@yansigit/opencodex 2.32.0 → 2.33.1

package/src/providers/quota.ts

@@ -8,7 +8,7 @@ import { isMainAccountIdentityGenerationLive } from "../codex/main-account-cache
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { codexPlanKey } from "../codex/plan";
 import { resolveEnvValue } from "../config";
-import { getValidAccessToken, getValidAccessTokenForAccount } from "../oauth";
+import { getValidAccessToken, getValidAccessTokenForAccount, getValidAccessTokenSnapshot, getValidAccessTokenSnapshotForAccount, type OAuthAccessSnapshot } from "../oauth";
 import { getAccountCredential, getAccountSet, getCredential } from "../oauth/store";
 import { antigravityUserAgent } from "../adapters/client-fingerprint";
 import { apiKeyPoolEntryId } from "./api-keys";
@@ -16,6 +16,7 @@ import { XAI_GROK_CLIENT_VERSION, XAI_GROK_COMPATIBILITY } from "./xai-transport
 import { getProviderRegistryEntry, providerCodexAccountMode, registryEntryForProviderDestination } from "./registry";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "./openai-tiers";
+import { globalAiStudioRelayHub } from "../server/aistudio-ws-hub";
 import {
   captureConfigGeneration,
   sweepExpiredOnWrite,
@@ -34,6 +35,7 @@ import {
   isTerminalAntigravityQuotaStatus,
 } from "./antigravity-quota";
 import { antigravityHostCandidates, isAntigravityHttpsHost } from "../adapters/google-antigravity-hosts";
+import { providerTlsFetch } from "../lib/provider-tls-profile";
 
 /** Match oauth/index REFRESH_SKEW_MS — use stored access without refresh when still fresh. */
 const ACCOUNT_TOKEN_SKEW_MS = 60_000;
@@ -1400,7 +1402,12 @@ export interface ProviderAccountQuota {
 
 /** Providers whose per-account quota can be probed. Extend as other OAuth APIs are covered. */
 export function supportsPerAccountQuota(provider: string): boolean {
-  return provider === "anthropic";
+  return (
+    provider === "anthropic" ||
+    provider === "google-antigravity" ||
+    provider === "command-code" ||
+    provider === "cursor"
+  );
 }
 
 function accountCacheKey(provider: string, accountId: string): string {
@@ -1519,8 +1526,21 @@ async function fetchAccountQuota(
 
