@yansigit/opencodex 2.32.0 → 2.33.1

package/src/server/aistudio-ws-hub.ts

@@ -0,0 +1,295 @@
+/**
+ * In-process WebSocket Relay Hub for Google AI Studio Web / Build sessions.
+ */
+
+export interface WsRelayRequest {
+  url: string;
+  method: string;
+  headers?: Record<string, string>;
+  body?: string;
+}
+
+export interface WsRelayStreamResult {
+  chunks: AsyncIterable<string>;
+  status?: number;
+  headers?: Record<string, string>;
+}
+
+export interface WebSocketLike {
+  send(data: string): void;
+  close(code?: number, reason?: string): void;
+}
+
+interface PendingStream {
+  pushChunk(chunk: string): void;
+  finish(): void;
+  fail(err: Error): void;
+}
+
+export interface AiStudioRelayHub {
+  hasActiveSessions(): boolean;
+  getActiveSessionCount(): number;
+  registerSession(id: string, ws: WebSocketLike): void;
+  unregisterSession(id: string): void;
+  reset(): void;
+  dispatchStream(req: WsRelayRequest, signal?: AbortSignal): Promise<WsRelayStreamResult>;
+  handleClientMessage(sessionId: string, raw: string): void;
+}
+
+export function createAiStudioRelayHub(): AiStudioRelayHub {
+  const sessions = new Map<string, WebSocketLike>();
+  const pendingRequests = new Map<string, PendingStream>();
+  const pendingBySession = new Map<string, Set<string>>();
+  let sessionRoundRobin = 0;
+
+  function getNextSession(): { id: string; ws: WebSocketLike } | undefined {
+    for (const [id, ws] of sessions.entries()) {
+      if ((ws as any).readyState !== undefined && (ws as any).readyState > 1) {
+        sessions.delete(id);
+      }
+    }
+    const arr = Array.from(sessions.values());
+    if (arr.length === 0) return undefined;
+    const id = Array.from(sessions.keys())[sessionRoundRobin % arr.length]!;
+    const ws = sessions.get(id)!;
+    sessionRoundRobin = (sessionRoundRobin + 1) % arr.length;
+    return { id, ws };
+  }
+
+  return {
+    hasActiveSessions() {
+      return sessions.size > 0;
+    },
+
+    getActiveSessionCount() {
+      return sessions.size;
+    },
+
+    registerSession(id: string, ws: WebSocketLike) {
+      sessions.set(id, ws);
+      console.log(`[AIStudioHub] registered session: ${id}, total: ${sessions.size}`);
+    },
+
+    unregisterSession(id: string) {
+      sessions.delete(id);
+      console.log(`[AIStudioHub] unregistered session: ${id}, remaining: ${sessions.size}`);
+      const requestIds = pendingBySession.get(id);
+      if (!requestIds) return;
+      for (const requestId of requestIds) {
+        pendingRequests.get(requestId)?.fail(new Error("Google AI Studio browser session disconnected"));
+      }
+      pendingBySession.delete(id);
+    },
+
+    reset() {
+      for (const pending of pendingRequests.values()) {
+        pending.fail(new Error("AI Studio relay hub reset"));
+      }
+      sessions.clear();
+      pendingRequests.clear();
+      pendingBySession.clear();
+      sessionRoundRobin = 0;
+    },
+
+    async dispatchStream(req: WsRelayRequest, signal?: AbortSignal): Promise<WsRelayStreamResult> {
+      const session = getNextSession();
+      if (!session) {
+        throw new Error("No active Google AI Studio browser session connected. Open the AI Studio bridge in your browser to start.");
+      }
+      const { id: sessionId, ws } = session;
+
+      const reqId = `req_${crypto.randomUUID()}`;
+      const chunkQueue: string[] = [];
+      let resolveNextChunk: ((value: IteratorResult<string>) => void) | null = null;
+      let rejectNextChunk: ((err: Error) => void) | null = null;
+      let isFinished = false;
+      let finishError: Error | null = null;
+
+      const pending: PendingStream = {
+        pushChunk(chunk: string) {
+          if (isFinished) return;
+          if (resolveNextChunk) {
+            const r = resolveNextChunk;
+            resolveNextChunk = null;
+            rejectNextChunk = null;
+            r({ value: chunk, done: false });
+          } else {
+            chunkQueue.push(chunk);
+          }
+        },
+        finish() {
+          if (isFinished) return;
+          isFinished = true;
+          pendingRequests.delete(reqId);
+          pendingBySession.get(sessionId)?.delete(reqId);
+          if (resolveNextChunk) {
+            const r = resolveNextChunk;
+            resolveNextChunk = null;
+            rejectNextChunk = null;
+            r({ value: undefined as any, done: true });
+          }
+        },
+        fail(err: Error) {
+          if (isFinished) return;
