@yansigit/opencodex 2.32.0 → 2.33.0

package/src/providers/xai-transport.ts

@@ -4,6 +4,27 @@ import { resolveGithubCopilotTransport } from "./github-copilot-transport";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
+/** The two hosts that serve xAI's Responses API: the public API and the Grok CLI proxy. */
+const XAI_RESPONSES_HOSTS = new Set(["api.x.ai", "cli-chat-proxy.grok.com"]);
+
+/**
+ * True when this provider's Responses traffic terminates at xAI itself.
+ *
+ * Probed 2026-08-22 one field per request: the two hosts accept and refuse exactly the same
+ * web_search fields, so they are one dialect rather than two. Matching is exact-host over
+ * https, which keeps lookalikes (`api.x.ai.evil.test`) and nonstandard ports out.
+ */
+export function isXaiResponsesDestination(provider: Pick<OcxProviderConfig, "baseUrl">): boolean {
+  try {
+    const url = new URL(provider.baseUrl);
+    return url.protocol === "https:"
+      && XAI_RESPONSES_HOSTS.has(url.hostname.toLowerCase())
+      && (url.port === "" || url.port === "443");
+  } catch {
+    return false;
+  }
+}
+
 export const XAI_GROK_COMPATIBILITY = {
   version: "0.2.93",
   userAgent: "opencodex-grok/0.2.93",

package/src/responses/google-provider-options.ts

@@ -0,0 +1,36 @@
+import { effectiveGoogleMode } from "../providers/registry";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+
+const AI_STUDIO_CACHED_CONTENT = /^cachedContents\/[^/?#\s]+$/;
+const VERTEX_CACHED_CONTENT = /^projects\/[^/?#\s]+\/locations\/[^/?#\s]+\/cachedContents\/[^/?#\s]+$/;
+
+export function googleProviderOptionsRouteError(
+  parsed: Pick<OcxParsedRequest, "options">,
+  route: {
+    providerName: string;
+    provider: OcxProviderConfig;
+    adapterName: string;
+  },
+): string | undefined {
+  if (!parsed.options.providerOptions?.google) return undefined;
+  const mode = effectiveGoogleMode(route.providerName, route.provider);
+  if (mode === "cloud-code-assist") {
+    return "provider_options.google is not supported on Google Cloud Code Assist routes";
+  }
+  if (route.adapterName !== "google" || (mode !== "ai-studio" && mode !== "vertex")) {
+    return "provider_options.google is supported only on Google AI Studio or Vertex routes";
+  }
+  if (mode === "ai-studio") {
+    const cachedContent = parsed.options.providerOptions.google.cachedContent;
+    if (cachedContent && VERTEX_CACHED_CONTENT.test(cachedContent)) {
+      return "provider_options.google.cached_content must use cachedContents/{id} on Google AI Studio routes";
+    }
+  }
+  if (mode === "vertex") {
+    const cachedContent = parsed.options.providerOptions.google.cachedContent;
+    if (cachedContent && AI_STUDIO_CACHED_CONTENT.test(cachedContent)) {
+      return "provider_options.google.cached_content must use projects/{project}/locations/{location}/cachedContents/{id} on Vertex routes";
+    }
+  }
+  return undefined;
+}

package/src/responses/namespace-tool-compat.ts

@@ -4,6 +4,14 @@ import { collectResponsesToolGroups } from "./tool-groups";
 export interface RoutedNamespaceToolIdentity {
   namespace: string;
   name: string;
+  /**
+   * The kind the tool was DECLARED as. Restoration and `tool_choice` matching both
+   * need it: a wire name identifies which tool, not which kind of call may carry it,
+   * so without this a tool declared `function` could be selected by a `custom`
+   * selector and come back as a `custom_tool_call` — the same name/kind mismatch
+   * that motivated narrowing the alias map in the first place.
+   */
+  kind: "function" | "custom";
 }
 
