feat(transport): carry opt-in Antigravity TLS profile onto provider egress

docs-site/src/content/docs/reference/configuration/providers.md

@@ -212,6 +212,7 @@ Providers can expose a built-in shorthand, such as `agy` for `google-antigravity
 | `noProxy?` | `string \| string[]` | Destinations this provider reaches directly, using `NO_PROXY` host-pattern syntax. A match bypasses both this provider's own proxy and an inherited global proxy. |
 | `requestPacing?` | `{ enabled, requestsPerMinute?, minIntervalMs?, maxConcurrentRequests?, models? }` | Optional client-side outbound request-start pacing, separate from upstream usage, billing, and rate-limit indicators. RPM is converted to an even interval; `minIntervalMs` may impose a longer interval. `maxConcurrentRequests` is a positive integer cap on in-flight requests. A provider or model rule may use the concurrency cap alone; provider limits apply across all models, while `models` entries use exact upstream model IDs (for example `nvidia/llama-3.1-nemotron-ultra-253b-v1`) and can only add delay or narrow concurrency. Queue waits do not consume the upstream response-header timeout. HTTP and explicit adapter `fetchResponse`/`runTurn` dispatches are covered. A concurrency-capped canonical Responses WebSocket turn uses HTTP/SSE so its lease can be released when the response body completes, errors, or is cancelled. For `runTurn` adapters, including Cursor, the cap counts active turns rather than physical sends: RunSSE and BidiAppend may overlap within one turn, while another turn waits. Follow-up sends still obey start intervals. |
 | `upstreamHttpVersion?` | `"auto" \| "http1.1" \| "h1" \| "http2" \| "h2"` | Pin the HTTP version used for upstream requests to this provider. Defaults to `auto`, which lets Bun negotiate. An explicit pin requires an HTTPS target and fails locally when it cannot be honored. Set `http1.1` when a provider's HTTP/2 SSE stream stalls instead of delivering events — the symptom is a long-running streaming request that produces nothing and eventually times out. For Cursor, `http1.1`/`h1` selects its `RunSSE` + `BidiAppend` compatibility transport for inference and also pins live model discovery. Management `POST`/`PATCH` accept `null` to clear it back to `auto`. |
+| `tlsProfile?` | `"antigravity-browser"` | **Use at your own risk.** Opt-in browser-like TLS handshake (through the optional `wreq-js` dependency) for the canonical `google-antigravity` OAuth provider. It changes only how the connection looks on the wire; it is not an official Google client, and it does not change what Google's terms allow. Google can still detect, rate-limit, suspend, or ban the account you signed in with, and you alone carry that risk. It is off by default and accepted only with the Google adapter, Cloud Code Assist mode, and Google's canonical HTTPS Antigravity hosts. Redirects stay manual. The provider's own `proxy`/`noProxy` route is carried by the TLS transport; a route it cannot keep fails the request instead of leaving by another path, which includes any direct route while `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` is set. `GET /api/providers` reports the profile state as `pending`, `active`, or `failed`. Omitting the field keeps the normal Bun transport and never loads the dependency. |
 | `responsesPath?` | `string` | Relative resource path for key-auth `openai-responses` requests. It must start with `/` and contain no scheme, query, or fragment. |
 | `chatCompletionsPath?` | `string` | Relative resource path for `openai-chat` requests, the mirror of `responsesPath` and subject to the same shape rules. Needed when one upstream serves Chat Completions and Responses under different prefixes: a per-model wire override changes the adapter and leaves `baseUrl` alone, so without this an opted-in Chat request would be sent to the Responses base. Z.AI is the shipped example. |
 | `allowEncryptedV2AgentTasks?` | `boolean` | Disabled by default. Trust a direct key-auth `openai-responses` provider to consume or relay opaque encrypted V2 sub-agent tasks unchanged. Eligible routes skip `agentTaskRecovery`; all other routes keep the existing recovery or fail-closed behavior. OpenCodex does not decrypt, translate, or recover tasks sent through this opt-in. |

