@iislee/opencodex 2.11.0 → 2.35.0

package/src/adapters/google-antigravity-wire.ts

@@ -3,12 +3,13 @@ import type { OcxContentPart, OcxParsedRequest } from "../types";
 import { antigravityUserAgent } from "./client-fingerprint";
 
 /**
- * Antigravity request User-Agent. Mirrors the real Antigravity CLI UA
- * (`antigravity/cli/{ver} (aidev_client; os_type=darwin; arch=arm64)`) so the request fingerprint
+ * Antigravity request User-Agent. Mirrors the real Antigravity IDE UA
+ * (`antigravity/ide/{ver} (aidev_client; os_type=windows; arch=amd64)`) so the request fingerprint
  * matches the OAuth credential — the prior literal `"antigravity"` was a giveaway no real client
- * sends. A `GOOGLE_ANTIGRAVITY_USER_AGENT` override still wins.
+ * sends. The IDE client family is also required to unlock newer agent models (the backend 404s
+ * CLI-shaped UAs for `gemini-3.7-*`). A `GOOGLE_ANTIGRAVITY_USER_AGENT` override still wins.
  */
-export const ANTIGRAVITY_REQUEST_UA = process.env.GOOGLE_ANTIGRAVITY_USER_AGENT || antigravityUserAgent();
+export const ANTIGRAVITY_REQUEST_UA = antigravityUserAgent();
 
 /**
  * Whether a stored `OcxToolCall.thoughtSignature` is a REAL upstream Gemini signature versus a
@@ -28,6 +29,11 @@ export const ANTIGRAVITY_REQUEST_UA = process.env.GOOGLE_ANTIGRAVITY_USER_AGENT
  */
 export function isLikelyRealThoughtSignature(sig: string | undefined): boolean {
   if (typeof sig !== "string" || sig.length < 16) return false;
+  // The validator-bypass sentinel is something WE fabricate for outbound requests when no real
+  // signature exists. It is alphanumeric with underscores, so it would otherwise satisfy every
+  // check below and be re-ingested as genuine — cached, replayed, and eventually treated as
+  // evidence that a turn was signed. It is never a real signature.
+  if (sig === "skip_thought_signature_validator") return false;
   // Reject synthetic Responses/tool-call ids and Anthropic tool-use ids (`_` or `-` separators).
   if (/^(fc|ctc|tsc|call|msg|rs|resp|reasoning|item|ws|toolu|tool|func|function)[-_]/i.test(sig)) return false;
   // Real Gemini thought signatures are opaque base64/base64url blobs: only [A-Za-z0-9+/_=-].
@@ -51,18 +57,50 @@ function firstUserText(parsed: OcxParsedRequest): string | undefined {
  * 0x7FFFFFFFFFFFFFFF, prefixed with "-". Falls back to a random "-<digits>" id when there is no text.
  */
 export function antigravitySessionId(parsed: OcxParsedRequest): string {
-  // Anchored on the first user message text: this is the one value that stays STABLE across every
-  // turn of a conversation, which the replay cache requires (it observes signatures on turn N's
-  // response and re-injects them on turn N+1's request, so both turns must map to the same id).
-  // Cross-conversation collisions (two threads opening with identical text) are made harmless by
-  // the replay cache keying signatures on functionCall identity (name+args), not on this id alone.
-  const text = firstUserText(parsed);
+  // The id must be IDENTICAL on turn N and turn N+1: the replay cache observes thought signatures
+  // on turn N's response and re-injects them on turn N+1's request, so a changing id loses the
+  // association entirely. (A *shared* id does not — signatures are keyed on functionCall identity,
+  // name+args, so cross-conversation collisions stay harmless. Instability is the failure mode.)
+  //
+  // First-user text does not guarantee that. It is stable only while the first user message
+  // survives verbatim in what this adapter sees, and Codex compacts, summarises, and trims long
+  // histories — at which point the anchor changes mid-conversation (#1295's sibling, #1297).
+  //
+  // `_clientThreadId` is Codex's own thread identity from `x-codex-parent-thread-id`. It survives
+  // compaction because it does not depend on message content, which is the property first-user
+  // text fails to provide. Deliberately NOT `promptCacheKey`: that is arbitrary Responses input
+  // and is explicitly shared across conversations for some clients
+  // (`adapters/cursor/request-builder.ts`), so it identifies a cache cohort, not a conversation.
+  //
+  // What is NOT claimed: that Google treats this id as anything but opaque, or that upstream
+  // signatures are not session-bound. Only the local association is verified here.
+  //
+  // Clients that send no thread header keep the text anchor and its instability; this is a scoped
+  // repair, not a universal one.
+  const text = clientThreadAnchor(parsed) ?? firstUserText(parsed);
   if (!text) return `-${Math.floor(Math.random() * 9e18).toString()}`;
   const digest = createHash("sha256").update(text, "utf8").digest();
   const masked = digest.readBigUInt64BE(0) & 0x7fffffffffffffffn;
   return `-${masked.toString()}`;
 }
 
