Antigravity Tools v5.0.4-beta.0

• [Native Android Architecture: Termux ARM64 Container-Free Deployment & Headless Runtime] (Fixes #3818, Thanks to @sandwitchers):
  • Android Termux Native Support: Added native aarch64-linux-android (Bionic libc) backend target and one-click installation script scripts/install-termux.sh, completely freeing Android devices from container overhead (PRoot / chroot / Docker) for ultra-lightweight, energy-efficient local API gateway and Web UI execution. (Fixes #3818, Thanks to @sandwitchers)
  • Zero-Account Web Deadlock Resolution: Fixed middleware deadlock in static asset and authentication filtering when zero accounts exist or the proxy service is inactive, ensuring seamless access to the Web console and account onboarding on cold boots. (Fixes #3818)
  • Cascading Static Asset Path Resolution: Introduced resolve_static_dist_path algorithm supporting ABV_DIST_PATH env override and cascaded directory probing (./dist, <exe_dir>/dist, $PREFIX/share/antigravity/dist), eliminating CWD execution path dependencies. (Fixes #3818)
  • CI Workflow & Distribution Packaging: Updated the Android release workflow to bundle frontend dist assets into antigravity-server-android-arm64.tar.gz, with the installer automatically deploying it to the standard share path. (Fixes #3818)
  • Server Command-Line Help Interception Fix: Pre-empted --help / -h before generic CLI parsing, restoring the display of server flags (-p, -h, --no-web, --pure-proxy). (Fixes #3818)
  • Web UI Model Probe Endpoint Parity: Registered the POST /api/proxy/test-model route on the headless admin server, resolving the 405 Method Not Allowed error when clicking the "Test" button on models in the Web UI. (Fixes #3818)

---

• [Android 原生架构支持：Termux ARM64 无容器部署与 Headless 运行环境] (Fixes #3818, Thanks to @sandwitchers):
  • Android Termux 原生无容器支持: 新增 aarch64-linux-android (Bionic libc) 原生后端构建目标与一键安装脚本 scripts/install-termux.sh，摆脱 PRoot / chroot / Docker 等容器层开销，在 Android 设备上实现超轻量、低功耗的原生 API 网关与 Web 控制台运行。(Fixes #3818, Thanks to @sandwitchers)
  • 零账号死锁与仪表盘准入修复: 修复无账号或服务未就绪时静态资源与鉴权中间件的拦截死锁，确保 0 账号冷启动下 Web 控制台与管理接口正常放行，用户可无阻进入控制台添加账号或配置服务。(Fixes #3818)
  • 静态资源智能级联探测: 新增 resolve_static_dist_path 探测算法，支持 ABV_DIST_PATH 环境变量优先指定，并级联搜索 ./dist、<exe_dir>/dist 及 $PREFIX/share/antigravity/dist，彻底解除对当前执行目录的强依赖。(Fixes #3818)
  • 构建流水线与资源包分发补全: 修正 CI 交叉编译打包流程，将前端 dist 完整打包入 antigravity-server-android-arm64.tar.gz 归档，安装脚本自动解压并软链接至系统标准路径。(Fixes #3818)
  • 服务端命令行帮助拦截修复: 优先接管 --help / -h 参数，解决此前被底层通用 CLI 错误捕获导致无法输出 server 参数（-p, -h, --no-web, --pure-proxy）的问题。(Fixes #3818)
  • Web 端模型连通性测活端点补齐: 为 Headless 独立 Web 服务补全注册 POST /api/proxy/test-model 路由，修复在网页端点击模型「测活」按钮返回 405 Method Not Allowed 并报错的问题。(Fixes #3818)

Full Changelog: v5.0.3...v5.0.4-beta.0

Antigravity Tools v5.0.3

• [Quota Attribution Governance: Root-Fixing 503 Misattribution & Quota False-Death; Refactoring Bucket Scheduling and Priority Competition] (Fixes #3838, #3841, #3821, PR #3845, Ref #3827, #3840):
  • Eradicate 503 Attribution Pollution (92.6% of all 5xx): Unified all internal gateway throttling predicates into the single source of truth policy::is_internal_gateway_exhaustion, covering the previously mis-detected All accounts rate-limited (the old list only matched all accounts limited), so local pool throttling is no longer reported as an upstream 503; converged the two other drifting implementations in rate_limit.rs and token_manager.rs. (Fixes #3838)
  • Dedicated 403 Ban Attribution: Added the account_forbidden error code with 12-language copy for TOS_VIOLATION / PERMISSION_DENIED, so a banned account is no longer conflated with capacity exhaustion after the 403→503 mapping. (Fixes #3838)
  • Decouple Quota Exhaustion from the Adaptive Circuit Breaker: Established the invariant that an upstream-declared quota exhaustion is an objective physical fact and must never be gated by the breaker switch. Fixed the defect where if !config.enabled { return; } short-circuited before the quota predicate, silently dropping Individual quota reached so the account was neither zeroed nor locked; added is_quota_exhausted_or_explicit_limited so QuotaExhausted accounts are intercepted even with the breaker disabled. (PR #3845, Thanks to @cubelikeplayDaniel)
  • Account Exclusion in Retry Loops: Each protocol retry loop now maintains attempted_accounts and passes it into get_token_filtered, eliminating the P2C behavior that kept re-selecting an account that had just returned 429 based on historical quota weights, and failing fast once the pool is exhausted. (PR #3845, Thanks to @cubelikeplayDaniel)
  • Eliminate Zero-Quota High-Priority Pool Starvation (Priority Inversion Deadlock): Moved the target-model positive-quota filter ahead of priority convergence in select_with_p2c, establishing that “priority only competes among healthy accounts holding a valid positive quota for that model”; fixed the severe defect where a drained account boosted to priority=1 still evicted every healthy full-quota account and returned “no available accounts”. (Ref #3840)
  • Authoritative Quota Diagnostics from Upstream: Added L1 quotaResetTimeStamp priority locking so all four bucket classes (Argon standalone / Ultra shared / standard Gemini / 3P) adopt the official recovery instant when exhausted; the lock source now prefers hard quotas, the false-full blind spot caused by an omitted remainingFraction is fixed, and the all-pool-zero-quota pass-through hole is closed. (Fixes #3841)
  • Frontend Circuit Breaker Default Corrected: circuit_breaker now initializes with enabled: true, preventing an accidental breaker shutdown when saving the settings page. (PR #3845)
• [Pedal Mode Rebuilt as Top Scheduling Priority] (PR #3840, Thanks to @zepeng-jin):
  • From Hard Disabling to Priority Competition: Activating pedal mode no longer suspends other accounts via proxy_disabled = true; expiring accounts are instead promoted to priority 1 (default 50). This eliminates three pathologies at once: Prompt Cache invalidation from forced failover, 429s from squeezing all concurrency onto a single account, and cross-model collateral damage from account-level disabling. Existing sessions stay bound to their account to preserve cache, new sessions consume the expiring quota first, and concurrent traffic spills over automatically. (PR #3840, Thanks to @zepeng-jin)
  • Smooth Automatic Recovery: Once the pedal account's weekly quota is fully drained (0%) or its reset time arrives, original priorities are restored precisely from originalPriorities, with tolerant cleanup retained for stale suspended state left by older versions. (PR #3840, Thanks to @zepeng-jin)
• [Timeout Contract and Stream Lifecycle Unification: Hard Truncation Removed, Four Protocols Share One Pipeline] (Fixes #3816, Fixes #3821, Ref #3763, PR #3817):
  • Hardcoded Truncation Abolished: Retired the 135s/160s hard truncation (below the measured medium p90 of 130.9s, which reversed legitimately slow requests into 504s and triggered retry storms); the first-byte baseline is restored to 180s, multimodal ceiling to 270s, and the 270s global request budget is pushed down into the pipeline, short-circuiting immediately when remaining budget is insufficient. (Fixes #3821)
  • Codex / Legacy Converged onto the Shared Lifecycle: create_codex_sse_stream and create_legacy_sse_stream moved from hand-rolled select! drivers to ProtocolStreamHandler adapters under run_stream_lifecycle, unifying 3s heartbeats, initial-TTFT grace, thinking/content phase promotion, steady-state sliding timeouts, and abnormal finalization; Gemini gained is_thinking_active so the thinking phase is no longer misjudged as a transition cliff. (Ref #3816, PR #3817, Thanks to @cubelikeplayDaniel)
  • Transition-Cliff Adaptive Promotion: Fixed the failure where a deep-thinking model emits thought blocks and then goes silent while upstream buffers a monolithic functionCall, causing the 120s steady-state timeout to truncate the stream into a false HTTP 200 with no output; the silent window now promotes to the Transition phase with a 180s grace window and : ping keep-alives. (Fixes #3816, Thanks to @mclinyeshi)
  • Sticky Unbinding Across All Terminal States: TerminalDisposition now folds FirstByte / Upload / GlobalBudget into abandon_sticky_account, eliminating the deadlock where clients waited out multiple three-minute attempts on the same slow account. (Fixes #3821)
  • Upload and Replay Guards: Upload stall timeouts are decoupled from the adaptive upload budget and floored at the connect timeout; the cross-account replay threshold for large bodies is widened to 4MB with a cap of 3 attempts to suppress upstream amplification. (Fixes #3821)
• [Model Routing and Gates: Custom Mapping Takes Top Precedence, Legacy Models Hard-Retired] (Fixes #2065, Ref #3764, #3769, #3815, PR #3787):
  • Four-Stage Inbound Model Gate: Missing model → 404 model not exist; custom mappings first (exact / case-insensitive / normalized / wildcard); the resolved target must exist in “downstream exposure ∪ agent tool list ∪ official catalog ∪ mapping values”; all-pool zero quota → 502 no quota accounts; fail-open on cold start without metadata, and gateway self-answered 404/502 go through the single-source is_gateway_self_answer exemption so accounts are never locked or unbound. (Ref #3764, #3769)
  • Custom Mappings Elevated to the Very Front: Ahead of official hot-update deprecation redirects, fixing the post-hoc resolve_bare_tiered_model_route rewrite into tiered/medium; the default tier selector flipped to prefer High, with in-place promotion to High on upstream 503 MODEL_CAPACITY_EXHAUSTED.
  • Legacy Model Retirement with Map-Before-Judge Ordering: Hard gates for Claude 3.x / < 4.6 and Gemini 2.x (image-generation families exempted independently), with the “map first, then judge” order locked so legacy names remain valid inbound aliases. (Ref #3815)
  • Pool-Adaptive Dark Routing: Removed the static CLAUDE_TO_GEMINI hardcoded map and added auto:gemini-flash-low / auto:claude-opus / auto:claude-opus-4-7 adaptive targets that pick and downgrade among Opus 5.5 / 4.6 / 4.7 by live positive quota; custom_mapping is decoupled from custom_mapping_expose with a builtin_mapping_version seamless migration. (Fixes #2065, PR #3787, Thanks to @cubelikeplayDaniel)
  • Upstream Physical Model Convergence: Removed the modelVersion override of upstream_model (internal build names polluted the already-arbitrated routing result); X-Upstream-Model is now the single authoritative source across protocols. (Ref #3658, #3654)
  • Official Thinking Migration Alignment: thinkingLevel first with thinkingBudget fallback; outbound fingerprint calibrated to 2.28.0 / CL 1008300195; model lists and one-click presets expose only models an account can actually use. (Ref #3751)
• [Multimodal Self-Healing and Freshness Sliding Window: In-Place Bad-Image Repair, Responses Protocol Parity] (Fixes #3758, #3824, #3756, PR #3759, PR #3830):
  • In-Place Bad-Image 400 Self-Healing: On 400 Unable to process input image the pipeline no longer locks the account or unbinds stickiness (preserving Prefix Cache), replacing the corrupted image with a structured placeholder and retrying in place; single-image cases record a SHA-256 fingerprint into ImageBlacklist (FIFO, cap 2000) for persistent immunity, while multi-image cases are replaced for the current turn only to avoid false positives. (Fixes #3758, PR #3759, Thanks to @cubelikeplayDaniel)
  • Multimodal Freshness Sliding Window Enabled by Default: enable_sliding_window = true keeping the latest 5 images by default; with the window enabled the gateway entry hard-limit on accumulated images is bypassed so the pipeline can prune, preventing long Codex conversations from being killed. (Fixes #3824)
  • Responses Protocol Parity: Simple-log mode now recursively redacts Base64 in input_image, inline Data URLs, and function_call_output; the token estimator gained a Responses branch with vision-token accounting. (PR #3830, Thanks to @mclinyeshi)
  • Image-Generation Watchdog Widened with Empty-Image Diagnostics: Primary endpoint 90s, fallback 45s, total budget 135s; a protocol-agnostic empty-image diagnostic extractor means an upstream 200 without an image is no longer treated as a false success. (Fixes #3756)
  • Cowork Auto-Compact Alignment: Removed the blanket 1M-model exemption and the mid-tool-call block, trig...

