chore(release): update 5.0.3-beta.1 release notes and fix GCP/autostart/multimodal issues (Fixes #3820, #3823, #3824)

Author: lbjlaq

CHANGELOG.md

@@ -4,6 +4,19 @@
 
 *   **版本演进**:
     *   **v5.0.3-beta.1 (2026-11-04)**:
+        -   **[官方 GCP Vertex AI 企业账号支持与多协议凭据自适应隔离] (Fixes #3823)**:
+            -   **对齐官方 GCP 企业客户端凭据**: 深度逆向对齐官方 Antigravity 应用的 GCP / Vertex AI 企业授权协议架构，引入官方企业客户端（`884354919052-...`）及密钥体系，支持通过 `antigravity_gcp` 独立注册与动态鉴权，彻底解决企业组织账号授权后被误判为 Free Tier 或缺失 Vertex AI 项目配额的缺陷。(Fixes #3823)
+            -   **存量凭据数据严格向下兼容**: 账号凭据严格通过 `token.oauth_client_key` 与 `is_gcp_tos` 区分；存量使用个人版官方客户端授权的自定义域名企业邮箱（如 `@imsot.org`）100% 保持个人模式平滑刷新，杜绝因仅凭邮箱后缀切换客户端导致 Google 报 `400 invalid_grant` 的风险。
+            -   **添加账号全模式多语言支持**: 重构前端添加账号弹窗，将“个人账号 (Personal)”与“企业 / GCP (Vertex AI)”账号类型切换器提升至公共顶层区域，统一覆盖 OAuth 授权、Refresh Token 批量录入及本地 DB 导入全场景；并同步补齐了中英日繁韩西葡俄土越阿缅等 12 种主流语言的完整本地化翻译。(Fixes #3823)
+            -   **IDE 状态数据库与自适应刷新注入**: 在向本地 Antigravity IDE 数据库（`state.vscdb`）注入凭据时，根据客户端类型精准控制 Protobuf Field 6（`is_gcp_tos`）与 Vertex AI 项目映射；刷新机制自适应账号所属凭据类型，杜绝跨模式客户端混用。
+        -   **[修复免打扰模式开机自启仍弹出界面与自启状态同步] (Fixes #3820, Thanks to @W2514)**:
+            -   **启动项参数防御性模糊匹配**: 修复部分 Windows 启动项（注册表或快捷方式/任务计划）拼接参数或带引号导致启动入参无法被 `== "--minimized"` 精准全等匹配、从而错将开机自启识别为普通前台启动而弹出主窗口的缺陷；增强入参检测逻辑支持模糊包含匹配（`lower.contains("--minimized") || lower.contains("--silent") || lower.contains("--hidden")`），确保免打扰启动 100% 稳定留在系统托盘。(Fixes #3820, Thanks to @W2514)
+            -   **开机自启动配置状态原子同步**: 在 `toggle_auto_launch` 注册/注销系统自启动项时，同步将 `config.auto_launch` 原子持久化写入应用配置文件，消除前端界面配置与底层操作系统注册表之间的状态脱节。(Fixes #3820)
+        -   **[多模态保鲜滑窗默认启用与风控 403 粘性熔断自动禁用] (Fixes #3824)**:
+            -   **对齐官方多模态保鲜滑窗规范**: 深度逆向对齐官方 Antigravity 应用的旧图清理与尺寸收敛机制，将网关的多模态保鲜滑动窗口设为默认开启（`enable_sliding_window = true`），默认保留最新 5 张图片（`max_fresh_images = 5`）；彻底杜绝在长对话中多轮历史图片累积导致请求体线性膨胀至数兆、引发上传堵塞及 504 Gateway Timeout 的硬伤。(Fixes #3824)
+            -   **上传速度自适应基准放宽**: 将默认最低上传带宽基准由 2.0 Mbps 宽限至 0.8 Mbps，增强慢速代理与复杂跨国网络环境下大图与附件上传的预算容忍度。
+            -   **403 人机验证阻断全链熔断与解绑**: 修复遇到 Google `VALIDATION_REQUIRED` 人机验证挑战时，粘性会话与调度快照未做阻断校验导致客户端多次重试死锁在同一故障账号的缺陷；现在检测到人机验证阻断后，立即强制解除会话粘性绑定（`session_accounts.remove`），并在快照生成与固定账号选择中无缝降级迁移至池中健康账号。
+            -   **403 自动触发禁用反代**: 发生 403 验证阻断时，同步调用 `toggle_proxy_status` 将账号标记为 `proxy_disabled = true`，使账号即刻在前端直观呈现停用状态并彻底退出反代调度池。
         -   **[网关超时全链路预算安全截断与终态会话粘性解绑] (Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)**:
             -   **客户端安全超时绝对硬顶**: 引入 `MAX_CLIENT_SAFE_TOTAL_BUDGET_SECS = 160s` 全链路安全硬上限；解决此前长文本结合多模态增量与多端点重试时总预算累加膨胀至 190s~256s 击穿下游客户端（如 JeikCode）180s 内置看门狗导致连接被强行切断为 canceled 孤儿请求的问题，为客户端看门狗预留出至少 20s 的安全缓冲，确保网关永远早于客户端吐出标准的结构化 504 响应。(Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)
             -   **首字预算基准与媒体上限压制**: 将上游首字节等待预算基准 `MAX_FIRST_BYTE_BUDGET_SECS` 压制至 135s，媒体增量上限 `MAX_FIRST_BYTE_CEILING_SECS` 压制至 145s；200k+ 超大上下文自适应 TTFT 下限同步对齐至 135s。(Fixes #3821, Thanks to @jeikl)

