@bacnh85/pi-web 0.10.4 → 0.10.5

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.10.5 (2026-09-13)
+
+### Added
+
+- **`GEMINI_WEB_SECURE_1PSIDTS` env** — the rotating `__Secure-1PSIDTS`
+  session cookie, injected into the client jar pre-init. Google stopped
+  serving SNlM0e/cookie rotations to plain clients; without it the session
+  is partially authed (chat works, `accessToken` unresolved, sensitive
+  surfaces refuse). With it: full auth (`accessToken` resolves).
+
 ## 0.10.4 (2026-09-13)
 
 ### Fixed

package/README.md

@@ -32,6 +32,7 @@ Variables:
 | `CRAWL4AI_API_TOKEN` | No (3) | — | Required if Crawl4AI auth enabled |
 | `GEMINI_WEB_SECURE_1PSID` | No (4) | — | `__Secure-1PSID` cookie from gemini.google.com — enables authed `web_research` (Deep Research) |
 | `GEMINI_WEB_PROXY` | No | — | Proxy URL for Gemini web calls (escape hatch if Google blocks the IP) |
+| `GEMINI_WEB_SECURE_1PSIDTS` | No (6) | — | Rotating `__Secure-1PSIDTS` cookie — restores full auth when Google withholds SNlM0e from plain clients (recommended for image surfaces) |
 | `ZAI_API_KEY` | No (5) | — | Z.ai API key — enables the `web_image` `zai` provider (GLM-Image via the official `api.z.ai`); `Z_AI_API_KEY` also accepted |
 | `WEB_IMAGE_API_BASE_URL` | No | — | `web_image` `custom` provider: any OpenAI-compatible images endpoint (e.g. `https://api.openai.com/v1`) |
 | `WEB_IMAGE_API_KEY` | No | — | Bearer key for the `custom` endpoint |
@@ -45,6 +46,7 @@ Variables:
 > (2) Required for hosted Firecrawl; optional for self-hosted instances without auth.
 > (3) Required for Crawl4AI v0.9+ default config.
 > (4) Without it `web_research mode=ask` still works in guest mode (Flash-only); `mode=research` errors with setup steps.
+> (6) Copy the current value from DevTools (Application → Cookies) alongside `__Secure-1PSID`; it rotates, so refresh it when auth degrades.
 > (5) `web_image` works with zero config via Gemini guest mode (availability varies by region/account); `zai` activates when `ZAI_API_KEY` is present, `custom` when `WEB_IMAGE_API_BASE_URL` is set.
 
 Secrets are never printed; `web_status` reports only presence/source.

package/extensions/lib/gemini.ts

@@ -14,13 +14,15 @@ import { findEnvValue } from "./config";
 export interface GeminiWebConfig {
   psid?: string;
   psidSource: string;
+  psidts?: string;
   proxy?: string;
 }
 
 export function loadGeminiWebConfig(cwd = process.cwd(), includeCwdEnv = false): GeminiWebConfig {
   const psid = findEnvValue("GEMINI_WEB_SECURE_1PSID", cwd, includeCwdEnv);
+  const psidts = findEnvValue("GEMINI_WEB_SECURE_1PSIDTS", cwd, includeCwdEnv);
   const proxy = findEnvValue("GEMINI_WEB_PROXY", cwd, includeCwdEnv);
-  return { psid: psid.value, psidSource: psid.value ? psid.source : "not set", proxy: proxy.value };
+  return { psid: psid.value, psidSource: psid.value ? psid.source : "not set", psidts: psidts.value, proxy: proxy.value };
 }
 
 // ---------------------------------------------------------------------------
@@ -66,7 +68,7 @@ export interface GeminiClientLike {
 }
 
 export type GeminiClientFactory = (
-  opts: { secure_1psid?: string; proxy?: string },
+  opts: { secure_1psid?: string; secure_1psidts?: string; proxy?: string },
 ) => GeminiClientLike | Promise<GeminiClientLike>;
 
 // Cached per config (psid|proxy) so a config change re-creates the client.
@@ -137,14 +139,24 @@ export async function loadDefaultFactory(): Promise<GeminiClientFactory> {
   }
   // ponytail: generous per-request cap (covers research); per-mode ask/research
   // timeouts are enforced by raceGuard below.
-  return (opts) => new Gemini({ secure_1psid: opts.secure_1psid, proxy: opts.proxy ?? null, timeout: 1_800_000 });
+  // ponytail: Google's rotating __Secure-1PSIDTS is required for sensitive
+  // surfaces (image generation refuses with "You might be signed out" when it
+  // is missing); the page HTML no longer carries SNlM0e/rotations for plain
+  // clients, so the user passes it explicitly and we inject it pre-init.
+  return (opts) => {
+    const client = new Gemini({ secure_1psid: opts.secure_1psid, proxy: opts.proxy ?? null, timeout: 1_800_000 });
+    if (opts.secure_1psidts) {
+      (client as unknown as { cookies: Record<string, string> }).cookies["__Secure-1PSIDTS"] = opts.secure_1psidts;
+    }
+    return client;
+  };
 }
 
 async function getClient(config: GeminiWebConfig, factory?: GeminiClientFactory): Promise<GeminiClientLike> {
-  const key = `${config.psid ?? ""}|${config.proxy ?? ""}`;
+  const key = `${config.psid ?? ""}|${config.psidts ?? ""}|${config.proxy ?? ""}`;
   if (cached?.key === key) return cached.client;
   const make = factory ?? (await loadDefaultFactory());
-  const client = await make({ secure_1psid: config.psid, proxy: config.proxy });
+  const client = await make({ secure_1psid: config.psid, secure_1psidts: config.psidts, proxy: config.proxy });
   cached = { key, client };
   return client;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-web",
-  "version": "0.10.4",
+  "version": "0.10.5",
   "description": "Pi extension for web search, page extraction, Firecrawl scraping/crawling, Crawl4AI headless browser crawling, Gemini web-tier research, free upstream image generation, and one-off gateway chat.",
   "type": "module",
   "license": "MIT",