clauderipple 0.6.0 → 0.8.0

package/dist/router/src/providers/chatgpt/index.js

@@ -15,6 +15,8 @@ import path from "node:path";
 import { homeDir } from "../../config.js";
 export const DEFAULT_BASE = "https://chatgpt.com/backend-api";
 const PING_MS = 15_000;
+/** How long a stream may hold its headers waiting for upstream's first item (see `handle`). Tests shorten it. */
+export const streamHold = { ms: 5_000 };
 /** Active quota lookup. Measured 2026-09-20: GET {base}/wham/usage → 200 JSON. The binary also
  * carries `/api/codex/usage`, but that path answers 403 here; `wham` is the one that works. */
 const USAGE_PATH = "/wham/usage";
@@ -24,6 +26,17 @@ const USAGE_TIMEOUT_MS = 10_000;
 const MODELS_PATH = "/codex/models";
 const MODELS_TIMEOUT_MS = 15_000;
 const MODELS_CACHE_MS = 60 * 60 * 1000;
+/** One image took about 30 s at low quality (2026-09-29); high quality and references take longer. */
+const IMAGE_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * The shape, asked for in words. The subscription backend accepts the tool's `size` and `quality`
+ * and ignores them — even "999x1" and "bogus" came back 200 as a 1536x1024 image (2026-09-29) —
+ * while the prompt steers it: "square composition" gave 1254x1254. So the shape is a prompt hint,
+ * and quality is the backend's to choose.
+ */
+export const IMAGE_ASPECTS = ["square", "landscape", "portrait"];
+export const IMAGE_FORMATS = ["png", "jpeg", "webp"];
+export const IMAGE_BACKGROUNDS = ["auto", "transparent", "opaque"];
 function anthropicError(status, type, message) {
     return { status, body: JSON.stringify({ type: "error", error: { type, message } }) };
 }
@@ -394,6 +407,107 @@ export class ChatGptAdapter {
         const prose = text.trim();
         return prose ? { hits: selected, text: prose } : { hits: selected };
     }
+    /**
+     * Hosted image generation, the same way `searchWeb` runs a hosted search: one Responses turn with
+     * the `image_generation` tool required. Wire measured 2026-09-29 against the live backend with a
+     * ChatGPT subscription: an `image_generation_call` output item whose `result` is the base64 image,
+     * beside the `size`, `quality` and `output_format` it chose and a `revised_prompt`; about 30 s.
+     */
+    async generateImage(model, req, signal) {
+        const tokens = await this.anyCredential();
+        if (tokens instanceof Error)
+            throw tokens;
+        const id = crypto.randomUUID();
+        const tool = {
+            type: "image_generation",
+            output_format: req.format ?? "png",
+            ...(req.background ? { background: req.background } : {}),
+        };
+        const prompt = req.aspect ? `${req.prompt}\n\nCompose it as a ${req.aspect} image.` : req.prompt;
+        const content = [{ type: "input_text", text: prompt }];
+        for (const image of req.images ?? [])
+            content.push({ type: "input_image", image_url: `data:${image.mediaType};base64,${image.data}` });
+        const body = {
+            model,
+            instructions: "Generate the requested image. Use any attached images as references.",
+            input: [{ type: "message", role: "user", content }],
+            tools: [tool],
+            tool_choice: "required",
+            reasoning: { effort: "low", summary: "auto" },
+            store: false,
+            stream: true,
+            prompt_cache_key: id,
+            client_metadata: { session_id: id, thread_id: id, turn_id: crypto.randomUUID(), "x-codex-window-id": `${id}:0` },
+        };
+        const timeout = AbortSignal.timeout(IMAGE_TIMEOUT_MS);
+        const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+        const res = await fetch(`${(this.cfg.url ?? DEFAULT_BASE).replace(/\/$/, "")}/codex/responses`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "text/event-stream",
+                authorization: `Bearer ${tokens.accessToken}`,
+                "chatgpt-account-id": tokens.accountId,
+                "OpenAI-Beta": "responses=experimental",
+                originator: "codex_cli_rs",
+                "session-id": id,
+                "thread-id": id,
