], "r") as f:
                 creds = json.load(f)
-            
-            cred_number = _get_credential_number_from_filename(cred_file.name)
-            env_lines = build_func(creds, cred_number)
-            
+
+            # Use auth class to build env lines
+            env_lines = auth_instance.build_env_lines(creds, cred_info["number"])
+
             combined_lines.extend(env_lines)
             combined_lines.append("")  # Blank line between credentials
             combined_count += 1
-            
+
         except Exception as e:
-            console.print(f"  ✗ Failed to process {cred_file.name}: {e}")
-    
+            console.print(
+                f"  ✗ Failed to process {Path(cred_info['file_path']).name}: {e}"
+            )
+
     # Write combined file
     combined_filename = f"{provider_name}_all_combined.env"
     combined_filepath = OAUTH_BASE_DIR / combined_filename
-    
-    with open(combined_filepath, 'w') as f:
-        f.write('\n'.join(combined_lines))
-    
-    console.print(Panel(
-        Text.from_markup(
-            f"Successfully combined {combined_count} {display_name} credentials into:\n"
-            f"[bold yellow]{combined_filepath}[/bold yellow]\n\n"
-            f"[bold]To use:[/bold] Copy the contents into your main .env file."
-        ),
-        style="bold green", title="Combine Complete"
-    ))
+
+    with open(combined_filepath, "w") as f:
+        f.write("\n".join(combined_lines))
+
+    console.print(
+        Panel(
+            Text.from_markup(
+                f"Successfully combined {combined_count} {display_name} credentials into:\n"
+                f"[bold yellow]{combined_filepath}[/bold yellow]\n\n"
+                f"[bold]To use:[/bold] Copy the contents into your main .env file."
+            ),
+            style="bold green",
+            title="Combine Complete",
+        )
+    )
 
 
 async def combine_all_credentials():
     """
     Combine ALL credentials from ALL providers into a single .env file.
+    Uses auth class list_credentials() and build_env_lines() methods.
     """
-    console.print(Panel("[bold cyan]Combine All Provider Credentials[/bold cyan]", expand=False))
-    
-    provider_config = {
-        "gemini_cli": ("GEMINI_CLI", _build_gemini_cli_env_lines),
-        "qwen_code": ("QWEN_CODE", _build_qwen_code_env_lines),
-        "iflow": ("IFLOW", _build_iflow_env_lines),
-        "antigravity": ("ANTIGRAVITY", _build_antigravity_env_lines),
-    }
-    
+    console.print(
+        Panel("[bold cyan]Combine All Provider Credentials[/bold cyan]", expand=False)
+    )
+
+    # List of providers that support OAuth credentials
+    oauth_providers = ["gemini_cli", "qwen_code", "iflow", "antigravity"]
+
+    provider_factory, _ = _ensure_providers_loaded()
+
     combined_lines = [
         "# Combined All Provider Credentials",
         f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
@@ -984,63 +918,83 @@ async def combine_all_credentials():
         "# Copy all lines below into your main .env file",
         "",
     ]
-    
+
     total_count = 0
     provider_counts = {}
-    
-    for provider_name, (prefix, build_func) in provider_config.items():
-        cred_files = sorted(list(OAUTH_BASE_DIR.glob(f"{provider_name}_oauth_*.json")))
-        
-        if not cred_files:
+
+    for provider_name in oauth_providers:
+        try:
+            auth_class = provider_factory.get_provider_auth_class(provider_name)
+            auth_instance = auth_class()
+        except Exception:
+            continue  # Skip providers that don't have auth classes
+
+        credentials = auth_instance.list_credentials(OAUTH_BASE_DIR)
+
+        if not credentials:
             continue
-        
-        display_name = prefix.replace("_", " ").title()
+
+        display_name = provider_name.replace("_", " ").title()
         combined_lines.append(f"# ===== {display_name} Credentials =====")
         combined_lines.append("")
-        
+
         provider_count = 0
-        for cred_file in cred_files:
+        for cred_info in credentials:
             try:
-                with open(cred_file, 'r') as f:
+                # Load credential file
+                with open(cred_info["file_path"], "r") as f:
                     creds = json.load(f)
-                
-                cred_number = _get_credential_number_from_filename(cred_file.name)
-                env_lines = build_func(creds, cred_number)
-                
+
+                # Use auth class to build env lines
+                env_lines = auth_instance.build_env_lines(creds, cred_info["number"])
+
                 combined_lines.extend(env_lines)
                 combined_lines.append("")
                 provider_count += 1
                 total_count += 1
-                
+
             except Exception as e:
-                console.print(f"  ✗ Failed to process {cred_file.name}: {e}")
-        
+                console.print(
+                    f"  ✗ Failed to process {Path(cred_info['file_path']).name}: {e}"
+                )
+
         provider_counts[display_name] = provider_count
-    
+
     if total_count == 0:
-        console.print(Panel("No credentials found to combine.", style="bold red", title="No Credentials"))
+        console.print(
+            Panel(
+                "No credentials found to combine.",
+                style="bold red",
+                title="No Credentials",
+            )
+        )
         return
-    
+
     # Write combined file
     combined_filename = "all_providers_combined.env"
     combined_filepath = OAUTH_BASE_DIR / combined_filename
-    
-    with open(combined_filepath, 'w') as f:
-        f.write('\n'.join(combined_lines))
-    
+
+    with open(combined_filepath, "w") as f:
+        f.write("\n".join(combined_lines))
+
     # Build summary
-    summary_lines = [f"  • {name}: {count} credential(s)" for name, count in provider_counts.items()]
+    summary_lines = [
+        f"  • {name}: {count} credential(s)" for name, count in provider_counts.items()
+    ]
     summary = "\n".join(summary_lines)
-    
-    console.print(Panel(
-        Text.from_markup(
-            f"Successfully combined {total_count} credentials from {len(provider_counts)} providers:\n"
-            f"{summary}\n\n"
-            f"[bold]Output file:[/bold] [yellow]{combined_filepath}[/yellow]\n\n"
-            f"[bold]To use:[/bold] Copy the contents into your main .env file."
-        ),
-        style="bold green", title="Combine Complete"
-    ))
+
+    console.print(
+        Panel(
+            Text.from_markup(
+                f"Successfully combined {total_count} credentials from {len(provider_counts)} providers:\n"
+                f"{summary}\n\n"
+                f"[bold]Output file:[/bold] [yellow]{combined_filepath}[/yellow]\n\n"
+                f"[bold]To use:[/bold] Copy the contents into your main .env file."
+            ),
+            style="bold green",
+            title="Combine Complete",
+        )
+    )
 
 
 async def export_credentials_submenu():
@@ -1049,40 +1003,65 @@ async def export_credentials_submenu():
     """
     while True:
         clear_screen()
-        console.print(Panel("[bold cyan]Export Credentials to .env[/bold cyan]", title="--- API Key Proxy ---", expand=False))
-        
-        console.print(Panel(
-            Text.from_markup(
-                "[bold]Individual Exports:[/bold]\n"
-                "1. Export Gemini CLI credential\n"
-                "2. Export Qwen Code credential\n"
-                "3. Export iFlow credential\n"
-                "4. Export Antigravity credential\n"
-                "\n"
-                "[bold]Bulk Exports (per provider):[/bold]\n"
-                "5. Export ALL Gemini CLI credentials\n"
-                "6. Export ALL Qwen Code credentials\n"
-                "7. Export ALL iFlow credentials\n"
-                "8. Export ALL Antigravity credentials\n"
-                "\n"
-                "[bold]Combine Credentials:[/bold]\n"
-                "9. Combine all Gemini CLI into one file\n"
-                "10. Combine all Qwen Code into one file\n"
-                "11. Combine all iFlow into one file\n"
-                "12. Combine all Antigravity into one file\n"
-                "13. Combine ALL providers into one file"
-            ),
-            title="Choose export option",
-            style="bold blue"
-        ))
+        console.print(
+            Panel(
+                "[bold cyan]Export Credentials to .env[/bold cyan]",
+                title="--- API Key Proxy ---",
+                expand=False,
+            )
+        )
+
+        console.print(
+            Panel(
+                Text.from_markup(
+                    "[bold]Individual Exports:[/bold]\n"
+                    "1. Export Gemini CLI credential\n"
+                    "2. Export Qwen Code credential\n"
+                    "3. Export iFlow credential\n"
+                    "4. Export Antigravity credential\n"
+                    "\n"
+                    "[bold]Bulk Exports (per provider):[/bold]\n"
+                    "5. Export ALL Gemini CLI credentials\n"
+                    "6. Export ALL Qwen Code credentials\n"
+                    "7. Export ALL iFlow credentials\n"
+                    "8. Export ALL Antigravity credentials\n"
+                    "\n"
+                    "[bold]Combine Credentials:[/bold]\n"
+                    "9. Combine all Gemini CLI into one file\n"
+                    "10. Combine all Qwen Code into one file\n"
+                    "11. Combine all iFlow into one file\n"
+                    "12. Combine all Antigravity into one file\n"
+                    "13. Combine ALL providers into one file"
+                ),
+                title="Choose export option",
+                style="bold blue",
+            )
+        )
 
         export_choice = Prompt.ask(
-            Text.from_markup("[bold]Please select an option or type [red]'b'[/red] to go back[/bold]"),
-            choices=["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "b"],
-            show_choices=False
+            Text.from_markup(
+                "[bold]Please select an option or type [red]'b'[/red] to go back[/bold]"
+            ),
+            choices=[
+                "1",
+                "2",
+                "3",
+                "4",
+                "5",
+                "6",
+                "7",
+                "8",
+                "9",
+                "10",
+                "11",
+                "12",
+                "13",
+                "b",
+            ],
+            show_choices=False,
         )
 
-        if export_choice.lower() == 'b':
+        if export_choice.lower() == "b":
             break
 
         # Individual exports
@@ -1146,39 +1125,53 @@ async def export_credentials_submenu():
 async def main(clear_on_start=True):
     """
     An interactive CLI tool to add new credentials.
-    
+
     Args:
-        clear_on_start: If False, skip initial screen clear (used when called from launcher 
+        clear_on_start: If False, skip initial screen clear (used when called from launcher
                        to preserve the loading screen)
     """
     ensure_env_defaults()
-    
+
     # Only show header if we're clearing (standalone mode)
     if clear_on_start:
-        console.print(Panel("[bold cyan]Interactive Credential Setup[/bold cyan]", title="--- API Key Proxy ---", expand=False))
-    
+        console.print(
+            Panel(
+                "[bold cyan]Interactive Credential Setup[/bold cyan]",
+                title="--- API Key Proxy ---",
+                expand=False,
+            )
+        )
+
     while True:
         # Clear screen between menu selections for cleaner UX
         clear_screen()
-        console.print(Panel("[bold cyan]Interactive Credential Setup[/bold cyan]", title="--- API Key Proxy ---", expand=False))
-        
-        console.print(Panel(
-            Text.from_markup(
-                "1. Add OAuth Credential\n"
-                "2. Add API Key\n"
-                "3. Export Credentials"
-            ),
-            title="Choose credential type",
-            style="bold blue"
-        ))
+        console.print(
+            Panel(
+                "[bold cyan]Interactive Credential Setup[/bold cyan]",
+                title="--- API Key Proxy ---",
+                expand=False,
+            )
+        )
+
+        console.print(
+            Panel(
+                Text.from_markup(
+                    "1. Add OAuth Credential\n2. Add API Key\n3. Export Credentials"
+                ),
+                title="Choose credential type",
+                style="bold blue",
+            )
+        )
 
         setup_type = Prompt.ask(
-            Text.from_markup("[bold]Please select an option or type [red]'q'[/red] to quit[/bold]"),
+            Text.from_markup(
+                "[bold]Please select an option or type [red]'q'[/red] to quit[/bold]"
+            ),
             choices=["1", "2", "3", "q"],
-            show_choices=False
+            show_choices=False,
         )
 
-        if setup_type.lower() == 'q':
+        if setup_type.lower() == "q":
             break
 
         if setup_type == "1":
@@ -1190,69 +1183,88 @@ async def main(clear_on_start=True):
                 "iflow": "iFlow (OAuth - also supports API keys)",
                 "antigravity": "Antigravity (OAuth)",
             }
-            
+
             provider_text = Text()
             for i, provider in enumerate(available_providers):
-                display_name = oauth_friendly_names.get(provider, provider.replace('_', ' ').title())
+                display_name = oauth_friendly_names.get(
+                    provider, provider.replace("_", " ").title()
+                )
                 provider_text.append(f"  {i + 1}. {display_name}\n")
-            
-            console.print(Panel(provider_text, title="Available Providers for OAuth", style="bold blue"))
+
+            console.print(
+                Panel(
+                    provider_text,
+                    title="Available Providers for OAuth",
+                    style="bold blue",
+                )
+            )
 
             choice = Prompt.ask(
-                Text.from_markup("[bold]Please select a provider or type [red]'b'[/red] to go back[/bold]"),
+                Text.from_markup(
+                    "[bold]Please select a provider or type [red]'b'[/red] to go back[/bold]"
+                ),
                 choices=[str(i + 1) for i in range(len(available_providers))] + ["b"],
-                show_choices=False
+                show_choices=False,
             )
 
-            if choice.lower() == 'b':
+            if choice.lower() == "b":
                 continue
-            
+
             try:
                 choice_index = int(choice) - 1
                 if 0 <= choice_index < len(available_providers):
                     provider_name = available_providers[choice_index]
-                    display_name = oauth_friendly_names.get(provider_name, provider_name.replace('_', ' ').title())
-                    console.print(f"\nStarting OAuth setup for [bold cyan]{display_name}[/bold cyan]...")
+                    display_name = oauth_friendly_names.get(
+                        provider_name, provider_name.replace("_", " ").title()
+                    )
+                    console.print(
+                        f"\nStarting OAuth setup for [bold cyan]{display_name}[/bold cyan]..."
+                    )
                     await setup_new_credential(provider_name)
                     # Don't clear after OAuth - user needs to see full flow
                     console.print("\n[dim]Press Enter to return to main menu...[/dim]")
                     input()
                 else:
-                    console.print("[bold red]Invalid choice. Please try again.[/bold red]")
+                    console.print(
+                        "[bold red]Invalid choice. Please try again.[/bold red]"
+                    )
                     await asyncio.sleep(1.5)
             except ValueError:
-                console.print("[bold red]Invalid input. Please enter a number or 'b'.[/bold red]")
+                console.print(
+                    "[bold red]Invalid input. Please enter a number or 'b'.[/bold red]"
+                )
                 await asyncio.sleep(1.5)
 
         elif setup_type == "2":
             await setup_api_key()
-            #console.print("\n[dim]Press Enter to return to main menu...[/dim]")
-            #input()
+            # console.print("\n[dim]Press Enter to return to main menu...[/dim]")
+            # input()
 
         elif setup_type == "3":
             await export_credentials_submenu()
 
+
 def run_credential_tool(from_launcher=False):
     """
     Entry point for credential tool.
-    
+
     Args:
         from_launcher: If True, skip loading screen (launcher already showed it)
     """
     # Check if we need to show loading screen
     if not from_launcher:
         # Standalone mode - show full loading UI
-        os.system('cls' if os.name == 'nt' else 'clear')
-        
+        os.system("cls" if os.name == "nt" else "clear")
+
         _start_time = time.time()
-        
+
         # Phase 1: Show initial message
         print("━" * 70)
         print("Interactive Credential Setup Tool")
         print("GitHub: https://github.com/Mirrowel/LLM-API-Key-Proxy")
         print("━" * 70)
         print("Loading credential management components...")
-        
+
         # Phase 2: Load dependencies with spinner
         with console.status("Loading authentication providers...", spinner="dots"):
             _ensure_providers_loaded()
@@ -1261,14 +1273,16 @@ def run_credential_tool(from_launcher=False):
         with console.status("Initializing credential tool...", spinner="dots"):
             time.sleep(0.2)  # Brief pause for UI consistency
         console.print("✓ Credential tool initialized")
-        
+
         _elapsed = time.time() - _start_time
         _, PROVIDER_PLUGINS = _ensure_providers_loaded()
-        print(f"✓ Tool ready in {_elapsed:.2f}s ({len(PROVIDER_PLUGINS)} providers available)")
-        
+        print(
+            f"✓ Tool ready in {_elapsed:.2f}s ({len(PROVIDER_PLUGINS)} providers available)"
+        )
+
         # Small delay to let user see the ready message
         time.sleep(0.5)
-    
+
     # Run the main async event loop
     # If from launcher, don't clear screen at start to preserve loading messages
     try:

src/rotator_library/providers/antigravity_auth_base.py

@@ -1,16 +1,36 @@
 # src/rotator_library/providers/antigravity_auth_base.py
 
+import asyncio
+import json
+import logging
+import os
+from pathlib import Path
+from typing import Any, Dict, Optional, List
+
+import httpx
+
 from .google_oauth_base import GoogleOAuthBase
 
