clawmoney 0.15.53 → 0.15.55

package/dist/commands/relay-setup.js

@@ -2,6 +2,7 @@ import { execSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import * as readline from "node:readline";
 import { intro, outro, multiselect, select, spinner, isCancel, cancel, log, } from "@clack/prompts";
 import chalk from "chalk";
 import { apiPost } from "../utils/api.js";
@@ -9,6 +10,8 @@ import { loadConfig, requireConfig } from "../utils/config.js";
 import { setupCommand } from "./setup.js";
 import { API_PRICES, PLATFORM_FEE } from "../relay/pricing.js";
 import { hasClaudeFingerprint, bootstrapClaudeFingerprint, } from "../relay/upstream/claude-bootstrap.js";
+import { hasGeminiFingerprint, bootstrapGeminiFingerprint, } from "../relay/upstream/gemini-bootstrap.js";
+import { hasCodexFingerprint, bootstrapCodexFingerprint, } from "../relay/upstream/codex-bootstrap.js";
 // ── Per-cli_type model catalogs ──
 //
 // `RECOMMENDED_MODELS` is what gets registered when the user picks "all
@@ -204,48 +207,95 @@ export async function relaySetupCommand() {
         process.exit(0);
     }
     const selectedClis = familyChoice;
-    // ── Step 2b: bootstrap per-cli fingerprints if missing ──
+    // Per-cli inline fingerprint bootstrap helper. Called from Step 3
+    // right after the "cli: N models" line so the capture flow is
+    // visually grouped with its owning cli family.
     //
-    // Claude / Codex / Gemini daemons each need a fingerprint file
+    // The daemon needs a fingerprint file per cli_type
     // (~/.clawmoney/<cli>-fingerprint.json) to mimic the real CLI's
-    // device_id + account_uuid when relaying requests. Without it,
-    // every relay request fails at execution time and the buyer sees
-    // 502s.
+    // device identity on every upstream request. Without it, the
+    // daemon fails at execution time and buyers see 502s. We
+    // previously required a manual two-terminal capture dance; now
+    // it's inlined into the wizard.
     //
-    // Previously users had to run a two-terminal capture dance
-    // manually. Now we do it inline: start a local proxy, invoke
-    // `claude -p hi` (etc) against it, intercept the first
-    // /v1/messages request, extract the fingerprint, forward the
-    // request upstream so the CLI call still succeeds.
+    // claude uses a plain HTTP proxy (in-process TS), same for gemini.
+    // codex uses the existing mjs capture script via subprocess
+    // because Codex CLI 0.118+ talks WebSocket.
     //
-    // Only claude is wired up for now; codex/gemini will follow the
-    // same pattern.
-    if (selectedClis.includes("claude") && !hasClaudeFingerprint()) {
-        // Append-only progress: print the ◇ line once, then append a
-        // single "." every 600ms until the bootstrap finishes. This
-        // avoids the `\r`-based spinner that stacks frames in Jack's
-        // terminal (see earlier iteration history), while still giving
-        // visible "working…" feedback.
-        process.stdout.write(`${chalk.gray("◇")}  Capturing Claude fingerprint ${chalk.dim("(runs `claude -p hi` once, ~5-15s)")}`);
-        const ticker = setInterval(() => {
-            process.stdout.write(chalk.dim("."));
-        }, 600);
+    // antigravity is handled separately via `clawmoney antigravity
+    // login` and doesn't need a fingerprint file.
+    const runCliBootstrap = async (cli) => {
+        let startLabel;
+        let run;
+        let check;
+        if (cli === "claude") {
+            if (hasClaudeFingerprint())
+                return;
+            startLabel = "Capturing Claude fingerprint (runs `claude -p hi` once, ~5-15s)";
+            check = hasClaudeFingerprint;
+            run = async () => {
+                const fp = await bootstrapClaudeFingerprint({ timeoutMs: 45_000 });
+                return `device=${fp.device_id.slice(0, 8)}… cc_version=${fp.cc_version || "?"}`;
+            };
+        }
+        else if (cli === "gemini") {
+            if (hasGeminiFingerprint())
+                return;
+            startLabel = "Capturing Gemini fingerprint (runs `gemini -p hi` once, ~10-20s)";
+            check = hasGeminiFingerprint;
+            run = async () => {
+                const fp = await bootstrapGeminiFingerprint({ timeoutMs: 60_000 });
+                return `project=${fp.project_id} cli_version=${fp.cli_version}`;
+            };
+        }
+        else if (cli === "codex") {
+            if (hasCodexFingerprint())
+                return;
+            startLabel = "Capturing Codex fingerprint (runs `codex -p hi` once, ~15-30s)";
+            check = hasCodexFingerprint;
+            run = async () => {
+                await bootstrapCodexFingerprint({ timeoutMs: 60_000 });
+                return "from chatgpt.com WS handshake";
+            };
+        }
+        else {
+            // antigravity or unknown — skip, no fingerprint needed.
