Add working CI (#82)

* Fix Databricks pypi proxy hostname

The hostname is pypi-proxy.cloud.databricks.com (hyphen), not
pypi.proxy.cloud.databricks.com — the dotted form doesn't resolve.

* Add network egress diagnostics to CI test job

Confirms whether the runner can reach files.pythonhosted.org,
pypi-proxy.cloud.databricks.com, and pypi.org. Earlier runs suggested
the runner can reach pythonhosted directly (wheel downloads succeed)
but can't reach the proxy or pypi.org for /simple/ lookups. Run this
to get hard evidence before talking to the runner-group owners.

Errors are tolerated so we see all three results before pytest runs.

* Switch CI to standard ubuntu-latest runners

The databricks-protected-runner-group's egress firewall blocks TLS to
pypi.org and pypi-proxy.cloud.databricks.com (only files.pythonhosted.org
is reachable for TLS handshakes), which prevents uv from resolving
build-isolation deps like setuptools to compile thrift's sdist.

Other Databricks Python repos (e.g. databricks-ai-bridge) run their
pytest CI on plain ubuntu-latest with no proxy and it works fine.
Switch both jobs to match. The test job has no need for protected
egress, and e2e only uses secrets passed via env, which work the
same on either runner.

Also removes the now-unused UV_INDEX_URL env var and the temporary
network diagnostic step.

* Strip ANSI before substring-asserting on typer help output

CI runners (e.g. GitHub Actions ubuntu-latest) set FORCE_COLOR=1, which
makes rich/typer render --help with SGR escapes that split styled tokens
across ANSI codes. ``"--agents" in result.output`` then fails because the
rendered output is actually ``--\x1b[0m\x1b[1magents``. The test passed
locally because non-TTY runs don't get colored.

Strip ANSI before checking so the assertion holds either way.

* Fix pre-existing ruff format and ty failures

- ruff format: auto-formatted src/ucode/databricks.py (collapsed lines
  ruff now considers fitting under the 100-char limit).
- ty: typed the run() wrapper with @overload so text=True narrows to
  CompletedProcess[str] (every caller that reads the return value uses
  text=True). Also guard _scrub_json's dict-key match against non-str
  keys so re.Pattern[str].search gets a str.

Test suite stays at 535 passing.

* Drop accidentally-committed local-only files

The prior commit ran `git add -A` and swept up local-only scratch files
(.antigravitycli/, .claude/, .vscode/, OPENCODE_PLAN.md, mlflow.db,
scripts/) that should never have been tracked. Removing them from the
index — they remain on disk locally.

* Close stdin on the e2e pytest run

The Databricks CLI's `auth login --no-browser` fallback path reads stdin
for the user to paste an OAuth code. In CI the runner's stdin sometimes
keeps the subprocess alive past Python's timeout, hanging the whole job
for the full ~6h workflow limit. Redirecting stdin to /dev/null makes
that fallback EOF immediately, so if M2M env vars don't yield a token
we fail fast with a clear error instead of hanging.

* Add M2M auth diagnostic step before e2e pytest

Last CI run failed with `Databricks CLI returned no access token` after
get_databricks_token's pytest fixture couldn't authenticate via M2M env
vars. The CLI's stderr is captured (and discarded) by ucode so we never
see *why* M2M failed. This diagnostic step prints the CLI version, which
auth env vars are set, whether ~/.databrickscfg exists, and the raw
output of `databricks auth token` + `current-user me` so the next run
will tell us exactly what's wrong.

* Use DATABRICKS_BEARER as CI escape hatch for e2e auth

`databricks auth token` only returns cached user-OAuth tokens (from
`databricks auth login`) — it has no M2M path. Hosted-runner CI has no
~/.databrickscfg and no cached login, so the CLI command always errors
with "OAuth is not configured for this host", and ucode's token helper
hangs on the `auth login --no-browser` fallback waiting for stdin.