+          isFinished = true;
+          finishError = err;
+          pendingRequests.delete(reqId);
+          pendingBySession.get(sessionId)?.delete(reqId);
+          if (rejectNextChunk) {
+            const r = rejectNextChunk;
+            resolveNextChunk = null;
+            rejectNextChunk = null;
+            r(err);
+          }
+        },
+      };
+
+      pendingRequests.set(reqId, pending);
+      const requestIds = pendingBySession.get(sessionId) ?? new Set<string>();
+      requestIds.add(reqId);
+      pendingBySession.set(sessionId, requestIds);
+
+      if (signal) {
+        signal.addEventListener("abort", () => {
+          try {
+            ws.send(JSON.stringify({ id: reqId, type: "abort" }));
+          } catch (err) {
+            void err;
+          }
+          pending.fail(new Error("Request aborted by client"));
+        });
+      }
+
+      const msg = {
+        id: reqId,
+        type: "http_request",
+        payload: {
+          url: req.url,
+          method: req.method,
+          headers: req.headers ?? {},
+          body: req.body ?? "",
+        },
+      };
+
+      ws.send(JSON.stringify(msg));
+
+      const asyncIterable: AsyncIterable<string> = {
+        [Symbol.asyncIterator]() {
+          return {
+            async next(): Promise<IteratorResult<string>> {
+              if (chunkQueue.length > 0) {
+                return { value: chunkQueue.shift()!, done: false };
+              }
+              if (isFinished) {
+                if (finishError) throw finishError;
+                return { value: undefined as any, done: true };
+              }
+              return new Promise<IteratorResult<string>>((resolve, reject) => {
+                resolveNextChunk = resolve;
+                rejectNextChunk = reject;
+              });
+            },
+          };
+        },
+      };
+
+      return { chunks: asyncIterable };
+    },
+
+    handleClientMessage(sessionId: string, raw: string) {
+      let data: any;
+      try {
+        data = JSON.parse(raw);
+      } catch (err) {
+        console.log("[AIStudioHub] failed to parse JSON message:", err);
+        void err;
+        return;
+      }
+
+      const { id, type, payload } = data || {};
+      if (!id) {
+        console.log("[AIStudioHub] message missing id");
+        return;
+      }
+
+      const pending = pendingRequests.get(id);
+      if (!pending || !pendingBySession.get(sessionId)?.has(id)) {
+        console.log("[AIStudioHub] no pending request for id:", id, "session:", sessionId);
+        return;
+      }
+
+      if (type === "stream_chunk") {
+        if (payload?.data) {
+          pending.pushChunk(payload.data);
+        }
+      } else if (type === "stream_end" || type === "http_response") {
+        if (payload?.body) {
+          pending.pushChunk(payload.body);
+        }
+        pending.finish();
+      } else if (type === "error") {
+        console.log(`[AIStudioHub] client error from ${sessionId}:`, payload?.error);
+        pending.fail(new Error(payload?.error || "Upstream AI Studio error"));
+      }
+    },
+  };
+}
+
+export const globalAiStudioRelayHub = createAiStudioRelayHub();
+
+export function getAiStudioUserScript(listenPort: number): string {
+  return `// ==UserScript==
+// @name         OpenCodex AI Studio Relay Bridge
+// @namespace    https://opencodex.dev/
+// @version      1.0.0
+// @description  Relays requests from opencodex to Google AI Studio session
+// @match        https://aistudio.google.com/*
+// @grant        none
+// @run-at       document-idle
+// ==/UserScript==
+
+(function() {
+  'use strict';
+  const WS_URL = "ws://127.0.0.1:${listenPort}/v1/ws/aistudio";
+  let ws;
+  function connect() {
+    try { ws = new WebSocket(WS_URL); } catch { setTimeout(connect, 3000); return; }
+    ws.onmessage = async (e) => {
+      try {
+        const msg = JSON.parse(e.data);
+        if (msg.type === "http_request") {
+          const { id, payload } = msg;
+          try {
+            const res = await fetch(payload.url, { method: payload.method, headers: payload.headers, body: payload.body, credentials: "include" });
+            if (payload.url.includes("streamGenerateContent") && res.body) {
+              const reader = res.body.getReader();
+              const decoder = new TextDecoder();
+              while (true) {
+                const { done, value } = await reader.read();
+                if (done) break;
