@yansigit/opencodex 2.31.3 → 2.33.0

package/src/responses/parser.ts

@@ -11,7 +11,7 @@ import type {
   OcxToolCall,
   OcxReasoningReplayScopeRef,
 } from "../types";
-import { namespacedToolName, toolChoiceCandidates } from "../types";
+import { createToolChoiceResolver, namespacedToolName } from "../types";
 import { responsesRequestSchema } from "./schema";
 import { providerMetadataFromResponsesFunctionCall } from "./provider-opaque-metadata";
 import { lookupReplayThoughtSignature } from "./thought-signature-replay";
@@ -758,8 +758,9 @@ export function parseRequest(
   const tc = mapToolChoice(data.tool_choice);
   if (tc && typeof tc === "object") {
     const selectors = "allowedTools" in tc ? tc.allowedTools : [tc.name];
+    const resolver = createToolChoiceResolver(mergedTools);
     for (const selector of selectors) {
-      if (toolChoiceCandidates(mergedTools, selector).length > 1) {
+      if (resolver.candidateCount(selector) > 1) {
         throw new Error(`ambiguous tool_choice name: ${selector}`);
       }
     }
@@ -780,6 +781,17 @@ export function parseRequest(
   if (data.frequency_penalty !== undefined) options.frequencyPenalty = data.frequency_penalty;
   if (data.service_tier !== undefined) options.serviceTier = data.service_tier;
   if (data.prompt_cache_key !== undefined) options.promptCacheKey = data.prompt_cache_key;
+  if (data.provider_options?.google) {
+    const google = data.provider_options.google;
+    options.providerOptions = {
+      google: {
+        ...(google.thinking_budget !== undefined ? { thinkingBudget: google.thinking_budget } : {}),
+        ...(google.include_thoughts !== undefined ? { includeThoughts: google.include_thoughts } : {}),
+        ...(google.safety_settings !== undefined ? { safetySettings: google.safety_settings } : {}),
+        ...(google.cached_content !== undefined ? { cachedContent: google.cached_content } : {}),
+      },
+    };
+  }
 
   // Stash the hosted web_search config (if Codex enabled it) so the proxy can run searches via the
   // gpt-mini sidecar for routed providers. buildTools still drops the hosted tool; the sidecar path

package/src/responses/provider-opaque-metadata.ts

@@ -24,11 +24,11 @@ function isObj(value: unknown): value is Record<string, unknown> {
 }
 
 /**
- * Same ceiling the Antigravity replay cache already enforces on a stored signature. An opaque
- * token this large is not a real signature, and accepting it would let a caller push unbounded
+ * Ceiling on stored thought signatures. Accommodates deep thinking models (e.g. Gemini 3.7
+ * Flash up to 64k tokens of reasoning, whose signatures can exceed 100 KiB) while bounding
  * state through history replay.
  */
-const MAX_SIGNATURE_BYTES = 64 * 1024;
+const MAX_SIGNATURE_BYTES = 1024 * 1024;
 
 export function isCarryableSignature(value: unknown): value is string {
   if (typeof value !== "string" || value.length === 0) return false;

package/src/responses/reasoning-replay-cache.ts

@@ -29,6 +29,7 @@ import type {
 const MAX_ENTRIES = 64;
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
+const OPAQUE_BLOB_REJECTION_TTL_MS = 5 * 60 * 1000;
 const replayIdentityKey = randomBytes(32);
 const CREDENTIAL_HEADER_NAMES = new Set([
   "authorization",
@@ -58,10 +59,17 @@ interface ServingIdentityEntry {
   at: number;
 }
 
+interface OpaqueBlobRejectionEntry {
+  bytes: number;
+  at: number;
+}
+
 const entries = new Map<string, CacheEntry>();
 const servingIdentities = new Map<string, ServingIdentityEntry>();
+const opaqueBlobRejections = new Map<string, OpaqueBlobRejectionEntry>();
 let totalBytes = 0;
 let servingIdentityTotalBytes = 0;
+let opaqueBlobRejectionTotalBytes = 0;
 let clockForTests: (() => number) | null = null;
 
 const now = (): number => clockForTests?.() ?? Date.now();
@@ -142,11 +150,31 @@ function servingIdentityFor(
   return { threadId, identity: JSON.stringify(identityTuple) };
 }
 
