@eddyskywalker/dsh-chatgpt-subscription 0.64.1 → 0.65.0

package/lib/index.js

@@ -19,12 +19,13 @@ import fs$1, { appendFileSync, constants as constants$1, copyFileSync, existsSyn
 import http, { createServer } from "node:http";
 import { WebError } from "@deepseek-ai/dsh-web";
 import { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
+import net, { isIP } from "node:net";
 import { MAX_TIMER_DELAY_MS, idleWatchdog, timeoutOf } from "@deepseek-ai/dsh-timeout";
 import { boundContextSummary, createUserMessage as createUserMessage$1 } from "@deepseek-ai/dsh-llm/message";
 import * as SettingsModule from "@deepseek-ai/dsh-settings";
 import { URL as URL$1, URLSearchParams as URLSearchParams$1, fileURLToPath } from "node:url";
-import { ProxyAgent, fetch as fetch$1 } from "undici";
+import tls from "node:tls";
+import { Agent, ProxyAgent, fetch as fetch$1 } from "undici";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { gzipSync } from "node:zlib";
 //#region src/shared/i18n-contracts.ts
@@ -808,7 +809,7 @@ const ROUTE_PREFIX$5 = "/api/dsh-chatgpt-subscription";
 * `test/responses-client.test.ts` asserts the two agree, so a release that
 * forgets this constant fails the suite instead of shipping quietly.
 */
-const PLUGIN_VERSION = "0.64.1";
+const PLUGIN_VERSION = "0.65.0";
 const CODEX_CHATGPT_PROVIDER_ID = "codex-chatgpt";
 const CODEX_API_BASE = "https://chatgpt.com/backend-api/codex";
 const CODEX_RESPONSES_URL = `${CODEX_API_BASE}/responses`;
@@ -6521,6 +6522,28 @@ const ENDPOINT_FALLBACKS = ["https://daily-cloudcode-pa.googleapis.com", "https:
 const FREE_TIER_ID = "free-tier";
 const ONBOARD_TIMEOUT_MS = 3e4;
 const ONBOARD_POLL_INTERVAL_MS = 1e3;
+/**
+* The two identity fields the Hub adds on `onboardUser` control-plane calls.
+*
+* Onboarding is not served by the same surface as inference: the Hub appends a
+* Node API client to its User-Agent there and states an X-Goog-Api-Client, while
+* content requests carry neither.
+*/
+const HUB_ONBOARD_UA_SUFFIX = "google-api-nodejs-client/10.3.0";
+const HUB_ONBOARD_API_CLIENT = "gl-node/22.21.1";
+/**
+* Headers the native Antigravity client never sends, but Node's fetch adds itself.
+*
+* `sec-fetch-mode` and `accept-language` are browser idioms: undici's `fetch` adds
+* them to every request and offers no way to suppress them, so the only seam is
+* the dispatcher underneath. The native client is a Go HTTP client and sends
+* neither, which makes them a shape difference an upstream can match on without
+* any TLS inspection.
+*
+* `connection: keep-alive` is deliberately NOT listed: undici's HTTP/1.1 writer
+* re-adds it regardless of what the dispatcher is handed.
+*/
+const ANTIGRAVITY_ABSENT_HEADERS = ["sec-fetch-mode", "accept-language"];
 const REDIRECT_PATH = "/oauth-callback";
 const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 const TOKEN_URL = "https://oauth2.googleapis.com/token";
@@ -6534,8 +6557,16 @@ const SCOPES = [
 ];
 const DEFAULT_CLIENT_ID = Buffer.from("MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==", "base64").toString("utf8");
 const DEFAULT_CLIENT_SECRET = Buffer.from("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=", "base64").toString("utf8");
-const ANTIGRAVITY_SYSTEM_INSTRUCTION = "You are Antigravity, a powerful agentic AI coding assistant designed by Google DeepMind. You are pair programming with a user to solve coding tasks. Be concise, practical, and tool-aware.";
-const ANTIGRAVITY_NO_PREAMBLE_INSTRUCTION = "CRITICAL: NEVER output rule checks, formatting guidelines, constraint checklists, or thinking/personality preambles in the final response. Output only the final response.";
+/**
+* The Antigravity persona, as the native client states it.
+*
+* Only these two opening sentences are attested — they are the part captured
+* `language_server` traffic and the reference reimplementations quote. The
+* capture's tail is a truncated fragment (`**Absolute paths only****
+* Proactiveness**`), so nothing past these sentences is reconstructed here: a
+* guessed continuation would be one more thing only this route sends.
+*/
+const ANTIGRAVITY_SYSTEM_INSTRUCTION = "You are Antigravity, a powerful agentic AI coding assistant designed by the Google Deepmind team working on Advanced Agentic Coding. You are pair programming with a USER to solve their coding task.";
 const GEMINI_ROLE = {
 	user: "user",
 	model: "model"
@@ -7210,15 +7241,137 @@ const DEFAULT_CALLBACK_PORT$2 = 51121;
 * once per sign-in. The ordinary case stops at the first usable port.
