Harden monitor (gate all routes), swap ChatGPT backend to free-Chatgpt-api, clean repo

- Security: gate /, /api/*, /chrome.log behind API_KEY (Bearer / ?key= / apikey
cookie). Previously these were public — anyone could view+drive the logged-in
ChatGPT/Gemini/Google sessions. This was the likely "abusive" flag cause.
- ChatGPT backend: replace chatgpt-free-api with the free-Chatgpt-api rewrite
(drop-in: same 127.0.0.1:9225, same /api/chat + /v1/chat/completions). Update
Dockerfile COPY paths.
- Cleanup: drop leftover per-service Dockerfiles, redundant sub-READMEs, dev-only
docs/test scripts, the prebuilt linux binary, and cdp_* debug scripts.
- Docs: fix references, mark all routes key-gated, note the Space is now private.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -13,7 +13,7 @@ RUN go mod tidy && CGO_ENABLED=0 go build -ldflags="-s -w" -o /profilesync .
 # Build the ChatGPT API server (talks to gpt-extension on 127.0.0.1:9225).
 FROM golang:1.26-bookworm AS chatgpt-build
 WORKDIR /src
-COPY chatgpt-free-api/ ./
+COPY free-Chatgpt-api/ ./
 RUN go mod download && CGO_ENABLED=0 go build -ldflags="-s -w" -o /agent .
 
 # Build the Gemini API server (talks to gemini-extension on 127.0.0.1:9226).
@@ -27,7 +27,7 @@ FROM akashyadav758/chrome:latest
 USER root
 
 # Copy extensions into the container
-COPY chatgpt-free-api/gpt-extension /opt/gpt-extension
+COPY free-Chatgpt-api/gpt-extension /opt/gpt-extension
 COPY free-gemini-api/gemini-extension /opt/gemini-extension
 COPY flow-agent/Flow-extension /opt/flow-extension
 
@@ -39,7 +39,7 @@ COPY --from=profilesync-build /profilesync /opt/profilesync/profilesync
 
 # Backend API servers (run on localhost; the monitor gateway fronts them).
 COPY --from=chatgpt-build /agent /opt/chatgpt/agent
-COPY chatgpt-free-api/config.json /opt/chatgpt/config.json
+COPY free-Chatgpt-api/config.json /opt/chatgpt/config.json
 COPY --from=gemini-build /free-gemini-api /opt/gemini-srv/free-gemini-api
 COPY flow-agent/ /opt/flow-srv/
 

HOWTOUSE.md

@@ -3,14 +3,14 @@
 One base URL fronts all three services. Every `/gpt`, `/gemini`, `/flow` call needs the
 `API_KEY` as a Bearer token. The monitor UI (`/`) needs no key.
 
-- **Base URL:** `https://akash1313-selfapi.hf.space`
+- **Base URL:** `https://akash1313-selfapi-v2.hf.space`
 - **Auth header:** `Authorization: Bearer YOUR_API_KEY`  *(your real key is in the gitignored `./api-key`)*
 
 > ⚠️ **You must be logged in** to ChatGPT / Gemini / Flow inside the browser
-> (`https://akash1313-selfapi.hf.space/`) for real responses. The servers reply even when
+> (`https://akash1313-selfapi-v2.hf.space/`) for real responses. The servers reply even when
 > logged out, but with `extensionConnected:false` / empty data. Check first:
 > ```bash
-> curl -H "Authorization: Bearer YOUR_API_KEY" https://akash1313-selfapi.hf.space/gpt/health
+> curl -H "Authorization: Bearer YOUR_API_KEY" https://akash1313-selfapi-v2.hf.space/gpt/health
 > ```
 > `extensionConnected:true` = ready.
 
@@ -27,12 +27,12 @@ One base URL fronts all three services. Every `/gpt`, `/gemini`, `/flow` call ne
 
 ```bash
 # Simple chat
-curl -X POST https://akash1313-selfapi.hf.space/gpt/api/chat \
+curl -X POST https://akash1313-selfapi-v2.hf.space/gpt/api/chat \
   -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" \
   -d '{"prompt":"Write a haiku about the sea","wait_for_response":true}'
 
 # OpenAI-compatible (drop-in for OpenAI SDKs — set base_url=.../gpt/v1)
-curl -X POST https://akash1313-selfapi.hf.space/gpt/v1/chat/completions \
+curl -X POST https://akash1313-selfapi-v2.hf.space/gpt/v1/chat/completions \
   -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" \
   -d '{"model":"gpt-5","messages":[{"role":"user","content":"hello"}],"stream":false}'
 ```
@@ -51,7 +51,7 @@ Optional fields: `"model"`, `"thinking_effort"`, `"conversation_id"` (continue a
 | `/gemini/output/<file>` | GET | — (generated media) |
 
 ```bash
-curl -X POST https://akash1313-selfapi.hf.space/gemini/chat \
+curl -X POST https://akash1313-selfapi-v2.hf.space/gemini/chat \
   -H "Authorization: Bearer YOUR_API_KEY" \
   -d "prompt=Explain quantum entanglement simply&new_chat=true"
 ```
@@ -70,12 +70,12 @@ curl -X POST https://akash1313-selfapi.hf.space/gemini/chat \
 
 ```bash
 # Text-to-video (aspect: portrait|landscape ; duration: 4,6,8,10)
-curl -X POST https://akash1313-selfapi.hf.space/flow/generate/video \
+curl -X POST https://akash1313-selfapi-v2.hf.space/flow/generate/video \
   -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" \
   -d '{"prompt":"a cat surfing a wave, cinematic","aspect":"landscape","duration":8}'
 
 # Text-to-image
-curl -X POST https://akash1313-selfapi.hf.space/flow/generate/image \
+curl -X POST https://akash1313-selfapi-v2.hf.space/flow/generate/image \
   -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" \
   -d '{"prompt":"neon city at night","aspect":"square"}'
 ```

README.md

@@ -1,5 +1,5 @@
 ---
-title: Selfapi
+title: Selfapi-v2
 emoji: 📊
 colorFrom: gray
 colorTo: blue
@@ -8,9 +8,9 @@ app_port: 3001
 pinned: false
 ---
 
-# Selfapi — Headless Chrome + Unpacked Extensions
+# Selfapi-v2 — Headless Chrome + Unpacked Extensions
 
-A [Hugging Face Space](https://huggingface.co/spaces/akash1313/selfapi) that runs a
+A [Hugging Face Space](https://huggingface.co/spaces/akash1313/selfapi-v2) that runs a
 persistent, headless **Chrome for Testing** browser inside Docker with three custom
 unpacked extensions auto-loaded, plus a live web monitor to watch the browser in real time.
 
@@ -25,12 +25,12 @@ automate workflows for ChatGPT, Google Gemini, and Google Flow.
 
 | Extension | Source dir | Loaded at | What it does |
 |-----------|-----------|-----------|--------------|
-| **Gpt Agent Api** | `chatgpt-free-api/gpt-extension` | `/opt/gpt-extension` | Auto-syncs ChatGPT cookies to a local ChatGPT Free API server |
+| **Gpt Agent Api** | `free-Chatgpt-api/gpt-extension` | `/opt/gpt-extension` | Auto-syncs ChatGPT cookies to a local ChatGPT Free API server |
 | **Gemini Api Agent** | `free-gemini-api/gemini-extension` | `/opt/gemini-extension` | Auto-syncs Google Gemini cookies to a local Free Gemini API server |
 | **Flow Agent** | `flow-agent/Flow-extension` | `/opt/flow-extension` | Automates Google Flow — T2V / V2V / I2V video + T2I / I2I image generation |
 
 All three are Manifest V3 extensions with background service workers. Each subfolder
-also contains the matching backend server and its own README.
+also contains the matching backend server.
 
 ---
 
@@ -42,9 +42,9 @@ run yourself — see each subproject's README for setup):
 
 | Project | Server | Talks to | Purpose |
 |---------|--------|----------|---------|
-| [`chatgpt-free-api`](chatgpt-free-api/README.md) | Go | `127.0.0.1:9225` | ChatGPT backend API from your logged-in session |
-| [`free-gemini-api`](free-gemini-api/README.md) | Go reverse-proxy | local server | Gemini text / Imagen 3 images / Gemini video |
-| [`flow-agent`](flow-agent/README.md) | Python FastAPI + CLI | `127.0.0.1:8100` | Google Flow T2V / V2V / I2V video + T2I / I2I images |
+| `free-Chatgpt-api` | Go | `127.0.0.1:9225` | ChatGPT backend API from your logged-in session |
+| `free-gemini-api` | Go reverse-proxy | local server | Gemini text / Imagen 3 images / Gemini video |
+| `flow-agent` | Python FastAPI + CLI | `127.0.0.1:8100` | Google Flow T2V / V2V / I2V video + T2I / I2I images |
 
 > ✅ The HF Space now runs **all three servers in the same container** as Chrome, and the
 > monitor doubles as a **single API gateway** that fronts them on one public port — see
@@ -162,7 +162,7 @@ Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/14
 
 A **macOS UA on a Linux box is an inconsistency** that Cloudflare Turnstile flags, causing
 the ChatGPT "verify you are human" check to loop forever (the tick never clears). The browser
-UA lives in `start_hf.sh`; the ChatGPT backend (`chatgpt-free-api/cookies.go`) uses the **same
+UA lives in `start_hf.sh`; the ChatGPT backend (`free-Chatgpt-api/cookies.go`) uses the **same
 UA and Chrome version (145)** so the `cf_clearance` cookie — which Cloudflare binds to the
 exact UA — stays valid across the browser and the backend.
 
@@ -172,11 +172,11 @@ exact UA — stays valid across the browser and the backend.
 
 | URL | Description |
 |-----|-------------|
-| `https://akash1313-selfapi.hf.space/` | Live Chrome monitor UI (open, no key) |
-| `https://akash1313-selfapi.hf.space/chrome.log` | Streaming Chrome log (debugging) |
-| `https://akash1313-selfapi.hf.space/gpt/…` | ChatGPT API (gateway → `127.0.0.1:9225`) |
-| `https://akash1313-selfapi.hf.space/gemini/…` | Gemini API (gateway → `127.0.0.1:8000`) |
-| `https://akash1313-selfapi.hf.space/flow/…` | Flow API (gateway → `127.0.0.1:8101`) |
+| `https://akash1313-selfapi-v2.hf.space/` | Live Chrome monitor UI — **key required** (open `/?key=YOUR_API_KEY` once; it sets a cookie) |
+| `https://akash1313-selfapi-v2.hf.space/chrome.log` | Streaming Chrome log — **key required** |
+| `https://akash1313-selfapi-v2.hf.space/gpt/…` | ChatGPT API (gateway → `127.0.0.1:9225`) |
+| `https://akash1313-selfapi-v2.hf.space/gemini/…` | Gemini API (gateway → `127.0.0.1:8000`) |
+| `https://akash1313-selfapi-v2.hf.space/flow/…` | Flow API (gateway → `127.0.0.1:8101`) |
 | `127.0.0.1:9222` (in-container) | Chrome DevTools Protocol |
 | `:9223` | CDP proxied for external tools (via socat) |
 
@@ -190,21 +190,22 @@ gateway strips the prefix and forwards to the server on localhost:
 
 | Prefix | Backend | Example endpoints |
 |--------|---------|-------------------|
-| `/gpt/` | chatgpt-free-api `:9225` | `/gpt/api/chat`, `/gpt/v1/chat/completions`, `/gpt/health` |
+| `/gpt/` | free-Chatgpt-api `:9225` | `/gpt/api/chat`, `/gpt/v1/chat/completions`, `/gpt/health` |
 | `/gemini/` | free-gemini-api `:8000` | `/gemini/chat`, `/gemini/status`, `/gemini/output/*` |
 | `/flow/` | flow-agent `:8101` | `/flow/generate/video`, `/flow/generate/image`, `/flow/health` |
 
 ### Auth — required
 
-The three prefixes are gated by an **`API_KEY`** Space secret. Every request must send it as a
-Bearer token (or `?key=`). **Fail-closed:** if `API_KEY` is unset the gateway returns `503`, so
-the logged-in accounts are never accidentally exposed. The monitor UI (`/`, `/chrome.log`) stays
-open.
+**Every** route — the API prefixes, the monitor UI (`/`), `/api/*`, `/chrome.log`, `/logs/*` — is
+gated by an **`API_KEY`** Space secret. Send it as a Bearer token, `?key=`, or (for the browser UI)
+open `/?key=YOUR_API_KEY` once to set an `apikey` cookie. **Fail-closed:** if `API_KEY` is unset
+every route returns `503`, so the logged-in accounts are never exposed. This Space is also
+**private** on Hugging Face, so the URL itself requires HF auth — defense in depth.
 
