fix(antigravity): consolidate multi-account discovery and model-denial routing

docs-site/src/content/docs/reference/configuration/providers.md

@@ -410,6 +410,7 @@ Providers can expose a built-in shorthand, such as `agy` for `google-antigravity
 | — | — | Antigravity account quota probes (`retrieveUserQuota` and `retrieveUserQuotaSummary`) always go to Google's own Cloud Code host through the pinned outbound transport, regardless of a configured `baseUrl`; the account bearer is never sent to an operator-configured endpoint and a redirect aborts the probe. Only the model-list fallback still honors `baseUrl`. |
 | — | — | If Antigravity quota summary returns 403 for a valid OAuth account, OpenCodex retries that endpoint once with the legacy `antigravity/1.0` User-Agent and the same token and project. A 401 is not retried. Inference and model discovery retain the IDE User-Agent. |
 | — | — | Antigravity quota shows Gemini 4 Argon as separate `Argon` / `Argon (Weekly)` windows next to Gem and Cla. They are display-only: account ranking, quota exhaustion, reset ordering and reset notifications keep using the Gemini and Claude windows, and Argon requests are still judged by the Gemini window. |
+| — | — | Refreshing Antigravity discovery unions usable accounts' enabled models and retains each account's own roster for six hours. With account failover active, a CCA 404 tries another eligible account only when its complete original error is at most 4 KiB and contains a model ResourceInfo whose resourceName exactly matches `models/<sent-model>`. Message-only errors, other resources and oversized, incomplete or erroring bodies keep the original HTTP status without a model denial or rotation. A confirmed denial lasts up to 24 hours, until positive discovery started after that request or credential replacement; older discovery cannot clear it or replace a newer positive roster. Exhaustion names the model and distinguishes unavailable accounts from credential, admission, or send-budget failure. No paid/trial classification is inferred. |
 | `location?` | `string` | Vertex location. API-key project endpoints default to `global` and ignore `GOOGLE_CLOUD_LOCATION`; ADC requires this field or the `GOOGLE_CLOUD_LOCATION` fallback. Gemini 4 Argon supports `global`, `us`, and `eu`. |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` | Cursor only: stdio or Streamable HTTP MCP servers. |
 | `desktopExecutor?` | `DesktopExecutorConfig` | Cursor only: external computer-use and record-screen commands. |

scripts/test-layout/layout-agent-assertion.json

@@ -3,5 +3,7 @@
   "agent-assertion-auth.test.ts": "server",
   "agent-assertion-routes.test.ts": "responses",
   "authorization-scheme.test.ts": "lib",
-  "server-antigravity-model-roster-routing.test.ts": "server"
+  "server-antigravity-model-roster-routing.test.ts": "server",
+  "antigravity-routing-carry.test.ts": "adapters/google",
+  "server-antigravity-model-denial-recovery.test.ts": "server"
 }

src/adapters/antigravity-refusal.ts

@@ -1,5 +1,34 @@
 /** Account-scoped Antigravity refusals. Unknown data never convicts an account. */
 import { BOUNDED_BODY_MAX_BYTES } from "../lib/bounded-body";
+import { registerProviderResponseProvenance } from "../providers/request-pacing";
+import { parseUpstreamJsonPayload } from "./upstream-http-error";
+
+/** Trusted only at the original Google body boundary; never serialized or inferred from display text. */
+const modelNotFoundResponses = new WeakMap<Response, true>();
+registerProviderResponseProvenance(modelNotFoundResponses);
+export const hasAntigravityModelNotFoundProvenance = (response: Response): boolean => modelNotFoundResponses.has(response);
+
+/** The caller supplies a complete original body, bounded to 4 KiB before normalization. */
+export function markAntigravityModelNotFound(response: Response, requestBody: string, payloadText: string): void {
+  if (response.status !== 404 || Buffer.byteLength(payloadText, "utf8") > 4096) return;
+  const request = parseUpstreamJsonPayload(requestBody) as { model?: unknown } | undefined;
+  const payload = parseUpstreamJsonPayload(payloadText) as { error?: {
+    code?: unknown; status?: unknown; message?: unknown; details?: unknown;
+  } } | undefined;
+  const model = request?.model;
+  const error = payload?.error;
+  if (typeof model !== "string" || !model || !error || error.status !== "NOT_FOUND"
+    || (error.code !== undefined && error.code !== 404)) return;
+  const details = Array.isArray(error.details) ? error.details : [];
+  const resourceInfo = details.filter((detail): detail is Record<string, unknown> =>
+    detail !== null && typeof detail === "object" && !Array.isArray(detail)
+    && detail["@type"] === "type.googleapis.com/google.rpc.ResourceInfo");
+  // No observed model-specific message form is known: prose alone cannot identify the missing resource.
+  if (!resourceInfo.length || resourceInfo.some(detail => detail.resourceName !== `models/${model}`
+    || (detail.resourceType !== undefined && (typeof detail.resourceType !== "string"
+      || !/(?:^|[./])models?$/i.test(detail.resourceType))))) return;
+  modelNotFoundResponses.set(response, true);
+}
 