+            return;
+        }
+        // In-place line replacement: print start line without a newline,
+        // then clear it on completion and print the result over the top.
+        // Uses readline.cursorTo/clearLine for terminal portability.
+        const startLine = `${chalk.gray("◇")}  ${chalk.bold(startLabel)}`;
+        process.stdout.write(startLine);
+        const clearStartLine = () => {
+            try {
+                readline.cursorTo(process.stdout, 0);
+                readline.clearLine(process.stdout, 0);
+            }
+            catch {
+                process.stdout.write("\n");
+            }
+        };
         try {
-            const fp = await bootstrapClaudeFingerprint({ timeoutMs: 45_000 });
-            clearInterval(ticker);
-            process.stdout.write("\n");
-            log.success(`Claude fingerprint captured ` +
-                chalk.dim(`(device=${fp.device_id.slice(0, 8)}… cc_version=${fp.cc_version || "?"})`));
+            const summary = await run();
+            clearStartLine();
+            process.stdout.write(`${chalk.green("◆")}  ${chalk.bold(cli)} fingerprint captured ` +
+                chalk.dim(`(${summary})`) +
+                "\n");
         }
         catch (err) {
-            clearInterval(ticker);
-            process.stdout.write("\n");
-            log.warn(`Claude fingerprint capture failed: ${err.message}`);
-            log.message(chalk.dim("Claude providers will be registered but the daemon won't be able " +
-                "to serve them until you bootstrap the fingerprint. " +
-                "Make sure `claude` is installed and logged in, then re-run setup."));
+            clearStartLine();
+            process.stdout.write(`${chalk.yellow("⚠")}  ${chalk.bold(cli)} fingerprint capture failed: ${err.message}\n`);
+            log.message(chalk.dim(`${cli} providers will be registered but the daemon won't be able ` +
+                "to serve them until the fingerprint is bootstrapped. " +
+                `Make sure \`${cli}\` is installed and logged in, then re-run setup.`));
         }
-    }
+        // Defensive: if the bootstrap somehow resolved without writing
+        // the file, warn so the user isn't surprised later.
+        if (!check()) {
+            log.message(chalk.dim(`(${cli} fingerprint file still missing — daemon preflight will fail for this cli)`));
+        }
+    };
     const registrations = [];
     for (const cli of selectedClis) {
         const allModels = modelsForCli(cli);
@@ -255,6 +305,10 @@ export async function relaySetupCommand() {
             continue;
         }
         log.success(`${chalk.bold(cli)}: ${recommended.length} models ${chalk.dim("— " + recommended.join(", "))}`);
+        // Bootstrap the fingerprint for this cli right after its model
+        // line so the ◆ "fingerprint captured" message sits visually
+        // under its owning family (claude / codex / gemini / antigravity).
+        await runCliBootstrap(cli);
         for (const model of recommended) {
             const p = API_PRICES[model];
             registrations.push({

package/dist/relay/upstream/codex-bootstrap.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Programmatic Codex fingerprint capture.
+ *
+ * Codex CLI 0.118+ talks to chatgpt.com over a WebSocket Upgrade
+ * (GET /v1/responses Upgrade: websocket) rather than plain HTTPS,
+ * which makes the in-process TS proxy approach used for Claude and
+ * Gemini much harder — we'd need to port the full handshake + frame
+ * decoder. So instead we reuse the existing
+ * `scripts/capture-codex-request.mjs` script which already handles
+ * all of that correctly: spawn it as a subprocess, run `codex -p hi`
+ * against it, and wait for `~/.clawmoney/codex-fingerprint.json` to
+ * appear. On success we SIGINT the capture proxy so it can scrub the
+ * transient capture files the way the manual flow does.