 */
 const CALLBACK_PORT_ATTEMPTS$2 = 1024;
+//#endregion
+//#region src/host/antigravity/client-version.ts
+/**
+* The Hub release this process reports to Cloud Code.
+*
+* The service gates its model catalogue and its Gemini quota buckets on the
+* client version in `User-Agent`, so a pinned constant silently ages into a
+* worse client: the same account sees fewer models and fewer quota buckets than
+* the official app on the same day. The Hub publishes the release it currently
+* ships in its updater manifest, which is what this module reads.
+*
+* The read is deliberately non-blocking. `defaultUserAgent()` is synchronous
+* and is called while a request is being built, so the process always has a
+* usable version to report: the built-in one until a manifest has been read,
+* the last known release after that. A manifest that cannot be read is not a
+* failure -- the reference reimplementations treat it the same way, because a
+* release that is one version old still serves requests.
+*
+* @see https://github.com/router-for-me/CLIProxyAPI — `internal/misc/antigravity_version.go`
+*/
+/** The Hub updater manifest for the arm64 macOS build. */
+const HUB_MANIFEST_URL = "https://antigravity-hub-auto-updater-974169037036.us-central1.run.app/manifest/latest-arm64-mac.yml";
+/**
+* The updater is an electron-builder client, and it says so when it reads its
+* own manifest. Sending the Hub User-Agent here would be this plugin's invention.
+*/
+const HUB_MANIFEST_USER_AGENT = "electron-builder";
+/**
+* Build changelists of known Hub releases: the `cl=` field of the User-Agent.
+*
+* A release with no entry here omits `cl=` instead of claiming another build's
+* changelist, which is what the official app does for a build it does not know.
+* `2.24.0` was read out of the official darwin-arm archive's build metadata; keep
+* the newest entry and {@link DEFAULT_ANTIGRAVITY_VERSION} in step.
+*/
+const HUB_RELEASE_CHANGELISTS = {
+	"2.23.0": "998057262",
+	"2.24.0": "1000335682",
+	"2.29.0": "1013060670"
+};
+const MANIFEST_TIMEOUT_MS = 5e3;
+/** How long a read manifest is trusted before another read is attempted. */
+const MANIFEST_TTL_MS = 360 * 60 * 1e3;
+/** Retry cadence while no manifest has ever been read. */
+const MANIFEST_RETRY_MS = 1800 * 1e3;
+let discoveredVersion;
+let lastAttempt = 0;
+let inFlight;
+/**
+* The Hub release to report right now.
+*
+* `DSH_ANTIGRAVITY_VERSION` still wins: pinning a version is how a user works
+* around a Hub release that misbehaves, and discovery must not override it.
+*/
+function currentHubVersion() {
+	return process.env.DSH_ANTIGRAVITY_VERSION?.trim() || discoveredVersion || "2.29.0";
+}
+/**
+* The changelist that belongs to a release, or undefined when it is unknown.
+*
+* `DSH_ANTIGRAVITY_CL` wins for the same reason the version pin does.
+*/
+function hubChangelist(version = currentHubVersion()) {
+	return process.env.DSH_ANTIGRAVITY_CL?.trim() || HUB_RELEASE_CHANGELISTS[version];
+}
+/** The release an electron-builder manifest declares, e.g. `version: 2.24.0`. */
+function parseHubManifestVersion(text) {
+	return /^\s*version:\s*['"]?(\d+\.\d+\.\d+)['"]?\s*$/m.exec(text)?.[1];
+}
+/**
+* Read the Hub release the updater manifest currently publishes.
+*
+* Single-flight and TTL-gated, so calling it on every request costs a `Date.now()`
+* most of the time. Never throws: the caller is a request path, and a manifest
+* that does not answer must not turn into a failed request.
