mixdog 0.9.166 → 0.9.167

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-login.mjs

@@ -3,12 +3,13 @@
  *
  * Flow: PKCE authorization on a loopback callback (port 51121, the port the
  * registered client is bound to) -> token exchange -> account email ->
- * `loadCodeAssist` for an existing Cloud project, falling back to `onboardUser`
- * which provisions one. A login without a project id is useless: every content
- * request carries `project`.
+ * `loadCodeAssist` for account status -> free-tier onboarding when needed ->
+ * refreshed Cloud project. A login without a project id is useless: every
+ * content request carries `project`.
  */
 import { createServer } from 'http';
 import { randomBytes } from 'crypto';
+import { setTimeout as delay } from 'node:timers/promises';
 import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
 import {
     AUTH_URL,
@@ -18,7 +19,7 @@ import {
     CLIENT_ID,
     CLIENT_SECRET,
     LOGIN_TIMEOUT_MS,
-    PROJECT_ENDPOINTS,
+    PROJECT_ENDPOINT,
     PROJECT_TIMEOUT_MS,
     REDIRECT_URI,
     SCOPES,
@@ -31,128 +32,182 @@ import {
     saveTokens,
 } from './antigravity-oauth-tokens.mjs';
 
-const ONBOARD_MAX_ATTEMPTS = 8;
-const ONBOARD_INTERVAL_MS = 2_000;
+const ONBOARD_INTERVAL_MS = 1_000;
+const CALLBACK_FAILURE_HTML = '<html><body><h2>Antigravity sign-in was not completed.</h2>'
+    + '<p>Return to Mixdog for the error details and any account verification link.</p></body></html>';
 
 export function generatePKCE() {
     return createOAuthPkce();
 }
 
-function readProjectId(value) {
-    if (typeof value === 'string' && value.trim()) return value.trim();
-    if (value && typeof value === 'object' && typeof value.id === 'string' && value.id.trim()) {
-        return value.id.trim();
-    }
-    return '';
-}
-
 function extractProjectId(payload) {
-    if (!payload || typeof payload !== 'object') return '';
-    for (const key of ['cloudaicompanionProject', 'projectId', 'project']) {
-        const id = readProjectId(payload[key]);
-        if (id) return id;
-    }
-    return '';
+    return typeof payload?.cloudaicompanionProject === 'string' ? payload.cloudaicompanionProject : '';
 }
 
-function defaultTierId(allowedTiers, currentTier) {
-    if (Array.isArray(allowedTiers) && allowedTiers.length) {
-        const preferred = allowedTiers.find((tier) => tier?.isDefault && String(tier?.id || '').trim());
-        if (preferred) return String(preferred.id).trim();
-        const first = allowedTiers.find((tier) => String(tier?.id || '').trim());
-        if (first) return String(first.id).trim();
-    }
-    const current = String(currentTier?.id || '').trim();
-    return current || 'free-tier';
+function accountVerificationError(validationUrl, reason, email) {
+    const account = email ? ` for ${email}` : '';
+    const detail = reason ? `\n${reason}` : '';
+    const error = new Error(_scrubTokens(`[antigravity-oauth] Account verification required${account}.${detail}`
+        + `\nVisit ${validationUrl} to continue, then sign in again.`));
+    error.code = 'VALIDATION_REQUIRED';
+    error.validationUrl = validationUrl;
+    return error;
 }
 
-async function postJson(url, body, accessToken, { fetchFn = fetch, signal = null } = {}) {
-    return await fetchFn(url, {
-        method: 'POST',
+async function requestCodeAssist(action, body, context, timeoutMs = PROJECT_TIMEOUT_MS) {
+    const { accessToken, fetchFn, signal } = context;
+    signal?.throwIfAborted();
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const isPost = body !== undefined;
+    const res = await fetchFn(`${PROJECT_ENDPOINT}/v1internal${isPost ? ':' : '/'}${action}`, {
+        method: isPost ? 'POST' : 'GET',
         headers: {
             'Content-Type': 'application/json',
             Authorization: `Bearer ${accessToken}`,
             ...antigravityHeaders(),
         },
-        body: JSON.stringify(body),
-        signal: signal || AbortSignal.timeout(PROJECT_TIMEOUT_MS),
+        ...(isPost ? { body: JSON.stringify(body) } : {}),
+        redirect: 'error',
+        signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
     });
+    if (res.status !== 200) {
+        const text = await res.text();
+        let failure = null;
+        try { failure = JSON.parse(text); } catch { /* Non-JSON errors retain their original detail below. */ }
+        const details = failure?.error?.details;
+        const validation = Array.isArray(details) ? details.find((entry) =>
+            entry?.reason === 'VALIDATION_REQUIRED'
+            && typeof entry.metadata?.validation_url === 'string'
+            && entry.metadata.validation_url.length > 0) : null;
+        if (validation) {
+            throw accountVerificationError(validation.metadata.validation_url, failure.error.message, context.email);
+        }
+        const detail = _scrubTokens(text);
+        throw new Error(`[antigravity-oauth] ${action} failed: ${res.status} ${res.statusText}: ${detail}`);
+    }
+    const payload = await res.json();
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        throw new Error(`[antigravity-oauth] invalid ${action} response`);
+    }
+    return payload;
 }
 
