zevairouter 1.0.73 → 1.0.75

package/open-sse/services/projectId.js

@@ -1,10 +1,14 @@
 /**
  * Project ID Service - Fetch and cache real Project IDs from Google Cloud Code API
  *
- *
  * Instead of generating random project IDs (e.g. "useful-spark-a1b2c"),
  * this service fetches the real Project ID bound to the authenticated user's account.
  * This significantly reduces the risk of being flagged by Google's anti-abuse systems.
+ *
+ * Account types:
+ * - free-tier (personal Gmail): loadCodeAssist / onboardUser returns a managed project id
+ * - standard-tier + userDefinedCloudaicompanionProject (GSuite/DASHER): caller must supply
+ *   a real GCP project the user can access (Code Assist license + IAM)
  */
 
 import { CLOUD_CODE_API, LOAD_CODE_ASSIST_HEADERS, LOAD_CODE_ASSIST_METADATA } from "../config/appConstants.js";
@@ -75,36 +79,72 @@ startCacheCleanup();
 
 // ─── Public API ───────────────────────────────────────────────────────────────
 
+/**
+ * Normalize a project id that may be a string or { id }.
+ * @param {unknown} value
+ * @returns {string|null}
+ */
+export function normalizeProjectId(value) {
+    if (typeof value === "string") {
+        const id = value.trim();
+        return id || null;
+    }
+    if (value && typeof value === "object" && typeof value.id === "string") {
+        const id = value.id.trim();
+        return id || null;
+    }
+    return null;
+}
+
+/**
+ * Detect whether a project id looks like a synthetic/random id we used to generate
+ * (e.g. "useful-spark-a1b2c"). Real GCP ids and Google-managed free-tier ids are kept.
+ * @param {string|null|undefined} projectId
+ * @returns {boolean}
+ */
+export function isSyntheticProjectId(projectId) {
+    if (!projectId || typeof projectId !== "string") return false;
+    // Historical generator: adj-noun-5hex
+    return /^(useful|bright|swift|calm|bold)-(fuze|wave|spark|flow|core)-[0-9a-f]{5}$/i.test(projectId.trim());
+}
+
 /**
  * Get the Project ID for a connection, with caching.
- * Returns null on failure (callers should fall back to random generation).
+ * Returns null on failure (callers must NOT invent a random project id).
  *
  * @param {string} connectionId - The connection identifier for cache keying
  * @param {string} accessToken  - Valid OAuth access token
+ * @param {{ preferredProjectId?: string|null }} [options]
  * @returns {Promise<string|null>} Real project ID or null
  */
-export async function getProjectIdForConnection(connectionId, accessToken) {
+export async function getProjectIdForConnection(connectionId, accessToken, options = {}) {
     if (!connectionId || !accessToken) return null;
 
-    // Return cached value if still fresh
+    const preferred = normalizeProjectId(options.preferredProjectId);
+
+    // Return cached value if still fresh (unless preferred is set and differs)
     const cached = projectIdCache.get(connectionId);
     if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
-        return cached.projectId;
+        if (!preferred || preferred === cached.projectId) {
+            return cached.projectId;
+        }
     }
 
-    // Deduplicate concurrent fetches for the same connection
-    if (pendingFetches.has(connectionId)) {
-        return pendingFetches.get(connectionId).promise;
+    // Deduplicate concurrent fetches for the same connection+preferred
+    const pendingKey = preferred ? `${connectionId}::${preferred}` : connectionId;
+    if (pendingFetches.has(pendingKey)) {
+        return pendingFetches.get(pendingKey).promise;
     }
 
