fix(antigravity): reliable Google sign-in on Windows; app-owned sign-in page opening

.github/workflows/managed-provider-runtime-update-provider.yml

@@ -281,6 +281,8 @@ jobs:
             apps/server/src/provider/antigravityAuthSupport.ts \
             apps/server/src/provider/acp \
             apps/server/src/scient/skills/antigravityPluginSkillProjection.ts \
+            apps/server/src/scient/skills/antigravityUserSkillLinks.ts \
+            apps/server/src/scient/providerLifecycle/antigravityBrowserHelperPreflight.ts \
             apps/server/scripts/qualify-antigravity-acp-catalog.ts \
             apps/server/src/scient/providerLifecycle/antigravityAcpCatalog.ts \
             apps/server/package.json \

UPSTREAM.md

@@ -1061,6 +1061,47 @@ Legacy CLI owners are named explicitly and remain active for explicit `agy` path
 and targets outside the qualified native set; removing a fallback requires native
 replacement qualification, not merely an available Google archive.
 
+Antigravity sign-in carries four marked seams into upstream-owned files. Three fix upstream bugs
+worth proposing to T3:
+
+- `linkAntigravityUserSkills` (`provider/antigravityAuthSupport.ts`) linked the private profile's
+  `config/skills` and `antigravity-cli/skills` to `~/.gemini` even when those directories did not
+  exist; on `session/new` the agent then fails every session with -32603. The seam calls
+  `scient/skills/antigravityUserSkillLinks.ts`: link only an existing directory, remove a dangling
+  link, and replace an empty directory the agent created once the target exists; a directory with
+  content is never touched. One marked fixture line in `antigravityAuthSupport.test.ts` creates
+  the CLI skill directory that upstream's test expected to be linked while missing.
+- `prepareAntigravityProfile`'s browser-helper preflight ran on every launch, and its
+  `timeoutOrElse` waited for the helper's teardown (`taskkill`, then an unbounded exit wait on
+  Windows). The seam (`scient/providerLifecycle/antigravityBrowserHelperPreflight.ts`) keeps a
+  success per helper executable and Node/Electron startup variables for the server process, and
+  lets a timed-out teardown finish in the background, bounded by one forced kill of the helper,
+  which a second marked line records as it starts. Creating the helper process is synchronous in
+  Node on Windows and can still block the event loop once.
+- `removeAntigravitySessionFiles` (`provider/acp/AntigravitySessionFiles.ts`) could not clean up
+  after a failed `session/new`, which leaves `<session>.db-wal`/`-shm` and never reports the
+  session id. The seam sweeps SQLite sidecars without their database
+  (`scient/providerLifecycle/antigravityConversationSidecars.ts`).
+
+The fourth stays inside `AntigravityAuth.ts`'s existing marked failure block, which takes its
+post-authentication message from `scient/providerLifecycle/antigravityAuthDiagnostics.ts` so the
+lifecycle bridge can mark the failure `failedAfterSignIn`; the same module records the failed
+ACP request in the local trace. Opening sign-in pages for the client that started them, and the
+Settings row's one-click sign-in, live in Scient-owned web modules
+(`scient/providerConnection/providerSignIn*.ts` and `oneClickSignIn.ts`), with one marked mount of
+`ProviderSignInPageCoordinator` in each authenticated shell of `routes/__root.tsx`.
+The server-side claim of a sign-in page adds one Scient RPC,
+`server.claimProviderSignInPage`, declared in `contracts/src/scient/providerConnectionRpcs.ts` and
+imported in its existing marked block of `contracts/src/rpc.ts`; its group entry, scope
+(`server/src/auth/RpcAuthorization.ts`) and aggregate (`server/src/observability/RpcInstrumentation.ts`)
+are each one marked line beside the existing provider-connection entries. Those existing
+provider-connection entries in the three files are earlier unmarked Scient additions, to be marked in a follow-up.
+The web defines its command in `scient/providerConnection/providerSignInCommands.ts`.
+`components/settings/ProviderInstanceCard.tsx` carries three marked blocks: its lifecycle
+presentation comes from a Scient hook (its import and its call), so a sign-in started here reads
+as starting from the click, and a failed sign-in or setup takes the error status dot. See
+[provider lifecycle](docs/internals/provider-lifecycle.md#opening-sign-in-pages).
+
 Antigravity reasoning presentation is a narrow client-side divergence. The shared
 `packages/client-runtime/src/antigravityModelPresentation.ts` groups recognized
 Google Gemini effort variants for the existing model and reasoning controls.