   const probe = (async (): Promise<AccountQuotaCacheEntry> => {
     try {
-      const token = await getTokenForAccountQuotaProbe(provider, accountId);
-      const quota = await fetchAnthropicUsageQuota(token);
+      let quota: ProviderQuota | null = null;
+      if (provider === "anthropic") {
+        const token = await getTokenForAccountQuotaProbe(provider, accountId);
+        quota = await fetchAnthropicUsageQuota(token);
+      } else if (provider === "google-antigravity") {
+        quota = await fetchAntigravityAccountQuota(accountId);
+      } else if (provider === "command-code") {
+        const token = await getTokenForAccountQuotaProbe(provider, accountId);
+        const res = await fetchCommandCodeUsageQuota(token);
+        quota = res === TERMINAL_QUOTA_FAILURE ? null : res;
+      } else if (provider === "cursor") {
+        const token = await getTokenForAccountQuotaProbe(provider, accountId);
+        const res = await fetchCursorUsageQuota(token);
+        quota = res?.quota ?? null;
+      }
       if (!quota) {
         // Preserve last-good bars and mark unavailable; advance TTL so failures
         // negative-cache instead of re-probing on every GUI poll.
@@ -1735,8 +1755,9 @@ function parseCommandCodeWindow(value: unknown): { percent: number; resetAt?: nu
   if (!row) return null;
   const cap = toFiniteNumber(row.cap);
   const used = toFiniteNumber(row.used);
-  if (cap === undefined || used === undefined || cap <= 0 || used < 0) return null;
-  const percent = normalizePercent((used / cap) * 100);
+  const percent = cap !== undefined && used !== undefined && cap > 0 && used >= 0
+    ? normalizePercent((used / cap) * 100)
+    : normalizePercent(row.percent);
   if (percent === undefined) return null;
   const resetAt = quotaResetAt(row);
   return { percent, ...(resetAt !== undefined ? { resetAt } : {}) };
@@ -1823,11 +1844,7 @@ async function resolveCommandCodeQuotaBearer(config: OcxProviderConfig): Promise
  * usage view uses (windowLimits.fiveHour / windowLimits.weekly), plus soft
  * whoami (team orgId scoping) and subscription-scoped spend for creditsUsd.
  */
-async function fetchCommandCodeQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaProbeResult> {
-  // Never release credentials to a user-edited or lookalike provider host.
-  if (!isCanonicalCommandCodeBaseUrl(config.baseUrl)) return null;
-  const bearer = await resolveCommandCodeQuotaBearer(config);
-  if (!bearer) return null;
+async function fetchCommandCodeUsageQuota(bearer: string): Promise<ProviderQuota | null | typeof TERMINAL_QUOTA_FAILURE> {
   const whoamiBody = await fetchCommandCodeJson(COMMAND_CODE_WHOAMI_URL, bearer);
   const whoami = asRecord(whoamiBody?.data) ?? whoamiBody;
   const org = asRecord(whoami?.org);
@@ -1851,7 +1868,7 @@ async function fetchCommandCodeQuota(provider: string, config: OcxProviderConfig
   const fiveHour = parseCommandCodeWindow(limits?.fiveHour);
   const weekly = parseCommandCodeWindow(limits?.weekly);
   const creditsUsd = await fetchCommandCodeSpend(bearer, credits, orgQuery);
-  return report(provider, "command-code:credits", {
+  return {
     ...(fiveHour ? {
       fiveHourPercent: fiveHour.percent,
       ...(fiveHour.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
@@ -1862,18 +1879,21 @@ async function fetchCommandCodeQuota(provider: string, config: OcxProviderConfig
     } : {}),
     ...(creditsUsd ? { creditsUsd } : {}),
     updatedAt: Date.now(),
-  });
+  };
 }
 
-/** Cursor included usage via api2.cursor.sh (Bearer from OAuth) — unofficial, may change. */
-async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport | null> {
-  let accessToken: string;
-  try {
-    accessToken = await getValidAccessToken("cursor");
-  } catch {
-    return null;
-  }
+async function fetchCommandCodeQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaProbeResult> {
+  // Never release credentials to a user-edited or lookalike provider host.
+  if (!isCanonicalCommandCodeBaseUrl(config.baseUrl)) return null;
+  const bearer = await resolveCommandCodeQuotaBearer(config);
+  if (!bearer) return null;
+  const result = await fetchCommandCodeUsageQuota(bearer);
+  if (!result || result === TERMINAL_QUOTA_FAILURE) return result;
+  return report(provider, "command-code:credits", result);
+}
 
+/** Cursor included usage via api2.cursor.sh (Bearer from OAuth) — unofficial, may change. */
+async function fetchCursorUsageQuota(accessToken: string): Promise<{ quota: ProviderQuota; source: string } | null> {
   const authHeaders = {
     Accept: "application/json",
     Authorization: `Bearer ${accessToken}`,
@@ -1933,15 +1953,17 @@ async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport |
         }
 
