@yansigit/opencodex 2.32.0 → 2.33.1

package/src/adapters/cursor/tool-definitions.ts

@@ -48,6 +48,24 @@ export const CURSOR_EXEC_COMMAND_INPUT_SCHEMA = {
     tty: { type: "boolean", description: "True allocates a PTY for the command; false or omitted uses plain pipes." },
     yield_time_ms: { type: "number", description: "Wait before yielding output. Defaults to 10000 ms; effective range is 250-30000 ms." },
     max_output_tokens: { type: "number", description: "Output token budget. Defaults to 10000 tokens; larger requests may be capped by policy." },
+    sandbox_permissions: {
+      type: "string",
+      enum: ["use_default", "require_escalated"],
+      description: "Per-command sandbox override. Defaults to use_default; use require_escalated for unsandboxed execution.",
+    },
+    justification: {
+      type: "string",
+      description: "User-facing approval question for require_escalated; omit otherwise.",
+    },
+    prefix_rule: {
+      type: "array",
+      items: { type: "string" },
+      description: "Reusable approval prefix for cmd, only with sandbox_permissions: require_escalated; for example [\"git\", \"pull\"].",
+    },
+    login: {
+      type: "boolean",
+      description: "True runs the shell with -l/-i semantics; false disables them. Defaults to true.",
+    },
   },
   required: ["cmd"],
   additionalProperties: false,
@@ -94,6 +112,13 @@ export const CURSOR_MULTI_EDIT_INPUT_SCHEMA = {
   additionalProperties: false,
 } as const;
 
+/** Cursor requires freeform custom tools to advertise their body as one string input. */
+export const CURSOR_FREEFORM_INPUT_SCHEMA = {
+  type: "object",
+  properties: { input: { type: "string" } },
+  required: ["input"],
+} as const;
+
 /**
  * Responses/Codex-side schema used ONLY for arg-key normalization after Cursor returns a call.
  * Cursor models are trained to emit `cmd`; Codex `shell_command` / `exec_command` validate
@@ -109,6 +134,10 @@ export const CODEX_SHELL_BRIDGE_ARG_NORMALIZE_SCHEMA = {
     yield_time_ms: { type: "number", description: "Wait before yielding output. Defaults to 10000 ms; effective range is 250-30000 ms." },
     max_output_tokens: { type: "number", description: "Output token budget. Defaults to 10000 tokens; larger requests may be capped by policy." },
     max_output_chars: { type: "number", description: "Output character budget when the Responses tool uses chars instead of tokens." },
+    sandbox_permissions: { type: "string" },
+    justification: { type: "string" },
+    prefix_rule: { type: "array" },
+    login: { type: "boolean" },
   },
   required: ["command"],
 } as const;
@@ -364,6 +393,7 @@ export function responsesToolNameFromCursorWire(name: string, cursorToolNameMap?
 
 /** Schema advertised to Cursor for this tool (may use Cursor-preferred field names like `cmd`). */
 export function cursorToolInputSchema(tool: OcxTool): unknown {
+  if (tool.freeform) return CURSOR_FREEFORM_INPUT_SCHEMA;
   return isBareCodexExecCommandTool(tool) ? CURSOR_EXEC_COMMAND_INPUT_SCHEMA : (tool.parameters ?? {});
 }
 