+ *
+ * Note: the mjs script hardcodes port 8788. If something else on the
+ * machine is already using that port, the spawn fails and we surface
+ * the error.
+ */
+export declare function hasCodexFingerprint(): boolean;
+export declare function bootstrapCodexFingerprint(opts?: {
+    timeoutMs?: number;
+}): Promise<void>;

package/dist/relay/upstream/codex-bootstrap.js

@@ -0,0 +1,216 @@
+/**
+ * Programmatic Codex fingerprint capture.
+ *
+ * Codex CLI 0.118+ talks to chatgpt.com over a WebSocket Upgrade
+ * (GET /v1/responses Upgrade: websocket) rather than plain HTTPS,
+ * which makes the in-process TS proxy approach used for Claude and
+ * Gemini much harder — we'd need to port the full handshake + frame
+ * decoder. So instead we reuse the existing
+ * `scripts/capture-codex-request.mjs` script which already handles
+ * all of that correctly: spawn it as a subprocess, run `codex -p hi`
+ * against it, and wait for `~/.clawmoney/codex-fingerprint.json` to
+ * appear. On success we SIGINT the capture proxy so it can scrub the
+ * transient capture files the way the manual flow does.
+ *
+ * Note: the mjs script hardcodes port 8788. If something else on the
+ * machine is already using that port, the spawn fails and we surface
+ * the error.
+ */
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const CONFIG_DIR = join(homedir(), ".clawmoney");
+const FINGERPRINT_PATH = join(CONFIG_DIR, "codex-fingerprint.json");
+const CAPTURE_PORT = 8788;
+const CAPTURE_SCRIPT = "capture-codex-request.mjs";
+export function hasCodexFingerprint() {
+    return existsSync(FINGERPRINT_PATH);
+}
+// Locate the mjs capture script relative to the installed dist.
+// After TS compilation this file ends up at
+//   <pkg>/dist/relay/upstream/codex-bootstrap.js
+// and the scripts live at <pkg>/scripts/capture-codex-request.mjs
+// so the relative walk is ../../../scripts.
+function findCaptureScript() {
+    const thisFile = fileURLToPath(import.meta.url);
+    const thisDir = dirname(thisFile);
+    const candidates = [
+        join(thisDir, "..", "..", "..", "scripts", CAPTURE_SCRIPT),
+        join(thisDir, "..", "..", "scripts", CAPTURE_SCRIPT),
+        join(thisDir, "..", "scripts", CAPTURE_SCRIPT),
+    ];
+    for (const c of candidates) {
+        if (existsSync(c))
+            return c;
+    }
+    return null;
+}
+export async function bootstrapCodexFingerprint(opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 60_000;
+    if (hasCodexFingerprint()) {
+        throw new Error("codex-fingerprint.json already exists — delete it to re-bootstrap");
+    }
+    const scriptPath = findCaptureScript();
+    if (!scriptPath) {
+        throw new Error(`capture-codex-request.mjs not found in the installed clawmoney package`);
+    }
+    let proxyChild = null;
+    let codexChild = null;
+    let pollInterval = null;
+    let done = false;
+    const cleanup = () => {
+        if (pollInterval) {
+            clearInterval(pollInterval);
+            pollInterval = null;
+        }
+        if (codexChild && !codexChild.killed) {
+            try {
+                codexChild.kill("SIGTERM");
+            }
+            catch {
+                // ignore
+            }
+        }
+        if (proxyChild && !proxyChild.killed) {
+            try {
+                // SIGINT triggers the mjs script's capture-file scrub
+                // cleanup (scrubs OAuth bearer tokens).
+                proxyChild.kill("SIGINT");
+            }
+            catch {
+                // ignore
+            }
+        }
+    };
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            if (done)
+                return;
+            done = true;
+            cleanup();
+            reject(new Error(`codex fingerprint capture timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        // 1. Spawn the capture proxy (mjs script). It inherits the
+        // current process's env, including HTTPS_PROXY which it needs
+        // to reach chatgpt.com.