Teach has_valid_databricks_auth and get_databricks_token to short-circuit
to a pre-fetched DATABRICKS_BEARER env var (the same env var
build_auth_shell_command already honors). The e2e workflow pulls it from
a repo secret; user fetches a fresh bearer (e.g. M2M client_credentials
against /oidc/v1/token) and pastes it into Settings → Secrets when the
token expires (~1h).

Removes DATABRICKS_CLIENT_ID/_SECRET from the workflow — they're no longer
load-bearing now that we don't call the CLI for auth.

* Fix e2e test monkeypatches + bump web-search timeout

- tests/test_e2e.py: TestConfigureSubset patches `run_databricks_login`
  at the wrong module path. cli.py does `from ucode.databricks import
  run_databricks_login`, so patching `ucode.databricks.run_databricks_login`
  doesn't affect the local name cli uses, and the real function runs
  (which opens a browser). Patch `ucode.cli.run_databricks_login` instead.
- mcp_web_search.py: bump urllib timeout from 60s to 180s. Codex
  Responses API with native web_search does a real web fetch + LLM
  completion, which legitimately can exceed 60s under load.

* Install agent CLIs in CI so launch tests don't skip

The six TestXxxLaunch tests all call `_require_binary("...")` and skip
when the agent isn't on PATH. The runner has only Node.js, not the
agents themselves, so every launch test skipped. Install all six
via `npm install -g` so they exercise real binaries against the e2e
workspace.

Author: rohita5l

.github/workflows/ci.yml

@@ -11,31 +11,46 @@ permissions:
 
 jobs:
   test:
-    runs-on:
-      group: databricks-protected-runner-group
-      labels: linux-ubuntu-latest
-    env:
-      UV_INDEX_URL: https://pypi.proxy.cloud.databricks.com/simple
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
       - run: uv run pytest --ignore=tests/test_e2e.py
 
   e2e:
     if: vars.E2E_ENABLED == 'true'
-    runs-on:
-      group: databricks-protected-runner-group
-      labels: linux-ubuntu-latest
+    runs-on: ubuntu-latest
     env:
-      UV_INDEX_URL: https://pypi.proxy.cloud.databricks.com/simple
       UCODE_TEST_WORKSPACE: ${{ secrets.UCODE_TEST_WORKSPACE }}
       DATABRICKS_HOST: ${{ secrets.UCODE_TEST_WORKSPACE }}
-      DATABRICKS_CLIENT_ID: ${{ secrets.DATABRICKS_CLIENT_ID }}
-      DATABRICKS_CLIENT_SECRET: ${{ secrets.DATABRICKS_CLIENT_SECRET }}
+      # DATABRICKS_BEARER is the CI escape hatch: `databricks auth token`
+      # only retrieves cached user-OAuth tokens, so on a hosted runner
+      # (no databrickscfg, no cached login) it can never produce a bearer.
+      # Pre-fetch one (e.g. via M2M OAuth client_credentials against
+      # /oidc/v1/token) and store it as a repo secret. Both
+      # has_valid_databricks_auth + get_databricks_token + the agents'
+      # apiKeyHelper short-circuit to this value when set. Tokens are
+      # short-lived (~1h); rotate when CI starts failing with 401s.
+      DATABRICKS_BEARER: ${{ secrets.DATABRICKS_BEARER }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
       - uses: databricks/setup-cli@bdb89f81c11a5bd647fd55b585b7c396ec68a25a  # v1.0.0
+      # The agent launch tests `_require_binary("codex")` etc. and skip when
+      # the CLI isn't on PATH. Install all six so each TestXxxLaunch test
+      # actually runs instead of skipping.
+      - name: Install agent CLIs
+        run: npm install -g
+          @anthropic-ai/claude-code
+          @openai/codex
+          @google/gemini-cli
+          opencode-ai
+          @github/copilot
+          @earendil-works/pi-coding-agent
       - run: uv tool install .
-      - run: uv run pytest tests/test_e2e.py -v
+      # Redirect stdin so any interactive `databricks auth login --no-browser`
+      # fallback EOFs instead of hanging the runner. With DATABRICKS_BEARER
+      # set, the auth code path doesn't shell out at all — this is a safety
+      # net for any code path we may have missed.
+      - run: uv run pytest tests/test_e2e.py -v < /dev/null

src/ucode/databricks.py

@@ -14,7 +14,7 @@
 import shutil
 import subprocess
 from pathlib import Path
-from typing import cast
+from typing import Literal, cast, overload
 from urllib import error as urllib_error
 from urllib import request as urllib_request
 from urllib.parse import urlparse
@@ -90,9 +90,7 @@ def _debug(label: str, detail: str) -> None:
         logger.debug("%s: %s", label, detail)
 
