@bacnh85/pi-web 0.10.3 → 0.10.5

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.10.5 (2026-09-13)
+
+### Added
+
+- **`GEMINI_WEB_SECURE_1PSIDTS` env** — the rotating `__Secure-1PSIDTS`
+  session cookie, injected into the client jar pre-init. Google stopped
+  serving SNlM0e/cookie rotations to plain clients; without it the session
+  is partially authed (chat works, `accessToken` unresolved, sensitive
+  surfaces refuse). With it: full auth (`accessToken` resolves).
+
+## 0.10.4 (2026-09-13)
+
+### Fixed
+
+- **Truthful image extensions**: saved files are typed by magic bytes, not
+  URL/file extension — Z.ai GLM-Image serves JPEG behind a `.png` URL, which
+  previously produced mislabeled files and inline blocks.
+
 ## 0.10.3 (2026-09-13)
 
 ### Fixed

package/README.md

@@ -32,6 +32,7 @@ Variables:
 | `CRAWL4AI_API_TOKEN` | No (3) | — | Required if Crawl4AI auth enabled |
 | `GEMINI_WEB_SECURE_1PSID` | No (4) | — | `__Secure-1PSID` cookie from gemini.google.com — enables authed `web_research` (Deep Research) |
 | `GEMINI_WEB_PROXY` | No | — | Proxy URL for Gemini web calls (escape hatch if Google blocks the IP) |
+| `GEMINI_WEB_SECURE_1PSIDTS` | No (6) | — | Rotating `__Secure-1PSIDTS` cookie — restores full auth when Google withholds SNlM0e from plain clients (recommended for image surfaces) |
 | `ZAI_API_KEY` | No (5) | — | Z.ai API key — enables the `web_image` `zai` provider (GLM-Image via the official `api.z.ai`); `Z_AI_API_KEY` also accepted |
 | `WEB_IMAGE_API_BASE_URL` | No | — | `web_image` `custom` provider: any OpenAI-compatible images endpoint (e.g. `https://api.openai.com/v1`) |
 | `WEB_IMAGE_API_KEY` | No | — | Bearer key for the `custom` endpoint |
@@ -45,6 +46,7 @@ Variables:
 > (2) Required for hosted Firecrawl; optional for self-hosted instances without auth.
 > (3) Required for Crawl4AI v0.9+ default config.
 > (4) Without it `web_research mode=ask` still works in guest mode (Flash-only); `mode=research` errors with setup steps.
+> (6) Copy the current value from DevTools (Application → Cookies) alongside `__Secure-1PSID`; it rotates, so refresh it when auth degrades.
 > (5) `web_image` works with zero config via Gemini guest mode (availability varies by region/account); `zai` activates when `ZAI_API_KEY` is present, `custom` when `WEB_IMAGE_API_BASE_URL` is set.
 
 Secrets are never printed; `web_status` reports only presence/source.

package/extensions/lib/gemini.ts

@@ -14,13 +14,15 @@ import { findEnvValue } from "./config";
 export interface GeminiWebConfig {
   psid?: string;
   psidSource: string;
+  psidts?: string;
   proxy?: string;
 }
 
 export function loadGeminiWebConfig(cwd = process.cwd(), includeCwdEnv = false): GeminiWebConfig {
   const psid = findEnvValue("GEMINI_WEB_SECURE_1PSID", cwd, includeCwdEnv);
+  const psidts = findEnvValue("GEMINI_WEB_SECURE_1PSIDTS", cwd, includeCwdEnv);
   const proxy = findEnvValue("GEMINI_WEB_PROXY", cwd, includeCwdEnv);
-  return { psid: psid.value, psidSource: psid.value ? psid.source : "not set", proxy: proxy.value };
+  return { psid: psid.value, psidSource: psid.value ? psid.source : "not set", psidts: psidts.value, proxy: proxy.value };
 }
 
 // ---------------------------------------------------------------------------
@@ -66,7 +68,7 @@ export interface GeminiClientLike {
 }
 
 export type GeminiClientFactory = (
-  opts: { secure_1psid?: string; proxy?: string },
+  opts: { secure_1psid?: string; secure_1psidts?: string; proxy?: string },
 ) => GeminiClientLike | Promise<GeminiClientLike>;
 
