From 2f74f8f6d15d999b0e7b1acfd0c2c422be8b332c Mon Sep 17 00:00:00 2001 From: Julius Marminge Date: Tue, 3 Nov 2026 22:01:36 +0000 Subject: [PATCH 1/4] test(server): reproduce #30413 Agent Platform ADC credentials stripped from Antigravity env These tests reproduce #30413: with Agent Platform and no API key, GOOGLE_APPLICATION_CREDENTIALS from the base environment must reach the Antigravity runtime, while Agent Platform with an API key still drops it. Co-Authored-By: Claude Opus 5.5 --- .../provider/antigravityAuthSupport.test.ts | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/apps/server/src/provider/antigravityAuthSupport.test.ts b/apps/server/src/provider/antigravityAuthSupport.test.ts index 6e9d805a52407..55b15057d8f4d 100644 --- a/apps/server/src/provider/antigravityAuthSupport.test.ts +++ b/apps/server/src/provider/antigravityAuthSupport.test.ts @@ -142,6 +142,34 @@ describe("Antigravity process environment", () => { expect(business.GOOGLE_API_KEY).toBeUndefined(); }); + it("keeps Application Default Credentials only for Agent Platform without an API key", () => { + const baseEnv = { PATH: "/usr/bin", GOOGLE_APPLICATION_CREDENTIALS: "/secrets/key.json" }; + const spawnFor = (auth: AntigravityAuthConfig) => + buildAntigravityAcpSpawnInput({ + installation: { executablePath: "/release/acp", harnessPath: "/release/harness" }, + profile, + cwd: "/project", + baseEnv, + auth, + }).env ?? {}; + + const adc = spawnFor({ + authMethod: "agent-platform", + apiKey: "", + gcpProject: "synthetic-project", + gcpLocation: "us-central1", + }); + expect(adc.GOOGLE_APPLICATION_CREDENTIALS).toBe("/secrets/key.json"); + + const apiKey = spawnFor({ + authMethod: "agent-platform", + apiKey: "vertex-secret", + gcpProject: "synthetic-project", + gcpLocation: "us-central1", + }); + expect(apiKey.GOOGLE_APPLICATION_CREDENTIALS).toBeUndefined(); + }); + it("isolates TEMP and TMP to the profile directory on Windows", () => { const windowsProfile: AntigravityProfile = { platform: "win32", From c58a99cee7e6b3540f8d1ae86f6b51a76fff693d Mon Sep 17 00:00:00 2001 From: Julius Marminge Date: Tue, 3 Nov 2026 22:05:00 +0000 Subject: [PATCH 2/4] fix(server): pass Application Default Credentials to Antigravity Agent Platform Agent Platform without an API key authenticates through Application Default Credentials, but GOOGLE_APPLICATION_CREDENTIALS was stripped from the runtime environment for every sign-in method. Keep it only for that case; every other method still strips it. Co-Authored-By: Claude Opus 5.5 --- apps/server/src/provider/antigravityAuthSupport.ts | 10 +++++++++- docs/user/providers-antigravity.md | 12 ++++++------ 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/apps/server/src/provider/antigravityAuthSupport.ts b/apps/server/src/provider/antigravityAuthSupport.ts index 2b2ae029e5b0e..d88db5d4babc0 100644 --- a/apps/server/src/provider/antigravityAuthSupport.ts +++ b/apps/server/src/provider/antigravityAuthSupport.ts @@ -197,10 +197,18 @@ function antigravityEnvironment( auth: AntigravityAuthConfig, runtimeTempDirectory?: string, ) { + // Application Default Credentials are the selected credential here, not an ambient override. + const usesApplicationDefaultCredentials = auth.authMethod === "agent-platform" && !auth.apiKey; const environment: NodeJS.ProcessEnv = {}; for (const [key, value] of Object.entries(baseEnv)) { // Windows treats environment keys as case-insensitive. Remove aliases too. - if (!removedEnvironmentKeys.has(key.toUpperCase())) environment[key] = value; + const name = key.toUpperCase(); + if ( + !removedEnvironmentKeys.has(name) || + (usesApplicationDefaultCredentials && name === "GOOGLE_APPLICATION_CREDENTIALS") + ) { + environment[key] = value; + } } // Put the GCP pair in settings.json because GOOGLE_API_KEY takes precedence in the environment. const credential = diff --git a/docs/user/providers-antigravity.md b/docs/user/providers-antigravity.md index 9a62a65efdcbc..cf5b82341c1f6 100644 --- a/docs/user/providers-antigravity.md +++ b/docs/user/providers-antigravity.md @@ -36,12 +36,12 @@ T3 Code's confirmation. Choose **Sign-in method** in the Antigravity provider settings: -| Method | Credentials | -| -------------------------- | -------------------------------------------------------------------------------------------- | -| Google account | Personal Google sign-in in the browser | -| Gemini Enterprise | Browser sign-in, GCP project, and GCP location | -| Gemini API key | API key; choose Connect without a browser | -| Agent Platform / Vertex AI | API key, or GCP project and location with Application Default Credentials on the environment | +| Method | Credentials | +| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Google account | Personal