Skip to content

Reject launch source flags under managed config - #714

Merged
andy-xu-db merged 2 commits into
mainfrom
andy-xu-db/stack/andy/managed-config-cli-guard
Sep 18, 2026
Merged

andy-xu-db merged 2 commits into
mainfrom
andy-xu-db/stack/andy/managed-config-cli-guard

Conversation

@andy-xu-db

@andy-xu-db andy-xu-db commented Sep 17, 2026

Copy link
Copy Markdown
Collaborator

🥞 Stacked PR

Use this link to review incremental changes.


Summary

  • Reject explicit --provider and --model-location launch options whenever the workspace returns a managed config, including an empty config.
  • Keep the existing first-launch/bootstrap path unchanged.
  • Keep saved provider choices valid; only explicit command-line source flags are rejected.

Stack

Built directly on #710. Claude behavior is isolated in #715 and Codex behavior in #716.

Testing

  • uv run pytest -q --ignore=tests/test_e2e_user_agent.py: 2,406 passed, 41 skipped at the stack tip
  • uv run pytest tests/test_cli.py -q: 369 passed on this branch
  • Ruff check and format check pass for all changed Python files
  • git diff --check

@lilly-luo

Copy link
Copy Markdown
Collaborator

this diff looks pretty extensive to do validation. would you be able to simplify some of the refactors + clean up the tests

@andy-xu-db
andy-xu-db force-pushed the andy-xu-db/stack/andy/managed-config-cli-guard branch 2 times, most recently from 98a11d2 to 6b3d9ec Compare September 18, 2026 04:35
lilly-luo added a commit that referenced this pull request Sep 18, 2026
## 🥞 Stacked PR
Use this
[link](https://github.com/databricks/unity-gateway/pull/710/files) to
review incremental changes.
-
[**auto-claude-model-discovery**](#710)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/710/files)] ←
_this PR_
-
[stack/andy/managed-config-cli-guard](#714)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/714/files/96a954c75e38f92aa68115ca0de579dac010d781..32b156bf7e7b5cb98e4ed40c986553c2697e600c)]
-
[stack/andy/managed-config-claude-discovery](#715)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/715/files/32b156bf7e7b5cb98e4ed40c986553c2697e600c..003d5da301b465fe304ed9a28b9690e46e55ecf5)]
-
[stack/andy/managed-config-codex-discovery](#716)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/716/files/003d5da301b465fe304ed9a28b9690e46e55ecf5..1da2ad3989f3c857016d9a2226847f2aa233a194)]

---------
## Summary

- Automatically enable Claude Code gateway model discovery when a user
launches with --provider.
- Preserve the existing automatic behavior for --model-location and the
explicit hidden opt-in.
- Add CLI regression coverage for provider launches.

## Testing

- uv run pytest tests/test_cli.py tests/test_agent_claude.py — 530
passed
- uv run --frozen ruff check src/ucode/cli.py tests/test_cli.py — passed
- uv run --frozen ruff format --check src/ucode/cli.py tests/test_cli.py
— passed
- uv run --frozen pytest -q — 2,386 passed, 41 skipped, 2
environment-dependent failures in tests/test_e2e_user_agent.py: the
installed Claude binary rejected the fixture model before sending a
request, and the installed Codex binary used ambient machine-wide
configuration instead of the capture server
<img width="638" height="501" alt="Screenshot 2026-09-17 at 5 07 31 PM"
src="https://github.com/user-attachments/assets/ac58ac34-6f37-4203-ad2e-b06df8041627"
/>


https://github.com/user-attachments/assets/c6753b85-c9e7-42e0-babf-b8a03bb84e22

Co-authored-by: andy-xu-db <310751426+andy-xu-db@users.noreply.github.com>
Co-authored-by: lilly-luo <lilly.luo@databricks.com>
Comment thread src/ucode/cli.py
@andy-xu-db
andy-xu-db enabled auto-merge (squash) September 18, 2026 13:51
@andy-xu-db
andy-xu-db force-pushed the andy-xu-db/stack/andy/managed-config-cli-guard branch from 8254456 to 9b8ec21 Compare September 18, 2026 13:53
@andy-xu-db
andy-xu-db merged commit b6a3fba into main Sep 18, 2026
20 checks passed
@andy-xu-db
andy-xu-db deleted the andy-xu-db/stack/andy/managed-config-cli-guard branch September 18, 2026 15:15
andy-xu-db added a commit that referenced this pull request Sep 18, 2026
## 🥞 Stacked PR
Use this
[link](https://github.com/databricks/unity-gateway/pull/716/files/ef21ce538e90530db5f55393ba03e0823607be56..d323731a0611b024c7dce5208b7d52a2dde5b964)
to review incremental changes.
-
[auto-claude-model-discovery](#710)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/710/files)]
[MERGED]
-
[stack/andy/managed-config-cli-guard](#714)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/714/files)]
-
[stack/andy/managed-config-claude-discovery](#715)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/715/files/9b8ec21377a667876e9224618662e72c3c0f005b..ef21ce538e90530db5f55393ba03e0823607be56)]
-
[**stack/andy/managed-config-codex-discovery**](#716)
[[Files
changed](https://github.com/databricks/unity-gateway/pull/716/files/ef21ce538e90530db5f55393ba03e0823607be56..d323731a0611b024c7dce5208b7d52a2dde5b964)]
← _this PR_

---------
## Summary

- Extend the same managed MPS/Unity Catalog source precedence to Codex.
- Pass the effective source into Codex configuration and reuse its
existing automatic, source-scoped model catalog discovery at launch.
- Make a launch-scoped managed Unity Catalog parent suppress a
developer-saved provider without rewriting developer state.
- Support both generic configure and `configure --agent codex` without
requiring globally discovered models.
- Keep Claude discovery environment behavior out of the Codex path.
- Add one focused managed-MPS integration journey: bare fresh-home
launch and a nonempty scoped discovery catalog.

## Stack

Stacked on #715, #714, and #710. Merge from the bottom.

## Testing

- `uv run pytest -q --ignore=tests/test_e2e_user_agent.py`: 2,406
passed, 41 skipped at the stack tip before the integration-test-only
update
- Focused Claude/Codex/CLI and integration-contract suites after the
update: 717 passed
- Managed Claude/Codex CI lane collection verified locally
- Ruff check and format check pass for `tests/` and
`scripts/run_integration.py`
- `python3.12 scripts/run_integration.py --help`
- `git diff --check`
- Live managed integration is left to the managed CI lane because local
managed-workspace credentials were not used

Tested with MPS in Managed Config:
<img width="1346" height="565" alt="Screenshot 2026-09-18 at 9 31 22 AM"
src="https://github.com/user-attachments/assets/537ffefe-1aa2-4acf-a9dc-940239c13e54"
/>


https://github.com/user-attachments/assets/90211b36-b894-46a7-8900-93ae1685cc24

Tested with Unity Catalog Location in Managed Config:
<img width="1344" height="372" alt="Screenshot 2026-09-18 at 9 34 27 AM"
src="https://github.com/user-attachments/assets/ccdc5dc4-6e65-4ea3-9587-d7db3e5ff6aa"
/>


https://github.com/user-attachments/assets/e66e660c-ba47-4946-a082-b25f229ba052
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants