fix(antigravity): heal empty-projectId accounts via retryable auto-onboarding (#10424)

* fix(antigravity): heal empty-projectId accounts via retryable auto-onboarding Accounts with an empty Cloud Code projectId get a permanent 422 "Missing Google projectId" when loadCodeAssist returns no project. The 3.8.50 bootstrap attempts to CREATE the project via onboardUser, but a single failed attempt (transient network/upstream error) was memoized forever in onboardAttemptedCache: every later request in the process skipped onboarding and 422'd, even though a retry would succeed. Replace the permanent per-token Set with a failure-backoff map: failed onboard attempts are retried after a 5-minute backoff (bounded, self-healing), the in-flight lock still dedupes concurrent calls, and success clears the failure marker and memoizes the project as before. Accounts that CAN be onboarded now heal automatically on a later request or token refresh — no user action. Tests: the existing "does not retry" case is now framed as the backoff window; a new case proves the account heals (retries onboarding and recovers the project) once the backoff expires. * chore(changelog): fragment for #10424 antigravity project autocreate * feat(antigravity): BYOP fast-fail + manual GCP project-id override Port decolua/9router#2934 + VansRouter 802a859: - tryOnboardUser now returns a three-way status; a 200 onboardUser response WITHOUT cloudaicompanionProject means Google deprecated automatic project creation for standard-tier (personal) accounts (BYOP). Such accounts are cached permanently (no pointless ~18s re-onboard) and the executor fails fast with 403 GCP_PROJECT_REQUIRED + actionable 'enter your project id' message instead of the generic 422 or a delayed 429. - Transient onboard failures keep the existing 5-min backoff heal. - Manual project-id override: the EditConnectionModal now stamps providerSpecificData.isProjectIdManual when the operator enters a project id, and tokenRefresh skips auto-discovery for flagged accounts so the manual value is never overwritten. * chore(changelog): cover BYOP fast-fail + manual override in #10424 fragment * test(antigravity): expect fast 403 GCP_PROJECT_REQUIRED when loadCodeAssist finds no project (#10424) Google now marks accounts without an onboarded project as BYOP (automatic project creation deprecated for standard-tier accounts, #2934). The PR's BYOP fast-fail path returns 403 gcp_project_required instead of the old generic 422 missing_project_id; align the #2334 executor test with that contract so CI unit-test shard 2/4 passes. * fix(antigravity): persist isProjectIdManual, fix BYOP citation, dodge refresh-retry Review follow-up on #10424: 1. EditConnectionModal: isProjectIdManual was set on updates.providerSpecificData right after the project-id field, then the OAuth path (Antigravity is always OAuth) rebuilt providerSpecificData from connection.providerSpecificData before the request went out, discarding the flag — tokenRefresh.ts was guarding a field never actually persisted. The flag now lands in the single surviving antigravity merge, with a jsdom regression test (modeled on edit-connection-modal-openai-store-toggle). 2. The '#2934' citation for the Google BYOP claim pointed at an unrelated closed issue. Swapped for the real tracking issue #8491 (empty Google projectId -> 422 class) across bootstrap/executor/test comments. 3. BYOP fast-fail now returns 422 instead of 403: chatCore's generic 401/403 -> refresh-and-retry path was hitting Google's OAuth token endpoint on every request from an affected account (pointless — refreshing cannot create a GCP project), and 422 matches the sibling missing_project_id error the client already maps to an action-needed prompt. Also: eslint-disable-next-line for the pre-existing react-hooks/set-state-in-effect baseline noise in the modal (repo convention, same pattern as 11 other dashboard files). * chore(ci): drop unused eslint-disable in EditConnectionModal form hydration The react-hooks/set-state-in-effect disable added in the previous commit is unused under the repo's pinned eslint-plugin-react-hooks (7.0.1) — the rule does not fire on this line at that version, so the unused directive tripped the whole-repo 'No new ESLint warnings' gate (max-warnings 0). Verified with the lockfile-pinned plugin: lint:json is clean (0 errors, 0 warnings). * fix(build): bound and retry the opencode-plugin