@eddyskywalker/dsh-chatgpt-subscription 0.2.2 → 0.2.4

package/lib/index.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import * as LlmModule from "@deepseek-ai/dsh-llm";
-import { HarnessError, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { CallId, HarnessError, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { WebError } from "@deepseek-ai/dsh-web";
 import { createUserMessage } from "@deepseek-ai/dsh-llm/message";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -14,6 +14,7 @@ import fs, { constants } from "node:fs";
 import fsPromises, { chmod, lstat, mkdir, open, rename, stat, unlink } from "node:fs/promises";
 import os, { homedir } from "node:os";
 import path, { dirname, join } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import { URL as URL$1, URLSearchParams as URLSearchParams$1 } from "node:url";
 //#region src/compat.ts
 /**
@@ -3191,16 +3192,18 @@ const DEFAULT_ACCOUNT = "oauth";
 * `security` command-line tool. The payload is encrypted at rest by the
 * Keychain, so this store reports itself as encrypted like Windows DPAPI.
 */
-var MacKeychainTokenStore = class {
+var MacKeychainCredentialStore = class {
 	service;
 	account;
+	parse;
 	storage = {
 		kind: "macos-keychain",
 		encrypted: true
 	};
-	constructor(service = DEFAULT_SERVICE, account = DEFAULT_ACCOUNT) {
+	constructor(service, account, parse) {
 		this.service = service;
 		this.account = account;
+		this.parse = parse;
 		if (process.platform !== "darwin") throw new Error("macOS Keychain storage requires macOS");
 	}
 	async load() {
@@ -3216,7 +3219,7 @@ var MacKeychainTokenStore = class {
 		if (result.code !== 0) throw new Error("Keychain credential read failed");
 		try {
 			const payload = result.stdout.replace(/\r?\n$/, "");
-			return parseStoredCredentials(JSON.parse(payload));
+			return this.parse(JSON.parse(payload));
 		} catch {
 			throw new Error("Keychain credential payload is invalid");
 		}
@@ -3244,6 +3247,11 @@ var MacKeychainTokenStore = class {
 		if (result.code !== 0 && result.code !== 44) throw new Error("Keychain credential deletion failed");
 	}
 };
+var MacKeychainTokenStore = class extends MacKeychainCredentialStore {
+	constructor(service = DEFAULT_SERVICE, account = DEFAULT_ACCOUNT) {
+		super(service, account, parseStoredCredentials);
+	}
+};
 function runSecurity(args) {
 	return new Promise((resolve, reject) => {
 		const child = spawn("security", args, {
@@ -3388,8 +3396,16 @@ $cipher = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Securit
 $directory = [IO.Path]::GetDirectoryName($path)
 [IO.Directory]::CreateDirectory($directory) | Out-Null
 $temporary = $path + '.tmp-' + [Guid]::NewGuid().ToString('N')
-[IO.File]::WriteAllBytes($temporary, $cipher)
-if ([IO.File]::Exists($path)) { [IO.File]::Replace($temporary, $path, $null) } else { [IO.File]::Move($temporary, $path) }
+try {
+  [IO.File]::WriteAllBytes($temporary, $cipher)
+  if ([IO.File]::Exists($path)) {
+    [IO.File]::Replace($temporary, $path, [System.Management.Automation.Language.NullString]::Value)
+  } else {
+    [IO.File]::Move($temporary, $path)
+  }
+} finally {
+  if ([IO.File]::Exists($temporary)) { [IO.File]::Delete($temporary) }
+}
 `;
 const UNPROTECT_SCRIPT = String.raw`
 $ErrorActionPreference = 'Stop'
@@ -3408,14 +3424,16 @@ if ([IO.File]::Exists($path)) { [IO.File]::Delete($path) }
 function defaultDpapiCredentialPath() {
 	return join(process.env.DSH_HOME?.trim() || join(homedir(), ".dsh"), "storages", "dsh-chatgpt-subscription", "oauth.dpapi");
 }
-var WindowsDpapiTokenStore = class {
+var WindowsDpapiCredentialStore = class {
 	path;
+	parse;
 	storage = {
 		kind: "windows-dpapi",
 		encrypted: true
 	};
-	constructor(path = defaultDpapiCredentialPath()) {
+	constructor(path, parse) {
 		this.path = path;
+		this.parse = parse;
 		if (process.platform !== "win32") throw new Error("Windows DPAPI storage requires Windows");
 		if (dirname(path) === path) throw new Error("invalid DPAPI credential path");
 	}
@@ -3424,7 +3442,7 @@ var WindowsDpapiTokenStore = class {
 		if (result.code === 3) return null;
 		if (result.code !== 0) throw new Error("DPAPI credential read failed");
 		try {
-			return parseStoredCredentials(JSON.parse(result.stdout));
+			return this.parse(JSON.parse(result.stdout));
 		} catch {
 			throw new Error("DPAPI credential payload is invalid");
 		}
@@ -3436,6 +3454,11 @@ var WindowsDpapiTokenStore = class {
 		if ((await runPowerShell(CLEAR_SCRIPT, this.path, "")).code !== 0) throw new Error("DPAPI credential deletion failed");
 	}
 };
+var WindowsDpapiTokenStore = class extends WindowsDpapiCredentialStore {
+	constructor(path = defaultDpapiCredentialPath()) {
+		super(path, parseStoredCredentials);
+	}
+};
 function runPowerShell(script, path, stdin) {
 	return new Promise((resolve, reject) => {
 		const child = spawn("powershell.exe", [
@@ -3856,6 +3879,96 @@ const MODELS = [
 	}
 ];
 //#endregion
+//#region src/host/credential-store-secret-service.ts
+const UNAVAILABLE = "Linux encrypted credential storage requires secret-tool (libsecret) and an unlocked Secret Service keyring.";
+/** Secrets travel over stdin/stdout; command arguments contain only lookup attributes. */