+*/
+function refreshHubVersion(fetchFn = fetch, now = Date.now()) {
+	if (process.env.DSH_ANTIGRAVITY_VERSION?.trim()) return Promise.resolve();
+	if (inFlight) return inFlight;
+	const interval = discoveredVersion === void 0 ? MANIFEST_RETRY_MS : MANIFEST_TTL_MS;
+	if (lastAttempt !== 0 && now - lastAttempt < interval) return Promise.resolve();
+	lastAttempt = now;
+	inFlight = (async () => {
+		try {
+			const response = await fetchFn(HUB_MANIFEST_URL, {
+				headers: { "User-Agent": HUB_MANIFEST_USER_AGENT },
+				signal: AbortSignal.timeout(MANIFEST_TIMEOUT_MS)
+			});
+			if (!response.ok) return;
+			const version = parseHubManifestVersion(await response.text());
+			if (version) discoveredVersion = version;
+		} catch {} finally {
+			inFlight = void 0;
+		}
+	})();
+	return inFlight;
+}
 let cachedQuota;
 let quotaFetchInFlight = null;
 /** Bumped by every cache clear so an in-flight fetch cannot publish stale state. */
 let quotaCacheEpoch$3 = 0;
 const PLATFORM = process.platform === "darwin" ? "MACOS" : process.platform === "win32" ? "WINDOWS" : "LINUX";
 function defaultUserAgent() {
-	const version = process.env.DSH_ANTIGRAVITY_VERSION || "2.23.0";
-	const cl = process.env.DSH_ANTIGRAVITY_CL || "998057262";
-	return `antigravity/hub/${version} (aidev_client; os_type=${process.env.DSH_ANTIGRAVITY_OS || (process.platform === "darwin" ? "darwin" : process.platform === "win32" ? "windows" : "linux")}; arch=${process.env.DSH_ANTIGRAVITY_ARCH || (process.arch === "x64" ? "amd64" : process.arch)}; cl=${cl})`;
+	const version = currentHubVersion();
+	const cl = hubChangelist(version);
+	return `antigravity/hub/${version} (aidev_client; os_type=${process.env.DSH_ANTIGRAVITY_OS || (process.platform === "darwin" ? "darwin" : process.platform === "win32" ? "windows" : "linux")}; arch=${process.env.DSH_ANTIGRAVITY_ARCH || (process.arch === "x64" ? "amd64" : process.arch)}${cl === void 0 ? "" : `; cl=${cl}`})`;
+}
+/**
+* The identity headers a captured Antigravity request does NOT carry.
+*
+* `X-Goog-Api-Client` and `Client-Metadata` are Gemini-CLI idioms: the native
+* `language_server` states its `ideType` in the JSON envelope (the
+* `loadCodeAssist` metadata) and sends a much smaller header set. Sending them
+* on every request therefore marked this route as a reimplementation while
+* buying nothing.
+*
+* Captures disagree about the exact header set, so the pair stays reachable
+* behind `DSH_ANTIGRAVITY_LEGACY_HEADERS` — an account that turns out to need it
+* gets a one-line switch instead of a code change.
+*/
+const LEGACY_IDENTITY_HEADERS = {
+	"X-Goog-Api-Client": "google-cloud-sdk vscode_cloudshelleditor/0.1",
+	"Client-Metadata": JSON.stringify({
+		ideType: "ANTIGRAVITY",
+		platform: PLATFORM,
+		pluginType: "GEMINI"
+	})
+};
+function legacyIdentityHeadersEnabled() {
+	const raw = (process.env.DSH_ANTIGRAVITY_LEGACY_HEADERS || "").trim().toLowerCase();
+	return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
 }
 function antigravityHeaders(token) {
 	return {
@@ -7226,12 +7379,7 @@ function antigravityHeaders(token) {
 		"Content-Type": "application/json",
 		Accept: "text/event-stream",
 		"User-Agent": process.env.DSH_ANTIGRAVITY_USER_AGENT || defaultUserAgent(),
-		"X-Goog-Api-Client": "google-cloud-sdk vscode_cloudshelleditor/0.1",
-		"Client-Metadata": JSON.stringify({
-			ideType: "ANTIGRAVITY",
-			platform: PLATFORM,
-			pluginType: "GEMINI"
-		})
+		...legacyIdentityHeadersEnabled() ? LEGACY_IDENTITY_HEADERS : {}
 	};
 }
 function jsonHeaders(token) {
@@ -7240,6 +7388,21 @@ function jsonHeaders(token) {
 		Accept: "application/json"
 	};
 }
+/**
+* The identity the Hub presents on `onboardUser` control-plane calls.
+*
+* Onboarding is the one surface where the native client is visibly a Node API
+* client: it appends `google-api-nodejs-client/<version>` to its User-Agent and
+* states `X-Goog-Api-Client`. Content requests carry neither, which is why this
+* is a separate builder rather than another field on {@link antigravityHeaders}.