 1. Set the Space secret **`API_KEY`** (Settings → Variables and secrets) to a strong random string.
 2. Call it:
    ```bash
-   curl -X POST https://akash1313-selfapi.hf.space/gpt/api/chat \
+   curl -X POST https://akash1313-selfapi-v2.hf.space/gpt/api/chat \
      -H "Authorization: Bearer $API_KEY" \
      -H "Content-Type: application/json" \
      -d '{"message":"hello"}'
@@ -222,7 +223,7 @@ chrome-space/
 ├── start_hf.sh             # container entrypoint / Chrome boot sequence
 ├── profilesync/            # Go tool: Chrome profile <-> Postgres snapshot
 ├── monitor/                # Go 3-tab live monitor (GPT / Gemini / Flow)
-├── chatgpt-free-api/       # ChatGPT Free API server + gpt-extension
+├── free-Chatgpt-api/       # ChatGPT Free API server + gpt-extension
 ├── free-gemini-api/        # Free Gemini API server + gemini-extension
 └── flow-agent/             # Flow automation CLI + Flow-extension
 ```

SETUP.md

@@ -9,8 +9,8 @@ Very short guide. Runs the browser + all 3 API servers on your own machine/serve
 
 ## 2. Get the code
 ```bash
-git clone https://huggingface.co/spaces/akash1313/selfapi
-cd selfapi
+git clone https://huggingface.co/spaces/akash1313/selfapi-v2
+cd selfapi-v2
 ```
 
 ## 3. Run it

chatgpt-free-api/Dockerfile

@@ -1,17 +0,0 @@
-# ChatGPT Free API agent — talks to the gpt-extension over ws/http on 127.0.0.1:9225.
-FROM golang:1.26-bookworm AS builder
-WORKDIR /app
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o agent .
-
-FROM debian:12-slim
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
-WORKDIR /app
-COPY --from=builder /app/agent .
-COPY config.json .
-
-EXPOSE 9225
-CMD ["./agent"]

chatgpt-free-api/README.md

@@ -1,56 +0,0 @@
-# ChatGPT Free API Agent
-
-A flat-structure Go server that connects with the Chrome extension (`gpt-extension`) to execute ChatGPT backend API requests directly from your authenticated browser session.
-
-## Setup & Running
-
-1. **Build & Run the Server:**
-   ```bash
-   go build -o agent .
-   ./agent
-   ```
-2. **Load Chrome Extension:**
-   - Open `chrome://extensions` in Chrome.
-   - Enable **Developer mode** (top-right).
-   - Click **Load unpacked** and select the `gpt-extension` folder (in the parent directory).
-3. **Login to ChatGPT:**
-   - Open `https://chatgpt.com/` and log in. The extension will automatically connect to the running Go agent (green status badge = connected).
-
----
-
-## API Usage
-
-### 1. Send Chat Request
-```bash
-curl -X POST "http://127.0.0.1:9225/api/chat" \
-  -H "Content-Type: application/json" \
-  -d '{"prompt": "Why is sky blue?", "conversation_id": ""}'
-```
-
-### 2. Bulk Sequential Requests
-```bash
-curl -X POST "http://127.0.0.1:9225/api/chat/bulk" \
-  -H "Content-Type: application/json" \
-  -d '{"prompts": ["hello", "how are you"]}'
-```
-
-### 3. Edit Existing Message
-```bash
-curl -X POST "http://127.0.0.1:9225/api/chat/edit" \
-  -H "Content-Type: application/json" \
-  -d '{"prompt": "updated prompt", "conversation_id": "conv-id", "message_id": "msg-id", "parent_id": "parent-id"}'
-```
-
-### 4. Health & Cookie Status
-- **Health Check:** `GET http://127.0.0.1:9225/health`
-- **Cookie Status:** `GET http://127.0.0.1:9225/api/cookies/status`
-
----
-
-## Testing
-
-Run the integration tests (requires agent running on port 9225):
-```bash
-./test.sh             # Run all tests (text, thread, bulk, image gen/edit)
-./test_image_only.sh  # Run only image generation/editing tests
-```

chatgpt-free-api/test.sh

@@ -1,124 +0,0 @@
-#!/bin/bash
-
-# Unset proxy variables for local communication
-unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY no_proxy
-
-# Colors for output
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[0;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-echo -e "${BLUE}==================================================${NC}"
-echo -e "${BLUE}        ChatGPT Free API Integration Test          ${NC}"
-echo -e "${BLUE}==================================================${NC}"
-
-# Check if agent is running on port 9225
-echo "🔍 Checking if agent is running on port 9225..."
-if ! curl -s --connect-timeout 2 http://127.0.0.1:9225/health >/dev/null; then
-    echo -e "${RED}❌ Error: Agent is not running on port 9225!${NC}"
-    echo -e "💡 Please start the server separately first by running: ${YELLOW}./agent${NC} or ${YELLOW}go run main.go${NC}"
-    exit 1
-fi
-echo -e "${GREEN}✅ Agent detected on port 9225! Running tests...${NC}"
-
-# Test 1: Check cookie status
-echo -e "\n${BLUE}[Test 1] Checking cookie status...${NC}"
-STATUS_RESP=$(curl -s http://127.0.0.1:9225/api/cookies/status)
-echo "Response: $STATUS_RESP"
-if [[ "$STATUS_RESP" == *"has_cookies\":true"* ]]; then
-    TEST1_STATUS="${GREEN}PASSED${NC}"
-else
-    TEST1_STATUS="${RED}FAILED (No cookies sync)${NC}"
-fi
-
-# Test 2: Send basic chat test
-echo -e "\n${BLUE}[Test 2] Sending basic text chat prompt...${NC}"
-CHAT_RESP=$(curl -s -X POST http://127.0.0.1:9225/api/chat \
-  -H "Content-Type: application/json" \
-  -d '{"prompt": "Tell me a short programmer joke."}')
-echo "Response: $CHAT_RESP"
-
-CONV_ID=$(echo "$CHAT_RESP" | grep -o '"conversation_id":"[^"]*' | cut -d'"' -f4)
-if [ -n "$CONV_ID" ]; then
-    TEST2_STATUS="${GREEN}PASSED${NC}"
-else
-    TEST2_STATUS="${RED}FAILED (No response or conversation ID)${NC}"
-fi
-
-# Test 3: Conversation thread continuity
-if [ -n "$CONV_ID" ]; then
-    echo -e "\n${BLUE}[Test 3] Testing thread continuity...${NC}"
-    THREAD_RESP=$(curl -s -X POST http://127.0.0.1:9225/api/chat \
-      -H "Content-Type: application/json" \
-      -d "{\"prompt\": \"Explain that joke.\", \"conversation_id\": \"$CONV_ID\"}")
-    echo "Response: $THREAD_RESP"
-    if [[ "$THREAD_RESP" == *"ok\":true"* ]]; then
-        TEST3_STATUS="${GREEN}PASSED${NC}"
-    else
-        TEST3_STATUS="${RED}FAILED (Thread reply failed)${NC}"
-    fi
-else
-    TEST3_STATUS="${YELLOW}SKIPPED (No conversation ID)${NC}"
-fi
-
-# Test 4: Bulk chat request
-echo -e "\n${BLUE}[Test 4] Testing bulk chat request...${NC}"
-BULK_RESP=$(curl -s -X POST http://127.0.0.1:9225/api/chat/bulk \
-  -H "Content-Type: application/json" \
-  -d '{"prompts": ["What is 2+2?", "What is Go?"], "wait_for_response": true}')
-echo "Response: $BULK_RESP"
-if [[ "$BULK_RESP" == *"ok\":true"* ]]; then
-    TEST4_STATUS="${GREEN}PASSED${NC}"
-else
-    TEST4_STATUS="${RED}FAILED${NC}"
-fi
-
-# Test 5: Image generation (GPT-2)
-echo -e "\n${BLUE}[Test 5] Testing GPT-2 image generation (Cute baby dragon)...${NC}"
-echo "⏳ Polling for GPT-2 generation, this will take 15-35 seconds..."
-GEN_RESP=$(curl -s -X POST http://127.0.0.1:9225/api/chat \
-  -H "Content-Type: application/json" \
-  -d '{"prompt": "Create a cute 3D cartoon baby dragon sitting on a small chest of gold. Directly generate the image now without asking any questions or confirmation."}')
-echo "Response: $GEN_RESP"
-
-# Extract generated image path
-GEN_IMAGE_PATH=$(echo "$GEN_RESP" | grep -o '"images":\["[^"]*' | cut -d'"' -f4)
-if [ -n "$GEN_IMAGE_PATH" ] && [ -f "$GEN_IMAGE_PATH" ]; then
-    TEST5_STATUS="${GREEN}PASSED ($GEN_IMAGE_PATH)${NC}"
-else
-    TEST5_STATUS="${RED}FAILED (Image file not generated/saved)${NC}"
-fi
-
-# Test 6: Image editing (GPT-2 Edit/Vision)
-if [ -n "$GEN_IMAGE_PATH" ] && [ -f "$GEN_IMAGE_PATH" ]; then
-    echo -e "\n${BLUE}[Test 6] Testing GPT-2 image editing (Adding wizard hat)...${NC}"
-    echo "⏳ Uploading source image and polling for edit, this will take 15-35 seconds..."
-    EDIT_RESP=$(curl -s -X POST http://127.0.0.1:9225/api/chat/edit \
-      -F "prompt=Add a small glowing wizard hat to the head of this dragon." \
-      -F "image=@$GEN_IMAGE_PATH")
-    echo "Response: $EDIT_RESP"
-
-    EDIT_IMAGE_PATH=$(echo "$EDIT_RESP" | grep -o '"images":\["[^"]*' | cut -d'"' -f4)
-    if [ -n "$EDIT_IMAGE_PATH" ] && [ -f "$EDIT_IMAGE_PATH" ]; then
-        TEST6_STATUS="${GREEN}PASSED ($EDIT_IMAGE_PATH)${NC}"
-    else
-        TEST6_STATUS="${RED}FAILED (Edited image file not generated/saved)${NC}"
-    fi
-else
-    TEST6_STATUS="${YELLOW}SKIPPED (No source image generated in Test 5)${NC}"
-fi
-
-echo -e "\n${BLUE}==================================================${NC}"
-echo -e "${BLUE}                Test Summary                      ${NC}"
-echo -e "${BLUE}==================================================${NC}"
-echo -e "1. Cookie Status:        $TEST1_STATUS"
-echo -e "2. Basic Chat:           $TEST2_STATUS"
-echo -e "3. Thread Continuity:    $TEST3_STATUS"
-echo -e "4. Bulk Chat:            $TEST4_STATUS"
-echo -e "5. GPT-2 Gen:            $TEST5_STATUS"
-echo -e "6. GPT-2 Image Editing:  $TEST6_STATUS"
-echo -e "${BLUE}==================================================${NC}"
-
-echo -e "\n${GREEN}✅ Tests completed!${NC}\n"

docs/architecture.md

@@ -40,5 +40,5 @@ the 3 extensions. Each server logs to `/home/chrome/{chatgpt,gemini,flow}.log`.
 ## Components added on top of the base image
 - `monitor/` — Go UI, now also the **reverse-proxy gateway** (`gatewayHandler`, `authOK`).
 - `profilesync/` — Go tool, Chrome profile ⇄ Postgres snapshot.
-- `chatgpt-free-api/`, `free-gemini-api/` (Go) + `flow-agent/` (Python/FastAPI) — the 3 servers,
+- `free-Chatgpt-api/`, `free-gemini-api/` (Go) + `flow-agent/` (Python/FastAPI) — the 3 servers,
   built/installed into the image by the `Dockerfile`.

docs/deployment.md

@@ -16,13 +16,13 @@ The `origin` remote embeds a token: `https://<user>:<hf_token>@huggingface.co/sp
 - The token **must belong to the Space owner** (`akash1313`) with `repo.write`. A token from a
   different account → `pre-receive hook declined: You are not authorized to push`.
 - Rotate/replace the token in the URL with:
-  `git remote set-url origin https://akash1313:<NEW_TOKEN>@huggingface.co/spaces/akash1313/selfapi`
+  `git remote set-url origin https://akash1313:<NEW_TOKEN>@huggingface.co/spaces/akash1313/selfapi-v2`
 - Local token files (`hf-token`, `neon-db`, `api-key`) are gitignored — never commit them.
 
 ### Watch the build
 ```bash
 curl -s -H "Authorization: Bearer <hf_token>" \
-  https://huggingface.co/api/spaces/akash1313/selfapi/runtime
+  https://huggingface.co/api/spaces/akash1313/selfapi-v2/runtime
 # stage: RUNNING_BUILDING → RUNNING_APP_STARTING → RUNNING   (errors: BUILD_ERROR / RUNTIME_ERROR)
 ```
 

