From 1f6b552ed676d9bd77108ef765e9d3f50cee3304 Mon Sep 17 00:00:00 2001
From: cubebox <58514883+juzijia@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:34:39 +0800
Subject: [PATCH 1/2] feat(antigravity): expose observed membership plan

---
 .../provider-workspace/ProviderAuthPanel.tsx  |  5 +-
 .../components/provider-workspace/types.ts    |  1 +
 gui/src/hooks/useProviderAccountPools.ts      |  1 +
 gui/src/pages/providers-shared.ts             |  1 +
 .../styles/provider-workspace-settings.css    |  1 +
 .../provider-quota-refresh-controls.test.tsx  | 30 +++++++
 src/oauth/google-antigravity.ts               | 79 +++++++++++++++----
 src/oauth/index.ts                            | 27 ++++---
 src/oauth/store.ts                            |  5 ++
 src/oauth/types.ts                            |  6 ++
 .../google/google-antigravity-oauth.test.ts   | 76 +++++++++++++++++-
 11 files changed, 201 insertions(+), 31 deletions(-)

diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index 58b7eb214e8..e6995c1d763 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -536,6 +536,7 @@ export default function ProviderAuthPanel({
               <ul className="pwi-auth-list">
                 {accounts.map(account => {
                   const label = oauthAccountDisplayLabel(accounts, account, t);
+                  const planLabel = account.plan === "Free" ? t("modal.badge.free") : account.plan;
                   const switching = switchingAccountId === account.id;
                   const pausing = pausingAccountId === account.id;
                   const healthStatus = account.health?.status;
@@ -550,11 +551,11 @@ export default function ProviderAuthPanel({
                     <button type="button" className="pwi-auth-row-main"
                       onClick={() => { if (!account.active && !account.paused && !showReauth && !inCooldown && !switchingAccountId && !pausingAccountId) void authHandlers.onSwitchAccount(item.name, account); }}
                       aria-current={account.active ? "true" : undefined}
-                      aria-label={`${label}${account.active ? ` — ${t("pws.accountCurrent")}` : ""}`}
+                      aria-label={`${label}${planLabel ? ` — ${planLabel}` : ""}${account.active ? ` — ${t("pws.accountCurrent")}` : ""}`}
                       disabled={Boolean(account.paused || showReauth || inCooldown || switchingAccountId || pausingAccountId)}>
                       <span className={`pwi-auth-dot ${showReauth ? "pwi-auth-dot--warn" : account.active && !account.paused ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
-                        <span className="pwi-auth-row-label">{label}</span>
+                        <span className="pwi-auth-row-heading"><span className="pwi-auth-row-label">{label}</span>{planLabel && <span className="badge badge-muted">{planLabel}</span>}</span>
                         <span className="pwi-auth-row-secondary">{[account.email, `${t("prov.accountId")}: ${maskedId}`].filter(Boolean).join(" · ")}</span>
                         {healthSummary && (
                           <span className="pwi-auth-row-secondary faint">{healthSummary}</span>
diff --git a/gui/src/components/provider-workspace/types.ts b/gui/src/components/provider-workspace/types.ts
index 0fbca409b7c..5a486142fcc 100644
--- a/gui/src/components/provider-workspace/types.ts
+++ b/gui/src/components/provider-workspace/types.ts
@@ -61,6 +61,7 @@ export type OAuthAccountRow = AccountQuotaReading & {
   autoSelectable?: boolean;
   skipReason?: "needs_reauth" | "paused" | "suspended" | "cooldown" | "quota_exhausted";
   paused?: boolean;
+  plan?: string | null;
   health?: { status: OAuthAccountHealthStatus; reason?: string; until?: string };
   healthLabel?: string;
   healthSummary?: string;
diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index a901a0ae133..d1e249de925 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -24,6 +24,7 @@ export interface OAuthAccount extends AccountQuotaReading {
   skipReason?: "needs_reauth" | "paused" | "suspended" | "cooldown" | "quota_exhausted";
   paused?: boolean;
   expiresAt?: number;
+  plan?: string | null;
   health?: { status: "healthy" | "cooldown" | "reauth_required" | "warning"; reason?: string; until?: string };
   healthLabel?: string;
   healthSummary?: string;
diff --git a/gui/src/pages/providers-shared.ts b/gui/src/pages/providers-shared.ts
index 3408690f335..c95ebe7c231 100644
--- a/gui/src/pages/providers-shared.ts
+++ b/gui/src/pages/providers-shared.ts
@@ -45,6 +45,7 @@ export interface OAuthAccount {
   active: boolean;
   needsReauth?: boolean;
   expiresAt?: number;
+  plan?: string | null;
 }
 