+*/
+function antigravityControlPlaneHeaders(token) {
+	return {
+		...jsonHeaders(token),
+		"User-Agent": `${process.env.DSH_ANTIGRAVITY_USER_AGENT || defaultUserAgent()} ${HUB_ONBOARD_UA_SUFFIX}`,
+		"X-Goog-Api-Client": HUB_ONBOARD_API_CLIENT
+	};
+}
 function endpointCandidates() {
 	const custom = process.env.DSH_ANTIGRAVITY_ENDPOINT?.trim();
 	if (custom) return [custom];
@@ -7265,11 +7428,7 @@ function extractProjectId(data) {
 	}
 }
 async function loadCodeAssistDetail(token, fetchFn = fetch, signal) {
-	const metadata = {
-		ideType: "ANTIGRAVITY",
-		platform: "PLATFORM_UNSPECIFIED",
-		pluginType: "GEMINI"
-	};
+	const metadata = { ideType: "ANTIGRAVITY" };
 	for (const endpoint of endpointCandidates()) try {
 		const response = await fetchFn(`${endpoint}/v1internal:loadCodeAssist`, {
 			method: "POST",
@@ -7292,11 +7451,15 @@ async function loadCodeAssistDetail(token, fetchFn = fetch, signal) {
 		};
 	} catch {}
 }
-async function onboardUser(token, fetchFn = fetch, signal) {
+async function onboardUser(token, fetchFn = fetch, signal, tierId = FREE_TIER_ID) {
 	const deadline = Date.now() + ONBOARD_TIMEOUT_MS;
 	const body = JSON.stringify({
-		tierId: FREE_TIER_ID,
-		metadata: { ideType: "ANTIGRAVITY" }
+		tierId,
+		metadata: {
+			ide_type: "ANTIGRAVITY",
+			ide_version: currentHubVersion(),
+			ide_name: "antigravity"
+		}
 	});
 	let lastError;
 	for (const endpoint of endpointCandidates()) try {
@@ -7305,7 +7468,7 @@ async function onboardUser(token, fetchFn = fetch, signal) {
 		const callSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
 		const response = await fetchFn(`${endpoint}/v1internal:onboardUser`, {
 			method: "POST",
-			headers: jsonHeaders(token),
+			headers: antigravityControlPlaneHeaders(token),
 			body,
 			signal: callSignal
 		});
@@ -7333,7 +7496,7 @@ async function onboardUser(token, fetchFn = fetch, signal) {
 			const pollSignal = signal ? AbortSignal.any([signal, pollTimeoutSignal]) : pollTimeoutSignal;
 			const pollResp = await fetchFn(`${endpoint}/v1internal/${operationName}`, {
 				method: "GET",
-				headers: jsonHeaders(token),
+				headers: antigravityControlPlaneHeaders(token),
 				signal: pollSignal
 			});
 			if (!pollResp.ok) {
@@ -7468,14 +7631,11 @@ async function fetchAccountQuota(store = new FileCredentialStore$3(), modelSetti
 	if (quotaFetchInFlight) return quotaFetchInFlight;
 	const epoch = quotaCacheEpoch$3;
 	const request = (async () => {
+		refreshHubVersion(fetchFn);
 		const { token, projectId: credentialProjectId } = await ensureApiKey(store, fetchFn);
-		const [assistResult, summaryResult] = await Promise.all([postJson("/v1internal:loadCodeAssist", token, { metadata: {
-			ideType: "ANTIGRAVITY",
-			platform: "PLATFORM_UNSPECIFIED",
-			pluginType: "GEMINI"
-		} }, fetchFn).catch(() => null), postJson("/v1internal:retrieveUserQuotaSummary", token, {}, fetchFn).catch(() => null)]);
+		const [assistResult, summaryResult] = await Promise.all([postJson("/v1internal:loadCodeAssist", token, { metadata: { ideType: "ANTIGRAVITY" } }, fetchFn).catch(() => null), postJson("/v1internal:retrieveUserQuotaSummary", token, {}, fetchFn).catch(() => null)]);
 		const discoveredProject = assistResult ? extractProjectId(assistResult.data) : void 0;
-		const projectId = credentialProjectId || discoveredProject || "antigravity-default";
+		const projectId = credentialProjectId || discoveredProject || "rising-fact-p41fc";
 		const modelsData = (await postJson("/v1internal:fetchAvailableModels", token, { project: projectId }, fetchFn).catch(() => null))?.data;
 		const { groups, description } = summaryResult ? parseQuotaSummary(summaryResult.data) : { groups: [] };
 		const catalogModels = modelsData ? parseCatalogModels(modelsData) : [];
@@ -7725,6 +7885,18 @@ function assertFreeTierEligible(payload) {
 	if (ineligibility.validationUrl) err.validationUrl = ineligibility.validationUrl;
 	throw err;
 }
+/**
+* The tier to onboard with, chosen the way the Hub chooses one.
+*
+* The Hub onboards into its own default allowed tier; this route additionally
+* requires the free tier to be on offer (it is the only tier this line claims
+* eligibility for), so that one is preferred next. Everything else is the
+* reference implementation's order: first allowed tier, current tier, free tier.
