pi-antigravity-rotator 2.3.1 → 2.3.2

package/CHANGELOG.md

@@ -2,8 +2,28 @@
 
 ## [Unreleased]
 
+## [2.3.2] - 2026-07-05
+
+### Fixed
+- **Assistant History**: Preserve final Responses assistant history.
+- **Claude Formatting**: Prevent Claude assistant prefill payloads and fix orphan Claude tool results to comply with API formatting constraints.
+- **Resource Leaks**: Release compat streams on client disconnect to prevent memory leaks.
+- **Security Audit**: Addressed audit hardening findings and fixed audit issues around OAuth and admin routes.
+
+
 ## [2.3.1] - 2026-06-30
 
+
+### Added
+- **Manual & Auto-Warmup (Kickstart) Timers**: Added ability to kickstart idle/fresh timers. A minimal request (`maxOutputTokens=1`) is sent to the cheapest model in the pool to start the 5h/7d reset window.
+- **Auto-Warmup Toggle**: Global operator toggle to automatically warm up idle pools during the quota polling cycle.
+- **Admin Endpoints**: Added `POST /api/kickstart/:email`, `POST /api/kickstart/:email/:modelKey`, and `POST /api/settings/auto-warmup/on|off`.
+- **Dashboard UI**: Added "Start Idle Timers" button on account cards when idle pools are detected, and a global "Enable/Disable Auto-Warmup" button in operator controls. Added telemetry cost estimates for `gemini-3.5-flash`.
+
+### Fixed
+- Included rolling idle pools (100% quota with a fresh resetTime) as valid kickstart targets.
+- Isolated tests from the production config directory (`PI_ROTATOR_DIR=/tmp/pi-rotator-test`) to prevent config corruption during `npm test`.
+
 ### Improved
 - **Accurate Quota Forecast**: Replaced the simple arithmetic average of pool quota with a weighted calculation based on each account's Tier capacity (Ultra/Pro/Plus/Free). The Dashboard's time remaining and percentage estimates are now mathematically accurate for mixed-tier deployments. (PR [#14](https://github.com/tuxevil/pi-antigravity-rotator/pull/14) by [@josenicomaia](https://github.com/josenicomaia))
 

package/README.md

@@ -68,9 +68,10 @@ To donate a quota-enabled account safely:
 - **Safer 429 handling** -- On provider `429`, stops the current request and avoids cascade-burning sibling accounts
 - **Concurrency guardrails** -- Limits each account to one in-flight request by default to avoid bursty pressure
 - **Operator fresh-window controls** -- You can block new `fresh` window starts globally, then selectively allow specific accounts to override that policy
+- **Auto-Warmup & Kickstart** -- Automatically detects idle quota pools (100% quota with a full reset time) and sends a minimal request to kickstart the 5h/7d window
 - **Protective pause** -- Pauses all routing for several hours after serious ToS/abuse-style flags so the rest of the pool is not burned
 - **Token auto-refresh** -- Tokens are refreshed automatically before expiry; no manual management
-- **Endpoint cascade** -- Tries daily, autopush, and prod API endpoints for resilience
+- **Endpoint fallback support** -- Uses the verified daily Cloud Code Assist endpoint by default; the forwarder supports endpoint cascading if additional verified upstream endpoints are configured in future releases
 - **Advanced Telemetry & Statistics** -- Track exactly how much USD you save compared to a paid API plan, predict quota depletion with the Forecast grid, view Latency tracking (p50/p95), and explore 60-day historical usage heatmaps
 - **Web dashboard** -- Real-time view of model routing table, per-account quota bars with per-model timers, and flagged account alerts
 - **Auto-update notifications** -- The dashboard checks npm for new releases every 30 minutes and shows a banner with one-click update when a newer version is available
@@ -79,6 +80,8 @@ To donate a quota-enabled account safely:
 
 ## Quick Start
 
+Requirements for npm/source installs: Node.js 22 or newer. The published package runs the TypeScript sources through `tsx` at runtime, so `tsx` is intentionally listed as a production dependency. The Docker image uses Node 22.
+
 ### Option A: Install from npm
 
 ```bash
@@ -108,10 +111,11 @@ npm start
 ### Option C: Docker
 
 ```bash
+mkdir -p docker-data
 docker compose up -d
 ```
 
-The included compose file persists runtime data under `./docker-data` and sets `PI_ROTATOR_DIR=/data`.
