fix(antigravity): require CSRF token for agy language server discovery

[manelpb]

TL;DR

Require --csrf_token in process arguments before probing candidate language server ports on agy. This prevents discovery from querying arbitrary open TCP ports on agy without authentication.

What was happening

• AntigravityProvider.probe() passed an empty string for csrfFlag when calling probeLS(processName: "agy", ...).
• With an empty csrfFlag, LanguageServerDiscovery considered any running agy process as a candidate regardless of whether it was started with a CSRF token.
• Discovery subsequently ran lsof to find all open TCP listening ports on the process and attempted HTTP requests to each port without authentication headers.
• These requests reliably failed with HTTP 401 or 400 across open ports, delaying the refresh cycle before falling back to Cloud Code.

What this changes

• Passes csrfFlag: "--csrf_token" in AntigravityProvider.probe() when probing agy, aligning it with the language_server probe.
• Non-server agy processes lacking --csrf_token are immediately skipped, preventing unauthenticated port probes.
• Adds regression test testDiscoverySkipsCandidateWithoutRequiredCSRFFlag in AntigravityProviderTests.

Closes #1402

Tests

• swift test --filter AntigravityProviderTests (31 tests passed).
• Verified that lsof and HTTP probes are skipped when --csrf_token is missing from agy process arguments.

[github-actions]

Thanks for your interest in contributing to OpenUsage!

External pull requests must reference an open issue that:

1. Has been approved by a maintainer with the approved label.
2. Is assigned to the pull request author (@manelpb).

Please discuss the change on an issue first, wait for a maintainer to approve and assign it to you, then reopen this pull request with Fixes #123 in its description.

Read the contribution guidelines.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-17T13:31:14.911660Z	4a6ca6a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the agy discovery configuration, required-token filtering, RPC token propagation, and regression test.

• Authenticated Discovery: Requires --csrf_token for agy candidates, skipping processes without it before port discovery while preserving Cloud Code fallback.
• Regression Coverage: Adds a fake-runner test asserting that a tokenless agy candidate returns no discovery result without invoking lsof.
• Validation: Swift syntax parsing passed for both changed files. The macOS-only test suite could not be run on this Linux runner.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[validatedev]

i'll test the pr asap and will provide feedback, tysm