@herbertgao/pi-extensions 2026.8.11 → 2026.8.13

package/node_modules/pi-web-access/gemini-api.ts

@@ -1,6 +1,14 @@
 import { existsSync, readFileSync } from "node:fs";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.ts";
 import { getWebSearchConfigPath } from "./utils.ts";
+import {
+	isGeminiAdcAvailable,
+	getAdcAccessToken,
+	getAdcProject,
+	getAdcLocation,
+	getVertexApiBase,
+	isVertexHost,
+} from "./gemini-adc.ts";
 
 const DEFAULT_API_HOST = "https://generativelanguage.googleapis.com";
 const API_VERSION = "v1beta";
@@ -72,6 +80,11 @@ export function getApiHost(): string {
 }
 
 export function getVersionedApiBase(): string {
+	const project = getAdcProject();
+	const location = getAdcLocation();
+	if (isGeminiAdcAvailable() && project && location) {
+		return getVertexApiBase(project, location);
+	}
 	return `${getApiHost()}/${API_VERSION}`;
 }
 
@@ -109,18 +122,21 @@ export function buildAuthHeaders(apiKey: string | null = null, cloudflareApiKey:
 	return cloudflareApiKey ? { "cf-aig-authorization": `Bearer ${cloudflareApiKey}` } : {};
 }
 
-function redactGeminiCredentials(text: string, apiKey: string | null | undefined, cloudflareApiKey: string | null | undefined): string {
-	return redactCredential(redactCredential(text, apiKey), cloudflareApiKey);
+function redactGeminiCredentials(text: string, apiKey: string | null | undefined, cloudflareApiKey: string | null | undefined, adcToken?: string | null): string {
+	let out = redactCredential(redactCredential(text, apiKey), cloudflareApiKey);
+	if (adcToken) out = redactCredential(out, adcToken);
+	return out;
 }
 
 const responseCredentials = new WeakMap<Response, {
 	apiKey: string | null | undefined;
 	cloudflareApiKey: string | null | undefined;
+	adcToken?: string | null;
 }>();
 
-export function redactGeminiApiResponse(response: Response, text: string, apiKey?: string | null): string {
+export function redactGeminiApiResponse(response: Response, text: string, apiKey?: string | null, adcToken?: string | null): string {
 	const credentials = responseCredentials.get(response);
-	return redactGeminiCredentials(text, credentials?.apiKey ?? apiKey, credentials?.cloudflareApiKey);
+	return redactGeminiCredentials(text, credentials?.apiKey ?? apiKey, credentials?.cloudflareApiKey, credentials?.adcToken ?? adcToken);
 }
 
 export async function fetchGeminiApi(
@@ -134,28 +150,42 @@ export async function fetchGeminiApi(
 			throw new Error("Gemini API credential query parameters are not allowed");
 		}
 	}
-	const resolvedApiKey = apiKey === undefined ? await getApiKey(init.signal ?? undefined) : apiKey;
+	const project = getAdcProject();
+	const location = getAdcLocation();
+	const adcMode = isGeminiAdcAvailable() && !!project && !!location && isVertexHost(parsedUrl.origin);
+	let adcToken: string | null = null;
+	if (adcMode) {
+		adcToken = await getAdcAccessToken(init.signal ?? undefined);
+	}
+	const resolvedApiKey = adcMode ? null : (apiKey === undefined ? await getApiKey(init.signal ?? undefined) : apiKey);
 	const cloudflareApiKey = isCloudflareGateway() ? await resolveCloudflareApiKey(init.signal ?? undefined) : null;
 	const allowedOrigins = new Set([
 		new URL(getApiHost()).origin,
 		new URL(DEFAULT_API_HOST).origin,
+		...(adcMode ? [parsedUrl.origin] : []),
 	]);
-	if ((resolvedApiKey || isGatewayConfigured()) && !allowedOrigins.has(parsedUrl.origin)) {
+	const needsAuth = resolvedApiKey || isGatewayConfigured() || adcMode;
+	if (needsAuth && !allowedOrigins.has(parsedUrl.origin)) {
 		throw new Error("Gemini API request host is not allowed");
 	}
 	const headers = new Headers(init.headers);
 	headers.delete("x-goog-api-key");
 	headers.delete("cf-aig-authorization");
-	for (const [name, value] of Object.entries(buildAuthHeaders(resolvedApiKey, cloudflareApiKey))) {
-		headers.set(name, value);
+	headers.delete("authorization");
+	if (adcMode && adcToken) {
+		headers.set("Authorization", `Bearer ${adcToken}`);
+	} else {
+		for (const [name, value] of Object.entries(buildAuthHeaders(resolvedApiKey, cloudflareApiKey))) {
+			headers.set(name, value);
+		}
 	}
 	try {
 		const response = await fetch(parsedUrl, { ...init, headers });
-		responseCredentials.set(response, { apiKey: resolvedApiKey, cloudflareApiKey });
+		responseCredentials.set(response, { apiKey: resolvedApiKey, cloudflareApiKey, adcToken });
 		return response;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
-		const redactedMessage = redactGeminiCredentials(message, resolvedApiKey, cloudflareApiKey);
+		const redactedMessage = redactGeminiCredentials(message, resolvedApiKey, cloudflareApiKey, adcToken);
 		if (redactedMessage === message) throw error;
 		const redactedError = new Error(redactedMessage);
 		if (error instanceof Error) redactedError.name = error.name;
@@ -163,12 +193,25 @@ export async function fetchGeminiApi(
 	}
 }
 