 const OAUTH_LABELS: Record<string, string> = {
diff --git a/gui/src/styles/provider-workspace-settings.css b/gui/src/styles/provider-workspace-settings.css
index f3c7d4b1a90..e52186bc0d4 100644
--- a/gui/src/styles/provider-workspace-settings.css
+++ b/gui/src/styles/provider-workspace-settings.css
@@ -77,6 +77,7 @@
 .pwi-auth-row-main:disabled { cursor: default; opacity: 0.72; }
 .pwi-auth-row-main:focus-visible,
 .pwi-auth-row-remove:focus-visible { outline: 2px solid var(--accent-ring); outline-offset: 2px; }
+.pwi-auth-row-heading { display: flex; align-items: center; gap: 6px; max-width: 100%; min-width: 0; flex-wrap: wrap; }
 .pwi-auth-row-label  { font-size: var(--text-control); color: var(--text); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .pwi-auth-row-remove {
   background: none; border: none; cursor: pointer; padding: 2px;
diff --git a/gui/tests/provider-quota-refresh-controls.test.tsx b/gui/tests/provider-quota-refresh-controls.test.tsx
index 5766221a13f..8b5d9c8e0cb 100644
--- a/gui/tests/provider-quota-refresh-controls.test.tsx
+++ b/gui/tests/provider-quota-refresh-controls.test.tsx
@@ -247,3 +247,33 @@ test("changing active account discards the previous refresh feedback", async ()
   expect(host.textContent).not.toContain("Quota check completed");
   expect(findButton("Refresh quotas")?.disabled).toBe(false);
 });
+
+test("Antigravity plan badge localizes Free, preserves provider names, and leaves pause controls intact", async () => {
+  win.localStorage.setItem("ocx-lang", "zh");
+  const item = { ...oauthItem, name: "google-antigravity" };
+  const handlers = authHandlers({ onPauseAccount: () => {} });
+  const row = { id: "ag-1", active: true, paused: false, plan: "Free" as string | null };
+  const view = (plan: string | null, paused = false) =>
+    <ProviderAuthPanel item={item} apiBase="" accounts={[{ ...row, plan, paused }]} authHandlers={handlers} />;
+  await render(view("Free"));
+  const main = () => host.querySelector(".pwi-auth-row-main") as HTMLButtonElement;
+  const heading = () => host.querySelector(".pwi-auth-row-heading")!;
+  expect(heading().textContent).toContain("免费");
+  expect(main().getAttribute("aria-label")).toContain("免费");
+  expect(findButton("暂停")).not.toBeNull();
+
+  await render(view("Google AI Pro"));
+  expect(heading().textContent).toContain("Google AI Pro");
+  expect(main().getAttribute("aria-label")).toContain("Google AI Pro");
+  expect(heading().textContent).not.toContain("免费");
+
+  await render(view("Google AI Ultra", true));
+  expect(heading().textContent).toContain("Google AI Ultra");
+  expect(main().disabled).toBe(true);
+  expect(findButton("恢复")).not.toBeNull();
+
+  await render(view(null));
+  expect(heading().querySelector(".badge")).toBeNull();
+  expect(main().getAttribute("aria-label")).not.toContain("Google AI");
+  expect(main().getAttribute("aria-label")).not.toContain("免费");
+});
diff --git a/src/oauth/google-antigravity.ts b/src/oauth/google-antigravity.ts
index be81b55de58..95e0d90a4b9 100644
--- a/src/oauth/google-antigravity.ts
+++ b/src/oauth/google-antigravity.ts
@@ -94,15 +94,42 @@ function extractProjectId(data: Record<string, unknown> | undefined): string | u
   return undefined;
 }
 
-async function loadCodeAssistProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
-  const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
-    body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
-    signal: requestSignal(signal),
-  });
-  if (!response.ok) return undefined;
-  return extractProjectId((await response.json().catch(() => undefined)) as Record<string, unknown> | undefined);
+/**
+ * Subscription tier reported by a loadCodeAssist `paidTier`: `free-tier` → "Free", an explicit
+ * `Google AI <name>` is carried verbatim, everything else (missing, malformed, unrecognised) is a
+ * truthful null — never a guess from `currentTier`, which is the bare product name even for free.
+ */
+function extractPaidTierPlan(data: Record<string, unknown>): string | null {
+  const paidTier = data.paidTier;
+  if (!paidTier || typeof paidTier !== "object") return null;
+  const tier = paidTier as { id?: unknown; name?: unknown };
+  if (tier.id === "free-tier") return "Free";
+  if (typeof tier.name === "string" && /^Google AI [^\s\x00-\x1f\x7f][^\x00-\x1f\x7f]*$/.test(tier.name) && tier.name === tier.name.trim()) return tier.name;
+  return null;
+}
+
+/**
+ * loadCodeAssist discovery for an access token. A plan/project observation is returned only when
+ * the call succeeded and produced a parseable body; a network error, non-2xx or unparseable
+ * response yields `{}` so the caller keeps the last known value instead of inventing one.
+ */
+async function loadCodeAssistDiscovery(accessToken: string, signal?: AbortSignal): Promise<{ projectId?: string; plan?: string | null }> {
+  let data: Record<string, unknown> | undefined;
+  try {
+    const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
+      body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
+      signal: requestSignal(signal),
+    });
+    if (!response.ok) return {};
+    data = (await response.json().catch(() => undefined)) as Record<string, unknown> | undefined;
+  } catch {
+    return {};
+  }
+  if (data === undefined) return {};
+  if (!data || typeof data !== "object" || Array.isArray(data)) return { plan: null };
+  return { projectId: extractProjectId(data), plan: extractPaidTierPlan(data) };
 }
 
 async function onboardProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
@@ -136,9 +163,23 @@ async function onboardProject(accessToken: string, signal?: AbortSignal): Promis
   return undefined;
 }
 
+/**
+ * Discover the CCA project and reported subscription tier for an access token
+ * (loadCodeAssist → onboardUser fallback). The tier observation comes only from a successful,
+ * parseable loadCodeAssist response; onboarding itself adds no tier observation.
+ * Onboarding is attempted only when loadCodeAssist yielded no project, and its failure never
+ * discards a tier observation loadCodeAssist already made.
+ */
+export async function discoverAntigravityAccount(accessToken: string, signal?: AbortSignal): Promise<{ projectId?: string; plan?: string | null }> {
+  const discovery = await loadCodeAssistDiscovery(accessToken, signal);
+  if (discovery.projectId) return discovery;
+  const onboarded = await onboardProject(accessToken, signal).catch(() => undefined);
+  return { ...(onboarded ? { projectId: onboarded } : {}), ...(discovery.plan !== undefined ? { plan: discovery.plan } : {}) };
+}
+
 /** Discover the CCA project for an access token (loadCodeAssist → onboardUser fallback). */
 export async function discoverAntigravityProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
-  return (await loadCodeAssistProject(accessToken, signal)) ?? (await onboardProject(accessToken, signal));
+  return (await discoverAntigravityAccount(accessToken, signal)).projectId;
 }
 
 function credentialsFromPayload(payload: GoogleTokenPayload, refreshFallback = ""): OAuthCredentials {
@@ -207,13 +248,13 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
     }, this.ctrl.signal);
     const creds = credentialsFromPayload(payload);
     this.ctrl.onProgress?.("Discovering Cloud Code Assist project");
-    const projectId = await discoverAntigravityProject(creds.access, this.ctrl.signal);
-    if (!projectId) {
+    const discovery = await discoverAntigravityAccount(creds.access, this.ctrl.signal);
+    if (!discovery.projectId) {
       // Fail the login rather than persisting a credential that every request would reject for a
       // missing CCA project — otherwise status shows "logged in" while all calls fail closed.
       throw new Error("Antigravity login could not discover a Cloud Code Assist project for this account. Ensure the account has Antigravity/Cloud Code Assist access and try again.");
     }
-    return { ...creds, projectId };
+    return { ...creds, projectId: discovery.projectId, ...(discovery.plan !== undefined ? { plan: discovery.plan } : {}) };
   }
 }
 
