feat: Antigravity safeguards (canonical destinations, strict affinity, snapshot pairing, TLS profile, and URI redaction)

[yansigit]

Summary

Hardens google-antigravity with existing OpenCodex mechanisms:

• Canonical OAuth destinations: Restricts Antigravity OAuth bearer destinations to canonical Google Cloud Code Assist hosts (daily-cloudcode-pa.googleapis.com and cloudcode-pa.googleapis.com). Noncanonical base URLs fail closed across config, management, and runtime boundaries.
• Snapshot-authoritative credentials: Derives bearer token, account identity, credential generation, and Cloud Code Assist project ID atomically from a single OAuthAccessSnapshot. Configured provider.project cannot split across accounts or override active snapshot projects.
• Strict account affinity: Binds conversations to one account for their lifetime without automatic cross-account rotation on 401, 429, quota exhaustion, or geoblocking.
• Cooldown classification & retry: Preserves HTTP 403 geoblock status during cooldowns, supports numeric Retry-After: 0 for immediate bounded same-account retry, and maintains strongest active cooldown.
• Proxy userinfo redaction: Redacts credentials and userinfo from all URI schemes (http, https, socks5, socks5h) in error messages and native transport errors.
• Request pacing jitter: Adds validated positive-only jitterMs (0..60,000 ms) at provider and model levels with Antigravity defaults (30 RPM, 2000 ms spacing, 500 ms jitter).
• Optional TLS profile: Provides in-process wreq-js TLS/HTTP2 emulation for canonical Antigravity data-plane hosts, while keeping OAuth token flows on Bun TLS.

Verification

• bun test tests/antigravity-routing.test.ts tests/antigravity-responses.test.ts tests/google-antigravity-wire.test.ts tests/provider-tls-profile.test.ts tests/redact.test.ts tests/request-pacing.test.ts tests/config.test.ts (308 passing)
• bun test tests/server-images.test.ts (66 passing)
• bun test tests/gemini-web-search.test.ts (16 passing)
• bun run typecheck (strict, zero errors)
• bun run privacy:scan (passed)
• bun run lint:gui (passed)
• bun run build:gui (passed)
• bun run audit:high (passed, zero high/critical vulnerabilities)
• Native wreq-js import, transport creation, and shutdown smoke test passed

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• New Features

  • Added configurable request pacing jitter, including provider-wide and model-specific settings up to 60 seconds.
  • Added an experimental Antigravity browser TLS profile with confirmation, status reporting, and automatic fallback.
  • Improved Antigravity OAuth account routing, session affinity, cooldown handling, and recovery.
  • Added safer provider destination validation and clearer redaction of sensitive error details.

• Documentation

  • Updated provider configuration and Antigravity guidance across supported languages.

• Bug Fixes

  • Improved handling of rate limits, authentication failures, quota errors, and unsafe destinations.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json, src/oauth/antigravity-routing.ts, src/oauth/google-antigravity.ts, src/oauth/index.ts, src/oauth/store.ts, src/server/auth-cors.ts, src/server/management/oauth-account-routes.ts.

[github-actions]

⏳ DRAFT

• UI screenshot required. hygiene: unsponsored_surface.

What to do

• Add a screenshot of the UI change to the PR description.
• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json, src/oauth/antigravity-routing.ts, src/oauth/google-antigravity.ts, src/oauth/index.ts, src/oauth/store.ts, src/server/auth-cors.ts, src/server/management/oauth-account-routes.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@yansigit Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b27cd40b-39df-4061-a8a4-2b044b9696c6

📥 Commits

Reviewing files that changed from the base of the PR and between 121c1fb and 03c5f7f.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (73)

