# Gemini API CLI (gemini-api) — pre-registered test plan
Written 2026-10-30 08:58 (UTC+8), BEFORE installing or running the binary.

Tool: google-gemini/gemini-api-cli, latest release v0.4.4 (published 2026-10-24 00:51 UTC+8), Apache-2.0, repo main b8b6082 (2026-10-30 05:32 UTC+8), 373 stars.
Install path: vendor's install.sh (downloaded and read first; it does not verify checksums.txt), we verify the archive against checksums.txt ourselves.

Access: no GEMINI_API_KEY. A key needs a Google account in Google AI Studio, which we are not approved to use. So every claim that needs a live Gemini call is V0.
Environment: clean HOME, no GEMINI_* / GOOGLE_* env vars except a FAKE key string where stated (to check redaction). strace -f for network syscalls.

## Core claims (verbatim, README at b8b6082)
C1 "Self-describing interface: Commands, flags, request schemas (--schema), and machine-readable usage (--usage) are built into the binary so an agent can inspect what it needs on the fly." + "--usage outputs the complete command tree, flags, defaults, environment variables, and config keys as machine-readable KDL" + "--schema prints the bundled JSON Schema (draft 2020-12)".
 Pass marks: --usage output parses with a KDL parser AND names all 18 top-level commands in the README table (generate image tts music video analyze transcribe agent files models configure auth whoami environments credentials webhooks triggers explore version = 19 names incl. version); --schema for generate, image, agent run is valid JSON declaring draft 2020-12, and the README hero-image.json body validates against the image schema. V2 = all; V1 = KDL parses but ≥1 command missing or 1 schema problem; F = output is not machine-parseable or schemas missing.
C2 "--dry-run validates inputs and prints the resolved HTTP request with credentials redacted—without making a network call or reading the OS keychain."
 Task: 6 dry-runs (generate, image --body @hero-image.json, tts, analyze -i local PDF, agent run --background, models list) with GEMINI_API_KEY=FAKE-KEY-<random>. Ground truth: strace shows 0 connect()/sendto() to non-local addresses; the fake key string appears 0 times in stdout/stderr; no access to D-Bus secret service socket (keychain); JSON preview parses; an invalid input (bad image_size "3K", missing file) is rejected with exit 2. V2 = all 6 + invalid cases; V1 = 1 problem; F = any network call or key leak.
C3 "Exit codes distinguish success (0), runtime/API failures (1), invalid usage/validation errors (2), and authentication/authorization failures (3)." + "--agent-mode ... enables structured JSON error envelopes on stderr".
 Task: unknown flag (expect 2), no key real call (expect 3), fake key real call to Google (expect 3 — server rejects key), --agent-mode on each (stderr = JSON). V2 = 3/3 codes + JSON envelopes; V1 = 2/3; F = ≤1.
C4 "One binary for models, media, and managed agents" (real generation/analysis/agent runs). V0: needs an API key from a Google account (not approved). Core → overall max V1 by shared rule.

Non-core: C5 "A single Go binary runs on macOS, Linux, and Windows" — Linux only checked (install + run).
Score = mean of tested claims (V2=10, V1=5, F=0, V0 excluded).