+                "x-client-request-id": id,
+                "x-codex-window-id": `${id}:0`,
+            },
+            body: JSON.stringify(body),
+            signal: requestSignal,
+        });
+        this.noteRateLimits(tokens, rateLimitsFromHeaders(res.headers));
+        if (!res.ok || !res.body) {
+            const text = await res.text().catch(() => "");
+            if (res.status === 401)
+                void this.accounts.forceRefresh(tokens.ownerId);
+            throw new Error(`ChatGPT image generation: HTTP ${res.status}${text ? ` ${redactErrorText(text, [tokens.accessToken], 200)}` : ""}`);
+        }
+        const parser = new SseParser();
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let image;
+        let text = "";
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                for (const event of parser.feed(decoder.decode(value, { stream: true }))) {
+                    if (event.type === "response.output_text.delta")
+                        text += String(event.delta ?? "");
+                    if (event.type === "response.output_item.done") {
+                        const item = event.item;
+                        if (item?.type === "image_generation_call" && typeof item.result === "string" && item.result)
+                            image = item;
+                    }
+                    if (event.type === "error" || event.type === "response.failed") {
+                        const error = (event.error ?? event.response?.error);
+                        throw new Error(`ChatGPT image generation: ${String(error?.message ?? "backend error")}`);
+                    }
+                }
+            }
+        }
+        finally {
+            try {
+                await reader.cancel();
+            }
+            catch { /* already closed */ }
+        }
+        // A refusal comes back as prose and no image; that prose is the only explanation there is.
+        if (!image)
+            throw new Error(`ChatGPT image generation: no image returned${text.trim() ? `: ${text.trim().slice(0, 300)}` : ""}`);
+        const str = (v) => (typeof v === "string" && v ? v : undefined);
+        return {
+            data: Buffer.from(image.result, "base64"),
+            format: str(image.output_format) ?? req.format ?? "png",
+            ...(str(image.size) ? { size: str(image.size) } : {}),
+            ...(str(image.quality) ? { quality: str(image.quality) } : {}),
+            ...(str(image.revised_prompt) ? { revisedPrompt: str(image.revised_prompt) } : {}),
+        };
+    }
     /** One in-flight lookup shared by every caller (the status route and the startup refresh). */
     rateLimitsInFlight = null;
     /**
@@ -906,12 +1020,41 @@ export class ChatGptAdapter {
         const parser = new SseParser();
         let bytes = 0;
         let ping = null;
-        if (wantStream) {
+        // Keep early rejection as an HTTP error until an actual content block arrives.
+        // A 200 followed by an error loses the status Claude uses for overflow recovery.
+        const pendingEvents = [];
+        const openStream = () => {
             res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
-            for (const ev of mapper.start())
+        };
+        const sendEvents = (events) => {
+            if (!wantStream)
+                return;
+            pendingEvents.push(...events);
+            if (!res.headersSent) {
+                if (mapper.failure?.type === "invalid_request_error")
+                    return;
+                if (!pendingEvents.some((e) => e.event !== "message_start"))
+                    return;
+                openStream();
+            }
+            for (const ev of pendingEvents.splice(0))
                 bytes += write(res, formatSse(ev));
+        };
+        // The hold waits for upstream's first item, which normally follows the request within a second
+        // — and an overflow rejection comes before it. Should it not come, the client must still hear
+        // something: past this deadline the stream opens with message_start and the pings keep it alive,
+        // as they did before the hold.