scripts/test-layout/layout.json

@@ -1331,6 +1331,8 @@
     "provider-model-discovery-contract.test.ts": "providers",
     "provider-outbound-private-network.test.ts": "providers",
     "provider-outbound.test.ts": "providers",
+    "provider-runtime-fetch.test.ts": "providers",
+    "provider-tls-profile.test.ts": "providers",
     "provider-payload.test.ts": "gui",
     "provider-quota-label-sanitize.test.ts": "providers",
     "provider-quota-observed-marker.test.ts": "providers",

src/config/schema/config-schema.ts

@@ -57,6 +57,7 @@ import { COMBO_NAMESPACE, comboConfigIssues } from "../../combos/types";
 import { routingProfileIssues } from "../../routing/profile";
 import { POLICY_NAMESPACE } from "../../routing/profile-namespace";
 import { providerDestinationConfigError } from "../../lib/destination-policy";
+import { providerTlsProfileConfigError } from "../../lib/provider-tls-profile";
 import { redactSecretString } from "../../lib/redact";
 import { openRouterRoutingConfigError } from "../../providers/openrouter-routing";
 import { vercelGatewayRoutingConfigError } from "../../providers/vercel-gateway-routing";
@@ -476,6 +477,14 @@ export const configSchema = z.object({
         });
       }
     }
+    const tlsProfileError = providerTlsProfileConfigError(name, provider);
+    if (tlsProfileError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", redactSecretString(name), "tlsProfile"],
+        message: tlsProfileError,
+      });
+    }
     const headersError = providerHeadersConfigError((provider as { headers?: unknown }).headers);
     if (headersError) {
       ctx.addIssue({

src/config/schema/leaf-validators.ts

@@ -294,6 +294,7 @@ export const providerConfigSchema = z.object({
   autoReviewModelOverrides: autoReviewModelOverridesSchema.optional(),
   adapter: z.string().min(1),
   baseUrl: z.string().min(1),
+  tlsProfile: z.literal("antigravity-browser").optional(),
   alias: z.string().optional(),
   modelAliases: z.record(z.string(), z.string()).optional(),
   modelDisplayNames: modelDisplayNamesSchema.optional(),

src/lib/provider-runtime-fetch.ts

@@ -0,0 +1,23 @@
+import type { OcxProviderConfig } from "../types";
+
+export const RUNTIME_PROVIDER_FETCH = Symbol("opencodex.provider.runtime-fetch");
+
+export interface RuntimeProviderFetch {
+  providerName: string;
+  origins: readonly string[];
+  fetch: typeof globalThis.fetch;
+}
+
+/** Return only an explicitly injected executor matching the provider and exact destination origin. */
+export function runtimeProviderFetch(
+  provider: OcxProviderConfig,
+  providerName: string | undefined,
+): typeof globalThis.fetch | undefined {
+  const runtime = (provider as OcxProviderConfig & { [RUNTIME_PROVIDER_FETCH]?: RuntimeProviderFetch })[RUNTIME_PROVIDER_FETCH];
+  if (!runtime || runtime.providerName !== providerName) return undefined;
+  try {
+    return runtime.origins.includes(new URL(provider.baseUrl).origin) ? runtime.fetch : undefined;
+  } catch {
+    return undefined;
+  }
+}

