opencode-antigravity-auth 1.6.5-beta.0 → 2.1.0

package/dist/src/plugin.js

@@ -1,30 +1,29 @@
 import { exec } from "node:child_process";
-import { tool } from "@opencode-ai/plugin";
-import { ANTIGRAVITY_DEFAULT_PROJECT_ID, ANTIGRAVITY_ENDPOINT_FALLBACKS, ANTIGRAVITY_ENDPOINT_PROD, ANTIGRAVITY_PROVIDER_ID, ANTIGRAVITY_REDIRECT_URI, getAntigravityHeaders, } from "./constants";
-import { authorizeAntigravity, exchangeAntigravity } from "./antigravity/oauth";
-import { authorizeGeminiCli, exchangeGeminiCli } from "./antigravity/oauth";
-import { accessTokenExpired, isOAuthAuth, parseRefreshParts, formatRefreshParts } from "./plugin/auth";
-import { promptAddAnotherAccount, promptLoginMode, promptProjectId } from "./plugin/cli";
-import { ensureProjectContext } from "./plugin/project";
-import { startAntigravityDebugRequest, logAntigravityDebugResponse, logAccountContext, logRateLimitEvent, logRateLimitSnapshot, logResponseBody, logModelFamily, isDebugEnabled, getLogFilePath, initializeDebug, } from "./plugin/debug";
-import { buildThinkingWarmupBody, isGenerativeLanguageRequest, prepareAntigravityRequest, transformAntigravityResponse, } from "./plugin/request";
-import { resolveModelWithTier } from "./plugin/transform/model-resolver";
-import { isEmptyResponseBody, createSyntheticErrorResponse, } from "./plugin/request-helpers";
-import { EmptyResponseError } from "./plugin/errors";
-import { AntigravityTokenRefreshError, refreshAccessToken } from "./plugin/token";
-import { startOAuthListener } from "./plugin/server";
-import { clearAccounts, loadAccounts, saveAccounts, saveAccountsReplace } from "./plugin/storage";
-import { AccountManager, parseRateLimitReason, calculateBackoffMs, computeSoftQuotaCacheTtlMs } from "./plugin/accounts";
-import { createAutoUpdateCheckerHook } from "./hooks/auto-update-checker";
-import { loadConfig, initRuntimeConfig } from "./plugin/config";
-import { createSessionRecoveryHook, getRecoverySuccessToast } from "./plugin/recovery";
-import { checkAccountsQuota } from "./plugin/quota";
-import { initDiskSignatureCache } from "./plugin/cache";
-import { createProactiveRefreshQueue } from "./plugin/refresh-queue";
-import { initLogger, createLogger } from "./plugin/logger";
-import { initHealthTracker, getHealthTracker, initTokenTracker, getTokenTracker } from "./plugin/rotation";
-import { initAntigravityVersion } from "./plugin/version";
-import { executeSearch } from "./plugin/search";
+import { tool } from "@opencode-ai/plugin/tool";
+import { ANTIGRAVITY_DEFAULT_PROJECT_ID, ANTIGRAVITY_ENDPOINT, ANTIGRAVITY_PROVIDER_ID, getAntigravityHeaders, getEndpointFallbacks, } from "./constants.js";
+import { authorizeAntigravity, exchangeAntigravity } from "./antigravity/oauth.js";
+import { accessTokenExpired, isOAuthAuth, parseRefreshParts, formatRefreshParts } from "./plugin/auth.js";
+import { promptAddAnotherAccount, promptLoginMode, promptProjectId } from "./plugin/cli.js";
+import { ensureProjectContext } from "./plugin/project.js";
+import { startAntigravityDebugRequest, logAntigravityDebugResponse, logAccountContext, logRateLimitEvent, logRateLimitSnapshot, logResponseBody, logModelFamily, isDebugEnabled, getLogFilePath, initializeDebug, } from "./plugin/debug.js";
+import { buildThinkingWarmupBody, isGenerativeLanguageRequest, prepareAntigravityRequest, transformAntigravityResponse, } from "./plugin/request.js";
+import { resolveModelWithTier } from "./plugin/transform/model-resolver.js";
+import { isEmptyResponseBody, createSyntheticErrorResponse, } from "./plugin/request-helpers.js";
+import { EmptyResponseError } from "./plugin/errors.js";
+import { AntigravityTokenRefreshError, refreshAccessToken } from "./plugin/token.js";
+import { startOAuthListener } from "./plugin/server.js";
+import { clearAccounts, loadAccounts, saveAccountCredentials, saveAccounts, saveAccountsReplace, updateAccountCredentials, updateAccounts } from "./plugin/storage.js";
+import { AccountManager, parseRateLimitReason, calculateBackoffMs, computeSoftQuotaCacheTtlMs } from "./plugin/accounts.js";
+import { createAutoUpdateCheckerHook } from "./hooks/auto-update-checker/index.js";
+import { loadConfig, initRuntimeConfig } from "./plugin/config/index.js";
+import { createSessionRecoveryHook, getRecoverySuccessToast } from "./plugin/recovery.js";
+import { checkAccountsQuota } from "./plugin/quota.js";
+import { acquireDiskSignatureCache } from "./plugin/cache.js";
+import { createProactiveRefreshQueue } from "./plugin/refresh-queue.js";
+import { initLogger, createLogger } from "./plugin/logger.js";
+import { initHealthTracker, getHealthTracker, initTokenTracker, getTokenTracker } from "./plugin/rotation.js";
+import { refreshAntigravityVersion, ANTIGRAVITY_VERSION_REFRESH_INTERVAL_MS } from "./plugin/version.js";
+import { executeSearch } from "./plugin/search.js";
 const MAX_OAUTH_ACCOUNTS = 10;
 const MAX_WARMUP_SESSIONS = 1000;
 const MAX_WARMUP_RETRIES = 2;
@@ -99,7 +98,19 @@ async function triggerAsyncQuotaRefreshForAccount(accountManager, accountIndex,
             quotaRefreshInProgressByEmail.delete(accountKey);
             return;
         }
-        const results = await checkAccountsQuota([singleAccount], client, providerId);
+        const results = await checkAccountsQuota([singleAccount], client, providerId, { onAccountUpdated: saveAccountCredentials });
+        const updatedAccount = results[0]?.updatedAccount;
+        if (updatedAccount) {
+            const saved = await updateAccounts(storage => {
+                const current = storage.accounts.find(item => singleAccount.id ? item.id === singleAccount.id : item.refreshToken === singleAccount.refreshToken);
+                if (current?.refreshToken === singleAccount.refreshToken)
+                    updateAccountCredentials(current, updatedAccount);
+            });
+            const current = saved?.accounts.find(item => singleAccount.id ? item.id === singleAccount.id : item.refreshToken === updatedAccount.refreshToken);
+            if (current && account.parts.refreshToken === singleAccount.refreshToken) {
+                accountManager.updateFromAuth(account, { ...accountManager.toAuthDetails(account), refresh: formatRefreshParts(current) }, singleAccount.refreshToken);