 export type RoutedNamespaceToolAliases = ReadonlyMap<string, RoutedNamespaceToolIdentity>;
@@ -138,7 +146,10 @@ function buildRewritePlan(groups: readonly unknown[][]): NamespaceRewritePlan {
         addSelector(selectors, `${parsed.namespace}.${childName}`, wireName);
         addSelector(selectors, childName, wireName);
         if (parsed.namespace !== BUILTIN_FUNCTIONS_NAMESPACE) {
-          aliases.set(wireName, { namespace: parsed.namespace, name: childName });
+          // A child declared `custom` stays custom; everything else lowers to a
+          // function, which is how `buildTools` flattens it upstream.
+          const kind = child.type === "custom" ? "custom" : "function";
+          aliases.set(wireName, { namespace: parsed.namespace, name: childName, kind });
         }
       }
     }
@@ -206,18 +217,34 @@ function rewriteToolList(
  * the failure this layer exists to prevent, and this layer's own response restoration is what put
  * the key on the item.
  */
+/**
+ * A selector's `namespace` is either absent — meaning "unqualified, resolve the bare
+ * name" — or a string naming the group. A present-but-non-string value is neither, and
+ * a malformed selector must not authorize anything: not through the unqualified
+ * fallback, and not by happening to carry an already-flattened wire name, which would
+ * otherwise match the alias map exactly and arm it anyway.
+ */
+function hasMalformedNamespace(value: Record<string, unknown>): boolean {
+  return "namespace" in value && typeof value.namespace !== "string";
+}
+
 function rewriteNamedSelector(
   value: unknown,
   plan: NamespaceRewritePlan,
   bareFallback: boolean,
 ): unknown {
   if (!isPlainObject(value) || typeof value.name !== "string") return value;
-  if (typeof value.namespace !== "string") {
+  // Malformed: hand it back untouched so no rewrite occurs. Authorization rejects it
+  // separately — returning it unchanged is not by itself enough, because the name it
+  // carries may already BE a wire name.
+  if (hasMalformedNamespace(value)) return value;
+  const namespace = value.namespace;
+  if (typeof namespace !== "string") {
     if (!bareFallback) return value;
     const wireName = plan.selectors.get(value.name) ?? undefined;
     return wireName === undefined || wireName === value.name ? value : { ...value, name: wireName };
   }
-  const { namespace, ...rest } = value;
+  const { namespace: _dropped, ...rest } = value;
   const wireName = plan.identities.get(loweredIdentity(namespace, value.name))
     ?? loweredWireName(namespace, value.name);
   return { ...rest, name: wireName };
@@ -239,6 +266,59 @@ function rewriteToolChoice(value: unknown, plan: NamespaceRewritePlan): unknown
   return changed ? { ...value, tools } : value;
 }
 