 export type AntigravityRefusalKind = "verify_account" | "other";
 export interface AntigravityRefusal { kind: AntigravityRefusalKind }

src/adapters/google-http.ts

@@ -9,6 +9,7 @@ import { repairGoogleInvalidRequestBodyWithReport } from "./google-wire-compiler
 import type { GoogleToolSchemaPolicy, GoogleToolSchemaProfile } from "./google-tool-schema";
 import { normalizeUpstreamHttpErrorResponse, readDisplaySafeErrorPayloadText } from "./upstream-http-error";
 import { readBoundedResponseBody } from "../lib/bounded-body";
+import { markAntigravityModelNotFound } from "./antigravity-refusal";
 import {
   abortError,
   cancelResponseBodyBestEffort,
@@ -31,19 +32,27 @@ export interface GoogleRetryOptions {
   toolSchemaPolicy?: GoogleToolSchemaPolicy;
 }
 
-async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
-  if (label === "Antigravity" && res.status === 403) {
-    const body = await readBoundedResponseBody(res, {
-      maxBytes: 4096, totalTimeoutMs: 2000, firstByteTimeoutMs: 2000,
-      inactivityTimeoutMs: 2000, signal,
-    });
+async function normalizeFinalGoogleError(label: string, res: Response, request: AdapterRequest, signal?: AbortSignal): Promise<Response> {
+  if (label === "Antigravity" && (res.status === 403 || res.status === 404)) {
+    let payloadText = "";
+    try {
+      const body = await readBoundedResponseBody(res, {
+        maxBytes: 4096, totalTimeoutMs: 2000, firstByteTimeoutMs: 2000,
+        inactivityTimeoutMs: 2000, signal,
+      });
+      if (body.displaySafe && !body.truncated && !body.timedOut && !body.oversized) payloadText = body.text;
+    } catch (error) {
+      if (signal?.aborted) throw error;
+    }
     const headers = new Headers(res.headers);
     headers.delete("content-encoding");
     headers.delete("content-length");
-    return inheritAccountAutoPauseResponse(res, new Response(safeGoogleHttpErrorMessage(label, res.status,
-      body.displaySafe && !body.truncated ? body.text : ""), {
+    const normalized = inheritAccountAutoPauseResponse(res, new Response(safeGoogleHttpErrorMessage(label, res.status,
+      payloadText), {
       status: res.status, statusText: res.statusText, headers,
     }));
+    if (!signal?.aborted) markAntigravityModelNotFound(normalized, request.body, payloadText);
+    return normalized;
   }
   return normalizeUpstreamHttpErrorResponse(res, {
     signal,
@@ -110,7 +119,7 @@ export async function fetchGoogleWithRetry(
               changedSendAllowed,
             }));
             if (!changedSendAllowed) {
-              return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
+              return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, activeRequest, ctx.abortSignal);
             }
           }
           compatibilityReplayUsed = true;
@@ -122,7 +131,7 @@ export async function fetchGoogleWithRetry(
         }
       }
       if (!retryableGoogleStatus(res.status) || attempt === TRANSIENT_RETRY_MAX_ATTEMPTS - 1) {
-        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
+        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, activeRequest, ctx.abortSignal);
       }
       // A 429 may be a transient rate limit (retry) or hard quota exhaustion (do NOT retry —
       // it won't recover for hours and burns retries). Peek the body to tell them apart.
@@ -147,7 +156,7 @@ export async function fetchGoogleWithRetry(
         retryAfterIsLowerBound: true,
       });
       if (delayMs > RETRY_AFTER_CEILING_MS) {
-        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
+        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, activeRequest, ctx.abortSignal);
       }
       pendingResponse = res;
       recovery = res.status === 429 ? "rate-limit-429" : "transient-5xx";
@@ -161,7 +170,7 @@ export async function fetchGoogleWithRetry(
           // upstream answer — but it used to leave the log indistinguishable from a request
           // where no retry was ever eligible (#5044).
           ctx.onRecoveryWithheld?.({ reason: "retry-send-budget" });
-          return ctx.returnRawErrors ? pendingResponse : normalizeFinalGoogleError(label, pendingResponse, ctx.abortSignal);
+          return ctx.returnRawErrors ? pendingResponse : normalizeFinalGoogleError(label, pendingResponse, activeRequest, ctx.abortSignal);
         }
         throw err;
       }