+            }
+        }
         if (results[0]?.status === "ok" && results[0]?.quota?.groups) {
             accountManager.updateQuotaCache(accountIndex, results[0].quota.groups);
             accountManager.requestSaveToDisk();
@@ -259,16 +270,6 @@ function extractVerificationErrorDetails(bodyText) {
     let validationRequired = lowerBody.includes("validation_required");
     let message;
     const verificationUrls = new Set();
-    // Detect SUBSCRIPTION_REQUIRED / Gemini Code Assist license errors
-    const isSubscriptionRequired = lowerBody.includes("subscription_required") ||
-        lowerBody.includes("lack a gemini code assist license");
-    // Detect Cloud Code Private API not enabled errors
-    const isApiEnableRequired = lowerBody.includes("cloud code private api has not been used") ||
-        lowerBody.includes("cloudcode-pa.googleapis.com/overview");
-    // Mark as validation required if we detect these specific error types
-    if (isSubscriptionRequired || isApiEnableRequired) {
-        validationRequired = true;
-    }
     const collectUrlsFromText = (text) => {
         for (const match of text.matchAll(/https:\/\/accounts\.google\.com\/[^\s"'<>]+/gi)) {
             if (match[0]) {
@@ -351,27 +352,15 @@ function extractVerificationErrorDetails(bodyText) {
         const fallback = decodedBody
             .split("\n")
             .map((line) => line.trim())
-            .find((line) => line && !line.startsWith("data:") && /(verify|validation|required|subscription|license)/i.test(line));
+            .find((line) => line && !line.startsWith("data:") && /(verify|validation|required)/i.test(line));
         if (fallback) {
             message = fallback;
         }
     }
-    // Classify the verification type
-    let verificationType = "unknown";
-    if (isSubscriptionRequired) {
-        verificationType = "gemini-cli";
-    }
-    else if (isApiEnableRequired) {
-        verificationType = "api-enable";
-    }
-    else if (verificationUrls.size > 0 && [...verificationUrls].some(u => u.includes("accounts.google.com"))) {
-        verificationType = "google-account";
-    }
     return {
         validationRequired,
         message,
         verifyUrl: selectBestVerificationUrl([...verificationUrls]),
-        verificationType,
     };
 }
 async function verifyAccountAccess(account, client, providerId) {
@@ -412,11 +401,12 @@ async function verifyAccountAccess(account, client, providerId) {
         Authorization: `Bearer ${refreshedAuth.access}`,
         "Content-Type": "application/json",
     };
-    if (projectId) {
-        headers["x-goog-user-project"] = projectId;
-    }
     const requestBody = {
+        project: projectId,
         model: "gemini-3-flash",
+        requestType: "agent",
+        userAgent: "antigravity",
+        requestId: `agent-${crypto.randomUUID()}`,
         request: {
             model: "gemini-3-flash",
             contents: [{ role: "user", parts: [{ text: "ping" }] }],
@@ -427,7 +417,7 @@ async function verifyAccountAccess(account, client, providerId) {
     const timeoutId = setTimeout(() => controller.abort(), 20000);
     let response;
     try {
-        response = await fetch(`${ANTIGRAVITY_ENDPOINT_PROD}/v1internal:streamGenerateContent?alt=sse`, {
+        response = await fetch(`${ANTIGRAVITY_ENDPOINT}/v1internal:streamGenerateContent?alt=sse`, {
             method: "POST",
             headers,
             body: JSON.stringify(requestBody),
@@ -459,14 +449,12 @@ async function verifyAccountAccess(account, client, providerId) {
             status: "blocked",
             message: extracted.message ?? "Google requires additional account verification.",
             verifyUrl: extracted.verifyUrl,
-            verificationType: extracted.verificationType,
         };
     }
     const fallbackMessage = extracted.message ?? `Request failed (${response.status} ${response.statusText}).`;
     return {
         status: "error",
         message: fallbackMessage,
-        verificationType: extracted.verificationType !== "unknown" ? extracted.verificationType : undefined,
     };
 }
 async function promptAccountIndexForVerification(accounts) {
@@ -507,7 +495,7 @@ async function promptOpenVerificationUrl() {
     const answer = (await promptOAuthCallbackValue("Open verification URL in your browser now? [Y/n]: ")).trim().toLowerCase();
     return answer === "" || answer === "y" || answer === "yes";
 }
-function markStoredAccountVerificationRequired(account, reason, verifyUrl, verificationType) {
+function markStoredAccountVerificationRequired(account, reason, verifyUrl) {
     let changed = false;
     const wasVerificationRequired = account.verificationRequired === true;
     if (!wasVerificationRequired) {
@@ -528,11 +516,6 @@ function markStoredAccountVerificationRequired(account, reason, verifyUrl, verif
         account.verificationUrl = normalizedUrl;
         changed = true;
     }
-    const normalizedType = verificationType?.trim();
-    if (normalizedType && account.verificationRequiredType !== normalizedType) {
-        account.verificationRequiredType = normalizedType;
-        changed = true;
-    }
     if (account.enabled !== false) {
         account.enabled = false;
         changed = true;
@@ -554,10 +537,6 @@ function clearStoredAccountVerificationRequired(account, enableIfRequired = fals
         account.verificationRequiredReason = undefined;
         changed = true;
     }
-    if (account.verificationRequiredType !== undefined) {
-        account.verificationRequiredType = undefined;
-        changed = true;
-    }
     if (account.verificationUrl !== undefined) {
         account.verificationUrl = undefined;
         changed = true;
@@ -636,7 +615,7 @@ function clampInt(value, min, max) {
     }
     return Math.min(max, Math.max(min, Math.floor(value)));
 }
-async function persistAccountPool(results, replaceAll = false) {
+export async function persistAccountPool(results, replaceAll = false) {
     if (results.length === 0) {
         return;
     }
@@ -1026,18 +1005,25 @@ function sleep(ms, signal) {
 /**
  * Creates an Antigravity OAuth plugin for a specific provider ID.
