feat(models): roll out Gemini 3.8 Flash across Antigravity, Google, and the sidecar #3286
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| # Gemini 3.8 Flash rollout plan | ||
|
|
||
| - Date: 2026-09-03 | ||
| - Session: `01a062e6-43d4-7ad2-8236-c75a8fb66a12` | ||
| - Work class: C3 — provider catalog, CCA wire routing, persisted config surface, usage pricing, generated metadata, docs and tests move together. | ||
| - Status: P (wp0, docs-only roadmap cycle). | ||
|
|
||
| ## Loop spec | ||
|
|
||
| - Archetype: satisfy-spec integration. | ||
| - Trigger: Google shipped Gemini 3.8 Flash on 2026-09-02, and authenticated Antigravity discovery already returns three 3.8 wire ids ranked FIRST in the Recommended sort. | ||
| - Goal: make Gemini 3.8 Flash the selectable, correctly tiered Antigravity Flash model, and carry the same spec to every other surface that already names 3.6/3.7 — without inventing anything the vendor has not published. | ||
| - Non-goals: Vertex routing, OrcaRouter/OpenRouter seeding, widening request transport beyond `text`+`image`, hand-editing generated metadata, deleting historical price rows or usage attribution, any release or publish. | ||
| - Verifier: focused `bun test <file>` runs on the touched subsystems plus `bun run typecheck`. **The repository-wide local suite is forbidden by the user** ("로컬스위트는 절대 돌리지 말고"); exact-head GitHub CI is the authoritative full gate. | ||
| - Stop condition: 3.8 is picker-visible with a working low/medium/high ladder, every inventoried 3.6/3.7 surface is updated or carries a recorded reason not to be, focused tests and typecheck pass, CI is green on the exact head SHA, and the PR is merged into `dev` with ancestry proof. | ||
| - Memory artifact: this unit folder. | ||
| - Expected terminal outcomes: `DONE`; `BLOCKED` if CI or branch protection refuses for a reason outside this change; `NEEDS_HUMAN` if a pricing claim turns out unprovable. | ||
| - Escalation: each A gate dispatches one independent read-only reviewer on `gpt-5.6-sol` at high reasoning effort. After two failed reviewer correction loops on the same packet, the main session stops and reports. | ||
|
|
||
| ## The decision this plan turns on | ||
|
|
||
| The 3.6 to 3.7 rollout (`devlog/_fin/260814_overnight_triage_release/020_gemini_37_flash.md`) was a **replacement**: the maintainer's operational fact was that Google pulls the previous Antigravity Flash model almost immediately, so 3.6 had to be deprecated in the same commit that introduced 3.7. | ||
|
|
||
| **That premise does not hold for this launch, and both halves of the disproof are first-hand:** | ||
|
|
||
| 1. Google's own `latest-model` guide says Gemini 3.7 Flash "remains fully supported" and still lists it as Stable (see `001`). | ||
| 2. A live CCA `:fetchAvailableModels` call on 2026-09-03 returns 3.5, 3.6, 3.7 **and** 3.8 wire ids simultaneously (see `002`). | ||
|
|
||
| So 3.8 lands **additively**: it becomes the default and the recommended Flash row, while 3.7 stays picker-visible and every existing retirement mapping is left exactly where it is. Copying the 3.7 unit's deprecation section would delete a model the backend is still serving. | ||
|
|
||
| ## The second decision: wire shape | ||
|
|
||
| 3.7 expresses its tiers as `thinkingLevel` against ONE wire id (`gemini-3.7-flash-tiered`). 3.8 does not: CCA publishes three suffixed wire ids and no `-tiered` row. That makes 3.8 structurally a **3.6-shaped** model, and it must be registered through `ANTIGRAVITY_EFFORT_WIRE_MAP` (rule 2/3), never through `ANTIGRAVITY_THINKING_LEVEL_MODELS` (rule 1b). Registering it the 3.7 way would send `thinkingLevel` against a nonexistent `gemini-3.8-flash-tiered` wire id. | ||
|
|
||
| ## Work-phase map (dependency-ordered, PHASE-SPLIT-01) | ||
|
|
||
| | Phase | Doc | Consumes | Delivers | | ||
| |---|---|---|---| | ||
| | wp0 | this folder | — | research + diff-level roadmap | | ||
