[ORCHESTRATOR TEST] feat(auth): multi-account Google Antigravity auth with automatic rotation (#579)
* feat(auth): add multi-account types and storage layer Add foundation for multi-account Google Antigravity auth: - ModelFamily, AccountTier, RateLimitState types for rate limit tracking - AccountMetadata, AccountStorage, ManagedAccount interfaces - Cross-platform storage module with XDG_DATA_HOME/APPDATA support - Comprehensive test coverage for storage operations 🤖 Generated with [OhMyOpenCode](https://github.com/code-yeongyu/oh-my-opencode) * feat(auth): implement AccountManager for multi-account rotation Add AccountManager class with automatic account rotation: - Per-family rate limit tracking (claude, gemini-flash, gemini-pro) - Paid tier prioritization in rotation logic - Round-robin account selection within tier pools - Account add/remove operations with index management - Storage persistence integration 🤖 Generated with [OhMyOpenCode](https://github.com/code-yeongyu/oh-my-opencode) * feat(auth): add CLI prompts for multi-account setup Add @clack/prompts-based CLI utilities: - promptAddAnotherAccount() for multi-account flow - promptAccountTier() for free/paid tier selection - Non-TTY environment handling (graceful skip) 🤖 Generated with [OhMyOpenCode](https://github.com/code-yeongyu/oh-my-opencode) * feat(auth): integrate multi-account OAuth flow into plugin Enhance OAuth flow for multi-account support: - Prompt for additional accounts after first OAuth (up to 10) - Collect email and tier for each account - Save accounts to storage via AccountManager - Load AccountManager in loader() from stored accounts - Toast notifications for account authentication success - Backward compatible with single-account flow 🤖 Generated with [OhMyOpenCode](https://github.com/code-yeongyu/oh-my-opencode) * feat(auth): add rate limit rotation to fetch interceptor Integrate AccountManager into fetch for automatic rotation: - Model family detection from URL (claude/gemini-flash/gemini-pro) - Rate limit detection (429 with retry-after > 5s, 5xx errors) - Mark rate-limited accounts and rotate to next available - Recursive retry with new account on rotation - Lazy load accounts from storage on first request - Debug logging for account switches 🤖 Generated with [OhMyOpenCode](https://github.com/code-yeongyu/oh-my-opencode) * feat(cli): add auth account management commands Add CLI commands for managing Google Antigravity accounts: - `auth list`: Show all accounts with email, tier, rate limit status - `auth remove <index|email>`: Remove account by index or email - Help text with usage examples - Active account indicator and remaining rate limit display 🤖 Generated with [OhMyOpenCode](https://github.com/code-yeongyu/oh-my-opencode) * refactor(auth): address review feedback - remove duplicate ManagedAccount and reuse fetch function - Remove unused ManagedAccount interface from types.ts (duplicate of accounts.ts) - Reuse fetchFn in rate limit retry instead of creating new fetch closure Preserves cachedTokens, cachedProjectId, fetchInstanceId, accountsLoaded state * fix(auth): address Cubic review feedback (8 issues) P1 fixes: - storage.ts: Use mode 0o600 for OAuth credentials file (security) - fetch.ts: Return original 5xx status instead of synthesized 429 - accounts.ts: Adjust activeIndex/currentIndex in removeAccount - plugin.ts: Fix multi-account migration to split on ||| not | P2 fixes: - cli.ts: Remove confusing cancel message when returning default - auth.ts: Use strict parseInt check to prevent partial matches - storage.test.ts: Use try/finally for env var cleanup * refactor(test): import ManagedAccount from accounts.ts instead of duplicating * fix(auth): address Oracle review findings (P1/P2) P1 fixes: - Clear cachedProjectId on account change to prevent stale project IDs - Continue endpoint fallback for single-account users on rate limit - Restore access/expires tokens from storage for non-active accounts - Re-throw non-ENOENT filesystem errors (keep returning null for parse errors) - Use atomic write (temp file + rename) for account storage P2 fixes: - Derive RateLimitState type from ModelFamily using mapped type - Add MODEL_FAMILIES constant and use dynamic iteration in clearExpiredRateLimits - Add missing else branch in storage.test.ts env cleanup - Handle open() errors gracefully with user-friendly toast message Tests updated to reflect correct behavior for token restoration. * fix(auth): address Cubic review round 2 (5 issues) P1: Return original 429/5xx response on last endpoint instead of generic 503 P2: Use unique temp filename (pid+timestamp) and cleanup on rename failure P2: Clear cachedProjectId when first account introduced (lastAccountIndex null) P3: Add console.error logging to open() catch block * test(auth): add AccountManager removeAccount index tests Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * test(auth): add storage layer security and atomicity tests Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(auth): address Cubic review round 3 (4 issues) P1 Fixes: - plugin.ts: Validate refresh_token before constructing first account - plugin.ts: Validate additionalTokens.refresh_token before pushing accounts - fetch.ts: Reset cachedTokens when switching accounts during rotation P2 Fixes: - fetch.ts: Improve model-family detection (parse model from body, fallback to URL) * fix(auth): address Cubic review round 4 (3 issues) P1 Fixes: - plugin.ts: Close serverHandle before early return on missing refresh_token - plugin.ts: Close additionalServerHandle before continue on missing refresh_token P2 Fixes: - fetch.ts: Remove overly broad 'pro' matching in getModelFamilyFromModelName * fix(auth): address Cubic review round 5 (9 issues) P1 Fixes: - plugin.ts: Close additionalServerHandle after successful account auth - fetch.ts: Cancel response body on 429/5xx to prevent connection leaks P2 Fixes: - plugin.ts: Close additionalServerHandle on OAuth error/missing code - plugin.ts: Close additionalServerHandle on verifier mismatch - auth.ts: Set activeIndex to -1 when all accounts removed - storage.ts: Use shared getDataDir utility for consistent paths - fetch.ts: Catch loadAccounts IO errors with graceful fallback - storage.test.ts: Improve test assertions with proper error tracking * feat(antigravity): add system prompt and thinking config constants * feat(antigravity): add reasoning_effort and Gemini 3 thinkingLevel support * feat(antigravity): inject system prompt into all requests * feat(antigravity): integrate thinking config and system prompt in fetch layer * feat(auth): auto-open browser for OAuth login on all platforms * fix(auth): add alias2ModelName for Antigravity Claude models Root cause: Antigravity API expects 'claude-sonnet-4-5-thinking' but we were sending 'gemini-claude-sonnet-4-5-thinking'. Ported alias mapping from CLIProxyAPI antigravity_executor.go:1328-1347. Transforms: - gemini-claude-sonnet-4-5-thinking → claude-sonnet-4-5-thinking - gemini-claude-opus-4-5-thinking → claude-opus-4-5-thinking - gemini-3-pro-preview → gemini-3-pro-high - gemini-3-flash-preview → gemini-3-flash * fix(auth): add requestType and toolConfig for Antigravity API Missing required fields from CLIProxyAPI implementation: - requestType: 'agent' - request.toolConfig.functionCallingConfig.mode: 'VALIDATED' - Delete request.safetySettings Also strip 'antigravity-' prefix before alias transformation. * fix(auth): remove broken alias2ModelName transformations for Gemini 3 CLIProxyAPI's alias mappings don't work with public Antigravity API: - gemini-3-pro-preview → gemini-3-pro-high (404!) - gemini-3-flash-preview → gemini-3-flash (404!) Tested: -preview suffix names work, transformed names return 404. Keep only gemini-claude-* prefix stripping for future Claude support. * fix(auth): implement correct alias2ModelName transformations for Antigravity API Implements explicit switch-based model name mappings for Antigravity API. Updates SANDBOX endpoint constants to clarify quota/availability behavior. Fixes test expectations to match new transformation logic. 🤖 Generated with assistance of OhMyOpenCode --------- Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
