@specode/pi-antigravity 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Specode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,85 @@
-# Temporary Holding Version
+# pi-antigravity
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[English](./README.md) | [简体中文](./README.zh-CN.md)
+
+An independently maintained Antigravity subscription provider for Pi. It adapts the official **agy CLI HTTP protocol** without running the CLI, an ACP bridge, or another agent.
+
+**Status: public-source chat provider, installed and user-tested locally.** Tested against Pi **1.5.2** with synthetic HTTP responses and bounded live diagnostics; see the acceptance limits below.
+
+## Installation
+
+Requires Node.js >= 22.19.0 and the Pi 1.5.2 provider APIs used by this implementation. Use version 0.1.1 or later for clean npm installations; 0.1.0 could rely on development dependencies to resolve Pi subpath imports.
+
+From npm:
+
+```sh
+pi install npm:@specode/pi-antigravity
+```
+
+Or from GitHub:
+
+```sh
+pi install git:github.com/specode/pi-antigravity
+```
+
+If the older `pi-antigravity` package is installed, remove it first with `pi remove npm:pi-antigravity`. Never load two implementations of the `antigravity` provider together. Existing Pi OAuth credentials are retained; no CLI credential migration is required.
+
+Run `/reload` or restart Pi after installation. If needed, use `/login`, choose Antigravity, and paste the complete callback URL when prompted. Select a chat model with `/model`.
+
+For local development:
+
+```sh
+pi install /path/to/pi-antigravity
+```
+
+## Development
+
+```sh
+npm ci
+npm run check
+```
+
+`check` runs strict type checking, offline tests, an isolated packed-extension smoke test, and a package dry run. The smoke test packs and extracts the package outside the checkout, without the extension's development dependencies, then loads it in real Pi with synthetic credentials and network fetches blocked. It does not touch your installed extensions or credentials. After publication, `npm run smoke -- @specode/pi-antigravity@<version>` validates the registry artifact the same way.
+
+The extension entry is `src/index.ts`. Do not load it alongside another provider registered as `antigravity`. Switching your installed provider, live account testing, and publishing are separate steps—not performed by development tests.
+
+## Publishing
+
+The scoped npm package is public. GitHub Actions validates pushes and pull requests. npm Trusted Publishing is configured for `specode/pi-antigravity` and `npm-publish.yml`, allowing future GitHub Release publications through OIDC without a long-lived npm token. Version 0.1.0 was bootstrapped through maintainer authentication; releases must use a new package version, never republish an existing one. Publishing and creating releases are external operations and require explicit authorization.
+
+## Request flow
+
+1. **Authentication:** native Pi OAuth registration, Google manual callback-URL login with PKCE/state validation, and token refresh. Pi owns credential storage and refresh locking. Existing OAuth credentials retain `access`, `refresh`, `expires`, `projectId`, and optional `email`.
+2. **Discovery:** initialize the consumer account and fetch the curated chat catalog. Public model IDs are separate from runtime IDs and explicitly discovered effort variants. Pi's standard model store retains the last successful account-owned snapshot for offline startup; failed refreshes do not erase it.
+3. **Conversion:** reuse Pi's public Google converters and normalized transcript. Rewrite only Pi's exact known opening sentences in the serialized system prompt; preserve rules, tools, user text, and session history.
+4. **Streaming:** one HTTP attempt to an approved official HTTPS origin, incremental SSE parsing, Pi instrumentation hooks, signatures, tool calls, usage, cancellation, separate header/idle deadlines, and one terminal event. No internal retries or hidden endpoint/model failover.
+
+The default endpoint is `https://daily-cloudcode-pa.googleapis.com`, observed for the consumer account in the handoff. This is not a universal enterprise-routing claim. CLI identity is pinned to **1.5.9 / build 1021519450**, with the actual host platform and architecture.
+
+## Boundaries
+
+- Chat/coding provider only. Antigravity image generation/editing has been cancelled and is not a remaining implementation or testing task.
+- Only curated chat models and explicit supported thinking variants are exposed. Unknown thinking contracts are omitted rather than guessed; unsupported requested effort fails visibly.
+- Subscription per-token billing is not known. Pi's zero cost metadata means **unpriced**, not free usage or an invoice estimate. Token usage is recorded separately from subscription quota.