+        let holdDeadline = null;
+        if (wantStream) {
+            holdDeadline = setTimeout(() => {
+                if (res.headersSent || res.writableEnded || mapper.failure)
+                    return;
+                openStream();
+                for (const ev of [...pendingEvents.splice(0), ...mapper.start()])
+                    bytes += write(res, formatSse(ev));
+            }, streamHold.ms);
             ping = setInterval(() => {
-                if (!res.writableEnded)
+                if (res.headersSent && !res.writableEnded)
                     bytes += write(res, formatSse({ event: "ping", data: { type: "ping" } }));
             }, PING_MS);
         }
@@ -927,9 +1070,7 @@ export class ChatGptAdapter {
                     if (mapper.rateLimits && mapper.rateLimits !== this.rateLimitsByAccount.get(credential.ownerId))
                         this.noteRateLimits(credential, mapper.rateLimits);
                     this.rememberInput(cacheKey, mapper.usage);
-                    if (wantStream)
-                        for (const o of outEvents)
-                            bytes += write(res, formatSse(o));
+                    sendEvents(outEvents);
                     if (mapper.isFinished)
                         break;
                 }
@@ -943,22 +1084,20 @@ export class ChatGptAdapter {
                 const tail = parser.sawDone
                     ? mapper.finish()
                     : mapper.fail(`${model}: upstream stream ended before the response completed`, "server_is_overloaded");
-                if (wantStream)
-                    for (const o of tail)
-                        bytes += write(res, formatSse(o));
+                sendEvents(tail);
             }
         }
         catch (e) {
             if (!ac.signal.aborted) {
                 const tail = mapper.fail(`stream interrupted: ${e.message}`, "server_is_overloaded");
-                if (wantStream)
-                    for (const o of tail)
-                        bytes += write(res, formatSse(o));
+                sendEvents(tail);
             }
         }
         finally {
             if (ping)
                 clearInterval(ping);
+            if (holdDeadline)
+                clearTimeout(holdDeadline);
             res.off("close", onClose);
             try {
                 await reader.cancel();
@@ -968,8 +1107,8 @@ export class ChatGptAdapter {
             }
         }
         const failure = mapper.failure;
-        const failedStatus = failure?.type === "overloaded_error" ? 529 : failure?.type === "rate_limit_error" ? 429 : 502;
-        if (!wantStream) {
+        const failedStatus = failure?.type === "invalid_request_error" ? 400 : failure?.type === "overloaded_error" ? 529 : failure?.type === "rate_limit_error" ? 429 : 502;
+        if (!wantStream || (failure && !res.headersSent)) {
             // A failed turn is an error here too, not a 200 carrying whatever arrived before it failed.
             const msg = failure ? anthropicError(failedStatus, failure.type, failure.message).body : JSON.stringify(mapper.message());
             res.writeHead(failure ? failedStatus : 200, { "content-type": "application/json", "content-length": String(Buffer.byteLength(msg)) }).end(msg);
@@ -985,7 +1124,7 @@ export class ChatGptAdapter {
             bytes,
             note: failure
                 ? `${wantStream ? "mid-stream " : ""}${failure.type}: ${failure.message} (in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens})`
-                : `in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens} stop=${mapper.stopReason}`,
+                : `in=${u.input_tokens} cached=${u.cache_read_input_tokens} out=${u.output_tokens} stop=${mapper.stopReason}${upstreamReq.service_tier ? " fast" : ""}`,
             usage: {
                 input: u.input_tokens,
                 cached: u.cache_read_input_tokens,

package/dist/router/src/providers/chatgpt/translate.js

@@ -161,10 +161,11 @@ export function toolNameForResponses(name) {
 // worst failure shape there is. `compat.ts` has dropped them on the anthropic-compatible path from
 // the start; the rule belongs here too, and is the same rule, not a second one.
 //
-// These do not arrive today. Claude Code runs its web search as a separate side request on a fixed
-// small model — measured 2026-09-17: an Opus session and a DeepSeek-routed session both sent it to
-// `claude-haiku-4-5`, which passes through to Anthropic and never reaches an adapter. Which model
-// that is, is a server-side flag we do not own, so this guards the day it changes.