apps/server/src/auth/RpcAuthorization.ts

@@ -78,6 +78,9 @@ export const RPC_REQUIRED_SCOPES = {
 
   [WS_METHODS.serverStartProviderConnection]: AuthProvidersManageScope,
   [WS_METHODS.serverCancelProviderConnection]: AuthProvidersManageScope,
+  // SCIENT-FORK:START — claiming a sign-in page needs the scope that starts the sign-in.
+  [WS_METHODS.serverClaimProviderSignInPage]: AuthProvidersManageScope,
+  // SCIENT-FORK:END
   [WS_METHODS.serverSubmitProviderAuthorizationCode]: AuthProvidersManageScope,
   [WS_METHODS.serverDisconnectProvider]: AuthProvidersManageScope,
   [WS_METHODS.serverPlanProviderRuntime]: AuthProvidersManageScope,

apps/server/src/observability/RpcInstrumentation.ts

@@ -265,6 +265,9 @@ const RPC_AGGREGATES = {
   [WS_METHODS.documentsReleaseDocumentPdf]: "documents",
   [WS_METHODS.serverStartProviderConnection]: "server",
   [WS_METHODS.serverCancelProviderConnection]: "server",
+  // SCIENT-FORK:START — sign-in page claims count with the other server RPCs.
+  [WS_METHODS.serverClaimProviderSignInPage]: "server",
+  // SCIENT-FORK:END
   [WS_METHODS.serverSubmitProviderAuthorizationCode]: "server",
   [WS_METHODS.serverDisconnectProvider]: "server",
   [WS_METHODS.serverPlanProviderRuntime]: "server",

apps/server/src/provider/AntigravityAuth.ts

@@ -20,8 +20,11 @@ import * as SubscriptionRef from "effect/SubscriptionRef";
 import * as AcpErrors from "effect-acp/errors";
 
 import type * as AcpSessionRuntime from "@t3tools/provider-acp/server/AcpSessionRuntime";
-// SCIENT-FORK:START — bounded native failure metadata, without provider payloads.
-import { recordAntigravityAuthFailure } from "../scient/providerLifecycle/antigravityAuthDiagnostics.ts";
+// SCIENT-FORK:START — bounded local failure diagnostics and the shared setup-failure message.
+import {
+  ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE,
+  recordAntigravityAuthFailure,
+} from "../scient/providerLifecycle/antigravityAuthDiagnostics.ts";
 // SCIENT-FORK:END
 import {
   antigravityAuthStageFailure,
@@ -125,7 +128,7 @@ function safeAuthFailure(
         return "Google sign-in was not approved. Start sign-in again.";
       }
       if (error.value.method === "session/new" && error.value.code === -32603) {
-        return "Antigravity authenticated, but could not initialize a session or load models.";
+        return ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE;
       }
       if (!usesBrowser && error.value.code === -32602) {
         return "Antigravity rejected the configured credentials. Check the provider settings.";

apps/server/src/provider/Drivers/ScientAntigravityDriver.ts

@@ -18,6 +18,7 @@ import * as Cause from "effect/Cause";
 import * as Effect from "effect/Effect";
 
 import {
+  ANTIGRAVITY_STARTING_MESSAGE,
   antigravityConnectionMethod,
   makeAntigravityConnectionActionsFromController,
   makeAntigravityManagedRuntimeActions,
@@ -111,6 +112,7 @@ export function makeAntigravityRuntimeIdentity<E>(input: {
             methods: [antigravityConnectionMethod(input.authMethod)],
             canDisconnect: provider.auth.status === "authenticated",
             operation: null,
+            startingMessage: ANTIGRAVITY_STARTING_MESSAGE,
             runtime,
           },
         };