+                ws.send(JSON.stringify({ id, type: "stream_chunk", payload: { data: decoder.decode(value, { stream: true }) } }));
+              }
+              ws.send(JSON.stringify({ id, type: "stream_end", payload: {} }));
+            } else {
+              const text = await res.text();
+              ws.send(JSON.stringify({ id, type: "http_response", payload: { body: text, status: res.status } }));
+            }
+          } catch (err) {
+            ws.send(JSON.stringify({ id, type: "error", payload: { error: String(err) } }));
+          }
+        }
+      } catch (err) {
+        void err;
+      }
+    };
+    ws.onclose = () => setTimeout(connect, 3000);
+  }
+  connect();
+})();
+`;
+}
+
+export function getAiStudioBridgeHtml(listenPort: number): string {
+  const extensionPath = typeof process !== "undefined" ? process.cwd() + "/integrations/aistudio-extension" : "integrations/aistudio-extension";
+  return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Google AI Studio Bridge</title><style>body{font-family:system-ui,-apple-system,sans-serif;background:#121316;color:#e1e3e6;padding:2rem;max-width:680px;margin:auto;line-height:1.5}.card{background:#1e1f23;border:1px solid #2d2f34;border-radius:8px;padding:1.5rem;margin-bottom:1.5rem}.status{display:inline-block;padding:0.25rem 0.75rem;border-radius:4px;font-weight:500}.connected{background:#163820;color:#4ade80}.disconnected{background:#3b1717;color:#f87171}code{background:#2a2c31;padding:0.2rem 0.4rem;border-radius:4px}.btn{display:inline-block;padding:0.5rem 1rem;background:#3b82f6;color:#fff;text-decoration:none;border-radius:6px;font-weight:500;margin-top:0.5rem}pre{background:#16171a;padding:1rem;border-radius:6px;overflow-x:auto;font-size:0.85rem}</style></head><body><div class="card"><h2>Google AI Studio Bridge</h2><p>Status: <span id="status" class="status disconnected">Connecting...</span></p><p>This bridge connects <code>opencodex</code> with your active Google AI Studio / Google AI Pro session.</p></div><div class="card"><h3>🧩 Option 1: Unpacked Extension for Brave / Chrome (Zero Tab Overhead)</h3><p>Run entirely in the background without needing an active browser tab:</p><ol style="padding-left:1.2rem;margin:0.5rem 0"><li>Open <code>brave://extensions</code> (or <code>chrome://extensions</code>) and toggle <strong>Developer mode</strong> in the top-right.</li><li>Click <strong>Load unpacked</strong> and select this directory:<br><code id="ext-path">${extensionPath}</code></li></ol><button class="btn" style="cursor:pointer" onclick="navigator.clipboard.writeText(document.getElementById('ext-path').textContent);this.textContent='Copied!'">📋 Copy Extension Directory Path</button></div><div class="card"><h3>🌐 Option 2: Userscript (Tampermonkey) or Console</h3><p>Install via Tampermonkey/Violentmonkey or paste in Developer Tools Console:</p><p><a class="btn" href="/aistudio/bridge.user.js">⚡ Install Userscript</a> <a class="btn" style="background:#374151;margin-left:0.5rem" href="https://aistudio.google.com" target="_blank">Open aistudio.google.com ↗</a></p><pre style="margin-top:1rem"><code>const ws=new WebSocket('ws://127.0.0.1:${listenPort}/v1/ws/aistudio');ws.onmessage=async(e)=>{const{id,payload,type}=JSON.parse(e.data);if(type==='http_request'){try{const res=await fetch(payload.url,{method:payload.method,headers:payload.headers,body:payload.body,credentials:'include'});if(payload.url.includes('streamGenerateContent')&&res.body){const r=res.body.getReader(),d=new TextDecoder();while(true){const{done,value}=await r.read();if(done)break;ws.send(JSON.stringify({id,type:'stream_chunk',payload:{data:d.decode(value,{stream:true})}}))}ws.send(JSON.stringify({id,type:'stream_end',payload:{}}))}else{const body=await res.text();ws.send(JSON.stringify({id,type:'http_response',payload:{body,status:res.status}}))}}catch(err){ws.send(JSON.stringify({id,type:'error',payload:{error:String(err)}}))}}};console.log('opencodex AI Studio relay active!');</code></pre></div><script>let ws;const statusEl=document.getElementById("status");function connect(){const proto=location.protocol==="https:"?"wss:":"ws:";ws=new WebSocket(proto+"//"+location.host+"/v1/ws/aistudio");ws.onopen=()=>{statusEl.textContent="🟢 Connected (Relay Active)";statusEl.className="status connected"};ws.onclose=()=>{statusEl.textContent="🔴 Disconnected (Retrying...)";statusEl.className="status disconnected";setTimeout(connect,2000)}};connect()</script></body></html>`;
+}