  */
-export const createAntigravityPlugin = (providerId) => async ({ client, directory }) => {
+export const createAntigravityPlugin = (providerId) => async ({ client, directory, runtimeVersion = 1, fetch: sendFetch = globalThis.fetch, canUseAccount }) => {
     // Load configuration from files and environment variables
     const config = loadConfig(directory);
     initRuntimeConfig(config);
     // Cached getAuth function for tool access
     let cachedGetAuth = null;
+    const refreshQueues = new Set();
+    const quotaRefreshes = new Set();
+    const transportManagers = new Set();
+    let disposed = false;
+    let managerGeneration = 0;
     // Initialize debug with config
     initializeDebug(config);
     // Initialize structured logger for TUI integration
     initLogger(client);
     // Fetch latest Antigravity version from remote API (non-blocking, falls back to hardcoded)
-    await initAntigravityVersion();
+    await refreshAntigravityVersion();
+    const versionRefreshTimer = setInterval(() => { void refreshAntigravityVersion(); }, ANTIGRAVITY_VERSION_REFRESH_INTERVAL_MS);
+    versionRefreshTimer.unref?.();
     // Initialize health tracker for hybrid strategy
     if (config.health_score) {
         initHealthTracker({
@@ -1060,19 +1046,21 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
     }
     // Initialize disk signature cache if keep_thinking is enabled
     // This integrates with the in-memory cacheSignature/getCachedSignature functions
-    if (config.keep_thinking) {
-        initDiskSignatureCache(config.signature_cache);
-    }
+    const releaseSignatureCache = config.keep_thinking
+        ? acquireDiskSignatureCache(config.signature_cache)
+        : undefined;
     // Initialize session recovery hook with full context
-    const sessionRecovery = createSessionRecoveryHook({ client, directory }, config);
-    const updateChecker = createAutoUpdateCheckerHook(client, directory, {
+    const sessionRecovery = runtimeVersion === 1
+        ? createSessionRecoveryHook({ client, directory }, config)
+        : null;
+    const updateChecker = runtimeVersion === 1 ? createAutoUpdateCheckerHook(client, directory, {
         showStartupToast: true,
         autoUpdate: config.auto_update,
-    });
+    }) : null;
     // Event handler for session recovery and updates
     const eventHandler = async (input) => {
         // Forward to update checker
-        await updateChecker.event(input);
+        await updateChecker?.event(input);
         // Track if this is a child session (subagent, background task)
         // This is used to filter toasts based on toast_scope config
         if (input.event.type === "session.created") {
@@ -1169,6 +1157,27 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
         },
     });
     return {
+        async flush() {
+            managerGeneration += 1;
+            await Promise.allSettled([...refreshQueues].map((queue) => queue.stop()));
+            refreshQueues.clear();
+            await Promise.allSettled([...transportManagers].map((manager) => manager.retire()));
+            transportManagers.clear();
+        },
+        async dispose() {
+            if (disposed)
+                return;
+            disposed = true;
+            managerGeneration += 1;
+            releaseSignatureCache?.();
+            clearInterval(versionRefreshTimer);
+            await Promise.allSettled([...refreshQueues].map((queue) => queue.stop()));
+            refreshQueues.clear();
+            await Promise.allSettled([...quotaRefreshes]);
+            await Promise.allSettled([...transportManagers].map((manager) => manager.retire()));
+            transportManagers.clear();
+            cachedGetAuth = null;
+        },
         event: eventHandler,
         tool: {
             google_search: googleSearchTool,
@@ -1176,11 +1185,22 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
         auth: {
             provider: providerId,
             loader: async (getAuth, provider) => {
+                if (disposed)
+                    throw new Error("Antigravity plugin has been disposed");
+                const expectedGeneration = managerGeneration;
+                if (runtimeVersion === 2) {
+                    await Promise.allSettled([...refreshQueues].map((queue) => queue.stop()));
+                    refreshQueues.clear();
+                    await Promise.allSettled([...transportManagers].map((manager) => manager.retire()));
+                    transportManagers.clear();
+                }
                 // Cache getAuth for tool access
                 cachedGetAuth = getAuth;
                 const auth = await getAuth();
                 // If OpenCode has no valid OAuth auth, clear any stale account storage
                 if (!isOAuthAuth(auth)) {
+                    if (runtimeVersion === 2)
+                        return {};
                     try {
                         await clearAccounts();
                     }
@@ -1194,8 +1214,22 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                 const authParts = parseRefreshParts(auth.refresh);
                 const storedAccounts = await loadAccounts();
                 // Note: AccountManager now ensures the current auth is always included in accounts
-                const accountManager = await AccountManager.loadFromDisk(auth);
+                const accountManager = await AccountManager.loadFromDisk(auth, runtimeVersion === 2);
+                if (runtimeVersion === 2)
+                    accountManager.useManagedStorage();
+                const abandonManager = async () => {
+                    await accountManager.retire();
+                    transportManagers.delete(accountManager);
+                    throw new Error(disposed ? "Antigravity plugin has been disposed" : "Antigravity accounts changed");
+                };
+                if (disposed || managerGeneration !== expectedGeneration)
+                    return abandonManager();
                 activeAccountManager = accountManager;
+                transportManagers.add(accountManager);
+                if (runtimeVersion === 2)
+                    await accountManager.saveToDisk();
+                if (disposed || managerGeneration !== expectedGeneration)
+                    return abandonManager();
                 if (accountManager.getAccountCount() > 0) {
                     accountManager.requestSaveToDisk();
                 }
@@ -1209,6 +1243,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                     });
                     refreshQueue.setAccountManager(accountManager);
                     refreshQueue.start();
+                    refreshQueues.add(refreshQueue);
                 }
                 if (isDebugEnabled()) {
                     const logPath = getLogFilePath();
@@ -1231,14 +1266,20 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                     }
                 }
                 return {
-                    apiKey: "",
+                    apiKey: "antigravity-oauth",
                     async fetch(input, init) {
                         if (!isGenerativeLanguageRequest(input)) {
-                            return fetch(input, init);
+                            return sendFetch(input, init);
                         }
+                        const checkLifetime = () => {
+                            if (disposed || (runtimeVersion === 2 && managerGeneration !== expectedGeneration))
+                                throw new Error("Antigravity accounts changed; retry the request");
+                        };
+                        checkLifetime();
                         const latestAuth = await getAuth();
+                        checkLifetime();
                         if (!isOAuthAuth(latestAuth)) {
-                            return fetch(input, init);
+                            return sendFetch(input, init);
                         }
                         if (accountManager.getAccountCount() === 0) {