Antigravity Tools v5.0.3-beta.5

• [Decouple Physical Quota Exhaustion from Adaptive Circuit Breaker; Exclude Attempted Accounts in Retry Loops] (PR #3845, Thanks to @cubelikeplayDaniel):
  • Physical fact takes precedence over adaptive strategy: Decoupled “upstream-declared quota exhaustion” from the “adaptive circuit breaker backoff switch”. Previously if !config.enabled { return; } ran before the quota predicate, so when Google returned an explicit Individual quota reached, the signal was dropped — the account was neither marked 0% nor locked. Now the invariant is established: an upstream-declared quota exhaustion is an objective physical fact and must never be gated by the breaker switch. (PR #3845, Thanks to @cubelikeplayDaniel)
  • Attempted-account exclusion in retry loops: Fixed repeated hammering of the same drained account. Previously get_token received an empty excluded_accounts, so P2C could re-select the just-429'd account due to its historical quota weight. Each protocol retry loop now maintains attempted_accounts and passes it to get_token_filtered, failing fast after a full pool sweep. (PR #3845, Thanks to @cubelikeplayDaniel)
  • No longer bypassing realtime locks when the breaker is off: Added is_quota_exhausted_or_explicit_limited, so accounts in QuotaExhausted state are still correctly intercepted even with the breaker disabled.
  • Frontend breaker default corrected: circuit_breaker now initializes with enabled: true, preventing users from accidentally disabling the breaker by saving settings. (PR #3845, Thanks to @cubelikeplayDaniel)
• [Fix beta.4 Release Pipeline Failure] (Ref #3845):
  • Background: The beta.4 Release pipeline hit a transient GitHub API HTTP 500 at the publish-release step (all 10 build jobs succeeded), so the Release object was never created and updater.json was missing — users could not see that version.
  • Resolution: Removed the dangling v5.0.3-beta.4 tag and shipped beta.5 directly, delivering the PR #3845 fixes together with everything since beta.3.

---

• [解耦客观物理配额耗尽与自适应熔断，增加单请求重试账号排除] (PR #3845, Thanks to @cubelikeplayDaniel):
  • 物理事实优先于自适应策略: 将「上游告知的配额耗尽」与「自适应熔断退避开关」彻底解耦。此前熔断关闭时，if !config.enabled { return; } 位于配额判据之前，导致 Google 明确返回 Individual quota reached 时信号被丢弃——账号配额不会置 0% 也不会锁定。现确立不变式：账号已被上游告知配额耗尽是客观物理事实，绝不受熔断开关影响。(PR #3845, Thanks to @cubelikeplayDaniel)
  • 重试循环引入账号排除机制: 修复多轮重试锤击同一耗尽账号的问题。此前 get_token 传入空的 excluded_accounts，P2C 可能因历史配额权重再次选中刚 429 的账号。现各协议重试循环维护 attempted_accounts 并传入 get_token_filtered，全池遍历后快速失败。(PR #3845, Thanks to @cubelikeplayDaniel)
  • 熔断关闭时不再旁路实时锁定: 新增 is_quota_exhausted_or_explicit_limited，即使熔断关闭也能正确拦截处于 QuotaExhausted 状态的账号。
  • 前端熔断默认值修正: circuit_breaker 初始默认改为 enabled: true，避免用户在设置页点击保存时意外关闭熔断器。(PR #3845, Thanks to @cubelikeplayDaniel)
• [修复 beta.4 发布流水线失败] (Ref #3845):
  • 问题背景: beta.4 的 Release 流水线在 publish-release 步骤遭遇 GitHub API 瞬时 500 错误（其余 10 个构建作业均成功），导致 Release 对象未创建、updater.json 缺失，用户无法感知该版本。
  • 修复方式: 删除悬空的 v5.0.3-beta.4 tag，直接发布 beta.5，将 PR #3845 的修复与 beta.3 以来的全部改动一并交付。

What's Changed

• fix(proxy,quota): 解耦客观物理配额耗尽与自适应熔断，增加单请求重试账号排除防反复锤击 by @cubelikeplayDaniel in #3845

