gemini-thought-signature-proxy 1.0.0

package/README.md

@@ -0,0 +1,49 @@
+```
+400 INVALID_ARGUMENT: Function call is missing a thought_signature in functionCall parts.
+```
+
+## Who is affected
+Anyone using VS Code or VS Code Insiders with GitHub Copilot's "Bring Your Own Key" (BYOK) feature connected to **any** OpenAI-compatible Gemini 3.1 endpoint in Agent mode (tool/function calling).
+
+## What is `thought_signature`?
+Gemini 3.1 uses "thinking" — an internal reasoning step before generating tool calls. Google cryptographically signs this reasoning and attaches the signature to any tool call the model returns. This signature is required to be echoed back on subsequent turns. However, VS Code's Copilot extension is a vanilla OpenAI client, so it strips this non-standard `extra_content` field entirely.
+
+## The Failure Flow
+1. VS Code → Google (round 1, signature returned)
+2. VS Code strips signature
+3. VS Code → Google (round 2, 400 error)
+
+## Quick Start
+Run the proxy locally:
+```bash
+npx gemini-thought-signature-proxy
+```
+
+Then, update your VS Code settings. Paste the following into your `chatLanguageModels.json`:
+```json
+"url": "http://localhost:3000/v1beta/openai/"
+```
+
+**How to find `chatLanguageModels.json`:**
+- Press `Cmd+Shift+P` (or `Ctrl+Shift+P` on Windows/Linux)
+- Search for `Open User Settings (JSON)`
+- Or find it directly at `~/Library/Application Support/Code - Insiders/User/chatLanguageModels.json` on macOS.
+
+## How it works
+This proxy sits between VS Code and Google. Before forwarding any request, it walks the `messages` array, finds every `role: "assistant"` message with `tool_calls`, and injects a stateless bypass sentinel:
+```json
+"extra_content": { "google": { "thought_signature": "skip_thought_signature_validator" } }
+```
+`skip_thought_signature_validator` is Google's own documented bypass sentinel for the signature validator, intended for exactly this third-party client scenario.
+
+## Path routing note
+VS Code constructs the final URL by appending `v1/chat/completions` to the base URL in `chatLanguageModels.json`. With a base of `http://localhost:3000/v1beta/openai/`, VS Code sends requests to `/v1beta/openai/v1/chat/completions`. The Google endpoint is `/v1beta/openai/chat/completions` (no extra `/v1`). The proxy intercepts VS Code's path and rewrites the upstream target accordingly.
+
+## Note on Models
+The bypass only activates for `models/gemini-3.1-pro-preview-customtools`. Other models pass through untouched.
+
+## When this might stop working
+If Google changes enforcement post-GA, the `PATCHED_MODEL_ID` and `BYPASS_SIGNATURE` constants may need to be updated.
+
+## References
+- [Google's official thought signatures docs](https://ai.google.dev/gemini-api/docs/thought-signatures)

package/cli.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+
+import './proxy.js';

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "gemini-thought-signature-proxy",
+  "version": "1.0.0",
+  "description": "A proxy to bypass the Gemini 3.1 Pro thought_signature 400 error in VS Code Copilot BYOK",
+  "main": "proxy.js",
+  "type": "module",
+  "bin": {
+    "gemini-thought-signature-proxy": "cli.js"
+  },
+  "scripts": {
+    "start": "node cli.js"
+  },
+  "keywords": [
+    "gemini",
+    "thought_signature",
+    "proxy",
+    "vscode",
+    "copilot",
+    "byok",
+    "tool-calling",
+    "agent-mode",
+    "400",
+    "INVALID_ARGUMENT"
+  ],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "express": "^4.18.2",
+    "node-fetch": "^3.3.2"
+  }
+}

