@bacnh85/pi-web 0.10.4 → 0.10.6

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.10.5 (2026-09-13)
+
+### Added
+
+- **`GEMINI_WEB_SECURE_1PSIDTS` env** — the rotating `__Secure-1PSIDTS`
+  session cookie, injected into the client jar pre-init. Google stopped
+  serving SNlM0e/cookie rotations to plain clients; without it the session
+  is partially authed (chat works, `accessToken` unresolved, sensitive
+  surfaces refuse). With it: full auth (`accessToken` resolves).
+
 ## 0.10.4 (2026-09-13)
 
 ### Fixed
@@ -254,3 +264,11 @@ All notable changes to `pi-web` will be documented in this file.
 
 - Consolidated 14 backend-specific tools into 7 unified tools (`web_search`, `web_extract`, `web_map`, `web_crawl`, `web_screenshot`, `web_pdf`, `web_status`).
 - Auto-selection and adaptive fallback between static (JSDOM), dynamic (Firecrawl), and full (Crawl4AI) backends.
+## 0.10.6
+
+Docs correction: Deep Research is **not** Gemini-Advanced-gated. Live
+verification (2026-09-13, free-tier account): Deep Research plan creation
+succeeds via a browser-impersonating client, while this package's Node
+transport is refused with 1184/FEATURE_NOT_AVAILABLE on the same fresh
+session. The 1184 error is a client-transport artifact; README,
+`web_research` descriptions, and troubleshooting updated accordingly.

package/README.md

@@ -32,6 +32,7 @@ Variables:
 | `CRAWL4AI_API_TOKEN` | No (3) | — | Required if Crawl4AI auth enabled |
 | `GEMINI_WEB_SECURE_1PSID` | No (4) | — | `__Secure-1PSID` cookie from gemini.google.com — enables authed `web_research` (Deep Research) |
 | `GEMINI_WEB_PROXY` | No | — | Proxy URL for Gemini web calls (escape hatch if Google blocks the IP) |
+| `GEMINI_WEB_SECURE_1PSIDTS` | No (6) | — | Rotating `__Secure-1PSIDTS` cookie — restores full auth when Google withholds SNlM0e from plain clients (recommended for image surfaces) |
 | `ZAI_API_KEY` | No (5) | — | Z.ai API key — enables the `web_image` `zai` provider (GLM-Image via the official `api.z.ai`); `Z_AI_API_KEY` also accepted |
 | `WEB_IMAGE_API_BASE_URL` | No | — | `web_image` `custom` provider: any OpenAI-compatible images endpoint (e.g. `https://api.openai.com/v1`) |
 | `WEB_IMAGE_API_KEY` | No | — | Bearer key for the `custom` endpoint |
@@ -45,6 +46,7 @@ Variables:
 > (2) Required for hosted Firecrawl; optional for self-hosted instances without auth.
 > (3) Required for Crawl4AI v0.9+ default config.
 > (4) Without it `web_research mode=ask` still works in guest mode (Flash-only); `mode=research` errors with setup steps.
+> (6) Copy the current value from DevTools (Application → Cookies) alongside `__Secure-1PSID`; it rotates, so refresh it when auth degrades.
 > (5) `web_image` works with zero config via Gemini guest mode (availability varies by region/account); `zai` activates when `ZAI_API_KEY` is present, `custom` when `WEB_IMAGE_API_BASE_URL` is set.
 
 Secrets are never printed; `web_status` reports only presence/source.
@@ -227,8 +229,12 @@ web_research(query="compare the top 3 cloud providers' AI offerings", mode="rese
   Google Search). Works **without any cookie** in guest mode (Flash-only).
   Sent as a temporary chat so your Gemini history stays clean.
 - **`mode: "research"`** — full Gemini **Deep Research**: plan → autonomous web
-  browsing (minutes) → cited report. Requires the cookie **and a Gemini
-  Advanced subscription** on the account. Default timeout 600 s, cap 1 800 000.
+  browsing (minutes) → cited report. Requires the cookie and a **fresh session**.
+  **Known limitation (2026-09):** Gemini refuses Deep Research for non-browser
+  clients, so this mode currently fails with 1184/FEATURE_NOT_AVAILABLE even on
+  free-tier accounts that *can* run Deep Research (proven via a
+  browser-impersonating client — it is not an Advanced-entitlement gate).
+  Default timeout 600 s, cap 1 800 000.
 
