Repository navigation
Conversation
Antigravity usage mirrored the Gemini CLI quota read, which Google now rejects for individual accounts (UNSUPPORTED_CLIENT), so the status bar never showed Antigravity usage. Read `agy --print /usage --output-format json` instead (version-gated to agy >= 1.1.11, using the configured executable), and show the Gemini and Claude/GPT pools with their 5h and weekly windows. Standalone port of the quota portion of stablyai#21654 and stablyai#21678, which are stacked behind unmerged PRs, onto current main. Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> Co-authored-by: Abhishek AI <325505575+abti-ai@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces the fork's local language-server probe (superseded, stablyai#22862 closed) with the agy CLI /usage fetcher, so quota shows without the Antigravity app running. Keeps the fork's Cursor mocks and win32 test expectations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (36)
💤 Files with no reviewable changes (2)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughAntigravity quota data now comes from the Priority: ➖ Normal Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to Independent Antigravity quota fetching has no identified merge-blocking issue. The reviewed cancellation and default-command visibility paths remain intact. Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to Quota refresh now runs the installed Antigravity CLI independently of the Gemini setting. Fixed arguments, a minimum-version check, time limits, and cancellation reduce the risk, but the behavior of the selected executable remains an important dependency. No specific security flaw was established. Retained concerns Security review detailsSecurity Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
The Antigravity quota-command guard accepts a leading env-assignment override (ACCOUNT=x agy) and then silently drops the assignment, so the quota read can use a different account than the user's terminal. A second, smaller propagation gap is inline too.
Reviewed changes
- New
agyquota fetcher (antigravity-usage-fetcher.ts) — runsagy --versiongated at 1.1.11, thenagy --print /usage --output-format jsonwith a fixed argv, timeouts, cancellation and JSON parsing into grouped 5h/weekly buckets. - Executable selection (
antigravity-usage-command.ts) — resolves the configured override to a single executable and refuses overrides that carry extra arguments. - Service integration — Antigravity becomes its own fetch lane; the Gemini mirror is deleted; the configured command is tracked across cycles and stale data is dropped when it changes.
- Renderer — groups Antigravity buckets by pool with native Session/Weekly labels across the status bar, roster and tooltip, and drops the Gemini-OAuth dependency from Antigravity availability.
- Types —
RateLimitWindow/RateLimitBucketgain optionalwindowLabel,id,groupName,groupDescription.
I verified the parser's command.data.groups[].buckets[] shape, the remaining_fraction direction, and the 1.1.11 version gate against the vendor docs/release notes and captured payloads — all consistent. I also confirmed hasReachedAppVersion fails closed on 1.1.11-rc.1, empty, and warning: 1.2.7 output.
ℹ️ Antigravity quota is read from the machine running Orca
fetchAntigravityRateLimits shells out to the local agy, so on a remote or WSL workspace the bar reflects the local machine's Antigravity account — or unavailable when agy is absent locally even though it exists on the host. The previous Gemini mirror read locally as well, so this is not a regression, but the entry now presents itself as native Antigravity usage without naming the host. This is called out as unverified in the PR body; confirming that local-only is the intended scope would be worth a sentence.
Technical details
# Antigravity quota host scope
## Affected sites
- `src/main/rate-limits/antigravity-usage-fetcher.ts` — `resolveAntigravityUsageCommand` /
`execFileCaptureToTermination` run on the Orca main process host, not the workspace host.
- `src/main/startup/main-process-account-services.ts:138` — resolver reads local settings.
## Open question for the human
- Is local-only Antigravity quota the intended contract for SSH/WSL workspaces, or should the
entry be hidden/suffixed when the active workspace runs on a remote host?ℹ️ Nitpicks
groupDescriptionis parsed (antigravity-usage-fetcher.ts:70) and threaded throughRateLimitBucket,getWindowSectionsandUsageSection, but no renderer reads it — the parser could drop it until a surface needs it.
DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏
| platform: NodeJS.Platform = process.platform | ||
| ): { ok: true; command: string } | { ok: false; error: string } { | ||
| const plan = planAgentBinary('agy', override, platform === 'win32' ? 'literal' : 'escape') | ||
| if (!plan.ok || plan.prefixArgs.length > 0) { |
There was a problem hiding this comment.
planAgentBinary lifts a leading NAME=value token into plan.env, so an override like ACCOUNT=x agy tokenizes to env={ACCOUNT:x} with an empty prefixArgs and passes this guard; the env is then silently discarded when /usage is spawned, so the quota read can hit a different account than the user's terminal. Reject when plan.env is set, or thread it into the fetch.
The test's env ACCOUNT=test agy case is rejected only because env becomes the binary, so it does not cover this.