+/**
+ * Codex's stable client thread id, prefixed before hashing so it does not collide with a first
+ * user message equal to the bare thread id.
+ *
+ * This is a prefix, not full domain separation: a textless-anchor request whose first message is
+ * literally `codex-thread:<id>` still hashes the same preimage. Tagging BOTH anchor classes would
+ * separate them completely, but it would also change every existing text-derived id — a
+ * Google-visible wire value for live conversations — which is a larger blast radius than the
+ * collision it removes. A collision is harmless here anyway: the replay cache keys signatures on
+ * functionCall identity (name+args), so a shared id does not misattribute them. Instability, not
+ * collision, is the failure mode this function exists to prevent.
+ */
+function clientThreadAnchor(parsed: OcxParsedRequest): string | undefined {
+  const threadId = parsed._clientThreadId?.trim();
+  return threadId ? `codex-thread:${threadId}` : undefined;
+}
+
 /** A Gemini content part as it appears in an Antigravity request body. */
 interface GeminiPart {
   thought?: boolean;

package/src/adapters/google-errors.ts

@@ -15,14 +15,50 @@ function googleErrorDetail(payloadText: string): { message?: string; status?: st
   };
 }
 
+
+
+const GOOGLE_QUOTA_EXHAUSTED_NEEDLES = [
+  "quotafailure",
+  "quota exceeded",
+  "exceeded your current quota",
+  "billing",
+  "individual quota reached",
+  "quota reached",
+  "enable overages",
+  "exhausted your capacity",
+  "daily limit reached",
+  "weekly limit reached",
+];
+
+// Per-minute / per-second / concurrency limits are transient rate limits: they should be
+// retried, not treated as hard quota exhaustion. These guards run before the needles so a
+// message like "Per-minute quota exceeded" stays in the retryable bucket.
+const GOOGLE_TRANSIENT_RATE_LIMIT_PATTERNS = [
+  "per minute",
+  "per-minute",
+  "per min",
+  "rpm",
+  "requests per minute",
+  "too many requests",
+  "rate limit",
+  "retry after",
+  // Upstream writes the header name both ways in prose ("retry-after: 60"); matching only the
+  // spaced spelling let a transient 429 fall through to the exhaustion needles below.
+  "retry-after",
+  "concurrent request limit",
+];
+
+export function isGoogleQuotaExhaustedText(text: string): boolean {
+  const lower = text.toLowerCase();
+  if (GOOGLE_TRANSIENT_RATE_LIMIT_PATTERNS.some(needle => lower.includes(needle))) return false;
+  return GOOGLE_QUOTA_EXHAUSTED_NEEDLES.some(needle => lower.includes(needle));
+}
+
+
 function classifyGoogle(label: string, status: number | undefined, enumStatus: string | undefined, text: string): string {
   const lower = `${enumStatus ?? ""} ${text}`.toLowerCase();
-  const quotaExhausted =
-    lower.includes("quotafailure") ||
-    lower.includes("quota exceeded") ||
-    lower.includes("exceeded your current quota") ||
-    lower.includes("billing");
-  if (enumStatus === "RESOURCE_EXHAUSTED" && quotaExhausted) return `${label} quota exhausted`;
+  const quotaExhausted = isGoogleQuotaExhaustedText(lower);
+  if ((!enumStatus || enumStatus === "RESOURCE_EXHAUSTED") && quotaExhausted) return `${label} quota exhausted`;
   if (status === 429 || enumStatus === "RESOURCE_EXHAUSTED" || lower.includes("rate limit")) {
     return `${label} rate limit exceeded`;
   }
@@ -76,10 +112,6 @@ export function retryableGoogleStatus(status: number): boolean {
  */
 export function isQuotaExhaustedBody(payloadText: string): boolean {
   const { message, status } = googleErrorDetail(payloadText);
-  if (status !== "RESOURCE_EXHAUSTED") return false;
-  const lower = (message ?? "").toLowerCase();
-  return lower.includes("quotafailure")
-    || lower.includes("quota exceeded")
-    || lower.includes("exceeded your current quota")
-    || lower.includes("billing");
+  if (status && status !== "RESOURCE_EXHAUSTED") return false;
+  return isGoogleQuotaExhaustedText(message ?? payloadText);
 }

