@yansigit/opencodex 2.33.0 → 2.33.1

package/src/server/aistudio-ws-hub.ts

@@ -0,0 +1,295 @@
+/**
+ * In-process WebSocket Relay Hub for Google AI Studio Web / Build sessions.
+ */
+
+export interface WsRelayRequest {
+  url: string;
+  method: string;
+  headers?: Record<string, string>;
+  body?: string;
+}
+
+export interface WsRelayStreamResult {
+  chunks: AsyncIterable<string>;
+  status?: number;
+  headers?: Record<string, string>;
+}
+
+export interface WebSocketLike {
+  send(data: string): void;
+  close(code?: number, reason?: string): void;
+}
+
+interface PendingStream {
+  pushChunk(chunk: string): void;
+  finish(): void;
+  fail(err: Error): void;
+}
+
+export interface AiStudioRelayHub {
+  hasActiveSessions(): boolean;
+  getActiveSessionCount(): number;
+  registerSession(id: string, ws: WebSocketLike): void;
+  unregisterSession(id: string): void;
+  reset(): void;
+  dispatchStream(req: WsRelayRequest, signal?: AbortSignal): Promise<WsRelayStreamResult>;
+  handleClientMessage(sessionId: string, raw: string): void;
+}
+
+export function createAiStudioRelayHub(): AiStudioRelayHub {
+  const sessions = new Map<string, WebSocketLike>();
+  const pendingRequests = new Map<string, PendingStream>();
+  const pendingBySession = new Map<string, Set<string>>();
+  let sessionRoundRobin = 0;
+
+  function getNextSession(): { id: string; ws: WebSocketLike } | undefined {
+    for (const [id, ws] of sessions.entries()) {
+      if ((ws as any).readyState !== undefined && (ws as any).readyState > 1) {
+        sessions.delete(id);
+      }
+    }
+    const arr = Array.from(sessions.values());
+    if (arr.length === 0) return undefined;
+    const id = Array.from(sessions.keys())[sessionRoundRobin % arr.length]!;
+    const ws = sessions.get(id)!;
+    sessionRoundRobin = (sessionRoundRobin + 1) % arr.length;
+    return { id, ws };
+  }
+
+  return {
+    hasActiveSessions() {
+      return sessions.size > 0;
+    },
+
+    getActiveSessionCount() {
+      return sessions.size;
+    },
+
+    registerSession(id: string, ws: WebSocketLike) {
+      sessions.set(id, ws);
+      console.log(`[AIStudioHub] registered session: ${id}, total: ${sessions.size}`);
+    },
+
+    unregisterSession(id: string) {
+      sessions.delete(id);
+      console.log(`[AIStudioHub] unregistered session: ${id}, remaining: ${sessions.size}`);
+      const requestIds = pendingBySession.get(id);
+      if (!requestIds) return;
+      for (const requestId of requestIds) {
+        pendingRequests.get(requestId)?.fail(new Error("Google AI Studio browser session disconnected"));
+      }
+      pendingBySession.delete(id);
+    },
+
+    reset() {
+      for (const pending of pendingRequests.values()) {
+        pending.fail(new Error("AI Studio relay hub reset"));
+      }
+      sessions.clear();
+      pendingRequests.clear();
+      pendingBySession.clear();
+      sessionRoundRobin = 0;
+    },
+
+    async dispatchStream(req: WsRelayRequest, signal?: AbortSignal): Promise<WsRelayStreamResult> {
+      const session = getNextSession();
+      if (!session) {
+        throw new Error("No active Google AI Studio browser session connected. Open the AI Studio bridge in your browser to start.");
+      }
+      const { id: sessionId, ws } = session;
+
+      const reqId = `req_${crypto.randomUUID()}`;
+      const chunkQueue: string[] = [];
+      let resolveNextChunk: ((value: IteratorResult<string>) => void) | null = null;
+      let rejectNextChunk: ((err: Error) => void) | null = null;
+      let isFinished = false;
+      let finishError: Error | null = null;
+
+      const pending: PendingStream = {
+        pushChunk(chunk: string) {
+          if (isFinished) return;
+          if (resolveNextChunk) {
+            const r = resolveNextChunk;
+            resolveNextChunk = null;
+            rejectNextChunk = null;
+            r({ value: chunk, done: false });
+          } else {
+            chunkQueue.push(chunk);
+          }
+        },
+        finish() {
+          if (isFinished) return;
+          isFinished = true;
+          pendingRequests.delete(reqId);
+          pendingBySession.get(sessionId)?.delete(reqId);
+          if (resolveNextChunk) {
+            const r = resolveNextChunk;
+            resolveNextChunk = null;
+            rejectNextChunk = null;
+            r({ value: undefined as any, done: true });
+          }
+        },
+        fail(err: Error) {
+          if (isFinished) return;