docs/troubleshooting.md

@@ -7,7 +7,7 @@ Every issue we actually hit, and the fix.
 | Symptom | Cause → Fix |
 |---------|-------------|
 | `pre-receive hook declined: You are not authorized to push` | The token in the `origin` URL isn't the Space owner's. Use an `akash1313` token with `repo.write` (see [deployment.md](deployment.md)). |
-| `Repository not found` on push | Remote points to a Space that doesn't exist. `git remote -v` and fix the name (we deploy to `akash1313/selfapi`). |
+| `Repository not found` on push | Remote points to a Space that doesn't exist. `git remote -v` and fix the name (we deploy to `akash1313/selfapi-v2`). |
 | Build `BUILD_ERROR` after bumping a server | `go.mod` Go version > build-stage image. Raise the `FROM golang:X` in the Dockerfile. |
 | Python `externally-managed-environment` during pip | Debian 12 PEP-668. We use `pip3 install --break-system-packages` (already in Dockerfile). |
 | Frequent restarts | Normal: **every `git push` and every secret change rebuilds.** Batch edits into one push. Not a CPU/RAM issue (cpu-basic = 2 vCPU / 16 GB; usage ~1–2 GB). |
@@ -26,7 +26,7 @@ Every issue we actually hit, and the fix.
 | Symptom | Cause → Fix |
 |---------|-------------|
 | Login lost after restart | `DATABASE_URL` unset or DB unreachable (HF). Set the Neon secret; verify a row in `chrome_profile`. |
-| ChatGPT Cloudflare "verify you are human" loops | UA/OS mismatch. The UA **must be Linux** (the Space runs Linux) — it's set in `start_hf.sh` and `chatgpt-free-api/cookies.go` (Chrome 145). If it still loops, it's the datacenter IP (HF=AWS) → use a residential `--proxy-server`. |
+| ChatGPT Cloudflare "verify you are human" loops | UA/OS mismatch. The UA **must be Linux** (the Space runs Linux) — it's set in `start_hf.sh` and `free-Chatgpt-api/cookies.go` (Chrome 145). If it still loops, it's the datacenter IP (HF=AWS) → use a residential `--proxy-server`. |
 | `extensionConnected:false` / `has_flow_key:false` on `/…/health` | The in-Chrome extension hasn't connected to its server yet. It connects when (a) Chrome has loaded the extension and (b) **you're logged in** to that service. Open the monitor UI, log in, wait. Extensions auto-retry (~5 s reconnect alarm). |
 | Extension never connects + API calls **hang forever** (`DidStartWorkerFail` in `chrome.log`) | Chrome was launched with renderer-capping flags (`--renderer-process-limit=1`, `--process-per-site`, `--no-zygote`). Each extension's MV3 service worker is its own renderer and the chat flow injects via `executeScript`; capping renderers starves them → workers fail to start and `executeScript` hangs. **Removed from `start_hf.sh`** — keep Chrome multi-process (HF has 16 GB). The UI chatting fine while the API hangs is the tell. |
 | Backend server logs | `GET /logs/{chatgpt,gemini,flow,monitor}` (API-key gated) tails each server's log without shelling into the container. |

flow-agent/Dockerfile

@@ -1,16 +0,0 @@
-# Flow Agent FastAPI server — talks to the Flow extension.
-#   Public HTTP API        : 127.0.0.1:8101 (uvicorn / FastAPI)
-#   Extension callback HTTP : 127.0.0.1:8100 (HTTP_PORT, ExtensionBridge — hardcoded in extension)
-#   cookie/token WebSocket  : 127.0.0.1:9227 (WS_PORT)
-FROM python:3.11-slim
-
-WORKDIR /app
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-COPY . .
-
-ENV WS_PORT=9227 \
-    HTTP_PORT=8100
-
-EXPOSE 8100 8101 9227
-CMD ["uvicorn", "cli.api:app", "--host", "127.0.0.1", "--port", "8101"]

flow-agent/README.md

@@ -1,468 +0,0 @@
-<div align="center">
-
-# ⚡ Flow Agent
-
-### Generate AI videos & images via HTTP/HTTPS API Server or CLI — no API key, no limits.
-
-**Omni Flash** for cinematic video generation · **Nano Banana 2** for unlimited image creation  
-FastAPI Integration · Auto watermark removal · Reference-based editing · Zero setup.
-
----
-
-🎬 `T2V` `V2V` `I2V` — Video generation with auto watermark clean *(uses credits)*  
-🖼️ `T2I` `I2I` — Unlimited image generation with reference support *(no credits needed)*  
-🔑 Uses your Google account via Chrome extension — **no API key required**  
-🌐 FastAPI HTTP/HTTPS Server — **perfect for n8n & external automation**
-
-</div>
-
-
-## ✅ Features & Status
-
-| Feature | What it does | Time | Status |
-|---------|-------------|------|--------|
-| **T2V** | Generate video from text prompt | ~44s | ✅ Working |
-| **T2I** | Generate image from text prompt | ~10-30s | ✅ Working |
-| **V2V** | Edit/restyle existing video | ~3min | ✅ Working |
-| **I2I** | Edit image with reference | ~10-30s | ✅ Working |
-| **I2V** | Animate a still image into video | ~44s | ✅ Working |
-| **FL** | First + Last frame video control | ~44s | ✅ Working |
-| **R2V** | Reference-based video generation | ~44s | ✅ Working |
-| **Upload** | Upload video/image to Flow | ~12s | ✅ Working |
-| **Watermark Remove** | Auto-remove Gemini watermark (~1s) | ~1s | ✅ Auto |
-| **Auto-Retry** | Auto-open/refresh Flow tab for token | auto | ✅ Built-in |
-| **API Sniffer** | Discover new endpoints/payloads | - | ✅ Working |
-
----
-
-## 📋 Prerequisites
-
-| Requirement | Details |
-|-------------|---------|
-| **Python** | 3.9 or higher |
-| **Chrome** | Latest version |
-| **Google Account** | Logged into Flow |
-| **ffmpeg** | Only for V2V merge (optional) |
-
----
-
-## 🛠️ Installation (Step by Step)
-
-### Step 1: Clone the repo
-
-```bash
-git clone https://github.com/kodelyx/flow-agent.git
-cd flow-agent
-```
-
-### Step 2: Install Python dependencies
-
-```bash
-pip install -r requirements.txt
-```
-
-This installs `websockets`, `opencv-python-headless`, and `numpy`.
-
-### Step 3: Install the Chrome Extension
-
-1. Open Chrome browser
-2. Go to `chrome://extensions` in the address bar
-3. Toggle **"Developer mode"** ON (top-right corner)
-4. Click **"Load unpacked"**
-5. Select the `extension/` folder from this repo
-6. You should see the **Flow Agent** extension appear
-
-### Step 4: Open Google Flow
-
-1. Open [labs.google/fx/tools/flow](https://labs.google/fx/tools/flow) in Chrome
-2. Make sure you're **logged into your Google account**
-3. The extension icon should show a **green badge** = connected
-4. The extension auto-opens this tab when needed
-
-> ⚠️ The Flow tab auto-opens when you run a command. No manual tab management needed!
-
----
-
-## 🚀 Usage
-
-### Text → Video (T2V)
-
-Generate a new video from a text description.
-
-```bash
-# Basic (portrait 9:16, 10 seconds)
-python -m cli.generate "A samurai drawing his katana on a cliff at golden sunset"
-
-# Landscape mode (16:9)
-python -m cli.generate "Eagle soaring over snowy mountains" --aspect landscape
-
-# Custom output file
-python -m cli.generate "A dragon breathing fire" -o dragon.mp4
-
-# Shorter duration (4/6/8/10 seconds)
-python -m cli.generate "Dog playing in the park" --duration 6
-
-# Generate multiple variations
-python -m cli.generate "Cyberpunk city at night" --count 4
-
-# I2V — animate a still image
-python -m cli.generate "Character comes alive" --start photo.png
-
-# FL — First + Last frame (controlled transition)
-python -m cli.generate "Person walks forward" --start start.png --end end.png
-
-# R2V — Reference images (character consistency)
-python -m cli.generate "Character in new scene" --ref char1.png char2.png
-```
-
-**CLI Options:**
-| Flag | Short | Default | Description |
-|------|-------|---------|-------------|
-| `--output` | `-o` | `omni_output.mp4` | Output filename |
-| `--aspect` | `-a` | `portrait` | `portrait` or `landscape` |
-| `--duration` | `-d` | `10` | `4`, `6`, `8`, or `10` seconds |
-| `--count` | `-c` | `1` | Generate 1-4 videos |
-| `--edit` | `-e` | - | Pass media_id for V2V edit mode |
-| `--start` | `-s` | - | Start frame image (I2V / FL mode) |
-| `--end` | | - | End frame image (use with --start for FL) |
-| `--ref` | `-r` | - | Reference image(s) for R2V mode |
-| `--no-clean` | | - | Skip auto watermark removal |
-
----
-
-### Text → Image (T2I)
-
-Generate images from a text description.
-
-```bash
-# Basic (portrait 9:16)
-python -m cli.image "A dragon breathing fire in a cyberpunk city"
-
-# Landscape
-python -m cli.image "Mountain sunset" --aspect landscape -o sunset.png
-
-# Square (for logos, icons)
-python -m cli.image "Minimal logo design" --aspect square
-
-# Generate 4 variations
-python -m cli.image "Abstract art" --count 4
-
-# I2I: Edit with reference image
-python -m cli.image "Make it anime style" --ref original.png -o anime.png
-```
-
-**CLI Options:**
-| Flag | Short | Default | Description |
-|------|-------|---------|-------------|
-| `--output` | `-o` | `output/image.png` | Output filename |
-| `--aspect` | `-a` | `portrait` | `portrait`, `landscape`, `square`, `4x3`, `3x4` |
-| `--count` | `-c` | `1` | Generate 1-4 variations |
-| `--ref` | `-r` | - | Reference image(s) for I2I |
-
-### Upload Video
-
-Upload a local video to Google Flow. Returns a `media_id` needed for V2V editing.
-
-```bash
-# Single video
-python -m cli.upload my_video.mp4
-
-# Batch upload all .mp4 in a folder
-python -m cli.upload chunks/ --batch
-```
-
-The `media_id` is **automatically saved** to `media-id.js`:
-```
-my_video.mp4 : 49f7d936-01e3-41ad-917a-2f9bb6ead00b
-```
-
----
-
-### Video → Video Edit (V2V)
-
-Apply style changes to an uploaded video (e.g., convert to anime).
-
-```bash
-# Step 1: Upload your video
-python -m cli.upload my_video.mp4
-# → media_id saved to media-id.js
-
-# Step 2: Edit with style prompt
-python -m cli.edit "Transform into vibrant anime style, Studio Ghibli aesthetic" \
-    --media-id 49f7d936-01e3-41ad-917a-2f9bb6ead00b \
-    --video-file my_video.mp4 \
-    --output output_anime/ \
-    --merge
-
-# Without local video file (specify duration manually)
-python -m cli.edit "Make it look cyberpunk neon" \
-    -m MEDIA_ID \
-    --total-seconds 30 \
-    -o output_cyber/
-```
-
-**How it works:** Long videos are automatically split into 10s segments, each processed in parallel, then merged with ffmpeg.
-
-**CLI Options:**
-| Flag | Short | Required | Description |
-|------|-------|----------|-------------|
-| `--media-id` | `-m` | Yes | Flow media ID (from upload) |
-| `--video-file` | `-v` | No | Local file (auto-detects duration/fps) |