+The Docker image installs production dependencies only and runs as the non-root `node` user (UID/GID 1000). The included compose file persists runtime data under `./docker-data`, sets `PI_ROTATOR_DIR=/data`, and publishes the proxy on `127.0.0.1:51200` by default. On Linux, make sure `docker-data` is writable by UID 1000 if your host user differs. If you need LAN access, change the compose port mapping to `51200:51200` only on a trusted network or behind a firewall/reverse proxy.
 
 ## Adding Accounts
 
@@ -151,7 +155,7 @@ If login fails at project discovery:
 
 ## Dashboard
 
-After starting the proxy, open `http://localhost:51200/dashboard` or `http://<your-server-ip>:51200/dashboard` from any machine on the same network (the proxy binds to `0.0.0.0`).
+After starting the proxy, open `http://localhost:51200/dashboard`. Native npm starts bind to `0.0.0.0` unless you set `PI_ROTATOR_BIND_HOST` or `bindHost`; the Docker compose example publishes only `127.0.0.1:51200` on the host by default. Use `http://<your-server-ip>:51200/dashboard` only after deliberately exposing the port on a trusted LAN, firewall, or reverse proxy.
 
 If `PI_ROTATOR_ADMIN_TOKEN` is unset, the proxy automatically generates a cryptographically secure token on first run and saves it to a `.admin-token` file in the root directory. This token will be printed to the console on first startup. You must append `?token=<your-token>` to the dashboard URL to access it, or set `PI_ROTATOR_ADMIN_TOKEN` in your environment to override it.
 
@@ -185,7 +189,7 @@ Agent 3 (Flash)       --->  localhost:51200  --->  Account A
 2. The proxy resolves the model to a quota key (e.g., `gemini-3.1-pro`)
 3. The best available account for that specific model is selected
 4. The `Authorization` header and `project` field are swapped with real credentials
-5. The request is forwarded (trying daily, autopush, then prod endpoints)
+5. The request is forwarded to the configured Antigravity endpoint (the verified daily endpoint by default; cascade applies only if additional verified endpoints are configured)
 6. The SSE response streams back to the agent transparently
 
 ### Per-Model Account Selection
@@ -243,7 +247,7 @@ The proxy detects blocked/suspended accounts at three levels:
 
 1. **Quota API check** (initial poll + every poll) -- If the quota API returns `401` or `403`, the account is immediately flagged.
 
-2. **API 401** (on request) -- If the prod endpoint rejects the token with `401 UNAUTHENTICATED`, the account is flagged.
+2. **API 401** (on request) -- If the upstream endpoint rejects the token with `401 UNAUTHENTICATED`, the account is flagged.
 
 3. **API 403** (on request) -- If the response body contains enforcement keywords such as `infring`, `suspend`, `abus`, `terminat`, `violat`, `banned`, `policy`, `forbidden`, or `verif`, the account is flagged.
 
@@ -310,13 +314,13 @@ pi-antigravity-rotator start --config-dir /path/to/config
 
 New v2.0 config fields:
 
-- `bindHost`: interface to bind on. Default: `0.0.0.0`.
+- `bindHost`: interface to bind on. Default: `0.0.0.0`. For local-only use, set `PI_ROTATOR_BIND_HOST=127.0.0.1` or `"bindHost": "127.0.0.1"`.
 - `routingPolicy`: current default is `timer-first`. Optional values now include `tier-first`, `quota-first`, and `hybrid`.
 - `tokenBucketEnabled`: enables the local per-account request bucket used by `hybrid`. Default: `false`.
 - `tokenBucketMaxTokens`: bucket capacity when enabled. Default: `50`.
 - `tokenBucketRefillPerMinute`: refill speed when enabled. Default: `6`.
 - `tokenBucketInitialTokens`: startup fill level when enabled. Default: `50`.
-- `accounts[].tier`: optional `ultra`, `pro`, `free`, or `unknown`.
+- `accounts[].tier`: optional `ultra`, `pro`, `plus`, `free`, or `unknown`.
