@yansigit/opencodex 2.32.0 → 2.33.1

package/src/generated/model-metadata.ts

@@ -27,6 +27,9 @@ const PROVIDER_ALIASES: Record<string, string> = {
   "google-antigravity": "google",
   "antigravity": "google",
   "gemini-antigravity": "google",
+  "google-aistudio": "google",
+  "aistudio": "google",
+  "gemini-aistudio": "google",
   "deepseek": "deepseek",
   "moonshot": "moonshot",
   "zhipu-bigmodel": "zai",

package/src/images/loop.ts

@@ -18,7 +18,7 @@ import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderContinuatio
 import { namespacedToolName, toolChoiceToolPredicate } from "../types";
 import { cloneProviderOpaqueToolCallMetadata } from "../responses/provider-opaque-metadata";
 import type { AttemptRecoveryKind } from "../usage/log";
-import { bridgeToResponsesSSE } from "../bridge";
+import { bridgeToResponsesSSE, diagnoseAdapterEvent, type BridgeDiagnosticContext } from "../bridge";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { fetchWithResetRetry, prepareSameTarget429Wait } from "../lib/upstream-retry";
@@ -35,6 +35,7 @@ import { submitVideoJob } from "./xai-video-client";
 import { downloadVideoToArtifact, createImageBudget, pruneArtifacts } from "./artifacts";
 import { IMAGE_GEN_TOOL_NAME, VIDEO_GEN_TOOL_NAME } from "./synthetic-tool";
 import type { ImageBridgePlan, VideoBridgePlan } from "./types";
+import { OcxRequestValidationError } from "../lib/errors";
 
 const SSE_HEADERS = {
   "Content-Type": "text/event-stream",
@@ -209,8 +210,14 @@ function extractIterationThinking(events: AdapterEvent[]): OcxThinkingContent[]
   return parts;
 }
 
-function jsonError(status: number, message: string): Response {
-  return new Response(JSON.stringify({ error: { message, type: "upstream_error", code: null } }), {
+function jsonError(status: number, message: string, errorType = "upstream_error", code: string | null = null): Response {
+  return new Response(JSON.stringify({
+    error: {
+      message,
+      type: errorType,
+      code,
+    },
+  }), {
     status,
     headers: { "Content-Type": "application/json" },
   });
@@ -219,7 +226,12 @@ function jsonError(status: number, message: string): Response {
 /** Hard provider/parse failure inside an iteration. The eager first iteration converts it to a
  *  non-2xx jsonError; later (already-streaming) iterations surface it as an in-stream error event. */
 class LoopError extends Error {
-  constructor(readonly status: number, message: string) {
+  constructor(
+    readonly status: number,
+    message: string,
+    readonly errorType?: string,
+    readonly code?: string,
+  ) {
     super(message);
     this.name = "LoopError";
   }
@@ -245,6 +257,8 @@ export interface ImageBridgeDeps {
   onAttemptSend?: (recovery?: AttemptRecoveryKind) => void;
   /** Called after each upstream request is built (parity with web-search / normal path). */
   onRequestBuilt?: (request: AdapterRequest) => void;
+  /** Validate the final adapter before every cached replay or request build. */
+  validateAdapter?: (parsed: OcxParsedRequest, adapter: ProviderAdapter) => void;
   abortSignal?: AbortSignal;
   onFirstOutput?: () => void;
   /** Max image-generation rounds before forcing a final answer. Defaults to 3; clamped to [0, 10]. */
@@ -270,6 +284,8 @@ export interface ImageBridgeDeps {
   onCompletedResponse?: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => void;
   /** WebSocket Responses path only — leave response id empty for protocol compatibility. */
   forceEmptyResponseId?: boolean;
+  /** Internal, opt-in structural stream diagnostics shared with the final bridge. */
+  diagnostic?: BridgeDiagnosticContext;
 }
 
