@iislee/opencodex 2.11.0

package/src/adapters/google-antigravity-wire.ts

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+import type { OcxContentPart, OcxParsedRequest } from "../types";
+import { antigravityUserAgent } from "./client-fingerprint";
+
+/**
+ * Antigravity request User-Agent. Mirrors the real Antigravity CLI UA
+ * (`antigravity/cli/{ver} (aidev_client; os_type=darwin; arch=arm64)`) so the request fingerprint
+ * matches the OAuth credential — the prior literal `"antigravity"` was a giveaway no real client
+ * sends. A `GOOGLE_ANTIGRAVITY_USER_AGENT` override still wins.
+ */
+export const ANTIGRAVITY_REQUEST_UA = process.env.GOOGLE_ANTIGRAVITY_USER_AGENT || antigravityUserAgent();
+
+/**
+ * Whether a stored `OcxToolCall.thoughtSignature` is a REAL upstream Gemini signature versus a
+ * foreign id that must not be forwarded to Gemini/Antigravity.
+ *
+ * Foreign ids that have 400'd Antigravity (`TYPE_BYTES` / Base64 decoding failed) include:
+ * - Responses/bridge item ids: `fc_...`, `ctc_...` (custom_tool_call), `tsc_...` (tool_search_call),
+ *   `call_...`, `rs_...`, …
+ * - Anthropic tool-use ids: `toolu_...`
+ *
+ * Only real signatures may be forwarded — sending a foreign id as `thoughtSignature` breaks
+ * multi-turn reasoning continuity. Real signatures are opaque base64-ish blobs with no
+ * Responses/Anthropic id prefix.
+ *
+ * Note: do NOT reject a bare `sig_` / `sig-` prefix — existing Gemini replay fixtures and some
+ * upstream blobs use that shape; a deny-list entry for `sig` would drop valid continuity tokens.
+ */
+export function isLikelyRealThoughtSignature(sig: string | undefined): boolean {
+  if (typeof sig !== "string" || sig.length < 16) return false;
+  // Reject synthetic Responses/tool-call ids and Anthropic tool-use ids (`_` or `-` separators).
+  if (/^(fc|ctc|tsc|call|msg|rs|resp|reasoning|item|ws|toolu|tool|func|function)[-_]/i.test(sig)) return false;
+  // Real Gemini thought signatures are opaque base64/base64url blobs: only [A-Za-z0-9+/_=-].
+  // Anything containing other characters (or whitespace) is not a real signature.
+  return /^[A-Za-z0-9+/_=-]+$/.test(sig);
+}
+
+function firstUserText(parsed: OcxParsedRequest): string | undefined {
+  for (const msg of parsed.context.messages) {
+    if (msg.role !== "user") continue;
+    if (typeof msg.content === "string") return msg.content;
+    const first = (msg.content as OcxContentPart[]).find(p => p.type === "text" && typeof p.text === "string");
+    if (first && first.type === "text") return first.text;
+  }
+  return undefined;
+}
+
+/**
+ * Deterministic Cloud Code Assist session id from the first user message text. Mirrors
+ * CLIProxyAPI `generateStableSessionID`: sha256(firstUserText) → BigEndian uint64 masked with
+ * 0x7FFFFFFFFFFFFFFF, prefixed with "-". Falls back to a random "-<digits>" id when there is no text.
+ */
+export function antigravitySessionId(parsed: OcxParsedRequest): string {
+  // Anchored on the first user message text: this is the one value that stays STABLE across every
+  // turn of a conversation, which the replay cache requires (it observes signatures on turn N's
+  // response and re-injects them on turn N+1's request, so both turns must map to the same id).
+  // Cross-conversation collisions (two threads opening with identical text) are made harmless by
+  // the replay cache keying signatures on functionCall identity (name+args), not on this id alone.
