fix(antigravity): read sidecar-less WAL conversations with an immutable fallback - #3532
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P2
|
Codex review: needs maintainer review before merge. Reviewed September 11, 2026, 5:23 PM ET / 21:23 UTC (Revision 7). ClawSweeper reviewWhat this changesAdds a guarded immutable SQLite fallback for Antigravity conversations without WAL sidecars, regression coverage and documentation, plus a billing-test timing adjustment. Merge readiness✅ Ready for maintainer review The macOS history failure remains on current main and in v0.59.0. The earlier findings are resolved, the supplied real-run evidence supports recovery, and no actionable introduced defect was found. Priority: P2 Review scores
Verification
How this fits togetherCodexBar reads Antigravity’s local conversation databases to build daily token history for the CLI and Usage & Spend views. Incomplete database scans prevent publication of the entire report. flowchart TD
A[Local conversation databases] --> B[Normal read-only SQLite scan]
B --> C{Cannot open and no WAL sidecar?}
C -->|Yes| D[Immutable read with stability checks]
C -->|No| E[Existing scan result]
D --> F{Complete and stable?}
E --> F
F -->|Yes| G[Publish daily token history]
F -->|No| H[Withhold incomplete report]
Before mergeNone. Agent review detailsSecurityNone. Review metrics
Technical reviewBest possible solution: Recover stable, checkpointed conversation history while preserving ordinary WAL coordination and withholding any incomplete or changing read. Do we have a high-confidence way to reproduce the issue? Yes: the reported macOS SQLite error maps directly to current main’s incomplete-report path for a cleanly closed WAL database. This read-only review inspected source and supplied evidence without executing tests or live probes. Is this the best way to solve the issue? Yes: the retry is narrowly limited to pre-row open failures, retains existing validation and budgets, and rejects results when the database changes; the earlier snapshot and documentation concerns are addressed. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against ad8b1745257e. LabelsLabel justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (6 earlier review cycles)
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 895a9ba145
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
rating: 🐚 platinum hermit
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
476c332 to
3ea3844
Compare
a95e2b8 to
68eb982
Compare
Route System rows through the existing system Codex login even when they retain a managed storage ID. Refresh the projection and reject stale source, slot or workspace selections before login. Share action exclusion and show live reauthentication progress. Fixes steipete#3558. Thanks @Nek-12 for the credential-source comparison. No credential copying, automatic renewal, profile-home changes or projection preference changes. Production code is net five lines smaller.
Normalize primary-first Cocoa screen frames into Quartz window coordinates before containment and blocked-proxy detection. Use the CoreGraphics rectangle decoder after validating numeric fields. Covers displays above, below and offset from the primary plus actual startup recovery guards. Removes eleven production lines. Related to steipete#3377 and steipete#3355 without claiming their broader symptoms are resolved. Includes the upper-display primary-origin proxy regression from review while preserving interior/top-edge containment safeguards.
…#3562) Check existing CLI billing acceptance before scanning local history, probing the version or fetching settings. Consolidate successful and eligible Team identity-only results while preserving errors, credentials, public APIs and legacy history semantics. Extracts the lazy-scan observation from steipete#3236 without its new history format or accounting scope. Reduces production code by four lines. Co-authored-by: Yuxin Qiao <104957188+Yuxin-Qiao@users.noreply.github.com> Preserves the original post-scan/version eligibility checkpoint and identity admitted before settings enrichment.
|
Verified the main-synchronized head The real built CLI reproduces the repair with a synthetic, sidecar-less WAL database whose filename also contains A separate Developer ID–signed debug proof bundle from this head launched successfully. Peekaboo verified the synthetic status item on-screen, opened its menu, selected Cached, and observed the expected template-image renderer state before quitting it. This is native launch/interaction smoke; the CLI/database comparison above is the bug-specific proof.