-export function isGeminiApiAvailable(): boolean {
+function hasGeminiApiKeySource(): boolean {
 	return hasCredentialSource({
 		provider: "Gemini",
 		configuredValue: loadConfig().geminiApiKey,
 		environmentValue: process.env.GEMINI_API_KEY,
-	}) || isGatewayConfigured();
+	});
+}
+
+export function isGeminiApiAvailable(): boolean {
+	return isGeminiAdcAvailable() || hasGeminiApiKeySource() || isGatewayConfigured();
+}
+
+/**
+ * Whether the Gemini Files-API paths (YouTube and local video analysis) can
+ * authenticate. These use the Gemini Files API and metadata endpoints, which do
+ * not support ADC, so they still require an API key or a Cloudflare gateway.
+ */
+export function isGeminiApiAvailableWithVideo(): boolean {
+	return hasGeminiApiKeySource() || isGatewayConfigured();
 }
 
 export interface GeminiApiOptions {
@@ -192,12 +235,13 @@ export async function queryGeminiApiWithInlineData(
 	options: GeminiApiOptions = {},
 ): Promise<GeminiGenerateContentResult> {
 	const signal = withTimeout(options.signal, options.timeoutMs ?? 120000);
-	const apiKey = options.apiKey ?? await getApiKey(signal);
-	if (!apiKey && !isGatewayConfigured()) {
+	const apiKey = isGeminiAdcAvailable() ? null : (options.apiKey ?? await getApiKey(signal));
+	if (!apiKey && !isGatewayConfigured() && !isGeminiAdcAvailable()) {
 		throw new Error(
 			"Gemini API not configured. Either:\n" +
 			`  1. Configure geminiApiKey in ${CONFIG_PATH} or set GEMINI_API_KEY\n` +
-			"  2. Set GOOGLE_GEMINI_BASE_URL + CLOUDFLARE_API_KEY for Cloudflare AI Gateway routing"
+			"  2. Set GOOGLE_GEMINI_BASE_URL + CLOUDFLARE_API_KEY for Cloudflare AI Gateway routing\n" +
+			"  3. Set geminiAuth to \"adc\" with a Google Cloud ADC (GOOGLE_APPLICATION_CREDENTIALS) + project/location"
 		);
 	}
 