+lib_logger = logging.getLogger("rotator_library")
+
+# Code Assist endpoint for project discovery
+CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com/v1internal"
+
+
 class AntigravityAuthBase(GoogleOAuthBase):
     """
     Antigravity OAuth2 authentication implementation.
-    
+
     Inherits all OAuth functionality from GoogleOAuthBase with Antigravity-specific configuration.
     Uses Antigravity's OAuth credentials and includes additional scopes for cclog and experimentsandconfigs.
+
+    Also provides project/tier discovery functionality that runs during authentication,
+    ensuring credentials have their tier and project_id cached before any API requests.
     """
-    
-    CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"
+
+    CLIENT_ID = (
+        "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"
+    )
     CLIENT_SECRET = "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"
     OAUTH_SCOPES = [
         "https://www.googleapis.com/auth/cloud-platform",
@@ -22,3 +42,600 @@ class AntigravityAuthBase(GoogleOAuthBase):
     ENV_PREFIX = "ANTIGRAVITY"
     CALLBACK_PORT = 51121
     CALLBACK_PATH = "/oauthcallback"
+
+    def __init__(self):
+        super().__init__()
+        # Project and tier caches - shared between auth base and provider
+        self.project_id_cache: Dict[str, str] = {}
+        self.project_tier_cache: Dict[str, str] = {}
+
+    # =========================================================================
+    # POST-AUTH DISCOVERY HOOK
+    # =========================================================================
+
+    async def _post_auth_discovery(
+        self, credential_path: str, access_token: str
+    ) -> None:
+        """
+        Discover and cache tier/project information immediately after OAuth authentication.
+
+        This is called by GoogleOAuthBase._perform_interactive_oauth() after successful auth,
+        ensuring tier and project_id are cached during the authentication flow rather than
+        waiting for the first API request.
+
+        Args:
+            credential_path: Path to the credential file
+            access_token: The newly obtained access token
+        """
+        lib_logger.debug(
+            f"Starting post-auth discovery for Antigravity credential: {Path(credential_path).name}"
+        )
+
+        # Skip if already discovered (shouldn't happen during fresh auth, but be defensive)
+        if (
+            credential_path in self.project_id_cache
+            and credential_path in self.project_tier_cache
+        ):
+            lib_logger.debug(
+                f"Tier and project already cached for {Path(credential_path).name}, skipping discovery"
+            )
+            return
+
+        # Call _discover_project_id which handles tier/project discovery and persistence
+        # Pass empty litellm_params since we're in auth context (no model-specific overrides)
+        project_id = await self._discover_project_id(
+            credential_path, access_token, litellm_params={}
+        )
+
+        tier = self.project_tier_cache.get(credential_path, "unknown")
+        lib_logger.info(
+            f"Post-auth discovery complete for {Path(credential_path).name}: "
+            f"tier={tier}, project={project_id}"
+        )
+
+    # =========================================================================
+    # PROJECT ID DISCOVERY
+    # =========================================================================
+
+    async def _discover_project_id(
+        self, credential_path: str, access_token: str, litellm_params: Dict[str, Any]
+    ) -> str:
+        """
+        Discovers the Google Cloud Project ID, with caching and onboarding for new accounts.
+
+        This follows the official Gemini CLI discovery flow adapted for Antigravity:
+        1. Check in-memory cache
+        2. Check configured project_id override (litellm_params or env var)
+        3. Check persisted project_id in credential file
+        4. Call loadCodeAssist to check if user is already known (has currentTier)
+           - If currentTier exists AND cloudaicompanionProject returned: use server's project
+           - If no currentTier: user needs onboarding
+        5. Onboard user (FREE tier: pass cloudaicompanionProject=None for server-managed)
+        6. Fallback to GCP Resource Manager project listing
+
+        Note: Unlike GeminiCli, Antigravity doesn't use tier-based credential prioritization,
+        but we still cache tier info for debugging and consistency.
+        """
+        lib_logger.debug(
+            f"Starting Antigravity project discovery for credential: {credential_path}"
+        )
+
+        # Check in-memory cache first
+        if credential_path in self.project_id_cache:
+            cached_project = self.project_id_cache[credential_path]
+            lib_logger.debug(f"Using cached project ID: {cached_project}")
+            return cached_project
+
+        # Check for configured project ID override (from litellm_params or env var)
+        configured_project_id = (
+            litellm_params.get("project_id")
+            or os.getenv("ANTIGRAVITY_PROJECT_ID")
+            or os.getenv("GOOGLE_CLOUD_PROJECT")
+        )
+        if configured_project_id:
+            lib_logger.debug(
+                f"Found configured project_id override: {configured_project_id}"
+            )
+
+        # Load credentials from file to check for persisted project_id and tier
+        # Skip for env:// paths (environment-based credentials don't persist to files)
+        credential_index = self._parse_env_credential_path(credential_path)
+        if credential_index is None:
+            # Only try to load from file if it's not an env:// path
+            try:
+                with open(credential_path, "r") as f:
+                    creds = json.load(f)
+
+                metadata = creds.get("_proxy_metadata", {})
+                persisted_project_id = metadata.get("project_id")
+                persisted_tier = metadata.get("tier")
+
+                if persisted_project_id:
+                    lib_logger.info(
+                        f"Loaded persisted project ID from credential file: {persisted_project_id}"
+                    )
+                    self.project_id_cache[credential_path] = persisted_project_id
+
+                    # Also load tier if available (for debugging/logging purposes)
+                    if persisted_tier:
+                        self.project_tier_cache[credential_path] = persisted_tier
+                        lib_logger.debug(f"Loaded persisted tier: {persisted_tier}")
+
+                    return persisted_project_id
+            except (FileNotFoundError, json.JSONDecodeError, KeyError) as e:
+                lib_logger.debug(f"Could not load persisted project ID from file: {e}")
+
+        lib_logger.debug(
+            "No cached or configured project ID found, initiating discovery..."
+        )
+        headers = {
+            "Authorization": f"Bearer {access_token}",
+            "Content-Type": "application/json",
+        }
+
+        discovered_project_id = None
+        discovered_tier = None
+
+        async with httpx.AsyncClient() as client:
+            # 1. Try discovery endpoint with loadCodeAssist
+            lib_logger.debug(
+                "Attempting project discovery via Code Assist loadCodeAssist endpoint..."
+            )
+            try:
+                # Build metadata - include duetProject only if we have a configured project
+                core_client_metadata = {
+                    "ideType": "IDE_UNSPECIFIED",
+                    "platform": "PLATFORM_UNSPECIFIED",
+                    "pluginType": "GEMINI",
+                }
+                if configured_project_id:
+                    core_client_metadata["duetProject"] = configured_project_id
+
+                # Build load request - pass configured_project_id if available, otherwise None
+                load_request = {
+                    "cloudaicompanionProject": configured_project_id,  # Can be None
+                    "metadata": core_client_metadata,
+                }
+
+                lib_logger.debug(
+                    f"Sending loadCodeAssist request with cloudaicompanionProject={configured_project_id}"
+                )
+                response = await client.post(
+                    f"{CODE_ASSIST_ENDPOINT}:loadCodeAssist",
+                    headers=headers,
+                    json=load_request,
+                    timeout=20,
+                )
+                response.raise_for_status()
+                data = response.json()
+
+                # Log full response for debugging
+                lib_logger.debug(
+                    f"loadCodeAssist full response keys: {list(data.keys())}"
+                )
+
+                # Extract tier information
+                allowed_tiers = data.get("allowedTiers", [])
+                current_tier = data.get("currentTier")
+
+                lib_logger.debug(f"=== Tier Information ===")
+                lib_logger.debug(f"currentTier: {current_tier}")
+                lib_logger.debug(f"allowedTiers count: {len(allowed_tiers)}")
+                for i, tier in enumerate(allowed_tiers):
+                    tier_id = tier.get("id", "unknown")
+                    is_default = tier.get("isDefault", False)
+                    user_defined = tier.get("userDefinedCloudaicompanionProject", False)
+                    lib_logger.debug(
+                        f"  Tier {i + 1}: id={tier_id}, isDefault={is_default}, userDefinedProject={user_defined}"
+                    )
+                lib_logger.debug(f"========================")
+
+                # Determine the current tier ID
+                current_tier_id = None
+                if current_tier:
+                    current_tier_id = current_tier.get("id")
+                    lib_logger.debug(f"User has currentTier: {current_tier_id}")
+
+                # Check if user is already known to server (has currentTier)
+                if current_tier_id:
+                    # User is already onboarded - check for project from server
+                    server_project = data.get("cloudaicompanionProject")
+
+                    # Check if this tier requires user-defined project (paid tiers)
+                    requires_user_project = any(
+                        t.get("id") == current_tier_id
+                        and t.get("userDefinedCloudaicompanionProject", False)
+                        for t in allowed_tiers
+                    )
+                    is_free_tier = current_tier_id == "free-tier"
+
+                    if server_project:
+                        # Server returned a project - use it (server wins)
+                        project_id = server_project
+                        lib_logger.debug(f"Server returned project: {project_id}")
+                    elif configured_project_id:
+                        # No server project but we have configured one - use it
+                        project_id = configured_project_id
+                        lib_logger.debug(
+                            f"No server project, using configured: {project_id}"
+                        )
+                    elif is_free_tier:
+                        # Free tier user without server project - try onboarding
+                        lib_logger.debug(
+                            "Free tier user with currentTier but no project - will try onboarding"
+                        )
+                        project_id = None
+                    elif requires_user_project:
+                        # Paid tier requires a project ID to be set
+                        raise ValueError(
+                            f"Paid tier '{current_tier_id}' requires setting ANTIGRAVITY_PROJECT_ID environment variable."
+                        )
+                    else:
+                        # Unknown tier without project - proceed to onboarding
+                        lib_logger.warning(
+                            f"Tier '{current_tier_id}' has no project and none configured - will try onboarding"
+                        )
+                        project_id = None
+
+                    if project_id:
+                        # Cache tier info
+                        self.project_tier_cache[credential_path] = current_tier_id
+                        discovered_tier = current_tier_id
+
+                        # Log appropriately based on tier
+                        is_paid = current_tier_id and current_tier_id not in [
+                            "free-tier",
+                            "legacy-tier",
+                            "unknown",
+                        ]
+                        if is_paid:
+                            lib_logger.info(
+                                f"Using Antigravity paid tier '{current_tier_id}' with project: {project_id}"
+                            )
+                        else:
+                            lib_logger.info(
+                                f"Discovered Antigravity project ID via loadCodeAssist: {project_id}"
+                            )
+
+                        self.project_id_cache[credential_path] = project_id
+                        discovered_project_id = project_id
+
+                        # Persist to credential file
+                        await self._persist_project_metadata(
+                            credential_path, project_id, discovered_tier
+                        )
+
+                        return project_id
+
+                # 2. User needs onboarding - no currentTier or no project found
+                lib_logger.info(
+                    "No existing Antigravity session found (no currentTier), attempting to onboard user..."
+                )
+
+                # Determine which tier to onboard with
+                onboard_tier = None
+                for tier in allowed_tiers:
+                    if tier.get("isDefault"):
+                        onboard_tier = tier
+                        break
+
+                # Fallback to legacy tier if no default
+                if not onboard_tier and allowed_tiers:
+                    for tier in allowed_tiers:
+                        if tier.get("id") == "legacy-tier":
+                            onboard_tier = tier
+                            break
+                    if not onboard_tier:
+                        onboard_tier = allowed_tiers[0]
+
+                if not onboard_tier:
+                    raise ValueError("No onboarding tiers available from server")
+
+                tier_id = onboard_tier.get("id", "free-tier")
+                requires_user_project = onboard_tier.get(
+                    "userDefinedCloudaicompanionProject", False
+                )
+
+                lib_logger.debug(
+                    f"Onboarding with tier: {tier_id}, requiresUserProject: {requires_user_project}"
+                )
+
+                # Build onboard request based on tier type
+                # FREE tier: cloudaicompanionProject = None (server-managed)
+                # PAID tier: cloudaicompanionProject = configured_project_id
+                is_free_tier = tier_id == "free-tier"
+
+                if is_free_tier:
+                    # Free tier uses server-managed project
+                    onboard_request = {
+                        "tierId": tier_id,
+                        "cloudaicompanionProject": None,  # Server will create/manage
+                        "metadata": core_client_metadata,
+                    }
+                    lib_logger.debug(
+                        "Free tier onboarding: using server-managed project"
+                    )
+                else:
+                    # Paid/legacy tier requires user-provided project
+                    if not configured_project_id and requires_user_project:
+                        raise ValueError(
+                            f"Tier '{tier_id}' requires setting ANTIGRAVITY_PROJECT_ID environment variable."
+                        )
+                    onboard_request = {
+                        "tierId": tier_id,
+                        "cloudaicompanionProject": configured_project_id,
+                        "metadata": {
+                            **core_client_metadata,
+                            "duetProject": configured_project_id,
+                        }
+                        if configured_project_id
+                        else core_client_metadata,
+                    }
+                    lib_logger.debug(
+                        f"Paid tier onboarding: using project {configured_project_id}"
+                    )
+
+                lib_logger.debug("Initiating onboardUser request...")
+                lro_response = await client.post(
+                    f"{CODE_ASSIST_ENDPOINT}:onboardUser",
+                    headers=headers,
+                    json=onboard_request,
+                    timeout=30,
+                )
+                lro_response.raise_for_status()
+                lro_data = lro_response.json()
+                lib_logger.debug(
+                    f"Initial onboarding response: done={lro_data.get('done')}"
+                )
+
+                # Poll for onboarding completion (up to 5 minutes)
+                for i in range(150):  # 150 × 2s = 5 minutes
+                    if lro_data.get("done"):
+                        lib_logger.debug(
+                            f"Onboarding completed after {i} polling attempts"
+                        )
+                        break
+                    await asyncio.sleep(2)
+                    if (i + 1) % 15 == 0:  # Log every 30 seconds
+                        lib_logger.info(
+                            f"Still waiting for onboarding completion... ({(i + 1) * 2}s elapsed)"
+                        )
+                    lib_logger.debug(
+                        f"Polling onboarding status... (Attempt {i + 1}/150)"
+                    )
+                    lro_response = await client.post(
+                        f"{CODE_ASSIST_ENDPOINT}:onboardUser",
+                        headers=headers,
+                        json=onboard_request,
+                        timeout=30,
+                    )
+                    lro_response.raise_for_status()
+                    lro_data = lro_response.json()
+
+                if not lro_data.get("done"):
+                    lib_logger.error("Onboarding process timed out after 5 minutes")
+                    raise ValueError(
+                        "Onboarding process timed out after 5 minutes. Please try again or contact support."
+                    )
+
+                # Extract project ID from LRO response
+                # Note: onboardUser returns response.cloudaicompanionProject as an object with .id
+                lro_response_data = lro_data.get("response", {})
+                lro_project_obj = lro_response_data.get("cloudaicompanionProject", {})
+                project_id = (
+                    lro_project_obj.get("id")
+                    if isinstance(lro_project_obj, dict)
+                    else None
+                )
+
+                # Fallback to configured project if LRO didn't return one
+                if not project_id and configured_project_id:
+                    project_id = configured_project_id
+                    lib_logger.debug(
+                        f"LRO didn't return project, using configured: {project_id}"
+                    )
+
+                if not project_id:
+                    lib_logger.error(
+                        "Onboarding completed but no project ID in response and none configured"
+                    )
+                    raise ValueError(
+                        "Onboarding completed, but no project ID was returned. "
+                        "For paid tiers, set ANTIGRAVITY_PROJECT_ID environment variable."
+                    )
+
+                lib_logger.debug(
+                    f"Successfully extracted project ID from onboarding response: {project_id}"
+                )
+
+                # Cache tier info
+                self.project_tier_cache[credential_path] = tier_id
+                discovered_tier = tier_id
+                lib_logger.debug(f"Cached tier information: {tier_id}")
+
+                # Log concise message based on tier
+                is_paid = tier_id and tier_id not in ["free-tier", "legacy-tier"]
+                if is_paid:
+                    lib_logger.info(
+                        f"Using Antigravity paid tier '{tier_id}' with project: {project_id}"
+                    )
+                else:
+                    lib_logger.info(
+                        f"Successfully onboarded user and discovered project ID: {project_id}"
+                    )
+
+                self.project_id_cache[credential_path] = project_id
+                discovered_project_id = project_id
+
+                # Persist to credential file
+                await self._persist_project_metadata(
+                    credential_path, project_id, discovered_tier
+                )
+
+                return project_id
+
+            except httpx.HTTPStatusError as e:
+                error_body = ""
+                try:
+                    error_body = e.response.text
+                except Exception:
+                    pass
+                if e.response.status_code == 403:
+                    lib_logger.error(
+                        f"Antigravity Code Assist API access denied (403). Response: {error_body}"
+                    )
+                    lib_logger.error(
+                        "Possible causes: 1) cloudaicompanion.googleapis.com API not enabled, 2) Wrong project ID for paid tier, 3) Account lacks permissions"
+                    )
+                elif e.response.status_code == 404:
+                    lib_logger.warning(
+                        f"Antigravity Code Assist endpoint not found (404). Falling back to project listing."
+                    )
+                elif e.response.status_code == 412:
+                    # Precondition Failed - often means wrong project for free tier onboarding
+                    lib_logger.error(
+                        f"Precondition failed (412): {error_body}. This may mean the project ID is incompatible with the selected tier."
+                    )
+                else:
+                    lib_logger.warning(
+                        f"Antigravity onboarding/discovery failed with status {e.response.status_code}: {error_body}. Falling back to project listing."
+                    )
+            except httpx.RequestError as e:
+                lib_logger.warning(
+                    f"Antigravity onboarding/discovery network error: {e}. Falling back to project listing."
+                )
+
+        # 3. Fallback to listing all available GCP projects (last resort)
+        lib_logger.debug(
+            "Attempting to discover project via GCP Resource Manager API..."
+        )
+        try:
+            async with httpx.AsyncClient() as client:
+                lib_logger.debug(
+                    "Querying Cloud Resource Manager for available projects..."
+                )
+                response = await client.get(
+                    "https://cloudresourcemanager.googleapis.com/v1/projects",
+                    headers=headers,
+                    timeout=20,
+                )
+                response.raise_for_status()
+                projects = response.json().get("projects", [])
+                lib_logger.debug(f"Found {len(projects)} total projects")
+                active_projects = [
+                    p for p in projects if p.get("lifecycleState") == "ACTIVE"
+                ]
+                lib_logger.debug(f"Found {len(active_projects)} active projects")
+
+                if not projects:
+                    lib_logger.error(
+                        "No GCP projects found for this account. Please create a project in Google Cloud Console."
+                    )
+                elif not active_projects:
+                    lib_logger.error(
+                        "No active GCP projects found. Please activate a project in Google Cloud Console."
+                    )
+                else:
+                    project_id = active_projects[0]["projectId"]
+                    lib_logger.info(
+                        f"Discovered Antigravity project ID from active projects list: {project_id}"
+                    )
+                    lib_logger.debug(
+                        f"Selected first active project: {project_id} (out of {len(active_projects)} active projects)"
+                    )
+                    self.project_id_cache[credential_path] = project_id
+                    discovered_project_id = project_id
+
+                    # Persist to credential file (no tier info from resource manager)
+                    await self._persist_project_metadata(
+                        credential_path, project_id, None
+                    )
+
+                    return project_id
+        except httpx.HTTPStatusError as e:
+            if e.response.status_code == 403:
+                lib_logger.error(
+                    "Failed to list GCP projects due to a 403 Forbidden error. The Cloud Resource Manager API may not be enabled, or your account lacks the 'resourcemanager.projects.list' permission."
+                )
+            else:
+                lib_logger.error(
+                    f"Failed to list GCP projects with status {e.response.status_code}: {e}"
+                )
+        except httpx.RequestError as e:
+            lib_logger.error(f"Network error while listing GCP projects: {e}")
+
+        raise ValueError(
+            "Could not auto-discover Antigravity project ID. Possible causes:\n"
+            "  1. The cloudaicompanion.googleapis.com API is not enabled (enable it in Google Cloud Console)\n"
+            "  2. No active GCP projects exist for this account (create one in Google Cloud Console)\n"
+            "  3. Account lacks necessary permissions\n"
+            "To manually specify a project, set ANTIGRAVITY_PROJECT_ID in your .env file."
+        )
+
+    async def _persist_project_metadata(
+        self, credential_path: str, project_id: str, tier: Optional[str]
+    ):
+        """Persists project ID and tier to the credential file for faster future startups."""
+        # Skip persistence for env:// paths (environment-based credentials)
+        credential_index = self._parse_env_credential_path(credential_path)
+        if credential_index is not None:
+            lib_logger.debug(
+                f"Skipping project metadata persistence for env:// credential path: {credential_path}"
+            )
+            return
+
+        try:
+            # Load current credentials
+            with open(credential_path, "r") as f:
+                creds = json.load(f)
+
+            # Update metadata
+            if "_proxy_metadata" not in creds:
+                creds["_proxy_metadata"] = {}
+
+            creds["_proxy_metadata"]["project_id"] = project_id
+            if tier:
+                creds["_proxy_metadata"]["tier"] = tier
+
+            # Save back using the existing save method (handles atomic writes and permissions)
+            await self._save_credentials(credential_path, creds)
+
+            lib_logger.debug(
+                f"Persisted project_id and tier to credential file: {credential_path}"
+            )
+        except Exception as e:
+            lib_logger.warning(
+                f"Failed to persist project metadata to credential file: {e}"
+            )
+            # Non-fatal - just means slower startup next time
+
+    # =========================================================================
+    # CREDENTIAL MANAGEMENT OVERRIDES
+    # =========================================================================
+
+    def _get_provider_file_prefix(self) -> str:
+        """Return the file prefix for Antigravity credentials."""
+        return "antigravity"
+
+    def build_env_lines(self, creds: Dict[str, Any], cred_number: int) -> List[str]:
+        """
+        Generate .env file lines for an Antigravity credential.
+
+        Includes tier and project_id from _proxy_metadata.
+        """
+        # Get base lines from parent class
+        lines = super().build_env_lines(creds, cred_number)
+
+        # Add Antigravity-specific fields (tier and project_id)
+        metadata = creds.get("_proxy_metadata", {})
+        prefix = f"{self.ENV_PREFIX}_{cred_number}"
+
+        project_id = metadata.get("project_id", "")
+        tier = metadata.get("tier", "")
+
+        if project_id:
+            lines.append(f"{prefix}_PROJECT_ID={project_id}")
+        if tier:
+            lines.append(f"{prefix}_TIER={tier}")
+
+        return lines