+/**
+ * Keep response restoration inside the caller's per-turn tool authorization boundary. The
+ * upstream sees every flattened declaration even when `tool_choice` narrows the tools it may call,
+ * so its output cannot be trusted merely because a wire name appeared in that catalog.
+ */
+function authorizedAliases(
+  aliases: Map<string, RoutedNamespaceToolIdentity>,
+  toolChoice: unknown,
+): Map<string, RoutedNamespaceToolIdentity> {
+  if (toolChoice === undefined || toolChoice === "auto" || toolChoice === "required") return aliases;
+  if (toolChoice === "none" || !isPlainObject(toolChoice)) return new Map();
+
+  // name -> the kind the selector claimed. A selector authorizes a tool only when it
+  // names it AND agrees about what kind of tool it is.
+  let authorized: Map<string, "function" | "custom">;
+  if (
+    (toolChoice.type === "function" || toolChoice.type === "custom")
+    && typeof toolChoice.name === "string"
+  ) {
+    // A malformed namespace makes the whole selector untrustworthy, even when its
+    // name is already a flattened wire name that would match the alias map exactly.
+    if (hasMalformedNamespace(toolChoice)) return new Map();
+    authorized = new Map([[toolChoice.name, toolChoice.type]]);
+  } else if (toolChoice.type === "allowed_tools" && Array.isArray(toolChoice.tools)) {
+    authorized = new Map();
+    for (const tool of toolChoice.tools) {
+      // Match the top-level branch above: only a function/custom selector can
+      // authorize a client namespace call. `allowed_tools` entries are typed
+      // `{type: string}` by the schema, so the accepted set is open-ended and
+      // an allowlist is the only closure that also covers kinds added later.
+      // Without this, `{type: "file_search", name: "<wire-name>"}` keeps the
+      // alias, and an upstream `function_call` carrying that name is restored
+      // into a namespace call the caller never permitted.
+      if (!isPlainObject(tool)) continue;
+      if (tool.type !== "function" && tool.type !== "custom") continue;
+      if (typeof tool.name !== "string") continue;
+      if (hasMalformedNamespace(tool)) continue;
+      authorized.set(tool.name, tool.type);
+    }
+  } else {
+    // An explicit selector for another tool kind does not authorize a client namespace call.
+    return new Map();
+  }
+
+  // The kind must agree too. A wire name says WHICH tool, not what kind of call may
+  // carry it, so a `custom` selector naming a tool declared `function` is the same
+  // name/kind mismatch as a `file_search` selector naming it — narrower, but the
+  // same class, and `allowed_tools[].type` accepts any string so both are reachable.
+  return new Map(
+    [...aliases].filter(([wireName, identity]) => authorized.get(wireName) === identity.kind),
+  );
+}
+
 function rewriteInputItem(item: unknown, plan: NamespaceRewritePlan, emitted: Set<string>): unknown {
   if (!isPlainObject(item)) return item;
   if (item.type === "additional_tools" && Array.isArray(item.tools)) {
@@ -292,7 +372,7 @@ export function rewriteRoutedNamespaceToolsForUpstream(body: unknown): {
       ...(input !== body.input ? { input } : {}),
       ...(toolChoice !== body.tool_choice ? { tool_choice: toolChoice } : {}),
     },
-    aliases: plan.aliases,
+    aliases: authorizedAliases(plan.aliases, toolChoice),
   };
 }
 

package/src/responses/parser.ts

@@ -781,6 +781,17 @@ export function parseRequest(
   if (data.frequency_penalty !== undefined) options.frequencyPenalty = data.frequency_penalty;
   if (data.service_tier !== undefined) options.serviceTier = data.service_tier;
   if (data.prompt_cache_key !== undefined) options.promptCacheKey = data.prompt_cache_key;
+  if (data.provider_options?.google) {
+    const google = data.provider_options.google;
+    options.providerOptions = {
+      google: {
+        ...(google.thinking_budget !== undefined ? { thinkingBudget: google.thinking_budget } : {}),
+        ...(google.include_thoughts !== undefined ? { includeThoughts: google.include_thoughts } : {}),
+        ...(google.safety_settings !== undefined ? { safetySettings: google.safety_settings } : {}),
+        ...(google.cached_content !== undefined ? { cachedContent: google.cached_content } : {}),
+      },
+    };
+  }
 
   // Stash the hosted web_search config (if Codex enabled it) so the proxy can run searches via the
   // gpt-mini sidecar for routed providers. buildTools still drops the hosted tool; the sidecar path

package/src/responses/provider-opaque-metadata.ts

@@ -24,11 +24,11 @@ function isObj(value: unknown): value is Record<string, unknown> {
 }
 
 /**
- * Same ceiling the Antigravity replay cache already enforces on a stored signature. An opaque
- * token this large is not a real signature, and accepting it would let a caller push unbounded
+ * Ceiling on stored thought signatures. Accommodates deep thinking models (e.g. Gemini 3.7
+ * Flash up to 64k tokens of reasoning, whose signatures can exceed 100 KiB) while bounding
  * state through history replay.
  */
-const MAX_SIGNATURE_BYTES = 64 * 1024;
+const MAX_SIGNATURE_BYTES = 1024 * 1024;
 
 export function isCarryableSignature(value: unknown): value is string {
   if (typeof value !== "string" || value.length === 0) return false;

package/src/responses/schema.ts

@@ -134,6 +134,42 @@ export const reasoningConfigSchema = z.object({
   summary: z.enum(["auto", "concise", "detailed", "none"]).optional(),
 });
 
