@bitkyc08/opencodex 2.6.7 → 2.6.8

package/src/providers/registry.ts

@@ -1,5 +1,6 @@
 import type { OcxProviderConfig } from "../types";
 import { KIRO_MODELS, KIRO_MODEL_CONTEXT_WINDOWS, KIRO_MODEL_REASONING_EFFORTS } from "./kiro-models";
+import { ANTIGRAVITY_MODELS, ANTIGRAVITY_MODEL_CONTEXT_WINDOWS } from "./antigravity-models";
 
 export type ProviderAuthKind = "forward" | "oauth" | "key" | "local";
 export type MetadataModelIdNormalize = "case-insensitive";
@@ -34,6 +35,9 @@ export interface ProviderRegistryEntry {
   jawcodeBundle?: string;
   extraMetadataAliases?: string[];
   metadataModelIdNormalize?: MetadataModelIdNormalize;
+  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
+  project?: string;
+  location?: string;
 }
 
 export type ProviderConfigSeed = Pick<
@@ -43,6 +47,7 @@ export type ProviderConfigSeed = Pick<
   | "reasoningEfforts" | "modelReasoningEfforts" | "reasoningEffortMap" | "modelReasoningEffortMap"
   | "noVisionModels" | "noReasoningModels" | "noTemperatureModels" | "noTopPModels" | "noPenaltyModels"
   | "autoToolChoiceOnlyModels" | "preserveReasoningContentModels" | "escapeBuiltinToolNames"
+  | "googleMode" | "project" | "location"
 >;
 
 
@@ -260,6 +265,8 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   { id: "openrouter", label: "OpenRouter", adapter: "openai-chat", baseUrl: "https://openrouter.ai/api/v1", authKind: "key", featured: true, dashboardUrl: "https://openrouter.ai/keys", jawcodeBundle: "openrouter" },
   { id: "groq", label: "Groq", adapter: "openai-chat", baseUrl: "https://api.groq.com/openai/v1", authKind: "key", featured: true, dashboardUrl: "https://console.groq.com/keys" },
   { id: "google", label: "Google Gemini", adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", authKind: "key", featured: true, dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3-pro", jawcodeBundle: "google", extraMetadataAliases: ["gemini"] },
+  { id: "google-vertex", label: "Google Vertex AI", adapter: "google", baseUrl: "https://aiplatform.googleapis.com", authKind: "key", dashboardUrl: "https://console.cloud.google.com/vertex-ai", defaultModel: "gemini-3-pro", googleMode: "vertex", jawcodeBundle: "google", extraMetadataAliases: ["gemini-vertex"] },
+  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, defaultModel: "gemini-3.5-flash-low", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
   { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
   { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", featured: true, note: "Local — key usually blank", reasoningEffortMap: OLLAMA_REASONING_MAP },
   { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", featured: true, note: "Local — key usually blank" },

package/src/redact.ts

@@ -69,3 +69,29 @@ export function redactUrlForLog(url: string): string {
     return redactSecretString(url.split("?")[0] ?? url);
   }
 }
+
+const USER_HOME_PATH_PATTERNS: Array<[RegExp, string]> = [
+  // Windows: C:\Users\<name>\...  ->  C:\Users\[USER]\...
+  [/([A-Za-z]:\\Users\\)[^\\/]+/gi, "$1[USER]"],
+  // POSIX: /Users/<name>/... (macOS) and /home/<name>/... (Linux)
+  [/(\/(?:Users|home)\/)[^/]+/gi, "$1[USER]"],
+];
+
+// Path segments whose name alone looks sensitive. Masked so a configured path
+// cannot surface a secret-flavored substring in diagnostics or logs.
+const SENSITIVE_SEGMENT_PATTERN = /(^|[\\/])([^\\/]*(?:secret|password|passwd|token|api[-_]?key|apikey|credential|email)[^\\/]*)(?=[\\/]|$)/gi;
+
+/**
+ * Mask the username segment of an absolute home path so diagnostics can print
+ * paths without leaking the OS account name, and mask any path segment whose
+ * name looks sensitive (token/secret/password/credential/email/...). Path-focused
+ * and secret-safe: also runs {@link redactSecretString} for token-shaped values.
+ */
+export function redactUserPath(path: string): string {
+  let masked = path;
+  for (const [pattern, replacement] of USER_HOME_PATH_PATTERNS) {
+    masked = masked.replace(pattern, replacement);
+  }
+  masked = masked.replace(SENSITIVE_SEGMENT_PATTERN, (_m, sep: string) => `${sep}[REDACTED]`);
+  return redactSecretString(masked);
+}

