NoeFabris/opencode-antigravity-auth v1.5.0

on GitHub

What's New

Added

• Account Verification Flow — Auth login menu now supports verify and verify-all actions. When Antigravity returns a 403 with validation_required, the account is automatically disabled, marked with a verification URL, and cooled down. Users can verify accounts directly from the menu with a probe request to confirm resolution

• Dynamic Antigravity Version — Plugin version is now fetched at startup from the Antigravity updater API, with a changelog-scrape fallback and a hardcoded last-resort. Eliminates stale "version no longer supported" errors after Antigravity updates

• Storage V4 Schema — New storage version adds verificationRequired, verificationRequiredAt, verificationRequiredReason, verificationUrl, and fingerprintHistory fields per account. Full migration chain from v1/v2/v3 to v4

• saveAccountsReplace — New destructive-write storage function that replaces the entire accounts file without merging, preventing deleted accounts from being resurrected by concurrent reads

• setAccountEnabled / Account Toggling — New account management methods: setAccountEnabled(), markAccountVerificationRequired(), clearAccountVerificationRequired(), removeAccountByIndex()

• Secure File Permissions — Credential storage files are now created with mode 0600 (owner read/write only). Existing files with overly permissive modes are tightened on load

• opencode.jsonc Support — Configure models flow now detects and prefers existing opencode.jsonc files. JSONC parsing strips comments and trailing commas before JSON.parse

• Header Contract Tests — New src/constants.test.ts validates header shapes, randomization behavior, and optional header fields for both Antigravity and Gemini CLI styles

Changed

• Unified Gemini Routing — Gemini quota fallback between Antigravity and Gemini CLI pools is now always enabled for Gemini models. The quota_fallback config flag is deprecated and ignored (backward-compatible, no breakage)

• cli_first Honored in Routing — resolveHeaderRoutingDecision() centralizes routing logic and properly respects cli_first for unsuffixed Gemini models

• Fingerprint Headers Simplified — buildFingerprintHeaders() now returns only User-Agent. Removed X-Goog-QuotaUser, X-Client-Device-Id, X-Goog-Api-Client, and Client-Metadata from outgoing content requests to align with Antigravity Manager behavior

• Client Metadata Reduced — Fingerprint client metadata trimmed to ideType, platform, pluginType only. Removed osVersion, arch, sqmId

• Gemini CLI User-Agent Format — Updated from google-genai-sdk/... to GeminiCLI/... format

• Search Model — Changed from gemini-2.0-flash to gemini-2.5-flash for improved search result quality

• Deterministic Search Generation — Search requests now use temperature: 0 and topP: 1 instead of thinking config

• OAuth Headers Dynamic — oauth.ts and project.ts now use getAntigravityHeaders() instead of static constants, removing stale X-Goog-Api-Client from token/project calls

Fixed

• #410: Strip x-goog-user-project header for ALL header styles, not just Antigravity. This header caused 403 errors on Daily/Prod endpoints when the user's GCP project lacked Cloud Code API
• #370 / #336: Account deletion now persists correctly. Root cause: saveAccounts() merged deleted accounts back from disk. Fixed by introducing saveAccountsReplace() for destructive writes and syncing in-memory state immediately
• #381: Disabled accounts no longer selected via sticky index. getCurrentAccountForFamily() now skips disabled accounts and advances the active index
• #384: google_search tool no longer returns empty citations when using gemini-3-flash. Search model switched to gemini-2.5-flash
• #377: Configure models flow now respects existing opencode.jsonc files instead of creating duplicate opencode.json
• Excessive Disk Writes — Fixed project context auth updates causing 3000+ writes/sec during streaming. Changed from reference equality to value comparison on auth tokens and added throttled saves. Prevents SSD wear on macOS
• Fingerprint Alignment — Force-regenerated fingerprints to match current Antigravity Manager behavior, fixing ideType and stripping stale client metadata fields

Removed

• Extra Outgoing Headers — X-Goog-Api-Client, Client-Metadata, X-Goog-QuotaUser, X-Client-Device-Id no longer sent on content requests
• Fingerprint Metadata Fields — osVersion, arch, sqmId removed from fingerprint client metadata
• updateFingerprintVersion Helper — Removed from accounts module (fingerprint version rewriting no longer needed)

Documentation

• AGENTS.md expanded with detailed architecture, code style, and fingerprint system documentation
• README.md, CONFIGURATION.md, MULTI-ACCOUNT.md updated to reflect deprecated quota_fallback and automatic Gemini pool fallback behavior
• antigravity.schema.json marks quota_fallback as deprecated/ignored

Full Changelog: v1.4.6...v1.5.0