package/src/adapters/google-http.ts

@@ -14,6 +14,11 @@ const GOOGLE_RETRY_ATTEMPTS = 3;
 const GOOGLE_RETRY_BASE_MS = 250;
 const GOOGLE_RETRY_MAX_MS = 2_000;
 
+export interface GoogleRetryOptions {
+  /** Repair-and-replay structurally invalid 400 bodies (Vertex/Antigravity behavior). */
+  repairInvalid400?: boolean;
+}
+
 async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
   return normalizeUpstreamHttpErrorResponse(res, {
     signal,
@@ -22,13 +27,21 @@ async function normalizeFinalGoogleError(label: string, res: Response, signal?:
 }
 
 /**
- * Fetch a Google-family upstream (Vertex / Antigravity) with Kiro-style hardening: per-attempt
- * timeout (`AbortSignal.any([parent, timeout])`), bounded retry on transient status / network
- * errors, `Retry-After` honoring, jittered exponential backoff, and a classified + redacted final
- * error body. `label` is the provider-facing prefix used in error messages.
+ * Fetch a Google-family upstream with Kiro-style hardening: per-attempt timeout
+ * (`AbortSignal.any([parent, timeout])`), bounded retry on transient status / network errors,
+ * `Retry-After` honoring, jittered exponential backoff, and (unless raw mode is used) a
+ * classified + redacted final error body. `label` is the provider-facing prefix used in error
+ * messages.
  */
-export async function fetchGoogleWithRetry(label: string, request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
+export async function fetchGoogleWithRetry(
+  label: string,
+  request: AdapterRequest,
+  ctx: AdapterFetchContext = {},
+  opts: GoogleRetryOptions = {},
+): Promise<Response> {
+  const repairInvalid400 = opts.repairInvalid400 ?? true;
   const timeoutMs = ctx.timeoutMs ?? 200_000;
+  const executor = ctx.executor ?? globalThis.fetch;
   let lastError: unknown;
   let activeRequest = request;
   let compatibilityReplayUsed = false;
@@ -39,8 +52,8 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
         method: activeRequest.method,
         headers: activeRequest.headers,
         body: activeRequest.body,
-      }, timeoutMs, ctx.abortSignal, ctx.stream);
-      if (res.status === 400 && !compatibilityReplayUsed) {
+      }, timeoutMs, ctx.abortSignal, ctx.stream, executor);
+      if (res.status === 400 && repairInvalid400 && !compatibilityReplayUsed) {
         let payloadText = "";
         try {
           payloadText = await readDisplaySafeErrorPayloadText(res.clone(), ctx.abortSignal);
@@ -61,10 +74,11 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
       }
       // A 429 may be a transient rate limit (retry) or hard quota exhaustion (do NOT retry —
       // it won't recover for hours and burns retries). Peek the body to tell them apart.
-      if (res.status === 429 && !ctx.returnRawErrors) {
-        const peek = await readDisplaySafeErrorPayloadText(res, ctx.abortSignal);
+      if (res.status === 429) {
+        const peekTarget = ctx.returnRawErrors ? res.clone() : res;
+        const peek = await readDisplaySafeErrorPayloadText(peekTarget, ctx.abortSignal);
         if (isQuotaExhaustedBody(peek)) {
-          return normalizeUpstreamHttpErrorResponse(res, {
+          return ctx.returnRawErrors ? res : normalizeUpstreamHttpErrorResponse(res, {
             signal: ctx.abortSignal,
             formatMessage: payloadText => safeGoogleHttpErrorMessage(label, res.status, payloadText || peek),
           });
@@ -89,6 +103,20 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
   throw lastError ?? new Error(`${label} fetch failed`);
 }
 