@@ -373,6 +403,7 @@ export function cursorToolInputSchema(tool: OcxTool): unknown {
  * treating `cmd` as canonical prevents the `cmd` → `command` rewrite Codex requires (#399).
  */
 export function cursorToolArgNormalizeSchema(tool: OcxTool): unknown {
+  if (tool.freeform) return CURSOR_FREEFORM_INPUT_SCHEMA;
   if (isBareCodexShellBridgeTool(tool)) {
     return shellBridgeArgNormalizeSchema(tool);
   }
@@ -651,11 +682,17 @@ export function buildCursorToolGuidanceSystemNote(
     // Code mode: shell/edit/MCP live inside freeform `exec` as nested helpers. Without this the
     // model probes for a top-level shell tool that is not there.
     codeMode
-      ? `\`${CODEX_UNIFIED_EXEC_TOOL}\` is Codex code mode: its body is JavaScript evaluated in a V8 isolate, not a shell command and not Node. Shell, file edits, and MCP are nested helpers called INSIDE that body as \`await tools.<name>(...)\`, for example \`await tools.exec_command({cmd: \"ls\"})\`. Read the tool description and the isolate global \`ALL_TOOLS\` (not \`tools.ALL_TOOLS\`) for helpers this turn provides; absence from the top-level catalog or from \`exec\`'s description is not absence. Those nested helpers are not themselves top-level tools, so do not call \`exec_command\` or \`shell_command\` at the top level here${codeModeOtherTopLevelNames.length > 0 ? `; every other tool this turn lists, including ${quotedNames(codeModeOtherTopLevelNames)}, remains callable at the top level as usual` : ""}. Nested \`tools.apply_patch(input)\` is host-executed: the string must begin exactly with \`*** Begin Patch\` and end with \`*** End Patch\` (no trailing \`***\` on those lines). OpenCodex does not rewrite JavaScript inside exec, so a decorated \`*** Begin Patch ***\` envelope is rejected by Codex before the file is touched.`
+      ? `\`${CODEX_UNIFIED_EXEC_TOOL}\` is Codex code mode: its body is JavaScript evaluated in a V8 isolate, not a shell command and not Node. Shell, file edits, and MCP are nested helpers called INSIDE that body as \`await tools.<name>(...)\`, for example \`await tools.exec_command({cmd: \"ls\"})\`. When commands require network access, file writes outside workspace, or fail due to sandbox/permission restrictions, pass \`sandbox_permissions: "require_escalated"\` and a clear \`justification: "..."\` to \`tools.exec_command\`. Read the tool description and the isolate global \`ALL_TOOLS\` (not \`tools.ALL_TOOLS\`) for helpers this turn provides; absence from the top-level catalog or from \`exec\`'s description is not absence. Those nested helpers are not themselves top-level tools, so do not call \`exec_command\` or \`shell_command\` at the top level here${codeModeOtherTopLevelNames.length > 0 ? `; every other tool this turn lists, including ${quotedNames(codeModeOtherTopLevelNames)}, remains callable at the top level as usual` : ""}. Your tool list may display tools under a longer \`mcp_opencodex-responses_*\` name; call whichever your list shows. Nested \`tools.apply_patch(input)\` is host-executed: the string must begin exactly with \`*** Begin Patch\` and end with \`*** End Patch\` (no trailing \`***\` on those lines). OpenCodex does not rewrite JavaScript inside exec, so a decorated \`*** Begin Patch ***\` envelope is rejected by Codex before the file is touched.`
       : undefined,
     codeMode
       ? "In code mode the isolate returns nothing on its own: call `text(...)` (or `notify(...)`) on any value you need to see, or the call completes with empty output. There is no `require`, no `module`, and no filesystem or network globals; reach the host only through the nested helpers."
       : undefined,
+    codeMode
+      ? "To read, search, or inspect files or run CLI commands, call `await tools.exec_command({ cmd: '...' })` inside `exec`. Do not write Node.js scripts or `require('fs')`."
+      : undefined,
+    codeMode
+      ? "NEVER attempt Cursor-native Shell, Read, Grep, List, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
+      : undefined,
     hasBareExec
       ? `${shellBridgeLabel} is the Codex Responses shell bridge for this turn, exposed through Cursor's tool protocol; it is not an external MCP server tool. \`shell_command\` and \`exec_command\` are aliases of the same bridge.`
       : undefined,
@@ -663,7 +700,13 @@ export function buildCursorToolGuidanceSystemNote(
       ? "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
       : undefined,
     hasBareExec
-      ? `Prefer the Codex shell bridge over Cursor-native Shell/Read. If a Cursor-native file read, directory listing, grep, or shell operation is rejected, continue with the listed catalog tool ${shellBridgeLabel}.`
+      ? `NEVER attempt Cursor-native Shell, Read, Grep, List, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
+      : undefined,
+    hasBareExec
+      ? "Tool-selection commentary is forbidden: for any shell, read, grep, list, or file operation, your FIRST visible action is the bridge call itself — never a sentence about which tool you will use, which tool was redirected, or switching surfaces. Words like 차단/전환/blocked/switching must not appear in your output for tool-routing reasons."
+      : undefined,
+    hasBareExec
+      ? 'When a command requires network access, file writes outside workspace, or fails due to sandbox restrictions, include `sandbox_permissions: "require_escalated"` and `justification: "..."`.'
       : undefined,
     hostShellNote,
     "Cursor product features (Chronicle, screen recording, Notes, Plans, background agents) are available only if this turn's catalog lists a matching tool; do not offer or promise them otherwise.",
@@ -675,6 +718,9 @@ export function buildCursorToolGuidanceSystemNote(
         ? `For file edits, prefer the structured edit tools ${quotedNames(structuredEditNames)} — they take replacements that OpenCodex converts into Codex \`apply_patch\` changes. Include exact leading whitespace in old_string/new_string. Use \`apply_patch\` directly only with a \`*** Begin Patch\` envelope and bare \`@@\` hunks (never git-style \`@@ -n,m +n,m @@\`); never emit patch-like plain text as tool arguments.`
         : "For file edits, use the `apply_patch` tool, not built-in file write/delete tools."
       : undefined,
+    hasApplyPatch
+      ? "Creating or modifying file CONTENT via shell redirection (`>`, `>>`, `printf`/`echo` into a file, `cat <<EOF`, `sed -i`) is forbidden while apply_patch or the structured edit tools are advertised — use those edit tools so the change is reviewable. Shell output redirection is fine for logs/scratch pipes that are not the deliverable file."
+      : undefined,
     hasBareExec
       ? "For tool-count demos, each counted tool must be a separate Codex shell-bridge invocation/result; do not collapse several requested tools into one chained shell command."
       : undefined,
@@ -686,6 +732,7 @@ export function buildCursorToolGuidanceSystemNote(
       ? `Use ${discoveryTools} only for explicit discovery/resource tasks, not generic tool-count demos.`
       : undefined,
     "Do not count or report a tool call unless a tool result was actually returned.",
+    "When pursuing a multi-step task, check, or verification, do not stop or narrate intended future actions in plain text; immediately call the tool to execute the next step until the task is complete.",
     hasBareExec
       ? `If a Cursor-native file read, directory listing, grep, or shell operation is rejected by the runtime, use ${shellBridgeLabel} with an equivalent host-shell-safe command (POSIX: \`cat\`/\`ls\`/\`rg\`; Windows PowerShell: \`Get-Content\`/\`Get-ChildItem\`/\`Select-String\`). For file edits, use ${structuredEditNames.length > 0 ? `the structured edit tools (${quotedNames(structuredEditNames)}) or ` : ""}\`apply_patch\` when available.`
       : undefined,