+- Tool schema names and literal values remain unchanged. Unsupported references or required strict-sampling contracts fail instead of silently removing tools.
+- Request UUIDs and transcript counters are provider-local bookkeeping, not a claimed reconstruction of every CLI retry/resume rule. Pi session IDs keep ordinary resumes stable and forks separate; direct calls without a session ID are ephemeral.
+- No account switching, credit overage, background warming, quota UI, search/fetch tools, CLI storage migration, or private Pi runtime imports.
+
+## Companion plugins
+
+- **[pi-subscription-usage](https://github.com/specode/pi-subscription-usage):** owns quota queries and display. The JSON credential bridge retains `token`, `projectId`, and optional `email`. Email-less accounts add an opaque `ownershipId` (persisted by Pi as `antigravityOwnershipId`) so token rotation cannot break catalog ownership; existing consumers can ignore it. This development work does not modify that plugin.
+- **[pi-subscription-image](https://github.com/specode/pi-subscription-image):** its existing Codex/Grok functionality is unchanged. The planned Antigravity backend has been cancelled; this provider registers no image-generation API or tool. Earlier image evidence is retained only as historical research.
+
+## Evidence and remaining acceptance
+
+The earlier **2026-11-15** protocol investigation covered 17 generation requests, including native read-tool feasibility, strict prompt-opening controls, and one reference-image request. [The evidence manifest](./test/fixtures/agy-cli-1.5.9/manifest.json) distinguishes official captures from direct probes. Redacted records are structural evidence, not replayable requests.
+
+Current offline tests exercise native Pi model/auth integration and real local Pi read-tool execution against mocked Gemini/Claude responses, plus malformed streams, cancellation, timeouts, signatures, concurrency, and cache isolation. OAuth application parameters were statically checked against the pinned official CLI archive; **this is not a live browser-login test**.
+
+Local deployment also verified real account initialization and catalog discovery, persistence of six public models, and offline restoration by the installed CLI. Existing credentials were unchanged.
+
+A separately authorized six-request Argon High diagnosis isolated a 429 to this repository's own injected instructions: they quoted the original Pi opening after the leading prompt had already been adapted. A strict same-request comparison changed only that documentation block to a source reference and returned 429 → 200. The literal example was removed from `AGENTS.md`, not from arbitrary user rules or history; a regression test prevents reintroduction. Small output caps and no tool execution mean this is not full tool-loop acceptance. Reload Pi's project rules before retrying an affected session.