-| `--total-seconds` | `-t` | No | Duration if no local file |
-| `--output` | `-o` | No | Output directory (default: `output/`) |
-| `--aspect` | `-a` | No | `portrait` or `landscape` |
-| `--merge` | | No | Merge segments with ffmpeg |
-
----
-
-### Image → Video (I2V)
-
-Animate a still image into a video. Requires Python scripting (no CLI yet):
-
-```python
-import asyncio
-from omniflash import (
-    ExtensionBridge, upload_image, generate_video_i2v,
-    poll_status, download_video, ASPECTS, DEFAULT_PROJECT,
-)
-
-async def main():
-    # Connect to extension
-    bridge = ExtensionBridge()
-    await bridge.start()
-    await bridge.wait_for_extension(30)
-
-    # Upload your image
-    img_id = await upload_image(bridge, "my_image.png")
-    print(f"Image uploaded: {img_id}")
-
-    # Generate video from image
-    media_ids = await generate_video_i2v(
-        bridge,
-        prompt="The character comes alive, dramatic movement, cinematic",
-        aspect=ASPECTS['portrait'],       # or ASPECTS['landscape']
-        project_id=DEFAULT_PROJECT,
-        image_media_id=img_id,
-        duration=8,                        # 4, 6, 8, or 10 seconds
-    )
-
-    # Wait for video to finish
-    if media_ids:
-        await poll_status(bridge, media_ids[0], DEFAULT_PROJECT)
-        await download_video(bridge, media_ids[0], "output_i2v.mp4")
-
-    await bridge.close()
-
-asyncio.run(main())
-```
-
----
-
-### API Sniffer
-
-Capture all API requests made by the Flow UI. Useful for discovering new endpoints or debugging.
-
-```bash
-# Start sniffer, then use Flow UI normally
-python -m cli.sniff
-
-# Save captured requests to file
-python -m cli.sniff --save sniffed.json
-```
-
-See [SNIFFING.md](SNIFFING.md) for the full API discovery guide.
-
----
-
-## 🌐 HTTP/HTTPS API Server (for n8n & external integrations)
-
-A FastAPI-based API server is included to trigger all Flow Agent features remotely (e.g., from n8n HTTP Request nodes, custom webhooks, or automation workflows).
-
-### Start the API Server
-
-Run the server from the project directory:
-```bash
-# Standard HTTP (defaults to port 8000)
-venv/bin/python -m cli.api --host 0.0.0.0 --port 8000
-
-# Optional HTTPS (auto-generates self-signed SSL certificates)
-venv/bin/python -m cli.api --host 0.0.0.0 --port 8443 --ssl
-```
-
-### Core API Endpoints
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| **GET** | `/health` | Check Extension Bridge health and token status. |
-| **POST** | `/generate/video` | T2V, I2V, FL, R2V video generation. Supports query `?download=true` to stream the binary `.mp4` file. |
-| **POST** | `/generate/image` | T2I, I2I image generation. Supports `?download=true` to stream the binary `.png` file. |
-| **POST** | `/upload/image` | Upload an image to Flow (via file upload or local file path). |
-| **POST** | `/upload/video` | Upload a video to Flow (via file upload or local file path). |
-| **POST** | `/edit/video` | V2V video editing (restyling segment duration). |
-| **GET** | `/download/{filename}` | Download generated image/video files from the `output/` folder. |
-
-### Verify with Integration Tests
-
-A comprehensive integration test script is provided to verify all endpoints:
-```bash
-venv/bin/python test_api.py
-```
-
-See [error.md](error.md) for detailed troubleshooting instructions if you encounter port conflicts or proxy network issues.
-
----
-
-## 🐍 Python API (for developers)
-
-Use the `omniflash` package directly in your own scripts:
-
-```python
-from omniflash import (
-    ExtensionBridge,          # WebSocket bridge to Chrome extension
-    generate_video,           # T2V: text → video
-    edit_video,               # V2V: video → video
-    upload_image,             # Upload image → get media_id
-    generate_video_i2v,       # I2V: image → video
-    poll_status,              # Poll until video is ready
-    download_video,           # Download finished video
-    ASPECTS,                  # {'portrait': '...', 'landscape': '...'}
-    DEFAULT_PROJECT,          # Your default project ID
-)
-from omniflash.upload import upload_video  # Upload video file
-from omniflash import media_store          # Read/write media-id.js
-
-# media_store examples:
-media_store.save("video.mp4", "uuid-here")   # Save entry
-mid = media_store.get("video.mp4")            # Get media_id
-all_entries = media_store.read_entries()       # Get all entries
-```
-
-> **Backward compatible:** `from omni import ExtensionBridge, generate_video, ...` still works.
-
----
-
-## 📁 Project Structure
-
-```
-flow-agent/
-├── omniflash/                  # Core Python package
-│   ├── __init__.py             # Public API exports
-│   ├── bridge.py               # ExtensionBridge (WS + HTTP + auto-retry)
-│   ├── config.py               # All config hardcoded here
-│   ├── media_store.py          # media-id.js read/write
-│   ├── upload.py               # Video upload (GCS resumable)
-│   ├── watermark.py            # Auto watermark removal (embedded assets)
-│   └── generators/             # API functions
-│       ├── common.py           # poll_status, download_video
-│       ├── t2v.py              # Text → Video
-│       ├── t2i.py              # Text → Image + I2I
-│       ├── v2v.py              # Video → Video (edit)
-│       └── i2v.py              # Image → Video + upload_image
-├── cli/                        # CLI entry points
-│   ├── generate.py             # python -m cli.generate
-│   ├── image.py                # python -m cli.image
-│   ├── upload.py               # python -m cli.upload
-│   ├── edit.py                 # python -m cli.edit
-│   └── sniff.py                # python -m cli.sniff
-├── extension/                  # Chrome extension
-│   ├── manifest.json           # Extension manifest
-│   ├── background.js           # WS client, API proxy
-│   ├── content.js              # Page ↔ background bridge
-│   └── injected.js             # Fetch interceptor, reCAPTCHA
-├── omni.py                     # Backward-compatible wrapper
-├── .gitignore                  # Git ignore rules
-├── media-id.js                 # Auto-updated filename → media_id
-├── requirements.txt            # Python dependencies
-├── SNIFFING.md                 # API discovery guide
-└── README.md
-```
-
----
-
-## ⚙️ How It Works
-
-```
-┌─────────────────────────────────┐
-│  Your Terminal / Python Script  │
-│  python -m cli.generate "..."   │
-└──────────┬──────────────────────┘
-           │ import omniflash
-           ▼
-┌─────────────────────────────────┐
-│  omniflash package              │
-│  ExtensionBridge (WS + HTTP)    │
-└──────────┬──────────────────────┘
-           │ WebSocket (:9222)
-           │ HTTP callback (:8100)
-           ▼
-┌─────────────────────────────────┐
-│  Chrome Extension (Flow Agent) │
-│  Auth token + reCAPTCHA solving │
-└──────────┬──────────────────────┘
-           │ HTTPS (browser cookies)
-           ▼
-┌─────────────────────────────────┐
-│  Google Omni API (aisandbox)    │
-│  Video generation / editing     │
-└─────────────────────────────────┘
-```
-
-1. Python starts a WebSocket server + HTTP callback server
-2. Chrome extension auto-connects and provides authentication
-3. Script sends API requests through the extension
-4. Extension solves reCAPTCHA and proxies with browser cookies
-5. Script polls for completion, then downloads the result
-
----
-
-## 🎯 Models & Endpoints
-
-| Model | Key | Duration | Type |
-|-------|-----|----------|------|
-| Omni Flash T2V 4s | `abra_t2v_4s` | 4 sec | Text → Video |
-| Omni Flash T2V 6s | `abra_t2v_6s` | 6 sec | Text → Video |
-| Omni Flash T2V 8s | `abra_t2v_8s` | 8 sec | Text → Video |
-| Omni Flash T2V 10s | `abra_t2v_10s` | 10 sec | Text → Video |
-| Omni Flash Edit | `abra_edit` | 10 sec | Video → Video |
-
-| Endpoint | Path |
-|----------|------|
-| T2V | `/v1/video:batchAsyncGenerateVideoText` |
-| I2V | `/v1/video:batchAsyncGenerateVideoStartImage` |
-| V2V Edit | `/v1/video:batchAsyncGenerateVideoEditVideo` |
-| Upload Image | `/v1/flow/uploadImage` |
-| Poll Status | `/v1/video:batchCheckAsyncVideoGenerationStatus` |
-| Get Media | `/v1/video/media/{media_id}` |
-
----
-
-## 🔧 Troubleshooting
-
-| Problem | Solution |
-|---------|----------|
-| Extension not connecting | Make sure Flow tab is open and you're logged in |
-| `Address already in use` | Another script is using port 9222/8100. Kill it first |
-| `TIMEOUT` error | Extension may have disconnected. Reload Flow tab |
-| `reCAPTCHA failed` | Reload Flow tab, wait a few seconds, try again |
-| `No media in response` | Check your prompt. Some prompts get blocked |
-| `curl failed` | Upload too large or network issue. Retry |
-| Video quality poor | Use longer duration (10s) and detailed prompts |
-| V2V merge fails | Install ffmpeg: `brew install ffmpeg` |
-
----
-
-## ⚠️ Important Notes
-
-- **Flow tab auto-opens** — no manual tab management needed
-- Uses your Google account's **free Flow credits** (check remaining in Flow UI)
-- Extension auto-reconnects and auto-retries (3 attempts)
-- **Watermark auto-removed** on every generated video (~1s)
-- `media-id.js` auto-updates on every upload (video or image)
-- All generated videos save to the `output/` directory by default
-- Old `from omni import ...` syntax still works (backward compatible)
-
----
-
-## 📄 License
-
-MIT

flow-agent/SNIFFING.md

@@ -1,205 +0,0 @@
-# 🔍 API Sniffing Guide
-
-How to discover new Google Flow API endpoints using the Chrome extension's built-in request sniffer.
-
-## How It Works
-
-```
-Flow UI (browser)
-    ↓ user clicks "Generate" / "Upload" etc.
-    ↓
-fetch() call to aisandbox-pa.googleapis.com
-    ↓ intercepted by injected.js (monkey-patched fetch)
-    ↓
-postMessage → content.js → background.js
-    ↓
-HTTP POST → http://127.0.0.1:8100/api/ext/callback
-    ↓
-Your sniff server logs the URL + payload
-```
-
-The extension's `injected.js` monkey-patches `window.fetch` to intercept ALL outgoing requests to `aisandbox-pa.googleapis.com`. Every request's URL, method, and body are forwarded to your local server.
-
-## Quick Start
-
-### 1. Start the Sniff Server
-
-```python
-python sniff.py
-```
-
-This starts:
-- WebSocket server on `ws://127.0.0.1:9222` (extension connects here)