+        proxyChild = spawn("node", [scriptPath], {
+            env: { ...process.env },
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let proxyStderr = "";
+        proxyChild.stderr?.on("data", (c) => {
+            proxyStderr += c.toString();
+            if (proxyStderr.length > 4_000) {
+                proxyStderr = proxyStderr.slice(-4_000);
+            }
+        });
+        proxyChild.stdout?.on("data", () => {
+            // drain — the mjs script prints a banner we don't care about
+        });
+        proxyChild.on("error", (err) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            cleanup();
+            reject(new Error(`failed to spawn capture proxy: ${err.message}`));
+        });
+        proxyChild.on("exit", (code) => {
+            // If the proxy crashed before the fingerprint was captured,
+            // reject. If we killed it deliberately after capture, 'done'
+            // is already set.
+            if (done)
+                return;
+            if (!hasCodexFingerprint()) {
+                done = true;
+                clearTimeout(timer);
+                cleanup();
+                const tail = proxyStderr.trim().slice(-400);
+                const detail = tail ? ` stderr: ${tail}` : "";
+                reject(new Error(`capture proxy exited (code ${code ?? "unknown"}) before fingerprint.${detail}`));
+            }
+        });
+        // Wait a moment for the proxy to bind port 8788, then spawn
+        // codex. 1.5s is enough on every machine I've tested.
+        setTimeout(() => {
+            if (done)
+                return;
+            // Poll the fingerprint file — the mjs script writes it as
+            // soon as the first upgrade handshake decodes successfully.
+            pollInterval = setInterval(() => {
+                if (done) {
+                    if (pollInterval) {
+                        clearInterval(pollInterval);
+                        pollInterval = null;
+                    }
+                    return;
+                }
+                if (hasCodexFingerprint()) {
+                    done = true;
+                    if (pollInterval) {
+                        clearInterval(pollInterval);
+                        pollInterval = null;
+                    }
+                    clearTimeout(timer);
+                    cleanup();
+                    resolve();
+                }
+            }, 500);
+            // Codex wants the proxy-local endpoint; strip HTTPS_PROXY so
+            // it talks to 127.0.0.1 directly (going through a proxy to
+            // loopback tends to wedge).
+            const childEnv = {
+                ...process.env,
+                OPENAI_BASE_URL: `http://127.0.0.1:${CAPTURE_PORT}/v1`,
+                NO_PROXY: "127.0.0.1,localhost",
+                no_proxy: "127.0.0.1,localhost",
+            };
+            delete childEnv.HTTPS_PROXY;
+            delete childEnv.https_proxy;
+            delete childEnv.HTTP_PROXY;
+            delete childEnv.http_proxy;
+            delete childEnv.ALL_PROXY;
+            delete childEnv.all_proxy;
+            codexChild = spawn("codex", ["-p", "hi"], {
+                env: childEnv,
+                stdio: ["ignore", "pipe", "pipe"],
+                shell: process.platform === "win32",
+            });
+            let codexStderr = "";
+            codexChild.stderr?.on("data", (c) => {
+                codexStderr += c.toString();
+                if (codexStderr.length > 4_000) {
+                    codexStderr = codexStderr.slice(-4_000);
+                }
+            });
+            codexChild.stdout?.on("data", () => {
+                // drain
+            });
+            codexChild.on("error", (err) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+                cleanup();
+                reject(new Error(`failed to spawn codex: ${err.message} (is the codex CLI installed and in PATH?)`));
+            });
+            codexChild.on("exit", (code) => {
+                // Give the proxy a moment to finish writing the fingerprint
+                // after the WS upgrade completes. If no file after that,
+                // fail with the stderr tail for diagnostics.
+                setTimeout(() => {
+                    if (done || hasCodexFingerprint())
+                        return;
+                    done = true;
+                    clearTimeout(timer);
+                    cleanup();
+                    const tail = codexStderr.trim().slice(-400);
+                    const detail = tail ? ` stderr: ${tail}` : "";
+                    reject(new Error(`codex -p hi exited with code ${code ?? "unknown"} before the capture proxy saw a /v1/responses upgrade.${detail}`));
+                }, 800);
+            });
+        }, 1500);
+    });
+}

package/dist/relay/upstream/gemini-bootstrap.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Programmatic Gemini fingerprint capture.
+ *
+ * Mirrors scripts/capture-gemini-request.mjs but runs inline so the
+ * setup wizard can bootstrap ~/.clawmoney/gemini-fingerprint.json
+ * without the two-terminal dance.