CHANGELOG_EN.md

@@ -4,6 +4,19 @@
 
 *   **Version History**:
     *   **v5.0.3-beta.1 (2026-11-04)**:
+        -   **[Official GCP Vertex AI Enterprise Account Support & Adaptive Credential Isolation] (Fixes #3823)**:
+            -   **Aligned with Official GCP Enterprise OAuth Credentials**: Reverse-engineered and matched the official Antigravity application architecture for GCP / Vertex AI enterprise authorization, integrating the official GCP enterprise client (`884354919052-...`) under `antigravity_gcp`. Completely resolves the issue where enterprise accounts were misidentified as Free Tier or lost access to Vertex AI project quotas. (Fixes #3823)
+            -   **Strict Backward Compatibility for Legacy Accounts**: Credentials strictly differentiate via `token.oauth_client_key` and `is_gcp_tos`; legacy accounts with custom domain emails (e.g. `@imsot.org`) previously authorized via the personal client retain 100% personal-mode refresh compatibility, preventing Google `400 invalid_grant` errors caused by naive domain-based client switching.
+            -   **Top-Level Account Type Selector Across All Import Modes with Full i18n**: Redesigned the Add Account dialog by hoisting the "Personal Account" vs. "Enterprise / GCP (Vertex AI)" type switcher to the top-level common area across OAuth, Refresh Token, and DB import modes; added complete translations across 12 languages including JA, ZH-TW, KO, ES, PT, RU, TR, VI, AR, and MY. (Fixes #3823)
+            -   **IDE Database Injection & Adaptive Refresh Integration**: Accurately toggles Protobuf Field 6 (`is_gcp_tos`) and maps the Vertex AI project when injecting credentials into the Antigravity IDE SQLite store (`state.vscdb`); ensures token refresh strictly honors the originating client descriptor.
+        -   **[Fix Quiet Autostart Still Showing Window and Sync Autostart Config] (Fixes #3820, Thanks to @W2514)**:
+            -   **Defensive Startup Argument Substring Matching**: Resolved an issue where quoted or concatenated startup parameters from certain Windows Run registry keys, shortcuts, or Task Scheduler instances failed strict equality comparisons (`== "--minimized"`), erroneously triggering an interactive window presentation on login; reinforced the check with substring pattern matching (`lower.contains("--minimized") || lower.contains("--silent") || lower.contains("--hidden")`), ensuring quiet login launch consistently stays in the system tray. (Fixes #3820, Thanks to @W2514)
+            -   **Atomic Autostart State Persistence**: Synchronously updated and persisted `config.auto_launch` to the app configuration file whenever toggling autostart via `toggle_auto_launch`, eliminating state drift between UI controls and OS registry entries. (Fixes #3820)
+        -   **[Default Multimodal Sliding Window & Automatic 403 Validation Circuit Breaking] (Fixes #3824)**:
