[Bug]: Antigravity Google sign-in hides the real failure reason (ineligible account, rejected redirect URL) #17508

Area

apps/server

Steps to reproduce

1. Settings → Antigravity → Google account → sign in with a Google account that Antigravity rejects (for example an admin-managed or otherwise ineligible account).
2. Google OAuth completes, then Antigravity's authenticate call fails.

Second case: after a failed attempt, paste a redirect URL from an earlier sign-in into the callback field.

Actual behavior

• The status row shows only Google sign-in failed. Start sign-in again.
• Server trace shows the real reason, RpcClient.authenticate: Onboarding failed: User is ineligible for free-tier. Reason: Your current account is not eligible for Antigravity. Try signing in with another personal Google account.
• A rejected redirect URL fails AntigravityAuth.complete with This redirect URL does not belong to the current sign-in. The status row keeps its previous text, and the message only appears in a separate alert that clears on the next command.

Expected behavior

The status row shows the provider's actionable reason, so the user knows to try another account instead of retrying the same one.

Cause

safeAuthFailure in apps/server/src/provider/AntigravityAuth.ts passes through only ProviderSetupError.detail and a few matched AcpRequestError patterns. An authenticate rejection matches none of them, so it falls to the generic fallback even though AcpRequestError.errorMessage holds the reason. In complete, a callback validation failure fails the RPC without publishing to the auth state.

Related

Same bug class (real cause hidden behind the generic message): #9655, #12245, #12477, #12473. Open PRs #14969 and #15629 improve error detail for session and startup failures. Neither covers sign-in authenticate rejections or the redirect-URL case.