-- HTTP server on `http://127.0.0.1:8100` (receives sniffed data)
-
-### 2. Open Flow UI
-
-Go to [labs.google/fx/tools/flow](https://labs.google/fx/tools/flow) in Chrome.
-The extension will auto-connect to your sniff server.
-
-### 3. Perform the Action
-
-Do whatever you want to discover the API for:
-- Upload an image/video
-- Generate a video
-- Change settings
-- Click any button
-
-### 4. Read the Logs
-
-The sniff server prints every intercepted request:
-```
-🔍 SNIFFED: https://aisandbox-pa.googleapis.com/v1/video:batchAsyncGenerateVideoText
-   Method: POST
-   Payload: {"mediaGenerationContext":{"batchId":"..."},"clientContext":{...},"requests":[...]}
-```
-
-## Sniff Server Code
-
-Save this as `sniff.py`:
-
-```python
-#!/usr/bin/env python3
-"""Sniff server — captures all Flow UI API requests."""
-
-import asyncio, json, websockets, logging
-from http.server import HTTPServer, BaseHTTPRequestHandler
-import threading
-
-logging.basicConfig(level=logging.INFO, format='%(asctime)s %(message)s', datefmt='%H:%M:%S')
-log = logging.getLogger('sniff')
-
-# Store all sniffed requests
-all_requests = []
-
-class Handler(BaseHTTPRequestHandler):
-    def do_POST(self):
-        length = int(self.headers.get('Content-Length', 0))
-        body = json.loads(self.rfile.read(length)) if length else {}
-
-        if body.get('type') == 'sniffed_video_request':
-            url = body.get('url', '')
-            method = body.get('method', '?')
-            payload = body.get('payload', '')
-
-            log.info('🔍 %s %s', method, url)
-            if payload:
-                log.info('   %s', str(payload)[:1000])
-
-            all_requests.append({
-                'url': url,
-                'method': method,
-                'payload': payload,
-                'timestamp': body.get('timestamp'),
-            })
-
-        self.send_response(200)
-        self.send_header('Content-Type', 'application/json')
-        self.send_header('Access-Control-Allow-Origin', '*')
-        self.end_headers()
-        self.wfile.write(b'{"ok":true}')
-
-    def do_OPTIONS(self):
-        self.send_response(200)
-        self.send_header('Access-Control-Allow-Origin', '*')
-        self.send_header('Access-Control-Allow-Methods', 'POST')
-        self.send_header('Access-Control-Allow-Headers', 'Content-Type')
-        self.end_headers()
-
-    def log_message(self, *a): pass
-
-# Start HTTP server
-srv = HTTPServer(('127.0.0.1', 8100), Handler)
-threading.Thread(target=srv.serve_forever, daemon=True).start()
-log.info('HTTP callback on :8100')
-
-async def on_connect(ws):
-    log.info('✅ Extension connected!')
-    async for raw in ws:
-        data = json.loads(raw)
-        if data.get('type') == 'token_captured':
-            log.info('🔑 Token captured')
-
-async def main():
-    async with websockets.serve(on_connect, '127.0.0.1', 9222):
-        log.info('⚡ WS server on :9222')
-        log.info('👉 Open Flow UI and perform any action...')
-        await asyncio.Future()
-
-asyncio.run(main())
-```
-
-## What Gets Captured
-
-| Action in Flow UI | API Endpoint |
-|-------------------|-------------|
-| Generate video (T2V) | `/v1/video:batchAsyncGenerateVideoText` |
-| Generate video (I2V) | `/v1/video:batchAsyncGenerateVideoStartImage` |
-| Generate video (Edit) | `/v1/video:batchAsyncGenerateVideoEditVideo` |
-| Poll video status | `/v1/video:batchCheckAsyncVideoGenerationStatus` |
-| Upload image | `/v1/flow/uploadImage` |
-| Generate image | `/v1/projects/{id}/flowMedia:batchGenerateImages` |
-| Get credits | `/v1/credits` |
-| Get media | `/v1/media/{media_id}` |
-| Upscale video | `/v1/video:batchAsyncGenerateVideoUpsampleVideo` |
-
-## How to Find New Endpoints
-
-### Example: Finding Video Upload
-
-1. Start `sniff.py`
-2. Open Flow UI
-3. Drag & drop a video file into Flow
-4. Check logs — you'll see the upload URL and payload format
-5. Add the new endpoint to `models.json`
-
-### Example: Finding Model Keys
-
-1. Start `sniff.py`  
-2. Open Flow UI
-3. Select different model (e.g., Omni Flash 4s)
-4. Click Generate
-5. Check logs — look for `videoModelKey` in the payload
-
-```json
-"requests": [{
-    "videoModelKey": "abra_t2v_4s",   ← this is what you need
-    ...
-}]
-```
-
-## Architecture
-
-```
-┌─────────────────────────────────────────────┐
-│  injected.js (MAIN world)                   │
-│  - Monkey-patches window.fetch              │
-│  - Captures URL + body of every request     │
-│  - Posts to content.js via postMessage       │
-└──────────────────┬──────────────────────────┘
-                   │ postMessage
-┌──────────────────▼──────────────────────────┐
-│  content.js (ISOLATED world)                │
-│  - Listens for __FLOWKIT_SNIFF__ messages    │
-│  - Forwards to background.js                │
-└──────────────────┬──────────────────────────┘
-                   │ chrome.runtime.sendMessage
-┌──────────────────▼──────────────────────────┐
-│  background.js (Service Worker)             │
-│  - Receives SNIFFED_AISANDBOX_REQUEST       │
-│  - POSTs to http://127.0.0.1:8100/callback  │
-└──────────────────┬──────────────────────────┘
-                   │ HTTP POST
-┌──────────────────▼──────────────────────────┐
-│  sniff.py (Your server)                     │
-│  - Logs every request                       │
-│  - Saves URL + method + payload             │
-└─────────────────────────────────────────────┘
-```
-
-## Tips
-
-- **Filter by keyword**: Modify the sniff server to only log URLs containing specific words (e.g., `upload`, `video`, `generate`)
-- **Save to file**: Add `json.dump(all_requests, open('sniffed.json', 'w'))` to save all captured requests
-- **Compare payloads**: Run the same action with different settings and diff the payloads to find which fields control what
-- **Telemetry noise**: Ignore URLs containing `batchLog`, `fetchUserRecommendations`, `frontendEvents` — these are analytics, not API calls

flow-agent/error.md

@@ -1,74 +0,0 @@
-# 🛠️ Flow Agent API Troubleshooting Guide (error.md)
-
-This document contains standard error scenarios and how to resolve them quickly.
-
----
-
-## 1. Error: `OSError: [Errno 48] Address already in use`
-* **Symptom**: The server fails to start and exits with: `OSError: [Errno 48] Address already in use` (typically for port `8000`, `8100`, or `9222`).
-* **Cause**: Another instance of the API server or a background flow-agent process is already running and occupying the port.
-* **Resolution**:
-  Run the following commands in your terminal to find and kill the process:
-  ```bash
-  # Clear API server port (8000)
-  kill -9 $(lsof -t -i:8000) 2>/dev/null || true
-
-  # Clear Extension bridge HTTP callback port (8100)
-  kill -9 $(lsof -t -i:8100) 2>/dev/null || true
-
-  # Clear Extension bridge WebSocket port (9222)
-  kill -9 $(lsof -t -i:9222) 2>/dev/null || true
-  ```
-
----
-
-## 2. Error: `Internal Server Error (500) - RuntimeError: curl failed`
-* **Symptom**: Step `Uploading Video to Flow` fails with Status Code `500` and the server console prints: `RuntimeError: curl failed: ...`
-* **Cause**: Your terminal session has sandbox/proxy environment variables active (`http_proxy`, `https_proxy`, `HTTP_PROXY`, or `HTTPS_PROXY` might be set by the AI agent sandbox). This causes `curl` to route all Google Cloud Storage uploads through a proxy that blocks the connection.
-* **Resolution**:
-  Clear the proxy variables in your terminal window before starting the server and running the test script:
-  ```bash
-  # 1. Unset the proxy variables
-  unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY
-
-  # 2. Restart the API server in this terminal
-  venv/bin/python -m cli.api --port 8000
-  ```
-  *(Make sure to also run `unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY` in your testing/client terminal window as well).*
-
----
-
-## 3. Error: `Google Flow extension is not connected or unauthorized`
-* **Symptom**: `/health` returns `has_flow_key: false` and generation calls return: `"Google Flow extension is not connected or unauthorized. Make sure Google Flow tab is open in Chrome."`
-* **Cause**: The Extension Bridge WS is connected, but the Chrome extension is unable to capture the auth token (`flowKey`) because Google Flow is either not open, has gone idle, or your Google account has logged out.
-* **Resolution**:
-  1. Open Chrome.
-  2. Make sure you are logged into your Google account at **[labs.google/fx/tools/flow](https://labs.google/fx/tools/flow)**.
-  3. Reload the page. The extension icon in your extension bar should show a green indicator.
-  4. Once logged in, the extension will automatically push the token to the server and heal the state.
-
----
-
-## 4. Error: `Failed (0): TIMEOUT`
-* **Symptom**: Request fails after 90 seconds with `TIMEOUT`.
-* **Cause**: Google Flow took too long to respond, or there is an active **reCAPTCHA challenge** popped up on your Chrome browser that requires manual verification.
-* **Resolution**:
-  1. Open Chrome and inspect the Google Flow tab.
-  2. If a reCAPTCHA prompt is present, solve it.
-  3. Reload the tab to refresh the connection, wait 5 seconds, and try your request again.
-
----
-
-## 5. Error: `zsh: no such file or directory: venv/bin/python`
-* **Symptom**: Running server or test script returns: `zsh: no such file or directory: venv/bin/python` or similar file errors.
-* **Cause**: The command is run from the parent workspace folder (`N8N-Agent`) instead of the cloned `flow-agent` project folder where the virtual environment (`venv`) resides.
-* **Resolution**:
-  Always change your directory to the `flow-agent` folder before running commands, or use the absolute paths:
-  ```bash
-  # Go to the correct directory first
-  cd /path/to/flow-agent
-  
-  # Then run the command
-  venv/bin/python -m cli.api --port 8000
-  ```
-

flow-agent/test_api.py

@@ -1,319 +0,0 @@
-#!/usr/bin/env python3
-"""Integration Test Script for Flow Agent API.
-
-Tests the following end-to-end flow:
-1. GET /health
-2. POST /generate/image (T2I)
-3. POST /upload/image
-4. POST /generate/video (I2V)
-5. POST /upload/video
-6. POST /edit/video (V2V)
-"""
-
-import os
-import sys
-import time
-
-# Add virtual environment site-packages to sys.path to run with system python