+var SecretServiceCredentialStore = class {
+	service;
+	account;
+	parse;
+	constructor(service, account, parse) {
+		this.service = service;
+		this.account = account;
+		this.parse = parse;
+	}
+	attributes() {
+		return [
+			"service",
+			this.service,
+			"account",
+			this.account
+		];
+	}
+	async load() {
+		const result = await runSecretTool(["lookup", ...this.attributes()]);
+		if (result.code === 1 && !result.hasStderr && result.stdout === "") return null;
+		if (result.code !== 0) throw new Error(UNAVAILABLE);
+		try {
+			return this.parse(JSON.parse(result.stdout));
+		} catch {
+			throw new Error("Secret Service credential payload is invalid");
+		}
+	}
+	async save(value) {
+		const payload = JSON.stringify(value);
+		if (Buffer.byteLength(payload, "utf8") >= 8192) throw new Error("Secret Service credential payload is too large");
+		if ((await runSecretTool([
+			"store",
+			"--label=DSH Antigravity OAuth",
+			...this.attributes()
+		], payload)).code !== 0) throw new Error(UNAVAILABLE);
+	}
+	async clear() {
+		const result = await runSecretTool(["clear", ...this.attributes()]);
+		if (result.code !== 0 && !(result.code === 1 && !result.hasStderr)) throw new Error(UNAVAILABLE);
+	}
+};
+function runSecretTool(args, stdin = "") {
+	return new Promise((resolve, reject) => {
+		const child = spawn("secret-tool", args, {
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let stdout = "";
+		let stderrLength = 0;
+		let settled = false;
+		const fail = () => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			child.kill();
+			reject(/* @__PURE__ */ new Error(UNAVAILABLE));
+		};
+		const timer = setTimeout(fail, 1e4);
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+			if (stdout.length > 1 << 20) fail();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderrLength += chunk.length;
+			if (stderrLength > 1 << 20) fail();
+		});
+		child.once("error", fail);
+		child.stdin.once("error", fail);
+		child.once("close", (code) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolve({
+				code: code ?? 1,
+				stdout,
+				hasStderr: stderrLength > 0
+			});
+		});
+		child.stdin.end(stdin);
+	});
+}
+//#endregion
 //#region src/host/antigravity/token-store.ts
 const ANTIGRAVITY_PREFERENCES_NAMESPACE = "dsh-antigravity";
 function registerAntigravityPreferenceStore(settings, fallbackStore = new FileModelSettingsStore()) {
@@ -3917,36 +4030,110 @@ function credentialPath() {
 function modelSettingsPath() {
 	return path.join(dshHomeDir(), "storages", "antigravity-models.json");
 }
+function parseAntigravityCredentials(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("Antigravity credential payload is invalid");
+	const record = value;
+	const credentials = {};
+	for (const key of [
+		"access",
+		"access_token",
+		"refresh",
+		"refresh_token",
+		"email",
+		"projectId"
+	]) {
+		if (record[key] === void 0) continue;
+		if (typeof record[key] !== "string") throw new Error("Antigravity credential payload is invalid");
+		credentials[key] = record[key];
+	}
+	for (const key of ["expires", "expires_at"]) {
+		if (record[key] === void 0) continue;
+		if (typeof record[key] !== "number" || !Number.isFinite(record[key])) throw new Error("Antigravity credential expiry is invalid");
+		credentials[key] = record[key];
+	}
+	if (!(credentials.access || credentials.access_token || credentials.refresh || credentials.refresh_token)) throw new Error("Antigravity credential tokens are missing");
+	return credentials;
+}
+function credentialAccount(filePath) {
+	return createHash("sha256").update(path.resolve(filePath)).digest("hex");
+}
+function createCredentialBackend(filePath) {
+	if (process.platform === "win32") return new WindowsDpapiCredentialStore(`${filePath}.dpapi`, parseAntigravityCredentials);
+	if (process.platform === "darwin") return new MacKeychainCredentialStore("dsh-antigravity", credentialAccount(filePath), parseAntigravityCredentials);
+	if (process.platform === "linux") return new SecretServiceCredentialStore("dsh-antigravity", credentialAccount(filePath), parseAntigravityCredentials);
+	throw new Error("Antigravity encrypted credential storage requires Windows, macOS, or Linux.");
+}
+const credentialOperations = /* @__PURE__ */ new Map();
+/** Keeps the public API; filePath identifies the legacy JSON that is migrated on first use. */
 var FileCredentialStore = class {
 	filePath;
-	constructor(filePath = credentialPath()) {
+	backend;
+	constructor(filePath = credentialPath(), backend = createCredentialBackend(filePath)) {
 		this.filePath = filePath;
+		this.backend = backend;
 	}
 	path() {
-		return this.filePath;
+		if (process.platform === "win32") return `${this.filePath}.dpapi`;
+		return `${process.platform === "darwin" ? "Keychain" : "Secret Service"}: dsh-antigravity/${credentialAccount(this.filePath)}`;
+	}
+	serialize(operation) {
+		const key = path.resolve(this.filePath);
+		const result = (credentialOperations.get(key) || Promise.resolve()).then(operation);
+		const settled = result.then(() => void 0, () => void 0);
+		credentialOperations.set(key, settled);
+		settled.then(() => {
+			if (credentialOperations.get(key) === settled) credentialOperations.delete(key);
