fix(server): Antigravity Agent Platform passes GOOGLE_APPLICATION_CREDENTIALS to the runtime

apps/server/src/provider/antigravityAuthSupport.test.ts

@@ -163,6 +163,34 @@ describe("Antigravity process environment", () => {
     expect(business.GOOGLE_API_KEY).toBeUndefined();
   });
 
+  it("keeps Application Default Credentials only for Agent Platform without an API key", () => {
+    const baseEnv = { PATH: "/usr/bin", GOOGLE_APPLICATION_CREDENTIALS: "/secrets/key.json" };
+    const spawnFor = (auth: AntigravityAuthConfig) =>
+      buildAntigravityAcpSpawnInput({
+        installation: { executablePath: "/release/acp", harnessPath: "/release/harness" },
+        profile,
+        cwd: "/project",
+        baseEnv,
+        auth,
+      }).env ?? {};
+
+    const adc = spawnFor({
+      authMethod: "agent-platform",
+      apiKey: "",
+      gcpProject: "synthetic-project",
+      gcpLocation: "us-central1",
+    });
+    expect(adc.GOOGLE_APPLICATION_CREDENTIALS).toBe("/secrets/key.json");
+
+    const apiKey = spawnFor({
+      authMethod: "agent-platform",
+      apiKey: "vertex-secret",
+      gcpProject: "synthetic-project",
+      gcpLocation: "us-central1",
+    });
+    expect(apiKey.GOOGLE_APPLICATION_CREDENTIALS).toBeUndefined();
+  });
+
   it("isolates TEMP and TMP to the profile directory on Windows", () => {
     const windowsProfile: AntigravityProfile = {
       platform: "win32",

apps/server/src/provider/antigravityAuthSupport.ts

@@ -199,10 +199,18 @@ function antigravityEnvironment(
   auth: AntigravityAuthConfig,
   runtimeTempDirectory?: string,
 ) {
+  // Application Default Credentials are the selected credential here, not an ambient override.
+  const usesApplicationDefaultCredentials = auth.authMethod === "agent-platform" && !auth.apiKey;
   const environment: NodeJS.ProcessEnv = {};
   for (const [key, value] of Object.entries(baseEnv)) {
     // Windows treats environment keys as case-insensitive. Remove aliases too.
-    if (!removedEnvironmentKeys.has(key.toUpperCase())) environment[key] = value;
+    const name = key.toUpperCase();
+    if (
+      !removedEnvironmentKeys.has(name) ||
+      (usesApplicationDefaultCredentials && name === "GOOGLE_APPLICATION_CREDENTIALS")
+    ) {
+      environment[key] = value;
+    }
   }
   // Put the GCP pair in settings.json because GOOGLE_API_KEY takes precedence in the environment.
   const credential =

docs/user/providers-antigravity.md

@@ -46,6 +46,11 @@ Choose **Sign-in method** in the Antigravity provider settings:
 The environment stores the Antigravity API key outside its settings file, and
 clients only see whether one is saved. The agent uses the method and credentials selected for this instance;
 ambient `GEMINI_API_KEY` and Google credential variables do not override them.
+The exception is Agent Platform without a saved API key, which uses Application
+Default Credentials: it reads `GOOGLE_APPLICATION_CREDENTIALS` from the instance's
+**Environment variables** or from the machine T3 Code runs on. Set it to the
+absolute path of a service-account JSON key, and clear any saved API key, which
+takes precedence.
 Changing the method stops the instance's sessions. Sign out before replacing an
 account.