| | wp1 | `010_wp1_antigravity_core.md` | wp0 | `antigravity-models.ts` catalog/ladder/routing + registry default | | ||
| | wp2 | `020_wp2_metadata_pricing.md` | wp1 | expected-prices rows, metadata source + regen | | ||
| | wp3 | `030_wp3_peripheral_surfaces.md` | wp2 | direct Google seed, free-directory, Cursor seed, sidecar default, docs | | ||
| | wp4 | `040_wp4_delivery.md` | wp3 | branch, `--no-verify` push, PR, exact-head CI, merge | | ||
|
|
||
| wp1 is first because every later surface keys off the picker id and ladder it establishes. wp2 depends on wp1 because the price overlay is keyed by the picker id and the suffix wire ids wp1 introduces. wp3 is last among the code phases because it is the set of surfaces that merely *reference* the model rather than define it. | ||
|
|
||
| ## Scope | ||
|
|
||
| ### IN | ||
|
|
||
| - `src/providers/antigravity-models.ts`, `src/providers/registry.ts` | ||
| - `src/usage/expected-prices.ts`, `scripts/model-metadata.source.json` (plus `bun run generate:model-metadata`) | ||
| - `src/providers/free-directory.ts`, `src/adapters/cursor/effort-map.ts`, `src/adapters/cursor/catalog.ts`, `src/web-search/index.ts` | ||
| - `docs-site/` provider and sidecar tables | ||
| - focused tests beside the existing Antigravity/catalog/price tests | ||
|
|
||
| ### OUT | ||
|
|
||
| - `src/adapters/google.ts` `GEMINI_DIRECT_WIRE_RENAMES`: no `gemini-3.8-flash-tiered` id is proven on any surface, so adding a rename would invent a wire id. Recorded in `030`. | ||
| - `src/providers/model-rename-migration.ts`: nothing is retired by this change, so no new rename entry. The existing 3.6/3.5 to 3.7 entries stay, because 3.7 is still live. | ||
| - `RETIRED_FLASH_TIERS` and `ANTIGRAVITY_USAGE_BASE_BY_ID`: unchanged for the same reason. | ||
| - Vertex (`google-vertex` `defaultModel` stays frozen), OrcaRouter, OpenRouter, GitHub Copilot. | ||
|
|
||
| ## Accept criteria (goalplan c-1 through c-7) | ||
|
|
||
| 1. `gemini-3.8-flash` is one collapsed picker row, not three suffix rows. | ||
| 2. Each of `low`/`medium`/`high` resolves to its own `gemini-3.8-flash-{tier}` wire id. | ||
| 3. `gemini-3.7-flash` remains picker-visible and its `-tiered` routing is untouched. | ||
| 4. Retired 3.6/3.5 ids still route to 3.7 with their recorded tier and stay picker-invisible. | ||
| 5. Historical usage rows carrying 3.6/3.7 ids still aggregate under their own base. | ||
| 6. `bun run typecheck` exits 0; only focused test files are run locally. | ||
| 7. CI green on the exact head SHA and the PR merged into `dev`. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| # 001 — Gemini 3.8 Flash: vendor claim ledger | ||
|
|
||
| Research snapshot 2026-09-03 (KST), collected by an independent read-only research lane on | ||
| `gpt-5.6-sol` at high reasoning effort. Every row was verified by opening the linked official | ||
| page. Unprovable fields say `NOT PROVEN` rather than borrowing 3.7's value. | ||
|
|
||
| | Claim | Value | Source | Page date | | ||
| |-------|-------|--------|-----------| | ||
| | Canonical Developer API id | `gemini-3.8-flash` | ai.google.dev/gemini-api/docs/models/gemini-3.8-flash | 2026-09-02 | | ||
| | Published aliases | stable id only; `-preview`/dated/`-latest` NOT PROVEN | same + docs/models | 2026-09-02 | | ||
| | Release date | 2026-09-02 | deepmind.google model card; docs.cloud.google.com | 2026-09-02 | | ||
| | Availability | GA, production-ready (not Preview) | latest-model guide | 2026-09-02 | | ||
| | Context window | 1,048,576 input tokens | model page | 2026-09-02 | | ||
| | Max output | 65,536 tokens | model page | 2026-09-02 | | ||
| | Input price | $0.75 / 1M through 2026-12-31, $1.50 / 1M from 2027-01-01 | Developer API pricing | 2026-09-02 | | ||
| | Output price (incl. thinking) | $3.75 / 1M through 2026-12-31, $7.50 / 1M from 2027-01-01 | Developer API pricing | 2026-09-02 | | ||