 
 ## Doctor
 
@@ -418,7 +422,7 @@ Login now fails if Google does not return a project ID. No shared fallback.
 | `POST` | `/v1/chat/completions` | OpenAI-compatible non-streaming chat adapter |
 | `POST` | `/v1/messages` | Anthropic-compatible non-streaming messages adapter |
 
-Dashboard and internal `/api/*` requests must include either `Authorization: Bearer <token>`, `X-Rotator-Admin-Token: <token>`, or `?token=<token>` for browser dashboard access. The native pi proxy endpoint and compatibility adapters (`/v1/*`) remain unauthenticated by design, so your AI agents and existing clients will keep working without requiring a token. Put this service behind a trusted local boundary if exposing beyond localhost/LAN.
+Dashboard and internal `/api/*` requests must include either `Authorization: Bearer <token>`, `X-Rotator-Admin-Token: <token>`, or `?token=<token>` for browser dashboard access. The native pi proxy endpoint and compatibility adapters (`/v1/*`) remain unauthenticated by design, so your AI agents and existing clients will keep working without requiring a token. `PI_ROTATOR_ADMIN_TOKEN` does **not** protect those proxy routes. Put this service behind a trusted local boundary, firewall, or reverse proxy if exposing beyond localhost/LAN.
 
 ### Compatibility Adapters
 
@@ -530,11 +534,12 @@ To connect Codex to your local rotator:
 
 ```bash
 npm run typecheck
+npm run typecheck:test
 npm test
 npm run check
 ```
 
-The test suite covers model resolution contracts and dashboard render/syntax smoke checks.
+`npm run typecheck` checks runtime source under `src/`; `npm run typecheck:test` also checks test helpers and mocks under `test/`. The test suite covers model resolution contracts and dashboard render/syntax smoke checks.
 
 ## Running as a Service
 
@@ -602,15 +607,16 @@ The dashboard shows both raw `Flag Events` and deduped `Unique Flag Incidents` s
 
 Flag data is the most valuable signal. It lets us study what behavior patterns lead to flags and improve the rotation algorithm to avoid them — benefiting everyone.
 
-### What is NEVER collected
+### What is not included in telemetry payloads
 
 - ❌ Email addresses
 - ❌ OAuth tokens or API keys
-- ❌ IP addresses
 - ❌ Google project IDs
 - ❌ Request/response bodies
 - ❌ Error message text (only which known keywords matched)
 
+IP addresses are not part of the telemetry JSON payload and are not written to telemetry event files. The receiver and network path can still observe the source IP for transport and in-memory rate limiting, and the default telemetry endpoint uses plain HTTP. Set `PI_ROTATOR_TELEMETRY=off` to disable telemetry, or set `PI_ROTATOR_TELEMETRY_URL` to an HTTPS endpoint you control.
+
 ### Endpoint
 
 Telemetry posts to:

package/package.json

@@ -1,20 +1,24 @@
 {
   "name": "pi-antigravity-rotator",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Multi-account rotation proxy for Google Antigravity with per-model routing, real-time quota tracking, and infringement detection",
   "license": "MIT",
   "type": "module",
   "bin": {
     "pi-antigravity-rotator": "bin/pi-antigravity-rotator.js"
   },
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "scripts": {
     "start": "tsx src/cli.ts start",
     "login": "tsx src/cli.ts login",
     "typecheck": "tsc --noEmit",
+    "typecheck:test": "tsc --project tsconfig.test.json",
     "test": "PI_ROTATOR_DIR=/tmp/pi-rotator-test node --import tsx/esm --test \"test/**/*.test.ts\"",
     "lint": "eslint src test",
-    "coverage": "c8 --reporter=text --reporter=html npm test",
-    "check": "npm run typecheck && npm test && npm run lint"
+    "coverage": "c8 --reporter=text --reporter=html --check-coverage --lines=60 --branches=50 --functions=60 --statements=60 npm test",
+    "check": "npm run typecheck && npm run typecheck:test && npm test && npm run lint"
   },
   "files": [
     "bin/",
@@ -43,15 +47,15 @@
   "author": "Sebastián Real (tuxevil)",
   "dependencies": {
     "pg": "^8.22.0",
-    "tsx": "^4.19.0"
+    "tsx": "^4.22.4"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^22.0.0",
+    "@types/node": "^22.20.0",
     "@types/pg": "^8.20.0",
     "c8": "^11.0.0",
-    "eslint": "^10.5.0",
+    "eslint": "^10.6.0",
     "typescript": "^5.7.0",
-    "typescript-eslint": "^8.61.1"
+    "typescript-eslint": "^8.62.1"
   }
 }

package/src/cli.ts

@@ -35,14 +35,39 @@ switch (command) {
     break;
   }
   case "status": {
+    const { initDb, closeDb } = await import("./db-store.js");
+    const {
+      getConfiguredAdminToken,
+      readPersistedAdminToken,
+      setPersistedAdminToken,
+    } = await import("./admin-auth.js");
     try {
+      await initDb();
