configure/preflight: account-level Custom URL reported as "Unity Gateway is not enabled" (303 -> /login parsed as JSON)

[rianbk]

Note: I drafted this with AI but I have read through it; the repro and evidence are from my own workspace.

Summary

When the workspace URL handed to ug is an account-level Custom URL (Account settings -> Custom URL, with "Auto redirect all previous workspace URLs" on), every workspace API call returns HTTP 303 redirecting to /login. ug tries to parse the empty body as JSON, fails, and reports:

ERROR Databricks Unity Gateway is not enabled on this workspace: model services
(response was not valid JSON (Expecting value)) are not available.

Unity Gateway is enabled on that workspace. The same metastore has 60 system.ai.* model services plus a working custom Model Provider Service with usage tracking, inference tables and rate limits configured.

This is the same class of misdiagnosis as #84 (closed), which covered an HTTP 400 Invalid Token. The trigger here is different — a 303 to the login page rather than a 400 — so the fix in #84 doesn't catch it.

Repro

1. Account has Custom URL enabled (https://<account>.databricks.com) with auto-redirect of previous workspace URLs turned on.
2. Run ug codex --workspace https://<account>.databricks.com (any harness; pi, claude and codex all fail identically).
3. Auth succeeds — ✔ Databricks authentication complete.
4. Preflight then fails with the error above.

Evidence

Using a valid OAuth token obtained for that same profile:

GET https://<account>.databricks.com/api/2.1/unity-catalog/model-services
  -> HTTP 303, 0 bytes
  -> location: /login?next_url=%2Fapi%2F2.1%2Funity-catalog%2Fmodel-services

GET https://<workspace-id>.cloud.databricks.com/api/2.1/unity-catalog/model-services
  -> HTTP 200, 34830 bytes (60 model services)

/api/2.1/unity-catalog/catalogs behaves identically on both hosts, so this is not specific to the model-services endpoint — the Custom URL does not serve token-authenticated workspace APIs at all.

Impact

The message names the wrong cause with high confidence. It asserts that a product feature is disabled when the actual problem is the URL (and therefore auth). Because Custom URL + auto-redirect makes that hostname the canonical entry point users see in the browser, pasting it into --workspace is the natural thing to do.

Diagnosing this took a long detour: the message sent us looking for missing model services and Unity Gateway enablement, neither of which was the problem.

Suggested fix

• Treat a 3xx redirect to /login, or any non-JSON content type, as an auth/URL error rather than a feature-availability error.
• Surface the actual HTTP status and redirect target in the error.
• Recommend ug configure --profile <profile> in the message.
• Optionally detect the account-console host shape and say so explicitly, since it is a known-bad value for --workspace.

Workaround

ug configure --profile <workspace-profile>

Uses the profile's host from ~/.databrickscfg (the *.cloud.databricks.com workspace URL) and connects fine — ✔ Unity Gateway connected.

Version

ug 0.1.0+198.gbbf9c40, macOS, installed via uv tool install.