 Both modes return the text plus **Sources** — URLs extracted from the
 answer/report markdown (the web protocol exposes no structured citations field).
@@ -263,10 +269,12 @@ Troubleshooting:
 
 - *"cookie expired or invalid"* — re-copy `__Secure-1PSID` (it rotates).
 - *"temporarily blocked this IP"* — set `GEMINI_WEB_PROXY`.
-- *research mode: "Unknown API error: 1184"* — on this account Deep Research
-  was rejected; usually means no Gemini Advanced subscription on the account
-  (Deep Research is Advanced-only), or Google changed the protocol. `ask`
-  mode is unaffected.
+- *research mode: "Unknown API error: 1184"* — **not** an entitlement error:
+  Deep Research plan creation succeeds on free-tier accounts via
+  browser-impersonating clients (verified 2026-09-13). Gemini refuses
+  privileged tools to non-browser clients; this tool's transport is plain
+  Node, so research currently fails regardless of plan. `ask` mode is
+  unaffected.
 
 ### `web_image` — free upstream image generation
 

package/extensions/index.ts

@@ -114,7 +114,7 @@ const WEB_ROUTING_GUIDANCE = `## Web Tool Routing (pi-web)
 - **web_map** — discover site URLs (Firecrawl Map).
 - **web_crawl** — multi-page crawl: \`mode: "light"\` (Firecrawl, url) or \`mode: "full"\` (Crawl4AI, urls[]).
 - **web_screenshot** / **web_pdf** — page capture (Crawl4AI).
-- **web_research** — AI-synthesized research via Gemini web (mode "ask" = grounded answer, guest OK; mode "research" = Deep Research report, needs cookie + Gemini Advanced, takes minutes).
+- **web_research** — AI-synthesized research via Gemini web (mode "ask" = grounded answer, guest OK; mode "research" = Deep Research report — currently blocked by Gemini's non-browser-client refusal (1184), not by entitlement; takes minutes when available).
 - **web_image** — text→image generation via free upstreams (auto: Gemini web → Z.ai GLM-Image → custom OpenAI-images endpoint; \`model\`/\`n\` params).
 - **web_chat** — one-off chat completion via an OpenAI-compatible gateway (\`WEB_CHAT_API_BASE_URL\`; non-streaming).
 - **web_status** — provider config + health.
@@ -485,7 +485,7 @@ export default function piWebExtension(pi: ExtensionAPI) {
     name: "web_research",
     label: "Web Research (Gemini)",
     description:
-      "AI-synthesized web research via Gemini (gemini.google.com web tier, cookie auth). Mode 'ask' returns a quick grounded answer with source links (works guest-mode, Flash only). Mode 'research' runs Gemini Deep Research — an autonomous agent browses the web for minutes and returns a comprehensive cited report (requires GEMINI_WEB_SECURE_1PSID cookie and a Gemini Advanced subscription).",
+      "AI-synthesized web research via Gemini (gemini.google.com web tier, cookie auth). Mode 'ask' returns a quick grounded answer with source links (works guest-mode, Flash only). Mode 'research' runs Gemini Deep Research — plan, autonomous web browsing, cited report. Requires GEMINI_WEB_SECURE_1PSID and a fresh session; note Gemini currently refuses Deep Research to non-browser clients (1184) — the error is a transport artifact, not an entitlement gate.",
     promptSnippet: "AI-synthesized research with citations",
     promptGuidelines: [
       "Use for AI-synthesized research with sources (mode ask = quick grounded answer; mode research = multi-minute Deep Research report). NOT for URL-list searches (web_search) or single-URL extraction (web_extract). Cite the returned source URLs.",
@@ -494,7 +494,7 @@ export default function piWebExtension(pi: ExtensionAPI) {
       query: Type.String({ description: "Research question or topic." }),
       mode: Type.Optional(Type.Union(
         [Type.Literal("ask"), Type.Literal("research")],
-        { default: "ask", description: "ask = quick grounded answer (guest OK); research = full Deep Research report (cookie + Gemini Advanced required, takes minutes)." },
+        { default: "ask", description: "ask = quick grounded answer (guest OK); research = full Deep Research report (fresh cookie required; currently refused to non-browser clients with 1184)." },
       )),
       model: Type.Optional(Type.String({ description: "Gemini model for ask mode (e.g. gemini-3-flash). Discovered from the account by default." })),
       ...sharedControlSchema,

package/extensions/lib/gemini.ts

@@ -14,13 +14,15 @@ import { findEnvValue } from "./config";
 export interface GeminiWebConfig {
   psid?: string;
   psidSource: string;
+  psidts?: string;
   proxy?: string;
 }
 
 export function loadGeminiWebConfig(cwd = process.cwd(), includeCwdEnv = false): GeminiWebConfig {
   const psid = findEnvValue("GEMINI_WEB_SECURE_1PSID", cwd, includeCwdEnv);
+  const psidts = findEnvValue("GEMINI_WEB_SECURE_1PSIDTS", cwd, includeCwdEnv);
   const proxy = findEnvValue("GEMINI_WEB_PROXY", cwd, includeCwdEnv);
-  return { psid: psid.value, psidSource: psid.value ? psid.source : "not set", proxy: proxy.value };
+  return { psid: psid.value, psidSource: psid.value ? psid.source : "not set", psidts: psidts.value, proxy: proxy.value };
 }
 
