pollImage/pollVideo capped themselves at 3min/10min while the caller's genCtx budget is 8min (image) / 12min (video), so slow-but-valid generations were killed early with 'adobe generation timed out'. Now the loop honors ctx.Err() and uses the full budget.
Now only the generate/video submit uses proxy.url; cookie-exchange/login, token refresh, credit-balance and project/session bootstrap all go direct. Also splits adobe GenerateVideo (submit=proxy, poll/download=local). Verified live: adobe gpt 1K cookie-exchange via local IP, submit 23.244.30.102 (proxy) vs local 76.209.9.65, 2.0MB PNG. Build+vet pass.
Reference-frame upload, the mp4 download and OpenAsset (/content) streaming now egress on the local IP; only the generate submit uses proxy.url. Verified live: submit egress 98.97.26.37 (proxy) vs upload/download 76.209.9.65 (local), 3.47MB video generated OK.
Extends the adobe split to leonardo, krea, imagine, runway (image+video) and chatgpt: reference-image upload, polling and result download egress on the local IP; only the generate/task-create submit uses proxy.url. chatgpt keeps its anti-bot-guarded submit+upload phase on the proxy and moves only the existing second (poll/resolve/download) session to local. custom is already direct. Build+vet pass; adobe verified live, the other providers are code-complete but not yet live-tested (no dev accounts).
Reference-image upload, job polling and result download now run on the local IP; only the generate submit egresses via proxy.url. Verified live: submit egress 74.244.159.228 (proxy) vs upload/poll/download 76.209.9.65 (local), 1K adobe gpt image generated OK.
The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.
Derive the 49-byte header seed and the salt F per-session from the grok homepage (browser-free tls-client GET), instead of hardcoding constants that go stale on every grok web rebuild (403 anti-bot). F is reproduced natively in Go (curve keyframe sampling: cubic-bezier easing, color lerp, rotation matrix, JS-exact number->hex). Static constants remain as env-overridable fallback. Adds offline regression test against server-verified ground-truth triples.
chiyi
Steven