-    // Each fetch gets its own AbortController so it can be canceled via removeConnection()
     const controller = new AbortController();
 
     const promise = (async () => {
         try {
-            const projectId = await fetchProjectId(accessToken, controller.signal);
+            const projectId = await fetchProjectId(accessToken, controller.signal, {
+                preferredProjectId: preferred,
+            });
             if (projectId) {
-                projectIdCache.set(connectionId, {projectId, fetchedAt: Date.now()});
+                projectIdCache.set(connectionId, { projectId, fetchedAt: Date.now() });
                 return projectId;
             }
             console.warn("[ProjectId] could not fetch projectId for connection", connectionId.slice(0, 8));
@@ -113,14 +153,38 @@ export async function getProjectIdForConnection(connectionId, accessToken) {
             console.warn(`[ProjectId] Error fetching project ID: ${error.message}`);
             return null;
         } finally {
-            pendingFetches.delete(connectionId);
+            pendingFetches.delete(pendingKey);
         }
     })();
 
-    pendingFetches.set(connectionId, {promise, controller, startedAt: Date.now()});
+    pendingFetches.set(pendingKey, { promise, controller, startedAt: Date.now() });
     return promise;
 }
 
+/**
+ * Resolve project id for an access token without connection caching.
+ * Used by OAuth postExchange / bulk import.
+ *
+ * @param {string} accessToken
+ * @param {{ preferredProjectId?: string|null }} [options]
+ * @returns {Promise<{ projectId: string|null, tierId: string|null, requiresUserProject: boolean, loadRaw?: object, error?: string }>}
+ */
+export async function resolveCloudCodeProject(accessToken, options = {}) {
+    if (!accessToken) {
+        return { projectId: null, tierId: null, requiresUserProject: false, error: "missing access token" };
+    }
+    try {
+        return await resolveProjectFromApi(accessToken, undefined, options);
+    } catch (error) {
+        return {
+            projectId: null,
+            tierId: null,
+            requiresUserProject: false,
+            error: error?.message || String(error),
+        };
+    }
+}
+
 /**
  * Invalidate the cached project ID for a connection.
  * Call this when a connection's credentials are fully revoked or refreshed.
@@ -131,36 +195,46 @@ export function invalidateProjectId(connectionId) {
 
 /**
  * Fully remove a connection: abort any in-flight fetch and delete its cached project ID.
- * Wire this into your connection close / disconnect lifecycle events to prevent memory leaks.
  *
  * @param {string} connectionId
  */
 export function removeConnection(connectionId) {
     if (!connectionId) return;
     projectIdCache.delete(connectionId);
-    const pending = pendingFetches.get(connectionId);
-    if (pending) {
-        try { pending.controller.abort(); } catch (_) { /* ignore */ }
-        pendingFetches.delete(connectionId);
+    for (const [key, pending] of pendingFetches) {
+        if (key === connectionId || key.startsWith(`${connectionId}::`)) {
+            try { pending.controller.abort(); } catch (_) { /* ignore */ }
+            pendingFetches.delete(key);
+        }
     }
 }
 
 // ─── Internal helpers ─────────────────────────────────────────────────────────
 
 /**
- * Fetch project ID via loadCodeAssist endpoint.
- * Falls back to onboardUser when loadCodeAssist returns no project.
- *
- * @param {string}      accessToken
- * @param {AbortSignal} signal
+ * @param {string} accessToken
+ * @param {AbortSignal} [signal]
+ * @param {{ preferredProjectId?: string|null }} [options]
  * @returns {Promise<string|null>}
  */
-async function fetchProjectId(accessToken, signal) {
+async function fetchProjectId(accessToken, signal, options = {}) {
+    const result = await resolveProjectFromApi(accessToken, signal, options);
+    return result.projectId;
+}
+
+/**
+ * @param {string} accessToken
+ * @param {AbortSignal} [signal]
+ * @param {{ preferredProjectId?: string|null }} [options]
+ */
+async function resolveProjectFromApi(accessToken, signal, options = {}) {
+    const preferred = normalizeProjectId(options.preferredProjectId);
+
     const response = await fetch(CLOUD_CODE_API.loadCodeAssist, {
         method: "POST",
         headers: { ...LOAD_CODE_ASSIST_HEADERS, "Authorization": `Bearer ${accessToken}` },
         body: JSON.stringify({ metadata: LOAD_CODE_ASSIST_METADATA }),
-        signal
+        signal,
     });
 
     if (!response.ok) {
@@ -169,44 +243,84 @@ async function fetchProjectId(accessToken, signal) {
     }
 
     const data = await response.json();
-    const projectId = extractProjectId(data);
-    if (projectId) return projectId;
+    const existing = extractProjectId(data);
+    if (existing) {
+        return {
+            projectId: existing,
+            tierId: pickTierId(data) || null,
+            requiresUserProject: false,
+            loadRaw: data,
+        };
+    }
 