 /**
@@ -487,6 +503,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
        * header deadline. The caller owns same-target 429 replays and key rotation around it.
        */
       const fetchOnce = async (requestAdapter: ProviderAdapter, recovery?: AttemptRecoveryKind): Promise<IterationResponse> => {
+        deps.validateAdapter?.(iterParsed, requestAdapter);
         let request: AdapterRequest;
         if (cachedRequest !== undefined && cachedAdapter === requestAdapter) {
           request = cachedRequest;
@@ -609,6 +626,9 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       return prepared;
     } catch (error) {
       if (isTranslatorBudgetExceededError(error)) throw error;
+      if (error instanceof OcxRequestValidationError) {
+        throw new LoopError(error.status, error.message, "invalid_request_error", "invalid_request_error");
+      }
       if (headerDeadline.didExpire()) {
         throw new LoopError(504, `Provider response-header timeout after ${connectTimeoutMs}ms during image-bridge`);
       }
@@ -638,6 +658,10 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         inactivityTimeoutMs: stallTimeoutMs,
         translatorBudget,
       })) {
+        if (deps.diagnostic) {
+          deps.diagnostic.adapterName = prepared.responseAdapter.name;
+          diagnoseAdapterEvent(deps.diagnostic, event);
+        }
         if (event.type === "heartbeat") yield event;
         else events.push(event);
       }
@@ -674,7 +698,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       firstPrepared = await prepareIterationDrained(maxRounds <= 0);
     } catch (e) {
       if (abortSignal) abortSignal.removeEventListener("abort", linkAbort);
-      if (e instanceof LoopError) return jsonError(e.status, e.message);
+      if (e instanceof LoopError) return jsonError(e.status, e.message, e.errorType, e.code ?? null);
       throw e;
     }
   }
@@ -920,7 +944,13 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
             yield {
               type: "error",
               message: e instanceof LoopError ? e.message : (e instanceof Error ? e.message : String(e)),
-              ...(e instanceof LoopError ? { status: e.status } : {}),
+              ...(e instanceof LoopError ? {
+                status: e.status,
+                ...(e.errorType !== undefined || e.status === 400
+                  ? { errorType: e.errorType ?? "upstream_error" }
+                  : {}),
+                ...(e.code !== undefined ? { code: e.code } : {}),
+              } : {}),
               ...(hiddenUsage ? { usage: hiddenUsage } : {}),
             };
           }
@@ -949,6 +979,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         onUsage: (usage: OcxUsage | undefined) => deps.onUsage?.(usage),
       } : {}),
       ...(deps.onCompletedResponse ? { onCompletedResponse: deps.onCompletedResponse } : {}),
+      ...(deps.diagnostic ? { diagnostic: deps.diagnostic } : {}),
     },
   );
   return new Response(sse, { headers: SSE_HEADERS });