+function opaqueBlobRejectionKeyFor(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): string | undefined {
+  const current = servingIdentityFor(scope);
+  return current ? JSON.stringify([current.threadId, current.identity]) : undefined;
+}
+
+function deleteOpaqueBlobRejection(key: string): void {
+  const entry = opaqueBlobRejections.get(key);
+  if (!entry) return;
+  opaqueBlobRejections.delete(key);
+  opaqueBlobRejectionTotalBytes -= entry.bytes;
+}
+
+function sweepExpiredOpaqueBlobRejections(at: number): void {
+  for (const [key, entry] of opaqueBlobRejections) {
+    if (at - entry.at >= OPAQUE_BLOB_REJECTION_TTL_MS) deleteOpaqueBlobRejection(key);
+  }
+}
+
 /**
- * Compare this request's route with the last successfully serving route for its client thread.
+ * Compare this request's route with the last successfully serving route for its conversation.
  * A live mismatch means replayed opaque reasoning was minted by another backend and must not be
  * forwarded to this one. Comparison deliberately does not refresh or replace the recorded route:
- * a failed candidate request did not serve the thread.
+ * a failed candidate request did not serve the conversation.
  *
  * Serving provenance uses restart-stable destination and credential dimensions so token
  * generations and other volatile credential material cannot create false route changes. Missing
@@ -164,7 +192,7 @@ export function reasoningReplayServingIdentityChanged(
   return previous !== undefined && previous.identity !== current.identity;
 }
 
-/** Record the route only after it has successfully served the client thread. */
+/** Record the route only after it has successfully served the conversation. */
 export function commitReasoningReplayServingIdentity(
   scope: OcxReasoningReplayScopeRef | undefined,
 ): void {
@@ -200,6 +228,54 @@ export function commitReasoningReplayServingIdentity(
   }
 }
 
+/**
+ * Whether this exact conversation and durable serving identity previously rejected opaque replay.
+ *
+ * The five serving dimensions deliberately match the serving record. Missing durable destination
+ * or credential identity is unknown and never falls back to process-local dimensions. The five
+ * minute TTL is shorter than the serving record's hour: a stale memo silently degrades reasoning,
+ * while expiry costs one visible recovery round trip and can safely re-establish the memo.
+ */
+export function reasoningReplayOpaqueBlobRejectionMemoized(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): boolean {
+  const key = opaqueBlobRejectionKeyFor(scope);
+  if (!key) return false;
+  const at = now();
+  sweepExpiredOpaqueBlobRejections(at);
+  return opaqueBlobRejections.has(key);
+}
+
+/** Record only after a blobless retry succeeded for this durable serving identity. */
+export function rememberReasoningReplayOpaqueBlobRejection(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): void {
+  const key = opaqueBlobRejectionKeyFor(scope);
+  if (!key) return;
+  const bytes = Buffer.byteLength(key, "utf8");
+  if (bytes > MAX_TOTAL_BYTES) return;
+  const at = now();
+  sweepExpiredOpaqueBlobRejections(at);
+  if (opaqueBlobRejections.has(key)) deleteOpaqueBlobRejection(key);
+  opaqueBlobRejections.set(key, { bytes, at });
+  opaqueBlobRejectionTotalBytes += bytes;
+  while (
+    (opaqueBlobRejectionTotalBytes > MAX_TOTAL_BYTES || opaqueBlobRejections.size > MAX_ENTRIES)
+    && opaqueBlobRejections.size > 1
+  ) {
+    let oldestKey: string | undefined;
+    let oldestAt = Infinity;
+    for (const [candidateKey, entry] of opaqueBlobRejections) {
+      if (entry.at < oldestAt) {
+        oldestAt = entry.at;
+        oldestKey = candidateKey;
+      }
+    }
+    if (oldestKey === undefined) break;
+    deleteOpaqueBlobRejection(oldestKey);
+  }
+}
+
 function processLocalIdentity(domain: string, material: string): string {
   return createHmac("sha256", replayIdentityKey)
     .update(domain)
@@ -420,7 +496,9 @@ export function peekReasoningForCall(
 export function clearReasoningReplayCacheForTests(clock?: (() => number) | null): void {
   entries.clear();
   servingIdentities.clear();
+  opaqueBlobRejections.clear();
   totalBytes = 0;
   servingIdentityTotalBytes = 0;
+  opaqueBlobRejectionTotalBytes = 0;
   clockForTests = clock ?? null;
 }

package/src/responses/schema.ts

@@ -134,6 +134,42 @@ export const reasoningConfigSchema = z.object({
   summary: z.enum(["auto", "concise", "detailed", "none"]).optional(),
 });
 