src/lib/provider-tls-profile.ts

@@ -0,0 +1,221 @@
+import type { OcxProviderConfig } from "../types";
+import { redactSecretString } from "./redact";
+import { runtimeProviderFetch } from "./provider-runtime-fetch";
+import { markEgressTransparentExecutor } from "./provider-egress";
+import {
+  outboundProxyConfigured,
+  proxyEnvPresent,
+  resolveProxyRoute,
+  socks5ProxyFromEnv,
+  type ProxyEnvMap,
+} from "./proxy-env";
+
+export type ProviderTlsProfile = "antigravity-browser";
+/**
+ * `pending` means the profile is configured and valid but no request has used it yet; the
+ * dashboard must not report a configured profile as `disabled` before its first send.
+ */
+export type ProviderTlsProfileStatus = "disabled" | "pending" | "active" | "failed";
+export const ANTIGRAVITY_TLS_HOSTS = new Set([
+  "daily-cloudcode-pa.googleapis.com",
+  "cloudcode-pa.googleapis.com",
+]);
+type TlsRuntime = {
+  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+  resolveProxyRoute?: typeof resolveProxyRoute;
+  env?: ProxyEnvMap;
+};
+let status = new Map<string, ProviderTlsProfileStatus>();
+let runtime: TlsRuntime | undefined;
+
+export function isCanonicalAntigravityUrl(input: string | URL): boolean {
+  try {
+    const url = new URL(input);
+    return (
+      url.protocol === "https:" &&
+      (url.port === "" || url.port === "443") &&
+      !url.username &&
+      !url.password &&
+      ANTIGRAVITY_TLS_HOSTS.has(url.hostname.toLowerCase())
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function providerTlsProfileConfigError(
+  providerName: string,
+  provider: Pick<
+    OcxProviderConfig,
+    "adapter" | "authMode" | "googleMode" | "baseUrl" | "tlsProfile"
+  >,
+): string | null {
+  if (provider.tlsProfile === undefined) return null;
+  if (provider.tlsProfile !== "antigravity-browser")
+    return "tlsProfile must be antigravity-browser";
+  if (
+    providerName !== "google-antigravity" ||
+    provider.adapter !== "google" ||
+    provider.authMode !== "oauth" ||
+    provider.googleMode !== "cloud-code-assist" ||
+    !isCanonicalAntigravityUrl(provider.baseUrl)
+  ) {
+    return "tlsProfile antigravity-browser requires the canonical Google Antigravity OAuth destination";
+  }
+  return null;
+}
+
+export function getProviderTlsProfileStatus(
+  name: string,
+  configured?: boolean,
+): ProviderTlsProfileStatus {
+  const recorded = status.get(name);
+  if (configured === undefined) return recorded ?? "disabled";
+  if (!configured) return "disabled";
+  return recorded === undefined || recorded === "disabled" ? "pending" : recorded;
+}
+
+/** The `/api/providers` fragment for a configured profile; empty when the provider has none. */
+export function providerTlsProfileDiagnostic(
+  name: string,
+  provider: Pick<OcxProviderConfig, "tlsProfile">,
+): { tlsProfile?: { profile: ProviderTlsProfile; status: ProviderTlsProfileStatus } } {
+  if (provider.tlsProfile === undefined) return {};
+  return { tlsProfile: { profile: provider.tlsProfile, status: getProviderTlsProfileStatus(name, true) } };
+}
+
+export function resetProviderTlsProfileForTests(): void {
+  status = new Map();
+  runtime = undefined;
+}
+
+export function setProviderTlsRuntimeForTest(
+  next: TlsRuntime | undefined,
+): void {
+  runtime = next;
+}
+
+function preserveTransportError(error: unknown): Error {
+  // A configured proxy URL can carry user:pass@, and the native transport may echo it. The
+  // shared redactor does not mask URL userinfo, so strip it here before the message travels.
+  const message = redactSecretString(
+    error instanceof Error ? error.message : "provider TLS transport failed",
+  ).replace(/\/\/[^/@\s]+@/g, "//<redacted>@");
+  const name = error instanceof Error ? error.name : "Error";
+  if (name === "AbortError" || name === "TimeoutError")
+    return new DOMException(message, name);
+  const wrapped = new Error(message);
+  wrapped.name = name;
+  return wrapped;
+}
+
+/** Proxy schemes the native TLS transport can carry for a route decided elsewhere. */
+const TLS_PROXY_PROTOCOLS = new Set(["http:", "https:", "socks5:", "socks5h:"]);
+
+function requireDirect(env: ProxyEnvMap): Record<string, never> {
+  // The native transport reads HTTP_PROXY/HTTPS_PROXY/ALL_PROXY itself whenever no proxy option
+  // is given, and it has no per-request "direct" switch. A direct route is therefore only