-async function fetchAccountEmail(accessToken, { fetchFn = fetch } = {}) {
+async function fetchAccountEmail(accessToken, { fetchFn = fetch, signal = null } = {}) {
     try {
         const res = await fetchFn(USERINFO_URL, {
             headers: { Authorization: `Bearer ${accessToken}` },
-            signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+            redirect: 'error',
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)]) : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
         });
         if (!res.ok) return '';
         const json = await res.json();
         return String(json?.email || '');
-    } catch { return ''; }
+    } catch {
+        signal?.throwIfAborted();
+        return '';
+    }
+}
+
+async function loadProjectState(context) {
+    const body = { metadata: codeAssistMetadata() };
+    let payload = await requestCodeAssist('loadCodeAssist', body, context);
+    const projectId = extractProjectId(payload);
+    if (payload.paidTier == null && projectId) {
+        payload = await requestCodeAssist('loadCodeAssist', {
+            ...body,
+            cloudaicompanionProject: projectId,
+        }, context);
+    }
+    return payload;
+}
+
+function tierIds(list, key) {
+    return Array.isArray(list) ? list.map((tier) => tier?.[key]).filter((id) => typeof id === 'string' && id) : [];
+}
+
+function tierSummary(payload) {
+    return `allowed tiers: [${tierIds(payload.allowedTiers, 'id').join(', ')}]; `
+        + `ineligible tiers: [${tierIds(payload.ineligibleTiers, 'tierId').join(', ')}]`;
 }
 
 /**
- * Resolve the Cloud project backing this account, provisioning one when the
- * account has none. Endpoints are tried in order because only production
- * answers `loadCodeAssist` reliably for managed accounts.
+ * Tier to onboard with. Free tier when Google allows it (or reports no tier
+ * list at all); otherwise the default allowed tier that Google can provision
+ * without a user-supplied Cloud project, e.g. a paid subscription tier.
  */
-async function discoverProject(accessToken, { fetchFn = fetch, onProgress = null } = {}) {
-    let tierId = 'free-tier';
-    let loaded = false;
-    let lastError = '';
-    for (const endpoint of PROJECT_ENDPOINTS) {
-        try {
-            onProgress?.('Checking for an existing project...');
-            const res = await postJson(
-                `${endpoint}/v1internal:loadCodeAssist`,
-                { metadata: codeAssistMetadata() },
-                accessToken,
-                { fetchFn },
-            );
-            if (!res.ok) {
-                lastError = `${res.status} ${_scrubTokens(await res.text().catch(() => '')).slice(0, 200)}`;
-                continue;
-            }
-            loaded = true;
-            const payload = await res.json();
-            const existing = extractProjectId(payload);
-            if (existing) return existing;
-            tierId = defaultTierId(payload?.allowedTiers, payload?.currentTier);
-            break;
-        } catch (err) {
-            lastError = String(err?.message || err).slice(0, 200);
+function onboardingTier(payload) {
+    const allowed = tierIds(payload.allowedTiers, 'id');
+    const ineligible = new Set(tierIds(payload.ineligibleTiers, 'tierId'));
+    if (allowed.includes('free-tier')) return 'free-tier';
+    if (!Array.isArray(payload.allowedTiers) && !ineligible.has('free-tier')) return 'free-tier';
+    const managed = (payload.allowedTiers ?? []).filter((tier) => typeof tier?.id === 'string' && tier.id
+        && tier.userDefinedCloudaicompanionProject !== true && !ineligible.has(tier.id));
+    return (managed.find((tier) => tier.isDefault) ?? managed[0])?.id ?? '';
+}
+
+function noTierError(payload, email) {
+    const summary = tierSummary(payload);
+    const blocked = payload.ineligibleTiers?.find((tier) => tier?.tierId === 'free-tier' && tier.reasonMessage)
+        ?? payload.ineligibleTiers?.find((tier) => tier?.reasonMessage);
+    if (blocked) {
+        const reason = `${blocked.reasonMessage}\n(${summary})`;
+        if (typeof blocked.validationUrl === 'string' && blocked.validationUrl) {
+            return accountVerificationError(blocked.validationUrl, reason, email);
         }
+        return new Error(`[antigravity-oauth] ${_scrubTokens(reason)}`);
     }
-    if (!loaded && lastError) {
-        throw new Error(`[antigravity-oauth] loadCodeAssist failed: ${lastError}`);
-    }
+    return new Error(`[antigravity-oauth] loadCodeAssist allowed no tier to onboard (${summary})`);
+}
 