Local full-suite limitation: the first attempt stopped on the unrelated Gemini helper's two-second success-case timeout; its isolated 20-test suite then passed. A fresh-private-TMPDIR full retry reached a 180-second CostUsageBoundedProgressTests fixture-seeding timeout; sampling showed file creation/open/write work. The full-suite pass is the exact-head CI run above. No tests or assertions were removed or relaxed. Contributor credit remains intact. The changelog entry is centralized in #3564, which should merge after this PR. |
Update SwiftLog to 1.15.1, SwiftLint to 0.65.1, Oxlint to 1.82.0, and Oxfmt to 0.67.0 with matching lockfile and verified platform digests. Preserve the existing formatting and lint rules. Collect the Antigravity fix note and contributor credit with the existing 0.59.1 maintenance notes, ordered by user impact. Merge after #3532; released sections and release artifacts are unchanged.
2 participants
Summary
One cleanly closed Antigravity conversation makes the whole Antigravity spend history unavailable on macOS. The Usage & Spend pane then lists no Antigravity source and shows "Refresh failures: 1", and
codexbar cost --provider antigravityreturns an empty report withhistoryCoverageIsEstablished: false.The cause is a SQLite platform behavior. When SQLite closes the last connection to a WAL database cleanly, it deletes the
-waland-shmsidecars. Apple's system SQLite (3.51.0 on macOS 26) then declines a read-only open of that file withSQLITE_CANTOPEN, because a read-only connection may not create the sidecars. The reader marks that database incomplete, the report becomes partial, and the fetcher withholds every row by design.This PR adds a narrow fallback in
AntigravityLocalReader.readDatabase:SQLITE_CANTOPENbefore any row is read, and no-walsidecar exists next to the database, the reader retries that one database withfile:<path>?immutable=1andSQLITE_OPEN_READONLY | SQLITE_OPEN_URI.-walmeans no WAL connection holds the database, so the main file alone carries the checkpointed state. A database with a-walsidecar present stays unavailable, as before.%,?, and#cannot change the URI.Statistics.immutableFallbackscounts the retries.The
#3212WAL test carried the comment "Some SQLite builds decline read-only WAL access without sidecars; that must stay unavailable." This PR argues against that ruling with field data: every new conversation lacks sidecars until some later bulk event recreates them, so the current policy blanks Antigravity spend for most macOS users most of the time.Evidence
On the reporting machine, 214 conversation databases exist. 213 have sidecars and open read-only. One has a WAL header (
writer version 2, read version 2) and no sidecars, and it fails:A one-off Swift probe that links the system SQLite3 library reproduces
rc=14at prepare after a successful open andBEGIN DEFERRED. Python's bundled SQLite 3.53.4 opens the same file and creates the sidecars. Sidecar birth times on the 213 databases cluster on five moments (184 of them on one day), not on each conversation's creation, so new conversations regularly lack sidecars.With this change, the same CLI command on the same machine returns 38 daily rows from 2026-06-20 through 2026-09-06 with
historyCoverageIsEstablished: true, and the file still has no sidecars afterwards.Trade-off
An immutable connection skips locking and change detection, so the read alone cannot prove one snapshot. The stability bracket above turns that into a fail-closed check: any change to the main file or the appearance of a
-walsidecar during the retry marks the database incomplete. The next scan reads the stable file. A temp copy would carry the same window and cost I/O on every refresh.Tests
All three cases keep the existing raw-SQLite control pattern: a separate control fixture reports which outcome the platform's SQLite produced, and the expectations follow that outcome. On Apple's SQLite the control returns
SQLITE_CANTOPENand the fallback path runs; on a SQLite that creates the sidecars itself, the ordinary path runs and no fallback is counted.AntigravityLocalWALTests: the existing sidecar-less case now expects.completecoverage and the fixture row on every platform,immutableFallbacksequal to 1 only when the control declined, and no sidecars afterwards in that case.%,?, and#reads completely through the escaped URI.-walsidecar never takes the fallback. Apple's SQLite declines that open, so the guard is exercised on macOS and the report stays partial. A root CI user can still read the file, and the control accepts that outcome.Commands run
Docs
docs/antigravity.mddescribes the fallback and its guard under "Local token history". No CHANGELOG entry, per repository convention.