package/src/router.ts

@@ -94,6 +94,12 @@ function routedProviderConfig(providerName: string, provider: OcxProviderConfig)
     baseUrl: registryEntry.baseUrl,
     authMode: canonicalAuthMode,
     apiKey: resolveEnvValue(provider.apiKey),
+    // Backfill the Google wire mode + Vertex project/location from the registry when the user
+    // config omits them, so a minimal `google-vertex`/`google-antigravity` entry still routes
+    // through the correct branch (CCA/Vertex) instead of falling back to AI Studio.
+    ...(provider.googleMode === undefined && registryEntry.googleMode !== undefined ? { googleMode: registryEntry.googleMode } : {}),
+    ...(provider.project === undefined && registryEntry.project !== undefined ? { project: registryEntry.project } : {}),
+    ...(provider.location === undefined && registryEntry.location !== undefined ? { location: registryEntry.location } : {}),
     ...(provider.contextWindow === undefined && registryEntry.contextWindow !== undefined ? { contextWindow: registryEntry.contextWindow } : {}),
     ...(provider.reasoningEfforts === undefined && registryEntry.reasoningEfforts !== undefined ? { reasoningEfforts: registryEntry.reasoningEfforts } : {}),
     ...(provider.escapeBuiltinToolNames === undefined && registryEntry.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: registryEntry.escapeBuiltinToolNames } : {}),

package/src/server.ts

@@ -35,7 +35,7 @@ import { parseRequest } from "./responses/parser";
 import { routeModel } from "./router";
 import { namespacedToolName } from "./types";
 import {
-  clearLoginState, getLoginStatus, getValidAccessToken, isOAuthProvider,
+  clearLoginState, getLoginStatus, getOAuthCredentialProjectId, getValidAccessToken, isOAuthProvider,
   listOAuthProviders, reconcileOAuthProviders, startLoginFlow, UnsupportedOAuthProviderError, upsertOAuthProvider,
 } from "./oauth/index";
 import type { CatalogModel } from "./codex-catalog";
@@ -48,7 +48,7 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "./oauth/key-pr
 import { deriveProviderPresets } from "./providers/derive";
 import type { AdapterEvent, OcxConfig, OcxProviderConfig } from "./types";
 import type { OcxUsage } from "./types";
-import { DEFAULT_PROVIDER_CONTEXT_CAP, providerContextCap, providerContextCaps, setProviderContextCap } from "./provider-context-cap";
+import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "./provider-context-cap";
 import {
   appendUsageEntry,
   readUsageEntries,
@@ -423,6 +423,12 @@ async function handleResponses(
   if (route.provider.authMode === "oauth") {
     try {
       route.provider = { ...route.provider, apiKey: await getValidAccessToken(route.providerName) };
+      // Antigravity (cloud-code-assist) needs the discovered Cloud Code Assist project id in the
+      // CCA envelope; the server injects only the bare token, so pull project from the credential.
+      if (route.provider.googleMode === "cloud-code-assist" && !route.provider.project) {
+        const projectId = getOAuthCredentialProjectId(route.providerName);
+        if (projectId) route.provider = { ...route.provider, project: projectId };
+      }
     } catch (err) {
       if (err instanceof UnsupportedOAuthProviderError) {
         return formatErrorResponse(
@@ -449,7 +455,7 @@ async function handleResponses(
   const recordTerminalOutcomes = options.recordTerminalOutcomes !== false;
 
   if ("passthrough" in adapter && adapter.passthrough) {
-    const request = adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
+    const request = await adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
     // Abort the upstream if the client disconnects. A directly-relayed body does not propagate the
     // consumer's cancel to a signalled fetch, so we pass the signal and relay through relayWithAbort,
     // whose cancel() aborts the upstream — preventing leaked connections (RC2, passthrough path).
@@ -589,7 +595,7 @@ async function handleResponses(
   const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal);
   const connectMs = config.connectTimeoutMs ?? 100_000;
 