         if (totalPercent !== undefined || customWindows.length > 0) {
-          const built = report(provider, "cursor:period-usage", {
-            ...(totalPercent !== undefined ? {
-              monthlyPercent: totalPercent,
-              ...(resetAt !== undefined ? { monthlyResetAt: resetAt } : {}),
-            } : {}),
-            ...(customWindows.length > 0 ? { customWindows } : {}),
-            updatedAt: Date.now(),
-          });
-          if (built) return { ...built, reverseEngineered: true };
+          return {
+            source: "cursor:period-usage",
+            quota: {
+              ...(totalPercent !== undefined ? {
+                monthlyPercent: totalPercent,
+                ...(resetAt !== undefined ? { monthlyResetAt: resetAt } : {}),
+              } : {}),
+              ...(customWindows.length > 0 ? { customWindows } : {}),
+              updatedAt: Date.now(),
+            },
+          };
         }
       }
     }
@@ -1967,12 +1989,14 @@ async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport |
             ? normalizePercent((used / limit) * 100)
             : undefined);
         if (percent !== undefined) {
-          const built = report(provider, "cursor:usage-summary", {
-            monthlyPercent: percent,
-            monthlyResetAt: normalizeResetAt(body?.billingCycleEnd),
-            updatedAt: Date.now(),
-          });
-          if (built) return { ...built, reverseEngineered: true };
+          return {
+            source: "cursor:usage-summary",
+            quota: {
+              monthlyPercent: percent,
+              monthlyResetAt: normalizeResetAt(body?.billingCycleEnd),
+              updatedAt: Date.now(),
+            },
+          };
         }
       }
     }
@@ -2021,11 +2045,26 @@ async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport |
         return Date.UTC(start.getUTCFullYear(), start.getUTCMonth() + 1, start.getUTCDate());
       })()
     : undefined;
-  const built = report(provider, "cursor:auth-usage", {
-    monthlyPercent: percent,
-    ...(monthlyResetAt !== undefined ? { monthlyResetAt } : {}),
-    updatedAt: Date.now(),
-  });
+  return {
+    source: "cursor:auth-usage",
+    quota: {
+      monthlyPercent: percent,
+      ...(monthlyResetAt !== undefined ? { monthlyResetAt } : {}),
+      updatedAt: Date.now(),
+    },
+  };
+}
+
+async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport | null> {
+  let accessToken: string;
+  try {
+    accessToken = await getValidAccessToken("cursor");
+  } catch {
+    return null;
+  }
+  const result = await fetchCursorUsageQuota(accessToken);
+  if (!result) return null;
+  const built = report(provider, result.source, result.quota);
   return built ? { ...built, reverseEngineered: true } : null;
 }
 
@@ -2077,23 +2116,63 @@ function antigravityUsedPercent(quotaInfo: Record<string, unknown>): number | un
   return normalizePercent(100 - remaining);
 }
 