package/src/adapters/cursor/tool-result-normalize.ts

@@ -44,8 +44,24 @@ const RUNTIME_FAILURE_GUIDANCE: ReadonlyArray<{ marker: string; guidance: string
     guidance: "The node_repl session keeps earlier declarations; rename the variable or use var/reassignment instead of redeclaring.",
   },
   {
-    marker: "unsupported import in exec",
-    guidance: "Imports are not available in this exec context; use the injected globals instead.",
+   marker: "unsupported import in exec",
+   guidance: "Imports are not available in this exec context; use the injected globals instead.",
+ },
+  {
+    marker: "require is not defined",
+    guidance: "In Codex code-mode exec (a V8 isolate, not Node.js), require/fs/process are not available. Use await tools.exec_command({ cmd: '...' }) inside exec to inspect files or run CLI tools.",
+  },
+  {
+    marker: "fs is not defined",
+    guidance: "In Codex code-mode exec (a V8 isolate, not Node.js), require/fs/process are not available. Use await tools.exec_command({ cmd: '...' }) inside exec to inspect files or run CLI tools.",
+  },
+  {
+    marker: "process is not defined",
+    guidance: "In Codex code-mode exec (a V8 isolate, not Node.js), require/fs/process are not available. Use await tools.exec_command({ cmd: '...' }) inside exec to inspect files or run CLI tools.",
+  },
+  {
+    marker: "module is not defined",
+    guidance: "In Codex code-mode exec (a V8 isolate, not Node.js), require/fs/process are not available. Use await tools.exec_command({ cmd: '...' }) inside exec to inspect files or run CLI tools.",
   },
 ];
 
@@ -80,13 +96,10 @@ export function normalizeCursorToolResultText(
       changed: true,
     };
   }
-  if (!isError) {
-    for (const { marker, guidance } of RUNTIME_FAILURE_GUIDANCE) {
-      if (text.includes(marker)) {
-        return { text: `${text}\n[recovery: ${guidance}]`, isError: true, changed: true };
-      }
+  for (const { marker, guidance } of RUNTIME_FAILURE_GUIDANCE) {
+    if (text.includes(marker) && !text.includes("[recovery:") && !text.includes(guidance)) {
+      return { text: `${text}\n[recovery: ${guidance}]`, isError: true, changed: true };
     }
   }
   return { text, isError, changed: false };
 }
-

package/src/adapters/cursor/types.ts

@@ -15,6 +15,13 @@ export interface CursorRunRequest {
   requestedModelParameters?: readonly CursorRequestedModelParameter[];
   /** Cursor Router optimization parameter; valid only while modelId is the `default` wire model. */
   routingLevel?: CursorRoutingLevel;
+  /**
+   * Corrective active-turn text for the single envelope-echo retry (devlog 260826 gap-10).
+   * When set on an external tool-result continuation, buildPreparedCursorRunRequest uses it as
+   * the userMessageAction text instead of the standard continuation text; rawMessages stay
+   * untouched so history replay is unchanged.
+   */
+  echoRetryContinuationText?: string;
   conversationId: string;
   system: string[];
   messages: CursorRequestMessage[];
@@ -25,9 +32,10 @@ export interface CursorRunRequest {
    * hydration). History stays text-only. data: URLs only in this slice.
    */
   selectedImages?: readonly ResolvedCursorImage[];
-  tools?: OcxTool[];
-  toolChoice?: OcxRequestOptions["toolChoice"];
-  parallelToolCalls?: boolean;
+ tools?: OcxTool[];
+ toolChoice?: OcxRequestOptions["toolChoice"];
+  textFormat?: OcxRequestOptions["textFormat"];
+ parallelToolCalls?: boolean;
   /**
    * Clear provider-private context-usage carry-forward before this run. Used when Codex starts a
    * newly observed compacted context epoch, so pre-compaction totals are not over-reported while

