@bitkyc08/opencodex 2.6.7 → 2.6.8

package/src/lib/gcp-adc.ts

@@ -0,0 +1,292 @@
+/**
+ * Application Default Credentials (ADC) resolution for Vertex AI.
+ *
+ * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:
+ *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT
+ *      exchange) or `type: "authorized_user"` (refresh-token exchange).
+ *   2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).
+ *   3. GCE / Cloud Run metadata server.
+ *
+ * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)
+ * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.
+ *
+ * Security: never logs the access token, private key, or refresh token.
+ */
+
+import { Buffer } from "node:buffer";
+import * as os from "node:os";
+import * as path from "node:path";
+import { readFileSync, existsSync, statSync } from "node:fs";
+
+/** Injectable fetch (tests pass a mock); defaults to the global fetch. */
+export type FetchImpl = typeof fetch;
+
+const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+
+const TOKEN_TIMEOUT_MS = 15_000;
+const TOKEN_ATTEMPTS = 3;
+const TOKEN_RETRY_BASE_MS = 300;
+
+interface CachedToken {
+  token: string;
+  expiresAtMs: number;
+}
+
+interface ServiceAccountCredentials {
+  type: "service_account";
+  client_email: string;
+  private_key: string;
+  private_key_id?: string;
+}
+
+interface AuthorizedUserCredentials {
+  type: "authorized_user";
+  client_id: string;
+  client_secret: string;
+  refresh_token: string;
+}
+
+type AdcFileCredentials = ServiceAccountCredentials | AuthorizedUserCredentials;
+
+interface TokenResponse {
+  access_token: string;
+  expires_in: number;
+  token_type?: string;
+}
+
+const tokenCache = new Map<string, CachedToken>();
+const inflight = new Map<string, Promise<string>>();
+
+function getRefreshSkewMs(): number {
+  const raw = Number(process.env.GOOGLE_VERTEX_REFRESH_SKEW_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 60_000;
+}
+
+function userAdcPath(): string {
+  return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
+}
+
+/**
+ * A content-freshness fingerprint for a credential file, so an in-place rewrite (e.g.
+ * `gcloud auth application-default login`, or a rotated service-account key at the same path)
+ * changes the cache key and invalidates the stale token. Falls back to the bare path when stat fails.
+ */
+function fileSourceTag(prefix: string, filePath: string): string {
+  try {
+    const st = statSync(filePath);
+    return `${prefix}:${filePath}:${st.size}:${Math.floor(st.mtimeMs)}`;
+  } catch {
+    return `${prefix}:${filePath}`;
+  }
+}
+
+function readJsonFile<T>(filePath: string): T | undefined {
+  if (!existsSync(filePath)) return undefined;
+  return JSON.parse(readFileSync(filePath, "utf8")) as T;
+}
+
+function loadAdcCredentials(): { source: string; creds: AdcFileCredentials } | undefined {
+  const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+  if (gacPath) {
+    const creds = readJsonFile<AdcFileCredentials>(gacPath);
+    if (!creds) throw new Error(`GOOGLE_APPLICATION_CREDENTIALS points to a missing file: ${gacPath}`);
+    return { source: fileSourceTag("gac", gacPath), creds };
+  }
+  const userPath = userAdcPath();
+  const creds = readJsonFile<AdcFileCredentials>(userPath);
+  if (creds) return { source: fileSourceTag("user", userPath), creds };
+  return undefined;
+}
+
+/**
+ * The cache key for the source the NEXT resolve would use, computed cheaply (no network). Lets the
+ * cache return a token only when it still matches the active credential source, so an in-process
+ * change to GOOGLE_APPLICATION_CREDENTIALS (or the user ADC file) does not keep serving a stale
+ * token from a different source. Falls back to "metadata" when no file/env ADC is present.