+*/
+function selectOnboardTier(payload) {
+	const allowed = payload.allowedTiers ?? [];
+	return allowed.find((tier) => tier.isDefault === true && tier.id)?.id ?? allowed.find((tier) => tier.id === "free-tier")?.id ?? allowed[0]?.id ?? payload.currentTier?.id ?? "free-tier";
+}
 async function discoverAntigravityProject(token, fetchFn = fetch, signal, onProgress) {
 	onProgress?.("正在检查 Cloud Code Assist 账号状态...");
 	const initial = await loadCodeAssistDetail(token, fetchFn, signal);
@@ -7732,7 +7904,7 @@ async function discoverAntigravityProject(token, fetchFn = fetch, signal, onProg
 	assertFreeTierEligible(initial);
 	if (initial.allowedTiers?.some((tier) => tier.id === "free-tier") === true && !initial.currentTier) {
 		onProgress?.("正在为新账号开通 Antigravity 免费额度...");
-		await onboardUser(token, fetchFn, signal);
+		await onboardUser(token, fetchFn, signal, selectOnboardTier(initial));
 		onProgress?.("正在获取专属项目 (Project ID)...");
 		const refreshed = await loadCodeAssistDetail(token, fetchFn, signal);
 		if (refreshed?.projectId) return refreshed.projectId;
@@ -8707,12 +8879,7 @@ function buildRequest$2(options, model, projectId, runtimeModel, effort, images
 		contents: convertMessages(options, model, runtimeModel, images),
 		systemInstruction: {
 			role: GEMINI_ROLE.user,
-			parts: [
-				{ text: ANTIGRAVITY_SYSTEM_INSTRUCTION },
-				{ text: `Please ignore following [ignore]${ANTIGRAVITY_SYSTEM_INSTRUCTION}[/ignore]` },
-				{ text: ANTIGRAVITY_NO_PREAMBLE_INSTRUCTION },
-				...options.system ? [{ text: sanitizeText$9(options.system) }] : []
-			]
+			parts: [{ text: ANTIGRAVITY_SYSTEM_INSTRUCTION }, ...options.system ? [{ text: sanitizeText$9(options.system) }] : []]
 		}
 	};
 	const generationConfig = {};
@@ -8757,7 +8924,7 @@ function buildRequest$2(options, model, projectId, runtimeModel, effort, images
 		request,
 		requestType: "agent",
 		userAgent: "antigravity",
-		requestId: `req_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
+		requestId: `agent-${randomUUID()}`
 	};
 }
 function createStreamState$8() {
@@ -10473,7 +10640,7 @@ var AntigravityAdapter = class extends LlmAdapter {
 				} else throw poolErr;
 			}
 			const { account, token, projectId: defaultProj } = eff;
-			const projectId = defaultProj || "antigravity-default";
+			const projectId = defaultProj || "rising-fact-p41fc";
 			triedAccountIds.add(account.id);
 			const body = JSON.stringify(buildRequest$2(requestOptions, model, projectId, runtimeModel, effort, images, {
 				claudeValidatedToolCalling: !this.validatedToolCallingRejected,
@@ -10699,7 +10866,7 @@ function buildImageRequest(prompt, projectId, aspectRatio, imageSize) {
 		},
 		requestType: "image_gen",
 		userAgent: "antigravity",
-		requestId: `img_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
+		requestId: `agent-${randomUUID()}`
 	};
 }
 function record$6(value) {
@@ -10994,7 +11161,7 @@ async function requestImage(accountPool, store, fetchFn, prompt, aspectRatio, im
 	while (true) {
 		const { account, token, projectId } = await acquireAccount(accountPool, store, tried, fetchFn);
 		tried.add(account.id);
-		const body = JSON.stringify(buildImageRequest(prompt, projectId || "antigravity-default", aspectRatio, imageSize));
+		const body = JSON.stringify(buildImageRequest(prompt, projectId || "rising-fact-p41fc", aspectRatio, imageSize));
 		let response;
 		let firstResponse;
 		for (const endpoint of endpointCandidates()) try {
@@ -11217,6 +11384,162 @@ const SYSTEM_PROXY_CACHE_TTL_MS = 5e3;
 * CONNECT phase only; the request itself keeps undici's own timeouts.
 */
 const PROXY_CONNECT_TIMEOUT_MS = 6e4;
+/**
+* The ProxyAgent constructor options for one proxy URL.
+*
+* `allowH2` is stated only when a caller asks to pin HTTP/1.1: ProxyAgent
+* forwards whatever it is given into the per-origin Agent, and `allowH2: false`
+* is what keeps h2 out of the tunnel's ALPN offer. Every other caller gets the
+* option object it had before, byte for byte.
