Source of truth: , , , Last updated: 2026-05-13 — v3.8.0 Audience: Engineers maintaining provider-specific stealth integrations.

not for evading fraud detection, sharing credentials, or violating provider Terms of Service. The maintainers expect operators to comply with the upstream ToS they signed when creating accounts.

---

— wreq-js (Chrome 124)

session that impersonates Chrome 124 on macOS. Used as a generic JA3/JA4 wrapper for upstreams behind Cloudflare. Falls back to native fetch when is not installed ().

• → → (also lower-case)
• (inherits from , default 600000)
• Response is fetch-compatible (, , , , ).

— tls-client-node (Firefox 148)

. ChatGPT's Cloudflare config pins to JA3/JA4 + HTTP/2 SETTINGS frame ordering — undici's handshake gets even with valid cookies.

(must match the Firefox 148 sent)
• (koffi-loaded shared library; avoids managed sidecar HTTP)
• supports streaming (writes body to temp file, tailed as )
• + triggers so the next call respawns the binding
• → → // (the native binding does not read these envs itself; it must be threaded through)
• (binary missing), (binding deadlocked)

---

is on, OmniRoute reshapes outgoing Claude requests so they are indistinguishable from traffic. Three modules collaborate:

fingerprint embedded in the billing header:

(hardcoded; matches official client)

(Client Content Hash)

:

placeholder
3. with the computed token

zero-width joiner () after the first character of "sensitive" client names so upstream filters cannot grep them. Default word list:

blocks, all , and / . Operator-overridable via .

— providers

• (Opus/Sonnet 4.x family)

— temperature + cache-control rules
• — tool-name remapping
• — extra payload normalization

---

, , , , . Mirrors ZeroGravity's and CLIProxyAPI's cloak system.

, , , , , , , , ) before forwarding.

(account-ban hot spot)

(consumed by ) routes every request through Antigravity AI Credit Overages (paid Google credits) instead of letting Google's free-tier quota gate things. This is documented as a feature, but it is the single most common ToS-violation report we see — multiple Google Ultra accounts have been banned with after running for a few hours with .

Google's side, not anything OmniRoute can prevent. The env var name and the existing docs make it sound like a safe knob to flip; it isn't.

Why this draws abuse detection more aggressively than free-tier-only usage:

Recommended posture:

Default to — overages are used only when free-tier returns 429, not on every request. This is the safer of the two non-zero modes.
1. Spread load across providers via Auto-Combo ( or -combo) instead of saturating a single Antigravity account.
2. Set per-connection RPM limits in the Antigravity provider's edit page (Dashboard → Providers → Antigravity → connection → rate limit). 30–60 RPM is a defensible upper bound for sustained use.
3. Use distinct upstream IPs per Antigravity account when possible (residential proxies aimed at the same account from many users compounds the abuse signal).
4. If banned: appeal via → "Restore Workspace/Account access" with the exact / response body Google sent. Restoration is not guaranteed.

is set to (or will be in v3.8.0; tracked separately).

— reads
• — credential plumbing
• #1183

---

interface CliFingerprint {
  headerOrder: string[]; // case-sensitive
  bodyFieldOrder: string[]; // top-level JSON keys
  userAgent?: string | (() => string);
  extraHeaders?: Record<string, string>;
}