package/src/adapters/cursor.ts

@@ -41,6 +41,15 @@ import {
   shouldSurfaceCursorOverflowFirst,
 } from "./cursor/thread-continuity";
 import { runCursorTurnWithRetry } from "./cursor/transport-retry";
+import { cursorRequestHasShellAlias, cursorRequestUsesCodeMode } from "./cursor/tool-definitions";
+import {
+  CURSOR_ECHO_RETRY_CONTINUATION_TEXT,
+  CURSOR_ROUTING_COMMENTARY_RETRY_TEXT,
+  CursorEnvelopeEchoSniffer,
+  CursorRoutingCommentaryError,
+  CursorRoutingCommentarySniffer,
+  CursorToolResultEchoError,
+} from "./cursor/envelope-echo";
 import {
   createDisabledCursorTransport,
   CursorTransportDisabledError,
@@ -208,6 +217,38 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
         };
 
         const runOnce = async (activeRequest: ReturnType<typeof createCursorRequest>) => {
+          const effort = _parsed.options.reasoning;
+          const isHeavyReasoning = effort === "high"
+            || effort === "max"
+            || effort === "xhigh"
+            || activeRequest.modelId.includes("grok-4.6")
+            || activeRequest.modelId.includes("kimi-k3")
+            || activeRequest.modelId.includes("opus-4-8");
+          const heartbeatOnlyMs = isHeavyReasoning ? 300_000 : 180_000;
+          const armEchoSniffer =
+            isCursorExternalWireModel(activeRequest.modelId)
+            && (_parsed.context.messages ?? []).some(message => message.role === "toolResult");
+          const echoSniffer = armEchoSniffer ? new CursorEnvelopeEchoSniffer() : undefined;
+          const armRoutingCommentarySniffer =
+            isCursorExternalWireModel(activeRequest.modelId)
+            && (
+              cursorRequestUsesCodeMode(activeRequest.tools, activeRequest.toolChoice)
+              || cursorRequestHasShellAlias(activeRequest.tools)
+            );
+          const routingCommentarySniffer = armRoutingCommentarySniffer
+            ? new CursorRoutingCommentarySniffer()
+            : undefined;
+          let guardHeld: AdapterEvent[] = [];
+          const releaseGuardHeld = () => {
+            for (const held of guardHeld) {
+              if (held.type !== "heartbeat") emittedOutput = true;
+              emit(held);
+            }
+            guardHeld = [];
+          };
+          const guardsSettled = () =>
+            (!echoSniffer || echoSniffer.settled)
+            && (!routingCommentarySniffer || routingCommentarySniffer.settled);
           await runCursorTurnWithRetry(
             makeTransport,
             {
@@ -216,6 +257,7 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
               translatorBudget: incoming.translatorBudget,
               requestDeclaresFullAccess: cursorRequestDeclaresFullAccess(activeRequest),
               sessionId: activeRequest.conversationId,
+              streamHeartbeatOnlyFailMs: heartbeatOnlyMs,
               ...(incoming.providerFetch ? { fetch: incoming.providerFetch } : {}),
             },
             activeRequest,
@@ -237,6 +279,43 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
                 },
               });
               for (const event of events) {
+                if (!guardsSettled()) {
+                  if (event.type === "text_delta") {
+                    guardHeld.push(event);
+                    if (echoSniffer && !echoSniffer.settled) {
+                      const decision = echoSniffer.feed(event.text);
+                      if (decision.kind === "echo") {
+                        guardHeld = [];
+                        throw new CursorToolResultEchoError(decision.marker);
+                      }
+                    }
+                    if (routingCommentarySniffer && !routingCommentarySniffer.settled) {
+                      const decision = routingCommentarySniffer.feed(event.text);
+                      if (decision.kind === "hallucination") {
+                        guardHeld = [];
+                        throw new CursorRoutingCommentaryError();
+                      }
+                    }
+                    if (guardsSettled()) releaseGuardHeld();
+                    continue;
+                  } else if (event.type === "thinking_delta" || event.type === "heartbeat") {
+                    // Reasoning before first text stays ordered; liveness still passes through.
+                    if (event.type === "thinking_delta") {
+                      guardHeld.push(event);
+                      continue;
+                    }
+                  } else {
+                    // A tool call, done, or error closes the text quarantine. Re-check the full
+                    // held first line before release so a fragmented routing claim cannot leak.
+                    echoSniffer?.finish();
+                    const routingDecision = routingCommentarySniffer?.finish();
+                    if (routingDecision?.kind === "hallucination") {
+                      guardHeld = [];
+                      throw new CursorRoutingCommentaryError();
+                    }
+                    releaseGuardHeld();
+                  }
+                }
                 if (event.type !== "heartbeat") emittedOutput = true;
                 if (event.type === "done") {
                   commitCapturedCheckpoint(activeRequest);
@@ -290,6 +369,50 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             await runOnce(request);
             break;
           } catch (err) {
+            const outputGuardRetryText =
+              err instanceof CursorToolResultEchoError
+                ? CURSOR_ECHO_RETRY_CONTINUATION_TEXT
+                : err instanceof CursorRoutingCommentaryError
+                  ? CURSOR_ROUTING_COMMENTARY_RETRY_TEXT
+                  : undefined;
+            // One-shot corrective retry for guarded external output (devlog 260826 gap-10/11).
+            // The quarantine guarantees no client-visible delta escaped, so a fresh-conversation
+            // retry is safe. A second rejection propagates as an error rather than looping.
+            if (
+              outputGuardRetryText
+              && !emittedOutput
+              && !replayUnsafe
+              && !incoming.abortSignal?.aborted
+            ) {
+              debugProviderDiagnostic(
+                "cursor",
+                err instanceof CursorToolResultEchoError
+                  ? "envelope-echo-retry"
+                  : "routing-commentary-retry",
+                {
+                  wireModel: request.modelId,
+                  conversationHash: request.conversationId.slice(0, 16),
+                },
+              );
+              const echoedConversationId = request.conversationId;
+              lastTransport = undefined;
+              _parsed._cursorConversationId = undefined;
+              request = {
+                ...createCursorRequest(_parsed, { forceFreshConversation: true }),
+                echoRetryContinuationText: outputGuardRetryText,
+              };
+              rekeyContextUsage(echoedConversationId, request.conversationId);
+              _parsed._cursorConversationId = request.conversationId;
+              if (_parsed._clientThreadId && _parsed._cursorIsolateConversation !== true) {
+                rememberCursorThreadConversation(
+                  _parsed._clientThreadId,
+                  request.conversationId,
+                  _parsed._cursorIdentityScope,
+                );
+              }
+              await runOnce(request);
+              break;
+            }
             const overflowRemintSafe =
               !lastRawIsToolResult
               && !emittedOutput