+const googleSafetyCategorySchema = z.enum([
+  "HARM_CATEGORY_HATE_SPEECH",
+  "HARM_CATEGORY_SEXUALLY_EXPLICIT",
+  "HARM_CATEGORY_DANGEROUS_CONTENT",
+  "HARM_CATEGORY_HARASSMENT",
+  "HARM_CATEGORY_CIVIC_INTEGRITY",
+  "HARM_CATEGORY_JAILBREAK",
+]);
+const googleSafetyThresholdSchema = z.enum([
+  "HARM_BLOCK_THRESHOLD_UNSPECIFIED",
+  "BLOCK_LOW_AND_ABOVE",
+  "BLOCK_MEDIUM_AND_ABOVE",
+  "BLOCK_ONLY_HIGH",
+  "BLOCK_NONE",
+  "OFF",
+]);
+const googleSafetySettingSchema = z.object({
+  category: googleSafetyCategorySchema,
+  threshold: googleSafetyThresholdSchema,
+}).strict();
+const googleProviderOptionsSchema = z.object({
+  thinking_budget: z.number().safe().int().gte(-1).optional(),
+  include_thoughts: z.boolean().optional(),
+  safety_settings: z.array(googleSafetySettingSchema).max(16).superRefine((settings, ctx) => {
+    const categories = new Set(settings.map(setting => setting.category));
+    if (categories.size !== settings.length) {
+      ctx.addIssue({ code: "custom", message: "safety_settings categories must be unique" });
+    }
+  }).optional(),
+  cached_content: z.string().regex(
+    /^(?:cachedContents\/[^/?#\s]+|projects\/[^/?#\s]+\/locations\/[^/?#\s]+\/cachedContents\/[^/?#\s]+)$/,
+    "cached_content must be a valid Google cached content resource name",
+  ).optional(),
+}).strict();
+const providerOptionsSchema = z.object({ google: googleProviderOptionsSchema.optional() }).strict();
+
 export const stopSchema = z.union([z.string(), z.array(z.string()), z.null()]);
 
 export const responsesRequestSchema = z.object({
@@ -162,4 +198,5 @@ export const responsesRequestSchema = z.object({
   prompt: z.unknown().optional(),
   text: z.unknown().optional(),
   truncation: z.unknown().optional(),
+  provider_options: providerOptionsSchema.optional(),
 });

