clauderipple 0.9.5 → 0.11.0

package/dist/router/src/providers/google/antigravity.js

@@ -31,6 +31,8 @@ export const GOOGLE_OAUTH = {
     prodApi: "https://cloudcode-pa.googleapis.com",
     /** Streaming and `onboardUser` use the daily host. Source: opencodex `src/oauth/google-antigravity.ts:24-25`. */
     dailyApi: "https://daily-cloudcode-pa.googleapis.com",
+    /** The two Cloud Code Assist hosts. They offer different models and count quota separately. */
+    hosts: ["https://daily-cloudcode-pa.googleapis.com", "https://cloudcode-pa.googleapis.com"],
     apiVersion: "v1internal",
     /** Preferred loopback port; the callback path is fixed. Source: opencodex `src/oauth/google-antigravity.ts:34-35`. */
     port: 51121,
@@ -91,8 +93,12 @@ export function resolveAntigravityThinkingLevel(effort) {
  * `ANTIGRAVITY_EFFORT_WIRE_MAP` / `ANTIGRAVITY_SUFFIX_TIER_MODELS`.
  */
 const SUFFIX_TIER_MODELS = {
+    // High rides on the medium tier: `-high` thinks with no budget (the catalogue's thinkingBudget -1,
+    // against 4000 for medium), and on 2026-10-17 the requests past 4000 output tokens took 64% of all
+    // request time. The owner chose speed over the deeper tier (2026-10-20). `-high` named outright
+    // still goes through as it is.
     "gemini-3.8-flash": {
-        wire: { low: "gemini-3.8-flash-low", medium: "gemini-3.8-flash-medium", high: "gemini-3.8-flash-high" },
+        wire: { low: "gemini-3.8-flash-low", medium: "gemini-3.8-flash-medium", high: "gemini-3.8-flash-medium" },
         default: "medium",
     },
 };
@@ -221,14 +227,15 @@ function collapseWireId(wireId) {
     return wireId;
 }
 /**
- * Parse `POST {dailyApi}/v1internal:fetchAvailableModels`. The body groups agent-callable models
- * under `agentModelSorts[].groups[].modelIds`, with tiered Flash ids under `tieredModelIds.flash`, and
- * describes each in `models[wireId]` (`maxTokens`). Source: opencodex
+ * Parse one host's `POST {host}/v1internal:fetchAvailableModels`. The body groups agent-callable
+ * models under `agentModelSorts[].groups[].modelIds`, with tiered Flash ids under
+ * `tieredModelIds.flash`, and describes each in `models[wireId]` (`maxTokens`). Source: opencodex
  * `parseAntigravityAvailableModels` (src/providers/antigravity-models.ts:489-560).
  *
  * Returns null when the shape is unreadable, so the caller falls back instead of showing nothing.
+ * The wire ids are kept so per-model host routing can match an exact wire id as well as a base id.
  */
-export function parseAvailableModels(payload, limit = 200) {
+export function parseHostCatalogue(payload, limit = 200) {
     if (!payload || typeof payload !== "object" || Array.isArray(payload))
         return null;
     const body = payload;
@@ -240,10 +247,12 @@ export function parseAvailableModels(payload, limit = 200) {
     // Collapse each wire id to its base id first, then take the context window and display name from
     // the first wire id that carried that base. A collapsed id is what routing understands.