Full Changelog: v5.0.3-beta.3...v5.0.3-beta.5

Antigravity Tools v5.0.3-beta.3

• [Eliminate 503 Misattribution and Quota False-Deadlock: Rebuild Bucket Scheduling, Custom Mapping Priority and Timeout Contract] (Fixes #3838, #3841, Ref #3821, #3827, #3840):
  • Root-cause fix for 503 misattribution (92.6% of all 5xx): Unified the internal rate-limit predicate into policy::is_internal_gateway_exhaustion as the single source of truth, and filled in the previously missed All accounts rate-limited (the old list only matched all accounts limited, causing local pool exhaustion to be misreported as upstream 503); also converged two other independently drifting implementations in rate_limit.rs and token_manager.rs. (Fixes #3838)
  • Dedicated 403 ban attribution: Added account_forbidden error code plus 12-language copy for TOS_VIOLATION / PERMISSION_DENIED, so a banned account is no longer conflated with capacity exhaustion after 403→503 remapping. (Fixes #3838)
  • Quota diagnosis upgraded to trust upstream authoritative signals: Added L1 locking that prefers the upstream quotaResetTimeStamp. All four quota bucket classes (Argon dedicated / Ultra shared / standard Gemini / 3P) carry it when exhausted, so trusting the official recovery instant is more reliable than local inference and immune to upstream copy changes; is_quota_depleted_signal is now case-insensitive, keeps check quota as the 1.5% bucket trigger, and explicitly excludes transient TPM throttling (preventing pool-wide cascading lockouts, Fixes #3506). (Fixes #3841)
  • Lock source ordered by hard-quota priority: Bucket predicate relaxed from “weekly only” to “any bucket in the matched group ≤ 1.5%”. A drained weekly locks until its own reset; only when weekly is healthy and solely 5h is drained do we lock the short 5h cycle — avoiding both re-probing every time 5h recovers while weekly is still zero, and locking a recoverable-in-minutes account for a whole day.
  • Fixed quota false-full blind spots: Handles upstream omitting remainingFraction for exhausted models (previously unwrap_or(100) read it as full), and unified multi-key tolerant quota matching across preferred accounts, sticky sessions and the 60s reuse window.
  • Quota scheduling closed loop: Blocked the whole-pool 0-quota bare-run escape; fixed the 3P path of accounts_with_positive_quota missing an available_models fallback, which let a single drained 3P model trip the 502 no quota accounts gate for the entire pool; quota-exhausted 429 responses are now passed through verbatim without gateway rewriting.
  • Eliminated priority-inversion starvation: Moved quota filtering ahead of priority convergence in select_with_p2c, establishing the invariant that “priority only competes among healthy accounts holding positive quota for the target model”. Fixes the severe defect where the pedal mode (or a manually boosted account) at priority=1 with 0% quota and zero in-flight would evict all other full-quota accounts and return “no available accounts”. (Ref #3840)
  • Model routing: user custom mapping takes absolute precedence: Custom mappings moved to the very front, ahead of official hot-update deprecation redirects; fixed the post-hoc resolve_bare_tiered_model_route rewrite that silently downgraded matched targets to tiered/medium; default tier selector flipped to prefer High (upstream medium/tiered are measured to be capacity-starved); added in-place promotion to High when upstream returns 503 MODEL_CAPACITY_EXHAUSTED.
  • Timeout contract: hard truncation removed, frontend/backend aligned: Abolished the 135s/160s hard-coded cap (below the measured medium p90 of 130.9s, which turned legitimately slow requests into 504 and triggered retry storms); first-byte baseline restored to 180s with multimodal ceiling widened to 270s; wired the frontend large-body replay threshold so the backend 4MB hardcode no longer drifts from the frontend 8MB setting.
• [Pedal Quota Mode Rebuilt as Highest Scheduling Priority] (PR #3840, Thanks to @zepeng-jin):
  • Brute-force suspension replaced by priority competition: Activating pedal mode no longer suspends other accounts via proxy_disabled = true; instead it boosts imminent accounts to scheduling priority 1 (default 50). Eliminates three pathologies at once: Prompt Caching invalidation from forced failover of ongoing sessions, 429s from crushing all concurrency onto a single account, and cross-model collateral damage from entity-level disabling. (PR #3840, Thanks to @zepeng-jin)
  • Concurrency resilience: Existing sessions stay bound to their accounts to preserve cache; new sessions fully prioritize burning the imminent account, with overflow spilling to other idle accounts.
  • Smooth automatic recovery: Once target accounts fully drain (0%) or reach their reset time, original priorities are restored precisely from originalPriorities; legacy suspended-state cleanup is retained for backward compatibility. (PR #3840, Thanks to @zepeng-jin)

---

• [根治 503 归因污染与配额假死：重构配额大桶调度、自定义映射优先级与超时契约] (Fixes #3838, #3841, Ref #3821, #3827, #3840):
  • 根除 503 归因污染（占全量 5xx 的 92.6%）: 统一收敛网关内部限流判据至 policy::is_internal_gateway_exhaustion 单一权威源，补全此前漏判的 All accounts rate-limited（旧列表只写 all accounts limited，导致本地账号池限流被误报为上游 503）；同步收敛 rate_limit.rs 与 token_manager.rs 中另两处独立漂移的判据实现。(Fixes #3838)
  • 新增 403 封禁专用归因: 为 TOS_VIOLATION / PERMISSION_DENIED 新增 account_forbidden 错误码与 12 语言文案，账号封禁不再被 403→503 映射后与容量枯竭混淆。(Fixes #3838)
  • 配额诊断升级为采信上游权威信号: 新增 L1 上游 quotaResetTimeStamp 优先锁定，四类配额桶（Argon 独立桶 / Ultra 共享大桶 / 普通 Gemini 大桶 / 3P 桶）耗尽时直接采信官方恢复时刻，比本地推算更可靠且不受上游改文案影响；is_quota_depleted_signal 统一判据大小写不敏感，保留 check quota 作为 1.5% 木桶触发入口并显式排除 TPM 瞬态限流（避免全池级联锁定，Fixes #3506）。(Fixes #3841)
  • 锁定源按硬配额优先排序: 桶判据由「仅 weekly」放宽为「命中分组内任意桶 ≤ 1.5%」，weekly 耗尽则锁 weekly reset，仅当 weekly 健康、只有 5h 耗尽时才锁 5h 短周期——既避免 5h 一恢复就去试而 weekly 仍为 0 造成反复调度，也避免把几十分钟可恢复的账号锁上一整天。
  • 修复配额假满额盲区: 处理上游对已耗尽模型直接省略 remainingFraction 的场景（原先 unwrap_or(100) 会读成满额），并在优先账号、会话粘性与 60s 复用窗口统一采用多键容错配额匹配。
  • 配额调度闭环: 封堵全池 0 配额裸奔放行漏洞；修复 accounts_with_positive_quota 的 3P 路径缺 available_models 兜底导致单个 3P 模型 0% 就让整池命中 502 no quota accounts 门禁的问题；100% 原样透传上游配额到期 429 响应，禁止网关改写。
  • 消除 0 配额高优账号饥饿全池（优先级倒置死锁）: 将 select_with_p2c 的配额过滤前置于优先级收敛，确立不变式「优先级只在具备该模型有效正配额的健康账号之间竞争」。修复蹬额度模式把临期账号设为 priority=1 后，该账号配额归零且空闲时会把其他满额账号剔除、进而 return None 报「无可用账号」的严重缺陷。(Ref #3840)
  • 模型路由：确立用户自定义映射最高优先级: 自定义映射提升至物理最前位，高于官方热更新淘汰重定向；修复映射命中后被后置 resolve_bare_tiered_model_route 二次篡改为 tiered/medium 的缺陷；默认档位选择器翻转为 High 优先（实测 medium/tiered 在上游处于容量枯竭状态）；新增上游 503 MODEL_CAPACITY_EXHAUSTED 原地升档 High 自愈能力。
  • 超时契约：解除硬截断，前后端闭环: 废除 135s/160s 超时硬编码截断（该值低于 medium 实测 p90 130.9s，会把本可成功的慢长请求反向判为 504 并引发重试风暴）；首字基准恢复 180s、多模态上限放宽至 270s；打通前端大请求体重放门限配置，消除后端硬编码 4MB 与前端 8MB 的双轨漂移。
• [蹬额度模式重构为最高调度优先级] (PR #3840, Thanks to @zepeng-jin):
  • 解除暴力禁用，改为优先级竞争: 激活蹬额度模式时不再通过 proxy_disabled = true 挂起其他账号，改为把临期账号调度优先级提升至 1（默认 50）。彻底消除三重症结：既有会话因强制 Failover 导致 Prompt Caching 击穿、多并发压在唯一账号上触发 429、以及账号实体级禁用造成跨模型误伤。(PR #3840, Thanks to @zepeng-jin)
  • 并发弹性保底: 老会话继续留在已绑定账号以保住缓存，新会话 100% 优先消耗临期账号，并发流量自动外溢至其他空闲账号。
  • 平滑自动恢复: 待蹬账号周配额全部消耗（0%）或到达重置时间后，按 originalPriorities 精准恢复初始优先级；并保留旧版本残留挂起状态的容错清理逻辑。(PR #3840, Thanks to @zepeng-jin)

What's Changed

• fix(proxy): 放宽长上下文大请求体跨账号重放护栏门槛至4MB并提升上限至3次 (Fixes #3821, Ref #3835) by @cubelikeplayDaniel in #3839
• fix(pedal): 重构蹬额度模式为最高调度优先级，消除会话粘性破坏与多会话并发挤兑 by @zepeng-jin in #3840