-  const request = adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
+  const request = await adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
   if (typeof request.usageLog?.inputTokens === "number") {
     logCtx.usageLogInputTokens = request.usageLog.inputTokens;
   }
@@ -1802,12 +1808,44 @@ async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): P
   }
 
   if (url.pathname === "/api/provider-context-caps" && req.method === "GET") {
-    return jsonResponse({ cap: DEFAULT_PROVIDER_CONTEXT_CAP, caps: providerContextCaps(config) });
+    return jsonResponse({ cap: DEFAULT_PROVIDER_CONTEXT_CAP, value: globalContextCapValue(config), caps: providerContextCaps(config) });
   }
 
   if (url.pathname === "/api/provider-context-caps" && req.method === "PUT") {
-    let body: { provider?: unknown; enabled?: unknown };
+    let body: { provider?: unknown; enabled?: unknown; value?: unknown; setAll?: unknown };
     try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const { saveConfig: save } = await import("./config");
+    const { clearModelCache } = await import("./model-cache");
+    const respond = () => jsonResponse({ ok: true, cap: DEFAULT_PROVIDER_CONTEXT_CAP, value: globalContextCapValue(config), caps: providerContextCaps(config) });
+
+    // Branch 1: set the global cap value and re-point every enabled provider to it.
+    if (body.value !== undefined) {
+      if (typeof body.value !== "number" || !Number.isFinite(body.value) || body.value <= 0) {
+        return jsonResponse({ error: "value must be a positive number" }, 400);
+      }
+      const affected = Object.keys(providerContextCaps(config));
+      setGlobalContextCapValue(config, body.value);
+      save(config);
+      for (const provider of affected) clearModelCache(provider);
+      await refreshCodexCatalogBestEffort();
+      return respond();
+    }
+
+    // Branch 2: enable/clear the cap for every provider at once.
+    if (body.setAll !== undefined) {
+      if (typeof body.setAll !== "boolean") {
+        return jsonResponse({ error: "setAll must be a boolean" }, 400);
+      }
+      const before = Object.keys(providerContextCaps(config));
+      const names = Object.keys(config.providers);
+      setAllProviderContextCaps(config, names, body.setAll);
+      save(config);
+      for (const provider of new Set([...before, ...names])) clearModelCache(provider);
+      await refreshCodexCatalogBestEffort();
+      return respond();
+    }
+
+    // Branch 3: existing per-provider toggle (enable writes the current global value).
     if (typeof body.provider !== "string" || typeof body.enabled !== "boolean") {
       return jsonResponse({ error: "provider string and enabled boolean are required" }, 400);
     }
@@ -1819,12 +1857,10 @@ async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): P
       return jsonResponse({ error: "unknown provider" }, 404);
     }
     setProviderContextCap(config, provider, body.enabled);
-    const { saveConfig: save } = await import("./config");
     save(config);
-    const { clearModelCache } = await import("./model-cache");
     clearModelCache(provider);
     await refreshCodexCatalogBestEffort();
-    return jsonResponse({ ok: true, cap: DEFAULT_PROVIDER_CONTEXT_CAP, caps: providerContextCaps(config) });
+    return respond();
   }
 
   // Enable/disable models: which routed models Codex sees. PUT hides them from the catalog +

package/src/types.ts

@@ -207,6 +207,8 @@ export interface OcxConfig {
   disabledModels?: string[];
   /** Provider-level Codex-visible context caps. Values only lower known model context windows. */
   providerContextCaps?: Record<string, number>;
+  /** Global Codex-visible context cap value (tokens). Falls back to DEFAULT_PROVIDER_CONTEXT_CAP. */
+  contextCapValue?: number;
   /** Bind hostname. Default "127.0.0.1" (loopback only). Set "0.0.0.0" to expose on all interfaces. */
   hostname?: string;
   /** Upstream stall timeout (seconds). After this many seconds of no upstream data, emits response.incomplete. Default 90. Min 1. */
@@ -326,6 +328,16 @@ export interface OcxProviderConfig {
    * attached images are described by a gpt vision model and replaced with text before the call.
    */
   noVisionModels?: string[];
+  /**
+   * Google adapter mode. "ai-studio" (default) = Generative Language API + x-goog-api-key.
+   * "vertex" = Vertex AI project/location endpoints with GCP ADC (or x-goog-api-key).
+   * "cloud-code-assist" = Google Antigravity (Cloud Code Assist) OAuth + CCA envelope.
+   */
+  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
+  /** Vertex AI GCP project id (or GOOGLE_CLOUD_PROJECT / GCLOUD_PROJECT env). */
+  project?: string;
+  /** Vertex AI location, e.g. "us-central1" or "global" (or GOOGLE_CLOUD_LOCATION env). */
+  location?: string;
 }
 