package/src/responses/state.ts

@@ -18,6 +18,12 @@ import {
 const MAX_STORED_RESPONSES = 1_000;
 const RESPONSE_TTL_MS = 60 * 60 * 1_000;
 const SNAPSHOT_DEBOUNCE_MS = 2_000;
+/** Snapshot size below which the debounce stays at its base value. */
+const SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES = 1 * 1024 * 1024;
+/** Ceiling for the stretched debounce. Continuation state is only read after a
+ *  restart, and a graceful shutdown flushes, so the exposure a longer debounce adds
+ *  is bounded by a hard kill — paid against rewriting the whole snapshot every 2 s. */
+const SNAPSHOT_DEBOUNCE_MAX_MS = 30_000;
 /** In-memory high-water byte cap across all entries. Forced store:false retention (kiro/cursor
  * continuation chains) stores the full expanded input each turn — ~quadratic bytes per chain —
  * so a count cap alone cannot bound memory. Oldest-first eviction applies past this mark. */
@@ -90,6 +96,43 @@ let oldestResidentId: string | undefined;
 let oldestResidentAt: number | null = null;
 let byteCapOverride: number | null = null;
 let stateRevision = 0;
+/** Byte length and digest of the last snapshot actually written, for the
+ *  identical-payload skip and the size-scaled debounce. The payload itself is not
+ *  retained: at the 24 MiB bound that would double the snapshot's memory cost. */
+let lastSnapshotBytes = 0;
+let lastSnapshotDigest: string | null = null;
+// The resolved file the digest above describes. Keeping it means a config-dir
+// change or a retargeted symlink is a miss rather than a false "unchanged".
+let lastSnapshotTarget: string | null = null;
+
+/**
+ * Is the snapshot on disk still byte-for-byte what we last wrote?
+ *
+ * The cached digest proves what this process wrote, not what is there now. Size is
+ * checked first so the common mismatch costs a `stat`, and the content comparison
+ * only runs when the size already agrees. Any read failure answers "no" and the
+ * caller rewrites — the safe direction.
+ */
+async function snapshotOnDiskMatches(path: string, payload: string, payloadBytes: number): Promise<boolean> {
+  try {
+    const file = Bun.file(path);
+    if (file.size !== payloadBytes) return false;
+    if (await file.text() !== payload) return false;
+    // Content matching is not the whole invariant. This file holds persisted request
+    // and response bodies, and `atomicWriteFileAsync` writes it owner-only; the
+    // unconditional rewrite used to restore that on every mutation. Skipping without
+    // checking would let a broadened mode persist indefinitely, so treat a widened
+    // file as "does not match" and let the caller rewrite it through the hardening
+    // path. POSIX only — Windows ACLs are re-applied by that same write path.
+    if (process.platform !== "win32") {
+      const mode = statSync(path).mode & 0o777;
+      if (mode !== 0o600) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
 const spillCounters = { writes: 0, writeFailures: 0, readFailures: 0 };
 /**
  * Admission-boundary observability (test-visible). directSpills: oversized
@@ -788,9 +831,38 @@ async function writeBoundedSnapshot(path: string): Promise<SnapshotWriteOutcome>
         entries.push(persistEntry);
       }
       entries.reverse();
-      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-      try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
-      await atomicWriteFileAsync(path, JSON.stringify({ version: 2, states: entries }));
+      const payload = JSON.stringify({ version: 2, states: entries });
+      const payloadBytes = Buffer.byteLength(payload, "utf8");
+      const payloadDigest = Bun.hash(payload).toString(36);
+      // A mutation does not always change what gets persisted: entries past the
+      // per-entry or total byte bound are dropped from the selection, and spill
+      // demotion moves bytes out of it. Re-writing a byte-identical 24 MiB file
+      // buys nothing, so compare first — but the cached digest describes what THIS
+      // process last wrote, which is not the same claim as "that is what is on disk
+      // now". A second proxy sharing the home, or anything that rewrites the file
+      // in place, leaves the digest describing bytes that are gone. Before every
+      // release-of-a-write, the previous behaviour rewrote unconditionally and so
+      // repaired that silently; skipping without checking would turn a repaired
+      // snapshot into a lost one at the next restart.
+      //
+      // Verify against the file itself, keyed to the resolved target so a retargeted
+      // symlink is also a miss. Reading back a matching-size file costs far less
+      // than the atomic replace it avoids, and only happens when the digest already
+      // matched — the amplification this fixes is the repeated WRITE, not the read.
+      const unchanged = lastSnapshotDigest !== null
+        && payloadDigest === lastSnapshotDigest
+        && payloadBytes === lastSnapshotBytes
+        && lastSnapshotTarget === resolveWriteTarget(path)
+        && existsSync(path)
+        && await snapshotOnDiskMatches(path, payload, payloadBytes);
+      if (!unchanged) {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        try { chmodSync(dirname(path), 0o700); } catch { /* best-effort (e.g. Windows) */ }
+        await atomicWriteFileAsync(path, payload);
+        lastSnapshotDigest = payloadDigest;
+        lastSnapshotBytes = payloadBytes;
+        lastSnapshotTarget = resolveWriteTarget(path);
+      }
       persistAttemptHookForTests?.();
       if (revision === stateRevision) return "stable";
     }
@@ -809,11 +881,26 @@ function drainPendingSpillUnlinks(): void {
   }
 }
 
+/**
+ * Debounce scaled by the size of the last snapshot written.
+ *
+ * The whole snapshot is re-serialized and atomically replaced on every flush, so at
+ * the 24 MiB bound a fixed 2 s debounce is up to ~12 MB/s of write amplification for
+ * state nothing reads until the next start (#2460). Small snapshots keep the base
+ * cadence; the stretch is linear in size and clamped, so the write rate is roughly
+ * flat instead of growing with the file.
+ */
+function snapshotDebounceMs(): number {
+  if (lastSnapshotBytes <= SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES) return SNAPSHOT_DEBOUNCE_MS;
+  const scaled = Math.round(SNAPSHOT_DEBOUNCE_MS * (lastSnapshotBytes / SNAPSHOT_DEBOUNCE_SCALE_FROM_BYTES));
+  return Math.min(scaled, SNAPSHOT_DEBOUNCE_MAX_MS);
+}
+
 function schedulePersistAt(path: string, replace = false): void {
   if (persistTimer && !replace) return;
   if (persistTimer) clearTimeout(persistTimer);
   pendingPersistPath = path;
-  persistTimer = setTimeout(() => { void persistNow(path); }, SNAPSHOT_DEBOUNCE_MS);
+  persistTimer = setTimeout(() => { void persistNow(path); }, snapshotDebounceMs());
   (persistTimer as { unref?: () => void }).unref?.();
 }
 