+            -   **Aligned with Official Antigravity Multimodal Pruning**: Reverse-engineered and matched the official Antigravity app's image cleanup behavior by enabling the multimodal sliding freshness window by default (`enable_sliding_window = true`) and keeping the latest 5 images (`max_fresh_images = 5`). Prevents multiround conversations from accumulating dozens of images, inflating request payloads to multi-megabytes, and triggering upload congestion or 504 Gateway Timeouts. (Fixes #3824)
+            -   **Relaxed Adaptive Upload Bandwidth Floor**: Lowered the minimum upload speed baseline from 2.0 Mbps to 0.8 Mbps to offer higher tolerance for slow proxies and volatile cross-border networks during large payload uploads.
+            -   **Full-Chain Circuit Breaking & Session Unbinding for 403 Challenges**: Fixed an issue where encountering Google's `VALIDATION_REQUIRED` challenge failed to unbind sticky sessions or filter snapshot pools, causing repeated client retries to deadlock on the same failing account. Sticky sessions are now immediately severed (`session_accounts.remove`), and pool selection automatically fails over to healthy accounts.
+            -   **Automatic Proxy Disabling on 403**: Synchronously marks the account as `proxy_disabled = true` upon validation failure, immediately reflecting the disabled state on the GUI and cleanly removing it from proxy rotation.
         -   **[Client-Safe Gateway Timeout Clamping and Session Affinity Release on Terminal Failures] (Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)**:
             -   **Client-Safe Timeout Hard Ceiling**: Introduced `MAX_CLIENT_SAFE_TOTAL_BUDGET_SECS = 160s` across the entire upstream call pipeline. Resolved an issue where long requests combining multimodal media offsets and multi-endpoint fallbacks ballooned to 190s~256s, exceeding client-side 180s watchdogs (such as JeikCode) and severing the connection into orphan canceled requests; guarantees a ≥20s safe window so the gateway always delivers a structured 504 error before the client disconnects. (Fixes #3821, Thanks to @jeikl, @cubelikeplayDaniel)
             -   **First-Byte Budget Baseline and Media Cap Tightening**: Clamped `MAX_FIRST_BYTE_BUDGET_SECS` to 135s and the media-augmented ceiling `MAX_FIRST_BYTE_CEILING_SECS` to 145s; aligned the 200k+ large-context adaptive TTFT floor to 135s. (Fixes #3821, Thanks to @jeikl)

src-tauri/src/commands/autostart.rs

@@ -28,6 +28,14 @@ pub async fn toggle_auto_launch(app: tauri::AppHandle, enable: bool) -> Result<(
         }
     }
 
+    // 同步将开机自启状态持久化到 app_config，确保系统配置与自启项保持原子一致
+    if let Ok(mut config) = crate::modules::config::load_app_config() {
+        if config.auto_launch != enable {
+            config.auto_launch = enable;
+            let _ = crate::modules::config::save_app_config(&config);
+        }
+    }
+
     Ok(())
 }
 

src-tauri/src/lib.rs

@@ -87,6 +87,9 @@ fn apply_login_launch_policy(app: &tauri::App) {
             || lower == "--hidden"
             || lower == "-s"
             || lower == "/minimized"
+            || lower.contains("--minimized")
+            || lower.contains("--silent")
+            || lower.contains("--hidden")
     });
     if !launched_by_login {
         return;