YeonGyu-Kim
+273
-12
@@ -37,7 +37,12 @@ import {
|
||||
} from "./oauth"
|
||||
import { createAntigravityFetch } from "./fetch"
|
||||
import { fetchProjectContext } from "./project"
|
||||
import { formatTokenForStorage } from "./token"
|
||||
import { formatTokenForStorage, parseStoredToken } from "./token"
|
||||
import { AccountManager } from "./accounts"
|
||||
import { loadAccounts } from "./storage"
|
||||
import { promptAddAnotherAccount, promptAccountTier } from "./cli"
|
||||
import { openBrowserURL } from "./browser"
|
||||
import type { AccountTier, AntigravityRefreshParts } from "./types"
|
||||
|
||||
/**
|
||||
* Provider ID for Google models
|
||||
@@ -45,6 +50,11 @@ import { formatTokenForStorage } from "./token"
|
||||
*/
|
||||
const GOOGLE_PROVIDER_ID = "google"
|
||||
|
||||
/**
|
||||
* Maximum number of Google accounts that can be added
|
||||
*/
|
||||
const MAX_ACCOUNTS = 10
|
||||
|
||||
/**
|
||||
* Type guard to check if auth is OAuth type
|
||||
*/
|
||||
@@ -118,6 +128,40 @@ export async function createGoogleAntigravityAuthPlugin({
|
||||
console.log("[antigravity-plugin] OAuth auth detected, creating custom fetch")
|
||||
}
|
||||
|
||||
let accountManager: AccountManager | null = null
|
||||
try {
|
||||
const storedAccounts = await loadAccounts()
|
||||
if (storedAccounts) {
|
||||
accountManager = new AccountManager(currentAuth, storedAccounts)
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.log(`[antigravity-plugin] Loaded ${accountManager.getAccountCount()} accounts from storage`)
|
||||
}
|
||||
} else if (currentAuth.refresh.includes("|||")) {
|
||||
const tokens = currentAuth.refresh.split("|||")
|
||||
const firstToken = tokens[0]!
|
||||
accountManager = new AccountManager(
|
||||
{ refresh: firstToken, access: currentAuth.access || "", expires: currentAuth.expires || 0 },
|
||||
null
|
||||
)
|
||||
for (let i = 1; i < tokens.length; i++) {
|
||||
const parts = parseStoredToken(tokens[i]!)
|
||||
accountManager.addAccount(parts)
|
||||
}
|
||||
await accountManager.save()
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.log("[antigravity-plugin] Migrated multi-account auth to storage")
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.error(
|
||||
`[antigravity-plugin] Failed to load accounts: ${
|
||||
error instanceof Error ? error.message : "Unknown error"
|
||||
}`
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
cachedClientId =
|
||||
(provider.options?.clientId as string) || ANTIGRAVITY_CLIENT_ID
|
||||
cachedClientSecret =
|
||||
@@ -180,6 +224,7 @@ export async function createGoogleAntigravityAuthPlugin({
|
||||
return {
|
||||
fetch: antigravityFetch,
|
||||
apiKey: "antigravity-oauth",
|
||||
accountManager,
|
||||
}
|
||||
},
|
||||
|
||||
@@ -197,6 +242,7 @@ export async function createGoogleAntigravityAuthPlugin({
|
||||
/**
|
||||
* Starts the OAuth authorization flow.
|
||||
* Opens browser for Google OAuth and waits for callback.
|
||||
* Supports multi-account flow with prompts for additional accounts.
|
||||
*
|
||||
* @returns Authorization result with URL and callback
|
||||
*/
|
||||
@@ -204,10 +250,13 @@ export async function createGoogleAntigravityAuthPlugin({
|
||||
const serverHandle = startCallbackServer()
|
||||
const { url, verifier } = await buildAuthURL(undefined, cachedClientId, serverHandle.port)
|
||||
|
||||
const browserOpened = await openBrowserURL(url)
|
||||
|
||||
return {
|
||||
url,
|
||||
instructions:
|
||||
"Complete the sign-in in your browser. We'll automatically detect when you're done.",
|
||||
instructions: browserOpened
|
||||
? "Opening browser for sign-in. We'll automatically detect when you're done."