+*/
+function proxyAgentOptions(uri, allowH2) {
+	return {
+		uri,
+		connectTimeout: PROXY_CONNECT_TIMEOUT_MS,
+		...allowH2 === false ? { allowH2: false } : {}
+	};
+}
+/** One pool per (proxy, protocol policy, credential): neither policy nor identity may be shared. */
+function agentCacheKey(proxyUrl, allowH2, poolKey) {
+	return `${poolKey ?? "shared"}:${allowH2 === false ? "h1" : "auto"}:${proxyUrl}`;
+}
+/** The key of the dispatcher that serves one credential's unproxied traffic. */
+function directAgentKey(poolKey, allowH2, omitAlpn) {
+	return `direct:${poolKey}:${allowH2 === true ? "auto" : "h1"}:${omitAlpn === true ? "noalpn" : "alpn"}`;
+}
+/**
+* How many pooled dispatchers may exist at once.
+*
+* A pool is per credential, so the bound has to clear the largest account pool
+* this plugin supports with room for a rotation or two. The oldest pool is
+* closed (not destroyed) when it is exceeded, so an evicted pool still finishes
+* the request it is serving.
+*/
+const DISPATCHER_POOL_CAPACITY = 64;
+/**
+* The pool a request belongs to, derived from its credential.
+*
+* Two accounts must never share one TLS connection: the native client is one
+* credential per process, so a server watching a connection that carries several
+* different `Authorization` values is watching a rotating pool, which no real
+* client does. The token is hashed, so the map never holds a raw credential.
+*
+* A request with no `Authorization` header is not credentialed (project
+* discovery before a token exists, the Hub release manifest) and keeps the
+* shared pool.
+*/
+function credentialPoolKey(init) {
+	const headers = init?.headers;
+	if (headers === void 0) return void 0;
+	const authorization = new Headers(headers).get("authorization");
+	if (!authorization) return void 0;
+	return createHash("sha256").update(authorization).digest("hex").slice(0, 16);
+}
+/** Timeout for establishing an origin connection on the native connector. */
+const NATIVE_CONNECT_TIMEOUT_MS = 3e4;
+/** One connector instance serves every direct agent: it holds no state of its own. */
+const NATIVE_CONNECTOR = buildNativeConnector();
+/**
+* A connector that offers no ALPN at all.
+*
+* The native Antigravity client is a Go HTTP/1.1 client and sends no ALPN
+* extension; undici's built-in connector always advertises `http/1.1`. Offering
+* nothing does not change the protocol that ends up being spoken (the server
+* falls back to HTTP/1.1 either way) but it removes one extension the client this
+* route imitates does not have.
+*
+* SNI is set explicitly: undici hands the connector an empty `servername`, and a
+* hello without SNI is refused by Cloud Code (measured: a bare
+* `SSL_ALERT_HANDSHAKE_FAILURE`).
+*
+* HTTP targets keep a plain TCP connect -- the ALPN question only exists for TLS.
+* `connectTls` / `connectTcp` are the seams that keep the shape testable.
+*/
+function buildNativeConnector(options = {}) {
+	const connectTls = options.connectTls ?? tls.connect;
+	const connectTcp = options.connectTcp ?? net.connect;
+	const timeoutMs = options.timeoutMs ?? NATIVE_CONNECT_TIMEOUT_MS;
+	return (connectorOptions, callback) => {
+		const protocol = String(connectorOptions.protocol ?? "https:");
+		const rawHost = String(connectorOptions.hostname || connectorOptions.host || "");
+		const glued = /^\[?([^\]]+)\]?:(\d+)$/.exec(rawHost);
+		const host = glued === null ? rawHost : glued[1];
+		const port = Number(connectorOptions.port) || Number(glued?.[2] ?? "") || (protocol === "http:" ? 80 : 443);
+		if (protocol === "http:") {
+			const socket = connectTcp({
+				host,
+				port
+			});
+			socket.setTimeout(timeoutMs, () => {
+				socket.destroy();
+				callback(/* @__PURE__ */ new Error("connect timeout"), null);
+			});
+			socket.once("error", (error) => {
+				socket.destroy();
+				callback(error, null);
+			});
+			socket.once("connect", () => {
+				socket.setTimeout(0);
+				callback(null, socket);
+			});
+			return;
+		}
+		const socket = connectTls({
+			host,
+			port,
+			servername: connectorOptions.servername || host
+		});
+		socket.setTimeout(timeoutMs, () => {
+			socket.destroy();
+			callback(/* @__PURE__ */ new Error("connect timeout"), null);
+		});
+		socket.once("error", (error) => {
+			socket.destroy();
+			callback(error, null);
+		});
+		socket.once("secureConnect", () => {
+			socket.setTimeout(0);
+			callback(null, socket);
+		});
+	};
+}
+/**
+* Drop headers before the request is written.
+*
+* `fetch` adds `sec-fetch-mode: cors` and `accept-language: *` to every request
+* and offers no way to suppress a header it adds itself. The dispatcher is the
+* seam it hands the header list to, so a consumer that imitates a non-browser
+* client can remove them there. The wrapped dispatcher keeps the inner agent's
+* pool: this is a filter, not a new connection pool.