+// `web_search` does not arrive today. Claude Code runs its web search as a separate side request on a
+// fixed small model — measured 2026-09-17: an Opus session and a DeepSeek-routed session both sent it
+// to `claude-haiku-4-5`, which passes through to Anthropic and never reaches an adapter. Which model
+// that is, is a server-side flag we do not own, so this guards the day it changes. The `advisor`
+// server tool does arrive: see `droppedServerToolNote`.
 export function isServerTool(tool) {
     const type = tool.type;
     return type !== undefined && type !== "custom";
@@ -177,6 +178,26 @@ export function serverToolNames(tools) {
             names.add(t.name);
     return names;
 }
+// Dropping the declaration is half of it (issue #47). Claude Code also tells the model, in text, how
+// to use the tool: the advisor comes with an `isMeta` user message ("# Advisor Tool / You have access
+// to an `advisor` tool…") on every subagent, whatever its `tools:` list says (CLI 2.1.286, measured
+// 2026-10-04: `dropped server tools for gpt-6-astra: advisor` on every worker request). A routed
+// worker reads the instruction, finds no such tool, and says so in each report. The CLI withdraws its
+// own instruction with one line when it removes the tool ("The advisor tool is no longer available;
+// disregard the earlier advisor instructions."); a line does the same here, without matching wording
+// that changes from release to release. Sorted, so one set always yields the same bytes and the
+// cached prefix does not move.
+/** One line withdrawing the instructions for the server tools a request had to drop; "" when none. */
+export function droppedServerToolNote(dropped) {
+    if (dropped.size === 0)
+        return "";
+    const names = [...dropped].sort().map((n) => `\`${n}\``).join(", ");
+    return `Not available in this session: ${names}. Anthropic runs these tools on its own servers, so this model cannot call them. Disregard any instruction to use them and carry on without them; there is no need to mention that they are missing.`;
+}
+/** The caller's system text with that line after it, so every translator places it the same way. */
+export function systemWithDroppedToolNote(req) {
+    return [systemText(req.system), droppedServerToolNote(serverToolNames(req.tools))].filter(Boolean).join("\n\n");
+}
 /**
  * Mangled name → original, for the tools declared in this request. The model echoes the name it was
  * given and Claude Code matches `tool_use.name` against its own tool list, so the response path has
@@ -199,7 +220,7 @@ export function toResponsesRequest(req, opts) {
     // Constant per (model, effort): changing effort mid-session costs one cache miss, which is acceptable.
     if (opts.identity)
         parts.push(identityLine(opts.model, opts.effort));
-    const sys = systemText(req.system);
+    const sys = systemWithDroppedToolNote(req);
     if (sys)
         parts.push(sys);
     if (opts.instructionsAppend)
@@ -308,6 +329,10 @@ export function toResponsesRequest(req, opts) {
     }
     if (tool_choice)
         out.tool_choice = tool_choice;
+    // Claude Code's `/fast` arrives as `speed: "fast"` (Anthropic fast mode). The ChatGPT backend's
+    // equivalent is the Codex CLI's Fast mode, which bills the plan at a higher rate (Codex docs, Speed).
+    if (req.speed === "fast")
+        out.service_tier = "priority";
     return out;
 }
 /** Rough token estimate for /v1/messages/count_tokens when the model is not Anthropic's. */
@@ -506,7 +531,10 @@ export class StreamMapper {
         if (this.finished)
             return [];
         this.finished = true;
-        const type = code === "server_is_overloaded" ? "overloaded_error" : code === "rate_limit_exceeded" || code === "usage_limit_reached" ? "rate_limit_error" : "api_error";
+        const contextOverflow = code === "context_length_exceeded" || /input exceeds the context window/i.test(message);
+        const type = contextOverflow ? "invalid_request_error" : code === "server_is_overloaded" ? "overloaded_error" : code === "rate_limit_exceeded" || code === "usage_limit_reached" ? "rate_limit_error" : "api_error";
+        if (contextOverflow)
+            message = `prompt is too long: ${message}`;
         this.failure = { type, message };
         return [...this.start(), ...this.closeBlock(), { event: "error", data: { type: "error", error: { type, message } } }];
     }

package/dist/router/src/providers/google/accounts.js

@@ -0,0 +1,345 @@
+// Google Antigravity (Cloud Code Assist) accounts: several Google logins can be signed in, and a
+// turn moves to the next one when the account it is on runs out.