package/src/lib/azure-identity.ts

@@ -0,0 +1,154 @@
+import type { OcxProviderConfig } from "../types";
+
+export const AZURE_IDENTITY_SCOPE = "https://cognitiveservices.azure.com/.default";
+export const AZURE_IDENTITY_UNAVAILABLE_ERROR = "Azure identity credential unavailable";
+
+export interface AzureTokenCredential {
+  getToken(scope: string): Promise<{ token?: string } | null>;
+}
+
+export type AzureCredentialFactory = (options?: { managedIdentityClientId?: string }) =>
+  AzureTokenCredential | Promise<AzureTokenCredential>;
+export type AzureIdentityModuleLoader = () => Promise<{
+  DefaultAzureCredential: new (options?: { managedIdentityClientId?: string }) => AzureTokenCredential;
+}>;
+export type AzureLoggerModuleLoader = () => Promise<{
+  AzureLogger: { log: (...args: unknown[]) => void };
+}>;
+
+const credentials = new Map<string, AzureTokenCredential>();
+const inflight = new Map<string, Promise<AzureTokenCredential>>();
+const invalidatedInflight = new Set<Promise<AzureTokenCredential>>();
+let testFactory: AzureCredentialFactory | undefined;
+let testModuleLoader: AzureIdentityModuleLoader | undefined;
+let testLoggerModuleLoader: AzureLoggerModuleLoader | undefined;
+
+async function loadAzureLoggerModule(): Promise<{
+  AzureLogger: { log: (...args: unknown[]) => void };
+}> {
+  const packageName: string = "@azure/logger";
+  return await import(packageName) as unknown as {
+    AzureLogger: { log: (...args: unknown[]) => void };
+  };
+}
+
+async function suppressAzureSdkLogging(): Promise<void> {
+  const module = await (testLoggerModuleLoader ?? loadAzureLoggerModule)();
+  module.AzureLogger.log = () => {};
+}
+
+async function loadAzureIdentityModule(): Promise<{
+  DefaultAzureCredential: new (options?: { managedIdentityClientId?: string }) => AzureTokenCredential;
+}> {
+  // Keep the package out of the static module graph until Task 3 installs it.
+  const packageName: string = "@azure/identity";
+  return await import(packageName) as unknown as {
+    DefaultAzureCredential: new (options?: { managedIdentityClientId?: string }) => AzureTokenCredential;
+  };
+}
+
+async function loadDefaultAzureCredential(options?: { managedIdentityClientId?: string }): Promise<AzureTokenCredential> {
+  await suppressAzureSdkLogging();
+  const module = await (testModuleLoader ?? loadAzureIdentityModule)();
+  return options === undefined
+    ? new module.DefaultAzureCredential()
+    : new module.DefaultAzureCredential(options);
+}
+
+function clientIdFor(provider: OcxProviderConfig): string {
+  return provider.azureCredential?.managedIdentityClientId?.trim() ?? "";
+}
+
+async function credentialFor(clientId: string): Promise<AzureTokenCredential> {
+  const cached = credentials.get(clientId);
+  if (cached) return cached;
+  const running = inflight.get(clientId);
+  if (running) return running;
+  const generation = cacheGeneration;
+  let promise!: Promise<AzureTokenCredential>;
+  promise = Promise.resolve((testFactory ?? loadDefaultAzureCredential)(clientId ? { managedIdentityClientId: clientId } : undefined))
+    .then(credential => {
+      if (cacheGeneration === generation && !invalidatedInflight.has(promise)) {
+        credentials.set(clientId, credential);
+      }
+      return credential;
+    })
+    .finally(() => {
+      invalidatedInflight.delete(promise);
+      if (inflight.get(clientId) === promise) inflight.delete(clientId);
+    });
+  inflight.set(clientId, promise);
+  return promise;
+}
+
+export function azureIdentityClientId(provider: Pick<OcxProviderConfig, "azureCredential">): string | undefined {
+  if (provider.azureCredential?.type !== "default-azure-credential") return undefined;
+  return provider.azureCredential.managedIdentityClientId?.trim() ?? "";
+}
+
+export function invalidateAzureCredentialCache(clientId: string): void {
+  const key = clientId.trim();
+  const running = inflight.get(key);
+  if (running) invalidatedInflight.add(running);
+  credentials.delete(key);
+  inflight.delete(key);
+}
+
+export function __azureCredentialCacheStateForTests(): {
+  credentials: number;
+  inflight: number;
+  invalidatedInflight: number;
+} {
+  return {
+    credentials: credentials.size,
+    inflight: inflight.size,
+    invalidatedInflight: invalidatedInflight.size,
+  };
+}
+
+export async function getAzureAccessToken(provider: OcxProviderConfig): Promise<string> {
+  try {
+    const credential = await credentialFor(clientIdFor(provider));
+    const result = await credential.getToken(AZURE_IDENTITY_SCOPE);
+    const token = result?.token?.trim();
+    if (!token) throw new Error(AZURE_IDENTITY_UNAVAILABLE_ERROR);
+    return token;
+  } catch {
+    throw new Error(AZURE_IDENTITY_UNAVAILABLE_ERROR);
+  }
+}
+
+export function setAzureCredentialFactoryForTests(factory: AzureCredentialFactory): void {
+  cacheGeneration++;
+  testFactory = factory;
+  testModuleLoader = undefined;
+  testLoggerModuleLoader = undefined;
+  credentials.clear();
+  inflight.clear();
+  invalidatedInflight.clear();
+}
+
+export function __resetAzureCredentialCache(): void {
+  cacheGeneration++;
+  testFactory = undefined;
+  testModuleLoader = undefined;
+  testLoggerModuleLoader = undefined;
+  credentials.clear();
+  inflight.clear();
+  invalidatedInflight.clear();
+}
+
+let cacheGeneration = 0;
+
+export function setAzureIdentityModuleLoaderForTests(loader: AzureIdentityModuleLoader): void {
+  cacheGeneration++;
+  testFactory = undefined;
+  testModuleLoader = loader;
+  credentials.clear();
+  inflight.clear();
+  invalidatedInflight.clear();
+}
+
+export function setAzureLoggerModuleLoaderForTests(loader: AzureLoggerModuleLoader): void {
+  testLoggerModuleLoader = loader;
+}

package/src/lib/debug.ts

@@ -1,7 +1,10 @@
+import { createHmac, randomBytes } from "node:crypto";
 import { appendDebugLogLine } from "./debug-log-buffer";
 import { isDebugEnabled } from "./debug-settings";
 import { redactSecrets } from "./redact";
 
