fix(antigravity): read AGY_TOKEN from bind-mounted target path

[ptone]

Summary

• File-type secrets in scion are bind-mounted directly to their target path (~/.gemini/antigravity-cli/antigravity-oauth-token), not staged to the env secret directory (~/.scion/harness/secrets/AGY_TOKEN). The provisioner failed to find the token because it only checked the env secret path.
• Adds fallback reads to the bind-mounted target path in _select_auth_method (token detection), _provision (token validation), and the generated agy-wrapper.sh (runtime keyring injection).

Test plan

• Python syntax validates (py_compile)
• go build ./... passes (no Go changes)
• Deploy with a file-type AGY_TOKEN secret and verify provisioner reads from ~/.gemini/antigravity-cli/antigravity-oauth-token
• Verify env-type AGY_TOKEN secrets still work (staging path checked first)
• Verify agy-wrapper.sh logs correct source ("from target path" vs "from staging file")

[gemini-code-assist]

Code Review

This pull request introduces a Google Cloud Monitoring metrics dashboard for Scion telemetry, enabling both global and project-scoped metrics visualization. It also adds a reimport feature to refresh harness configurations from their source URLs, updates the Antigravity harness to use file-based OAuth tokens with a new capture script, and enhances the skill creation page with a combined create-and-publish flow. On the feedback side, several improvements are recommended: the telemetry pipeline's attrSetKey should be updated to handle all OTLP scalar types to prevent incorrect metrics deduplication; file operations in capture_auth.py should be moved inside the try block to avoid unhandled exceptions; the harness-config update command should explicitly reject positional arguments when --all is specified; and duration conversions in the metrics dashboard should use the idiomatic Truncate(time.Second) method.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The current implementation of attrSetKey only checks for string and non-zero integer values. If an attribute is a boolean (e.g., true or false), a double, or an integer with a value of 0, it will be ignored or mapped to the same empty/zero representation. This can cause different attribute sets (such as debug=true and debug=false) to produce the same cache key, leading to incorrect metrics deduplication and potential data loss.

Using a type switch over kv.Value.Value allows robust and correct handling of all OTLP scalar types.

Suggested change

	if kv.Value != nil {
	if sv := kv.Value.GetStringValue(); sv != "" {
	b.WriteString(sv)
	} else if iv := kv.Value.GetIntValue(); iv != 0 {
	fmt.Fprintf(&b, "%d", iv)
	}
	}
	if kv.Value != nil {
	switch v := kv.Value.Value.(type) {
	case *commonpb.AnyValue_StringValue:
	b.WriteString(v.StringValue)
	case *commonpb.AnyValue_IntValue:
	fmt.Fprintf(&b, "%d", v.IntValue)
	case *commonpb.AnyValue_BoolValue:
	fmt.Fprintf(&b, "%t", v.BoolValue)
	case *commonpb.AnyValue_DoubleValue:
	fmt.Fprintf(&b, "%g", v.DoubleValue)
	case *commonpb.AnyValue_BytesValue:
	fmt.Fprintf(&b, "%x", v.BytesValue)
	}
	}

[gemini-code-assist]

The with open statement is placed outside the try-except block. If the file cannot be opened (for example, due to a PermissionError or other OSError), an unhandled exception will be raised, crashing the script. Moving the with open statement inside the try block ensures all file-related errors are gracefully handled.

Suggested change

	with open(config_path, "r", encoding="utf-8") as f:
	try:
	data = json.load(f)
	except (json.JSONDecodeError, OSError):
	return []
	try:
	with open(config_path, "r", encoding="utf-8") as f:
	data = json.load(f)
	except (json.JSONDecodeError, OSError):
	return []

[gemini-code-assist]

When the --all flag is specified, any positional arguments (harness-config names) are silently ignored. To prevent user confusion and ensure clear command usage, the command should return an error if both --all and positional arguments are provided.

	if len(args) > 0 && all {
		return fmt.Errorf("cannot specify a harness-config name when using --all")
	}
	if all && urlOverride != "" {

[gemini-code-assist]

Converting the duration to seconds as a float, casting it to time.Duration (which represents nanoseconds), and then multiplying by time.Second is highly non-idiomatic and hard to read. Using Truncate(time.Second) is much cleaner and idiomatic.

Suggested change

	AlignmentPeriod: durationpb.New(time.Duration(end.Sub(start).Seconds()) * time.Second),
	AlignmentPeriod: durationpb.New(end.Sub(start).Truncate(time.Second)),

[gemini-code-assist]

Converting the duration to seconds as a float, casting it to time.Duration (which represents nanoseconds), and then multiplying by time.Second is highly non-idiomatic and hard to read. Using Truncate(time.Second) is much cleaner and idiomatic.

Suggested change

	AlignmentPeriod: durationpb.New(time.Duration(end.Sub(start).Seconds()) * time.Second),
	AlignmentPeriod: durationpb.New(end.Sub(start).Truncate(time.Second)),