Problem
Antigravity's manual OAuth callback path does not recognize provider denial URLs. A pasted callback containing error=access_denied and the current login's state is discarded because it has no code. The login requests another manual input instead of reporting the denial. If the user stops responding, the original failure is eventually replaced by a cancellation or timeout.
The localhost HTTP callback path already rejects the same matching-state response with Authorization failed: access_denied.
Observed against main f6b49ae59605b1276b8267f2886d22c03f01533c, Node 22.22.3 on Windows, using the real loginAntigravity entry point and localhost callback server with synthetic OAuth data. No live account was used.
Value
Users relying on manual callback entry, including browser/terminal sessions on different machines, should get the original authorization failure promptly. A rejected sign-in is not another request for an authorization code.
Approach
Keep the existing OAuth owner and both input paths. Recognize an error response in manual callback parsing and reject only when its state exactly matches this login. Keep mismatched or missing-state denial URLs non-terminal, and preserve successful callback and raw-code behavior.
No provider routing, credentials, refresh policy, or new authentication surface is needed.
Validation
Reproduction using the real login function:
- Capture the generated authorization URL's
redirect_uri and state from onAuth.
- Return
<redirect_uri>?error=access_denied&state=<current-state> from onManualCodeInput without sending an HTTP callback.
- Record whether the manual input callback is invoked again and whether token exchange runs.
Expected: one prompt, rejection with Authorization failed: access_denied, no token exchange.
Before fix: the second prompt is reached. A deterministic test aborts there to avoid waiting for the login deadline and observes Login cancelled, failing the expected original error assertion. The five success/state controls pass on the unchanged code.
The regression suite should also retain raw authorization codes, successful callback URLs with and without state, and ignoring denial URLs with wrong or absent state until valid input arrives.
Impact
- User-visible: preserves the original matching authorization denial instead of asking repeatedly or timing out.
- Model-visible context/tools: none.
- Runtime/lifecycle: the manual path should terminate the existing callback/input race on an authenticated denial, using its existing cleanup.
- Persisted config/data: none.
- Compatibility/risk: successful manual inputs stay compatible; only an exact matching-state error may terminate the login.
Problem
Antigravity's manual OAuth callback path does not recognize provider denial URLs. A pasted callback containing
error=access_deniedand the current login'sstateis discarded because it has nocode. The login requests another manual input instead of reporting the denial. If the user stops responding, the original failure is eventually replaced by a cancellation or timeout.The localhost HTTP callback path already rejects the same matching-state response with
Authorization failed: access_denied.Observed against main
f6b49ae59605b1276b8267f2886d22c03f01533c, Node 22.22.3 on Windows, using the realloginAntigravityentry point and localhost callback server with synthetic OAuth data. No live account was used.Value
Users relying on manual callback entry, including browser/terminal sessions on different machines, should get the original authorization failure promptly. A rejected sign-in is not another request for an authorization code.
Approach
Keep the existing OAuth owner and both input paths. Recognize an error response in manual callback parsing and reject only when its state exactly matches this login. Keep mismatched or missing-state denial URLs non-terminal, and preserve successful callback and raw-code behavior.
No provider routing, credentials, refresh policy, or new authentication surface is needed.
Validation
Reproduction using the real login function:
redirect_uriandstatefromonAuth.<redirect_uri>?error=access_denied&state=<current-state>fromonManualCodeInputwithout sending an HTTP callback.Expected: one prompt, rejection with
Authorization failed: access_denied, no token exchange.Before fix: the second prompt is reached. A deterministic test aborts there to avoid waiting for the login deadline and observes
Login cancelled, failing the expected original error assertion. The five success/state controls pass on the unchanged code.The regression suite should also retain raw authorization codes, successful callback URLs with and without state, and ignoring denial URLs with wrong or absent state until valid input arrives.
Impact