From 9bd867a9a78aa219b86ed3559ddc4c4a0c14b41e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C4=B1za=20KARA?=
 <17912708+rizakara@users.noreply.github.com>
Date: Sat, 5 Sep 2026 17:16:37 +0300
Subject: [PATCH] fix(server): stop blaming Google sign-in for Antigravity
 session errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Antigravity setup runs `authenticate` and then a `session/new` probe in the
same flow. When the probe fails, `safeAuthFailure` had no case for it and fell
through to "Google sign-in failed. Start sign-in again." — even though Google
had succeeded and `acp_token.json` was already written. Following that banner
means signing out, which deletes the working token.

Map an ACP request error on a `session/*` method to a message that says the
sign-in worked and tells the user not to sign out.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../src/provider/AntigravityAuth.test.ts      | 21 ++++++++++++++++++-
 apps/server/src/provider/AntigravityAuth.ts   |  6 ++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/provider/AntigravityAuth.test.ts b/apps/server/src/provider/AntigravityAuth.test.ts
index f009255e90a2..32d170ad5d56 100644
--- a/apps/server/src/provider/AntigravityAuth.test.ts
+++ b/apps/server/src/provider/AntigravityAuth.test.ts
@@ -61,7 +61,7 @@ const makeHarness = Effect.fn("makeAuthTestHarness")(function* (
   } = {},
 ) {
   const authenticated = yield* Deferred.make<void, AcpErrors.AcpError>();
-  const discovered = yield* Deferred.make<void>();
+  const discovered = yield* Deferred.make<void, AcpErrors.AcpError>();
   const closed = yield* Deferred.make<void>();
   const events: string[] = [];
   let receiveAuthorizationUrl:
@@ -243,6 +243,25 @@ it.layer(NodeServices.layer)("AntigravityAuth", (it) => {
     }),
   );
 
+  it.effect("keeps a failed session request from reading as a Google sign-in failure", () =>
+    Effect.gen(function* () {
+      const harness = yield* makeHarness();
+      const state = yield* harness.auth.controller.start(owner);
+      yield* phase(harness.auth, "waiting");
+      yield* harness.auth.controller.complete(owner, { flowId: state.flowId!, callbackUrl });
+      yield* Deferred.succeed(harness.authenticated, undefined);
+      yield* Deferred.fail(
+        harness.discovered,
+        AcpErrors.AcpRequestError.internalError("Internal error", undefined, {
+          method: "session/new",
+        }),
+      );
+      const failed = yield* phase(harness.auth, "failed");
+      assert.notInclude(failed.message ?? "", "Google sign-in failed");
+      assert.include(failed.message ?? "", "could not start a session");
+    }),
+  );
+
   it.effect("accepts direct local or cached completion without a callback RPC", () =>
     Effect.gen(function* () {
       const harness = yield* makeHarness({ interactive: false });
diff --git a/apps/server/src/provider/AntigravityAuth.ts b/apps/server/src/provider/AntigravityAuth.ts
index c7118bccad83..420904109961 100644
--- a/apps/server/src/provider/AntigravityAuth.ts
+++ b/apps/server/src/provider/AntigravityAuth.ts
@@ -117,6 +117,12 @@ function safeAuthFailure(cause: Cause.Cause<unknown>, usesBrowser: boolean): str
       if (!usesBrowser && error.value.code === -32602) {
         return "Antigravity rejected the configured credentials. Check the provider settings.";
       }
+      // Authentication already succeeded once the flow reaches a session
+      // request, so the stored credentials are valid. Telling the user to sign
+      // in again would send them through a sign-out that deletes them.
+      if (error.value.method?.startsWith("session/")) {
+        return "Signed in, but Antigravity could not start a session. Retry without signing out.";
+      }
     }
   }
   return usesBrowser