+const googleSafetyCategorySchema = z.enum([
+  "HARM_CATEGORY_HATE_SPEECH",
+  "HARM_CATEGORY_SEXUALLY_EXPLICIT",
+  "HARM_CATEGORY_DANGEROUS_CONTENT",
+  "HARM_CATEGORY_HARASSMENT",
+  "HARM_CATEGORY_CIVIC_INTEGRITY",
+  "HARM_CATEGORY_JAILBREAK",
+]);
+const googleSafetyThresholdSchema = z.enum([
+  "HARM_BLOCK_THRESHOLD_UNSPECIFIED",
+  "BLOCK_LOW_AND_ABOVE",
+  "BLOCK_MEDIUM_AND_ABOVE",
+  "BLOCK_ONLY_HIGH",
+  "BLOCK_NONE",
+  "OFF",
+]);
+const googleSafetySettingSchema = z.object({
+  category: googleSafetyCategorySchema,
+  threshold: googleSafetyThresholdSchema,
+}).strict();
+const googleProviderOptionsSchema = z.object({
+  thinking_budget: z.number().safe().int().gte(-1).optional(),
+  include_thoughts: z.boolean().optional(),
+  safety_settings: z.array(googleSafetySettingSchema).max(16).superRefine((settings, ctx) => {
+    const categories = new Set(settings.map(setting => setting.category));
+    if (categories.size !== settings.length) {
+      ctx.addIssue({ code: "custom", message: "safety_settings categories must be unique" });
+    }
+  }).optional(),
+  cached_content: z.string().regex(
+    /^(?:cachedContents\/[^/?#\s]+|projects\/[^/?#\s]+\/locations\/[^/?#\s]+\/cachedContents\/[^/?#\s]+)$/,
+    "cached_content must be a valid Google cached content resource name",
+  ).optional(),
+}).strict();
+const providerOptionsSchema = z.object({ google: googleProviderOptionsSchema.optional() }).strict();
+
 export const stopSchema = z.union([z.string(), z.array(z.string()), z.null()]);
 
 export const responsesRequestSchema = z.object({
@@ -162,4 +198,5 @@ export const responsesRequestSchema = z.object({
   prompt: z.unknown().optional(),
   text: z.unknown().optional(),
   truncation: z.unknown().optional(),
+  provider_options: providerOptionsSchema.optional(),
 });