-    onProgress?.('Provisioning a project...');
-    for (const endpoint of PROJECT_ENDPOINTS) {
-        for (let attempt = 1; attempt <= ONBOARD_MAX_ATTEMPTS; attempt += 1) {
-            try {
-                const res = await postJson(
-                    `${endpoint}/v1internal:onboardUser`,
-                    { tierId, metadata: codeAssistMetadata() },
-                    accessToken,
-                    { fetchFn },
-                );
-                if (!res.ok) break;
-                const payload = await res.json();
-                const provisioned = extractProjectId(payload?.response) || extractProjectId(payload);
-                if (payload?.done && provisioned) return provisioned;
-                // The operation is long-running: poll the same endpoint.
-                onProgress?.(`Waiting for project provisioning (${attempt}/${ONBOARD_MAX_ATTEMPTS})...`);
-                await new Promise((r) => setTimeout(r, ONBOARD_INTERVAL_MS));
-            } catch {
-                break;
-            }
+async function provisionProject(context, tierId) {
+    const deadline = Date.now() + PROJECT_TIMEOUT_MS;
+    const remaining = () => {
+        const ms = deadline - Date.now();
+        if (ms <= 0) throw new Error(`[antigravity-oauth] onboardUser timed out after ${PROJECT_TIMEOUT_MS}ms`);
+        return ms;
+    };
+    let operation = await requestCodeAssist('onboardUser', {
+        tierId,
+        metadata: codeAssistMetadata(),
+    }, context, remaining());
+    while (operation.done !== true) {
+        await delay(Math.min(ONBOARD_INTERVAL_MS, remaining()), undefined, { signal: context.signal ?? undefined });
+        const timeoutMs = remaining();
+        if (typeof operation.name !== 'string' || !operation.name) {
+            throw new Error('[antigravity-oauth] onboardUser returned an operation without a name');
         }
+        operation = await requestCodeAssist(operation.name, undefined, context, timeoutMs);
+    }
+    if (operation.error != null) {
+        const { code, message } = operation.error;
+        const detail = message ? `${typeof code === 'number' ? `${code}: ` : ''}${message}` : JSON.stringify(operation.error);
+        throw new Error(`[antigravity-oauth] onboardUser operation failed: ${_scrubTokens(detail)}`);
+    }
+    if (!operation.response || typeof operation.response['@type'] !== 'string') {
+        throw new Error('[antigravity-oauth] invalid onboardUser response');
     }
-    throw new Error('[antigravity-oauth] could not resolve a Cloud project for this account');
 }
 
