@rulemetric/proxy 0.7.21 → 0.7.22

package/addon/providers.py

@@ -52,6 +52,24 @@ def detect_provider(host: str, path: str) -> str | None:
         return "anthropic"
     if host == "generativelanguage.googleapis.com" and ":generateContent" in path:
         return "gemini"
+    # Antigravity / Gemini Code Assist. NOT generativelanguage — the IDE routes
+    # LLM traffic to the internal Cloud Code API at cloudcode-pa.googleapis.com
+    # (canary: daily-cloudcode-pa) with `/v1internal:<method>` paths. Confirmed
+    # live 2026-07-20: 17 intercepted `POST /v1internal:streamGenerateContent?alt=sse`
+    # calls, which also disproves the long-standing "Antigravity bypasses the
+    # proxy over QUIC" theory — the traffic arrives over TCP and is decrypted.
+    #
+    # Matching `:streamGenerateContent` only is deliberate: the other v1internal
+    # methods this host serves (loadCodeAssist, fetchUserInfo,
+    # fetchAvailableModels, cascadeNuxes, onboardUser) are metadata/heartbeat
+    # calls carrying no prompt or model usage, and they fire every 5 minutes.
+    # Matching them would buffer their bodies for nothing.
+    #
+    # Returning a provider here is load-bearing beyond routing: the addon streams
+    # (and therefore never buffers the body of) any flow `_flow_is_parsed()`
+    # rejects, so without this rule the request body is unreadable by design.
+    if "cloudcode-pa.googleapis.com" in host and ":streamGenerateContent" in path:
+        return "gemini_code_assist"
     if "bedrock-runtime" in host and "/converse" in path:
         return "bedrock"
     if host.endswith(".snowflakecomputing.com") and "/api/v2/cortex/inference:complete" in path:
@@ -385,6 +403,46 @@ def parse_gemini(body: dict[str, Any]) -> dict[str, Any]:
     return _finalize(snap)
 
 
+def parse_gemini_code_assist(body: dict[str, Any]) -> dict[str, Any]:
+    """Parse an Antigravity / Gemini Code Assist ``streamGenerateContent`` body.
+
+    cloudcode-pa wraps a standard Gemini request in an envelope::
+
+        {"model": "gemini-3-flash-agent", "project": ..., "requestId": ...,
+         "requestType": ..., "userAgent": ...,
+         "request": {"contents": [...], "systemInstruction": {...},
+                     "generationConfig": {...}, "tools": [...],
+                     "sessionId": ..., "labels": ..., "toolConfig": ...}}
+
+    (envelope confirmed from a live intercepted request, 2026-07-20).
+
+    Two things make this more than a passthrough to :func:`parse_gemini`:
+
+    1. The model id is on the OUTER envelope, not the inner body — parsing the
+       inner body alone yields ``model="unknown"`` and silently destroys every
+       per-model segmented verdict for this harness.
+    2. The provider is reported as ``gemini_code_assist``, NOT ``gemini``. They
+       are different hosts, different envelopes and different harnesses;
+       collapsing them would merge Antigravity usage into direct Gemini API
+       usage in any provider-grouped read.
+    """
+    inner = body.get("request")
+    if not isinstance(inner, dict):
+        inner = {}
+
+    snap = parse_gemini(inner)
+    snap["provider"] = "gemini_code_assist"
+
+    # Outer envelope wins; fall back to the inner body, then parse_gemini's
+    # own "unknown" sentinel (which resolveModelId treats as no-model, so an
+    # unresolved model never becomes a fabricated segment).
+    model = body.get("model") or inner.get("model")
+    if model:
+        snap["model"] = model
+
+    return snap
+
+
 # ---------------------------------------------------------------------------
 # Bedrock
 # ---------------------------------------------------------------------------