package/proxy.js

@@ -0,0 +1,86 @@
+import express from "express";
+import fetch from "node-fetch";
+
+const PORT = process.env.PORT || 3000;
+const GOOGLE_BASE_URL = "https://generativelanguage.googleapis.com";
+const BYPASS_SIGNATURE = "skip_thought_signature_validator";
+const PATCHED_MODEL_ID = "models/gemini-3.1-pro-preview-customtools";
+
+const app = express();
+app.use(express.json({ limit: "50mb" }));
+
+function injectThoughtSignatures(messages) {
+  if (!Array.isArray(messages)) return messages;
+  return messages.map((message) => {
+    if (message.role !== "assistant" || !Array.isArray(message.tool_calls)) {
+      return message;
+    }
+    const patchedToolCalls = message.tool_calls.map((toolCall) => {
+      const existingSignature = toolCall?.extra_content?.google?.thought_signature;
+      if (existingSignature) return toolCall;
+      return {
+        ...toolCall,
+        extra_content: { google: { thought_signature: BYPASS_SIGNATURE } },
+      };
+    });
+    return { ...message, tool_calls: patchedToolCalls };
+  });
+}
+
+app.post("/v1beta/openai/v1/chat/completions", async (req, res) => {
+  try {
+    const body = req.body ?? {};
+    const { messages, model, ...rest } = body;
+    const requiresPatch = model === PATCHED_MODEL_ID;
+    const patchedMessages = requiresPatch ? injectThoughtSignatures(messages) : messages;
+    if (requiresPatch) {
+      console.log(`[proxy] ✓ Injecting thought_signature bypass for model: ${model}`);
+    }
+    const upstreamUrl = `${GOOGLE_BASE_URL}/v1beta/openai/chat/completions`;
+    const forwardHeaders = { "content-type": req.headers["content-type"] || "application/json" };
+    if (req.headers["authorization"]) forwardHeaders["authorization"] = req.headers["authorization"];
+    console.log(`[proxy] → POST ${upstreamUrl}  |  model: ${model ?? "unknown"}  |  messages: ${patchedMessages?.length ?? 0}`);
+    const upstreamResponse = await fetch(upstreamUrl, {
+      method: "POST",
+      headers: forwardHeaders,
+      body: JSON.stringify({ messages: patchedMessages, model, ...rest }),
+    });
+    res.status(upstreamResponse.status);
+    const ct = upstreamResponse.headers.get("content-type");
+    if (ct) res.set("content-type", ct);
+    upstreamResponse.body.pipe(res);
+  } catch (err) {
+    console.error("[proxy] ✖ Error:", err);
+    res.status(502).json({ error: "proxy_error", details: err.message });
+  }
+});
+
+app.all("*", async (req, res) => {
+  try {
+    const qs = req.url.includes("?") ? req.url.slice(req.url.indexOf("?")) : "";
+    const upstreamUrl = `${GOOGLE_BASE_URL}${req.path}${qs}`;
+    const forwardHeaders = {};
+    for (const header of ["authorization", "content-type", "accept"]) {
+      if (req.headers[header]) forwardHeaders[header] = req.headers[header];
+    }
+    const fetchOptions = { method: req.method, headers: forwardHeaders };
+    if (req.method !== "GET" && req.method !== "HEAD" && req.body) {
+      fetchOptions.body = JSON.stringify(req.body);
+    }
+    console.log(`[proxy] → ${req.method} ${upstreamUrl}`);
+    const upstreamResponse = await fetch(upstreamUrl, fetchOptions);
+    res.status(upstreamResponse.status);
+    const ct = upstreamResponse.headers.get("content-type");
+    if (ct) res.set("content-type", ct);
+    upstreamResponse.body.pipe(res);
+  } catch (err) {
+    console.error("[proxy] ✖ Error in passthrough:", err);
+    res.status(502).json({ error: "proxy_error", details: err.message });
+  }
+});
+
+app.listen(PORT, () => {
+  console.log(`\n  Gemini thought_signature bypass proxy`);
+  console.log(`  Listening → http://localhost:${PORT}`);
+  console.log(`  Forwarding → ${GOOGLE_BASE_URL}\n`);
+});