@gajae-code/coding-agent 0.15.5 → 0.16.0

package/src/web/search/providers/base.ts

@@ -20,7 +20,10 @@ export const SEARXNG_BEARER_CREDENTIAL_PREFIX = "gjc-searxng-bearer:";
 /**
  * Shared web search parameters passed to providers.
  *
- * `authStorage` is the **only** credential source providers may consult.
+ * `authStorage` is the credential source for canonical providers. Native
+ * active-model search may instead use `activeModelContext.resolveCredentials`,
+ * which is supplied by ModelRegistry so rotating config credentials and
+ * generated headers are refreshed before the request.
  * Opening a sibling SQLite handle or calling provider-direct refresh helpers
  * (e.g. `refreshOpenAIOpenAI code backendToken`, `refreshGoogleCloudToken`) is prohibited:
  * it races the broker's per-credential refresh and POSTs the broker sentinel
@@ -75,8 +78,8 @@ export interface SearchParams {
 	codeExecution?: Record<string, unknown>;
 	urlContext?: Record<string, unknown>;
 	/**
-	 * The single source of truth for credentials. Providers MUST consult this
-	 * handle exclusively (`getApiKey` for bearer-style auth, `getOAuthAccess`
+	 * The canonical source of truth for credentials. Providers MUST consult this
+	 * handle (`getApiKey` for bearer-style auth, `getOAuthAccess`
 	 * when identity metadata is required). Do not open `AgentStorage` or any
 	 * `AuthCredentialStore` directly — that bypasses the broker pipeline and
 	 * the per-credential single-flight refresh.
@@ -108,7 +111,9 @@ export abstract class SearchProvider {
 	abstract isAvailable(authStorage: AuthStorage, settings?: SearchProviderSettings): Promise<boolean> | boolean;
 
 	/**
-	 * Execute a search. Credentials MUST be resolved through `params.authStorage`.
+	 * Execute a search. Canonical credentials MUST be resolved through
+	 * `params.authStorage`; active-model credentials MUST use the injected
+	 * resolver when one is present.
 	 */
 	abstract search(params: SearchParams): Promise<SearchResponse>;
 }

package/src/web/search/providers/gemini.ts

@@ -16,7 +16,13 @@ import {
 } from "@gajae-code/ai/providers/google-gemini-headers";
 import { fetchWithRetry } from "@gajae-code/utils";
 
-import type { SearchCitation, SearchResponse, SearchSource } from "../../../web/search/types";
+import type {
+	ActiveSearchModelContext,
+	ActiveSearchModelCredentials,
+	SearchCitation,
+	SearchResponse,
+	SearchSource,
+} from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -38,6 +44,49 @@ const RATE_LIMIT_BUDGET_MS = 30 * 1000;
 const GEMINI_PROVIDERS = ["google-gemini-cli", "google-antigravity"] as const;
 type GeminiProviderId = (typeof GEMINI_PROVIDERS)[number];
 
