@yina-npm/openrouterx 0.4.22 → 0.4.24

package/app/src/mitm/antigravityModels.js

@@ -0,0 +1,265 @@
+const REAL_AVAILABLE_MODELS_FIXTURE = require("./antigravityAvailableModels.fixture.json");
+
+const BASE_MODEL_EXPERIMENTS = {
+  experiments: {
+    CASCADE_USE_EXPERIMENT_CHECKPOINTER: {
+      stringValue: JSON.stringify({
+        strategy: "CHECKPOINT_STRATEGY_SINGLE_PROMPT",
+        max_token_limit: "128000",
+        token_threshold: "50000",
+        max_overhead_ratio: "0.15",
+        moving_window_size: "1",
+        enabled: true,
+        max_output_tokens: "16384",
+        checkpoint_model: "MODEL_PLACEHOLDER_M50",
+        retry_config: {
+          max_retries: 0,
+          initial_sleep_duration_ms: 1000,
+          exponential_multiplier: 2,
+          include_error_feedback: false,
+        },
+      }, null, 4),
+    },
+  },
+};
+
+const COMMON_CODE_MIME_TYPES = {
+  "application/json": true,
+  "application/pdf": true,
+  "application/rtf": true,
+  "application/x-ipynb+json": true,
+  "application/x-javascript": true,
+  "application/x-python-code": true,
+  "application/x-typescript": true,
+  "image/heic": true,
+  "image/heif": true,
+  "image/jpeg": true,
+  "image/png": true,
+  "image/webp": true,
+  "text/css": true,
+  "text/csv": true,
+  "text/html": true,
+  "text/javascript": true,
+  "text/markdown": true,
+  "text/plain": true,
+  "text/rtf": true,
+  "text/x-python": true,
+  "text/x-python-script": true,
+  "text/x-typescript": true,
+  "text/xml": true,
+  "video/mp4": true,
+  "video/webm": true,
+};
+
+function quota(resetDays = 7) {
+  const resetTime = new Date(Date.now() + resetDays * 24 * 60 * 60 * 1000).toISOString();
+  return { remainingFraction: 1, resetTime };
+}
+
+function geminiModel(displayName, model, options = {}) {
+  return {
+    displayName,
+    supportsImages: true,
+    supportsThinking: true,
+    thinkingBudget: options.thinkingBudget ?? 1024,
+    minThinkingBudget: options.minThinkingBudget ?? 128,
+    recommended: true,
+    maxTokens: 1048576,
+    maxOutputTokens: 65535,
+    tokenizerType: "LLAMA_WITH_SPECIAL",
+    quotaInfo: quota(options.resetDays),
+    model,
+    apiProvider: "API_PROVIDER_GOOGLE_GEMINI",
+    modelProvider: "MODEL_PROVIDER_GOOGLE",
+    supportsVideo: true,
+    supportedMimeTypes: COMMON_CODE_MIME_TYPES,
+    requiresImageOutputOutsideFunctionResponses: options.requiresImageOutputOutsideFunctionResponses,
+    modelExperiments: BASE_MODEL_EXPERIMENTS,
+  };
+}
+
+function anthropicModel(displayName, model) {
+  return {
+    displayName,
+    supportsImages: true,
+    supportsThinking: true,
+    thinkingBudget: 1024,
+    recommended: true,
+    maxTokens: 250000,
+    maxOutputTokens: 64000,
+    tokenizerType: "LLAMA_WITH_SPECIAL",
+    quotaInfo: quota(),
+    model,
+    apiProvider: "API_PROVIDER_ANTHROPIC_VERTEX",
+    modelProvider: "MODEL_PROVIDER_ANTHROPIC",