+  const text = firstUserText(parsed);
+  if (!text) return `-${Math.floor(Math.random() * 9e18).toString()}`;
+  const digest = createHash("sha256").update(text, "utf8").digest();
+  const masked = digest.readBigUInt64BE(0) & 0x7fffffffffffffffn;
+  return `-${masked.toString()}`;
+}
+
+/** A Gemini content part as it appears in an Antigravity request body. */
+interface GeminiPart {
+  thought?: boolean;
+  thoughtSignature?: string;
+  thought_signature?: string;
+  text?: string;
+  [key: string]: unknown;
+}
+interface GeminiContent {
+  role?: string;
+  parts?: GeminiPart[];
+  [key: string]: unknown;
+}
+
+function hasSignature(part: GeminiPart): boolean {
+  return typeof part.thoughtSignature === "string" && part.thoughtSignature.length > 0
+    || typeof part.thought_signature === "string" && part.thought_signature.length > 0;
+}
+
+/**
+ * Claude-on-Antigravity signature sanitization (the no-cache path). Mirrors CLIProxyAPI's
+ * `StripEmptySignatureThinkingBlocks` + non-model signature stripping: drop thinking parts that
+ * carry no valid signature (they would 400 upstream), and strip signature fields from non-model
+ * (user) content. Mutates and returns `contents`.
+ */
+export function sanitizeAntigravityClaudeSignatures(contents: unknown[]): unknown[] {
+  if (!Array.isArray(contents)) return contents;
+  for (const raw of contents as GeminiContent[]) {
+    if (!raw || typeof raw !== "object" || !Array.isArray(raw.parts)) continue;
+    const isModel = raw.role === "model";
+    if (!isModel) {
+      // Non-model parts must not carry thought signatures.
+      for (const part of raw.parts) {
+        delete part.thoughtSignature;
+        delete part.thought_signature;
+      }
+      continue;
+    }
+    // Model turn: drop thinking blocks lacking a valid signature.
+    raw.parts = raw.parts.filter(part => !(part.thought === true && !hasSignature(part)));
+  }
+  return contents;
+}

package/src/adapters/google-errors.ts

@@ -0,0 +1,85 @@
+import { parseUpstreamJsonPayload, safeUpstreamErrorString, sanitizeUpstreamErrorText } from "./upstream-http-error";
+
+/** Pull the human detail out of the Google API error envelope `{error:{message,status,code}}`. */
+function googleErrorDetail(payloadText: string): { message?: string; status?: string } {
+  const trimmed = payloadText.trim();
+  if (!trimmed || (!trimmed.startsWith("{") && !trimmed.startsWith("["))) {
+    return { message: trimmed || undefined };
+  }
+  const parsed = parseUpstreamJsonPayload(trimmed);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+  const err = (parsed as { error?: { message?: unknown; status?: unknown } }).error;
+  return {
+    message: safeUpstreamErrorString(err?.message),
+    status: safeUpstreamErrorString(err?.status),
+  };
+}
+
+function classifyGoogle(label: string, status: number | undefined, enumStatus: string | undefined, text: string): string {
+  const lower = `${enumStatus ?? ""} ${text}`.toLowerCase();
+  const quotaExhausted =
+    lower.includes("quotafailure") ||
+    lower.includes("quota exceeded") ||
+    lower.includes("exceeded your current quota") ||
+    lower.includes("billing");
+  if (enumStatus === "RESOURCE_EXHAUSTED" && quotaExhausted) return `${label} quota exhausted`;
+  if (status === 429 || enumStatus === "RESOURCE_EXHAUSTED" || lower.includes("rate limit")) {
+    return `${label} rate limit exceeded`;
+  }
+  if (status === 401 || enumStatus === "UNAUTHENTICATED" || lower.includes("unauthenticated") || lower.includes("invalid authentication") || lower.includes("expired")) {
+    return `${label} authentication failed`;
+  }
+  if (status === 403 || enumStatus === "PERMISSION_DENIED" || lower.includes("permission denied") || lower.includes("access denied")) {
+    return `${label} access denied`;
+  }
+  if (status === 503 || enumStatus === "UNAVAILABLE" || lower.includes("overloaded") || lower.includes("unavailable")) {
+    return `${label} server overloaded`;
+  }
+  if (status === 400 || status === 404 || enumStatus === "INVALID_ARGUMENT" || enumStatus === "NOT_FOUND" || lower.includes("invalid") || lower.includes("not found") || lower.includes("malformed")) {
+    return `${label} invalid request`;
+  }
+  return `${label} upstream error`;
+}
+
+/**
+ * Normalize a Google/Vertex/Antigravity HTTP error body into a short, classified, secret-redacted
+ * message. Mirrors `kiro-errors.ts`. `label` is the provider-facing prefix ("Vertex AI",
+ * "Antigravity").