-venv_site_packages = os.path.join(os.path.dirname(os.path.abspath(__file__)), "venv", "lib", "python3.14", "site-packages")
-if os.path.exists(venv_site_packages):
-    sys.path.insert(0, venv_site_packages)
-
-# Clear proxy environment variables to bypass sandbox proxy for local requests
-os.environ.pop("HTTP_PROXY", None)
-os.environ.pop("HTTPS_PROXY", None)
-os.environ.pop("http_proxy", None)
-os.environ.pop("https_proxy", None)
-
-# Auto-install requests if not present
-try:
-    import requests
-except ImportError:
-    print("📦 Installing 'requests' library for testing...")
-    os.system(f"{sys.executable} -m pip install requests")
-    import requests
-
-API_URL = "http://localhost:8000"
-
-def log_step(name):
-    print(f"\n{'=' * 60}")
-    print(f"🚀 STEP: {name}")
-    print(f"{'=' * 60}")
-
-def check_health():
-    log_step("Checking Server Health")
-    try:
-        r = requests.get(f"{API_URL}/health")
-        print(f"Status Code: {r.status_code}")
-        print(f"Response: {r.text}")
-        if r.status_code != 200:
-            print("❌ Server health check failed!")
-            sys.exit(1)
-        data = r.json()
-        if not data.get("extension_connected"):
-            print("❌ Chrome extension is NOT connected. Please check Chrome devtools.")
-            sys.exit(1)
-        if not data.get("has_flow_key"):
-            print("⚠️ Chrome extension is connected but NOT logged in / authorized.")
-            print("   Please make sure labs.google/fx/tools/flow is open and logged in Chrome.")
-            sys.exit(1)
-        print("✅ Health Check Passed!")
-    except Exception as e:
-        print(f"❌ Failed to connect to server: {e}")
-        sys.exit(1)
-
-def generate_image():
-    log_step("Text-to-Image (T2I) Generation")
-    payload = {
-        "prompt": "a simple red apple on a clean wooden table, professional studio lighting, 8k resolution",
-        "aspect": "square",
-        "count": 1
-    }
-    r = requests.post(f"{API_URL}/generate/image", json=payload)
-    print(f"Status Code: {r.status_code}")
-    print(f"Response: {r.text}")
-    
-    if r.status_code != 200:
-        print("❌ Image generation failed!")
-        sys.exit(1)
-        
-    data = r.json()
-    outputs = data.get("outputs", [])
-    if not outputs:
-        print("❌ No outputs returned in image generation!")
-        sys.exit(1)
-        
-    img_info = outputs[0]
-    remote_url = img_info.get("remote_url")
-    filename = img_info.get("filename")
-    
-    # Download generated image locally for next steps
-    local_img_path = os.path.join("output", "test_t2i.png")
-    os.makedirs("output", exist_ok=True)
-    
-    print(f"📥 Downloading image from {remote_url}...")
-    img_r = requests.get(remote_url)
-    with open(local_img_path, "wb") as f:
-        f.write(img_r.content)
-        
-    print(f"✅ Saved test image to {local_img_path}")
-    return local_img_path
-
-def upload_image(image_path):
-    log_step("Uploading Image to Flow")
-    with open(image_path, "rb") as f:
-        files = {"file": (os.path.basename(image_path), f, "image/png")}
-        r = requests.post(f"{API_URL}/upload/image", files=files)
-        
-    print(f"Status Code: {r.status_code}")
-    print(f"Response: {r.text}")
-    
-    if r.status_code != 200:
-        print("❌ Image upload failed!")
-        sys.exit(1)
-        
-    data = r.json()
-    media_id = data.get("media_id")
-    if not media_id:
-        print("❌ No media_id returned from upload!")
-        sys.exit(1)
-        
-    print(f"✅ Image uploaded successfully! media_id: {media_id}")
-    return media_id
-
-def generate_image_i2i(image_media_id):
-    log_step("Image-to-Image (I2I) Generation")
-    payload = {
-        "prompt": "transform the red apple into a vibrant cartoon style, Pixar 3D aesthetic",
-        "aspect": "square",
-        "count": 1,
-        "ref": [image_media_id]
-    }
-    r = requests.post(f"{API_URL}/generate/image", json=payload)
-    print(f"Status Code: {r.status_code}")
-    print(f"Response: {r.text}")
-    
-    if r.status_code != 200:
-        print("❌ Image-to-Image (I2I) generation failed!")
-        sys.exit(1)
-        
-    data = r.json()
-    outputs = data.get("outputs", [])
-    if not outputs:
-        print("❌ No outputs returned in I2I generation!")
-        sys.exit(1)
-        
-    img_info = outputs[0]
-    remote_url = img_info.get("remote_url")
-    
-    local_i2i_path = os.path.join("output", "test_i2i.png")
-    print(f"📥 Downloading I2I image from {remote_url}...")
-    img_r = requests.get(remote_url)
-    with open(local_i2i_path, "wb") as f:
-        f.write(img_r.content)
-        
-    print(f"✅ Saved I2I image to {local_i2i_path}")
-    return local_i2i_path
-
-def generate_video_t2v():
-    log_step("Text-to-Video (T2V) Generation")
-    payload = {
-        "prompt": "a beautiful golden retriever playing in a park, high quality, 8k, cinematic lighting",
-        "aspect": "portrait",
-        "duration": 4,
-        "count": 1
-    }
-    r = requests.post(f"{API_URL}/generate/video", json=payload)
-    print(f"Status Code: {r.status_code}")
-    print(f"Response: {r.text}")
-    
-    if r.status_code != 200:
-        print("❌ T2V video generation failed!")
-        sys.exit(1)
-        
-    data = r.json()
-    outputs = data.get("outputs", [])
-    if not outputs:
-        print("❌ No outputs returned in T2V video generation!")
-        sys.exit(1)
-        
-    video_info = outputs[0]
-    download_url = video_info.get("download_url")
-    
-    local_video_path = os.path.join("output", "test_t2v.mp4")
-    
-    print(f"📥 Downloading video from {API_URL}{download_url}...")
-    video_r = requests.get(f"{API_URL}{download_url}")
-    with open(local_video_path, "wb") as f:
-        f.write(video_r.content)
-        
-    print(f"✅ Saved T2V video to {local_video_path}")
-    return local_video_path
-
-def generate_video_i2v(image_media_id):
-    log_step("Image-to-Video (I2V) Generation")
-    payload = {
-        "prompt": "the apple slowly rolls forward, dynamic cinematic panning, highly realistic",
-        "aspect": "portrait",
-        "duration": 4, # Short duration for faster testing
-        "count": 1,
-        "start": image_media_id # Animate using the uploaded image
-    }
-    r = requests.post(f"{API_URL}/generate/video", json=payload)
-    print(f"Status Code: {r.status_code}")
-    print(f"Response: {r.text}")
-    
-    if r.status_code != 200:
-        print("❌ Video generation failed!")
-        sys.exit(1)
-        
-    data = r.json()
-    outputs = data.get("outputs", [])
-    if not outputs:
-        print("❌ No outputs returned in video generation!")
-        sys.exit(1)
-        
-    video_info = outputs[0]
-    download_url = video_info.get("download_url")
-    filename = video_info.get("filename")
-    
-    local_video_path = os.path.join("output", "test_i2v.mp4")
-    
-    print(f"📥 Downloading video from {API_URL}{download_url}...")
-    video_r = requests.get(f"{API_URL}{download_url}")
-    with open(local_video_path, "wb") as f:
-        f.write(video_r.content)
-        
-    print(f"✅ Saved test video to {local_video_path}")
-    return local_video_path
-
-def upload_video(video_path):
-    log_step("Uploading Video to Flow")
-    with open(video_path, "rb") as f:
-        files = {"file": (os.path.basename(video_path), f, "video/mp4")}
-        r = requests.post(f"{API_URL}/upload/video", files=files)
-        
-    print(f"Status Code: {r.status_code}")
-    print(f"Response: {r.text}")
-    
-    if r.status_code != 200:
-        print("❌ Video upload failed!")
-        sys.exit(1)
-        
-    data = r.json()
-    media_id = data.get("media_id")
-    if not media_id:
-        print("❌ No media_id returned from upload!")
-        sys.exit(1)
-        
-    print(f"✅ Video uploaded successfully! media_id: {media_id}")
-    return media_id
-
-def edit_video_v2v(video_media_id):
-    log_step("Video-to-Video (V2V) Editing")
-    payload = {
-        "prompt": "make it look like an anime sketch style, drawing pencil style",
-        "video_media_id": video_media_id,
-        "aspect": "portrait",
-        "fps": 24,
-        "duration": 4
-    }
-    r = requests.post(f"{API_URL}/edit/video", json=payload)
-    print(f"Status Code: {r.status_code}")
-    print(f"Response: {r.text}")
-    
-    if r.status_code != 200:
-        print("❌ V2V video editing failed!")
-        sys.exit(1)
-        
-    data = r.json()
-    outputs = data.get("outputs", [])
-    if not outputs:
-        print("❌ No outputs returned in video edit!")
-        sys.exit(1)
-        
-    video_info = outputs[0]
-    download_url = video_info.get("download_url")
-    
-    local_edit_path = os.path.join("output", "test_v2v.mp4")
-    
-    print(f"📥 Downloading edited video from {API_URL}{download_url}...")
-    video_r = requests.get(f"{API_URL}{download_url}")
-    with open(local_edit_path, "wb") as f:
-        f.write(video_r.content)
-        
-    print(f"✅ Saved edited video to {local_edit_path}")
-
-def main():
-    print("🎬 Starting Flow Agent API Integration Test...")
-    
-    # 1. Health check
-    check_health()
-    
-    # 2. Text to Image (T2I)
-    local_image = generate_image()
-    
-    # 2b. Text to Video (T2V)
-    local_t2v_video = generate_video_t2v()
-    
-    # 3. Upload Image to GCS/Flow
-    image_media_id = upload_image(local_image)
-    
-    # 4. Image to Image (I2I)
-    local_i2i_image = generate_image_i2i(image_media_id)
-    
-    # 5. Image to Video (I2V)
-    local_video = generate_video_i2v(image_media_id)
-    
-    # 6. Upload Video to GCS/Flow
-    video_media_id = upload_video(local_video)
-    
-    # 7. Video to Video (V2V)
-    edit_video_v2v(video_media_id)
-    
-    print("\n" + "=" * 60)
-    print("🎉 ALL TESTS PASSED SUCCESSFULLY! Flow Agent API is 100% verified.")
-    print("=" * 60)
-
-if __name__ == "__main__":
-    main()

{chatgpt-free-api → free-Chatgpt-api}/.gitignore

@@ -11,3 +11,6 @@ debug_poll.json
 
 # Local Output Files
 output/
+
+# prebuilt linux binary (Docker builds from source)
+*.linux-amd64

free-gemini-api/.dockerignore

@@ -1,8 +0,0 @@
-dist/
-output/
-cookies.json