+//
+// Stored in <home>/google-accounts.json (0600, cross-process lock, atomic write), the same shape as
+// the ChatGPT pool. We refresh these; a refresh token Google has invalidated marks only that account
+// for a new sign-in. Identity is the account email plus the discovered Cloud Code Assist project id.
+//
+// Nothing here has been measured against a live Google endpoint — there is no subscription in this
+// environment. The wire facts (token endpoint shape, `invalid_grant`, project discovery) are taken
+// from the reference implementation opencodex as a behavioral spec (src/oauth/google-antigravity.ts)
+// and marked (assumption) in docs/ARCHITECTURE.md §4d.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { redactErrorText } from "../../redact.js";
+import { withFileLock, writeJsonAtomic } from "../../locked-file.js";
+import { GOOGLE_OAUTH } from "./antigravity.js";
+export function googleAccountsPath(home) {
+    return path.join(home, "google-accounts.json");
+}
+function validAccount(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const a = value;
+    return typeof a.id === "string" && a.id.length > 0
+        && typeof a.accessToken === "string" && a.accessToken.length > 0
+        && (a.refreshToken === undefined || typeof a.refreshToken === "string")
+        && typeof a.projectId === "string" && a.projectId.length > 0
+        && typeof a.expiresAt === "number" && Number.isFinite(a.expiresAt)
+        && typeof a.label === "string" && a.label.length > 0
+        && typeof a.createdAt === "string" && typeof a.updatedAt === "string"
+        && (a.email === undefined || typeof a.email === "string")
+        && (a.needsReauth === undefined || typeof a.needsReauth === "boolean")
+        && (a.paused === undefined || typeof a.paused === "boolean");
+}
+/** The file's accounts; [] when absent, null when unreadable (so a mutation refuses to overwrite it). */
+function parseAccountsFile(home) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(googleAccountsPath(home), "utf8"));
+        if (parsed.version !== 1 || !Array.isArray(parsed.accounts) || !parsed.accounts.every(validAccount))
+            return null;
+        const seen = new Set();
+        return parsed.accounts.filter((account) => !seen.has(account.id) && seen.add(account.id)).map((account) => ({ ...account }));
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? [] : null;
+    }
+}
+export function readGoogleAccounts(home) {
+    return parseAccountsFile(home) ?? [];
+}
+function readForMutation(home) {
+    const accounts = parseAccountsFile(home);
+    if (accounts === null)
+        throw new Error("Google account store is unreadable; refusing to overwrite it");
+    return accounts;
+}
+function write(home, accounts) {
+    writeJsonAtomic(googleAccountsPath(home), { version: 1, accounts });
+}
+function mutate(home, change) {
+    return withFileLock(googleAccountsPath(home), () => {
+        const { accounts, result } = change(readForMutation(home));
+        if (accounts)
+            write(home, accounts);
+        return result;
+    });
+}
+/** Same person: the email when both have one, else the same Cloud Code Assist project. */
+function sameIdentity(a, b) {
+    if (a.email && b.email)
+        return a.email.toLowerCase() === b.email.toLowerCase();
+    return a.projectId === b.projectId;
+}
+/** Add a signed-in account, or replace the same one after a re-login. */
+export function saveGoogleAccount(home, grant, now = new Date().toISOString()) {
+    return mutate(home, (accounts) => {
+        const key = { ...(grant.email ? { email: grant.email } : {}), projectId: grant.projectId };
+        const index = accounts.findIndex((account) => sameIdentity(account, key));
+        const previous = index >= 0 ? accounts[index] : undefined;
+        const account = {
+            id: previous?.id ?? crypto.randomUUID(),
+            accessToken: grant.accessToken,
+            ...(grant.refreshToken ? { refreshToken: grant.refreshToken } : {}),
+            projectId: grant.projectId,
+            ...(grant.email ?? previous?.email ? { email: grant.email ?? previous.email } : {}),
+            expiresAt: grant.expiresAt,
+            label: previous?.label ?? grant.email ?? `Google account ${accounts.length + 1}`,
