Add --auto-approve to experimental prompt sites (#5026)

## Why

The rest of the CLI already exposes `--auto-approve` on confirmation
prompts: `bundle deploy`, `bundle destroy`, `pipelines deploy`,
`pipelines destroy`, `completion install`, `completion uninstall`, `auth
logout`, and `apps delete` all have it. Five prompts in experimental
commands do not, which is inconsistent and also blocks any
non-interactive use of those commands (CI, scripts).

The five sites:

- `databricks ssh setup`: "Host already exists" prompt
- `databricks ssh connect`: required IDE extension install
- `databricks ssh connect`: IDE settings update
- `databricks apps dev-remote`: viewer connection request
- `databricks apps init`: optional resource confirmation

All five are in `Hidden: true` / experimental commands.

## Changes

Before: these prompts could not be bypassed, so these commands didn't
match the `--auto-approve` convention the rest of the CLI has settled
on.
Now: each of the four owning commands accepts `--auto-approve`, and the
prompt is skipped when the flag is set.

Follows the same convention as the commands listed above: a bool flag on
the command, threaded through the options struct, checked before the
prompt. No new cmdio helper, no context-based capability, no new pattern
- just applying the existing one to the last few places that didn't have
it.

Behavior details:

- **`ssh setup --auto-approve`**: recreates an existing host config
without prompting.
- **`ssh connect --auto-approve`**: installs the required IDE SSH
extension and applies missing IDE settings without prompting. Also
removes the `cmdio.IsPromptSupported` short-circuit on the settings path
so the flag works in non-TTY contexts (the whole point).
- **`apps dev-remote --auto-approve`**: auto-approves every viewer
connection for the life of the session. Help text flags the trust
implication (anyone with the shareable dev URL is trusted). Intended for
trusted environments only.
- **`apps init --auto-approve`**: skips the `Configure <optional
resource>?` confirmation. Optional resources are only configured when
their values are supplied via `--set plugin.resourceKey.field=value`.

No `NEXT_CHANGELOG.md` entry since all commands are experimental.

## Test plan

- [x] `make checks` clean
- [x] `make lint` clean
- [x] `go test ./experimental/ssh/... ./libs/apps/vite/...
./cmd/apps/...` passes
- [x] Unit tests added:
- `TestSetup_AutoApproveRecreatesExistingHost`: Setup with
AutoApprove=true recreates a pre-existing host config
- `TestCheckIDESSHExtension_AutoApproveMissing_Installs`: extension is
installed without a prompt
- `TestCheckIDESSHExtension_NoPrompt_WithoutAutoApprove_Errors`:
non-interactive without the flag still errors with install instructions
- `TestCheckAndUpdateSettings_AutoApproveWithoutPromptSupport`: settings
applied even when prompts are unsupported
- `TestCheckAndUpdateSettings_AutoApproveCreatesMissingFile`: missing
settings file is created
  - `TestNewBridge_AutoApprove`: bridge stores the flag
- `TestBridgeHandleConnectionRequest_AutoApproveSkipsStdin`: connection
request is approved without reading stdin
- [ ] Manual: `databricks ssh setup --name h --cluster <id>` twice;
second run with `--auto-approve` recreates silently
- [ ] Manual: `databricks ssh connect --ide vscode --auto-approve` with
the SSH extension missing: installs without a prompt
- [ ] Manual: `databricks apps dev-remote --name <app> --auto-approve`:
external viewer opens the shareable URL and is approved without stdin
interaction
- [ ] Manual: `databricks apps init --name x --features analytics
--auto-approve`: optional resources are skipped when no `--set`
supplied; honored when `--set` is supplied

Author: simonfaltum

cmd/apps/dev.go

@@ -113,9 +113,10 @@ func startViteDevServer(ctx context.Context, appURL string, port int) (*exec.Cmd
 
 func newDevRemoteCmd() *cobra.Command {
 	var (
-		appName    string
-		clientPath string
-		port       int
+		appName     string
+		clientPath  string
+		port        int
+		autoApprove bool
 	)
 
 	cmd := &cobra.Command{
@@ -174,7 +175,7 @@ Examples:
 				appName = selected
 			}
 
