fix(antigravity): drop synthetic x-goog-api-client header on onboarding by dbc-hbin · Pull Request #1889 · lidge-jun/opencodex

dbc-hbin · 2026-08-17T04:26:51Z

Summary

Remove synthetic x-goog-api-client header from Antigravity onboardUser requests and pass ANTIGRAVITY_IDE_VERSION for metadata.ide_version.

Context & Evidence

Following discussion in #1836:

Decompilation of Antigravity IDE 2.5.5 (language_server_macos_arm 126MB Go1.26.5) confirms that x-goog-api-client is never sent on the wire.
- 0 ADRP hits across all SetHTTPHeaders variants (IDE, CLI, Hub, Standalone, Stubby).
- The single raw string occurrence at 0x24ea019 is part of a generationConfig.x-goog-api-client descriptor, not a header.
metadata.ide_version in onboardUser is aligned to ANTIGRAVITY_IDE_VERSION (2.5.5), separating it from the User-Agent header.
Removed obsolete ANTIGRAVITY_GOOG_API_CLIENT_UA export and associated test.

Verification

bun test tests/client-fingerprint.test.ts tests/google-antigravity-oauth.test.ts tests/google-antigravity-wire.test.ts (73 passed, 0 failed)
bun run typecheck (passed with 0 errors)

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

All CI tests are green on my local testing.
I pushed my PR to the latest dev commit.
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.

github-actions · 2026-08-17T04:27:05Z

⚠️ Deterministic hygiene checks failed.

unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/google-antigravity.ts.

coderabbitai · 2026-08-17T04:27:14Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b1328395-9c3d-4d17-9e3b-14cb570039c1

📥 Commits

Reviewing files that changed from the base of the PR and between 3d67ac2 and eb3132e.

📒 Files selected for processing (4)

src/adapters/client-fingerprint.ts
src/oauth/google-antigravity.ts
tests/client-fingerprint.test.ts
tests/google-antigravity-oauth.test.ts

💤 Files with no reviewable changes (2)

src/adapters/client-fingerprint.ts
tests/client-fingerprint.test.ts

Included review availability: Your plan includes up to 10 reviews per rolling hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

Antigravity OAuth onboarding now uses ANTIGRAVITY_IDE_VERSION for metadata, omits the x-goog-api-client header, and retains the Antigravity IDE User-Agent. The obsolete client User-Agent constant and its test are removed.

Changes

Antigravity OAuth identity

Layer / File(s)	Summary
Update onboarding request identity `src/adapters/client-fingerprint.ts`, `src/oauth/google-antigravity.ts`, `tests/client-fingerprint.test.ts`, `tests/google-antigravity-oauth.test.ts`	The secondary Google API client User-Agent constant and test are removed. Onboarding requests no longer send `x-goog-api-client`; `metadata.ide_version` uses `ANTIGRAVITY_IDE_VERSION`. Tests verify the header omission, IDE `User-Agent`, and metadata value.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to eb313

This localized change removes an unused onboarding header and aligns the IDE version metadata; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

lidge-jun/opencodex#1646: Modifies Antigravity client fingerprinting and OAuth identity handling.
lidge-jun/opencodex#1836: Modifies Antigravity OAuth headers and x-goog-api-client handling.

Suggested reviewers: ingwannu, lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing the synthetic x-goog-api-client header from Antigravity onboarding requests.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-17T04:27:19Z

⏳ DRAFT

hygiene: unsponsored_surface.

What to do

Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/google-antigravity.ts.
Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

⬜ All CI tests are green on my local testing.
⬜ I pushed my PR to the latest dev commit.
⬜ I resolved all correct Codex and CodeRabbit findings.
⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@dbc-hbin Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

All three Antigravity PRs merge clean onto current dev in the corrected order, so the client-fingerprint overlap an earlier audit predicted between #1889 and #1891 does not actually conflict at these heads. Worth saying plainly rather than leaving the prediction standing. #1889 is blocked by the same gate as #1888: its four failures are hygiene and enforce-target rather than tests, because it touches src/oauth and pr-sponsored-surface lists that as restricted. The maintainer-sponsored label is the record that a security review happened, so applying it to clear my own merge would make the record false. That is exactly why leading the train with #1891 rather than #1889 was right - the alternative held everything behind a gate no agent should touch. Re-confirmed the two state facts this document originally had inverted: #1836 is already closed and #1906 is open.

The audit found what my own accept criterion was written to catch and did not. #1891 moves the GOOGLE_ANTIGRAVITY_USER_AGENT lookup into antigravityUserAgent, which has an untouched caller that puts its return value into the onboardUser request body as ide_version. So an operator override that previously reached only the User-Agent header now also goes upstream in the body. Reproduced in a scratch worktree: baseline dev sends the fixed 2.5.5 string, dev plus #1891 sends LEAK-CANARY/1.0. The dependency runs opposite to my reorder. I put #1889 last because it is the only PR with red CI, but #1889 is the one that makes ide_version a real version constant - it closes the hole #1891 widens. Ordering by CI colour put the fix behind the regression. #1889 should be sponsored and land first. That makes refusing to self-apply the sponsorship label costlier rather than wrong, which is worth stating plainly. Also recorded: #1897 merged after local verification, since no CI run existed at its head, and it misses one of its four cache-contract requirements - invalidation on authorization failure, where markProviderDiscoveryFailed neither clears the cache nor bumps the generation.