package/src/responses/state.ts

@@ -18,6 +18,12 @@ import {
 const MAX_STORED_RESPONSES = 1_000;
 const RESPONSE_TTL_MS = 60 * 60 * 1_000;
 const SNAPSHOT_DEBOUNCE_MS = 2_000;
+/** Snapshot size below which the debounce stays at its base value. */
+const SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES = 1 * 1024 * 1024;
+/** Ceiling for the stretched debounce. Continuation state is only read after a
+ *  restart, and a graceful shutdown flushes, so the exposure a longer debounce adds
+ *  is bounded by a hard kill — paid against rewriting the whole snapshot every 2 s. */
+const SNAPSHOT_DEBOUNCE_MAX_MS = 30_000;
 /** In-memory high-water byte cap across all entries. Forced store:false retention (kiro/cursor
  * continuation chains) stores the full expanded input each turn — ~quadratic bytes per chain —
  * so a count cap alone cannot bound memory. Oldest-first eviction applies past this mark. */
@@ -90,6 +96,43 @@ let oldestResidentId: string | undefined;
 let oldestResidentAt: number | null = null;
 let byteCapOverride: number | null = null;
 let stateRevision = 0;
+/** Byte length and digest of the last snapshot actually written, for the
+ *  identical-payload skip and the size-scaled debounce. The payload itself is not
+ *  retained: at the 24 MiB bound that would double the snapshot's memory cost. */
+let lastSnapshotBytes = 0;
+let lastSnapshotDigest: string | null = null;
+// The resolved file the digest above describes. Keeping it means a config-dir
+// change or a retargeted symlink is a miss rather than a false "unchanged".
+let lastSnapshotTarget: string | null = null;
+
+/**
+ * Is the snapshot on disk still byte-for-byte what we last wrote?
+ *
+ * The cached digest proves what this process wrote, not what is there now. Size is
+ * checked first so the common mismatch costs a `stat`, and the content comparison
+ * only runs when the size already agrees. Any read failure answers "no" and the
+ * caller rewrites — the safe direction.
+ */
+async function snapshotOnDiskMatches(path: string, payload: string, payloadBytes: number): Promise<boolean> {
+  try {
+    const file = Bun.file(path);
+    if (file.size !== payloadBytes) return false;
+    if (await file.text() !== payload) return false;
+    // Content matching is not the whole invariant. This file holds persisted request
+    // and response bodies, and `atomicWriteFileAsync` writes it owner-only; the
+    // unconditional rewrite used to restore that on every mutation. Skipping without
+    // checking would let a broadened mode persist indefinitely, so treat a widened
+    // file as "does not match" and let the caller rewrite it through the hardening
+    // path. POSIX only — Windows ACLs are re-applied by that same write path.
+    if (process.platform !== "win32") {
+      const mode = statSync(path).mode & 0o777;
+      if (mode !== 0o600) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
 const spillCounters = { writes: 0, writeFailures: 0, readFailures: 0 };
 /**
  * Admission-boundary observability (test-visible). directSpills: oversized
@@ -788,9 +831,38 @@ async function writeBoundedSnapshot(path: string): Promise<SnapshotWriteOutcome>
         entries.push(persistEntry);
       }
       entries.reverse();
-      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-      try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
-      await atomicWriteFileAsync(path, JSON.stringify({ version: 2, states: entries }));
+      const payload = JSON.stringify({ version: 2, states: entries });
+      const payloadBytes = Buffer.byteLength(payload, "utf8");
+      const payloadDigest = Bun.hash(payload).toString(36);
+      // A mutation does not always change what gets persisted: entries past the
+      // per-entry or total byte bound are dropped from the selection, and spill
+      // demotion moves bytes out of it. Re-writing a byte-identical 24 MiB file
+      // buys nothing, so compare first — but the cached digest describes what THIS
+      // process last wrote, which is not the same claim as "that is what is on disk
+      // now". A second proxy sharing the home, or anything that rewrites the file
+      // in place, leaves the digest describing bytes that are gone. Before every
+      // release-of-a-write, the previous behaviour rewrote unconditionally and so
+      // repaired that silently; skipping without checking would turn a repaired
+      // snapshot into a lost one at the next restart.
+      //
+      // Verify against the file itself, keyed to the resolved target so a retargeted
+      // symlink is also a miss. Reading back a matching-size file costs far less
+      // than the atomic replace it avoids, and only happens when the digest already
+      // matched — the amplification this fixes is the repeated WRITE, not the read.
+      const unchanged = lastSnapshotDigest !== null
+        && payloadDigest === lastSnapshotDigest
+        && payloadBytes === lastSnapshotBytes
+        && lastSnapshotTarget === resolveWriteTarget(path)
+        && existsSync(path)
+        && await snapshotOnDiskMatches(path, payload, payloadBytes);
+      if (!unchanged) {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
+        await atomicWriteFileAsync(path, payload);
+        lastSnapshotDigest = payloadDigest;
+        lastSnapshotBytes = payloadBytes;
+        lastSnapshotTarget = resolveWriteTarget(path);
+      }
       persistAttemptHookForTests?.();
       if (revision === stateRevision) return "stable";
     }
@@ -809,11 +881,26 @@ function drainPendingSpillUnlinks(): void {
   }
 }
 
+/**
+ * Debounce scaled by the size of the last snapshot written.
+ *
+ * The whole snapshot is re-serialized and atomically replaced on every flush, so at
+ * the 24 MiB bound a fixed 2 s debounce is up to ~12 MB/s of write amplification for
+ * state nothing reads until the next start (#2460). Small snapshots keep the base
+ * cadence; the stretch is linear in size and clamped, so the write rate is roughly
+ * flat instead of growing with the file.
+ */
+function snapshotDebounceMs(): number {
+  if (lastSnapshotBytes <= SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES) return SNAPSHOT_DEBOUNCE_MS;
+  const scaled = Math.round(SNAPSHOT_DEBOUNCE_MS * (lastSnapshotBytes / SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES));
+  return Math.min(scaled, SNAPSHOT_DEBOUNCE_MAX_MS);
+}
+
 function schedulePersistAt(path: string, replace = false): void {
   if (persistTimer && !replace) return;
   if (persistTimer) clearTimeout(persistTimer);
   pendingPersistPath = path;
-  persistTimer = setTimeout(() => { void persistNow(path); }, SNAPSHOT_DEBOUNCE_MS);
+  persistTimer = setTimeout(() => { void persistNow(path); }, snapshotDebounceMs());
   (persistTimer as { unref?: () => void }).unref?.();
 }
 