Google sign-in in the browser | +| Gemini Enterprise | Browser sign-in, GCP project, and GCP location | +| Gemini API key | API key; choose Connect without a browser | +| Agent Platform / Vertex AI | API key, or GCP project and location with Application Default Credentials on the environment, such as a service-account key in `GOOGLE_APPLICATION_CREDENTIALS` under **Environment variables** | The environment stores the Antigravity API key outside its settings file, and clients only see whether one is saved. The agent uses the method and credentials selected for this instance; From c615b6a4e1006d2254ab8dfc47c0edbe350128f7 Mon Sep 17 00:00:00 2001 From: Julius Marminge Date: Tue, 3 Nov 2026 22:11:00 +0000 Subject: [PATCH 3/4] docs: name the service-account key path for Agent Platform ADC Co-Authored-By: Claude Opus 5.5 --- docs/user/providers-antigravity.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/user/providers-antigravity.md b/docs/user/providers-antigravity.md index cf5b82341c1f6..9923bd32d6fc3 100644 --- a/docs/user/providers-antigravity.md +++ b/docs/user/providers-antigravity.md @@ -36,12 +36,12 @@ T3 Code's confirmation. Choose **Sign-in method** in the Antigravity provider settings: -| Method | Credentials | -| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Google account | Personal Google sign-in in the browser | -| Gemini Enterprise | Browser sign-in, GCP project, and GCP location | -| Gemini API key | API key; choose Connect without a browser | -| Agent Platform / Vertex AI | API key, or GCP project and location with Application Default Credentials on the environment, such as a service-account key in `GOOGLE_APPLICATION_CREDENTIALS` under **Environment variables** | +| Method | Credentials | +| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Google account | Personal Google sign-in in the browser | +| Gemini Enterprise | Browser sign-in, GCP project, and GCP location | +| Gemini API key | API key; choose Connect without a browser | +| Agent Platform / Vertex AI | API key, or GCP project and location with Application Default Credentials on the environment, such as `GOOGLE_APPLICATION_CREDENTIALS` set to a service-account JSON key path under **Environment variables** | The environment stores the Antigravity API key outside its settings file, and clients only see whether one is saved. The agent uses the method and credentials selected for this instance; From b183118abcc57448f69d2543aea0848cd8080bd1 Mon Sep 17 00:00:00 2001 From: Julius Marminge Date: Tue, 3 Nov 2026 22:23:07 +0000 Subject: [PATCH 4/4] docs: explain the Agent Platform ADC exception to ambient credentials Co-Authored-By: Claude Opus 5.5 --- docs/user/providers-antigravity.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/docs/user/providers-antigravity.md b/docs/user/providers-antigravity.md index 9923bd32d6fc3..40eef9d0b838a 100644 --- a/docs/user/providers-antigravity.md +++ b/docs/user/providers-antigravity.md @@ -36,16 +36,21 @@ T3 Code's confirmation. Choose **Sign-in method** in the Antigravity provider settings: -| Method | Credentials | -| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Google account | Personal Google sign-in in the browser | -| Gemini Enterprise | Browser sign-in, GCP project, and GCP location | -| Gemini API key | API key; choose Connect without a browser | -| Agent Platform / Vertex AI | API key, or GCP project and location with Application Default Credentials on the environment, such as `GOOGLE_APPLICATION_CREDENTIALS` set to a service-account JSON key path under **Environment variables** | +| Method | Credentials | +| -------------------------- | -------------------------------------------------------------------------------------------- | +| Google account | Personal Google sign-in in the browser | +| Gemini Enterprise | Browser sign-in, GCP project, and GCP location | +| Gemini API key | API key; choose Connect without a browser | +| Agent Platform / Vertex AI | API key, or GCP project and location with Application Default Credentials on the environment | The environment stores the Antigravity API key outside its settings file, and clients only see whether one is saved. The agent uses the method and credentials selected for this instance; ambient `GEMINI_API_KEY` and Google credential variables do not override them. +The exception is Agent Platform without a saved API key, which uses Application +Default Credentials: it reads `GOOGLE_APPLICATION_CREDENTIALS` from the instance's +**Environment variables** or from the machine T3 Code runs on. Set it to the +absolute path of a service-account JSON key, and clear any saved API key, which +takes precedence. Changing the method stops the instance's sessions. Sign out before replacing an account.