                             throw new Error("No Antigravity accounts configured. Run `opencode auth login`.");
@@ -1246,6 +1287,10 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                         const urlString = toUrlString(input);
                         const family = getModelFamilyFromUrl(urlString);
                         const model = extractModelFromUrl(urlString);
+                        const eligible = (account) => !canUseAccount || canUseAccount({ id: account.id, refreshToken: account.parts.refreshToken }, model ?? "");
+                        if (!accountManager.getAccounts().some(account => account.enabled !== false && eligible(account))) {
+                            throw new Error("No enabled Antigravity account has access to this model. Refresh available models from /antigravity.");
+                        }
                         const debugLines = [];
                         const pushDebug = (line) => {
                             if (!isDebugEnabled())
@@ -1297,30 +1342,30 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                             if (family !== "gemini")
                                 return false;
                             // Use AccountManager method which properly checks for disabled/cooling-down accounts
-                            return accountManager.hasOtherAccountWithAntigravityAvailable(currentAccount.index, family, model);
+                            return accountManager.hasOtherAccountWithAntigravityAvailable(currentAccount.index, family, model, eligible);
                         };
                         while (true) {
                             // Check for abort at the start of each iteration
                             checkAborted();
-                            const accountCount = accountManager.getAccountCount();
+                            const accountCount = accountManager.getEnabledAccounts().filter(eligible).length;
                             const routingDecision = resolveHeaderRoutingDecision(urlString, family, config);
                             const { cliFirst, preferredHeaderStyle, explicitQuota, allowQuotaFallback, } = routingDecision;
                             if (accountCount === 0) {
                                 throw new Error("No Antigravity accounts available. Run `opencode auth login`.");
                             }
                             const softQuotaCacheTtlMs = computeSoftQuotaCacheTtlMs(config.soft_quota_cache_ttl_minutes, config.quota_refresh_interval_minutes);
-                            let account = accountManager.getCurrentOrNextForFamily(family, model, config.account_selection_strategy, preferredHeaderStyle, config.pid_offset_enabled, config.soft_quota_threshold_percent, softQuotaCacheTtlMs);
+                            let account = accountManager.getCurrentOrNextForFamily(family, model, config.account_selection_strategy, preferredHeaderStyle, config.pid_offset_enabled, config.soft_quota_threshold_percent, softQuotaCacheTtlMs, eligible);
                             if (!account && allowQuotaFallback) {
                                 const alternateHeaderStyle = preferredHeaderStyle === "antigravity" ? "gemini-cli" : "antigravity";
-                                account = accountManager.getCurrentOrNextForFamily(family, model, config.account_selection_strategy, alternateHeaderStyle, config.pid_offset_enabled, config.soft_quota_threshold_percent, softQuotaCacheTtlMs);
+                                account = accountManager.getCurrentOrNextForFamily(family, model, config.account_selection_strategy, alternateHeaderStyle, config.pid_offset_enabled, config.soft_quota_threshold_percent, softQuotaCacheTtlMs, eligible);
                                 if (account) {
                                     pushDebug(`selected-by-fallback idx=${account.index} preferred=${preferredHeaderStyle} alternate=${alternateHeaderStyle}`);
                                 }
                             }
                             if (!account) {
-                                if (accountManager.areAllAccountsOverSoftQuota(family, config.soft_quota_threshold_percent, softQuotaCacheTtlMs, model)) {
+                                if (accountManager.areAllAccountsOverSoftQuota(family, config.soft_quota_threshold_percent, softQuotaCacheTtlMs, model, eligible)) {
                                     const threshold = config.soft_quota_threshold_percent;
-                                    const softQuotaWaitMs = accountManager.getMinWaitTimeForSoftQuota(family, threshold, softQuotaCacheTtlMs, model);
+                                    const softQuotaWaitMs = accountManager.getMinWaitTimeForSoftQuota(family, threshold, softQuotaCacheTtlMs, model, eligible);
                                     const maxWaitMs = (config.max_rate_limit_wait_seconds ?? 300) * 1000;
                                     if (softQuotaWaitMs === null || (maxWaitMs > 0 && softQuotaWaitMs > maxWaitMs)) {
                                         const waitTimeFormatted = softQuotaWaitMs ? formatWaitTime(softQuotaWaitMs) : "unknown";
@@ -1340,7 +1385,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                 }
                                 const strictWait = !allowQuotaFallback;
                                 // All accounts are rate-limited - wait and retry
-                                const waitMs = accountManager.getMinWaitTimeForFamily(family, model, preferredHeaderStyle, strictWait) || 60_000;
+                                const waitMs = accountManager.getMinWaitTimeForFamily(family, model, preferredHeaderStyle, strictWait, eligible) || 60_000;
                                 const waitSecValue = Math.max(1, Math.ceil(waitMs / 1000));
                                 pushDebug(`all-rate-limited family=${family} accounts=${accountCount} waitMs=${waitMs}`);
                                 if (isDebugEnabled()) {
@@ -1408,7 +1453,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                         continue;
                                     }
                                     resetAccountFailureState(account.index);
-                                    accountManager.updateFromAuth(account, refreshed);
+                                    accountManager.updateFromAuth(account, refreshed, parseRefreshParts(authRecord.refresh).refreshToken);
                                     authRecord = refreshed;
                                     try {
                                         await accountManager.saveToDisk();
@@ -1419,9 +1464,24 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                 }
                                 catch (error) {
                                     if (error instanceof AntigravityTokenRefreshError && error.code === "invalid_grant") {
-                                        const removed = accountManager.removeAccount(account);
+                                        if (runtimeVersion === 2) {
+                                            const rejectedToken = parseRefreshParts(authRecord.refresh).refreshToken;
+                                            const saved = await updateAccounts(storage => {
+                                                const current = storage.accounts.find(item => account.id ? item.id === account.id : item.refreshToken === rejectedToken);
+                                                if (current?.refreshToken === rejectedToken)
+                                                    current.enabled = false;
+                                            });
+                                            const current = saved?.accounts.find(item => account.id ? item.id === account.id : item.refreshToken === rejectedToken);
+                                            if (current && current.refreshToken !== rejectedToken) {
+                                                accountManager.updateFromAuth(account, { type: "oauth", refresh: formatRefreshParts(current) });
+                                                continue;
+                                            }