+/**
+ * AI Studio direct (`generativelanguage.googleapis.com`) retry wrapper.
+ *
+ * Direct requests keep the default server error surface — the raw `Provider error <status>:
+ * <body>` text the shared Responses path formats — and keep single-shot 400 semantics (no
+ * request-shape compatibility replay). The wrapper exists for the failure mode observed in
+ * production: AI Studio's transient `503 UNAVAILABLE` "model is currently experiencing high
+ * demand" spikes, plus plain rate-limit 429s, both of which previously failed immediately
+ * because the default server fetch path only retries connection resets.
+ */
+export function fetchDirectGeminiWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
+  return fetchGoogleWithRetry("Gemini", request, { ...ctx, returnRawErrors: true }, { repairInvalid400: false });
+}
+
 /** Vertex AI retry wrapper. */
 export function fetchVertexWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
   return fetchGoogleWithRetry("Vertex AI", request, ctx);

package/src/adapters/google-tool-schema.ts

@@ -7,6 +7,27 @@ type Schema = Record<string, unknown>;
 const ALLOWED_TYPES = new Set(["string", "integer", "number", "boolean", "array", "object"]);
 const MAX_SCHEMA_DEPTH = 24; // Google's documented nesting limit is 32; leave headroom for CCA.
 const MAX_DEREF_DEPTH = 16;
+const MAX_SCHEMA_NODES = 1_024;
+const BUDGET_EXHAUSTED = Symbol("schema-budget-exhausted");
+const MERGED_SCHEMA_KEYS = [
+  "type",
+  "nullable",
+  "description",
+  "format",
+  "enum",
+  "const",
+  "properties",
+  "items",
+  "required",
+  "anyOf",
+] as const;
+
+type SanitizeResult = Schema | typeof BUDGET_EXHAUSTED;
+
+interface SanitizeState {
+  activeRefs: Set<string>;
+  remainingNodes: number;
+}
 
 function isRecord(value: unknown): value is Schema {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -34,6 +55,16 @@ function collectDefs(root: unknown, defs: Map<string, unknown>): void {
   }
 }
 
+function mergeRefTarget(target: Schema, overlay: Schema): Schema {
+  const merged: Schema = {};
+  if (Object.hasOwn(target, "$ref")) merged.$ref = target.$ref;
+  for (const key of MERGED_SCHEMA_KEYS) {
+    if (Object.hasOwn(overlay, key)) merged[key] = overlay[key];
+    else if (Object.hasOwn(target, key)) merged[key] = target[key];
+  }
+  return merged;
+}
+
 function normalizeType(value: unknown, out: Schema, preserveNullType: boolean): void {
   const candidates = Array.isArray(value) ? value : [value];
   let sawNull = false;
@@ -65,9 +96,16 @@ function normalizeAnyOf(
   defs: Map<string, unknown>,
   depth: number,
   refDepth: number,
+  state: SanitizeState,
 ): Schema {
   if (!Array.isArray(value) || value.length === 0) return {};
-  const schemas = value.map(item => sanitizeSchema(item, defs, depth + 1, refDepth, true));
+  const schemas: Schema[] = [];
+  for (let index = 0; index < value.length; index++) {
+    if (state.remainingNodes <= 0) return {};
+    const schema = sanitizeSchema(value[index], defs, depth + 1, refDepth, true, state);
+    if (schema === BUDGET_EXHAUSTED) return {};
+    schemas.push(schema);
+  }
 
   const nonNullSchemas = schemas.filter(schema => schema.type !== "null");
   const nullSchemas = schemas.filter(schema => schema.type === "null");
@@ -100,12 +138,17 @@ function sanitizeProperties(
   defs: Map<string, unknown>,
   depth: number,
   refDepth: number,
+  state: SanitizeState,
 ): Record<string, Schema> | undefined {
   if (!isRecord(value)) return undefined;
   const properties: Record<string, Schema> = Object.create(null) as Record<string, Schema>;
-  for (const [name, schema] of Object.entries(value)) {
+  for (const name in value) {
+    if (!Object.hasOwn(value, name)) continue;
+    if (state.remainingNodes <= 0) break;
     // Property names form a name bag and must never be interpreted as schema keywords.
-    properties[name] = sanitizeSchema(schema, defs, depth + 1, refDepth, false);
+    const schema = sanitizeSchema(value[name], defs, depth + 1, refDepth, false, state);
+    if (schema === BUDGET_EXHAUSTED) break;
+    properties[name] = schema;
   }
   return properties;
 }
@@ -116,17 +159,25 @@ function sanitizeSchema(
   depth: number,
   refDepth: number,
   preserveNullType: boolean,
-): Schema {
+  state: SanitizeState,
+): SanitizeResult {
+  if (state.remainingNodes <= 0) return BUDGET_EXHAUSTED;
+  state.remainingNodes -= 1;
   if (depth >= MAX_SCHEMA_DEPTH || !isRecord(node)) return {};
 
