pi-antigravity-rotator 2.1.5 → 2.2.1

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-06-20
+
+### Fixed
+- **Support tool response images**: Extracted any image content (`image_url` or `image` formats) from OpenAI tool response content and mapped them to Antigravity `inlineData` parts.
+- **Ordered tool results**: Guaranteed all tool results remain clustered at the top of the parts array, complying with Claude's strict layout requirements.
+- **Dangling tool call filtering**: Filtered out any `tool_calls` that do not have a matching `tool_result` in the subsequent message to prevent `400 Bad Request`.
+- **Inline JSON-Schema union types**: Collapsed Draft-2020-12 inline union type arrays (e.g. `type: ["number", "null"]`) to the first non-null type and lifted nullability into the proto-supported `nullable` flag to fix 400 errors.
+
+## [2.2.0] - 2026-06-16
+
+### Security
+
+### Security
+- **Admin token autogeneration**: On first run with no `PI_ROTATOR_ADMIN_TOKEN` env var, a cryptographically secure token is generated, persisted to `.admin-token` (mode 0600), and printed once to the operator. Dashboard and `/api/*` routes are now protected by default on fresh installs. Override the generated token by setting `PI_ROTATOR_ADMIN_TOKEN` in the env. `.admin-token` added to `.gitignore`.
+- **Querystring secret redaction**: `redactSensitive()` now also redacts `access_token`, `token`, `api_key`, `apikey`, `key`, `refresh_token` when they appear in querystring (`?key=val&...`) or URL fragment.
+- **OAuth fallback warning**: New `warnIfUsingFallbackOAuthCreds()` detects when `ANTIGRAVITY_CLIENT_ID` and/or `ANTIGRAVITY_CLIENT_SECRET` are missing and emits a one-time warning that the rotator is using the public Antigravity IDE client.
+- **Removed open CORS**: `Access-Control-Allow-Origin: *` removed from `/api/status` and `/api/config`. Replaced with `Cache-Control: no-store`. Dashboard still works same-origin.
+- **Truncated/redacted validation logs**: New `logValidationFailure()` truncates payloads to 200 chars and runs them through `redactSensitive` before logging. Applied to OpenAI messages validation and stream error logs in `compat.ts`.
+
+### Added
+- **`Config.modelSpecs`**: Operators can now override the per-model thinking/output spec table used by the compat layer without recompiling. Add a `modelSpecs` field to `accounts.json` and call `setModelSpecsOverride()` at boot (done automatically by `index.ts`).
+- **`warnIfInsecureTelemetryEndpoint()`**: Detects plain `http://` telemetry endpoints and emits a one-time warning. Default endpoint switched to `https://`. Override via `PI_ROTATOR_TELEMETRY_URL`. Silence via `PI_ROTATOR_TELEMETRY_INSECURE_OK=1`.
+- **Persistent `responsesStore`**: The OpenAI Responses API store (used by Codex via `previous_response_id`) is now persisted to `<configDir>/responses.json` with atomic writes and a 1.5s debounce. Restart-safe: in-flight Codex conversations continue across rotator restarts. New `src/responses-store.ts` with `load()`, `flush()`, `flushSync()`. Corrupt files are moved aside to `.corrupt-<ts>.bak` on startup.
+- **Debounced state writes**: Hot paths (`recordRequest`, `markExhausted`, `markError`, `markFlagged`) now call `scheduleStateSave()` instead of `saveState()`, coalescing multiple writes within a 1s window into a single disk write. New `flushPendingStateSaveSync()` in the SIGTERM/SIGINT shutdown handler drains the queue synchronously to minimise data loss.
+- **GitHub Actions CI**: New `.github/workflows/ci.yml` runs `npm ci` + `npm run check` (typecheck + 191 tests) on push and PR to `main`. Node 22 with npm cache. PRs without green checks cannot be merged.
+- **8 e2e proxy tests** (`test/proxy-e2e.test.ts`): Cover the full proxy flow with a local HTTP server as mock Antigravity — 200 happy path, 429 rate-limited (Retry-After and RESOURCE_EXHAUSTED), 401 unauthorized, 403 flagged and non-flagged, 500 server error, endpoint cascade (daily→prod).
+- **7 dashboard tests** (`test/dashboard.test.ts`): Verify utf-8/viewport meta tags, all 12 admin API endpoints are referenced, the `escapeHtml`/`jsString`/`maskText`/`maskEmail` helpers are present and `escapeHtml` correctly escapes the 5 HTML-sensitive characters, no hardcoded OAuth secrets or refresh tokens leak into the HTML.
+
+### Changed
+- **Refactored `proxy.ts`**: Extracted `classifyUpstreamResponse()` that returns a discriminated `UpstreamAction`. Both `withRotation()` and `handleProxyRequest()` dispatch against the helper instead of duplicating the 401/403/404/400/429/5xx branches. ~150 lines of parallel code removed. New `UpstreamAction` type with 9 action kinds.
+
+### Cleanup
+- **Removed `src/antigravity-prompt.ts`**: 80-line `ANTIGRAVITY_IDENTITY_PROMPT` export with 0 references in the repo.
+- **Consolidated agent docs**: `CLAUDE.md` now points to `AGENTS.md` as the single source of truth. The duplicated BEADS INTEGRATION block is gone.
+- **Moved scripts to `scripts/`**: 10 one-off utility scripts (`mitm.js`, `mock_google.js`, `query_models.{js,ts}`, `test-compat.ts`, `test-direct.js`, `test_generate.js`, `test_loop.js`, `test-http.cjs`, `test-openai.cjs`) moved from the repo root. `query_models.ts` and `test-compat.ts` updated to use `../src/...` relative imports after the move.
+
+## [2.2.1] - 2026-06-16
+
+### Fixed
+- **SSE usage extraction cross-event matching**: The old `extractTokenUsage()` ran a regex on the last 32KB of the upstream body, which could match across SSE event boundaries and return incorrect `(input, output)` pairs. Replaced with `SseEventAccumulator` + `extractUsageFromSseEvent()` that buffer complete SSE events (split on `\n\n`), parse each `data:` payload as JSON, and recursively search for `usageMetadata` (Gemini) or `usage` (OpenAI/Anthropic). Regex remains as a last-resort fallback for malformed JSON. Real-time streaming is preserved — the `res.write(chunk)` in `onData` is unchanged. Resolves ROADMAP §2.
+
+## [2.1.6] - 2026-06-12
+
+### Fixed
+- **Streaming tool calls finish reason**: Fixed an issue where `streamCompatSse` emitted `finish_reason: "stop"` instead of `"tool_calls"` when function calls were streamed to the client via OpenAI compatibility layer. This resolves compatibility issues with clients like ZED editor that discard pending tool executions as canceled when receiving "stop".
+
 ## [2.1.5] - 2026-05-27
 