+                                        }
+                                        const removed = runtimeVersion === 2
+                                            ? accountManager.setAccountEnabled(account.index, false)
+                                            : accountManager.removeAccount(account);
                                         if (removed) {
-                                            log.warn("Removed revoked account from pool - reauthenticate via `opencode auth login`");
+                                            log.warn("Revoked account excluded from rotation - reauthenticate via `opencode auth login`");
                                             try {
                                                 await accountManager.saveToDisk();
                                             }
@@ -1481,7 +1541,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                             }
                             if (projectContext.auth.refresh !== authRecord.refresh ||
                                 projectContext.auth.access !== authRecord.access) {
-                                accountManager.updateFromAuth(account, projectContext.auth);
+                                accountManager.updateFromAuth(account, projectContext.auth, parseRefreshParts(authRecord.refresh).refreshToken);
                                 authRecord = projectContext.auth;
                                 try {
                                     await accountManager.saveToDisk();
@@ -1521,7 +1581,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                 });
                                 try {
                                     pushDebug("thinking-warmup: start");
-                                    const warmupResponse = await fetch(warmupUrl, warmupInit);
+                                    const warmupResponse = await sendFetch(warmupUrl, warmupInit);
                                     const transformed = await transformAntigravityResponse(warmupResponse, true, warmupDebugContext, prepared.requestedModel, projectId, warmupUrl, prepared.effectiveModel, prepared.sessionId);
                                     await transformed.text();
                                     markWarmupSuccess(prepared.sessionId);
@@ -1548,7 +1608,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                 // Antigravity-first fallback: exhaust antigravity across ALL accounts before gemini-cli
                                 if (allowQuotaFallback && family === "gemini" && headerStyle === "antigravity") {
                                     // Check if ANY other account has antigravity available
-                                    if (accountManager.hasOtherAccountWithAntigravityAvailable(account.index, family, model)) {
+                                    if (accountManager.hasOtherAccountWithAntigravityAvailable(account.index, family, model, eligible)) {
                                         // Switch to another account with antigravity (preserve antigravity priority)
                                         pushDebug(`antigravity rate-limited on account ${account.index}, but available on other accounts. Switching.`);
                                         shouldSwitchAccount = true;
@@ -1602,19 +1662,14 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                 // Track capacity retries per endpoint to prevent infinite loops
                                 let capacityRetryCount = 0;
                                 let lastEndpointIndex = -1;
-                                for (let i = 0; i < ANTIGRAVITY_ENDPOINT_FALLBACKS.length; i++) {
+                                const endpoints = getEndpointFallbacks(headerStyle);
+                                for (let i = 0; i < endpoints.length; i++) {
                                     // Reset capacity retry counter when switching to a new endpoint
                                     if (i !== lastEndpointIndex) {
                                         capacityRetryCount = 0;
                                         lastEndpointIndex = i;
                                     }
-                                    const currentEndpoint = ANTIGRAVITY_ENDPOINT_FALLBACKS[i];
-                                    // Skip sandbox endpoints for Gemini CLI models - they only work with Antigravity quota
-                                    // Gemini CLI models must use production endpoint (cloudcode-pa.googleapis.com)
-                                    if (headerStyle === "gemini-cli" && currentEndpoint !== ANTIGRAVITY_ENDPOINT_PROD) {
-                                        pushDebug(`Skipping sandbox endpoint ${currentEndpoint} for gemini-cli headerStyle`);
-                                        continue;
-                                    }
+                                    const currentEndpoint = endpoints[i];
                                     try {
                                         const prepared = prepareAntigravityRequest(input, init, accessToken, projectContext.effectiveProjectId, currentEndpoint, headerStyle, forceThinkingRecovery, {
                                             claudeToolHardening: config.claude_tool_hardening,
@@ -1659,7 +1714,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                         if (config.account_selection_strategy === 'hybrid') {
                                             tokenConsumed = getTokenTracker().consume(account.index);
                                         }
-                                        const response = await fetch(prepared.request, prepared.init);
+                                        const response = await sendFetch(prepared.request, prepared.init);
                                         pushDebug(`status=${response.status} ${response.statusText}`);
                                         // Handle 429 rate limit (or Service Overloaded) with improved logic
                                         if (response.status === 429 || response.status === 503 || response.status === 529) {
@@ -1838,27 +1893,12 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                             if (extracted.validationRequired) {
                                                 const verificationReason = extracted.message ?? "Google requires account verification.";
                                                 const cooldownMs = 10 * 60 * 1000;
-                                                accountManager.markAccountVerificationRequired(account.index, verificationReason, extracted.verifyUrl, extracted.verificationType);
+                                                accountManager.markAccountVerificationRequired(account.index, verificationReason, extracted.verifyUrl);
                                                 accountManager.markAccountCoolingDown(account, cooldownMs, "validation-required");
                                                 accountManager.markRateLimited(account, cooldownMs, family, headerStyle, model);
                                                 const label = account.email || `Account ${account.index + 1}`;
                                                 if (accountManager.shouldShowAccountToast(account.index, 60000)) {
-                                                    let toastMessage;
-                                                    switch (extracted.verificationType) {
-                                                        case "gemini-cli":
-                                                            toastMessage = `⚠ ${label} needs Gemini CLI login. Run 'opencode auth login' → Gemini CLI Login.`;
-                                                            break;
-                                                        case "api-enable":
-                                                            toastMessage = `⚠ ${label}: Cloud Code API not enabled. Run 'opencode auth login' → Verify accounts.`;
-                                                            break;
-                                                        case "google-account":
