feat(core): support native Snowflake Cortex authentication - #47156

Summary

Supersedes #47135, #47139, and #47151. Changes only the existing Snowflake plugin and its tests. Updated against the latest v2, including the @opencode package names and current session request API.

• Use the existing OpenAI-compatible-to-native mapping and compatibility.maxTokensField, removing Snowflake's AI SDK hook/fetch wrapper and redundant package overrides. The native stream parser already supports empty delta roles, so stream-role rewriting is unnecessary.
• Add browser OAuth with account/role prompts, PKCE, a scoped loopback callback, and token refresh. Add an account prompt for manual PATs and construct account-specific endpoints from environment, saved credentials, or configuration.
• Register only SNOWFLAKE_CORTEX_TOKEN and SNOWFLAKE_CORTEX_PAT as credential environment variables. SNOWFLAKE_ACCOUNT configures the endpoint and is never an API key.
• Use session HTTP hooks for environment-token overrides and Cortex's conversation-complete response. Let normal model resolution supply and proactively refresh stored credentials; refresh once on an initial 401 and let the session runner retry.
• Keep valid environment-token overrides usable even if an expired saved OAuth login has a revoked refresh token. Preserve the saved OAuth credential for when the override is removed.

Verification

The cleanup pass removes 28 lines: the plugin is 264 lines and its tests are 290. It removes redundant refresh-token arguments and callback wrappers, and shares expired-credential fixtures, stop-response assertions, and polling setup. All six Snowflake tests and their 42 assertions are retained.

Six focused Snowflake integration tests cover:

• Browser OAuth/PKCE, refresh-on-401, and native retry credentials.
• Manual PAT account selection, native max-token serialization, and empty-role SSE parsing.
• Forged-state rejection before token exchange.
• Environment token precedence over PAT/account values and expired stored OAuth.
• Env-only PAT setup, account-only setup having no credential, and unrelated 400 errors remaining errors.
• Automatic refresh during native model resolution, including refresh-token rotation and persistence.

Token/model responses are scripted at the HTTP-client boundary; browser callbacks use a real loopback listener. Requests run through the actual model resolver, session request preparation, and native LLM stream.

Checks:

• bun typecheck in packages/core — passed.
• bun test test/plugin/provider-snowflake-cortex.test.ts test/integration.test.ts test/model-resolver.test.ts test/session-model-request.test.ts in packages/core — 67 pass.
• Focused type-aware lint — passed.
• git diff --check — passed.

No live Snowflake account authorization was performed.