package/node_modules/pi-web-access/gemini-search.ts

@@ -3,11 +3,17 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { activityMonitor } from "./activity.ts";
 import { CredentialResolutionError } from "./credential-source.ts";
 import { getApiKey, getVersionedApiBase, fetchGeminiApi, isGatewayConfigured, isGeminiApiAvailable, redactGeminiApiResponse } from "./gemini-api.ts";
+import { isGeminiAdcAvailable } from "./gemini-adc.ts";
 import { getGeminiWebAvailabilityDiagnostic, isGeminiWebAvailable, queryWithCookies } from "./gemini-web.ts";
 import { isPerplexityAvailable, searchWithPerplexity, type SearchResult, type SearchResponse, type SearchOptions } from "./perplexity.ts";
 import { isExaAvailable, searchWithExa } from "./exa.ts";
 import { isBraveAvailable, searchWithBrave } from "./brave.ts";
-import { isOpenAISearchAvailable, searchWithOpenAI } from "./openai-search.ts";
+import {
+	isCurrentModelHostedSearchEligible,
+	isOpenAISearchAvailable,
+	searchWithCurrentModelOpenAI,
+	searchWithOpenAI,
+} from "./openai-search.ts";
 import { isParallelAvailable, searchWithParallel } from "./parallel.ts";
 import { isParallelMcpAvailable, searchWithParallelMcp } from "./parallel-mcp.ts";
 import { isTinyFishAvailable, searchWithTinyFish } from "./tinyfish.ts";
@@ -29,9 +35,10 @@ import { isBrightDataAvailable, searchWithBrightData } from "./brightdata.ts";
 import { isSerpBaseAvailable, searchWithSerpBase } from "./serpbase.ts";
 import { isSerperAvailable, searchWithSerper } from "./serper.ts";
 import { isValyuAvailable, searchWithValyu } from "./valyu.ts";
+import { isKimiSearchAvailable, searchWithKimi } from "./kimi-search.ts";
 import { getWebSearchConfigPath } from "./utils.ts";
 
-export const RESOLVED_SEARCH_PROVIDERS = ["openai", "brave", "parallel", "parallel-mcp", "tinyfish", "search1api", "searchinfinity", "querit", "tavily", "firecrawl", "jina", "searxng", "duckduckgo", "perplexity", "gemini", "exa", "serpdive", "kagi", "ollama", "anysearch", "xai", "brightdata", "serpbase", "serper", "valyu", "bocha"] as const;
+export const RESOLVED_SEARCH_PROVIDERS = ["openai", "brave", "parallel", "parallel-mcp", "tinyfish", "search1api", "searchinfinity", "querit", "tavily", "firecrawl", "jina", "searxng", "duckduckgo", "perplexity", "gemini", "kimi", "exa", "serpdive", "kagi", "ollama", "anysearch", "xai", "brightdata", "serpbase", "serper", "valyu", "bocha"] as const;
 export const SEARCH_PROVIDERS = ["auto", "all", ...RESOLVED_SEARCH_PROVIDERS] as const;
 
 export type ResolvedSearchProvider = typeof RESOLVED_SEARCH_PROVIDERS[number];
@@ -46,12 +53,14 @@ export type SearchProviderErrorKind =
 	| "auth"
 	| "invalid-request"
 	| "invalid-response"
+	| "unsupported"
 	| "aborted"
 	| "unknown";
 
 export interface SearchRoutingConfig {
 	providers: ResolvedSearchProvider[];
-	fallbackOn: Array<Extract<SearchProviderErrorKind, "transient" | "quota" | "network" | "invalid-response">>;
+	useCurrentModel?: boolean;
+	fallbackOn: Array<Extract<SearchProviderErrorKind, "transient" | "quota" | "network" | "invalid-response" | "unsupported">>;
 }
 
 export class SearchProviderError extends Error {
@@ -93,10 +102,10 @@ export interface AttributedSearchResponse extends SearchResponse {
 
 const CONFIG_PATH = getWebSearchConfigPath();
 const DEFAULT_SEARCH_MODEL = "gemini-3.6-flash";
-// Explicit-only providers (Parallel MCP, DuckDuckGo, AnySearch, xAI, Bright Data, SerpBase, Serper, Valyu) are deliberately absent:
+// Explicit-only providers (Parallel MCP, DuckDuckGo, Kimi, AnySearch, xAI, Bright Data, SerpBase, Serper, Valyu) are deliberately absent:
 // `all` must never fan out to an opt-in or paid provider without the user asking for it.
 const ALL_SEARCH_PROVIDERS: ResolvedSearchProvider[] = ["searxng", "openai", "exa", "brave", "parallel", "tinyfish", "search1api", "searchinfinity", "querit", "tavily", "firecrawl", "jina", "serpdive", "kagi", "ollama", "perplexity", "gemini", "bocha"];
-const VALID_ROUTING_KINDS = ["transient", "quota", "network", "invalid-response"] as const;
+const VALID_ROUTING_KINDS = ["transient", "quota", "network", "invalid-response", "unsupported"] as const;
 