+
+The user subsequently reported successful real usage after the fix. This records local deployment/fix acceptance, not verified coverage of every model, tool continuation, login, resume, or cancellation path.
+
+Remaining individually unverified areas: authorized `/login`, complete live tool-loop and session UI acceptance, and broader account/model coverage. Antigravity image generation is out of scope, not unfinished work. See [AGENTS.md](./AGENTS.md), the sole development/handoff entry point, for exact contracts and limitations.

package/README.zh-CN.md

@@ -0,0 +1,85 @@
+# pi-antigravity
+
+[English](./README.md) | [简体中文](./README.zh-CN.md)
+
+独立维护的 Pi Antigravity 订阅 provider。适配官方 **agy CLI 的 HTTP 协议**，运行时不启动官方 CLI、ACP bridge 或另一套 agent。
+
+**状态：公开源码的聊天 provider，已安装到本机并获用户实测确认。** 基于 Pi **1.5.2** 完成合成 HTTP 测试和受限真实对照；验收边界见下文。
+
+## 安装
+
+需要 Node.js >= 22.19.0，以及本实现使用的 Pi 1.5.2 provider API。全新 npm 安装请使用 0.1.1 或更高版本；0.1.0 的 Pi 子路径导入可能依赖开发目录中的依赖才能解析。
+
+从 npm 安装：
+
+```sh
+pi install npm:@specode/pi-antigravity
+```
+
+也可以从 GitHub 安装：
+
+```sh
+pi install git:github.com/specode/pi-antigravity
+```
+
+如果已安装旧 `pi-antigravity` 包，先执行 `pi remove npm:pi-antigravity`。不要同时加载两个注册 `antigravity` 的实现。保留现有 Pi OAuth 凭据，无需迁移 CLI 登录存储。
+
+安装后执行 `/reload` 或重启 Pi。需要登录时运行 `/login`，选择 Antigravity，并按提示粘贴完整回调 URL；通过 `/model` 选择聊天模型。
+
+本地开发也可以直接安装源码目录：
+
+```sh
+pi install /path/to/pi-antigravity
+```
+
+## 开发验证
+
+```sh
+npm ci
+npm run check
+```
+
+`check` 包含严格类型检查、离线测试、隔离的发布包加载测试及打包预检。冒烟测试先打包，再解压到源码目录之外，不带扩展的开发依赖，以合成凭据在真实 Pi 中加载并阻止网络 fetch，不触碰用户已安装扩展或凭据。发布后可运行 `npm run smoke -- @specode/pi-antigravity@<version>` 同样验证 registry 中的实际包。
+
+扩展入口为 `src/index.ts`。不要与另一个注册 `antigravity` 的 provider 同时加载。切换用户安装、真实账号测试和发布均为独立步骤，不会由开发测试执行。
+
+## 发布
+
+scoped npm 包公开访问。GitHub Actions 验证 push 和 pull request。npm 已为 `specode/pi-antigravity` 和 `npm-publish.yml` 配置 Trusted Publishing，后续 GitHub Release 通过 OIDC 发布，不使用长期 npm token。0.1.0 已经维护者认证完成首次发布；后续 Release 必须使用新版本号，不重复发布既有版本。发布和创建 Release 属于外部操作，仍须明确授权。
+
+## 请求主流程
+
+1. **认证**：Pi 原生 OAuth 注册，Google 手动粘贴完整回调 URL 登录，校验 PKCE／state，支持 token 刷新。凭据保存和刷新锁由 Pi 管理。保留现有 OAuth 的 `access`、`refresh`、`expires`、`projectId` 及可选 `email`。
+2. **目录**：初始化 consumer 账号并拉取精选聊天目录。公开模型 id 与 runtime id、明确发现的思考档位分离。Pi 标准模型存储保留账号隔离的最后成功快照，支持离线启动；刷新失败不清空快照。
+3. **转换**：复用 Pi 公开 Google 转换器和标准 transcript。仅在序列化系统提示词时精确替换 Pi 已知开头两句，保留规则、工具、用户文本和会话记录。
+4. **流式处理**：只向批准的官方 HTTPS origin 发送一次 HTTP 请求，增量解析 SSE，保留 Pi 观测钩子、签名、工具调用与用量，支持取消、独立的响应头／流空闲超时及唯一终止事件。不内置重试，不暗中切换 endpoint 或模型。
+
+默认 endpoint 为交接中 consumer 账号实际使用的 `https://daily-cloudcode-pa.googleapis.com`，不宣称适用于所有企业账号。CLI 身份固定为 **1.5.9／构建 1021519450**，平台与架构取当前主机实际值。
+
+## 功能边界
+
+- 仅维护聊天／编码 provider。Antigravity 生图／编辑计划已取消，不再列为待开发或待测试任务。
+- 仅公开精选聊天模型和明确支持的思考变体。不猜测未知思考协议；不支持的显式档位直接报错。
+- 尚无订阅按 token 计费依据。Pi 成本元数据中的零表示**未定价**，不表示免费，也不是账单估算。请求 token 用量与订阅额度分开。
