Repository navigation
[Bug]: Antigravity: GOOGLE_APPLICATION_CREDENTIALS in provider env is saved but never reaches the runtime #30413
Description
Before submitting
- I searched existing issues and did not find a duplicate.
- I included enough detail to reproduce or investigate the problem.
Area
apps/server
Steps to reproduce
- Antigravity provider, Sign-in method "Agent Platform (Vertex AI)", with a GCP project and location set and
AGY_ADC_AUTHin the provider environment. - In Settings > Providers > Antigravity > Environment variables, add
GOOGLE_APPLICATION_CREDENTIALS= path to a service-account JSON key. Save. - Start a new Antigravity thread and send a message.
- Inspect the spawned
agy_acp_server.parprocess:tr '\0' '\n' </proc/<pid>/environ | grep -E '^(AGY|GOOGLE)_'.
Expected behavior
GOOGLE_APPLICATION_CREDENTIALS reaches the Antigravity runtime, so Vertex calls authenticate as the service account. Standalone agy honours the variable: AGY_ADC_AUTH=true GOOGLE_APPLICATION_CREDENTIALS=key.json agy -p "hi" works on the same machine.
If T3 deliberately strips the variable, the settings UI should say so instead of accepting and saving it.
Actual behavior
The value is saved (a provider-env-…-GOOGLE_APPLICATION_CREDENTIALS.bin secret appears at 19:33:52, and settings.json lists the entry). The runtime spawned at 19:34:55 has only AGY_ADC_AUTH=true and AGY_ACP_FORCE_FILE_STORAGE=1. GOOGLE_APPLICATION_CREDENTIALS is missing, so the runtime falls back to the user ADC file.
Why it matters: in Google Workspace orgs with Google Cloud session control, user ADC expires every N hours with invalid_grant "reauth related error (invalid_rapt)". A service-account key is the standard fix, and this route to it is silently blocked.
Workaround: overwrite ~/.config/gcloud/application_default_credentials.json with the service-account key. That works, but it changes ADC for every tool on the machine.
Impact
Major degradation or frequent failure
Version or commit
T3 Code 0.1.6 (Linux AppImage), managed Antigravity ACP runtime release 2e37012c…, agy 1.4.12
Environment
Linux Mint 22.3 (kernel 6.8), desktop app, Antigravity with authMethod: "agent-platform" on a paid GCP project (credits, not an AI Pro subscription)
Related: #23036 (Agent Platform ADC setup gaps).
Activity
CoreyKatzburg commentedon Nov 11, 2026
Also having this issue on Windows 10, T3 Code 0.1.9-nightly.20261111.4501, with the
agyCLI 1.5.5 as binary path. It now blocks Gemini 4 Carbon, which the 1.5.5 CLI lists only for ADC sign-in (AGY_ADC_AUTH). With this variable dropped, every ADC instance runs as whatever account is in the machine's default ADC file, and the quota project comes from that file too (GOOGLE_CLOUD_PROJECTdoesn't override it). Details: #34395.Cause:
removedEnvironmentKeysinapps/server/src/provider/antigravityAuthSupport.tsincludesGOOGLE_APPLICATION_CREDENTIALS.antigravityEnvironmentapplies it tobaseEnv, which already has the instance environment merged in (mergeProviderInstanceEnvironmentin the driver). So a value set explicitly on the instance is removed along with any inherited copy.Suggested fix: strip these keys only when they're inherited from the process environment, and keep them when they're set in the instance's own environment. The isolation from stray machine-wide credentials stays, and an explicit per-instance choice wins.