+ */
+function currentAdcSourceKey(): string {
+  const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+  if (gacPath) return fileSourceTag("gac", gacPath);
+  const userPath = userAdcPath();
+  if (existsSync(userPath)) return fileSourceTag("user", userPath);
+  return "metadata";
+}
+
+function base64UrlEncode(bytes: Uint8Array | string): string {
+  const buf = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : Buffer.from(bytes);
+  return buf.toString("base64url");
+}
+
+function pemToPkcs8(pem: string): ArrayBuffer {
+  const body = pem
+    .replace(/-----BEGIN [^-]+-----/g, "")
+    .replace(/-----END [^-]+-----/g, "")
+    .replace(/\s+/g, "");
+  if (!body) throw new Error("Invalid PEM: empty body");
+  const buf = Buffer.from(body, "base64");
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength) as ArrayBuffer;
+}
+
+async function signJwtRs256(claims: Record<string, unknown>, privateKeyPem: string, keyId?: string): Promise<string> {
+  const header: Record<string, unknown> = { alg: "RS256", typ: "JWT" };
+  if (keyId) header.kid = keyId;
+  const payload = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
+  const key = await globalThis.crypto.subtle.importKey(
+    "pkcs8",
+    pemToPkcs8(privateKeyPem),
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const signature = new Uint8Array(
+    await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload)),
+  );
+  return `${payload}.${base64UrlEncode(signature)}`;
+}
+
+function tokenRetryDelayMs(attempt: number): number {
+  const exp = TOKEN_RETRY_BASE_MS * 2 ** attempt;
+  return Math.floor(exp * (0.8 + Math.random() * 0.4));
+}
+
+function isRetryableTokenStatus(status: number): boolean {
+  return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+
+function tokenTimeoutSignal(parent: AbortSignal | undefined): AbortSignal {
+  const timeout = AbortSignal.timeout(TOKEN_TIMEOUT_MS);
+  return parent ? AbortSignal.any([parent, timeout]) : timeout;
+}
+
+/**
+ * Exchange a grant for a Google access token, hardened with a per-attempt timeout + bounded retry
+ * on transient failures (network errors and 429/5xx). Non-retryable statuses (e.g. 400/401 from a
+ * bad grant) fail fast. The error message carries only the status code, never the response body
+ * (which can leak grant/account details) or the token/key.
+ */
+async function postForToken(body: URLSearchParams, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < TOKEN_ATTEMPTS; attempt++) {
+    if (signal?.aborted) throw signal.reason ?? new Error("Google OAuth token exchange aborted");
+    let response: Response;
+    try {
+      response = await fetchImpl(OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+        signal: tokenTimeoutSignal(signal),
+      });
+    } catch (err) {
+      if (signal?.aborted) throw err;
+      lastError = err;
+      if (attempt === TOKEN_ATTEMPTS - 1) break;
+      await new Promise(resolve => setTimeout(resolve, tokenRetryDelayMs(attempt)));
+      continue;
+    }
+    if (response.ok) return (await response.json()) as TokenResponse;
+    if (!isRetryableTokenStatus(response.status) || attempt === TOKEN_ATTEMPTS - 1) {
+      throw new Error(`Google OAuth token exchange failed (${response.status})`);
+    }
+    lastError = new Error(`Google OAuth token exchange failed (${response.status})`);
+    await response.body?.cancel().catch(() => {});
+    await new Promise(resolve => setTimeout(resolve, tokenRetryDelayMs(attempt)));
+  }
+  throw lastError instanceof Error ? lastError : new Error("Google OAuth token exchange failed");
+}
+
+async function exchangeJwtForToken(creds: ServiceAccountCredentials, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse> {
+  const now = Math.floor(Date.now() / 1000);
