Repository navigation
fix(ai): antigravity secret extraction tries all GOCSPX candidates (#1633) - #1642
Merged
Merged
Conversation
…1633) binaryIntel() no longer trusts position: it collects every GOCSPX run in the agy binary (each run's first 35 chars, plus chars 35-70 for 70+ char runs, deduped) and refresh() tries candidates in order, advancing only when the token endpoint rejects a candidate with invalid_client (401 + error=invalid_client); all other failures surface unchanged. The accepted candidate is cached in memory only and tried first next time; nothing is logged or persisted. Tests cover both binary layouts with synthetic fixtures. 6/6 file tests, antigravity.test 18/18, tsgo clean. Note: branch created via the Git Data API because the laptop git credential helper hangs on push (recurring infra issue); contents byte-identical to local commit bc8863dc76.
Author
|
@codex review |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1633 (fix task 9666, routed from triage task 9664; lane opencode-a).
What
binaryIntel()inpackages/ai/src/providers/antigravity-auth.tsno longer trusts run position:[:35], plus[35:70]for runs ≥70 chars (the 1.4.8 concatenated-pair layout), deduped in scan order. The extraction cache is keyed by binary path.refresh()tries candidates in order — the previously accepted candidate first — and advances to the next candidate only when the token endpoint answers 401 witherror: "invalid_client". Every other failure (invalid_grant from a bad stored grant, 5xx, transport, timeouts, oversize bodies) surfaces unchanged, exactly as before. The winner is cached in memory only.Tests (synthetic fixtures only — no real credential material)
packages/ai/test/provider/antigravity-auth.test.ts, new#1633describe:invalid_grantfailure does not cycle candidates and surfaces verbatim (exactly one request).Results: file suite 6/6 pass,
antigravity.test.ts18/18 pass,tsgo --noEmitclean for packages/ai.The interim AGY_BIN pin to the 1.4.8 binary can be dropped once this lands. The door copy in developing-today/code is out of scope (retires under #1414).