+		});
+		return result;
 	}
-	async read() {
+	async removeLegacy() {
 		try {
-			const content = await fsPromises.readFile(this.filePath, "utf8");
-			const parsed = JSON.parse(content);
-			if (typeof parsed === "object" && parsed !== null && ("access_token" in parsed || "access" in parsed)) return parsed;
-			return null;
-		} catch {
-			return null;
+			await fsPromises.unlink(this.filePath);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw new Error("Antigravity legacy credential removal failed");
 		}
 	}
-	async write(credentials) {
-		await fsPromises.mkdir(path.dirname(this.filePath), { recursive: true });
-		const tmp = `${this.filePath}.tmp.${Date.now()}`;
-		await fsPromises.writeFile(tmp, JSON.stringify(credentials, null, 2), "utf8");
-		await fsPromises.rename(tmp, this.filePath);
+	async saveVerified(credentials) {
+		await this.backend.save(credentials);
+		if (!isDeepStrictEqual(await this.backend.load(), credentials)) throw new Error("Antigravity encrypted credential verification failed");
+		await this.removeLegacy();
+	}
+	read() {
+		return this.serialize(async () => {
+			const current = await this.backend.load();
+			if (current !== null) {
+				await this.removeLegacy();
+				return current;
+			}
+			let legacy;
+			try {
+				const stats = await fsPromises.lstat(this.filePath);
+				if (!stats.isFile() || stats.isSymbolicLink()) throw new Error("Invalid credential file");
+				if (process.getuid && stats.uid !== process.getuid()) throw new Error("Invalid credential owner");
+				if (process.platform !== "win32") await fsPromises.chmod(this.filePath, 384);
+				legacy = await fsPromises.readFile(this.filePath, "utf8");
+			} catch (error) {
+				if (error.code === "ENOENT") return null;
+				throw new Error("Antigravity legacy credential read failed");
+			}
+			let credentials;
+			try {
+				credentials = parseAntigravityCredentials(JSON.parse(legacy));
+			} catch {
+				throw new Error("Antigravity legacy credential payload is invalid");
+			}
+			await this.saveVerified(credentials);
+			return credentials;
+		});
 	}
-	async delete() {
-		try {
-			await fsPromises.unlink(this.filePath);
-		} catch (err) {
-			if (err.code !== "ENOENT") throw err;
-		}
+	write(credentials) {
+		return this.serialize(() => this.saveVerified(parseAntigravityCredentials(credentials)));
+	}
+	delete() {
+		return this.serialize(async () => {
+			await this.removeLegacy();
+			await this.backend.clear();
+		});
 	}
 };
 var FileModelSettingsStore = class {
@@ -4064,9 +4251,9 @@ function extractProjectId(data) {
 		}
 	}
 }
-async function listCloudAICompanionProjects(token) {
+async function listCloudAICompanionProjects(token, fetchFn = fetch) {
 	for (const endpoint of endpointCandidates()) try {
-		const response = await fetch(`${endpoint}/v1internal:listCloudAICompanionProjects`, {
+		const response = await fetchFn(`${endpoint}/v1internal:listCloudAICompanionProjects`, {
 			method: "POST",
 			headers: antigravityHeaders(token),
 			body: JSON.stringify({}),
@@ -4076,7 +4263,7 @@ async function listCloudAICompanionProjects(token) {
 		return extractProjectId(await response.json());
 	} catch {}
 }
-async function loadCodeAssist(token) {
+async function loadCodeAssist(token, fetchFn = fetch) {
 	const cached = projectCache.get(token);
 	if (cached && cached.expiresAt > Date.now()) return cached.projectId;
 	const body = JSON.stringify({ metadata: {
@@ -4085,7 +4272,7 @@ async function loadCodeAssist(token) {
 		pluginType: "GEMINI"
 	} });
 	for (const endpoint of endpointCandidates()) try {
-		const response = await fetch(`${endpoint}/v1internal:loadCodeAssist`, {
+		const response = await fetchFn(`${endpoint}/v1internal:loadCodeAssist`, {
 			method: "POST",
 			headers: antigravityHeaders(token),
 			body,
@@ -4100,7 +4287,7 @@ async function loadCodeAssist(token) {
 			});
 			return project;
 		}
-		const listProj = await listCloudAICompanionProjects(token);
+		const listProj = await listCloudAICompanionProjects(token, fetchFn);
 		if (listProj) {
 			projectCache.set(token, {
 				projectId: listProj,
@@ -4110,9 +4297,9 @@ async function loadCodeAssist(token) {
 		}
 	} catch {}
 }
-async function postJson(path, token, body) {
+async function postJson(path, token, body, fetchFn = fetch) {
 	for (const endpoint of endpointCandidates()) try {
-		const response = await fetch(`${endpoint}${path}`, {
+		const response = await fetchFn(`${endpoint}${path}`, {
 			method: "POST",
 			headers: jsonHeaders(token),
 			body: JSON.stringify(body)
@@ -4175,16 +4362,16 @@ function parseCatalogModels(data) {
 	}
 	return list;
 }
-async function fetchAccountQuota(store = new FileCredentialStore(), modelSettings) {
-	const { token, projectId: credentialProjectId } = await ensureApiKey(store);
+async function fetchAccountQuota(store = new FileCredentialStore(), modelSettings, fetchFn = fetch) {
+	const { token, projectId: credentialProjectId } = await ensureApiKey(store, fetchFn);
 	const [assistResult, summaryResult] = await Promise.all([postJson("/v1internal:loadCodeAssist", token, { metadata: {
 		ideType: "ANTIGRAVITY",
 		platform: "PLATFORM_UNSPECIFIED",