     const collapsed = new Map();
+    const wireIds = [];
     const add = (wireId) => {
         if (typeof wireId !== "string" || !available.has(wireId))
             return;
         const id = collapseWireId(wireId);
+        wireIds.push(wireId);
         if (!collapsed.has(id))
             collapsed.set(id, wireId);
     };
@@ -278,7 +287,25 @@ export function parseAvailableModels(payload, limit = 200) {
         if (out.length >= limit)
             break;
     }
-    return out.length > 0 ? out : null;
+    return out.length > 0 ? { models: out, wireIds } : null;
+}
+/** The picker rows of one host's body, or null when the shape is unreadable. */
+export function parseAvailableModels(payload, limit = 200) {
+    return parseHostCatalogue(payload, limit)?.models ?? null;
+}
+/** Build the per-model host map from each host's catalogue; a host with no catalogue contributes nothing. */
+export function buildHostMap(cataloguesByHost) {
+    const map = new Map();
+    for (const [host, catalogue] of cataloguesByHost) {
+        const names = new Set([...catalogue.models.map((m) => m.id), ...catalogue.wireIds]);
+        for (const name of names) {
+            const hosts = map.get(name) ?? [];
+            if (!hosts.includes(host))
+                hosts.push(host);
+            map.set(name, hosts);
+        }
+    }
+    return map;
 }
 function extractProjectId(data) {
     if (!data)
@@ -373,10 +400,10 @@ export async function fetchUserEmail(accessToken, fetchImpl = fetch, signal) {
         return undefined;
     }
 }
-/** The models a CCA account can reach now, or null when the endpoint cannot be read. */
-export async function fetchAvailableModels(accessToken, projectId, fetchImpl = fetch, signal) {
+/** One host's catalogue, or null when the endpoint cannot be read. Never throws. */
+export async function fetchHostCatalogue(accessToken, projectId, host, fetchImpl = fetch, signal) {
     try {
-        const response = await fetchImpl(`${GOOGLE_OAUTH.dailyApi}/${GOOGLE_OAUTH.apiVersion}:fetchAvailableModels`, {
+        const response = await fetchImpl(`${host}/${GOOGLE_OAUTH.apiVersion}:fetchAvailableModels`, {
             method: "POST",
             headers: { authorization: `Bearer ${accessToken}`, accept: "*/*", "content-type": "application/json", "user-agent": antigravityUserAgent() },
             body: JSON.stringify({ project: projectId }),
@@ -384,9 +411,45 @@ export async function fetchAvailableModels(accessToken, projectId, fetchImpl = f
         });
         if (!response.ok)
             return null;
-        return parseAvailableModels(await response.json().catch(() => undefined));
+        return parseHostCatalogue(await response.json().catch(() => undefined));
     }
     catch {
         return null;
     }
 }
+/**
+ * The models a CCA account can reach, asked on every host that offers them (measured 2026-10-20:
+ * the prod host lists Gemini Pro models the daily host does not, and vice versa for some Flash
+ * tiers). Models are merged with the preferred host's row winning, and the returned host map is
+ * what routing uses to send a model to a host that actually offers it. Null when no host answered.
+ */
+export async function fetchAvailableModels(accessToken, projectId, opts = {}) {
+    const hosts = opts.hosts ?? GOOGLE_OAUTH.hosts;
+    const results = await Promise.all(hosts.map(async (host) => [host, await fetchHostCatalogue(accessToken, projectId, host, opts.fetchImpl ?? fetch, opts.signal)]));
+    const byHost = new Map();
+    for (const [host, catalogue] of results)
+        if (catalogue)
+            byHost.set(host, catalogue);
+    if (byHost.size === 0)
+        return null;
+    // Host order is preference order (daily first), so the first host to list a model keeps its row
+    // and a failing host simply contributes nothing to the merge.
+    const models = [];
+    const seen = new Set();
+    for (const catalogue of byHost.values()) {
+        for (const model of catalogue.models) {
+            if (seen.has(model.id))
+                continue;
+            seen.add(model.id);
+            models.push(model);
+        }
+    }
+    return { models, hosts: buildHostMap(byHost), byHost };
+}
+/**
+ * The host a model's request should go to: the first host in `hosts` that offers the resolved wire
+ * id or the base id, else `fallback`. An unknown model is not hidden — it goes to the default only.
