fix(antigravity): drop synthetic x-goog-api-client header on onboarding

[dbc-hbin]

Summary

Remove synthetic x-goog-api-client header from Antigravity onboardUser requests and pass ANTIGRAVITY_IDE_VERSION for metadata.ide_version.

Context & Evidence

Following discussion in #1836:

• Decompilation of Antigravity IDE 2.5.5 (language_server_macos_arm 126MB Go1.26.5) confirms that x-goog-api-client is never sent on the wire.
  • 0 ADRP hits across all SetHTTPHeaders variants (IDE, CLI, Hub, Standalone, Stubby).
  • The single raw string occurrence at 0x24ea019 is part of a generationConfig.x-goog-api-client descriptor, not a header.
• metadata.ide_version in onboardUser is aligned to ANTIGRAVITY_IDE_VERSION (2.5.5), separating it from the User-Agent header.
• Removed obsolete ANTIGRAVITY_GOOG_API_CLIENT_UA export and associated test.

Verification

• bun test tests/client-fingerprint.test.ts tests/google-antigravity-oauth.test.ts tests/google-antigravity-wire.test.ts (71 passed, 0 failed)
• bun run typecheck (passed with 0 errors)

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/google-antigravity.ts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b1328395-9c3d-4d17-9e3b-14cb570039c1

📥 Commits

Reviewing files that changed from the base of the PR and between 3d67ac2 and eb3132e.

📒 Files selected for processing (4)

• src/adapters/client-fingerprint.ts
• src/oauth/google-antigravity.ts
• tests/client-fingerprint.test.ts
• tests/google-antigravity-oauth.test.ts

💤 Files with no reviewable changes (2)

• src/adapters/client-fingerprint.ts
• tests/client-fingerprint.test.ts

Included review availability: Your plan includes up to 10 reviews per rolling hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Antigravity OAuth onboarding now uses ANTIGRAVITY_IDE_VERSION for metadata, omits the x-goog-api-client header, and retains the Antigravity IDE User-Agent. The obsolete client User-Agent constant and its test are removed.

Changes

Antigravity OAuth identity

Layer / File(s)	Summary
Update onboarding request identity src/adapters/client-fingerprint.ts, src/oauth/google-antigravity.ts, tests/client-fingerprint.test.ts, tests/google-antigravity-oauth.test.ts	The secondary Google API client User-Agent constant and test are removed. Onboarding requests no longer send x-goog-api-client; metadata.ide_version uses ANTIGRAVITY_IDE_VERSION. Tests verify the header omission, IDE User-Agent, and metadata value.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to eb313

This localized change removes an unused onboarding header and aligns the IDE version metadata; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• lidge-jun/opencodex#1646: Modifies Antigravity client fingerprinting and OAuth identity handling.
• lidge-jun/opencodex#1836: Modifies Antigravity OAuth headers and x-goog-api-client handling.

Suggested reviewers: ingwannu, lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: removing the synthetic x-goog-api-client header from Antigravity onboarding requests.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/google-antigravity.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@dbc-hbin Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.