-export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetch, onProgress = null }) {
+/** Resolve account eligibility and return the project from a fresh status load. */
+export async function discoverProject(accessToken, { fetchFn = fetch, onProgress = null, signal = null, email = '' } = {}) {
+    const context = { accessToken, fetchFn, signal, email };
+    onProgress?.('Checking Cloud Code Assist account status...');
+    const initial = await loadProjectState(context);
+    if (initial.currentTier == null) {
+        const tierId = onboardingTier(initial);
+        if (!tierId) throw noTierError(initial, email);
+        onProgress?.(`Provisioning the Antigravity ${tierId}...`);
+        await provisionProject(context, tierId);
+    }
+    onProgress?.('Refreshing Cloud Code Assist project...');
+    const refreshed = await loadProjectState(context);
+    const projectId = extractProjectId(refreshed);
+    if (!projectId) throw new Error('[antigravity-oauth] loadCodeAssist did not return a cloudaicompanionProject');
+    return projectId;
+}
+
+export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetch, onProgress = null, signal = null }) {
+    signal?.throwIfAborted();
     const cleanCode = String(code || '').trim();
     if (!cleanCode) throw new Error('[antigravity-oauth] authorization code is required');
     const res = await fetchFn(TOKEN_URL, {
@@ -169,7 +224,7 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
         // Secret-bearing (code + verifier): refuse redirects so neither can be
         // replayed against an untrusted host.
         redirect: 'error',
-        signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+        signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)]) : AbortSignal.timeout(TOKEN_TIMEOUT_MS),
     });
     if (!res.ok) {
         const text = await res.text().catch(() => '');
@@ -179,8 +234,8 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
     if (!json?.access_token || !json?.refresh_token) {
         throw new Error('[antigravity-oauth] token exchange response missing access_token or refresh_token');
     }
-    const email = await fetchAccountEmail(json.access_token, { fetchFn });
-    const projectId = await discoverProject(json.access_token, { fetchFn, onProgress });
+    const email = await fetchAccountEmail(json.access_token, { fetchFn, signal });
+    const projectId = await discoverProject(json.access_token, { fetchFn, onProgress, signal, email });
     const tokens = {
         access_token: json.access_token,
         refresh_token: json.refresh_token,
@@ -188,11 +243,18 @@ export async function exchangeAuthorizationCode({ code, verifier, fetchFn = fetc
         project_id: projectId,
         email,
     };
+    signal?.throwIfAborted();
     saveTokens(tokens);
     return tokens;
 }
 
-export async function beginOAuthLogin({ fetchFn = fetch } = {}) {
+export async function beginOAuthLogin({
+    fetchFn = fetch,
+    onProgress = null,
+    createServerFn = createServer,
+    openBrowserFn = null,
+} = {}) {
+    const controller = new AbortController();
     const pkce = generatePKCE();
     const state = randomBytes(16).toString('hex');
     const url = new URL(AUTH_URL);
@@ -210,53 +272,96 @@ export async function beginOAuthLogin({ fetchFn = fetch } = {}) {
     let server = null;
     let timeout = null;
     let finish = null;
+    let settled = false;
+    let exchangePromise = null;
+    const acceptCode = (code) => {
+        if (exchangePromise) return exchangePromise;
+        controller.signal.throwIfAborted();
+        // The browser deadline ends when a code arrives; network requests have
+        // their own deadlines. Browser and manual callbacks share one exchange.
+        if (timeout) clearTimeout(timeout);
+        timeout = null;
+        exchangePromise = exchangeAuthorizationCode({
+            code, verifier: pkce.verifier, fetchFn, onProgress, signal: controller.signal,
+        });
+        exchangePromise.then(
+            (tokens) => finish(tokens),
+            (error) => finish(null, error instanceof Error ? error : new Error(String(error))),
+        );
+        return exchangePromise;
+    };
     const waitForCallback = new Promise((resolvePromise, reject) => {
-        let settled = false;
         finish = (value, error = null) => {
             if (settled) return;
             settled = true;
+            controller.abort();
             if (timeout) clearTimeout(timeout);
             try { server?.close(); } catch { /* already closed */ }
             if (error) reject(error);
             else resolvePromise(value);
         };
-        server = createServer(async (req, res) => {
+        server = createServerFn(async (req, res) => {
             const requestUrl = new URL(req.url || '/', `http://${CALLBACK_HOST}:${CALLBACK_PORT}`);
             if (requestUrl.pathname !== CALLBACK_PATH) {
                 res.writeHead(404);
                 res.end();
                 return;
             }
-            const code = requestUrl.searchParams.get('code');
-            if (!code || requestUrl.searchParams.get('state') !== state) {
+            if (requestUrl.searchParams.get('state') !== state) {
+                res.writeHead(400);
+                res.end('Invalid OAuth state');
+                return;
+            }
+            const authorizationError = requestUrl.searchParams.get('error');
+            if (authorizationError) {
+                const detail = requestUrl.searchParams.get('error_description') || authorizationError;
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(CALLBACK_FAILURE_HTML);
+                // A late denial must not cancel an already accepted code.
+                if (!exchangePromise) {
+                    finish(null, new Error(`[antigravity-oauth] authorization failed: ${_scrubTokens(detail)}`));
+                }
+                return;
+            }
+            const code = requestUrl.searchParams.get('code')?.trim();
+            if (!code) {
                 res.writeHead(400);
-                res.end('Invalid');
-                finish(null);
+                res.end('Missing authorization code');
                 return;
             }
-            res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end('<html><body><h2>Antigravity login successful! You can close this tab.</h2></body></html>');
             try {
-                finish(await exchangeAuthorizationCode({ code, verifier: pkce.verifier, fetchFn }));
-            } catch (err) {
-                finish(null, err instanceof Error ? err : new Error(String(err)));
+                await acceptCode(code);
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end('<html><body><h2>Antigravity connected.</h2><p>You can close this tab.</p></body></html>');
+            } catch {
+                // The shared exchange reports its error through waitForCallback.
+                // Do not interpolate provider-controlled text into browser HTML.
+                res.writeHead(500, { 'Content-Type': 'text/html' });
+                res.end(CALLBACK_FAILURE_HTML);
             }
         });
-        timeout = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
+        timeout = setTimeout(() => finish(
+            null,
+            new Error(`[antigravity-oauth] browser authentication timed out after ${LOGIN_TIMEOUT_MS}ms`),
+        ), LOGIN_TIMEOUT_MS);
         if (timeout.unref) timeout.unref();
+        server.on('error', (err) => finish(
+            null,
+            new Error(`[antigravity-oauth] callback server failed on ${CALLBACK_HOST}:${CALLBACK_PORT}: ${err?.message || err}`),
+        ));
         server.listen(CALLBACK_PORT, CALLBACK_HOST, async () => {
+            if (settled) return;
             process.stderr.write(`\n[antigravity-oauth] Open this URL to log in:\n${url.toString()}\n\n`);
             try {
-                const { openInBrowser } = await import('../../../shared/open-url.mjs');
-                openInBrowser(url.toString());
+                if (openBrowserFn) await openBrowserFn(url.toString());
+                else {
+                    const { openInBrowser } = await import('../../../shared/open-url.mjs');
+                    if (!settled) await openInBrowser(url.toString());
+                }
             } catch (err) {
                 process.stderr.write(`[antigravity-oauth] browser open failed: ${String(err?.message || err).slice(0, 200)}\n`);
             }
         });
-        server.on('error', (err) => finish(
-            null,
-            new Error(`[antigravity-oauth] callback server failed on ${CALLBACK_HOST}:${CALLBACK_PORT}: ${err?.message || err}`),
-        ));
     });
 