+ */
+export function hostForModel(hosts, model, wire, fallback) {
+    return hosts.get(wire)?.[0] ?? hosts.get(model)?.[0] ?? fallback;
+}

package/dist/router/src/providers/google/index.js

@@ -14,20 +14,50 @@
 // vendor sent. The antigravity path picks the account the conversation is sticky to and moves to the
 // next one only on a refusal that has not reached the client (§4 Credential pools).
 import http from "node:http";
+import { setTimeout as sleep } from "node:timers/promises";
 import { providerExhaustion } from "../../health.js";
 import { CredentialPool, retryAfterMs } from "../../pool.js";
 import { credentialHeaderValues, redactErrorText } from "../../redact.js";
 import { SseParser } from "../chatgpt/sse.js";
 import { fetchWithRetry } from "../retry.js";
 import { estimateTokens, formatSse, GoogleStreamMapper, toGeminiRequest } from "./translate.js";
-import { createTransport, googleBaseUrl, resolveApiKey } from "./transport.js";
+import { antigravityBaseUrl, createTransport, googleBaseUrl, resolveApiKey } from "./transport.js";
 import { ThoughtSignatureStore } from "./thoughtSignatures.js";
 import { conversationKey, serverToolNames, toolNameRestoreMap } from "../chatgpt/translate.js";
 import { GoogleAccountPool } from "./accounts.js";
-import { fetchAvailableModels, staticAntigravityModels } from "./antigravity.js";
+import { fetchAvailableModels, hostForModel, resolveAntigravityWireModel, staticAntigravityModels, GOOGLE_OAUTH } from "./antigravity.js";
+import { GoogleUsage } from "./usage.js";
+import { ANTIGRAVITY_PROMPT_REFUSAL_MESSAGE, isAntigravityPromptRefusal } from "./prompt-refusal.js";
 const PING_MS = 15_000;
 /** How long the CCA model list is reused before asking again. */
 const MODELS_CACHE_MS = 60 * 60 * 1000;
+/**
+ * How often a turn asks again when Google says it has no capacity for the model, and how long it
+ * waits first. A few slower asks rather than the ten-in-a-row ladder: each refusal took seconds to
+ * arrive (41–103 s for ten on 2026-10-20), and capacity does not come back in 250 ms. Mutable only so
+ * tests can shorten the waits.
+ */
+export const capacityRetry = { delaysMs: [3_000, 6_000] };
+/**
+ * Cloud Code Assist saying the **model** has no capacity on its servers — not the account, not its
+ * quota. Measured 2026-10-20 on the daily host for `gemini-3.8-flash-high`: HTTP 503,
+ * `{"error":{"code":503,"status":"UNAVAILABLE","message":"No capacity available for model … on the
+ * server","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","reason":
+ * "MODEL_CAPACITY_EXHAUSTED","domain":"cloudcode-pa.googleapis.com","metadata":{"model":…,
+ * "OVERLOADED_TOO_MANY_RETRIES_PER_REQUEST":"true",…}}]}}`. Recognised by the ErrorInfo reason alone;
+ * any other 503 keeps the ordinary transient handling.
+ */
+export function isModelCapacityExhausted(status, text) {
+    if (status !== 503)
+        return false;
+    try {
+        const details = JSON.parse(text)?.error?.details;
+        return Array.isArray(details) && details.some((d) => typeof d === "object" && d !== null && d.reason === "MODEL_CAPACITY_EXHAUSTED");
+    }
+    catch {
+        return false;
+    }
+}
 function anthropicError(status, type, message) {
     return { status, body: JSON.stringify({ type: "error", error: { type, message } }) };
 }
@@ -113,6 +143,8 @@ export class GoogleAdapter {
     cfg;
     log;
     accounts;
+    /** Per-account quota, for the status bar's limits row (`GET /api/limits`). */
+    usage;
     /** Cooldowns and conversation stickiness, shared with the proxy's other credential pools. */
     pool;
     lastInputByKey = new Map();
@@ -124,12 +156,57 @@ export class GoogleAdapter {
     verifyUrls = new Map();
     modelsCache = null;
     modelsInFlight = null;
+    /** When the last listing attempt failed, so a turn does not retry an unreadable catalogue every time. */
+    modelsFailedAt = Number.NEGATIVE_INFINITY;
+    /** The fetch the adapter's side calls use (model listing, and the account store); injectable for tests. */
+    fetchImpl;
     constructor(name, cfg, home, log, pool = new CredentialPool(), fetchImpl) {
         this.name = name;
         this.cfg = cfg;
         this.log = log;
         this.pool = pool;
+        this.fetchImpl = fetchImpl;
         this.accounts = new GoogleAccountPool({ home, log, ...(fetchImpl ? { fetch: fetchImpl } : {}) });
+        // Quota: each Cloud Code Assist host counts its own, so the limits row reads every host a
+        // selected model lives on (resolved lazily from the cached model catalogue below).