package/src/server/auth-cors.ts

@@ -10,6 +10,7 @@ import {
 } from "../config";
 import {
   apiKeyTransportConfigError,
+  azureCredentialConfigError,
   booleanRecordConfigError,
   modelAdapterRecordConfigError,
   nonBlankStringArrayConfigError,
@@ -19,6 +20,7 @@ import {
   providerHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
   upstreamHttpVersionConfigError,
+  isAzureIdentityProvider,
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
@@ -26,8 +28,10 @@ import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
+import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
 import { googleVertexLocationConfigError } from "../providers/google-vertex-location";
 import { xaiResponsesOptInState } from "../providers/xai-responses-opt-in";
+import { antigravityOAuthDestinationConfigError, getProviderTlsProfileStatus, providerTlsProfileConfigError } from "../lib/provider-tls-profile";
 
 let _corsOrigin = "http://localhost:10100";
 export function setCorsOrigin(port: number): void { _corsOrigin = `http://localhost:${port}`; }
@@ -565,6 +569,8 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     if (contextOverlayError) return contextOverlayError;
     delete canonicalCandidate.contextWindow;
     delete canonicalCandidate.modelContextWindows;
+    // User-owned soft compaction policy; it does not alter the canonical transport seed.
+    delete canonicalCandidate.modelAutoCompactTokenLimits;
     const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
@@ -573,6 +579,12 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     return `provider ${name} must not include codexAccountMode`;
   }
   const typed = provider as unknown as OcxProviderConfig;
+  const tlsProfileError = providerTlsProfileConfigError(name, typed);
+  if (tlsProfileError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${tlsProfileError}`;
+  }
+  const antigravityError = antigravityOAuthDestinationConfigError(name, typed);
+  if (antigravityError) return `provider ${name} ${antigravityError}`;
   const baseUrlError = providerBaseUrlConfigError(typed.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
   if (effectiveGoogleMode(name, typed) === "vertex" && typed.location !== undefined) {
@@ -605,8 +617,17 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   }
   const apiKeyTransportError = apiKeyTransportConfigError(typed);
   if (apiKeyTransportError) return `provider ${name} ${apiKeyTransportError}`;
+  const azureCredentialError = azureCredentialConfigError(raw);
+  if (azureCredentialError) return `provider ${JSON.stringify(redactSecretString(name))} ${azureCredentialError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
   if (maxInputError) return `provider ${name} ${maxInputError}`;
+  const autoCompactError = modelAutoCompactTokenLimitsConfigError(
+    raw.modelAutoCompactTokenLimits,
+    { requireNativeIds: name === "openai" },
+  );
+  if (autoCompactError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${autoCompactError}`;
+  }
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
   const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
@@ -689,6 +710,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       adapter: provider.adapter,
       baseUrl: publicProviderBaseUrl(provider.baseUrl),
       hasApiKey: !!provider.apiKey,
