V2: Snowflake Cortex OAuth login not supported

[kitlangton]

Summary

The v2 branch does not support the Snowflake Cortex OAuth login. V1 supports it (account-scoped PKCE OAuth with role selection and per-account endpoint); V2 has no Snowflake login method registered.

Part of the systemic V2 provider-login gap (see #34765).

Evidence

• No snowflake-cortex plugin registers a login method in packages/core/src/plugin/provider/ — only openai and opencode register OAuth methods.
• (The provider may exist in the catalog, but without the login + request auth it cannot authenticate.)

How V1 does it (reference)

packages/opencode/src/plugin/snowflake-cortex.ts:

• Collects an account input (myorg-myaccount) and optional role; PKCE OAuth against https://<account>.snowflakecomputing.com/oauth/authorize + /oauth/token-request (HTTP Basic client auth).
• Requires refresh_token in the token response; refreshes via the same account host and persists via client.auth.set (stores accountId in the credential).
• loader custom fetch that, for OAuth credentials: refreshes when expired, requires accountId, and sets Authorization: Bearer <access> (+ User-Agent). The account host determines the endpoint.

What V2 needs

1. Register the Snowflake OAuth login method (account + role inputs; PKCE; Basic client auth) in a V2 snowflake-cortex plugin.
2. Persist the Snowflake account/accountId in credential metadata (needed for both refresh and endpoint).
3. Request-time: derive the per-account base URL from credential metadata and inject Authorization: Bearer <access>; route refresh through V2's integration refresh.

Because the endpoint is account-specific, this is a good test case for the shared credential-aware request hook in #34765 setting endpoint.baseURL from credential.metadata on the native @opencode-ai/llm path.

Environment

• Branch: v2
• Status: verified against source; not runtime-reproduced (requires a Snowflake account).

[opencode-agent]

Tracker update from V2 TODO LIST audit (2026-07-02):

This is part of the broader V2 provider-login / credential-aware request-routing gap. Please coordinate with:

• V2: ChatGPT subscription (OpenAI OAuth) not routed to codex backend — HTTP 401 missing api.responses.write #34765 for the ChatGPT/OpenAI OAuth case and shared request-routing discussion
• feat(llm): add native provider packages #33689 / feat(core): load native provider packages #33925 / feat: flatten provider config and load native packages #34462 for the native provider package loading/config stack

The likely durable fix should live at the native provider package / provider-resolution seam so OAuth credential metadata and per-provider request headers/base URLs work across the native @opencode-ai/llm path, instead of re-porting one-off V1 fetch monkey-patches.

[opencode-agent]

Audit update (2026-07-08): #34843 only fixed ChatGPT/OpenAI OAuth routing (#34765); it did not add Snowflake Cortex OAuth. This issue remains open and is not resolved by that cross-reference.

[686f6c61]

I'll take this: port Snowflake Cortex OAuth login from V1 into the V2 provider plugin path (account-scoped PKCE, credential metadata, request auth/refresh).

[686f6c61]

Opened #41111 with V2 Snowflake Cortex OAuth (PKCE login, credential metadata, per-account Cortex baseURL on the native model path).