@@ -230,9 +271,15 @@ export async function refreshAntigravityToken(refreshToken: string, signal?: Abo
     refresh_token: refreshToken,
   }, signal);
   const creds = credentialsFromPayload(payload, refreshToken);
-  // Re-discover the project on refresh so a newly-onboarded account fills in projectId.
-  const projectId = await discoverAntigravityProject(creds.access, signal).catch(() => undefined);
-  return projectId ? { ...creds, projectId } : creds;
+  // Re-discover on refresh so a newly-onboarded account fills in projectId and a reported tier is
+  // refreshed. A discovery hiccup must never fail the refresh: loadCodeAssist folds network and
+  // onboarding errors into "no observation", which merged() then retains.
+  const discovery = await discoverAntigravityAccount(creds.access, signal);
+  return {
+    ...creds,
+    ...(discovery.projectId ? { projectId: discovery.projectId } : {}),
+    ...(discovery.plan !== undefined ? { plan: discovery.plan } : {}),
+  };
 }
 
 /**
diff --git a/src/oauth/index.ts b/src/oauth/index.ts
index db7e5b7c5ad..47daec85842 100644
--- a/src/oauth/index.ts
+++ b/src/oauth/index.ts
@@ -858,6 +858,7 @@ function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCrede
     source: fresh.source === "local-cli" ? "local-cli"
       : previous.source === "local-cli" ? "oauth" : fresh.source ?? previous.source ?? "oauth",
     ...(fresh.projectId === undefined && previous.projectId ? { projectId: previous.projectId } : {}),
+    ...(fresh.plan === undefined && previous.plan !== undefined ? { plan: previous.plan } : {}),
     ...(fresh.apiBaseUrl === undefined && previous.apiBaseUrl ? { apiBaseUrl: previous.apiBaseUrl } : {}),
     ...(fresh.email === undefined && previous.email ? { email: previous.email } : {}),
     ...(fresh.accountId === undefined && previous.accountId ? { accountId: previous.accountId } : {}),
@@ -1785,18 +1786,19 @@ export interface OAuthAccountSummary {
   needsReauth?: boolean;
   expiresAt?: number;
   /**
-   * Subscription tier, mirroring the field the OpenAI/Codex provider reports, so a consumer
-   * weighting a multi-account pool by seat size needs no per-provider branching (#3777).
+   * Display-only subscription tier, mirroring the field the OpenAI/Codex provider reports.
    *
    * Always present and explicitly `null` when the tier is unknown. The distinction matters:
    * an ABSENT key means the proxy is too old to report a tier at all, while `null` means this
-   * version looked and upstream did not say. Omitting it would make those indistinguishable and
+   * version has no recognized tier to display. Omitting it would make those indistinguishable and
    * invite a consumer to assume a tier.
    *
-   * Every OAuth provider reports `null` today. Anthropic's `/api/oauth/usage` returns quota
-   * buckets only — `five_hour`, `seven_day`, the model-scoped weekly windows and `limits[]` —
-   * and carries no subscription/tier field, and its token response carries none either. See
-   * `fetchAnthropicUsageQuota` in `src/providers/quota.ts`.
+   * Google Antigravity can report a plan from a loadCodeAssist `paidTier` (see
+   * `extractPaidTierPlan` in `src/oauth/google-antigravity.ts`); every other provider reports
+   * `null`. Anthropic's `/api/oauth/usage` returns quota buckets only — `five_hour`, `seven_day`,
+   * the model-scoped weekly windows and `limits[]` — and carries no subscription/tier field, and
+   * its token response carries none either. See `fetchAnthropicUsageQuota` in
+   * `src/providers/quota.ts`.
    */
   plan: string | null;
 }
@@ -1820,11 +1822,12 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
     active: a.id === set.activeAccountId,
     ...(a.needsReauth ? { needsReauth: true } : {}),
     expiresAt: a.credential.expires,
-    // Explicitly null rather than omitted — see OAuthAccountSummary.plan. No OAuth provider
-    // exposes a subscription tier today, so there is nothing truthful to put here; deriving one
-    // from quota percentages is not possible, because they are normalized per account and a
-    // half-consumed small seat is indistinguishable from a half-consumed large one.
-    plan: null,
+    // Explicitly null when the credential carries no observed tier — see OAuthAccountSummary.plan.
+    // Only Google Antigravity reports a paidTier today; other providers have nothing truthful to
+    // put here, and deriving one from quota percentages is not possible, because they are
+    // normalized per account and a half-consumed small seat is indistinguishable from a
+    // half-consumed large one.
+    plan: a.credential.plan ?? null,
   }));
 