package/src/adapters/google-aistudio-parser.ts

@@ -0,0 +1,49 @@
+/**
+ * Resilient streaming chunk parser for Google AI Studio MakerSuite private RPC protocol.
+ */
+
+export interface MakerSuiteParsedResult {
+  text: string;
+  thought?: string;
+  thoughtSignature?: string;
+}
+
+export function parseMakerSuiteChunk(raw: string): MakerSuiteParsedResult {
+  const result: MakerSuiteParsedResult = { text: "" };
+  if (!raw || typeof raw !== "string") return result;
+
+  // 1. Extract regular model response text: [null, "escaped_text"]
+  const textMatches = raw.matchAll(/\[\s*null\s*,\s*"((?:[^"\\]|\\.)*)"/g);
+  for (const m of textMatches) {
+    if (!m[1]) continue;
+    try {
+      const decoded = JSON.parse('"' + m[1] + '"');
+      if (decoded) result.text += decoded;
+    } catch (err) {
+      void err;
+      result.text += m[1];
+    }
+  }
+
+  // 2. Extract model reasoning / thoughts: [true, "escaped_thought"]
+  const thoughtMatches = raw.matchAll(/\[\s*true\s*,\s*"((?:[^"\\]|\\.)*)"/g);
+  for (const m of thoughtMatches) {
+    if (!m[1]) continue;
+    try {
+      const decoded = JSON.parse('"' + m[1] + '"');
+      if (decoded) result.thought = (result.thought ?? "") + decoded;
+    } catch (err) {
+      void err;
+      result.thought = (result.thought ?? "") + m[1];
+    }
+  }
+
+  // 3. Extract Gemini thought signature token if present
+  const sigMatch = raw.match(/"(ErQ[A-Za-z0-9+/=_-]{30,})"/);
+  if (sigMatch?.[1]) {
+    result.thoughtSignature = sigMatch[1];
+  }
+
+  return result;
+}
+