+    supportedMimeTypes: {
+      "image/heic": true,
+      "image/heif": true,
+      "image/jpeg": true,
+      "image/png": true,
+      "image/webp": true,
+    },
+    modelExperiments: BASE_MODEL_EXPERIMENTS,
+  };
+}
+
+function openAiModel(displayName, model) {
+  return {
+    displayName,
+    supportsThinking: true,
+    thinkingBudget: 8192,
+    recommended: true,
+    maxTokens: 131072,
+    maxOutputTokens: 32768,
+    tokenizerType: "LLAMA_WITH_SPECIAL",
+    quotaInfo: quota(),
+    model,
+    apiProvider: "API_PROVIDER_OPENAI_VERTEX",
+    modelProvider: "MODEL_PROVIDER_OPENAI",
+    modelExperiments: BASE_MODEL_EXPERIMENTS,
+  };
+}
+
+function tabModel(model, maxTokens = 16384) {
+  return {
+    maxTokens,
+    maxOutputTokens: 4096,
+    tokenizerType: "QWEN2",
+    quotaInfo: { remainingFraction: 1 },
+    model,
+    apiProvider: "API_PROVIDER_INTERNAL",
+    supportsCumulativeContext: true,
+    supportsEstimateTokenCounter: true,
+    isInternal: true,
+    promptTemplaterType: "PROMPT_TEMPLATER_TYPE_CHATML",
+    toolFormatterType: "TOOL_FORMATTER_TYPE_XML",
+    requiresLeadInGeneration: true,
+  };
+}
+
+function googleTabModel(model, maxTokens = 16384) {
+  return {
+    maxTokens,
+    maxOutputTokens: 4096,
+    tokenizerType: "LLAMA_WITH_SPECIAL",
+    quotaInfo: { remainingFraction: 1 },
+    model,
+    apiProvider: "API_PROVIDER_GOOGLE_GEMINI",
+    modelProvider: "MODEL_PROVIDER_GOOGLE",
+    supportsCumulativeContext: true,
+    supportsEstimateTokenCounter: true,
+    isInternal: true,
+    promptTemplaterType: "PROMPT_TEMPLATER_TYPE_CHATML",
+    toolFormatterType: "TOOL_FORMATTER_TYPE_XML",
+    requiresLeadInGeneration: true,
+  };
+}
+
+function imageModel(displayName, model) {
+  return {
+    displayName,
+    supportsImages: true,
+    maxTokens: 32768,
+    maxOutputTokens: 8192,
+    tokenizerType: "LLAMA_WITH_SPECIAL",
+    quotaInfo: quota(),
+    model,
+    apiProvider: "API_PROVIDER_GOOGLE_GEMINI",
+    modelProvider: "MODEL_PROVIDER_GOOGLE",
+    supportedMimeTypes: COMMON_CODE_MIME_TYPES,
+  };
+}
+
+function freshResetTime(days = 7) {
+  return new Date(Date.now() + days * 24 * 60 * 60 * 1000).toISOString();
+}
+
+function cloneFixtureWithFreshQuota() {
+  const payload = JSON.parse(JSON.stringify(REAL_AVAILABLE_MODELS_FIXTURE));
+  const agentIds = new Set(
+    (payload.agentModelSorts || [])
+      .flatMap((sort) => sort.groups || [])
+      .flatMap((group) => group.modelIds || []),
+  );
+
+  for (const [id, model] of Object.entries(payload.models || {})) {
+    if (!model.quotaInfo) model.quotaInfo = { remainingFraction: 1 };
+    model.quotaInfo.remainingFraction = typeof model.quotaInfo.remainingFraction === "number"
+      ? model.quotaInfo.remainingFraction
+      : 1;
+    if (model.quotaInfo.resetTime) {
+      model.quotaInfo.resetTime = freshResetTime(agentIds.has(id) ? 7 : 1);