 		pluginType: "GEMINI"
-	} }).catch(() => null), postJson("/v1internal:retrieveUserQuotaSummary", token, {}).catch(() => null)]);
+	} }, fetchFn).catch(() => null), postJson("/v1internal:retrieveUserQuotaSummary", token, {}, fetchFn).catch(() => null)]);
 	const discoveredProject = assistResult ? extractProjectId(assistResult.data) : void 0;
 	const projectId = credentialProjectId || discoveredProject || "antigravity-default";
-	const modelsData = (await postJson("/v1internal:fetchAvailableModels", token, { project: projectId }).catch(() => null))?.data;
+	const modelsData = (await postJson("/v1internal:fetchAvailableModels", token, { project: projectId }, fetchFn).catch(() => null))?.data;
 	const { groups, description } = summaryResult ? parseQuotaSummary(summaryResult.data) : { groups: [] };
 	const catalogModels = modelsData ? parseCatalogModels(modelsData) : [];
 	const assistData = assistResult?.data || {};
@@ -4282,9 +4469,9 @@ function openBrowser(url) {
 		});
 	} catch {}
 }
-async function getUserEmail(token) {
+async function getUserEmail(token, fetchFn = fetch) {
 	try {
-		const response = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", { headers: { Authorization: `Bearer ${token}` } });
+		const response = await fetchFn("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", { headers: { Authorization: `Bearer ${token}` } });
 		if (!response.ok) return void 0;
 		const data = await response.json();
 		return typeof data.email === "string" ? data.email : void 0;
@@ -4363,8 +4550,8 @@ function startCallbackServer(expectedState) {
 		});
 	});
 }
-async function exchangeOAuthCode(code, verifier, callbackUrl) {
-	const tokenResponse = await fetch(TOKEN_URL, {
+async function exchangeOAuthCode(code, verifier, callbackUrl, fetchFn = fetch) {
+	const tokenResponse = await fetchFn(TOKEN_URL, {
 		method: "POST",
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: new URLSearchParams$1({
@@ -4382,7 +4569,7 @@ async function exchangeOAuthCode(code, verifier, callbackUrl) {
 	const accessToken = typeof tokenData.access_token === "string" ? tokenData.access_token : "";
 	const expiresIn = typeof tokenData.expires_in === "number" ? tokenData.expires_in : 3600;
 	if (!refreshToken) throw new Error("No refresh token received. Re-run login and allow offline access.");
-	const [email, discoveredProject] = await Promise.all([getUserEmail(accessToken), loadCodeAssist(accessToken).catch(() => void 0)]);
+	const [email, discoveredProject] = await Promise.all([getUserEmail(accessToken, fetchFn), loadCodeAssist(accessToken, fetchFn).catch(() => void 0)]);
 	return {
 		refresh: refreshToken,
 		refresh_token: refreshToken,
@@ -4394,7 +4581,7 @@ async function exchangeOAuthCode(code, verifier, callbackUrl) {
 		email
 	};
 }
-async function beginWebLogin(store) {
+async function beginWebLogin(store, fetchFn = fetch) {
 	if (webLoginFlow.status === "pending") return { ...webLoginFlow };
 	const { verifier, challenge } = generatePKCE();
 	const state = base64Url(randomBytes(32));
@@ -4420,7 +4607,7 @@ async function beginWebLogin(store) {
 		try {
 			const { code, state: returnedState } = await waitForCode();
 			if (returnedState !== state) throw new Error("OAuth state mismatch");
-			const credentials = await exchangeOAuthCode(code, verifier, callbackUrl);
+			const credentials = await exchangeOAuthCode(code, verifier, callbackUrl, fetchFn);
 			await store.write(credentials);
 			webLoginFlow.status = "complete";
 			webLoginFlow.email = credentials.email;
@@ -4438,10 +4625,10 @@ async function beginWebLogin(store) {
 function getWebLoginStatus() {
 	return { ...webLoginFlow };
 }
-async function refreshAntigravityToken(credentials) {
+async function refreshAntigravityToken(credentials, fetchFn = fetch) {
 	const refreshToken = credentials.refresh || credentials.refresh_token;
 	if (!refreshToken) throw new Error("Missing Antigravity refresh token.");
-	const response = await fetch(TOKEN_URL, {
+	const response = await fetchFn(TOKEN_URL, {
 		method: "POST",
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: new URLSearchParams$1({
@@ -4466,12 +4653,12 @@ async function refreshAntigravityToken(credentials) {
 		expires_at: Date.now() + expiresIn * 1e3 - 300 * 1e3
 	};
 }
-async function ensureApiKey(store) {
+async function ensureApiKey(store, fetchFn = fetch) {
 	let credentials = await store.read();
 	if (!credentials) throw new Error("Not logged into Antigravity. Please log in from Settings > Antigravity.");
 	const expires = credentials.expires || credentials.expires_at || 0;
 	if (!(credentials.access || credentials.access_token) || expires <= Date.now() + 6e4) {
-		credentials = await refreshAntigravityToken(credentials);
+		credentials = await refreshAntigravityToken(credentials, fetchFn);
 		await store.write(credentials);
 	}
 	return {
@@ -4479,7 +4666,7 @@ async function ensureApiKey(store) {
 		projectId: credentials.projectId
 	};
 }
-async function loginAndSave(store, signal, onUrl) {
+async function loginAndSave(store, signal, onUrl, fetchFn = fetch) {
 	const { verifier, challenge } = generatePKCE();
 	const state = base64Url(randomBytes(32));
