Merge branch 'main' into jb/aitools-interface

Author: simonfaltum

NEXT_CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ### Notable Changes
 
+* Breaking change: OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux) instead of `~/.databricks/token-cache.json`. After upgrading, run `databricks auth login` once per profile to re-authenticate; cached tokens from older versions are not migrated. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg` (the env var takes precedence over the config setting), then re-run `databricks auth login`. On systems where the OS keyring is not reachable (e.g. Linux containers without a D-Bus session bus), the CLI transparently falls back to the file cache when reading tokens so legacy `token-cache.json` entries remain accessible without manual configuration.
+
 ### CLI
 * Added `databricks aitools` command group for installing Databricks skills into your coding agents (Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity). Skills are fetched from [github.com/databricks/databricks-agent-skills](https://github.com/databricks/databricks-agent-skills) and either symlinked into each agent's skills directory or copied into the current project. Use `databricks aitools install` to set up, `update` to pull newer versions, `list` to see what's available, and `uninstall` to remove them.
 

acceptance/cmd/auth/describe/u2m-json-output/output.txt

@@ -2,7 +2,7 @@
 >>> [CLI] auth describe --profile u2m-profile --output json
 Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
 {
-  "mode": "plaintext",
-  "location": "~/.databricks/token-cache.json",
+  "mode": "secure",
+  "location": "OS keyring (service: databricks-cli)",
   "source": "default"
 }

acceptance/cmd/auth/describe/u2m-plaintext-config/output.txt

@@ -1,7 +1,7 @@
 
 >>> [CLI] auth describe --profile u2m-profile
 Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
-Unable to authenticate: error getting token: cache: token not found
+Unable to authenticate: error getting token: cache: no cached credentials; run `databricks auth login` to sign in
 Token storage: plaintext, ~/.databricks/token-cache.json (from auth_storage in [__settings__] section of [TEST_TMP_DIR]/home/.databrickscfg)
 -----
 Current configuration:

acceptance/cmd/auth/describe/u2m-plaintext-default/test.toml

@@ -1,7 +1,7 @@
 
 >>> [CLI] auth describe --profile u2m-profile
 Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
-Unable to authenticate: error getting token: cache: token not found
+Unable to authenticate: error getting token: cache: no cached credentials; run `databricks auth login` to sign in
 Token storage: plaintext, ~/.databricks/token-cache.json (from DATABRICKS_AUTH_STORAGE environment variable)
 -----
 Current configuration:

acceptance/cmd/auth/describe/u2m-plaintext-env/output.txt

@@ -1,8 +1,8 @@
 
 >>> [CLI] auth describe --profile u2m-profile
 Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
-Unable to authenticate: error getting token: cache: token not found
-Token storage: plaintext, ~/.databricks/token-cache.json (from default)
+Unable to authenticate: error getting token: [KEYRING_LOOKUP_ERROR]
+Token storage: secure, OS keyring (service: databricks-cli) (from default)
 -----
 Current configuration:
   ✓ host: https://u2m-profile.databricks.test (from [TEST_TMP_DIR]/home/.databrickscfg config file)

…ribe/u2m-plaintext-default/out.test.toml …escribe/u2m-secure-default/out.test.tomlacceptance/cmd/auth/describe/u2m-plaintext-default/out.test.toml renamed to acceptance/cmd/auth/describe/u2m-secure-default/out.test.toml acceptance/cmd/auth/describe/u2m-plaintext-default/out.test.toml renamed to acceptance/cmd/auth/describe/u2m-secure-default/out.test.toml

@@ -0,0 +1,11 @@
+Ignore = [
+    "home"
+]
+
+# This test runs against the real OS keyring at Lookup time (no writes).
+# macOS produces a clean miss; Linux without a usable D-Bus session bus
+# produces a backend error. Normalize both so the assertion stays on the
+# resolved storage mode, not the lookup outcome.
+[[Repls]]
+Old = 'Unable to authenticate: error getting token: .*'
+New = 'Unable to authenticate: error getting token: [KEYRING_LOOKUP_ERROR]'

…escribe/u2m-plaintext-default/output.txt …h/describe/u2m-secure-default/output.txtacceptance/cmd/auth/describe/u2m-plaintext-default/output.txt renamed to acceptance/cmd/auth/describe/u2m-secure-default/output.txt acceptance/cmd/auth/describe/u2m-plaintext-default/output.txt renamed to acceptance/cmd/auth/describe/u2m-secure-default/output.txt

@@ -36,4 +36,4 @@ logfood (Default)  [DATABRICKS_URL]  NO
 
 === Logged out profile should no longer return a token
 >>> musterr [CLI] auth token --profile logfood
-Error: cache: databricks OAuth is not configured for this host. Try logging in again with `databricks auth login --profile logfood` before retrying. If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new
+Error: cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in