+function isGenerativeLanguageWire(api: string): boolean {
+	return api === "google-generative-ai" || api === "google-generative-language" || api === "gemini-wire";
+}
+
+function isGoogleWire(api: string): boolean {
+	return isGenerativeLanguageWire(api) || api === "google-gemini-cli" || api === "google-vertex";
+}
+
+const OFFICIAL_GEMINI_HOSTS = new Set([
+	"cloudcode-pa.googleapis.com",
+	"daily-cloudcode-pa.googleapis.com",
+	"daily-cloudcode-pa.sandbox.googleapis.com",
+	"generativelanguage.googleapis.com",
+]);
+const CANONICAL_GEMINI_PROVIDERS = new Set(["google", "gemini", "google-gemini-cli", "google-antigravity"]);
+
+function isOfficialGeminiBaseUrl(baseUrl: string | undefined): boolean {
+	if (!baseUrl?.trim()) return true;
+	try {
+		const host = new URL(baseUrl).hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "").replace(/\.$/, "");
+		return OFFICIAL_GEMINI_HOSTS.has(host);
+	} catch {
+		return false;
+	}
+}
+
+function isCustomGeminiContext(ctx: ActiveSearchModelContext | undefined): boolean {
+	if (!ctx || !isGoogleWire(ctx.api)) return false;
+	if (ctx.ownerAuthOverride) return true;
+	if (!isOfficialGeminiBaseUrl(ctx.baseUrl)) return true;
+	const provider = ctx.provider.toLowerCase();
+	return Boolean(ctx.resolveCredentials && !CANONICAL_GEMINI_PROVIDERS.has(provider));
+}
+
+function isCustomGenerativeLanguageContext(ctx: ActiveSearchModelContext | undefined): boolean {
+	return isGenerativeLanguageWire(ctx?.api ?? "") && isCustomGeminiContext(ctx);
+}
+
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+	const normalized = name.toLowerCase();
+	return Object.keys(headers).some(key => key.toLowerCase() === normalized);
+}
+
 interface GeminiToolParams {
 	google_search?: Record<string, unknown>;
 	code_execution?: Record<string, unknown>;
@@ -433,19 +482,28 @@ export async function searchGemini(params: GeminiSearchParams): Promise<SearchRe
  * Native Gemini web search over the public Generative Language REST API
  * (`{baseUrl}/v1beta/models/{model}:generateContent`), reusing the ACTIVE
  * model's own API key + baseUrl. This is the "native search over a proxy" path
- * for `google-generative-ai` wire models whose canonical gemini-cli/antigravity
- * OAuth is absent. Distinct from {@link searchGemini}, which speaks the Cloud
- * Code Assist API with OAuth.
+ * for Generative Language wire models. Distinct from {@link searchGemini},
+ * which speaks the Cloud Code Assist API with OAuth.
  */
 async function searchGeminiViaGenerativeLanguage(params: SearchParams): Promise<SearchResponse> {
 	const ctx = params.activeModelContext;
 	if (!ctx) throw new SearchProviderError("gemini", "Gemini web search requires active model context", 400);
-	const apiKey = await params.authStorage.getApiKey(ctx.provider, params.sessionId, {
-		baseUrl: ctx.baseUrl,
-		modelId: ctx.modelId,
-		signal: params.signal,
-	});
-	if (!apiKey) throw new SearchProviderError("gemini", `No credentials for ${ctx.provider}`, 401);
+	const activeCredentials: ActiveSearchModelCredentials = ctx.resolveCredentials
+		? await ctx.resolveCredentials({ sessionId: params.sessionId, signal: params.signal })
+		: {
+				apiKey: await params.authStorage.getApiKey(ctx.provider, params.sessionId, {
+					baseUrl: ctx.baseUrl,
+					modelId: ctx.modelId,
+					signal: params.signal,
+				}),
+				headers: ctx.headers,
+			};
+	const apiKey = activeCredentials.apiKey;
+	const headers = { ...(activeCredentials.headers ?? ctx.headers ?? {}) };
+	if (apiKey && !hasHeader(headers, "x-goog-api-key")) headers["x-goog-api-key"] = apiKey;
+	if (!apiKey && !hasHeader(headers, "x-goog-api-key")) {
+		throw new SearchProviderError("gemini", `No credentials for ${ctx.provider}`, 401);
+	}
 
 	const model = ctx.wireModelId ?? ctx.modelId;
 	const base = (ctx.baseUrl ?? "https://generativelanguage.googleapis.com").replace(/\/+$/, "");
@@ -468,7 +526,10 @@ async function searchGeminiViaGenerativeLanguage(params: SearchParams): Promise<
 
 	const response = await fetch(url, {
 		method: "POST",
-		headers: { ...(ctx.headers ?? {}), "x-goog-api-key": apiKey, "Content-Type": "application/json" },
+		headers: {
+			...headers,
+			...(hasHeader(headers, "content-type") ? {} : { "Content-Type": "application/json" }),
+		},
 		body: JSON.stringify(body),
 		signal: withHardTimeout(params.signal, "llm"),
 	});
@@ -534,11 +595,22 @@ export class GeminiProvider extends SearchProvider {
 	}
 