|
||||
: "Please open the URL above in your browser to sign in.",
|
||||
method: "auto",
|
||||
|
||||
callback: async () => {
|
||||
@@ -238,28 +287,240 @@ export async function createGoogleAntigravityAuthPlugin({
|
||||
|
||||
const tokens = await exchangeCode(result.code, verifier, cachedClientId, cachedClientSecret, serverHandle.port)
|
||||
|
||||
if (!tokens.refresh_token) {
|
||||
serverHandle.close()
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.error("[antigravity-plugin] OAuth response missing refresh_token")
|
||||
}
|
||||
return { type: "failed" as const }
|
||||
}
|
||||
|
||||
let email: string | undefined
|
||||
try {
|
||||
const userInfo = await fetchUserInfo(tokens.access_token)
|
||||
email = userInfo.email
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.log(`[antigravity-plugin] Authenticated as: ${userInfo.email}`)
|
||||
console.log(`[antigravity-plugin] Authenticated as: ${email}`)
|
||||
}
|
||||
} catch {
|
||||
// User info is optional
|
||||
}
|
||||
|
||||
const projectContext = await fetchProjectContext(tokens.access_token)
|
||||
const projectId = projectContext.cloudaicompanionProject || ""
|
||||
const tier = await promptAccountTier()
|
||||
|
||||
const formattedRefresh = formatTokenForStorage(
|
||||
tokens.refresh_token,
|
||||
projectContext.cloudaicompanionProject || "",
|
||||
projectContext.managedProjectId
|
||||
)
|
||||
const expires = Date.now() + tokens.expires_in * 1000
|
||||
const accounts: Array<{
|
||||
parts: AntigravityRefreshParts
|
||||
access: string
|
||||
expires: number
|
||||
email?: string
|
||||
tier: AccountTier
|
||||
projectId: string
|
||||
}> = [{
|
||||
parts: {
|
||||
refreshToken: tokens.refresh_token,
|
||||
projectId,
|
||||
managedProjectId: projectContext.managedProjectId,
|
||||
},
|
||||
access: tokens.access_token,
|
||||
expires,
|
||||
email,
|
||||
tier,
|
||||
projectId,
|
||||
}]
|
||||
|
||||
await client.tui.showToast({
|
||||
body: {
|
||||
message: `Account 1 authenticated${email ? ` (${email})` : ""}`,
|
||||
variant: "success",
|
||||
},
|
||||
})
|
||||
|
||||
while (accounts.length < MAX_ACCOUNTS) {
|
||||
const addAnother = await promptAddAnotherAccount(accounts.length)
|
||||
if (!addAnother) break
|
||||
|
||||
const additionalServerHandle = startCallbackServer()
|
||||
const { url: additionalUrl, verifier: additionalVerifier } = await buildAuthURL(
|
||||
undefined,
|
||||
cachedClientId,
|
||||
additionalServerHandle.port
|
||||
)
|
||||
|
||||
const additionalBrowserOpened = await openBrowserURL(additionalUrl)
|
||||
if (!additionalBrowserOpened) {
|
||||
await client.tui.showToast({
|
||||
body: {
|
||||
message: `Please open in browser: ${additionalUrl}`,
|
||||
variant: "warning",
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
try {
|
||||
const additionalResult = await additionalServerHandle.waitForCallback()
|
||||
|
||||
if (additionalResult.error || !additionalResult.code) {
|
||||
additionalServerHandle.close()
|
||||
await client.tui.showToast({
|
||||
body: {
|
||||
message: "Skipping this account...",
|
||||
variant: "warning",
|
||||
},
|
||||
})
|
||||
continue
|
||||
}
|
||||
|
||||
const additionalState = decodeState(additionalResult.state)
|
||||
if (additionalState.verifier !== additionalVerifier) {
|
||||
additionalServerHandle.close()
|
||||
await client.tui.showToast({
|
||||
body: {
|
||||
message: "Verification failed, skipping...",
|
||||
variant: "warning",
|
||||
},
|
||||
})
|
||||
continue
|
||||
}
|
||||
|
||||
const additionalTokens = await exchangeCode(
|
||||
additionalResult.code,
|
||||
additionalVerifier,
|
||||
cachedClientId,
|
||||
cachedClientSecret,
|
||||
additionalServerHandle.port
|
||||
)
|
||||
|
||||
if (!additionalTokens.refresh_token) {
|
||||
additionalServerHandle.close()
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.error("[antigravity-plugin] Additional account OAuth response missing refresh_token")