Full Changelog: v5.0.3-beta.2...v5.0.3-beta.3

Antigravity Tools v5.0.3-beta.2

• [Fix Primary Daily Endpoint Jitter Leading to Sandbox Fallback Endpoint Poisoning] (Fixes #3827, PR #3833, Thanks to @modded-soldier-9):
  • Sandbox Endpoint Isolation & Anti-Leapfrog Priority Partitioning: Introduced sandbox endpoint detection and partitioned sorting so daily-cloudcode-pa.sandbox.googleapis.com never leapfrogs primary Daily endpoints due to health stats; eliminates accidental account poisoning and false 504 Gateway Timeouts triggered when non-US proxies receive 400 (User location is not supported) from sandbox endpoints. (Fixes #3827, PR #3833, Thanks to @modded-soldier-9)
  • Sandbox 400 Degradation & Extended Cooldown: Reclassified sandbox 400 errors as eligible for next-endpoint rotation with an enforced minimum 300-second cooldown penalty, preventing repetitive fallback cascades.
• [Fix Classic Client Credential Sync Missing Fallback Files and State Dual-Write] (Fixes #3829, PR #3834, Thanks to @modded-soldier-9):
  • Unified Credential Dual-Write across Classic and IDE Modes: Fixed an issue where switching accounts in Classic mode (target_ide == "classic") prompted for re-authentication on desktop restart; unified the fallback credential writer (jetski-standalone-oauth-token) to apply seamlessly across both Classic and IDE runtimes. (Fixes #3829, PR #3834, Thanks to @modded-soldier-9)
  • Safe SQLite Atomic Backup and State Ingestion: When state.vscdb is present in the Classic data directory, atomically backs up the database and dual-writes the authentication token and serviceMachineId to maintain strict state parity.
• [Enterprise & GCP Vertex AI Project ID Management and Auto-Discovery] (Fixes #3823):
  • Visual GCP Project ID Configuration & Persistence: Added a dedicated Project ID setting within the Account Details modal, allowing users to inspect, manually set, or modify the linked Google Cloud Project ID for Enterprise/GCP accounts, synchronously persisted to local credentials and gateway memory.
  • One-Click Auto-Fetch Project ID: Implemented the auto_fetch_account_project_id command with an "Auto Fetch" button in the GUI, automatically querying loadCodeAssist to discover and associate the account's upstream cloudaicompanionProject.
  • Proxy Pool Integration & Timeout Hardening: Relaxed the query timeout from an aggressive 3 seconds to 12 seconds and routed requests through the global ProxyPool, ensuring high reliability across proxies and international latency variations.
  • Precise Enterprise Tier Classification: Fixed an issue where the built-in standard client key (antigravity_enterprise) or legacy is_gcp_tos flags mistakenly caused personal accounts to be classified as ENTERPRISE, strictly reserving the tier for true antigravity_gcp clients and authoritative subscription levels.
  • Comprehensive 12-Language i18n: Added complete translations for the Project ID controls, descriptions, placeholders, and status toasts across 12 languages (AR, EN, ES, JA, KO, MY, PT, RU, TR, VI, ZH, ZH-TW).
• [Fix Responses Protocol Multimodal Sliding Window Ingress Guard, Payload Audit Redaction, and Token Estimation] (PR #3830, Thanks to @mclinyeshi):
  • Bypass Cumulative Image Byte Interception when Sliding Window is Active: Fixed an issue where enabling the multimodal sliding freshness window (enable_sliding_window = true) still triggered an ingress HTTP 400 rejection if historical, unpruned images accumulated beyond 32MB; cumulative payload limits are now cleanly deferred to pipeline sliding window pruning while retaining single-image limits (>20MB), preventing multimodal Agent sessions (e.g. Codex) from being falsely blocked at entry. (PR #3830, Thanks to @mclinyeshi)
  • Comprehensive Responses Base64 Image Audit Redaction: In simple audit mode, recursively sanitized inline Data URLs, input_image blocks, and function_call_output images into lightweight placeholders ([base64 image: xxx bytes]), preventing SQLite database bloating and UI sluggishness during multiround image inspection tasks. (PR #3830, Thanks to @mclinyeshi)
  • Responses Multimodal Visual Token Estimation: Added native Responses payload parsing in PipelineTokenEstimator, correctly converting multimodal images into visual tokens and preventing token underestimation from skewing pipeline timeout budgets. (PR #3830, Thanks to @mclinyeshi)
• [Fix Long-Context Conversations Mistakenly Triggering Cowork Auto-Compaction & Experiment Matrix] (Fixes #3821, Ref #3826, PR #3835, PR #3836, Thanks to @cubelikeplayDaniel):
  • Align Configured Auto-Compaction Guard with Tool Turn Ingress: Removed the one-size-fits-all 1M exemption and premature tool interruptions, ensuring authentic Cowork sessions containing tool results trigger self-healing auto-compaction strictly per GUI-configured effective_threshold; resolved an issue where upload budgets were clipped by TTFT offsets for large payloads. (Fixes #3821, Ref #3826, PR #3835, Thanks to @cubelikeplayDaniel)
  • Full-Chain 10-Case Dual-Track Control Experiment Matrix: Added test_cowork_10_control_experiment_matrix unit tests thoroughly asserting 5 oversize clipping conditions and 5 safe passthrough conditions, ensuring gateway guards stay 100% consistent with configuration thresholds. (Fixes #3821, Ref #3826, PR #3836, Thanks to @cubelikeplayDaniel)

---

• [主端点偶发抖动沙箱降级抢占导致的端点毒化修复] (Fixes #3827, PR #3833, Thanks to @modded-soldier-9):
  • 沙箱端点隔离与防抢占排序: 在上游端点调度中引入沙箱端点探测与分区保护机制，确保 daily-cloudcode-pa.sandbox.googleapis.com 永不因统计权重抢占 Daily 主端点，根除跨区 IP 触发 400（User location is not supported）后导致的整号熔断与 504 误判问题。(Fixes #3827, PR #3833, Thanks to @modded-soldier-9)
  • 沙箱 400 容错与长冷却降级: 沙箱端点返回 400 时允许继续轮询下一个健康端点，并自动施加至少 300 秒长冷却惩罚，避免次级端点连续抖动。
• [经典版一键切号遗漏本地降级凭据及状态双写修复] (Fixes #3829, PR #3834, Thanks to @modded-soldier-9):
  • 经典版与 IDE 凭据双写平权: 修复在 Antigravity 经典版（classic）下一键切号后重启客户端再次提示需登录认证的问题；统一经典版与 IDE 版的本地降级凭据（jetski-standalone-oauth-token）写入逻辑。(Fixes #3829, PR #3834, Thanks to @modded-soldier-9)
  • 本地 SQLite 状态安全双写与原子备份: 若经典版用户数据目录中存在 state.vscdb，执行原子备份并在数据库中安全注入 token 与 serviceMachineId，实现状态严格双写。
• [企业与 GCP Vertex AI Project ID 智能绑定与一键自动获取] (Fixes #3823):
  • GCP Project ID 可视化管理与持久化: 在账号详情弹窗中新增 Project ID 设置项，支持为企业及 GCP 账号查看、手动配置或更换绑定的 Google Cloud 项目 ID，并原子更新至账号凭据存储与代理调度器。
  • 一键自动请求获取 Project ID: 新增 auto_fetch_account_project_id 命令与前端「自动获取」按钮，调用上游 loadCodeAssist 自动嗅探并关联账号真实的 cloudaicompanionProject，极大简化企业账号接入流程。
  • 健壮的代理池链路与超时优化: 优化 Project ID 获取逻辑，将原 3 秒过短硬编码超时放宽至 12 秒，并全面接入全局代理池（ProxyPool），确保网络抖动与跨国出口代理环境下 100% 稳定解析。
  • 等级识别精准校准: 修复企业号识别中误将内置标准客户端（antigravity_enterprise）或历史遗留 is_gcp_tos 脏标记当作企业号导致普通账号被误标为 ENTERPRISE 的缺陷，严格按官方 antigravity_gcp 客户端及权威套餐返回收敛。
  • 12 种主流语言多语言补齐: 为 Project ID 字段、提示说明与自动获取状态（获取中/成功/失败）补齐了中英日繁韩西葡俄土越阿缅等全量 12 种语言本地化翻译。
• [修复 Responses 协议多模态滑窗入口误杀、简要日志脱敏与 Token 估算] (PR #3830, Thanks to @mclinyeshi):
  • 滑窗启用时豁免入口多图硬拦截: 修复在开启多模态滑动窗口（enable_sliding_window = true）时，网关入口因未裁剪的历史累计图片超过 32MB 硬上限而提前返回 400 阻断的缺陷；现在开启滑窗时安全放行累积历史图片（单张 >20MB 校验仍然生效），统一交由后续管线滑动窗口执行裁剪，避免 Codex 等多模态 Agent 长对话误杀。(PR #3830, Thanks to @mclinyeshi)
  • 补齐 Responses 简要日志 Base64 脱敏: 在简要日志（simple）审计模式下，对 /v1/responses 的 input_image、内联 Data URL 以及工具输出（function_call_output）递归执行 Base64 占位脱敏（[base64 image: xxx bytes]），彻底解决长程看图任务导致本地数据库膨胀与前端视图卡顿的问题。(PR #3830, Thanks to @mclinyeshi)
  • 补齐 Responses 协议视觉 Token 估算: 在管线 Token 估算器中补齐 Responses 格式分支，正确识别多模态图片并按视觉 Token 标准统一折算，防止多模态请求 Token 估算失真影响管线超时预算。(PR #3830, Thanks to @mclinyeshi)
• [修复普通长文本对话误触发 Cowork 自动压缩与对照实验矩阵] (Fixes #3821, Ref #3826, PR #3835, PR #3836, Thanks to @cubelikeplayDaniel):
  • 对齐配置自愈门禁与工具轮次放行: 移除 1M 模型一刀切硬豁免与工具中途阻断，确保包含工具返回的真实 Cowork 会话在超限时能够按配置的有效阈值（effective_threshold）精准触发自愈压缩；修复大请求体上传预算计算中的首字节倒扣截断缺陷。(Fixes #3821, Ref #3826, PR #3835, Thanks to @cubelikeplayDaniel)
  • 全链路 10 次双轨对照实验矩阵: 新增 test_cowork_10_control_experiment_matrix 单元测试，全面覆盖 5 次超大截断与 5 次安全放行矩阵，保障 Cowork 门禁与配置阈值契约一致性。(Fixes #3821, Ref #3826, PR #3836, Thanks to @cubelikeplayDaniel)