+      setPersistedAdminToken(readPersistedAdminToken());
+      const token = getConfiguredAdminToken();
       const port = 51200;
-      const res = await fetch(`http://localhost:${port}/api/status`);
+      const res = await fetch(`http://localhost:${port}/api/status`, {
+        headers: token ? { "X-Rotator-Admin-Token": token } : {},
+      });
+      if (res.status === 401) {
+        console.error(
+          "Rotator status is protected and the local admin token was rejected.",
+        );
+        process.exitCode = 1;
+        break;
+      }
+      if (!res.ok) {
+        console.error(`Rotator status returned HTTP ${res.status}`);
+        process.exitCode = 1;
+        break;
+      }
       const data = await res.json();
       console.log(JSON.stringify(data, null, 2));
     } catch {
       console.error("Rotator is not running or unreachable on port 51200");
-      process.exit(1);
+      process.exitCode = 1;
+    } finally {
+      await closeDb();
     }
     break;
   }

package/src/compat/translators.ts

@@ -145,6 +145,7 @@ export interface CompatCompletion {
   thinkingText?: string; // Gemini thought blocks (thought: true), emitted as reasoning_content
   inputTokens: number;
   outputTokens: number;
+  firstByteMs?: number;
   responseId?: string;
   toolCalls?: OpenAIToolCall[];
 }
@@ -785,6 +786,8 @@ export function openAIToAntigravityBody(
   const isGeminiThinking = !isClaude && isThinking;
 
   const contents: GeminiContent[] = [];
+  // Claude requires every tool_result to immediately follow its tool_use turn.
+  let pendingClaudeToolCallIds = new Set<string>();
   for (let i = 0; i < conversationMessages.length; i++) {
     const msg = conversationMessages[i];
     if (msg.role === "assistant" || msg.role === "model") {
@@ -882,24 +885,39 @@ export function openAIToAntigravityBody(
         parts.push({ text: "..." });
       }
       if (parts.length > 0) {
+        const functionCallIds = new Set<string>();
+        for (const part of parts) {
+          if (!isRecord(part)) continue;
+          const functionCall = part.functionCall;
+          if (
+            isRecord(functionCall) &&
+            typeof functionCall.id === "string" &&
+            functionCall.id
+          ) {
+            functionCallIds.add(functionCall.id);
+          }
+        }
+        const hasFunctionCall = parts.some((p: any) => p.functionCall);
         if (isClaude) {
           const lastContent = contents[contents.length - 1];
           const prevHasFunctionCall =
             lastContent &&
             lastContent.role === "model" &&
             lastContent.parts.some((p: any) => p.functionCall);
-          const hasFunctionCall = parts.some((p: any) => p.functionCall);
           if (prevHasFunctionCall && !hasFunctionCall) {
             // Skip
           } else if (hasFunctionCall) {
             const fcOnly = parts.filter((p: any) => p.functionCall);
             if (prevHasFunctionCall) {
               lastContent.parts.push(...fcOnly);
+              for (const id of functionCallIds) pendingClaudeToolCallIds.add(id);
             } else {
               contents.push({ role: "model", parts: fcOnly });
+              pendingClaudeToolCallIds = new Set(functionCallIds);
             }
           } else {
             contents.push({ role: "model", parts });
+            pendingClaudeToolCallIds.clear();
           }
         } else {
           contents.push({ role: "model", parts });
@@ -912,6 +930,12 @@ export function openAIToAntigravityBody(
           : extractText(msg.content);
       const fnName = msg.name || "unknown";
       const toolCallId = msg.tool_call_id;
+      if (
+        isClaude &&
+        (!toolCallId || !pendingClaudeToolCallIds.has(toolCallId))
+      ) {
+        continue;
+      }
       let responseData: unknown;
       try {
         const parsed = JSON.parse(responseText);
@@ -980,9 +1004,35 @@ export function openAIToAntigravityBody(
       } else {
         contents.push({ role: "user", parts: [fnResponsePart, ...toolImages] });
       }
+      if (isClaude && toolCallId) pendingClaudeToolCallIds.delete(toolCallId);
     } else {
       const msgParts = extractParts(msg.content);
-      if (msgParts.length > 0) contents.push({ role: "user", parts: msgParts });
+      if (msgParts.length > 0) {
+        if (isClaude) pendingClaudeToolCallIds.clear();
+        contents.push({ role: "user", parts: msgParts });
+      }
+    }
+  }
+
+  if (isClaude) {
+    while (contents.at(-1)?.role === "model") {
+      const lastContent = contents.at(-1);
+      const hasFunctionCall =
+        lastContent?.parts.some((p: any) => isRecord(p) && p.functionCall) ??
