feat(ai): run the AI analyst through any Gemini-compatible gateway

[tsstod]

Lets the AI analyst (/api/ai/analyze, /api/ai/briefing, /api/ai/overview) run against any server that speaks the Gemini REST API, not just Google. With neither new variable set, nothing changes.

Why

The analyst could only talk to generativelanguage.googleapis.com, and only with a GEMINI_API_KEY_* set. Without one, analyze and briefing return 503 NO_API_KEY and the one-click overview drops to the heuristic analyst. .env.example didn't mention the Gemini keys at all, so a fresh self-hosted install never gets a model.

Gateways such as OmniRoute serve Gemini's own endpoint (/v1beta/models/{model}:generateContent) and route each request to whatever provider they're configured with, free-tier ones included. The Gemini SDK already accepts a baseUrl, so a gateway needs no second client.

What changed

• OSIRIS_AI_BASE_URL points the existing SDK at the gateway. OSIRIS_AI_MODEL overrides the model id (default stays gemini-2.0-flash; auto lets OmniRoute choose). Both are read per request, not at import.
• No Gemini key needed behind a gateway. The SDK refuses to run without a key, so a stand-in is passed. OSIRIS_AI_API_KEY is used if the gateway wants a real one. Real GEMINI_API_KEY_* values still win when both are set.
• Reasoning no longer leaks into the output. Reasoning models behind a gateway return their chain of thought as parts flagged thought: true. SDK 0.24's response.text() concatenates every part, so a briefing opened with the model talking to itself. The new responseText() drops those parts. It still calls text() first, so a blocked response keeps surfacing as SAFETY_BLOCKED.
• One shared key lookup. The three routes each carried their own copy of the GEMINI_API_KEY_1..8 loop; they now share getServerApiKeys().
• Truthful overview label. The overview footer said "GEMINI 2.0 FLASH" whatever answered. The route now returns the model id and the label shows that.
• .env.example gains an AI ANALYST section covering the Gemini keys and the gateway variables, including the Docker note: use host.docker.internal, not 127.0.0.1.

Testing

• src/lib/ai-engine.test.ts (9 tests) stubs fetch and asserts on what the real SDK sends. That covers the default Google URL, the gateway URL and model, thought-part stripping, plain replies unchanged, and key selection.
• tsc --noEmit is clean. eslint on the touched files reports only no-explicit-any errors that already exist on master, at the same count per file.
• End to end against a local OmniRoute (OSIRIS_AI_BASE_URL=http://127.0.0.1:20128, OSIRIS_AI_MODEL=auto): overview and briefing both answered through the gateway, and the briefing came back without reasoning text. AI OVERVIEW in the Live Alerts panel rendered a model read-out labelled AUTO.
• After rebasing onto master (8781ae3, fix(map): restore the basemap's proxy path, and stop the banner covering a working map #335): the full npx vitest run passes on a local branch that combines this PR with feat(recon): let GITHUB_TOKEN lift the GitHub recon rate limit #337 and fix(ui): keep every tool-strip flyout inside the window #338 — 49 test files passed, 614 tests passed. The 2 skipped files and 16 skipped tests are pre-existing skips of the network-gated tests.

Notes

• Touches only the AI routes, AiOverview.tsx, ai-engine.ts and .env.example, so it doesn't conflict with feat(recon): let GITHUB_TOKEN lift the GitHub recon rate limit #337 or fix(ui): keep every tool-strip flyout inside the window #338; both of those are also one commit on current master, and the three merge cleanly together.

🤖 Generated with Claude Code

[vercel]

@tsstod is attempting to deploy a commit to the Developing Osiris' projects Team on Vercel.

A member of the Team first needs to authorize it.

[tsstod]

The red Vercel – osiris check here is Vercel waiting for a team member to authorize a deploy from a fork. No build has run, so here's a local one instead:

• npm run build passes (Next 16.3.4, exit 0) on a local branch combining this PR with feat(recon): let GITHUB_TOKEN lift the GitHub recon rate limit #337 and fix(ui): keep every tool-strip flyout inside the window #338 on current master (8781ae3). next.config.ts sets typescript.ignoreBuildErrors: false, so the build's type check passed too.
• npx vitest run passes on the same branch: 49 test files and 614 tests. The 16 skipped tests are the existing network-gated ones.

🤖 Generated with Claude Code