src/rotator_library/providers/antigravity_provider.py

@@ -718,12 +718,7 @@ class AntigravityProvider(AntigravityAuthBase, ProviderInterface):
     def __init__(self):
         super().__init__()
         self.model_definitions = ModelDefinitions()
-        self.project_id_cache: Dict[
-            str, str
-        ] = {}  # Cache project ID per credential path
-        self.project_tier_cache: Dict[
-            str, str
-        ] = {}  # Cache project tier per credential path (for debugging)
+        # NOTE: project_id_cache and project_tier_cache are inherited from AntigravityAuthBase
 
         # Base URL management
         self._base_url_index = 0
@@ -931,6 +926,8 @@ class AntigravityProvider(AntigravityAuthBase, ProviderInterface):
 
         return loaded
 
+    # NOTE: _post_auth_discovery() is inherited from AntigravityAuthBase
+
     # =========================================================================
     # MODEL UTILITIES
     # =========================================================================
@@ -1007,524 +1004,7 @@ class AntigravityProvider(AntigravityAuthBase, ProviderInterface):
 
         return "thinking_" + "_".join(key_parts) if key_parts else None
 
-    # =========================================================================
-    # PROJECT ID DISCOVERY
-    # =========================================================================
-
-    async def _discover_project_id(
-        self, credential_path: str, access_token: str, litellm_params: Dict[str, Any]
-    ) -> str:
-        """
-        Discovers the Google Cloud Project ID, with caching and onboarding for new accounts.
-
-        This follows the official Gemini CLI discovery flow adapted for Antigravity:
-        1. Check in-memory cache
-        2. Check configured project_id override (litellm_params or env var)
-        3. Check persisted project_id in credential file
-        4. Call loadCodeAssist to check if user is already known (has currentTier)
-           - If currentTier exists AND cloudaicompanionProject returned: use server's project
-           - If no currentTier: user needs onboarding
-        5. Onboard user (FREE tier: pass cloudaicompanionProject=None for server-managed)
-        6. Fallback to GCP Resource Manager project listing
-
-        Note: Unlike GeminiCli, Antigravity doesn't use tier-based credential prioritization,
-        but we still cache tier info for debugging and consistency.
-        """
-        lib_logger.debug(
-            f"Starting Antigravity project discovery for credential: {credential_path}"
-        )
-
-        # Check in-memory cache first
-        if credential_path in self.project_id_cache:
-            cached_project = self.project_id_cache[credential_path]
-            lib_logger.debug(f"Using cached project ID: {cached_project}")
-            return cached_project
-
-        # Check for configured project ID override (from litellm_params or env var)
-        configured_project_id = (
-            litellm_params.get("project_id")
-            or os.getenv("ANTIGRAVITY_PROJECT_ID")
-            or os.getenv("GOOGLE_CLOUD_PROJECT")
-        )
-        if configured_project_id:
-            lib_logger.debug(
-                f"Found configured project_id override: {configured_project_id}"
-            )
-
-        # Load credentials from file to check for persisted project_id and tier
-        # Skip for env:// paths (environment-based credentials don't persist to files)
-        credential_index = self._parse_env_credential_path(credential_path)
-        if credential_index is None:
-            # Only try to load from file if it's not an env:// path
-            try:
-                with open(credential_path, "r") as f:
-                    creds = json.load(f)
-
-                metadata = creds.get("_proxy_metadata", {})
-                persisted_project_id = metadata.get("project_id")
-                persisted_tier = metadata.get("tier")
-
-                if persisted_project_id:
-                    lib_logger.info(
-                        f"Loaded persisted project ID from credential file: {persisted_project_id}"
-                    )
-                    self.project_id_cache[credential_path] = persisted_project_id
-
-                    # Also load tier if available (for debugging/logging purposes)
-                    if persisted_tier:
-                        self.project_tier_cache[credential_path] = persisted_tier
-                        lib_logger.debug(f"Loaded persisted tier: {persisted_tier}")
-
-                    return persisted_project_id
-            except (FileNotFoundError, json.JSONDecodeError, KeyError) as e:
-                lib_logger.debug(f"Could not load persisted project ID from file: {e}")
-
-        lib_logger.debug(
-            "No cached or configured project ID found, initiating discovery..."
-        )
-        headers = {
-            "Authorization": f"Bearer {access_token}",
-            "Content-Type": "application/json",
-        }
-
-        discovered_project_id = None
-        discovered_tier = None
-
-        # Use production endpoint for loadCodeAssist (more reliable than sandbox URLs)
-        code_assist_endpoint = "https://cloudcode-pa.googleapis.com/v1internal"
-
-        async with httpx.AsyncClient() as client:
-            # 1. Try discovery endpoint with loadCodeAssist
-            lib_logger.debug(
-                "Attempting project discovery via Code Assist loadCodeAssist endpoint..."
-            )
-            try:
-                # Build metadata - include duetProject only if we have a configured project
-                core_client_metadata = {
-                    "ideType": "IDE_UNSPECIFIED",
-                    "platform": "PLATFORM_UNSPECIFIED",
-                    "pluginType": "GEMINI",
-                }
-                if configured_project_id:
-                    core_client_metadata["duetProject"] = configured_project_id
-
-                # Build load request - pass configured_project_id if available, otherwise None
-                load_request = {
-                    "cloudaicompanionProject": configured_project_id,  # Can be None
-                    "metadata": core_client_metadata,
-                }
-
-                lib_logger.debug(
-                    f"Sending loadCodeAssist request with cloudaicompanionProject={configured_project_id}"
-                )
-                response = await client.post(
-                    f"{code_assist_endpoint}:loadCodeAssist",
-                    headers=headers,
-                    json=load_request,
-                    timeout=20,
-                )
-                response.raise_for_status()
-                data = response.json()
-
-                # Log full response for debugging
-                lib_logger.debug(
-                    f"loadCodeAssist full response keys: {list(data.keys())}"
-                )
-
-                # Extract tier information
-                allowed_tiers = data.get("allowedTiers", [])
-                current_tier = data.get("currentTier")
-
-                lib_logger.debug(f"=== Tier Information ===")
-                lib_logger.debug(f"currentTier: {current_tier}")
-                lib_logger.debug(f"allowedTiers count: {len(allowed_tiers)}")
-                for i, tier in enumerate(allowed_tiers):
-                    tier_id = tier.get("id", "unknown")
-                    is_default = tier.get("isDefault", False)
-                    user_defined = tier.get("userDefinedCloudaicompanionProject", False)
-                    lib_logger.debug(
-                        f"  Tier {i + 1}: id={tier_id}, isDefault={is_default}, userDefinedProject={user_defined}"
-                    )
-                lib_logger.debug(f"========================")
-
-                # Determine the current tier ID
-                current_tier_id = None
-                if current_tier:
-                    current_tier_id = current_tier.get("id")
-                    lib_logger.debug(f"User has currentTier: {current_tier_id}")
-
-                # Check if user is already known to server (has currentTier)
-                if current_tier_id:
-                    # User is already onboarded - check for project from server
-                    server_project = data.get("cloudaicompanionProject")
-
-                    # Check if this tier requires user-defined project (paid tiers)
-                    requires_user_project = any(
-                        t.get("id") == current_tier_id
-                        and t.get("userDefinedCloudaicompanionProject", False)
-                        for t in allowed_tiers
-                    )
-                    is_free_tier = current_tier_id == "free-tier"
-
-                    if server_project:
-                        # Server returned a project - use it (server wins)
-                        project_id = server_project
-                        lib_logger.debug(f"Server returned project: {project_id}")
-                    elif configured_project_id:
-                        # No server project but we have configured one - use it
-                        project_id = configured_project_id
-                        lib_logger.debug(
-                            f"No server project, using configured: {project_id}"
-                        )
-                    elif is_free_tier:
-                        # Free tier user without server project - try onboarding
-                        lib_logger.debug(
-                            "Free tier user with currentTier but no project - will try onboarding"
-                        )
-                        project_id = None
-                    elif requires_user_project:
-                        # Paid tier requires a project ID to be set
-                        raise ValueError(
-                            f"Paid tier '{current_tier_id}' requires setting ANTIGRAVITY_PROJECT_ID environment variable."
-                        )
-                    else:
-                        # Unknown tier without project - proceed to onboarding
-                        lib_logger.warning(
-                            f"Tier '{current_tier_id}' has no project and none configured - will try onboarding"
-                        )
-                        project_id = None
-
-                    if project_id:
-                        # Cache tier info
-                        self.project_tier_cache[credential_path] = current_tier_id
-                        discovered_tier = current_tier_id
-
-                        # Log appropriately based on tier
-                        is_paid = current_tier_id and current_tier_id not in [
-                            "free-tier",
-                            "legacy-tier",
-                            "unknown",
-                        ]
-                        if is_paid:
-                            lib_logger.info(
-                                f"Using Antigravity paid tier '{current_tier_id}' with project: {project_id}"
-                            )
-                        else:
-                            lib_logger.info(
-                                f"Discovered Antigravity project ID via loadCodeAssist: {project_id}"
-                            )
-
-                        self.project_id_cache[credential_path] = project_id
-                        discovered_project_id = project_id
-
-                        # Persist to credential file
-                        await self._persist_project_metadata(
-                            credential_path, project_id, discovered_tier
-                        )
-
-                        return project_id
-
-                # 2. User needs onboarding - no currentTier or no project found
-                lib_logger.info(
-                    "No existing Antigravity session found (no currentTier), attempting to onboard user..."
-                )
-
-                # Determine which tier to onboard with
-                onboard_tier = None
-                for tier in allowed_tiers:
-                    if tier.get("isDefault"):
-                        onboard_tier = tier
-                        break
-
-                # Fallback to legacy tier if no default
-                if not onboard_tier and allowed_tiers:
-                    for tier in allowed_tiers:
-                        if tier.get("id") == "legacy-tier":
-                            onboard_tier = tier
-                            break
-                    if not onboard_tier:
-                        onboard_tier = allowed_tiers[0]
-
-                if not onboard_tier:
-                    raise ValueError("No onboarding tiers available from server")
-
-                tier_id = onboard_tier.get("id", "free-tier")
-                requires_user_project = onboard_tier.get(
-                    "userDefinedCloudaicompanionProject", False
-                )
-
-                lib_logger.debug(
-                    f"Onboarding with tier: {tier_id}, requiresUserProject: {requires_user_project}"
-                )
-
-                # Build onboard request based on tier type
-                # FREE tier: cloudaicompanionProject = None (server-managed)
-                # PAID tier: cloudaicompanionProject = configured_project_id
-                is_free_tier = tier_id == "free-tier"
-
-                if is_free_tier:
-                    # Free tier uses server-managed project
-                    onboard_request = {
-                        "tierId": tier_id,
-                        "cloudaicompanionProject": None,  # Server will create/manage
-                        "metadata": core_client_metadata,
-                    }
-                    lib_logger.debug(
-                        "Free tier onboarding: using server-managed project"
-                    )
-                else:
-                    # Paid/legacy tier requires user-provided project
-                    if not configured_project_id and requires_user_project:
-                        raise ValueError(
-                            f"Tier '{tier_id}' requires setting ANTIGRAVITY_PROJECT_ID environment variable."
-                        )
-                    onboard_request = {
-                        "tierId": tier_id,
-                        "cloudaicompanionProject": configured_project_id,
-                        "metadata": {
-                            **core_client_metadata,
-                            "duetProject": configured_project_id,
-                        }
-                        if configured_project_id
-                        else core_client_metadata,
-                    }
-                    lib_logger.debug(
-                        f"Paid tier onboarding: using project {configured_project_id}"
-                    )
-
-                lib_logger.debug("Initiating onboardUser request...")
-                lro_response = await client.post(
-                    f"{code_assist_endpoint}:onboardUser",
-                    headers=headers,
-                    json=onboard_request,
-                    timeout=30,
-                )
-                lro_response.raise_for_status()
-                lro_data = lro_response.json()
-                lib_logger.debug(
-                    f"Initial onboarding response: done={lro_data.get('done')}"
-                )
-
-                # Poll for onboarding completion (up to 5 minutes)
-                for i in range(150):  # 150 × 2s = 5 minutes
-                    if lro_data.get("done"):
-                        lib_logger.debug(
-                            f"Onboarding completed after {i} polling attempts"
-                        )
-                        break
-                    await asyncio.sleep(2)
-                    if (i + 1) % 15 == 0:  # Log every 30 seconds
-                        lib_logger.info(
-                            f"Still waiting for onboarding completion... ({(i + 1) * 2}s elapsed)"
-                        )
-                    lib_logger.debug(
-                        f"Polling onboarding status... (Attempt {i + 1}/150)"
-                    )
-                    lro_response = await client.post(
-                        f"{code_assist_endpoint}:onboardUser",
-                        headers=headers,
-                        json=onboard_request,
-                        timeout=30,
-                    )
-                    lro_response.raise_for_status()
-                    lro_data = lro_response.json()
-
-                if not lro_data.get("done"):
-                    lib_logger.error("Onboarding process timed out after 5 minutes")
-                    raise ValueError(
-                        "Onboarding process timed out after 5 minutes. Please try again or contact support."
-                    )
-
-                # Extract project ID from LRO response
-                # Note: onboardUser returns response.cloudaicompanionProject as an object with .id
-                lro_response_data = lro_data.get("response", {})
-                lro_project_obj = lro_response_data.get("cloudaicompanionProject", {})
-                project_id = (
-                    lro_project_obj.get("id")
-                    if isinstance(lro_project_obj, dict)
-                    else None
-                )
-
-                # Fallback to configured project if LRO didn't return one
-                if not project_id and configured_project_id:
-                    project_id = configured_project_id
-                    lib_logger.debug(
-                        f"LRO didn't return project, using configured: {project_id}"
-                    )
-
-                if not project_id:
-                    lib_logger.error(
-                        "Onboarding completed but no project ID in response and none configured"
-                    )
-                    raise ValueError(
-                        "Onboarding completed, but no project ID was returned. "
-                        "For paid tiers, set ANTIGRAVITY_PROJECT_ID environment variable."
-                    )
-
-                lib_logger.debug(
-                    f"Successfully extracted project ID from onboarding response: {project_id}"
-                )
-
-                # Cache tier info
-                self.project_tier_cache[credential_path] = tier_id
-                discovered_tier = tier_id
-                lib_logger.debug(f"Cached tier information: {tier_id}")
-
-                # Log concise message based on tier
-                is_paid = tier_id and tier_id not in ["free-tier", "legacy-tier"]
-                if is_paid:
-                    lib_logger.info(
-                        f"Using Antigravity paid tier '{tier_id}' with project: {project_id}"
-                    )
-                else:
-                    lib_logger.info(
-                        f"Successfully onboarded user and discovered project ID: {project_id}"
-                    )
-
-                self.project_id_cache[credential_path] = project_id
-                discovered_project_id = project_id
-
-                # Persist to credential file
-                await self._persist_project_metadata(
-                    credential_path, project_id, discovered_tier
-                )
-
-                return project_id
-
-            except httpx.HTTPStatusError as e:
-                error_body = ""
-                try:
-                    error_body = e.response.text
-                except Exception:
-                    pass
-                if e.response.status_code == 403:
-                    lib_logger.error(
-                        f"Antigravity Code Assist API access denied (403). Response: {error_body}"
-                    )
-                    lib_logger.error(
-                        "Possible causes: 1) cloudaicompanion.googleapis.com API not enabled, 2) Wrong project ID for paid tier, 3) Account lacks permissions"
-                    )
-                elif e.response.status_code == 404:
-                    lib_logger.warning(
-                        f"Antigravity Code Assist endpoint not found (404). Falling back to project listing."
-                    )
-                elif e.response.status_code == 412:
-                    # Precondition Failed - often means wrong project for free tier onboarding
-                    lib_logger.error(
-                        f"Precondition failed (412): {error_body}. This may mean the project ID is incompatible with the selected tier."
-                    )
-                else:
-                    lib_logger.warning(
-                        f"Antigravity onboarding/discovery failed with status {e.response.status_code}: {error_body}. Falling back to project listing."
-                    )
-            except httpx.RequestError as e:
-                lib_logger.warning(
-                    f"Antigravity onboarding/discovery network error: {e}. Falling back to project listing."
-                )
-
-        # 3. Fallback to listing all available GCP projects (last resort)
-        lib_logger.debug(
-            "Attempting to discover project via GCP Resource Manager API..."
-        )
-        try:
-            async with httpx.AsyncClient() as client:
-                lib_logger.debug(
-                    "Querying Cloud Resource Manager for available projects..."
-                )
-                response = await client.get(
-                    "https://cloudresourcemanager.googleapis.com/v1/projects",
-                    headers=headers,
-                    timeout=20,
-                )
-                response.raise_for_status()
-                projects = response.json().get("projects", [])
-                lib_logger.debug(f"Found {len(projects)} total projects")
-                active_projects = [
-                    p for p in projects if p.get("lifecycleState") == "ACTIVE"
-                ]
-                lib_logger.debug(f"Found {len(active_projects)} active projects")
-
-                if not projects:
-                    lib_logger.error(
-                        "No GCP projects found for this account. Please create a project in Google Cloud Console."
-                    )
-                elif not active_projects:
-                    lib_logger.error(
-                        "No active GCP projects found. Please activate a project in Google Cloud Console."
-                    )
-                else:
-                    project_id = active_projects[0]["projectId"]
-                    lib_logger.info(
-                        f"Discovered Antigravity project ID from active projects list: {project_id}"
-                    )
-                    lib_logger.debug(
-                        f"Selected first active project: {project_id} (out of {len(active_projects)} active projects)"
-                    )
-                    self.project_id_cache[credential_path] = project_id
-                    discovered_project_id = project_id
-
-                    # Persist to credential file (no tier info from resource manager)
-                    await self._persist_project_metadata(
-                        credential_path, project_id, None
-                    )
-
-                    return project_id
-        except httpx.HTTPStatusError as e:
-            if e.response.status_code == 403:
-                lib_logger.error(
-                    "Failed to list GCP projects due to a 403 Forbidden error. The Cloud Resource Manager API may not be enabled, or your account lacks the 'resourcemanager.projects.list' permission."
-                )
-            else:
-                lib_logger.error(
-                    f"Failed to list GCP projects with status {e.response.status_code}: {e}"
-                )
-        except httpx.RequestError as e:
-            lib_logger.error(f"Network error while listing GCP projects: {e}")
-
-        raise ValueError(
-            "Could not auto-discover Antigravity project ID. Possible causes:\n"
-            "  1. The cloudaicompanion.googleapis.com API is not enabled (enable it in Google Cloud Console)\n"
-            "  2. No active GCP projects exist for this account (create one in Google Cloud Console)\n"
-            "  3. Account lacks necessary permissions\n"
-            "To manually specify a project, set ANTIGRAVITY_PROJECT_ID in your .env file."
-        )
-
-    async def _persist_project_metadata(
-        self, credential_path: str, project_id: str, tier: Optional[str]
-    ):
-        """Persists project ID and tier to the credential file for faster future startups."""
-        # Skip persistence for env:// paths (environment-based credentials)
-        credential_index = self._parse_env_credential_path(credential_path)
-        if credential_index is not None:
-            lib_logger.debug(
-                f"Skipping project metadata persistence for env:// credential path: {credential_path}"
-            )
-            return
-
-        try:
-            # Load current credentials
-            with open(credential_path, "r") as f:
-                creds = json.load(f)
-
-            # Update metadata
-            if "_proxy_metadata" not in creds:
-                creds["_proxy_metadata"] = {}
-
-            creds["_proxy_metadata"]["project_id"] = project_id
-            if tier:
-                creds["_proxy_metadata"]["tier"] = tier
-
-            # Save back using the existing save method (handles atomic writes and permissions)
-            await self._save_credentials(credential_path, creds)
-
-            lib_logger.debug(
-                f"Persisted project_id and tier to credential file: {credential_path}"
-            )
-        except Exception as e:
-            lib_logger.warning(
-                f"Failed to persist project metadata to credential file: {e}"
-            )
-            # Non-fatal - just means slower startup next time
+    # NOTE: _discover_project_id() and _persist_project_metadata() are inherited from AntigravityAuthBase
 