-			bridge := vite.NewBridge(ctx, w, appName, port)
+			bridge := vite.NewBridge(ctx, w, appName, port, autoApprove)
 
 			// Validate app exists and get domain before starting Vite
 			var appDomain *url.URL
@@ -234,6 +235,7 @@ Examples:
 	cmd.Flags().StringVar(&appName, "name", "", "Name of the app to connect to (prompts if not provided)")
 	cmd.Flags().StringVar(&clientPath, "client-path", "./client", "Path to the Vite client directory")
 	cmd.Flags().IntVar(&port, "port", vitePort, "Port to run the Vite server on")
+	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Automatically approve every viewer connection. Anyone with the shareable dev URL will be trusted for the life of the session; use only in trusted environments.")
 
 	return cmd
 }

cmd/apps/init.go

@@ -76,6 +76,7 @@ func newInitCmd() *cobra.Command {
 		deploy       bool
 		run          string
 		setValues    []string
+		autoApprove  bool
 	)
 
 	cmd := &cobra.Command{
@@ -160,6 +161,7 @@ Environment variables:
 				runChanged:     cmd.Flags().Changed("run"),
 				pluginsChanged: cmd.Flags().Changed("features") || cmd.Flags().Changed("plugins"),
 				setValues:      setValues,
+				autoApprove:    autoApprove,
 			})
 		},
 	}
@@ -178,6 +180,7 @@ Environment variables:
 	_ = cmd.Flags().MarkHidden("plugins")
 	cmd.Flags().BoolVar(&deploy, "deploy", false, "Deploy the app after creation")
 	cmd.Flags().StringVar(&run, "run", "", "Run the app after creation (none, dev, dev-remote)")
+	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip confirmation prompts for optional resources. Optional resources are only configured when their values are provided via --set.")
 
 	return cmd
 }
@@ -198,6 +201,7 @@ type createOptions struct {
 	runChanged     bool     // true if --run flag was explicitly set
 	pluginsChanged bool     // true if --plugins flag was explicitly set
 	setValues      []string // --set plugin.resourceKey.field=value pairs
+	autoApprove    bool
 }
 
 // parseSetValues parses --set key=value pairs into the resourceValues map.
@@ -332,7 +336,7 @@ func parseDeployAndRunFlags(deploy bool, run string) (bool, prompt.RunMode, erro
 
 // promptForPluginsAndDeps prompts for plugins and their resource dependencies using the manifest.
 // skipDeployRunPrompt indicates whether to skip prompting for deploy/run (because flags were provided).
-func promptForPluginsAndDeps(ctx context.Context, m *manifest.Manifest, preSelectedPlugins []string, skipDeployRunPrompt bool) (*prompt.CreateProjectConfig, error) {
+func promptForPluginsAndDeps(ctx context.Context, m *manifest.Manifest, preSelectedPlugins []string, skipDeployRunPrompt, autoApprove bool) (*prompt.CreateProjectConfig, error) {
 	config := &prompt.CreateProjectConfig{
 		Dependencies: make(map[string]string),
 		Features:     preSelectedPlugins, // Reuse Features field for plugin names
@@ -394,14 +398,18 @@ func promptForPluginsAndDeps(ctx context.Context, m *manifest.Manifest, preSelec
 		}
 	}
 
-	// Step 3: Prompt for optional plugin resource dependencies
-	for _, r := range optionalResources {
-		values, err := promptForResource(ctx, r, theme, false)
-		if err != nil {
-			return nil, err
-		}
-		for k, v := range values {
-			config.Dependencies[k] = v
+	// Step 3: Prompt for optional plugin resource dependencies.
+	// With --auto-approve, optional resources are skipped here; they're only
+	// configured when their values are supplied via --set (merged later).
+	if !autoApprove {
+		for _, r := range optionalResources {
+			values, err := promptForResource(ctx, r, theme, false)
+			if err != nil {
+				return nil, err
+			}
+			for k, v := range values {
+				config.Dependencies[k] = v
+			}
 		}
 	}
 