+            createdAt: previous?.createdAt ?? now,
+            updatedAt: now,
+            ...(previous?.paused ? { paused: true } : {}),
+        };
+        const next = [...accounts];
+        if (index >= 0)
+            next[index] = account;
+        else
+            next.push(account);
+        return { accounts: next, result: { ...summarize(account), added: index < 0 } };
+    });
+}
+/** Compare-and-swap a refreshed grant: an older concurrent refresh must not overwrite a newer one. */
+export function replaceGoogleTokens(home, id, expectedRefreshToken, grant, now = new Date().toISOString()) {
+    return mutate(home, (accounts) => {
+        const index = accounts.findIndex((account) => account.id === id && account.refreshToken === expectedRefreshToken);
+        if (index < 0)
+            return { result: false };
+        const previous = accounts[index];
+        const next = [...accounts];
+        next[index] = {
+            ...previous,
+            accessToken: grant.accessToken,
+            ...(grant.refreshToken ? { refreshToken: grant.refreshToken } : {}),
+            projectId: grant.projectId || previous.projectId,
+            ...(grant.email ? { email: grant.email } : {}),
+            expiresAt: grant.expiresAt,
+            updatedAt: now,
+            needsReauth: false,
+        };
+        return { accounts: next, result: true };
+    });
+}
+/** Mark only the token generation that failed; a sign-in that landed meanwhile wins. */
+export function markGoogleNeedsReauth(home, id, expectedAccessToken) {
+    return mutate(home, (accounts) => {
+        const index = accounts.findIndex((account) => account.id === id && account.accessToken === expectedAccessToken);
+        if (index < 0)
+            return { result: false };
+        const next = [...accounts];
+        next[index] = { ...next[index], needsReauth: true, updatedAt: new Date().toISOString() };
+        return { accounts: next, result: true };
+    });
+}
+export function updateGoogleAccount(home, id, change) {
+    const label = change.label?.replace(/[\x00-\x1f\x7f]/g, "").trim().slice(0, 80);
+    if (change.label !== undefined && !label)
+        return false;
+    return mutate(home, (accounts) => {
+        const index = accounts.findIndex((account) => account.id === id);
+        if (index < 0)
+            return { result: false };
+        const next = [...accounts];
+        const { paused: _paused, ...rest } = next[index];
+        next[index] = { ...rest, ...(label ? { label } : {}), ...((change.paused ?? next[index].paused) ? { paused: true } : {}), updatedAt: new Date().toISOString() };
+        return { accounts: next, result: true };
+    });
+}
+export function removeGoogleAccount(home, id) {
+    return mutate(home, (accounts) => {
+        const next = accounts.filter((account) => account.id !== id);
+        return next.length === accounts.length ? { result: false } : { accounts: next, result: true };
+    });
+}
+export function removeAllGoogleAccounts(home) {
+    return withFileLock(googleAccountsPath(home), () => {
+        const count = readGoogleAccounts(home).length;
+        fs.rmSync(googleAccountsPath(home), { force: true });
+        return count;
+    });
+}
+export function summarize(account) {
+    return {
+        id: account.id,
+        label: account.label,
+        ...(account.email ? { email: account.email } : {}),
+        projectId: account.projectId,
+        expiresAt: account.expiresAt,
+        needsReauth: account.needsReauth === true,
+        paused: account.paused === true,
+    };
+}
+// ---------------------------------------------------------------------------------------------
+// Runtime
+/** Refresh this long before expiry. A turn never waits for it while the old token still works. */
+const REFRESH_LEAD_MS = GOOGLE_OAUTH.refreshLeadMs;
+export class GoogleRefreshError extends Error {
+    terminal;
+    constructor(message, terminal) {
+        super(message);
+        this.terminal = terminal;
+    }
+}
+/**
+ * Whether a refused refresh means "sign in again". Only Google's `invalid_grant` counts; a 5xx whose
+ * body happens to mention "expired" must not retire a working account. Prose is read only when the
+ * body carries no `error` code at all and only for a 400/401.