+- 保留工具 schema 属性名和字面值。不支持的引用或必须严格采样的契约明确失败，不静默删除工具。
+- 请求 UUID 与 transcript 计数属于本 provider 的本地记账，不声称还原了 CLI 所有重试／恢复规则。Pi session id 让普通恢复保持标识稳定、fork 相互隔离；无 session id 的直接调用按临时会话处理。
+- 不实现账号切换、超额 credits、后台预热、额度 UI、搜索／网页工具、CLI 登录存储迁移或 Pi 私有运行时依赖。
+
+## 独立插件协作
+
+- **[pi-subscription-usage](https://github.com/specode/pi-subscription-usage)**：负责额度查询和展示。JSON 凭据桥接保留 `token`、`projectId` 及可选 `email`。无 email 的账号额外携带不透明的 `ownershipId`（由 Pi 以 `antigravityOwnershipId` 保存），避免 token 轮换破坏目录归属；既有消费者可忽略此字段。本次开发不修改该插件。
+- **[pi-subscription-image](https://github.com/specode/pi-subscription-image)**：已有 Codex/Grok 功能保持不变，原计划的 Antigravity 后端已取消；本 provider 不注册生图 API 或工具。早期生图证据仅作为历史调研记录保留。
+
+## 证据与待完成验收
+
+此前 **2026-11-15** 协议调研共执行 17 次生成请求，覆盖原生 read 工具可行性、严格的提示词开头对照及一次参考图请求。[证据清单](./test/fixtures/agy-cli-1.5.9/manifest.json) 区分官方抓包和直接探测。脱敏记录仅用于结构取证，不能重放。
+
+当前离线测试覆盖 Pi 原生模型／认证集成，使用 mock Gemini／Claude 响应执行真实的本地 Pi read 工具，并覆盖异常流、取消、超时、签名、并发和缓存隔离。OAuth 应用参数已对照固定版本官方 CLI 归档静态核实；**这不等于真实浏览器登录已验收**。
+
+本机部署另外验证了真实账号初始化和目录发现，6 个公开模型的持久化及已安装 CLI 的离线恢复。既有凭据保持不变。
+
+另经独立授权执行 6 次 Argon High 对照，定位到本仓库自身注入的项目规则：真正的开头虽已适配，文档却又逐字引用了原始 Pi 开头。严格保持请求其他字段相同，仅把该文档段落改为源码引用，结果从 429 变为 200。已移除 `AGENTS.md` 的这一逐字示例并增加回归测试，不改写任意用户规则或历史。测试限制了输出且未执行工具，不能视为完整工具闭环验收。受影响会话应先重载 Pi 的项目规则再重试。
+
+用户随后反馈修复后实际测试正常，记为本机部署及该修复的用户验收；不据此宣称所有模型、工具续轮、登录、恢复或取消流程均已验证。
+
+仍未单独验收的范围：经授权的 `/login`、真实完整工具闭环与会话 UI，以及更广泛的账号／模型覆盖。Antigravity 生图不在范围内，不是未完成待办。精确契约和限制统一见唯一开发／交接入口 [AGENTS.md](./AGENTS.md)。

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,22 @@
+# Third-party notices
+
+## Pi
+
+- Project: <https://github.com/earendil-works/pi>
+- License: MIT
+- Integration: public provider/auth/model/transcript APIs and the public Google message/tool converters from `@earendil-works/pi-ai`.
+
+Pi supplies these packages at runtime. This package declares them as peers and does not bundle their implementations.
+
+## pi-antigravity by Rahul Arya
+
+- Project: <https://github.com/Rahularya01/pi-antigravity>
+- Author: Rahul Arya
+- License: MIT
+- Reference: the 0.14.0 provider was used as a protocol-research reference, including authentication and model-discovery clues. It is not a runtime dependency, and its agent, tools, compatibility registry, and account store are not bundled here.
+
+## Official agy CLI observations
+
+The independently implemented protocol adapter is also informed by redacted observations of the official agy CLI 1.5.9. No official binary, extracted source, user credential, or raw prompt capture is included. OAuth installed-application identifiers in `src/auth.ts` are public client application parameters, not user access or refresh tokens. The synthetic image and redacted protocol observations under `test/fixtures/` are research evidence, not an implemented image-generation feature.
+
+This project is not affiliated with or endorsed by Google, Antigravity, Pi, or the upstream extension author.