+ *
+ * Flow:
+ *   1. Listen on a random localhost port.
+ *   2. Spawn `gemini -p "hi"` with CODE_ASSIST_ENDPOINT pointing at us.
+ *   3. When the first POST hits a /v1internal:generateContent (or
+ *      similar) path, extract project_id / user_agent / cli_version /
+ *      x_goog_api_client from the body + headers, persist to
+ *      ~/.clawmoney/gemini-fingerprint.json, and forward the request
+ *      to cloudcode-pa.googleapis.com so the gemini CLI still sees a
+ *      valid response.
+ *   4. Clean up proxy server + gemini subprocess.
+ *
+ * Note: the :loadCodeAssist bootstrap request that Gemini CLI fires
+ * first carries only `{metadata}` without a project — we skip it and
+ * wait for a subsequent v1internal request that actually carries a
+ * project field. Mirrors the mjs script's extractFingerprint guard.
+ */
+export interface GeminiFingerprint {
+    project_id: string;
+    cli_version: string;
+    user_agent: string;
+    x_goog_api_client: string;
+}
+export declare function hasGeminiFingerprint(): boolean;
+export declare function bootstrapGeminiFingerprint(opts?: {
+    timeoutMs?: number;
+}): Promise<GeminiFingerprint>;

package/dist/relay/upstream/gemini-bootstrap.js

@@ -0,0 +1,316 @@
+/**
+ * Programmatic Gemini fingerprint capture.
+ *
+ * Mirrors scripts/capture-gemini-request.mjs but runs inline so the
+ * setup wizard can bootstrap ~/.clawmoney/gemini-fingerprint.json
+ * without the two-terminal dance.
+ *
+ * Flow:
+ *   1. Listen on a random localhost port.
+ *   2. Spawn `gemini -p "hi"` with CODE_ASSIST_ENDPOINT pointing at us.
+ *   3. When the first POST hits a /v1internal:generateContent (or
+ *      similar) path, extract project_id / user_agent / cli_version /
+ *      x_goog_api_client from the body + headers, persist to
+ *      ~/.clawmoney/gemini-fingerprint.json, and forward the request
+ *      to cloudcode-pa.googleapis.com so the gemini CLI still sees a
+ *      valid response.
+ *   4. Clean up proxy server + gemini subprocess.
+ *
+ * Note: the :loadCodeAssist bootstrap request that Gemini CLI fires
+ * first carries only `{metadata}` without a project — we skip it and
+ * wait for a subsequent v1internal request that actually carries a
+ * project field. Mirrors the mjs script's extractFingerprint guard.
+ */
+import { createServer } from "node:http";
+import { existsSync, mkdirSync, readdirSync, unlinkSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { fetch as undiciFetch, ProxyAgent } from "undici";
+const CONFIG_DIR = join(homedir(), ".clawmoney");
+const FINGERPRINT_PATH = join(CONFIG_DIR, "gemini-fingerprint.json");
+export function hasGeminiFingerprint() {
+    return existsSync(FINGERPRINT_PATH);
+}
+const HOP_BY_HOP = new Set([
+    "host",
+    "connection",
+    "content-length",
+    "transfer-encoding",
+    "accept-encoding",
+]);
+function cloneHeaders(src) {
+    const out = {};
+    for (const [k, v] of Object.entries(src)) {
+        if (v == null)
+            continue;
+        if (HOP_BY_HOP.has(k.toLowerCase()))
+            continue;
+        out[k] = Array.isArray(v) ? v.join(", ") : v;
+    }
+    return out;
+}
+// /v1beta and /v1alpha go to generativelanguage (AI Studio).
+// Everything else (notably /v1internal for Code Assist) goes to
+// cloudcode-pa. Matches the manual script's routing.
+function resolveUpstreamURL(path) {
+    if (path.startsWith("/v1beta") ||
+        path.startsWith("/v1/beta") ||
+        path.startsWith("/v1alpha")) {
+        return `https://generativelanguage.googleapis.com${path}`;
+    }
+    return `https://cloudcode-pa.googleapis.com${path}`;
+}
+function extractFingerprint(body, headers) {
+    if (!body || typeof body !== "object")
+        return null;
+    const projectRaw = body.project;
+    const projectId = typeof projectRaw === "string" ? projectRaw.trim() : "";
+    // :loadCodeAssist carries {metadata} without a project — wait for
+    // the next request that does.
