[Crash] OmnigentError: {'error_code': 403, 'message': 'Invalid access token. [ReqId: 145ae51b-da74-40a7-ac56-0ad190834faf]'}

[matthewmoorcroft]

Description

This crash was auto-reported by Omnigent's crash handler.

Exception: OmnigentError: {'error_code': 403, 'message': 'Invalid access token. [ReqId: 145ae51b-da74-40a7-ac56-0ad190834faf]'}

Command:

/Users/matthew.moorcroft/.local/bin/omnigent

Traceback:

Traceback (most recent call last):
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent/cli.py", line 1669, in main
    cli(args=argv, standalone_mode=False)
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/click/core.py", line 1569, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/click/core.py", line 1490, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/click/core.py", line 1970, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/click/core.py", line 1353, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/click/core.py", line 907, in invoke
    return callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent/cli.py", line 6541, in run
    _dispatch_run(
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent/cli.py", line 6219, in _dispatch_run
    run_chat(
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent/chat.py", line 441, in run_chat
    _chat_via_daemon(
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent/chat.py", line 1838, in _chat_via_daemon
    prepared = asyncio.run(
               ^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/python/cpython-3.12.13-macos-aarch64-none/lib/python3.12/asyncio/runners.py", line 195, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/python/cpython-3.12.13-macos-aarch64-none/lib/python3.12/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/python/cpython-3.12.13-macos-aarch64-none/lib/python3.12/asyncio/base_events.py", line 691, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent/chat.py", line 1697, in _prepare_chat_session_via_daemon
    created = await sdk.sessions.create(
              ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent_client/_sessions.py", line 389, in create
    raise_for_status(resp.status_code, response_body(resp))
  File "/Users/matthew.moorcroft/.local/share/uv/tools/omnigent/lib/python3.12/site-packages/omnigent_client/_errors.py", line 105, in raise_for_status
    raise OmnigentError(message, status_code, code)
omnigent_client._errors.OmnigentError: {'error_code': 403, 'message': 'Invalid access token. [ReqId: 145ae51b-da74-40a7-ac56-0ad190834faf]'}

Steps to reproduce

1. Configure Omnigent against a Databricks-fronted server (as above) and log in
   once so the pointer record exists.
2. Let the underlying Databricks OAuth refresh token expire (it lapses after
   a period of inactivity; ~9 days in my case). Confirm with:

   databricks auth describe --host https://[environment]cloud.databricks.com
   

   which reports: Unable to authenticate: A new access token could not be retrieved because the refresh token is invalid.
3. Launch a bare omnigent (which dispatches to run -> _dispatch_run).
4. Observed: the launch dies with OmnigentError 403 Invalid access token
   at sessions.create(), and the crash handler auto-files a report.
   Expected: on a TTY, detect the expired credential and run the existing
   browser databricks auth login flow (or at minimum print the exact
   databricks auth login --profile <profile> command) instead of crashing.

Version

0.7.0.dev0

OS

macOS-26.5.2

[matthewmoorcroft]

Root cause

_dispatch_run calls run_chat(...) directly and never invokes
_ensure_databricks_server_auth. That pre-flight (cli.py:2690) already exists and
is used by the host command (cli.py:6791) and the native-terminal dispatch path
(via _ensure_backend, cli.py:5874). It probes /v1/me, and when it sees the
Databricks edge signature it runs the login flow via _databricks_login
(cli.py:9222, which shells out to databricks auth login --host <workspace>).

The detection is _databricks_workspace_login_target (cli.py:9130), which keys on
a 302 -> /oidc/... redirect or a 401 carrying
WWW-Authenticate: Bearer realm="DatabricksRealm". An unauthenticated probe of my
server returns exactly that:

HTTP/2 401
www-authenticate: Bearer realm="DatabricksRealm"
x-databricks-reason-phrase: Credential was not sent or was of an unsupported type for this API.

So the pre-flight would have detected and handled this cleanly — the run path
just doesn't call it. On the launch path, DatabricksRecordAuth._sdk_token
(chat.py:761) swallows the mint failure and returns None, auth_flow
(chat.py:799) then sends the request with no Authorization header, and the
resulting 403 propagates uncaught out of sessions.create().

Notably, _ensure_databricks_server_auth's own docstring anticipates this exact
failure: without it "the run would otherwise die much later with an opaque ...
traceback from the session-create call."