+    }
+  }
+
+  return payload;
+}
+
+function buildAntigravityAvailableModelsResponse() {
+  if (REAL_AVAILABLE_MODELS_FIXTURE?.models) return cloneFixtureWithFreshQuota();
+
+  const models = {
+    "gemini-2.5-flash-thinking": geminiModel("Gemini 3.1 Flash Lite", "MODEL_GOOGLE_GEMINI_2_5_FLASH_THINKING"),
+    "gemini-2.5-pro": geminiModel("Gemini 2.5 Pro", "MODEL_GOOGLE_GEMINI_2_5_PRO", {
+      requiresImageOutputOutsideFunctionResponses: true,
+    }),
+    "gemini-2.5-flash-lite": geminiModel("Gemini 3.1 Flash Lite", "MODEL_GOOGLE_GEMINI_2_5_FLASH_LITE"),
+    "gemini-2.5-flash": geminiModel("Gemini 3.1 Flash Lite", "MODEL_GOOGLE_GEMINI_2_5_FLASH"),
+    "gemini-3.1-flash-lite": geminiModel("Gemini 3.1 Flash Lite", "MODEL_PLACEHOLDER_M50"),
+    "gemini-3.1-pro-high": geminiModel("Gemini 3.1 Pro (High)", "MODEL_PLACEHOLDER_M37", {
+      thinkingBudget: 10001,
+    }),
+    "gemini-3.1-pro-low": geminiModel("Gemini 3.1 Pro (Low)", "MODEL_PLACEHOLDER_M36", {
+      thinkingBudget: 1001,
+    }),
+    "gemini-3-flash-agent": geminiModel("Gemini 3 Flash", "MODEL_PLACEHOLDER_M84", {
+      thinkingBudget: -1,
+      minThinkingBudget: 32,
+    }),
+    "gemini-3-flash": geminiModel("Gemini 3 Flash", "MODEL_PLACEHOLDER_M18", {
+      thinkingBudget: -1,
+      minThinkingBudget: 32,
+    }),
+    "gemini-3.1-flash-image": imageModel("Gemini 3.1 Flash Image", "MODEL_PLACEHOLDER_M21"),
+    "claude-sonnet-4-6": anthropicModel("Claude Sonnet 4.6 (Thinking)", "MODEL_PLACEHOLDER_M35"),
+    "claude-opus-4-6-thinking": anthropicModel("Claude Opus 4.6 (Thinking)", "MODEL_PLACEHOLDER_M26"),
+    "gpt-oss-120b-medium": openAiModel("GPT-OSS 120B (Medium)", "MODEL_OPENAI_GPT_OSS_120B_MEDIUM"),
+    "tab_flash_lite_preview": googleTabModel("MODEL_PLACEHOLDER_M19"),
+    "tab_jump_flash_lite_preview": googleTabModel("MODEL_PLACEHOLDER_M28"),
+    "chat_20706": tabModel("MODEL_CHAT_20706"),
+    "chat_23310": tabModel("MODEL_CHAT_23310", 32768),
+  };
+
+  return {
+    models,
+    defaultAgentModelId: "gemini-3.1-pro-high",
+    agentModelSorts: [
+      {
+        displayName: "Recommended",
+        groups: [
+          {
+            modelIds: [
+              "gemini-3.1-pro-high",
+              "gemini-3.1-pro-low",
+              "gemini-3-flash-agent",
+              "claude-sonnet-4-6",
+              "claude-opus-4-6-thinking",
+              "gpt-oss-120b-medium",
+            ],
+          },
+        ],
+      },
+    ],
+    commandModelIds: ["gemini-3-flash"],
+    tabModelIds: ["chat_20706", "chat_23310"],
+    imageGenerationModelIds: [],
+    mqueryModelIds: ["gemini-3.1-flash-lite"],
+    webSearchModelIds: ["gemini-3.1-flash-lite"],
+    commitMessageModelIds: ["gemini-3-flash"],
+    audioTranscriptionModelIds: [],
+    experimentIds: [],
+    tieredModelIds: {},
+  };
+}
+
+module.exports = { buildAntigravityAvailableModelsResponse };