+          isFinished = true;
+          finishError = err;
+          pendingRequests.delete(reqId);
+          pendingBySession.get(sessionId)?.delete(reqId);
+          if (rejectNextChunk) {
+            const r = rejectNextChunk;
+            resolveNextChunk = null;
+            rejectNextChunk = null;
+            r(err);
+          }
+        },
+      };
+
+      pendingRequests.set(reqId, pending);
+      const requestIds = pendingBySession.get(sessionId) ?? new Set<string>();
+      requestIds.add(reqId);
+      pendingBySession.set(sessionId, requestIds);
+
+      if (signal) {
+        signal.addEventListener("abort", () => {
+          try {
+            ws.send(JSON.stringify({ id: reqId, type: "abort" }));
+          } catch (err) {
+            void err;
+          }
+          pending.fail(new Error("Request aborted by client"));
+        });
+      }
+
+      const msg = {
+        id: reqId,
+        type: "http_request",
+        payload: {
+          url: req.url,
+          method: req.method,
+          headers: req.headers ?? {},
+          body: req.body ?? "",
+        },
+      };
+
+      ws.send(JSON.stringify(msg));
+
+      const asyncIterable: AsyncIterable<string> = {
+        [Symbol.asyncIterator]() {
+          return {
+            async next(): Promise<IteratorResult<string>> {
+              if (chunkQueue.length > 0) {
+                return { value: chunkQueue.shift()!, done: false };
+              }
+              if (isFinished) {
+                if (finishError) throw finishError;
+                return { value: undefined as any, done: true };
+              }
+              return new Promise<IteratorResult<string>>((resolve, reject) => {
+                resolveNextChunk = resolve;
+                rejectNextChunk = reject;
+              });
+            },
+          };
+        },
+      };
+
+      return { chunks: asyncIterable };
+    },
+
+    handleClientMessage(sessionId: string, raw: string) {
+      let data: any;
+      try {
+        data = JSON.parse(raw);
+      } catch (err) {
+        console.log("[AIStudioHub] failed to parse JSON message:", err);
+        void err;
+        return;
+      }
+
+      const { id, type, payload } = data || {};
+      if (!id) {
+        console.log("[AIStudioHub] message missing id");
+        return;
+      }
+
+      const pending = pendingRequests.get(id);
+      if (!pending || !pendingBySession.get(sessionId)?.has(id)) {
+        console.log("[AIStudioHub] no pending request for id:", id, "session:", sessionId);
+        return;
+      }
+
+      if (type === "stream_chunk") {
+        if (payload?.data) {
+          pending.pushChunk(payload.data);
+        }
+      } else if (type === "stream_end" || type === "http_response") {
+        if (payload?.body) {
+          pending.pushChunk(payload.body);
+        }
+        pending.finish();
+      } else if (type === "error") {
+        console.log(`[AIStudioHub] client error from ${sessionId}:`, payload?.error);
+        pending.fail(new Error(payload?.error || "Upstream AI Studio error"));
+      }
+    },
+  };
+}
+
+export const globalAiStudioRelayHub = createAiStudioRelayHub();
+
+export function getAiStudioUserScript(listenPort: number): string {
+  return `// ==UserScript==
+// @name         OpenCodex AI Studio Relay Bridge
+// @namespace    https://opencodex.dev/
+// @version      1.0.0
+// @description  Relays requests from opencodex to Google AI Studio session
+// @match        https://aistudio.google.com/*
+// @grant        none
+// @run-at       document-idle
+// ==/UserScript==
+
+(function() {
+  'use strict';
+  const WS_URL = "ws://127.0.0.1:${listenPort}/v1/ws/aistudio";
+  let ws;
+  function connect() {
+    try { ws = new WebSocket(WS_URL); } catch { setTimeout(connect, 3000); return; }
+    ws.onmessage = async (e) => {
+      try {
+        const msg = JSON.parse(e.data);
+        if (msg.type === "http_request") {
+          const { id, payload } = msg;
+          try {
+            const res = await fetch(payload.url, { method: payload.method, headers: payload.headers, body: payload.body, credentials: "include" });
+            if (payload.url.includes("streamGenerateContent") && res.body) {
+              const reader = res.body.getReader();
+              const decoder = new TextDecoder();
+              while (true) {
+                const { done, value } = await reader.read();
+                if (done) break;