package/src/adapters/google-antigravity-replay.ts

@@ -38,9 +38,9 @@ const REPLAY_TTL_MS = 60 * 60 * 1000; // 1h
 export const ANTIGRAVITY_REPLAY_MAX_ENTRIES = 10_240;
 const REPLAY_EVICT_BATCH = 128;
 const REPLAY_MAX_CALLS_PER_SESSION = 256;
-export const ANTIGRAVITY_REPLAY_MAX_BYTES_PER_SESSION = 2 * 1024 * 1024;
+export const ANTIGRAVITY_REPLAY_MAX_BYTES_PER_SESSION = 8 * 1024 * 1024;
 export const ANTIGRAVITY_REPLAY_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
-const REPLAY_MAX_SIGNATURE_BYTES = 64 * 1024;
+const REPLAY_MAX_SIGNATURE_BYTES = 1024 * 1024;
 /** Fixed 64-hex outer key length, counted once per session entry. */
 const REPLAY_SESSION_KEY_BYTES = 64;
 const REPLAY_SNAPSHOT_FILE = "antigravity-replay.json";

package/src/adapters/google-antigravity-wire.ts

@@ -11,6 +11,13 @@ import { antigravityUserAgent } from "./client-fingerprint";
  */
 export const ANTIGRAVITY_REQUEST_UA = antigravityUserAgent();
 
+/**
+ * Bypass sentinel for Google Cloud Code Assist (Antigravity).
+ * When a historical functionCall part lacks a thought_signature, Antigravity rejects
+ * the request with HTTP 400 unless this sentinel is provided.
+ */
+export const ANTIGRAVITY_SIGNATURE_BYPASS_SENTINEL = "skip_thought_signature_validator";
+
 /**
  * Whether a stored `OcxToolCall.thoughtSignature` is a REAL upstream Gemini signature versus a
  * foreign id that must not be forwarded to Gemini/Antigravity.

package/src/adapters/google-errors.ts

@@ -2,7 +2,10 @@ import { parseUpstreamJsonPayload, safeUpstreamErrorString, sanitizeUpstreamErro
 
 /** Pull the human detail out of the Google API error envelope `{error:{message,status,code}}`. */
 function googleErrorDetail(payloadText: string): { message?: string; status?: string } {
-  const trimmed = payloadText.trim();
+  let trimmed = payloadText.trim();
+  if (trimmed.startsWith("data:")) {
+    trimmed = trimmed.replace(/^data:\s*/, "").trim();
+  }
   if (!trimmed || (!trimmed.startsWith("{") && !trimmed.startsWith("["))) {
     return { message: trimmed || undefined };
   }
@@ -18,7 +21,8 @@ function googleErrorDetail(payloadText: string): { message?: string; status?: st
 const ANTIGRAVITY_GEO_BLOCKED_MARKER = "user location is not supported for the api use";
 
 export function isAntigravityGeoBlockedBody(payloadText: string): boolean {
-  return payloadText.toLowerCase().includes(ANTIGRAVITY_GEO_BLOCKED_MARKER);
+  const lower = payloadText.toLowerCase();
+  return lower.includes(ANTIGRAVITY_GEO_BLOCKED_MARKER) || lower.includes("location is not supported");
 }
 
 function classifyGoogle(label: string, status: number | undefined, enumStatus: string | undefined, text: string): string {

package/src/adapters/google-http.ts

@@ -7,7 +7,7 @@ import {
 } from "./google-errors";
 import { isGoogleMixedBuiltinToolError, repairGoogleInvalidRequestBody, stripGoogleBuiltinToolsFromWireBody } from "./google-wire-compiler";
 import { normalizeUpstreamHttpErrorResponse, readDisplaySafeErrorPayloadText } from "./upstream-http-error";
-import { recordAntigravityCooldown } from "../oauth/antigravity-routing";
+import { recordAntigravityCooldown, recordAntigravitySyntheticFailure } from "../oauth/antigravity-routing";
 import {
   antigravityHostCandidates,
   canonicalAntigravityHttpsHost,
@@ -178,6 +178,7 @@ function responseWithBufferedBody(
 async function prepareCcaSseResponse(
   response: Response,
   fetchPeer: (() => Promise<Response>) | undefined,
+  accountId?: string,
 ): Promise<Response> {
   if (!response.body) return fetchPeer ? fetchPeer() : response;
   const reader = response.body.getReader();
@@ -209,6 +210,13 @@ async function prepareCcaSseResponse(
             return failoverOrPassthrough();
           }
           if (probe === "quota_exhausted" || probe === "geo_blocked") {
+            if (accountId) {
+              recordAntigravitySyntheticFailure(accountId, {
+                code: probe === "quota_exhausted" ? 429 : 403,
+                status: probe === "quota_exhausted" ? "RESOURCE_EXHAUSTED" : "PERMISSION_DENIED",
+                message: probe === "quota_exhausted" ? "quota exceeded" : "user location is not supported",
+              });
+            }
             const status = probe === "quota_exhausted" ? 429 : 403;
             return passthrough(undefined, status);
           }
@@ -237,6 +245,13 @@ async function prepareCcaSseResponse(
           return failoverOrPassthrough();
         }
         if (probe === "quota_exhausted" || probe === "geo_blocked") {
+          if (accountId) {
+            recordAntigravitySyntheticFailure(accountId, {
+              code: probe === "quota_exhausted" ? 429 : 403,
+              status: probe === "quota_exhausted" ? "RESOURCE_EXHAUSTED" : "PERMISSION_DENIED",
+              message: probe === "quota_exhausted" ? "quota exceeded" : "user location is not supported",
+            });
+          }
           const status = probe === "quota_exhausted" ? 429 : 403;
           return passthrough(overflow, status);
         }
@@ -262,6 +277,8 @@ function isUnavailableResponse(response: Response): boolean {
 export interface GoogleRetryOptions {
   /** Repair-and-replay structurally invalid 400 bodies (Vertex/Antigravity behavior). */
   repairInvalid400?: boolean;
+  /** Let the Responses layer own Antigravity's single same-account 429 replay. */
+  retry429?: boolean;
 }
 
