Fix: Parse xsrf_token and gemini_bl from cookie file (400 Bad Request)

[01MASTERS]

Description

This PR fixes a critical bug where the server throws a 400 Bad Request from the Gemini upstream when using the cookie authentication method.

Root Cause:
Google's Gemini backend recently tightened its security checks, requiring a valid xsrf_token and the correct gemini_bl payload version for all requests. While the gemini-cookie-sync-extension correctly exports these fields into the cookie_file JSON, the server was ignoring them and falling back to hardcoded, outdated defaults (from July 2026).

Fixes Included:

1. Updated load_cookie() in both the monolithic gemini_web2api.py and the modular gemini.py to dynamically parse and apply xsrf_token and gemini_bl.
2. Fixed a sequencing bug where the request payload and URL were constructed before load_cookie() ran, guaranteeing that the fresh tokens are used even on the very first request.

This brings the server logic into sync with the latest extension updates and completely restores cookie authentication functionality.

[Copilot]

Pull request overview

This PR aims to restore Gemini “cookie_file” authentication by loading xsrf_token and gemini_bl from the cookie JSON export and ensuring those values are applied before constructing the request payload/URL.

Changes:

• Parse xsrf_token and gemini_bl from JSON cookie files in both the modular and monolithic implementations.
• Adjust request sequencing so cookies/tokens are loaded before building request payloads/URLs (first-request correctness).
• Add internal planning notes/questions and update .gitignore to ignore .agents/ and .planning/.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
gemini_web2api/gemini.py	Load xsrf_token/gemini_bl from cookie JSON and call load_cookie() before building payload/URL; adds debug logging.
gemini_web2api.py	Load xsrf_token/gemini_bl from cookie JSON and call load_cookie() earlier in request flow.
.planning/research/questions.md	Adds a research question related to auth robustness.
.planning/notes/auth-flow-cookie-sync.md	Adds documentation describing the cookie-sync authentication flow.
.gitignore	Ignores .agents/ and .planning/.

Suppressed comments (1)

gemini_web2api/gemini.py:245

• This logs the raw xsrf_token when log_requests is enabled. Even in debug mode, avoid emitting session/XSRF material to logs; it can leak via process supervisors, container logs, or support bundles.

    log(f"DEBUG URL: {url}")
    log(f"DEBUG XSRF: {CONFIG.get('xsrf_token')}")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Sophomoresty]

The core idea is good (reading xsrf_token and gemini_bl from the cookie JSON file), but this PR needs cleanup before it can be merged:

1. Remove the DEBUG log lines (log(f"DEBUG URL: ..."), log(f"DEBUG XSRF: ..."))
2. Remove the .planning/ directory (personal notes)
3. Don't call load_cookie() at the start of every request — it reads from disk each time which is wasteful. Instead, read these fields once at startup when the cookie file is loaded
4. The changes to gemini_web2api/gemini.py reference a file that doesn't exist in the main branch

Feel free to resubmit with these fixes. The xsrf_token/gemini_bl extraction from the JSON cookie file is a welcome addition.