fix(ai): remove secret-tool/agy binary dependencies from antigravity + vibe credential paths (#1825 remainder) #1964

Remainder of #1825 — remove the binary dependencies from the antigravity + vibe credential paths

Filed as the routed implementation follow-up of #1825 (re-triage of queue task 10989, 2026-11-08). #1825 stays open as the audit record; this issue owns the implementation.

Status of #1825's slices

• Narrow error-quality slice: DONE — PR fix(ai): antigravity missing-binary errors name the binary and remedies (#1825) #1844 merged (946b49c): missing-binary errors now name secret-tool / the agy binary and the remedies.
• Architectural remainder: this issue. It was recorded BLOCKED on a design choice among (a)–(d); Drew ruled on 2026-11-06 (audit follow-up: antigravity + vibe credential paths spawn secret-tool; antigravity refresh requires the agy binary #1825 (comment)), ruling the OUTCOME instead of picking a mechanism:

"ensure this will be the last time we have to run a binary Command for a provider"

No provider may depend on running a binary command for auth. Amending the doctrine to sanction these exceptions (option d) is ruled out as a standalone answer. Per-provider mechanics are the fleet's, under that constraint.

Gap on current main (684598b, verified x2 2026-11-08)

• packages/ai/src/providers/antigravity-auth.ts:156-164 — every credential load execFiles secret-tool lookup service gemini username antigravity (15s timeout).
• packages/ai/src/providers/antigravity-auth.ts:175-270 — findAgyBinary() + binaryIntel() extract OAuth client-secret candidates from the agy binary's bytes; refresh() (:316, :414) depends on them, so an expired token cannot refresh where the binary is absent.
• packages/ai/src/providers/vibe-auth.ts:118-131 — tier-4 resolution execFiles secret-tool lookup. This is the deployed tier: the fleet config keeps MISTRAL_API_KEY out of the server env (vibe provider: native wire-protocol emulation of the Mistral Vibe binary (no ACP host, no subprocess) #1653).
• packages/ai/src/quota/providers/antigravity.ts:1,124 — imports execFile from node:child_process and execFiles secret-tool (graceful null).

Chosen no-spawn route (specified in triage)

1. Keyring reads move in-process at all three sites: read the Secret Service keyring via a D-Bus client binding in-process (session bus, org.freedesktop.secrets), deleting every child_process/execFile use. If a D-Bus client proves infeasible in the Bun runtime, the fallback route is a provisioned credential-file tier read in place (the claude-code/commandcode pattern — file read only, zero spawns) made the deployed default, with the subprocess keyring tier removed. Either way: no child process is spawned.
2. Antigravity refresh without the agy binary: the OAuth client secret is provisioned at sign-in time into the provider's own credential store (credential-file field or env ANTIGRAVITY_OAUTH_CLIENT_SECRET); findAgyBinary/binaryIntel byte extraction is removed from the refresh path.
3. Deployed-tier behavior preserved: the vibe door still resolves its keyring sign-in key in the fleet configuration where MISTRAL_API_KEY is absent from the server env.

Acceptance

• Grep for child_process / Bun.spawn / execa over packages/ai/src/{providers,protocols,route} returns zero files.
• Credential resolution for both doors works (or fails with the documented naming error) with secret-tool and agy absent from PATH, and spawns no child process.
• Antigravity refresh succeeds with no agy binary present, given a provisioned client secret.
• Regression tests cover the no-binary path for both doors; existing antigravity-auth / vibe-auth tests keep passing; packages/ai typecheck clean.
• No credential value is logged, copied, or persisted anywhere new (read-in-place discipline).

Acceptance criteria

• No provider credential path in the antigravity or vibe providers executes an external binary command (secret-tool, agy, or any other) for auth, per Drew's 2026-11-06 ruling on audit follow-up: antigravity + vibe credential paths spawn secret-tool; antigravity refresh requires the agy binary #1825.
• Credentials are obtained through an in-process mechanism; missing credentials produce an actionable error naming the remedy (building on PR fix(ai): antigravity missing-binary errors name the binary and remedies (#1825) #1844's error-quality slice).
• Existing provider auth tests pass and new tests cover the no-binary credential path for both providers.