   if (typeof node.$ref === "string" && refDepth < MAX_DEREF_DEPTH) {
     const target = resolveRef(node.$ref, defs);
     if (isRecord(target)) {
-      const merged: Schema = { ...target };
-      for (const [key, value] of Object.entries(node)) {
-        if (key !== "$ref") merged[key] = value;
+      if (state.activeRefs.has(node.$ref)) return {};
+      state.activeRefs.add(node.$ref);
+      // Select only inputs the sanitizer can consume. Spreading an untrusted definition here would
+      // enumerate and allocate every unsupported annotation before the node budget can stop work.
+      const merged = mergeRefTarget(target, node);
+      try {
+        return sanitizeSchema(merged, defs, depth, refDepth + 1, preserveNullType, state);
+      } finally {
+        state.activeRefs.delete(node.$ref);
       }
-      return sanitizeSchema(merged, defs, depth, refDepth + 1, preserveNullType);
     }
   }
 
@@ -140,18 +191,27 @@ function sanitizeSchema(
   const enumValues = sanitizeEnum(node.enum ?? (typeof node.const === "string" ? [node.const] : undefined));
   if (enumValues) out.enum = enumValues;
 
-  const properties = sanitizeProperties(node.properties, defs, depth, refDepth);
+  const properties = sanitizeProperties(node.properties, defs, depth, refDepth, state);
   if (properties) out.properties = properties;
 
-  if (isRecord(node.items)) {
-    out.items = sanitizeSchema(node.items, defs, depth + 1, refDepth, false);
+  if (properties && Array.isArray(node.required)) {
+    const required = [...new Set(node.required.filter((item): item is string => (
+      typeof item === "string" && Object.hasOwn(properties, item)
+    )))];
+    if (required.length > 0) out.required = required;
   }
 
-  if (Array.isArray(node.required)) {
-    out.required = [...new Set(node.required.filter((item): item is string => typeof item === "string"))];
+  if (state.remainingNodes <= 0) return out;
+
+  if (isRecord(node.items)) {
+    const items = sanitizeSchema(node.items, defs, depth + 1, refDepth, false, state);
+    if (items !== BUDGET_EXHAUSTED) out.items = items;
   }
 
-  if (node.anyOf !== undefined) Object.assign(out, normalizeAnyOf(node.anyOf, defs, depth, refDepth));
+  if (state.remainingNodes <= 0) return out;
+  if (node.anyOf !== undefined) {
+    Object.assign(out, normalizeAnyOf(node.anyOf, defs, depth, refDepth, state));
+  }
   return out;
 }
 
@@ -159,7 +219,12 @@ export function sanitizeGeminiToolParameters(parameters: unknown): Record<string
   try {
     const defs = new Map<string, unknown>();
     collectDefs(parameters, defs);
-    const root = sanitizeSchema(parameters, defs, 0, 0, false);
+    const state: SanitizeState = {
+      activeRefs: new Set(),
+      remainingNodes: MAX_SCHEMA_NODES,
+    };
+    const sanitized = sanitizeSchema(parameters, defs, 0, 0, false, state);
+    const root = sanitized === BUDGET_EXHAUSTED ? {} : sanitized;
 
     // Function arguments are always an object. Claude additionally rejects root composition and a
     // missing root type even when those forms are valid general-purpose JSON Schema.

package/src/adapters/google-truncation.ts

@@ -11,3 +11,14 @@ export function vertexTruncationErrorMessage(reason?: string): string {
   const suffix = reason ? ` (${redactSecretString(reason).slice(0, 160)})` : "";
   return `Vertex AI response truncated upstream before the turn completed${suffix}`;
 }
+
+/**
+ * Whether a finished turn must fail closed. A truncation reason arriving mid tool call always
+ * does. MALFORMED_FUNCTION_CALL fails closed even with zero started calls: the malformed call
+ * is dropped upstream and usually never materializes as a part, so the turn is incomplete
+ * despite looking empty. MAX_TOKENS with no started call stays a plain token-limit stop.
+ */
+export function isVertexTruncatedTurn(finishReason: string | undefined, toolCallsStarted: number): boolean {
+  if (!isVertexTruncationReason(finishReason)) return false;
+  return toolCallsStarted > 0 || finishReason === "MALFORMED_FUNCTION_CALL";
+}