+        false;
+      if (hasFunctionCall) {
+        contents.pop();
+        continue;
+      }
+      contents.push({
+        role: "user",
+        parts: [
+          {
+            text: "Continue from the previous assistant message. Do not repeat completed tool calls unless new user input asks for them.",
+          },
+        ],
+      });
+      break;
     }
   }
 
@@ -1174,12 +1224,6 @@ export function convertAnthropicMessagesToOpenAI(
         const otherBlocks = blocks.filter(
           (b) => !isRecord(b) || b.type !== "tool_result",
         );
-        if (otherBlocks.length > 0) {
-          result.push({
-            role: "user",
-            content: otherBlocks as ChatMessage["content"],
-          });
-        }
         for (const tr of toolResults) {
           const content =
             typeof tr.content === "string"
@@ -1193,6 +1237,12 @@ export function convertAnthropicMessagesToOpenAI(
             tool_call_id: tr.tool_use_id as string,
           });
         }
+        if (otherBlocks.length > 0) {
+          result.push({
+            role: "user",
+            content: otherBlocks as ChatMessage["content"],
+          });
+        }
         continue;
       }
     }

package/src/compat.ts

@@ -3,7 +3,13 @@ import { Readable } from "node:stream";
 import { PayloadTooLargeError, readLimitedBody } from "./body-limit.js";
 import { logger, redactSensitive } from "./logger.js";
 import type { AccountRotator } from "./rotator.js";
-import { withRotation, flattenHeaders, type RequestBody } from "./proxy.js";
+import {
+  withRotation,
+  flattenHeaders,
+  type RequestBody,
+  type RotationAttemptContext,
+  type RotationOutcome,
+} from "./proxy.js";
 import {
   isRecord,
   sanitizeGeminiSchema,
@@ -258,7 +264,42 @@ function summarizeCompatRequest(body: RequestBody): string {
   return `model=${body.model} userAgent=${body.userAgent || "none"} turns=${contents.length} tools=${tools} systemInstruction=${systemInstruction}`;
 }
 
+function recordCompatOutcome(
+  rotator: AccountRotator,
+  body: RequestBody,
+  context: RotationAttemptContext,
+  statusCode: number,
+  completion?: CompatCompletion,
+  totalMs = Date.now() - context.requestStartMs,
+): void {
+  const ttfbMs = completion?.firstByteMs ?? totalMs;
+  rotator.recordLatency(body.displayModel || body.model, ttfbMs, totalMs);
+  rotator.recordRequestLog({
+    model: context.displayModelKey,
+    account: context.label,
+    statusCode,
+    ttfbMs,
+    totalMs,
+    inputTokens: completion?.inputTokens ?? 0,
+    outputTokens: completion?.outputTokens ?? 0,
+  });
+}
 
+function recordCompatFailure(
+  rotator: AccountRotator,
+  body: RequestBody,
+  outcome: RotationOutcome<unknown>,
+): void {
+  if (outcome.ok || !outcome.context) return;
+  recordCompatOutcome(
+    rotator,
+    body,
+    outcome.context,
+    outcome.status,
+    undefined,
+    outcome.totalMs,
+  );
+}
 
 async function readJsonBody(req: IncomingMessage): Promise<unknown> {
   try {
@@ -283,6 +324,8 @@ async function streamCompatSse(
   let text = "";
   let inputTokens = 0;
   let outputTokens = 0;
+  const streamStartMs = Date.now();
+  let firstByteMs: number | undefined;
   let responseId: string | undefined;
   let toolCallIndex = 0;
 
@@ -317,16 +360,23 @@ async function streamCompatSse(
 
   let tailBuffer = "";
   let reqClosed = false;
-  req.once("close", () => {
+  const closeUpstreamForClient = (): void => {
     reqClosed = true;
-  });
+    if (!nodeStream.destroyed) nodeStream.destroy();
+  };
+  const responseEvents = res as {
+    once?: (event: "close", listener: () => void) => unknown;