     # =========================================================================
     # THINKING MODE SANITIZATION
@@ -2559,9 +2039,9 @@ class AntigravityProvider(AntigravityAuthBase, ProviderInterface):
                                 f"Ignoring duplicate - this may indicate malformed conversation history."
                             )
                             continue
-                        #lib_logger.debug(
+                        # lib_logger.debug(
                         #    f"[Grouping] Collected response for ID: {resp_id}"
-                        #)
+                        # )
                         collected_responses[resp_id] = resp
 
                 # Try to satisfy pending groups (newest first)
@@ -2576,10 +2056,10 @@ class AntigravityProvider(AntigravityAuthBase, ProviderInterface):
                             collected_responses.pop(gid) for gid in group_ids
                         ]
                         new_contents.append({"parts": group_responses, "role": "user"})
-                        #lib_logger.debug(
+                        # lib_logger.debug(
                         #    f"[Grouping] Satisfied group with {len(group_responses)} responses: "
                         #    f"ids={group_ids}"
-                        #)
+                        # )
                         pending_groups.pop(i)
                         break
                 continue
@@ -2599,10 +2079,10 @@ class AntigravityProvider(AntigravityAuthBase, ProviderInterface):
                     ]
 
                     if call_ids:
-                        #lib_logger.debug(
+                        # lib_logger.debug(
                         #    f"[Grouping] Created pending group expecting {len(call_ids)} responses: "
                         #    f"ids={call_ids}, names={func_names}"
-                        #)
+                        # )
                         pending_groups.append(
                             {
                                 "ids": call_ids,

src/rotator_library/providers/gemini_auth_base.py

@@ -1,15 +1,35 @@
 # src/rotator_library/providers/gemini_auth_base.py
 
+import asyncio
+import json
+import logging
+import os
+from pathlib import Path
+from typing import Any, Dict, Optional, List
+
+import httpx
+
 from .google_oauth_base import GoogleOAuthBase
 