+  // honoured when no proxy variable exists at all; otherwise omitting the option would send the
+  // credential through the environment proxy the operator routed this request away from.
+  if (outboundProxyConfigured(env)) {
+    throw new Error("provider TLS profile cannot force a direct connection while a proxy environment variable is set");
+  }
+  return {};
+}
+
+/**
+ * The proxy option expressing this send's route on the native transport, or a refusal.
+ *
+ * `sendWithConnectionPolicy` resolves the per-provider egress (`providers.<name>.proxy` /
+ * `noProxy`) and passes it as `init.proxy`: a URL, `false` for direct, or absent when the
+ * provider inherits the global environment route.
+ */
+function tlsProxyOption(init: RequestInit | undefined, destination: string | URL): { proxy?: string } {
+  const env = runtime?.env ?? process.env;
+  const decided = init !== undefined && Object.hasOwn(init, "proxy")
+    ? (init as RequestInit & { proxy?: unknown }).proxy
+    : undefined;
+  if (typeof decided === "string") {
+    let protocol: string;
+    try {
+      protocol = new URL(decided).protocol;
+    } catch {
+      throw new Error("provider TLS profile cannot preserve configured proxy semantics");
+    }
+    if (!TLS_PROXY_PROTOCOLS.has(protocol)) {
+      throw new Error("provider TLS profile cannot preserve configured proxy semantics");
+    }
+    return { proxy: decided };
+  }
+  if (decided === false) return requireDirect(env);
+  const route = (runtime?.resolveProxyRoute ?? resolveProxyRoute)(new URL(destination), env);
+  if (route.kind === "fallback") {
+    // `resolveProxyRoute` only classifies HTTP(S) proxies; an inherited ALL_PROXY of socks5://
+    // or socks5h:// is the route the ordinary outbound path takes through socks5ProxyFromEnv().
+    // Carry that same route when no HTTPS-specific variable outranks it, instead of refusing
+    // every Antigravity send for an operator whose only global proxy is SOCKS.
+    const socks = proxyEnvPresent("HTTPS_PROXY", env) ? undefined : socks5ProxyFromEnv(env);
+    if (socks) return { proxy: socks.trim() };
+    throw new Error("provider TLS profile cannot preserve configured proxy semantics");
+  }
+  if (route.kind === "proxy") return { proxy: route.proxy };
+  return requireDirect(env);
+}
+
+export function providerTlsFetch(
+  name: string,
+  provider: Pick<
+    OcxProviderConfig,
+    "adapter" | "authMode" | "googleMode" | "baseUrl" | "tlsProfile"
+  >,
+  fallback: typeof globalThis.fetch,
+): typeof globalThis.fetch {
+  if (provider.tlsProfile === undefined) {
+    status.set(name, "disabled");
+    return fallback;
+  }
+  if (providerTlsProfileConfigError(name, provider)) {
+    status.set(name, "failed");
+    return (async () => {
+      throw new Error("invalid provider TLS profile");
+    }) as unknown as typeof globalThis.fetch;
+  }
+  // Transparent to provider egress: the route decided at the physical send arrives as
+  // `init.proxy` and is either carried by the native transport or refused below.
+  return markEgressTransparentExecutor((async (input, init) => {
+    const destination =
+      typeof input === "string" || input instanceof URL ? input : input.url;
+    if (!isCanonicalAntigravityUrl(destination)) {
+      status.set(name, "failed");
+      throw new Error("provider TLS profile refused noncanonical destination");
+    }
+    try {
+      const configured = runtimeProviderFetch(
+        provider as OcxProviderConfig,
+        name,
+      );
+      const proxyOption = tlsProxyOption(init, destination);
+      const mod =
+        configured === undefined
+          ? runtime ?? ((await import("wreq-js")) as unknown as TlsRuntime)
+          : undefined;
+      const { proxy: _decidedRoute, ...rest } = (init ?? {}) as RequestInit & { proxy?: unknown };
+      const response = await (configured ?? mod!.fetch)(input, {
+        ...rest,
+        redirect: "manual",
+        browser: "chrome_142",
+        os: "windows",
+        ...proxyOption,
+      } as RequestInit & { browser: string; os: string });
+      status.set(name, "active");
+      return response;
+    } catch (error) {
+      if (init?.signal?.aborted && error === init.signal.reason) {
+        // A caller cancellation says nothing about the profile's health.
+        throw error;
+      }
+      status.set(name, "failed");
+      throw preserveTransportError(error);
+    }
+  }) as typeof globalThis.fetch);
+}