-                                                            toastMessage = `⚠ ${label} needs Google verification. Run 'opencode auth login' → Verify accounts.`;
-                                                            break;
-                                                        default:
-                                                            toastMessage = `⚠ ${label} needs verification. Run 'opencode auth login' and use Verify accounts.`;
-                                                            break;
-                                                    }
-                                                    await showToast(toastMessage, "warning");
+                                                    await showToast(`⚠ ${label} needs verification. Run 'opencode auth login' and use Verify accounts.`, "warning");
                                                     accountManager.markToastShown(account.index);
                                                 }
                                                 pushDebug(`verification-required: disabled account ${account.index}`);
@@ -1871,7 +1911,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                         const shouldRetryEndpoint = (response.status === 403 ||
                                             response.status === 404 ||
                                             response.status >= 500);
-                                        if (shouldRetryEndpoint && i < ANTIGRAVITY_ENDPOINT_FALLBACKS.length - 1) {
+                                        if (shouldRetryEndpoint && i < endpoints.length - 1) {
                                             await logResponseBody(debugContext, response, response.status);
                                             lastFailure = createFailureContext(response);
                                             continue;
@@ -1881,7 +1921,11 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                             account.consecutiveFailures = 0;
                                             getHealthTracker().recordSuccess(account.index);
                                             accountManager.markAccountUsed(account.index);
-                                            void triggerAsyncQuotaRefreshForAccount(accountManager, account.index, client, providerId, config.quota_refresh_interval_minutes);
+                                            if (!disposed) {
+                                                const quotaRefresh = triggerAsyncQuotaRefreshForAccount(accountManager, account.index, client, providerId, config.quota_refresh_interval_minutes);
+                                                quotaRefreshes.add(quotaRefresh);
+                                                void quotaRefresh.then(() => quotaRefreshes.delete(quotaRefresh), () => quotaRefreshes.delete(quotaRefresh));
+                                            }
                                         }
                                         logAntigravityDebugResponse(debugContext, response, {
                                             note: response.ok ? "Success" : `Error ${response.status}`,
@@ -1973,7 +2017,7 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                                 headers: { "Content-Type": "application/json" }
                                             });
                                         }
-                                        if (i < ANTIGRAVITY_ENDPOINT_FALLBACKS.length - 1) {
+                                        if (i < endpoints.length - 1) {
                                             lastError = error instanceof Error ? error : new Error(String(error));
                                             continue;
                                         }
@@ -2035,19 +2079,6 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                         let status = 'unknown';
                                         if (acc.verificationRequired) {
                                             status = 'verification-required';
-                                            // Backfill verificationRequiredType for accounts flagged before this field existed
-                                            if (!acc.verificationRequiredType && acc.verificationRequiredReason) {
-                                                const lowerReason = acc.verificationRequiredReason.toLowerCase();
-                                                if (lowerReason.includes("subscription_required") || lowerReason.includes("gemini code assist license")) {
-                                                    acc.verificationRequiredType = "gemini-cli";
-                                                }
-                                                else if (lowerReason.includes("cloud code private api has not been used") || lowerReason.includes("cloudcode-pa.googleapis.com/overview")) {
-                                                    acc.verificationRequiredType = "api-enable";
-                                                }
-                                                else if (lowerReason.includes("accounts.google.com")) {
-                                                    acc.verificationRequiredType = "google-account";
-                                                }
-                                            }
                                         }
                                         else {
                                             const rateLimits = acc.rateLimitResetTimes;
@@ -2075,7 +2106,6 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                             status,
                                             isCurrentAccount: idx === (existingStorage.activeIndex ?? 0),
                                             enabled: acc.enabled !== false,
-                                            verificationRequiredType: acc.verificationRequiredType,
                                         };
                                     });
                                     menuResult = await promptLoginMode(existingAccounts);
@@ -2218,95 +2248,6 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                         }
                                         continue;
                                     }
-                                    if (menuResult.mode === "gemini-cli-login") {
-                                        if (existingStorage.accounts.length === 0) {
-                                            console.log("\nNo accounts available. Add an account first.\n");
-                                            continue;
-                                        }
-                                        // Show account picker
-                                        const accountIndex = await promptAccountIndexForVerification(existingStorage.accounts.map((acc, idx) => ({
-                                            email: acc.email,
-                                            index: idx,
-                                        })));
-                                        if (accountIndex === undefined) {
-                                            console.log("\nGemini CLI login cancelled.\n");
-                                            continue;
-                                        }
-                                        const targetAccount = existingStorage.accounts[accountIndex];
-                                        if (!targetAccount) {
-                                            console.log(`\nAccount ${accountIndex + 1} not found.\n`);
-                                            continue;
-                                        }
-                                        const accountLabel = targetAccount.email || `Account ${accountIndex + 1}`;
-                                        console.log(`\nStarting Gemini CLI login for ${accountLabel}...`);
-                                        console.log("This will open your browser to authorize Gemini Code Assist.\n");
-                                        let oauthListener;