+        this.usage = new GoogleUsage(this.accounts, {
+            baseUrl: antigravityBaseUrl(cfg.url),
+            hosts: () => this.quotaHosts(),
+            warn: (message) => log.warn(message),
+            ...(fetchImpl ? { fetch: fetchImpl } : {}),
+        });
+    }
+    /**
+     * The hosts whose quota the limits row must read: one per host that offers a model this provider
+     * routes (the configured model list, or the discovered catalogue when it lists none). A pinned
+     * `url` is the only host, because generation never leaves it.
+     */
+    quotaHosts() {
+        if (this.cfg.url)
+            return [antigravityBaseUrl(this.cfg.url)];
+        const hosts = this.modelsCache?.hosts;
+        // Without a catalogue we cannot tell which host the models go to; read the default one only,
+        // rather than showing an unused host's numbers.
+        if (!hosts)
+            return [GOOGLE_OAUTH.dailyApi];
+        const models = this.cfg.models ?? [];
+        // No configured model list means the provider routes whatever the client asks for; both hosts
+        // are then in use in principle, so both quotas are read.
+        if (models.length === 0)
+            return [...GOOGLE_OAUTH.hosts];
+        const fallback = antigravityBaseUrl(this.cfg.url);
+        const used = [];
+        for (const entry of models) {
+            // The host the model is actually sent to, not every host that lists it: a shared model goes
+            // to the preferred (daily) host, so only that host's quota is spent by this provider. The
+            // default effort stands in for the configured model because the config carries no per-turn
+            // effort; its tier's host is the representative one.
+            const wire = resolveAntigravityWireModel(entry.id, this.cfg.defaultEffort).wire;
+            const host = hostForModel(hosts, entry.id, wire, fallback);
+            if (!used.includes(host))
+                used.push(host);
+        }
+        return used.length ? used : [GOOGLE_OAUTH.dailyApi];
     }
     describeAuth() {
         const all = this.accounts.summaries();
@@ -161,6 +238,15 @@ export class GoogleAdapter {
             };
         });
     }
+    /**
+     * Each account's quota groups by owner id, for the status bar's limits row. Never a token; a
+     * failed lookup keeps that account's last good groups.
+     */
+    usageSnapshot() {
+        // Knowing which hosts hold the selected models needs the catalogue; a cold cache would read
+        // daily only and show the wrong host's numbers. The listing is cached for an hour.
+        return this.ensureHostMap().then(() => this.usage.snapshot());
+    }
     /**
      * Ask Google again whether an account still needs its verification page (dashboard action). The
      * mark otherwise clears only when the account next answers a turn, so a person who had just
@@ -173,7 +259,7 @@ export class GoogleAdapter {
             return "unknown";
         const model = this.cfg.models?.[0]?.id ?? staticAntigravityModels()[0].id;
         const transport = createTransport("antigravity", this.cfg.url ? { url: this.cfg.url } : {});
-        const built = transport.build({ contents: [{ role: "user", parts: [{ text: "ping" }] }], generationConfig: { maxOutputTokens: 16 } }, { model, stream: false, antigravity: { accessToken: credential.accessToken, projectId: credential.projectId, conversationKey: `recheck:${ownerId}` } });
+        const built = transport.build({ contents: [{ role: "user", parts: [{ text: "ping" }] }], generationConfig: { maxOutputTokens: 16 } }, { model, stream: false, antigravity: { accessToken: credential.accessToken, projectId: credential.projectId, conversationKey: `recheck:${ownerId}` }, antigravityBaseUrl: this.hostFor(model, undefined) });
         try {
             const upstream = await fetch(built.url, { method: "POST", headers: built.headers, body: built.body, signal: AbortSignal.timeout(30_000) });
             const text = await upstream.text().catch(() => "");
@@ -216,15 +302,53 @@ export class GoogleAdapter {
     }
     async fetchModelsOnce() {
         const credential = await this.anyCredential();
+        // No account is not a failed listing: a sign-in must take effect at once, not an hour later.