+*/
+function stripDispatchHeaders(dispatcher, headers) {
+	const banned = new Set(headers.map((name) => name.toLowerCase()));
+	const strip = (input) => {
+		if (Array.isArray(input)) return input.filter((entry) => !banned.has(String(entry[0]).toLowerCase()));
+		if (input !== null && typeof input === "object") {
+			const kept = {};
+			for (const [name, value] of Object.entries(input)) if (!banned.has(name.toLowerCase())) kept[name] = value;
+			return kept;
+		}
+		return input;
+	};
+	const inner = dispatcher;
+	const shaped = {
+		dispatch(options, handler) {
+			return inner.dispatch({
+				...options,
+				headers: strip(options.headers)
+			}, handler);
+		},
+		close: (...args) => inner.close(...args),
+		destroy: (...args) => inner.destroy(...args)
+	};
+	Object.defineProperty(shaped, "wrapped", {
+		value: dispatcher,
+		enumerable: false
+	});
+	return shaped;
+}
 function normalizeProxyUrl(rawUrl) {
 	const trimmed = rawUrl.trim();
 	if (!trimmed) return "";
@@ -11491,6 +11814,8 @@ var ProxyManager = class {
 	detected = false;
 	proxyListeners = /* @__PURE__ */ new Set();
 	agents = /* @__PURE__ */ new Map();
+	/** One shaping wrapper per pooled dispatcher, so a pool keeps a stable identity. */
+	shaped = /* @__PURE__ */ new WeakMap();
 	constructor(options) {
 		this.getPreferences = options.getPreferences;
 		this.baseFetch = options.baseFetch ?? fetch;
@@ -11558,31 +11883,87 @@ var ProxyManager = class {
 		if (mode === "custom") return prefs.customProxyUrl ? normalizeProxyUrl(prefs.customProxyUrl) : null;
 		return this.getSystemProxy();
 	}
-	getOrCreateAgent(proxyUrl) {
-		let agent = this.agents.get(proxyUrl);
-		if (!agent) {
-			agent = new ProxyAgent({
-				uri: proxyUrl,
-				connectTimeout: PROXY_CONNECT_TIMEOUT_MS
-			});
-			this.agents.set(proxyUrl, agent);
-		}
+	getOrCreateAgent(proxyUrl, allowH2, poolKey) {
+		const key = agentCacheKey(proxyUrl, allowH2, poolKey);
+		const existing = this.agents.get(key);
+		if (existing instanceof ProxyAgent) return existing;
+		const agent = new ProxyAgent(proxyAgentOptions(proxyUrl, allowH2));
+		this.remember(key, agent);
 		return agent;
 	}
-	createFetch() {
+	/**
+	* The dispatcher for one credential's direct (unproxied) traffic.
+	*
+	* Node's global fetch pools every origin in one process-wide agent, so a
+	* credentialed request cannot be given a private connection through it. The
+	* pooled path therefore dispatches through undici's own fetch with an agent of
+	* its own; HTTP/1.1 stays the default, because that is what the global fetch
+	* this replaces would have spoken.
+	*/
+	getOrCreateDirectAgent(poolKey, overrides) {
+		const key = directAgentKey(poolKey, overrides?.allowH2, overrides?.omitAlpn);
+		const existing = this.agents.get(key);
+		if (existing instanceof Agent) return existing;
+		const agent = new Agent({
+			allowH2: overrides?.allowH2 === true,
+			...overrides?.omitAlpn === true ? { connect: NATIVE_CONNECTOR } : {}
+		});
+		this.remember(key, agent);
+		return agent;
+	}
+	/** Store a dispatcher, retiring the oldest pool once the bound is reached. */
+	remember(key, agent) {
+		if (this.agents.size >= DISPATCHER_POOL_CAPACITY) {
+			const oldest = this.agents.keys().next();
+			if (!oldest.done) {
+				const evicted = this.agents.get(oldest.value);
+				this.agents.delete(oldest.value);
+				evicted?.close().catch(() => void 0);
+			}
+		}
+		this.agents.set(key, agent);
+	}
+	/** Hand one request to a specific dispatcher through undici's fetch. */
+	dispatchWith(input, init, dispatcher) {
+		return this.proxyFetchFn(input, {
+			...init,
+			dispatcher
+		});
+	}
+	/**
+	* A fetch that follows this manager's proxy policy, with optional protocol and
+	* credential pins for one consumer.
+	*
+	* `allowH2: false` keeps TLS at HTTP/1.1. Antigravity asks for it: the native
+	* `language_server` speaks HTTP/1.1, and the direct path this manager falls
+	* back to is Node's global fetch, which offers http/1.1 only - without the pin
+	* the same route would speak h2 behind a proxy and HTTP/1.1 without one.
+	*
+	* `credentialPools: true` gives every distinct credential its own connection
+	* pool on both paths, which is what keeps a multi-account rotation from being
+	* visible as one connection carrying several identities.