package/app/src/mitm/cert/install.js

@@ -4,11 +4,14 @@ const { exec } = require("child_process");
 const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js");
 const { runElevatedPowerShell, quotePs } = require("../winElevated.js");
 const { log, err } = require("../logger");
+const { ROOT_CA_CN } = require("./rootCA.js");
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
 const LINUX_CERT_DIR = "/usr/local/share/ca-certificates";
-const ROOT_CA_CN = "9Router MITM Root CA";
+const LEGACY_ROOT_CA_CN = "9Router MITM Root CA";
+const LINUX_CERT_FILE = `${LINUX_CERT_DIR}/openrouterx-root-ca.crt`;
+const LEGACY_LINUX_CERT_FILE = `${LINUX_CERT_DIR}/9router-root-ca.crt`;
 
 // Get SHA1 fingerprint from cert file using Node.js crypto
 function getCertFingerprint(certPath) {
@@ -84,7 +87,10 @@ async function installCert(sudoPassword, certPath) {
 
 async function installCertMac(sudoPassword, certPath) {
   // Remove all old certs with same name first to avoid duplicate/stale cert conflict
-  const deleteOld = `security delete-certificate -c "9Router MITM Root CA" /Library/Keychains/System.keychain 2>/dev/null || true`;
+  const deleteOld = [
+    `security delete-certificate -c "${LEGACY_ROOT_CA_CN}" /Library/Keychains/System.keychain 2>/dev/null || true`,
+    `security delete-certificate -c "${ROOT_CA_CN}" /Library/Keychains/System.keychain 2>/dev/null || true`,
+  ].join(" && ");
   const install = `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`;
   try {
     await execWithPassword(`${deleteOld} && ${install}`, sudoPassword);
@@ -99,6 +105,7 @@ async function installCertWindows(certPath) {
   // Auto-elevate via UAC popup if not admin (zero popup if already admin).
   // Delete any stale cert with same CN before adding to avoid duplicates.
   const script = `
+    certutil -delstore Root ${quotePs(LEGACY_ROOT_CA_CN)} 2>$null | Out-Null
     certutil -delstore Root ${quotePs(ROOT_CA_CN)} 2>$null | Out-Null
     $exit = & certutil -addstore Root ${quotePs(certPath)} 2>&1
     if ($LASTEXITCODE -ne 0) { throw "certutil exit $LASTEXITCODE" }
@@ -153,8 +160,7 @@ async function uninstallCertWindows() {
 }
 
 function checkCertInstalledLinux() {
-  const certFile = `${LINUX_CERT_DIR}/9router-root-ca.crt`;
-  return Promise.resolve(fs.existsSync(certFile));
+  return Promise.resolve(fs.existsSync(LINUX_CERT_FILE));
 }
 
 async function installCertLinux(sudoPassword, certPath) {
@@ -162,9 +168,9 @@ async function installCertLinux(sudoPassword, certPath) {
     log(`🔐 Cert: cannot install to system store without sudo — trust this file on clients: ${certPath}`);
     return;
   }
-  const destFile = `${LINUX_CERT_DIR}/9router-root-ca.crt`;
+  const destFile = LINUX_CERT_FILE;
   // Try update-ca-certificates (Debian/Ubuntu), fallback to update-ca-trust (Fedora/RHEL)
-  const cmd = `cp "${certPath}" "${destFile}" && (update-ca-certificates 2>/dev/null || update-ca-trust 2>/dev/null || true)`;
+  const cmd = `rm -f "${LEGACY_LINUX_CERT_FILE}" && cp "${certPath}" "${destFile}" && (update-ca-certificates 2>/dev/null || update-ca-trust 2>/dev/null || true)`;
   try {
     await execWithPassword(cmd, sudoPassword);
     log("🔐 Cert: ✅ installed to Linux trust store");
@@ -177,8 +183,7 @@ async function uninstallCertLinux(sudoPassword) {
   if (!isSudoAvailable()) {
     return;
   }
-  const destFile = `${LINUX_CERT_DIR}/9router-root-ca.crt`;
-  const cmd = `rm -f "${destFile}" && (update-ca-certificates 2>/dev/null || update-ca-trust 2>/dev/null || true)`;
+  const cmd = `rm -f "${LINUX_CERT_FILE}" "${LEGACY_LINUX_CERT_FILE}" && (update-ca-certificates 2>/dev/null || update-ca-trust 2>/dev/null || true)`;
   try {
     await execWithPassword(cmd, sudoPassword);
     log("🔐 Cert: ✅ uninstalled from Linux trust store");

package/app/src/mitm/cert/rootCA.js

@@ -5,6 +5,8 @@ const { MITM_DIR } = require("../paths");
 
 const ROOT_CA_KEY_PATH = path.join(MITM_DIR, "rootCA.key");
 const ROOT_CA_CERT_PATH = path.join(MITM_DIR, "rootCA.crt");
+const ROOT_CA_CN = "OpenRouterX MITM Root CA";
+const ROOT_CA_ORG = "OpenRouterX";
 