@@ -1418,6 +1505,9 @@ export function clearResponseStateMemoryForTests(): void {
   replayScopeMismatchDrops = 0;
   replayOverlapSkips = 0;
   persistAttemptHookForTests = null;
+  lastSnapshotBytes = 0;
+  lastSnapshotDigest = null;
+  lastSnapshotTarget = null;
   loaded = false;
 }
 

package/src/router.ts

@@ -9,6 +9,7 @@ import {
 } from "./combos";
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
+import { isAzureIdentityProvider } from "./config/provider-validation";
 import { resolveEnvValue } from "./config";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { redactSecretString, redactUrlForLog } from "./lib/redact";
@@ -271,10 +272,15 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
   if (!registryEntry || !providerMatchesRegistryTransportWithStaticGuards(providerName, provider)) {
     assertProviderDestinationAllowed(providerName, provider);
-    return { ...provider, apiKey: usableResolvedApiKey(provider.apiKey) };
+    return {
+      ...provider,
+      apiKey: usableResolvedApiKey(provider.apiKey),
+      ...(isAzureIdentityProvider(provider) ? { liveModels: false } : {}),
+    };
   }
   const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
-  const staticModelCatalog = !providerSupportsLiveModelDiscovery(providerName, provider);
+  const staticModelCatalog = isAzureIdentityProvider(provider)
+    || !providerSupportsLiveModelDiscovery(providerName, provider);
   const repairLegacyMimoFreeAuth = providerName === "mimo-free"
     && staticModelCatalog
     && (provider.authMode === undefined || provider.authMode === "local");

package/src/server/auth-cors.ts

@@ -1,31 +1,37 @@
 import { timingSafeEqual } from "node:crypto";
 import { formatErrorResponse } from "../bridge";
+import {
+  codexAutoStartEnabled,
+  modelPreferHostedToolsConfigError,
+  providerModelCostsConfigError,
+  requestPacingConfigError,
+  retryOn429PolicyConfigError,
+  sanitizeModelCostsForDisplay,
+} from "../config";
 import {
   apiKeyTransportConfigError,
+  azureCredentialConfigError,
   booleanRecordConfigError,
   modelAdapterRecordConfigError,
-  modelPreferHostedToolsConfigError,
-  codexAutoStartEnabled,
   nonBlankStringArrayConfigError,
   positiveIntegerConfigError,
   positiveIntegerRecordConfigError,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  providerModelCostsConfigError,
   reasoningSummaryDeliveryRecordConfigError,
-  retryOn429PolicyConfigError,
-  requestPacingConfigError,
-  sanitizeModelCostsForDisplay,
   upstreamHttpVersionConfigError,
-} from "../config";
+  isAzureIdentityProvider,
+} from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
+import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
 import { googleVertexLocationConfigError } from "../providers/google-vertex-location";
 import { xaiResponsesOptInState } from "../providers/xai-responses-opt-in";
+import { antigravityOAuthDestinationConfigError, getProviderTlsProfileStatus, providerTlsProfileConfigError } from "../lib/provider-tls-profile";
 