| | Separate thinking price | none — thinking billed as output | pricing | 2026-09-02 | | ||
| | Cache read | $0.075 / 1M through 2026-12-31, then $0.15 | pricing | 2026-09-02 | | ||
| | Cache storage | $0.50 / 1M tokens/hour through 2026-12-31, then $1.00 | pricing | 2026-09-02 | | ||
| | Batch / Flex | half of standard input and output | pricing | 2026-09-02 | | ||
| | Priority | $1.35 in / $6.75 out per 1M through 2026-12-31 | pricing | 2026-09-02 | | ||
| | Thinking parameter | `generation_config.thinking_level` (replaces `thinking_budget`) | latest-model | 2026-09-02 | | ||
| | Thinking values | `low` / `medium` / `high`, default `medium` | latest-model; Cloud guide | 2026-09-02 | | ||
| | `minimal` | unsupported — setting it returns a validation error | model page; Cloud guide | 2026-09-02 | | ||
| | Inputs | text, image, video, audio, PDF | model page | 2026-09-02 | | ||
| | Outputs | text only (no image/audio generation, no Live API) | model page | 2026-09-02 | | ||
| | Knowledge cutoff | March 2026 (some domains still January 2025) | DeepMind model card | 2026-09-02 | | ||
| | Antigravity default | proven for the Managed Agents agent and the Antigravity SDK; the desktop/CCA backend default is NOT PROVEN | latest-model | 2026-09-02 | | ||
| | Vertex / Agent Platform id | `gemini-3.8-flash`, `publishers/google/models/gemini-3.8-flash:generateContent` | Cloud developer guide | 2026-09-02 | | ||
| | **3.7 Flash deprecated?** | **No — Google says 3.7 Flash "remains fully supported" and still lists it Stable** | latest-model; models catalog | 2026-09-02 | | ||
| | CCA billing equivalence | NOT PROVEN — the listed prices are Developer API prices | pricing | 2026-09-02 | | ||
|
|
||
| ## Other providers OpenCodex integrates | ||
|
|
||
| | Provider | 3.8 model id published? | Source | | ||
| |---|---|---| | ||
| | OpenRouter | YES — `google/gemini-3.8-flash` | openrouter.ai model page | | ||
| | Cursor | NO — models page and changelog still stop at 3.7 Flash | cursor.com/docs/models-and-pricing; /changelog | | ||
| | GitHub Copilot | NO — supported-model table lists 3.5/3.6/3.7 only | docs.github.com Copilot supported models | | ||
|
|
||
| ## Unprovable fields | ||
|
|
||
| - 3.8-specific preview, dated, or `-latest` aliases. | ||
| - A standalone `blog.google` launch post (the date rests on the DeepMind card and the Cloud record). | ||
| - Cloud Code Assist billing equivalence to Developer API list prices. | ||
| - Cursor and GitHub Copilot 3.8 model ids. | ||
|
|
||
| ## Why the pricing row cannot be `verified` for Antigravity | ||
|
|
||
| OpenCodex routes this model through CCA, and the pricing page distinguishes Developer API, | ||
| Enterprise Agent Platform, and managed Antigravity-agent pricing without proving equivalence | ||
| for the Cloud Code Assist backend. This is exactly the provenance caveat the 3.7 unit already | ||
| recorded, and `src/usage/expected-prices.ts` already has the right enum member for it: | ||
| `verified-derived`. Only a `google`-provider row may claim `verified`. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| # 002 — Live Cloud Code Assist evidence | ||
|
|
||
| Probes run 2026-09-03 from this worktree against `daily-cloudcode-pa.googleapis.com` using the | ||
| already-stored local Antigravity OAuth credential and the repository's own | ||
| `ANTIGRAVITY_REQUEST_UA`. No token, refresh token, or project id was printed or persisted; the | ||
| probe scripts were removed after the run. | ||
|
|
||
| ## `v1internal:fetchAvailableModels` — the 3.8 rows | ||
|
|
||
| | Wire id | displayName | maxTokens | maxOutputTokens | supportsThinking | thinkingBudget | minThinkingBudget | supportsImages | supportsVideo | | ||
| |---|---|---:|---:|---|---:|---:|---|---| | ||
| | `gemini-3.8-flash-low` | Gemini 3.8 Flash (Low) | 1048576 | 65536 | true | 1000 | 32 | true | true | | ||
| | `gemini-3.8-flash-medium` | Gemini 3.8 Flash (Medium) | 1048576 | 65536 | true | 4000 | 32 | true | true | | ||
