feat(antigravity): scope agy print reports to the selected account

[Sogl]

Summary

Fixes #3662 — scoped implementation per the requirements in #3780 (comment) (private staging, isolated child environment, fail-closed credential handling, no raw-output logging, platform-specific proof).

When a Google account is selected or injected in Auto mode, the ambient agy -p /usage report is suppressed because it carries no account identity — and with it the model-scoped quota detail that only the print command exposes. This PR runs the same print command scoped to the account instead:

• Private staging: the account's OAuth tokens are encoded as agy's file-token payload and written to a fresh codexbar-agy-scoped-<uuid> HOME under the per-user temporary directory (0700 dirs, 0600 token), deleted via defer after the run. No persistent credential copies, locks, or shared state.
• Isolated child environment: agy receives an allowlist env (login PATH, TMPDIR, locale, proxy vars) — no ANTIGRAVITY_OAUTH_CREDENTIALS_JSON, no ambient provider credentials. A non-empty SSH_TTY makes agy select file-token storage, so the scoped run never consults the OS keyring.
• Fail-closed: the staged token is re-read from disk and its id_token claim must match the selected account before launch; missing/malformed credentials or unverifiable identity throw before any spawn. Any scoped failure preserves the original ambient error so the primary diagnostic is never masked, and an ambient identity-free report is never substituted for a selected account — the pipeline falls through to the existing account-scoped OAuth strategy exactly as before.
• No raw output: subprocess failures classify through the existing AntigravityCLIPrintFailure taxonomy.
• macOS-only gate: the scoped execution lives behind #if os(macOS); on Linux the closure is nil and behavior is byte-for-byte unchanged. Ambient paths (unselected Auto, explicit --source cli) are untouched; cancellation still propagates before any scoped attempt.

Diff: +702/−3, of which ~250 lines are the new scoped-fetch file and ~370 its tests.

Test plan

• swift test --filter AntigravityScopedPrintFetchTests — 14 tests (payload format, env allowlist, staged identity verification, fail-closed wiring, real spawned stub-agy e2e asserting staged HOME/env isolation and cleanup)
• swift test --filter Antigravity — 540 tests, 0 failures
• make check — clean except one pre-existing line-length violation in TypeSafeWebFetchStrategy.swift:175 (upstream, not this diff)
• Full swift test — 12,439 tests; 9 issues: 1 was this diff (missing Provider-specific by design annotation — fixed and verified), 8 are unrelated environment-dependent failures on this machine (Pi ~/.omp root discovery, SwiftUI layout metrics, a render-timing budget)
• git diff --check — clean

Platform proof: .github/pr-proof/antigravity-scoped-fetch/live-evidence.log — live macOS evidence on agy 1.2.9, including the production path: CodexBarCLI usage --provider antigravity --account A shows the scoped antigravity-cli-scoped-usage subprocess returning A's quota labeled A while ambient agy is logged in as B; auto mode with the app-selected account takes the same path; a revoked-credential account preserves the original ambient-path error, fails closed to scoped OAuth, and never displays B's quota. Manually staged runs additionally show agy authenticating as A in its own log, zero ambient ~/.gemini writes (614-file snapshot diff), UNAUTHENTICATED rejection of revoked staged credentials, and in-place refresh of an expired staged grant.

Grant provenance + expiry path: the saved test grants carry the OAuth client ID that CodexBar's Add Account flow discovers from the installed Antigravity.app — they are CodexBar-minted under Antigravity's own client. A production run with the saved grant's expiry_date forced to the past shows the scoped attempt failing closed at the 90s bound while the account-scoped OAuth strategy recovers with A's data labeled A (ambient B never appears).

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 23, 2026, 11:31 AM ET / 15:31 UTC (Revision 6).

ClawSweeper review

What this changes

Adds a macOS fallback that retrieves Antigravity quotas using the selected account’s credentials in an isolated temporary home, with tests, documentation, and runtime evidence.

Merge readiness

✅ Ready for maintainer review

This remains useful: main and v0.65.0 still lack selected-account CLI reports. The updated runtime evidence resolves the previous proof request, and no blocking introduced defect was found.