 type SearchConfig = {
 	searchProvider: SearchProviderSelection;
@@ -144,19 +153,27 @@ function normalizeSearchRouting(value: unknown): SearchRoutingConfig {
 	}
 	const raw = value as Record<string, unknown>;
 	const providers = normalizeResolvedProviderList(raw.providers, `searchRouting.providers in ${CONFIG_PATH}`);
+	const useCurrentModel = raw.useCurrentModel;
+	if (useCurrentModel !== undefined && typeof useCurrentModel !== "boolean") {
+		throw new Error(`searchRouting.useCurrentModel in ${CONFIG_PATH} must be a boolean`);
+	}
 	if (!Array.isArray(raw.fallbackOn) || raw.fallbackOn.length === 0) {
 		throw new Error(`searchRouting.fallbackOn in ${CONFIG_PATH} must be a non-empty array`);
 	}
 	const fallbackOn: SearchRoutingConfig["fallbackOn"] = [];
 	for (const kind of raw.fallbackOn) {
 		if (typeof kind !== "string" || !VALID_ROUTING_KINDS.includes(kind as typeof VALID_ROUTING_KINDS[number])) {
-			throw new Error(`searchRouting.fallbackOn in ${CONFIG_PATH} may only contain transient, quota, network, or invalid-response`);
+			throw new Error(`searchRouting.fallbackOn in ${CONFIG_PATH} may only contain transient, quota, network, invalid-response, or unsupported`);
 		}
 		if (!fallbackOn.includes(kind as SearchRoutingConfig["fallbackOn"][number])) {
 			fallbackOn.push(kind as SearchRoutingConfig["fallbackOn"][number]);
 		}
 	}
-	return { providers, fallbackOn };
+	return {
+		providers,
+		...(useCurrentModel !== undefined ? { useCurrentModel: useCurrentModel as boolean } : {}),
+		fallbackOn,
+	};
 }
 