+      hasAzureCredential: isAzureIdentityProvider(provider),
       hasHeaders: !!provider.headers && Object.keys(provider.headers).length > 0,
     };
     if (name === "xai") {
@@ -699,14 +721,17 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "disabled",
       "allowPrivateNetwork",
       "authMode",
+      "googleMode",
       "apiKeyTransport",
       "keyOptional",
       "freeTier",
       "liveModels",
       "requestPacing",
+      "tlsProfile",
       "models",
       "contextWindow",
       "modelContextWindows",
+      "modelAutoCompactTokenLimits",
       "defaultMaxOutputTokens",
       "modelMaxOutputTokens",
       "openRouterRouting",
@@ -728,6 +753,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
+    dto.tlsProfileStatus = provider.tlsProfile === undefined ? "disabled" : getProviderTlsProfileStatus(name, provider);
     const modelCosts = sanitizeModelCostsForDisplay(provider.modelCosts);
     if (modelCosts) dto.modelCosts = modelCosts;
     // Resolve the note by DESTINATION, not by name. A preset saved under a custom name is
@@ -748,6 +774,9 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     defaultProvider: config.defaultProvider,
     codexAutoStart: codexAutoStartEnabled(config),
     websockets: config.websockets,
+    // The GUI's browser-open toggle reads and writes this; absent means the
+    // historical auto-open behavior.
+    oauthOpenBrowser: config.oauthOpenBrowser !== false,
     providers,
   };
 }

package/src/server/chat-completions.ts

@@ -9,6 +9,7 @@ import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import {
   assertChatCompletionsRoutingBody,
   ChatCompletionsRequestError,
+  copyChatResponsesSessionHeaders,
   chatCompletionsToResponsesBody,
 } from "../chat/inbound";
 import {
@@ -201,6 +202,7 @@ async function handleChatCompletionsWithBudget(
     const value = req.headers.get(name);
     if (value) headers.set(name, value);
   }
+  copyChatResponsesSessionHeaders(req.headers, headers);
   // Prefer main ChatGPT auth so OpenAI-backed sidecars remain reachable on routed turns.
   if (!directRoute) {
     // This enrichment is optional for routed/non-main providers. If native main

package/src/server/images.ts

@@ -33,7 +33,9 @@ import { readJsonRequestBody } from "./request-decompress";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
-import { getValidAccessToken, getOAuthCredentialProjectId } from "../oauth/index";
+import { getValidAccessToken, getOAuthCredentialProjectId, getValidAccessTokenSnapshot, type OAuthAccessSnapshot } from "../oauth/index";
+import { isCanonicalAntigravityUrl, providerTlsFetch } from "../lib/provider-tls-profile";
+import { redactErrorMessage } from "../lib/redact";
 import { safeAntigravityHttpErrorMessage } from "../adapters/google-errors";
 import { sanitizeUpstreamErrorText } from "../adapters/upstream-http-error";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
@@ -156,6 +158,9 @@ async function tryCcaImageGeneration(
   if (endpoint !== "generations") return undefined;
   const provider = config.providers?.["google-antigravity"];
   if (!provider || provider.disabled) return undefined;
+  if (provider.baseUrl && !isCanonicalAntigravityUrl(provider.baseUrl)) {
+    return formatErrorResponse(400, "invalid_request_error", "google-antigravity requires a canonical destination");
+  }
 