…ssues The still-open table covered issues and omitted lidge-jun#1891 and lidge-jun#1889, so a reader working from the closeout alone would find no trace of two deliberate holds - one of which is the campaign's most consequential finding. Both are blocked before merge, so the close-on-dev-merge decision does not reach them: that policy governs when a merged fix closes its issue, and neither has merged.

lidge-jun · 2026-08-18T02:06:49Z

Held on a governance gate rather than on the change. This touches src/oauth/google-antigravity.ts,
which .github/scripts/pr-sponsored-surface.cjs lists under RESTRICTED_PREFIXES, so both
hygiene and enforce-target report unsponsored_surface until a maintainer applies the
maintainer-sponsored label.

I am not applying that label. MAINTAINERS.md requires explicit security review for auth and
credential surfaces, and the label is the visible record that the review happened — applying it
without doing the review would not just bypass a gate, it would make the record false. That is a
maintainer action by design.

On the merge mechanics, which are fine: this merges clean onto current dev, so there is no
rebase debt waiting once the sponsorship question is settled.

Context on the rest of the Antigravity set, since the ordering has moved:

fix(antigravity): match live agy model discovery #1897 has landed (aca3c0241) — the live discovery half is on dev.
fix(antigravity): align User-Agent token order and auth_method with 2.5.5 decompilation #1891 is clean and verified (75 pass / 0 fail on the merged tree, typecheck clean); it is
held only by its own unticked readiness checklist, and it does not touch a restricted path.

So the practical order is #1891 whenever its author ticks the boxes, then this one once a
maintainer has reviewed the OAuth change and sponsored it.

- Remove synthetic x-goog-api-client header from Antigravity onboardUser requests. - Decompilation of Antigravity IDE 2.5.5 (language_server_macos_arm) confirmed x-goog-api-client is never sent on the wire (0 ADRP hits across all SetHTTPHeaders variants). - Pass ANTIGRAVITY_IDE_VERSION for metadata.ide_version instead of the full User-Agent string. - Remove obsolete ANTIGRAVITY_GOOG_API_CLIENT_UA export and test.

Wave 5D was smaller than planned. lidge-jun#1897 had already merged as aca3c02 and lidge-jun#1836 was already closed, so half the wave was resolved before the phase ran. lidge-jun#1891 I verified rather than took on trust: clean merge onto dev, 75 pass / 0 fail across the three fingerprint suites, typecheck clean. Its description carries a decompiled token sequence and a live round trip, which is the right evidence for a fingerprint change because the failure mode is silent upstream rejection rather than a failing test. It is held only by its own unticked readiness checklist. lidge-jun#1889 is the campaign's second auth-surface block after lidge-jun#1888. It touches src/oauth/, MAINTAINERS.md requires explicit security review there, and the maintainer-sponsored label is the record that the review happened - so applying it to unblock a merge would make the record false rather than skip a step.

…ompted Two record errors. lidge-jun#1889 has two distinct failing checks, not four - four was the count of failing check runs across re-runs. And the audit's finding that lidge-jun#1891 sits 62 commits behind dev is itself stale: the live head 8123680 is 0 behind, so ticking alone is now sufficient. Keeping that as a lesson rather than deleting it, because the mechanism it named is real and would have made my advice wrong on a different day. The audit also asked whether anything here could be landed rather than held, and one thing could: metadata.ide_version was set to antigravityUserAgent(), the whole header, where the real client sends a bare version. Live on dev, independent of both PRs, and invisible because the request still succeeds. Fixed in lidge-jun#1955. That distinction is worth stating. I hold lidge-jun#1889 because reviewing someone else's auth change is the maintainer act the sponsorship label records - but a one-line auth fix I wrote and verified myself is precisely the case where a maintainer sponsors their own work.

…ilure lidge-jun#1891's hold expired four minutes after I wrote it - the author rebased and ticked all four boxes at 02:10:50Z - so it merged as 5c66ad2. Wave 5D is now down to lidge-jun#1889 alone, blocked on maintainer sponsorship. The full suite on the merged tree is 12805 pass, 10 skip, 1 fail. The failure is the Unix shim autostart test failing with status 126, permission denied on exec, and it is environmental rather than a regression: it reproduces solo, it fails identically at the pre-campaign baseline 1208bd2, and all four test shards passed in dev CI for 9eb3a10. The test writes a shim to a temp dir and spawnSyncs it; this sandbox blocks execution from that path. Recorded rather than skipped - the fix is an environment note, not a test change.