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@specode/pi-antigravity",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "type": "module",
+  "description": "Independent Antigravity subscription chat provider for Pi, aligned with the official agy CLI HTTP protocol.",
+  "license": "MIT",
+  "author": "Specode",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/specode/pi-antigravity.git"
+  },
+  "homepage": "https://github.com/specode/pi-antigravity#readme",
+  "bugs": {
+    "url": "https://github.com/specode/pi-antigravity/issues"
+  },
+  "keywords": [
+    "pi-package",
+    "pi-extension",
+    "pi-coding-agent",
+    "antigravity",
+    "oauth",
+    "provider",
+    "subscription"
+  ],
+  "files": ["src", "README.md", "README.zh-CN.md", "LICENSE", "THIRD_PARTY_NOTICES.md"],
+  "scripts": {
+    "test": "tsx --test test/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "smoke": "tsx scripts/smoke.mjs",
+    "pack:check": "npm pack --dry-run",
+    "check": "npm run typecheck && npm test && npm run smoke && npm run pack:check",
+    "prepublishOnly": "npm run check"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "1.5.2",
+    "@earendil-works/pi-coding-agent": "1.5.2",
+    "@types/node": "^26.0.0",
+    "tsx": "^4.21.0",
+    "typescript": "^6.0.0"
+  },
+  "publishConfig": { "access": "public" },
+  "pi": { "extensions": ["./src/index.ts"] },
+  "engines": { "node": ">=22.19.0" }
+}

package/src/auth.ts

@@ -0,0 +1,288 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import type { OAuthCredential, OAuthCredentials, ProviderAuth, ProviderAuthInteraction } from "@earendil-works/pi-ai";
+import { assertOfficialBaseUrl, CLIENT_USER_AGENT, DEFAULT_BASE_URL, postJson, readBoundedBody } from "./client.ts";
+
+/** Existing Pi auth.json shape. Pi alone owns storage and refresh locking. */
+export interface AntigravityOAuthCredential extends OAuthCredential {
+  projectId: string;
+  email?: string;
+  /** Provider-local fallback identity, retained when a refresh token rotates. */
+  antigravityOwnershipId?: string;
+}
+
+/** Public credential bridge consumed by chat, usage and image integrations. */
+export interface AntigravityApiKey {
+  token: string;
+  projectId: string;
+  email?: string;
+  /** Optional additive bridge metadata; never a replacement bearer-token format. */
+  ownershipId?: string;
+}
+
+export interface AccountInitialization {
+  baseUrl: string;
+  projectId: string;
+  currentTier?: { id?: string; name?: string };
+  paidTier?: { id?: string; name?: string };
+}
+
+export interface InitializeAccountOptions {
+  baseUrl?: string;
+  signal?: AbortSignal;
+  /** Injectable transport for offline tests; production uses the shared client. */
+  postJson?: typeof postJson;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+function wireString(value: unknown): value is string {
+  return typeof value === "string" && value.length <= 8192 && /^[\x21-\x7e]+$/.test(value);
+}
+
+function email(value: unknown): string | undefined {
+  return typeof value === "string" && value.length <= 254 && /^[^\s@]+@[^\s@]+$/.test(value)
+    ? value : undefined;
+}
+
+function invalidCredentials(): Error {
+  // Never include JSON parser errors: they can quote access tokens.
+  return new Error("Invalid Antigravity credentials: expected token and Cloud Code Assist projectId.");
+}
+
+/** Strict JSON bridge; raw bearer tokens and fabricated project IDs are not accepted. */
+export function parseApiKey(value: string | undefined): AntigravityApiKey {
+  let parsed: unknown;
+  try { parsed = JSON.parse(value ?? ""); } catch { throw invalidCredentials(); }
+  const data = record(parsed);
+  if (!data || !wireString(data.token) || !wireString(data.projectId)) throw invalidCredentials();
+  if (data.email !== undefined && !email(data.email)) throw invalidCredentials();
+  if (data.ownershipId !== undefined && !validOwnershipId(data.ownershipId)) throw invalidCredentials();
+  return { token: data.token, projectId: data.projectId, ...(email(data.email) ? { email: email(data.email) } : {}),
+    ...(validOwnershipId(data.ownershipId) ? { ownershipId: data.ownershipId } : {}) };
+}
+
+function validOwnershipId(value: unknown): value is string {
+  return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+
+/** Derive once from the old refresh token; retain the marker before rotating it. */
+function fallbackOwnershipId(credential: OAuthCredentials): string {
+  const existing = credential.antigravityOwnershipId;
+  if (existing !== undefined) {
+    if (!validOwnershipId(existing)) throw invalidCredentials();
+    return existing;
+  }
+  if (!wireString(credential.refresh)) throw invalidCredentials();
+  return createHash("sha256").update("pi-antigravity/ownership/v1\0").update(credential.refresh).digest("hex");
+}
+
+/** Pure serialization of existing Pi OAuth credentials; does not mutate or persist. */
+export function getApiKey(credential: OAuthCredentials): string {
+  if (!wireString(credential.access) || !wireString(credential.projectId)) throw invalidCredentials();
+  if (credential.email !== undefined && !email(credential.email)) throw invalidCredentials();
+  return JSON.stringify({ token: credential.access, projectId: credential.projectId,
+    ...(email(credential.email) ? { email: email(credential.email) } : { ownershipId: fallbackOwnershipId(credential) }) });
+}
+
+function tier(value: unknown): AccountInitialization["currentTier"] {
+  const data = record(value);
+  if (!data) return undefined;
+  const id = wireString(data.id) ? data.id : undefined;
+  const name = typeof data.name === "string" && data.name.length <= 256 && !/[\x00-\x1f\x7f]/.test(data.name)
+    ? data.name : undefined;
+  return id || name ? { ...(id ? { id } : {}), ...(name ? { name } : {}) } : undefined;
+}
+
+/**
+ * Initialize the consumer account on one explicitly approved origin.