+  const assertion = await signJwtRs256(
+    { iss: creds.client_email, scope: CLOUD_PLATFORM_SCOPE, aud: OAUTH_TOKEN_URL, exp: now + 3600, iat: now },
+    creds.private_key,
+    creds.private_key_id,
+  );
+  return postForToken(new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }), signal, fetchImpl);
+}
+
+async function exchangeRefreshToken(creds: AuthorizedUserCredentials, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse> {
+  return postForToken(
+    new URLSearchParams({
+      client_id: creds.client_id,
+      client_secret: creds.client_secret,
+      refresh_token: creds.refresh_token,
+      grant_type: "refresh_token",
+    }),
+    signal,
+    fetchImpl,
+  );
+}
+
+async function fetchMetadataToken(signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse | undefined> {
+  const timeout = AbortSignal.timeout(2000);
+  const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+  try {
+    const response = await fetchImpl(METADATA_TOKEN_URL, {
+      method: "GET",
+      headers: { "Metadata-Flavor": "Google" },
+      signal: combined,
+    });
+    if (!response.ok) return undefined;
+    return (await response.json()) as TokenResponse;
+  } catch {
+    return undefined;
+  }
+}
+
+async function resolveAccessTokenUncached(signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<{ source: string; token: TokenResponse }> {
+  const adc = loadAdcCredentials();
+  if (adc) {
+    const token = adc.creds.type === "service_account"
+      ? await exchangeJwtForToken(adc.creds, signal, fetchImpl)
+      : await exchangeRefreshToken(adc.creds, signal, fetchImpl);
+    return { source: adc.source, token };
+  }
+  const metadata = await fetchMetadataToken(signal, fetchImpl);
+  if (metadata) return { source: "metadata", token: metadata };
+  throw new Error(
+    "Vertex AI requires Application Default Credentials. Set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or run on a GCE/Cloud Run instance with a service account.",
+  );
+}
+
+/** Returns a Bearer access token for the `Authorization` header on Vertex AI calls (cached + refreshed). */
+export async function getVertexAccessToken(options?: { signal?: AbortSignal; fetch?: FetchImpl }): Promise<string> {
+  const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
+  const skew = getRefreshSkewMs();
+  const now = Date.now();
+
+  // Only serve a cached token that matches the source the next resolve would actually use; prune
+  // expired or now-stale (different-source) entries so a credential-source change is honored.
+  const expectedSource = currentAdcSourceKey();
+  for (const [source, cached] of tokenCache) {
+    if (source === expectedSource && cached.expiresAtMs - skew > now) return cached.token;
+    if (cached.expiresAtMs - skew <= now) tokenCache.delete(source);
+  }
+
+  // Dedup in-flight fetches PER source, not globally: if the credential source changes while a
+  // fetch is in flight, a new caller must not reuse the old source's promise (cross-source bleed).
+  const cacheKey = expectedSource;
+  const existing = inflight.get(cacheKey);
+  if (existing) return existing;
+
+  const promise = (async () => {
+    try {
+      const { source, token } = await resolveAccessTokenUncached(options?.signal, fetchImpl);
+      const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1000);
+      tokenCache.set(source, { token: token.access_token, expiresAtMs });
+      return token.access_token;
+    } finally {
+      inflight.delete(cacheKey);
+    }
+  })();
+  inflight.set(cacheKey, promise);
+  return promise;
+}
+
+/** Test seam: clears every cached token + in-flight promise. */
+export function __resetVertexTokenCache(): void {
+  tokenCache.clear();
+  inflight.clear();
+}