+ */
+export function refreshRejectionIsTerminal(status, body) {
+    let code;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.error === "string")
+            code = parsed.error;
+    }
+    catch {
+        /* not JSON */
+    }
+    if (code)
+        return code === "invalid_grant";
+    return (status === 400 || status === 401) && /\binvalid_grant\b/i.test(body);
+}
+/**
+ * Exchange a refresh token for a new grant. Google's token endpoint takes a form-encoded body with
+ * the client id and secret (this is a public installed-app client). Throws GoogleRefreshError.
+ * Source: opencodex `postToken` / `refreshAntigravityToken`.
+ */
+export async function refreshGoogleGrant(refreshToken, previous, fetchImpl = fetch, now = Date.now) {
+    let res;
+    try {
+        res = await fetchImpl(GOOGLE_OAUTH.tokenUrl, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+            body: new URLSearchParams({ grant_type: "refresh_token", client_id: GOOGLE_OAUTH.clientId, client_secret: GOOGLE_OAUTH.clientSecret, refresh_token: refreshToken }).toString(),
+            signal: AbortSignal.timeout(GOOGLE_OAUTH.requestTimeoutMs),
+        });
+    }
+    catch (error) {
+        throw new GoogleRefreshError(`token refresh unreachable: ${error.message}`, false);
+    }
+    const text = await res.text().catch(() => "");
+    if (!res.ok)
+        throw new GoogleRefreshError(`token refresh failed: HTTP ${res.status} ${redactErrorText(text, [refreshToken], 200)}`, refreshRejectionIsTerminal(res.status, text));
+    let j;
+    try {
+        j = JSON.parse(text);
+    }
+    catch {
+        throw new GoogleRefreshError("token refresh answered with something other than JSON", false);
+    }
+    if (!j.access_token)
+        throw new GoogleRefreshError("token refresh answered without an access token", false);
+    const expiresIn = typeof j.expires_in === "number" && Number.isFinite(j.expires_in) && j.expires_in > 0 ? j.expires_in : 3600;
+    // The project was settled at sign-in (an account cannot be stored without one), so a refresh does
+    // not ask again: discovery can poll `onboardUser` for seconds, once an hour, for an answer it has.
+    return {
+        accessToken: j.access_token,
+        refreshToken: j.refresh_token ?? refreshToken,
+        projectId: previous.projectId,
+        ...(previous.email ? { email: previous.email } : {}),
+        expiresAt: now() + expiresIn * 1000,
+    };
+}
+/** One refresh per token generation across every adapter in this process. */
+const refreshing = new Map();
+function credentialOf(ownerId, label, accessToken, projectId) {
+    // The runtime id is the account itself, not its token: a usage limit belongs to the account, and a
+    // refresh must not bring a spent account back early.
+    return { id: ownerId, ownerId, label, accessToken, projectId, headers: { authorization: `Bearer ${accessToken}` } };
+}
+/**
+ * The Antigravity accounts one google provider may use. Refreshes what is due without holding a turn
+ * up, and can force a refresh when the backend refuses a token that has not expired yet.