+let debugFingerprintKey: Uint8Array | undefined;
+
 function emitDebugLine(line: string): void {
   if (!isDebugEnabled()) return;
   try {
@@ -29,3 +32,42 @@ export function debugProviderDiagnostic(adapter: string, event: string, details:
     /* diagnostics must never affect request handling */
   }
 }
+
+/** Process-local, content-free correlation aid for opt-in provider diagnostics. */
+export function debugFingerprint(value: string | Uint8Array): string | undefined {
+  if (!isDebugEnabled()) return undefined;
+  try {
+    debugFingerprintKey ??= randomBytes(32);
+    return createHmac("sha256", debugFingerprintKey).update(value).digest("hex");
+  } catch {
+    return undefined;
+  }
+}
+
+export interface DebugStreamDiagnosticContext {
+  requestId: string;
+  adapterName: string;
+  attempt?: number;
+  recovery?: string;
+}
+
+export type DebugStreamDiagnosticStage = "adapter" | "bridge";
+
+/** Emit one structural line for an adapter/bridge event without retaining its content. */
+export function debugStreamDiagnostic(
+  context: DebugStreamDiagnosticContext,
+  stage: DebugStreamDiagnosticStage,
+  sequence: number,
+  eventType: string,
+  details?: Record<string, unknown>,
+): void {
+  debugProviderDiagnostic(context.adapterName, "stream", {
+    stage,
+    sequence,
+    eventType,
+    ...(context.requestId !== undefined ? { requestId: context.requestId } : {}),
+    ...(context.attempt !== undefined ? { attempt: context.attempt } : {}),
+    ...(context.recovery !== undefined ? { recovery: context.recovery } : {}),
+    ...details,
+  });
+}

package/src/lib/errors.ts

@@ -4,6 +4,16 @@ export interface OcxErrorPayload {
   code: string | null;
 }
 
+/** A local request validation failure that must remain a client-visible HTTP 400. */
+export class OcxRequestValidationError extends Error {
+  readonly status = 400;
+
+  constructor(message: string) {
+    super(message);
+    this.name = "OcxRequestValidationError";
+  }
+}
+
 /** OpenAI / Codex hard block for high-risk cybersecurity activity (HTTP 400 or mid-stream). */
 export const CYBER_POLICY_ERROR_CODE = "cyber_policy";
 
@@ -180,6 +190,10 @@ export function classifyError(status: number, type: string, message: string): Oc
   }
   if (
     text.includes("insufficient_quota") ||
+    text.includes("insufficient credits") ||
+    text.includes("purchase more credits") ||
+    text.includes("run out of credits") ||
+    text.includes("out of credits") ||
     text.includes("exceeded your current quota") ||
     text.includes("quota exhausted") ||
     text.includes("account quota exceeded") ||

package/src/lib/provider-outbound.ts

@@ -7,12 +7,14 @@ import {
   resolvePublicAddresses,
 } from "./destination-policy";
 import { pinnedHttpGet, pinnedHttpPost } from "./pinned-http";
-import { outboundProxyConfigured } from "./proxy-env";
+import { noProxyMatches, outboundProxyConfigured, proxyForUrl } from "./proxy-env";
 import { publicProviderBaseUrl } from "./provider-url";
+import { antigravityOAuthDestinationConfigError, isCanonicalAntigravityUrl, providerTlsFetch } from "./provider-tls-profile";
+import { waitForProviderRequestSlot } from "../providers/request-pacing";
 
 type ProviderGetInit = Omit<RequestInit, "body" | "method" | "redirect">;
 type ProviderPostInit = ProviderGetInit & { body: string };
-type ProviderOutboundConfig = Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork"> & {
+type ProviderOutboundConfig = Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork"> & Partial<Pick<OcxProviderConfig, "adapter" | "authMode" | "googleMode" | "tlsProfile">> & {
   fetch?: typeof globalThis.fetch;
 };
 export interface ProviderOutboundDependencies {
@@ -40,36 +42,26 @@ function normalizeProxyHostname(hostname: string): string {
     : normalized;
 }
 