package/addon/rulemetric_addon.py

@@ -13,7 +13,15 @@ from datetime import datetime, timezone
 
 from mitmproxy import http
 
-from providers import detect_provider, parse_anthropic, parse_openai, parse_gemini, parse_bedrock, parse_copilot_fim
+from providers import (
+    detect_provider,
+    parse_anthropic,
+    parse_openai,
+    parse_gemini,
+    parse_gemini_code_assist,
+    parse_bedrock,
+    parse_copilot_fim,
+)
 from reporter import report_snapshot, report_event
 from session_linker import find_active_session, find_session_by_external_id
 from sse_parser import parse_streaming_response
@@ -25,6 +33,7 @@ logger = logging.getLogger("rulemetric.addon")
 _NON_OPENAI_PARSERS = {
     "anthropic": parse_anthropic,
     "gemini": parse_gemini,
+    "gemini_code_assist": parse_gemini_code_assist,
     "bedrock": parse_bedrock,
     "github_copilot_fim": parse_copilot_fim,
 }
@@ -58,12 +67,14 @@ _UUID_RE_LITERAL = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
 _PROVIDERS_WITH_AUTO_BOOTSTRAP = frozenset({
     "github_copilot_chat",  # vscode-sessionid header — stable per VS Code window
     "anthropic",            # Claude Code session_id — unique per conversation
+    "gemini_code_assist",   # request.sessionId — per-conversation (Antigravity)
 })
 
 # Maps internal provider name to the `tool` value used in the sessions table.
 _PROVIDER_TO_TOOL = {
     "github_copilot_chat": "vscode_copilot",
     "anthropic": "claude_code",
+    "gemini_code_assist": "antigravity",
 }
 
 
@@ -86,6 +97,8 @@ def _extract_wire_session_id(
       * ``github_copilot_chat``: ``vscode-sessionid`` HEADER (stable per VS
         Code window; one RuleMetric session per VS Code instance — see
         `_PROVIDERS_WITH_AUTO_BOOTSTRAP`).
+      * ``gemini_code_assist``: ``body.request.sessionId`` (Antigravity nests
+        its per-conversation id inside the Cloud Code envelope).
 
     OpenAI/Cursor put a stable user id in ``body.user``; whether it's a
     session id or a long-lived machine id is harness-dependent, so it's an
@@ -113,6 +126,26 @@ def _extract_wire_session_id(
                 return sid
             return None
 
