[guidobouman]

Summary

• "Not enabled" only on 404. The launch preflight reports "Databricks Unity Gateway is not enabled on this workspace" only when the model-services probe returns HTTP 404. Any other non-transient, non-auth failure now says the gateway could not be verified, with the reason and the docs link. Before, those failures claimed the gateway was disabled. Auth, scope, permission and transient failures keep their existing messages.
• Memoize the gateway probe. A successful probe is cached per workspace for the life of the process. ug codex configures once for auto-setup and again on the launch path. Re-probing a gateway that had just answered only gave the flaky model-services listing another chance to fail. Failures are never cached.
• Quieter sudo note. The "Enter password to configure ..." note is skipped when sudo is passwordless, where it was misleading. Writes behave exactly as before.

The probe's retry of transient errors now comes from #1246, so this PR no longer changes retry or timeout behavior.

Tests

• A 404 reports "not enabled". A non-404, non-transient failure reports "could not verify", without "not enabled" or "transient".
• Successful probes are memoized per workspace and failures are not. A second configure_shared_state in one process doesn't re-probe.
• The sudo note is skipped when sudo is passwordless and shown otherwise.
• ruff format, ruff check and ty check are clean.
• The full suite passes except for 11 environment-dependent failures (test_agents_init.py::TestInstallToolBinary, test_e2e_user_agent.py, test_smart_router.py). Before the rebase, the same 11 also failed on an unmodified checkout.

This pull request and its description were written by Isaac.

[lilly-luo]

Nice fix overall. The 404-only "not enabled" message and the probe memoization both address real UX problems, and the tests cover the new paths well. A few things to look at:

• Retries have no backoff (databricks.py:2177): the probe now retries 429 and 5xx back-to-back, with no Retry-After handling, against an endpoint we already know is overloaded.
• Worst-case latency (databricks.py:3748): the comment says the worst case stays near the old 10s, but a hanging page 0 now takes about 40s under the spinner.
• Other definitive 4xx errors fall into the "transient" message (databricks.py:3845): worth confirming what a workspace without UG actually returns.
• Cache key (databricks.py:3827): keyed on workspace only, and it also caches empty/inconclusive "reachable" results. Fine for today's single-profile flow; a short note or a (workspace, token) key would make that explicit.
• Nit: the test_cli.py reformat of the HTTP 401 tuple is unrelated churn.

The sudo-note change looks good to me. As a side benefit, sudo -n true succeeds as root, so the note no longer appears when ug runs as root either.

[lilly-luo]

we just landed a change that fixes the 499 transient issue here: #1246

can you scope this down to just the sudo note?

[guidobouman]

Scoped it down, but think this set still makes sense. Your take?

[guidobouman]

Thanks for the approval, @lilly-luo! I don't have write access to this repo, so I can't add it to the merge queue myself. Could you queue it when you get a chance?