         if (credential instanceof Error)
             return null;
-        const models = await fetchAvailableModels(credential.accessToken, credential.projectId);
-        if (!models) {
+        // Both Cloud Code Assist hosts are asked; one host failing must not hide the other's models.
+        const hosts = this.cfg.url ? [antigravityBaseUrl(this.cfg.url)] : GOOGLE_OAUTH.hosts;
+        const catalogue = await fetchAvailableModels(credential.accessToken, credential.projectId, {
+            hosts,
+            ...(this.fetchImpl ? { fetchImpl: this.fetchImpl } : {}),
+        });
+        if (!catalogue) {
             this.log.warn(`google ${this.name}: fetchAvailableModels returned nothing; falling back to the static list`);
+            // A cold host is not asked again on every turn while it is unreadable.
+            this.modelsFailedAt = Date.now();
             return staticAntigravityModels();
         }
-        this.modelsCache = { at: Date.now(), models };
-        return models;
+        this.modelsCache = { at: Date.now(), models: catalogue.models, hosts: catalogue.hosts };
+        if (catalogue.byHost.size < hosts.length) {
+            const answered = [...catalogue.byHost.keys()].map((h) => new URL(h).host);
+            const missing = hosts.filter((h) => !catalogue.byHost.has(h)).map((h) => new URL(h).host);
+            this.log.warn(`google ${this.name}: fetchAvailableModels answered on ${answered.join(", ")}; ${missing.join(", ")} failed, its models are hidden`);
+        }
+        return catalogue.models;
+    }
+    /**
+     * Make sure the host map is loaded, within the same hour-long cache as `fetchModels`. A listing
+     * that just failed is not retried on every turn; the default host is used meanwhile.
+     */
+    async ensureHostMap() {
+        if (this.modelsCache || this.cfg.url)
+            return;
+        if (!this.accounts.signedIn())
+            return;
+        if (Date.now() - this.modelsFailedAt < MODELS_CACHE_MS)
+            return;
+        await this.fetchModels();
+    }
+    /**
+     * The host a turn for `model` must go to: the one that offers its resolved wire id, preferring
+     * daily when both do, else the provider's default. Unknown models and an unread catalogue fall
+     * back to the default, exactly as before the second host existed.
+     */
+    hostFor(model, effort) {
+        const fallback = antigravityBaseUrl(this.cfg.url);
+        if (this.cfg.url || !this.modelsCache)
+            return fallback;
+        const wire = resolveAntigravityWireModel(model, effort).wire;
+        return hostForModel(this.modelsCache.hosts, model, wire, fallback);
     }
     /** For side calls (models, project refresh) with no conversation: a usable account, else any. */
     async anyCredential() {
@@ -257,13 +381,23 @@ export class GoogleAdapter {
         const caps = effortLevels ? { effortLevels } : {};
         // A request that names no effort gets the provider's configured one, as the ChatGPT one does.
         const useEffort = effort ?? this.cfg.defaultEffort;
+        // A model that only one CCA host offers must be sent there. The catalogue is the only source of
+        // that routing, so a cold cache (first turn after a restart) is filled before the turn is built.
+        // It is a no-op within the hour after that, and a failure silently keeps the default host.
+        if (this.cfg.auth === "antigravity")
+            await this.ensureHostMap();
+        const host = this.cfg.auth === "antigravity" ? this.hostFor(model, useEffort) : undefined;
+        // Thought signatures are per host: CCA runs its state separately on each, and replaying one
+        // host's signature to the other is refused (see thoughtSignatures.ts). The API-key path keeps
+        // the unscoped store.