 	const { server, waitForCode } = await startCallbackServer(state);
@@ -4501,7 +4688,7 @@ async function loginAndSave(store, signal, onUrl) {
 		if (signal?.aborted) throw new Error("OAuth login aborted");
 		const { code, state: returnedState } = await waitForCode();
 		if (returnedState !== state) throw new Error("OAuth state mismatch");
-		const credentials = await exchangeOAuthCode(code, verifier, callbackUrl);
+		const credentials = await exchangeOAuthCode(code, verifier, callbackUrl, fetchFn);
 		await store.write(credentials);
 		return credentials;
 	} finally {
@@ -4578,15 +4765,27 @@ function toolResultText(blocks) {
 }
 function replayBlockFor(message, index) {
 	const source = message.source;
-	if (!source || source.kind !== "model") return void 0;
+	if (!source || source.kind !== "model" || source.provider !== "antigravity") return void 0;
 	const state = source.replayState;
 	if (!isRecord(state)) return void 0;
+	if (Array.isArray(state.blocks)) return state.blocks[index];
 	const resp = isRecord(state.response) ? state.response : void 0;
 	if (resp) {
 		if (Array.isArray(resp.outputItems)) return resp.outputItems[index];
 		if (Array.isArray(resp.blocks)) return resp.blocks[index];
 	}
-	if (Array.isArray(state.blocks)) return state.blocks[index];
+}
+function thoughtSignature(part) {
+	return asString(part?.thoughtSignature) || asString(part?.thought_signature) || asString(part?.thinkingSignature) || asString(part?.textSignature);
+}
+function replayPart(part) {
+	const copy = { ...part };
+	const signature = thoughtSignature(part);
+	delete copy.thought_signature;
+	delete copy.thinkingSignature;
+	if (signature) copy.thoughtSignature = signature;
+	if (typeof copy.text === "string") copy.text = sanitizeText(copy.text);
+	return copy;
 }
 function assistantParts(message, model, runtimeModel, toolNames) {
 	const parts = [];
@@ -4595,30 +4794,39 @@ function assistantParts(message, model, runtimeModel, toolNames) {
 		const block = message.content[index];
 		if (!isRecord(block)) continue;
 		const replay = replayBlockFor(message, index);
-		if (block.type === "text" && String(block.text || "").trim()) parts.push({ text: sanitizeText(String(block.text)) });
-		else if (block.type === "reasoning" && String(block.text || "").trim()) {
-			const sig = asString(replay?.thinkingSignature) || asString(replay?.thought_signature) || asString(block.thought_signature);
-			if (sig) parts.push({
+		const originalParts = Array.isArray(replay?.parts) ? replay.parts.filter(isRecord) : [];
+		if ((block.type === "text" || block.type === "reasoning") && originalParts.length > 0 && originalParts.every((part) => !part.functionCall) && originalParts.map((part) => asString(part.text) || "").join("") === sanitizeText(String(block.text || ""))) {
+			parts.push(...originalParts.map(replayPart));
+			continue;
+		}
+		if (block.type === "text" && String(block.text || "").trim()) {
+			const sig = thoughtSignature(replay) || thoughtSignature(block);
+			parts.push({
+				text: sanitizeText(String(block.text)),
+				...sig ? { thoughtSignature: sig } : {}
+			});
+		} else if (block.type === "reasoning" && String(block.text || "").trim()) {
+			const sig = thoughtSignature(replay) || thoughtSignature(block);
+			parts.push({
 				thought: true,
 				text: sanitizeText(String(block.text)),
-				thought_signature: sig,
-				thoughtSignature: sig
+				...sig ? { thoughtSignature: sig } : {}
 			});
-			else parts.push({ text: sanitizeText(String(block.text)) });
 		} else if (block.type === "tool-call") {
 			const toolId = String(block.id || "");
 			const toolName = String(block.name || "");
 			toolNames.set(toolId, toolName);
-			const sig = asString(replay?.thought_signature) || asString(replay?.thoughtSignature) || asString(block.thought_signature) || asString(block.thoughtSignature) || "skip_thought_signature_validator";
+			const originalCall = originalParts.find((part) => isRecord(part.functionCall));
+			const effectiveSignature = thoughtSignature(originalCall) || thoughtSignature(replay) || thoughtSignature(block) || (originalCall ? void 0 : "skip_thought_signature_validator");
 			parts.push({
 				functionCall: {
 					name: toolName,
 					args: parseArguments(block.arguments),
 					...toolCallIdNeeded(model.id, runtimeModel) ? { id: sanitizeToolCallId(toolId, toolName) } : {}
 				},
-				thought_signature: sig,
-				thoughtSignature: sig
+				...effectiveSignature ? { thoughtSignature: effectiveSignature } : {}
 			});
+			parts.push(...originalParts.filter((part) => !part.functionCall).map(replayPart));
 		}
 	}
 	return parts;
@@ -4722,6 +4930,8 @@ function buildRequest(options, model, projectId, runtimeModel, effort) {
 	const isTiered = runtimeModel === "gemini-3.8-flash-tiered" || runtimeModel === "gemini-3.7-flash-tiered";
 	const isSuffixed = /^gemini-.+(?:-(?:extra-)?low|-medium|-high|-xhigh)$/.test(runtimeModel);
 	const isGemini25 = runtimeModel.startsWith("gemini-2.5-") || model.id.startsWith("gemini-2.5-");
+	const isGemini3 = /^gemini-3[.-]/.test(runtimeModel) && !runtimeModel.includes("image");
+	const isGeminiAgent = runtimeModel === "gemini-pro-agent" || runtimeModel === "gemini-3-flash-agent";
 	if (isTiered) {
