From 90fca485bc38f883b93c63bded5ccfbae8e6fb42 Mon Sep 17 00:00:00 2001
From: Raxxoor <manker_lol@hotmail.com>
Date: Thu, 30 Apr 2026 00:58:54 +0100
Subject: [PATCH] fix(antigravity): scrub internal OmniRoute headers (#1794)

Integrated into release/v3.7.5
---
 open-sse/services/antigravityHeaderScrub.ts |  3 ++-
 tests/unit/executor-antigravity.test.ts     | 20 ++++++++++++++++++--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/open-sse/services/antigravityHeaderScrub.ts b/open-sse/services/antigravityHeaderScrub.ts
index 5ecdd91627..200e324957 100644
--- a/open-sse/services/antigravityHeaderScrub.ts
+++ b/open-sse/services/antigravityHeaderScrub.ts
@@ -52,7 +52,8 @@ export function scrubProxyAndFingerprintHeaders(
 ): Record<string, string> {
   const cleaned: Record<string, string> = {};
   for (const [key, value] of Object.entries(headers)) {
-    if (!HEADERS_TO_REMOVE.includes(key.toLowerCase())) {
+    const lowerKey = key.toLowerCase();
+    if (!lowerKey.startsWith("x-omniroute-") && !HEADERS_TO_REMOVE.includes(lowerKey)) {
       cleaned[key] = value;
     }
   }
diff --git a/tests/unit/executor-antigravity.test.ts b/tests/unit/executor-antigravity.test.ts
index 817a3d4d1a..5ecf7c76c2 100644
--- a/tests/unit/executor-antigravity.test.ts
+++ b/tests/unit/executor-antigravity.test.ts
@@ -3,6 +3,7 @@ import assert from "node:assert/strict";
 
 import { AntigravityExecutor } from "../../open-sse/executors/antigravity.ts";
 import { setCliCompatProviders } from "../../open-sse/config/cliFingerprints.ts";
+import { scrubProxyAndFingerprintHeaders } from "../../open-sse/services/antigravityHeaderScrub.ts";
 import {
   clearAntigravityVersionCache,
   seedAntigravityVersionCache,
@@ -43,13 +44,28 @@ test("AntigravityExecutor.buildUrl always targets the streaming endpoint", () =>
   );
 });
 
-test("AntigravityExecutor.buildHeaders includes auth and SSE accept", () => {
+test("AntigravityExecutor.buildHeaders includes native headers without OmniRoute internals", () => {
   const executor = new AntigravityExecutor();
   const headers = executor.buildHeaders({ accessToken: "ag-token" }, false);
 
   assert.equal(headers.Authorization, "Bearer ag-token");
   assert.equal(headers.Accept, "text/event-stream");
-  assert.equal(headers["X-OmniRoute-Source"], "omniroute");
+  assert.equal(headers["X-OmniRoute-Source"], undefined);
+});
+
+test("Antigravity header scrub removes OmniRoute internal headers", () => {
+  const headers = scrubProxyAndFingerprintHeaders({
+    Authorization: "Bearer ag-token",
+    "X-OmniRoute-Source": "omniroute",
+    "X-OmniRoute-No-Cache": "true",
+    "X-Forwarded-For": "127.0.0.1",
+  });
+
+  assert.equal(headers.Authorization, "Bearer ag-token");
+  assert.equal(headers["X-OmniRoute-Source"], undefined);
+  assert.equal(headers["X-OmniRoute-No-Cache"], undefined);
+  assert.equal(headers["X-Forwarded-For"], undefined);
+  assert.equal(headers["Accept-Encoding"], "gzip, deflate, br");
 });
 
 test("AntigravityExecutor.transformRequest normalizes model, project and contents", async () => {