+        if provider == "gemini_code_assist":
+            # Antigravity nests its per-conversation id inside the Cloud Code
+            # envelope: {"model": ..., "request": {"sessionId": ..., ...}}.
+            # UUID-validated like the anthropic path — the id becomes a
+            # registry FILENAME in _ensure_session_for_wire_id, so an
+            # unvalidated value would be a path-traversal vector.
+            #
+            # UNVERIFIED: whether this equals the conversation id the
+            # Antigravity hook registers (_ensure-session.sh). If they differ,
+            # the wire id has no registry file and auto-bootstrap creates a
+            # SECOND session alongside the hook's. The probe logs both so the
+            # next live generation settles it — do not assume equivalence.
+            if not body:
+                return None
+            inner = body.get("request")
+            sid = inner.get("sessionId") if isinstance(inner, dict) else None
+            if isinstance(sid, str) and re.fullmatch(_UUID_RE_LITERAL, sid):
+                return sid
+            return None
+
         if provider == "github_copilot_chat" and headers is not None:
             # mitmproxy.http.Headers supports .get like a dict
             sid = headers.get("vscode-sessionid") if hasattr(headers, "get") else None
@@ -457,7 +490,7 @@ def _parse_response_content(body: dict, provider: str) -> dict:
     # Stop reason — Anthropic and Gemini have unique formats; everything else is OpenAI-compatible
     if provider == "anthropic":
         result["stop_reason"] = body.get("stop_reason")
-    elif provider == "gemini":
+    elif provider in ("gemini", "gemini_code_assist"):
         candidates = body.get("candidates", [])
         if candidates:
             result["stop_reason"] = candidates[0].get("finishReason")
@@ -637,20 +670,55 @@ class RuleMetricAddon:
         # Deliberately placed BEFORE the `flow.request.stream` early-return:
         # generation calls are the ones most likely to be streamed, so a probe
         # after that check would silently skip the exact traffic we need.
-        # Off unless RULEMETRIC_PROXY_DEBUG_CLOUDCODE=1; delete once the parser
-        # lands.
+        # Off unless RULEMETRIC_PROXY_DEBUG_CLOUDCODE=1. The parser has landed,
+        # but this stays: snapshot ATTRIBUTION for this provider is still broken
+        # (the proxy posts to a session id the API 404s on), and this probe is
+        # the only view of the request envelope while that is worked out. Remove
+        # it once Antigravity snapshots persist end to end.
         if os.environ.get("RULEMETRIC_PROXY_DEBUG_CLOUDCODE") == "1":
             try:
                 if "cloudcode-pa.googleapis.com" in flow.request.pretty_host:
                     body_len = 0 if flow.request.stream else len(flow.request.raw_content or b"")
+                    # Structure only — top-level keys and the model id, never
+                    # prompt content. Enough to write the parser against the
+                    # real Cloud Code envelope instead of assuming it matches
+                    # generativelanguage's plain Gemini shape.
+                    shape = "-"
+                    if body_len:
+                        try:
+                            parsed = json.loads(flow.request.get_text() or "{}")
+                            if isinstance(parsed, dict):
+                                keys = sorted(parsed.keys())
+                                model = parsed.get("model")
+                                inner = parsed.get("request")
+                                inner_keys = (
+                                    sorted(inner.keys()) if isinstance(inner, dict) else None
+                                )
+                                # sessionId is logged because attribution now
+                                # keys on it (_extract_wire_session_id). It must
+                                # be compared against the conversation id the
+                                # Antigravity hook registers in
+                                # $TMPDIR/rulemetric/ — if they differ, the
+                                # proxy bootstraps a second session instead of
+                                # joining the hook's. An id, not prompt content.
+                                inner_sid = (
+                                    inner.get("sessionId") if isinstance(inner, dict) else None
+                                )
+                                shape = (
+                                    f"keys={keys} model={model!r} "
+                                    f"request.keys={inner_keys} sessionId={inner_sid!r}"
+                                )
+                        except Exception as exc:
+                            shape = f"<unparsed: {exc}>"
                     logger.warning(
-                        "[cloudcode-probe] %s https://%s%s streamed=%s body_bytes=%d ctype=%s",
+                        "[cloudcode-probe] %s https://%s%s streamed=%s body_bytes=%d ctype=%s %s",
                         flow.request.method,
                         flow.request.pretty_host,
                         flow.request.path,
                         bool(flow.request.stream),
                         body_len,
                         flow.request.headers.get("content-type", "-"),
+                        shape,
                     )
             except Exception as exc:  # never let a probe break capture
                 logger.warning("[cloudcode-probe] failed: %s", exc)

package/addon/session_linker.py

@@ -37,6 +37,11 @@ _PROVIDER_TO_TOOLS: dict[str, list[str]] = {
     "github_copilot_chat": ["vscode_copilot"],
     "github_copilot_fim": ["vscode_copilot"],
     "azure_openai": ["cursor", "vscode_copilot"],
+    # Antigravity / Gemini Code Assist (cloudcode-pa). Without this the linker
+    # falls through to "most recent session", which on a dev machine is the
+    # Claude Code session driving the terminal — silently recording Antigravity
+    # generations against Claude Code and corrupting per-harness comparisons.
+    "gemini_code_assist": ["antigravity"],
 }
 
 
@@ -45,7 +50,32 @@ def _parse_session_file(f: Path, now: float) -> dict[str, str] | None:
 