apps/server/src/provider/ScientProviderInstanceSeams.ts

@@ -50,6 +50,8 @@ export interface ProviderConnectionActionFailure {
    * the sign-in as possibly removed.
    */
   readonly signInMayBeRemoved?: boolean | undefined;
+  /** The provider accepted the sign-in; the failure came while finishing its setup. */
+  readonly afterSignIn?: boolean | undefined;
 }
 
 export interface ProviderConnectionAttempt {
@@ -96,6 +98,8 @@ export interface ProviderConnectionAttempt {
  */
 export interface ProviderConnectionActions {
   readonly methods: ReadonlyArray<ProviderConnectionMethod>;
+  /** Shown while `start` runs, for a provider whose start can take noticeably long. */
+  readonly startingMessage?: string | undefined;
   /**
    * `account` names an entry of the provider's own sign-in list. The manager
    * passes it only for a provider whose snapshot lists accounts, and only an

apps/server/src/provider/acp/AntigravitySessionFiles.ts

@@ -2,6 +2,9 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
+// SCIENT-FORK:START — sidecars left without their database are swept on every cleanup.
+import { removeOrphanedAntigravityConversationSidecars } from "../../scient/providerLifecycle/antigravityConversationSidecars.ts";
+// SCIENT-FORK:END
 
 const isNativeSessionId = Schema.is(Schema.String.check(Schema.isUUID(4)));
 const decodeSessionMetadata = Schema.decodeEffect(
@@ -15,6 +18,9 @@ export const removeAntigravitySessionFiles = Effect.fn("removeAntigravitySession
     readonly sessionId: string | undefined;
     readonly cwd: string;
   }) {
+    // SCIENT-FORK:START — also covers a session/new that failed before reporting its id.
+    yield* removeOrphanedAntigravityConversationSidecars(input.profileDirectory);
+    // SCIENT-FORK:END
     if (input.sessionId === undefined || !isNativeSessionId(input.sessionId)) {
       return;
     }

apps/server/src/provider/antigravityAuthSupport.test.ts

@@ -717,6 +717,9 @@ it.layer(NodeServices.layer)("Antigravity profile preparation", (it) => {
         const cliSkills = path.join(userHome, ".gemini", "antigravity-cli", "skills");
         const sourcePlugin = path.join(userHome, ".gemini", "config", "plugins", "science");
         yield* fs.makeDirectory(path.join(configSkills, "review"), { recursive: true });
+        // SCIENT-FORK:START — only an existing skill directory is linked.
+        yield* fs.makeDirectory(cliSkills, { recursive: true });
+        // SCIENT-FORK:END
         yield* fs.makeDirectory(path.join(sourcePlugin, "skills", "literature"), {
           recursive: true,
         });