|
||||
}
|
||||
await client.tui.showToast({
|
||||
body: {
|
||||
message: "Account missing refresh token, skipping...",
|
||||
variant: "warning",
|
||||
},
|
||||
})
|
||||
continue
|
||||
}
|
||||
|
||||
let additionalEmail: string | undefined
|
||||
try {
|
||||
const additionalUserInfo = await fetchUserInfo(additionalTokens.access_token)
|
||||
additionalEmail = additionalUserInfo.email
|
||||
} catch {
|
||||
// User info is optional
|
||||
}
|
||||
|
||||
const additionalProjectContext = await fetchProjectContext(additionalTokens.access_token)
|
||||
const additionalProjectId = additionalProjectContext.cloudaicompanionProject || ""
|
||||
const additionalTier = await promptAccountTier()
|
||||
|
||||
const additionalExpires = Date.now() + additionalTokens.expires_in * 1000
|
||||
|
||||
accounts.push({
|
||||
parts: {
|
||||
refreshToken: additionalTokens.refresh_token,
|
||||
projectId: additionalProjectId,
|
||||
managedProjectId: additionalProjectContext.managedProjectId,
|
||||
},
|
||||
access: additionalTokens.access_token,
|
||||
expires: additionalExpires,
|
||||
email: additionalEmail,
|
||||
tier: additionalTier,
|
||||
projectId: additionalProjectId,
|
||||
})
|
||||
|
||||
additionalServerHandle.close()
|
||||
|
||||
await client.tui.showToast({
|
||||
body: {
|
||||
message: `Account ${accounts.length} authenticated${additionalEmail ? ` (${additionalEmail})` : ""}`,
|
||||
variant: "success",
|
||||
},
|
||||
})
|
||||
} catch (error) {
|
||||
additionalServerHandle.close()
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.error(
|
||||
`[antigravity-plugin] Additional account OAuth failed: ${
|
||||
error instanceof Error ? error.message : "Unknown error"
|
||||
}`
|
||||
)
|
||||
}
|
||||
await client.tui.showToast({
|
||||
body: {
|
||||
message: "Failed to authenticate additional account, skipping...",
|
||||
variant: "warning",
|
||||
},
|
||||
})
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
const firstAccount = accounts[0]!
|
||||
try {
|
||||
const accountManager = new AccountManager(
|
||||
{
|
||||
refresh: formatTokenForStorage(
|
||||
firstAccount.parts.refreshToken,
|
||||
firstAccount.projectId,
|
||||
firstAccount.parts.managedProjectId
|
||||
),
|
||||
access: firstAccount.access,
|
||||
expires: firstAccount.expires,
|
||||
},
|
||||
null
|
||||
)
|
||||
|
||||
for (let i = 1; i < accounts.length; i++) {
|
||||
const acc = accounts[i]!
|
||||
accountManager.addAccount(
|
||||
acc.parts,
|
||||
acc.access,
|
||||
acc.expires,
|
||||
acc.email,
|
||||
acc.tier
|
||||
)
|
||||
}
|
||||
|
||||
const currentAccount = accountManager.getCurrentAccount()
|
||||
if (currentAccount) {
|
||||
currentAccount.email = firstAccount.email
|
||||
currentAccount.tier = firstAccount.tier
|
||||
}
|
||||
|
||||
await accountManager.save()
|
||||
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.log(`[antigravity-plugin] Saved ${accounts.length} accounts to storage`)
|
||||
}
|
||||
} catch (error) {
|
||||
if (process.env.ANTIGRAVITY_DEBUG === "1") {
|
||||
console.error(
|
||||
`[antigravity-plugin] Failed to save accounts: ${
|
||||
error instanceof Error ? error.message : "Unknown error"
|
||||
}`
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
const allRefreshTokens = accounts
|
||||
.map((acc) => formatTokenForStorage(
|
||||
acc.parts.refreshToken,
|
||||
acc.projectId,
|
||||
acc.parts.managedProjectId
|
||||
))
|
||||
.join("|||")
|
||||
|
||||
return {
|
||||
type: "success" as const,
|
||||
access: tokens.access_token,
|
||||
refresh: formattedRefresh,
|
||||
expires: Date.now() + tokens.expires_in * 1000,
|
||||
access: firstAccount.access,
|
||||
refresh: allRefreshTokens,
|
||||
expires: firstAccount.expires,
|
||||
}
|
||||
} catch (error) {
|
||||
serverHandle.close()
|
||||
|
||||
Reference in New Issue
Block a user