Repository navigation
[Bug]: Antigravity Google sign-in hides the real failure reason (ineligible account, rejected redirect URL) #17508
Description
Area
apps/server
Steps to reproduce
- Settings → Antigravity → Google account → sign in with a Google account that Antigravity rejects (for example an admin-managed or otherwise ineligible account).
- Google OAuth completes, then Antigravity's
authenticatecall fails.
Second case: after a failed attempt, paste a redirect URL from an earlier sign-in into the callback field.
Actual behavior
- The status row shows only
Google sign-in failed. Start sign-in again. - Server trace shows the real reason,
RpcClient.authenticate:Onboarding failed: User is ineligible for free-tier. Reason: Your current account is not eligible for Antigravity. Try signing in with another personal Google account. - A rejected redirect URL fails
AntigravityAuth.completewithThis redirect URL does not belong to the current sign-in.The status row keeps its previous text, and the message only appears in a separate alert that clears on the next command.
Expected behavior
The status row shows the provider's actionable reason, so the user knows to try another account instead of retrying the same one.
Cause
safeAuthFailure in apps/server/src/provider/AntigravityAuth.ts passes through only ProviderSetupError.detail and a few matched AcpRequestError patterns. An authenticate rejection matches none of them, so it falls to the generic fallback even though AcpRequestError.errorMessage holds the reason. In complete, a callback validation failure fails the RPC without publishing to the auth state.
Related
Same bug class (real cause hidden behind the generic message): #9655, #12245, #12477, #12473. Open PRs #14969 and #15629 improve error detail for session and startup failures. Neither covers sign-in authenticate rejections or the redirect-URL case.
Note
Responses generated with Claude
Activity
juliusmarminge commentedon Oct 22, 2026
Fresh triage: this is a sign-in error-reporting bug, with no reported exploitable vulnerability. No duplicate found among 948 open issues using Antigravity, Google sign-in, redirect URL, and the reported error strings. Related account-verification reports fail after successful sign-in rather than at authenticate.
Source inspection of cached main b5a226e49c still shows the generic fallback in safeAuthFailure and callback validation returning before publishing auth state. This is not a runtime reproduction: no rejected Google account was supplied, and a fresh main fetch has not completed. The triage rules require maintainer handling for changes to authentication. Leaving open for Julius; no code changes or PR.
kaovilai commentedon Oct 22, 2026
This was caused by using my company enterprise Google sign in which do not include usage for antigravity as part of workspace account. Access is provided via Google cloud projects instead. To reproduce, get an enterprise workspace Google account plan without Gemini coding access and login in t3code.
kaovilai commentedon Oct 22, 2026
Screenshot for context. This is Settings → Antigravity → Google account after signing in with the enterprise Workspace account (no Antigravity entitlement). The status row shows only the generic
Google sign-in failed. Start sign-in again., with no hint that the account itself is ineligible.Note
Responses generated with Claude (model: Claude Sonnet 5.5)