feat: auto-authenticate OpenCode and Grok, and add standalone providers (Ollama, Zed, Kiro, Cloudflare, AWS Bedrock)

apps/server/package.json

@@ -41,6 +41,7 @@
     "@ff-labs/fff-node": "0.11.0",
     "@muse-code/sdk": "1.4.6",
     "@napi-rs/keyring": "^1.3.0",
+    "@t3tools/client-runtime": "workspace:*",
     "@t3tools/provider-acp": "workspace:*",
     "@t3tools/provider-acp-registry": "workspace:*",
     "@t3tools/provider-core": "workspace:*",

apps/server/src/policy/managedProviders.ts

@@ -23,6 +23,12 @@ import { kiroClient } from "@t3tools/provider-kiro/client";
 import { museClient } from "@t3tools/provider-muse/client";
 import { openCodeClient } from "@t3tools/provider-opencode/client";
 import { piClient } from "@t3tools/provider-pi/client";
+import {
+  bedrockClient,
+  cloudflareClient,
+  ollamaClient,
+  zedClient,
+} from "@t3tools/client-runtime/provider-clients";
 import type { ProviderClientDefinition } from "@t3tools/provider-core/client";
 
 interface KnownDriver {
@@ -50,6 +56,10 @@ const PACKAGED_CLIENTS: ReadonlyArray<ProviderClientDefinition> = [
   museClient,
   openCodeClient,
   piClient,
+  ollamaClient,
+  zedClient,
+  cloudflareClient,
+  bedrockClient,
   acpRegistryClient,
 ];
 

apps/server/src/processRunner.ts

@@ -272,11 +272,11 @@ const runProcessCore = Effect.fn("processRunner.runProcessCore")(function* (
   const outputMode = input.outputMode ?? "error";
   const truncatedMarker = input.truncatedMarker ?? "";
   const extendEnv = input.env !== undefined;
-  const spawnCommand = yield* resolveSpawnCommand(
-    input.command,
-    input.args,
-    input.env === undefined ? {} : { env: input.env, extendEnv },
-  );
+  const spawnCwd = input.spawnCwd ?? input.cwd;
+  const spawnCommand = yield* resolveSpawnCommand(input.command, input.args, {
+    ...(input.env === undefined ? {} : { env: input.env, extendEnv }),
+    ...(spawnCwd ? { cwd: spawnCwd } : {}),
+  });
 
   const toSpawnError = (cause: unknown) =>
     new ProcessSpawnError({

apps/server/src/provider/AntigravityProvider.test.ts

@@ -135,6 +135,12 @@ const makeHarness = Effect.fn("makeAntigravityProviderHarness")(function* (
     readonly enabled?: boolean;
     readonly safe?: boolean;
     readonly probeUsage?: Effect.Effect<ServerProviderUsageLimits>;
+    readonly probeAuth?: Effect.Effect<{
+      readonly authenticated: boolean;
+      readonly type?: string;
+      readonly label?: string;
+      readonly email?: string;
+    }>;
   } = {},
 ) {
   const initialProbe = yield* Deferred.make<EffectAcpSchema.InitializeResponse, ProbeError>();
@@ -150,6 +156,7 @@ const makeHarness = Effect.fn("makeAntigravityProviderHarness")(function* (
       stampIdentity: (snapshot) => Effect.succeed({ ...snapshot, instanceId, driver }),
       ...(options.auth ? { auth: options.auth } : {}),
       ...(options.probeUsage ? { probeUsage: options.probeUsage } : {}),
+      ...(options.probeAuth ? { probeAuth: options.probeAuth } : {}),
       probe: Ref.update(probeCalls, (count) => count + 1).pipe(
         Effect.andThen(Ref.get(probe)),
         Effect.flatten,
@@ -394,11 +401,75 @@ it.layer(layerTest)("Antigravity provider snapshots", (it) => {
     ),
   );
 