-                                        try {
-                                            oauthListener = await startOAuthListener();
-                                            const geminiRedirectUri = ANTIGRAVITY_REDIRECT_URI;
-                                            const authorization = await authorizeGeminiCli(geminiRedirectUri, targetAccount.email);
-                                            const opened = await openBrowser(authorization.url);
-                                            if (opened) {
-                                                console.log("Opened authorization URL in your browser.");
-                                            }
-                                            else {
-                                                console.log("Could not open browser. Please open this URL manually:");
-                                                console.log(`\n${authorization.url}\n`);
-                                            }
-                                            console.log("Waiting for authorization...\n");
-                                            const callbackUrl = await oauthListener.waitForCallback();
-                                            const callbackParams = new URL(callbackUrl, "http://localhost").searchParams;
-                                            const code = callbackParams.get("code");
-                                            if (!code) {
-                                                console.log("✗ Authorization failed: no code received.\n");
-                                                await promptOAuthCallbackValue("\nPress Enter to return to menu...");
-                                                continue;
-                                            }
-                                            const result = await exchangeGeminiCli(code, authorization.verifier, geminiRedirectUri);
-                                            if (result.type === "success") {
-                                                const provisionedEmail = result.email || accountLabel;
-                                                console.log(`✓ Gemini CLI access provisioned for ${provisionedEmail}`);
-                                                // Verify the account actually works now
-                                                console.log("Verifying account access...");
-                                                const postVerification = await verifyAccountAccess(targetAccount, client, providerId);
-                                                if (postVerification.status === "ok") {
-                                                    // Clear any verification flags and re-enable the account
-                                                    if (targetAccount.verificationRequired) {
-                                                        const { changed } = clearStoredAccountVerificationRequired(targetAccount, true);
-                                                        if (changed) {
-                                                            await saveAccounts(existingStorage);
-                                                        }
-                                                        activeAccountManager?.clearAccountVerificationRequired(accountIndex, true);
-                                                        console.log(`✓ ${provisionedEmail} verified and re-enabled.\n`);
-                                                    }
-                                                    else if (targetAccount.enabled === false) {
-                                                        targetAccount.enabled = true;
-                                                        await saveAccounts(existingStorage);
-                                                        activeAccountManager?.setAccountEnabled(accountIndex, true);
-                                                        console.log(`✓ ${provisionedEmail} verified and re-enabled.\n`);
-                                                    }
-                                                    else {
-                                                        console.log(`✓ ${provisionedEmail} verified and ready for requests.\n`);
-                                                    }
-                                                }
-                                                else {
-                                                    console.log(`⚠ Verification probe still failing: ${postVerification.message}`);
-                                                    console.log("The API may take a few minutes to propagate. Try verifying again shortly.\n");
-                                                }
-                                            }
-                                            else {
-                                                console.log(`✗ Gemini CLI login failed: ${result.error}\n`);
-                                            }
-                                        }
-                                        catch (error) {
-                                            console.log(`✗ Gemini CLI login error: ${error instanceof Error ? error.message : String(error)}\n`);
-                                        }
-                                        finally {
-                                            oauthListener?.close();
-                                        }
-                                        await promptOAuthCallbackValue("\nPress Enter to return to menu...");
-                                        continue;
-                                    }
                                     if (menuResult.mode === "verify" || menuResult.mode === "verify-all") {
                                         const verifyAll = menuResult.mode === "verify-all" || menuResult.verifyAll === true;
                                         if (verifyAll) {
@@ -2338,11 +2279,11 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                                     continue;
                                                 }
                                                 if (verification.status === "blocked") {
-                                                    const changed = markStoredAccountVerificationRequired(account, verification.message, verification.verifyUrl, verification.verificationType);
+                                                    const changed = markStoredAccountVerificationRequired(account, verification.message, verification.verifyUrl);
                                                     if (changed) {
                                                         storageUpdated = true;
                                                     }
-                                                    activeAccountManager?.markAccountVerificationRequired(i, verification.message, verification.verifyUrl, verification.verificationType);
+                                                    activeAccountManager?.markAccountVerificationRequired(i, verification.message, verification.verifyUrl);
                                                     blockedCount += 1;
                                                     console.log("needs verification");
                                                     const verifyUrl = verification.verifyUrl ?? account.verificationUrl;
@@ -2390,68 +2331,9 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                         const account = existingStorage.accounts[verifyAccountIndex];
                                         if (!account) {
                                             console.log(`\nAccount ${verifyAccountIndex + 1} not found.\n`);
-                                            await promptOAuthCallbackValue("\nPress Enter to return to menu...");
                                             continue;
                                         }
                                         const label = account.email || `Account ${verifyAccountIndex + 1}`;
-                                        // Smart verify: if account is flagged as needing Gemini CLI login,
