Antigravity — VS Code extension with Google sign-in

A companion extension for Google Antigravity: sign in with your Google account via OAuth 2.0 (PKCE, loopback flow) and keep the session refreshed. The stored access token is the foundation for later phases (talking to Google APIs / Antigravity tooling on your account's behalf).

How users sign in

Each user runs Antigravity: Sign in with Google. Their browser opens Google's own login page where they enter their email and password (and 2-step verification if enabled). The extension never sees or stores the password — it only receives OAuth tokens for that user's account, which is how Google requires third-party apps to work. Each machine/user gets an independent session.

One-time setup — publisher only (not end users)

You, as the extension author, create ONE OAuth client that ships inside the extension. Users never touch Google Cloud Console.

1. Go to https://console.cloud.google.com/apis/credentials
2. Configure the OAuth consent screen:
   • User type: External (so any Google account can sign in)
   • Fill in app name, support email, scopes openid email profile
   • While the app is in Testing status only accounts you list as test users can sign in (max 100). Click Publish app to open it to everyone. With only the basic openid/email/profile scopes, publishing does not require Google's verification review.
3. Create an OAuth client ID of type Desktop app.
4. Paste the ID and secret into EMBEDDED_CLIENT_ID / EMBEDDED_CLIENT_SECRET at the top of src/extension.ts, then package the extension (npx @vscode/vsce package) and share the .vsix.

The antigravity.googleClientId/googleClientSecret settings remain as developer overrides for testing with a different client; end users leave them empty.

Build & run

npm install
npm run compile

Press F5 in VS Code to launch the Extension Development Host. If .vscode/launch.json is missing, create it with:

{
  "version": "0.2.0",
  "configurations": [
    {
      "name": "Run Extension",
      "type": "extensionHost",
      "request": "launch",
      "args": ["--extensionDevelopmentPath=${workspaceFolder}"],
      "outFiles": ["${workspaceFolder}/out/**/*.js"]
    }
  ]
}

Commands

• Antigravity: Sign in with Google — opens your browser for consent, captures the callback on a local loopback port, stores tokens in VS Code's SecretStorage.
• Antigravity: Show signed-in account — shows account + token expiry.
• Antigravity: Sign out — clears stored tokens.

A status-bar item (bottom right, rocket icon) shows the signed-in account.

What to test

1. Set the client ID/secret, run Sign in with Google → browser opens, consent, tab says "Signed in", VS Code toast shows your email. Debug log: [antigravity] auth code received, exchanging for tokens.
2. Reload the window → status bar still shows your email (tokens persisted).
3. Wait past expiry (~1 h) or temporarily lower the 60 s skew in getValidTokens, run Show signed-in account → log shows [antigravity] refreshing access token.
4. Sign out → status bar returns to "sign in".

Security notes

• Tokens live in context.secrets (Windows Credential Manager under the hood), never in settings or files.
• PKCE + state check protect the loopback callback; the local server only binds 127.0.0.1 and closes immediately after one callback.
• Google treats desktop-app client secrets as non-confidential; keeping it in user settings is standard for this flow.