 let _corsOrigin = "http://localhost:10100";
 export function setCorsOrigin(port: number): void { _corsOrigin = `http://localhost:${port}`; }
@@ -563,6 +569,8 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     if (contextOverlayError) return contextOverlayError;
     delete canonicalCandidate.contextWindow;
     delete canonicalCandidate.modelContextWindows;
+    // User-owned soft compaction policy; it does not alter the canonical transport seed.
+    delete canonicalCandidate.modelAutoCompactTokenLimits;
     const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
@@ -571,6 +579,12 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     return `provider ${name} must not include codexAccountMode`;
   }
   const typed = provider as unknown as OcxProviderConfig;
+  const tlsProfileError = providerTlsProfileConfigError(name, typed);
+  if (tlsProfileError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${tlsProfileError}`;
+  }
+  const antigravityError = antigravityOAuthDestinationConfigError(name, typed);
+  if (antigravityError) return `provider ${name} ${antigravityError}`;
   const baseUrlError = providerBaseUrlConfigError(typed.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
   if (effectiveGoogleMode(name, typed) === "vertex" && typed.location !== undefined) {
@@ -603,8 +617,17 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   }
   const apiKeyTransportError = apiKeyTransportConfigError(typed);
   if (apiKeyTransportError) return `provider ${name} ${apiKeyTransportError}`;
+  const azureCredentialError = azureCredentialConfigError(raw);
+  if (azureCredentialError) return `provider ${JSON.stringify(redactSecretString(name))} ${azureCredentialError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
   if (maxInputError) return `provider ${name} ${maxInputError}`;
+  const autoCompactError = modelAutoCompactTokenLimitsConfigError(
+    raw.modelAutoCompactTokenLimits,
+    { requireNativeIds: name === "openai" },
+  );
+  if (autoCompactError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${autoCompactError}`;
+  }
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
   const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
@@ -687,6 +710,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       adapter: provider.adapter,
       baseUrl: publicProviderBaseUrl(provider.baseUrl),
       hasApiKey: !!provider.apiKey,
+      hasAzureCredential: isAzureIdentityProvider(provider),
       hasHeaders: !!provider.headers && Object.keys(provider.headers).length > 0,
     };
     if (name === "xai") {
@@ -702,9 +726,11 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "freeTier",
       "liveModels",
       "requestPacing",
+      "tlsProfile",
       "models",
       "contextWindow",
       "modelContextWindows",
+      "modelAutoCompactTokenLimits",
       "defaultMaxOutputTokens",
       "modelMaxOutputTokens",
       "openRouterRouting",
@@ -726,6 +752,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
+    dto.tlsProfileStatus = provider.tlsProfile === undefined ? "disabled" : getProviderTlsProfileStatus(name, provider);
     const modelCosts = sanitizeModelCostsForDisplay(provider.modelCosts);
     if (modelCosts) dto.modelCosts = modelCosts;
     // Resolve the note by DESTINATION, not by name. A preset saved under a custom name is
@@ -746,6 +773,9 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     defaultProvider: config.defaultProvider,
     codexAutoStart: codexAutoStartEnabled(config),
     websockets: config.websockets,
+    // The GUI's browser-open toggle reads and writes this; absent means the
+    // historical auto-open behavior.
+    oauthOpenBrowser: config.oauthOpenBrowser !== false,
     providers,
   };
 }

package/src/server/images.ts

@@ -33,7 +33,9 @@ import { readJsonRequestBody } from "./request-decompress";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
-import { getValidAccessToken, getOAuthCredentialProjectId } from "../oauth/index";
+import { getValidAccessToken, getOAuthCredentialProjectId, getValidAccessTokenSnapshot, type OAuthAccessSnapshot } from "../oauth/index";
+import { isCanonicalAntigravityUrl, providerTlsFetch } from "../lib/provider-tls-profile";
+import { redactErrorMessage } from "../lib/redact";
 import { safeAntigravityHttpErrorMessage } from "../adapters/google-errors";
 import { sanitizeUpstreamErrorText } from "../adapters/upstream-http-error";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
@@ -156,6 +158,9 @@ async function tryCcaImageGeneration(
   if (endpoint !== "generations") return undefined;
   const provider = config.providers?.["google-antigravity"];
   if (!provider || provider.disabled) return undefined;
+  if (provider.baseUrl && !isCanonicalAntigravityUrl(provider.baseUrl)) {
+    return formatErrorResponse(400, "invalid_request_error", "google-antigravity requires a canonical destination");
+  }
 