     Returned dict has keys: session_id, rw_session_id, tool_type.
     """
-    SKIP_SUFFIXES = (".log", ".seq", ".ctxhash", ".pid", ".lock")
+    # Companion files that share the registry directory with real session keys.
+    # A session key file is named for the harness session id and CONTAINS the DB
+    # session id; every entry below is a sidecar written next to it.
+    #
+    # This list is load-bearing, not cosmetic. `.injected-memories` (written by
+    # session-start.sh and REWRITTEN by user-prompt.sh on every prompt) holds one
+    # MEMORY uuid per line. Memory ids and session ids are both bare uuids, so a
+    # marker parsed as a session file hands back a memory id — and because the
+    # marker is rewritten per prompt it is usually the NEWEST file in the
+    # directory, which is exactly what the mtime-descending scan below prefers.
+    # Result: every snapshot for any provider without a wire session id was
+    # posted against a memory id and rejected 404. Observed live 2026-07-20 with
+    # Antigravity (memory dbed4f3d-88ab-4abb-a7e1-71702e8667b6), silently broken
+    # since memory injection shipped.
+    #
+    # When adding a new sidecar anywhere (hooks, proxy, CLI), add its suffix
+    # here in the same change.
+    SKIP_SUFFIXES = (
+        ".log",
+        ".seq",
+        ".ctxhash",
+        ".pid",
+        ".lock",
+        ".sesslock",
+        ".injected-memories",
+    )
 
     if not f.is_file():
         return None
@@ -198,6 +228,39 @@ def find_active_session(provider: str | None = None) -> dict[str, str] | None:
                     )
                     return candidate
 
+            # No session of the expected harness. Do NOT hand this traffic to a
+            # session belonging to a DIFFERENT, positively-identified harness —
+            # that silently files (e.g.) Antigravity generations into a Claude
+            # Code session and corrupts the per-harness comparison this pipeline
+            # exists to make. Observed live 2026-07-20: 2 of 6 Antigravity
+            # snapshots landed on an active Claude Code session because the
+            # Antigravity registry file predated the tool_type line and so could
+            # never match above, leaving a bare mtime race between two live
+            # harnesses.
+            #
+            # This mirrors the wire-id path's existing policy in
+            # rulemetric_addon.py ("drop rather than risk cross-attribution");
+            # that guard only covered providers that expose a wire id.
+            #
+            # Blank tool_type stays eligible: legacy/pre-fix registry files
+            # carry no harness line, and dropping them would lose capture for
+            # every session created before _ensure-session.sh started writing
+            # line 2. Unknown is ambiguous; a known-foreign harness is not.
+            foreign_tools = {
+                t for tools in _PROVIDER_TO_TOOLS.values() for t in tools
+            } - set(preferred_tools)
+            filtered = [
+                c for c in candidates if c.get("tool_type") not in foreign_tools
+            ]
+            if not filtered:
+                logger.warning(
+                    "No session for provider %s (%d candidate(s), all belonging to "
+                    "other harnesses) — dropping rather than cross-attributing",
+                    provider, len(candidates),
+                )
+                return None
+            candidates = filtered
+
     # Fall back to most recent session (candidates are already sorted by mtime desc)
     logger.debug(
         "Using most recent session %s (tool=%s) — no provider-specific match",

package/addon/sse_parser.py

@@ -320,6 +320,10 @@ def aggregate_copilot_fim_sse(events: list[dict[str, Any]]) -> dict[str, Any]:
 _NON_OPENAI_AGGREGATORS = {
     "anthropic": aggregate_anthropic_sse,
     "gemini": aggregate_gemini_sse,
+    # Antigravity/Code Assist responses are Gemini SSE (usageMetadata +
+    # candidates[].finishReason) — same wire shape, different envelope on the
+    # REQUEST side only.
+    "gemini_code_assist": aggregate_gemini_sse,
     "github_copilot_fim": aggregate_copilot_fim_sse,
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/proxy",
-  "version": "0.7.21",
+  "version": "0.7.22",
   "type": "module",
   "publishConfig": {
     "access": "public"