+                ws.send(JSON.stringify({ id, type: "stream_chunk", payload: { data: decoder.decode(value, { stream: true }) } }));
+              }
+              ws.send(JSON.stringify({ id, type: "stream_end", payload: {} }));
+            } else {
+              const text = await res.text();
+              ws.send(JSON.stringify({ id, type: "http_response", payload: { body: text, status: res.status } }));
+            }
+          } catch (err) {
+            ws.send(JSON.stringify({ id, type: "error", payload: { error: String(err) } }));
+          }
+        }
+      } catch (err) {
+        void err;
+      }
+    };
+    ws.onclose = () => setTimeout(connect, 3000);
+  }
+  connect();
+})();
+`;
+}
+
+export function getAiStudioBridgeHtml(listenPort: number): string {
+  const extensionPath = typeof process !== "undefined" ? process.cwd() + "/integrations/aistudio-extension" : "integrations/aistudio-extension";
+  return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Google AI Studio Bridge</title><style>body{font-family:system-ui,-apple-system,sans-serif;background:#121316;color:#e1e3e6;padding:2rem;max-width:680px;margin:auto;line-height:1.5}.card{background:#1e1f23;border:1px solid #2d2f34;border-radius:8px;padding:1.5rem;margin-bottom:1.5rem}.status{display:inline-block;padding:0.25rem 0.75rem;border-radius:4px;font-weight:500}.connected{background:#163820;color:#4ade80}.disconnected{background:#3b1717;color:#f87171}code{background:#2a2c31;padding:0.2rem 0.4rem;border-radius:4px}.btn{display:inline-block;padding:0.5rem 1rem;background:#3b82f6;color:#fff;text-decoration:none;border-radius:6px;font-weight:500;margin-top:0.5rem}pre{background:#16171a;padding:1rem;border-radius:6px;overflow-x:auto;font-size:0.85rem}</style></head><body><div class="card"><h2>Google AI Studio Bridge</h2><p>Status: <span id="status" class="status disconnected">Connecting...</span></p><p>This bridge connects <code>opencodex</code> with your active Google AI Studio / Google AI Pro session.</p></div><div class="card"><h3>🧩 Option 1: Unpacked Extension for Brave / Chrome (Zero Tab Overhead)</h3><p>Run entirely in the background without needing an active browser tab:</p><ol style="padding-left:1.2rem;margin:0.5rem 0"><li>Open <code>brave://extensions</code> (or <code>chrome://extensions</code>) and toggle <strong>Developer mode</strong> in the top-right.</li><li>Click <strong>Load unpacked</strong> and select this directory:<br><code id="ext-path">${extensionPath}</code></li></ol><button class="btn" style="cursor:pointer" onclick="navigator.clipboard.writeText(document.getElementById('ext-path').textContent);this.textContent='Copied!'">📋 Copy Extension Directory Path</button></div><div class="card"><h3>🌐 Option 2: Userscript (Tampermonkey) or Console</h3><p>Install via Tampermonkey/Violentmonkey or paste in Developer Tools Console:</p><p><a class="btn" href="/aistudio/bridge.user.js">⚡ Install Userscript</a> <a class="btn" style="background:#374151;margin-left:0.5rem" href="https://aistudio.google.com" target="_blank">Open aistudio.google.com ↗</a></p><pre style="margin-top:1rem"><code>const ws=new WebSocket('ws://127.0.0.1:${listenPort}/v1/ws/aistudio');ws.onmessage=async(e)=>{const{id,payload,type}=JSON.parse(e.data);if(type==='http_request'){try{const res=await fetch(payload.url,{method:payload.method,headers:payload.headers,body:payload.body,credentials:'include'});if(payload.url.includes('streamGenerateContent')&&res.body){const r=res.body.getReader(),d=new TextDecoder();while(true){const{done,value}=await r.read();if(done)break;ws.send(JSON.stringify({id,type:'stream_chunk',payload:{data:d.decode(value,{stream:true})}}))}ws.send(JSON.stringify({id,type:'stream_end',payload:{}}))}else{const body=await res.text();ws.send(JSON.stringify({id,type:'http_response',payload:{body,status:res.status}}))}}catch(err){ws.send(JSON.stringify({id,type:'error',payload:{error:String(err)}}))}}};console.log('opencodex AI Studio relay active!');</code></pre></div><script>let ws;const statusEl=document.getElementById("status");function connect(){const proto=location.protocol==="https:"?"wss:":"ws:";ws=new WebSocket(proto+"//"+location.host+"/v1/ws/aistudio");ws.onopen=()=>{statusEl.textContent="🟢 Connected (Relay Active)";statusEl.className="status connected"};ws.onclose=()=>{statusEl.textContent="🔴 Disconnected (Retrying...)";statusEl.className="status disconnected";setTimeout(connect,2000)}};connect()</script></body></html>`;
+}