 ### Fixed
@@ -11,6 +57,8 @@
   - **Consecutive tool result merging**: Multiple `functionResponse` parts are now merged into a single `user` Gemini turn, ensuring all `tool_result` blocks appear in one message directly after the `tool_use` assistant message.
 
 
+## [2.1.4] - 2026-05-27
+
 ### Improved
 - **Less Lossy Schema Collapsing for Claude**: The `sanitizeClaudeViaGeminiSchema` function now handles complex `anyOf`/`oneOf`/`allOf` schemas with significantly less information loss:
   - **Nullable detection (lossless)**: `anyOf: [{type: X}, {type: "null"}]` patterns are now converted to `{type: X, nullable: true}` instead of losing the null variant.

package/README.md

@@ -471,6 +471,7 @@ Current adapter scope:
 
 Thanks to these amazing people who have contributed to the project:
 
+- **[@josenicomaia](https://github.com/josenicomaia)** (José Nicodemos Maia Neto) — Fixed streaming pass-through to emit correct `finish_reason` for tool calls, fixing tool execution on ZED editor. ([PR #8](https://github.com/tuxevil/pi-antigravity-rotator/pull/8))
 - **[@javargasm](https://github.com/javargasm)** (Jeisson Alexander Vargas Marroquin) — Anthropic tool-use compatibility layer (`tool_use`/`tool_result` content block conversion), JSON schema round-trip fixes, and compat test suite expansion. ([PR #3](https://github.com/tuxevil/pi-antigravity-rotator/pull/3), [PR #7](https://github.com/tuxevil/pi-antigravity-rotator/pull/7))
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-antigravity-rotator",
-  "version": "2.1.5",
+  "version": "2.2.1",
   "description": "Multi-account rotation proxy for Google Antigravity with per-model routing, real-time quota tracking, and infringement detection",
   "license": "MIT",
   "type": "module",
@@ -12,7 +12,9 @@
     "login": "tsx src/cli.ts login",
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx/esm --test \"test/**/*.test.ts\"",
-    "check": "npm run typecheck && npm test"
+    "lint": "eslint src test",
+    "coverage": "c8 --reporter=text --reporter=html npm test",
+    "check": "npm run typecheck && npm test && npm run lint"
   },
   "files": [
     "bin/",
@@ -43,7 +45,11 @@
     "tsx": "^4.19.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
-    "typescript": "^5.7.0"
+    "c8": "^11.0.0",
+    "eslint": "^10.5.0",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.61.1"
   }
 }

package/src/account-store.ts

@@ -102,7 +102,37 @@ export function saveAccountsConfig(config: Config): void {
 	writeJsonFileAtomic(ACCOUNTS_FILE, applyConfigDefaults(config));
 }
 