 
-_SECRET_KEY_PATTERN = re.compile(
-    r"(token|secret|password|bearer|api_key|apikey)", re.IGNORECASE
-)
+_SECRET_KEY_PATTERN = re.compile(r"(token|secret|password|bearer|api_key|apikey)", re.IGNORECASE)
 
 
 def _format_subprocess_result(
@@ -127,7 +125,11 @@ def _scrub_databrickscfg(text: str) -> str:
 def _scrub_json(value: object) -> object:
     if isinstance(value, dict):
         return {
-            k: ("<redacted>" if _SECRET_KEY_PATTERN.search(k) else _scrub_json(v))
+            k: (
+                "<redacted>"
+                if isinstance(k, str) and _SECRET_KEY_PATTERN.search(k)
+                else _scrub_json(v)
+            )
             for k, v in value.items()
         }
     if isinstance(value, list):
@@ -225,6 +227,30 @@ def _http_get_json(
         return None, f"network error: {exc.reason}"
 
 
+@overload
+def run(
+    args: list[str],
+    *,
+    check: bool = True,
+    capture_output: bool = False,
+    text: Literal[True],
+    env: dict[str, str] | None = None,
+    timeout: int | None = None,
+) -> subprocess.CompletedProcess[str]: ...
+
+
+@overload
+def run(
+    args: list[str],
+    *,
+    check: bool = True,
+    capture_output: bool = False,
+    text: Literal[False] = False,
+    env: dict[str, str] | None = None,
+    timeout: int | None = None,
+) -> subprocess.CompletedProcess[bytes]: ...
+
+
 def run(
     args: list[str],
     *,
@@ -331,6 +357,11 @@ def install_databricks_cli() -> None:
 
 
 def has_valid_databricks_auth(workspace: str) -> bool:
+    # Honor the CI short-circuit (see ``get_databricks_token``): if a
+    # pre-fetched bearer is available, treat auth as valid and skip the
+    # `databricks auth token` shell-out (which only knows user-OAuth).
+    if os.environ.get("DATABRICKS_BEARER", "").strip():
+        return True
     _log_auth_diagnostics()
     try:
         env = build_databricks_cli_env(workspace)
@@ -419,6 +450,17 @@ def ensure_databricks_auth(workspace: str) -> None:
 
 
 def get_databricks_token(workspace: str, *, force_refresh: bool = False) -> str:
+    # ``DATABRICKS_BEARER`` is the CI escape hatch: when set, skip the
+    # `databricks auth token` subprocess entirely and return the pre-fetched
+    # bearer directly. Used by the e2e job, where the protected runner has
+    # no `databricks auth login` cache and `databricks auth token` only knows
+    # how to read user-OAuth caches (not M2M client_credentials). Mirrors the
+    # same short-circuit baked into ``build_auth_shell_command``.
+    bearer = os.environ.get("DATABRICKS_BEARER", "").strip()
+    if bearer:
+        _debug("get_databricks_token", "using DATABRICKS_BEARER env var")
+        return bearer
+
     _log_auth_diagnostics()
     env = build_databricks_cli_env(workspace)
     cmd = ["databricks", "auth", "token", "--host", workspace, "--output", "json"]
@@ -429,9 +471,7 @@ def get_databricks_token(workspace: str, *, force_refresh: bool = False) -> str:
         "get_databricks_token.env",
         "set="
         + ",".join(
-            sorted(
-                k for k in env if k.startswith("DATABRICKS_") or k in {"BUNDLE_PROFILE"}
-            )
+            sorted(k for k in env if k.startswith("DATABRICKS_") or k in {"BUNDLE_PROFILE"})
         ),
     )
 