Priority: P2
Reviewed head: e0172ea2efe543f5db5600207452593938ab458d

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused implementation with relevant production evidence, defensive fallback behavior, and no blocking review findings.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (logs): Committed macOS agy 1.2.9 traces exercise the production scoped fetch with selected A versus ambient B, invalid-credential rejection, Add Account grant provenance, and expired-grant OAuth recovery. These resolve the prior proof request. The staging format is temporary; no existing persisted data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (logs): Committed macOS agy 1.2.9 traces exercise the production scoped fetch with selected A versus ambient B, invalid-credential rejection, Add Account grant provenance, and expired-grant OAuth recovery. These resolve the prior proof request. The staging format is temporary; no existing persisted data contract changes.
Evidence reviewed	9 items	Introduced scope and merge result: The pinned merge-base-to-head delta contains six files. The verified test merge has the pinned main and PR head as its two parents and retains the same six-file change; unrelated base-branch additions are not PR deletions. Owner-defined implementation boundary: The OWNER comment at #3780 (comment) requests a separate implementation with private staging, an isolated environment, fail-closed credentials, safe diagnostics, and platform-specific proof. The predecessor was closed unmerged and does not supersede this work. Credential and execution boundary: The new helper encodes existing account credentials into agy’s file-token format, uses private directories and a restricted environment, checks the staged identity claim, runs the existing bounded subprocess owner, and removes staging afterward. This explicitly depends on agy’s file-storage and SSH_TTY behavior; supplied macOS agy 1.2.9 traces exercise that contract. Existing saved credential schemas and login-client selection are unchanged.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar combines Antigravity’s local app, CLI, and OAuth sources to display account usage. This change lets the CLI report serve a selected Google account while preserving account-scoped OAuth fallback.

flowchart TD
 A[Selected Google account] --> B[Existing local probes]
 B -->|Cannot provide matching usage| C[Private credential staging]
 C --> D[Isolated agy usage command]
 D -->|Success| E[Selected account quota display]
 C -->|Failure| F[Account scoped OAuth fallback]
 D -->|Failure| F
 F --> E

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +277/-3 (net +274); tests +373/-0	Production growth implements the requested private staging boundary, with focused coverage exceeding the production delta.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3662
Summary: This PR is an implementation candidate for the open selected-account quota gap; the two earlier proposals were closed without merging.

Members:

• canonical: Antigravity "Limits not available" bug. #3662 - The PR explicitly targets this report, whose owner discussion confirms the remaining account-scoped fallback gap.
• partial_overlap: feat(antigravity): fetch usage per saved account via scoped agy #3780 - Closed-unmerged predecessor pursued scoped CLI credentials with a broader persistence and login design.
• partial_overlap: fix(antigravity): fall back to agy usage report when OAuth quota endpoints return 403 #3708 - Closed-unmerged alternative reused ambient CLI credentials after a local identity check.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Provide selected-account quotas through private per-run CLI staging while retaining OAuth recovery and the existing explicit-source behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a new account-scoped retrieval capability; current source confirms the intentional fallback restriction, and supplied macOS traces demonstrate the added path.

Is this the best way to solve the issue?

Yes. The implementation follows the owner’s narrower staging requirements, reuses existing parsing and process handling, and avoids the predecessor’s persistent credential homes and login-client changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against efaee7a37213.

Labels

Label changes:

No label changes.

Label justifications:

• P2: Restores useful selected-account quota detail for one provider while existing explicit CLI and OAuth paths remain available.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): Committed macOS agy 1.2.9 traces exercise the production scoped fetch with selected A versus ambient B, invalid-credential rejection, Add Account grant provenance, and expired-grant OAuth recovery. These resolve the prior proof request. The staging format is temporary; no existing persisted data contract changes.
• proof: sufficient: Contributor real behavior proof is sufficient. Committed macOS agy 1.2.9 traces exercise the production scoped fetch with selected A versus ambient B, invalid-credential rejection, Add Account grant provenance, and expired-grant OAuth recovery. These resolve the prior proof request. The staging format is temporary; no existing persisted data contract changes.