apps/server/src/provider/antigravityAuthSupport.ts

@@ -24,6 +24,13 @@ import { collectUint8StreamText } from "@t3tools/provider-core/server/collectStr
 // SCIENT-FORK:START — plugin skills are projected without their other components.
 import { projectAntigravityPluginSkills } from "../scient/skills/antigravityPluginSkillProjection.ts";
 // SCIENT-FORK:END
+// SCIENT-FORK:START — safe skill links and a once-per-helper browser preflight.
+import {
+  recordAntigravityPreflightChild,
+  verifyAntigravityBrowserHelperOnce,
+} from "../scient/providerLifecycle/antigravityBrowserHelperPreflight.ts";
+import { prepareAntigravitySkillLink } from "../scient/skills/antigravityUserSkillLinks.ts";
+// SCIENT-FORK:END
 import type * as AcpSessionRuntime from "@t3tools/provider-acp/server/AcpSessionRuntime";
 import {
   antigravityUserSkillDirectories,
@@ -368,6 +375,9 @@ const linkAntigravityUserSkills = Effect.fn("linkAntigravityUserSkills")(functio
     [links[1], targets[1]],
   ] as const) {
     yield* Effect.gen(function* () {
+      // SCIENT-FORK:START — link only an existing directory; never leave a dangling link.
+      if (yield* prepareAntigravitySkillLink({ link, target })) return;
+      // SCIENT-FORK:END
       const existing = yield* fs.readLink(link).pipe(
         Effect.map((value): string | undefined => path.resolve(path.dirname(link), value)),
         Effect.catchReason("PlatformError", "NotFound", () => Effect.undefined),
@@ -460,6 +470,9 @@ export const prepareAntigravityProfile = Effect.fn("prepareAntigravityProfile")(
         shell: false,
       }),
     );
+    // SCIENT-FORK:START — a timed-out preflight can force-kill this helper.
+    yield* recordAntigravityPreflightChild(child);
+    // SCIENT-FORK:END
     const [stdout, stderr, exitCode] = yield* Effect.all(
       [
         collectUint8StreamText({ stream: child.stdout, maxBytes: 4_096 }),
@@ -478,12 +491,15 @@ export const prepareAntigravityProfile = Effect.fn("prepareAntigravityProfile")(
       return yield* authSupportError("Antigravity browser suppression could not be verified.");
     }
   }).pipe(
-    Effect.scoped,
-    Effect.timeoutOrElse({
-      duration: "5 seconds",
-      orElse: () =>
-        Effect.fail(authSupportError("Antigravity browser suppression verification timed out.")),
+    // SCIENT-FORK:START — verified once per helper; a timeout does not wait for its teardown.
+    verifyAntigravityBrowserHelperOnce({
+      spawner,
+      helperExecutable,
+      environment,
+      timeout: "5 seconds",
+      onTimeout: () => authSupportError("Antigravity browser suppression verification timed out."),
     }),
+    // SCIENT-FORK:END
     Effect.mapError((error) =>
       error._tag === "AcpTransportError"
         ? error

apps/server/src/scient/providerLifecycle/AntigravityAcpLifecycleActions.test.ts

@@ -18,6 +18,7 @@ import {
 import { ANTIGRAVITY_RELEASE_VERSION } from "../../provider/antigravityRelease.ts";
 import type { ProviderAuthController } from "../../provider/ProviderAuthService.ts";
 import { bundledAntigravityAcpAsset } from "./antigravityAcpCatalog.ts";
+import { ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE } from "./antigravityAuthDiagnostics.ts";
 
 const instanceId = ProviderInstanceId.make("antigravity-lifecycle-test");
 const driver = ProviderDriverKind.make("antigravity");
@@ -353,3 +354,58 @@ it.effect("never removes a managed runtime when its repair download or verificat
     expect(refreshes).toBe(1);
   }),
 );
+
+it.effect("tells a session failure after Google accepted the sign-in from a failed sign-in", () =>
+  Effect.gen(function* () {
+    const controllerWith = (states: ReadonlyArray<ProviderAuthState>): ProviderAuthController => ({
+      start: () => Effect.succeed(authState("starting", { flowId: "flow" })),
+      complete: () => Effect.die("No callback in this test."),
+      cancel: (_owner, flowId) => Effect.succeed(authState("cancelled", { flowId })),
+      logout: () => Effect.succeed(authState("idle")),
+      subscribe: () => Stream.fromIterable(states),
+    });
+    const startWith = (states: ReadonlyArray<ProviderAuthState>) =>
+      makeAntigravityConnectionActionsFromController({
+        instanceId,
+        authMethod: "oauth-personal",
+        controller: controllerWith(states),
+        stopSessions: Effect.void,
+        randomOwnerId: Effect.succeed("owner"),
+      });
+
+    const actions = startWith([]);
+    expect(actions.startingMessage).toBe("Antigravity can take up to a minute to start.");
+
+    // A stored sign-in: authentication passes at once and session/new fails before any link.
+    const beforeLink = yield* startWith([
+      authState("failed", { flowId: "flow", message: ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE }),
+    ])
+      .start("antigravity_google")
+      .pipe(Effect.scoped, Effect.flip);
+    expect(beforeLink).toMatchObject({
+      message: ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE,
+      afterSignIn: true,
+    });
+
+    // A browser sign-in that Google accepted, followed by the same failure.
+    const attempt = yield* startWith([
+      authState("waiting", { flowId: "flow", authorizationUrl }),
+      authState("failed", { flowId: "flow", message: ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE }),
+    ]).start("antigravity_google");
+    expect(yield* attempt.waitForCompletion.pipe(Effect.flip)).toMatchObject({
+      message: ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE,
+      afterSignIn: true,
+    });
+
+    const declined = yield* startWith([
+      authState("waiting", { flowId: "flow", authorizationUrl }),
+      authState("failed", {
+        flowId: "flow",
+        message: "Google sign-in failed. Start sign-in again.",
+      }),
+    ]).start("antigravity_google");
+    const plain = yield* declined.waitForCompletion.pipe(Effect.flip);
+    expect(plain.message).toBe("Google sign-in failed. Start sign-in again.");
+    expect(plain.afterSignIn).toBeUndefined();
+  }).pipe(Effect.scoped),
+);