+ * The minimal metadata body is a public upstream protocol clue, not a claim of
+ * byte-for-byte CLI capture. Only cloudaicompanionProject is recognized; no
+ * guessed UUID, onboarding, explicit GCP project_id, or endpoint probing.
+ */
+export async function initializeAccount(token: string, options: InitializeAccountOptions = {}): Promise<AccountInitialization> {
+  options.signal?.throwIfAborted();
+  if (!wireString(token)) throw invalidCredentials();
+  const baseUrl = assertOfficialBaseUrl(options.baseUrl ?? DEFAULT_BASE_URL);
+  const response = await (options.postJson ?? postJson)(baseUrl, "/v1internal:loadCodeAssist", token,
+    { metadata: { ideType: "ANTIGRAVITY" } }, options.signal);
+  options.signal?.throwIfAborted();
+  const data = record(response);
+  const project = data?.cloudaicompanionProject;
+  const projectId = typeof project === "string" ? project : record(project)?.id;
+  if (!wireString(projectId)) {
+    throw new Error("Antigravity loadCodeAssist did not return a Cloud Code Assist project; automatic onboarding is not implemented.");
+  }
+  return { baseUrl, projectId, ...(tier(data?.currentTier) ? { currentTier: tier(data?.currentTier) } : {}),
+    ...(tier(data?.paidTier) ? { paidTier: tier(data?.paidTier) } : {}) };
+}
+
+/**
+ * Static verification: official CLI 1.5.9 darwin-arm archive, SHA-512 recorded
+ * in test/fixtures/agy-cli-1.5.9/manifest.json. CLI backend/auth (not acpauth):
+ * getOauthParams consumer branch 0x102b7584c, getScopesByAuthMethod
+ * 0x102b759b0, StartInteractive 0x102b74e60, completeOAuth.func1.1
+ * 0x102b7a400. Google Endpoint has AuthStyleInParams (1). It calls standard
+ * oauth2 Config.Exchange and tokenRefresher.Token. These are public client
+ * application parameters, not user credentials. Static verification is not
+ * a live /login acceptance test. We require full URLs/state rather than the
+ * CLI's more permissive bare-code input; no localhost/ACP flow is implemented.