   const prompt = (body as { prompt?: unknown })?.prompt;
   if (typeof prompt !== "string" || !prompt.trim()) {
@@ -174,36 +179,25 @@ async function tryCcaImageGeneration(
   // OAuth token refresh and project discovery, not just the upstream fetch.
   const timeoutMs = config.images?.timeoutMs ?? IMAGES_UPSTREAM_TIMEOUT_MS;
   const linkedSignal = signalWithTimeout(timeoutMs, signal);
-  let token: string;
+  let snapshot: OAuthAccessSnapshot;
   try {
-    // Race the OAuth refresh against the deadline signal. getValidAccessToken
-    // chains through 4 layers (resolveAccessSnapshotForAccount →
-    // refreshAndPersistAccessToken → refreshGenericAccountWithLock →
-    // def.refresh()) that do HTTP calls without accepting a signal. Rather than
-    // threading signal through the entire chain, race the whole call against
-    // linkedSignal: when the signal aborts we stop awaiting and surface the
-    // cancellation immediately instead of hanging on the refresh HTTP call.
-    token = await abortableRace(getValidAccessToken("google-antigravity"), linkedSignal.signal);
+    snapshot = await abortableRace(getValidAccessTokenSnapshot("google-antigravity"), linkedSignal.signal);
   } catch (err) {
     linkedSignal.cleanup();
-    // abortableRace rejects immediately when the signal fires, so client
-    // cancellation and deadline expiry surface here. Parent abort propagates
-    // into the linked signal, so check parent first (499) before the linked
-    // signal (504).
     if (signal.aborted) {
       return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
     }
     if (linkedSignal.signal.aborted) {
       return formatErrorResponse(504, "upstream_error", "CCA image generation timed out during authentication");
     }
-    // Missing/revoked credential → 401 (re-login required); transient refresh/network → 502.
     const errName = err instanceof Error ? err.name : "";
     if (errName === "OAuthLoginRequiredError") {
       return formatErrorResponse(401, "invalid_request_error", "Google Antigravity login required: run 'ocx login google-antigravity'");
     }
     return formatErrorResponse(502, "upstream_error", "CCA image generation failed: OAuth token refresh failed");
   }
-  const project = getOAuthCredentialProjectId("google-antigravity");
+  const token = snapshot.accessToken;
+  const project = snapshot.projectId;
   if (!project) {
     linkedSignal.cleanup();
     return formatErrorResponse(
@@ -234,10 +228,8 @@ async function tryCcaImageGeneration(
   let upstream: Response | undefined;
   try {
     try {
-      // Image generation is a paid, non-idempotent POST. A transport failure is
-      // ambiguous: the upstream may have accepted the request before the
-      // connection failed, so never replay it on a peer host.
-      upstream = await fetch(`${baseUrl}/v1internal:generateContent`, {
+      const executor = providerTlsFetch("google-antigravity", provider, globalThis.fetch);
+      upstream = await executor(`${baseUrl}/v1internal:generateContent`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -249,23 +241,15 @@ async function tryCcaImageGeneration(
       });
     } catch (err) {
       if (signal.aborted) return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
+      const rawMsg = err instanceof Error ? err.message : String(err);
+      const safeMsg = redactErrorMessage(sanitizeUpstreamErrorText(rawMsg));
       if (err instanceof Error && err.name === "TimeoutError") {
-        return ccaAmbiguousImageTransportError("upstream request timed out");
+        return formatErrorResponse(504, "upstream_error", `CCA image generation timed out: ${safeMsg}`);
       }
-      // Network/DNS/runtime errors may embed the request URL or headers verbatim
-      // (e.g. "fetch failed: https://…/v1internal:generateContent"). The token
-      // lives in an Authorization header, not in the URL, but sanitize defensively
-      // so no upstream-rejected credential or query param can reach the client,
-      // and strip the internal base URL host from the surfaced message.
-      // 400, not 5xx: the POST is paid and non-idempotent. Codex retries every
-      // 5xx up to 5 attempts, which would duplicate generation after an ambiguous
-      // transport failure (the upstream may already have accepted the request).
-      const rawMsg = err instanceof Error ? err.message : String(err);
-      const safeMsg = sanitizeUpstreamErrorText(rawMsg).replace(
-        /https?:\/\/[^\s"'<>]+/gi,
-        "[upstream-url]",
-      );
-      return ccaAmbiguousImageTransportError(safeMsg);
+      if (provider.tlsProfile === "antigravity-browser") {
+        return formatErrorResponse(502, "upstream_error", `CCA image generation failed: ${safeMsg}`);
+      }
+      return ccaAmbiguousImageTransportError(safeMsg.replace(/https?:\/\/[^\s"'<>]+/gi, "[upstream-url]"));
     }
 