I held lidge-jun#1891 and argued lidge-jun#1889 must land first. lidge-jun#1891 merged without it at 02:25:46Z; lidge-jun#1889 is still open and draft. For a while this document and both promotion PR descriptions described lidge-jun#1891 as deliberately excluded while it sat on the promotion head - which is the worst kind of error in a record written to inform an approval, because a maintainer would have approved believing the promotion excluded a change it contained. The concern is addressed on that head anyway, by a different route than the hold pointed at: lidge-jun#1957 made ide_version a bare constant, so the body field no longer carries the User-Agent. The hold was right about the defect and wrong about which PR would fix it. Two smaller ones. Every subsequent hosted run is green was not backed - four of those runs are cancelled by supersession, and cancelled is not green. And the campaign landed ten functional PRs, not nine; the count predated lidge-jun#1891.

dbc-hbin requested review from Ingwannu, Wibias and lidge-jun as code owners August 17, 2026 04:26

github-actions Bot added bug Something isn't working intake: hygiene-blocked Deterministic PR hygiene checks failed labels Aug 17, 2026

github-actions Bot marked this pull request as draft August 17, 2026 04:27

dbc-hbin changed the title ~~fix(antigravity): drop synthetic x-goog-api-client header on onboarding~~ fix(antigravity): align User-Agent format with 2.5.5 decompilation and drop x-goog-api-client Aug 17, 2026

dbc-hbin force-pushed the fix/antigravity-drop-goog-api-client branch from 6bcaa95 to eb3132e Compare August 17, 2026 04:32

dbc-hbin changed the title ~~fix(antigravity): align User-Agent format with 2.5.5 decompilation and drop x-goog-api-client~~ fix(antigravity): drop synthetic x-goog-api-client header on onboarding Aug 17, 2026

dbc-hbin force-pushed the fix/antigravity-drop-goog-api-client branch from eb3132e to ea64418 Compare August 17, 2026 09:22

dbc-hbin marked this pull request as ready for review August 17, 2026 09:23

github-actions Bot marked this pull request as draft August 17, 2026 09:24

dbc-hbin marked this pull request as ready for review August 17, 2026 09:24

github-actions Bot marked this pull request as draft August 17, 2026 09:24

dbc-hbin force-pushed the fix/antigravity-drop-goog-api-client branch from ea64418 to e6dff3e Compare August 17, 2026 16:43

dbc-hbin marked this pull request as ready for review August 17, 2026 16:45

github-actions Bot marked this pull request as draft August 17, 2026 16:46

lidge-jun mentioned this pull request Aug 18, 2026

fix(antigravity): align User-Agent token order and auth_method with 2.5.5 decompilation #1891

Merged

4 tasks

coderabbitai Bot mentioned this pull request Aug 18, 2026

docs(devlog): record the Wave 5C Cursor outcome #1954

Merged

4 tasks

lidge-jun mentioned this pull request Aug 18, 2026

fix(antigravity): send a bare ide_version, not the whole User-Agent #1955

Merged

4 tasks

coderabbitai Bot mentioned this pull request Aug 18, 2026

fix(antigravity): send a bare ide_version + Wave 5 closeout record #1957

Merged

4 tasks

This was referenced Aug 18, 2026

[WRONG BRANCH] promote: dev -> preview after the Wave 5 campaign #1958

Merged

[WRONG BRANCH] promote: dev -> main after the Wave 5 campaign #1959

Merged

lidge-jun mentioned this pull request Aug 18, 2026

fix(test): sanitize both shim recursion-guard variables #1960

Merged

4 tasks

dbc-hbin force-pushed the fix/antigravity-drop-goog-api-client branch from e6dff3e to 1ff6f6a Compare August 18, 2026 02:53

dbc-hbin marked this pull request as ready for review August 18, 2026 02:53

github-actions Bot marked this pull request as draft August 18, 2026 02:53

This was referenced Aug 18, 2026

[WRONG BRANCH] Promote dev to preview: Wave 5 campaign (107 commits) #1962

Merged

[WRONG BRANCH] Promote dev to main: Wave 5 campaign (107 commits) #1963

Merged

lidge-jun mentioned this pull request Aug 18, 2026

docs(devlog): final Wave 5 campaign record, including its own errors #1972

Merged

4 tasks

Navigation Menu

fix(antigravity): drop synthetic x-goog-api-client header on onboarding - #1889

fix(antigravity): drop synthetic x-goog-api-client header on onboarding#1889
dbc-hbin wants to merge 1 commit into
lidge-jun:devfrom
dbc-hbin:fix/antigravity-drop-goog-api-client

dbc-hbin commented Aug 17, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

coderabbitai Bot commented Aug 17, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

lidge-jun commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dbc-hbin commented Aug 17, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context & Evidence

Verification

Review readiness checklist

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

coderabbitai Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ DRAFT

What to do

Review readiness checklist

Uh oh!

lidge-jun commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dbc-hbin commented Aug 17, 2026 •

edited by github-actions Bot

Loading

coderabbitai Bot commented Aug 17, 2026 •

edited

Loading

github-actions Bot commented Aug 17, 2026 •

edited

Loading