+lib_logger = logging.getLogger("rotator_library")
+
+# Code Assist endpoint for project discovery
+CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com/v1internal"
+
+
 class GeminiAuthBase(GoogleOAuthBase):
     """
     Gemini CLI OAuth2 authentication implementation.
-    
+
     Inherits all OAuth functionality from GoogleOAuthBase with Gemini-specific configuration.
+
+    Also provides project/tier discovery functionality that runs during authentication,
+    ensuring credentials have their tier and project_id cached before any API requests.
     """
-    
-    CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"
+
+    CLIENT_ID = (
+        "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"
+    )
     CLIENT_SECRET = "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"
     OAUTH_SCOPES = [
         "https://www.googleapis.com/auth/cloud-platform",
@@ -18,4 +38,606 @@ class GeminiAuthBase(GoogleOAuthBase):
     ]
     ENV_PREFIX = "GEMINI_CLI"
     CALLBACK_PORT = 8085
-    CALLBACK_PATH = "/oauth2callback"
+    CALLBACK_PATH = "/oauth2callback"
+
+    def __init__(self):
+        super().__init__()
+        # Project and tier caches - shared between auth base and provider
+        self.project_id_cache: Dict[str, str] = {}
+        self.project_tier_cache: Dict[str, str] = {}
+
+    # =========================================================================
+    # POST-AUTH DISCOVERY HOOK
+    # =========================================================================
+
+    async def _post_auth_discovery(
+        self, credential_path: str, access_token: str
+    ) -> None:
+        """
+        Discover and cache tier/project information immediately after OAuth authentication.
+
+        This is called by GoogleOAuthBase._perform_interactive_oauth() after successful auth,
+        ensuring tier and project_id are cached during the authentication flow rather than
+        waiting for the first API request.
+
+        Args:
+            credential_path: Path to the credential file
+            access_token: The newly obtained access token
+        """
+        lib_logger.debug(
+            f"Starting post-auth discovery for GeminiCli credential: {Path(credential_path).name}"
+        )
+
+        # Skip if already discovered (shouldn't happen during fresh auth, but be defensive)
+        if (
+            credential_path in self.project_id_cache
+            and credential_path in self.project_tier_cache
+        ):
+            lib_logger.debug(
+                f"Tier and project already cached for {Path(credential_path).name}, skipping discovery"
+            )
+            return
+
+        # Call _discover_project_id which handles tier/project discovery and persistence
+        # Pass empty litellm_params since we're in auth context (no model-specific overrides)
+        project_id = await self._discover_project_id(
+            credential_path, access_token, litellm_params={}
+        )
+
+        tier = self.project_tier_cache.get(credential_path, "unknown")
+        lib_logger.info(
+            f"Post-auth discovery complete for {Path(credential_path).name}: "
+            f"tier={tier}, project={project_id}"
+        )
+
+    # =========================================================================
+    # PROJECT ID DISCOVERY
+    # =========================================================================
+
+    async def _discover_project_id(
+        self, credential_path: str, access_token: str, litellm_params: Dict[str, Any]
+    ) -> str:
+        """
+        Discovers the Google Cloud Project ID, with caching and onboarding for new accounts.
+
+        This follows the official Gemini CLI discovery flow:
+        1. Check in-memory cache
+        2. Check configured project_id override (litellm_params or env var)
+        3. Check persisted project_id in credential file
+        4. Call loadCodeAssist to check if user is already known (has currentTier)
+           - If currentTier exists AND cloudaicompanionProject returned: use server's project
+           - If currentTier exists but NO cloudaicompanionProject: use configured project_id (paid tier requires this)
+           - If no currentTier: user needs onboarding
+        5. Onboard user based on tier:
+           - FREE tier: pass cloudaicompanionProject=None (server-managed)
+           - PAID tier: pass cloudaicompanionProject=configured_project_id
+        6. Fallback to GCP Resource Manager project listing
+        """
+        lib_logger.debug(
+            f"Starting project discovery for credential: {credential_path}"
+        )
+
+        # Check in-memory cache first
+        if credential_path in self.project_id_cache:
+            cached_project = self.project_id_cache[credential_path]
+            lib_logger.debug(f"Using cached project ID: {cached_project}")
+            return cached_project
+
+        # Check for configured project ID override (from litellm_params or env var)
+        # This is REQUIRED for paid tier users per the official CLI behavior
+        configured_project_id = litellm_params.get("project_id") or os.getenv(
+            "GEMINI_CLI_PROJECT_ID"
+        )
+        if configured_project_id:
+            lib_logger.debug(
+                f"Found configured project_id override: {configured_project_id}"
+            )
+
+        # Load credentials from file to check for persisted project_id and tier
+        # Skip for env:// paths (environment-based credentials don't persist to files)
+        credential_index = self._parse_env_credential_path(credential_path)
+        if credential_index is None:
+            # Only try to load from file if it's not an env:// path
+            try:
+                with open(credential_path, "r") as f:
+                    creds = json.load(f)
+
+                metadata = creds.get("_proxy_metadata", {})
+                persisted_project_id = metadata.get("project_id")
+                persisted_tier = metadata.get("tier")
+
+                if persisted_project_id:
+                    lib_logger.info(
+                        f"Loaded persisted project ID from credential file: {persisted_project_id}"
+                    )
+                    self.project_id_cache[credential_path] = persisted_project_id
+
+                    # Also load tier if available
+                    if persisted_tier:
+                        self.project_tier_cache[credential_path] = persisted_tier
+                        lib_logger.debug(f"Loaded persisted tier: {persisted_tier}")
+
+                    return persisted_project_id
+            except (FileNotFoundError, json.JSONDecodeError, KeyError) as e:
+                lib_logger.debug(f"Could not load persisted project ID from file: {e}")
+
+        lib_logger.debug(
+            "No cached or configured project ID found, initiating discovery..."
+        )
+        headers = {
+            "Authorization": f"Bearer {access_token}",
+            "Content-Type": "application/json",
+        }
+
+        discovered_project_id = None
+        discovered_tier = None
+
+        async with httpx.AsyncClient() as client:
+            # 1. Try discovery endpoint with loadCodeAssist
+            lib_logger.debug(
+                "Attempting project discovery via Code Assist loadCodeAssist endpoint..."
+            )
+            try:
+                # Build metadata - include duetProject only if we have a configured project
+                core_client_metadata = {
+                    "ideType": "IDE_UNSPECIFIED",
+                    "platform": "PLATFORM_UNSPECIFIED",
+                    "pluginType": "GEMINI",
+                }
+                if configured_project_id:
+                    core_client_metadata["duetProject"] = configured_project_id
+
+                # Build load request - pass configured_project_id if available, otherwise None
+                load_request = {
+                    "cloudaicompanionProject": configured_project_id,  # Can be None
+                    "metadata": core_client_metadata,
+                }
+
+                lib_logger.debug(
+                    f"Sending loadCodeAssist request with cloudaicompanionProject={configured_project_id}"
+                )
+                response = await client.post(
+                    f"{CODE_ASSIST_ENDPOINT}:loadCodeAssist",
+                    headers=headers,
+                    json=load_request,
+                    timeout=20,
+                )
+                response.raise_for_status()
+                data = response.json()
+
+                # Log full response for debugging
+                lib_logger.debug(
+                    f"loadCodeAssist full response keys: {list(data.keys())}"
+                )
+
+                # Extract and log ALL tier information for debugging
+                allowed_tiers = data.get("allowedTiers", [])
+                current_tier = data.get("currentTier")
+
+                lib_logger.debug(f"=== Tier Information ===")
+                lib_logger.debug(f"currentTier: {current_tier}")
+                lib_logger.debug(f"allowedTiers count: {len(allowed_tiers)}")
+                for i, tier in enumerate(allowed_tiers):
+                    tier_id = tier.get("id", "unknown")
+                    is_default = tier.get("isDefault", False)
+                    user_defined = tier.get("userDefinedCloudaicompanionProject", False)
+                    lib_logger.debug(
+                        f"  Tier {i + 1}: id={tier_id}, isDefault={is_default}, userDefinedProject={user_defined}"
+                    )
+                lib_logger.debug(f"========================")
+
+                # Determine the current tier ID
+                current_tier_id = None
+                if current_tier:
+                    current_tier_id = current_tier.get("id")
+                    lib_logger.debug(f"User has currentTier: {current_tier_id}")
+
+                # Check if user is already known to server (has currentTier)
+                if current_tier_id:
+                    # User is already onboarded - check for project from server
+                    server_project = data.get("cloudaicompanionProject")
+
+                    # Check if this tier requires user-defined project (paid tiers)
+                    requires_user_project = any(
+                        t.get("id") == current_tier_id
+                        and t.get("userDefinedCloudaicompanionProject", False)
+                        for t in allowed_tiers
+                    )
+                    is_free_tier = current_tier_id == "free-tier"
+
+                    if server_project:
+                        # Server returned a project - use it (server wins)
+                        # This is the normal case for FREE tier users
+                        project_id = server_project
+                        lib_logger.debug(f"Server returned project: {project_id}")
+                    elif configured_project_id:
+                        # No server project but we have configured one - use it
+                        # This is the PAID TIER case where server doesn't return a project
+                        project_id = configured_project_id
+                        lib_logger.debug(
+                            f"No server project, using configured: {project_id}"
+                        )
+                    elif is_free_tier:
+                        # Free tier user without server project - this shouldn't happen normally
+                        # but let's not fail, just proceed to onboarding
+                        lib_logger.debug(
+                            "Free tier user with currentTier but no project - will try onboarding"
+                        )
+                        project_id = None
+                    elif requires_user_project:
+                        # Paid tier requires a project ID to be set
+                        raise ValueError(
+                            f"Paid tier '{current_tier_id}' requires setting GEMINI_CLI_PROJECT_ID environment variable. "
+                            "See https://goo.gle/gemini-cli-auth-docs#workspace-gca"
+                        )
+                    else:
+                        # Unknown tier without project - proceed carefully
+                        lib_logger.warning(
+                            f"Tier '{current_tier_id}' has no project and none configured - will try onboarding"
+                        )
+                        project_id = None
+
+                    if project_id:
+                        # Cache tier info
+                        self.project_tier_cache[credential_path] = current_tier_id
+                        discovered_tier = current_tier_id
+
+                        # Log appropriately based on tier
+                        is_paid = current_tier_id and current_tier_id not in [
+                            "free-tier",
+                            "legacy-tier",
+                            "unknown",
+                        ]
+                        if is_paid:
+                            lib_logger.info(
+                                f"Using Gemini paid tier '{current_tier_id}' with project: {project_id}"
+                            )
+                        else:
+                            lib_logger.info(
+                                f"Discovered Gemini project ID via loadCodeAssist: {project_id}"
+                            )
+
+                        self.project_id_cache[credential_path] = project_id
+                        discovered_project_id = project_id
+
+                        # Persist to credential file
+                        await self._persist_project_metadata(
+                            credential_path, project_id, discovered_tier
+                        )
+
+                        return project_id
+
+                # 2. User needs onboarding - no currentTier
+                lib_logger.info(
+                    "No existing Gemini session found (no currentTier), attempting to onboard user..."
+                )
+
+                # Determine which tier to onboard with
+                onboard_tier = None
+                for tier in allowed_tiers:
+                    if tier.get("isDefault"):
+                        onboard_tier = tier
+                        break
+
+                # Fallback to LEGACY tier if no default (requires user project)
+                if not onboard_tier and allowed_tiers:
+                    # Look for legacy-tier as fallback
+                    for tier in allowed_tiers:
+                        if tier.get("id") == "legacy-tier":
+                            onboard_tier = tier
+                            break
+                    # If still no tier, use first available
+                    if not onboard_tier:
+                        onboard_tier = allowed_tiers[0]
+
+                if not onboard_tier:
+                    raise ValueError("No onboarding tiers available from server")
+
+                tier_id = onboard_tier.get("id", "free-tier")
+                requires_user_project = onboard_tier.get(
+                    "userDefinedCloudaicompanionProject", False
+                )
+
+                lib_logger.debug(
+                    f"Onboarding with tier: {tier_id}, requiresUserProject: {requires_user_project}"
+                )
+
+                # Build onboard request based on tier type (following official CLI logic)
+                # FREE tier: cloudaicompanionProject = None (server-managed)
+                # PAID tier: cloudaicompanionProject = configured_project_id (user must provide)
+                is_free_tier = tier_id == "free-tier"
+
+                if is_free_tier:
+                    # Free tier uses server-managed project
+                    onboard_request = {
+                        "tierId": tier_id,
+                        "cloudaicompanionProject": None,  # Server will create/manage
+                        "metadata": core_client_metadata,
+                    }
+                    lib_logger.debug(
+                        "Free tier onboarding: using server-managed project"
+                    )
+                else:
+                    # Paid/legacy tier requires user-provided project
+                    if not configured_project_id and requires_user_project:
+                        raise ValueError(
+                            f"Tier '{tier_id}' requires setting GEMINI_CLI_PROJECT_ID environment variable. "
+                            "See https://goo.gle/gemini-cli-auth-docs#workspace-gca"
+                        )
+                    onboard_request = {
+                        "tierId": tier_id,
+                        "cloudaicompanionProject": configured_project_id,
+                        "metadata": {
+                            **core_client_metadata,
+                            "duetProject": configured_project_id,
+                        }
+                        if configured_project_id
+                        else core_client_metadata,
+                    }
+                    lib_logger.debug(
+                        f"Paid tier onboarding: using project {configured_project_id}"
+                    )
+
+                lib_logger.debug("Initiating onboardUser request...")
+                lro_response = await client.post(
+                    f"{CODE_ASSIST_ENDPOINT}:onboardUser",
+                    headers=headers,
+                    json=onboard_request,
+                    timeout=30,
+                )
+                lro_response.raise_for_status()
+                lro_data = lro_response.json()
+                lib_logger.debug(
+                    f"Initial onboarding response: done={lro_data.get('done')}"
+                )
+
+                for i in range(150):  # Poll for up to 5 minutes (150 × 2s)
+                    if lro_data.get("done"):
+                        lib_logger.debug(
+                            f"Onboarding completed after {i} polling attempts"
+                        )
+                        break
+                    await asyncio.sleep(2)
+                    if (i + 1) % 15 == 0:  # Log every 30 seconds
+                        lib_logger.info(
+                            f"Still waiting for onboarding completion... ({(i + 1) * 2}s elapsed)"
+                        )
+                    lib_logger.debug(
+                        f"Polling onboarding status... (Attempt {i + 1}/150)"
+                    )
+                    lro_response = await client.post(
+                        f"{CODE_ASSIST_ENDPOINT}:onboardUser",
+                        headers=headers,
+                        json=onboard_request,
+                        timeout=30,
+                    )
+                    lro_response.raise_for_status()
+                    lro_data = lro_response.json()
+
+                if not lro_data.get("done"):
+                    lib_logger.error("Onboarding process timed out after 5 minutes")
+                    raise ValueError(
+                        "Onboarding process timed out after 5 minutes. Please try again or contact support."
+                    )
+
+                # Extract project ID from LRO response
+                # Note: onboardUser returns response.cloudaicompanionProject as an object with .id
+                lro_response_data = lro_data.get("response", {})
+                lro_project_obj = lro_response_data.get("cloudaicompanionProject", {})
+                project_id = (
+                    lro_project_obj.get("id")
+                    if isinstance(lro_project_obj, dict)
+                    else None
+                )
+
+                # Fallback to configured project if LRO didn't return one
+                if not project_id and configured_project_id:
+                    project_id = configured_project_id
+                    lib_logger.debug(
+                        f"LRO didn't return project, using configured: {project_id}"
+                    )
+
+                if not project_id:
+                    lib_logger.error(
+                        "Onboarding completed but no project ID in response and none configured"
+                    )
+                    raise ValueError(
+                        "Onboarding completed, but no project ID was returned. "
+                        "For paid tiers, set GEMINI_CLI_PROJECT_ID environment variable."
+                    )
+
+                lib_logger.debug(
+                    f"Successfully extracted project ID from onboarding response: {project_id}"
+                )
+
+                # Cache tier info
+                self.project_tier_cache[credential_path] = tier_id
+                discovered_tier = tier_id
+                lib_logger.debug(f"Cached tier information: {tier_id}")
+
+                # Log concise message for paid projects
+                is_paid = tier_id and tier_id not in ["free-tier", "legacy-tier"]
+                if is_paid:
+                    lib_logger.info(
+                        f"Using Gemini paid tier '{tier_id}' with project: {project_id}"
+                    )
+                else:
+                    lib_logger.info(
+                        f"Successfully onboarded user and discovered project ID: {project_id}"
+                    )
+
+                self.project_id_cache[credential_path] = project_id
+                discovered_project_id = project_id
+
+                # Persist to credential file
+                await self._persist_project_metadata(
+                    credential_path, project_id, discovered_tier
+                )
+
+                return project_id
+
+            except httpx.HTTPStatusError as e:
+                error_body = ""
+                try:
+                    error_body = e.response.text
+                except Exception:
+                    pass
+                if e.response.status_code == 403:
+                    lib_logger.error(
+                        f"Gemini Code Assist API access denied (403). Response: {error_body}"
+                    )
+                    lib_logger.error(
+                        "Possible causes: 1) cloudaicompanion.googleapis.com API not enabled, 2) Wrong project ID for paid tier, 3) Account lacks permissions"
+                    )
+                elif e.response.status_code == 404:
+                    lib_logger.warning(
+                        f"Gemini Code Assist endpoint not found (404). Falling back to project listing."
+                    )
+                elif e.response.status_code == 412:
+                    # Precondition Failed - often means wrong project for free tier onboarding
+                    lib_logger.error(
+                        f"Precondition failed (412): {error_body}. This may mean the project ID is incompatible with the selected tier."
+                    )
+                else:
+                    lib_logger.warning(
+                        f"Gemini onboarding/discovery failed with status {e.response.status_code}: {error_body}. Falling back to project listing."
+                    )
+            except httpx.RequestError as e:
+                lib_logger.warning(
+                    f"Gemini onboarding/discovery network error: {e}. Falling back to project listing."
+                )
+
+        # 3. Fallback to listing all available GCP projects (last resort)
+        lib_logger.debug(
+            "Attempting to discover project via GCP Resource Manager API..."
+        )
+        try:
+            async with httpx.AsyncClient() as client:
+                lib_logger.debug(
+                    "Querying Cloud Resource Manager for available projects..."
+                )
+                response = await client.get(
+                    "https://cloudresourcemanager.googleapis.com/v1/projects",
+                    headers=headers,
+                    timeout=20,
+                )
+                response.raise_for_status()
+                projects = response.json().get("projects", [])
+                lib_logger.debug(f"Found {len(projects)} total projects")
+                active_projects = [
+                    p for p in projects if p.get("lifecycleState") == "ACTIVE"
+                ]
+                lib_logger.debug(f"Found {len(active_projects)} active projects")
+
+                if not projects:
+                    lib_logger.error(
+                        "No GCP projects found for this account. Please create a project in Google Cloud Console."
+                    )
+                elif not active_projects:
+                    lib_logger.error(
+                        "No active GCP projects found. Please activate a project in Google Cloud Console."
+                    )
+                else:
+                    project_id = active_projects[0]["projectId"]
+                    lib_logger.info(
+                        f"Discovered Gemini project ID from active projects list: {project_id}"
+                    )
+                    lib_logger.debug(
+                        f"Selected first active project: {project_id} (out of {len(active_projects)} active projects)"
+                    )
+                    self.project_id_cache[credential_path] = project_id
+                    discovered_project_id = project_id
+
+                    # Persist to credential file (no tier info from resource manager)
+                    await self._persist_project_metadata(
+                        credential_path, project_id, None
+                    )
+
+                    return project_id
+        except httpx.HTTPStatusError as e:
+            if e.response.status_code == 403:
+                lib_logger.error(
+                    "Failed to list GCP projects due to a 403 Forbidden error. The Cloud Resource Manager API may not be enabled, or your account lacks the 'resourcemanager.projects.list' permission."
+                )
+            else:
+                lib_logger.error(
+                    f"Failed to list GCP projects with status {e.response.status_code}: {e}"
+                )
+        except httpx.RequestError as e:
+            lib_logger.error(f"Network error while listing GCP projects: {e}")
+
+        raise ValueError(
+            "Could not auto-discover Gemini project ID. Possible causes:\n"
+            "  1. The cloudaicompanion.googleapis.com API is not enabled (enable it in Google Cloud Console)\n"
+            "  2. No active GCP projects exist for this account (create one in Google Cloud Console)\n"
+            "  3. Account lacks necessary permissions\n"
+            "To manually specify a project, set GEMINI_CLI_PROJECT_ID in your .env file."
+        )
+
+    async def _persist_project_metadata(
+        self, credential_path: str, project_id: str, tier: Optional[str]
+    ):
+        """Persists project ID and tier to the credential file for faster future startups."""
+        # Skip persistence for env:// paths (environment-based credentials)
+        credential_index = self._parse_env_credential_path(credential_path)
+        if credential_index is not None:
+            lib_logger.debug(
+                f"Skipping project metadata persistence for env:// credential path: {credential_path}"
+            )
+            return
+
+        try:
+            # Load current credentials
+            with open(credential_path, "r") as f:
+                creds = json.load(f)
+
+            # Update metadata
+            if "_proxy_metadata" not in creds:
+                creds["_proxy_metadata"] = {}
+
+            creds["_proxy_metadata"]["project_id"] = project_id
+            if tier:
+                creds["_proxy_metadata"]["tier"] = tier
+
+            # Save back using the existing save method (handles atomic writes and permissions)
+            await self._save_credentials(credential_path, creds)
+
+            lib_logger.debug(
+                f"Persisted project_id and tier to credential file: {credential_path}"
+            )
+        except Exception as e:
+            lib_logger.warning(
+                f"Failed to persist project metadata to credential file: {e}"
+            )
+            # Non-fatal - just means slower startup next time
+
+    # =========================================================================
+    # CREDENTIAL MANAGEMENT OVERRIDES
+    # =========================================================================
+
+    def _get_provider_file_prefix(self) -> str:
+        """Return the file prefix for Gemini CLI credentials."""
+        return "gemini_cli"
+
+    def build_env_lines(self, creds: Dict[str, Any], cred_number: int) -> List[str]:
+        """
+        Generate .env file lines for a Gemini CLI credential.
+
+        Includes tier and project_id from _proxy_metadata.
+        """
+        # Get base lines from parent class
+        lines = super().build_env_lines(creds, cred_number)
+
+        # Add Gemini-specific fields (tier and project_id)
+        metadata = creds.get("_proxy_metadata", {})
+        prefix = f"{self.ENV_PREFIX}_{cred_number}"
+
+        project_id = metadata.get("project_id", "")
+        tier = metadata.get("tier", "")
+
+        if project_id:
+            lines.append(f"{prefix}_PROJECT_ID={project_id}")
+        if tier:
+            lines.append(f"{prefix}_TIER={tier}")
+
+        return lines

src/rotator_library/providers/gemini_cli_provider.py

@@ -383,12 +383,7 @@ class GeminiCliProvider(GeminiAuthBase, ProviderInterface):
     def __init__(self):
         super().__init__()
         self.model_definitions = ModelDefinitions()
-        self.project_id_cache: Dict[
-            str, str
-        ] = {}  # Cache project ID per credential path
-        self.project_tier_cache: Dict[
-            str, str
-        ] = {}  # Cache project tier per credential path
+        # NOTE: project_id_cache and project_tier_cache are inherited from GeminiAuthBase
 
         # Gemini 3 configuration from environment
         memory_ttl = _env_int("GEMINI_CLI_SIGNATURE_CACHE_TTL", 3600)
@@ -580,6 +575,8 @@ class GeminiCliProvider(GeminiAuthBase, ProviderInterface):
 
         return loaded
 
+    # NOTE: _post_auth_discovery() is inherited from GeminiAuthBase
+
     # =========================================================================
     # MODEL UTILITIES
     # =========================================================================
@@ -595,520 +592,7 @@ class GeminiCliProvider(GeminiAuthBase, ProviderInterface):
             return name[len(self._gemini3_tool_prefix) :]
         return name
 