npm install in prepublish The plugin's node_modules is gitignored, so every fresh CI checkout runs a full npm install inside @omniroute/opencode-plugin during build:cli. npm's unbounded fetch retries turn a stalled registry CDN connection (the recurring onnxruntime-class ETIMEDOUT flake) into a 20-30 minute hang — the DAST 'Build CLI bundle' step has been cancelled at the 30m cap repeatedly. - Bound npm fetch: --fetch-timeout 60s, 2 retries with capped backoff — a stalled connection now fails fast instead of hanging the job. - Retry the install up to 3 times with a 10s pause between attempts, so transient CDN failures recover in-build. Net effect: the step either completes (network OK) or fails quickly with a clear error (network down) — it can no longer eat the whole job budget. * ci(quality): use the npm-ci-retry action on every install step Fast Quality Gates failed on the recurring onnxruntime-node postinstall ETIMEDOUT (Microsoft CDN 150.171.x.x) - the same transient flake that has hit Vitest and dast-smoke today. Only the Build job used the retry action; the other five jobs (Docs, Fast Quality Gates, Vitest, Unit Tests, changelog) still ran a bare install and die on any CDN hiccup. Use the existing retry action (3 attempts, exponential backoff) on every install step for consistency. * Merge branch 'release/v3.8.50' into fix/antigravity-project-autocreate * test(fix): refresh expired alibaba quota sample validity and onnxruntime pin for v3.8.50 base - alibaba-free-tier-quota-fetcher.test.ts: sample quotaValidityPeriod (2026-08-16 16:00 UTC) is in the past, making every quota entry classify as expired/not_capable; bump to 2028-01-01 UTC so the text/merge classification tests exercise the intended path again. - optional-transformers-dependency.test.ts: onnxruntime-node pin assertion updated from ~1.24.3 to ~1.27.0 to match package.json (bumped by #10403); the regular-not-optional intent is unchanged. * test(fix): widen modelsDevSync lastSync wait from 200ms default to 2000ms The truthy-spellings loop asserted each enabled case completes its first fetch within waitFor's 200ms default timeout, which trips under CI runner load (observed on PR 10424 shard 2/4). Match the file's other lastSync waits (2000ms) so the sync-completion assertion is load-tolerant. --------- Co-authored-by: Rouzbeh <rqzbeh@users.noreply.github.com>
2026-08-17 20:52:15 +03:00 · 2026-08-17 14:53:41 +03:30
parent 24ef1dc3d4
commit 6ff2e7b2c2
12 changed files with 489 additions and 48 deletions
--- a/open-sse/executors/antigravity.ts
+++ b/open-sse/executors/antigravity.ts
@@ -28,7 +28,10 @@ import {
  resolveAntigravityOutputCap,
 } from "./antigravityOutputCap.ts";
 export { MAX_ANTIGRAVITY_OUTPUT_TOKENS } from "./antigravityOutputCap.ts";
-import { ensureAntigravityProjectAssigned } from "../services/antigravityProjectBootstrap.ts";
+import {
+  ensureAntigravityProjectAssigned,
+  ANTIGRAVITY_REQUIRES_MANUAL_PROJECT,
+} from "../services/antigravityProjectBootstrap.ts";
 import { persistDiscoveredAntigravityProjectId } from "../services/antigravityProjectPersist.ts";
 import { markAntigravityMissingCloudCodeProject } from "../services/antigravityProjectPersistence.ts";
 import {
@@ -577,6 +580,7 @@ export class AntigravityExecutor extends BaseExecutor {
    // its Google account already owns a Cloud Code project (the OAuth-time loadCodeAssist
    // returned empty/transiently failed). Mirror the Cloud Code bootstrap to recover it
    // here — the helper memoizes per access-token, so this is a one-time round-trip.
+    let requiresManualProject = false;
    if (!projectId && credentials?.accessToken) {
      const discovered = await ensureAntigravityProjectAssigned(
        credentials.accessToken,
@@ -584,7 +588,7 @@ export class AntigravityExecutor extends BaseExecutor {
        getAntigravityClientProfile(credentials),
        signal
      );
-      if (discovered) {
+      if (discovered && discovered !== ANTIGRAVITY_REQUIRES_MANUAL_PROJECT) {
        projectId = discovered;
        // #8491: persist the recovered id so it survives the next token refresh
        // or process restart instead of being silently rediscovered every time.
@@ -594,10 +598,40 @@ export class AntigravityExecutor extends BaseExecutor {
          credentials.providerSpecificData
        );
      }
+      requiresManualProject = discovered === ANTIGRAVITY_REQUIRES_MANUAL_PROJECT;
    }