-                                        // trigger the OAuth flow directly instead of just probing
-                                        if (account.verificationRequired && account.verificationRequiredType === "gemini-cli") {
-                                            console.log(`\n${label} needs Gemini CLI login. Starting OAuth flow...\n`);
-                                            let oauthListener;
-                                            try {
-                                                oauthListener = await startOAuthListener();
-                                                const geminiRedirectUri = ANTIGRAVITY_REDIRECT_URI;
-                                                const authorization = await authorizeGeminiCli(geminiRedirectUri, account.email);
-                                                const opened = await openBrowser(authorization.url);
-                                                if (opened) {
-                                                    console.log("Opened authorization URL in your browser.");
-                                                }
-                                                else {
-                                                    console.log("Could not open browser. Please open this URL manually:");
-                                                    console.log(`\n${authorization.url}\n`);
-                                                }
-                                                console.log("Waiting for authorization...\n");
-                                                const callbackUrl = await oauthListener.waitForCallback();
-                                                const callbackParams = new URL(callbackUrl, "http://localhost").searchParams;
-                                                const code = callbackParams.get("code");
-                                                if (!code) {
-                                                    console.log("✗ Authorization failed: no code received.\n");
-                                                    await promptOAuthCallbackValue("\nPress Enter to return to menu...");
-                                                    continue;
-                                                }
-                                                const result = await exchangeGeminiCli(code, authorization.verifier, geminiRedirectUri);
-                                                if (result.type === "success") {
-                                                    // Verify the account actually works now
-                                                    console.log("Verifying account access...");
-                                                    const postVerification = await verifyAccountAccess(account, client, providerId);
-                                                    if (postVerification.status === "ok") {
-                                                        const { changed } = clearStoredAccountVerificationRequired(account, true);
-                                                        if (changed) {
-                                                            await saveAccounts(existingStorage);
-                                                        }
-                                                        activeAccountManager?.clearAccountVerificationRequired(verifyAccountIndex, true);
-                                                        console.log(`✓ ${label} Gemini CLI access provisioned and verified. Account re-enabled.\n`);
-                                                    }
-                                                    else {
-                                                        console.log(`✓ Gemini CLI login completed for ${result.email || label}.`);
-                                                        console.log(`⚠ Verification probe still failing: ${postVerification.message}`);
-                                                        console.log("The API may take a few minutes to propagate. Try verifying again shortly.\n");
-                                                    }
-                                                }
-                                                else {
-                                                    console.log(`✗ Gemini CLI login failed: ${result.error}\n`);
-                                                }
-                                            }
-                                            catch (error) {
-                                                console.log(`✗ Gemini CLI login error: ${error instanceof Error ? error.message : String(error)}\n`);
-                                            }
-                                            finally {
-                                                oauthListener?.close();
-                                            }
-                                            await promptOAuthCallbackValue("\nPress Enter to return to menu...");
-                                            continue;
-                                        }
                                         console.log(`\nChecking verification status for ${label}...\n`);
                                         const verification = await verifyAccountAccess(account, client, providerId);
                                         if (verification.status === "ok") {
@@ -2466,15 +2348,14 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                             else {
                                                 console.log(`✓ ${label} is ready for requests.\n`);
                                             }
-                                            await promptOAuthCallbackValue("\nPress Enter to return to menu...");
                                             continue;
                                         }
                                         if (verification.status === "blocked") {
-                                            const changed = markStoredAccountVerificationRequired(account, verification.message, verification.verifyUrl, verification.verificationType);
+                                            const changed = markStoredAccountVerificationRequired(account, verification.message, verification.verifyUrl);
                                             if (changed) {
                                                 await saveAccounts(existingStorage);
                                             }
-                                            activeAccountManager?.markAccountVerificationRequired(verifyAccountIndex, verification.message, verification.verifyUrl, verification.verificationType);
+                                            activeAccountManager?.markAccountVerificationRequired(verifyAccountIndex, verification.message, verification.verifyUrl);
                                             const verifyUrl = verification.verifyUrl ?? account.verificationUrl;
                                             console.log(`⚠ ${label} needs Google verification before it can be used.`);
                                             if (verification.message) {
@@ -2496,11 +2377,9 @@ export const createAntigravityPlugin = (providerId) => async ({ client, director
                                             else {
                                                 console.log("No verification URL was returned. Try re-authenticating this account.\n");
                                             }
-                                            await promptOAuthCallbackValue("\nPress Enter to return to menu...");
                                             continue;
                                         }
                                         console.log(`✗ ${label}: ${verification.message}\n`);
-                                        await promptOAuthCallbackValue("\nPress Enter to return to menu...");
                                         continue;
                                     }
                                     break;