   // A stored credential counts as "logged in" when it exists and is not marked for
diff --git a/src/oauth/store.ts b/src/oauth/store.ts
index 5c9fff453fe..47c04ee6e3c 100644
--- a/src/oauth/store.ts
+++ b/src/oauth/store.ts
@@ -532,6 +532,11 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
   if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
   if (typeof candidate.projectId === "string" && candidate.projectId.length > 0) normalized.projectId = candidate.projectId;
+  if (candidate.plan === null) normalized.plan = null;
+  else if (typeof candidate.plan === "string") {
+    const plan = candidate.plan.trim();
+    if (plan.length > 0 && plan.length <= 128 && !/[\x00-\x1f\x7f]/.test(plan)) normalized.plan = plan;
+  }
   if (typeof candidate.apiBaseUrl === "string" && candidate.apiBaseUrl.length > 0) {
     // Persist only allowlisted origins; drop anything else so auth.json cannot
     // become an SSRF springboard across reloads. Copilot and Devin are the two
diff --git a/src/oauth/types.ts b/src/oauth/types.ts
index 73af11f0a63..1273679986f 100644
--- a/src/oauth/types.ts
+++ b/src/oauth/types.ts
@@ -64,6 +64,12 @@ export type OAuthCredentials = {
   source?: OAuthCredentialSource;
   /** Google Antigravity (Cloud Code Assist) discovered project id; injected into the CCA envelope. */
   projectId?: string;
+  /**
+   * Google Antigravity subscription tier from loadCodeAssist `paidTier`; display-only, never used
+   * for routing or selection. Absent = no observation this round (retain previous); `null` = an
+   * observed "no recognized plan"; a string = the tier to show.
+   */
+  plan?: string | null;
   /**
    * GitHub Copilot allowlisted API origin from token `endpoints.api` (HTTPS `*.githubcopilot.com` only).
    * Never reuse for Antigravity projectId; validated on write and again at request time.
diff --git a/tests/adapters/google/google-antigravity-oauth.test.ts b/tests/adapters/google/google-antigravity-oauth.test.ts
index 68cf6f49e6a..3e86d67afba 100644
--- a/tests/adapters/google/google-antigravity-oauth.test.ts
+++ b/tests/adapters/google/google-antigravity-oauth.test.ts
@@ -3,7 +3,8 @@ import { discoverAntigravityProject, refreshAntigravityToken } from "../../../sr
 import { mkdirSync} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { getCredential, saveCredential } from "../../../src/oauth/store";
+import { getAccountCredential, getAccountSet, getCredential, saveCredential } from "../../../src/oauth/store";
+import { getValidAccessTokenForAccount, getLoginStatus } from "../../../src/oauth";
 import { ANTIGRAVITY_IDE_VERSION } from "../../../src/adapters/client-fingerprint";
 import { removeTreeWithRetry } from "../../helpers/remove-tree";
 
@@ -133,6 +134,21 @@ describe("antigravity refresh", () => {
     expect(cred.expires - issuedAt).toBe(55 * 60 * 1000);
   });
 
+  test.each([
+    [{ id: "free-tier", name: "Free" }, "Free"],
+    [{ id: "paid-pro", name: "Google AI Pro" }, "Google AI Pro"],
+    [{ id: "fixture-ultra", name: "Google AI Ultra" }, "Google AI Ultra"],
+    [{ id: "unknown-product", name: "Other Product" }, null],
+    [undefined, null],
+  ] as const)("observes loadCodeAssist paidTier %p as %p", async (paidTier, expected) => {
+    routeFetch(url => {
+      if (url.includes("oauth2.googleapis.com/token")) return Response.json({ access_token: "fresh", expires_in: 3600 });
+      if (url.includes(":loadCodeAssist")) return Response.json({ cloudaicompanionProject: "proj", paidTier });
+      throw new Error(`Unexpected request: ${url}`);
+    });
+    expect((await refreshAntigravityToken("rt")).plan).toBe(expected);
+  });
+
   test("refresh failure carries status only, not the response body", async () => {
     routeFetch((url) => {
       if (url.includes("oauth2.googleapis.com/token")) return new Response("invalid_grant secret-detail", { status: 400 });
@@ -157,6 +173,64 @@ describe("antigravity credential persistence (projectId survives the store)", ()
     if (tmp) removeTreeWithRetry(tmp);
   });
 
+  test.each([
+    ["request failure", "throw", "Google AI Pro"],
+    ["non-2xx", "status", "Google AI Pro"],
+    ["unparseable body", "invalid", "Google AI Pro"],
+    ["unknown product", "unknown", null],
+    ["missing tier", "missing", null],
+    ["observed null then onboarding throws", "null-onboard", null],
+    ["observed Pro then onboarding throws", "pro-onboard", "Google AI Pro"],
+  ] as const)("refresh keeps or replaces previous Pro: %s", async (_label, mode, expected) => {
+    tmp = join(tmpdir(), `ag-plan-${Date.now()}-${Math.random().toString(16).slice(2)}`);
+    mkdirSync(tmp, { recursive: true });
+    process.env.HOME = tmp;
+    process.env.OPENCODEX_HOME = join(tmp, "ocx");
+    await saveCredential("google-antigravity", {
+      access: "old", refresh: "rt", expires: Date.now() - 1000,
+      projectId: "proj-old", plan: "Google AI Pro",
+    });
+    const id = getAccountSet("google-antigravity")!.activeAccountId;
+    routeFetch(url => {
+      if (url.includes("oauth2.googleapis.com/token")) return Response.json({ access_token: "fresh", expires_in: 3600 });
+      if (url.includes(":loadCodeAssist")) {
+        if (mode === "throw") throw new Error("offline");
+        if (mode === "status") return new Response("failure", { status: 503 });
+        if (mode === "invalid") return new Response("not json");
+        const paidTier = mode === "unknown" || mode === "null-onboard"
+          ? { id: "other", name: "Other Product" }
+          : mode === "pro-onboard" ? { id: "pro", name: "Google AI Pro" } : undefined;
+        return Response.json({ ...(mode === "unknown" || mode === "missing" ? { cloudaicompanionProject: "proj-new" } : {}), paidTier });
+      }
+      if (url.includes(":onboardUser")) {
+        if (mode.endsWith("-onboard")) throw new Error("onboarding unavailable");
+        return new Response("forbidden", { status: 403 });
+      }
+      throw new Error(`Unexpected request: ${url}`);
+    });
+    expect(await getValidAccessTokenForAccount("google-antigravity", id)).toBe("fresh");
+    expect(getAccountCredential("google-antigravity", id)?.plan).toBe(expected);
+    expect(getLoginStatus("google-antigravity").accounts?.[0]?.plan).toBe(expected);
+  });
+
+  test("plan normalization persists null, trims bounded names, rejects controls and accepts legacy records", async () => {
+    tmp = join(tmpdir(), `ag-store-plan-${Date.now()}-${Math.random().toString(16).slice(2)}`);
+    mkdirSync(tmp, { recursive: true });
+    process.env.HOME = tmp;
+    process.env.OPENCODEX_HOME = join(tmp, "ocx");
+    const base = { access: "a", refresh: "r", expires: Date.now() + 3_600_000 };
+    await saveCredential("google-antigravity", { ...base, plan: null });
+    expect(getCredential("google-antigravity")?.plan).toBeNull();
+    await saveCredential("google-antigravity", { ...base, plan: "  Google AI Pro  " });
+    expect(getCredential("google-antigravity")?.plan).toBe("Google AI Pro");
+    for (const bad of ["bad\nplan", "x".repeat(129)]) {
+      await saveCredential("google-antigravity", { ...base, plan: bad });
+      expect(getCredential("google-antigravity")?.plan).toBeUndefined();
+    }
+    await saveCredential("google-antigravity", base);
+    expect(getCredential("google-antigravity")?.plan).toBeUndefined();
+  });
+
   test("saveCredential + getCredential round-trips projectId (regression: was stripped by normalizeCredential)", async () => {
     tmp = join(tmpdir(), `ag-store-${Date.now()}-${Math.random().toString(16).slice(2)}`);
     mkdirSync(tmp, { recursive: true });