    if (!projectId) {
      markAntigravityMissingCloudCodeProject(credentials?.connectionId);
+      if (requiresManualProject) {
+        // Google no longer auto-creates GCP projects for standard-tier
+        // accounts (tracked in #8491): fail fast with a clear instruction
+        // instead of the generic 422 — a fabricated/omitted id only earns a
+        // delayed 429 RESOURCE_EXHAUSTED from Google's quota check.
+        const errorBody = {
+          error: {
+            message:
+              "GCP_PROJECT_REQUIRED: Google Antigravity now requires a free GCP Project ID. " +
+              "Create one at console.cloud.google.com and enter it in Providers → Antigravity " +
+              "(connection settings → Project ID). Automatic project creation is no longer " +
+              "available for personal accounts.",
+            type: "gcp_project_required",
+            code: "gcp_project_required",
+          },
+        };
+        // 422, not 403: chatCore's generic "401/403 → refresh credentials and
+        // retry" path would otherwise hit Google's OAuth token endpoint on
+        // every request from an affected account — pointless, since refreshing
+        // the token cannot create a GCP project. 422 also matches the sibling
+        // missing_project_id error, which the client already maps to a clear
+        // "action needed" prompt.
+        const resp = new Response(JSON.stringify(errorBody), {
+          status: 422,
+          headers: { "Content-Type": "application/json" },
+        });
+        // Returning a Response object signals the executor to stop and forward it
+        return resp as unknown as never;
+      }
      // (#489) Return a structured error instead of throwing — gives the client a clear signal
      // to show a "Reconnect OAuth" prompt rather than an opaque "Internal Server Error".
      const errorMsg =
--- a/open-sse/services/antigravityProjectBootstrap.ts
+++ b/open-sse/services/antigravityProjectBootstrap.ts
@@ -20,7 +20,10 @@ import {
 } from "./antigravityHeaders.ts";
 import { extractCodeAssistOnboardTierId } from "./codeAssistSubscription.ts";
 import type { AntigravityClientProfile } from "./antigravityClientProfile.ts";
-import { ANTIGRAVITY_BOOTSTRAP_BASE_URLS, getAntigravityOnboardUrls } from "../config/antigravityUpstream.ts";
+import {
+  ANTIGRAVITY_BOOTSTRAP_BASE_URLS,
+  getAntigravityOnboardUrls,
+} from "../config/antigravityUpstream.ts";

 const LOAD_CODE_ASSIST_PATH = "/v1internal:loadCodeAssist";
 const BOOTSTRAP_TIMEOUT_MS = 8_000;
@@ -47,7 +50,39 @@ function evictOldest(cache: Map<string, unknown>): void {
 const projectCache = new Map<string, string>();

 /** Per-key lock to prevent concurrent onboard attempts for the same token. */
-const onboardLocks = new Map<string, Promise<boolean>>();
+const onboardLocks = new Map<string, Promise<void>>();
+
+/**
+ * Sentinel returned by ensureAntigravityProjectAssigned when Google's
+ * onboardUser completed but did NOT return a project id — no automatic
+ * project creation for standard-tier (personal) accounts (tracked in #8491),
+ * so Google requires a user-defined GCP project (BYOP). The
+ * caller must fail fast with a clear "enter your GCP project id" error
+ * instead of retrying (a fabricated id gets a delayed 429 RESOURCE_EXHAUSTED).
+ */
+export const ANTIGRAVITY_REQUIRES_MANUAL_PROJECT = "__REQUIRES_GCP_PROJECT__";
+
+/**
+ * Per-token cache of accounts Google told us to Bring Your Own Project.
+ * Permanent for the process lifetime (LRU-capped): re-running onboardUser
+ * for such an account is a pointless ~18s quota-check round-trip that
+ * always comes back empty. Cleared by clearAntigravityProjectCache(); a
+ * manually-entered project id (stored on the connection) short-circuits
+ * before this is consulted.
+ */
+const requiresManualProjectCache = new Set<string>();
+
+function markRequiresManualProject(key: string): void {
+  if (requiresManualProjectCache.size >= MAX_CACHE_SIZE) {
+    const oldest = requiresManualProjectCache.values().next().value;
+    if (oldest !== undefined) requiresManualProjectCache.delete(oldest);
+  }
+  requiresManualProjectCache.add(key);
+}
+
+/** Outcome of an onboardUser attempt — three-way so the caller can distinguish
+ * "transient failure (retry later)" from "Google says bring your own project". */
+type AntigravityOnboardStatus = "onboarded" | "requires_manual_project" | "failed";

 type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;