 export function getConfiguredSearchRouting(): SearchRoutingConfig | undefined {
@@ -278,6 +295,7 @@ function classifyProviderError(provider: ResolvedSearchProvider, err: unknown):
 	const lower = message.toLowerCase();
 	const status = providerErrorStatus(message);
 	let kind: SearchProviderErrorKind = "unknown";
+	const mentionsUnsupportedWebSearch = /(?:web[_ -]?search|web[_ -]?search_preview|(?:the )?tool)\b.*\b(?:unsupported|not supported|does not support|doesn't support|unknown|unrecognized|unavailable|not found)|\b(?:unsupported|not supported|does not support|doesn't support|unknown|unrecognized|unavailable|not found)\b.*\b(?:web[_ -]?search|web[_ -]?search_preview|(?:the )?tool)/i.test(lower);
 	if (err instanceof CredentialResolutionError || /(?:api )?key (?:not found|missing)|credential resolution/.test(lower)) {
 		kind = "credential";
 	} else if (isAbortError(err)) {
@@ -286,6 +304,8 @@ function classifyProviderError(provider: ResolvedSearchProvider, err: unknown):
 		kind = "quota";
 	} else if (status === 401 || status === 403) {
 		kind = "auth";
+	} else if (provider === "openai" && (status === 400 || status === 422) && mentionsUnsupportedWebSearch) {
+		kind = "unsupported";
 	} else if (status === 400 || status === 422) {
 		kind = "invalid-request";
 	} else if (status === 402 || status === 429) {
@@ -298,7 +318,7 @@ function classifyProviderError(provider: ResolvedSearchProvider, err: unknown):
 		kind = "auth";
 	} else if (/bad request|invalid request/.test(lower)) {
 		kind = "invalid-request";
-	} else if (/invalid json|no parseable response|no parseable results|invalid response|returned empty response/.test(lower)) {
+	} else if (/invalid json|no parseable response|no parseable results|invalid response|returned empty response|no web_search_call/.test(lower)) {
 		kind = "invalid-response";
 	} else if (/temporar|service unavailable|server error/.test(lower)) {
 		kind = "transient";
@@ -314,9 +334,12 @@ async function searchWithResolvedProvider(
 	provider: ResolvedSearchProvider,
 	query: string,
 	options: FullSearchOptions,
+	useCurrentModel = false,
 ): Promise<AttributedSearchResponse> {
 	if (provider === "openai") {
-		const result = await searchWithOpenAI(query, options, options.extensionContext);
+		const result = useCurrentModel
+			? await searchWithCurrentModelOpenAI(query, options, options.extensionContext)
+			: await searchWithOpenAI(query, options, options.extensionContext);
 		return { ...result, provider };
 	}
 	if (provider === "brave") return { ...(await searchWithBrave(query, options)), provider };
@@ -342,6 +365,7 @@ async function searchWithResolvedProvider(
 	if (provider === "perplexity") return { ...(await searchWithPerplexity(query, options)), provider };
 	if (provider === "searxng") return { ...(await searchWithSearXNG(query, options)), provider };
 	if (provider === "duckduckgo") return { ...(await searchWithDuckDuckGo(query, options)), provider };
+	if (provider === "kimi") return { ...(await searchWithKimi(query, options, options.extensionContext)), provider };
 	if (provider === "gemini") {
 		const result = await searchWithGemini(query, options, true);
 		if (result) return { ...result, provider };
@@ -349,7 +373,8 @@ async function searchWithResolvedProvider(
 			"Gemini search unavailable. Either:\n" +
 			`  1. Configure geminiApiKey in ${CONFIG_PATH} or set GEMINI_API_KEY\n` +
 			"  2. Set GOOGLE_GEMINI_BASE_URL + CLOUDFLARE_API_KEY for Cloudflare AI Gateway routing\n" +
-			"  3. Sign into gemini.google.com in a supported Chromium-based browser",
+			"  3. Set geminiAuth to \"adc\" in web-search.json with a Google Cloud ADC + project/location\n" +
+			"  4. Sign into gemini.google.com in a supported Chromium-based browser",
 		);
 	}
 	const result = await searchWithExa(query, options);
@@ -357,8 +382,12 @@ async function searchWithResolvedProvider(
 	throw new Error("Exa search returned no results.");
 }
 
-async function isResolvedProviderAvailable(provider: ResolvedSearchProvider, options: FullSearchOptions): Promise<boolean> {
-	if (provider === "openai") return isOpenAISearchAvailable(options.extensionContext);
+async function isResolvedProviderAvailable(provider: ResolvedSearchProvider, options: FullSearchOptions, useCurrentModel = false): Promise<boolean> {
+	if (provider === "openai") {
+		return useCurrentModel
+			? isCurrentModelHostedSearchEligible(options.extensionContext)
+			: isOpenAISearchAvailable(options.extensionContext);
+	}
 	if (provider === "brave") return isBraveAvailable();
 	if (provider === "parallel") return isParallelAvailable();
 	if (provider === "parallel-mcp") return isParallelMcpAvailable();
@@ -382,10 +411,19 @@ async function isResolvedProviderAvailable(provider: ResolvedSearchProvider, opt
 	if (provider === "perplexity") return isPerplexityAvailable();
 	if (provider === "searxng") return isSearXNGAvailable();
 	if (provider === "duckduckgo") return isDuckDuckGoAvailable();
-	if (provider === "gemini") return isGeminiApiAvailable() || !!(await isGeminiWebAvailable());
+	if (provider === "gemini") return isGeminiApiAvailable() || await isGeminiWebOptionallyAvailable();
+	if (provider === "kimi") return isKimiSearchAvailable(options.extensionContext);
 	return isExaAvailable();
 }
 