src-tauri/src/modules/account.rs

@@ -2056,11 +2056,12 @@ pub async fn switch_account(
 }
 
 fn is_enterprise_client(client_key: Option<&str>) -> bool {
-    client_key
-        .map(str::trim)
-        .filter(|key| !key.is_empty())
-        .map(|key| key.eq_ignore_ascii_case("antigravity_enterprise"))
-        .unwrap_or(false)
+    crate::modules::oauth::is_gcp_enterprise_client(client_key)
+        || client_key
+            .map(str::trim)
+            .filter(|key| !key.is_empty())
+            .map(|key| key.eq_ignore_ascii_case("antigravity_enterprise"))
+            .unwrap_or(false)
 }
 
 fn normalize_project_id(project_id: Option<&str>) -> Option<String> {
@@ -3271,14 +3272,25 @@ pub async fn fetch_quota_with_retry(account: &mut Account) -> crate::error::AppR
                     }
                 };
 
+                let is_gcp_tos = if crate::modules::oauth::is_gcp_enterprise_client(
+                    token_res
+                        .oauth_client_key
+                        .as_deref()
+                        .or(account.token.oauth_client_key.as_deref()),
+                ) {
+                    true
+                } else {
+                    account.token.is_gcp_tos
+                };
+
                 let new_token = TokenData::new(
                     token_res.access_token.clone(),
                     account.token.refresh_token.clone(),
                     token_res.expires_in,
                     account.token.email.clone(),
                     account.token.project_id.clone(), // Keep original project_id
                     None,                             // Add None as session_id
-                    account.token.is_gcp_tos,
+                    is_gcp_tos,
                     token_res.id_token.clone(),
                 )
                 .with_oauth_client_key(
@@ -3772,6 +3784,16 @@ pub async fn batch_import_accounts_logic(
                     )
                     .await;
 
+                    let is_gcp_tos = if crate::modules::oauth::is_gcp_enterprise_client(
+                        token_res.oauth_client_key.as_deref(),
+                    ) {
+                        true
+                    } else if let Ok(existing_acc) = load_account(&account_id) {
+                        existing_acc.token.is_gcp_tos
+                    } else {
+                        false
+                    };
+
                     // 5. 构造 TokenData 与 Account（若为既有账号，保留原有偏好与配额数据原地更新，杜绝重复凭据文件！）
                     let mut account = if let Ok(mut existing_acc) = load_account(&account_id) {
                         existing_acc.token = crate::models::TokenData::new(
@@ -3781,7 +3803,7 @@ pub async fn batch_import_accounts_logic(
                             Some(real_email.clone()),
                             project_id.or(existing_acc.token.project_id.clone()),
                             None,
-                            false,
+                            is_gcp_tos,
                             token_res.id_token,
                         )
                         .with_oauth_client_key(token_res.oauth_client_key);
@@ -3803,7 +3825,7 @@ pub async fn batch_import_accounts_logic(
                             Some(real_email.clone()),
                             project_id,
                             None,
-                            false,
+                            is_gcp_tos,
                             token_res.id_token,
                         )
                         .with_oauth_client_key(token_res.oauth_client_key);

src-tauri/src/modules/db.rs

@@ -113,13 +113,18 @@ pub fn inject_token(
 ) -> Result<String, String> {
     crate::modules::logger::log_info("Starting Token injection...");
 
-    // 如果使用的是本项目的内置 Client ID (antigravity_enterprise 实际上是标准版)
-    // 则强制关闭 GCP TOS 标志，以确保 IDE 使用标准 Client ID 进行刷新
+    // 针对个人客户端（如内置标准客户端 antigravity_enterprise），若检测到误标 is_gcp_tos 则进行修正
+    // 但若为企业/GCP 客户端 (antigravity_gcp 等)，必须保留 is_gcp_tos = true
     if let Some(key) = oauth_client_key {
-        if key == "antigravity_enterprise" {
+        if crate::modules::oauth::is_gcp_enterprise_client(Some(key)) {
+            crate::modules::logger::log_info(
+                "[DB] GCP Enterprise client detected, preserving is_gcp_tos = true for injection.",
+            );
+            is_gcp_tos = true;
+        } else if key == "antigravity_enterprise" || key == "antigravity_personal" {
             if is_gcp_tos {
                 crate::modules::logger::log_info(
-                    "[DB] Built-in client detected, forcing Standard mode for injection.",
+                    "[DB] Standard client detected, forcing Standard mode for injection.",
                 );
                 is_gcp_tos = false;
             }

src-tauri/src/modules/oauth.rs

@@ -1,8 +1,19 @@
 use serde::{Deserialize, Serialize};
 