+        const signatures = host ? this.thoughtSignatures.scope(host) : this.thoughtSignatures;
         const upstreamRequest = toGeminiRequest(json, {
             model,
             ...(useEffort ? { effort: useEffort } : {}),
             caps,
             ...(this.cfg.identity === undefined ? {} : { identity: this.cfg.identity }),
             ...(this.cfg.instructionsAppend ? { instructionsAppend: this.cfg.instructionsAppend } : {}),
-            thoughtSignatures: this.thoughtSignatures,
+            thoughtSignatures: signatures,
             // The CCA path never adds the sentinel: the signature goes back on the exact functionCall the
             // model signed (or nothing at all), rather than a fabricated validator bypass.
             signatureSentinel: this.cfg.auth === "api-key",
@@ -275,7 +409,7 @@ export class GoogleAdapter {
         const startInput = Math.max(estimateTokens(json), this.lastInputByKey.get(key) ?? 0);
         const transport = createTransport(this.cfg.auth, { ...(this.cfg.apiKey ? { apiKey: this.cfg.apiKey } : {}), ...(this.cfg.url ? { url: this.cfg.url } : {}) });
         if (this.cfg.auth === "antigravity") {
-            return this.handleAntigravity(res, json, upstreamRequest, transport, model, useEffort, wantStream, key, startInput);
+            return this.handleAntigravity(res, json, upstreamRequest, transport, model, useEffort, wantStream, key, startInput, host, signatures);
         }
         const apiKey = resolveApiKey(this.cfg.apiKey);
         if (!apiKey) {
@@ -331,19 +465,23 @@ export class GoogleAdapter {
      * and its failure handling mirror the ChatGPT pool (accounts.ts), because the cache cost of moving
      * a conversation off its account is the same (§4).
      */
-    async handleAntigravity(res, json, upstreamRequest, transport, model, effort, wantStream, key, startInput) {
+    async handleAntigravity(res, json, upstreamRequest, transport, model, effort, wantStream, key, startInput, host, signatures) {
         const controller = new AbortController();
         const onClose = () => controller.abort();
         res.on("close", onClose);
         const sent = await this.sendToAnAccount({
             conversation: key,
             signal: controller.signal,
+            system: upstreamRequest.systemInstruction,
+            model,
+            host,
             build: (credential) => {
                 const built = transport.build(upstreamRequest, {
                     model,
                     stream: wantStream,
                     ...(effort ? { effort } : {}),
                     antigravity: { accessToken: credential.accessToken, projectId: credential.projectId, conversationKey: key },
+                    antigravityBaseUrl: host,
                 });
                 return { built, secrets: [credential.accessToken, ...credentialHeaderValues(Object.entries(built.headers))] };
             },
@@ -352,6 +490,17 @@ export class GoogleAdapter {
             res.off("close", onClose);
             if (sent.kind === "aborted")
                 return { status: 0, bytes: 0, note: "client closed" };
+            if (sent.kind === "prompt-refused") {
+                const err = anthropicError(400, "invalid_request_error", ANTIGRAVITY_PROMPT_REFUSAL_MESSAGE);
+                return { kind: "prompt-incompatible", status: 400, bytes: 0, errorBody: err.body,
+                    note: "upstream 429: suspected Antigravity SDK prompt refusal with remaining quota", refusal: "prompt-incompatible" };
+            }
+            if (sent.kind === "no-capacity") {
+                // Overloaded, so Claude Code asks again on its own when no fallback takes the turn.