 // Cached per config (psid|proxy) so a config change re-creates the client.
@@ -137,14 +139,24 @@ export async function loadDefaultFactory(): Promise<GeminiClientFactory> {
   }
   // ponytail: generous per-request cap (covers research); per-mode ask/research
   // timeouts are enforced by raceGuard below.
-  return (opts) => new Gemini({ secure_1psid: opts.secure_1psid, proxy: opts.proxy ?? null, timeout: 1_800_000 });
+  // ponytail: Google's rotating __Secure-1PSIDTS is required for sensitive
+  // surfaces (image generation refuses with "You might be signed out" when it
+  // is missing); the page HTML no longer carries SNlM0e/rotations for plain
+  // clients, so the user passes it explicitly and we inject it pre-init.
+  return (opts) => {
+    const client = new Gemini({ secure_1psid: opts.secure_1psid, proxy: opts.proxy ?? null, timeout: 1_800_000 });
+    if (opts.secure_1psidts) {
+      (client as unknown as { cookies: Record<string, string> }).cookies["__Secure-1PSIDTS"] = opts.secure_1psidts;
+    }
+    return client;
+  };
 }
 
 async function getClient(config: GeminiWebConfig, factory?: GeminiClientFactory): Promise<GeminiClientLike> {
-  const key = `${config.psid ?? ""}|${config.proxy ?? ""}`;
+  const key = `${config.psid ?? ""}|${config.psidts ?? ""}|${config.proxy ?? ""}`;
   if (cached?.key === key) return cached.client;
   const make = factory ?? (await loadDefaultFactory());
-  const client = await make({ secure_1psid: config.psid, proxy: config.proxy });
+  const client = await make({ secure_1psid: config.psid, secure_1psidts: config.psidts, proxy: config.proxy });
   cached = { key, client };
   return client;
 }

package/extensions/lib/imageapi.ts

@@ -238,7 +238,7 @@ export async function apiGenerateImage(opts: {
   for (let i = 0; i < items.length; i++) {
     const item = items[i];
     if (typeof item?.b64_json === "string" && item.b64_json) {
-      paths.push(writeB64(opts.outDir, item.b64_json, i));
+      paths.push(writeB64(opts.outDir, Buffer.from(item.b64_json, "base64"), i));
     } else if (typeof item?.url === "string" && item.url) {
       // A failed download must not waste the generation: surface the URL.
       try {
@@ -256,9 +256,19 @@ export async function apiGenerateImage(opts: {
   return { paths, urls, model: typeof payload?.model === "string" ? payload.model : opts.model };
 }
 
-function writeB64(outDir: string, b64: string, i: number): string {
-  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}.png`);
-  fs.writeFileSync(file, Buffer.from(b64, "base64"));
+// Some gateways serve JPEG/WebP bytes behind a .png URL (Z.ai GLM-Image does) —
+// trust the magic bytes, not the URL/file extension.
+function extFromBytes(buf: Buffer, fallback: string): string {
+  if (buf.length >= 4 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) return ".png";
+  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return ".jpg";
+  if (buf.length >= 6 && buf.toString("ascii", 0, 3) === "GIF") return ".gif";
+  if (buf.length >= 12 && buf.toString("ascii", 0, 4) === "RIFF" && buf.toString("ascii", 8, 12) === "WEBP") return ".webp";
+  return fallback;
+}
+
+function writeB64(outDir: string, buf: Buffer, i: number): string {
+  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFromBytes(buf, ".png")}`);
+  fs.writeFileSync(file, buf);
   return file;
 }
 
@@ -290,7 +300,7 @@ async function downloadImage(
     if (!res.ok) throw new ImageApiError(res.status, `image download failed (HTTP ${res.status})`);
   const buf = Buffer.from(await res.arrayBuffer());
   if (buf.length > MAX_DOWNLOAD_BYTES) throw new Error(`image exceeds the ${MAX_DOWNLOAD_BYTES}-byte download cap`);
-  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFor(url)}`);
+  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFromBytes(buf, extFor(url))}`);
   fs.writeFileSync(file, buf);
   return file;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-web",
-  "version": "0.10.3",
+  "version": "0.10.5",
   "description": "Pi extension for web search, page extraction, Firecrawl scraping/crawling, Crawl4AI headless browser crawling, Gemini web-tier research, free upstream image generation, and one-off gateway chat.",
   "type": "module",
   "license": "MIT",