 		const selected = (effort || "medium").toLowerCase();
 		const isOff = selected === "off" || selected === "none";
@@ -4729,7 +4939,7 @@ function buildRequest(options, model, projectId, runtimeModel, effort) {
 			thinkingLevel: isOff ? "MINIMAL" : selected === "high" || selected === "xhigh" ? "HIGH" : selected === "medium" ? "MEDIUM" : "LOW",
 			includeThoughts: !isOff
 		};
-	} else if (isSuffixed) {
+	} else if (isSuffixed || isGemini3 || isGeminiAgent) {
 		const selected = (effort || "medium").toLowerCase();
 		generationConfig.thinkingConfig = { includeThoughts: !(selected === "off" || selected === "none") };
 	} else if (isGemini25) {
@@ -4765,58 +4975,90 @@ function createStreamState() {
 		replayBlocks: [],
 		currentBlock: null,
 		hasContent: false,
-		hasToolCall: false
+		hasToolCall: false,
+		usageMetadata: null,
+		done: false,
+		finished: false
+	};
+}
+function closeCurrentBlock(state) {
+	if (!state.currentBlock) return [];
+	const { index, type, text } = state.currentBlock;
+	const block = {
+		type,
+		text
+	};
+	state.blocks[index] = block;
+	state.currentBlock = null;
+	return [{
+		type: "block-end",
+		index,
+		block
+	}];
+}
+const USAGE_FIELDS = [
+	"promptTokenCount",
+	"cachedContentTokenCount",
+	"candidatesTokenCount",
+	"thoughtsTokenCount",
+	"totalTokenCount"
+];
+function collectUsage(value, state) {
+	if (!isRecord(value)) return;
+	for (const key of USAGE_FIELDS) {
+		const count = value[key];
+		if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0) continue;
+		state.usageMetadata ??= {};
+		state.usageMetadata[key] = count;
+	}
+}
+function tokenUsage(u) {
+	const prompt = u.promptTokenCount ?? 0;
+	const cache = Math.min(prompt, u.cachedContentTokenCount ?? 0);
+	const thoughts = u.thoughtsTokenCount ?? 0;
+	const explicitOutput = (u.candidatesTokenCount ?? 0) + thoughts;
+	const totalOutput = u.totalTokenCount !== void 0 && u.promptTokenCount !== void 0 ? Math.max(0, u.totalTokenCount - prompt) : 0;
+	return {
+		inputTokens: prompt - cache,
+		outputTokens: Math.max(explicitOutput, totalOutput),
+		...cache > 0 ? { cacheReadTokens: cache } : {},
+		...u.thoughtsTokenCount !== void 0 ? { reasoningTokens: thoughts } : {}
 	};
 }
 function processStreamLine(line, state) {
-	if (!line.startsWith("data:")) return [];
+	if (state.finished || !line.startsWith("data:")) return [];
 	const json = line.slice(5).trim();
-	if (!json || json === "[DONE]") return [];
+	if (json === "[DONE]") {
+		state.done = true;
+		return closeStream(state);
+	}
+	if (!json) return [];
 	const chunk = safeJsonParse(json);
 	if (!isRecord(chunk)) return [];
 	const responseData = isRecord(chunk.response) ? chunk.response : chunk;
-	const candidate = (Array.isArray(responseData.candidates) ? responseData.candidates : [])[0];
+	const candidates = Array.isArray(responseData.candidates) ? responseData.candidates : [];
+	const candidate = isRecord(candidates[0]) ? candidates[0] : void 0;
 	const content = isRecord(candidate?.content) ? candidate.content : void 0;
 	const parts = Array.isArray(content?.parts) ? content.parts : [];
 	const out = [];
-	const closeCurrentBlock = () => {
-		if (!state.currentBlock) return;
-		const index = state.blocks.length - 1;
-		if (state.currentBlock.type === "text") out.push({
-			type: "block-end",
-			index,
-			block: {
-				type: "text",
-				text: state.currentBlock.text
-			}
-		});
-		else out.push({
-			type: "block-end",
-			index,
-			block: {
-				type: "reasoning",
-				text: state.currentBlock.text
-			}
-		});
-		state.currentBlock = null;
-	};
 	for (const part of parts) {
 		if (!isRecord(part)) continue;
-		if (part.text !== void 0 && typeof part.text === "string") {
+		if (typeof part.text === "string" && part.text !== "") {
 			const isThinking = Boolean(part.thought);
 			const blockType = isThinking ? "reasoning" : "text";
 			if (!state.currentBlock || state.currentBlock.type !== blockType) {
-				closeCurrentBlock();
+				out.push(...closeCurrentBlock(state));
+				const index = state.blocks.length;
 				state.currentBlock = {
+					index,
 					type: blockType,
 					text: ""
 				};
-				const index = state.blocks.length;
 				state.blocks.push({
 					type: blockType,
 					text: ""
 				});
-				state.replayBlocks.push({ type: blockType });
+				state.replayBlocks.push({ parts: [] });
 				out.push({
 					type: "block-start",
 					index,
@@ -4826,45 +5068,55 @@ function processStreamLine(line, state) {
 			const delta = sanitizeText(part.text);
 			state.currentBlock.text += delta;
 			state.hasContent = true;
-			if (isThinking && part.thoughtSignature) {
-				state.currentBlock.thinkingSignature = part.thoughtSignature;
-				state.replayBlocks[state.blocks.length - 1].thinkingSignature = part.thoughtSignature;
-			} else if (!isThinking && part.thoughtSignature) {
-				state.currentBlock.textSignature = part.thoughtSignature;
-				state.replayBlocks[state.blocks.length - 1].textSignature = part.thoughtSignature;
-			}
+			state.replayBlocks[state.currentBlock.index].parts.push(replayPart(part));
 			out.push({
 				type: isThinking ? "reasoning-delta" : "text-delta",
-				index: state.blocks.length - 1,
