fix(antigravity): capture token from gnome-keyring when file path not written by AGY

[ptone]

Summary

• provision.py: Save DBUS_SESSION_BUS_ADDRESS to ~/.scion/harness/.dbus-env after keyring init, so other processes (e.g. the tmux shell tab running capture_auth.py) can access the gnome-keyring
• capture_auth.py: Add keyring fallback — when the file-based capture finds no token at ~/.gemini/antigravity-cli/antigravity-oauth-token, read from gnome-keyring via secret-tool lookup and store via sciontool secret set

Fixes the no-auth capture flow where AGY writes the OAuth token to gnome-keyring but may not persist it to the expected file path.

Test plan

• Start an antigravity agent in no-auth mode
• Complete interactive login via agy
• Verify ~/.scion/harness/.dbus-env is written with the DBUS address
• Run capture_auth.py — confirm it falls back to keyring and captures AGY_TOKEN
• Verify sciontool secret get AGY_TOKEN returns the token

[gemini-code-assist]

Code Review

This pull request introduces a telemetry metrics dashboard querying Google Cloud Monitoring, adds support for tracking and re-importing harness-configs and templates from remote source URLs, and updates the Antigravity harness to use file-based OAuth tokens with an interactive credential capture flow. It also adds PROJECT_SLUG to trusted lifecycle hook variables, enables combined create-and-publish flows for skills, and implements metric batching and deduplication in the telemetry pipeline to prevent sampling-rate violations. Review feedback focuses on addressing potential nil pointer dereferences in metric merging and metrics querying, correcting image tag parsing when registry ports are present, ensuring proper environment variable fallback for AGY_TOKEN during provisioning, and validating JSON types in the credential capture script.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If the image name contains a registry port but no tag (e.g., localhost:5001/my-image), strings.LastIndex(name, ":") will match the port's colon instead of a tag separator. This results in the image name being incorrectly truncated to just the registry host (e.g., localhost).

To prevent this, ensure that the matched colon appears after the last slash / in the image path.

Suggested change

	imageBaseName := harnessConfigName
	if hcDir.Config.Image != "" {
	name := hcDir.Config.Image
	if colonIdx := strings.LastIndex(name, ":"); colonIdx >= 0 {
	name = name[:colonIdx]
	}
	imageBaseName = name
	}
	imageBaseName := harnessConfigName
	if hcDir.Config.Image != "" {
	name := hcDir.Config.Image
	if colonIdx := strings.LastIndex(name, ":"); colonIdx >= 0 {
	if slashIdx := strings.LastIndex(name, "/"); slashIdx < colonIdx {
	name = name[:colonIdx]
	}
	}
	imageBaseName = name
	}

[gemini-code-assist]

If obj is not a dictionary (e.g., it is None or a list), accessing obj.get("token") or checking "refresh_token" in obj will raise an AttributeError or TypeError before the isinstance(obj, dict) check is reached on line 83.

Validate that obj is a dictionary first before checking for the presence of the refresh token.

Suggested change

	has_refresh = (
	"refresh_token" in obj
	or (isinstance(obj.get("token"), dict) and "refresh_token" in obj["token"])
	)
	if not isinstance(obj, dict) or not has_refresh:
	print("capture-auth: token file missing refresh_token field", file=sys.stderr)
	return False
	return True
	if not isinstance(obj, dict):
	print("capture-auth: token file is not a JSON object", file=sys.stderr)
	return False
	has_refresh = (
	"refresh_token" in obj
	or (isinstance(obj.get("token"), dict) and "refresh_token" in obj["token"])
	)
	if not has_refresh:
	print("capture-auth: token file missing refresh_token field", file=sys.stderr)
	return False
	return True

[gemini-code-assist]

If AGY_TOKEN is passed as an environment variable, it is detected and added to env_keys by _present_env_keys, but _select_auth_method currently ignores env_keys when checking for AGY_TOKEN. This breaks environment-variable-based token injection.

Include a check for "AGY_TOKEN" in env_keys.

Suggested change

	has_token = "AGY_TOKEN" in secret_files or bool(_read_secret(secret_files, "AGY_TOKEN"))
	has_token = "AGY_TOKEN" in env_keys or "AGY_TOKEN" in secret_files or bool(_read_secret(secret_files, "AGY_TOKEN"))

[gemini-code-assist]

If AGY_TOKEN is passed as an environment variable, _read_secret will return an empty string, causing the validation to fail and the provisioner to exit with an error. Fall back to reading from os.environ if the secret file is not present.

Suggested change

	token_raw = _read_secret(secret_files, "AGY_TOKEN")
	if not token_raw:
	token_raw = _read_secret(secret_files, "AGY_TOKEN") or os.environ.get("AGY_TOKEN")
	if not token_raw:

[gemini-code-assist]

If either aSum.Sum or bSum.Sum is nil, accessing aSum.Sum.DataPoints or bSum.Sum.DataPoints later in the function will cause a nil pointer dereference panic. Add defensive nil checks for aSum.Sum and bSum.Sum before proceeding.

Suggested change

	func mergeMetricDataPoints(a, b *metricpb.Metric) *metricpb.Metric {
	aSum, aOK := a.Data.(*metricpb.Metric_Sum)
	bSum, bOK := b.Data.(*metricpb.Metric_Sum)
	if !aOK || !bOK {
	// For non-Sum metrics, keep the one with the latest timestamp
	return b
	}
	func mergeMetricDataPoints(a, b *metricpb.Metric) *metricpb.Metric {
	aSum, aOK := a.Data.(*metricpb.Metric_Sum)
	bSum, bOK := b.Data.(*metricpb.Metric_Sum)
	if !aOK || !bOK || aSum.Sum == nil || bSum.Sum == nil {
	// For non-Sum metrics or if Sum is nil, keep the one with the latest timestamp
	return b
	}

[gemini-code-assist]

Specify encoding="utf-8" when opening the temporary file to ensure consistent behavior across different platforms and environments.

Suggested change

	with os.fdopen(fd, "w") as f:
	f.write(token)
	with os.fdopen(fd, "w", encoding="utf-8") as f:
	f.write(token)

[gemini-code-assist]

Defensively check if p.GetValue() is nil before calling GetInt64Value() to prevent potential nil pointer dereference panics.

		for _, p := range ts.GetPoints() {
			if val := p.GetValue(); val != nil {
				total += val.GetInt64Value()
			}
		}