+async function isGeminiWebOptionallyAvailable(): Promise<boolean> {
+	try {
+		return !!(await isGeminiWebAvailable());
+	} catch {
+		return false;
+	}
+}
+
 function providerLabel(provider: ResolvedSearchProvider): string {
 	if (provider === "openai") return "OpenAI";
 	if (provider === "parallel-mcp") return "Parallel MCP";
@@ -399,6 +437,7 @@ function providerLabel(provider: ResolvedSearchProvider): string {
 	if (provider === "duckduckgo") return "DuckDuckGo";
 	if (provider === "kagi") return "Kagi";
 	if (provider === "bocha") return "Bocha";
+	if (provider === "kimi") return "Kimi";
 	if (provider === "ollama") return "Ollama";
 	if (provider === "xai") return "xAI";
 	if (provider === "brightdata") return "Bright Data";
@@ -431,7 +470,7 @@ async function searchWithProviders(
 			: await isResolvedProviderAvailable(provider, options),
 	})))).filter((entry) => entry.available).map((entry) => entry.provider);
 	if (providers.length === 0) {
-		throw new Error("No configured search provider available for provider \"all\". Parallel MCP, AnySearch, xAI, Bright Data, SerpBase, Serper, and Valyu are excluded.");
+		throw new Error("No configured search provider available for provider \"all\". Parallel MCP, DuckDuckGo, Kimi, AnySearch, xAI, Bright Data, SerpBase, Serper, and Valyu are excluded.");
 	}
 
 	const settled = await Promise.allSettled(
@@ -499,12 +538,13 @@ async function searchWithConfiguredRouting(
 ): Promise<AttributedSearchResponse> {
 	const diagnostics: string[] = [];
 	for (const provider of routing.providers) {
-		if (!(await isResolvedProviderAvailable(provider, options))) {
+		const useCurrentModel = provider === "openai" && routing.useCurrentModel === true;
+		if (!(await isResolvedProviderAvailable(provider, options, useCurrentModel))) {
 			diagnostics.push(`${provider}: unavailable`);
 			continue;
 		}
 		try {
-			return await searchWithResolvedProvider(provider, query, options);
+			return await searchWithResolvedProvider(provider, query, options, useCurrentModel);
 		} catch (err) {
 			const classified = classifyProviderError(provider, err);
 			diagnostics.push(`${provider} [${classified.kind}]: ${errorMessage(err)}`);
@@ -732,8 +772,8 @@ async function searchWithGeminiApi(query: string, options: SearchOptions = {}):
 		AbortSignal.timeout(120000),
 		...(options.signal ? [options.signal] : []),
 	]);
-	const apiKey = await getApiKey(requestSignal);
-	if (!apiKey && !isGatewayConfigured()) return null;
+	const apiKey = isGeminiAdcAvailable() ? null : await getApiKey(requestSignal);
+	if (!apiKey && !isGatewayConfigured() && !isGeminiAdcAvailable()) return null;
 
 	const activityId = activityMonitor.logStart({ type: "api", query });
 

package/node_modules/pi-web-access/gemini-url-context.ts

@@ -1,6 +1,7 @@
 import { activityMonitor } from "./activity.ts";
 import { CredentialResolutionError } from "./credential-source.ts";
 import { getApiKey, getVersionedApiBase, fetchGeminiApi, isGatewayConfigured, DEFAULT_MODEL } from "./gemini-api.ts";
+import { isGeminiAdcAvailable } from "./gemini-adc.ts";
 import { isGeminiWebAvailable, queryWithCookies } from "./gemini-web.ts";
 import { extractHeadingTitle, type ExtractedContent } from "./extract.ts";
 
@@ -23,8 +24,8 @@ export async function extractWithUrlContext(
 		AbortSignal.timeout(60000),
 		...(signal ? [signal] : []),
 	]);
-	const apiKey = await getApiKey(requestSignal);
-	if (!apiKey && !isGatewayConfigured()) return null;
+	const apiKey = isGeminiAdcAvailable() ? null : await getApiKey(requestSignal);
+	if (!apiKey && !isGatewayConfigured() && !isGeminiAdcAvailable()) return null;
 
 	const activityId = activityMonitor.logStart({ type: "api", query: `url_context: ${url}` });
 

package/node_modules/pi-web-access/gemini-web-config.ts

@@ -4,10 +4,18 @@ import { getWebSearchConfigPath } from "./utils.ts";
 const CONFIG_PATH = getWebSearchConfigPath();
 
 interface GeminiWebConfig {
-	chromeProfile?: string;
+	browserCookies?: BrowserCookieSelection;
 	allowBrowserCookies?: boolean;
 }
 