-    // Determine the tier to use for onboarding
-    let tierID = "legacy-tier";
-    if (Array.isArray(data.allowedTiers)) {
-        for (const tier of data.allowedTiers) {
-            if (tier && typeof tier === "object" && tier.isDefault === true) {
-                if (tier.id && typeof tier.id === "string" && tier.id.trim()) {
-                    tierID = tier.id.trim();
-                    break;
-                }
-            }
+    const tierInfo = pickTierInfo(data);
+    const tierId = tierInfo.tierId || "free-tier";
+    const requiresUserProject = !!tierInfo.userDefined;
+
+    // Workspace / DASHER: free-tier blocked at loadCodeAssist. Chat still works with an
+    // existing managed Cloud Code project string (from free-tier peers / stored id) —
+    // no GCP console setup required. Only onboard when caller supplies a preferred id.
+    if (requiresUserProject) {
+        if (!preferred) {
+            console.warn(
+                "[ProjectId] GSuite/DASHER has no free-tier project from loadCodeAssist; " +
+                "caller should reuse a stored/peer managed project id."
+            );
+            return {
+                projectId: null,
+                tierId,
+                requiresUserProject: true,
+                loadRaw: data,
+                error: "no managed project on account; use stored or peer projectId",
+            };
         }
+        const onboarded = await onboardUser(accessToken, tierId, signal, preferred);
+        return {
+            projectId: onboarded || preferred,
+            tierId,
+            requiresUserProject: true,
+            loadRaw: data,
+            error: undefined,
+        };
     }
 
-    return onboardUser(accessToken, tierID, signal);
+    // free-tier / auto project: onboard without a project string
+    const onboarded = await onboardUser(accessToken, tierId, signal, null);
+    return {
+        projectId: onboarded,
+        tierId,
+        requiresUserProject: false,
+        loadRaw: data,
+        error: onboarded ? undefined : "onboardUser did not return a project id",
+    };
 }
 
 /**
  * Fetch project ID via onboardUser endpoint (polls until done).
  *
- * @param {string}      accessToken
- * @param {string}      tierID
- * @param {AbortSignal} externalSignal  – propagated from the connection's AbortController
+ * @param {string} accessToken
+ * @param {string} tierID
+ * @param {AbortSignal} [externalSignal]
+ * @param {string|null} [cloudaicompanionProject] - string project id for standard-tier
  * @returns {Promise<string|null>}
  */
-async function onboardUser(accessToken, tierID, externalSignal) {
-    console.log(`[ProjectId] Onboarding user with tier: ${tierID}`);
+async function onboardUser(accessToken, tierID, externalSignal, cloudaicompanionProject = null) {
+    console.log(
+        `[ProjectId] Onboarding user with tier: ${tierID}` +
+        (cloudaicompanionProject ? ` project=${cloudaicompanionProject}` : "")
+    );
 
     const reqBody = { tierId: tierID, metadata: LOAD_CODE_ASSIST_METADATA };
+    // API expects a scalar string for cloudaicompanionProject (not {id: ...}).
+    if (cloudaicompanionProject) {
+        reqBody.cloudaicompanionProject = cloudaicompanionProject;
+    }
+
     const MAX_ATTEMPTS = 5;
 
     for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-        // Bail out immediately if the connection was removed
         if (externalSignal?.aborted) return null;
 