+    if (!projectId)
+        return null;
+    const uaRaw = headers["user-agent"];
+    const ua = (Array.isArray(uaRaw) ? uaRaw.join(", ") : (uaRaw ?? "")).trim();
+    const versionMatch = ua.match(/GeminiCLI\/(\d+\.\d+[.\d]*)/i);
+    const cliVersion = versionMatch ? versionMatch[1] : "unknown";
+    const xGoogRaw = headers["x-goog-api-client"];
+    const xGoog = (Array.isArray(xGoogRaw) ? xGoogRaw.join(", ") : (xGoogRaw ?? "")).trim();
+    return {
+        project_id: projectId,
+        cli_version: cliVersion,
+        user_agent: ua || `GeminiCLI/${cliVersion}`,
+        x_goog_api_client: xGoog || "gl-node/unknown",
+    };
+}
+function scrubCaptureFiles() {
+    try {
+        for (const f of readdirSync(CONFIG_DIR)) {
+            if (/^capture-gemini-\d+\.json$/.test(f)) {
+                unlinkSync(join(CONFIG_DIR, f));
+            }
+        }
+    }
+    catch {
+        // ignore — best-effort
+    }
+}
+export async function bootstrapGeminiFingerprint(opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 45_000;
+    mkdirSync(CONFIG_DIR, { recursive: true });
+    if (hasGeminiFingerprint()) {
+        throw new Error("gemini-fingerprint.json already exists — delete it to re-bootstrap");
+    }
+    // Gemini talks to Google — Google is reachable only through a
+    // proxy from GFW-side networks, so we DO honor HTTPS_PROXY for the
+    // upstream forward. The child subprocess gets no proxy env because
+    // it's talking to 127.0.0.1 (us), and routing 127.0.0.1 through
+    // http_proxy tends to wedge.
+    const proxyUrl = process.env.HTTPS_PROXY ||
+        process.env.https_proxy ||
+        process.env.HTTP_PROXY ||
+        process.env.http_proxy;
+    let upstreamDispatcher;
+    if (proxyUrl && /^https?:\/\//.test(proxyUrl)) {
+        upstreamDispatcher = new ProxyAgent(proxyUrl);
+    }
+    let server = null;
+    let geminiChild = null;
+    let resolved = false;
+    let capturedFp = null;
+    const cleanup = () => {
+        if (geminiChild && !geminiChild.killed) {
+            try {
+                geminiChild.kill("SIGTERM");
+            }
+            catch {
+                // ignore
+            }
+        }
+        if (server) {
+            try {
+                server.close();
+            }
+            catch {
+                // ignore
+            }
+            server = null;
+        }
+    };
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            if (resolved)
+                return;
+            resolved = true;
+            cleanup();
+            reject(new Error(`gemini fingerprint capture timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        server = createServer((req, res) => {
+            const chunks = [];
+            req.on("data", (c) => chunks.push(c));
+            req.on("end", async () => {
+                const bodyBuf = Buffer.concat(chunks);
+                const bodyText = bodyBuf.toString("utf-8");
+                let parsedBody;
+                try {
+                    parsedBody = JSON.parse(bodyText);
+                }
+                catch {
+                    parsedBody = bodyText;
+                }
+                const isGenerate = req.method === "POST" &&
+                    typeof req.url === "string" &&
+                    (req.url.includes("generateContent") || req.url.includes("v1internal"));
+                if (!capturedFp &&
+                    isGenerate &&
+                    parsedBody &&
+                    typeof parsedBody === "object") {
+                    const fp = extractFingerprint(parsedBody, req.headers);
+                    if (fp) {
+                        capturedFp = fp;
+                        try {
+                            writeFileSync(FINGERPRINT_PATH, JSON.stringify(fp, null, 2), "utf-8");
+                            scrubCaptureFiles();
+                        }
+                        catch (writeErr) {
+                            if (!resolved) {
+                                resolved = true;
+                                clearTimeout(timer);
+                                cleanup();
+                                reject(new Error(`failed to write gemini fingerprint: ${writeErr.message}`));
+                                return;
+                            }
+                        }
+                    }
+                }
+                // Forward to real Google upstream.