package/src/server/auth-cors.ts

@@ -721,6 +721,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "disabled",
       "allowPrivateNetwork",
       "authMode",
+      "googleMode",
       "apiKeyTransport",
       "keyOptional",
       "freeTier",

package/src/server/chat-completions.ts

@@ -9,6 +9,7 @@ import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import {
   assertChatCompletionsRoutingBody,
   ChatCompletionsRequestError,
+  copyChatResponsesSessionHeaders,
   chatCompletionsToResponsesBody,
 } from "../chat/inbound";
 import {
@@ -201,6 +202,7 @@ async function handleChatCompletionsWithBudget(
     const value = req.headers.get(name);
     if (value) headers.set(name, value);
   }
+  copyChatResponsesSessionHeaders(req.headers, headers);
   // Prefer main ChatGPT auth so OpenAI-backed sidecars remain reachable on routed turns.
   if (!directRoute) {
     // This enrichment is optional for routed/non-main providers. If native main

package/src/server/index.ts

@@ -40,6 +40,7 @@ import {
   enforceAppOwnedMemoryBudget,
   resolveAppOwnedMemoryBudgetBytes,
 } from "../lib/app-owned-memory";
+import { getAiStudioBridgeHtml, getAiStudioUserScript, globalAiStudioRelayHub } from "./aistudio-ws-hub";
 import {
   registerAppOwnedMemorySweepFallback,
   registerDefaultAppOwnedMemoryStores,
@@ -668,6 +669,12 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     if (path === "/v1/realtime" || path === "/v1/live") {
       return req.headers.get("upgrade")?.toLowerCase() === "websocket";
     }
+    if (path === "/v1/ws/aistudio" || path === "/aistudio/ws") {
+      return req.headers.get("upgrade")?.toLowerCase() === "websocket";
+    }
+    if (path === "/v1/ws/aistudio/status") return req.method === "GET";
+    if (path === "/api/aistudio/session") return req.method === "POST";
+    if (path === "/aistudio/bridge" || path === "/aistudio/bridge.user.js") return req.method === "GET";
     return false;
   }
 