+				index: state.currentBlock.index,
 				text: delta
 			});
+		} else if (!isRecord(part.functionCall) && thoughtSignature(part)) {
+			if (state.replayBlocks.length === 0) {
+				const type = part.thought ? "reasoning" : "text";
+				state.blocks.push({
+					type,
+					text: ""
+				});
+				state.replayBlocks.push({ parts: [] });
+				out.push({
+					type: "block-start",
+					index: 0,
+					blockType: type
+				});
+				out.push({
+					type: "block-end",
+					index: 0,
+					block: {
+						type,
+						text: ""
+					}
+				});
+			}
+			state.replayBlocks[state.replayBlocks.length - 1].parts.push(replayPart(part));
 		}
 		if (isRecord(part.functionCall)) {
-			closeCurrentBlock();
+			out.push(...closeCurrentBlock(state));
 			const fc = part.functionCall;
 			const toolName = asString(fc.name) || "";
 			const toolId = sanitizeToolCallId(asString(fc.id) || "", toolName);
 			const argsText = JSON.stringify(isRecord(fc.args) ? fc.args : {});
 			const index = state.blocks.length;
-			const sig = asString(part.thought_signature) || asString(part.thoughtSignature) || asString(part.thinkingSignature) || asString(fc.thought_signature) || asString(fc.thoughtSignature) || state.currentBlock?.thinkingSignature;
 			const block = {
 				type: "tool-call",
-				id: toolId,
+				id: CallId(toolId),
 				name: toolName,
-				arguments: argsText,
-				...sig ? {
-					thought_signature: sig,
-					thoughtSignature: sig
-				} : {}
+				arguments: argsText
 			};
 			state.blocks.push(block);
-			state.replayBlocks.push({
-				type: "tool-call",
-				...sig ? {
-					thought_signature: sig,
-					thoughtSignature: sig
-				} : {}
-			});
+			const sig = thoughtSignature(part) || thoughtSignature(fc);
+			state.replayBlocks.push({ parts: [{
+				...replayPart(part),
+				...sig ? { thoughtSignature: sig } : {}
+			}] });
 			state.hasContent = true;
 			state.hasToolCall = true;
 			out.push({
@@ -4875,7 +5127,7 @@ function processStreamLine(line, state) {
 			out.push({
 				type: "tool-call-delta",
 				index,
-				id: toolId,
+				id: CallId(toolId),
 				name: toolName,
 				argumentsDelta: argsText
 			});
@@ -4886,55 +5138,33 @@ function processStreamLine(line, state) {
 			});
 		}
 	}
-	if (responseData.usageMetadata && isRecord(responseData.usageMetadata)) {
-		const u = responseData.usageMetadata;
-		const usage = {
-			inputTokens: Math.max(0, (u.promptTokenCount || 0) - (u.cachedContentTokenCount || 0)),
-			outputTokens: (u.candidatesTokenCount || 0) + (u.thoughtsTokenCount || 0),
-			...u.cachedContentTokenCount ? { cacheReadTokens: u.cachedContentTokenCount } : {}
-		};
-		out.push({
-			type: "usage",
-			usage
-		});
-	}
-	const finishReason = candidate?.finishReason;
+	collectUsage(chunk.usageMetadata, state);
+	if (responseData !== chunk) collectUsage(responseData.usageMetadata, state);
+	const finishReason = asString(candidate?.finishReason) || asString(responseData.finishReason);
 	if (finishReason) {
-		closeCurrentBlock();
-		const reason = state.hasToolCall ? { kind: "tool-calls" } : finishReason === "MAX_TOKENS" ? { kind: "max-tokens" } : { kind: "stop" };
-		out.push({
-			type: "finish",
-			reason,
-			replayState: { response: {
-				outputItems: state.replayBlocks,
-				blocks: state.replayBlocks
-			} }
-		});
+		state.finishReason = finishReason;
+		out.push(...closeCurrentBlock(state));
 	}
 	return out;
 }
 function closeStream(state) {
-	const out = [];
-	if (state.currentBlock) {
-		const index = state.blocks.length - 1;
-		if (state.currentBlock.type === "text") out.push({
-			type: "block-end",
-			index,
-			block: {
-				type: "text",
-				text: state.currentBlock.text
-			}
-		});
-		else out.push({
-			type: "block-end",
-			index,
-			block: {
-				type: "reasoning",
-				text: state.currentBlock.text
-			}
-		});
-		state.currentBlock = null;
-	}
+	if (state.finished) return [];
+	if (!state.finishReason && !state.done) throw new LlmError("Antigravity stream ended before its terminal response", "PROVIDER_ERROR");
+	state.finished = true;
+	const out = closeCurrentBlock(state);
+	if (state.usageMetadata) out.push({
+		type: "usage",
+		usage: tokenUsage(state.usageMetadata)
+	});
+	const reason = state.finishReason === "MAX_TOKENS" ? { kind: "max-tokens" } : state.hasToolCall ? { kind: "tool-calls" } : { kind: "stop" };
+	out.push({
+		type: "finish",
+		reason,
+		replayState: {
+			response: { provider: PROVIDER_ID },
+			blocks: state.replayBlocks
+		}
+	});
 	return out;
 }
 //#endregion
@@ -4943,11 +5173,13 @@ var AntigravityAdapter = class extends LlmAdapter {
 	store;
 	modelSettings;
 	preferences;
-	constructor(store = new FileCredentialStore(), modelSettings = new FileModelSettingsStore(), preferences) {
+	options;
+	constructor(store = new FileCredentialStore(), modelSettings = new FileModelSettingsStore(), preferences, options = {}) {
 		super();
 		this.store = store;
 		this.modelSettings = modelSettings;
 		this.preferences = preferences;
+		this.options = options;
 	}
 	providerInfo(provider) {
 		return {
@@ -5018,7 +5250,7 @@ var AntigravityAdapter = class extends LlmAdapter {
 			contextWindow: 128e3,
 			maxTokens: 65536
 		};