-        // Per-attempt timeout controller; forwards external abort as well
         const localCtrl = new AbortController();
         const timeoutId = setTimeout(() => localCtrl.abort(), 30_000);
         const forwardAbort = () => localCtrl.abort();
@@ -217,7 +331,7 @@ async function onboardUser(accessToken, tierID, externalSignal) {
                 method: "POST",
                 headers: { ...LOAD_CODE_ASSIST_HEADERS, "Authorization": `Bearer ${accessToken}` },
                 body: JSON.stringify(reqBody),
-                signal: localCtrl.signal
+                signal: localCtrl.signal,
             });
 
             clearTimeout(timeoutId);
@@ -235,10 +349,14 @@ async function onboardUser(accessToken, tierID, externalSignal) {
                     console.log(`[ProjectId] Successfully onboarded, project ID: ${projectId}`);
                     return projectId;
                 }
+                // Some standard-tier responses echo empty object; fall back to requested project.
+                if (cloudaicompanionProject) {
+                    console.log(`[ProjectId] onboard done without id; using preferred project ${cloudaicompanionProject}`);
+                    return cloudaicompanionProject;
+                }
                 throw new Error("onboardUser done but no project_id in response");
             }
 
-            // Server not done yet – wait and retry
             console.log(`[ProjectId] Onboard attempt ${attempt}/${MAX_ATTEMPTS}: not done yet, waiting...`);
             await new Promise(resolve => setTimeout(resolve, 2000));
 
@@ -246,14 +364,13 @@ async function onboardUser(accessToken, tierID, externalSignal) {
             clearTimeout(timeoutId);
             if (error.name === "AbortError") {
                 console.warn(`[ProjectId] onboardUser attempt ${attempt} aborted (timeout or connection removed)`);
-                if (externalSignal?.aborted) return null;   // connection gone – stop retrying
+                if (externalSignal?.aborted) return null;
                 continue;
             }
             if (attempt === MAX_ATTEMPTS) {
                 console.warn(`[ProjectId] onboardUser failed after ${MAX_ATTEMPTS} attempts: ${error.message}`);
                 return null;
             }
-            // Continue to next attempt instead of throwing (which would skip remaining retries)
             console.warn(`[ProjectId] onboardUser attempt ${attempt} failed: ${error.message}, retrying...`);
             await new Promise(resolve => setTimeout(resolve, 2000));
         } finally {
@@ -265,6 +382,46 @@ async function onboardUser(accessToken, tierID, externalSignal) {
     return null;
 }
 
+function pickTierInfo(data) {
+    let tierId = null;
+    let userDefined = false;
+
+    if (data?.currentTier?.id && typeof data.currentTier.id === "string") {
+        tierId = data.currentTier.id.trim();
+        userDefined = !!data.currentTier.userDefinedCloudaicompanionProject;
+    }
+
+    if (Array.isArray(data?.allowedTiers)) {
+        for (const tier of data.allowedTiers) {
+            if (tier && typeof tier === "object" && tier.isDefault === true && tier.id) {
+                tierId = String(tier.id).trim();
+                userDefined = !!tier.userDefinedCloudaicompanionProject;
+                break;
+            }
+        }
+        // If no default, prefer free-tier when present (personal accounts).
+        if (!tierId) {
+            const free = data.allowedTiers.find(t => t?.id === "free-tier");
+            if (free) {
+                tierId = "free-tier";
+                userDefined = !!free.userDefinedCloudaicompanionProject;
+            } else if (data.allowedTiers[0]?.id) {
+                tierId = String(data.allowedTiers[0].id).trim();
+                userDefined = !!data.allowedTiers[0].userDefinedCloudaicompanionProject;
+            }
+        }
+    }
+
+    // free-tier is never user-defined even if flag is missing
+    if (tierId === "free-tier") userDefined = false;
+
+    return { tierId, userDefined };
+}
+
+function pickTierId(data) {
+    return pickTierInfo(data).tierId;
+}
+
 /**
  * Extract project ID from loadCodeAssist response.
  */

package/open-sse/translator/request/openai-to-gemini.js

@@ -269,7 +269,10 @@ export function openaiToGeminiCLIRequest(model, body, stream) {
 