+ */
+export const OAUTH_CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
+const OAUTH_CLIENT_SECRET = "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";
+export const OAUTH_AUTH_URL = "https://accounts.google.com/o/oauth2/auth";
+export const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+export const OAUTH_REDIRECT_URI = "https://antigravity.google/oauth-callback";
+const USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
+export const OAUTH_SCOPES = Object.freeze([
+  "https://www.googleapis.com/auth/cloud-platform",
+  "https://www.googleapis.com/auth/userinfo.email",
+  "https://www.googleapis.com/auth/userinfo.profile",
+  "https://www.googleapis.com/auth/cclog",
+  "https://www.googleapis.com/auth/experimentsandconfigs",
+  "https://www.googleapis.com/auth/aicode",
+  "openid",
+]);
+export interface AuthOptions extends InitializeAccountOptions {
+  fetch?: typeof fetch;
+  now?: () => number;
+  requestTimeoutMs?: number;
+  loginTimeoutMs?: number;
+}
+
+/** Errors retain only allowlisted OAuth codes, never token response bodies. */
+export class AntigravityOAuthError extends Error {
+  constructor(readonly status: number, readonly code?: string) {
+    super(`Antigravity OAuth request failed (HTTP ${status}${code ? `, ${code}` : ""}).`);
+    this.name = "AntigravityOAuthError";
+  }
+}
+const SAFE_OAUTH_CODES = new Set(["invalid_grant", "invalid_client", "invalid_request", "unauthorized_client", "unsupported_grant_type", "access_denied", "temporarily_unavailable", "server_error"]);
+
+/** Strict manual callback parsing. No arbitrary redirect origins or bare codes. */
+export function parseOAuthCallback(value: string, expectedState: string): string {
+  let url: URL;
+  try { url = new URL(value.trim()); } catch { throw new Error("Paste the complete Antigravity callback URL including code and state."); }
+  if (url.origin + url.pathname !== OAUTH_REDIRECT_URI || url.username || url.password || url.hash) {
+    throw new Error("Unexpected Antigravity OAuth callback URL.");
+  }
+  const state = url.searchParams.getAll("state");
+  const a = Buffer.from(state[0] ?? "");
+  const b = Buffer.from(expectedState);
+  if (state.length !== 1 || !b.length || a.length !== b.length || !timingSafeEqual(a, b)) {
+    throw new Error("Antigravity OAuth state mismatch; restart login.");
+  }
+  if (url.searchParams.has("error")) throw new Error("Antigravity OAuth authorization was denied.");
+  const code = url.searchParams.getAll("code");
+  if (code.length !== 1 || !wireString(code[0])) throw new Error("Antigravity OAuth callback is missing a valid authorization code.");
+  return code[0];
+}
+
+async function oauthJson(url: string, init: RequestInit, signal: AbortSignal, options: AuthOptions): Promise<Record<string, unknown>> {
+  signal.throwIfAborted();
+  const bounded = AbortSignal.any([signal, AbortSignal.timeout(options.requestTimeoutMs ?? 30_000)]);
+  let response: Response;
+  let text: string;
+  try {
+    response = await (options.fetch ?? fetch)(url, { ...init, redirect: "error", signal: bounded });
+    text = await readBoundedBody(response, 64 * 1024, bounded);
+  } catch {
+    bounded.throwIfAborted();
+    throw new Error("Antigravity OAuth network request failed.");
+  }
+  bounded.throwIfAborted();
+  let data: Record<string, unknown> | undefined;
+  try { data = record(JSON.parse(text)); } catch { /* Never retain parser errors containing secrets. */ }
+  if (!response.ok) {
+    const code = typeof data?.error === "string" && SAFE_OAUTH_CODES.has(data.error) ? data.error : undefined;
+    throw new AntigravityOAuthError(response.status, code);
+  }
+  if (!data) throw new Error("Antigravity OAuth returned an invalid JSON object.");
+  return data;
+}
+async function exchangeToken(params: Record<string, string>, signal: AbortSignal, options: AuthOptions): Promise<Record<string, unknown>> {
+  return oauthJson(OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": CLIENT_USER_AGENT },
+    body: new URLSearchParams({ client_id: OAUTH_CLIENT_ID, client_secret: OAUTH_CLIENT_SECRET, ...params }).toString(),
+  }, signal, options);
+}
+function tokenFields(data: Record<string, unknown>, now: number, previousRefresh?: string): OAuthCredentials {
+  const refresh = data.refresh_token === undefined ? previousRefresh : data.refresh_token;
+  const seconds = data.expires_in;
+  if (!wireString(data.access_token) || !wireString(refresh) || typeof seconds !== "number" ||
+    !Number.isFinite(seconds) || seconds <= 0 || !Number.isSafeInteger(now + seconds * 1000) ||