-    async def _discover_project_id(
-        self, credential_path: str, access_token: str, litellm_params: Dict[str, Any]
-    ) -> str:
-        """
-        Discovers the Google Cloud Project ID, with caching and onboarding for new accounts.
-
-        This follows the official Gemini CLI discovery flow:
-        1. Check in-memory cache
-        2. Check configured project_id override (litellm_params or env var)
-        3. Check persisted project_id in credential file
-        4. Call loadCodeAssist to check if user is already known (has currentTier)
-           - If currentTier exists AND cloudaicompanionProject returned: use server's project
-           - If currentTier exists but NO cloudaicompanionProject: use configured project_id (paid tier requires this)
-           - If no currentTier: user needs onboarding
-        5. Onboard user based on tier:
-           - FREE tier: pass cloudaicompanionProject=None (server-managed)
-           - PAID tier: pass cloudaicompanionProject=configured_project_id
-        6. Fallback to GCP Resource Manager project listing
-        """
-        lib_logger.debug(
-            f"Starting project discovery for credential: {credential_path}"
-        )
-
-        # Check in-memory cache first
-        if credential_path in self.project_id_cache:
-            cached_project = self.project_id_cache[credential_path]
-            lib_logger.debug(f"Using cached project ID: {cached_project}")
-            return cached_project
-
-        # Check for configured project ID override (from litellm_params or env var)
-        # This is REQUIRED for paid tier users per the official CLI behavior
-        configured_project_id = litellm_params.get("project_id")
-        if configured_project_id:
-            lib_logger.debug(
-                f"Found configured project_id override: {configured_project_id}"
-            )
-
-        # Load credentials from file to check for persisted project_id and tier
-        # Skip for env:// paths (environment-based credentials don't persist to files)
-        credential_index = self._parse_env_credential_path(credential_path)
-        if credential_index is None:
-            # Only try to load from file if it's not an env:// path
-            try:
-                with open(credential_path, "r") as f:
-                    creds = json.load(f)
-
-                metadata = creds.get("_proxy_metadata", {})
-                persisted_project_id = metadata.get("project_id")
-                persisted_tier = metadata.get("tier")
-
-                if persisted_project_id:
-                    lib_logger.info(
-                        f"Loaded persisted project ID from credential file: {persisted_project_id}"
-                    )
-                    self.project_id_cache[credential_path] = persisted_project_id
-
-                    # Also load tier if available
-                    if persisted_tier:
-                        self.project_tier_cache[credential_path] = persisted_tier
-                        lib_logger.debug(f"Loaded persisted tier: {persisted_tier}")
-
-                    return persisted_project_id
-            except (FileNotFoundError, json.JSONDecodeError, KeyError) as e:
-                lib_logger.debug(f"Could not load persisted project ID from file: {e}")
-
-        lib_logger.debug(
-            "No cached or configured project ID found, initiating discovery..."
-        )
-        headers = {
-            "Authorization": f"Bearer {access_token}",
-            "Content-Type": "application/json",
-        }
-
-        discovered_project_id = None
-        discovered_tier = None
-
-        async with httpx.AsyncClient() as client:
-            # 1. Try discovery endpoint with loadCodeAssist
-            lib_logger.debug(
-                "Attempting project discovery via Code Assist loadCodeAssist endpoint..."
-            )
-            try:
-                # Build metadata - include duetProject only if we have a configured project
-                core_client_metadata = {
-                    "ideType": "IDE_UNSPECIFIED",
-                    "platform": "PLATFORM_UNSPECIFIED",
-                    "pluginType": "GEMINI",
-                }
-                if configured_project_id:
-                    core_client_metadata["duetProject"] = configured_project_id
-
-                # Build load request - pass configured_project_id if available, otherwise None
-                load_request = {
-                    "cloudaicompanionProject": configured_project_id,  # Can be None
-                    "metadata": core_client_metadata,
-                }
-
-                lib_logger.debug(
-                    f"Sending loadCodeAssist request with cloudaicompanionProject={configured_project_id}"
-                )
-                response = await client.post(
-                    f"{CODE_ASSIST_ENDPOINT}:loadCodeAssist",
-                    headers=headers,
-                    json=load_request,
-                    timeout=20,
-                )
-                response.raise_for_status()
-                data = response.json()
-
-                # Log full response for debugging
-                lib_logger.debug(
-                    f"loadCodeAssist full response keys: {list(data.keys())}"
-                )
-
-                # Extract and log ALL tier information for debugging
-                allowed_tiers = data.get("allowedTiers", [])
-                current_tier = data.get("currentTier")
-
-                lib_logger.debug(f"=== Tier Information ===")
-                lib_logger.debug(f"currentTier: {current_tier}")
-                lib_logger.debug(f"allowedTiers count: {len(allowed_tiers)}")
-                for i, tier in enumerate(allowed_tiers):
-                    tier_id = tier.get("id", "unknown")
-                    is_default = tier.get("isDefault", False)
-                    user_defined = tier.get("userDefinedCloudaicompanionProject", False)
-                    lib_logger.debug(
-                        f"  Tier {i + 1}: id={tier_id}, isDefault={is_default}, userDefinedProject={user_defined}"
-                    )
-                lib_logger.debug(f"========================")
-
-                # Determine the current tier ID
-                current_tier_id = None
-                if current_tier:
-                    current_tier_id = current_tier.get("id")
-                    lib_logger.debug(f"User has currentTier: {current_tier_id}")
-
-                # Check if user is already known to server (has currentTier)
-                if current_tier_id:
-                    # User is already onboarded - check for project from server
-                    server_project = data.get("cloudaicompanionProject")
-
-                    # Check if this tier requires user-defined project (paid tiers)
-                    requires_user_project = any(
-                        t.get("id") == current_tier_id
-                        and t.get("userDefinedCloudaicompanionProject", False)
-                        for t in allowed_tiers
-                    )
-                    is_free_tier = current_tier_id == "free-tier"
-
-                    if server_project:
-                        # Server returned a project - use it (server wins)
-                        # This is the normal case for FREE tier users
-                        project_id = server_project
-                        lib_logger.debug(f"Server returned project: {project_id}")
-                    elif configured_project_id:
-                        # No server project but we have configured one - use it
-                        # This is the PAID TIER case where server doesn't return a project
-                        project_id = configured_project_id
-                        lib_logger.debug(
-                            f"No server project, using configured: {project_id}"
-                        )
-                    elif is_free_tier:
-                        # Free tier user without server project - this shouldn't happen normally
-                        # but let's not fail, just proceed to onboarding
-                        lib_logger.debug(
-                            "Free tier user with currentTier but no project - will try onboarding"
-                        )
-                        project_id = None
-                    elif requires_user_project:
-                        # Paid tier requires a project ID to be set
-                        raise ValueError(
-                            f"Paid tier '{current_tier_id}' requires setting GEMINI_CLI_PROJECT_ID environment variable. "
-                            "See https://goo.gle/gemini-cli-auth-docs#workspace-gca"
-                        )
-                    else:
-                        # Unknown tier without project - proceed carefully
-                        lib_logger.warning(
-                            f"Tier '{current_tier_id}' has no project and none configured - will try onboarding"
-                        )
-                        project_id = None
-
-                    if project_id:
-                        # Cache tier info
-                        self.project_tier_cache[credential_path] = current_tier_id
-                        discovered_tier = current_tier_id
-
-                        # Log appropriately based on tier
-                        is_paid = current_tier_id and current_tier_id not in [
-                            "free-tier",
-                            "legacy-tier",
-                            "unknown",
-                        ]
-                        if is_paid:
-                            lib_logger.info(
-                                f"Using Gemini paid tier '{current_tier_id}' with project: {project_id}"
-                            )
-                        else:
-                            lib_logger.info(
-                                f"Discovered Gemini project ID via loadCodeAssist: {project_id}"
-                            )
-
-                        self.project_id_cache[credential_path] = project_id
-                        discovered_project_id = project_id
-
-                        # Persist to credential file
-                        await self._persist_project_metadata(
-                            credential_path, project_id, discovered_tier
-                        )
-
-                        return project_id
-
-                # 2. User needs onboarding - no currentTier
-                lib_logger.info(
-                    "No existing Gemini session found (no currentTier), attempting to onboard user..."
-                )
-
-                # Determine which tier to onboard with
-                onboard_tier = None
-                for tier in allowed_tiers:
-                    if tier.get("isDefault"):
-                        onboard_tier = tier
-                        break
-
-                # Fallback to LEGACY tier if no default (requires user project)
-                if not onboard_tier and allowed_tiers:
-                    # Look for legacy-tier as fallback
-                    for tier in allowed_tiers:
-                        if tier.get("id") == "legacy-tier":
-                            onboard_tier = tier
-                            break
-                    # If still no tier, use first available
-                    if not onboard_tier:
-                        onboard_tier = allowed_tiers[0]
-
-                if not onboard_tier:
-                    raise ValueError("No onboarding tiers available from server")
-
-                tier_id = onboard_tier.get("id", "free-tier")
-                requires_user_project = onboard_tier.get(
-                    "userDefinedCloudaicompanionProject", False
-                )
-
-                lib_logger.debug(
-                    f"Onboarding with tier: {tier_id}, requiresUserProject: {requires_user_project}"
-                )
-
-                # Build onboard request based on tier type (following official CLI logic)
-                # FREE tier: cloudaicompanionProject = None (server-managed)
-                # PAID tier: cloudaicompanionProject = configured_project_id (user must provide)
-                is_free_tier = tier_id == "free-tier"
-
-                if is_free_tier:
-                    # Free tier uses server-managed project
-                    onboard_request = {
-                        "tierId": tier_id,
-                        "cloudaicompanionProject": None,  # Server will create/manage
-                        "metadata": core_client_metadata,
-                    }
-                    lib_logger.debug(
-                        "Free tier onboarding: using server-managed project"
-                    )
-                else:
-                    # Paid/legacy tier requires user-provided project
-                    if not configured_project_id and requires_user_project:
-                        raise ValueError(
-                            f"Tier '{tier_id}' requires setting GEMINI_CLI_PROJECT_ID environment variable. "
-                            "See https://goo.gle/gemini-cli-auth-docs#workspace-gca"
-                        )
-                    onboard_request = {
-                        "tierId": tier_id,
-                        "cloudaicompanionProject": configured_project_id,
-                        "metadata": {
-                            **core_client_metadata,
-                            "duetProject": configured_project_id,
-                        }
-                        if configured_project_id
-                        else core_client_metadata,
-                    }
-                    lib_logger.debug(
-                        f"Paid tier onboarding: using project {configured_project_id}"
-                    )
-
-                lib_logger.debug("Initiating onboardUser request...")
-                lro_response = await client.post(
-                    f"{CODE_ASSIST_ENDPOINT}:onboardUser",
-                    headers=headers,
-                    json=onboard_request,
-                    timeout=30,
-                )
-                lro_response.raise_for_status()
-                lro_data = lro_response.json()
-                lib_logger.debug(
-                    f"Initial onboarding response: done={lro_data.get('done')}"
-                )
-
-                for i in range(150):  # Poll for up to 5 minutes (150 × 2s)
-                    if lro_data.get("done"):
-                        lib_logger.debug(
-                            f"Onboarding completed after {i} polling attempts"
-                        )
-                        break
-                    await asyncio.sleep(2)
-                    if (i + 1) % 15 == 0:  # Log every 30 seconds
-                        lib_logger.info(
-                            f"Still waiting for onboarding completion... ({(i + 1) * 2}s elapsed)"
-                        )
-                    lib_logger.debug(
-                        f"Polling onboarding status... (Attempt {i + 1}/150)"
-                    )
-                    lro_response = await client.post(
-                        f"{CODE_ASSIST_ENDPOINT}:onboardUser",
-                        headers=headers,
-                        json=onboard_request,
-                        timeout=30,
-                    )
-                    lro_response.raise_for_status()
-                    lro_data = lro_response.json()
-
-                if not lro_data.get("done"):
-                    lib_logger.error("Onboarding process timed out after 5 minutes")
-                    raise ValueError(
-                        "Onboarding process timed out after 5 minutes. Please try again or contact support."
-                    )
-
-                # Extract project ID from LRO response
-                # Note: onboardUser returns response.cloudaicompanionProject as an object with .id
-                lro_response_data = lro_data.get("response", {})
-                lro_project_obj = lro_response_data.get("cloudaicompanionProject", {})
-                project_id = (
-                    lro_project_obj.get("id")
-                    if isinstance(lro_project_obj, dict)
-                    else None
-                )
-
-                # Fallback to configured project if LRO didn't return one
-                if not project_id and configured_project_id:
-                    project_id = configured_project_id
-                    lib_logger.debug(
-                        f"LRO didn't return project, using configured: {project_id}"
-                    )
-
-                if not project_id:
-                    lib_logger.error(
-                        "Onboarding completed but no project ID in response and none configured"
-                    )
-                    raise ValueError(
-                        "Onboarding completed, but no project ID was returned. "
-                        "For paid tiers, set GEMINI_CLI_PROJECT_ID environment variable."
-                    )
-
-                lib_logger.debug(
-                    f"Successfully extracted project ID from onboarding response: {project_id}"
-                )
-
-                # Cache tier info
-                self.project_tier_cache[credential_path] = tier_id
-                discovered_tier = tier_id
-                lib_logger.debug(f"Cached tier information: {tier_id}")
-
-                # Log concise message for paid projects
-                is_paid = tier_id and tier_id not in ["free-tier", "legacy-tier"]
-                if is_paid:
-                    lib_logger.info(
-                        f"Using Gemini paid tier '{tier_id}' with project: {project_id}"
-                    )
-                else:
-                    lib_logger.info(
-                        f"Successfully onboarded user and discovered project ID: {project_id}"
-                    )
-
-                self.project_id_cache[credential_path] = project_id
-                discovered_project_id = project_id
-
-                # Persist to credential file
-                await self._persist_project_metadata(
-                    credential_path, project_id, discovered_tier
-                )
-
-                return project_id
-
-            except httpx.HTTPStatusError as e:
-                error_body = ""
-                try:
-                    error_body = e.response.text
-                except Exception:
-                    pass
-                if e.response.status_code == 403:
-                    lib_logger.error(
-                        f"Gemini Code Assist API access denied (403). Response: {error_body}"
-                    )
-                    lib_logger.error(
-                        "Possible causes: 1) cloudaicompanion.googleapis.com API not enabled, 2) Wrong project ID for paid tier, 3) Account lacks permissions"
-                    )
-                elif e.response.status_code == 404:
-                    lib_logger.warning(
-                        f"Gemini Code Assist endpoint not found (404). Falling back to project listing."
-                    )
-                elif e.response.status_code == 412:
-                    # Precondition Failed - often means wrong project for free tier onboarding
-                    lib_logger.error(
-                        f"Precondition failed (412): {error_body}. This may mean the project ID is incompatible with the selected tier."
-                    )
-                else:
-                    lib_logger.warning(
-                        f"Gemini onboarding/discovery failed with status {e.response.status_code}: {error_body}. Falling back to project listing."
-                    )
-            except httpx.RequestError as e:
-                lib_logger.warning(
-                    f"Gemini onboarding/discovery network error: {e}. Falling back to project listing."
-                )
-
-        # 3. Fallback to listing all available GCP projects (last resort)
-        lib_logger.debug(
-            "Attempting to discover project via GCP Resource Manager API..."
-        )
-        try:
-            async with httpx.AsyncClient() as client:
-                lib_logger.debug(
-                    "Querying Cloud Resource Manager for available projects..."
-                )
-                response = await client.get(
-                    "https://cloudresourcemanager.googleapis.com/v1/projects",
-                    headers=headers,
-                    timeout=20,
-                )
-                response.raise_for_status()
-                projects = response.json().get("projects", [])
-                lib_logger.debug(f"Found {len(projects)} total projects")
-                active_projects = [
-                    p for p in projects if p.get("lifecycleState") == "ACTIVE"
-                ]
-                lib_logger.debug(f"Found {len(active_projects)} active projects")
-
-                if not projects:
-                    lib_logger.error(
-                        "No GCP projects found for this account. Please create a project in Google Cloud Console."
-                    )
-                elif not active_projects:
-                    lib_logger.error(
-                        "No active GCP projects found. Please activate a project in Google Cloud Console."
-                    )
-                else:
-                    project_id = active_projects[0]["projectId"]
-                    lib_logger.info(
-                        f"Discovered Gemini project ID from active projects list: {project_id}"
-                    )
-                    lib_logger.debug(
-                        f"Selected first active project: {project_id} (out of {len(active_projects)} active projects)"
-                    )
-                    self.project_id_cache[credential_path] = project_id
-                    discovered_project_id = project_id
-
-                    # [NEW] Persist to credential file (no tier info from resource manager)
-                    await self._persist_project_metadata(
-                        credential_path, project_id, None
-                    )
-
-                    return project_id
-        except httpx.HTTPStatusError as e:
-            if e.response.status_code == 403:
-                lib_logger.error(
-                    "Failed to list GCP projects due to a 403 Forbidden error. The Cloud Resource Manager API may not be enabled, or your account lacks the 'resourcemanager.projects.list' permission."
-                )
-            else:
-                lib_logger.error(
-                    f"Failed to list GCP projects with status {e.response.status_code}: {e}"
-                )
-        except httpx.RequestError as e:
-            lib_logger.error(f"Network error while listing GCP projects: {e}")
-
-        raise ValueError(
-            "Could not auto-discover Gemini project ID. Possible causes:\n"
-            "  1. The cloudaicompanion.googleapis.com API is not enabled (enable it in Google Cloud Console)\n"
-            "  2. No active GCP projects exist for this account (create one in Google Cloud Console)\n"
-            "  3. Account lacks necessary permissions\n"
-            "To manually specify a project, set GEMINI_CLI_PROJECT_ID in your .env file."
-        )
-
-    async def _persist_project_metadata(
-        self, credential_path: str, project_id: str, tier: Optional[str]
-    ):
-        """Persists project ID and tier to the credential file for faster future startups."""
-        # Skip persistence for env:// paths (environment-based credentials)
-        credential_index = self._parse_env_credential_path(credential_path)
-        if credential_index is not None:
-            lib_logger.debug(
-                f"Skipping project metadata persistence for env:// credential path: {credential_path}"
-            )
-            return
-
-        try:
-            # Load current credentials
-            with open(credential_path, "r") as f:
-                creds = json.load(f)
-
-            # Update metadata
-            if "_proxy_metadata" not in creds:
-                creds["_proxy_metadata"] = {}
-
-            creds["_proxy_metadata"]["project_id"] = project_id
-            if tier:
-                creds["_proxy_metadata"]["tier"] = tier
-
-            # Save back using the existing save method (handles atomic writes and permissions)
-            await self._save_credentials(credential_path, creds)
-
-            lib_logger.debug(
-                f"Persisted project_id and tier to credential file: {credential_path}"
-            )
-        except Exception as e:
-            lib_logger.warning(
-                f"Failed to persist project metadata to credential file: {e}"
-            )
-            # Non-fatal - just means slower startup next time
+    # NOTE: _discover_project_id() and _persist_project_metadata() are inherited from GeminiAuthBase
 
     def _check_mixed_tier_warning(self):
         """Check if mixed free/paid tier credentials are loaded and emit warning."""