What's Changed

• fix(claude): 修复普通长文本对话误触发 Cowork 自动压缩 400 假限额报错 (Ref #3821) by @cubelikeplayDaniel in #3828
• fix(proxy,responses): 修复 Responses 协议多模态滑窗入口误杀、简要日志 Base64 膨胀与 Token 估算异常 by @mclinyeshi in #3830
• Revert "fix(claude): 修复普通长文本对话误触发 Cowork 自动压缩 400 假限额报错 (Ref #3821)" by @cubelikeplayDaniel in #3831
• fix(claude): 移除1M豁免并放行工具轮次确保Cowork按配置阈值自愈压缩 (Fixes #3821, #3826) by @cubelikeplayDaniel in #3835
• test(claude): 补充Cowork自动压缩与防误杀10次双轨对照实验矩阵单测 (Fixes #3821, Ref #3826) by @cubelikeplayDaniel in #3836
• fix(proxy/upstream): 修复主端点偶发抖动沙箱降级抢占导致的端点毒化 (Fixes #3827) by @modded-soldier-9 in #3833
• fix(desktop/integration): 修复经典版切号遗漏本地降级凭据及状态双写导致重新认证 (Fixes #3829) by @modded-soldier-9 in #3834

New Contributors

• @mclinyeshi made their first contribution in #3830

Full Changelog: v5.0.3-beta.1...v5.0.3-beta.2

Antigravity Tools v5.0.3-beta.1

• [Official GCP Vertex AI Enterprise Account Support & Adaptive Credential Isolation] (Fixes #3823):
  • Aligned with Official GCP Enterprise OAuth Credentials: Reverse-engineered and matched the official Antigravity application architecture for GCP / Vertex AI enterprise authorization, integrating the official GCP enterprise client (884354919052-...) under antigravity_gcp. Completely resolves the issue where enterprise accounts were misidentified as Free Tier or lost access to Vertex AI project quotas. (Fixes #3823)
  • Strict Backward Compatibility for Legacy Accounts: Credentials strictly differentiate via token.oauth_client_key and is_gcp_tos; legacy accounts with custom domain emails (e.g. @imsot.org) previously authorized via the personal client retain 100% personal-mode refresh compatibility, preventing Google 400 invalid_grant errors caused by naive domain-based client switching.
  • Top-Level Account Type Selector Across All Import Modes with Full i18n: Redesigned the Add Account dialog by hoisting the "Personal Account" vs. "Enterprise / GCP (Vertex AI)" type switcher to the top-level common area across OAuth, Refresh Token, and DB import modes; added complete translations across 12 languages including JA, ZH-TW, KO, ES, PT, RU, TR, VI, AR, and MY. (Fixes #3823)
  • IDE Database Injection & Adaptive Refresh Integration: Accurately toggles Protobuf Field 6 (is_gcp_tos) and maps the Vertex AI project when injecting credentials into the Antigravity IDE SQLite store (state.vscdb); ensures token refresh strictly honors the originating client descriptor.
• [Fix Quiet Autostart Still Showing Window and Sync Autostart Config] (Fixes #3820, Thanks to @W2514):
  • Defensive Startup Argument Substring Matching: Resolved an issue where quoted or concatenated startup parameters from certain Windows Run registry keys, shortcuts, or Task Scheduler instances failed strict equality comparisons (== "--minimized"), erroneously triggering an interactive window presentation on login; reinforced the check with substring pattern matching (lower.contains("--minimized") || lower.contains("--silent") || lower.contains("--hidden")), ensuring quiet login launch consistently stays in the system tray. (Fixes #3820, Thanks to @W2514)
  • Atomic Autostart State Persistence: Synchronously updated and persisted config.auto_launch to the app configuration file whenever toggling autostart via toggle_auto_launch, eliminating state drift between UI controls and OS registry entries. (Fixes #3820)
• [Default Multimodal Sliding Window & Automatic 403 Validation Circuit Breaking] (Fixes #3824):
  • Aligned with Official Antigravity Multimodal Pruning: Reverse-engineered and matched the official Antigravity app's image cleanup behavior by enabling the multimodal sliding freshness window by default (enable_sliding_window = true) and keeping the latest 5 images (max_fresh_images = 5). Prevents multiround conversations from accumulating dozens of images, inflating request payloads to multi-megabytes, and triggering upload congestion or 504 Gateway Timeouts. (Fixes #3824)
  • Relaxed Adaptive Upload Bandwidth Floor: Lowered the minimum upload speed baseline from 2.0 Mbps to 0.8 Mbps to offer higher tolerance for slow proxies and volatile cross-border networks during large payload uploads.
  • Full-Chain Circuit Breaking & Session Unbinding for 403 Challenges: Fixed an issue where encountering Google's VALIDATION_REQUIRED challenge failed to unbind sticky sessions or filter snapshot pools, causing repeated client retries to deadlock on the same failing account. Sticky sessions are now immediately severed (session_accounts.remove), and pool selection automatically fails over to healthy accounts.
  • Automatic Proxy Disabling on 403: Synchronously marks the account as proxy_disabled = true upon validation failure, immediately reflecting the disabled state on the GUI and cleanly removing it from proxy rotation.
• [Client-Safe Gateway Timeout Clamping and Session Affinity Release on Terminal Failures] (Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel):
  • Client-Safe Timeout Hard Ceiling: Introduced MAX_CLIENT_SAFE_TOTAL_BUDGET_SECS = 160s across the entire upstream call pipeline. Resolved an issue where long requests combining multimodal media offsets and multi-endpoint fallbacks ballooned to 190s~256s, exceeding client-side 180s watchdogs (such as JeikCode) and severing the connection into orphan canceled requests; guarantees a ≥20s safe window so the gateway always delivers a structured 504 error before the client disconnects. (Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)
  • First-Byte Budget Baseline and Media Cap Tightening: Clamped MAX_FIRST_BYTE_BUDGET_SECS to 135s and the media-augmented ceiling MAX_FIRST_BYTE_CEILING_SECS to 145s; aligned the 200k+ large-context adaptive TTFT floor to 135s. (Fixes #3821, Thanks to @jeikl)
  • Primary Endpoint First-Byte Grace: Corrected reserve_for_fallback deduction so only secondary fallback endpoints (idx > 0) have 1/3 of the budget withheld; the primary endpoint (idx == 0) now receives full first-byte generation time, fulfilling the original intent for large-context and deep-reasoning models. (Fixes #3821, Thanks to @jeikl)
  • Session Affinity Release on Terminal Failures: Extended pipeline::terminal::TerminalDisposition to include FirstByte, Upload, and GlobalBudget in abandon_sticky_account; upstream queuing timeouts or upload stall interruptions immediately unbind session affinity so subsequent client retries automatically balance to healthy accounts across the pool, eliminating multi-round 3-minute lockups on a single stalled account. (Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)
  • Phased Timeout Diagnosis and Stream Silence Clamping: Corrected timeout classification in send_with_phased_budget so post-upload timeouts accurately report stage=await_first_byte; clamped transition_secs and streaming_sliding_secs in StreamLifecycleConfig to the global request remaining budget. (Fixes #3821, Thanks to @jeikl)
  • Regression Testing: Updated terminal affinity-release assertions and client timeout envelope tests; all 6 terminal::tests and 17 client::tests pass cleanly. (Fixes #3821)