     return {
@@ -264,11 +369,10 @@ export async function beginOAuthLogin({ fetchFn = fetch } = {}) {
         url: url.toString(),
         waitForCallback,
         completeCode: async (input) => {
-            const parsed = parseOAuthCodeInput(input);
+            const parsed = parseOAuthCodeInput(input, { allowHashState: true });
             if (parsed.state && parsed.state !== state) throw new Error('[antigravity-oauth] OAuth state mismatch');
-            const tokens = await exchangeAuthorizationCode({ code: parsed.code, verifier: pkce.verifier, fetchFn });
-            finish?.(tokens);
-            return tokens;
+            if (!parsed.code) throw new Error('[antigravity-oauth] authorization code is required');
+            return await acceptCode(parsed.code);
         },
         cancel: () => { finish?.(null); },
     };

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-tokens.mjs

@@ -19,6 +19,8 @@ import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { ANTIGRAVITY_MODELS } from './provider-model-identities.mjs';
+export { ANTIGRAVITY_MODELS } from './provider-model-identities.mjs';
 
 // The Antigravity IDE's installed-app OAuth client, which every copy of that
 // IDE ships (a native-app client is not a confidential credential). It is
@@ -35,7 +37,7 @@ export const CLIENT_SECRET = decode('R09DU1BYLUs1', 'OEZXUjQ4NkxkTEoxbUxCOHNYQzR
 
 export const AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
 export const TOKEN_URL = 'https://oauth2.googleapis.com/token';
-export const USERINFO_URL = 'https://www.googleapis.com/oauth2/v2/userinfo';
+export const USERINFO_URL = 'https://www.googleapis.com/oauth2/v1/userinfo?alt=json';
 export const SCOPES = [
     'https://www.googleapis.com/auth/cloud-platform',
     'https://www.googleapis.com/auth/userinfo.email',
@@ -47,74 +49,102 @@ export const SCOPES = [
 export const CALLBACK_HOST = '127.0.0.1';
 export const CALLBACK_PORT = 51121;
 export const CALLBACK_PATH = '/oauth-callback';
-// Google matches the redirect URI string exactly, and the registered client is
-// bound to `localhost` — the loopback server binds 127.0.0.1 all the same.
-export const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+// Use the same literal loopback address in authorization and token exchange.
+export const REDIRECT_URI = `http://${CALLBACK_HOST}:${CALLBACK_PORT}${CALLBACK_PATH}`;
 