src/rotator_library/providers/google_oauth_base.py

@@ -1,14 +1,17 @@
 # src/rotator_library/providers/google_oauth_base.py
 
 import os
+import re
 import webbrowser
-from typing import Union, Optional
+from dataclasses import dataclass, field
+from typing import Union, Optional, List
 import json
 import time
 import asyncio
 import logging
 from pathlib import Path
 from typing import Dict, Any
+from glob import glob
 
 import httpx
 from rich.console import Console
@@ -25,6 +28,24 @@ lib_logger = logging.getLogger("rotator_library")
 console = Console()
 
 
+@dataclass
+class CredentialSetupResult:
+    """
+    Standardized result structure for credential setup operations.
+
+    Used by all auth classes to return consistent setup results to the credential tool.
+    """
+
+    success: bool
+    file_path: Optional[str] = None
+    email: Optional[str] = None
+    tier: Optional[str] = None
+    project_id: Optional[str] = None
+    is_update: bool = False
+    error: Optional[str] = None
+    credentials: Optional[Dict[str, Any]] = field(default=None, repr=False)
+
+
 class GoogleOAuthBase:
     """
     Base class for Google OAuth2 authentication providers.
@@ -840,6 +861,18 @@ class GoogleOAuthBase:
             lib_logger.info(
                 f"{self.ENV_PREFIX} OAuth initialized successfully for '{display_name}'."
             )
+
+            # Perform post-auth discovery (tier, project, etc.) while we have a fresh token
+            if path:
+                try:
+                    await self._post_auth_discovery(path, new_creds["access_token"])
+                except Exception as e:
+                    # Don't fail auth if discovery fails - it can be retried on first request
+                    lib_logger.warning(
+                        f"Post-auth discovery failed for '{display_name}': {e}. "
+                        "Tier/project will be discovered on first request."
+                    )
+
         return new_creds
 
     async def initialize_token(
@@ -945,6 +978,23 @@ class GoogleOAuthBase:
                 return {"Authorization": f"Bearer {cached['access_token']}"}
             raise
 
+    async def _post_auth_discovery(
+        self, credential_path: str, access_token: str
+    ) -> None:
+        """
+        Hook for subclasses to perform post-authentication discovery.
+
+        Called after successful OAuth authentication (both initial and re-auth).
+        Subclasses can override this to discover and cache tier/project information
+        during the authentication flow rather than waiting for the first API request.
+
+        Args:
+            credential_path: Path to the credential file
+            access_token: The newly obtained access token
+        """
+        # Default implementation does nothing - subclasses can override
+        pass
+
     async def get_user_info(
         self, creds_or_path: Union[Dict[str, Any], str]
     ) -> Dict[str, Any]:
@@ -976,3 +1026,372 @@ class GoogleOAuthBase:
             if path:
                 await self._save_credentials(path, creds)
             return {"email": user_info.get("email")}
+
+    # =========================================================================
+    # CREDENTIAL MANAGEMENT METHODS
+    # =========================================================================
+
+    def _get_provider_file_prefix(self) -> str:
+        """
+        Get the file name prefix for this provider's credential files.
+
+        Override in subclasses if the prefix differs from ENV_PREFIX.
+        Default: lowercase ENV_PREFIX with underscores (e.g., "gemini_cli")
+        """
+        return self.ENV_PREFIX.lower()
+
+    def _get_oauth_base_dir(self) -> Path:
+        """
+        Get the base directory for OAuth credential files.
+
+        Can be overridden to customize credential storage location.
+        """
+        return Path.cwd() / "oauth_creds"
+
+    def _find_existing_credential_by_email(
+        self, email: str, base_dir: Optional[Path] = None
+    ) -> Optional[Path]:
+        """
+        Find an existing credential file for the given email.
+
+        Args:
+            email: Email address to search for
+            base_dir: Directory to search in (defaults to oauth_creds)
+
+        Returns:
+            Path to existing credential file, or None if not found
+        """
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        for cred_file in glob(pattern):
+            try:
+                with open(cred_file, "r") as f:
+                    creds = json.load(f)
+                existing_email = creds.get("_proxy_metadata", {}).get("email")
+                if existing_email == email:
+                    return Path(cred_file)
+            except (json.JSONDecodeError, IOError) as e:
+                lib_logger.debug(f"Could not read credential file {cred_file}: {e}")
+                continue
+
+        return None
+
+    def _get_next_credential_number(self, base_dir: Optional[Path] = None) -> int:
+        """
+        Get the next available credential number for new credential files.
+
+        Args:
+            base_dir: Directory to scan (defaults to oauth_creds)
+
+        Returns:
+            Next available credential number (1, 2, 3, etc.)
+        """
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        existing_numbers = []
+        for cred_file in glob(pattern):
+            match = re.search(r"_oauth_(\d+)\.json$", cred_file)
+            if match:
+                existing_numbers.append(int(match.group(1)))
+
+        if not existing_numbers:
+            return 1
+        return max(existing_numbers) + 1
+
+    def _build_credential_path(
+        self, base_dir: Optional[Path] = None, number: Optional[int] = None
+    ) -> Path:
+        """
+        Build a path for a new credential file.
+
+        Args:
+            base_dir: Directory for credential files (defaults to oauth_creds)
+            number: Credential number (auto-determined if None)
+
+        Returns:
+            Path for the new credential file
+        """
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        if number is None:
+            number = self._get_next_credential_number(base_dir)
+
+        prefix = self._get_provider_file_prefix()
+        filename = f"{prefix}_oauth_{number}.json"
+        return base_dir / filename
+
+    async def setup_credential(
+        self, base_dir: Optional[Path] = None
+    ) -> CredentialSetupResult:
+        """
+        Complete credential setup flow: OAuth -> save -> discovery.
+
+        This is the main entry point for setting up new credentials.
+        Handles the entire lifecycle:
+        1. Perform OAuth authentication
+        2. Get user info (email) for deduplication
+        3. Find existing credential or create new file path
+        4. Save credentials to file
+        5. Perform post-auth discovery (tier/project for Google OAuth)
+
+        Args:
+            base_dir: Directory for credential files (defaults to oauth_creds)
+
+        Returns:
+            CredentialSetupResult with status and details
+        """
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        # Ensure directory exists
+        base_dir.mkdir(exist_ok=True)
+
+        try:
+            # Step 1: Perform OAuth authentication (returns credentials dict)
+            temp_creds = {
+                "_proxy_metadata": {"display_name": f"new {self.ENV_PREFIX} credential"}
+            }
+            new_creds = await self.initialize_token(temp_creds)
+
+            # Step 2: Get user info for deduplication
+            user_info = await self.get_user_info(new_creds)
+            email = user_info.get("email")
+
+            if not email:
+                return CredentialSetupResult(
+                    success=False, error="Could not retrieve email from OAuth response"
+                )
+
+            # Step 3: Check for existing credential with same email
+            existing_path = self._find_existing_credential_by_email(email, base_dir)
+            is_update = existing_path is not None
+
+            if is_update:
+                file_path = existing_path
+                lib_logger.info(
+                    f"Found existing credential for {email}, updating {file_path.name}"
+                )
+            else:
+                file_path = self._build_credential_path(base_dir)
+                lib_logger.info(
+                    f"Creating new credential for {email} at {file_path.name}"
+                )
+
+            # Step 4: Save credentials to file
+            await self._save_credentials(str(file_path), new_creds)
+
+            # Step 5: Perform post-auth discovery (tier, project_id)
+            # This is already called in _perform_interactive_oauth, but we call it again
+            # in case credentials were loaded from existing token
+            tier = None
+            project_id = None
+            try:
+                await self._post_auth_discovery(
+                    str(file_path), new_creds["access_token"]
+                )
+                # Reload credentials to get discovered metadata
+                with open(file_path, "r") as f:
+                    updated_creds = json.load(f)
+                tier = updated_creds.get("_proxy_metadata", {}).get("tier")
+                project_id = updated_creds.get("_proxy_metadata", {}).get("project_id")
+                new_creds = updated_creds
+            except Exception as e:
+                lib_logger.warning(
+                    f"Post-auth discovery failed: {e}. Tier/project will be discovered on first request."
+                )
+
+            return CredentialSetupResult(
+                success=True,
+                file_path=str(file_path),
+                email=email,
+                tier=tier,
+                project_id=project_id,
+                is_update=is_update,
+                credentials=new_creds,
+            )
+
+        except Exception as e:
+            lib_logger.error(f"Credential setup failed: {e}")
+            return CredentialSetupResult(success=False, error=str(e))
+
+    def build_env_lines(self, creds: Dict[str, Any], cred_number: int) -> List[str]:
+        """
+        Generate .env file lines for a credential.
+
+        Subclasses should override to include provider-specific fields
+        (e.g., tier, project_id for Google OAuth providers).
+
+        Args:
+            creds: Credential dictionary loaded from JSON
+            cred_number: Credential number (1, 2, 3, etc.)
+
+        Returns:
+            List of .env file lines
+        """
+        email = creds.get("_proxy_metadata", {}).get("email", "unknown")
+        prefix = f"{self.ENV_PREFIX}_{cred_number}"
+
+        lines = [
+            f"# {self.ENV_PREFIX} Credential #{cred_number} for: {email}",
+            f"# Exported from: {self._get_provider_file_prefix()}_oauth_{cred_number}.json",
+            f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
+            "#",
+            "# To combine multiple credentials into one .env file, copy these lines",
+            "# and ensure each credential has a unique number (1, 2, 3, etc.)",
+            "",
+            f"{prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
+            f"{prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
+            f"{prefix}_SCOPE={creds.get('scope', '')}",
+            f"{prefix}_TOKEN_TYPE={creds.get('token_type', 'Bearer')}",
+            f"{prefix}_ID_TOKEN={creds.get('id_token', '')}",
+            f"{prefix}_EXPIRY_DATE={creds.get('expiry_date', 0)}",
+            f"{prefix}_CLIENT_ID={creds.get('client_id', '')}",
+            f"{prefix}_CLIENT_SECRET={creds.get('client_secret', '')}",
+            f"{prefix}_TOKEN_URI={creds.get('token_uri', 'https://oauth2.googleapis.com/token')}",
+            f"{prefix}_UNIVERSE_DOMAIN={creds.get('universe_domain', 'googleapis.com')}",
+            f"{prefix}_EMAIL={email}",
+        ]
+
+        return lines
+
+    def export_credential_to_env(
+        self, credential_path: str, output_dir: Optional[Path] = None
+    ) -> Optional[str]:
+        """
+        Export a credential file to .env format.
+
+        Args:
+            credential_path: Path to the credential JSON file
+            output_dir: Directory for output .env file (defaults to same as credential)
+
+        Returns:
+            Path to the exported .env file, or None on error
+        """
+        try:
+            cred_path = Path(credential_path)
+
+            # Load credential
+            with open(cred_path, "r") as f:
+                creds = json.load(f)
+
+            # Extract metadata
+            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
+
+            # Get credential number from filename
+            match = re.search(r"_oauth_(\d+)\.json$", cred_path.name)
+            cred_number = int(match.group(1)) if match else 1
+
+            # Build output path
+            if output_dir is None:
+                output_dir = cred_path.parent
+
+            safe_email = email.replace("@", "_at_").replace(".", "_")
+            prefix = self._get_provider_file_prefix()
+            env_filename = f"{prefix}_{cred_number}_{safe_email}.env"
+            env_path = output_dir / env_filename
+
+            # Build and write content
+            env_lines = self.build_env_lines(creds, cred_number)
+            with open(env_path, "w") as f:
+                f.write("\n".join(env_lines))
+
+            lib_logger.info(f"Exported credential to {env_path}")
+            return str(env_path)
+
+        except Exception as e:
+            lib_logger.error(f"Failed to export credential: {e}")
+            return None
+
+    def list_credentials(self, base_dir: Optional[Path] = None) -> List[Dict[str, Any]]:
+        """
+        List all credential files for this provider.
+
+        Args:
+            base_dir: Directory to search (defaults to oauth_creds)
+
+        Returns:
+            List of dicts with credential info:
+            - file_path: Path to credential file
+            - email: User email
+            - tier: Tier info (if available)
+            - project_id: Project ID (if available)
+            - number: Credential number
+        """
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        credentials = []
+        for cred_file in sorted(glob(pattern)):
+            try:
+                with open(cred_file, "r") as f:
+                    creds = json.load(f)
+
+                metadata = creds.get("_proxy_metadata", {})
+
+                # Extract number from filename
+                match = re.search(r"_oauth_(\d+)\.json$", cred_file)
+                number = int(match.group(1)) if match else 0
+
+                credentials.append(
+                    {
+                        "file_path": cred_file,
+                        "email": metadata.get("email", "unknown"),
+                        "tier": metadata.get("tier"),
+                        "project_id": metadata.get("project_id"),
+                        "number": number,
+                    }
+                )
+            except Exception as e:
+                lib_logger.debug(f"Could not read credential file {cred_file}: {e}")
+                continue
+
+        return credentials
+
+    def delete_credential(self, credential_path: str) -> bool:
+        """
+        Delete a credential file.
+
+        Args:
+            credential_path: Path to the credential file
+
+        Returns:
+            True if deleted successfully, False otherwise
+        """
+        try:
+            cred_path = Path(credential_path)
+
+            # Validate that it's one of our credential files
+            prefix = self._get_provider_file_prefix()
+            if not cred_path.name.startswith(f"{prefix}_oauth_"):
+                lib_logger.error(
+                    f"File {cred_path.name} does not appear to be a {self.ENV_PREFIX} credential"
+                )
+                return False
+
+            if not cred_path.exists():
+                lib_logger.warning(f"Credential file does not exist: {credential_path}")
+                return False
+
+            # Remove from cache if present
+            self._credentials_cache.pop(credential_path, None)
+
+            # Delete the file
+            cred_path.unlink()
+            lib_logger.info(f"Deleted credential file: {credential_path}")
+            return True
+
+        except Exception as e:
+            lib_logger.error(f"Failed to delete credential: {e}")
+            return False

src/rotator_library/providers/iflow_auth_base.py

@@ -9,8 +9,11 @@ import logging
 import webbrowser
 import socket
 import os
+import re
+from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Dict, Any, Tuple, Union, Optional
+from glob import glob
+from typing import Dict, Any, Tuple, Union, Optional, List
 from urllib.parse import urlencode, parse_qs, urlparse
 
 import httpx
@@ -40,6 +43,20 @@ IFLOW_CLIENT_SECRET = "4Z3YjXycVsQvyGF1etiNlIBB4RsqSDtW"
 CALLBACK_PORT = 11451
 