@@ -903,6 +910,73 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         return withCors(formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed"), req, policy);
       }
 
+      if (url.pathname === "/v1/ws/aistudio" || url.pathname === "/aistudio/ws") {
+        if (isDraining()) return drainingResponse(req, policy);
+        const admission = resolveApiAuth(req, policy);
+        if (!admission) {
+          return withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy);
+        }
+        const origin = req.headers.get("Origin");
+        const isExtensionOrigin = origin?.startsWith("chrome-extension://");
+        if (!isAllowedRequestOrigin(req, policy) && origin !== "https://aistudio.google.com" && !isExtensionOrigin) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "AI Studio relay WebSocket blocked: non-local Origin"), req, policy);
+        }
+        const sessionId = "aistudio_" + crypto.randomUUID().slice(0, 8);
+        if (requestServer.upgrade(req, {
+          data: { kind: "aistudio-relay", aistudioSessionId: sessionId },
+        })) return undefined as unknown as Response;
+       return withCors(formatErrorResponse(426, "upgrade_required", "AI Studio WebSocket upgrade failed"), req, policy);
+     }
+
+      if (url.pathname === "/v1/ws/aistudio/status" && req.method === "GET") {
+        return jsonResponse({
+          activeSessions: globalAiStudioRelayHub.getActiveSessionCount(),
+          hasActiveSessions: globalAiStudioRelayHub.hasActiveSessions(),
+        });
+      }
+
+      if (url.pathname === "/api/aistudio/session" && req.method === "POST") {
+        const admission = resolveApiAuth(req, policy);
+        if (!admission) {
+          return withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy);
+        }
+        const origin = req.headers.get("Origin");
+        const isExtensionOrigin = origin?.startsWith("chrome-extension://");
+        if (!isAllowedRequestOrigin(req, policy) && origin !== "https://aistudio.google.com" && !isExtensionOrigin) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin request blocked"), req, policy);
+        }
+        try {
+          const bodyJson = (await req.json()) as any;
+          const { saveAiStudioSession, saveAiStudioSessionFromToken } = await import("../oauth/aistudio-session-sync");
+          if (bodyJson.token && typeof bodyJson.token === "string") {
+            saveAiStudioSessionFromToken(bodyJson.token);
+          } else if (Array.isArray(bodyJson.cookies)) {
+            saveAiStudioSession({
+              selectedProject: bodyJson.selectedProject || "",
+              windowId: bodyJson.windowId || "",
+              cookies: bodyJson.cookies,
+            });
+          } else {
+            return withCors(jsonResponse({ error: "invalid session payload" }, 400), req, policy);
+          }
+          return withCors(jsonResponse({ ok: true, message: "AI Studio session updated successfully" }), req, policy);
+        } catch (err) {
+          return withCors(jsonResponse({ error: String(err) }, 400), req, policy);
+        }
+      }
+
+      if (url.pathname === "/aistudio/bridge" && req.method === "GET") {
+        const listenPort = (server.port ?? config.port) || 10100;
+        const bridgeHtml = getAiStudioBridgeHtml(listenPort);
+        return new Response(bridgeHtml, { headers: { "Content-Type": "text/html; charset=utf-8" } });
+      }
+
+      if (url.pathname === "/aistudio/bridge.user.js" && req.method === "GET") {
+        const listenPort = (server.port ?? config.port) || 10100;
+        const userScript = getAiStudioUserScript(listenPort);
+        return new Response(userScript, { headers: { "Content-Type": "application/javascript; charset=utf-8" } });
+      }
+
       if (url.pathname === "/healthz" && req.method === "GET") {
         // service/pid/port let CLI liveness reject foreign 200s and verify pid identity.
         const healthPort = server.port ?? listenPort;
@@ -1564,6 +1638,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       // Text frames. response.processed is a no-op ack. close() aborts the upstream (RC2 parity).
       // Live sideband sockets (kind=live-sideband) are a transparent bidirectional relay instead.
       open(ws: ServerWebSocket<WsData>) {
+        if (ws.data.kind === "aistudio-relay" && ws.data.aistudioSessionId) {
+          globalAiStudioRelayHub.registerSession(ws.data.aistudioSessionId, ws);
+          return;
+        }
         if (ws.data.kind === "live-sideband") {
           if (!ws.data.liveTurnAdmissionLease) {
             closeLiveSideband(ws, 1013, "server busy");
@@ -1580,6 +1658,18 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         registerCodexWebSocket(ws);
       },
       message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
+        if (ws.data.kind === "aistudio-relay" && ws.data.aistudioSessionId) {
+          const text = typeof raw === "string"
+            ? raw
+            : Buffer.isBuffer(raw)
+              ? raw.toString("utf-8")
+              : new TextDecoder().decode(raw as any);
+          globalAiStudioRelayHub.handleClientMessage(
+            ws.data.aistudioSessionId,
+            text
+          );
+          return;
+        }
         if (ws.data.kind === "live-sideband") {
           if (ws.data.liveClosing) return;
           const rawBytes = webSocketFrameBytes(raw);
@@ -1758,6 +1848,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         })();
       },
       close(ws: ServerWebSocket<WsData>) {
+        if (ws.data.kind === "aistudio-relay" && ws.data.aistudioSessionId) {
+          globalAiStudioRelayHub.unregisterSession(ws.data.aistudioSessionId);
+          return;
+        }
         if (ws.data.kind === "live-sideband") {
           closeLiveSideband(ws);
           return;

