Sign up
View stargazers13Sign up

[Bug]: Antigravity Google sign-in hides the real failure reason (ineligible account, rejected redirect URL)#17508

opened16d agobyKkaovilai

Area

apps/server

Steps to reproduce

  1. Settings → Antigravity → Google account → sign in with a Google account that Antigravity rejects (for example an admin-managed or otherwise ineligible account).
  2. Google OAuth completes, then Antigravity's authenticate call fails.

Second case: after a failed attempt, paste a redirect URL from an earlier sign-in into the callback field.

Actual behavior

  • The status row shows only Google sign-in failed. Start sign-in again.
  • Server trace shows the real reason, RpcClient.authenticate: Onboarding failed: User is ineligible for free-tier. Reason: Your current account is not eligible for Antigravity. Try signing in with another personal Google account.
  • A rejected redirect URL fails AntigravityAuth.complete with This redirect URL does not belong to the current sign-in. The status row keeps its previous text, and the message only appears in a separate alert that clears on the next command.

Expected behavior

The status row shows the provider's actionable reason, so the user knows to try another account instead of retrying the same one.

Cause

safeAuthFailure in apps/server/src/provider/AntigravityAuth.ts passes through only ProviderSetupError.detail and a few matched AcpRequestError patterns. An authenticate rejection matches none of them, so it falls to the generic fallback even though AcpRequestError.errorMessage holds the reason. In complete, a callback validation failure fails the RPC without publishing to the auth state.

Related

Same bug class (real cause hidden behind the generic message): #9655, #12245, #12477, #12473. Open PRs #14969 and #15629 improve error detail for session and startup failures. Neither covers sign-in authenticate rejections or the redirect-URL case.

Note

Responses generated with Claude

JJulius Marminge4d ago

Fresh triage: this is a sign-in error-reporting bug, with no reported exploitable vulnerability. No duplicate found among 948 open issues using Antigravity, Google sign-in, redirect URL, and the reported error strings. Related account-verification reports fail after successful sign-in rather than at authenticate.

Source inspection of cached main b5a226e49c still shows the generic fallback in safeAuthFailure and callback validation returning before publishing auth state. This is not a runtime reproduction: no rejected Google account was supplied, and a fresh main fetch has not completed. The triage rules require maintainer handling for changes to authentication. Leaving open for Julius; no code changes or PR.

Kkaovilai4d ago
Synced from GitHub

This was caused by using my company enterprise Google sign in which do not include usage for antigravity as part of workspace account. Access is provided via Google cloud projects instead. To reproduce, get an enterprise workspace Google account plan without Gemini coding access and login in t3code.

Kkaovilai4d ago
Synced from GitHub

Screenshot for context. This is Settings → Antigravity → Google account after signing in with the enterprise Workspace account (no Antigravity entitlement). The status row shows only the generic Google sign-in failed. Start sign-in again., with no hint that the account itself is ineligible.

Antigravity settings: Google account row showing only the generic message 'Google sign-in failed. Start sign-in again.'

Note

Responses generated with Claude (model: Claude Sonnet 5.5)