Repository navigation
antigravity: client-secret extraction (first GOCSPX match) stale for agy 1.4.11 — refresh fails invalid_client #1633
Description
antigravity: OAuth client-secret extraction (first GOCSPX match) is stale for agy 1.4.11 — refresh fails invalid_client
Found 2026-11-04 during the #1414 native repoint verification (deploy-gated sequence on #1146).
Symptom
With the native provider live (config repoint merged in code), the first call failed:
route_attempt 227773 | antigravity-direct | gemini-3.8-flash | failure
provider.auth: Antigravity keyring credential unavailable: token endpoint HTTP 401:
invalid_client — "The provided client secret is invalid."
The door (bin/antigravity-direct.mjs in developing-today/code, same extraction design) fails identically on :18751, so this is a shared extraction defect, not a provider wiring defect.
Root cause (verified live against Google's token endpoint)
binaryIntel() in packages/ai/src/providers/antigravity-auth.ts takes the FIRST match of /GOCSPX-[A-Za-z0-9_-]{10,}/ and slices 35 chars, per the layout of the agy binary it was verified against. That layout changed:
- agy 1.4.8 (nix build): 2 GOCSPX runs, lengths [70, 40]. run0[:35] is the 70-char concatenated pair's first half — token endpoint answers invalid_grant for a bogus grant (= client secret ACCEPTED).
- agy 1.4.11 (~/.gemini/bin/agy, self-updated 2026-10-30): 3 runs, lengths [40, 43, 40]. run0[:35] -> invalid_client (rejected). run1[:35] -> invalid_grant (accepted). run2[:35] -> invalid_client.
So in the 1.4.11 binary the pairing secret is the SECOND run's first 35 chars; the first-match heuristic picks a decoy/other-client secret. Probe method note: with an intentionally bogus refresh_token, Google answers invalid_client when the secret is wrong and invalid_grant when the secret is right — a safe oracle that never touches the real grant.
Impact
Any consumer refreshing through this extraction is down whenever the stored access token expires: the native provider AND the remaining door. Lane traffic survived until the stored token aged out (last success 2026-11-04 09:00 UTC); the 05:47 CST reboot stopped the CLI from refreshing it, and every refresh since has hit invalid_client.
Interim workaround (applied live, 2026-11-04)
AGY_BIN=/run/current-system/sw/bin/agy on the opencode.service unit (drop-in), so extraction reads the 1.4.8 binary whose layout the heuristic matches. Verified: route_attempt 227942, antigravity-direct/gemini-3.8-flash, success through the native provider; the same AGY_BIN drop-in restored the door (chat completion via :18751 OK).
Fix direction
Do not trust position: collect ALL candidate secrets (each run's [:35], plus [35:70] for >=70-char runs, deduped), and on a token-endpoint invalid_client response try the next candidate (cache the winner in memory). Add a test with both binary layouts (1.4.8-style 70-char pair first; 1.4.11-style decoy first, pairing secret second). The door carries the same logic in code's bin/antigravity-direct.mjs but retires under #1414; the fork fix is the durable one.
Activity
dezren39 commentedon Nov 4, 2026
Triage evidence — issue-sweep-rotating feeder, 2026-11-04
Verdict: CONFIRMED on current main
63c50eec0d27139b6ebdc57ed85d4d3ace35b5b3(verified twice with freshgh apireads this run).What I checked (reads only; the live token-endpoint oracle evidence is already in the issue body):
packages/ai/src/providers/antigravity-auth.ts:136-156—binaryIntel()still takes the FIRST GOCSPX match: line 153text.match(/GOCSPX-[A-Za-z0-9_-]{10,}/), line 156clientSecret = match[0].slice(0, 35). The header comment (lines 17-18) and line 155 still assert the first-35 pairing — exactly the stale heuristic this issue documents for agy 1.4.11, where the pairing secret is the SECOND run's first 35 chars and the first run is a decoy.packages/ai/test/provider/antigravity-auth.test.ts— the existing fixture binary carries a SINGLE 40-char GOCSPX run, so the multi-run layout regression has no test coverage today.queue/*/work/*state; a queue-list check found no live task for antigravity: client-secret extraction (first GOCSPX match) stale for agy 1.4.11 — refresh fails invalid_client #1633. Not a duplicate of the other antigravity issues (fix(ai): antigravity convertSchema collapses a multi-valued type union to its first member — type: ["string","integer"] is sent upstream as STRING only #1556/fix(ai): antigravity convertSchema drops const — a fixed-value parameter is sent upstream unconstrained #1557/fix(ai): antigravity convertSchema inverts booleanfalsesubschemas — a never-valid schema is sent upstream as unconstrained #1573 are convertSchema defects, different code path).Done looks like (the issue's fix direction):
[:35], plus[35:70]for >=70-char runs, deduped) instead of trusting position.invalid_clientresponse, refresh tries the next candidate and caches the winner in memory.AGY_BIN=1.4.8 workaround described in the issue can be retired once the fix verifies against a 1.4.11 binary.Cross-repo note: the door copy in developing-today/code (
bin/antigravity-direct.mjs) carries the same extraction design but retires under #1414 per this issue, so no separate port is filed — the fork fix here is the durable one.Priority: high — refresh is broken for the current agy binary; only the interim
AGY_BINpin keeps the native provider and the door alive.dezren39 commentedon Nov 4, 2026
agent-note:v1
state: queued
Agent: issue-sweep-rotating (triage feeder)
Session/ID: issue-sweep-rotating run 2026-11-04 09:24 CST
Found via: rotating feeder pick (developing-today/opencode this run)
Task: enqueued triage packet as queue task 9664 in repo-health-opencode-pilot (dedupe repo-health:v1:triage:developing-today/opencode:issue:1633)
Evidence: feeder triage CONFIRMED on main 63c50ee — antigravity-auth.ts:153 first-match GOCSPX regex, :156 slice(0,35); see evidence comment #1633 (comment)
Expectation: triage confirms the candidate-collection fix design (all runs, try-next on invalid_client, cache winner) and routes a fix packet; both binary layouts covered by tests.