package/src/oauth/google-antigravity.ts

@@ -0,0 +1,225 @@
+/**
+ * Google Antigravity (Cloud Code Assist) OAuth + project discovery.
+ *
+ * Mirrors CLIProxyAPI `internal/auth/antigravity/*`. Flow: standard Google OAuth (PKCE) → discover
+ * the Cloud Code Assist project via `loadCodeAssist`, onboarding via `onboardUser` when the account
+ * has no project yet. The discovered `projectId` is stored on the credential and injected into the
+ * CCA request envelope by the google adapter.
+ *
+ * The client id/secret below are the public OAuth client identifiers embedded in the Antigravity
+ * desktop client (overridable via env), not user secrets. Tokens/refresh are never logged.
+ */
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const CLIENT_ID = process.env.GOOGLE_ANTIGRAVITY_CLIENT_ID
+  || "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
+const CLIENT_SECRET = process.env.GOOGLE_ANTIGRAVITY_CLIENT_SECRET
+  || "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";
+const AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const PROD_API = "https://cloudcode-pa.googleapis.com";
+const DAILY_API = "https://daily-cloudcode-pa.googleapis.com";
+const API_VERSION = "v1internal";
+const SCOPES = [
+  "https://www.googleapis.com/auth/cloud-platform",
+  "https://www.googleapis.com/auth/userinfo.email",
+  "https://www.googleapis.com/auth/userinfo.profile",
+  "https://www.googleapis.com/auth/cclog",
+  "https://www.googleapis.com/auth/experimentsandconfigs",
+];
+const CALLBACK_PORT = 51121;
+const CALLBACK_PATH = "/callback";
+const REFRESH_SKEW_MS = 50 * 60 * 1000; // refresh proactively ~50min before nominal 1h expiry
+const REQUEST_TIMEOUT_MS = 30_000;
+const ONBOARD_ATTEMPTS = 5;
+const ONBOARD_POLL_MS = 2_000;
+
+function requestSignal(signal: AbortSignal | undefined): AbortSignal {
+  const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+
+interface GoogleTokenPayload {
+  access_token?: unknown;
+  refresh_token?: unknown;
+  expires_in?: unknown;
+  id_token?: unknown;
+}
+
+function decodeJwtPayload(token: string): Record<string, unknown> | undefined {
+  const part = token.split(".")[1];
+  if (!part) return undefined;
+  try {
+    return JSON.parse(Buffer.from(part, "base64url").toString("utf8")) as Record<string, unknown>;
+  } catch {
+    return undefined;
+  }
+}
+
+function emailFromToken(accessToken: string, idToken: string | undefined): string | undefined {
+  const payload = (idToken ? decodeJwtPayload(idToken) : undefined) ?? decodeJwtPayload(accessToken);
+  const email = payload?.email;
+  return typeof email === "string" && email.length > 0 ? email.toLowerCase() : undefined;
+}
+
+async function postToken(body: Record<string, string>, signal?: AbortSignal): Promise<GoogleTokenPayload> {
+  const response = await fetch(TOKEN_ENDPOINT, {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(body).toString(),
+    signal: requestSignal(signal),
+  });
+  if (!response.ok) {
+    // Status only — the body can carry grant/account details.
+    throw new Error(`Antigravity token request failed: ${response.status}`);
+  }
+  return (await response.json()) as GoogleTokenPayload;
+}
+
+/** Pull a Cloud Code Assist project id out of a loadCodeAssist/onboardUser response shape. */
+function extractProjectId(data: Record<string, unknown> | undefined): string | undefined {
+  if (!data) return undefined;
+  for (const key of ["cloudaicompanionProject", "projectId", "project"]) {
+    const value = data[key];
+    if (typeof value === "string" && value.length > 0) return value;
+    if (value && typeof value === "object" && typeof (value as { id?: unknown }).id === "string") {
+      return (value as { id: string }).id;
+    }
+  }
+  return undefined;
+}
+
+async function loadCodeAssistProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
+  const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json" },
+    body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
+    signal: requestSignal(signal),
+  });
+  if (!response.ok) return undefined;
+  return extractProjectId((await response.json().catch(() => undefined)) as Record<string, unknown> | undefined);
+}
+
+async function onboardProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
+  for (let attempt = 0; attempt < ONBOARD_ATTEMPTS; attempt++) {
+    if (signal?.aborted) throw signal.reason ?? new Error("Antigravity onboarding aborted");
+    const response = await fetch(`${DAILY_API}/${API_VERSION}:onboardUser`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json" },
+      body: JSON.stringify({ tier_id: "free-tier", metadata: { ide_type: "ANTIGRAVITY", ide_name: "antigravity" } }),
+      signal: requestSignal(signal),
+    });
+    if (!response.ok) {