 /**
  * Check if cert file is expired or expiring within 30 days
@@ -19,18 +21,29 @@ function isCertExpired(certPath) {
   }
 }
 
+function isOpenRouterXRootCA(certPath) {
+  try {
+    const cert = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
+    const cn = cert.subject.getField("CN")?.value;
+    const org = cert.subject.getField("O")?.value;
+    return cn === ROOT_CA_CN && org === ROOT_CA_ORG;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Generate Root CA certificate (only once, auto-regenerate if expired)
  * This Root CA will sign all dynamic leaf certificates
  */
 async function generateRootCA() {
   const exists = fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH);
-  if (exists && !isCertExpired(ROOT_CA_CERT_PATH)) {
+  if (exists && !isCertExpired(ROOT_CA_CERT_PATH) && isOpenRouterXRootCA(ROOT_CA_CERT_PATH)) {
     console.log("✅ Root CA already exists");
     return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
   }
   if (exists) {
-    console.log("🔐 Root CA expired or expiring soon — regenerating...");
+    console.log("🔐 Root CA expired, stale, or branded for legacy 9Router — regenerating...");
     try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore */ }
     try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore */ }
   }
@@ -53,8 +66,8 @@ async function generateRootCA() {
   cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 10);
 
   const attrs = [
-    { name: "commonName", value: "9Router MITM Root CA" },
-    { name: "organizationName", value: "9Router" },
+    { name: "commonName", value: ROOT_CA_CN },
+    { name: "organizationName", value: ROOT_CA_ORG },
     { name: "countryName", value: "US" }
   ];
 
@@ -169,5 +182,7 @@ module.exports = {
   generateLeafCert,
   isCertExpired,
   ROOT_CA_CERT_PATH,
-  ROOT_CA_KEY_PATH
+  ROOT_CA_KEY_PATH,
+  ROOT_CA_CN,
+  ROOT_CA_ORG
 };

package/app/src/mitm/config.js

@@ -3,6 +3,7 @@
 const TARGET_HOSTS = [
   "daily-cloudcode-pa.googleapis.com",
   "cloudcode-pa.googleapis.com",
+  "daily-cloudcode-pa.sandbox.googleapis.com",
   "api.individual.githubcopilot.com",
   "q.us-east-1.amazonaws.com",
   "api2.cursor.sh",
@@ -15,12 +16,38 @@ const URL_PATTERNS = {
   copilot: ["/chat/completions", "/v1/messages", "/responses"],
   kiro: ["/generateAssistantResponse"],
   cursor: ["/BidiAppend", "/RunSSE", "/RunPoll", "/Run"],
-  openrouter: ["/models", "/api/v1/models", "/chat/completions", "/v1/chat/completions", "/v1/messages", "/responses"],
+  openrouter: [
+    "/models",
+    "/api/v1/models",
+    "/api/v1/key",
+    "/api/v1/auth/key",
+    "/chat/completions",
+    "/v1/chat/completions",
+    "/api/v1/chat/completions",
+    "/v1/messages",
+    "/responses",
+    "/api/v1/responses",
+  ],
 };
 
