Force token refresh in the auth-token apiKeyHelper

[brodrigu]

Problem

Long-running Claude Code / Codex sessions die when the original Databricks OAuth token expires (~1h), even though the apiKeyHelper is configured to refresh every 15 min via CLAUDE_CODE_API_KEY_HELPER_TTL_MS: 900000.

Root cause

ucode auth-token is the command Claude Code's apiKeyHelper (and Codex's auth command) re-invokes on that 15-min interval. It called get_databricks_token(...) without force_refresh, so the underlying databricks auth token only renewed the token when the CLI independently judged the cached token "close to expiry":

Get authentication token from the local cache… Refresh the access token if it is expired or close to expiry. Use --force-refresh to bypass expiry checks.

That heuristic can lapse between helper invocations, so the session dies at the original token's expiry. Notably, this is inconsistent with the gemini/opencode/copilot/pi agents, whose background refreshers already pass force_refresh=True.

Fix

Pass force_refresh=True from the auth-token helper so each refresh cycle bypasses the expiry heuristic and hands back a token with a full fresh lifetime.

Tests

• tests/test_cli.py — the auth-token command forwards force_refresh=True.
• tests/test_databricks.py — --force-refresh is (and by default isn't) forwarded to the real databricks auth token argv.

Full suite passes (853 passed); the only failures are two pre-existing network-dependent e2e tests that also fail on clean main.

Note for reviewers

PR #137 (Windows support) touches this same auth code and is stale against #177 — the two will conflict.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes long-running agent sessions (Claude Code/Codex) failing at ~1 hour due to Databricks OAuth token expiry by forcing a refresh on every ucode auth-token helper invocation, bypassing the Databricks CLI’s “close to expiry” heuristic.

Changes:

• Update ucode auth-token to call get_databricks_token(..., force_refresh=True) every time.
• Add CLI-level test coverage ensuring auth-token forwards force_refresh=True.
• Add Databricks argv-forwarding tests verifying --force-refresh is appended only when requested.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/ucode/cli.py	Forces refresh in auth-token helper to prevent token-expiry session drops.
tests/test_cli.py	Verifies auth-token forwards force_refresh=True and keeps stdout clean.
tests/test_databricks.py	Verifies get_databricks_token forwards --force-refresh appropriately.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[brodrigu]

Thanks — good catch. Addressed in 08bd1d4: the three --use-pat test mocks now declare force_refresh as keyword-only (lambda w, p, *, force_refresh=False), mirroring the real get_databricks_token signature so the tests fail if the call site ever passes it positionally.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[brodrigu]

Pushed 54b4432 on top of the accepted quoting suggestion:

• Path quoting — extended the >> "$argv_log" quoting to the third (pre-existing) occurrence in test_passes_profile_flag_when_provided so the fake shim is consistent.
• DATABRICKS_BEARER short-circuit — the remaining Copilot concern. Rather than patching each test, I strip DATABRICKS_BEARER once in the shared _fake_databricks helper, since get_databricks_token short-circuits on it and every test in TestGetDatabricksToken needs the fake CLI shim to actually run. A leaked CI/developer bearer would otherwise silently bypass the shim.

All 216 tests in test_databricks.py + test_cli.py pass; lint/format clean.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.