@@ -830,7 +838,7 @@ func runCreate(ctx context.Context, opts createOptions) error {
 
 	if isInteractive && !opts.pluginsChanged && !flagsMode {
 		// Interactive mode without --plugins flag: prompt for plugins, dependencies, description
-		config, err := promptForPluginsAndDeps(ctx, m, selectedPlugins, skipDeployRunPrompt)
+		config, err := promptForPluginsAndDeps(ctx, m, selectedPlugins, skipDeployRunPrompt, opts.autoApprove)
 		if err != nil {
 			return err
 		}

experimental/ssh/cmd/connect.go

@@ -36,6 +36,7 @@ the SSH server and handling the connection proxy.
 	var liteswap string
 	var skipSettingsCheck bool
 	var environmentVersion int
+	var autoApprove bool
 
 	cmd.Flags().StringVar(&clusterID, "cluster", "", "Databricks cluster ID (for dedicated clusters)")
 	cmd.Flags().DurationVar(&shutdownDelay, "shutdown-delay", defaultShutdownDelay, "Delay before shutting down the server after the last client disconnects")
@@ -71,6 +72,8 @@ the SSH server and handling the connection proxy.
 	cmd.Flags().IntVar(&environmentVersion, "environment-version", defaultEnvironmentVersion, "Environment version for serverless compute")
 	cmd.Flags().MarkHidden("environment-version")
 
+	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip confirmation prompts, installing IDE extensions and applying IDE settings without asking")
+
 	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
 		// CLI in the proxy mode is executed by the ssh client and can't prompt for input
 		if proxyMode {
@@ -110,6 +113,7 @@ the SSH server and handling the connection proxy.
 			SkipSettingsCheck:    skipSettingsCheck,
 			EnvironmentVersion:   environmentVersion,
 			AdditionalArgs:       args,
+			AutoApprove:          autoApprove,
 		}
 		if err := opts.Validate(); err != nil {
 			return err

experimental/ssh/cmd/setup.go

@@ -28,13 +28,15 @@ an SSH host configuration to your SSH config file.
 	var sshConfigPath string
 	var shutdownDelay time.Duration
 	var autoStartCluster bool
+	var autoApprove bool
 
 	cmd.Flags().StringVar(&hostName, "name", "", "Host name to use in SSH config")
 	cmd.MarkFlagRequired("name")
 	cmd.Flags().StringVar(&clusterID, "cluster", "", "Databricks cluster ID")
 	cmd.Flags().BoolVar(&autoStartCluster, "auto-start-cluster", true, "Automatically start the cluster when establishing the ssh connection")
 	cmd.Flags().StringVar(&sshConfigPath, "ssh-config", "", "Path to SSH config file (default ~/.ssh/config)")
 	cmd.Flags().DurationVar(&shutdownDelay, "shutdown-delay", defaultShutdownDelay, "SSH server will terminate after this delay if there are no active connections")
+	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip confirmation prompts, recreating existing SSH host configs without asking")
 
