fix(server): preserve antigravity ipv6 startup diagnostics

[maria-rcks]

Antigravity installation hid an IPv6-related runtime abort behind a generic "could not start" error.

effect-acp now reports signal exits (for example SIGABRT) as AcpProcessExitedError with the signal, so the session runtime attaches the child's redacted stderr. Installation recognizes the native IPv6 check failure and tells users to enable IPv6 (on WSL: remove ipv6.disable=1 and run wsl --shutdown). Other startup failures show the exit status and redacted stderr; Google sign-in URLs are now redacted from that excerpt. A failed validation keeps the previous release selected.

Closes #9800. Refs #9839 and #13387.

Verification (Blacksmith): installation, effect-acp stdio, and stderr tests passed (41), including a real Node child that prints the IPv6 diagnostic and aborts. Scoped lint and server, effect-acp, and provider-acp typechecks passed. A real Antigravity runtime on an IPv6-disabled WSL host is unverified.

Written by claude-opus-5-5 via Claude Code in T3 Code

[coderabbitai]

Warning

Review limit reached

Only developers with an assigned seat can use this organization's usage-based review budget, and seats here are assigned manually. Ask an admin to assign a seat, or change the review continuation mode in Billing.

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: caa24056-a8a8-45fe-97eb-e2e96ff02f93

---

📥 Commits

Reviewing files that changed from the base of the PR and between d811c70 and 6a09d5a.

---

📒 Files selected for processing (8)

• apps/server/src/provider/AntigravityInstallation.test.ts
• apps/server/src/provider/AntigravityInstallation.ts
• packages/effect-acp/src/_internal/stdio.test.ts
• packages/effect-acp/src/_internal/stdio.ts
• packages/effect-acp/src/errors.ts
• packages/provider-acp/src/server/AcpSessionRuntime.ts
• packages/provider-acp/src/server/stderr.test.ts
• packages/provider-acp/src/server/stderr.ts

---

---

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9c7a20d1-a618-4bb7-82ec-bf2c48c40657

---

📥 Commits

Reviewing files that changed from the base of the PR and between 2ee80c1 and d811c70.

---

📒 Files selected for processing (4)

• apps/server/src/provider/AntigravityInstallation.test.ts
• packages/provider-acp/src/server/AcpSessionRuntime.ts
• packages/provider-acp/src/server/stderr.test.ts
• packages/provider-acp/src/server/stderr.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

---

📝 Walkthrough

Walkthrough

ACP process-exit errors now retain signal details used during Antigravity startup validation. Installation errors identify recognized IPv6 startup failures and include WSL guidance. ACP stderr sanitization replaces Google Accounts sign-in URLs with a placeholder.

Changes

Startup failure diagnostics

Layer / File(s)	Summary
Signal-aware ACP exit errors packages/effect-acp/src/errors.ts, packages/effect-acp/src/_internal/stdio.ts, packages/provider-acp/src/server/AcpSessionRuntime.ts, packages/effect-acp/src/_internal/stdio.test.ts	Signal-based child-process exit failures produce AcpProcessExitedError values that retain the signal and PID. Runtime enrichment preserves the signal with captured stderr. Tests cover SIGABRT and SIGTERM.
Antigravity validation diagnostics apps/server/src/provider/AntigravityInstallation.ts, apps/server/src/provider/AntigravityInstallation.test.ts	Installation validation maps recognized IPv6 startup diagnostics to guidance and includes other ACP process-exit messages. The test checks the error message, staging cleanup, and availability of the previous release.

ACP stderr URL redaction

Layer / File(s)	Summary
Google sign-in URL redaction packages/provider-acp/src/server/stderr.ts, packages/provider-acp/src/server/stderr.test.ts	The stderr sanitizer replaces HTTP and HTTPS URLs on accounts.google.com with [sign-in-url]. The test checks that the OAuth state value is excluded.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant AntigravityInstallation
  participant AntigravityRuntime
  participant makeTerminationError
  participant AcpSessionRuntime
  AntigravityInstallation->>AntigravityRuntime: verify runtime startup
  AntigravityRuntime->>makeTerminationError: report child-process signal exit
  makeTerminationError->>AcpSessionRuntime: provide process-exit error with signal
  AcpSessionRuntime->>AntigravityInstallation: return process-exit error with stderr
  AntigravityInstallation->>AntigravityInstallation: map IPv6 diagnostic to guidance

Loading

Suggested reviewers: juliusmarminge

---

Merge Risk: ⚪ Minimal · up to d811c

No actionable issue is established that should delay merging this diagnostics change. A real Antigravity run on an IPv6-disabled WSL host remains unverified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to d811c

Startup failures expose more diagnostic detail, but retain bounded redaction and validation before activation. No concrete security regression was identified. Coverage does not establish that every newly surfaced diagnostic is free of sensitive data.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The affected source is spawned ACP child stderr. The inspected outputs are process-exit errors, connection-termination events, and Antigravity installation failure state. Captured stderr is limited to 4,096 characters per runtime; tenant-wide or cross-service exposure is not established by this evidence.

Security Findings and Attack Paths

• inferred — A child can influence newly visible startup diagnostics through stderr. The inspected enrichment path applies bounded capture and sanitization, and no concrete redaction bypass or authority escalation was established. This conclusion does not establish confidentiality for unrecognized sensitive output.

Trust Boundaries and Controls

• observed — Signal classification requires matching child-process platform-error metadata and an exact signal-message format; it is not parsed from stderr. IPv6 recognition uses stderr only to select explanatory text. It neither changes host configuration automatically nor converts validation failure into success.

Resilience and Maintainability Implications

• observed — Termination recording retains a first-writer guard before emitting a connection-termination event. The termination callback still ensures runtime-scope closure. Adding signal context does not replace these existing failure-containment mechanisms.

---

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Issue #9800 requires Antigravity installation to preserve the IPv6 startup diagnostic and provide actionable guidance. makeTerminationError now creates AcpProcessExitedError for signal exits. The …
Out of Scope Changes check		The signal handling, stderr propagation, stderr redaction, and tests support issue #9800. Google sign-in URL redaction limits exposure when startup stderr is shown. No unrelated change is established …
Title check		The title clearly identifies the main change: preserving IPv6 startup diagnostics for Antigravity in the server.
Description check		The description explains the problem, the cross-component fix, linked issues, focused verification, unverified coverage, and the agent attribution. It does not use the template headings or state expli…

---

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

---

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This focused bug fix improves Antigravity IPv6 startup diagnostics and preserves signal details across ACP failures, but it also changes shared process-error behavior and sanitizes authentication-sensitive OAuth URLs. Those security-sensitive handling changes require human review.

No code changes detected at 6a09d5a. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate 2ee80c1

[macroscopeapp]

This copies cause.message (including child stderr) into the installation error's detail, which becomes persisted/user-facing state. Service error messages must be derived from safe structured attributes, not an underlying error message; keep the original error in cause and use a fixed diagnostic here.

Suggested change

	: `The downloaded Antigravity runtime could not start in this environment.\n${cause.message}`
	: "The downloaded Antigravity runtime could not start in this environment."

^{Posted via Macroscope — Effect Service Conventions}