 	search(params: SearchParams): Promise<SearchResponse> {
-		// Native-over-proxy: when canonical gemini-cli/antigravity OAuth is
-		// absent but the active model speaks the Generative Language wire, reuse
-		// its own API key + baseUrl instead of failing closed.
 		const ctx = params.activeModelContext;
-		if (!hasGeminiOAuth(params.authStorage) && ctx?.api === "google-generative-ai") {
+		// Native-over-proxy: a custom model's owner-bound resolver must win over
+		// canonical Gemini OAuth. Otherwise the request would silently leave the
+		// proxy and hit Cloud Code with another registry's identity.
+		if (isCustomGeminiContext(ctx)) {
+			if (isCustomGenerativeLanguageContext(ctx)) return searchGeminiViaGenerativeLanguage(params);
+			return Promise.reject(
+				new SearchProviderError(
+					"gemini",
+					`Gemini native search does not support custom ${ctx?.api ?? ""} transports`,
+					400,
+				),
+			);
+		}
+		// Preserve the existing active-key fallback when canonical OAuth is absent.
+		if (!hasGeminiOAuth(params.authStorage) && ctx && isGenerativeLanguageWire(ctx.api)) {
 			return searchGeminiViaGenerativeLanguage(params);
 		}
 		return searchGemini({

package/src/web/search/providers/openai-compatible.ts

@@ -1,4 +1,4 @@
-import type { SearchCitation, SearchResponse, SearchSource } from "../types";
+import type { ActiveSearchModelCredentials, SearchCitation, SearchResponse, SearchSource } from "../types";
 import { SearchProviderError } from "../types";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -7,6 +7,11 @@ import { classifyProviderHttpError, withHardTimeout } from "./utils";
 
 type JsonObject = Record<string, unknown>;
 
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+	const normalized = name.toLowerCase();
+	return Object.keys(headers).some(key => key.toLowerCase() === normalized);
+}
+
 function isJsonObject(value: unknown): value is JsonObject {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -154,15 +159,25 @@ export class OpenAICompatibleSearchProvider extends SearchProvider {
 		if (ctx.api !== "openai-responses" && ctx.api !== "openai-completions") {
 			throw new SearchProviderError(this.id, `OpenAI-compatible web search does not support ${ctx.api}`, 400);
 		}
-		const apiKey = await params.authStorage.getApiKey(ctx.provider, params.sessionId, {
-			baseUrl: ctx.baseUrl,
-			modelId: ctx.modelId,
-			signal: params.signal,
-		});
-		if (!apiKey) throw new SearchProviderError(this.id, `No credentials for ${ctx.provider}`, 401);
+		const activeCredentials: ActiveSearchModelCredentials = ctx.resolveCredentials
+			? await ctx.resolveCredentials({ sessionId: params.sessionId, signal: params.signal })
+			: {
+					apiKey: await params.authStorage.getApiKey(ctx.provider, params.sessionId, {
+						baseUrl: ctx.baseUrl,
+						modelId: ctx.modelId,
+						signal: params.signal,
+					}),
+					headers: ctx.headers,
+				};
+		const apiKey = activeCredentials.apiKey;
+		const headers = { ...(activeCredentials.headers ?? ctx.headers ?? {}) };
+		if (apiKey && !hasHeader(headers, "authorization")) headers.Authorization = `Bearer ${apiKey}`;
+		if (!hasHeader(headers, "authorization")) {
+			throw new SearchProviderError(this.id, `No credentials for ${ctx.provider}`, 401);
+		}
+		if (!hasHeader(headers, "content-type")) headers["Content-Type"] = "application/json";
 		const model = ctx.wireModelId ?? ctx.modelId;
 		const baseUrl = ctx.baseUrl ?? "";
-		const headers = { ...(ctx.headers ?? {}), Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" };
 		const messages = [
 			{ role: "system", content: params.systemPrompt },
 			{ role: "user", content: params.query },