 	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
 		// We want to avoid the situation where the setup command works because it pulls the auth config from a bundle,
@@ -53,6 +55,7 @@ an SSH host configuration to your SSH config file.
 			SSHConfigPath:    sshConfigPath,
 			ShutdownDelay:    shutdownDelay,
 			Profile:          wsClient.Config.Profile,
+			AutoApprove:      autoApprove,
 		}
 		clientOpts := client.ClientOptions{
 			ClusterID:        setupOpts.ClusterID,

experimental/ssh/internal/client/client.go

@@ -99,6 +99,8 @@ type ClientOptions struct {
 	SkipSettingsCheck bool
 	// Environment version for serverless compute.
 	EnvironmentVersion int
+	// If true, skip confirmation prompts for IDE extension install and IDE settings updates.
+	AutoApprove bool
 }
 
 func (o *ClientOptions) Validate() error {
@@ -234,7 +236,7 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOpt
 		if err := vscode.CheckIDECommand(opts.IDE); err != nil {
 			return err
 		}
-		if err := vscode.CheckIDESSHExtension(ctx, opts.IDE); err != nil {
+		if err := vscode.CheckIDESSHExtension(ctx, opts.IDE, opts.AutoApprove); err != nil {
 			return err
 		}
 	}
@@ -243,12 +245,15 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOpt
 	// desired server ports (or socket connection mode) for the connection to go through
 	// (as the majority of the localhost ports on the remote side are blocked by iptable rules).
 	// Plus the platform (always linux), and extensions (python and jupyter), to make the initial experience smoother.
-	if opts.IDE != "" && opts.IsServerlessMode() && !opts.ProxyMode && !opts.SkipSettingsCheck && cmdio.IsPromptSupported(ctx) {
-		err := vscode.CheckAndUpdateSettings(ctx, opts.IDE, opts.ConnectionName)
+	if opts.IDE != "" && opts.IsServerlessMode() && !opts.ProxyMode && !opts.SkipSettingsCheck {
+		err := vscode.CheckAndUpdateSettings(ctx, opts.IDE, opts.ConnectionName, opts.AutoApprove)
 		if err != nil {
 			cmdio.LogString(ctx, fmt.Sprintf("Failed to update IDE settings: %v", err))
 			cmdio.LogString(ctx, vscode.GetManualInstructions(opts.IDE, opts.ConnectionName))
 			cmdio.LogString(ctx, "Use --skip-settings-check to bypass IDE settings verification.")
+			if opts.AutoApprove {
+				return fmt.Errorf("aborted: IDE settings need to be updated manually: %w", err)
+			}
 			shouldProceed, promptErr := cmdio.AskYesOrNo(ctx, "Do you want to proceed with the connection?")
 			if promptErr != nil {
 				return fmt.Errorf("failed to prompt user: %w", promptErr)

experimental/ssh/internal/setup/setup.go

@@ -30,6 +30,8 @@ type SetupOptions struct {
 	Profile string
 	// Proxy command to use for the SSH connection
 	ProxyCommand string
+	// Skip confirmation prompts (e.g. recreate existing host config without asking)
+	AutoApprove bool
 }
 
 func validateClusterAccess(ctx context.Context, client *databricks.WorkspaceClient, clusterID string) error {
@@ -112,13 +114,18 @@ func Setup(ctx context.Context, client *databricks.WorkspaceClient, opts SetupOp
 
 	recreate := false
 	if exists {
-		recreate, err = sshconfig.PromptRecreateConfig(ctx, opts.HostName)
-		if err != nil {
-			return err
-		}
-		if !recreate {
-			cmdio.LogString(ctx, fmt.Sprintf("Skipping setup for host '%s'", opts.HostName))
-			return nil
+		if opts.AutoApprove {
+			recreate = true
+			cmdio.LogString(ctx, fmt.Sprintf("Host '%s' already exists, recreating (--auto-approve)", opts.HostName))
+		} else {
+			recreate, err = sshconfig.PromptRecreateConfig(ctx, opts.HostName)
+			if err != nil {
+				return err
+			}
+			if !recreate {
+				cmdio.LogString(ctx, fmt.Sprintf("Skipping setup for host '%s'", opts.HostName))
+				return nil
+			}
 		}
 	}
 

experimental/ssh/internal/setup/setup_test.go

@@ -256,6 +256,54 @@ func TestSetup_SuccessfulWithNewConfigFile(t *testing.T) {
 	assert.Contains(t, hostConfigStr, "--profile=test-profile")
 }
 
