fix(oauth): recover Antigravity 401 with account-bound credentials

[lidge-jun]

Summary

Antigravity OAuth requests receiving an upstream 401 currently skip the shared forced-refresh and one-replay path. Enable that existing path while keeping the rejected account's token and Cloud Code Assist project together. Refuse replay without a usable project and keep the second 401 terminal.

Carries #3576 and resolves #3575 after verified dev integration. Original agentHits commits are retained with cherry-pick provenance. Both native passthrough and adapted Responses recovery use the existing account/generation fences; no new account-pool or generic retry policy is introduced.

Stack layer 4/5, depends on #3688 (codex/c-lane-3631-d778). Review this layer only; quota diagnostics follows above it. Merge bottom-up into dev.

Verification

• Local tests, typechecks and builds are not run, per maintainer instruction.
• macmini-cf Bun 1.4.0, exact head 9b5ffaaaaa5ee954b1ff14707ed65785f22192b8: 208 pass / 0 fail across 11 files, including native path assertions and layout/core-boundary checks. Archive SHA256 verified.
• Independent security/code re-review: PASS; fixture URL/reachability corrections verified at the same head.
• Coverage includes JSON/SSE and Chat bridge recovery, native passthrough guards, bounded refresh/replay, and same-account token/project pairing.
• New regression file registered in both repository test-layout manifests.
• Independent security review and exact-head hosted full CI gate merge.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: agentHits zvercombat26rus@icloud.com

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 62 / 80

이 PR은 Antigravity OAuth가 upstream 401을 받았을 때 공유 forced-refresh + one-replay 경로를 타게 합니다. 원본 #3576 carry, 이슈 #3575 해결 목표입니다. 거절된 계정의 token과 Cloud Code Assist projectId를 같이 유지하고, project 없이 replay하지 않으며, 두 번째 401은 terminal입니다. C-lane 스택에서 #3688 위 층(4/5)이고 base는 codex/c-lane-3631-d778입니다.

지금 FORCE_REFRESH_PROVIDERS와 Responses core의 OAuth 401 replay allowlist는 xai/copilot/kiro만 있습니다. Antigravity는 401에서 refresh/replay를 건너뛰어 바로 실패합니다. 이 변경은 allowlist에 google-antigravity를 넣고, cloud-code-assist 모드에서 refresh 후 project가 없으면 401로 거절하며, transport resolve 시 project를 같이 실습니다. 새 account-pool/generic retry 정책은 만들지 않습니다.

계정·generation fence를 기존 경로에 태운 점이 좋습니다. 테스트 파일이 layout에 등록됩니다. draft·#3688 의존·보안 리뷰 통과 서술이 있습니다.

경로/심볼 src/oauth/index.ts FORCE_REFRESH_PROVIDERS - google-antigravity 추가.

경로/심볼 src/server/responses/core.ts OAuth 401 replay - 동명 provider 허용 + CCA project 가드(두 자리: adapted/native 근처).

경로 원본 #3576 / 이슈 #3575 - 머지 후 #3576 landed 닫기, #3575 닫기.

경로 상위 #3693(quota refresh diagnostics) - 이 층 위에 쌓입니다. 아래부터 머지하세요.

메인테이너의 판단이 필요한 지점

• #3688이 아직 draft인데 C-lane을 통째로 기다릴지, #3688만 먼저 넣을지
• Antigravity 401을 계정 pause/reauth UX와 어떻게 연결할지

너의 추천
#3688 안착 후 이 층 CI·draft 해제·머지. #3576/#3575 landed·이슈 닫기. 단독 dev 머지 금지.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Owner explicitly authorized admin merging the C-lane stack. Independent security/code review: PASS at 9b5ffaaaaa5ee954b1ff14707ed65785f22192b8. Remote focused verification: 208pass/0fail. Exact-head Cross-platform CI run 33979752516 succeeded with actual Linux/macOS suites and typecheck. Admin merge uses the owner-authorized review bypass; no self-approval is claimed. Original author attribution is retained.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T18:39:08.405581Z	9b5ffaa	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.