From 2c34bdcc94e5b1f0d0c7aba65484e2facd183a90 Mon Sep 17 00:00:00 2001
From: cubebox <58514883+juzijia@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:15:26 +0800
Subject: [PATCH 2/2] fix(antigravity): harden membership plan handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

• Retain unobserved plan across reauth and same-identity upsert
• Normalize plan field on credentials and reject control chars
• Align loadCodeAssist failure semantics and discovery fallback
• Restore badge-green styling for Google AI Pro membership badge
• Add focused regression coverage for reauth, upsert, and tier observation
---
 .../provider-workspace/ProviderAuthPanel.tsx  |  2 +-
 gui/src/pages/providers-shared.ts             |  1 -
 .../provider-quota-refresh-controls.test.tsx  | 32 ++++++----
 src/oauth/google-antigravity.ts               | 46 ++++++-------
 src/oauth/store.ts                            | 19 ++++--
 .../google/google-antigravity-oauth.test.ts   | 64 +++++++++++++++----
 tests/oauth/oauth-reauth-bind.test.ts         | 32 ++++++++++
 7 files changed, 139 insertions(+), 57 deletions(-)

diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index e6995c1d763..9bb21fdc778 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -555,7 +555,7 @@ export default function ProviderAuthPanel({
                       disabled={Boolean(account.paused || showReauth || inCooldown || switchingAccountId || pausingAccountId)}>
                       <span className={`pwi-auth-dot ${showReauth ? "pwi-auth-dot--warn" : account.active && !account.paused ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
-                        <span className="pwi-auth-row-heading"><span className="pwi-auth-row-label">{label}</span>{planLabel && <span className="badge badge-muted">{planLabel}</span>}</span>
+                        <span className="pwi-auth-row-heading"><span className="pwi-auth-row-label">{label}</span>{planLabel && <span className="badge badge-green">{planLabel}</span>}</span>
                         <span className="pwi-auth-row-secondary">{[account.email, `${t("prov.accountId")}: ${maskedId}`].filter(Boolean).join(" · ")}</span>
                         {healthSummary && (
                           <span className="pwi-auth-row-secondary faint">{healthSummary}</span>
diff --git a/gui/src/pages/providers-shared.ts b/gui/src/pages/providers-shared.ts
index c95ebe7c231..3408690f335 100644
--- a/gui/src/pages/providers-shared.ts
+++ b/gui/src/pages/providers-shared.ts
@@ -45,7 +45,6 @@ export interface OAuthAccount {
   active: boolean;
   needsReauth?: boolean;
   expiresAt?: number;
-  plan?: string | null;
 }
 
 const OAUTH_LABELS: Record<string, string> = {
diff --git a/gui/tests/provider-quota-refresh-controls.test.tsx b/gui/tests/provider-quota-refresh-controls.test.tsx
index 8b5d9c8e0cb..6df6a3e5c70 100644
--- a/gui/tests/provider-quota-refresh-controls.test.tsx
+++ b/gui/tests/provider-quota-refresh-controls.test.tsx
@@ -252,28 +252,38 @@ test("Antigravity plan badge localizes Free, preserves provider names, and leave
   win.localStorage.setItem("ocx-lang", "zh");
   const item = { ...oauthItem, name: "google-antigravity" };
   const handlers = authHandlers({ onPauseAccount: () => {} });
-  const row = { id: "ag-1", active: true, paused: false, plan: "Free" as string | null };
-  const view = (plan: string | null, paused = false) =>
-    <ProviderAuthPanel item={item} apiBase="" accounts={[{ ...row, plan, paused }]} authHandlers={handlers} />;
-  await render(view("Free"));
+  const row = { id: "ag-1", active: true, paused: false };
+  const view = (plan: string | null, paused = false, pausingAccountId: string | null = null) =>
+    <ProviderAuthPanel item={item} apiBase="" accounts={[{ ...row, plan, paused }]}
+      pausingAccountId={pausingAccountId} authHandlers={handlers} />;
   const main = () => host.querySelector(".pwi-auth-row-main") as HTMLButtonElement;
-  const heading = () => host.querySelector(".pwi-auth-row-heading")!;
-  expect(heading().textContent).toContain("免费");
+  const badge = () => main().querySelector(".pwi-auth-row-copy .badge");
+
+  await render(view("Free"));
+  expect(badge()?.textContent).toBe("免费");
   expect(main().getAttribute("aria-label")).toContain("免费");
-  expect(findButton("暂停")).not.toBeNull();
+  expect(main().getAttribute("aria-label")).toContain("当前");
 
   await render(view("Google AI Pro"));
-  expect(heading().textContent).toContain("Google AI Pro");
+  expect(badge()?.textContent).toBe("Google AI Pro");
   expect(main().getAttribute("aria-label")).toContain("Google AI Pro");
-  expect(heading().textContent).not.toContain("免费");
 
   await render(view("Google AI Ultra", true));
-  expect(heading().textContent).toContain("Google AI Ultra");
+  expect(badge()?.textContent).toBe("Google AI Ultra");
   expect(main().disabled).toBe(true);
   expect(findButton("恢复")).not.toBeNull();
 