+	*/
+	createFetch(overrides) {
+		const shape = (dispatcher) => {
+			const headers = overrides?.stripHeaders;
+			if (headers === void 0 || headers.length === 0) return dispatcher;
+			const cached = this.shaped.get(dispatcher);
+			if (cached !== void 0) return cached;
+			const shaped = stripDispatchHeaders(dispatcher, headers);
+			this.shaped.set(dispatcher, shaped);
+			return shaped;
+		};
 		return async (input, init) => {
+			const poolKey = overrides?.credentialPools === true ? credentialPoolKey(init) : void 0;
 			const activeProxy = this.resolveActiveProxyUrl();
-			if (!activeProxy) return this.baseFetch(input, init);
-			if (shouldBypassProxy(requestTarget(input), this.getNoProxyList())) return this.baseFetch(input, init);
+			if (!activeProxy) return poolKey === void 0 ? this.baseFetch(input, init) : this.dispatchWith(input, init, shape(this.getOrCreateDirectAgent(poolKey, overrides)));
+			if (shouldBypassProxy(requestTarget(input), this.getNoProxyList())) return poolKey === void 0 ? this.baseFetch(input, init) : this.dispatchWith(input, init, shape(this.getOrCreateDirectAgent(poolKey, overrides)));
 			for (let attempt = 0;; attempt += 1) try {
-				const agent = this.getOrCreateAgent(activeProxy);
-				return await this.proxyFetchFn(input, {
-					...init,
-					dispatcher: agent
-				});
+				const agent = shape(this.getOrCreateAgent(activeProxy, overrides?.allowH2, poolKey));
+				return await this.dispatchWith(input, init, agent);
 			} catch (error) {
 				if (attempt === 0 && isDestroyedClientError(error)) {
-					this.agents.delete(activeProxy);
+					this.agents.delete(agentCacheKey(activeProxy, overrides?.allowH2, poolKey));
 					continue;
 				}
 				throw error;
@@ -104902,8 +105283,16 @@ function apply(ctx, pluginConfig = {}) {
 			logger: ctx.logger
 		});
 		const proxyFetch = proxyManager.createFetch();
+		const antigravityProxyFetch = proxyManager.createFetch({
+			allowH2: false,
+			credentialPools: true,
+			stripHeaders: ANTIGRAVITY_ABSENT_HEADERS,
+			omitAlpn: true
+		});
+		refreshHubVersion(antigravityProxyFetch);
 		const providerLimits = readModelRequestLimits();
-		const modelFetch = Object.fromEntries(CONTROLLED_PROVIDERS.map((provider) => [provider, createControlledModelFetch(createDiagnosticFetch(proxyFetch, {
+		const baseFetchFor = (provider) => provider === "antigravity" ? antigravityProxyFetch : proxyFetch;
+		const modelFetch = Object.fromEntries(CONTROLLED_PROVIDERS.map((provider) => [provider, createControlledModelFetch(createDiagnosticFetch(baseFetchFor(provider), {
 			provider,
 			onRecord: (record) => ctx.logger.info("[provider-diagnostics] " + JSON.stringify(record))
 		}), {
@@ -104918,7 +105307,7 @@ function apply(ctx, pluginConfig = {}) {
 				attachments: ctx.attachments
 			}, antigravityAccountPool)
 		});
-		const disposeAntigravityRoutes = registerAntigravityRoutes(ctx, antigravityStore, antigravityModelSettings, antigravityPreferences, proxyFetch, antigravityAccountPool);
+		const disposeAntigravityRoutes = registerAntigravityRoutes(ctx, antigravityStore, antigravityModelSettings, antigravityPreferences, antigravityProxyFetch, antigravityAccountPool);
 		const disposeCommandCodeRoutes = registerCommandCodeRoutes(ctx, commandCodeStore, commandCodeModelSettings, commandCodePreferences, {
 			fetchFn: proxyFetch,
 			serving: () => commandCodeClaim.serving(),
@@ -105419,7 +105808,7 @@ function apply(ctx, pluginConfig = {}) {
 		const disposeAdapter = ctx.llm.registerAdapter([PROVIDER_ID$13], adapter);
 		const disposeImageTool = ctx.tools.register(createCodexImageTool(oauth, ctx.attachments, { fetchFn: proxyFetch }));
 		const disposeAntigravityImageTool = ctx.tools.register(createAntigravityImageTool(antigravityAccountPool, antigravityStore, ctx.attachments, {
-			fetchFn: proxyFetch,
+			fetchFn: antigravityProxyFetch,
 			isEnabled: () => antigravityPreferences.status().enabled !== false
 		}));
 		const disposeVideoTool = ctx.tools.register(createKimiVideoTool(ctx, { fetchFn: proxyFetch }));