+ */
+export function safeGoogleHttpErrorMessage(label: string, status: number, payloadText: string): string {
+  const { message, status: enumStatus } = googleErrorDetail(payloadText);
+  const prefix = classifyGoogle(label, status, enumStatus, [message, enumStatus].filter(Boolean).join(" "));
+  const detail = message ? sanitizeUpstreamErrorText(message).slice(0, 500) : `HTTP ${status}`;
+  return `${prefix}: ${detail}`;
+}
+
+/** Vertex AI HTTP error message (label = "Vertex AI"). */
+export function safeVertexHttpErrorMessage(status: number, payloadText: string): string {
+  return safeGoogleHttpErrorMessage("Vertex AI", status, payloadText);
+}
+
+/** Antigravity (Cloud Code Assist) HTTP error message (label = "Antigravity"). */
+export function safeAntigravityHttpErrorMessage(status: number, payloadText: string): string {
+  return safeGoogleHttpErrorMessage("Antigravity", status, payloadText);
+}
+
+/** Google-family retryable HTTP set (mirrors Kiro). Quota-exhausted is classified above and not retried. */
+export function retryableGoogleStatus(status: number): boolean {
+  return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+
+/**
+ * True when a 429 body indicates hard quota exhaustion (not a transient rate limit). Quota
+ * exhaustion is generally not expected to recover for hours (AIP-194), so it must NOT be retried —
+ * unlike a plain rate limit. The HTTP status alone can't distinguish the two, so the retry layer
+ * inspects the body with this.
+ */
+export function isQuotaExhaustedBody(payloadText: string): boolean {
+  const { message, status } = googleErrorDetail(payloadText);
+  if (status !== "RESOURCE_EXHAUSTED") return false;
+  const lower = (message ?? "").toLowerCase();
+  return lower.includes("quotafailure")
+    || lower.includes("quota exceeded")
+    || lower.includes("exceeded your current quota")
+    || lower.includes("billing");
+}

package/src/adapters/google-http.ts

@@ -0,0 +1,100 @@
+import type { AdapterFetchContext, AdapterRequest } from "./base";
+import { isQuotaExhaustedBody, retryableGoogleStatus, safeGoogleHttpErrorMessage } from "./google-errors";
+import { repairGoogleInvalidRequestBody } from "./google-wire-compiler";
+import { normalizeUpstreamHttpErrorResponse, readDisplaySafeErrorPayloadText } from "./upstream-http-error";
+import {
+  abortError,
+  cancelResponseBodyBestEffort,
+  fetchWithAttemptDeadline,
+  retryBackoffDelayMs,
+  sleepWithAbort,
+} from "../lib/upstream-retry";
+
+const GOOGLE_RETRY_ATTEMPTS = 3;
+const GOOGLE_RETRY_BASE_MS = 250;
+const GOOGLE_RETRY_MAX_MS = 2_000;
+
+async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
+  return normalizeUpstreamHttpErrorResponse(res, {
+    signal,
+    formatMessage: payloadText => safeGoogleHttpErrorMessage(label, res.status, payloadText),
+  });
+}
+
+/**
+ * Fetch a Google-family upstream (Vertex / Antigravity) with Kiro-style hardening: per-attempt
+ * timeout (`AbortSignal.any([parent, timeout])`), bounded retry on transient status / network
+ * errors, `Retry-After` honoring, jittered exponential backoff, and a classified + redacted final
+ * error body. `label` is the provider-facing prefix used in error messages.