 // Synonym map: rawModel from request → canonical alias key in mitmAlias DB
 const MODEL_SYNONYMS = {
-  antigravity: { "gemini-default": "gemini-3-flash" },
+  antigravity: {
+    "gemini-default": "gemini-3-flash",
+    "gemini-3-flash-agent": "gemini-3-flash",
+    "gemini-3.1-flash-lite": "gemini-3-flash",
+    "gemini-2.5-flash-lite": "gemini-3-flash",
+    "gemini-2.5-flash": "gemini-3-flash",
+    __defaults: {
+      "gemini-3.1-pro-high": "gemini-3.1-pro-high",
+      "gemini-3.1-pro-low": "gemini-3.1-pro-low",
+      "gemini-3-flash-agent": "cx/gpt-5.5",
+      "gemini-3-flash": "cx/gpt-5.5",
+      "claude-sonnet-4-6": "claude-sonnet-4-6",
+      "claude-opus-4-6-thinking": "claude-opus-4-6-thinking",
+      "gpt-oss-120b-medium": "gpt-oss-120b-medium",
+    },
+  },
 };
 
 // URL substrings whose request/response should NOT be dumped to file (telemetry, polling, empty)
@@ -35,7 +62,7 @@ const LOG_BLACKLIST_URL_PARTS = [
 function getToolForHost(host) {
   const h = (host || "").split(":")[0];
   if (h === "api.individual.githubcopilot.com") return "copilot";
-  if (h === "daily-cloudcode-pa.googleapis.com" || h === "cloudcode-pa.googleapis.com") return "antigravity";
+  if (h === "daily-cloudcode-pa.googleapis.com" || h === "cloudcode-pa.googleapis.com" || h === "daily-cloudcode-pa.sandbox.googleapis.com") return "antigravity";
   if (h === "q.us-east-1.amazonaws.com") return "kiro";
   if (h === "api2.cursor.sh") return "cursor";
   if (h === "openrouter.ai" || h === "api.openrouter.ai") return "openrouter";

package/app/src/mitm/dns/dnsConfig.js

@@ -12,8 +12,8 @@ const { runElevatedPowerShell, isAdmin } = require("../winElevated.js");
  * If anything fails mid-way, restore from `.bak`. Same-volume renames are atomic on NTFS.
  */
 function atomicWriteHostsWin(target, originalContent, newContent) {
-  const tmpNew = `${target}.9router.new`;
-  const tmpBak = `${target}.9router.bak`;
+  const tmpNew = `${target}.openrouterx.new`;
+  const tmpBak = `${target}.openrouterx.bak`;
   try {
     fs.writeFileSync(tmpNew, newContent, "utf8");
     try { fs.unlinkSync(tmpBak); } catch { /* none */ }
@@ -36,6 +36,18 @@ const IS_MAC = process.platform === "darwin";
 const HOSTS_FILE = IS_WIN
   ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts")
   : "/etc/hosts";
+const MAC_PF_ANTIGRAVITY_ANCHOR = "com.apple/openrouterx-mitm-antigravity";
+const MAC_ANTIGRAVITY_FALLBACK_IPS = [
+  "216.239.32.223",
+  "216.239.34.223",
+  "216.239.36.223",
+  "216.239.38.223",
+];
+const MAC_ANTIGRAVITY_LEGACY_SHARED_IP_PREFIXES = [
+  "142.250.",
+  "142.251.",
+  "172.217.",
+];
 
 /** True when `sudo` exists (e.g. missing on minimal Docker images like Alpine). */
 function isSudoAvailable() {
@@ -110,6 +122,97 @@ async function flushDNS(sudoPassword) {
   }
 }
 