@@ -138,7 +173,7 @@ async function tryOnboardUser(
  clientProfile: AntigravityClientProfile,
  tierId: string,
  signal?: AbortSignal
-): Promise<boolean> {
+): Promise<AntigravityOnboardStatus> {
  const urls = getAntigravityOnboardUrls();
  const headers = getAntigravityContentHeaders(clientProfile, accessToken);

@@ -157,7 +192,20 @@ async function tryOnboardUser(
      });

      if (response.ok) {
-        return true;
+        // Accounts Google expects to Bring Their Own Project: onboardUser
+        // returns 200 without a `cloudaicompanionProject` in the body — no
+        // automatic project creation for standard-tier/personal accounts
+        // (tracked in #8491). Detect that so we can fail fast with a clear
+        // instruction instead of retrying forever or fabricating an id that
+        // Google later rejects with a delayed 429 RESOURCE_EXHAUSTED.
+        const body = await response.text().catch(() => "");
+        if (body && !/cloudaicompanionProject/.test(body)) {
+          console.warn(
+            `[models] antigravity onboardUser done but no project in response at ${url} — Google BYOP (user-defined GCP project) required`
+          );
+          return "requires_manual_project";
+        }
+        return "onboarded";
      }

      console.warn(
@@ -171,18 +219,40 @@ async function tryOnboardUser(
      console.warn(`[models] antigravity onboardUser threw for ${url}: ${msg} — trying next`);
    }
  }
-  return false;
+  return "failed";
 }

-/** Per-token memoization for accounts we already tried onboarding (avoid repeated calls). */
-const onboardAttemptedCache = new Set<string>();
+/**
+ * Per-token failure backoff for the onboardUser creation path.
+ *
+ * A FAILED onboard attempt must never be memoized as "done": a transient
+ * upstream/network error would otherwise poison the account for the whole
+ * process lifetime, so every later request 422s with "Missing Google
+ * projectId" even though onboarding would succeed on retry. Instead we record
+ * WHEN a failure happened and only skip re-attempts while the short backoff
+ * window is open — the account heals itself on the next request after it
+ * expires. Successful discoveries are memoized in `projectCache` (with LRU
+ * eviction) and clear any pending failure marker.
+ */
+const onboardFailureAt = new Map<string, number>();
+const ONBOARD_RETRY_BACKOFF_MS = 5 * 60 * 1000;

-function addToOnboardAttemptedCache(key: string): void {
-  if (onboardAttemptedCache.size >= MAX_CACHE_SIZE) {
-    const oldest = onboardAttemptedCache.values().next().value;
-    if (oldest !== undefined) onboardAttemptedCache.delete(oldest);
+function markOnboardFailure(key: string): void {
+  if (onboardFailureAt.size >= MAX_CACHE_SIZE) {
+    const oldest = onboardFailureAt.keys().next().value;
+    if (oldest !== undefined) onboardFailureAt.delete(oldest);
  }
-  onboardAttemptedCache.add(key);
+  onboardFailureAt.set(key, Date.now());
+}
+
+function isOnboardOnBackoff(key: string): boolean {
+  const failedAt = onboardFailureAt.get(key);
+  if (failedAt === undefined) return false;
+  if (Date.now() - failedAt >= ONBOARD_RETRY_BACKOFF_MS) {
+    onboardFailureAt.delete(key);
+    return false;
+  }
+  return true;
 }

 /**
@@ -212,49 +282,71 @@ export async function ensureAntigravityProjectAssigned(
  }

  const { projectId: initialProjectId, tierId } = await tryLoadCodeAssist(
-    accessToken, fetchImpl, clientProfile, signal
+    accessToken,
+    fetchImpl,
+    clientProfile,
+    signal
  );

  let projectId = initialProjectId;