src/ucode/mcp_web_search.py

@@ -119,7 +119,7 @@ def _call_responses_api(query: str) -> dict[str, Any]:
         },
     )
     try:
-        with urllib_request.urlopen(request, timeout=60) as response:
+        with urllib_request.urlopen(request, timeout=180) as response:
             raw = response.read().decode("utf-8")
     except urllib_error.HTTPError as exc:
         detail = ""

tests/test_cli.py

@@ -2,13 +2,24 @@
 
 from __future__ import annotations
 
+import re
 from unittest.mock import patch
 
 import pytest
 from typer.testing import CliRunner
 
 from ucode.cli import app
 
+_ANSI_RE = re.compile(r"\x1b\[[0-9;]*m")
+
+
+def _strip_ansi(text: str) -> str:
+    """Drop SGR escape sequences so substring assertions match regardless of
+    whether the runner forces color rendering (e.g. CI sets FORCE_COLOR=1,
+    which makes rich split styled tokens like ``--agents`` with ANSI codes)."""
+    return _ANSI_RE.sub("", text)
+
+
 runner = CliRunner()
 
 TOOLS = ["codex", "claude", "gemini", "opencode"]
@@ -68,9 +79,10 @@ def test_subcommand_help(self, tool):
     def test_configure_help_lists_agents_flag(self):
         result = runner.invoke(app, ["configure", "--help"])
         assert result.exit_code == 0
-        assert "--agents" in result.output
-        assert "comma-separated list of agents" in result.output
-        assert "--workspaces" in result.output
+        output = _strip_ansi(result.output)
+        assert "--agents" in output
+        assert "comma-separated list of agents" in output
+        assert "--workspaces" in output
 
 
 def _patch_launch(tool: str):

tests/test_e2e.py

@@ -213,7 +213,7 @@ def test_only_picks_codex_writes_only_codex_config(self, tmp_path, monkeypatch,
         monkeypatch.setattr(state_mod, "STATE_PATH", tmp_path / "state.json")
         # Don't actually run `databricks auth login`; the developer running
         # this suite is already authenticated.
-        monkeypatch.setattr("ucode.databricks.run_databricks_login", lambda ws: None)
+        monkeypatch.setattr("ucode.cli.run_databricks_login", lambda ws: None)
         # Skip the workspace prompt and the multi-select picker.
         monkeypatch.setattr(cli_mod, "_prompt_for_configuration", lambda tool=None: e2e_workspace)
         monkeypatch.setattr(cli_mod, "prompt_for_tools", lambda available: ["codex"])
@@ -248,7 +248,7 @@ def test_rerun_with_different_pick_preserves_previous(
 
         self._redirect_config_paths(monkeypatch, tmp_path)
         monkeypatch.setattr(state_mod, "STATE_PATH", tmp_path / "state.json")
-        monkeypatch.setattr("ucode.databricks.run_databricks_login", lambda ws: None)
+        monkeypatch.setattr("ucode.cli.run_databricks_login", lambda ws: None)
         monkeypatch.setattr(cli_mod, "_prompt_for_configuration", lambda tool=None: e2e_workspace)
         monkeypatch.setattr(
             cli_mod, "install_tool_binary", lambda tool, strict=False, update_existing=False: True
@@ -281,7 +281,7 @@ def test_empty_pick_returns_zero_and_writes_nothing(self, tmp_path, monkeypatch,
 
         codex_path = self._redirect_config_paths(monkeypatch, tmp_path)
         monkeypatch.setattr(state_mod, "STATE_PATH", tmp_path / "state.json")
-        monkeypatch.setattr("ucode.databricks.run_databricks_login", lambda ws: None)
+        monkeypatch.setattr("ucode.cli.run_databricks_login", lambda ws: None)
         monkeypatch.setattr(cli_mod, "_prompt_for_configuration", lambda tool=None: e2e_workspace)
         monkeypatch.setattr(cli_mod, "prompt_for_tools", lambda available: [])
         install_calls: list[str] = []