 // ---------------------------------------------------------------------------
@@ -66,7 +68,7 @@ export interface GeminiClientLike {
 }
 
 export type GeminiClientFactory = (
-  opts: { secure_1psid?: string; proxy?: string },
+  opts: { secure_1psid?: string; secure_1psidts?: string; proxy?: string },
 ) => GeminiClientLike | Promise<GeminiClientLike>;
 
 // Cached per config (psid|proxy) so a config change re-creates the client.
@@ -137,14 +139,24 @@ export async function loadDefaultFactory(): Promise<GeminiClientFactory> {
   }
   // ponytail: generous per-request cap (covers research); per-mode ask/research
   // timeouts are enforced by raceGuard below.
-  return (opts) => new Gemini({ secure_1psid: opts.secure_1psid, proxy: opts.proxy ?? null, timeout: 1_800_000 });
+  // ponytail: Google's rotating __Secure-1PSIDTS is required for sensitive
+  // surfaces (image generation refuses with "You might be signed out" when it
+  // is missing); the page HTML no longer carries SNlM0e/rotations for plain
+  // clients, so the user passes it explicitly and we inject it pre-init.
+  return (opts) => {
+    const client = new Gemini({ secure_1psid: opts.secure_1psid, proxy: opts.proxy ?? null, timeout: 1_800_000 });
+    if (opts.secure_1psidts) {
+      (client as unknown as { cookies: Record<string, string> }).cookies["__Secure-1PSIDTS"] = opts.secure_1psidts;
+    }
+    return client;
+  };
 }
 
 async function getClient(config: GeminiWebConfig, factory?: GeminiClientFactory): Promise<GeminiClientLike> {
-  const key = `${config.psid ?? ""}|${config.proxy ?? ""}`;
+  const key = `${config.psid ?? ""}|${config.psidts ?? ""}|${config.proxy ?? ""}`;
   if (cached?.key === key) return cached.client;
   const make = factory ?? (await loadDefaultFactory());
-  const client = await make({ secure_1psid: config.psid, proxy: config.proxy });
+  const client = await make({ secure_1psid: config.psid, secure_1psidts: config.psidts, proxy: config.proxy });
   cached = { key, client };
   return client;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-web",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "description": "Pi extension for web search, page extraction, Firecrawl scraping/crawling, Crawl4AI headless browser crawling, Gemini web-tier research, free upstream image generation, and one-off gateway chat.",
   "type": "module",
   "license": "MIT",

package/skills/pi-web/SKILL.md

@@ -17,7 +17,7 @@ Use the **10 unified tools** from the `pi-web` extension for all web-related tas
 | `web_crawl` | Crawl multiple pages from a site | Light (Firecrawl) or Full (Crawl4AI) |
 | `web_screenshot` | Capture page screenshot as PNG | Crawl4AI daemon (public URLs) or local headless Chrome (localhost/LAN/file URLs — auto-detected) |
 | `web_pdf` | Generate page PDF | Crawl4AI daemon (public URLs) or local headless Chrome (localhost/LAN/file URLs — auto-detected) |
-| `web_research` | AI-synthesized research with sources | Gemini web tier: ask = grounded answer (guest OK); research = Deep Research report (cookie + Gemini Advanced) |
+| `web_research` | AI-synthesized research with sources | Gemini web tier: ask = grounded answer (guest OK); research = Deep Research report (fresh cookie; currently refused to non-browser clients with 1184) |
 | `web_image` | Generate images from a text prompt | Gemini web (guest/cookie) → Z.ai GLM-Image (`ZAI_API_KEY`) → custom OpenAI-images endpoint |
 | `web_chat` | One-off chat via an OpenAI-compatible gateway | `WEB_CHAT_API_BASE_URL` (ChatGPT web bridge, official OpenAI, …) |
 | `web_status` | Check provider configuration and health | — |
@@ -59,7 +59,7 @@ What do you need?
 ├── AI-synthesized research with sources (synthesis, comparisons, reports)
 │   → web_research
 │     ├─ quick grounded answer: mode=ask (default; guest OK, Flash-only)
-│     └─ multi-minute Deep Research report: mode=research (needs cookie + Gemini Advanced)
+│     └─ multi-minute Deep Research report: mode=research (fresh cookie; currently blocked by Gemini's non-browser refusal)
 │
 ├── Generate an image from a text prompt (NOT capturing an existing page)
 │   → web_image