| | `gemini-3.8-flash-high` | Gemini 3.8 Flash (High) | 1048576 | 65536 | true | -1 | 32 | true | true | | ||
|
|
||
| **There is no `gemini-3.8-flash-tiered` row.** The payload does contain | ||
| `gemini-3.7-flash-tiered` and `gemini-3.6-flash-tiered`, so its absence for 3.8 is a fact about | ||
| this generation, not a gap in the probe. | ||
|
|
||
| ## `agentModelSorts` Recommended order (verbatim) | ||
|
|
||
| ``` | ||
| gemini-3.8-flash-high, gemini-3.8-flash-medium, gemini-3.8-flash-low, | ||
| gemini-3.7-flash-high, gemini-3.7-flash-medium, gemini-3.7-flash-low, | ||
| gemini-3.6-flash-high, gemini-3.6-flash-medium, gemini-3.6-flash-low, | ||
| gemini-pro-agent, gemini-3.1-pro-low, claude-sonnet-4-6, | ||
| claude-opus-4-6-thinking, gpt-oss-120b-medium | ||
| ``` | ||
|
|
||
| Two things follow. 3.8 outranks every other Flash generation, so it is the natural default. And | ||
| **3.7 and 3.6 are both still being served** — the "previous Flash is pulled immediately" | ||
| premise behind the 3.6 deprecation does not apply here. | ||
|
|
||
| ## `v1internal:generateContent` — all three tiers accept inference | ||
|
|
||
| Minimal one-line prompts with `generationConfig.thinkingConfig.thinkingLevel` set to the | ||
| matching tier: | ||
|
|
||
| | Wire model | HTTP | Output marker | | ||
| |---|---:|---| | ||
| | `gemini-3.8-flash-low` | 200 | `OK-LOW` | | ||
| | `gemini-3.8-flash-medium` | 200 | `OK-MEDIUM` | | ||
| | `gemini-3.8-flash-high` | 200 | `OK-HIGH` | | ||
|
|
||
| This is the same pre-exposure proof the 3.6 rollout recorded: all three ids accept inference | ||
| before any catalog change ships, so the ladder in `010` cannot advertise a rung the backend | ||
| would reject. | ||
|
|
||
| ## What the running proxy does with them today | ||
|
|
||
| `ocx models live --provider google-antigravity` currently publishes the three 3.8 ids as | ||
| **separate uncollapsed rows with `reasoningEfforts: []`** — the same broken shape #1897 | ||
| described. Discovery finds them, and no static rule knows they are one model, so they arrive as | ||
| three effortless picker entries. That is the defect wp1 closes. | ||
|
|
||
| ## Security boundary for these probes | ||
|
|
||
| - Assets: local Antigravity OAuth access token and discovered project id. | ||
| - Trust boundary: local read of the existing credential store, then HTTPS to the fixed | ||
| registry-owned base URL. Model text cannot choose the destination, headers, or credential. | ||
|
Comment on lines
+59
to
+60
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository guidance ---'
find /tmp/coderabbit-repo-knowledge/lidge-jun-opencodex-7afea732 -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- target document ---'
cat -n devlog/_plan/260903_gemini_38_rollout/002_live_cca_probe.md
printf '%s\n' '--- directly related references ---'
rg -n -i --glob '*.md' 'redirect|followRedirect|follow redirect|CCA|credential store|Authorization|registry-owned' devlog/_plan/260903_gemini_38_rollout devlog 2>/dev/null | head -200Repository: lidge-jun/opencodex Length of output: 38115 🏁 Script executed: set -eu
printf '%s\n' '--- target document ---'
cat -n devlog/_plan/260903_gemini_38_rollout/002_live_cca_probe.md
printf '%s\n' '--- related redirect and credential-handling references ---'
rg -n -i --glob '*.md' 'redirect|followRedirect|follow redirect|CCA|credential store|Authorization|registry-owned' devlog/_plan/260903_gemini_38_rollout devlog 2>/dev/null | head -200Repository: lidge-jun/opencodex Length of output: 39739 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- redirect contract notes ---'
sed -n '1,75p' devlog/_fin/260730_remote_issue_merge_round/030_pr652_model_discovery_contract.md
sed -n '70,95p' devlog/_fin/260730_remote_issue_merge_round/090_wp_pr_landing_round2.md
printf '%s\n' '--- implementation references ---'