@@ -1418,6 +1505,9 @@ export function clearResponseStateMemoryForTests(): void {
   replayScopeMismatchDrops = 0;
   replayOverlapSkips = 0;
   persistAttemptHookForTests = null;
+  lastSnapshotBytes = 0;
+  lastSnapshotDigest = null;
+  lastSnapshotTarget = null;
   loaded = false;
 }
 

package/src/router.ts

@@ -9,6 +9,7 @@ import {
 } from "./combos";
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
+import { isAzureIdentityProvider } from "./config/provider-validation";
 import { resolveEnvValue } from "./config";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { redactSecretString, redactUrlForLog } from "./lib/redact";
@@ -271,10 +272,15 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
   if (!registryEntry || !providerMatchesRegistryTransportWithStaticGuards(providerName, provider)) {
     assertProviderDestinationAllowed(providerName, provider);
-    return { ...provider, apiKey: usableResolvedApiKey(provider.apiKey) };
+    return {
+      ...provider,
+      apiKey: usableResolvedApiKey(provider.apiKey),
+      ...(isAzureIdentityProvider(provider) ? { liveModels: false } : {}),
+    };
   }
   const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
-  const staticModelCatalog = !providerSupportsLiveModelDiscovery(providerName, provider);
+  const staticModelCatalog = isAzureIdentityProvider(provider)
+    || !providerSupportsLiveModelDiscovery(providerName, provider);
   const repairLegacyMimoFreeAuth = providerName === "mimo-free"
     && staticModelCatalog
     && (provider.authMode === undefined || provider.authMode === "local");

package/src/server/auth-cors.ts

@@ -10,6 +10,7 @@ import {
 } from "../config";
 import {
   apiKeyTransportConfigError,
+  azureCredentialConfigError,
   booleanRecordConfigError,
   modelAdapterRecordConfigError,
   nonBlankStringArrayConfigError,
@@ -19,6 +20,7 @@ import {
   providerHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
   upstreamHttpVersionConfigError,
+  isAzureIdentityProvider,
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
@@ -26,8 +28,10 @@ import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
+import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
 import { googleVertexLocationConfigError } from "../providers/google-vertex-location";
 import { xaiResponsesOptInState } from "../providers/xai-responses-opt-in";
+import { antigravityOAuthDestinationConfigError, getProviderTlsProfileStatus, providerTlsProfileConfigError } from "../lib/provider-tls-profile";
 