+      // Transient (429/5xx): keep polling within the attempt budget. Hard 4xx: give up now.
+      if (response.status === 429 || response.status >= 500) {
+        await new Promise(resolve => setTimeout(resolve, ONBOARD_POLL_MS));
+        continue;
+      }
+      return undefined;
+    }
+    const data = (await response.json().catch(() => ({}))) as Record<string, unknown>;
+    if (data.done === true) {
+      return extractProjectId(data.response as Record<string, unknown> | undefined);
+    }
+    await new Promise(resolve => setTimeout(resolve, ONBOARD_POLL_MS));
+  }
+  return undefined;
+}
+
+/** Discover the CCA project for an access token (loadCodeAssist → onboardUser fallback). */
+export async function discoverAntigravityProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
+  return (await loadCodeAssistProject(accessToken, signal)) ?? (await onboardProject(accessToken, signal));
+}
+
+function credentialsFromPayload(payload: GoogleTokenPayload, refreshFallback = ""): OAuthCredentials {
+  if (typeof payload.access_token !== "string" || payload.access_token.length === 0) {
+    throw new Error("Antigravity token response did not include an access token");
+  }
+  const refresh = typeof payload.refresh_token === "string" && payload.refresh_token.length > 0
+    ? payload.refresh_token
+    : refreshFallback;
+  if (!refresh) throw new Error("Antigravity token response did not include a refresh token");
+  const expiresIn = typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) ? payload.expires_in : 3600;
+  const idToken = typeof payload.id_token === "string" ? payload.id_token : undefined;
+  return {
+    refresh,
+    access: payload.access_token,
+    expires: Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS,
+    email: emailFromToken(payload.access_token, idToken),
+  };
+}
+
+class AntigravityOAuthFlow extends OAuthCallbackFlow {
+  #verifier = "";
+
+  constructor(ctrl: OAuthController) {
+    super(ctrl, {
+      preferredPort: CALLBACK_PORT,
+      callbackPath: CALLBACK_PATH,
+      callbackHostname: "127.0.0.1",
+      callbackBindHostname: "127.0.0.1",
+      redirectUri: `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`,
+    } satisfies OAuthCallbackFlowOptions);
+  }
+
+  async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+    const pkce = await generatePKCE();
+    this.#verifier = pkce.verifier;
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: redirectUri,
+      scope: SCOPES.join(" "),
+      code_challenge: pkce.challenge,
+      code_challenge_method: "S256",
+      access_type: "offline",
+      prompt: "consent",
+      state,
+    });
+    return {
+      url: `${AUTH_ENDPOINT}?${params.toString()}`,
+      instructions: "Complete Google (Antigravity) login in your browser, then paste the redirect URL or code if prompted.",
+    };
+  }
+
+  async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+    if (!this.#verifier) throw new Error("Antigravity OAuth PKCE verifier was not initialized");
+    const payload = await postToken({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      client_secret: CLIENT_SECRET,
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: this.#verifier,
+    }, this.ctrl.signal);
+    const creds = credentialsFromPayload(payload);
+    this.ctrl.onProgress?.("Discovering Cloud Code Assist project");
+    const projectId = await discoverAntigravityProject(creds.access, this.ctrl.signal);
+    if (!projectId) {
+      // Fail the login rather than persisting a credential that every request would reject for a
+      // missing CCA project — otherwise status shows "logged in" while all calls fail closed.
+      throw new Error("Antigravity login could not discover a Cloud Code Assist project for this account. Ensure the account has Antigravity/Cloud Code Assist access and try again.");
+    }
+    return { ...creds, projectId };
+  }
+}
+
+export async function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials> {
+  return new AntigravityOAuthFlow(ctrl).login();
+}
+
+export async function refreshAntigravityToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials> {
+  if (!refreshToken) throw new Error("Antigravity credentials are expired and do not include a refresh token");
+  const payload = await postToken({
+    grant_type: "refresh_token",
+    client_id: CLIENT_ID,
+    client_secret: CLIENT_SECRET,
+    refresh_token: refreshToken,
+  }, signal);
+  const creds = credentialsFromPayload(payload, refreshToken);
+  // Re-discover the project on refresh so a newly-onboarded account fills in projectId.
+  const projectId = await discoverAntigravityProject(creds.access, signal).catch(() => undefined);
+  return projectId ? { ...creds, projectId } : creds;
+}