+ */
+export async function fetchGoogleWithRetry(label: string, request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
+  const timeoutMs = ctx.timeoutMs ?? 200_000;
+  let lastError: unknown;
+  let activeRequest = request;
+  let compatibilityReplayUsed = false;
+  for (let attempt = 0; attempt < GOOGLE_RETRY_ATTEMPTS; attempt++) {
+    if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
+    try {
+      const res = await fetchWithAttemptDeadline(activeRequest.url, {
+        method: activeRequest.method,
+        headers: activeRequest.headers,
+        body: activeRequest.body,
+      }, timeoutMs, ctx.abortSignal, ctx.stream);
+      if (res.status === 400 && !compatibilityReplayUsed) {
+        let payloadText = "";
+        try {
+          payloadText = await readDisplaySafeErrorPayloadText(res.clone(), ctx.abortSignal);
+        } catch (error) {
+          if (ctx.abortSignal?.aborted) throw error;
+        }
+        const repairedBody = repairGoogleInvalidRequestBody(activeRequest.body, payloadText);
+        if (repairedBody !== undefined) {
+          compatibilityReplayUsed = true;
+          activeRequest = { ...activeRequest, body: repairedBody };
+          cancelResponseBodyBestEffort(res);
+          attempt--; // The changed-request replay is separate from transient retry accounting.
+          continue;
+        }
+      }
+      if (!retryableGoogleStatus(res.status) || attempt === GOOGLE_RETRY_ATTEMPTS - 1) {
+        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
+      }
+      // A 429 may be a transient rate limit (retry) or hard quota exhaustion (do NOT retry —
+      // it won't recover for hours and burns retries). Peek the body to tell them apart.
+      if (res.status === 429 && !ctx.returnRawErrors) {
+        const peek = await readDisplaySafeErrorPayloadText(res, ctx.abortSignal);
+        if (isQuotaExhaustedBody(peek)) {
+          return normalizeUpstreamHttpErrorResponse(res, {
+            signal: ctx.abortSignal,
+            formatMessage: payloadText => safeGoogleHttpErrorMessage(label, res.status, payloadText || peek),
+          });
+        }
+      }
+      cancelResponseBodyBestEffort(res);
+      await sleepWithAbort(retryBackoffDelayMs(attempt, {
+        baseDelayMs: GOOGLE_RETRY_BASE_MS,
+        maxDelayMs: GOOGLE_RETRY_MAX_MS,
+        headers: res.headers,
+      }), ctx.abortSignal);
+    } catch (err) {
+      if (ctx.abortSignal?.aborted) throw err;
+      lastError = err;
+      if (attempt === GOOGLE_RETRY_ATTEMPTS - 1) throw err;
+      await sleepWithAbort(retryBackoffDelayMs(attempt, {
+        baseDelayMs: GOOGLE_RETRY_BASE_MS,
+        maxDelayMs: GOOGLE_RETRY_MAX_MS,
+      }), ctx.abortSignal);
+    }
+  }
+  throw lastError ?? new Error(`${label} fetch failed`);
+}
+
+/** Vertex AI retry wrapper. */
+export function fetchVertexWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
+  return fetchGoogleWithRetry("Vertex AI", request, ctx);
+}
+
+/** Antigravity (Cloud Code Assist) retry wrapper. */
+export function fetchAntigravityWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
+  return fetchGoogleWithRetry("Antigravity", request, ctx);
+}

package/src/adapters/google-tool-schema.ts

@@ -0,0 +1,173 @@
+type Schema = Record<string, unknown>;
+
+// Google documents this function-schema subset: type, nullable, required, format, description,
+// properties, items, enum, anyOf, $ref, and $defs. We inline local refs and normalize anyOf, so
+// only the eight scalar/container keywords below are ever emitted. Building from an allowlist
+// prevents new MCP/JSON-Schema annotations from turning into provider-wide 400 responses.