-// Content requests ride the IDE's daily sandbox channel first. Production is
-// kept last as a fallback: it answers, but not for every Antigravity-only model.
-const ENDPOINT_DAILY = 'https://daily-cloudcode-pa.sandbox.googleapis.com';
+// Content requests ride the IDE's own daily channel first (the host the
+// shipped client is launched with). The sandbox daily host is an older
+// channel that has answered with version-gating stubs; autopush is the
+// fastest alternate when daily is saturated. Production is kept last: it
+// answers, but not for every Antigravity-only model.
+const ENDPOINT_DAILY = 'https://daily-cloudcode-pa.googleapis.com';
+const ENDPOINT_DAILY_SANDBOX = 'https://daily-cloudcode-pa.sandbox.googleapis.com';
 const ENDPOINT_AUTOPUSH = 'https://autopush-cloudcode-pa.sandbox.googleapis.com';
 const ENDPOINT_PROD = 'https://cloudcode-pa.googleapis.com';
-export const CONTENT_ENDPOINTS = Object.freeze([ENDPOINT_DAILY, ENDPOINT_AUTOPUSH, ENDPOINT_PROD]);
-// Project discovery is best supported on production, so it leads there.
-export const PROJECT_ENDPOINTS = Object.freeze([ENDPOINT_PROD, ENDPOINT_DAILY, ENDPOINT_AUTOPUSH]);
+export const CONTENT_ENDPOINTS = Object.freeze([ENDPOINT_DAILY, ENDPOINT_AUTOPUSH, ENDPOINT_DAILY_SANDBOX, ENDPOINT_PROD]);
+// Account provisioning uses the hub control plane, not the content sandboxes.
+export const PROJECT_ENDPOINT = ENDPOINT_DAILY;
 
-// The gateway exposes no public catalog endpoint, so the model list is curated.
-// Wire ids are the ones the backend accepts verbatim; Gemini 3 Pro and the
-// Claude family carry their effort tier in the id rather than a parameter.
-export const ANTIGRAVITY_MODELS = Object.freeze([
-    { id: 'gemini-3-pro-high', name: 'Gemini 3 Pro High', provider: 'antigravity-oauth', contextWindow: 1048576 },
-    { id: 'gemini-3-pro-low', name: 'Gemini 3 Pro Low', provider: 'antigravity-oauth', contextWindow: 1048576 },
-    { id: 'gemini-3-flash-agent', name: 'Gemini 3 Flash', provider: 'antigravity-oauth', contextWindow: 1048576 },
-    { id: 'claude-opus-4-6-thinking', name: 'Claude Opus 4.6 Thinking', provider: 'antigravity-oauth', contextWindow: 250000 },
-    { id: 'claude-sonnet-4-6', name: 'Claude Sonnet 4.6', provider: 'antigravity-oauth', contextWindow: 250000 },
-    { id: 'claude-opus-4-5-thinking', name: 'Claude Opus 4.5 Thinking', provider: 'antigravity-oauth', contextWindow: 200000 },
-    { id: 'claude-sonnet-4-5', name: 'Claude Sonnet 4.5', provider: 'antigravity-oauth', contextWindow: 1000000 },
-]);
 export const DEFAULT_ANTIGRAVITY_MODEL = ANTIGRAVITY_MODELS[0].id;
 
-const ANTIGRAVITY_VERSION_FALLBACK = '1.18.3';
+const ANTIGRAVITY_VERSION_FALLBACK = '2.8.0';
 export const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 export const TOKEN_TIMEOUT_MS = 30_000;
 export const PROJECT_TIMEOUT_MS = 30_000;
 // Refresh ahead of expiry so an in-flight turn never posts a stale token.
 export const TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1000;
 