 let _corsOrigin = "http://localhost:10100";
 export function setCorsOrigin(port: number): void { _corsOrigin = `http://localhost:${port}`; }
@@ -565,6 +569,8 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     if (contextOverlayError) return contextOverlayError;
     delete canonicalCandidate.contextWindow;
     delete canonicalCandidate.modelContextWindows;
+    // User-owned soft compaction policy; it does not alter the canonical transport seed.
+    delete canonicalCandidate.modelAutoCompactTokenLimits;
     const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
@@ -573,6 +579,12 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     return `provider ${name} must not include codexAccountMode`;
   }
   const typed = provider as unknown as OcxProviderConfig;
+  const tlsProfileError = providerTlsProfileConfigError(name, typed);
+  if (tlsProfileError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${tlsProfileError}`;
+  }
+  const antigravityError = antigravityOAuthDestinationConfigError(name, typed);
+  if (antigravityError) return `provider ${name} ${antigravityError}`;
   const baseUrlError = providerBaseUrlConfigError(typed.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
   if (effectiveGoogleMode(name, typed) === "vertex" && typed.location !== undefined) {
@@ -605,8 +617,17 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   }
   const apiKeyTransportError = apiKeyTransportConfigError(typed);
   if (apiKeyTransportError) return `provider ${name} ${apiKeyTransportError}`;
+  const azureCredentialError = azureCredentialConfigError(raw);
+  if (azureCredentialError) return `provider ${JSON.stringify(redactSecretString(name))} ${azureCredentialError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
   if (maxInputError) return `provider ${name} ${maxInputError}`;
+  const autoCompactError = modelAutoCompactTokenLimitsConfigError(
+    raw.modelAutoCompactTokenLimits,
+    { requireNativeIds: name === "openai" },
+  );
+  if (autoCompactError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${autoCompactError}`;
+  }
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
   const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
@@ -689,6 +710,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       adapter: provider.adapter,
       baseUrl: publicProviderBaseUrl(provider.baseUrl),
       hasApiKey: !!provider.apiKey,
+      hasAzureCredential: isAzureIdentityProvider(provider),
       hasHeaders: !!provider.headers && Object.keys(provider.headers).length > 0,
     };
     if (name === "xai") {
@@ -704,9 +726,11 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "freeTier",
       "liveModels",
       "requestPacing",
+      "tlsProfile",
       "models",
       "contextWindow",
       "modelContextWindows",
+      "modelAutoCompactTokenLimits",
       "defaultMaxOutputTokens",
       "modelMaxOutputTokens",
       "openRouterRouting",
@@ -728,6 +752,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
+    dto.tlsProfileStatus = provider.tlsProfile === undefined ? "disabled" : getProviderTlsProfileStatus(name, provider);
     const modelCosts = sanitizeModelCostsForDisplay(provider.modelCosts);
     if (modelCosts) dto.modelCosts = modelCosts;
     // Resolve the note by DESTINATION, not by name. A preset saved under a custom name is
@@ -748,6 +773,9 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     defaultProvider: config.defaultProvider,
     codexAutoStart: codexAutoStartEnabled(config),
     websockets: config.websockets,
+    // The GUI's browser-open toggle reads and writes this; absent means the
+    // historical auto-open behavior.
+    oauthOpenBrowser: config.oauthOpenBrowser !== false,
     providers,
   };
 }

package/src/server/images.ts

@@ -33,7 +33,9 @@ import { readJsonRequestBody } from "./request-decompress";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
-import { getValidAccessToken, getOAuthCredentialProjectId } from "../oauth/index";
+import { getValidAccessToken, getOAuthCredentialProjectId, getValidAccessTokenSnapshot, type OAuthAccessSnapshot } from "../oauth/index";
+import { isCanonicalAntigravityUrl, providerTlsFetch } from "../lib/provider-tls-profile";
+import { redactErrorMessage } from "../lib/redact";
 import { safeAntigravityHttpErrorMessage } from "../adapters/google-errors";
 import { sanitizeUpstreamErrorText } from "../adapters/upstream-http-error";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
@@ -156,6 +158,9 @@ async function tryCcaImageGeneration(
   if (endpoint !== "generations") return undefined;
   const provider = config.providers?.["google-antigravity"];
   if (!provider || provider.disabled) return undefined;
+  if (provider.baseUrl && !isCanonicalAntigravityUrl(provider.baseUrl)) {
+    return formatErrorResponse(400, "invalid_request_error", "google-antigravity requires a canonical destination");
+  }
 