+  await render(view("Google AI Pro", false, row.id));
+  expect(badge()?.textContent).toBe("Google AI Pro");
+  expect(main().disabled).toBe(true);
+  const pause = findButton("暂停");
+  expect(pause?.disabled).toBe(true);
+  expect(pause?.getAttribute("aria-busy")).toBe("true");
+
   await render(view(null));
-  expect(heading().querySelector(".badge")).toBeNull();
+  expect(badge()).toBeNull();
+  expect(main().closest(".pwi-auth-acct")?.textContent).not.toMatch(/null/i);
+  expect(main().getAttribute("aria-label")).not.toMatch(/null/i);
   expect(main().getAttribute("aria-label")).not.toContain("Google AI");
   expect(main().getAttribute("aria-label")).not.toContain("免费");
 });
diff --git a/src/oauth/google-antigravity.ts b/src/oauth/google-antigravity.ts
index 95e0d90a4b9..f0cd3a1bd73 100644
--- a/src/oauth/google-antigravity.ts
+++ b/src/oauth/google-antigravity.ts
@@ -104,32 +104,33 @@ function extractPaidTierPlan(data: Record<string, unknown>): string | null {
   if (!paidTier || typeof paidTier !== "object") return null;
   const tier = paidTier as { id?: unknown; name?: unknown };
   if (tier.id === "free-tier") return "Free";
-  if (typeof tier.name === "string" && /^Google AI [^\s\x00-\x1f\x7f][^\x00-\x1f\x7f]*$/.test(tier.name) && tier.name === tier.name.trim()) return tier.name;
-  return null;
+  if (typeof tier.name !== "string" || /[\x00-\x1f\x7f-\x9f]/.test(tier.name)) return null;
+  const name = tier.name.trim();
+  return name.length <= 128 && /^Google AI [^\s\x00-\x1f\x7f-\x9f][^\x00-\x1f\x7f-\x9f]*$/.test(name) ? name : null;
 }
 
 /**
  * loadCodeAssist discovery for an access token. A plan/project observation is returned only when
- * the call succeeded and produced a parseable body; a network error, non-2xx or unparseable
- * response yields `{}` so the caller keeps the last known value instead of inventing one.
+ * the call succeeded and produced a parseable body. A fetch rejection propagates (so project
+ * discovery does not onboard); non-2xx and JSON parse failure yield no observation.
  */
 async function loadCodeAssistDiscovery(accessToken: string, signal?: AbortSignal): Promise<{ projectId?: string; plan?: string | null }> {
-  let data: Record<string, unknown> | undefined;
+  const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
+    body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
+    signal: requestSignal(signal),
+  });
+  if (!response.ok) return {};
+  let data: unknown;
   try {
-    const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
-      body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
-      signal: requestSignal(signal),
-    });
-    if (!response.ok) return {};
-    data = (await response.json().catch(() => undefined)) as Record<string, unknown> | undefined;
+    data = await response.json();
   } catch {
     return {};
   }
-  if (data === undefined) return {};
   if (!data || typeof data !== "object" || Array.isArray(data)) return { plan: null };
-  return { projectId: extractProjectId(data), plan: extractPaidTierPlan(data) };
+  const projectId = extractProjectId(data as Record<string, unknown>);
+  return { ...(projectId ? { projectId } : {}), plan: extractPaidTierPlan(data as Record<string, unknown>) };
 }
 
 async function onboardProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
@@ -174,7 +175,7 @@ export async function discoverAntigravityAccount(accessToken: string, signal?: A
   const discovery = await loadCodeAssistDiscovery(accessToken, signal);
   if (discovery.projectId) return discovery;
   const onboarded = await onboardProject(accessToken, signal).catch(() => undefined);
-  return { ...(onboarded ? { projectId: onboarded } : {}), ...(discovery.plan !== undefined ? { plan: discovery.plan } : {}) };
+  return { ...discovery, ...(onboarded ? { projectId: onboarded } : {}) };
 }
 
 /** Discover the CCA project for an access token (loadCodeAssist → onboardUser fallback). */
@@ -254,7 +255,7 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
       // missing CCA project — otherwise status shows "logged in" while all calls fail closed.
       throw new Error("Antigravity login could not discover a Cloud Code Assist project for this account. Ensure the account has Antigravity/Cloud Code Assist access and try again.");
     }
-    return { ...creds, projectId: discovery.projectId, ...(discovery.plan !== undefined ? { plan: discovery.plan } : {}) };
+    return { ...creds, ...discovery };
   }
 }
 
@@ -272,14 +273,9 @@ export async function refreshAntigravityToken(refreshToken: string, signal?: Abo
   }, signal);
   const creds = credentialsFromPayload(payload, refreshToken);
   // Re-discover on refresh so a newly-onboarded account fills in projectId and a reported tier is
-  // refreshed. A discovery hiccup must never fail the refresh: loadCodeAssist folds network and
-  // onboarding errors into "no observation", which merged() then retains.
-  const discovery = await discoverAntigravityAccount(creds.access, signal);
-  return {
-    ...creds,
-    ...(discovery.projectId ? { projectId: discovery.projectId } : {}),
-    ...(discovery.plan !== undefined ? { plan: discovery.plan } : {}),
-  };
+  // refreshed. A fetch rejection must not fail token refresh or clear a previous plan.
+  const discovery = await discoverAntigravityAccount(creds.access, signal).catch(() => ({}));
+  return { ...creds, ...discovery };
 }
 
 /**
diff --git a/src/oauth/store.ts b/src/oauth/store.ts
index 47c04ee6e3c..87741a744c1 100644
--- a/src/oauth/store.ts
+++ b/src/oauth/store.ts
@@ -532,10 +532,11 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
   if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
   if (typeof candidate.projectId === "string" && candidate.projectId.length > 0) normalized.projectId = candidate.projectId;
-  if (candidate.plan === null) normalized.plan = null;
-  else if (typeof candidate.plan === "string") {
-    const plan = candidate.plan.trim();
-    if (plan.length > 0 && plan.length <= 128 && !/[\x00-\x1f\x7f]/.test(plan)) normalized.plan = plan;
+  if (candidate.plan !== undefined) {
+    if (typeof candidate.plan === "string" && !/[\x00-\x1f\x7f-\x9f]/.test(candidate.plan)) {
+      const plan = candidate.plan.trim();
+      normalized.plan = plan.length > 0 && plan.length <= 128 ? plan : null;
+    } else normalized.plan = null;
   }
   if (typeof candidate.apiBaseUrl === "string" && candidate.apiBaseUrl.length > 0) {
     // Persist only allowlisted origins; drop anything else so auth.json cannot
@@ -854,6 +855,12 @@ export interface OAuthCredentialWriteReceipt {
   previousAccount: ProviderAccount | undefined;
 }
 