 // Wrap Gemini CLI format in Cloud Code wrapper
 function wrapInCloudCodeEnvelope(model, geminiCLI, credentials = null, isAntigravity = false) {
-  const projectId = credentials?.projectId || generateProjectId();
+  const projectId =
+    credentials?.projectId ||
+    credentials?.providerSpecificData?.projectId ||
+    generateProjectId();
 
   const envelope = {
     project: projectId,
@@ -318,7 +321,10 @@ function wrapInCloudCodeEnvelope(model, geminiCLI, credentials = null, isAntigra
 
 // Wrap Claude format in Cloud Code envelope for Antigravity
 function wrapInCloudCodeEnvelopeForClaude(model, claudeRequest, credentials = null) {
-  const projectId = credentials?.projectId || generateProjectId();
+  const projectId =
+    credentials?.projectId ||
+    credentials?.providerSpecificData?.projectId ||
+    generateProjectId();
 
   const envelope = {
     project: projectId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.73",
+  "version": "1.0.75",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/providers.js

@@ -6,6 +6,7 @@
 // Ensure outbound fetch respects HTTP(S)_PROXY/ALL_PROXY in Node runtime
 import "open-sse/index.js";
 import crypto from "crypto";
+import { resolveCloudCodeProject } from "open-sse/services/projectId.js";
 
 import { generatePKCE, generateState } from "./utils/pkce";
 import {
@@ -437,17 +438,6 @@ const PROVIDERS = {
       return await response.json();
     },
     postExchange: async (tokens) => {
-      // Numeric enums matching Antigravity binary ClientMetadata
-      const loadHeaders = {
-        "Authorization": `Bearer ${tokens.access_token}`,
-        "Content-Type": "application/json",
-        "User-Agent": ANTIGRAVITY_CONFIG.loadCodeAssistUserAgent,
-        "X-Goog-Api-Client": ANTIGRAVITY_CONFIG.loadCodeAssistApiClient,
-        "Client-Metadata": ANTIGRAVITY_CONFIG.loadCodeAssistClientMetadata,
-        "x-request-source": "local",
-      };
-      const metadata = getOAuthClientMetadata();
-
       // Fetch user info
       const userInfoRes = await fetch(`${ANTIGRAVITY_CONFIG.userInfoUrl}?alt=json`, {
         headers: {
@@ -457,52 +447,32 @@ const PROVIDERS = {
       });
       const userInfo = userInfoRes.ok ? await userInfoRes.json() : {};
 
-      // Load Code Assist to get project ID and tier
+      // Resolve managed Cloud Code project (loadCodeAssist + free-tier onboard).
+      // GSuite/DASHER often has none — bulk save applies peer/bootstrap projectId.
+      const preferredProjectId =
+        process.env.ANTIGRAVITY_GCP_PROJECT ||
+        process.env.ZEVAI_ANTIGRAVITY_GCP_PROJECT ||
+        "";
       let projectId = "";
-      let tierId = "legacy-tier";
       try {
-        const loadRes = await fetch(ANTIGRAVITY_CONFIG.loadCodeAssistEndpoint, {
-          method: "POST",
-          headers: loadHeaders,
-          body: JSON.stringify({ metadata }),
-        });
-        if (loadRes.ok) {
-          const data = await loadRes.json();
-          projectId = data.cloudaicompanionProject?.id || data.cloudaicompanionProject || "";
-          if (Array.isArray(data.allowedTiers)) {
-            for (const tier of data.allowedTiers) {
-              if (tier.isDefault && tier.id) {
-                tierId = tier.id.trim();
-                break;
-              }
-            }
-          }
+        // Cap wait so bulk automation never hangs on Cloud Code onboard retries.
+        const resolved = await Promise.race([
+          resolveCloudCodeProject(tokens.access_token, {
+            preferredProjectId: preferredProjectId || null,
+          }),
+          new Promise((resolve) =>
+            setTimeout(
+              () => resolve({ projectId: null, error: "project resolve timed out" }),
+              20_000,
+            ),
+          ),
+        ]);
+        projectId = resolved.projectId || preferredProjectId || "";
+        if (!projectId && resolved.error) {
+          console.warn("[Antigravity OAuth] project resolve:", resolved.error);
         }
       } catch (e) {
-        console.log("Failed to load code assist:", e);
-      }
-
-      // Fire-and-forget onboarding — does not block DB save
-      if (projectId) {
-        const doOnboard = async () => {
-          for (let i = 0; i < 10; i++) {
-            try {
-              const onboardRes = await fetch(ANTIGRAVITY_CONFIG.onboardUserEndpoint, {
-                method: "POST",
-                headers: loadHeaders,
-                body: JSON.stringify({ tierId, metadata }),
-              });
-              if (onboardRes.ok) {
-                const result = await onboardRes.json();
-                if (result.done === true) break;
-              }
-            } catch (e) {
-              break;
-            }
-            await new Promise(resolve => setTimeout(resolve, 5000));
-          }
-        };
-        doOnboard().catch(() => {});
+        console.warn("[Antigravity OAuth] project resolve failed:", e?.message || e);
       }
 