 async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
@@ -291,13 +308,15 @@ async function recordAntigravityHttpCooldown(
   if (response.status === 429) {
     recordAntigravityCooldown(
       accountId,
-      isQuotaExhaustedBody(payloadText) ? "quota_exhausted" : "rate_limited",
-      retryAfterMs(response.headers.get("retry-after")),
+      response.headers.get("retry-after"),
+      Date.now(),
+      isQuotaExhaustedBody(payloadText) ? "quota" : "rate-limit",
+      "synthetic",
     );
     return true;
   }
-  if (isAntigravityGeoBlockedBody(payloadText)) {
-    recordAntigravityCooldown(accountId, "geo_blocked");
+  if (response.status === 403 || isAntigravityGeoBlockedBody(payloadText)) {
+    recordAntigravityCooldown(accountId, response.headers.get("retry-after"), Date.now(), "geoblock", "synthetic");
     return true;
   }
   return false;
@@ -318,6 +337,7 @@ async function fetchGoogleWithRetryInternal(
   opts: GoogleRetryOptions = {},
 ): Promise<Response> {
   const repairInvalid400 = opts.repairInvalid400 ?? true;
+  const retry429 = opts.retry429 ?? true;
   const timeoutMs = ctx.timeoutMs ?? 200_000;
   const executor = ctx.executor ?? globalThis.fetch;
   let activeRequest = request;
@@ -369,7 +389,7 @@ async function fetchGoogleWithRetryInternal(
             opts,
           )
           : undefined;
-        return prepareCcaSseResponse(res, fetchPeer);
+        return prepareCcaSseResponse(res, fetchPeer, ctx.accountId);
       }
       if (res.status === 400 && repairInvalid400 && !compatibilityReplayUsed) {
         let payloadText = "";
@@ -397,6 +417,9 @@ async function fetchGoogleWithRetryInternal(
           continue;
         }
       }
+      if (res.status === 429 && !retry429) {
+        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
+      }
       if (!retryableGoogleStatus(res.status) || attempt === GOOGLE_RETRY_ATTEMPTS - 1) {
         return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
       }
@@ -466,5 +489,5 @@ export function fetchVertexWithRetry(request: AdapterRequest, ctx: AdapterFetchC
 
 /** Antigravity (Cloud Code Assist) retry wrapper. */
 export function fetchAntigravityWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
-  return fetchGoogleWithRetry("Antigravity", request, ctx);
+  return fetchGoogleWithRetry("Antigravity", request, ctx, { retry429: false });
 }

package/src/adapters/google-truncation.ts

@@ -12,6 +12,11 @@ export function vertexTruncationErrorMessage(reason?: string): string {
   return `Vertex AI response truncated upstream before the turn completed${suffix}`;
 }
 
+export function googleTruncationErrorMessage(reason?: string): string {
+  const suffix = reason ? ` (${redactSecretString(reason).slice(0, 160)})` : "";
+  return `Google AI Studio response truncated upstream before the turn completed${suffix}`;
+}
+
 /**
  * Whether a finished turn must fail closed. A truncation reason arriving mid tool call always
  * does. MALFORMED_FUNCTION_CALL fails closed even with zero started calls: the malformed call

package/src/adapters/google-wire-compiler.ts

@@ -5,6 +5,15 @@ type JsonObject = Record<string, unknown>;
 