---

• [官方 GCP Vertex AI 企业账号支持与多协议凭据自适应隔离] (Fixes #3823):
  • 对齐官方 GCP 企业客户端凭据: 深度逆向对齐官方 Antigravity 应用的 GCP / Vertex AI 企业授权协议架构，引入官方企业客户端（884354919052-...）及密钥体系，支持通过 antigravity_gcp 独立注册与动态鉴权，彻底解决企业组织账号授权后被误判为 Free Tier 或缺失 Vertex AI 项目配额的缺陷。(Fixes #3823)
  • 存量凭据数据严格向下兼容: 账号凭据严格通过 token.oauth_client_key 与 is_gcp_tos 区分；存量使用个人版官方客户端授权的自定义域名企业邮箱（如 @imsot.org）100% 保持个人模式平滑刷新，杜绝因仅凭邮箱后缀切换客户端导致 Google 报 400 invalid_grant 的风险。
  • 添加账号全模式多语言支持: 重构前端添加账号弹窗，将“个人账号 (Personal)”与“企业 / GCP (Vertex AI)”账号类型切换器提升至公共顶层区域，统一覆盖 OAuth 授权、Refresh Token 批量录入及本地 DB 导入全场景；并同步补齐了中英日繁韩西葡俄土越阿缅等 12 种主流语言的完整本地化翻译。(Fixes #3823)
  • IDE 状态数据库与自适应刷新注入: 在向本地 Antigravity IDE 数据库（state.vscdb）注入凭据时，根据客户端类型精准控制 Protobuf Field 6（is_gcp_tos）与 Vertex AI 项目映射；刷新机制自适应账号所属凭据类型，杜绝跨模式客户端混用。
• [修复免打扰模式开机自启仍弹出界面与自启状态同步] (Fixes #3820, Thanks to @W2514):
  • 启动项参数防御性模糊匹配: 修复部分 Windows 启动项（注册表或快捷方式/任务计划）拼接参数或带引号导致启动入参无法被 == "--minimized" 精准全等匹配、从而错将开机自启识别为普通前台启动而弹出主窗口的缺陷；增强入参检测逻辑支持模糊包含匹配（lower.contains("--minimized") || lower.contains("--silent") || lower.contains("--hidden")），确保免打扰启动 100% 稳定留在系统托盘。(Fixes #3820, Thanks to @W2514)
  • 开机自启动配置状态原子同步: 在 toggle_auto_launch 注册/注销系统自启动项时，同步将 config.auto_launch 原子持久化写入应用配置文件，消除前端界面配置与底层操作系统注册表之间的状态脱节。(Fixes #3820)
• [多模态保鲜滑窗默认启用与风控 403 粘性熔断自动禁用] (Fixes #3824):
  • 对齐官方多模态保鲜滑窗规范: 深度逆向对齐官方 Antigravity 应用的旧图清理与尺寸收敛机制，将网关的多模态保鲜滑动窗口设为默认开启（enable_sliding_window = true），默认保留最新 5 张图片（max_fresh_images = 5）；彻底杜绝在长对话中多轮历史图片累积导致请求体线性膨胀至数兆、引发上传堵塞及 504 Gateway Timeout 的硬伤。(Fixes #3824)
  • 上传速度自适应基准放宽: 将默认最低上传带宽基准由 2.0 Mbps 宽限至 0.8 Mbps，增强慢速代理与复杂跨国网络环境下大图与附件上传的预算容忍度。
  • 403 人机验证阻断全链熔断与解绑: 修复遇到 Google VALIDATION_REQUIRED 人机验证挑战时，粘性会话与调度快照未做阻断校验导致客户端多次重试死锁在同一故障账号的缺陷；现在检测到人机验证阻断后，立即强制解除会话粘性绑定（session_accounts.remove），并在快照生成与固定账号选择中无缝降级迁移至池中健康账号。
  • 403 自动触发禁用反代: 发生 403 验证阻断时，同步调用 toggle_proxy_status 将账号标记为 proxy_disabled = true，使账号即刻在前端直观呈现停用状态并彻底退出反代调度池。
• [网关超时全链路预算安全截断与终态会话粘性解绑] (Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel):
  • 客户端安全超时绝对硬顶: 引入 MAX_CLIENT_SAFE_TOTAL_BUDGET_SECS = 160s 全链路安全硬上限；解决此前长文本结合多模态增量与多端点重试时总预算累加膨胀至 190s~256s 击穿下游客户端（如 JeikCode）180s 内置看门狗导致连接被强行切断为 canceled 孤儿请求的问题，为客户端看门狗预留出至少 20s 的安全缓冲，确保网关永远早于客户端吐出标准的结构化 504 响应。(Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)
  • 首字预算基准与媒体上限压制: 将上游首字节等待预算基准 MAX_FIRST_BYTE_BUDGET_SECS 压制至 135s，媒体增量上限 MAX_FIRST_BYTE_CEILING_SECS 压制至 145s；200k+ 超大上下文自适应 TTFT 下限同步对齐至 135s。(Fixes #3821, Thanks to @jeikl)
  • 主端点首字节宽限免预留扣减: 修正 reserve_for_fallback 逻辑，仅在备用端点（idx > 0）尝试时预扣 1/3 预算，首选主端点（idx == 0）享有完整的首字节生成时间，兑现长上下文与深度思考模型的生成宽限初衷。(Fixes #3821, Thanks to @jeikl)
  • 终态全量解绑会话粘性: 扩展 pipeline::terminal::TerminalDisposition，将 FirstByte、Upload 与 GlobalBudget 终态全部纳入 abandon_sticky_account；上游排队超时或上传网络停滞中断时，立即解除当前会话对该账号的强绑定，使客户端下一次重试自动切换到号池中的健康账号，彻底消除卡在同一慢账号死循环等满多轮 3 分钟的死锁。(Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)
  • 阶段耗尽口径纠正与流式静默夹持: 修正 send_with_phased_budget 中的超时判定，上传完成后的超时精准归类为 stage=await_first_byte；StreamLifecycleConfig 中的 transition_secs 与 streaming_sliding_secs 同样受限于全局请求剩余预算，杜绝流内静默越界。(Fixes #3821, Thanks to @jeikl)
  • 单元测试与验证全绿: 补齐并更新 terminal 粘性解绑断言与 client 预算包线单测，terminal::tests 6/6 通过，client::tests 17/17 全部通过。(Fixes #3821)

What's Changed

• fix(proxy): 网关超时全链路预算安全截断与终态会话粘性解绑 (Fixes #3821) by @cubelikeplayDaniel in #3822

Full Changelog: https://gith...

Antigravity Tools v5.0.3-beta.0

• [Unified Streaming Lifecycle Across Protocols: Codex/Legacy Adopt the Pipeline, Gemini Gains Thinking-Phase Awareness] (Ref #3816, PR #3817, Thanks to @cubelikeplayDaniel):
  • Codex / Legacy Converged onto the Shared Lifecycle: Replaced the hand-rolled select! drivers in create_codex_sse_stream and create_legacy_sse_stream with ProtocolStreamHandler adapters driven by run_stream_lifecycle, centralizing 3s heartbeats, initial-TTFT grace, thinking/streaming phase promotion, steady-state sliding timeouts, and abnormal finalization. Removed the duplicated phase state machines and timeout branches while preserving Responses event streams, text_completion frames, tool-call caching, grounding citations, and session-persistence acknowledgements. (Ref #3816, PR #3817, Thanks to @cubelikeplayDaniel)
  • Generic Termination Hooks in the Pipeline: Added optional emit_error_finalize, finalize_without_content, and finalize_barrier hooks so Codex's error + response.failed, Legacy's error frame + single [DONE], thinking-only EOF response.incomplete, and "emit response.completed only after session persistence succeeds" contracts remain unchanged after the migration. (Ref #3816, PR #3817)
  • Gemini Thinking-Phase Awareness: Added is_thinking_active tracking to GeminiStreamHandler so thinking blocks, visible text, tool calls, and finishReason correctly drive InitialTtft → Thinking → Streaming/Transition, preventing thinking periods from being misclassified as a transition cliff. (Ref #3816, PR #3817)
  • Regression Coverage: Added Legacy normal/error single-[DONE] tests and a Gemini thinking-phase transition test; all 22 OpenAI streaming, 6 Gemini streaming, and 10 lifecycle tests pass. (Ref #3816, PR #3817)

---

• [四协议流式生命周期统一：Codex/Legacy 接入流水线，Gemini 补齐思考阶段] (Ref #3816, PR #3817, Thanks to @cubelikeplayDaniel):
  • Codex / Legacy 收敛至统一生命周期: 将 create_codex_sse_stream 与 create_legacy_sse_stream 由手写 select! 驱动改为 ProtocolStreamHandler 适配器，统一交由 run_stream_lifecycle 接管 3s 心跳、首字宽限、思考/正文阶段跃迁、稳态滑动超时与异常收尾；删除两套重复的 phase 状态机与超时分支，保留 Responses 事件流、text_completion 帧、工具调用缓存、grounding 引文与会话落盘 ack 语义。(Ref #3816, PR #3817, Thanks to @cubelikeplayDaniel)
  • 流水线通用终止钩子: 新增 emit_error_finalize、finalize_without_content 与 finalize_barrier 三个可选钩子，使 Codex 的 error + response.failed、Legacy 的错误帧 + 单次 [DONE]、思考-only EOF 的 response.incomplete 以及落盘成功后再下发 response.completed 等协议契约在接入流水线后保持完全一致。(Ref #3816, PR #3817)
  • Gemini 思考阶段补齐: 为 GeminiStreamHandler 增加 is_thinking_active 状态，思考块、正文、工具调用与 finishReason 可正确驱动 InitialTtft → Thinking → Streaming/Transition 阶段机，避免思考期被误判为过渡断崖。(Ref #3816, PR #3817)
  • 回归测试覆盖: 新增 Legacy 正常收尾/异常中断单次 [DONE] 用例与 Gemini 思考阶段迁移用例；OpenAI 22 项、Gemini 6 项、流水线生命周期 10 项定向测试全部通过。(Ref #3816, PR #3817)

