v3.10.8: Fix Re-OAuth buttons, block staging/sandbox for Antigravity, prefer production endpoint

- Fix Linux GUI Re-OAuth: load_oauth_secrets() was undefined, now loads inline
- Fix GLib.idle_add lambda returning truthy tuple (repeated callbacks)
- Proxy: production cloudcode-pa.googleapis.com tried first, sandbox as fallback
- Proxy: 403 SERVICE_DISABLED falls through to next endpoint
- Project discovery validates against production endpoint, not staging
- Antigravity preset base_url changed to production
- Windows GUI project discovery also uses production endpoint

src/codex_launcher_lib.py

@@ -83,6 +83,16 @@ model_catalog_json = ""
 """
 
 CHANGELOG = [
+    ("3.10.8", "2026-05-25", [
+        "Fix Re-OAuth buttons: load_oauth_secrets() was undefined in Linux GUI",
+        "Re-OAuth: replaced deprecated OOB flow with PKCE + localhost callback",
+        "Proxy: prefer production cloudcode-pa over staging/sandbox endpoints",
+        "Proxy: fallthrough 403 SERVICE_DISABLED to next endpoint",
+        "Project discovery: validate against production endpoint, not staging",
+        "Antigravity preset base_url changed to production (was daily-cloudcode-pa.sandbox)",
+        "Fix GLib.idle_add lambda returning truthy tuple (caused repeated calls)",
+        "Windows GUI: project discovery also uses production endpoint",
+    ]),
     ("3.10.7", "2026-05-25", [
         "Prompt Enhancer: per-provider toggle to improve prompt clarity after compaction",
         "Two modes: offline (template injection) and ai-powered (external LLM rewrites)",
@@ -439,7 +449,7 @@ PROVIDER_PRESETS = {
     },
     "Google Antigravity (OAuth)": {
         "backend_type": "gemini-oauth-antigravity",
-        "base_url": "https://daily-cloudcode-pa.sandbox.googleapis.com",
+        "base_url": "https://cloudcode-pa.googleapis.com",
         "oauth_provider": "google-antigravity",
         "models": [
             "antigravity-gemini-3-flash",

src/translate-proxy.py

@@ -4812,9 +4812,9 @@ class Handler(http.server.BaseHTTPRequestHandler):
             wrapped["requestId"] = f"agent-{uuid.uuid4().hex[:12]}"
 
         endpoints = ([
+            "https://cloudcode-pa.googleapis.com",
             "https://daily-cloudcode-pa.sandbox.googleapis.com",
             "https://autopush-cloudcode-pa.sandbox.googleapis.com",
-            "https://cloudcode-pa.googleapis.com",
         ] if OAUTH_PROVIDER == "google-antigravity" else [
             "https://cloudcode-pa.googleapis.com",
         ])
@@ -4844,6 +4844,9 @@ class Handler(http.server.BaseHTTPRequestHandler):
             except Exception:
                 pass
 
+        if OAUTH_PROVIDER == "google-antigravity":
+            print(f"[antigravity-endpoint] endpoints={[e.replace('https://','') for e in endpoints]} project={project_id}", file=sys.stderr)
+
         for ep in endpoints:
             target = f"{ep}/{url_suffix}"
             req = urllib.request.Request(target, data=body_b, headers=headers)
@@ -4860,6 +4863,9 @@ class Handler(http.server.BaseHTTPRequestHandler):
                         print(f"[{self._session_id}] saved 400 debug request to {debug_path}", file=sys.stderr)
                     except Exception:
                         pass
+                if e.code == 403 and "SERVICE_DISABLED" in err_body[:500] and ep != endpoints[-1]:
+                    print(f"[{self._session_id}] {ep} SERVICE_DISABLED, trying next endpoint", file=sys.stderr)
+                    continue
                 if e.code == 429 and ep != endpoints[-1]:
                     print(f"[{self._session_id}] {ep} HTTP 429, trying next endpoint", file=sys.stderr)
                     continue