package/src/server/management/logs-usage-routes.ts

@@ -21,7 +21,7 @@ import {
   submitManualLoginCode,
   upsertOAuthProvider,
 } from "../../oauth";
-import { removeCredential } from "../../oauth/store";
+import { getAccountSet, removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
@@ -204,10 +204,16 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const filter = {
       provider: url.searchParams.get("provider"),
       model: url.searchParams.get("model"),
+      account: url.searchParams.get("account"),
     };
+    const fallbackAccounts: Record<string, string> = {};
+    for (const p of listOAuthProviders()) {
+      const set = getAccountSet(p);
+      if (set?.activeAccountId) fallbackAccounts[p] = set.activeAccountId;
+    }
     const project = <T extends UsageSummary>(summary: T, entries?: PersistedUsageEntry[]) =>
-      projectUsageSummary(summary, filter, entries);
-    const filterRequested = Boolean(filter.provider ?? filter.model);
+      projectUsageSummary(summary, filter, entries, fallbackAccounts);
+    const filterRequested = Boolean(filter.provider ?? filter.model ?? filter.account);
     const now = Date.now();
     try {
       const cacheKey = `${range}:${surface}`;
@@ -242,7 +248,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       const revisionReadAt = Date.now();
       const window = snapshotWindow(snapshot.entries);
       const summary = {
-        ...summarizeUsage(snapshot.entries, range, now, surface),
+        ...summarizeUsage(snapshot.entries, range, now, surface, fallbackAccounts),
         historyTruncated: snapshot.truncatedPrefixBytes > 0 || snapshot.entriesTruncated,
         truncatedPrefixBytes: snapshot.truncatedPrefixBytes,
         entriesTruncated: snapshot.entriesTruncated,
@@ -270,7 +276,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       for (const nextRange of ranges) {
         for (const nextSurface of surfaces) {
           const nextSummary = nextRange === range && nextSurface === surface ? summary : {
-            ...summarizeUsage(snapshot.entries, nextRange, now, nextSurface),
+            ...summarizeUsage(snapshot.entries, nextRange, now, nextSurface, fallbackAccounts),
             historyTruncated: summary.historyTruncated,
             truncatedPrefixBytes: summary.truncatedPrefixBytes,
             entriesTruncated: summary.entriesTruncated,