+function shellQuoteSingle(str) {
+  return `'${String(str).replace(/'/g, "'\\''")}'`;
+}
+
+function getDefaultMacInterface() {
+  if (!IS_MAC) return "";
+  try {
+    const out = execSync("route -n get default 2>/dev/null | awk '/interface:/{print $2; exit}'", {
+      encoding: "utf8",
+      windowsHide: true,
+    }).trim();
+    return out || "en0";
+  } catch {
+    return "en0";
+  }
+}
+
+async function getMacAntigravityRedirectIPs() {
+  return [...MAC_ANTIGRAVITY_FALLBACK_IPS];
+}
+
+function getMacLoopbackIPv4Aliases() {
+  if (!IS_MAC) return [];
+  try {
+    const out = execSync("ifconfig lo0", { encoding: "utf8", windowsHide: true });
+    return [...out.matchAll(/^\s+inet\s+(\d+\.\d+\.\d+\.\d+)\s+/gm)].map((m) => m[1]);
+  } catch {
+    return [];
+  }
+}
+
+function getMacLegacyAntigravityAliases() {
+  return getMacLoopbackIPv4Aliases().filter((ip) =>
+    MAC_ANTIGRAVITY_LEGACY_SHARED_IP_PREFIXES.some((prefix) => ip.startsWith(prefix))
+  );
+}
+
+async function enableMacAntigravityRedirect(sudoPassword) {
+  if (!IS_MAC) return;
+  const ips = await getMacAntigravityRedirectIPs();
+  if (ips.length === 0) return;
+
+  await enableMacAntigravityLoopbackAliases(sudoPassword, ips);
+
+  const iface = getDefaultMacInterface();
+  const rules = [
+    `table <openrouterx_antigravity> persist { ${ips.join(", ")} }`,
+    `rdr pass on ${iface} inet proto tcp from any to <openrouterx_antigravity> port 443 -> 127.0.0.1 port 443`,
+    "",
+  ].join("\n");
+  const command = [
+    "pfctl -E >/dev/null 2>&1 || true",
+    `printf '%s' ${shellQuoteSingle(rules)} | pfctl -a ${shellQuoteSingle(MAC_PF_ANTIGRAVITY_ANCHOR)} -f -`,
+  ].join(" && ");
+
+  await execWithPassword(command, sudoPassword);
+  log(`🌐 PF antigravity: ✅ redirect active on ${iface} (${ips.length} IPs)`);
+}
+
+async function disableMacAntigravityRedirect(sudoPassword) {
+  if (!IS_MAC) return;
+  const ips = [...new Set([
+    ...await getMacAntigravityRedirectIPs(),
+    ...getMacLegacyAntigravityAliases(),
+  ])];
+  await execWithPassword(`pfctl -a ${shellQuoteSingle(MAC_PF_ANTIGRAVITY_ANCHOR)} -F all >/dev/null 2>&1 || true`, sudoPassword);
+  await disableMacAntigravityLoopbackAliases(sudoPassword, ips);
+  log("🌐 PF antigravity: ✅ redirect removed");
+}
+
+async function enableMacAntigravityLoopbackAliases(sudoPassword, ips) {
+  if (!IS_MAC || !ips.length) return;
+  const commands = ips.map((ip) => `ifconfig lo0 alias ${ip}/32 2>/dev/null || true`);
+  await execWithPassword(commands.join("; "), sudoPassword);
+  log(`🌐 lo0 antigravity: ✅ aliases active (${ips.length} IPs)`);
+}
+
+async function disableMacAntigravityLoopbackAliases(sudoPassword, ips) {
+  if (!IS_MAC || !ips.length) return;
+  const commands = ips.map((ip) => `ifconfig lo0 -alias ${ip} 2>/dev/null || true`);
+  await execWithPassword(commands.join("; "), sudoPassword);
+}
+
+async function ensureToolNetworkRedirect(tool, sudoPassword) {
+  if (tool === "antigravity") await enableMacAntigravityRedirect(sudoPassword);
+}
+
+async function removeToolNetworkRedirect(tool, sudoPassword) {
+  if (tool === "antigravity") await disableMacAntigravityRedirect(sudoPassword);
+}
+
 /**
  * Check if DNS entry exists for a specific host
  */
@@ -150,6 +253,7 @@ async function addDNSEntry(tool, sudoPassword) {
   const entriesToAdd = hosts.filter(h => !checkDNSEntry(h));
   if (entriesToAdd.length === 0) {
     log(`🌐 DNS ${tool}: already active`);
+    await ensureToolNetworkRedirect(tool, sudoPassword);
     return;
   }
 