     // Stream the upstream body with a bounded reader so an oversized or malicious

package/src/server/index.ts

@@ -40,6 +40,7 @@ import {
   enforceAppOwnedMemoryBudget,
   resolveAppOwnedMemoryBudgetBytes,
 } from "../lib/app-owned-memory";
+import { getAiStudioBridgeHtml, getAiStudioUserScript, globalAiStudioRelayHub } from "./aistudio-ws-hub";
 import {
   registerAppOwnedMemorySweepFallback,
   registerDefaultAppOwnedMemoryStores,
@@ -668,6 +669,12 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     if (path === "/v1/realtime" || path === "/v1/live") {
       return req.headers.get("upgrade")?.toLowerCase() === "websocket";
     }
+    if (path === "/v1/ws/aistudio" || path === "/aistudio/ws") {
+      return req.headers.get("upgrade")?.toLowerCase() === "websocket";
+    }
+    if (path === "/v1/ws/aistudio/status") return req.method === "GET";
+    if (path === "/api/aistudio/session") return req.method === "POST";
+    if (path === "/aistudio/bridge" || path === "/aistudio/bridge.user.js") return req.method === "GET";
     return false;
   }
 
@@ -903,6 +910,73 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         return withCors(formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed"), req, policy);
       }
 
+      if (url.pathname === "/v1/ws/aistudio" || url.pathname === "/aistudio/ws") {
+        if (isDraining()) return drainingResponse(req, policy);
+        const admission = resolveApiAuth(req, policy);
+        if (!admission) {
+          return withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy);
+        }
+        const origin = req.headers.get("Origin");
+        const isExtensionOrigin = origin?.startsWith("chrome-extension://");
+        if (!isAllowedRequestOrigin(req, policy) && origin !== "https://aistudio.google.com" && !isExtensionOrigin) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "AI Studio relay WebSocket blocked: non-local Origin"), req, policy);
+        }
+        const sessionId = "aistudio_" + crypto.randomUUID().slice(0, 8);
+        if (requestServer.upgrade(req, {
+          data: { kind: "aistudio-relay", aistudioSessionId: sessionId },
+        })) return undefined as unknown as Response;
+       return withCors(formatErrorResponse(426, "upgrade_required", "AI Studio WebSocket upgrade failed"), req, policy);
+     }
+
+      if (url.pathname === "/v1/ws/aistudio/status" && req.method === "GET") {
+        return jsonResponse({
+          activeSessions: globalAiStudioRelayHub.getActiveSessionCount(),
+          hasActiveSessions: globalAiStudioRelayHub.hasActiveSessions(),
+        });
+      }
+
+      if (url.pathname === "/api/aistudio/session" && req.method === "POST") {
+        const admission = resolveApiAuth(req, policy);
+        if (!admission) {
+          return withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy);
+        }
+        const origin = req.headers.get("Origin");
+        const isExtensionOrigin = origin?.startsWith("chrome-extension://");
+        if (!isAllowedRequestOrigin(req, policy) && origin !== "https://aistudio.google.com" && !isExtensionOrigin) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin request blocked"), req, policy);
+        }
+        try {
+          const bodyJson = (await req.json()) as any;
+          const { saveAiStudioSession, saveAiStudioSessionFromToken } = await import("../oauth/aistudio-session-sync");
+          if (bodyJson.token && typeof bodyJson.token === "string") {