       return { userInfo, projectId };

package/src/lib/oauth/services/antigravityBulkImportManager.js

@@ -13,6 +13,7 @@ import {
   createGenericCallbackMonitor,
 } from "./kiroGoogleAutomation.js";
 import { generateAuthData, exchangeTokens } from "../providers.js";
+import { resolveCloudCodeProject } from "open-sse/services/projectId.js";
 
 const ANTIGRAVITY_PROVIDER_ID = "antigravity";
 const ANTIGRAVITY_LABEL = "Antigravity";
@@ -26,11 +27,57 @@ function getRedirectUri() {
   return `http://localhost:${port}/callback`;
 }
 
+/**
+ * Bootstrap managed Cloud Code project string.
+ * Gmail free-tier usually gets its own from loadCodeAssist/onboard.
+ * GSuite/DASHER does not — but chat accepts existing managed project strings
+ * (no GCP console, no prior Gmail connection required).
+ * Prefer env → peers → token resolve → sticky bootstrap id.
+ */
+const ANTIGRAVITY_BOOTSTRAP_PROJECT =
+  process.env.ANTIGRAVITY_GCP_PROJECT ||
+  process.env.ZEVAI_ANTIGRAVITY_GCP_PROJECT ||
+  // Known-working Cloud Code managed project style id (not a user GCP project).
+  // Used only when Google returns no free-tier project (typical GSuite/DASHER).
+  "woven-tributary-j9tls";
+
+async function resolveProjectIdForSave(tokens) {
+  let projectId = (tokens.projectId || "").trim();
+  if (projectId) return projectId;
+
+  // 1) Peer connections already on this machine
+  try {
+    const { getProviderConnections } = await import("../../../models/index.js");
+    const peers = await getProviderConnections({ provider: ANTIGRAVITY_PROVIDER_ID, isActive: true });
+    for (const peer of peers || []) {
+      const peerPid = (peer.projectId || peer.providerSpecificData?.projectId || "").trim();
+      if (peerPid) return peerPid;
+    }
+  } catch {
+    // ignore peer lookup failures
+  }
+
+  // 2) Token resolve (free-tier Gmail path if postExchange missed it)
+  if (tokens.accessToken) {
+    try {
+      const resolved = await resolveCloudCodeProject(tokens.accessToken);
+      if (resolved.projectId) return resolved.projectId;
+    } catch {
+      // ignore — never block bulk save on project resolve
+    }
+  }
+
+  // 3) Bootstrap — GSuite bulk on empty machine still gets a usable projectId
+  return ANTIGRAVITY_BOOTSTRAP_PROJECT;
+}
+
 async function defaultSaveAntigravityConnection({ tokens, email }) {
   const { createProviderConnection } = await import("../../../models/index.js");
+  // Top-level projectId is what chat/auth read; also mirror into providerSpecificData.
+  const projectId = await resolveProjectIdForSave(tokens);
   const providerSpecificData = {
     authMethod: "oauth",
-    projectId: tokens.projectId || "",
+    projectId,
     loginEmail: email,
     automation: "gsuite-bulk",
   };
@@ -42,6 +89,7 @@ async function defaultSaveAntigravityConnection({ tokens, email }) {
     refreshToken: tokens.refreshToken || "",
     email,
     displayName: tokens.displayName || email.split("@")[0],
+    projectId,
     providerSpecificData,
     expiresAt: tokens.expiresIn
       ? new Date(Date.now() + tokens.expiresIn * 1000).toISOString()