package/src/oauth/index.ts

@@ -8,6 +8,7 @@ import { ANTHROPIC_OAUTH_BETA, loginAnthropic, refreshAnthropicToken } from "./a
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginKiro, readKiroCliSqlite, refreshKiroToken } from "./kiro";
 import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
+import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 
 const REFRESH_SKEW_MS = 60_000;
@@ -60,6 +61,12 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("kiro"),
     defaultModel: oauthDefaultModel("kiro"),
   },
+  "google-antigravity": {
+    login: (ctrl) => loginAntigravity(ctrl),
+    refresh: refreshAntigravityToken,
+    providerConfig: oauthConfig("google-antigravity"),
+    defaultModel: oauthDefaultModel("google-antigravity"),
+  },
   chatgpt: {
     login: loginChatGPT,
     refresh: (rt) => refreshChatGPTToken(rt),
@@ -72,6 +79,11 @@ export function isOAuthProvider(name: string): boolean {
   return name in OAUTH_PROVIDERS;
 }
 
+/** The discovered project id stored on an OAuth credential (Antigravity CCA), if any. */
+export function getOAuthCredentialProjectId(provider: string): string | undefined {
+  return getCredential(provider)?.projectId;
+}
+
 /** Provider ids that support real OAuth login (drives the GUI's "Log in with …" buttons). */
 export function listOAuthProviders(): string[] {
   return Object.keys(OAUTH_PROVIDERS);
@@ -127,7 +139,13 @@ async function refreshAndPersistAccessToken(
   }
   try {
     const fresh = await def.refresh(cred.refresh);
-    saveCredential(provider, { ...fresh, source: fresh.source ?? cred.source ?? "oauth" });
+    saveCredential(provider, {
+      ...fresh,
+      source: fresh.source ?? cred.source ?? "oauth",
+      // Preserve a previously-discovered project id when a refresh-time re-discovery comes back empty
+      // (e.g. a transient network blip), so Antigravity does not lose its CCA project across refresh.
+      ...(fresh.projectId === undefined && cred.projectId ? { projectId: cred.projectId } : {}),
+    });
     return fresh.access;
   } catch (err) {
     if (provider === "kiro") {

package/src/oauth/store.ts

@@ -51,6 +51,7 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   if (typeof candidate.email === "string" && candidate.email.length > 0) normalized.email = candidate.email;
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
   if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
+  if (typeof candidate.projectId === "string" && candidate.projectId.length > 0) normalized.projectId = candidate.projectId;
   return normalized;
 }
 

package/src/oauth/types.ts

@@ -8,6 +8,8 @@ export type OAuthCredentials = {
   email?: string;
   accountId?: string;
   source?: OAuthCredentialSource;
+  /** Google Antigravity (Cloud Code Assist) discovered project id; injected into the CCA envelope. */
+  projectId?: string;
 };
 
 export interface OAuthController {

package/src/provider-context-cap.ts

@@ -27,10 +27,39 @@ export function applyProviderContextCap(contextWindow: number | undefined, cap:
   return contextWindow > cap ? cap : contextWindow;
 }
 