 // Google OAuth configuration
+// 个人版官方客户端 (IDE 默认)
 const CLIENT_ID: &str = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
 const CLIENT_SECRET: &str = "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";
+
+// 企业版 / GCP (Vertex AI) 官方客户端
+const GCP_CLIENT_ID: &str =
+    "884354919052-36trc1jjb3tguiac32ov6cod268c5blh.apps.googleusercontent.com";
+const GCP_CLIENT_SECRET: &str = "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";
+
+pub const BUILTIN_PERSONAL_CLIENT_KEY: &str = "antigravity_personal";
+pub const BUILTIN_ENTERPRISE_CLIENT_KEY: &str = "antigravity_enterprise";
+pub const BUILTIN_GCP_CLIENT_KEY: &str = "antigravity_gcp";
+
 const TOKEN_URL: &str = "https://oauth2.googleapis.com/token";
 const USERINFO_URL: &str = "https://www.googleapis.com/oauth2/v2/userinfo";
 const TOKEN_REFRESH_SKEW_SECONDS: i64 = 900;
@@ -74,6 +85,8 @@ pub struct OAuthClientDescriptor {
     pub client_id: String,
     pub is_active: bool,
     pub is_builtin: bool,
+    #[serde(default)]
+    pub is_gcp_tos: bool,
 }
 
 const OAUTH_CLIENTS_ENV: &str = "ANTIGRAVITY_OAUTH_CLIENTS";
@@ -87,14 +100,31 @@ fn normalize_client_key(key: &str) -> String {
     key.trim().to_ascii_lowercase()
 }
 
+pub fn is_gcp_enterprise_client(client_key: Option<&str>) -> bool {
+    let key = match client_key.map(str::trim).filter(|k| !k.is_empty()) {
+        Some(k) => k.to_ascii_lowercase(),
+        None => return false,
+    };
+    key == BUILTIN_GCP_CLIENT_KEY || key.contains("gcp") || key.contains("vertex")
+}
+
 fn build_registry() -> OAuthClientRegistry {
-    let mut clients: Vec<OAuthClientConfig> = vec![OAuthClientConfig {
-        key: normalize_client_key(DEFAULT_OAUTH_CLIENT_KEY),
-        label: "Antigravity Enterprise".to_string(),
-        client_id: CLIENT_ID.to_string(),
-        client_secret: CLIENT_SECRET.to_string(),
-        is_builtin: true,
-    }];
+    let mut clients: Vec<OAuthClientConfig> = vec![
+        OAuthClientConfig {
+            key: normalize_client_key(DEFAULT_OAUTH_CLIENT_KEY),
+            label: "Antigravity (Standard)".to_string(),
+            client_id: CLIENT_ID.to_string(),
+            client_secret: CLIENT_SECRET.to_string(),
+            is_builtin: true,
+        },
+        OAuthClientConfig {
+            key: normalize_client_key(BUILTIN_GCP_CLIENT_KEY),
+            label: "Google Cloud / Vertex AI (Enterprise)".to_string(),
+            client_id: GCP_CLIENT_ID.to_string(),
+            client_secret: GCP_CLIENT_SECRET.to_string(),
+            is_builtin: true,
+        },
+    ];
 
     if let Ok(raw_extra_clients) = std::env::var(OAUTH_CLIENTS_ENV) {
         for entry in raw_extra_clients.split(';') {
@@ -293,6 +323,7 @@ pub fn list_oauth_clients() -> Result<Vec<OAuthClientDescriptor>, String> {
             client_id: client.client_id.clone(),
             is_active: client.key == registry.active_key,
             is_builtin: client.is_builtin,
+            is_gcp_tos: is_gcp_enterprise_client(Some(&client.key)),
         })
         .collect())
 }