Full Changelog: v5.0.2-beta.9...v5.0.3-beta.0

Antigravity Tools v5.0.2-beta.9

• [Codex / Responses Stream Transition-Cliff Adaptive Promotion and First-Byte Budget Expansion] (Fixes #3816, PR #3817, Thanks to @mclinyeshi, @cubelikeplayDaniel):
  • Transition Cliff Adaptive Promotion and Heartbeat Keep-Alive: Resolved a critical issue in Codex Desktop calling deep reasoning models like gemini-4-argon-high, where upstream pauses streaming while buffering monolithic functionCall payloads (such as large scripts or diagrams) after thinking output, causing the gateway to prematurely terminate the connection at the 120-second steady-state timeout and resulting in false HTTP 200 empty responses followed by client reconnect loops; introduced state-aware lifecycle tracking (InitialTtft -> Thinking/Streaming -> Transition) to create_codex_sse_stream and create_legacy_sse_stream, automatically promoting to the Transition phase upon steady-state silence, granting an independent transition_secs (180s) grace window, and streaming continuous : ping\n\n heartbeats to keep the downstream connection alive while upstream completes full buffer synthesis. (Fixes #3816, PR #3817, Thanks to @mclinyeshi, @cubelikeplayDaniel)
  • First-Byte Budget Ceiling Expansion: Raised MAX_FIRST_BYTE_BUDGET_SECS from 150s to 180s, preventing massive-context prefill requests under peak upstream load from exhausting the initial byte budget too early and triggering unnecessary fallback retries culminating in 504 Gateway Timeout. (Fixes #3816, PR #3817, Thanks to @mclinyeshi, @cubelikeplayDaniel)
  • Regression Test Coverage: Added the test_codex_stream_survives_transition_cliff_after_thinking unit test, simulating post-reasoning monolithic tool buffering to verify that the stream survives the silence gap and delivers response.completed cleanly. (PR #3817, Thanks to @cubelikeplayDaniel)

---

• [Codex / Responses 流式过渡断崖自适应跃迁与首字超时预算扩容] (Fixes #3816, PR #3817, Thanks to @mclinyeshi, @cubelikeplayDaniel):
  • 过渡断崖自适应跃迁与心跳保活: 修复 Codex Desktop 调用 gemini-4-argon-high 等深思考模型在输出思考块后，上游整包缓冲巨型 functionCall（如复杂代码或思维导图文件）引发长静默时，网关单方面在 120 秒稳态超时截断连接导致 HTTP 200 无输出并触发客户端频繁重连的硬伤；为 create_codex_sse_stream 与 create_legacy_sse_stream 引入状态机阶段追踪，在检测到思考或前导文本后的长静默时自动跃迁至 Transition 阶段，赋予独立的 transition_secs (180s) 宽限期并持续发送 : ping\n\n 保活连接，给予上游充足时间完成巨型工具调用的整包生成。(Fixes #3816, PR #3817, Thanks to @mclinyeshi, @cubelikeplayDaniel)
  • 首字节预算硬上限扩容: 将上游首字节等待预算基准硬上限 MAX_FIRST_BYTE_BUDGET_SECS 由 150 秒提升至 180 秒，避免超大上下文 Prefill 且首选端点排队时过早耗尽首字预算触发多端点重传放大并在最后抛出 504 Gateway Timeout。(Fixes #3816, PR #3817, Thanks to @mclinyeshi, @cubelikeplayDaniel)
  • 回归测试覆盖: 补齐 test_codex_stream_survives_transition_cliff_after_thinking 单元测试，模拟思考后上游长静默整包下发工具调用场景，确保流式驱动器成功跃迁并完整交付 response.completed。(PR #3817, Thanks to @cubelikeplayDaniel)

What's Changed

• fix(proxy,codex): 修复 Codex/Responses 流式过渡断崖误判超时导致 200 无输出及首字预算硬上限截断 (Fixes #3816) by @cubelikeplayDaniel in #3817

Full Changelog: v5.0.2-beta.8...v5.0.2-beta.9

Antigravity Tools v5.0.2-beta.8

• [3P Quota Decoupling and Unauthorized Slot Blanks, Eliminating Phantom Quotas] (Fixes #3809, Ref #3811, PR #3812, Thanks to @cubelikeplayDaniel):
  • Capability-Gated Frontend Blanks: Added actual model authorization checks to getGroupQuotaSummaries; accounts with no usable Claude / 3P models now return empty values so quota cards render the standard - placeholder, removing the false 100% saturation caused by idle upstream 3P quota groups; dashboard averages, bottleneck extraction, and the 5H best-account ranking now skip accounts without 3P capability, safely showing - instead of errors when no account qualifies. (Fixes #3809, PR #3812, Thanks to @cubelikeplayDaniel)
  • Backend Phantom-Quota Isolation: fetch_quota_with_cache now strips generic 3P quota groups when an account has no usable Claude / GPT models; Account::update_quota performs defensive cleanup of legacy records so stale on-disk quotas cannot resurrect; token_manager validates real authorization during bucket event sync to prevent phantom data from propagating downstream. (Fixes #3809, Ref #3811, PR #3812, Thanks to @cubelikeplayDaniel)
  • Regression Coverage: Added the frontend claudeQuotaSanitize suite and the Rust test_update_quota_purges_phantom_3p_groups_when_no_claude_or_gpt_models test covering blanks without 3P models, normal listings, and fully disabled model isolation. (PR #3812, Thanks to @cubelikeplayDaniel)
• [Quota Auto-Refresh Default Tightened to 10 Minutes] (Fixes #3809, PR #3814, Thanks to @cubelikeplayDaniel):
  • Atomic Default Alignment: Lowered refresh_interval from 15 to 10 minutes in both AppConfig::new() and the settings form defaults, reducing local state lag after quota consumption and window resets. (Fixes #3809, PR #3814, Thanks to @cubelikeplayDaniel)
• [Inbound Model Gate Documentation Alignment and Ordering Regression Test] (Ref #3815):
  • Clarified Retired-Family Scope: Corrected the is_retired_model_id docs — the hard gate applies to the final mapped egress model, so retired names remain valid as inbound alias keys pointing to compliant models; documented that downstream_exposed_models needs no alias registration because aliases are resolved before gating. (Ref #3815)
  • Locked Map-Before-Judge Ordering: Added a regression test covering exact, dotted-version canonicalization, and wildcard alias paths to prevent future refactors from moving the retired check ahead of custom mapping and killing user aliases again. (Ref #3815)

---

• [3P 配额解耦与无授权留空，杜绝虚假满额与幽灵配额] (Fixes #3809, Ref #3811, PR #3812, Thanks to @cubelikeplayDaniel):
  • 前端能力准入留空: 在 getGroupQuotaSummaries 中增加实际授权模型校验，账号在 Claude / 3P 分组下无任何可用模型时返回空值，驱动配额卡片统一渲染占位符 -，消除上游空转配额组造成的虚假 100% 满额；大盘均值、短板提取与 5H 最优账号推荐同步跳过无 3P 能力账号，全池无可用账号时安全展示 - 而非报错。(Fixes #3809, PR #3812, Thanks to @cubelikeplayDaniel)
  • 后端幽灵配额隔离: fetch_quota_with_cache 在账号实际可用模型不含任何 Claude / GPT 模型时主动剥离通用 3P 配额组；Account::update_quota 增加历史防御清理，避免旧数据反序列化复活虚假配额；token_manager 配额桶事件同步校验真实授权，杜绝幽灵数据向下游广播。(Fixes #3809, Ref #3811, PR #3812, Thanks to @cubelikeplayDaniel)
  • 回归测试覆盖: 新增前端 claudeQuotaSanitize 测试与 Rust test_update_quota_purges_phantom_3p_groups_when_no_claude_or_gpt_models，覆盖无 3P 模型留空、正常模型展示与纯禁用模型隔离。(PR #3812, Thanks to @cubelikeplayDaniel)
• [配额自动刷新默认间隔收敛至 10 分钟] (Fixes #3809, PR #3814, Thanks to @cubelikeplayDaniel):
  • 前后端默认值原子对齐: 将全局 AppConfig::new() 与设置页表单状态的 refresh_interval 默认值由 15 分钟调整为 10 分钟，缩短配额消耗与窗口重置后的本地状态同步延迟。(Fixes #3809, PR #3814, Thanks to @cubelikeplayDaniel)
• [入站模型门禁文档口径更正与顺序回归测试] (Ref #3815):
  • 厘清已下线判定对象: 更正 is_retired_model_id 文档——硬门禁作用于映射后的最终出站模型，已下线旧名允许作为入站别名键指向合规模型；同步补充 downstream_exposed_models 说明，别名经映射解析后即可放行，无需登记进门禁放行集合。(Ref #3815)
  • 锁定先映射后判定顺序: 新增回归测试覆盖精确 / 点号规范化 / 通配符三条自定义别名路径，防止后续重构把已下线判定重新前置而误杀用户别名。(Ref #3815)