+const BROWSER_COOKIE_PRESETS = ["helium", "chrome", "brave", "arc", "chromium", "edge"] as const;
+export type BrowserCookiePreset = typeof BROWSER_COOKIE_PRESETS[number];
+
+export interface BrowserCookieSelection {
+	browser?: BrowserCookiePreset;
+	profile?: string;
+}
+
 let cachedConfig: GeminiWebConfig | null = null;
 
 export function normalizeChromeProfile(value: unknown): string | undefined {
@@ -16,6 +24,35 @@ export function normalizeChromeProfile(value: unknown): string | undefined {
 	return normalized.length > 0 ? normalized : undefined;
 }
 
+function parseBrowserCookies(value: unknown): BrowserCookieSelection | undefined {
+	if (value === undefined) return undefined;
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error(`browserCookies in ${CONFIG_PATH} must be an object`);
+	}
+	const raw = value as Record<string, unknown>;
+	if ("profilePath" in raw) {
+		throw new Error(`browserCookies.profilePath is not supported; use a browser preset and profile directory name in ${CONFIG_PATH}`);
+	}
+	let browser: BrowserCookiePreset | undefined;
+	if (raw.browser !== undefined) {
+		if (typeof raw.browser !== "string") throw new Error(`browserCookies.browser in ${CONFIG_PATH} must be a supported browser name`);
+		const normalized = raw.browser.trim().toLowerCase();
+		const preset = BROWSER_COOKIE_PRESETS.find((candidate) => candidate === normalized);
+		if (!preset) {
+			throw new Error(`Unsupported browserCookies.browser ${JSON.stringify(raw.browser)} in ${CONFIG_PATH}`);
+		}
+		browser = preset;
+	}
+	if (raw.profile !== undefined && typeof raw.profile !== "string") {
+		throw new Error(`browserCookies.profile in ${CONFIG_PATH} must be a profile directory name`);
+	}
+	const profile = normalizeChromeProfile(raw.profile);
+	if (profile && (profile === "." || profile === ".." || profile.includes("/") || profile.includes("\\"))) {
+		throw new Error(`browserCookies.profile in ${CONFIG_PATH} must be a profile directory name, not a path`);
+	}
+	return { ...(browser ? { browser } : {}), ...(profile ? { profile } : {}) };
+}
+
 function loadConfig(): GeminiWebConfig {
 	if (cachedConfig) return cachedConfig;
 	if (!existsSync(CONFIG_PATH)) {
@@ -24,28 +61,41 @@ function loadConfig(): GeminiWebConfig {
 	}
 
 	const rawText = readFileSync(CONFIG_PATH, "utf-8");
-	let raw: { chromeProfile?: unknown; allowBrowserCookies?: unknown };
+	let raw: { chromeProfile?: unknown; browserCookies?: unknown; allowBrowserCookies?: unknown };
 	try {
-		raw = JSON.parse(rawText) as { chromeProfile?: unknown; allowBrowserCookies?: unknown };
+		raw = JSON.parse(rawText) as { chromeProfile?: unknown; browserCookies?: unknown; allowBrowserCookies?: unknown };
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		throw new Error(`Failed to parse ${CONFIG_PATH}: ${message}`);
 	}
 
+	if (raw.chromeProfile !== undefined) {
+		throw new Error(`chromeProfile in ${CONFIG_PATH} is no longer supported; use browserCookies.profile`);
+	}
 	cachedConfig = {
-		chromeProfile: normalizeChromeProfile(raw.chromeProfile),
+		browserCookies: parseBrowserCookies(raw.browserCookies),
 		allowBrowserCookies: raw.allowBrowserCookies === true,
 	};
 	return cachedConfig;
 }
 
