Support Custom Gateway / Proxy Auth for Antigravity Provider

[jorotodorovv]

Area

apps/server, apps/web, packages/contracts

Problem or use case

Both the standalone Antigravity ACP runtime (1.4.5+) and the official agy CLI (1.5.1+, supported via custom binaryPath in #32503 / #33143) support routing LLM traffic through an enterprise gateway or local proxy (such as CLIProxyAPI) via environment variables:

• AGY_LLM_GATEWAY_URL
• AGY_LLM_GATEWAY_API_KEY
• AGY_ACP_ENABLE_GATEWAY_AUTH=1

Currently, using Antigravity with a gateway/proxy in T3 Code requires two workarounds:

1. Manually configuring all three raw environment variables on the provider instance.
2. Dealing with the authenticate handshake: because AntigravityAuthMethod only offers oauth-personal, oauth-business, gemini-api-key, and agent-platform, T3 Code still sends authenticate (e.g. oauth-personal) or expects GCP/Gemini API key credentials rather than recognizing that gateway auth is self-authenticating via the gateway URL and key.

Meanwhile, Claude and Codex already work cleanly alongside local proxy hubs (e.g. cliproxy in usageLimitSources).

Proposed behavior

Add first-class gateway auth support to AntigravitySettings (or AntigravityAuthMethod):

• Add a gateway option to ANTIGRAVITY_AUTH_METHODS (or allow binding/configuring a gatewayUrl + apiKey via SettingsSecretValue in AntigravitySettings).
• When authMethod === "gateway", antigravityEnvironment in apps/server/src/provider/antigravityAuthSupport.ts sets AGY_LLM_GATEWAY_URL, AGY_LLM_GATEWAY_API_KEY, and AGY_ACP_ENABLE_GATEWAY_AUTH: "1".
• Skip browser OAuth preflight / interactive sign-in requirement when gateway auth is selected and configured.
• Switching authMethod back to oauth-personal cleanly stops injecting the gateway variables and returns to standard Google OAuth without affecting any shared usageLimitSources hub configuration used by Claude or Codex.

Questions

1. Would you be open to a focused PR adding gateway as an AntigravityAuthMethod with a gatewayUrl setting (reusing the existing apiKey secret setting)?
2. Or would you prefer keeping the surface area smaller—for example, detecting when AGY_LLM_GATEWAY_URL / AGY_ACP_ENABLE_GATEWAY_AUTH are present in the instance environment and skipping the OAuth sign-in requirement automatically without adding new settings fields?