 const GOOGLE_TOOL_NAME = /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/;
 const GOOGLE_THINKING_LEVELS = new Set(["minimal", "low", "medium", "high"]);
+const GOOGLE_SAFETY_CATEGORIES = new Set([
+  "HARM_CATEGORY_HATE_SPEECH", "HARM_CATEGORY_SEXUALLY_EXPLICIT", "HARM_CATEGORY_DANGEROUS_CONTENT",
+  "HARM_CATEGORY_HARASSMENT", "HARM_CATEGORY_CIVIC_INTEGRITY", "HARM_CATEGORY_JAILBREAK",
+]);
+const GOOGLE_SAFETY_THRESHOLDS = new Set([
+  "HARM_BLOCK_THRESHOLD_UNSPECIFIED", "BLOCK_LOW_AND_ABOVE", "BLOCK_MEDIUM_AND_ABOVE",
+  "BLOCK_ONLY_HIGH", "BLOCK_NONE", "OFF",
+]);
+const GOOGLE_CACHED_CONTENT = /^(?:cachedContents\/[^/?#\s]+|projects\/[^/?#\s]+\/locations\/[^/?#\s]+\/cachedContents\/[^/?#\s]+)$/;
 
 function isObject(value: unknown): value is JsonObject {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -158,12 +167,18 @@ function compileGenerationConfig(value: unknown): JsonObject | undefined {
     ))].slice(0, 5);
     if (stopSequences.length > 0) out.stopSequences = stopSequences;
   }
-  if (isObject(value.thinkingConfig) && typeof value.thinkingConfig.thinkingLevel === "string") {
-    const raw = value.thinkingConfig.thinkingLevel.toLowerCase();
-    const thinkingLevel = GOOGLE_THINKING_LEVELS.has(raw)
-      ? raw
-      : (["xhigh", "max", "ultra"].includes(raw) ? "high" : undefined);
-    if (thinkingLevel) out.thinkingConfig = { thinkingLevel };
+  if (isObject(value.thinkingConfig)) {
+    const config: JsonObject = {};
+    if (typeof value.thinkingConfig.thinkingBudget === "number"
+      && Number.isSafeInteger(value.thinkingConfig.thinkingBudget)
+      && value.thinkingConfig.thinkingBudget >= -1) config.thinkingBudget = value.thinkingConfig.thinkingBudget;
+    if (typeof value.thinkingConfig.includeThoughts === "boolean") config.includeThoughts = value.thinkingConfig.includeThoughts;
+    if (typeof value.thinkingConfig.thinkingLevel === "string") {
+      const raw = value.thinkingConfig.thinkingLevel.toLowerCase();
+      const thinkingLevel = GOOGLE_THINKING_LEVELS.has(raw) ? raw : (["xhigh", "max", "ultra"].includes(raw) ? "high" : undefined);
+      if (thinkingLevel && config.thinkingBudget === undefined) config.thinkingLevel = thinkingLevel;
+    }
+    if (Object.keys(config).length > 0) out.thinkingConfig = config;
   }
   if (Array.isArray(value.responseModalities)) {
     const valid = value.responseModalities.filter((m): m is string => typeof m === "string" && ["TEXT", "IMAGE", "AUDIO"].includes(m));
@@ -180,6 +195,20 @@ function compileGenerationConfig(value: unknown): JsonObject | undefined {
   return Object.keys(out).length > 0 ? out : undefined;
 }
 
+function compileSafetySettings(value: unknown): unknown[] | undefined {
+  if (!Array.isArray(value) || value.length > 16) return undefined;
+  const seen = new Set<string>();
+  const out: JsonObject[] = [];
+  for (const setting of value) {
+    if (!isObject(setting) || typeof setting.category !== "string" || !GOOGLE_SAFETY_CATEGORIES.has(setting.category)
+      || typeof setting.threshold !== "string" || !GOOGLE_SAFETY_THRESHOLDS.has(setting.threshold)
+      || seen.has(setting.category)) return undefined;
+    seen.add(setting.category);
+    out.push({ category: setting.category, threshold: setting.threshold });
+  }
+  return out.length > 0 ? out : undefined;
+}
+
 function compileToolConfig(value: unknown, toWireName: (name: string) => string): JsonObject | undefined {
   if (!isObject(value) || !isObject(value.functionCallingConfig)) return undefined;
   const raw = value.functionCallingConfig;
@@ -216,6 +245,9 @@ export function compileGoogleWireBody(input: unknown): {
   if (generationConfig) body.generationConfig = generationConfig;
   const toolConfig = compileToolConfig(source.toolConfig, names.toWire);
   if (toolConfig) body.toolConfig = toolConfig;
+  const safetySettings = compileSafetySettings(source.safetySettings);
+  if (safetySettings) body.safetySettings = safetySettings;
+  if (typeof source.cachedContent === "string" && GOOGLE_CACHED_CONTENT.test(source.cachedContent)) body.cachedContent = source.cachedContent;
   if (typeof source.sessionId === "string" && source.sessionId.length > 0) body.sessionId = source.sessionId;
   return { body, restoreToolName: names.fromWire };
 }