-.env
-.git/
-.DS_Store
-goapi
-*.exe

free-gemini-api/Dockerfile

@@ -1,21 +0,0 @@
-# Build stage
-FROM golang:1.25-alpine AS builder
-WORKDIR /app
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o free-gemini-api .
-
-# Runtime stage
-FROM alpine:3.19
-RUN apk --no-cache add ca-certificates curl
-WORKDIR /app
-COPY --from=builder /app/free-gemini-api .
-RUN mkdir -p /app/output
-
-EXPOSE 8000 9226
-
-ENV WS_PORT="9226" \
-    PORT="8000"
-
-CMD ["./free-gemini-api"]

free-gemini-api/README.md

@@ -1,401 +0,0 @@
-<div align="center">
-
-# 🔓 Free Gemini API
-
-### Unleash the Full Power of Google Gemini 3.5 Flash, Imagen 3, and Gemini Video — Completely Free
-
-[![Go Version](https://img.shields.io/badge/Go-1.21+-00ADD8?style=for-the-badge&logo=go&logoColor=white)](https://go.dev)
-[![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge)](LICENSE)
-[![Docker](https://img.shields.io/badge/Docker-Hub-2496ED?style=for-the-badge&logo=docker&logoColor=white)](https://hub.docker.com/r/akashyadav758/free-gemini-api)
-
-**No API Keys. No Token Costs. No Complex Setup. Zero Watermarks.**
-
-*A high-performance Go reverse-proxy API server wrapping the consumer Gemini portal (`gemini.google.com`). Access text generation, multi-turn chat, image creation (Imagen 3), video creation (Gemini Video), video-to-video styling, and music generation through a simple unified REST interface.*
-
-[Architectural Benefits](#-architectural-benefits) • [Key Features](#-key-features) • [Quick Start](#-quick-start) • [API Endpoints](#-api-endpoints) • [SDK Integration](#-sdk-integration) • [Architecture](#-architecture)
-
-</div>
-
----
-
-## 🚀 Architectural Benefits
-
-This project is engineered to solve the real-world operational challenges of web-scraping and reverse-proxying consumer endpoints, delivering production-grade reliability:
-
-### 🎨 In-Place Reverse Alpha-Blending Watermark Remover
-Google adds visual watermarks to the bottom-right corner of all generated images and videos. The Go API server includes a highly optimized, fully automated native Go implementation ([gemini/watermark.go](file:///Users/akashyadav/Server/Go-Map/Free-gemini-api/free-gemini-api-kodelyx/gemini/watermark.go)) that executes in-process immediately upon download.
-* **The Mathematics:** It reverses the blending equation:
-  $$\text{watermarked} = \alpha \times \text{logo} + (1 - \alpha) \times \text{original}$$
-  $${\text{original}} = \frac{\text{watermarked} - \alpha \times \text{logo}}{1 - \alpha}$$
-* **Layout Adaptability:** Dynamically identifies coordinates and dimensions based on the file aspect ratio (Portrait `720x1280` maps to a `48px` watermark; standard landscape/large scales dynamically map to a `96px` watermark), yielding perfectly clean, professional-grade media outputs without black borders or distortion.
-* **Zero Dependencies:** Completely native—runs without requiring Python 3, `numpy`, or `opencv-python`!
-
-### 🔄 403 Forbidden Auto-Redirect Bypasser
-Downloading media from Google's content servers (`googleusercontent.com`) directly often results in `403 Forbidden` errors. This client implements a custom redirect follow loop:
-* **The Pipeline:** It disables Go's default automatic HTTP redirect handler, manually intercepts HTTP `302/307` locations, and dynamically injects the user's active session cookies on *every* redirect hop (e.g. cross-domain transfers to `lh3.usercontent` and `fife.usercontent`), guaranteeing 100% download success.
-
-### 🔌 Zero-Spam Chrome Extension WebSocket Bridge
-Keeping cookies updated across server restarts is solved via our lightweight Chrome Extension (`/extension`):
-* **One-Shot Sync:** Utilizing a persistent WebSocket connection, the extension instantly syncs active cookies on startup or when the browser detects a change, completely avoiding heavy periodic background alarm polls and preserving laptop battery.
-
-### 🔍 Parser-Level Deduplication & Rapid Refusal Detection
-* **Deduplication:** The JSON response parser identifies and filters out duplicate image/video references returned by the Gemini consumer API, saving bandwidth and disk space.
-* **Refusal Detection:** Recognizes generation limit responses early (e.g., *“I can't create more videos for you today...”*), immediately terminating the long-polling routine and returning structured JSON failures instead of hanging for minutes.
-
----
-
-## 🔥 Comparison
-
-| Feature | Standard Cloud API | **Free Gemini API** |
-|:---|:---|:---|
-| **Pricing** | Pay per token / image / video | **100% Free** |
-| **API Key Required** | Yes | **No** (Uses Cookie Session) |
-| **Video Generation** | Highly restricted (Expensive) | **Gemini Video Enabled** (Standard Daily Quota) |
-| **Image Generation** | Cost per image | **Imagen 3 Enabled** (Unlimited - Uses Gemini 3.5) |
-| **Watermark Removal** | None (Or paid edit) | **Automatic In-Place Clean** |
-| **Setup Overhead** | Complex SDK configurations | **Single REST API / Docker Container** |
-
----
-
-## ✨ Key Features
-
-* **AI Chat:** Multi-turn conversational memory with Server-Sent Events (SSE) streaming support (OpenAI-compatible `data: [DONE]` format).
-* **Imagen 3 Image Gen:** Generate stunning visuals from text prompts, perform image-to-image editing (e.g., altering clothing, backgrounds, or assets), or upload up to 10 images simultaneously for multi-image analysis.
-* **Gemini Video Gen:** Generate text-to-video clips, image-to-video reference animations, or perform complex video-to-video visual edits (e.g., turning a beach video loop into a Studio Ghibli hand-drawn anime style).
-* **Music Generation:** Produce vocal and instrumental tracks on-demand, returned as local static URL references.
-* **Automated Session Hot-Reload:** Hot-reloads session settings and tokens on cookie sync updates, allowing uninterrupted server operation.
-
----
-
-## 🏁 Quick Start
-
-### Step 1: Install Chrome Cookie Bridge Extension
-1. Open Google Chrome and go to `chrome://extensions/`.
-2. Enable **Developer mode** (top-right toggle).
-3. Click **Load unpacked** (top-left) and select the `extension` folder located in this repository.
-4. Log into [gemini.google.com](https://gemini.google.com) on this browser instance.
-5. The extension will automatically detect your active session and sync your cookies to the Go backend WebSocket server (default port `9222`).
-
----
-
-### Step 2: Run the Server
-
-Choose your preferred deployment method below:
-
-#### Option A: Pre-built Binary (Recommended & Easiest)
-1. Download the latest release binary matching your operating system from the GitHub Releases.
-2. Make the binary executable and launch it:
-   * **macOS / Linux:**
-     ```bash
-     chmod +x free-gemini-api-mac-arm64
-     ./free-gemini-api-mac-arm64
-     ```
-   * **Windows:** Double-click on `free-gemini-api-win-x64.exe` or run it from CMD/PowerShell.
-
-#### Option B: From Source (For Local Dev)
-Ensure you have Go 1.21+ installed on your system. Watermark removal and all endpoints run natively without any Python requirements!
-```bash
-# Run the Go server
-go run .
-```
-
-#### Option C: Docker Setup
-Run the pre-built Docker container:
-```bash
-docker run -d --name free-gemini-api \
-  -e WS_PORT=9222 \
-  -e PORT=8000 \
-  -p 8000:8000 \
-  -p 9222:9222 \
-  akashyadav758/free-gemini-api:latest
-```
-  -e WS_PORT=9222 \
-  -e PORT=8000 \
-  -p 8000:8000 \
-  -p 9222:9222 \
-  akashyadav758/free-gemini-api:latest
-```
-
----
-
-### Step 3: Environment Variables (`.env`)
-Create a `.env` file in the root of the project to customize connection configurations:
-```env
-WS_PORT=8001            # WebSocket cookie bridge port (configured in extension)
-PORT=8000               # Port on which this Go API server runs
-```
-
----
-
-## 📡 API Endpoints
-
-### 1. `POST /chat` — Unified Interface
-Handles text conversations, streaming, image generation, multi-image analysis, and video processing.
-
-#### parameters
-
-| Field | Type | Description |
-|:---|:---|:---|
-| `prompt` | `string` | **Required.** The instruction or text query. |
-| `user_id` | `string` | Optional. Isolated session identity. |
-| `new_chat` | `bool` | Optional. Clear conversational history context. |
-| `stream` | `bool` | Optional. Stream responses back via SSE. |
-| `image` | `file(s)` | Optional. Multi-part form image upload (supports up to 10 files). |
-
----
-
-### End-Point Integrations & Examples
-
-#### A. Text Generation (Standard JSON)
-```bash
-curl -X POST http://localhost:8000/chat \
-  -H "Content-Type: application/json" \
-  -d '{
-    "prompt": "Explain quantum computing in three clear bullet points.",
-    "user_id": "test_user_1",
-    "new_chat": true
-  }'
-```
-
-#### B. Streaming Text Chat (Server-Sent Events)
-```bash
-curl -N -X POST http://localhost:8000/chat \
-  -H "Content-Type: application/json" \
-  -d '{
-    "prompt": "Write a short creative story about a developer and an AI assistant.",
-    "user_id": "test_user_1",
-    "stream": true
-  }'
-```
-
-#### C. Imagen 3 Image Generation (Text → Image)
-Prompt the system to generate pictures, which are automatically downloaded, cleaned of watermarks, and saved locally:
-```bash
-curl -X POST http://localhost:8000/chat \
-  -H "Content-Type: application/json" \
-  -d '{
-    "prompt": "Generate a beautiful landscape image of a sunset over snow-covered mountains, highly detailed.",
-    "user_id": "test_user_1",
-    "new_chat": true
-  }'
-```
-
-#### D. Image Editing & Variations (Image + Text Prompt)
-Upload an existing image and tell the AI to edit it in place:
-```bash
-curl -X POST http://localhost:8000/chat \
-  -F "prompt=Change the background of this image to a busy neon cyberpunk street" \
-  -F "image=@/path/to/my_photo.png" \
-  -F "user_id=test_user_1" \
-  -F "new_chat=true"
-```
-
-#### E. Gemini Video Generation (Image → Video / Text → Video)
-Provide an image reference and animate it, or generate fresh video segments from text:
-```bash
-curl -X POST http://localhost:8000/chat \
-  -F "prompt=Animate this scene: make the ocean waves crash dynamically on the shore with smooth cinematic motions" \
-  -F "image=@/path/to/beach_scene.png" \
-  -F "user_id=test_user_1" \
-  -F "new_chat=true"
-```
-
-#### F. Video-to-Video Visual Styling (Video File Input)