+const ALLOWED_TYPES = new Set(["string", "integer", "number", "boolean", "array", "object"]);
+const MAX_SCHEMA_DEPTH = 24; // Google's documented nesting limit is 32; leave headroom for CCA.
+const MAX_DEREF_DEPTH = 16;
+
+function isRecord(value: unknown): value is Schema {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function resolveRef(ref: string, defs: Map<string, unknown>): unknown {
+  // Only local pointers into the schema's own $defs/definitions are safe to inline.
+  const match = /^#\/(?:\$defs|definitions)\/(.+)$/.exec(ref);
+  if (!match) return undefined;
+  try {
+    return defs.get(decodeURIComponent(match[1].replace(/~1/g, "/").replace(/~0/g, "~")));
+  } catch {
+    return undefined;
+  }
+}
+
+function collectDefs(root: unknown, defs: Map<string, unknown>): void {
+  if (!isRecord(root)) return;
+  for (const bag of ["$defs", "definitions"] as const) {
+    const group = root[bag];
+    if (!isRecord(group)) continue;
+    for (const [name, value] of Object.entries(group)) {
+      if (!defs.has(name)) defs.set(name, value);
+    }
+  }
+}
+
+function normalizeType(value: unknown, out: Schema, preserveNullType: boolean): void {
+  const candidates = Array.isArray(value) ? value : [value];
+  let sawNull = false;
+
+  for (const candidate of candidates) {
+    if (typeof candidate !== "string") continue;
+    const type = candidate.toLowerCase();
+    if (type === "null") {
+      sawNull = true;
+    } else if (out.type === undefined && ALLOWED_TYPES.has(type)) {
+      out.type = type;
+    }
+  }
+
+  if (!sawNull) return;
+  if (out.type !== undefined) out.nullable = true;
+  else if (preserveNullType) out.type = "null";
+  else out.nullable = true;
+}
+
+function sanitizeEnum(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const values = [...new Set(value.filter((item): item is string => typeof item === "string"))];
+  return values.length > 0 ? values : undefined;
+}
+
+function normalizeAnyOf(
+  value: unknown,
+  defs: Map<string, unknown>,
+  depth: number,
+  refDepth: number,
+): Schema {
+  if (!Array.isArray(value) || value.length === 0) return {};
+  const schemas = value.map(item => sanitizeSchema(item, defs, depth + 1, refDepth, true));
+
+  const nonNullSchemas = schemas.filter(schema => schema.type !== "null");
+  const nullSchemas = schemas.filter(schema => schema.type === "null");
+  if (
+    nonNullSchemas.length === 1
+    && nullSchemas.length > 0
+    && nullSchemas.every(schema => Object.keys(schema).every(key => key === "type"))
+  ) {
+    return { ...nonNullSchemas[0], nullable: true };
+  }
+
+  const type = schemas[0]?.type;
+  const sameType = schemas.length > 0 && schemas.every(schema => schema.type === type);
+  const enumOnly = schemas.every(schema => {
+    const allowedKeys = type === undefined ? new Set(["enum"]) : new Set(["type", "enum"]);
+    return Array.isArray(schema.enum) && Object.keys(schema).every(key => allowedKeys.has(key));
+  });
+  if (sameType && enumOnly && type !== "null") {
+    const values = sanitizeEnum(schemas.flatMap(schema => schema.enum as unknown[]));
+    if (values) return { ...(typeof type === "string" ? { type } : {}), enum: values };
+  }
+
+  // CCA's Claude bridge turns typed anyOf branches into an invalid input_schema. Widen only this
+  // node when a union cannot be collapsed losslessly; parent annotations and structure survive.
