cli: configure and launch with a custom OAuth app

src/ucode/agents/claude.py

@@ -29,6 +29,7 @@
     build_auth_shell_command,
     build_tool_base_url,
     get_databricks_token,
+    state_oauth_client_id,
 )
 from ucode.launcher import exec_or_spawn
 from ucode.managed_files import (
@@ -360,6 +361,7 @@ def render_overlay(
     relayed_base_url: str | None = None,
     route_root_model: str | None = None,
     custom_model: str | None = None,
+    oauth_client_id: str | None = None,
 ) -> tuple[dict, list[list[str]]]:
     """Return (overlay, managed_key_paths) for Claude settings.json.
 
@@ -477,7 +479,9 @@ def render_overlay(
     if relayed:
         keys = [["env", k] for k in env]
     else:
-        overlay["apiKeyHelper"] = build_auth_shell_command(workspace, profile, use_pat=use_pat)
+        overlay["apiKeyHelper"] = build_auth_shell_command(
+            workspace, profile, use_pat=use_pat, oauth_client_id=oauth_client_id
+        )
         keys = [["apiKeyHelper"]] + [["env", k] for k in env]
 
     # Disable Claude Code's built-in WebSearch: it declares Anthropic's hosted
@@ -641,6 +645,7 @@ def write_tool_config(
         relayed_base_url=relayed_base_url,
         route_root_model=route_root_model,
         custom_model=custom_model,
+        oauth_client_id=state_oauth_client_id(state),
     )
     tracing_env_vars = tracing_env(state, "claude")
     stop_hook_command = claude_tracing_stop_hook_command() if tracing_env_vars else None

src/ucode/agents/codex.py

@@ -27,6 +27,7 @@
     build_auth_token_argv,
     build_tool_base_url,
     get_databricks_token,
+    state_oauth_client_id,
 )
 from ucode.launcher import exec_or_spawn
 from ucode.managed_files import (
@@ -141,8 +142,11 @@ def _provider_block(
     databricks_profile: str | None,
     use_pat: bool = False,
     provider: str | None = None,
+    oauth_client_id: str | None = None,
 ) -> dict:
-    auth_argv = build_auth_token_argv(workspace, databricks_profile, use_pat=use_pat)
+    auth_argv = build_auth_token_argv(
+        workspace, databricks_profile, use_pat=use_pat, oauth_client_id=oauth_client_id
+    )
     base_url = build_tool_base_url("codex", workspace)
     http_headers = {
         "User-Agent": f"ucode/{ucode_version()} codex/{agent_version('codex')}",
@@ -173,13 +177,14 @@ def render_overlay(
     databricks_profile: str | None = None,
     use_pat: bool = False,
     provider: str | None = None,
+    oauth_client_id: str | None = None,
 ) -> dict:
     overlay: dict = {"model_provider": CODEX_MODEL_PROVIDER_NAME}
     if model:
         overlay["model"] = model
     overlay["model_providers"] = {
         CODEX_MODEL_PROVIDER_NAME: _provider_block(
-            workspace, databricks_profile, use_pat, provider
+            workspace, databricks_profile, use_pat, provider, oauth_client_id
         ),
     }
     return overlay
@@ -191,6 +196,7 @@ def render_legacy_overlay(
     databricks_profile: str | None = None,
     use_pat: bool = False,
     provider: str | None = None,
+    oauth_client_id: str | None = None,
 ) -> dict:
     """Overlay for Codex CLI < 0.134.0, which only reads `~/.codex/config.toml`.
 
@@ -205,7 +211,7 @@ def render_legacy_overlay(
         "profiles": {CODEX_PROFILE_NAME: profile_block},
         "model_providers": {
             CODEX_MODEL_PROVIDER_NAME: _provider_block(
-                workspace, databricks_profile, use_pat, provider
+                workspace, databricks_profile, use_pat, provider, oauth_client_id
             ),
         },
     }
@@ -320,6 +326,7 @@ def write_tool_config(state: dict, model: str | None = None, provider: str | Non
             databricks_profile,
             use_pat=bool(state.get("use_pat")),
             provider=provider,
+            oauth_client_id=state_oauth_client_id(state),
         )
         doc = read_toml_safe(LEGACY_CODEX_CONFIG_PATH)
         deep_merge_dict(doc, overlay)
@@ -345,6 +352,7 @@ def write_tool_config(state: dict, model: str | None = None, provider: str | Non
         databricks_profile,
         use_pat=bool(state.get("use_pat")),
         provider=provider,
+        oauth_client_id=state_oauth_client_id(state),
     )
 
     def compose(base: dict) -> dict:

src/ucode/agents/opencode.py

@@ -23,6 +23,7 @@
     build_opencode_base_urls,
     get_databricks_token,
     model_token_limits,
+    state_oauth_client_id,
 )
 from ucode.state import mark_tool_managed, save_state
 from ucode.telemetry import agent_version, ucode_version
@@ -174,6 +175,7 @@ def render_auth_plugin(state: dict) -> str:
         state["workspace"],
         state.get("profile"),
         use_pat=bool(state.get("use_pat")),
+        oauth_client_id=state_oauth_client_id(state),
     )
     # A 401 must not return the same still-unexpired cached credential.
     argv.append("--force-refresh")