-Upload a video and completely rewrite its artistic style:
-```bash
-curl -X POST http://localhost:8000/chat \
-  -F "prompt=Edit this video: Convert the entire visual style of this video into a beautiful Studio Ghibli hand-drawn anime style." \
-  -F "image=@/path/to/original_video.mp4;type=video/mp4" \
-  -F "user_id=test_user_1" \
-  -F "new_chat=true"
-```
-
----
-
-### 2. `POST /music` — Song & Audio Track Generation
-Generates audio tracks from description prompts.
-```bash
-curl -X POST http://localhost:8000/music \
-  -H "Content-Type: application/json" \
-  -d '{
-    "prompt": "A relaxing lofi chillhop beat with smooth piano and rain sounds",
-    "user_id": "test_user_1",
-    "new_chat": true
-  }'
-```
-
----
-
-### Response Structure (JSON Example)
-```json
-{
-  "text": "I have successfully generated your media loop based on the prompt...",
-  "conversation_id": "c_3eeb67f56f0c82f2",
-  "response_id": "r_5fd71304b0a2190b",
-  "choice_id": "rc_82705406bcc3a2f7",
-  "images": [
-    "http://localhost:8000/static/img_r_5fd71304b0a2190b_0.png"
-  ],
-  "videos": [
-    "http://localhost:8000/static/vid_r_5fd71304b0a2190b_0.mp4"
-  ],
-  "music": [],
-  "elapsed": 43.56
-}
-```
-*(All generated files served dynamically from `/static/*` have already undergone in-place watermark removal).*
-
----
-
-## 🐍 SDK Integration
-
-### Python Example
-A production-ready script utilizing Python's `requests` library to interface with the REST server:
-
-```python
-import requests
-import json
-
-BASE_URL = "http://localhost:8000"
-
-def generate_text(prompt: str, user_id: str = "py_user"):
-    url = f"{BASE_URL}/chat"
-    payload = {
-        "prompt": prompt,
-        "user_id": user_id,
-        "new_chat": True
-    }
-    headers = {"Content-Type": "application/json"}
-    
-    response = requests.post(url, json=payload, headers=headers)
-    return response.json()
-
-def edit_image_to_video(prompt: str, image_path: str, user_id: str = "py_user"):
-    url = f"{BASE_URL}/chat"
-    files = {
-        "image": (image_path, open(image_path, "rb"), "image/png")
-    }
-    data = {
-        "prompt": prompt,
-        "user_id": user_id,
-        "new_chat": "true"
-    }
-    
-    response = requests.post(url, files=files, data=data)
-    return response.json()
-
-if __name__ == "__main__":
-    # Generate simple text
-    print("Sending text prompt...")
-    text_res = generate_text("Explain machine learning in one sentence.")
-    print("Response:", text_res["text"])
-    
-    # Generate / Edit Image-to-Video
-    # print(edit_image_to_video("Animate a flying eagle in the clouds", "eagle.png"))
-```
-
-### Node.js Example (Streaming Support)
-An asynchronous ES6 script displaying streaming chunks using standard node-fetch:
-
-```javascript
-const BASE_URL = "http://localhost:8000";
-
-async function streamStory(prompt) {
-  const response = await fetch(`${BASE_URL}/chat`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      prompt: prompt,
-      stream: true,
-      user_id: "node_user",
-      new_chat: true
-    })
-  });
-
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder("utf-8");
-
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    
-    const chunk = decoder.decode(value);
-    // Print SSE stream lines
-    console.log(chunk);
-  }
-}
-
-streamStory("Write a short futuristic sci-fi paragraph.");
-```
-
----
-
-## 🏗️ Architecture
-
-```
-                                 ┌────────────────────────┐
-                                 │      REST Client       │
-                                 │  (Python, Node, cURL)  │
-                                 └───────────┬────────────┘
-                                             │
-                                             │ HTTP REST / SSE (Port 8000)
-                                             ▼
-┌─────────────────────────────────────────────────────────────────────────────────────────┐
-│ Go API Gateway (Fiber v3 Server)                                                        │
-│                                                                                         │
-│  ┌────────────────┐     ┌──────────────────┐     ┌────────────────┐     ┌────────────┐  │
-│  │ Unified Chat   │     │ Streaming Engine │     │ Media Down-    │     │ In-Place   │  │
-│  │ Endpoints      │     │ (Server-Sent     │     │ loader & Cookie│     │ Watermark  │  │
-│  │ (POST /chat)   │     │ Events)          │     │ Injector       │     │ Processor  │  │
-│  └───────┬────────┘     └────────┬─────────┘     └────────┬───────┘     └──────┬─────┘  │
-└──────────┼───────────────────────┼────────────────────────┼────────────────────┼────────┘
-           │                       │                        │                    │
-           │ JSON RPC payload      │ Chunk Streams          │ Follows manual     │ Executes
-           │                       │                        │ redirects          │ watermark.go
-           ▼                       ▼                        ▼                    ▼
-┌─────────────────────────────────────────────────────────────────────────────────────────┐
-│ Google Gemini Web API Backend                                                           │
-│ (consumer.rpc.StreamGenerate / hNvQHb video poller / Imagen 3 Engine)                   │
-└─────────────────────────────────────────────────────────▲───────────────────────────────┘
-                                                          │
-                                                          │ Live Cookie Synchronization
-                                                          │ (WebSocket Bridge Port 9222)
-                                                 ┌────────┴────────┐
-                                                 │ Chrome Extension│
-                                                 │ Cookie Bridge   │
-                                                 └─────────────────┘
-```
-
-### Directory Structure
-```
-├── main.go               # Fiber HTTP engine startup, Universal REST routers
-├── .env                  # Port and WebSocket bridge configs
-├── cookies.json          # Live cookie storage, written dynamically via extension
-├── gemini/
-│   ├── client.go         # Session initialization, API calls, redirect tracking
-│   ├── models.go         # API schemas and structures
-│   ├── monitor.go        # WebSocket bridge and cookies listener
-│   └── watermark.go      # Native Go reverse alpha-blending watermark remover
-└── extension/
-    ├── manifest.json     # Chrome browser extension manifest definitions
-    ├── background.js     # WebSocket connection to Go backend, cookie event handlers
-    ├── popup.html        # Interactive developer status panel UI
-    └── popup.js          # Local settings controller
-```
-
----
-
-## ⚠️ Limits & Notes
-
-* **Video Quota limits:** Gemini Video generation is limited to standard consumer daily accounts (~3-5 videos daily). The system returns an immediate refusal object with `videos: null` once limits are triggered.
-* **WebSocket Cookie Sync:** Ensure you load the extension located under `/extension` in your browser to automatically stream and sync active cookies to the backend Go server on port `9222`.
-
----
-
-<div align="center">
-
-**⭐ Star this repository if this project helps you! ⭐**
-
-*Disclaimer: This is an unofficial proxy wrapper built for educational and personal research projects. Adhere to Google Terms of Service.*
-
-</div>

monitor/main.go

@@ -546,6 +546,11 @@ func authOK(w http.ResponseWriter, r *http.Request) bool {
 	if got == "" {
 		got = r.URL.Query().Get("key")
 	}
+	if got == "" {
+		if c, err := r.Cookie("apikey"); err == nil {
+			got = c.Value
+		}
+	}
 	if got != apiKey {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return false
@@ -553,6 +558,18 @@ func authOK(w http.ResponseWriter, r *http.Request) bool {
 	return true
 }
 
+// gate wraps a handler so it requires the API key (Bearer header, ?key=, or the
+// apikey cookie). Every monitor route that can view or drive the logged-in
+// browser is gated — nothing is publicly reachable.
+func gate(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !authOK(w, r) {
+			return
+		}
+		h(w, r)
+	}
+}
+
 // gatewayHandler builds an API-key-gated reverse proxy that strips prefix and
 // forwards to target (e.g. /gpt/api/chat -> http://127.0.0.1:9225/api/chat).
 func gatewayHandler(prefix, target string) http.HandlerFunc {
@@ -606,20 +623,28 @@ func main() {
 			http.NotFound(w, r)
 			return
 		}
+		if !authOK(w, r) {
+			return
+		}
+		// If the key arrived via ?key=, persist it as a cookie so the in-page
+		// /api/* fetches (same origin) stay authorized without re-passing it.
+		if k := r.URL.Query().Get("key"); k != "" && k == apiKey {
+			http.SetCookie(w, &http.Cookie{Name: "apikey", Value: k, Path: "/", HttpOnly: true, SameSite: http.SameSiteStrictMode})
+		}
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
 		w.Write(indexHTML)
 	})
-	http.HandleFunc("/api/tabs", tabsHandler)
-	http.HandleFunc("/api/screen", screenHandler)
-	http.HandleFunc("/api/input", inputHandler)
-	http.HandleFunc("/api/navigate", navigateHandler)
-	http.HandleFunc("/api/reload", reloadHandler)
-	http.HandleFunc("/api/back", historyHandler(-1))
-	http.HandleFunc("/api/forward", historyHandler(+1))
-	http.HandleFunc("/api/newtab", newtabHandler)
-	http.HandleFunc("/api/closetab", closetabHandler)
-	http.HandleFunc("/api/stats", statsHandler)
-	http.HandleFunc("/chrome.log", chromeLogHandler)
+	http.HandleFunc("/api/tabs", gate(tabsHandler))
+	http.HandleFunc("/api/screen", gate(screenHandler))
+	http.HandleFunc("/api/input", gate(inputHandler))
+	http.HandleFunc("/api/navigate", gate(navigateHandler))
+	http.HandleFunc("/api/reload", gate(reloadHandler))
+	http.HandleFunc("/api/back", gate(historyHandler(-1)))
+	http.HandleFunc("/api/forward", gate(historyHandler(+1)))
+	http.HandleFunc("/api/newtab", gate(newtabHandler))
+	http.HandleFunc("/api/closetab", gate(closetabHandler))
+	http.HandleFunc("/api/stats", gate(statsHandler))
+	http.HandleFunc("/chrome.log", gate(chromeLogHandler))
 	http.HandleFunc("/logs/", backendLogHandler)
 
 	// API gateway → the three backend servers on localhost (API-key gated).