+function retainUnobservedPlan(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCredentials {
+  return fresh.plan === undefined && previous.plan !== undefined
+    ? { ...fresh, plan: previous.plan }
+    : fresh;
+}
+
 export async function saveCredentialWithReceipt(
   provider: string,
   cred: OAuthCredentials,
@@ -878,7 +885,7 @@ export async function saveCredentialWithReceipt(
     } else if (identity) {
       const existing = set.accounts.find(a => (a.credential.accountId ?? a.credential.email) === identity);
       if (existing) {
-        existing.credential = safe;
+        existing.credential = retainUnobservedPlan(safe, existing.credential);
         delete existing.needsReauth;
         if (existing.paused !== true) set.activeAccountId = existing.id;
         accountId = existing.id;
@@ -1145,7 +1152,7 @@ export async function saveAccountCredential(
     const set = store[provider];
     const account = set?.accounts.find(a => a.id === accountId);
     if (!set || !account) return;
-    account.credential = safe;
+    account.credential = retainUnobservedPlan(safe, account.credential);
     if (opts.rotateLoginId) account.loginId = randomUUID();
     delete account.needsReauth;
     // A pause that found no usable fallback leaves the active id on a paused row. Once this
diff --git a/tests/adapters/google/google-antigravity-oauth.test.ts b/tests/adapters/google/google-antigravity-oauth.test.ts
index 3e86d67afba..9d19dcaf6bc 100644
--- a/tests/adapters/google/google-antigravity-oauth.test.ts
+++ b/tests/adapters/google/google-antigravity-oauth.test.ts
@@ -38,6 +38,21 @@ describe("antigravity project discovery", () => {
     expect(await discoverAntigravityProject("tok")).toBe("proj-nested");
   });
 
+  test.each(["network", "non-2xx", "invalid JSON"] as const)("loadCodeAssist %s follows base onboarding behavior", async mode => {
+    const { calls } = routeFetch(url => {
+      if (url.includes(":loadCodeAssist")) {
+        if (mode === "network") throw new Error("offline");
+        if (mode === "non-2xx") return new Response("unavailable", { status: 503 });
+        return new Response("not json");
+      }
+      if (url.includes(":onboardUser")) return Response.json({ done: true, response: { cloudaicompanionProject: "proj-onboarded" } });
+      throw new Error(`Unexpected request: ${url}`);
+    });
+    if (mode === "network") await expect(discoverAntigravityProject("tok")).rejects.toThrow("offline");
+    else await expect(discoverAntigravityProject("tok")).resolves.toBe("proj-onboarded");
+    expect(calls.filter(url => url.includes(":onboardUser"))).toHaveLength(mode === "network" ? 0 : 1);
+  });
+
   test("falls back to onboardUser poll loop (not-done then done)", async () => {
     let onboardCalls = 0;
     routeFetch((url, init) => {
@@ -137,7 +152,13 @@ describe("antigravity refresh", () => {
   test.each([
     [{ id: "free-tier", name: "Free" }, "Free"],
     [{ id: "paid-pro", name: "Google AI Pro" }, "Google AI Pro"],
+    [{ id: "paid-pro", name: " Google AI Pro " }, "Google AI Pro"],
     [{ id: "fixture-ultra", name: "Google AI Ultra" }, "Google AI Ultra"],
+    [{ id: "paid", name: `Google AI ${"x".repeat(118)}` }, `Google AI ${"x".repeat(118)}`],
+    [{ id: "paid", name: `Google AI ${"x".repeat(119)}` }, null],
+    [{ id: "paid", name: "Google AI Pro\n" }, null],
+    [{ id: "paid", name: "Google AI Pro\u0085" }, null],
+    [{ id: "paid", name: 42 }, null],
     [{ id: "unknown-product", name: "Other Product" }, null],
     [undefined, null],
   ] as const)("observes loadCodeAssist paidTier %p as %p", async (paidTier, expected) => {
@@ -178,20 +199,21 @@ describe("antigravity credential persistence (projectId survives the store)", ()
     ["non-2xx", "status", "Google AI Pro"],
     ["unparseable body", "invalid", "Google AI Pro"],
     ["unknown product", "unknown", null],
+    ["oversized name", "oversized", null],
     ["missing tier", "missing", null],
     ["observed null then onboarding throws", "null-onboard", null],
     ["observed Pro then onboarding throws", "pro-onboard", "Google AI Pro"],
-  ] as const)("refresh keeps or replaces previous Pro: %s", async (_label, mode, expected) => {
+  ] as const)("refresh preserves or replaces the observed plan: %s", async (_label, mode, expected) => {
     tmp = join(tmpdir(), `ag-plan-${Date.now()}-${Math.random().toString(16).slice(2)}`);
     mkdirSync(tmp, { recursive: true });
     process.env.HOME = tmp;
     process.env.OPENCODEX_HOME = join(tmp, "ocx");
     await saveCredential("google-antigravity", {
       access: "old", refresh: "rt", expires: Date.now() - 1000,
-      projectId: "proj-old", plan: "Google AI Pro",
+      projectId: "proj-old", plan: mode === "pro-onboard" ? "Free" : "Google AI Pro",
     });
     const id = getAccountSet("google-antigravity")!.activeAccountId;
-    routeFetch(url => {
+    const { calls } = routeFetch(url => {
       if (url.includes("oauth2.googleapis.com/token")) return Response.json({ access_token: "fresh", expires_in: 3600 });
       if (url.includes(":loadCodeAssist")) {
         if (mode === "throw") throw new Error("offline");
@@ -199,8 +221,9 @@ describe("antigravity credential persistence (projectId survives the store)", ()
         if (mode === "invalid") return new Response("not json");
         const paidTier = mode === "unknown" || mode === "null-onboard"
           ? { id: "other", name: "Other Product" }
+          : mode === "oversized" ? { id: "paid", name: `Google AI ${"x".repeat(119)}` }
           : mode === "pro-onboard" ? { id: "pro", name: "Google AI Pro" } : undefined;
-        return Response.json({ ...(mode === "unknown" || mode === "missing" ? { cloudaicompanionProject: "proj-new" } : {}), paidTier });
+        return Response.json({ ...(["unknown", "oversized", "missing"].includes(mode) ? { cloudaicompanionProject: "proj-new" } : {}), paidTier });
       }
       if (url.includes(":onboardUser")) {
         if (mode.endsWith("-onboard")) throw new Error("onboarding unavailable");
@@ -209,6 +232,8 @@ describe("antigravity credential persistence (projectId survives the store)", ()
       throw new Error(`Unexpected request: ${url}`);
     });
     expect(await getValidAccessTokenForAccount("google-antigravity", id)).toBe("fresh");
+    if (mode === "throw") expect(calls.some(url => url.includes(":onboardUser"))).toBe(false);
+    if (mode.endsWith("-onboard")) expect(calls.filter(url => url.includes(":onboardUser"))).toHaveLength(1);
     expect(getAccountCredential("google-antigravity", id)?.plan).toBe(expected);
     expect(getLoginStatus("google-antigravity").accounts?.[0]?.plan).toBe(expected);
   });
@@ -218,17 +243,30 @@ describe("antigravity credential persistence (projectId survives the store)", ()
     mkdirSync(tmp, { recursive: true });
     process.env.HOME = tmp;
     process.env.OPENCODEX_HOME = join(tmp, "ocx");
-    const base = { access: "a", refresh: "r", expires: Date.now() + 3_600_000 };
-    await saveCredential("google-antigravity", { ...base, plan: null });
-    expect(getCredential("google-antigravity")?.plan).toBeNull();
-    await saveCredential("google-antigravity", { ...base, plan: "  Google AI Pro  " });
-    expect(getCredential("google-antigravity")?.plan).toBe("Google AI Pro");
-    for (const bad of ["bad\nplan", "x".repeat(129)]) {
-      await saveCredential("google-antigravity", { ...base, plan: bad });
-      expect(getCredential("google-antigravity")?.plan).toBeUndefined();
-    }
+    const base = { access: "a", refresh: "r", expires: Date.now() + 3_600_000, email: "ag@example.test" };
     await saveCredential("google-antigravity", base);
     expect(getCredential("google-antigravity")?.plan).toBeUndefined();
+    expect(Object.hasOwn(getCredential("google-antigravity")!, "plan")).toBe(false);
+    for (const [input, expected] of [
+      [null, null],
+      ["  Google AI Pro  ", "Google AI Pro"],
+      [`Google AI ${"x".repeat(118)}`, `Google AI ${"x".repeat(118)}`],
+      ["bad\nplan", null],
+      ["\tGoogle AI Pro", null],
+      ["Google AI Pro\n", null],
+      ["Google AI Pro\x7f", null],
+      ["Google AI Pro\u0085", null],
+      ["x".repeat(129), null],
+      ["   ", null],
+      [42, null],
+    ] as const) {
+      await saveCredential("google-antigravity", { ...base, plan: input as string | null });
+      expect(getCredential("google-antigravity")?.plan).toBe(expected);
+      expect(Object.hasOwn(getCredential("google-antigravity")!, "plan")).toBe(true);
+    }
+    await saveCredential("google-antigravity", base);
+    expect(getCredential("google-antigravity")?.plan).toBeNull();
+    expect(Object.hasOwn(getCredential("google-antigravity")!, "plan")).toBe(true);
   });
 