   const prompt = (body as { prompt?: unknown })?.prompt;
   if (typeof prompt !== "string" || !prompt.trim()) {
@@ -174,36 +179,25 @@ async function tryCcaImageGeneration(
   // OAuth token refresh and project discovery, not just the upstream fetch.
   const timeoutMs = config.images?.timeoutMs ?? IMAGES_UPSTREAM_TIMEOUT_MS;
   const linkedSignal = signalWithTimeout(timeoutMs, signal);
-  let token: string;
+  let snapshot: OAuthAccessSnapshot;
   try {
-    // Race the OAuth refresh against the deadline signal. getValidAccessToken
-    // chains through 4 layers (resolveAccessSnapshotForAccount →
-    // refreshAndPersistAccessToken → refreshGenericAccountWithLock →
-    // def.refresh()) that do HTTP calls without accepting a signal. Rather than
-    // threading signal through the entire chain, race the whole call against
-    // linkedSignal: when the signal aborts we stop awaiting and surface the
-    // cancellation immediately instead of hanging on the refresh HTTP call.
-    token = await abortableRace(getValidAccessToken("google-antigravity"), linkedSignal.signal);
+    snapshot = await abortableRace(getValidAccessTokenSnapshot("google-antigravity"), linkedSignal.signal);
   } catch (err) {
     linkedSignal.cleanup();
-    // abortableRace rejects immediately when the signal fires, so client
-    // cancellation and deadline expiry surface here. Parent abort propagates
-    // into the linked signal, so check parent first (499) before the linked
-    // signal (504).
     if (signal.aborted) {
       return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
     }
     if (linkedSignal.signal.aborted) {
       return formatErrorResponse(504, "upstream_error", "CCA image generation timed out during authentication");
     }
-    // Missing/revoked credential → 401 (re-login required); transient refresh/network → 502.
     const errName = err instanceof Error ? err.name : "";
     if (errName === "OAuthLoginRequiredError") {
       return formatErrorResponse(401, "invalid_request_error", "Google Antigravity login required: run 'ocx login google-antigravity'");
     }
     return formatErrorResponse(502, "upstream_error", "CCA image generation failed: OAuth token refresh failed");
   }
-  const project = getOAuthCredentialProjectId("google-antigravity");
+  const token = snapshot.accessToken;
+  const project = snapshot.projectId;
   if (!project) {
     linkedSignal.cleanup();
     return formatErrorResponse(
@@ -234,10 +228,8 @@ async function tryCcaImageGeneration(
   let upstream: Response | undefined;
   try {
     try {
-      // Image generation is a paid, non-idempotent POST. A transport failure is
-      // ambiguous: the upstream may have accepted the request before the
-      // connection failed, so never replay it on a peer host.
-      upstream = await fetch(`${baseUrl}/v1internal:generateContent`, {
+      const executor = providerTlsFetch("google-antigravity", provider, globalThis.fetch);
+      upstream = await executor(`${baseUrl}/v1internal:generateContent`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -249,23 +241,15 @@ async function tryCcaImageGeneration(
       });
     } catch (err) {
       if (signal.aborted) return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
+      const rawMsg = err instanceof Error ? err.message : String(err);
+      const safeMsg = redactErrorMessage(sanitizeUpstreamErrorText(rawMsg));
       if (err instanceof Error && err.name === "TimeoutError") {
-        return ccaAmbiguousImageTransportError("upstream request timed out");
+        return formatErrorResponse(504, "upstream_error", `CCA image generation timed out: ${safeMsg}`);
       }
-      // Network/DNS/runtime errors may embed the request URL or headers verbatim
-      // (e.g. "fetch failed: https://…/v1internal:generateContent"). The token
-      // lives in an Authorization header, not in the URL, but sanitize defensively
-      // so no upstream-rejected credential or query param can reach the client,
-      // and strip the internal base URL host from the surfaced message.
-      // 400, not 5xx: the POST is paid and non-idempotent. Codex retries every
-      // 5xx up to 5 attempts, which would duplicate generation after an ambiguous
-      // transport failure (the upstream may already have accepted the request).
-      const rawMsg = err instanceof Error ? err.message : String(err);
-      const safeMsg = sanitizeUpstreamErrorText(rawMsg).replace(
-        /https?:\/\/[^\s"'<>]+/gi,
-        "[upstream-url]",
-      );
-      return ccaAmbiguousImageTransportError(safeMsg);
+      if (provider.tlsProfile === "antigravity-browser") {
+        return formatErrorResponse(502, "upstream_error", `CCA image generation failed: ${safeMsg}`);
+      }
+      return ccaAmbiguousImageTransportError(safeMsg.replace(/https?:\/\/[^\s"'<>]+/gi, "[upstream-url]"));
     }
 
     // Stream the upstream body with a bounded reader so an oversized or malicious