   const prompt = (body as { prompt?: unknown })?.prompt;
   if (typeof prompt !== "string" || !prompt.trim()) {
@@ -174,36 +179,25 @@ async function tryCcaImageGeneration(
   // OAuth token refresh and project discovery, not just the upstream fetch.
   const timeoutMs = config.images?.timeoutMs ?? IMAGES_UPSTREAM_TIMEOUT_MS;
   const linkedSignal = signalWithTimeout(timeoutMs, signal);
-  let token: string;
+  let snapshot: OAuthAccessSnapshot;
   try {
-    // Race the OAuth refresh against the deadline signal. getValidAccessToken
-    // chains through 4 layers (resolveAccessSnapshotForAccount →
-    // refreshAndPersistAccessToken → refreshGenericAccountWithLock →
-    // def.refresh()) that do HTTP calls without accepting a signal. Rather than
-    // threading signal through the entire chain, race the whole call against
-    // linkedSignal: when the signal aborts we stop awaiting and surface the
-    // cancellation immediately instead of hanging on the refresh HTTP call.
-    token = await abortableRace(getValidAccessToken("google-antigravity"), linkedSignal.signal);
+    snapshot = await abortableRace(getValidAccessTokenSnapshot("google-antigravity"), linkedSignal.signal);
   } catch (err) {
     linkedSignal.cleanup();
-    // abortableRace rejects immediately when the signal fires, so client
-    // cancellation and deadline expiry surface here. Parent abort propagates
-    // into the linked signal, so check parent first (499) before the linked
-    // signal (504).
     if (signal.aborted) {
       return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
     }
     if (linkedSignal.signal.aborted) {
       return formatErrorResponse(504, "upstream_error", "CCA image generation timed out during authentication");
     }
-    // Missing/revoked credential → 401 (re-login required); transient refresh/network → 502.
     const errName = err instanceof Error ? err.name : "";
     if (errName === "OAuthLoginRequiredError") {
       return formatErrorResponse(401, "invalid_request_error", "Google Antigravity login required: run 'ocx login google-antigravity'");
     }
     return formatErrorResponse(502, "upstream_error", "CCA image generation failed: OAuth token refresh failed");
   }
-  const project = getOAuthCredentialProjectId("google-antigravity");
+  const token = snapshot.accessToken;
+  const project = snapshot.projectId;
   if (!project) {
     linkedSignal.cleanup();
     return formatErrorResponse(
@@ -234,10 +228,8 @@ async function tryCcaImageGeneration(
   let upstream: Response | undefined;
   try {
     try {
-      // Image generation is a paid, non-idempotent POST. A transport failure is
-      // ambiguous: the upstream may have accepted the request before the
-      // connection failed, so never replay it on a peer host.
-      upstream = await fetch(`${baseUrl}/v1internal:generateContent`, {
+      const executor = providerTlsFetch("google-antigravity", provider, globalThis.fetch);
+      upstream = await executor(`${baseUrl}/v1internal:generateContent`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -249,23 +241,15 @@ async function tryCcaImageGeneration(
       });
     } catch (err) {
       if (signal.aborted) return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
+      const rawMsg = err instanceof Error ? err.message : String(err);
+      const safeMsg = redactErrorMessage(sanitizeUpstreamErrorText(rawMsg));
       if (err instanceof Error && err.name === "TimeoutError") {
-        return ccaAmbiguousImageTransportError("upstream request timed out");
+        return formatErrorResponse(504, "upstream_error", `CCA image generation timed out: ${safeMsg}`);
       }
-      // Network/DNS/runtime errors may embed the request URL or headers verbatim
-      // (e.g. "fetch failed: https://…/v1internal:generateContent"). The token
-      // lives in an Authorization header, not in the URL, but sanitize defensively
-      // so no upstream-rejected credential or query param can reach the client,
-      // and strip the internal base URL host from the surfaced message.
-      // 400, not 5xx: the POST is paid and non-idempotent. Codex retries every
-      // 5xx up to 5 attempts, which would duplicate generation after an ambiguous
-      // transport failure (the upstream may already have accepted the request).
-      const rawMsg = err instanceof Error ? err.message : String(err);
-      const safeMsg = sanitizeUpstreamErrorText(rawMsg).replace(
-        /https?:\/\/[^\s"'<>]+/gi,
-        "[upstream-url]",
-      );
-      return ccaAmbiguousImageTransportError(safeMsg);
+      if (provider.tlsProfile === "antigravity-browser") {
+        return formatErrorResponse(502, "upstream_error", `CCA image generation failed: ${safeMsg}`);
+      }
+      return ccaAmbiguousImageTransportError(safeMsg.replace(/https?:\/\/[^\s"'<>]+/gi, "[upstream-url]"));
     }
 
     // Stream the upstream body with a bounded reader so an oversized or malicious