package/src/web/search/providers/xai.ts

@@ -6,7 +6,14 @@
  */
 import type { AuthStorage } from "@gajae-code/ai/core";
 import { $credentialEnv, $env } from "@gajae-code/utils";
-import type { SearchCitation, SearchResponse, SearchSource, SearchUsage } from "../../../web/search/types";
+import type {
+	ActiveSearchModelContext,
+	ActiveSearchModelCredentials,
+	SearchCitation,
+	SearchResponse,
+	SearchSource,
+	SearchUsage,
+} from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -49,11 +56,13 @@ export interface XaiSearchParams {
 	signal?: AbortSignal;
 	authStorage: AuthStorage;
 	sessionId?: string;
+	activeModelContext?: ActiveSearchModelContext;
 }
 
 interface XaiAuth {
 	bearer: string;
 	mode: "api_key" | "oauth";
+	headers?: Record<string, string>;
 }
 
 interface PreparedXaiTools {
@@ -67,7 +76,53 @@ function asTrimmed(value: string | undefined): string | undefined {
 	return trimmed.length > 0 ? trimmed : undefined;
 }
 
-function getModel(): string {
+function isOpenAICompatWire(api: string): boolean {
+	return api === "openai-responses" || api === "openai-completions";
+}
+
+function looksXaiModelId(modelId: string | undefined): boolean {
+	if (!modelId) return false;
+	const id = modelId.toLowerCase();
+	return id.startsWith("grok-") || id.startsWith("x-ai/grok-") || id.startsWith("xai/grok-");
+}
+
+function isOfficialXaiBaseUrl(baseUrl: string | undefined): boolean {
+	if (!baseUrl?.trim()) return true;
+	try {
+		return new URL(baseUrl).hostname.toLowerCase().replace(/\.$/, "") === "api.x.ai";
+	} catch {
+		return false;
+	}
+}
+
+function isCustomXaiContext(ctx: ActiveSearchModelContext | undefined): ctx is ActiveSearchModelContext {
+	if (!ctx || !isOpenAICompatWire(ctx.api)) return false;
+	if (ctx.ownerAuthOverride) return true;
+	const provider = ctx.provider.toLowerCase();
+	if (provider === "xai" && !isOfficialXaiBaseUrl(ctx.baseUrl)) return true;
+	if (!looksXaiModelId(ctx.wireModelId) && !looksXaiModelId(ctx.modelId)) return false;
+	if (!isOfficialXaiBaseUrl(ctx.baseUrl)) return true;
+	return provider !== "xai";
+}
+
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+	const normalized = name.toLowerCase();
+	return Object.keys(headers).some(key => key.toLowerCase() === normalized);
+}
+
+function explicitCredentialHeader(headers: Record<string, string> | undefined): string | undefined {
+	for (const [key, value] of Object.entries(headers ?? {})) {
+		const normalized = key.toLowerCase();
+		if (normalized === "authorization" || normalized === "x-api-key") return value;
+	}
+	return undefined;
+}
+
+function getModel(activeModelContext?: ActiveSearchModelContext): string {
+	const ctx = activeModelContext;
+	if (isCustomXaiContext(ctx)) {
+		return ctx.wireModelId ?? ctx.modelId;
+	}
 	return asTrimmed($env.PI_XAI_WEB_SEARCH_MODEL) ?? asTrimmed($env.XAI_WEB_SEARCH_MODEL) ?? DEFAULT_MODEL;
 }
 
@@ -76,12 +131,14 @@ export function resolveXaiSearchBaseUrlForTest(): string {
 	return getBaseUrl();
 }
 
-function getBaseUrl(): string {
+function getBaseUrl(activeModelContext?: ActiveSearchModelContext): string {
+	const ctx = activeModelContext;
+	if (isCustomXaiContext(ctx) && ctx.baseUrl) return ctx.baseUrl;
 	return asTrimmed($credentialEnv("XAI_SEARCH_BASE_URL")) ?? DEFAULT_BASE_URL;
 }
 