+func TestSetup_AutoApproveRecreatesExistingHost(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmpDir := t.TempDir()
+	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
+
+	// Pre-seed an existing host config so PromptRecreateConfig would fire without --auto-approve.
+	hostConfigDir := filepath.Join(tmpDir, ".databricks", "ssh-tunnel-configs")
+	require.NoError(t, os.MkdirAll(hostConfigDir, 0o700))
+	existingHostConfig := filepath.Join(hostConfigDir, "test-host")
+	require.NoError(t, os.WriteFile(existingHostConfig, []byte("# stale\nHost test-host\n    User stale\n"), 0o600))
+
+	configPath := filepath.Join(tmpDir, "ssh_config")
+
+	m := mocks.NewMockWorkspaceClient(t)
+	clustersAPI := m.GetMockClustersAPI()
+	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
+		DataSecurityMode: compute.DataSecurityModeSingleUser,
+	}, nil)
+
+	opts := SetupOptions{
+		HostName:      "test-host",
+		ClusterID:     "cluster-123",
+		SSHConfigPath: configPath,
+		SSHKeysDir:    tmpDir,
+		ShutdownDelay: 30 * time.Second,
+		AutoApprove:   true,
+	}
+
+	clientOpts := client.ClientOptions{
+		ClusterID:     opts.ClusterID,
+		ShutdownDelay: opts.ShutdownDelay,
+	}
+	proxyCommand, err := clientOpts.ToProxyCommand()
+	require.NoError(t, err)
+	opts.ProxyCommand = proxyCommand
+
+	err = Setup(ctx, m.WorkspaceClient, opts)
+	assert.NoError(t, err)
+
+	// Host config should be recreated (no longer contains the stale User).
+	content, err := os.ReadFile(existingHostConfig)
+	require.NoError(t, err)
+	s := string(content)
+	assert.NotContains(t, s, "User stale")
+	assert.Contains(t, s, "--cluster=cluster-123")
+}
+
 func TestSetup_SuccessfulWithExistingConfigFile(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	tmpDir := t.TempDir()

experimental/ssh/internal/vscode/run.go

@@ -95,7 +95,8 @@ func isExtensionVersionAtLeast(version, minVersion string) bool {
 
 // CheckIDESSHExtension verifies that the required Remote SSH extension is installed
 // with a compatible version, and offers to install/update it if not.
-func CheckIDESSHExtension(ctx context.Context, option string) error {
+// When autoApprove is true, the extension is installed without asking.
+func CheckIDESSHExtension(ctx context.Context, option string, autoApprove bool) error {
 	ide := getIDE(option)
 
 	out, err := exec.CommandContext(ctx, ide.Command, "--list-extensions", "--show-versions").Output()
@@ -116,18 +117,22 @@ func CheckIDESSHExtension(ctx context.Context, option string) error {
 			ide.SSHExtensionName, version, ide.MinSSHExtensionVersion)
 	}
 
-	if !cmdio.IsPromptSupported(ctx) {
-		return fmt.Errorf("%s Install it with: %s --install-extension %s",
-			msg, ide.Command, ide.SSHExtensionID)
-	}
+	if !autoApprove {
+		if !cmdio.IsPromptSupported(ctx) {
+			return fmt.Errorf("%s Install it with: %s --install-extension %s, or pass --auto-approve",
+				msg, ide.Command, ide.SSHExtensionID)
+		}
 