+async function fetchAntigravityAccountQuota(accountId: string): Promise<ProviderQuota | null> {
+  let snapshot: OAuthAccessSnapshot;
+  try {
+    snapshot = await getValidAccessTokenSnapshotForAccount("google-antigravity", accountId);
+  } catch {
+    return null;
+  }
+  if (!snapshot.projectId) return null;
+  const entry = getProviderRegistryEntry("google-antigravity");
+  const baseUrl = (entry?.baseUrl || "https://daily-cloudcode-pa.googleapis.com").replace(/\/+$/, "");
+  const providerConfig: Pick<OcxProviderConfig, "adapter" | "authMode" | "baseUrl" | "googleMode" | "tlsProfile"> = {
+    adapter: "google",
+    authMode: "oauth",
+    googleMode: "cloud-code-assist",
+    baseUrl,
+  };
+  const fetchImpl = providerTlsFetch("google-antigravity", providerConfig, globalThis.fetch);
+  let liveQuota: ProviderQuota | null;
+  try {
+    liveQuota = await fetchAntigravityLiveQuota({
+      accessToken: snapshot.accessToken,
+      projectId: snapshot.projectId,
+      baseUrl,
+      timeoutMs: REQUEST_TIMEOUT_MS,
+      fetchImpl,
+    });
+  } catch (error) {
+    if (error instanceof AntigravityQuotaRpcError && isTerminalAntigravityQuotaStatus(error.status)) {
+      return null;
+    }
+    liveQuota = null;
+  }
+  if (!liveQuota) return null;
+  return {
+    ...liveQuota,
+    updatedAt: Date.now(),
+  };
+}
+
 async function fetchAntigravityQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaProbeResult> {
-  const credential = getCredential("google-antigravity");
-  if (!credential?.projectId) return null;
-  let accessToken: string;
+  let snapshot: OAuthAccessSnapshot;
   try {
-    accessToken = await getValidAccessToken("google-antigravity");
+    snapshot = await getValidAccessTokenSnapshot("google-antigravity");
   } catch {
     return null;
   }
+  if (!snapshot.projectId) return null;
   const baseUrl = (config.baseUrl || "https://daily-cloudcode-pa.googleapis.com").replace(/\/+$/, "");
+  const fetchImpl = providerTlsFetch(provider, config, globalThis.fetch);
   let liveQuota: ProviderQuota | null;
   try {
     liveQuota = await fetchAntigravityLiveQuota({
-      accessToken,
-      projectId: credential.projectId,
+      accessToken: snapshot.accessToken,
+      projectId: snapshot.projectId,
       baseUrl,
       timeoutMs: REQUEST_TIMEOUT_MS,
+      fetchImpl,
     });
   } catch (error) {
     if (error instanceof AntigravityQuotaRpcError && isTerminalAntigravityQuotaStatus(error.status)) {
@@ -2106,15 +2185,15 @@ async function fetchAntigravityQuota(provider: string, config: OcxProviderConfig
   for (const [index, host] of antigravityHostCandidates(baseUrl).entries()) {
     if (!isAntigravityHttpsHost(host)) continue;
     try {
-      const response = await fetch(`${host}/v1internal:fetchAvailableModels`, {
+      const response = await fetchImpl(`${host}/v1internal:fetchAvailableModels`, {
         method: "POST",
         headers: {
           Accept: "application/json",
           "Content-Type": "application/json",
           "User-Agent": antigravityUserAgent(),
-          Authorization: `Bearer ${accessToken}`,
+          Authorization: `Bearer ${snapshot.accessToken}`,
         },
-        body: JSON.stringify({ project: credential.projectId }),
+        body: JSON.stringify({ project: snapshot.projectId }),
         redirect: "error",
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
       });
@@ -2173,6 +2252,22 @@ async function fetchAntigravityQuota(provider: string, config: OcxProviderConfig
   });
 }
 
+async function fetchAiStudioQuota(name: string, provider: OcxProviderConfig): Promise<ProviderQuotaReport | null> {
+  const active = globalAiStudioRelayHub.hasActiveSessions();
+  const sessionCount = globalAiStudioRelayHub.getActiveSessionCount();
+  const now = Date.now();
+
+  return {
+    provider: name,
+    label: "Google AI Studio (Web)",
+    source: active ? `Browser Relay (${sessionCount} active tab${sessionCount > 1 ? "s" : ""})` : "Browser Relay (Disconnected)",
+    updatedAt: now,
+    quota: {
+      updatedAt: now,
+    },
+  };
+}
+
 async function maybeFetchProviderQuota(
   name: string,
   provider: OcxProviderConfig,
@@ -2248,6 +2343,9 @@ async function maybeFetchProviderQuota(
     if ((provider.authMode ?? "key") === "key" && name === "neuralwatt") {
       return fetchNeuralwattQuota(name, provider);
     }
+    if (provider.googleMode === "ai-studio-web" || name === "google-aistudio") {
+      return fetchAiStudioQuota(name, provider);
+    }
     return null;
   } catch {
     return null;