+/** Effective global cap value: explicit config value, else the built-in default. */
+export function globalContextCapValue(config: Pick<OcxConfig, "contextCapValue">): number {
+  const value = config.contextCapValue;
+  return isValidContextCap(value) ? Math.floor(value) : DEFAULT_PROVIDER_CONTEXT_CAP;
+}
+
 export function setProviderContextCap(config: OcxConfig, provider: string, enabled: boolean): void {
   const next = providerContextCaps(config);
-  if (enabled) next[provider] = DEFAULT_PROVIDER_CONTEXT_CAP;
+  if (enabled) next[provider] = globalContextCapValue(config);
   else delete next[provider];
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
   else delete config.providerContextCaps;
 }
+
+/** Set the global cap value and re-point every already-enabled provider to it. */
+export function setGlobalContextCapValue(config: OcxConfig, value: number): void {
+  if (!isValidContextCap(value)) return;
+  const next = Math.floor(value);
+  config.contextCapValue = next;
+  const caps = providerContextCaps(config);
+  for (const provider of Object.keys(caps)) caps[provider] = next;
+  if (Object.keys(caps).length > 0) config.providerContextCaps = caps;
+}
+
+/** Enable the cap for every named provider at the current value, or clear all caps. */
+export function setAllProviderContextCaps(config: OcxConfig, providerNames: string[], enabled: boolean): void {
+  if (!enabled) {
+    delete config.providerContextCaps;
+    return;
+  }
+  const value = globalContextCapValue(config);
+  const next: Record<string, number> = {};
+  for (const name of providerNames) next[name] = value;
+  if (Object.keys(next).length > 0) config.providerContextCaps = next;
+  else delete config.providerContextCaps;
+}

package/src/providers/antigravity-models.ts

@@ -0,0 +1,30 @@
+// Google Antigravity (Cloud Code Assist) bundled model list.
+//
+// Single source of truth: the Antigravity `:fetchAvailableModels` backend, the same one the `agy`
+// CLI resolves labels against. The 8 ids below are the WIRE ids (not the human labels) that the CCA
+// `streamGenerateContent` envelope's `model` field accepts, each verified to return 200 live. The
+// effort tier is baked into the id by the backend (e.g. "Gemini 3.1 Pro (High)" => gemini-pro-agent),
+// so opencodex must send these exact strings, not the label-shaped guesses. Antigravity's OAuth
+// backend has no OpenAI-style `GET /models`, so this static list is what surfaces in the picker.
+export const ANTIGRAVITY_MODELS = [
+  "gemini-3.5-flash-low",
+  "gemini-3-flash-agent",
+  "gemini-3.5-flash-extra-low",
+  "gemini-3.1-pro-low",
+  "gemini-pro-agent",
+  "claude-sonnet-4-6",
+  "claude-opus-4-6-thinking",
+  "gpt-oss-120b-medium",
+];
+
+// Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
+export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "gemini-3.5-flash-low": 1_048_576,
+  "gemini-3-flash-agent": 1_048_576,
+  "gemini-3.5-flash-extra-low": 1_048_576,
+  "gemini-3.1-pro-low": 1_048_576,
+  "gemini-pro-agent": 1_048_576,
+  "claude-sonnet-4-6": 200_000,
+  "claude-opus-4-6-thinking": 1_000_000,
+  "gpt-oss-120b-medium": 131_072,
+};

package/src/providers/derive.ts

@@ -81,6 +81,9 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...entry.autoToolChoiceOnlyModels] } : {}),
     ...(entry.preserveReasoningContentModels ? { preserveReasoningContentModels: [...entry.preserveReasoningContentModels] } : {}),
     ...(entry.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: entry.escapeBuiltinToolNames } : {}),
+    ...(entry.googleMode ? { googleMode: entry.googleMode } : {}),
+    ...(entry.project ? { project: entry.project } : {}),
+    ...(entry.location ? { location: entry.location } : {}),
   };
 }
 
@@ -111,6 +114,9 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       ...(entry.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...entry.autoToolChoiceOnlyModels] } : {}),
       ...(entry.preserveReasoningContentModels ? { preserveReasoningContentModels: [...entry.preserveReasoningContentModels] } : {}),
       ...(entry.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: entry.escapeBuiltinToolNames } : {}),
+      ...(entry.googleMode ? { googleMode: entry.googleMode } : {}),
+      ...(entry.project ? { project: entry.project } : {}),
+      ...(entry.location ? { location: entry.location } : {}),
     };
   }
   return out;