package/src/server/management/oauth-account-routes.ts

@@ -438,10 +438,20 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
-    if (provider !== "anthropic") return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
+    const supported = provider === "anthropic" || provider === "google-antigravity" || provider === "cursor" || provider === "command-code";
+    if (!supported) return jsonResponse({ error: "clear-cooldown is not supported for this provider" }, 400);
     if (!accountId) return jsonResponse({ error: "missing accountId" }, 400);
-    const { clearAnthropicAccountCooldown } = await import("../../oauth/anthropic-routing");
-    const cleared = clearAnthropicAccountCooldown(accountId);
+    let cleared = false;
+    if (provider === "anthropic") {
+      const { clearAnthropicAccountCooldown } = await import("../../oauth/anthropic-routing");
+      cleared = clearAnthropicAccountCooldown(accountId);
+    } else if (provider === "google-antigravity") {
+      const { clearAntigravityAccountCooldown } = await import("../../oauth/antigravity-routing");
+      cleared = clearAntigravityAccountCooldown(accountId);
+    } else if (provider === "cursor" || provider === "command-code") {
+      const { clearPoolAccountCooldown } = await import("../../routing/account-pool");
+      cleared = clearPoolAccountCooldown(provider, accountId);
+    }
     return jsonResponse({ ok: true, cleared });
   }
 

package/src/server/port-reclaim.ts

@@ -144,6 +144,24 @@ export function scanListenPids(port: number): ListenPidScan {
           .filter(pid => Number.isSafeInteger(pid) && pid > 0),
       };
     } catch (lsofErr) {
+      if (lsofErr && typeof lsofErr === "object" && "status" in lsofErr && lsofErr.status === 1) {
+        return { ok: true, pids: [] };
+      }
+      try {
+        const output = execFileSync("ss", ["-tlnp", `sport = :${port}`], {
+          encoding: "utf-8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 3000,
+        });
+        const pids = new Set<number>();
+        for (const match of output.matchAll(/pid=(\d+)/g)) {
+          const pid = Number(match[1]);
+          if (Number.isSafeInteger(pid) && pid > 0) pids.add(pid);
+        }
+        return { ok: true, pids: [...pids] };
+      } catch {
+        /* ss unavailable or unsupported on this platform; try netstat */
+      }
       try {
         const output = execFileSync("netstat", ["-anlp"], {
           encoding: "utf-8",
@@ -154,7 +172,7 @@ export function scanListenPids(port: number): ListenPidScan {
       } catch (netstatErr) {
         return {
           ok: false,
-          error: `lsof/netstat unavailable: ${String(lsofErr)} / ${String(netstatErr)}`,
+          error: `lsof/ss/netstat unavailable: ${String(lsofErr)} / ${String(netstatErr)}`,
         };
       }
     }

package/src/server/request-log-conversation.ts

@@ -61,6 +61,18 @@ export function sessionIdHeaderFromRequest(headers: Headers): string | null {
   return headers.get("session_id") ?? headers.get("session-id");
 }
 
+/**
+ * Codex thread identity from inbound Responses headers when the parent-thread header is absent.
+ * Priority: x-codex-parent-thread-id > thread-id > session_id / session-id.
+ */
+export function inboundClientThreadIdFromRequest(headers: Headers): string | undefined {
+  return firstSanitizedConversationId(
+    headers.get("x-codex-parent-thread-id"),
+    headers.get("thread-id"),
+    sessionIdHeaderFromRequest(headers),
+  );
+}
+
 function firstSanitizedConversationId(
   ...values: Array<string | null | undefined>
 ): string | undefined {