package/src/providers/registry.ts

@@ -161,6 +161,7 @@ export interface ProviderRegistryEntry {
   note?: string;
   dashboardUrl?: string;
   defaultModel?: string;
+  requestPacing?: OcxProviderConfig["requestPacing"];
   models?: string[];
   liveModels?: boolean;
   /**
@@ -298,7 +299,7 @@ export interface ProviderRegistryEntry {
   jawcodeBundle?: string;
   extraMetadataAliases?: string[];
   metadataModelIdNormalize?: MetadataModelIdNormalize;
-  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
+  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist" | "ai-studio-web";
   project?: string;
   location?: string;
 }
@@ -1597,7 +1598,28 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // 2026-07-10: defaultModel is frozen pending Vertex-specific Tier-2 evidence; Gemini API
   // evidence from ai.google.dev does not establish Vertex publisher availability.
   { id: "google-vertex", label: "Google Vertex AI", adapter: "google", baseUrl: "https://aiplatform.googleapis.com", authKind: "key", dashboardUrl: "https://console.cloud.google.com/vertex-ai", defaultModel: "gemini-3-pro", googleMode: "vertex", jawcodeBundle: "google", extraMetadataAliases: ["gemini-vertex"] },
-  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", allowBaseUrlOverride: true, dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, liveModels: true, defaultModel: "gemini-3.7-flash", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, modelInputModalities: ANTIGRAVITY_MODEL_INPUT_MODALITIES, modelReasoningEfforts: ANTIGRAVITY_MODEL_EFFORTS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
+  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", allowBaseUrlOverride: true, dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, liveModels: true, defaultModel: "gemini-3.7-flash", requestPacing: { enabled: true, requestsPerMinute: 30, minIntervalMs: 2_000, jitterMs: 500 }, modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, modelInputModalities: ANTIGRAVITY_MODEL_INPUT_MODALITIES, modelReasoningEfforts: ANTIGRAVITY_MODEL_EFFORTS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
+  {
+    id: "google-aistudio",
+    label: "Google AI Studio (Web)",
+    adapter: "google",
+    baseUrl: "https://alkalimakersuite-pa.clients6.google.com",
+    authKind: "local",
+    keyOptional: true,
+    featured: true,
+    dashboardPreset: true,
+    dashboardUrl: "https://aistudio.google.com",
+    defaultModel: "gemini-3.7-flash",
+    models: ["gemini-3.7-flash", "gemini-3.1-pro-preview", "gemini-2.5-pro", "gemini-2.5-flash", "gemini-3.5-flash"],
+    liveModels: false,
+    // Conservative pacing for a browser-backed subscription session: avoid bursts while
+    // keeping interactive coding-agent requests usable. Jitter reduces synchronized retries.
+    requestPacing: { enabled: true, requestsPerMinute: 8, minIntervalMs: 7_500, jitterMs: 1_500 },
+    googleMode: "ai-studio-web",
+    jawcodeBundle: "google",
+    extraMetadataAliases: ["aistudio", "gemini-aistudio"],
+    note: "Relays prompts through your active Google AI Studio / Google AI Pro browser session at /aistudio/bridge (default proxy port 10100).",
+  },
   { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
   { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
   { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
@@ -1867,6 +1889,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     liveModels: true,
     preserveCustomDestination: true,
     defaultModel: "deepseek/deepseek-v4-flash",
+    promptCacheKey: true,
     // The default is also the cold-start seed: live discovery failure must not empty the catalog
     // for a freshly configured provider with no stale cache (issue #308 pattern).
     models: ["deepseek/deepseek-v4-flash"],
@@ -2911,8 +2934,8 @@ export function providerCodexAccountMode(id: string, provider?: OcxProviderConfi
  */
 export function effectiveGoogleMode(
   providerId: string,
-  prov: { adapter?: string; googleMode?: "ai-studio" | "vertex" | "cloud-code-assist" },
-): "ai-studio" | "vertex" | "cloud-code-assist" | null {
+  prov: { adapter?: string; googleMode?: "ai-studio" | "vertex" | "cloud-code-assist" | "ai-studio-web" },
+): "ai-studio" | "vertex" | "cloud-code-assist" | "ai-studio-web" | null {
   if (prov.adapter !== "google") return null;
   return prov.googleMode ?? getProviderRegistryEntry(providerId)?.googleMode ?? "ai-studio";
 }