+                const err = anthropicError(529, "overloaded_error", `Google provider: ${vendorMessage(sent.text)} — Google is out of capacity for this model (MODEL_CAPACITY_EXHAUSTED), asked ${sent.asks} times. This is Google's server capacity, not your account or its quota; try again shortly, or give the route a fallback.`);
+                return { kind: "model-capacity", status: 529, bytes: 0, errorBody: err.body,
+                    note: `upstream 503 MODEL_CAPACITY_EXHAUSTED after ${sent.asks} asks; account not rested` };
+            }
             if (sent.kind === "unreachable") {
                 const err = anthropicError(502, "api_error", `Google provider unreachable: ${sent.error.message}`);
                 if (!res.headersSent)
@@ -389,13 +538,13 @@ export class GoogleAdapter {
                 ...(sent.kind === "no-account" ? { upstreamCalled: false, refusal: "no-account" } : {}),
                 ...(sent.kind === "refused" ? { exhaustion: providerExhaustion(sent.status, sent.text, sent.retryAfterSeconds === undefined ? undefined : sent.retryAfterSeconds * 1000) } : {}), };
         }
-        return this.streamBack(res, sent.upstream, transport, json, model, wantStream, key, startInput, controller, onClose);
+        return this.streamBack(res, sent.upstream, transport, json, model, wantStream, key, startInput, controller, onClose, signatures);
     }
     /** Stream (or buffer) an already-ok upstream response back to the client as Anthropic SSE. */
-    async streamBack(res, upstream, transport, json, model, wantStream, key, startInput, controller, onClose) {
+    async streamBack(res, upstream, transport, json, model, wantStream, key, startInput, controller, onClose, signatures = this.thoughtSignatures) {
         const mapper = new GoogleStreamMapper(model, startInput, toolNameRestoreMap(json), (info) => {
             if (info.signature)
-                this.thoughtSignatures.set(info.id, info.signature);
+                signatures.set(info.id, info.signature);
         });
         const parser = new SseParser();
         const reader = upstream.body.getReader();
@@ -503,6 +652,9 @@ export class GoogleAdapter {
      * - 401, or a 403 that reads as a credential refusal: one refresh of that account and a replay;
      *   refused again with a 401, the account is marked for sign-in.
      * - 429 and 402: the account rests until its stated reset (or a default), and the next takes over.
+     * - A 503 `MODEL_CAPACITY_EXHAUSTED`: no rest and no other account — the model is out of capacity
+     *   on Google's side, not this account. The same account is asked again after `capacityRetry`'s
+     *   waits, then the turn ends unwritten so the proxy can try a route fallback (§5, 2026-10-20).
      * - Any other 403, 5xx, or no connection: a short rest, and the next account.
      * - Anything else is the request's fault; another account would refuse it the same way.
      *
@@ -514,6 +666,7 @@ export class GoogleAdapter {
         const refreshed = new Set();
         let last = null;
         let lastThrown = null;
+        let capacityAsks = 0;
         for (;;) {
             const credential = await this.pickAccount(spec.conversation, tried);
             if (credential === "none")
@@ -536,7 +689,7 @@ export class GoogleAdapter {
                     headers: built.headers,
                     body: built.body,
                     signal: spec.signal,
-                }, { log: (line) => this.log.info(`google ${this.name}: ${line}`) });
+                }, { log: (line) => this.log.info(`google ${this.name}: ${line}`), stopOn: isModelCapacityExhausted });
             }
             catch (e) {
                 if (spec.signal.aborted)
@@ -557,6 +710,30 @@ export class GoogleAdapter {
             const safeText = redactErrorText(text, secrets);
             const status = upstream.status;
             this.log.warn(`google ${this.name}: account ${credential.ownerId.slice(0, 8)} answered ${status}: ${safeText.slice(0, 400)}`);
+            // The model, not the account, is out of capacity: resting the account refused every other turn
+            // with "all accounts resting" for its ten seconds (10 times in 3 minutes, 2026-10-20), and
+            // another account would meet the same model on the same host. So nothing is charged to it.
+            if (isModelCapacityExhausted(status, text)) {
+                capacityAsks++;
+                const delay = capacityRetry.delaysMs[capacityAsks - 1];
+                if (delay === undefined)
+                    return { kind: "no-capacity", text: safeText, asks: capacityAsks };
+                this.log.info(`google ${this.name}: ${spec.model} out of capacity (ask ${capacityAsks}); asking again in ${delay}ms without resting the account`);
+                try {
+                    await sleep(delay, undefined, { signal: spec.signal });
+                }
+                catch {
+                    return { kind: "aborted" };
+                }
+                continue;
+            }
+            // The generic 429 is also real exhaustion. Only fresh quota evidence for this
+            // account/model permits a request-specific refusal; otherwise keep ordinary
+            // cooldown and account rotation. The proxy can still try a route fallback.