-function responsesEndpoint(): string {
-	return `${getBaseUrl().replace(/\/+$/, "")}/responses`;
+function responsesEndpoint(activeModelContext?: ActiveSearchModelContext): string {
+	return `${getBaseUrl(activeModelContext).replace(/\/+$/, "")}/responses`;
 }
 
 async function resolveXaiAuth(
@@ -89,7 +146,26 @@ async function resolveXaiAuth(
 	sessionId: string | undefined,
 	model: string,
 	signal: AbortSignal | undefined,
+	activeModelContext?: ActiveSearchModelContext,
 ): Promise<XaiAuth | null> {
+	const ctx = activeModelContext;
+	if (isCustomXaiContext(ctx)) {
+		const activeCredentials: ActiveSearchModelCredentials = ctx.resolveCredentials
+			? await ctx.resolveCredentials({ sessionId, signal })
+			: {
+					apiKey: await authStorage.getApiKey(ctx.provider, sessionId, {
+						baseUrl: ctx.baseUrl,
+						modelId: ctx.modelId,
+						signal,
+					}),
+					headers: ctx.headers,
+				};
+		const headers = { ...(activeCredentials.headers ?? ctx.headers ?? {}) };
+		const bearer = activeCredentials.apiKey ?? explicitCredentialHeader(headers);
+		if (!bearer) return null;
+		return { bearer, mode: "api_key", headers };
+	}
+
 	const credentialSessionId = sessionId ?? `xai-search:${crypto.randomUUID()}`;
 	const bearer = await authStorage.getApiKey("xai", credentialSessionId, {
 		baseUrl: getBaseUrl(),
@@ -409,8 +485,14 @@ function parseUsage(json: any): SearchUsage | undefined {
 
 /** Execute xAI web/X search through the Responses API search tools. */
 export async function searchXai(params: XaiSearchParams): Promise<SearchResponse> {
-	const model = getModel();
-	const auth = await resolveXaiAuth(params.authStorage, params.sessionId, model, params.signal);
+	const model = getModel(params.activeModelContext);
+	const auth = await resolveXaiAuth(
+		params.authStorage,
+		params.sessionId,
+		model,
+		params.signal,
+		params.activeModelContext,
+	);
 	if (!auth) {
 		throw new SearchProviderError(
 			"xai",
@@ -419,12 +501,15 @@ export async function searchXai(params: XaiSearchParams): Promise<SearchResponse
 		);
 	}
 
-	const response = await fetch(responsesEndpoint(), {
+	const headers = { ...(auth.headers ?? {}) };
+	if (!hasHeader(headers, "authorization") && !hasHeader(headers, "x-api-key")) {
+		headers.Authorization = `Bearer ${auth.bearer}`;
+	}
+	if (!hasHeader(headers, "content-type")) headers["Content-Type"] = "application/json";
+
+	const response = await fetch(responsesEndpoint(params.activeModelContext), {
 		method: "POST",
-		headers: {
-			Authorization: `Bearer ${auth.bearer}`,
-			"Content-Type": "application/json",
-		},
+		headers,
 		body: JSON.stringify(
 			buildXaiRequestBody({
 				query: params.query,
@@ -511,6 +596,7 @@ export class XaiProvider extends SearchProvider {
 			signal: params.signal,
 			authStorage: params.authStorage,
 			sessionId: params.sessionId,
+			activeModelContext: params.activeModelContext,
 		});
 	}
 }

package/src/web/search/types.ts

@@ -27,6 +27,18 @@ export type SearchProviderId =
 
 export type WebSearchMode = "on" | "off" | "auto";
 
+/** Credentials and request headers resolved for the active model. */
+export interface ActiveSearchModelCredentials {
+	apiKey?: string;
+	headers?: Record<string, string>;
+}
+
+/** Refresh-aware resolver supplied by the model registry for native search. */
+export type ActiveSearchModelCredentialResolver = (options: {
+	sessionId?: string;
+	signal?: AbortSignal;
+}) => Promise<ActiveSearchModelCredentials>;
+
 export interface ActiveSearchModelContext {
 	provider: string;
 	modelId: string;
@@ -34,6 +46,10 @@ export interface ActiveSearchModelContext {
 	api: string;
 	baseUrl?: string;
 	headers?: Record<string, string>;
+	/** Resolve the active model key and current headers before each native search. */
+	resolveCredentials?: ActiveSearchModelCredentialResolver;
+	/** True when registry-owned auth or transport overrides this active model. */
+	ownerAuthOverride?: boolean;
 	webSearch?: WebSearchMode;
 }