src/codex/catalog/antigravity-discovery.ts

@@ -0,0 +1,59 @@
+import { getConfigDir } from "../../config/paths";
+import { getValidAccessSnapshotForAccount, type OAuthAccessSnapshot } from "../../oauth";
+import { credentialGeneration, getAccountCredentialWithStatus, getAccountSet } from "../../oauth/store";
+import { providerOutboundPost, providerRedirectError } from "../../lib/provider-outbound";
+import { isRegistryModelDiscoveryUrl, readBoundedDiscoveryJson } from "../../providers/model-discovery";
+import { parseAntigravityAvailableModels, type AntigravityAvailableModel } from "../../providers/antigravity-models";
+import { captureAntigravityModelObservation, recordAntigravityAccountRoster } from "../../providers/antigravity-account-roster";
+import type { OcxProviderConfig } from "../../types";
+import { materializeCapturedHeaders, type CapturedModelsRequest } from "./gather-capture";
+
+/** A sibling contributes only while the exact snapshot sent is still usable. */
+export async function discoverAntigravitySiblings(
+  name: string, provider: OcxProviderConfig, activeAccountId: string,
+  request: CapturedModelsRequest, maxBytes: number, maxModels: number,
+  root: string,
+): Promise<() => AntigravityAvailableModel[]> {
+  if (root !== getConfigDir()) return () => [];
+  const results: Array<{
+    snapshot: OAuthAccessSnapshot; models: AntigravityAvailableModel[];
+    observation: ReturnType<typeof captureAntigravityModelObservation>;
+  }> = [];
+  const current = (snapshot: OAuthAccessSnapshot): boolean => {
+    if (getConfigDir() !== root) return false;
+    const row = getAccountCredentialWithStatus(name, snapshot.accountId);
+    return !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
+      && credentialGeneration(row.credential) === snapshot.generation
+      && row.credential.access === snapshot.accessToken;
+  };
+  // Bound concurrency and preserve stable account order; a failed sibling is fail-soft.
+  for (const sibling of getAccountSet(name)?.accounts ?? []) {
+    if (sibling.id === activeAccountId || sibling.paused || sibling.needsReauth) continue;
+    try {
+      if (getConfigDir() !== root) break;
+      const snapshot = await getValidAccessSnapshotForAccount(name, sibling.id, { requireUsableAccount: true });
+      const project = provider.project ?? snapshot.projectId;
+      if (!project || !current(snapshot)) continue;
+      const observation = captureAntigravityModelObservation();
+      const response = await providerOutboundPost(name, provider, request.url, {
+        headers: materializeCapturedHeaders(request, snapshot.accessToken),
+        body: JSON.stringify({ project }), signal: AbortSignal.timeout(8000),
+      }, { isCanonicalUrl: isRegistryModelDiscoveryUrl, beforeSend: () => current(snapshot) });
+      if (!response.ok || await providerRedirectError(response, request.url)) continue;
+      const bounded = await readBoundedDiscoveryJson(response, maxBytes);
+      if (!bounded.ok) continue;
+      const models = parseAntigravityAvailableModels(bounded.value, maxModels);
+      if (models && current(snapshot)) results.push({ snapshot, models, observation });
+    } catch { /* A sibling cannot invalidate successful active-account discovery. */ }
+  }
+  // Called synchronously with the catalog publication, after all outbound awaits.
+  return () => {
+    const union: AntigravityAvailableModel[] = [];
+    for (const { snapshot, models, observation } of results) {
+      if (!current(snapshot)) continue;
+      recordAntigravityAccountRoster(name, snapshot.accountId, models, Date.now(), observation);
+      union.push(...models);
+    }
+    return union;
+  };
+}