 export interface CodexAccount {

package/src/usage-summary.ts

@@ -22,6 +22,14 @@ export interface UsageDay {
   requests: number;
   reportedRequests: number;
   totalTokens: number;
+  models: UsageDayModel[];
+}
+
+export interface UsageDayModel {
+  model: string;
+  provider: string;
+  requests: number;
+  totalTokens: number;
 }
 
 export interface UsageModel {
@@ -124,24 +132,43 @@ function buildDayGrid(range: UsageRange, since: number | null, now: number, entr
   const window = rangeWindow(range, now);
   const days = range === "all" ? dayCountForAllRange(entries, now) : window.days;
   const grid = new Map<string, UsageDay>();
+  // Per-day model breakdown accumulator, keyed by day then provider/model, so the 7d bar chart can
+  // render a per-model stacked bar with a hover tooltip without a second pass over the entries.
+  const dayModels = new Map<string, Map<string, UsageDayModel>>();
+  const bumpDayModel = (dayKey: string, entry: PersistedUsageEntry): void => {
+    let models = dayModels.get(dayKey);
+    if (!models) { models = new Map(); dayModels.set(dayKey, models); }
+    const mKey = `${entry.provider}/${entry.model}`;
+    let m = models.get(mKey);
+    if (!m) { m = { model: entry.model, provider: entry.provider, requests: 0, totalTokens: 0 }; models.set(mKey, m); }
+    m.requests += 1;
+    if (typeof entry.totalTokens === "number") m.totalTokens += entry.totalTokens;
+    else if (entry.usage) m.totalTokens += entry.usage.inputTokens + entry.usage.outputTokens;
+  };
   for (let i = days - 1; i >= 0; i--) {
     const key = localDateKey(now - i * DAY_MS);
-    grid.set(key, { date: key, requests: 0, reportedRequests: 0, totalTokens: 0 });
+    grid.set(key, { date: key, requests: 0, reportedRequests: 0, totalTokens: 0, models: [] });
   }
   for (const entry of entries) {
     const key = localDateKey(entry.timestamp);
     let day = grid.get(key);
     if (!day) {
-      day = { date: key, requests: 0, reportedRequests: 0, totalTokens: 0 };
+      day = { date: key, requests: 0, reportedRequests: 0, totalTokens: 0, models: [] };
       grid.set(key, day);
     }
     day.requests += 1;
     if (entry.usageStatus === "reported") day.reportedRequests += 1;
     if (typeof entry.totalTokens === "number") day.totalTokens += entry.totalTokens;
     else if (entry.usage) day.totalTokens += entry.usage.inputTokens + entry.usage.outputTokens;
+    bumpDayModel(key, entry);
   }
   void since;
-  return [...grid.values()].sort((a, b) => a.date.localeCompare(b.date));
+  const out = [...grid.values()].sort((a, b) => a.date.localeCompare(b.date));
+  for (const day of out) {
+    const models = dayModels.get(day.date);
+    if (models) day.models = [...models.values()].sort((a, b) => b.requests - a.requests);
+  }
+  return out;
 }
 
 function buildModels(entries: PersistedUsageEntry[], totalRequests: number): UsageModel[] {

package/src/web-search/loop.ts

@@ -130,7 +130,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       ...parsed, stream: false,
       context: { ...parsed.context, messages, tools: forceAnswer ? toolsNoWebSearch : allTools },
     };
-    const request = adapter.buildRequest(iterParsed, { headers: selectedForwardHeaders });
+    const request = await adapter.buildRequest(iterParsed, { headers: selectedForwardHeaders });
     let resp: Response;
     try {
       resp = adapter.fetchResponse