   test("saveCredential + getCredential round-trips projectId (regression: was stripped by normalizeCredential)", async () => {
diff --git a/tests/oauth/oauth-reauth-bind.test.ts b/tests/oauth/oauth-reauth-bind.test.ts
index 0dca8a8891a..539142322f2 100644
--- a/tests/oauth/oauth-reauth-bind.test.ts
+++ b/tests/oauth/oauth-reauth-bind.test.ts
@@ -124,6 +124,38 @@ describe("OAuth account-scoped reauth", () => {
     expect(getAccountSet("xai")?.accounts[0]?.loginId).not.toBe(loginId);
   });
 
+  test.each([
+    ["reauth without observation", "reauth", "Google AI Pro", undefined, "Google AI Pro"],
+    ["reauth without observation after null", "reauth", null, undefined, null],
+    ["reauth with explicit null", "reauth", "Google AI Pro", null, null],
+    ["reauth with fresh Pro", "reauth", "Free", "Google AI Pro", "Google AI Pro"],
+    ["same-identity upsert without observation", "upsert", "Google AI Pro", undefined, "Google AI Pro"],
+    ["same-identity upsert with explicit null", "upsert", "Google AI Pro", null, null],
+    ["same-identity upsert with fresh Pro", "upsert", null, "Google AI Pro", "Google AI Pro"],
+  ] as const)("Antigravity %s preserves only unobserved plan", async (_case, mode, previous, incoming, expected) => {
+    await saveCredential("google-antigravity", {
+      access: "old-access", refresh: "old-refresh", expires: Date.now() + 60_000,
+      email: "ag@example.test", accountId: "ag-account", projectId: "old-project", plan: previous,
+    });
+    const slotId = getAccountSet("google-antigravity")!.activeAccountId;
+    const provider = OAUTH_PROVIDERS["google-antigravity"]!;
+    const original = provider.login;
+    provider.login = async () => ({
+      access: "new-access", refresh: "new-refresh", expires: Date.now() + 60_000,
+      email: "ag@example.test", accountId: "ag-account", projectId: "new-project",
+      ...(incoming !== undefined ? { plan: incoming } : {}),
+    });
+    try {
+      await runLogin("google-antigravity", {} as OAuthController, mode === "reauth" ? { reauthAccountId: slotId } : undefined);
+    } finally {
+      provider.login = original;
+    }
+    expect(getAccountSet("google-antigravity")?.accounts).toHaveLength(1);
+    expect(getAccountCredential("google-antigravity", slotId)).toMatchObject({
+      access: "new-access", refresh: "new-refresh", projectId: "new-project", plan: expected,
+    });
+  });
+
   test("kiro-cli reauth refuses a native-origin slot before any CLI work", async () => {
     const cred: OAuthCredentials = { access: "native-access", refresh: "native-refresh", expires: Date.now() + 60_000 };
     await appendKiroAccountFromDeviceLogin(cred);