+                const upstreamURL = resolveUpstreamURL(req.url || "/");
+                const targetHost = new URL(upstreamURL).host;
+                try {
+                    const upstreamHeaders = cloneHeaders(req.headers);
+                    upstreamHeaders["host"] = targetHost;
+                    const upstreamResp = await undiciFetch(upstreamURL, {
+                        method: req.method,
+                        headers: upstreamHeaders,
+                        body: req.method === "GET" || req.method === "HEAD"
+                            ? undefined
+                            : bodyBuf,
+                        dispatcher: upstreamDispatcher,
+                    });
+                    const respHeaders = {};
+                    upstreamResp.headers.forEach((v, k) => {
+                        const lower = k.toLowerCase();
+                        if (lower === "content-encoding" ||
+                            lower === "content-length" ||
+                            lower === "transfer-encoding")
+                            return;
+                        respHeaders[k] = v;
+                    });
+                    res.writeHead(upstreamResp.status, respHeaders);
+                    if (upstreamResp.body) {
+                        const reader = upstreamResp.body.getReader();
+                        while (true) {
+                            const { done: rDone, value } = await reader.read();
+                            if (rDone)
+                                break;
+                            res.write(Buffer.from(value));
+                        }
+                    }
+                    res.end();
+                }
+                catch (err) {
+                    try {
+                        res.writeHead(502);
+                        res.end();
+                    }
+                    catch {
+                        // ignore
+                    }
+                    if (!resolved && !capturedFp) {
+                        resolved = true;
+                        clearTimeout(timer);
+                        cleanup();
+                        reject(new Error(`upstream google request failed: ${err.message}`));
+                        return;
+                    }
+                }
+                if (capturedFp && !resolved) {
+                    resolved = true;
+                    clearTimeout(timer);
+                    cleanup();
+                    resolve(capturedFp);
+                }
+            });
+        });
+        server.on("error", (err) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timer);
+            cleanup();
+            reject(new Error(`gemini bootstrap proxy error: ${err.message}`));
+        });
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            if (!addr || typeof addr === "string") {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timer);
+                cleanup();
+                reject(new Error("failed to bind gemini capture proxy"));
+                return;
+            }
+            const port = addr.port;
+            // Strip upstream proxy env vars from the child so it hits our
+            // local 127.0.0.1 listener directly. NO_PROXY is belt-and-braces.
+            const childEnv = {
+                ...process.env,
+                CODE_ASSIST_ENDPOINT: `http://127.0.0.1:${port}`,
+                NO_PROXY: "127.0.0.1,localhost",
+                no_proxy: "127.0.0.1,localhost",
+            };
+            delete childEnv.HTTPS_PROXY;
+            delete childEnv.https_proxy;
+            delete childEnv.HTTP_PROXY;
+            delete childEnv.http_proxy;
+            delete childEnv.ALL_PROXY;
+            delete childEnv.all_proxy;
+            geminiChild = spawn("gemini", ["-p", "hi"], {
+                env: childEnv,
+                stdio: ["ignore", "pipe", "pipe"],
+                shell: process.platform === "win32",
+            });
+            let stderrBuf = "";
+            geminiChild.stderr?.on("data", (chunk) => {
+                stderrBuf += chunk.toString();
+                if (stderrBuf.length > 4_000) {
+                    stderrBuf = stderrBuf.slice(-4_000);
+                }
+            });
+            geminiChild.stdout?.on("data", () => {
+                // drain
+            });
+            geminiChild.on("error", (err) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timer);
+                cleanup();
+                reject(new Error(`failed to spawn gemini: ${err.message} (is the gemini CLI installed and in PATH?)`));
+            });
+            geminiChild.on("exit", (code) => {
+                setTimeout(() => {
+                    if (capturedFp || resolved)
+                        return;
+                    resolved = true;
+                    clearTimeout(timer);
+                    cleanup();
+                    const tail = stderrBuf.trim().slice(-400);
+                    const detail = tail ? ` stderr: ${tail}` : "";
+                    reject(new Error(`gemini -p hi exited with code ${code ?? "unknown"} before sending a v1internal request.${detail}`));
+                }, 500);
+            });
+        });
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawmoney",
-  "version": "0.15.53",
+  "version": "0.15.55",
   "description": "ClawMoney CLI -- Earn rewards with your AI agent",
   "type": "module",
   "bin": {