• docs-site/src/content/docs/fr/reference/configuration/providers.md
• docs-site/src/content/docs/guides/providers.md
• docs-site/src/content/docs/ja/reference/configuration/providers.md
• docs-site/src/content/docs/ko/reference/configuration/providers.md
• docs-site/src/content/docs/reference/configuration/providers.md
• docs-site/src/content/docs/ru/reference/configuration/providers.md
• docs-site/src/content/docs/tr/reference/configuration/providers.md
• docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
• docs-site/src/content/docs/zh-tw/reference/configuration/providers.md
• gui/src/components/provider-workspace/ProviderSettings.tsx
• gui/src/components/provider-workspace/types.ts
• gui/src/i18n/de.ts
• gui/src/i18n/en.ts
• gui/src/i18n/fr.ts
• gui/src/i18n/ja.ts
• gui/src/i18n/ko.ts
• gui/src/i18n/ru.ts
• gui/src/i18n/tr.ts
• gui/src/i18n/zh-TW.ts
• gui/src/i18n/zh.ts
• gui/src/pages/providers-shared.ts
• gui/src/provider-workspace/catalog.ts
• gui/tests/provider-settings-antigravity-tls.test.tsx
• gui/tests/provider-settings-request-pacing.test.tsx
• package.json
• src/adapters/base.ts
• src/adapters/google-http.ts
• src/adapters/google.ts
• src/codex/catalog/provider-fetch.ts
• src/config.ts
• src/lib/provider-outbound.ts
• src/lib/provider-tls-profile.ts
• src/lib/proxy-env.ts
• src/lib/redact.ts
• src/oauth/antigravity-routing.ts
• src/oauth/google-antigravity.ts
• src/oauth/index.ts
• src/oauth/store.ts
• src/providers/derive.ts
• src/providers/quota.ts
• src/providers/registry.ts
• src/providers/request-pacing.ts
• src/server/auth-cors.ts
• src/server/images.ts
• src/server/management/oauth-account-routes.ts
• src/server/management/provider-routes.ts
• src/server/responses/core.ts
• src/server/responses/fetch-helpers.ts
• src/types.ts
• src/types/provider.ts
• src/web-search/gemini-executor.ts
• structure/04_transports-and-sidecars.md
• tests/antigravity-responses.test.ts
• tests/antigravity-routing.test.ts
• tests/antigravity-session-affinity.test.ts
• tests/chat-completions-endpoint.test.ts
• tests/config.test.ts
• tests/empty-completion-core.test.ts
• tests/gemini-web-search.test.ts
• tests/google-adapter.test.ts
• tests/google-antigravity-oauth.test.ts
• tests/google-models-listing.test.ts
• tests/google-vertex-http.test.ts
• tests/management-provider-validation.test.ts
• tests/oauth-store-multi.test.ts
• tests/provider-connection-test.test.ts
• tests/provider-outbound.test.ts
• tests/provider-quota.test.ts
• tests/provider-tls-profile.test.ts
• tests/redact.test.ts
• tests/request-pacing.test.ts
• tests/responses-fetch-helpers-boundary.test.ts
• tests/server-images.test.ts

---

📝 Walkthrough

Walkthrough

This PR adds Antigravity TLS profile support, request-pacing jitter, Antigravity account routing and retry handling, provider management updates, GUI controls, localized strings, and matching documentation and tests.