dezren39 commentedon Nov 4, 2026
Triage verdict — task 9664 (lane opencode-a): CONFIRMED, fix design confirmed, fix routed
Re-verified fresh on main
63c50eec0d27139b6ebdc57ed85d4d3ace35b5b3this shift (code reads only; no secret values inspected or recorded):packages/ai/src/providers/antigravity-auth.tsbinaryIntel()still takes the FIRST/GOCSPX-[A-Za-z0-9_-]{10,}/match and slices[0, 35]; the header comment (lines 17–18) and the inline comment at the match still assert the stale 1.4.8 pairing ("the first 35 chars pair with OAUTH_CLIENT_ID").invalid_clientretry/next-candidate handling (no occurrence in the module), andbinaryIntelCachecaches the single extracted secret — so the decoy is sticky for the process lifetime.invalid_granton a bogus grant); run0/run2 are rejected (invalid_client).Fix design (as directed on the issue, confirmed feasible against the code): collect ALL candidates — each run's
[:35], plus[35:70]for runs ≥70 chars, deduped — return the candidate list frombinaryIntel()instead of a single secret; the refresh exchange tries candidates in order, advancing only on aninvalid_clientresponse (other failures — network,invalid_grantfrom a bad stored grant with an accepted secret, 5xx — must NOT advance or mask the real error), and caches the winning candidate in memory only. Never log or persist candidate values. Update the stale comments. Tests inpackages/ai/test/provider/antigravity-auth.test.tswith synthetic fixture binaries for both layouts (1.4.8-style 70-char concatenated pair first; 1.4.11-style decoy first, pairing secret second), using fake GOCSPX strings — no real secret material in fixtures.Fix routed as a queue task (see the agent note that follows). The interim AGY_BIN pin to the 1.4.8 binary stays necessary until the fix lands. Out of scope per the packet: the door copy in developing-today/code (retires under #1414).
dezren39 commentedon Nov 4, 2026
agent-note:v1
state: triage-complete
Agent: repo-queue-worker-shift-opencode (lane opencode-a)
Task: triage task 9664 completed — verdict CONFIRMED (see comment above); fix enqueued as queue task 9666 in repo-health-opencode-pilot (dedupe repo-health:v1:fix:developing-today/opencode:issue:1633).
dezren39 commentedon Nov 4, 2026
PR #1642 opened — fix task 9666 (lane opencode-a), parked on CI/Codex:
binaryIntel()collects all GOCSPX candidates andrefresh()advances only oninvalid_client, winner cached in memory only. Tests: both binary layouts + non-advance case, 6/6 in file; antigravity suite 18/18; tsgo clean. Resume: disposition Codex, verify CI, merge, complete task 9666, clean labels here; the interim AGY_BIN pin can then be dropped.Merge pull request #1642 from developing-today-forks/queue/9666-1633-…
dezren39 commentedon Nov 4, 2026
PR #1642 merged (merge commit 94c4461). Task 9666 completed. Re-verified at merge time: antigravity-auth tests 6/6 and the full packages/ai provider suite green (0 fail, 1349 tests) at the PR tree; mergeable clean. No Codex review arrived despite the request (repo-wide pattern; zero findings to disposition), so the merge proceeded under the standing merge directive.
agent-note:v1 — repo-queue-worker-shift-opencode lane A, task 9666 done