feat(antigravity): add experimental native Messages provider

[chris7iu]

Summary

Add an experimental, opt-in, default-off native Antigravity provider for Anthropic Messages and local count_tokens. This is not an agy subprocess wrapper: agent-executed tools cannot serve as faithful external Messages tool turns.

Supported exact selectors:

• antigravity/gemini-4-argon-low
• antigravity/gemini-4-argon-medium
• antigravity/gemini-4-argon-high

Enablement is explicit (CCP_ANTIGRAVITY_ENABLED=1 or antigravity.enabled configuration). Default-disabled model discovery remains unchanged. This draft requests code/protocol review; live Google authentication, entitlement and native-generation acceptance have not been verified by this contribution.

Provider and session contract

• Native transport targets the Cloud Code Assist generation API, with proxy identification by default and an explicit native-API User-Agent override, bounded requests, no redirects and no automatic inference retries.
• One fixed model/tier/profile/project session. Changing the selector or account/project requires a fresh client session; observed Claude Code behavior strips replay carriers across model changes.
• Text/system/client-tool turns, bounded signed-history replay, and an explicit schema adapter with original-schema validation and lossless JSON-string codecs where native schema projection is insufficient. Codec guidance preserves complete accepted constraints and rejects oversized guidance rather than truncating it.
• Completed parameterless native calls may omit args; caller input is {}, while native replay retains the original omission. Unsupported incremental arguments, media/server tools, forced-tool semantics and ambiguous repeated same-name ID-less parallel calls remain rejected.
• Native output is bounded and collected into a validated signed turn; Messages streaming does not claim native-token latency or incremental-tool-argument parity.
• Conservative, unmeasured 200,000-token client advertisement. No [1m] alias or verified native 1M claim. Model tier governs native thinking; generic effort hints cannot switch tiers.
• OpenAI-compatible generation is explicitly not implemented for this provider.

Replay boundary

The versioned ccp:antigravity:v1: envelope retains raw native contents/signatures, stable session identity, caller/native tool mapping and codec information. Omitted/full visible thinking has the same reconstructed semantic history and local token estimate.

Its digest is consistency checking, not authentication. It does not authenticate every opaque native signature byte. A mutation confined to opaque signature material may pass local consistency and be rejected by the upstream after one attempt; the provider does not repair signatures, retry inference or log the carrier.

Authentication, cancellation and privacy

• Explicit OAuth consent, PKCE S256 and independent one-time state; no automatic agy/Codex/Gemini credential import, account rotation or hidden onboarding.
• Separate proxy-owned private credential storage; missing, corrupt and unreadable states are distinct. A stable sibling lock and profile/epoch checks protect login/logout/refresh, rather than locking the replaceable credential inode.
• Refresh maintenance is manager-owned and single-flight. It acquires a bounded lock before network effects; validated token rotation is persisted independently of request cancellation and the network timer. Failed persistence retains a scoped pending replacement and never retries an obsolete refresh token. Ambiguous refresh outcomes require login. This does not promise crash-proof remote OAuth transactions.
• Request cancellation owns generation transport only; it does not detach inference. Controlled TCP tests cover disconnection before native headers and during body collection. Local logout does not require valid transport configuration and does not touch another provider's files.
• Incoming client credentials are not forwarded to native generation. Provider traffic/error reporting excludes prompts, carriers, signatures, tokens and account/project identifiers.

Explicit User-Agent compatibility override

The default HTTP User-Agent is exactly claude-code-proxy/<package version>. CCP_ANTIGRAVITY_USER_AGENT, then antigravity.userAgent, can supply a full verbatim override for generation and loadCodeAssist only. OAuth code exchange and refresh retain the proxy default; generic CCP_USER_AGENT and incoming client headers do not select this override.

The documented optional agy1.3.5 example comes from pinned public protocol evidence. It is not auto-detected, automatically enabled, or a claim to match the installed/current agy1.4.2 client. No version/changelist/platform fields are synthesized or rewritten in an explicit override.