 
+@dataclass
+class IFlowCredentialSetupResult:
+    """
+    Standardized result structure for iFlow credential setup operations.
+    """
+
+    success: bool
+    file_path: Optional[str] = None
+    email: Optional[str] = None
+    is_update: bool = False
+    error: Optional[str] = None
+    credentials: Optional[Dict[str, Any]] = field(default=None, repr=False)
+
+
 def get_callback_port() -> int:
     """
     Get the OAuth callback port, checking environment variable first.
@@ -1165,3 +1182,261 @@ class IFlowAuthBase:
         except Exception as e:
             lib_logger.error(f"Failed to get iFlow user info from credentials: {e}")
             return {"email": None}
+
+    # =========================================================================
+    # CREDENTIAL MANAGEMENT METHODS
+    # =========================================================================
+
+    def _get_provider_file_prefix(self) -> str:
+        """Return the file prefix for iFlow credentials."""
+        return "iflow"
+
+    def _get_oauth_base_dir(self) -> Path:
+        """Get the base directory for OAuth credential files."""
+        return Path.cwd() / "oauth_creds"
+
+    def _find_existing_credential_by_email(
+        self, email: str, base_dir: Optional[Path] = None
+    ) -> Optional[Path]:
+        """Find an existing credential file for the given email."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        for cred_file in glob(pattern):
+            try:
+                with open(cred_file, "r") as f:
+                    creds = json.load(f)
+                existing_email = creds.get("email") or creds.get(
+                    "_proxy_metadata", {}
+                ).get("email")
+                if existing_email == email:
+                    return Path(cred_file)
+            except (json.JSONDecodeError, IOError) as e:
+                lib_logger.debug(f"Could not read credential file {cred_file}: {e}")
+                continue
+
+        return None
+
+    def _get_next_credential_number(self, base_dir: Optional[Path] = None) -> int:
+        """Get the next available credential number."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        existing_numbers = []
+        for cred_file in glob(pattern):
+            match = re.search(r"_oauth_(\d+)\.json$", cred_file)
+            if match:
+                existing_numbers.append(int(match.group(1)))
+
+        if not existing_numbers:
+            return 1
+        return max(existing_numbers) + 1
+
+    def _build_credential_path(
+        self, base_dir: Optional[Path] = None, number: Optional[int] = None
+    ) -> Path:
+        """Build a path for a new credential file."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        if number is None:
+            number = self._get_next_credential_number(base_dir)
+
+        prefix = self._get_provider_file_prefix()
+        filename = f"{prefix}_oauth_{number}.json"
+        return base_dir / filename
+
+    async def setup_credential(
+        self, base_dir: Optional[Path] = None
+    ) -> IFlowCredentialSetupResult:
+        """
+        Complete credential setup flow: OAuth -> save.
+
+        This is the main entry point for setting up new credentials.
+        """
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        # Ensure directory exists
+        base_dir.mkdir(exist_ok=True)
+
+        try:
+            # Step 1: Perform OAuth authentication
+            temp_creds = {"_proxy_metadata": {"display_name": "new iFlow credential"}}
+            new_creds = await self.initialize_token(temp_creds)
+
+            # Step 2: Get user info for deduplication
+            email = new_creds.get("email") or new_creds.get("_proxy_metadata", {}).get(
+                "email"
+            )
+
+            if not email:
+                return IFlowCredentialSetupResult(
+                    success=False, error="Could not retrieve email from OAuth response"
+                )
+
+            # Step 3: Check for existing credential with same email
+            existing_path = self._find_existing_credential_by_email(email, base_dir)
+            is_update = existing_path is not None
+
+            if is_update:
+                file_path = existing_path
+                lib_logger.info(
+                    f"Found existing credential for {email}, updating {file_path.name}"
+                )
+            else:
+                file_path = self._build_credential_path(base_dir)
+                lib_logger.info(
+                    f"Creating new credential for {email} at {file_path.name}"
+                )
+
+            # Step 4: Save credentials to file
+            await self._save_credentials(str(file_path), new_creds)
+
+            return IFlowCredentialSetupResult(
+                success=True,
+                file_path=str(file_path),
+                email=email,
+                is_update=is_update,
+                credentials=new_creds,
+            )
+
+        except Exception as e:
+            lib_logger.error(f"Credential setup failed: {e}")
+            return IFlowCredentialSetupResult(success=False, error=str(e))
+
+    def build_env_lines(self, creds: Dict[str, Any], cred_number: int) -> List[str]:
+        """Generate .env file lines for an iFlow credential."""
+        email = creds.get("email") or creds.get("_proxy_metadata", {}).get(
+            "email", "unknown"
+        )
+        prefix = f"IFLOW_{cred_number}"
+
+        lines = [
+            f"# IFLOW Credential #{cred_number} for: {email}",
+            f"# Exported from: iflow_oauth_{cred_number}.json",
+            f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
+            "#",
+            "# To combine multiple credentials into one .env file, copy these lines",
+            "# and ensure each credential has a unique number (1, 2, 3, etc.)",
+            "",
+            f"{prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
+            f"{prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
+            f"{prefix}_API_KEY={creds.get('api_key', '')}",
+            f"{prefix}_EXPIRY_DATE={creds.get('expiry_date', '')}",
+            f"{prefix}_EMAIL={email}",
+            f"{prefix}_TOKEN_TYPE={creds.get('token_type', 'Bearer')}",
+            f"{prefix}_SCOPE={creds.get('scope', 'read write')}",
+        ]
+
+        return lines
+
+    def export_credential_to_env(
+        self, credential_path: str, output_dir: Optional[Path] = None
+    ) -> Optional[str]:
+        """Export a credential file to .env format."""
+        try:
+            cred_path = Path(credential_path)
+
+            # Load credential
+            with open(cred_path, "r") as f:
+                creds = json.load(f)
+
+            # Extract metadata
+            email = creds.get("email") or creds.get("_proxy_metadata", {}).get(
+                "email", "unknown"
+            )
+
+            # Get credential number from filename
+            match = re.search(r"_oauth_(\d+)\.json$", cred_path.name)
+            cred_number = int(match.group(1)) if match else 1
+
+            # Build output path
+            if output_dir is None:
+                output_dir = cred_path.parent
+
+            safe_email = email.replace("@", "_at_").replace(".", "_")
+            env_filename = f"iflow_{cred_number}_{safe_email}.env"
+            env_path = output_dir / env_filename
+
+            # Build and write content
+            env_lines = self.build_env_lines(creds, cred_number)
+            with open(env_path, "w") as f:
+                f.write("\n".join(env_lines))
+
+            lib_logger.info(f"Exported credential to {env_path}")
+            return str(env_path)
+
+        except Exception as e:
+            lib_logger.error(f"Failed to export credential: {e}")
+            return None
+
+    def list_credentials(self, base_dir: Optional[Path] = None) -> List[Dict[str, Any]]:
+        """List all iFlow credential files."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        credentials = []
+        for cred_file in sorted(glob(pattern)):
+            try:
+                with open(cred_file, "r") as f:
+                    creds = json.load(f)
+
+                email = creds.get("email") or creds.get("_proxy_metadata", {}).get(
+                    "email", "unknown"
+                )
+
+                # Extract number from filename
+                match = re.search(r"_oauth_(\d+)\.json$", cred_file)
+                number = int(match.group(1)) if match else 0
+
+                credentials.append(
+                    {
+                        "file_path": cred_file,
+                        "email": email,
+                        "number": number,
+                    }
+                )
+            except Exception as e:
+                lib_logger.debug(f"Could not read credential file {cred_file}: {e}")
+                continue
+
+        return credentials
+
+    def delete_credential(self, credential_path: str) -> bool:
+        """Delete a credential file."""
+        try:
+            cred_path = Path(credential_path)
+
+            # Validate that it's one of our credential files
+            prefix = self._get_provider_file_prefix()
+            if not cred_path.name.startswith(f"{prefix}_oauth_"):
+                lib_logger.error(
+                    f"File {cred_path.name} does not appear to be an iFlow credential"
+                )
+                return False
+
+            if not cred_path.exists():
+                lib_logger.warning(f"Credential file does not exist: {credential_path}")
+                return False
+
+            # Remove from cache if present
+            self._credentials_cache.pop(credential_path, None)
+
+            # Delete the file
+            cred_path.unlink()
+            lib_logger.info(f"Deleted credential file: {credential_path}")
+            return True
+
+        except Exception as e:
+            lib_logger.error(f"Failed to delete credential: {e}")
+            return False

src/rotator_library/providers/qwen_auth_base.py

@@ -9,8 +9,11 @@ import asyncio
 import logging
 import webbrowser
 import os
+import re
+from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Dict, Any, Tuple, Union, Optional
+from glob import glob
+from typing import Dict, Any, Tuple, Union, Optional, List
 
 import httpx
 from rich.console import Console
@@ -35,6 +38,20 @@ REFRESH_EXPIRY_BUFFER_SECONDS = 3 * 60 * 60  # 3 hours buffer before expiry
 console = Console()
 
 
+@dataclass
+class QwenCredentialSetupResult:
+    """
+    Standardized result structure for Qwen credential setup operations.
+    """
+
+    success: bool
+    file_path: Optional[str] = None
+    email: Optional[str] = None
+    is_update: bool = False
+    error: Optional[str] = None
+    credentials: Optional[Dict[str, Any]] = field(default=None, repr=False)
+
+
 class QwenAuthBase:
     def __init__(self):
         self._credentials_cache: Dict[str, Dict[str, Any]] = {}
@@ -928,3 +945,251 @@ class QwenAuthBase:
         except Exception as e:
             lib_logger.error(f"Failed to get Qwen user info from credentials: {e}")
             return {"email": None}
+
+    # =========================================================================
+    # CREDENTIAL MANAGEMENT METHODS
+    # =========================================================================
+
+    def _get_provider_file_prefix(self) -> str:
+        """Return the file prefix for Qwen credentials."""
+        return "qwen_code"
+
+    def _get_oauth_base_dir(self) -> Path:
+        """Get the base directory for OAuth credential files."""
+        return Path.cwd() / "oauth_creds"
+
+    def _find_existing_credential_by_email(
+        self, email: str, base_dir: Optional[Path] = None
+    ) -> Optional[Path]:
+        """Find an existing credential file for the given email."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        for cred_file in glob(pattern):
+            try:
+                with open(cred_file, "r") as f:
+                    creds = json.load(f)
+                existing_email = creds.get("_proxy_metadata", {}).get("email")
+                if existing_email == email:
+                    return Path(cred_file)
+            except (json.JSONDecodeError, IOError) as e:
+                lib_logger.debug(f"Could not read credential file {cred_file}: {e}")
+                continue
+
+        return None
+
+    def _get_next_credential_number(self, base_dir: Optional[Path] = None) -> int:
+        """Get the next available credential number."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        existing_numbers = []
+        for cred_file in glob(pattern):
+            match = re.search(r"_oauth_(\d+)\.json$", cred_file)
+            if match:
+                existing_numbers.append(int(match.group(1)))
+
+        if not existing_numbers:
+            return 1
+        return max(existing_numbers) + 1
+
+    def _build_credential_path(
+        self, base_dir: Optional[Path] = None, number: Optional[int] = None
+    ) -> Path:
+        """Build a path for a new credential file."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        if number is None:
+            number = self._get_next_credential_number(base_dir)
+
+        prefix = self._get_provider_file_prefix()
+        filename = f"{prefix}_oauth_{number}.json"
+        return base_dir / filename
+
+    async def setup_credential(
+        self, base_dir: Optional[Path] = None
+    ) -> QwenCredentialSetupResult:
+        """
+        Complete credential setup flow: OAuth -> save.
+
+        This is the main entry point for setting up new credentials.
+        """
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        # Ensure directory exists
+        base_dir.mkdir(exist_ok=True)
+
+        try:
+            # Step 1: Perform OAuth authentication
+            temp_creds = {
+                "_proxy_metadata": {"display_name": "new Qwen Code credential"}
+            }
+            new_creds = await self.initialize_token(temp_creds)
+
+            # Step 2: Get user info for deduplication
+            email = new_creds.get("_proxy_metadata", {}).get("email")
+
+            if not email:
+                return QwenCredentialSetupResult(
+                    success=False, error="Could not retrieve email from OAuth response"
+                )
+
+            # Step 3: Check for existing credential with same email
+            existing_path = self._find_existing_credential_by_email(email, base_dir)
+            is_update = existing_path is not None
+
+            if is_update:
+                file_path = existing_path
+                lib_logger.info(
+                    f"Found existing credential for {email}, updating {file_path.name}"
+                )
+            else:
+                file_path = self._build_credential_path(base_dir)
+                lib_logger.info(
+                    f"Creating new credential for {email} at {file_path.name}"
+                )
+
+            # Step 4: Save credentials to file
+            await self._save_credentials(str(file_path), new_creds)
+
+            return QwenCredentialSetupResult(
+                success=True,
+                file_path=str(file_path),
+                email=email,
+                is_update=is_update,
+                credentials=new_creds,
+            )
+
+        except Exception as e:
+            lib_logger.error(f"Credential setup failed: {e}")
+            return QwenCredentialSetupResult(success=False, error=str(e))
+
+    def build_env_lines(self, creds: Dict[str, Any], cred_number: int) -> List[str]:
+        """Generate .env file lines for a Qwen credential."""
+        email = creds.get("_proxy_metadata", {}).get("email", "unknown")
+        prefix = f"QWEN_CODE_{cred_number}"
+
+        lines = [
+            f"# QWEN_CODE Credential #{cred_number} for: {email}",
+            f"# Exported from: qwen_code_oauth_{cred_number}.json",
+            f"# Generated at: {time.strftime('%Y-%m-%d %H:%M:%S')}",
+            "#",
+            "# To combine multiple credentials into one .env file, copy these lines",
+            "# and ensure each credential has a unique number (1, 2, 3, etc.)",
+            "",
+            f"{prefix}_ACCESS_TOKEN={creds.get('access_token', '')}",
+            f"{prefix}_REFRESH_TOKEN={creds.get('refresh_token', '')}",
+            f"{prefix}_EXPIRY_DATE={creds.get('expiry_date', 0)}",
+            f"{prefix}_RESOURCE_URL={creds.get('resource_url', 'https://portal.qwen.ai/v1')}",
+            f"{prefix}_EMAIL={email}",
+        ]
+
+        return lines
+
+    def export_credential_to_env(
+        self, credential_path: str, output_dir: Optional[Path] = None
+    ) -> Optional[str]:
+        """Export a credential file to .env format."""
+        try:
+            cred_path = Path(credential_path)
+
+            # Load credential
+            with open(cred_path, "r") as f:
+                creds = json.load(f)
+
+            # Extract metadata
+            email = creds.get("_proxy_metadata", {}).get("email", "unknown")
+
+            # Get credential number from filename
+            match = re.search(r"_oauth_(\d+)\.json$", cred_path.name)
+            cred_number = int(match.group(1)) if match else 1
+
+            # Build output path
+            if output_dir is None:
+                output_dir = cred_path.parent
+
+            safe_email = email.replace("@", "_at_").replace(".", "_")
+            env_filename = f"qwen_code_{cred_number}_{safe_email}.env"
+            env_path = output_dir / env_filename
+
+            # Build and write content
+            env_lines = self.build_env_lines(creds, cred_number)
+            with open(env_path, "w") as f:
+                f.write("\n".join(env_lines))
+
+            lib_logger.info(f"Exported credential to {env_path}")
+            return str(env_path)
+
+        except Exception as e:
+            lib_logger.error(f"Failed to export credential: {e}")
+            return None
+
+    def list_credentials(self, base_dir: Optional[Path] = None) -> List[Dict[str, Any]]:
+        """List all Qwen credential files."""
+        if base_dir is None:
+            base_dir = self._get_oauth_base_dir()
+
+        prefix = self._get_provider_file_prefix()
+        pattern = str(base_dir / f"{prefix}_oauth_*.json")
+
+        credentials = []
+        for cred_file in sorted(glob(pattern)):
+            try:
+                with open(cred_file, "r") as f:
+                    creds = json.load(f)
+
+                metadata = creds.get("_proxy_metadata", {})
+
+                # Extract number from filename
+                match = re.search(r"_oauth_(\d+)\.json$", cred_file)
+                number = int(match.group(1)) if match else 0
+
+                credentials.append(
+                    {
+                        "file_path": cred_file,
+                        "email": metadata.get("email", "unknown"),
+                        "number": number,
+                    }
+                )
+            except Exception as e:
+                lib_logger.debug(f"Could not read credential file {cred_file}: {e}")
+                continue
+
+        return credentials
+
+    def delete_credential(self, credential_path: str) -> bool:
+        """Delete a credential file."""
+        try:
+            cred_path = Path(credential_path)
+
+            # Validate that it's one of our credential files
+            prefix = self._get_provider_file_prefix()
+            if not cred_path.name.startswith(f"{prefix}_oauth_"):
+                lib_logger.error(
+                    f"File {cred_path.name} does not appear to be a Qwen Code credential"
+                )
+                return False
+
+            if not cred_path.exists():
+                lib_logger.warning(f"Credential file does not exist: {credential_path}")
+                return False
+
+            # Remove from cache if present
+            self._credentials_cache.pop(credential_path, None)
+
+            # Delete the file
+            cred_path.unlink()
+            lib_logger.info(f"Deleted credential file: {credential_path}")
+            return True
+
+        except Exception as e:
+            lib_logger.error(f"Failed to delete credential: {e}")
+            return False