+            saveAiStudioSessionFromToken(bodyJson.token);
+          } else if (Array.isArray(bodyJson.cookies)) {
+            saveAiStudioSession({
+              selectedProject: bodyJson.selectedProject || "",
+              windowId: bodyJson.windowId || "",
+              cookies: bodyJson.cookies,
+            });
+          } else {
+            return withCors(jsonResponse({ error: "invalid session payload" }, 400), req, policy);
+          }
+          return withCors(jsonResponse({ ok: true, message: "AI Studio session updated successfully" }), req, policy);
+        } catch (err) {
+          return withCors(jsonResponse({ error: String(err) }, 400), req, policy);
+        }
+      }
+
+      if (url.pathname === "/aistudio/bridge" && req.method === "GET") {
+        const listenPort = (server.port ?? config.port) || 10100;
+        const bridgeHtml = getAiStudioBridgeHtml(listenPort);
+        return new Response(bridgeHtml, { headers: { "Content-Type": "text/html; charset=utf-8" } });
+      }
+
+      if (url.pathname === "/aistudio/bridge.user.js" && req.method === "GET") {
+        const listenPort = (server.port ?? config.port) || 10100;
+        const userScript = getAiStudioUserScript(listenPort);
+        return new Response(userScript, { headers: { "Content-Type": "application/javascript; charset=utf-8" } });
+      }
+
       if (url.pathname === "/healthz" && req.method === "GET") {
         // service/pid/port let CLI liveness reject foreign 200s and verify pid identity.
         const healthPort = server.port ?? listenPort;
@@ -1564,6 +1638,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       // Text frames. response.processed is a no-op ack. close() aborts the upstream (RC2 parity).
       // Live sideband sockets (kind=live-sideband) are a transparent bidirectional relay instead.
       open(ws: ServerWebSocket<WsData>) {
+        if (ws.data.kind === "aistudio-relay" && ws.data.aistudioSessionId) {
+          globalAiStudioRelayHub.registerSession(ws.data.aistudioSessionId, ws);
+          return;
+        }
         if (ws.data.kind === "live-sideband") {
           if (!ws.data.liveTurnAdmissionLease) {
             closeLiveSideband(ws, 1013, "server busy");
@@ -1580,6 +1658,18 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         registerCodexWebSocket(ws);
       },
       message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
+        if (ws.data.kind === "aistudio-relay" && ws.data.aistudioSessionId) {
+          const text = typeof raw === "string"
+            ? raw
+            : Buffer.isBuffer(raw)
+              ? raw.toString("utf-8")
+              : new TextDecoder().decode(raw as any);
+          globalAiStudioRelayHub.handleClientMessage(
+            ws.data.aistudioSessionId,
+            text
+          );
+          return;
+        }
         if (ws.data.kind === "live-sideband") {
           if (ws.data.liveClosing) return;
           const rawBytes = webSocketFrameBytes(raw);
@@ -1758,6 +1848,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         })();
       },
       close(ws: ServerWebSocket<WsData>) {
+        if (ws.data.kind === "aistudio-relay" && ws.data.aistudioSessionId) {
+          globalAiStudioRelayHub.unregisterSession(ws.data.aistudioSessionId);
+          return;
+        }
         if (ws.data.kind === "live-sideband") {
           closeLiveSideband(ws);
           return;