fix(sse): bound Antigravity 429 retry loop and lock quota-exhausted accounts for full reset window

[ahmet-cetinkaya]

🚀 Motivation and Context

Fixes two critical gaps in Antigravity 429 handling:

1. Executor retry loop — A persistent 429 on the short-retry branch (retryAfterMs ≤ 60s) looped forever on the same endpoint/account because the branch did urlIndex--; continue without checking the shared retry counter. Production log showed 77 consecutive 429s on one daily endpoint with zero fallback.

2. Quota-exhausted lockout — After the retry-loop bound, OmniRoute fell over to the next account but re-selected the exhausted one first on every subsequent request (~60s wasted per request). The 429 body "Individual quota reached. Contact your administrator to enable overages. Resets in 164h27m24s." was not recognized as quota exhaustion, so the model was locked for only ~5s instead of the real 6.8-day reset window.

⚙️ Implementation Details

Commit 1 — fix(sse): bound Antigravity short-retry 429 loop per endpoint

• Gate the short-retry branch on retryAttemptsByUrl[urlIndex] < MAX_AUTO_RETRIES (mirroring the already-bounded sibling)
• A persistent 429 now retries at most 3× per endpoint across all 3 base URLs, then returns the 429 to account-fallback
• Regression test: tests/unit/executor-antigravity.test.ts — asserts 12 total attempts (3 × 4) and a returned 429

Commit 2 — fix(sse): lock Antigravity quota-exhausted account for full reset window

• classify429.ts — add QUOTA_PATTERNS: /individual quota reached/i, /enable overages/i
• accountFallback.ts — delegate to looksLikeQuotaExhausted() for quota patterns; extend parseRetryFromErrorText() to parse "Resets? in XhYmZs"
• The exact reset duration reaches recordModelLockoutFailure as exactCooldownMs (uncapped, per user choice)
• Verified: classify429 → quota_exhausted; parseRetryFromErrorText → 592044000 ms (164h27m24s exactly); checkFallbackError → usedUpstreamRetryHint: true

Mirrors Antigravity-Manager src-tauri/src/proxy/rate_limit.rs set_lockout_until behavior. Patterns are specific — plain rate-limit messages still classify as rate_limit.

Commit 3 — refactor(sse): address review findings from PR #3122

• Removed overly broad /quota reached/i pattern (retained only /individual quota reached/i)
• Delegated classifyErrorText() to looksLikeQuotaExhausted() for quota patterns (eliminates duplication)
• Added 30-day cap to computeDurationMs (prevents adversarial/buggy upstream from locking indefinitely)
• Flattened parseRetryFromErrorText nested structure for readability
• Added test for CREDITS_EXHAUSTED_SIGNALS "free tier of the model has been exhausted" entry
• Added test for 30-day cooldown cap

📋 Checklist for Reviewer

• Tests passed locally (10768 pass / 0 fail; coverage 79.88/75.18/82.4/79.88)
• Commit history is clean and descriptive (3 commits, all Conventional Commits)
• Code quality standards met (typecheck clean, lint 0 errors)
• Code review findings addressed (5 MAJOR, 3 MINOR fixed in commit 3)

🔗 Related

• [BUG] Circuit breaker: differentiate 429 rate-limit vs quota-exhausted #2100 — [BUG] Circuit breaker: differentiate 429 rate-limit vs quota
• [Bug] 429 quota reset time from error body not used for account cooldown #858 — [Bug] 429 quota reset time from error body not used

[gemini-code-assist]

Code Review

This pull request introduces changes to handle Antigravity / Cloud Code quota exhaustion and prevent infinite retry loops. Specifically, it bounds short-retries in AntigravityExecutor using a per-URL attempt counter to avoid infinite loops on persistent 429 errors. It also updates error parsing and classification to recognize Antigravity's 'Resets in XhYmZs' phrasing and quota-related error messages, ensuring they are correctly classified as quota exhaustion with the appropriate long cooldown rather than transient rate limits. Comprehensive unit tests have been added to verify these behaviors. There are no review comments, so I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[diegosouzapw]

Thanks, @ahmet-cetinkaya! 🙏 Two solid fixes: bounding the Antigravity 429 short-retry branch with the per-URL MAX_AUTO_RETRIES guard (no more infinite loop on a persistent 429), and locking quota-exhausted accounts for the full "Resets in XhYmZs" window via model lockout (right resilience layer — never trips the provider breaker). I pushed a small follow-up dropping the broad /quota reached/i pattern (it would also flag transient per-minute limits) — the Antigravity message is still caught by /individual quota reached/i, with a regression assertion added. Merged into release/v3.8.9.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• open-sse/executors/antigravity.ts - bounds retry loop, test added
• open-sse/services/accountFallback.ts - parsing/classification fixes
• src/shared/utils/classify429.ts - new Antigravity patterns, capped cooldown
• tests/unit/account-fallback-service.test.ts - regression tests
• tests/unit/classify429.test.ts - pattern coverage
• tests/unit/executor-antigravity.test.ts - bounded retry test

---

_{Reviewed by step-3.7-flash-20260528 · 708,913 tokens}