What's Changed

• fix(quota,dashboard): 3P模型解耦与无授权留空，杜绝虚假满额与报错 (Fixes #3809, Ref #3811) by @cubelikeplayDaniel in #3812
• fix(config): 将自动刷新配额默认间隔调整为10分钟 (Fixes #3809) by @cubelikeplayDaniel in #3814

Full Changelog: v5.0.2-beta.7...v5.0.2-beta.8

Antigravity Tools v5.0.2-beta.7

• [Gemini Native Stream Interruption Root-Cause Transparency & Premature EOF Diagnostics] (Fixes #3813):
  • Official Standard finishMessage Diagnostic Forwarding: Resolved the issue where native Gemini streams encountering connection drops (e.g. error reading a body from connection or idle timeouts) after partial output emitted a synthesized recovery chunk with only a hardcoded MAX_TOKENS, masking the true network failure and misleading downstream clients into diagnosing an output token limit exceeded; integrated the error report into candidate frames using Google's official standard finishMessage alongside structured gatewayError and gatewayInterrupted: true flags, preserving all generated content cleanly under the zero content tampering contract while exposing exact interruption details. (Fixes #3813)
  • Incomplete Premature EOF Fallback: Fixed an issue where streams emitting content but closed prematurely by upstream without an official finishReason: "STOP" resulted in a silent EOF without completion metadata; added an incomplete stream guard in the finalize hook to automatically emit a diagnostic chunk explaining the premature EOF, while preserving silent EOF when valid completion markers are present to protect trailing usage metadata chunks. (Fixes #3813)
• [Token Stats Dual-Perspective Redesign, Multi-Dashboard TTFT Integration, and Minimalist Control Bar Upgrade] (Fixes #3810):
  • Dual-Perspective Model Breakdown: Resolved the issue where token statistics recorded only the client's original requested model, masking heavy consumption by routed premium models (e.g., Fable 5, Opus); introduced effective_model() on ProxyRequestLog to split token tracking into "Routed Model" (actual quota/cost consumption) and "Requested Model" (original client call) perspectives; User Token tracking is aligned with the effective model simultaneously. (Fixes #3810)
  • Multi-Dashboard Time to First Token (TTFT) Integration: Added ttft_ms REAL to token_usage table to accurately capture millisecond-precision response latency for both streaming首包 and non-streaming responses; seamlessly integrated into all dashboards: Cyber Cockpit View displays real-time global TTFT on the efficiency dial and model TTFT tags on model rank cards; Apple Bento View shows average TTFT on cache efficiency cards and top models list; Classic View introduces a dedicated "TTFT" metric card and an "TTFT" column in the detailed model statistics table.
  • Backward-Compatible DB Schema & Aggregation API: Dynamically added requested_model and ttft_ms fields with dedicated indexes to the token_usage table; extended get_token_stats_by_model and model trend endpoints with the view_mode parameter, leveraging dynamic COALESCE(NULLIF(requested_model, ''), model) aggregation to keep both perspectives clean and fully backward compatible. (Fixes #3810)
  • Historical Data Inference Migration & Discrepancy Notice: Runs an automatic one-time migration upon startup for historical records lacking requested_model, backfilling the calculated routed target into model and preserving the legacy record as requested_model. Note: Because raw request logs are periodically rotated, historical records are migrated by inferring routing targets from current default routing rules; past requests that utilized customized overrides or multi-stage fallback rotations may reflect minor attribution discrepancies, whereas newly dispatched requests are tracked with real-time exactness. (Fixes #3810)
  • Daily Stats Window Alignment & Data Clarity: Fixed an issue where the "Day" filter internally defaulted to a 14-day window, mistakenly blending historical older usage into daily counts; aligned "Day" strictly with the last 24 hours / today, paired with contextual tooltips on all time ranges to prevent period mismatch and data confusion.
  • Minimalist Control Bar Redesign & Vertical Space Recovery: Removed the redundant, oversized "Token Usage Statistics" header to eliminate visual duplication with the active global nav tab and reclaim substantial vertical screen real estate; seamlessly embedded minute-level granular switches (1h / 24h) directly inside the "Minute" pill button; neatly grouped dashboard view toggles, model perspectives, time spans, custom pricing, and refresh actions into a unified single-line control bar without awkward multi-row wrapping.
  • Full 12-Locale Multi-Language Localization: Completed translations and tooltips across all 12 supported system languages covering routed/requested perspectives, TTFT latency, and time-range descriptors. (Fixes #3810)

---

• [Gemini 原生流中断真实原因透传与异常 EOF 诊断完善] (Fixes #3813):
  • 透传官方标准 finishMessage 诊断: 解决此前 Gemini 原生流在输出部分内容后发生连接中断（如 error reading a body from connection 或超时）时，合成收尾帧直接写死 MAX_TOKENS、掩盖真实错误导致下游客户端与用户误判为达到模型输出上限的问题；在接入错误报告后，在候选帧中注入 Google 官方标准字段 finishMessage 及结构化 gatewayError / gatewayInterrupted: true，在遵守零正文篡改契约、保全截断前生成内容的同时，如实告知中断类型与错误原文。(Fixes #3813)
  • 未下发 finishReason 异常提前 EOF 兜底: 修复上游产生正文但未经正常 finishReason: "STOP" 下发即直接遭遇连接 EOF 导致下游静默断流、缺少完成标记的缺陷；在正常收尾钩子中增加未完成判定并自动补发带有明确提前截断提示的收尾诊断帧，若正常下发过完成标记则严格保持静默 EOF，不破坏尾部用量帧与多 candidate 兼容性。(Fixes #3813)
• [Token 统计双视角重构、首字耗时 (TTFT) 全看板集成与控制栏极简体验升级] (Fixes #3810):
  • 分模型统计双视角支持: 解决分模型统计仅记录客户端原始模型导致昂贵路由模型（如 Fable 5、Opus 等）消耗被掩盖的问题；在 ProxyRequestLog 中引入 effective_model()，将 Token 统计划分为「实际路由模型」（真实配额/成本消耗）与「请求模型」（原始客户端调用）两个独立视角，User Token 用量同步对齐实际生效模型。(Fixes #3810)
  • 多看板首字耗时 (TTFT) 统计集成: 在 token_usage 表引入 ttft_ms REAL 首字延迟字段，在网关响应首包或非流式完成时精准捕获毫秒级延迟；全面集成至所有统计视图：总览看板（Cyber Cockpit） 效能仪表展示实时全局 TTFT、模型榜单标注各模型首字响应速度；深度洞察看板（Apple Bento） 缓存效能卡片与主力模型榜展示平均首字延迟；经典看板独立指标卡片增加「首字延迟」卡片，并在底部分模型详细统计表格中增加「首字耗时」列。
  • 数据库与聚合接口向下兼容: 在 token_usage 表动态新增 requested_model 与 ttft_ms 字段并建立专用索引；为后端 get_token_stats_by_model 及模型趋势接口扩充 view_mode 参数，采用 COALESCE(NULLIF(requested_model, ''), model) 动态聚合，保证两套维度互不干扰且完美兼容既有调用。(Fixes #3810)
  • 历史数据自动推断迁移与误差注意事项: 应用启动时对旧版本未包含 requested_model 的历史记录执行一次性自动迁移；迁移时根据网关当前的统一路由规则将真实路由模型回填到 model，将原始记录模型留存至 requested_model。注意：由于历史调用日志随时间滚动清理，旧数据的路由目标依据当前默认规则反推迁移，对于曾经自定义修改过映射规则或经历过复杂降级轮询的历史请求，迁移后可能存在微小归属偏差；新产生的请求则全程由网关实时精准记录。(Fixes #3810)
  • 「日」分类周期校正与数据防混淆: 修复此前「日」分类底层写死按 14 天统计导致历史旧数据被误合并呈现的缺陷，精确校准为按近 24 小时 / 当天进行精准日汇总；为各时间维度补充明确的 Tooltip 浮窗提示，彻底消除不同模块周期脱节与脏数据疑虑。
  • 极简控制栏重构与空间释放 (Minimalist UI): 移除页面顶部与全局导航 Tab 重叠冗余的「Token 消费统计」大标题区域，释放大量垂直空间；将原本独立平铺导致多行折断的分钟粒度（1h / 24h）无缝内联嵌入至「分钟」胶囊内部；将看板切换、模型视角、时间跨度、单价配置与刷新按功能分组收敛至同一平整控制栏，彻底消除常规窗口下的孤立断行与拥挤感。
  • 全量 12 语种国际化支持: 同步补齐全部 12 种系统语言关于实际路由/请求模型、首字延迟 (TTFT) 以及各时间范围 Tooltip 提示的词条与上下文指引。(Fixes #3810)

Full Changelog: v5.0.2-beta.6...v5.0.2-beta.7