+// Reasonable upper bounds on per-account fields. These are defensive
+// limits to prevent a malicious or buggy caller from growing
+// accounts.json without bound, which would slow every subsequent
+// saveState. The numbers are well above any realistic real value.
+export const MAX_EMAIL_LENGTH = 254; // RFC 5321
+export const MAX_LABEL_LENGTH = 100;
+export const MAX_PROJECT_ID_LENGTH = 100;
+export const MAX_REFRESH_TOKEN_LENGTH = 4096;
+
+function validateAccountConfigLengths(entry: AccountConfig): void {
+	const checks: Array<[string, number]> = [
+		["email", MAX_EMAIL_LENGTH],
+		["label", MAX_LABEL_LENGTH],
+		["projectId", MAX_PROJECT_ID_LENGTH],
+		["refreshToken", MAX_REFRESH_TOKEN_LENGTH],
+	];
+	for (const [field, max] of checks) {
+		const value = entry[field as keyof AccountConfig];
+		if (typeof value === "string" && value.length > max) {
+			throw new Error(
+				`Account ${field} exceeds maximum length ${max} (got ${value.length}). ` +
+				`This usually indicates a malformed input — refusing to write to accounts.json.`,
+			);
+		}
+	}
+}
+
+export { validateAccountConfigLengths };
+
 export function addAccountToConfig(entry: AccountConfig): { isNew: boolean } {
+	validateAccountConfigLengths(entry);
 	const config = loadOrCreateAccountsConfig();
 	const existing = config.accounts.findIndex((a) => a.email === entry.email);
 

package/src/admin-auth.ts

@@ -1,13 +1,96 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
 
 interface AdminAuthRequest {
 	url?: string;
 	headers: IncomingMessage["headers"];
 }
 
+const ADMIN_TOKEN_FILENAME = ".admin-token";
+
+let persistedToken: string | null = null;
+
+/**
+ * Set the persisted admin token at runtime. Called by index.ts after
+ * ensureAdminToken resolves the effective token. Subsequent calls to
+ * getConfiguredAdminToken() will return this token if no env var is set.
+ */
+export function setPersistedAdminToken(token: string | null): void {
+	persistedToken = token && token.length > 0 ? token : null;
+}
+
 export function getConfiguredAdminToken(env: NodeJS.ProcessEnv = process.env): string | null {
 	const token = env.PI_ROTATOR_ADMIN_TOKEN?.trim();
-	return token ? token : null;
+	if (token) return token;
+	return persistedToken;
+}
+
+/**
+ * Generate a cryptographically secure admin token (32 random bytes, hex).
+ * 64 hex characters = 256 bits of entropy.
+ */
+export function generateAdminToken(): string {
+	return randomBytes(32).toString("hex");
+}
+
+export function readPersistedAdminToken(configDir: string): string | null {
+	const tokenPath = join(configDir, ADMIN_TOKEN_FILENAME);
+	if (!existsSync(tokenPath)) return null;
+	try {
+		const raw = readFileSync(tokenPath, "utf-8").trim();
+		return raw ? raw : null;
+	} catch {
+		return null;
+	}
+}
+
+export function writePersistedAdminToken(configDir: string, token: string): void {
+	const tokenPath = join(configDir, ADMIN_TOKEN_FILENAME);
+	writeFileSync(tokenPath, token, { mode: 0o600, encoding: "utf-8" });
+	try {
+		chmodSync(tokenPath, 0o600);
+	} catch {
+		// Best effort: some filesystems (e.g. Windows) don't support POSIX perms.
+	}
+}
+
+export interface ResolvedAdminToken {
+	token: string;
+	source: "env" | "file" | "generated";
+	generated: boolean;
+}
+
+/**
+ * Resolve the effective admin token, generating and persisting one if needed.
+ * Priority: PI_ROTATOR_ADMIN_TOKEN env var > .admin-token file > generate new.
+ *
+ * When a token is generated, it is persisted to .admin-token with 0600 perms
+ * and returned. The caller is responsible for printing it to the operator.
+ */
+export function ensureAdminToken(
+	configDir: string,
+	env: NodeJS.ProcessEnv = process.env,
+): ResolvedAdminToken {
+	const envToken = env.PI_ROTATOR_ADMIN_TOKEN?.trim();
+	if (envToken) {
+		return { token: envToken, source: "env", generated: false };
+	}
+
+	const fileToken = readPersistedAdminToken(configDir);
+	if (fileToken) {
+		return { token: fileToken, source: "file", generated: false };
+	}
+
+	const newToken = generateAdminToken();
+	try {
+		writePersistedAdminToken(configDir, newToken);
+	} catch {
+		// If we cannot write the file (read-only fs, perms), still return the
+		// token for this session. The next restart will simply generate again.
+	}
+	return { token: newToken, source: "generated", generated: true };
 }
 
 export function getRequestAdminToken(req: AdminAuthRequest): string | null {