package/src/sse/handlers/chat.js

@@ -202,13 +202,48 @@ async function handleSingleModelChat(body, modelStr, clientRawRequest = null, re
 
     const refreshedCredentials = await checkAndRefreshToken(provider, credentials);
 
-    // Ensure real project ID is available for providers that need it (P0 fix: cold miss)
-    if ((provider === "antigravity" || provider === "gemini-cli") && !refreshedCredentials.projectId) {
-      const pid = await getProjectIdForConnection(credentials.connectionId, refreshedCredentials.accessToken);
-      if (pid) {
-        refreshedCredentials.projectId = pid;
-        // Persist to DB in background so subsequent requests have it immediately
-        updateProviderCredentials(credentials.connectionId, { projectId: pid }).catch(() => { });
+    // Ensure Cloud Code project ID is available (P0 fix: cold miss).
+    // Gmail free-tier: loadCodeAssist/onboard returns a managed project.
+    // GSuite/DASHER: free-tier blocked, but chat still works with an existing
+    // managed project string (peer free-tier project or previously stored id).
+    // Brand-new random project names usually 403 — avoid inventing when we can reuse.
+    if (provider === "antigravity" || provider === "gemini-cli") {
+      const preferredProjectId =
+        refreshedCredentials.projectId ||
+        credentials.projectId ||
+        credentials.providerSpecificData?.projectId ||
+        null;
+      if (preferredProjectId) {
+        refreshedCredentials.projectId = preferredProjectId;
+      }
+      if (!refreshedCredentials.projectId) {
+        let pid = await getProjectIdForConnection(
+          credentials.connectionId,
+          refreshedCredentials.accessToken,
+          { preferredProjectId },
+        );
+        // Peer fallback: reuse another antigravity connection's managed project id
+        // (same behavior users saw historically — no GCP console required for GSuite).
+        if (!pid && provider === "antigravity") {
+          try {
+            const { getProviderConnections } = await import("@/models/index.js");
+            const peers = await getProviderConnections({ provider: "antigravity", isActive: true });
+            for (const peer of peers || []) {
+              if (peer.id === credentials.connectionId) continue;
+              const peerPid = peer.projectId || peer.providerSpecificData?.projectId;
+              if (peerPid) {
+                pid = peerPid;
+                break;
+              }
+            }
+          } catch {
+            // ignore peer lookup failures
+          }
+        }
+        if (pid) {
+          refreshedCredentials.projectId = pid;
+          updateProviderCredentials(credentials.connectionId, { projectId: pid }).catch(() => { });
+        }
       }
     }
 

package/src/sse/services/auth.js

@@ -248,7 +248,7 @@ export async function getProviderCredentials(provider, excludeConnectionIds = nu
       expiresAt: connection.expiresAt,
       expiresIn: connection.expiresIn,
       lastRefreshAt: connection.lastRefreshAt,
-      projectId: connection.projectId,
+      projectId: connection.projectId || connection.providerSpecificData?.projectId || null,
       connectionName: connection.displayName || connection.name || connection.email || connection.id,
       copilotToken: connection.providerSpecificData?.copilotToken,
       providerSpecificData: {