Technical details
# Env-assignment override escapes the executable-only guard
## Affected sites
- `src/main/rate-limits/antigravity-usage-command.ts:10` — only checks `plan.prefixArgs`, not `plan.env`.
- `src/main/rate-limits/antigravity-usage-fetcher.ts:192` — spawns `AGY_USAGE_ARGS` with no env override.
## Required outcome
- An override that carries environment assignments must not be silently used without them; either refuse it (consistent with the "only the executable path" error) or pass `plan.env` through to the spawn.| if (!plan.ok || plan.prefixArgs.length > 0) { | |
| if (!plan.ok || plan.prefixArgs.length > 0 || plan.env) { |
| detectedAgentIds: TuiAgent[] | null, | ||
| settings?: Pick<GlobalSettings, 'agentCmdOverrides'> | null | ||
| ): boolean { | ||
| if (id === 'antigravity' && hasExplicitTuiLaunchCommand(settings, 'antigravity')) { |
There was a problem hiding this comment.
The new settings-aware branch is reached by StatusBarVisibilityMenu and use-status-bar-controller, but useAvailableStatusBarToggles (use-available-status-bar-toggles.ts:11) still calls with two arguments. As a result the Appearance pane hides the Antigravity toggle when agy is not on PATH even though a custom launch command is configured, while the status-bar menu shows it. Threading settings through that hook would keep availability consistent.
This branch has not been deployed
1 participant
ELI5
The Antigravity entry in the status bar never shows usage for personal Google accounts. Orca was borrowing the Gemini CLI's quota, and Google now refuses that request. This PR asks the Antigravity CLI (
agy) for its own numbers instead, so the entry shows real usage without the Antigravity app running.What Changed
loadCodeAssistnow returns no project and marks the free tierUNSUPPORTED_CLIENT("migrate to Antigravity"), so the entry always says usage is unavailable. It also stayed hidden unless Gemini CLI OAuth was turned on.agy --print /usage --output-format jsonwith fixed arguments, a timeout, and cancellation support. It shows both Antigravity pools, Gemini models and Claude/GPT, each with its 5-hour and weekly window and reset time. The Gemini-to-Antigravity mirror is removed. The Antigravity entry no longer depends on the Gemini OAuth toggle.agy --versionmust report 1.1.11 or newer before/usageis run, because older versions treat/usageas a paid model prompt. A custom Antigravity command is used when it is a plain executable path. A command with extra arguments is refused rather than run as a quota query.Why
This is not new design. It is the quota part of #21654 and #21678, which a maintainer already reviewed and chose over the language-server and keychain approaches, ported onto current
main. Those PRs were merged into a long stacked branch, and that stack is still blocked by unmerged PRs such as #21653, somainstill ships the Gemini mirror. Taking only the quota files lets this fix land on its own.Compared with the other approaches:
Conflicts with current
mainwere small: the new OpenCode Go fetch call, Cursor bucket visibility inStatusBarProviderSegment, and the OpenCode Go API-key visibility signal. The newerservice-cursor-usage.test.tsneeded a mock for the Antigravity fetcher.Linked Issue
Fixes #9122. Addresses #19561, #22511, #23008, and the quota part of #19587 and #17345.
Visual Proof
No screenshot. The app could not be launched from this worktree because the native module rebuild fails on this machine. Instead, the real fetcher was run against a signed-in
agy1.2.12 on Windows 11 and returnedstatus: okwith four buckets:The CLI reported
num_turns: 0andtotal_tokens: 0for this probe. The rendering is unchanged from #21654 and #21678; see the proof in #21678.Testing
On Windows,
tscpassed for both the node and web configs,oxlintwas clean, andcheck-changed-code-qualitypassed with 0 findings. The vitest run oversrc/main/rate-limitsandsrc/renderer/src/components/status-barhad 1070 passing and 10 failing. The same 10 tests fail on unmodifiedmainon this machine (Codex RPC, OpenCode XDG path, Claude WSL target), so this PR adds no new failures. macOS and Linux were not run locally.Pitfall for reviewers testing by hand on Windows: from Git Bash, MSYS rewrites
/usageinto a file path, andagythen runs a real, billable model turn. Test from PowerShell or cmd. Orca spawnsagydirectly, so it is not affected.AI Disclosure
Ported and verified with Claude (Opus 5.5). The original implementation is by @abti-ai (#20797) and @nwparker (#21654, #21678), both credited as co-authors on the commit.
Review
Agent skill upstream boundary
docs/reference/agent-skill-sharing-upstream-boundary.mdand copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.Notes
agyon the machine running Orca. Remote and WSL quota were not verified.--versioncall and one/usagecall per refresh, each with a 10-second limit.Checklist
N/Awith reasonpnpm lint,pnpm typecheck,pnpm test, andpnpm buildpass (or CI will cover; local preferred)🤖 Generated with Claude Code