+  // Google told us this account must Bring Its Own Project — fail fast with
+  // the sentinel instead of repeating the pointless ~18s onboard round-trip.
+  if (!projectId && requiresManualProjectCache.has(cacheKey)) {
+    return ANTIGRAVITY_REQUIRES_MANUAL_PROJECT;
+  }
+
  // loadCodeAssist is read-only — if the account was never onboarded, it returns
  // empty. Call onboardUser to create the project, then retry discovery.
-  if (!projectId && !onboardAttemptedCache.has(cacheKey)) {
+  // Re-attempts are bounded by a short failure backoff (not a permanent memo),
+  // so a transient onboard failure heals on the next request. Accounts Google
+  // marks BYOP are cached permanently and short-circuit above.
+  if (!projectId && !isOnboardOnBackoff(cacheKey)) {
    // Per-key lock: concurrent calls for the same token share one onboard attempt.
    let lock = onboardLocks.get(cacheKey);
    if (!lock) {
      lock = (async () => {
        let aborted = false;
+        let succeeded = false;
+        let requiresManual = false;
        try {
-          const onboarded = await tryOnboardUser(
-            accessToken, fetchImpl, clientProfile, tierId, signal
+          const status = await tryOnboardUser(
+            accessToken,
+            fetchImpl,
+            clientProfile,
+            tierId,
+            signal
          );
-          if (onboarded) {
-            const retry = await tryLoadCodeAssist(
-              accessToken, fetchImpl, clientProfile, signal
-            );
+          if (status === "requires_manual_project") {
+            markRequiresManualProject(cacheKey);
+            requiresManual = true;
+            return;
+          }
+          if (status === "onboarded") {
+            const retry = await tryLoadCodeAssist(accessToken, fetchImpl, clientProfile, signal);
            if (retry.projectId) {
              evictOldest(projectCache);
              projectCache.set(cacheKey, retry.projectId);
-              return true;
+              succeeded = true;
+              return;
            }
          }
-          return false;
        } catch (e) {
          aborted = signal?.aborted === true;
-          return false;
+          return;
        } finally {
          onboardLocks.delete(cacheKey);
-          if (!aborted) addToOnboardAttemptedCache(cacheKey);
+          if (!aborted && !requiresManual) {
+            if (succeeded) onboardFailureAt.delete(cacheKey);
+            else markOnboardFailure(cacheKey);
+          }
        }
      })();
      onboardLocks.set(cacheKey, lock);
    }
-    const success = await lock;
-    if (success) {
-      const cached = projectCache.get(cacheKey);
-      if (cached) return cached;
-    }
+    await lock;
+    if (projectCache.has(cacheKey)) return projectCache.get(cacheKey);
+    if (requiresManualProjectCache.has(cacheKey)) return ANTIGRAVITY_REQUIRES_MANUAL_PROJECT;
  }

  if (projectId) {
@@ -268,10 +360,17 @@ export async function ensureAntigravityProjectAssigned(
 /** Exported for tests. */
 export function clearAntigravityProjectCache(): void {
  projectCache.clear();
-  onboardAttemptedCache.clear();
+  onboardFailureAt.clear();
+  requiresManualProjectCache.clear();
  onboardLocks.clear();
 }

+/** Test-only: clear the onboard failure backoff (simulates backoff expiry). */
+export function clearAntigravityOnboardBackoff(key?: string): void {
+  if (key) onboardFailureAt.delete(key);
+  else onboardFailureAt.clear();
+}
+
 /** Exported for tests — inspect cache state. */
 export function getAntigravityProjectFromCache(
  accessToken: string,
--- a/open-sse/services/tokenRefresh.ts
+++ b/open-sse/services/tokenRefresh.ts
@@ -336,6 +336,7 @@ async function _getAccessTokenInternal(provider, credentials, log, proxyConfig:
      if (
        result?.accessToken &&
        (provider === "antigravity" || provider === "agy") &&
+        !credentials.providerSpecificData?.isProjectIdManual &&
        !(credentials.projectId || credentials.providerSpecificData?.projectId)
      ) {
        try {