package/src/providers/request-pacing.ts

@@ -33,6 +33,8 @@ interface Waiter {
   modelId?: string;
   providerIntervalMs: number;
   modelIntervalMs: number;
+  providerJitterMs: number;
+  modelJitterMs: number;
   queuedAt: number;
   signal?: AbortSignal;
   resolve: () => void;
@@ -54,6 +56,7 @@ export interface RequestPacingRuntime {
   setTimer: (callback: () => void, delayMs: number) => unknown;
   clearTimer: (handle: unknown) => void;
   enqueueMicrotask: (callback: () => void) => void;
+  random: () => number;
 }
 
 export interface ProviderRequestPacingStatus {
@@ -71,6 +74,7 @@ const defaultRuntime: RequestPacingRuntime = {
   setTimer: (callback, delayMs) => setTimeout(callback, delayMs),
   clearTimer: handle => clearTimeout(handle as ReturnType<typeof setTimeout>),
   enqueueMicrotask: queueMicrotask,
+  random: Math.random,
 };
 let runtime = defaultRuntime;
 let lastReconciledGeneration = 0;
@@ -90,6 +94,19 @@ function normalizedInterval(rule: RequestPacingRule | undefined): number {
   return Math.max(rpmInterval, fixedInterval);
 }
 
+function normalizedJitter(rule: RequestPacingRule | undefined): number {
+  return rule?.jitterMs !== undefined && Number.isInteger(rule.jitterMs)
+    ? Math.min(60_000, Math.max(0, rule.jitterMs))
+    : 0;
+}
+
+function jitterDelay(jitterMs: number): number {
+  if (jitterMs <= 0) return 0;
+  const sample = runtime.random();
+  if (!Number.isFinite(sample)) return 0;
+  return Math.min(jitterMs, Math.floor(Math.max(0, sample) * jitterMs));
+}
+
 export function requestPacingIntervalMs(provider: OcxProviderConfig, modelId?: string): number {
   const policy = provider.requestPacing;
   if (!policy?.enabled) return 0;
@@ -100,12 +117,17 @@ export function requestPacingIntervalMs(provider: OcxProviderConfig, modelId?: s
 function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string): {
   providerIntervalMs: number;
   modelIntervalMs: number;
+  providerJitterMs: number;
+  modelJitterMs: number;
 } {
   const policy = provider.requestPacing;
-  if (!policy?.enabled) return { providerIntervalMs: 0, modelIntervalMs: 0 };
+  if (!policy?.enabled) return { providerIntervalMs: 0, modelIntervalMs: 0, providerJitterMs: 0, modelJitterMs: 0 };
+  const model = modelId ? policy.models?.[modelId] : undefined;
   return {
     providerIntervalMs: normalizedInterval(policy),
-    modelIntervalMs: modelId ? normalizedInterval(policy.models?.[modelId]) : 0,
+    modelIntervalMs: normalizedInterval(model),
+    providerJitterMs: normalizedJitter(policy),
+    modelJitterMs: normalizedJitter(model),
   };
 }
 
@@ -186,9 +208,9 @@ function runQueue(providerName: string, state: ProviderPacer): void {
   const startedAt = runtime.now();
   state.lastStartedAt = startedAt;
   state.lastModelId = waiter.modelId;
-  state.providerNextStartAt = startedAt + waiter.providerIntervalMs;
-  if (waiter.modelId && waiter.modelIntervalMs > 0) {
-    state.modelNextStartAt.set(waiter.modelId, startedAt + waiter.modelIntervalMs);
+  state.providerNextStartAt = startedAt + waiter.providerIntervalMs + jitterDelay(waiter.providerJitterMs);
+  if (waiter.modelId && (waiter.modelIntervalMs > 0 || waiter.modelJitterMs > 0)) {
+    state.modelNextStartAt.set(waiter.modelId, startedAt + waiter.modelIntervalMs + jitterDelay(waiter.modelJitterMs));
   }
   waiter.resolve();
   runtime.enqueueMicrotask(() => runQueue(providerName, state));
@@ -201,7 +223,12 @@ export async function waitForProviderRequestSlot(
   signal?: AbortSignal,
 ): Promise<void> {
   const intervals = requestPacingIntervals(provider, modelId);
-  if (Math.max(intervals.providerIntervalMs, intervals.modelIntervalMs) <= 0) return;
+  if (Math.max(
+    intervals.providerIntervalMs,
+    intervals.modelIntervalMs,
+    intervals.providerJitterMs,
+    intervals.modelJitterMs,
+  ) <= 0) return;
   if (signal?.aborted) throw abortReason(signal);
 