+    off?: (event: "close", listener: () => void) => unknown;
+  };
+  req.once("close", closeUpstreamForClient);
+  responseEvents.once?.("close", closeUpstreamForClient);
 
   try {
     for await (const chunk of nodeStream) {
       if (reqClosed) {
-        nodeStream.destroy();
         break;
       }
+      if (firstByteMs === undefined) firstByteMs = Date.now() - streamStartMs;
       const str = chunk.toString();
       tailBuffer += str;
       let newlineIdx;
@@ -496,9 +546,14 @@ async function streamCompatSse(
       }
     }
   } catch (err) {
-    compatLogger.warn(
-      `Stream read error: ${redactSensitive(String(err)).slice(0, 200)}`,
-    );
+    if (!reqClosed) {
+      compatLogger.warn(
+        `Stream read error: ${redactSensitive(String(err)).slice(0, 200)}`,
+      );
+    }
+  } finally {
+    req.off("close", closeUpstreamForClient);
+    responseEvents.off?.("close", closeUpstreamForClient);
   }
 
   if (!reqClosed && !res.writableEnded) {
@@ -542,6 +597,7 @@ async function streamCompatSse(
     text,
     inputTokens,
     outputTokens,
+    firstByteMs,
     responseId,
     toolCalls: collectedToolCalls,
   };
@@ -563,6 +619,8 @@ async function streamResponsesSse(
   let thinkingText = "";
   let inputTokens = 0;
   let outputTokens = 0;
+  const streamStartMs = Date.now();
+  let firstByteMs: number | undefined;
   const toolCalls: OpenAIToolCall[] = [];
   let toolCallIndex = 0;
   let nextOutputIndex = 0;
@@ -572,9 +630,16 @@ async function streamResponsesSse(
   let reasoningItemId = "";
   let reasoningDone = false;
   let reqClosed = false;
-  req.once("close", () => {
+  const closeUpstreamForClient = (): void => {
     reqClosed = true;
-  });
+    if (!nodeStream.destroyed) nodeStream.destroy();
+  };
+  const responseEvents = res as {
+    once?: (event: "close", listener: () => void) => unknown;
+    off?: (event: "close", listener: () => void) => unknown;
+  };
+  req.once("close", closeUpstreamForClient);
+  responseEvents.once?.("close", closeUpstreamForClient);
 
   res.writeHead(200, {
     "Content-Type": "text/event-stream",
@@ -616,9 +681,9 @@ async function streamResponsesSse(
   try {
     for await (const chunk of nodeStream) {
       if (reqClosed) {
-        nodeStream.destroy();
         break;
       }
+      if (firstByteMs === undefined) firstByteMs = Date.now() - streamStartMs;
       tailBuffer += chunk.toString();
       let newlineIdx;
       while ((newlineIdx = tailBuffer.indexOf("\n")) >= 0) {
@@ -810,9 +875,14 @@ async function streamResponsesSse(
       }
     }
   } catch (err) {
-    compatLogger.warn(
-      `Responses stream read error: ${redactSensitive(String(err)).slice(0, 200)}`,
-    );
+    if (!reqClosed) {
+      compatLogger.warn(
+        `Responses stream read error: ${redactSensitive(String(err)).slice(0, 200)}`,
+      );
+    }
+  } finally {
+    req.off("close", closeUpstreamForClient);
+    responseEvents.off?.("close", closeUpstreamForClient);
   }
 
   const completion: CompatCompletion = {
@@ -820,6 +890,7 @@ async function streamResponsesSse(
     thinkingText: thinkingText || undefined,
     inputTokens,
     outputTokens,
+    firstByteMs,
     toolCalls: toolCalls.length > 0 ? toolCalls : undefined,
   };
   if (!reqClosed && !res.writableEnded) {
@@ -899,7 +970,7 @@ async function completeResponsesViaRotator(
     body.model,
     flattenHeaders(req.headers),
     body,
-    async (response) => {
+    async (response, context) => {
       const completion = await streamResponsesSse(
         response.body,
         req,
@@ -916,10 +987,12 @@ async function completeResponsesViaRotator(
           completion.outputTokens,
