lbjlaq/Antigravity-Manager v5.0.2-beta.5

Antigravity Tools v5.0.2-beta.5

on GitHub

• [Web/Docker Mode OAuth Flow Fixes, State Tearing Protection, and Synchronous Exchange Feedback] (Fixes #3802, PR #3803, PR #3805, Thanks to @dandelion-promise520, @cubelikeplayDaniel):
  • State Tearing & Duplicate Prepare Prevention: Optimized handleOAuthWeb in AddAccountDialog to prioritize reusing already prepared authorization URLs rather than re-triggering prepare_oauth_url upon clicking "Start OAuth"; added idempotent state reuse in backend prepare_oauth_flow_manually (returning existing URLs for identical client and redirect_uri), completely eliminating state overrides that caused callback codes to drop into cancelled channels. (Fixes #3802, PR #3803, Thanks to @dandelion-promise520, @cubelikeplayDaniel)
  • Built-in Client Loopback Fallback Guard (PR #3803): Added an is_builtin_oauth_client guard in resolve_oauth_redirect_uri that enforces http://localhost:<port>/auth/callback for the default built-in Google client even if ABV_PUBLIC_URL is set, completely avoiding upstream Google 400 redirect_uri_mismatch errors caused by unauthorized custom domains. (PR #3803, Thanks to @cubelikeplayDaniel)
  • Active Flow Cleanup on Exchange Failure (PR #3805): Added explicit cancel_oauth_flow() calls upon exchange errors in both submit_oauth_code and HTTP handle_oauth_callback, immediately freeing the global single-flow state when Google returns invalid_grant or expired codes; additionally clears the frontend oauthUrl cache upon submission error, completely eliminating stale flow state reuse and retry deadlocks. (PR #3805, Thanks to @cubelikeplayDaniel)
  • Bi-directional CSRF Fallback & Resilient Manual Input Parsing (PR #3803, PR #3805): Automatically extracts and forwards the original state from oauthUrl as a fallback when submitting manual codes in the frontend, preventing CSRF verification bypasses on bare code inputs; upgraded parse_manual_oauth_input to reliably handle full URLs, schemeless localhost:<port>/... addresses, %2F encoded strings, raw codes, and upstream error=access_denied callbacks. (Fixes #3802, PR #3803, PR #3805, Thanks to @dandelion-promise520, @cubelikeplayDaniel)
  • Client Key Preservation & Account Pool Sync: Replaced the detached background tokio::spawn task in Web mode; manual code submissions and web callbacks now strictly preserve and forward the bound client_key to exchange_code_with_client, accompanied by active token_manager.load_accounts() reloading on callback, eliminating upstream invalid_grant: Bad Request errors caused by client mismatch. (Fixes #3802, PR #3803, Thanks to @dandelion-promise520, @cubelikeplayDaniel)
  • Headless/Docker Deployment Contextual Guidance & Action Guards: Added a clear contextual callout above the manual code input in Web mode explaining that browser connection refusal upon redirecting to localhost is normal Google Desktop OAuth behavior, guiding remote users to copy and paste the full callback URL from the address bar; restricted the "I have authorized, continue" button to desktop mode to prevent Web UI confusion. (Fixes #3802, PR #3803, Thanks to @dandelion-promise520, @cubelikeplayDaniel)

• [Web/Docker 模式 OAuth 链路修复、状态防撕裂与回填同步闭环] (Fixes #3802, PR #3803, PR #3805, Thanks to @dandelion-promise520, @cubelikeplayDaniel):
  • 消除前端重复 Prepare 与状态撕裂: 优化 AddAccountDialog 中 handleOAuthWeb 逻辑，优先复用已生成的授权 URL，禁止点击「开始授权」时二次触发 prepare_oauth_url；后端 prepare_oauth_flow_manually 增加状态幂等复用检查（同 client 与 redirect_uri 直接返回现有 URL），彻底解决双重请求导致后台全局 Flow 状态被重置覆盖、回调 code 掉入废弃通道的硬伤。(Fixes #3802, PR #3803, Thanks to @dandelion-promise520, @cubelikeplayDaniel)
  • 内置客户端防重定向失配拦截 (PR #3803): 在 resolve_oauth_redirect_uri 中增加 is_builtin_oauth_client 环回回退防御，当使用默认内置 Google OAuth 凭据时，即使用户配置了 ABV_PUBLIC_URL 也强制使用 http://localhost:<port>/auth/callback，彻底规避因公网/局域网域名未在上游控制台注册而触发的 Google 400 redirect_uri_mismatch 阻断。(PR #3803, Thanks to @cubelikeplayDaniel)
  • 换码失败主动清理脏状态闭环 (PR #3805): 在手动换码 submit_oauth_code 及 HTTP 回调 handle_oauth_callback 的兑换异常分支中补充主动调用 cancel_oauth_flow()，当 Google 报 invalid_grant 或 Code 过期时立即释放全局单例 Flow 状态；前端提交失败时自动清空本地 oauthUrl 缓存，彻底杜绝脏状态残留导致用户重试时因状态复用死锁。(PR #3805, Thanks to @cubelikeplayDaniel)
  • 手动回填 CSRF 双向核对与弹性解析 (PR #3803, PR #3805): 前端提交手动回填时，自动从预生成的 oauthUrl 中解析原始 state 作为 fallbackState 传给后端，避免仅回填裸 Code 时因丢失 state 导致 CSRF 防护被跳过；升级 parse_manual_oauth_input 智能解析引擎，全面兼容完整 URL、无 scheme 域名（localhost:8045/...）、已编码 %2F 与裸 Code，并拦截上游 error=access_denied 等拒绝响应。(Fixes #3802, PR #3803, PR #3805, Thanks to @dandelion-promise520, @cubelikeplayDaniel)
  • Web 兑换透传客户端凭据与号池实时同步: 移除原 Web 模式后台游离且丢弃了 client 的 tokio::spawn 异步任务；手动提交以及 Web 回调统一通过 flow 绑定的 client_key 调用 exchange_code_with_client 进行兑换，并在回调成功后主动调用 token_manager.load_accounts() 刷新内存与文件，彻底消除因客户端不匹配导致 Google 上游报 invalid_grant: Bad Request 的缺陷。(Fixes #3802, PR #3803, Thanks to @dandelion-promise520, @cubelikeplayDaniel)
  • 无头/Docker 远程部署交互与按键守护: 在 Web 模式手动回填输入框上方新增上下文提示，明确解释因 Google Desktop OAuth 规范限制，授权后跳转至 localhost 显示连接拒绝属正常安全行为，引导用户直接复制地址栏完整 URL 粘贴提交；限制「我已授权，继续」按键仅在桌面端可用，避免 Web 模式下点击造成混淆。(Fixes #3802, PR #3803, Thanks to @dandelion-promise520, @cubelikeplayDaniel)

Full Changelog: v5.0.2-beta.4...v5.0.2-beta.5