package/src/server/request-log.ts

@@ -1200,6 +1200,7 @@ export function finishRequestAttempt(
   status: number,
   durationMs: number,
   usage?: OcxUsage,
+  upstreamError?: string,
 ): PersistedUsageAttempt {
   const finalized = finalizedUsage(
     attempt.adapter,
@@ -1214,7 +1215,7 @@ export function finishRequestAttempt(
   else delete attempt.usage;
   if (finalized.totalTokens !== undefined) attempt.totalTokens = finalized.totalTokens;
   else delete attempt.totalTokens;
-  const errorCode = requestLogErrorCode(status);
+  const errorCode = requestLogErrorCode(status, upstreamError);
   if (errorCode) attempt.errorCode = errorCode;
   else delete attempt.errorCode;
   return attempt;

package/src/server/responses/core.ts

@@ -249,6 +249,7 @@ import {
 } from "../request-log";
 import {
   conversationIdFromResponsesRequest,
+  inboundClientThreadIdFromRequest,
   normalizeLogConversationId,
   reasoningReplayConversationIdFromResponsesRequest,
   sessionIdHeaderFromRequest,
@@ -1803,7 +1804,7 @@ export async function handleComboResponses(
   // Expand previous_response_id before image policy and child dispatch so a
   // continuation that only references prior images still fails closed when
   // imageInput is disabled (and so targets see the full replayed input).
-  const inboundClientThreadId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
+  const inboundClientThreadId = inboundClientThreadIdFromRequest(req.headers);
   const body = expandPreviousResponseInput(rawBody, inboundClientThreadId);
   const scopeMismatch = previousResponseScopeMismatch(body);
   if (scopeMismatch) {
@@ -2254,7 +2255,7 @@ async function handleResponsesInner(
   let unreadableEncryptedAgentTask = hasUnreadableEncryptedAgentTask(
     (body as { input?: unknown } | undefined)?.input,
   );
-  const inboundClientThreadId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
+  const inboundClientThreadId = inboundClientThreadIdFromRequest(req.headers);
   const originalBody = body;
   if (options.comboReplaySnapshot) {
     copyPreviousResponseReplayProvenance(options.comboReplaySnapshot.sourceBody, body);
@@ -4519,7 +4520,7 @@ async function handleResponsesInner(
         }
       },
       recordSidecarOutcome: wsPlan.forwardSidecar?.recordOutcome,
-      connectTimeoutMs: config.connectTimeoutMs ?? 200_000,
+      connectTimeoutMs: config.connectTimeoutMs ?? Math.max(200_000, wsPlan.routedModelStallTimeoutMs),
       routedModelStallTimeoutMs: wsPlan.routedModelStallTimeoutMs,
       stallTimeoutSec: wsPlan.stallTimeoutSec,
       streamRoutedModelOutput: wsPlan.streamRoutedModelOutput,

package/src/server/responses/policy-fallback.ts

@@ -89,7 +89,7 @@ function finishFailedPolicyAttempt(logCtx: RequestLogContext, status: number): v
   const attempt = logCtx.activeAttempt;
   if (attempt) {
     const startedAt = logCtx.activeAttemptStartedAt ?? Date.now();
-    finishRequestAttempt(attempt, status, Math.max(0, Date.now() - startedAt), attempt.usage ?? logCtx.usage);
+    finishRequestAttempt(attempt, status, Math.max(0, Date.now() - startedAt), attempt.usage ?? logCtx.usage, logCtx.upstreamError);
   }
   delete logCtx.activeAttempt;
   delete logCtx.activeAttemptStartedAt;

package/src/server/ws-bridge.ts

@@ -35,7 +35,8 @@ export interface WsData {
   cancel?: () => void; // cancels the in-flight stream reader/fetch
   turnId?: number; // monotonically increasing per socket; prevents stale frames after replacement turns
   /** Discriminator: Responses reframing vs transparent live/realtime sideband relay. */
-  kind?: "responses" | "live-sideband";
+  kind?: "responses" | "live-sideband" | "aistudio-relay";
+  aistudioSessionId?: string;
   liveUpstream?: WebSocket;
   liveUpstreamUrl?: string;
   liveUpstreamHeaders?: Record<string, string>;