Changes

Antigravity TLS profile, pacing, and routing

Layer / File(s)	Summary
Config contracts and docs src/types/provider.ts, src/config.ts, src/providers/registry.ts, src/providers/derive.ts, gui/src/pages/providers-shared.ts, gui/src/provider-workspace/catalog.ts, docs-site/src/content/docs/.../providers.md, structure/04_transports-and-sidecars.md, package.json, tests/config.test.ts, tests/request-pacing.test.ts	Provider config adds requestPacing.jitterMs and tlsProfile: "antigravity-browser". The registry seeds default Antigravity pacing. Docs and shared types describe the new fields, limits, host restrictions, fallback behavior, and transport boundary.
Pacing jitter editing and scheduling gui/src/components/provider-workspace/ProviderSettings.tsx, src/providers/request-pacing.ts, gui/tests/provider-settings-*.test.tsx, tests/chat-completions-endpoint.test.ts, tests/empty-completion-core.test.ts, tests/request-pacing.test.ts	The provider settings UI can edit global and per-model jitter and detect jitter-only changes. The runtime samples bounded jitter, enforces jitter-only pacing, and uses deterministic random sources in tests.
TLS profile transport and fetch routing src/lib/provider-tls-profile.ts, src/lib/proxy-env.ts, src/lib/provider-outbound.ts, src/server/responses/fetch-helpers.ts, src/lib/redact.ts, src/web-search/gemini-executor.ts, tests/provider-tls-profile.test.ts, tests/provider-outbound.test.ts, tests/gemini-web-search.test.ts, tests/redact.test.ts, tests/responses-fetch-helpers-boundary.test.ts	A new TLS-profile transport uses wreq-js for canonical Antigravity Cloud Code Assist destinations. The fetch path adds proxy selection, NO_PROXY matching, public-address checks, cached status, fallback to Bun, and redacted native errors.
OAuth snapshots, routing, and provider errors src/oauth/antigravity-routing.ts, src/oauth/google-antigravity.ts, src/oauth/index.ts, src/oauth/store.ts, src/adapters/google-http.ts, src/adapters/google.ts, src/codex/catalog/provider-fetch.ts, tests/antigravity-routing.test.ts, tests/antigravity-session-affinity.test.ts, tests/google-adapter.test.ts, tests/google-antigravity-oauth.test.ts, tests/google-vertex-http.test.ts, tests/oauth-store-multi.test.ts	Antigravity now uses account-scoped access snapshots, session affinity, cooldown state, and typed terminal OAuth errors. The Google adapter observes normalized provider errors with redacted messages, and adapter-level 429 retries are disabled for Antigravity.
Management APIs and Antigravity integrations src/server/auth-cors.ts, src/server/management/provider-routes.ts, src/server/management/oauth-account-routes.ts, src/providers/quota.ts, src/server/images.ts, src/web-search/gemini-executor.ts, tests/management-provider-validation.test.ts, tests/provider-connection-test.test.ts, tests/provider-quota.test.ts, tests/google-models-listing.test.ts, tests/server-images.test.ts	Management APIs accept and report tlsProfile and tlsProfileStatus, validate canonical Antigravity OAuth destinations, redact connection-test errors, and clear cached TLS status on provider mutations. Quota, model discovery, image generation, and web search use snapshot project IDs and provider-aware fetch execution.
Responses recovery and retry flow src/server/responses/core.ts, tests/antigravity-responses.test.ts	The Responses pipeline detects Antigravity OAuth routes, selects an account per session, requires snapshot project IDs, records synthetic failures, applies geoblock cooldowns, and performs one abort-aware retry for short 429 responses.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant ProviderSettings
  participant ProviderRoutes
  participant ProviderTlsProfile
  User->>ProviderSettings: enable antigravity-browser
  ProviderSettings->>ProviderRoutes: PATCH tlsProfile
  ProviderRoutes->>ProviderTlsProfile: clear cached status
  ProviderRoutes-->>ProviderSettings: provider with tlsProfileStatus
  ProviderSettings-->>User: show disabled/active/fallback

Loading

sequenceDiagram
  participant Client
  participant Responses
  participant Routing as AntigravityRouting
  participant OAuth
  participant Google
  Client->>Responses: request
  Responses->>Routing: resolve session account
  Routing-->>Responses: account and cooldown state
  Responses->>OAuth: get token snapshot for account
  OAuth-->>Responses: access token and projectId
  Responses->>Google: send provider request
  Google-->>Responses: provider error or response
  Responses->>Routing: record cooldown/synthetic failure
  Responses-->>Client: final response or retry result

Loading

Possibly related PRs

• lidge-jun/opencodex#1178: This PR extends the same Antigravity model-discovery and OAuth snapshot paths in provider-fetch, OAuth handling, and management flows.
• lidge-jun/opencodex#1916: Both PRs update Antigravity behavior in src/server/responses/core.ts, src/adapters/google.ts, and src/oauth/antigravity-routing.ts.
• lidge-jun/opencodex#2070: Both PRs touch Google Antigravity adapter error handling and overlapping adapter tests.

Suggested reviewers: lidge-jun

✨ Finishing Touches 💡 2

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch codex/antigravity-safeguards

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[yansigit]

Closed: opened against upstream by mistake; PRs should target origin fork.