fix(server): preserve Antigravity startup diagnostics

[juliusmarminge]

Antigravity installation discarded the runtime's stderr, so startup failures such as disabled IPv6 appeared only as a generic validation error.

Keep the last 4 KiB of native diagnostic lines and include them when startup validation fails. Drain an exited validator's stderr before reporting failure, flush a final line without a newline, and preserve the tail of oversized native errors. The drain has a one-second bound for inherited pipes that never close. Sign-in URLs, including malformed, log-prefixed, and oversized browser-helper messages, remain excluded. The existing installed runtime stays active after validation fails.

Fixes #9800.

Verification:

• A fake runtime emits an AF_INET6 socket failure and exits before ACP initialization. Reproduced against 5a433244d, committed September 4, 2026. The base installation message contains only the generic error; this change preserves the diagnostic.
• Five additional regression cases fail against the first PR revision: unterminated and oversized diagnostics, fragmented oversized auth output, delayed stderr after process exit, and an inherited pipe. The installation fixture observes process exit before stderr is emitted; the delayed-stream test uses receipts, and the inherited-pipe test uses a virtual clock.
• Focused tests cover bounded output, absent output, fragmented lines, authentication URL exclusion, and retaining the prior installation. No Google runtime download or account is needed.
• vp test run src/provider/AntigravityInstallation.test.ts src/provider/antigravityAuthSupport.test.ts src/provider/acp/AntigravityAcpSupport.test.ts --maxWorkers=2: 104 passed.
• Targeted lint and the server typecheck passed.

This verifies error propagation with a deterministic process fixture, not native startup on an IPv6-disabled WSL kernel. Screenshots are not applicable to this server-side diagnostic fix.

GPT 6 Astra via Codex in T3 Code.

---

Note

Medium Risk
Touches install failure messaging and stderr parsing on the Antigravity/ACP path; mistakes could leak auth material into diagnostics, though the change explicitly filters sign-in output.

Overview
Antigravity install validation no longer surfaces only a generic “could not start” message when the runtime dies before ACP initialize. The server now keeps a bounded tail (4 KiB) of native stderr lines and appends them to the failed verify state message.

ACP runtime / stderr plumbing: AcpSessionRuntime adds optional onStderrEnd and, when initialize fails on an already-exited child, drains remaining stderr (with a 1s cap for inherited pipes that never EOF). Large stderr chunks are fed to handlers in slices. makeAntigravityStderrHandler is reworked to split OAuth/sign-in traffic from diagnostics, drop oversized auth fragments, expose flushDiagnostics for lines without a trailing newline, and wire through makeAntigravityAcpRuntime via onDiagnostic.

Tests cover IPv6-style failures, bounded/oversized/unterminated diagnostics, delayed stderr after exit, inherited pipes, and keeping URLs/secrets out of user-visible diagnostics.

^{Reviewed by Cursor Bugbot for commit 2126d7a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add startup-diagnostics validation-failure tests for AntigravityInstallation

Adds a parameterized test covering IPv6 diagnostics, bounded diagnostic tails, unterminated stderr, oversized diagnostics, fragmented oversized authorization messages, and absent diagnostics. The test uses a custom child-process spawner, waits for installation failure, and checks that the final native startup diagnostic is preserved while discarded prefixes and authorization content are excluded. It also confirms staging cleanup and that the previous release remains active.

^{Macroscope summarized 2126d7a.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	−11 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−7 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.7 KiB	+206 B (+1.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	−2 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.7 KiB	+208 B (+3.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	59.3 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Claude	Live turn messages	8	10	+2 (+25.0%)	21	✅

Baseline: 087cfb8 · PR result: 2126d7a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8ff4b4aa09107f2f46c0e57a82120ac9f09b3b23. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR is a focused startup-diagnostics fix with bounded output and strong regression coverage, but it also changes authentication-message parsing and filtering in production ACP code. That authentication-sensitive runtime change requires human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Orchestrator decision: prepared, not merging automatically. I reviewed the complete updated diff and the resolved findings. The tests now cover delayed/unterminated diagnostics, inherited pipes and bounded authentication-message filtering. Because the correction changes production authentication parsing, it needs your human review despite passing correctness checks. This fixes diagnostic visibility, not the underlying IPv6-disabled runtime incompatibility. GPT 6 Astra via Codex in T3 Code.

[juliusmarminge]

Superseded by #13387.