-		const settings = await this.modelSettings.read();
+		const settings = this.preferences ? this.preferences.status() : await this.modelSettings.read();
 		const effectiveEffort = options.reasoningEffort || settings.defaultReasoningEffort || void 0;
 		const effectiveOptions = effectiveEffort ? {
 			...options,
@@ -5027,7 +5259,8 @@ var AntigravityAdapter = class extends LlmAdapter {
 		yield* wrapStreamWithWatchdog((watchdogSignal) => this.requestStream(effectiveOptions, model, watchdogSignal), options.signal, STREAM_IDLE_TIMEOUT_MS, STREAM_IDLE_TIMEOUT_CODE, "Antigravity");
 	}
 	async *requestStream(options, model, signal) {
-		const { token, projectId: defaultProj } = await ensureApiKey(this.store);
+		const fetchFn = this.options.fetchFn ?? fetch;
+		const { token, projectId: defaultProj } = await ensureApiKey(this.store, fetchFn);
 		const projectId = defaultProj || "antigravity-default";
 		const effort = String(options.reasoningEffort || "medium").toLowerCase();
 		const routing = ROUTING[model.id];
@@ -5039,7 +5272,6 @@ var AntigravityAdapter = class extends LlmAdapter {
 			for (const fc of routing.fallbackCandidates) if (!candidates.includes(fc)) candidates.push(fc);
 		}
 		let response;
-		candidates[0];
 		for (const runtimeModel of candidates) {
 			const body = JSON.stringify(buildRequest(options, model, projectId, runtimeModel, effort));
 			const headers = {
@@ -5047,7 +5279,7 @@ var AntigravityAdapter = class extends LlmAdapter {
 				...model.id.startsWith("claude-") ? { "anthropic-beta": "interleaved-thinking-2025-05-14" } : {}
 			};
 			for (const endpoint of endpointCandidates()) try {
-				response = await fetch(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
+				response = await fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
 					method: "POST",
 					headers,
 					body,
@@ -5083,8 +5315,10 @@ var AntigravityAdapter = class extends LlmAdapter {
 					if (!trimmed) continue;
 					const chunks = processStreamLine(trimmed, state);
 					for (const chunk of chunks) yield chunk;
+					if (state.finished) return;
 				}
 			}
+			buffer += decoder.decode();
 			if (buffer.trim()) {
 				const chunks = processStreamLine(buffer.trim(), state);
 				for (const chunk of chunks) yield chunk;
@@ -5151,7 +5385,7 @@ async function getAntigravityWebStatus(store, modelSettings, preferences) {
 		defaultReasoningEffort: settings.defaultReasoningEffort || null
 	};
 }
-function registerAntigravityRoutes(ctx, store, modelSettings, preferences) {
+function registerAntigravityRoutes(ctx, store, modelSettings, preferences, fetchFn = fetch) {
 	return ctx.webServer.register({
 		kind: "prefix",
 		path: "/antigravity/api",
@@ -5169,7 +5403,7 @@ function registerAntigravityRoutes(ctx, store, modelSettings, preferences) {
 					if (request.method !== "POST") return sendMethodNotAllowed(response);
 					return sendJson(response, 200, {
 						ok: true,
-						value: await beginWebLogin(store)
+						value: await beginWebLogin(store, fetchFn)
 					});
 				}
 				if (path === "login/status") {
@@ -5181,7 +5415,7 @@ function registerAntigravityRoutes(ctx, store, modelSettings, preferences) {
 				}
 				if (path === "quota") {
 					if (request.method !== "GET" && request.method !== "POST") return sendMethodNotAllowed(response);
-					const quota = await fetchAccountQuota(store, modelSettings);
+					const quota = await fetchAccountQuota(store, modelSettings, fetchFn);
 					return sendJson(response, 200, {
 						ok: true,
 						value: {
@@ -5254,21 +5488,15 @@ function apply(ctx) {
 	const antigravityStore = new FileCredentialStore();
 	const antigravityModelSettings = new FileModelSettingsStore();
 	const antigravityPreferences = registerAntigravityPreferenceStore(ctx.settings, antigravityModelSettings);
-	const antigravityAdapter = new AntigravityAdapter(antigravityStore, antigravityModelSettings, antigravityPreferences);
-	ctx.effect(() => {
-		const disposeAntigravityAdapter = ctx.llm.registerAdapter([PROVIDER_ID], antigravityAdapter);
-		const disposeAntigravityRoutes = registerAntigravityRoutes(ctx, antigravityStore, antigravityModelSettings, antigravityPreferences);
-		return () => {
-			disposeAntigravityRoutes();
-			disposeAntigravityAdapter();
-		};
-	}, "dsh-antigravity: adapter, routes, and lifecycle");
 	ctx.effect(() => {
 		const proxyManager = new ProxyManager({
 			getPreferences: () => preferences.status(),
 			logger: ctx.logger
 		});
 		const proxyFetch = proxyManager.createFetch();
+		const antigravityAdapter = new AntigravityAdapter(antigravityStore, antigravityModelSettings, antigravityPreferences, { fetchFn: proxyFetch });
+		const disposeAntigravityAdapter = ctx.llm.registerAdapter([PROVIDER_ID], antigravityAdapter);
+		const disposeAntigravityRoutes = registerAntigravityRoutes(ctx, antigravityStore, antigravityModelSettings, antigravityPreferences, proxyFetch);
 		const oauth = new OAuthService(store, {
 			fetchFn: proxyFetch,
 			logger: ctx.logger
@@ -5312,6 +5540,8 @@ function apply(ctx) {
 			disposeImageTool();
 			disposeAdapter();
 			disposeRoutes();
+			disposeAntigravityRoutes();
+			disposeAntigravityAdapter();
 			oauth.dispose();
 			proxyManager.dispose();
 		};