+ */
+export class GoogleAccountPool {
+    home;
+    log;
+    fetchImpl;
+    now;
+    constructor(options) {
+        this.home = options.home;
+        this.log = options.log;
+        this.fetchImpl = options.fetch;
+        this.now = options.now ?? Date.now;
+    }
+    ownAccounts() {
+        return readGoogleAccounts(this.home);
+    }
+    /** Accounts that could be sent right now, without network I/O. */
+    peekCredentials() {
+        const out = [];
+        for (const account of this.ownAccounts()) {
+            if (account.paused || account.needsReauth || this.now() >= account.expiresAt)
+                continue;
+            out.push(credentialOf(account.id, account.label, account.accessToken, account.projectId));
+        }
+        return out;
+    }
+    /** Accounts for one turn. Waits for a refresh only when nothing could be sent otherwise. */
+    async credentials() {
+        const ready = this.peekCredentials();
+        const due = this.refreshDue();
+        if (ready.length > 0) {
+            void due.catch((error) => this.log.warn(`google account refresh task failed: ${error.message}`));
+            return ready;
+        }
+        await due;
+        return this.peekCredentials();
+    }
+    /** Refresh every stored account inside its lead window. */
+    async refreshDue() {
+        const due = this.ownAccounts().filter((account) => !account.needsReauth && account.refreshToken && this.now() >= account.expiresAt - REFRESH_LEAD_MS);
+        await Promise.all(due.map((account) => this.refresh(account)));
+    }
+    /** The project id for an owner, from the store. */
+    projectFor(ownerId) {
+        return this.ownAccounts().find((account) => account.id === ownerId)?.projectId;
+    }
+    /**
+     * The backend refused this account's token before it expired. One refresh; true when a new token
+     * is in place.
+     */
+    async forceRefresh(ownerId) {
+        const account = this.ownAccounts().find((candidate) => candidate.id === ownerId);
+        if (!account?.refreshToken || account.needsReauth)
+            return false;
+        const before = account.accessToken;
+        await this.refresh(account);
+        const after = this.ownAccounts().find((candidate) => candidate.id === ownerId);
+        return !!after && !after.needsReauth && after.accessToken !== before;
+    }
+    /** A token the backend refused after a refresh: that account needs a new sign-in. */
+    reject(credential) {
+        if (markGoogleNeedsReauth(this.home, credential.ownerId, credential.accessToken)) {
+            this.log.warn(`google account ${credential.ownerId.slice(0, 8)}: token refused; sign-in required`);
+        }
+    }
+    refresh(account) {
+        const refreshToken = account.refreshToken;
+        const key = `${this.home}\0${account.id}\0${crypto.createHash("sha256").update(refreshToken).digest("hex")}`;
+        const running = refreshing.get(key);
+        if (running)
+            return running;
+        const task = refreshGoogleGrant(refreshToken, account, this.fetchImpl, this.now).then((grant) => {
+            if (replaceGoogleTokens(this.home, account.id, refreshToken, grant)) {
+                this.log.info(`google account ${account.id.slice(0, 8)}: token refreshed, valid until ${new Date(grant.expiresAt).toISOString()}`);
+            }
+        }, (error) => {
+            if (error instanceof GoogleRefreshError && error.terminal) {
+                markGoogleNeedsReauth(this.home, account.id, account.accessToken);
+                this.log.warn(`google account ${account.id.slice(0, 8)}: refresh rejected; sign-in required`);
+            }
+            else {
+                this.log.warn(`google account ${account.id.slice(0, 8)}: refresh failed: ${redactErrorText(error.message, [account.accessToken, refreshToken], 300)}`);
+            }
+        }).finally(() => refreshing.delete(key));
+        refreshing.set(key, task);
+        return task;
+    }
+    summaries() {
+        return this.ownAccounts().map(summarize);
+    }
+    /** Whether anything is signed in at all, expired or not — the "log in first" check. */
+    signedIn() {
+        return this.ownAccounts().length > 0;
+    }
+}