+            if (isAntigravityPromptRefusal(spec.system, status, text, upstream.headers.get("retry-after")) &&
+                this.usage.hasRemainingQuota(credential, spec.model, spec.host)) {
+                return { kind: "prompt-refused" };
+            }
             // Not a rest and not a refresh: the account works again the moment its person finishes
             // Google's page, so it stays in rotation and the next turn finds out.
             const verifyUrl = status === 403 ? googleValidationUrl(text) : undefined;

package/dist/router/src/providers/google/prompt-refusal.js

@@ -0,0 +1,29 @@
+const SDK_PARAGRAPH = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+const GENERIC_EXHAUSTED = "Resource has been exhausted (e.g. check quota).";
+export const ANTIGRAVITY_PROMPT_REFUSAL_MESSAGE = `Google Antigravity rejected this Claude Agent SDK system prompt (upstream 429: ${GENERIC_EXHAUSTED}). ` +
+    "This request appears incompatible with Antigravity; retrying or waiting on this account is unlikely to fix it. " +
+    "Choose another provider for this Claude Code request.";
+/**
+ * Measured 2026-10-16: the same Gemini 3.8 Flash / Claude Opus 5.5 request got 429
+ * with this standalone SDK paragraph and 200 without it. This is response-based
+ * classification, never a prompt rewrite or a prediction before Google answers.
+ * Keep any explicit quota/reset details on the ordinary rate-limit path. This shape
+ * alone also occurs on real exhaustion; callers must require fresh quota evidence.
+ */
+export function isAntigravityPromptRefusal(system, status, text, retryAfter) {
+    if (status !== 429 || retryAfter !== null)
+        return false;
+    if (!system?.parts.some(part => part.text?.split(/\r?\n\s*\r?\n/).some(paragraph => paragraph.trim() === SDK_PARAGRAPH)))
+        return false;
+    try {
+        const error = JSON.parse(text)?.error;
+        if (!error || typeof error !== "object" || Array.isArray(error))
+            return false;
+        const e = error;
+        return e.code === 429 && e.status === "RESOURCE_EXHAUSTED" && e.message === GENERIC_EXHAUSTED &&
+            (e.details === undefined || (Array.isArray(e.details) && e.details.length === 0));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/router/src/providers/google/thoughtSignatures.js

@@ -43,5 +43,18 @@ export class ThoughtSignatureStore {
             this.map.delete(oldest);
         }
     }
+    /**
+     * A view whose keys carry the Cloud Code Assist host the signature came from. Cloud Code Assist
+     * runs on two hosts with separate state, and replaying a signature minted on one to the other is
+     * what the backend refuses (TYPE_BYTES), so a conversation that moves between hosts must not
+     * find the other host's signature. The shared store keeps the LRU bound across both views.
+     */
+    scope(host) {
+        const prefix = `${host}\u0000`;
+        return {
+            get: (id) => this.get(prefix + id),
+            set: (id, signature) => this.set(prefix + id, signature),
+        };
+    }
     get size() { return this.map.size; }
 }

package/dist/router/src/providers/google/transport.js

@@ -77,7 +77,7 @@ export function createTransport(mode, opts) {
                     request,
                 };
                 return {
-                    url: `${base}/${GOOGLE_OAUTH.apiVersion}:${method}${query}`,
+                    url: `${(o.antigravityBaseUrl ? o.antigravityBaseUrl.replace(/\/+$/, "") : base)}/${GOOGLE_OAUTH.apiVersion}:${method}${query}`,
                     headers: {
                         "content-type": "application/json",
                         accept: o.stream ? "text/event-stream" : "application/json",