rg -n -C 4 --glob '!devlog/**' 'daily-cloudcode-pa\.googleapis\.com|fetchAvailableModels|redirect:\s*["'\''](error|manual)|cloud.?code.?assist' . | head -240Repository: lidge-jun/opencodex Length of output: 22936 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- bounded discovery transport ---'
rg -n -C 8 'fetch\(|redirect|providerDestinationResolvedError|buildModelsRequest|fetchModels' src/codex/catalog/provider-fetch.ts src/providers/model-discovery.ts src/oauth/index.ts
printf '%s\n' '--- CCA probe caller ---'
sed -n '960,1035p' src/server/management/provider-routes.tsRepository: lidge-jun/opencodex Length of output: 16236 🏁 Script executed: #!/bin/bash
set -eu
rg -n -C 10 'function providerOutbound(Post|Get)|providerOutbound(Post|Get)|function providerRedirectError|providerRedirectError|redirect:\s*["'\''](error|manual)["'\'']|providerDestinationResolvedError' src/lib src/server/management/provider-routes.ts src/codex/catalog/provider-fetch.tsRepository: lidge-jun/opencodex Length of output: 25197 Document the enforced redirect control. The outbound helper uses 🤖 Prompt for AI Agents |
||
| - Controls: nothing credential-bearing printed or written; probe files deleted after the run. | ||
|
Comment on lines
+60
to
+61
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository knowledge files ---'
find /tmp/coderabbit-repo-knowledge/lidge-jun-opencodex-7afea732 -maxdepth 2 -type f -name '*.md' -print | sort
printf '%s\n' '--- target file lines 1-90 ---'
cat -n devlog/_plan/260903_gemini_38_rollout/002_live_cca_probe.md | sed -n '1,90p'
printf '%s\n' '--- tracked files in target directory ---'
git ls-files 'devlog/_plan/260903_gemini_38_rollout/*'Repository: lidge-jun/opencodex Length of output: 6403 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- bounded rollout references ---'
rg -n -C 3 --no-heading \
'daily-cloudcode-pa\.googleapis\.com|ANTIGRAVITY_REQUEST_UA|fetchAvailableModels|generateContent|Authorization|redirect|credential store|access token|project id|curl|fetch\(' \
devlog/_plan/260903_gemini_38_rollout \
/tmp/coderabbit-repo-knowledge/lidge-jun-opencodex-7afea732/learnings/devlog-plan-260807-compatibility-lab.md || true
printf '%s\n' '--- repository references to the probe identifiers ---'
rg -n -C 2 --no-heading \
'daily-cloudcode-pa\.googleapis\.com|ANTIGRAVITY_REQUEST_UA|google-antigravity|credential store' \
--glob '!devlog/_plan/260903_gemini_38_rollout/002_live_cca_probe.md' \
--glob '!node_modules' --glob '!dist' --glob '!build' . | head -300 || trueRepository: lidge-jun/opencodex Length of output: 37066 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- google adapter request construction ---'
cat -n src/adapters/google.ts | sed -n '800,925p'
printf '%s\n' '--- OAuth discovery request construction ---'
cat -n src/oauth/index.ts | sed -n '1070,1140p'
cat -n src/oauth/index.ts | sed -n '1188,1235p'
printf '%s\n' '--- relevant redirect/fetch transport references ---'
rg -n -C 4 --no-heading \
'redirect\s*:|redirect|fetch\(|undici|Dispatcher|http[s]?\.request|Authorization' \
src/adapters/google.ts src/oauth/index.ts src/server src/lib src/oauth \
--glob '!**/*.test.*' --glob '!**/*.spec.*' | head -500Repository: lidge-jun/opencodex Length of output: 49705 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- model discovery fetch and redirect check ---'
cat -n src/server/management/provider-routes.ts | sed -n '990,1050p'
rg -n -C 6 --no-heading 'function providerRedirectError|const providerRedirectError|providerRedirectError' src
printf '%s\n' '--- lab probe route ---'
cat -n src/lib/lab-live-route-production.ts | sed -n '1,135p'
printf '%s\n' '--- consumers of request builders and fetch wrappers ---'
rg -n -C 5 --no-heading 'buildModelsRequest|fetch\(.*modelsUrl|fetch\(.*url|fetch\(request\.url|request\.url|redirect:\s*"error"|redirect:\s*"manual"' \