+// The backend gates models on the client version in the User-Agent, so the
+// version tracks the latest Antigravity release via its update manifest.
+// The pinned value is the offline fallback; the env override always wins.
+const VERSION_MANIFEST_URL = 'https://antigravity-hub-auto-updater-974169037036.us-central1.run.app/manifest/latest-arm64-mac.yml';
+const VERSION_FETCH_TIMEOUT_MS = 5_000;
+const VERSION_RETRY_AFTER_MS = 10 * 60 * 1000;
+let _discoveredVersion = null;
+let _versionFetch = null;
+let _versionFailedAt = 0;
+
 function antigravityVersion() {
-    return String(process.env.MIXDOG_ANTIGRAVITY_VERSION || '').trim() || ANTIGRAVITY_VERSION_FALLBACK;
+    return String(process.env.MIXDOG_ANTIGRAVITY_VERSION || '').trim() || _discoveredVersion || ANTIGRAVITY_VERSION_FALLBACK;
+}
+
+/** Version from an electron-builder update manifest, or null when absent. */
+export function parseAntigravityManifestVersion(text) {
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const match = /^\s*version\s*:\s*(?:"([^"]*)"|'([^']*)'|([^\s#]+))\s*(?:#.*)?$/.exec(line);
+        if (!match) continue;
+        const version = (match[1] ?? match[2] ?? match[3] ?? '').trim();
+        return /^\d+\.\d+\.\d+$/.test(version) ? version : null;
+    }
+    return null;
+}
+
+/**
+ * Resolve the current client version once per process. A failed lookup keeps
+ * the pinned fallback and is not retried for a while, so an unreachable
+ * manifest host never delays every request.
+ */
+export function ensureAntigravityVersion({ fetchFn = fetch } = {}) {
+    if (process.env.MIXDOG_ANTIGRAVITY_VERSION || _discoveredVersion) return Promise.resolve(antigravityVersion());
+    if (_versionFetch) return _versionFetch;
+    if (Date.now() - _versionFailedAt < VERSION_RETRY_AFTER_MS) return Promise.resolve(antigravityVersion());
+    _versionFetch = (async () => {
+        try {
+            const res = await fetchFn(VERSION_MANIFEST_URL, {
+                headers: { 'Cache-Control': 'no-cache', 'User-Agent': 'electron-builder' },
+                signal: AbortSignal.timeout(VERSION_FETCH_TIMEOUT_MS),
+            });
+            if (res.ok) _discoveredVersion = parseAntigravityManifestVersion(await res.text());
+        } catch {
+            // The pinned fallback stays valid when discovery fails.
+        } finally {
+            if (!_discoveredVersion) _versionFailedAt = Date.now();
+            _versionFetch = null;
+        }
+        return antigravityVersion();
+    })();
+    return _versionFetch;
 }
 
-function osPlatformTag() {
-    return process.platform === 'win32' ? 'WINDOWS' : process.platform === 'darwin' ? 'MACOS' : 'LINUX';
+export function _resetAntigravityVersionForTest() {
+    _discoveredVersion = null;
+    _versionFetch = null;
+    _versionFailedAt = 0;
 }
 
 /**
- * Headers the Antigravity IDE sends. The backend gates newer models on the
- * client version, so this tracks the shipped release.
+ * Cloud Code Assist expects the hub client identity rather than Electron's
+ * browser headers. Keep the captured client platform independent of the host.
  */
 export function antigravityHeaders() {
     return {
-        'User-Agent': `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) `
-            + `Antigravity/${antigravityVersion()} Chrome/138.0.7204.235 Electron/37.3.1 Safari/537.36`,
-        'X-Goog-Api-Client': 'google-cloud-sdk vscode_cloudshelleditor/0.1',
-        'Client-Metadata': JSON.stringify({
-            ideType: 'ANTIGRAVITY',
-            platform: osPlatformTag(),
-            pluginType: 'GEMINI',
-        }),
+        'User-Agent': `antigravity/hub/${antigravityVersion()} (aidev_client; os_type=darwin; arch=arm64; cl=963137146)`,
     };
 }
 
 /** `loadCodeAssist` / `onboardUser` metadata block. */
-export function codeAssistMetadata(projectId = '') {
-    const metadata = {
-        ideType: 'ANTIGRAVITY',
-        platform: osPlatformTag(),
-        pluginType: 'GEMINI',
-    };
-    if (projectId) metadata.duetProject = projectId;
-    return metadata;
+export function codeAssistMetadata() {
+    return { ideType: 'ANTIGRAVITY' };
 }
 
 // --- Token store ---