-export function getChromeProfileFromConfig(): string | undefined {
-	return loadConfig().chromeProfile;
+export function getBrowserCookieSelectionFromConfig(): BrowserCookieSelection {
+	return { ...loadConfig().browserCookies };
 }
 
 export function isBrowserCookieAccessAllowed(): boolean {
 	if (process.env.PI_ALLOW_BROWSER_COOKIES === "1" || process.env.FEYNMAN_ALLOW_BROWSER_COOKIES === "1") {
 		return true;
 	}
-	return loadConfig().allowBrowserCookies === true;
+	if (!existsSync(CONFIG_PATH)) return false;
+
+	const rawText = readFileSync(CONFIG_PATH, "utf-8");
+	let raw: { allowBrowserCookies?: unknown };
+	try {
+		raw = JSON.parse(rawText) as { allowBrowserCookies?: unknown };
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse ${CONFIG_PATH}: ${message}`);
+	}
+	return raw.allowBrowserCookies === true;
 }

package/node_modules/pi-web-access/gemini-web.ts

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
-import { getLastGoogleCookieDiagnostic, type CookieMap, getGoogleCookies } from "./chrome-cookies.ts";
-import { getChromeProfileFromConfig, isBrowserCookieAccessAllowed, normalizeChromeProfile } from "./gemini-web-config.ts";
+import { getLastGoogleCookieDiagnostic, getLastGoogleCookieDiagnosticDetails, type BrowserCookieDiagnosticDetails, type CookieMap, getGoogleCookies } from "./chrome-cookies.ts";
+import { getBrowserCookieSelectionFromConfig, isBrowserCookieAccessAllowed, normalizeChromeProfile } from "./gemini-web-config.ts";
 
 const GEMINI_APP_URL = "https://gemini.google.com/app";
 const GEMINI_STREAM_GENERATE_URL =
@@ -100,8 +100,10 @@ export interface GeminiWebOptions {
 export async function isGeminiWebAvailable(chromeProfile?: string): Promise<CookieMap | null> {
 	if (!isBrowserCookieAccessAllowed()) return null;
 
+	const configured = getBrowserCookieSelectionFromConfig();
 	const result = await getGoogleCookies({
-		profile: normalizeChromeProfile(chromeProfile) ?? getChromeProfileFromConfig(),
+		browser: configured.browser,
+		profile: normalizeChromeProfile(chromeProfile) ?? configured.profile,
 		requiredCookies: REQUIRED_COOKIES,
 	});
 	if (!result) return null;
@@ -112,6 +114,10 @@ export function getGeminiWebAvailabilityDiagnostic(): string | null {
 	return isBrowserCookieAccessAllowed() ? getLastGoogleCookieDiagnostic() : null;
 }
 
+export function getGeminiWebAvailabilityDiagnosticDetails(): BrowserCookieDiagnosticDetails | null {
+	return isBrowserCookieAccessAllowed() ? getLastGoogleCookieDiagnosticDetails() : null;
+}
+
 export async function getActiveGoogleEmail(cookies: CookieMap): Promise<string | null> {
 	const cookieHeader = buildCookieHeader(cookies);
 	if (!cookieHeader) return null;

package/node_modules/pi-web-access/github-api.ts

@@ -8,13 +8,14 @@ const MAX_INLINE_FILE_CHARS = 100_000;
 let ghAvailable: boolean | null = null;
 let ghHintShown = false;
 
-export async function checkGhAvailable(): Promise<boolean> {
+export async function checkGhAvailable(signal?: AbortSignal): Promise<boolean> {
 	if (ghAvailable !== null) return ghAvailable;
 
 	return new Promise((resolve) => {
-		execFile("gh", ["--version"], { timeout: 5000 }, (err) => {
-			ghAvailable = !err;
-			resolve(ghAvailable);
+		execFile("gh", ["--version"], { timeout: 5000, ...(signal ? { signal } : {}) }, (err) => {
+			const available = !err;
+			if (!signal?.aborted) ghAvailable = available;
+			resolve(available);
 		});
 	});
 }