+    (data.token_type !== undefined && (typeof data.token_type !== "string" || data.token_type.toLowerCase() !== "bearer"))) {
+    throw new Error("Antigravity OAuth returned invalid or incomplete token data.");
+  }
+  return { access: data.access_token, refresh, expires: now + seconds * 1000 };
+}
+function waitForPrompt<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) abort();
+    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
+
+/** Native manual-paste OAuth login; returns credentials for Pi to store. */
+export async function loginAntigravity(interaction: ProviderAuthInteraction, options: AuthOptions = {}): Promise<AntigravityOAuthCredential> {
+  const signal = AbortSignal.any([interaction.signal, ...(options.signal ? [options.signal] : []), AbortSignal.timeout(options.loginTimeoutMs ?? 5 * 60_000)]);
+  signal.throwIfAborted();
+  const baseUrl = assertOfficialBaseUrl(options.baseUrl ?? DEFAULT_BASE_URL);
+  const verifier = randomBytes(32).toString("base64url");
+  const state = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  const params = new URLSearchParams({ client_id: OAUTH_CLIENT_ID, redirect_uri: OAUTH_REDIRECT_URI,
+    response_type: "code", scope: OAUTH_SCOPES.join(" "), code_challenge: challenge, code_challenge_method: "S256",
+    state, access_type: "offline", prompt: "consent" });
+  interaction.notify({ type: "auth_url", url: `${OAUTH_AUTH_URL}?${params}`,
+    instructions: "Sign in, then paste the complete final Antigravity callback URL (including code and state)." });
+  const pasted = await waitForPrompt(interaction.prompt({ type: "manual_code", message: "Paste the complete Antigravity callback URL:", signal }), signal);
+  signal.throwIfAborted();
+  const code = parseOAuthCallback(pasted, state);
+  const now = (options.now ?? Date.now)();
+  const data = await exchangeToken({ grant_type: "authorization_code", code, code_verifier: verifier, redirect_uri: OAUTH_REDIRECT_URI }, signal, options);
+  const fields = tokenFields(data, now);
+  interaction.notify({ type: "progress", message: "Initializing Antigravity account." });
+  const user = await oauthJson(USERINFO_URL, { method: "GET", headers: { Authorization: `Bearer ${fields.access}`, "User-Agent": CLIENT_USER_AGENT } }, signal, options);
+  const accountEmail = email(user.email);
+  if (!accountEmail) throw new Error("Antigravity OAuth user info did not contain a valid account email.");
+  const account = await initializeAccount(fields.access, { ...options, baseUrl, signal });
+  signal.throwIfAborted();
+  return { ...fields, type: "oauth", projectId: account.projectId, email: accountEmail };
+}
+
+/** Refresh only the current credential; preserve project/email and token rotation. */
+export async function refreshAntigravityToken(credential: OAuthCredential, signal: AbortSignal, options: AuthOptions = {}): Promise<AntigravityOAuthCredential> {
+  signal = options.signal ? AbortSignal.any([signal, options.signal]) : signal;
+  signal.throwIfAborted();
+  assertOfficialBaseUrl(options.baseUrl ?? DEFAULT_BASE_URL);
+  if (!wireString(credential.refresh)) throw invalidCredentials();
+  if (credential.email !== undefined && !email(credential.email)) throw invalidCredentials();
+  // Require initialized credentials before rotating: no fallible discovery may
+  // discard the only valid replacement refresh token after the exchange.
+  if (!wireString(credential.projectId)) throw invalidCredentials();
+  const ownershipId = email(credential.email) ? undefined : fallbackOwnershipId(credential);
+  const now = (options.now ?? Date.now)();
+  const fields = tokenFields(await exchangeToken({ grant_type: "refresh_token", refresh_token: credential.refresh }, signal, options), now, credential.refresh);
+  // No discovery after token rotation when projectId is already known: avoid
+  // losing the rotated credential due to an unrelated initialization failure.
+  const projectId = credential.projectId;
+  signal.throwIfAborted();
+  return { ...credential, ...fields, type: "oauth", projectId,
+    ...(ownershipId === undefined ? {} : { antigravityOwnershipId: ownershipId }) };
+}
+
+/** Native auth. Pi owns locking, persistence, login/logout and caller cancellation. */
+export function createAntigravityAuth(options: AuthOptions = {}): ProviderAuth {
+  return { oauth: {
+    name: "Antigravity", isSubscription: true, loginLabel: "Sign in with Google (Antigravity subscription)",
+    login: interaction => loginAntigravity(interaction, options),
+    refresh: (credential, signal) => refreshAntigravityToken(credential, signal, options),
+    async toAuth(credential) { return { apiKey: getApiKey(credential) }; },
+  } };
+}