src/codex/catalog/provider-models.ts

@@ -53,7 +53,8 @@ import {
 import type { FastPolicyAuthority } from "../../providers/fastwire";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../../providers/registry";
 import { parseAntigravityAvailableModels, registerAntigravityDiscoveredWireModels } from "../../providers/antigravity-models";
-import { recordAntigravityAccountRoster } from "../../providers/antigravity-account-roster";
+import { captureAntigravityModelObservation, recordAntigravityAccountRoster } from "../../providers/antigravity-account-roster";
+import { discoverAntigravitySiblings } from "./antigravity-discovery";
 import { applyProviderContextCap, providerContextCap, resolveUnknownRoutedContextWindow } from "../../providers/context-cap";
 import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { effectiveModelAliases } from "../../providers/default-aliases";
@@ -729,6 +730,7 @@ export async function fetchProviderModelsWithAuth(
     // fetch a different URL and keep the rejection.
     if (!maySendAnthropicDiscovery()) return observed(withConfiguredRetention(failedDiscoveryConfigured), "degraded");
     const outboundDependencies = { isCanonicalUrl: isRegistryModelDiscoveryUrl, beforeSend: maySendAnthropicDiscovery };
+    const antigravityObservation = cloudCodeAssist ? captureAntigravityModelObservation() : undefined;
     const res = request.method === "POST"
       ? await providerOutboundPost(name, prov, url, {
         headers,
@@ -790,7 +792,21 @@ export async function fetchProviderModelsWithAuth(
       return observed(models, "degraded");
     }
     if (antigravity) {
-      const upstream: CatalogModel[] = antigravity.map(model => ({
+      if (getConfigDir() !== metadataConfigDir) return observed(withConfiguredRetention(configured), "degraded");
+      const admitSiblings = resolveAuth.kind === "refreshing" && name === "google-antigravity"
+        && prov.authMode === "oauth" && auth.oauthAccountId
+        ? await discoverAntigravitySiblings(name, prov, auth.oauthAccountId, request, discovery.maxResponseBytes, discovery.maxModels, metadataConfigDir)
+        : () => [];
+      if (!isCurrentCacheGeneration() || getConfigDir() !== metadataConfigDir) return observed(withConfiguredRetention(configured), "degraded");
+      const activeAccount = auth.oauthAccountId ? getAccountCredentialWithStatus(name, auth.oauthAccountId) : null;
+      if (auth.oauthAccountId && (!activeAccount || activeAccount.paused || activeAccount.needsReauth
+        || activeAccount.credential.expires <= Date.now() || activeAccount.credential.access !== apiKey
+        || credentialGeneration(activeAccount.credential) !== auth.oauthGeneration))
+        return observed(withConfiguredRetention(configured), "degraded");
+      const byId = new Map(antigravity.map(model => [model.id, model]));
+      for (const model of admitSiblings()) if (!byId.has(model.id)) byId.set(model.id, model);
+      const merged = [...byId.values()];
+      const upstream: CatalogModel[] = merged.map(model => ({
         id: model.id,
         provider: name,
         // Only an exact discovered wire map proves a new model's selectable effort ladder.
@@ -810,13 +826,13 @@ export async function fetchProviderModelsWithAuth(
       }
       // Save exact family routes before publishing synthetic IDs. These synchronous writes
       // cannot interleave with a credential-generation change; failure keeps the prior cache.
-      registerAntigravityDiscoveredWireModels(prov.baseUrl, antigravity, {
+      registerAntigravityDiscoveredWireModels(prov.baseUrl, merged, {
         provider: name,
         cacheGeneration,
       });
       // Entitlement is per account (Claude 4.6 vs 5.5, Argon): remember what THIS account
       // lists so account selection can prefer one that serves the requested model.
-      if (auth.oauthAccountId) recordAntigravityAccountRoster(name, auth.oauthAccountId, antigravity);
+      if (auth.oauthAccountId) recordAntigravityAccountRoster(name, auth.oauthAccountId, antigravity, Date.now(), antigravityObservation);
       if (!setCached(name, forCache, Date.now(), cacheGeneration, catalogAuthority)) {
         return observed(withConfiguredRetention(configured), "degraded");
       }