-	shouldInstall, err := cmdio.AskYesOrNo(ctx, msg+" Would you like to install it?")
-	if err != nil {
-		return fmt.Errorf("failed to prompt user: %w", err)
-	}
-	if !shouldInstall {
-		return fmt.Errorf("%s Install it with: %s --install-extension %s",
-			msg, ide.Command, ide.SSHExtensionID)
+		shouldInstall, err := cmdio.AskYesOrNo(ctx, msg+" Would you like to install it?")
+		if err != nil {
+			return fmt.Errorf("failed to prompt user: %w", err)
+		}
+		if !shouldInstall {
+			return fmt.Errorf("%s Install it with: %s --install-extension %s",
+				msg, ide.Command, ide.SSHExtensionID)
+		}
+	} else {
+		cmdio.LogString(ctx, msg+" Installing automatically (--auto-approve).")
 	}
 
 	cmdio.LogString(ctx, fmt.Sprintf("Installing %q...", ide.SSHExtensionName))

experimental/ssh/internal/vscode/run_test.go

@@ -240,7 +240,7 @@ func TestCheckIDESSHExtension_UpToDate(t *testing.T) {
 	extensionOutput := "ms-python.python@2024.1.1\nms-vscode-remote.remote-ssh@0.123.0\n"
 	createFakeIDEExecutable(t, tmpDir, "code", extensionOutput)
 
-	err := CheckIDESSHExtension(ctx, VSCodeOption)
+	err := CheckIDESSHExtension(ctx, VSCodeOption, false)
 	assert.NoError(t, err)
 }
 
@@ -252,7 +252,7 @@ func TestCheckIDESSHExtension_ExactMinVersion(t *testing.T) {
 	extensionOutput := "ms-vscode-remote.remote-ssh@0.120.0\n"
 	createFakeIDEExecutable(t, tmpDir, "code", extensionOutput)
 
-	err := CheckIDESSHExtension(ctx, VSCodeOption)
+	err := CheckIDESSHExtension(ctx, VSCodeOption, false)
 	assert.NoError(t, err)
 }
 
@@ -264,7 +264,7 @@ func TestCheckIDESSHExtension_Missing(t *testing.T) {
 	extensionOutput := "ms-python.python@2024.1.1\n"
 	createFakeIDEExecutable(t, tmpDir, "code", extensionOutput)
 
-	err := CheckIDESSHExtension(ctx, VSCodeOption)
+	err := CheckIDESSHExtension(ctx, VSCodeOption, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), `"Remote - SSH"`)
 	assert.Contains(t, err.Error(), "not installed")
@@ -278,7 +278,7 @@ func TestCheckIDESSHExtension_Outdated(t *testing.T) {
 	extensionOutput := "ms-vscode-remote.remote-ssh@0.100.0\n"
 	createFakeIDEExecutable(t, tmpDir, "code", extensionOutput)
 
-	err := CheckIDESSHExtension(ctx, VSCodeOption)
+	err := CheckIDESSHExtension(ctx, VSCodeOption, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "0.100.0")
 	assert.Contains(t, err.Error(), ">= 0.120.0")
@@ -292,6 +292,31 @@ func TestCheckIDESSHExtension_Cursor(t *testing.T) {
 	extensionOutput := "anysphere.remote-ssh@1.0.32\n"
 	createFakeIDEExecutable(t, tmpDir, "cursor", extensionOutput)
 
-	err := CheckIDESSHExtension(ctx, CursorOption)
+	err := CheckIDESSHExtension(ctx, CursorOption, false)
 	assert.NoError(t, err)
 }
+
+func TestCheckIDESSHExtension_AutoApproveMissing_Installs(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("PATH", tmpDir)
+	ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+
+	// Fake `code` returns no extensions for --list-extensions, but succeeds for --install-extension.
+	createFakeIDEExecutable(t, tmpDir, "code", "")
+
+	err := CheckIDESSHExtension(ctx, VSCodeOption, true)
+	assert.NoError(t, err)
+}
+
+func TestCheckIDESSHExtension_NoPrompt_WithoutAutoApprove_Errors(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("PATH", tmpDir)
+	ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+
+	extensionOutput := "ms-python.python@2024.1.1\n"
+	createFakeIDEExecutable(t, tmpDir, "code", extensionOutput)
+
+	err := CheckIDESSHExtension(ctx, VSCodeOption, false)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--install-extension")
+}