         );
       }
+      recordCompatOutcome(rotator, body, context, response.status, completion);
       return completion;
     },
   );
   if (!outcome.ok) {
+    recordCompatFailure(rotator, body, outcome);
     return {
       completion: { text: "", inputTokens: 0, outputTokens: 0 },
       status: outcome.status,
@@ -949,7 +1022,7 @@ async function completeViaRotator(
     body.model,
     flattenHeaders(req.headers),
     body,
-    async (response) => {
+    async (response, context) => {
       if (streamMode === "none") {
         const raw = await response.text();
         const completion = parseAntigravitySse(raw);
@@ -960,6 +1033,13 @@ async function completeViaRotator(
             completion.outputTokens,
           );
         }
+        recordCompatOutcome(
+          rotator,
+          body,
+          context,
+          response.status,
+          completion,
+        );
         return completion;
       } else {
         const completion = await streamCompatSse(
@@ -976,11 +1056,19 @@ async function completeViaRotator(
             completion.outputTokens,
           );
         }
+        recordCompatOutcome(
+          rotator,
+          body,
+          context,
+          response.status,
+          completion,
+        );
         return completion;
       }
     },
   );
   if (!outcome.ok) {
+    recordCompatFailure(rotator, body, outcome);
     if (outcome.status === 404) {
       compatLogger.warn(
         `Compat upstream 404 endpoint=${outcome.endpoint || "unknown"} ${summarizeCompatRequest(body)} error=${(outcome.errorText || "").slice(0, 300)}`,

package/src/exposure.ts

@@ -0,0 +1,17 @@
+import type { Config } from "./types.js";
+
+type ExposureConfig = Pick<Config, "bindHost" | "proxyPort">;
+
+export function isLoopbackBindHost(bindHost?: string | null): boolean {
+  const host = (bindHost || "0.0.0.0").trim().toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+
+export function getProxyExposureWarning(config: ExposureConfig): string | null {
+  const bindHost = config.bindHost || "0.0.0.0";
+  if (isLoopbackBindHost(bindHost)) return null;
+  return (
+    `Native and /v1 compatibility proxy routes are unauthenticated by design and are listening on ${bindHost}:${config.proxyPort}. ` +
+    "Restrict this port to localhost/LAN, a firewall, or a trusted reverse proxy, or set bindHost to 127.0.0.1 for local-only use."
+  );
+}

package/src/index.ts

@@ -24,6 +24,7 @@ import { setModelAliasesOverride } from "./types.js";
 import { writeTextFileAtomic } from "./storage.js";
 import { initDb } from "./db-store.js";
 import { stopPendingSessionReaper } from "./onboarding.js";
+import { getProxyExposureWarning } from "./exposure.js";
 
 function loadConfig(): Config {
   try {
@@ -146,6 +147,16 @@ function maybeWarnAboutAdminExposure(config: Config): void {
   console.warn();
 }
 
+function maybeWarnAboutProxyExposure(config: Config): void {
+  const warning = getProxyExposureWarning(config);
+  if (!warning) return;
+  console.warn(`WARNING: ${warning}`);
+  console.warn(
+    "WARNING: PI_ROTATOR_ADMIN_TOKEN protects dashboard/admin APIs, but not the native or /v1 proxy routes.",
+  );
+  console.warn();
+}
+
 export async function main(): Promise<void> {
   console.log("=== Pi Antigravity Rotator ===");
   console.log();
@@ -181,6 +192,7 @@ export async function main(): Promise<void> {
   maybeShowStarNudge();
   bootstrapAdminToken();
   maybeWarnAboutAdminExposure(config);
+  maybeWarnAboutProxyExposure(config);
   warnIfUsingFallbackOAuthCreds();
   warnIfInsecureTelemetryEndpoint();
   setModelSpecsOverride(config.modelSpecs ?? null);