src/providers/model-rename-fields.ts

@@ -142,6 +142,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   desktopExecutor: "none",
   unsafeAllowNativeLocalExec: "none",
   nativeLocalExec: "none",
+  tlsProfile: "none",
 } as const satisfies Record<keyof OcxProviderConfig, ModelRenameRole>;
 
 function fieldsWithRole(role: ModelRenameRole): string[] {

src/server/auth-cors.ts

@@ -32,6 +32,7 @@ import {
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { providerEgressConfigError } from "../lib/provider-egress";
+import { providerTlsProfileConfigError } from "../lib/provider-tls-profile";
 import { redactSecretString } from "../lib/redact";
 import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
@@ -780,6 +781,11 @@ export function providerManagementConfigError(
     return `provider ${name} must not include codexAccountMode`;
   }
   const typed = provider as unknown as OcxProviderConfig;
+  // Every write path (POST, PUT, reload, both PATCH passes) funnels through here, so a PATCH
+  // that changes authMode/baseUrl/adapter under a retained tlsProfile is refused before it
+  // persists a row the config schema would later reject as document-fatal.
+  const tlsProfileError = providerTlsProfileConfigError(name, typed);
+  if (tlsProfileError) return `provider ${JSON.stringify(redactSecretString(name))} ${tlsProfileError}`;
   const baseUrlError = providerBaseUrlConfigError(typed.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
   if (effectiveGoogleMode(name, typed) === "vertex" && typed.location !== undefined) {
@@ -1110,6 +1116,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   desktopExecutor: "redacted",
   unsafeAllowNativeLocalExec: "editor",
   nativeLocalExec: "editor",
+  tlsProfile: "editor",
 } as const satisfies Record<keyof OcxProviderConfig, ProviderConfigFieldPolicy>;
 
 type ProviderFieldWithPolicy<Policy extends ProviderConfigFieldPolicy> = {

src/server/management/provider-routes.ts

@@ -137,6 +137,7 @@ import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostR
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { providerTlsProfileDiagnostic } from "../../lib/provider-tls-profile";
 
 type ProviderPatchApplication =
   | { error: string }
@@ -930,8 +931,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
 
   if (url.pathname === "/api/providers" && req.method === "GET") {
     return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
-      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
-      hasApiKey: !!p.apiKey,
+      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel, hasApiKey: !!p.apiKey,
       // Presence only (#959 review): header names and values never leave the process.
       hasHeaders: !!p.headers && Object.keys(p.headers).length > 0,
       allowPrivateNetwork: p.allowPrivateNetwork === true,
@@ -962,7 +962,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       ...(name === "xai" ? { xaiResponsesOptInState: xaiResponsesOptInState(p) } : {}),
       // Only opt-in Fast lanes (Anthropic fast mode bills usage credits) get a dashboard switch.
       ...(getProviderRegistryEntry(name)?.fastOptIn === true ? { fastOptIn: { enabled: p.fastEnabled === true } } : {}),
-      discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
+      discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name), ...providerTlsProfileDiagnostic(name, p),
       ...(name === "openai" && isCanonicalOpenAiForwardProvider(p)
         ? { entitlement: getCodexModelEntitlementStatus(config) }
         : {}),