+  it.effect(
+    "updates status, email, and text generation when probeAuth transitions from authenticated to unauthenticated",
+    () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const probeAuthRef = yield* Ref.make<
+            Effect.Effect<{
+              readonly authenticated: boolean;
+              readonly type?: string;
+              readonly label?: string;
+              readonly email?: string;
+            }>
+          >(
+            Effect.succeed({
+              authenticated: true,
+              type: "oauth-personal",
+              label: "Google account",
+              email: "user@example.com",
+            }),
+          );
+          const harness = yield* makeHarness({
+            probeAuth: Effect.flatten(Ref.get(probeAuthRef)),
+          });
+          yield* harness.initialize;
+
+          const authenticatedSnapshot = yield* harness.provider.snapshot.getSnapshot;
+          expect(authenticatedSnapshot).toMatchObject({
+            installed: true,
+            status: "ready",
+            auth: {
+              status: "authenticated",
+              type: "oauth-personal",
+              label: "Google account",
+              email: "user@example.com",
+            },
+            supportsTextGeneration: true,
+          });
+
+          // Transition to unauthenticated
+          yield* Ref.set(
+            probeAuthRef,
+            Effect.succeed({
+              authenticated: false,
+              type: "oauth-personal",
+              label: "Google account",
+            }),
+          );
+          const unauthenticatedSnapshot = yield* harness.provider.snapshot.refresh;
+          expect(unauthenticatedSnapshot).toMatchObject({
+            installed: true,
+            status: "warning",
+            auth: {
+              status: "unauthenticated",
+            },
+            supportsTextGeneration: false,
+          });
+          expect(unauthenticatedSnapshot.auth).not.toHaveProperty("email");
+        }),
+      ),
+  );
+
   it.effect("clears all account metadata on sign-out and authentication failure", () =>
     Effect.scoped(
       Effect.gen(function* () {
         const auth = { type: "gemini-api-key", label: "Gemini API key" };
-        const harness = yield* makeHarness({ auth });
+        const harness = yield* makeHarness({
+          auth,
+          probeAuth: Effect.succeed({ authenticated: false }),
+        });
         yield* harness.initialize;
         for (const clear of [harness.provider.onSignedOut, harness.provider.onAuthRequired]) {
           yield* harness.provider.onSessionStarted(started, "/workspace");

apps/server/src/provider/AntigravityProvider.ts

@@ -165,6 +165,15 @@ interface AntigravityProviderOptions {
   readonly clearUsage?: Effect.Effect<void>;
   readonly maintenanceCapabilities?: ProviderMaintenanceCapabilities;
   readonly auth?: { readonly type: string; readonly label: string };
+  readonly probeAuth?: Effect.Effect<
+    | {
+        readonly authenticated: boolean;
+        readonly type?: string;
+        readonly label?: string;
+        readonly email?: string;
+      }
+    | undefined
+  >;
 }
 
 export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(function* (
@@ -292,16 +301,44 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
               : `Antigravity did not respond to its local health check within ${HEALTH_CHECK_TIMEOUT}.`;
     const supportsTextGeneration =
       initialized !== undefined ? yield* options.supportsTextGeneration : false;
+    const probedAuth =
+      initialized !== undefined && options.probeAuth
+        ? yield* options.probeAuth.pipe(Effect.orElseSucceed(() => undefined))
+        : undefined;
     const updatedAt = DateTime.formatIso(yield* DateTime.now);
     const next = yield* SubscriptionRef.updateAndGet(metadata, (state) => {
       if (state.authRevision !== before.authRevision) return state;
       const { message: _previousMessage, ...draft } = state.draft;
-      const authenticated = draft.auth.status === "authenticated";
+      const authStatus =
+        probedAuth !== undefined
+          ? probedAuth.authenticated
+            ? "authenticated"
+            : "unauthenticated"
+          : draft.auth.status;
+      const authenticated = authStatus === "authenticated";
+      const authType =
+        probedAuth !== undefined
+          ? probedAuth.authenticated || usesCredentials
+            ? (probedAuth.type ?? options.auth?.type)
+            : undefined
+          : (draft.auth.type ?? options.auth?.type);
+      const authLabel =
+        probedAuth !== undefined
+          ? probedAuth.authenticated || usesCredentials
+            ? (probedAuth.label ?? options.auth?.label)
+            : undefined
+          : (draft.auth.label ?? options.auth?.label);
+      const authEmail =
+        probedAuth !== undefined
+          ? probedAuth.authenticated
+            ? probedAuth.email
+            : undefined
+          : draft.auth.email;
       const message =
         errorMessage ??
         (authenticated
           ? undefined
-          : draft.auth.status === "unauthenticated"
+          : authStatus === "unauthenticated"
             ? signInMessage
             : authUncheckedMessage);
       return {
@@ -312,6 +349,12 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
           // Lightweight custom-launcher probes lack versions; preserve the real handshake's version.
           version: version === "unknown" ? draft.version : version || draft.version,
           status: errorMessage ? "error" : authenticated ? "ready" : "warning",
+          auth: {
+            status: authStatus,
+            ...(authType ? { type: authType } : {}),
+            ...(authLabel ? { label: authLabel } : {}),
+            ...(authEmail ? { email: authEmail } : {}),
+          },
           checkedAt: updatedAt,
           usageLimits: missingInstallation ? undefined : draft.usageLimits,
           ...(missingInstallation
@@ -325,8 +368,7 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
             : {}),
           ...(initialized !== undefined
             ? {
-                supportsTextGeneration:
-                  supportsTextGeneration && draft.auth.status !== "unauthenticated",
+                supportsTextGeneration: supportsTextGeneration && authStatus !== "unauthenticated",
               }
             : {}),
           ...(message ? { message } : {}),