Evidence

What I checked:

• Introduced scope and merge result: The pinned merge-base-to-head delta contains six files. The verified test merge has the pinned main and PR head as its two parents and retains the same six-file change; unrelated base-branch additions are not PR deletions. (e0172ea2efe5)
• Owner-defined implementation boundary: The OWNER comment at feat(antigravity): fetch usage per saved account via scoped agy #3780 (comment) requests a separate implementation with private staging, an isolated environment, fail-closed credentials, safe diagnostics, and platform-specific proof. The predecessor was closed unmerged and does not supersede this work.
• Credential and execution boundary: The new helper encodes existing account credentials into agy’s file-token format, uses private directories and a restricted environment, checks the staged identity claim, runs the existing bounded subprocess owner, and removes staging afterward. This explicitly depends on agy’s file-storage and SSH_TTY behavior; supplied macOS agy 1.2.9 traces exercise that contract. Existing saved credential schemas and login-client selection are unchanged. (Sources/CodexBarCore/Providers/Antigravity/AntigravityScopedPrintFetch.swift:141, e0172ea2efe5)
• Fallback preserves account isolation: The scoped closure is installed only on macOS and used where selected or injected Auto credentials already prohibit ambient reports. Scoped failure preserves the original diagnostic and existing OAuth fallback; cancellation propagates. Explicit CLI and unselected Auto retain their existing paths. (Sources/CodexBarCore/Providers/Antigravity/AntigravityProviderDescriptor.swift:526, e0172ea2efe5)
• Production runtime proof and prior request resolved: The complete committed log records macOS production CLI runs returning account A’s distinct quota windows while ambient agy uses B, invalid scoped credentials reaching no ambient quota result, and manual boundary checks leaving 614 ambient files untouched. Sections 5–6 identify the grants as originating from CodexBar Add Account and show forced expiry recovering through production OAuth with A’s identity. Scoped refresh stalled once at the 90-second limit and failed once after about 17 seconds; the evidence establishes safe recovery, not reliable agy refresh. (.github/pr-proof/antigravity-scoped-fetch/live-evidence.log:63, e0172ea2efe5)
• Grant provenance matches existing login code: The existing Add Account runner resolves the OAuth client, exchanges the authorization code, and saves the access token, refresh token, ID token, expiry, and client fields. This supports the newly documented grant provenance without introducing a different login or credential migration. (Sources/CodexBar/Providers/Antigravity/AntigravityLoginRunner.swift:80, e0172ea2efe5)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• sobczi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-09-23T13:51:19.528Z sha 6b9bce3 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T13:59:37.149Z sha 6b706a6 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T14:09:07.524Z sha 527f7df :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T14:47:27.585Z sha a5a3284 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T15:06:35.742Z sha ea3fc66 :: needs real behavior proof before merge. :: none

[steipete]

Thanks @Sogl for the scoped-fetch implementation and the agy 1.2.9 evidence. The ambient identity-free-report guard is preserved, including fallback after a scoped failure. I’m not adopting this version: its report identity comes from the staged credentials, while the proposed conflicting-response check cannot fire because the current print parser always returns no account email. The credential-isolation behavior needs a stronger supported-version contract, and this patch adds 274 production lines beyond the bounded change allowed here. The expired-grant evidence also shows a 90-second delay before OAuth recovery. Closing this implementation while retaining the existing account-ownership guards and OAuth fallback.

[Sogl]

@steipete Thanks for the close review. One thing from live testing that changes the picture: the 403 is per-account licensing — unlicensed accounts fail on both cloudcode-pa hosts (even with an agy-minted token), while agy still serves their quota through its privileged language-server path. So the identity-free print report really is the only source for those accounts.

Before another attempt — what's the identity contract you'd accept? Would verifying the ambient credential's signed id_token against the selected account be enough to attribute the ambient report, or does the identity need to come from agy's own output? If the latter, this looks upstream-blocked until agy reports identity in /usage — I can file that request with them.