The cloud ORPC routes (addGoogleAccount, listCloudAccounts, refreshAccountQuota,
syncLocalAccount) returned the full account including access and refresh
tokens, but the renderer never reads them. Blank the two secrets in those
responses; token metadata (expiry, project id) is kept so the schema holds.
Also compare the presented gateway API key with timingSafeEqual.
Delete files with no importers (src/actions/{account,database,window}.ts,
drag-window-region, navigation-menu, ui/navigation-menu, ui/toggle,
ui/toggle-group) and the packages only they or nothing used
(@icons-pack/react-simple-icons, @radix-ui/react-icons,
@sentry/integrations, @radix-ui/react-{navigation-menu,toggle,toggle-group}).
Drop the duplicated Playwright block in .gitignore.
Pin the current behavior with characterization tests (claude-request-mapper,
model-mapping, rate-limit-reason; 91 cases, all green before the refactor),
then split buildContents, buildGenerationConfig, transformClaudeRequestIn,
resolveModelRoute, detectRateLimitReason and computeRetryAfterSeconds into
small helpers. Also declare the emitted toolConfig on GeminiRequest.
evandro