-function noProxyMatches(url: URL): boolean {
-  const raw = process.env.NO_PROXY ?? process.env.no_proxy ?? "";
-  const hostname = normalizeProxyHostname(url.hostname);
-  const port = url.port || (url.protocol === "https:" ? "443" : "80");
-  for (const rawEntry of raw.split(",")) {
-    let entry = rawEntry.trim().toLowerCase();
-    if (!entry) continue;
-    if (entry === "*") return true;
-    entry = entry.replace(/^https?:\/\//, "").split("/", 1)[0]!;
-
-    let entryHost = entry;
-    let entryPort = "";
-    const bracketed = /^\[([^\]]+)](?::(\d+))?$/.exec(entry);
-    if (bracketed) {
-      entryHost = bracketed[1]!;
-      entryPort = bracketed[2] ?? "";
-    } else if ((entry.match(/:/g)?.length ?? 0) === 1) {
-      const separator = entry.lastIndexOf(":");
-      const possiblePort = entry.slice(separator + 1);
-      if (/^\d+$/.test(possiblePort)) {
-        entryHost = entry.slice(0, separator);
-        entryPort = possiblePort;
-      }
-    }
-    if (entryPort && entryPort !== port) continue;
-    entryHost = normalizeProxyHostname(entryHost.replace(/^\*?\./, ""));
-    if (!entryHost) continue;
-    if (hostname === entryHost || hostname.endsWith(`.${entryHost}`)) return true;
+function antigravityProfileFetch(
+  name: string,
+  provider: ProviderOutboundConfig,
+  url: string,
+): typeof globalThis.fetch | undefined {
+  if (name !== "google-antigravity"
+    || provider.fetch
+    || provider.tlsProfile !== "antigravity-browser"
+    || provider.adapter !== "google"
+    || provider.authMode !== "oauth"
+    || provider.googleMode !== "cloud-code-assist"
+    || !isCanonicalAntigravityUrl(provider.baseUrl)
+    || !isCanonicalAntigravityUrl(url)) {
+    return undefined;
   }
-  return false;
+  const nativeFetch = providerTlsFetch(name, provider as Parameters<typeof providerTlsFetch>[1], globalThis.fetch);
+  return (async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit): Promise<Response> => {
+    await waitForProviderRequestSlot(name, provider as OcxProviderConfig, undefined, init?.signal ?? undefined);
+    return nativeFetch(input, init);
+  }) as typeof globalThis.fetch;
 }
 
 let proxyBoundaryWarned = false;
@@ -112,11 +104,31 @@ async function providerOutboundRequest(
   init: ProviderGetInit | ProviderPostInit,
   dependencies: ProviderOutboundDependencies = {},
 ): Promise<Response> {
+  const antigravityBaseError = antigravityOAuthDestinationConfigError(name, provider);
+  if (antigravityBaseError) throw new ProviderOutboundPolicyError(`provider ${name} ${antigravityBaseError}`);
+  if (name === "google-antigravity" && !isCanonicalAntigravityUrl(url)) {
+    throw new ProviderOutboundPolicyError("provider google-antigravity requires a canonical Antigravity HTTPS destination for OAuth");
+  }
   const postUrl = method === "POST" ? new URL(url) : undefined;
   if (postUrl?.protocol !== undefined && postUrl.protocol !== "https:") {
     throw new ProviderOutboundPolicyError("provider POST URL must use HTTPS");
   }
-  if (provider.fetch) {
+  const profiledFetch = antigravityProfileFetch(name, provider, url);
+  const fetchOverride = provider.fetch ?? profiledFetch;
+  if (profiledFetch) {
+    // Keep the profiled executor behind the same pre-dispatch DNS boundary as
+    // the pinned path. A proxy owns peer selection, so match the existing
+    // providerOutbound proxy boundary and deliberately skip local resolution.
+    if (!proxyForUrl(url)) {
+      const resolveAddresses = dependencies.resolveAddresses ?? resolvePublicAddresses;
+      await resolveAddresses(url, {
+        context: "provider URL",
+        allowPrivateNetwork: false,
+      });
+    }
+    return fetchOverride!(url, { ...init, method, redirect: "manual" });
+  }
+  if (fetchOverride) {
     // A caller-owned executor cannot be peer-pinned here. This branch keeps literal/config
     // checks and redirect blocking, but does not provide the resolved-address guarantees of
     // the built-in transport. Main-request migration must define that executor contract first.
@@ -135,7 +147,7 @@ async function providerOutboundRequest(
       });
       if (destinationError) throw new ProviderOutboundPolicyError(destinationError);
     }
-    return provider.fetch(url, { ...init, method, redirect: "manual" });
+    return fetchOverride(url, { ...init, method, redirect: "manual" });
   }
   const parsed = postUrl ?? new URL(url);
   const proxyConfigured = configuredProxyFor();