apps/server/src/scient/providerLifecycle/AntigravityAcpLifecycleActions.ts

@@ -26,6 +26,7 @@ import { ANTIGRAVITY_ACP_REGISTRY_VERSION } from "./antigravityAcpCatalog.ts";
 import { ManagedRuntimeCatalog } from "./ManagedRuntimeCatalog.ts";
 import { antigravityAuthUsesBrowser } from "../../provider/antigravityAuthSupport.ts";
 import type { ProviderAuthController } from "../../provider/ProviderAuthService.ts";
+import { ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE } from "./antigravityAuthDiagnostics.ts";
 
 function isTerminalAuthPhase(
   phase: ProviderAuthState["phase"],
@@ -45,22 +46,24 @@ const failure = (message: string, cause?: unknown) =>
     ...(cause === undefined ? {} : { cause }),
   });
 
+export const ANTIGRAVITY_STARTING_MESSAGE = "Antigravity can take up to a minute to start.";
+
 export function antigravityConnectionMethod(method: AntigravityAuthMethod) {
   return antigravityAuthUsesBrowser(method)
     ? ("antigravity_google" as const)
     : ("antigravity_credentials" as const);
 }
 
-function authFailureMessage(state: {
-  readonly phase: string;
-  readonly message: string | null;
-}): string {
-  return (
+function authFailure(state: { readonly phase: string; readonly message: string | null }) {
+  const message =
     state.message?.trim() ||
     (state.phase === "cancelled"
       ? "Antigravity sign-in was cancelled."
-      : "Antigravity sign-in did not finish.")
-  );
+      : "Antigravity sign-in did not finish.");
+  return new ProviderConnectionActionError({
+    message,
+    ...(message === ANTIGRAVITY_SESSION_SETUP_FAILED_MESSAGE ? { afterSignIn: true } : {}),
+  });
 }
 
 /** Expose the official ACP auth controller through Scient's compact lifecycle UI. */
@@ -80,6 +83,7 @@ export function makeAntigravityConnectionActionsFromController(input: {
     );
   return {
     methods: [antigravityConnectionMethod(input.authMethod)],
+    startingMessage: ANTIGRAVITY_STARTING_MESSAGE,
     start: (method) =>
       Effect.gen(function* () {
         if (method !== antigravityConnectionMethod(input.authMethod)) {
@@ -111,7 +115,7 @@ export function makeAntigravityConnectionActionsFromController(input: {
               )
             : started;
         if (isTerminalAuthPhase(initial.phase) && initial.phase !== "succeeded") {
-          return yield* failure(authFailureMessage(initial));
+          return yield* authFailure(initial);
         }
         const flowId = initial.flowId ?? started.flowId;
         if (!flowId) {
@@ -124,9 +128,7 @@ export function makeAntigravityConnectionActionsFromController(input: {
             Option.match({
               onNone: () => Effect.fail(failure("Antigravity sign-in stopped unexpectedly.")),
               onSome: (state) =>
-                state.phase === "succeeded"
-                  ? Effect.void
-                  : Effect.fail(failure(authFailureMessage(state))),
+                state.phase === "succeeded" ? Effect.void : Effect.fail(authFailure(state)),
             }),
           ),
         );

apps/server/src/scient/providerLifecycle/ProviderConnectionActions.ts

@@ -103,4 +103,5 @@ export class ProviderConnectionActionError extends Data.TaggedError(
   readonly message: string;
   readonly cause?: unknown;
   readonly signInMayBeRemoved?: boolean;
+  readonly afterSignIn?: boolean;
 }> {}