[HemSoft]

When agy has no saved sign-in, every background Gemini coding refresh opened Google sign-in in the default browser and then waited 60 s for a code, past CodexBar's 30 s limit. Background agy runs now can't start sign-in, and the Gemini coding row says Not signed in within about a second.

Fixes #282. Context: chief#43.

Change

• gemini_coding::CliRunner runs agy with a loopback SSH_CONNECTION and SSH_CLIENT, replacing any inherited values and removing SSH_TTY. Over SSH, agy prints the sign-in link instead of launching a browser (Authenticate: browser locally, "manual URL" over SSH). The Settings sign-in window (gemini_login) already clears these variables, so the interactive flow still uses the local browser.
• CommandOptions.stop_on_stderr (new, used only by agy): the runner stops the command once that text appears on stderr, ignoring ASCII case, and returns what it wrote so far. agy's marker is authentication required. Every other caller passes None.
• CodingError::SignedOut maps to ProviderError::NotSignedIn ("Not signed in. Sign in to the Antigravity CLI from Settings > Accounts."). It replaces a TimedOut on Windows and macOS.
• To keep the strict CRAP gate flat, collect hands its completion check, now including the marker, to complete(). CodingError::message() now holds the text that Display and the provider's Refused reason used to duplicate, and CodingError::of_failed_run sorts a failed /usage run into SignedOut or NoUsage.
• Docs: COMMAND_RUNNER.md ("No interactive sign-in") and a no-browser check in ANTIGRAVITY_LOGIN_TESTING.md.

The obvious alternative, a closed stdin pipe, makes a signed-out agy fail fast on macOS without a tty. On Windows it doesn't help: agy reads the code from the hidden console's CONIN$ and still launches rundll32 (probe below). DETACHED_PROCESS would remove that console, but agy's own console children would then get visible windows, the #280 regression.

Evidence

Windows-native, signed-out agy 1.4.8 started like CodexBar starts it (CREATE_NO_WINDOW). Run 40540550812 on the throwaway probe/agy-signin-282 branch, with process creations from Security event 4688:

stdin	SSH variables	rundll32 (browser)	agy's wait
null (main)	no	yes	60 s
closed pipe	no	yes	60 s
null	yes	no	60 s
closed pipe	yes	no	60 s

The SSH variables stop the browser. stop_on_stderr ends the 60 s wait.

Windows console probe of the real release builds, main af6f00c vs this PR (run 40542734918, artifact console-probe-40542734918, processes.json). Each build ran for 4 minutes on the hosted desktop with a Gemini account and agy installed but signed out. The candidate was 5813c1c; its code matches this PR's code before the CRAP-neutral refactor in c59a20a.

Build	CodexBar agy -p /usage runs	rundll32 url.dll,FileProtocolHandler <accounts.google.com…> started by them	Spacing
main af6f00c	3 (16:50:49, 16:52:20, 16:53:52)	3, one per run; Edge showed "Sign in - Google Accounts" in the foreground	~90 s (30 s timeout + 60 s refresh)
this PR	4 (16:56:30, 16:57:31, 16:58:33, 16:59:35)	0	~61 s (fails fast, so the refresh cadence holds)

Control: in both phases the probe's own launch of agy with no SSH variables (matrix-agy-contained-usage, 16:55:13 and 17:00:54) still started rundll32, so agy stayed signed out through the fix phase. The fix phase logged one Edge foreground event, at app-fix-stopping. That was the Edge window main's runs had already opened, coming forward when CodexBar quit. No process started it. Console windows from CodexBar: 0 in both builds.

macOS (air), real signed-out agy 1.4.8, with an open shim first on PATH that logs calls instead of opening anything:

	open <accounts.google.com/o/oauth2/auth…>	Result
main's invocation, no tty	called	60 s wait, then exit 1 (CodexBar: TimedOut at 30 s)
main's invocation, with a tty	called	60 s wait
this PR's CliRunner + fetch, no tty	not called	Err(SignedOut) in 0.9 s
this PR's CliRunner + fetch, with a tty	not called	Err(SignedOut) in 0.5 s

Signed-in /usage with the SSH variables set: agy 1.4.8 on Linux (mini), signed in, reached over a real SSH session (SSH_CONNECTION set), with AGY_CLI_DISABLE_AUTO_UPDATE=true and null stdin: status SUCCESS, num_turns 0, command usage, all five buckets (gemini-weekly, gemini-5h, 3p-weekly, 3p-5h, gemini-argon-wtu-weekly). I had no signed-in agy on Windows or macOS to test with.

Tests

• command_runner fixture prompt: a real child writes the prompt and then never exits. With stop_on_stderr it returns success: false with its stderr before the 3 s deadline.
• command::tests::a_stop_marker_is_found_across_reads_and_case: a marker split across reads, mixed case, no false match.
• gemini_coding: both of agy's prompt forms map to SignedOut, other failures stay NoUsage, and CliRunner::options is pinned.
• gemini: a signed-out CLI fails the account with needs_sign_in() and the "Not signed in" text.
• The Windows no-console regression fixture from fix: keep the Antigravity CLI's self-updater from opening console windows #280 is unchanged and still runs in command_runner.

Validation

Local gates on air (macOS arm64) at c59a20a: cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings and cargo test --workspace --locked all pass (1,048 tests, 0 failed). CI runs the same gates on Windows, macOS and Linux, plus strict rust-metrics.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T17:05:13.513620Z	c59a20a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[HemSoft]

@codex review

[HemSoft]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: c59a20aad8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".