src/server/management/provider-routes.ts src/oauth src/adapters src/lib | head -500Repository: lidge-jun/opencodex Length of output: 37750 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- provider outbound policy ---'
cat -n src/lib/provider-outbound.ts | sed -n '1,205p'
printf '%s\n' '--- pinned lab transport ---'
cat -n src/lab/live/transport.ts | sed -n '1,280p'
printf '%s\n' '--- pinned lab sender ---'
cat -n src/server/lab-live-pinned-sender.ts | sed -n '1,240p'
printf '%s\n' '--- CCA registry and destination policy references ---'
rg -n -C 5 --no-heading \
'google-antigravity|daily-cloudcode-pa\.googleapis\.com|registryEntryForProviderDestination|providerDestinationResolvedError|createPinnedTransport|destination' \
src/providers/registry.ts src/lib/destination-policy.ts src/lab/live src/server/lab-live-pinned-sender.ts | head -500Repository: lidge-jun/opencodex Length of output: 50375 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- actual pinned sender definitions ---'
rg -l --no-heading 'createLabAuthorizedPinnedSender|LabPinnedSender|host/sni mismatch|destination_mismatch' src
rg -n -C 8 --no-heading 'createLabAuthorizedPinnedSender|export .*LabPinnedSender|function .*PinnedSender' src
printf '%s\n' '--- LabDestinationV1 construction and route context ---'
rg -n -C 6 --no-heading 'LabDestinationV1|fingerprint:|addresses:|routeContext\.baseUrl|destination:' src/lab src/server | head -400Repository: lidge-jun/opencodex Length of output: 33744 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- authorized pinned sender ---'
cat -n src/lib/lab-live-pinned-sender.ts | sed -n '1,180p'
printf '%s\n' '--- pinned HTTP primitives ---'
rg -n -C 5 --no-heading 'export async function pinnedHttp(Post|Get)|function pinnedHttp(Post|Get)|redirect|hostname|servername|path' src/lib/pinned-http.ts
cat -n src/lib/pinned-http.ts | sed -n '1,260p'
printf '%s\n' '--- route context definition and producers ---'
rg -n -C 8 --no-heading 'interface LabRouteContext|type LabRouteContext|baseUrl:' src/lab/live src/lib | head -400Repository: lidge-jun/opencodex Length of output: 24936 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- LabRouteContext construction sites ---'
rg -n -C 10 --no-heading \
'LabRouteContext|providerInstanceKey|effectiveAdapter|upstreamProtocol|routeContext\s*[:=]' \
src --glob '!src/lab/live/types.ts' --glob '!**/*.test.*' --glob '!**/*.spec.*' | head -500
printf '%s\n' '--- Antigravity base URL resolution and override policy ---'
rg -n -C 8 --no-heading \
'allowBaseUrlOverride|google-antigravity|baseUrl.*daily-cloudcode|resolveProviderTransport|providerConfigSeed' \
src/providers src/oauth src/server | head -500Repository: lidge-jun/opencodex Length of output: 50375 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- effective provider and route-context path ---'
rg -n -C 12 --no-heading \
'export function resolveWireProtocolOverride|function resolveWireProtocolOverride|resolveWireProtocolOverride\(' \
src/server/adapter-resolve.ts src/routing/compatibility/subject.ts src | head -220
printf '%s\n' '--- exact security-relevant source slices ---'
cat -n src/routing/compatibility/subject.ts | sed -n '56,125p'
cat -n src/providers/registry.ts | sed -n '1748,1759p'
cat -n src/lib/lab-live-route-production.ts | sed -n '37,75p'Repository: lidge-jun/opencodex Length of output: 24805 Sensitive Data Exposure (CWE-200): Exposure of Sensitive Information to an Unauthorized Actor Reachability: Internal · Exploitability: Difficult Bind Antigravity lab credentials to the registry host.
🤖 Prompt for AI Agents |
||
| - Blast radius: three minimal quota-consuming inference calls. No configuration mutated. | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a language identifier to the output fence.
The fence contains plain text output. Change the opening fence to
textso Markdown lint can validate the block deterministically.🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 22-22: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Source: Linters/SAST tools