   const state = pacers.get(providerName) ?? {

package/src/providers/xai-transport.ts

@@ -4,6 +4,27 @@ import { resolveGithubCopilotTransport } from "./github-copilot-transport";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
+/** The two hosts that serve xAI's Responses API: the public API and the Grok CLI proxy. */
+const XAI_RESPONSES_HOSTS = new Set(["api.x.ai", "cli-chat-proxy.grok.com"]);
+
+/**
+ * True when this provider's Responses traffic terminates at xAI itself.
+ *
+ * Probed 2026-08-22 one field per request: the two hosts accept and refuse exactly the same
+ * web_search fields, so they are one dialect rather than two. Matching is exact-host over
+ * https, which keeps lookalikes (`api.x.ai.evil.test`) and nonstandard ports out.
+ */
+export function isXaiResponsesDestination(provider: Pick<OcxProviderConfig, "baseUrl">): boolean {
+  try {
+    const url = new URL(provider.baseUrl);
+    return url.protocol === "https:"
+      && XAI_RESPONSES_HOSTS.has(url.hostname.toLowerCase())
+      && (url.port === "" || url.port === "443");
+  } catch {
+    return false;
+  }
+}
+
 export const XAI_GROK_COMPATIBILITY = {
   version: "0.2.93",
   userAgent: "opencodex-grok/0.2.93",

package/src/responses/google-provider-options.ts

@@ -0,0 +1,36 @@
+import { effectiveGoogleMode } from "../providers/registry";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+
+const AI_STUDIO_CACHED_CONTENT = /^cachedContents\/[^/?#\s]+$/;
+const VERTEX_CACHED_CONTENT = /^projects\/[^/?#\s]+\/locations\/[^/?#\s]+\/cachedContents\/[^/?#\s]+$/;
+
+export function googleProviderOptionsRouteError(
+  parsed: Pick<OcxParsedRequest, "options">,
+  route: {
+    providerName: string;
+    provider: OcxProviderConfig;
+    adapterName: string;
+  },
+): string | undefined {
+  if (!parsed.options.providerOptions?.google) return undefined;
+  const mode = effectiveGoogleMode(route.providerName, route.provider);
+  if (mode === "cloud-code-assist") {
+    return "provider_options.google is not supported on Google Cloud Code Assist routes";
+  }
+  if (route.adapterName !== "google" || (mode !== "ai-studio" && mode !== "vertex")) {
+    return "provider_options.google is supported only on Google AI Studio or Vertex routes";
+  }
+  if (mode === "ai-studio") {
+    const cachedContent = parsed.options.providerOptions.google.cachedContent;
+    if (cachedContent && VERTEX_CACHED_CONTENT.test(cachedContent)) {
+      return "provider_options.google.cached_content must use cachedContents/{id} on Google AI Studio routes";
+    }
+  }
+  if (mode === "vertex") {
+    const cachedContent = parsed.options.providerOptions.google.cachedContent;
+    if (cachedContent && AI_STUDIO_CACHED_CONTENT.test(cachedContent)) {
+      return "provider_options.google.cached_content must use projects/{project}/locations/{location}/cachedContents/{id} on Vertex routes";
+    }
+  }
+  return undefined;
+}