+  return {};
+}
+
+function sanitizeProperties(
+  value: unknown,
+  defs: Map<string, unknown>,
+  depth: number,
+  refDepth: number,
+): Record<string, Schema> | undefined {
+  if (!isRecord(value)) return undefined;
+  const properties: Record<string, Schema> = Object.create(null) as Record<string, Schema>;
+  for (const [name, schema] of Object.entries(value)) {
+    // Property names form a name bag and must never be interpreted as schema keywords.
+    properties[name] = sanitizeSchema(schema, defs, depth + 1, refDepth, false);
+  }
+  return properties;
+}
+
+function sanitizeSchema(
+  node: unknown,
+  defs: Map<string, unknown>,
+  depth: number,
+  refDepth: number,
+  preserveNullType: boolean,
+): Schema {
+  if (depth >= MAX_SCHEMA_DEPTH || !isRecord(node)) return {};
+
+  if (typeof node.$ref === "string" && refDepth < MAX_DEREF_DEPTH) {
+    const target = resolveRef(node.$ref, defs);
+    if (isRecord(target)) {
+      const merged: Schema = { ...target };
+      for (const [key, value] of Object.entries(node)) {
+        if (key !== "$ref") merged[key] = value;
+      }
+      return sanitizeSchema(merged, defs, depth, refDepth + 1, preserveNullType);
+    }
+  }
+
+  const out: Schema = {};
+  normalizeType(node.type, out, preserveNullType);
+
+  if (typeof node.nullable === "boolean") out.nullable = node.nullable;
+  if (typeof node.description === "string") out.description = node.description;
+  if (typeof node.format === "string") out.format = node.format;
+
+  const enumValues = sanitizeEnum(node.enum ?? (typeof node.const === "string" ? [node.const] : undefined));
+  if (enumValues) out.enum = enumValues;
+
+  const properties = sanitizeProperties(node.properties, defs, depth, refDepth);
+  if (properties) out.properties = properties;
+
+  if (isRecord(node.items)) {
+    out.items = sanitizeSchema(node.items, defs, depth + 1, refDepth, false);
+  }
+
+  if (Array.isArray(node.required)) {
+    out.required = [...new Set(node.required.filter((item): item is string => typeof item === "string"))];
+  }
+
+  if (node.anyOf !== undefined) Object.assign(out, normalizeAnyOf(node.anyOf, defs, depth, refDepth));
+  return out;
+}
+
+export function sanitizeGeminiToolParameters(parameters: unknown): Record<string, unknown> {
+  try {
+    const defs = new Map<string, unknown>();
+    collectDefs(parameters, defs);
+    const root = sanitizeSchema(parameters, defs, 0, 0, false);
+
+    // Function arguments are always an object. Claude additionally rejects root composition and a
+    // missing root type even when those forms are valid general-purpose JSON Schema.
+    root.type = "object";
+    if (!isRecord(root.properties)) root.properties = {};
+    return root;
+  } catch {
+    // Last-resort containment: no third-party schema may break every tool in the request.
+    return { type: "object", properties: {} };
+  }
+}

package/src/adapters/google-truncation.ts

@@ -0,0 +1,13 @@
+import { redactSecretString } from "../lib/redact";
+
+/** Gemini/Vertex finishReason values that mean the turn was cut off, not cleanly stopped. */
+const TRUNCATION_REASONS = new Set(["MAX_TOKENS", "MALFORMED_FUNCTION_CALL"]);
+
+export function isVertexTruncationReason(finishReason: string | undefined): boolean {
+  return finishReason !== undefined && TRUNCATION_REASONS.has(finishReason);
+}
+
+export function vertexTruncationErrorMessage(reason?: string): string {
+  const suffix = reason ? ` (${redactSecretString(reason).slice(0, 160)})` : "";
+  return `Vertex AI response truncated upstream before the turn completed${suffix}`;
+}