fix(server): deliver Antigravity sign-in URLs without stderr

[mtdewwolf]

Antigravity sign-in can remain stuck when Python's Windows browser subprocess loses the helper's stderr, leaving T3 without the Google authorization URL (#9624; transport investigation in #9690).

Send the existing browser helper's URL to a tokenized 127.0.0.1 listener scoped to explicit sign-in. The listener validates the URL and passes it to the existing auth controller, preserving client ownership and remote callback handling. Rejected or failed listener delivery falls back to the existing stderr marker. The helper still exits successfully if cancellation closes both the listener and stderr, preventing a fallback browser launch on the server. Ambient listener variables are removed before configuring each process.

Validation on Windows:

• 52 focused auth/support tests passed, including actual helper execution with all stdio discarded, listener cleanup, invalid/oversized requests, and environment isolation. Eight existing shell-based driver tests are skipped on Windows.
• Server typecheck, targeted lint, and formatting passed.
• Python 3.10 webbrowser successfully delivered a synthetic URL through the new listener. The standalone probe preserved stderr before the change, so it did not independently reproduce the reported failure; the regression test explicitly discards stdio. No full Google OAuth or client UI session was performed.

Fixes #9624.

Model: GPT-6. Harness: Codex.

Note

Deliver Antigravity sign-in URLs via loopback HTTP listener instead of stderr

• Adds serveAntigravityAuthorizationUrlSink, a scoped loopback HTTP listener with a random 32-byte token in the path that accepts one POST, forwards the parsed authorization URL to the supplied callback, and returns 204 on success.
• The generated browser-helper now posts the authorization URL to the configured sink with a 5-second timeout, falling back to the stderr marker path when no sink is set.
• buildAntigravityAcpSpawnInput writes the sink URL to the canonical environment variable only when supplied, and removedEnvironmentKeys strips inherited sink values so stale values are not carried forward.
• AntigravityDriver.create starts the listener when an authorization callback is provided and passes the resulting URL into the ACP spawn configuration.
• Risk: stale ANTIGRAVITY_AUTHORIZATION_SINK aliases in the environment are silently dropped; only the canonical variable name is emitted, so any external tooling relying on the old alias will stop receiving the sink URL.

?? Macroscope summarized 7ad9a7b. 2 files reviewed, 1 issue evaluated, 1 issue filtered, 0 comments posted

??? Filtered Issues

apps/server/src/provider/antigravityAuthSupport.ts � 0 comments posted, 1 evaluated, 1 filtered

• line 70: When no T3_ANTIGRAVITY_AUTH_SINK is present, as in prepareAntigravityProfile's browser-suppression preflight, process.env.T3_ANTIGRAVITY_AUTH_SINK && fetch(...) evaluates to undefined and the generated helper immediately evaluates undefined.then(...). The helper therefore exits with a TypeError instead of writing its stderr marker, so the preflight rejects and every Antigravity profile setup fails before the ACP can start. [ Out of scope (triage) ]

Summary by CodeRabbit

• New Features

  • Authorization URLs can now be delivered directly during Antigravity authentication flows.
  • Authentication continues to support fallback URL delivery when direct delivery is unavailable.
  • Authorization requests are validated and limited to the active authentication flow.

• Bug Fixes

  • Improved authentication handling when standard input/output channels are unavailable.
  • Added request-size limits and clearer handling of invalid authorization requests.
  • Prevented stale authentication connection settings from interfering with new login attempts.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This authentication fix introduces a new loopback HTTP delivery path and changes how the browser helper communicates with the server during sign-in. It also adds a production static-analysis suppression directive, so the change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 545b9d17-3e43-4583-ae63-afa50090d2be

📥 Commits

Reviewing files that changed from the base of the PR and between 7ad9a7b and 991fd6d.

📒 Files selected for processing (2)

• apps/server/src/provider/antigravityAuthSupport.test.ts
• apps/server/src/provider/antigravityAuthSupport.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The Antigravity authentication flow now uses a loopback HTTP sink to deliver authorization URLs. The browser helper posts the URL to the sink, and the server forwards valid requests to the runtime callback. Tests cover validation, cleanup, shutdown, and end-to-end delivery.

Changes

Antigravity authentication handoff

Layer / File(s)	Summary
Loopback authorization sink apps/server/src/provider/antigravityAuthSupport.ts	Adds a loopback HTTP listener with tokenized paths, POST validation, URL parsing, body-size limits, scoped shutdown, and error handling.
Helper and runtime wiring apps/server/src/provider/antigravityAuthSupport.ts, apps/server/src/provider/Drivers/AntigravityDriver.ts	The browser helper posts authorization URLs to the sink. The driver creates the sink when onAuthorizationUrl is available and passes its URL into the spawned environment.
Integration coverage apps/server/src/provider/antigravityAuthSupport.test.ts	Tests environment cleanup, request rejection, URL delivery, error handling, listener shutdown, and successful helper completion.

Priority: ➖ Normal — Impact reflects medium issue severity.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 272f8

Antigravity sign-in URLs are delivered through a scoped local listener with the existing stderr marker retained as a fallback. The covered failure and shutdown paths leave no concrete current-head merge-blocking risk.

Sequence Diagram(s)

sequenceDiagram
  participant BrowserHelper
  participant AuthorizationSink
  participant AntigravityAuthCallback
  BrowserHelper->>AuthorizationSink: POST authorization URL
  AuthorizationSink->>AntigravityAuthCallback: forward validated URL
  AntigravityAuthCallback-->>AuthorizationSink: complete or fail

Loading

Suggested reviewers: t3dotgg, wellyngtonf

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address issue #9624 by adding a scoped loopback listener for Antigravity authorization URLs, preserving stderr fallback behavior, and forwarding the URL to the existing authentication cont…
Out of Scope Changes check	✅ Passed	The changes are limited to Antigravity authorization URL transport, environment isolation, listener validation, fallback behavior, and focused tests. No unrelated code changes are identified.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files.
Title check	✅ Passed	The title clearly and concisely describes the main change: delivering Antigravity sign-in URLs without relying on stderr.
Description check	✅ Passed	The description clearly explains what changed, why it changed, the fallback behavior, validation performed, and known verification limits. It does not use the template headings or checklist, but the r…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[mtdewwolf]

Addressed the review findings in 991fd6d:

• CodeRabbit's delivery-failure concern was valid: a rejected fetch or non-success HTTP response previously exited without preserving the URL. The helper now falls back to the existing stderr marker in both cases, while retaining exit code 0 if stderr is closed after cancellation. Added actual subprocess coverage for absent, rejecting, and closed listeners.
• The undefined.then warning in CodeRabbit's linked-issue check and Macroscope's filtered summary is a false positive. In the original expression, .then(...) is part of the right-hand operand of &&: (sink && fetch(...).then(...)) || report(). With no sink, neither fetch nor .then runs. The existing preflight already exercised this, and the new test explicitly verifies no-sink marker delivery and exit code 0.
• Macroscope's correctness check passed. Its approvability result requests human review of the auth transport and the Node HTTP diagnostic suppression; that is not a correctness finding. The suppression remains scoped to the Node HTTP factory used by the Effect-managed listener. This change does not claim or bypass human approval.

Validation: 52 focused auth/support tests passed. After replacing the new test's JSON encoder with the repository's Schema helper, all 33 support tests passed again. Server typecheck, targeted lint, formatting, and diff checks passed. Full Google OAuth/client verification remains unperformed as documented in the PR.