Validation rejects empty/outer-whitespace, control/non-ASCII, overlong and non-Unicode values before native requests; headers are marked sensitive and errors/status omit raw values. Tests assert exactly one UA across native and OAuth operations, default/override precedence, hostile incoming-header isolation and unchanged no-retry/no-redirect behavior.

A focused regression exposed existing full-environment UTF-8 snapshots panicking before native validation. The follow-up excludes only this independently OS-string-validated key from legacy snapshot iteration, preserving other valid entries/order/collection behavior. Invalid native configuration remains provider-scoped; unrelated non-Unicode entries still fail, now with fixed redacted panic text. Linux CLI and injected Windows ASCII-name comparisons are tested; no Windows runtime claim is made.

Read-only capability contract

GET /v1/models?include_capabilities=true adds a versioned native-provider capability descriptor. Plain /v1/models remains baseline-compatible when disabled. antigravity auth status --json exposes the same safe local descriptor; exit 0 means a report was emitted, not that the provider is ready.

Capability/status reads do not refresh credentials, look up projects, run inference or create directories. Serving metadata comes from the serving provider instance. Local configuration readiness is not proof of Google access.

Validation

All checks used disposable offline, non-root containers with private process/network namespaces, isolated homes/configuration and synthetic endpoints. No live gateway, credentials or host auth sockets were mounted.

• Baseline: 1,119 Rust tests passed.
• Final candidate under ordinary process umask 0022: formatting, Clippy with -D warnings, build and 1,222 Rust tests passed. Credential/evidence/cache roots remained private, and source hashes were unchanged during the run.
• 83 Python unit/HTTP tests passed (the original 47 plus 36 portable-launcher/identity controls), with no actual Claude process launched for that fixture run. Those Python/fixture files are unchanged by the subsequent User-Agent follow-up; the Python suite was not unnecessarily rerun. Synthetic parameterless-call golden bytes match Rust; the original v1 field/digest format and earlier golden vectors remain unchanged.
• The optional developer launcher requires an explicit local image and native ELF executable, validates the nonroot caller, keeps host-only cleanup evidence separate from container-writable output, and never pulls images or launches Claude on the host. Its revised lifecycle is unit-tested with process stubs, not a fresh actual-client execution.
• Tests-first regressions cover schema-guidance loss (including typeless anyOf siblings), credential mode handling, cancellation-independent refresh persistence, failed-write recovery, profile/epoch/logout races, effective-target raw-byte validation, assistant-fragment boundaries, parameterless-call replay and display-independent estimates.
• Existing-provider regression tests are included in the full Rust gate. Status/error/Retry-After and single-attempt behavior have synthetic transport controls; reqwest retries are explicitly disabled.
• Earlier isolated real-Claude-Code compatibility runs against a fake endpoint informed the fixed-model contract. They are historical evidence, not a fresh end-to-end verification of the final changed fixtures or Google's service.

An independent read-only review's concrete findings were reproduced and fixed; a second pass found and verified the additional typeless-anyOf guidance correction. Runtime acceptance remains a separate gate despite the passing local suite.

Protocol provenance and limitations

Implementation is based on pinned public MIT-licensed protocol evidence from cortexkit/antigravity-auth at f5a836df058a99cee6099ad308b9675e4ef11026, with provenance/licensing recorded in the contribution. Reference observations for the low tier are distinct from catalog-inferred medium/high encodings; none establish this user's entitlement or an official service guarantee.

No device identity/attestation copying, missing-signature sentinel, signature stripping, borrowed account/project identity or provider fallback is added. The optional User-Agent override is explicit compatibility metadata, not proof of official-client identity or entitlement. No binary/version installation or production activation is part of this PR. The dependent model-gateway frontend contribution is separate and must validate this native capability contract rather than assume a release already contains it.

🤖 Generated with Claude Code