@@ -172,6 +276,7 @@ async function addDNSEntry(tool, sudoPassword) {
       await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
       await flushDNS(sudoPassword);
     }
+    await ensureToolNetworkRedirect(tool, sudoPassword);
     log(`🌐 DNS ${tool}: ✅ added ${entriesToAdd.join(", ")}`);
   } catch (error) {
     const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : `Failed to add DNS entry: ${error.message}`;
@@ -189,6 +294,7 @@ async function removeDNSEntry(tool, sudoPassword) {
   const entriesToRemove = hosts.filter(h => checkDNSEntry(h));
   if (entriesToRemove.length === 0) {
     log(`🌐 DNS ${tool}: already inactive`);
+    await removeToolNetworkRedirect(tool, sudoPassword);
     return;
   }
 
@@ -207,6 +313,7 @@ async function removeDNSEntry(tool, sudoPassword) {
       await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
       await flushDNS(sudoPassword);
     }
+    await removeToolNetworkRedirect(tool, sudoPassword);
     log(`🌐 DNS ${tool}: ✅ removed ${entriesToRemove.join(", ")}`);
   } catch (error) {
     const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : `Failed to remove DNS entry: ${error.message}`;
@@ -233,6 +340,12 @@ async function removeAllDNSEntries(sudoPassword) {
  */
 function removeAllDNSEntriesSync() {
   try {
+    if (IS_MAC) {
+      try { execSync(`pfctl -a ${MAC_PF_ANTIGRAVITY_ANCHOR} -F all >/dev/null 2>&1 || true`, { stdio: "ignore" }); } catch { /* ignore */ }
+      for (const ip of MAC_ANTIGRAVITY_FALLBACK_IPS) {
+        try { execSync(`ifconfig lo0 -alias ${ip} 2>/dev/null || true`, { stdio: "ignore" }); } catch { /* ignore */ }
+      }
+    }
     if (!fs.existsSync(HOSTS_FILE)) return;
     const allHosts = Object.values(TOOL_HOSTS).flat();
     const content = fs.readFileSync(HOSTS_FILE, "utf8");

package/app/src/mitm/handlers/antigravity.js

@@ -1,12 +1,18 @@
-const { err, createResponseDumper } = require("../logger");
+const { log, err, createResponseDumper } = require("../logger");
 const { fetchRouter, pipeSSE } = require("./base");
 
+const NO_CREDENTIALS_MARKER = "No active credentials for provider";
+
 /**
  * Intercept Antigravity request — forward Gemini body as-is to /v1/chat/completions.
  * Router auto-detects format via body.userAgent==="antigravity" + body.request.contents,
  * runs antigravity→openai→provider→openai→antigravity translators internally.
+ *
+ * Graceful fallback: if Router returns 404 because no provider credentials are
+ * configured, passthrough to the real upstream so Antigravity works out-of-the-box
+ * without requiring a login in the Router dashboard.
  */
-async function intercept(req, res, bodyBuffer, mappedModel) {
+async function intercept(req, res, bodyBuffer, mappedModel, passthrough) {
   const dumper = createResponseDumper(req, "intercept-antigravity");
   const isStream = req.url.includes(":streamGenerateContent");
   try {
@@ -14,6 +20,27 @@ async function intercept(req, res, bodyBuffer, mappedModel) {
     if (body.model) body.model = mappedModel;
 
     const routerRes = await fetchRouter(body, "/v1/chat/completions", req.headers);
+
+    // Graceful fallback: no credentials in Router → passthrough to real upstream
+    if (routerRes.status === 404) {
+      const text = await routerRes.text();
+      if (text.includes(NO_CREDENTIALS_MARKER)) {
+        log(`⏩ passthrough | antigravity | no credentials for mapped model "${mappedModel || "unknown"}" — forwarding to real upstream`);
+        if (dumper) {
+          dumper.writeHeader(routerRes.status, Object.fromEntries(routerRes.headers));
+          dumper.writeChunk(text);
+          dumper.end();
+        }
+        return passthrough(req, res, bodyBuffer);
+      }
+      // Other 404 errors: propagate as-is
+      if (!res.headersSent) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(text);
+      }
+      return;
+    }
+
     await pipeSSE(routerRes, res, dumper);
   } catch (error) {
     err(`[antigravity] ${error.message}`);