Tell AI agents to pass the device code login on to the user by maksim-zuev-db · Pull Request #7235 · databricks/cli

maksim-zuev-db · 2026-10-28T15:46:05Z

Stacked on #7220.

Changes

When an AI agent is detected (useragent.AgentProvider()), device code login prints a note after the user code that tells the agent to give the URL and the code to the user, not to open the URL or approve the login itself, and to ask the user for the confirmation code. In the interactive login, the note also tells the agent to enter the code at the Confirmation code prompt. Agent detection does not change the flow.

The note uses the new agent.AgentNote, which AgentNotice now uses too, with its text unchanged. The new testutil.SetAgent keeps the agent running the tests out of them.

Why

The login must be approved by the user, but an agent that runs it gets the URL and the code and could try to approve it itself, or not pass it on. Split out of #7220 to keep that PR smaller.

Tests

The device-code/non-interactive/nominal acceptance test runs both steps with AGENT set. TestPromptForConfirmationCode_Agent checks the interactive note, and libs/agent tests cover AgentNote and AgentNotice.

This pull request and its description were written by Isaac.

github-actions · 2026-10-28T15:53:32Z

Commit: db9fab4ea | Workflow run

Regression test report

Selected 2 changed tests (limit=20, 0 not selected)

2 tests: regression=2 unreleased=0 coverage=0 failing=0

test	branch	main (`df305f2`)	latest (v1.23.0)
TestAccept/cmd/auth/login/device-code/non-interactive/errors	✅	❌	❌
TestAccept/cmd/auth/login/device-code/non-interactive/nominal	✅	❌	❌

TestAccept/cmd/auth/login/device-code/non-interactive/errors: branch ✅ | main (df305f2) ❌ | latest (v1.23.0) ❌

main (df305f2):

acceptance_test.go:1342: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors273880217/002/output.txt
        @@ -65,9 +65,6 @@
         >>> AGENT=test-agent musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code AAAA-AAAA
         Error: token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code and approve the login if you haven't, then rerun this command. Run the same command without --user-code and --confirmation-code to start a new login if it still fails
         
        -Note for AI agents (test-agent): ask the user to check the confirmation code
        -and to approve the login if they haven't. Do not approve it yourself
        -
         === Rerun with the right confirmation code
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code wdjb-0001 --confirmation-code ftfa-qqky
        
    acceptance_test.go:1120: 
        LOG.expired: Using a browser on another device, visit:
        LOG.expired: http://127.0.0.1:34023/device/verification
        LOG.expired: 
        LOG.expired: And enter the code:
        LOG.expired: WDJB-0002
        LOG.expired: 
        LOG.expired: Once finished, complete the login by running the same command with
        LOG.expired: --user-code WDJB-0002 and --confirmation-code set to the confirmation code
        LOG.expired: provided in your browser.
    acceptance_test.go:1120: 
        LOG.scopes: Using a browser on another device, visit:
        LOG.scopes: http://127.0.0.1:34023/device/verification
        LOG.scopes: 
        LOG.scopes: And enter the code:
        LOG.scopes: WDJB-0003
        LOG.scopes: 
        LOG.scopes: Once finished, complete the login by running the same command with
        LOG.scopes: --user-code WDJB-0003 and --confirmation-code set to the confirmation code
        LOG.scopes: provided in your browser.
    acceptance_test.go:1120: 
        LOG.wrong-code: Using a browser on another device, visit:
        LOG.wrong-code: http://127.0.0.1:34023/device/verification
        LOG.wrong-code: 
        LOG.wrong-code: And enter the code:
        LOG.wrong-code: WDJB-0001
        LOG.wrong-code: 
        LOG.wrong-code: Once finished, complete the login by running the same command with
        LOG.wrong-code: --user-code WDJB-0001 and --confirmation-code set to the confirmation code
        LOG.wrong-code: provided in your browser.
FAIL

latest (v1.23.0):

acceptance_test.go:1342: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors3358202876/002/output.txt
        @@ -5,112 +5,276 @@
         Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Flags the non-interactive login cannot honor
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
        -Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-0001
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Missing host
         
         >>> musterr [CLI] auth login --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: the command is being run in a non-interactive environment, please specify a host using --host
         
         >>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Incomplete flags of the second step
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --user-code
        +Error: unknown flag: --confirmation-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001
        -Error: --user-code requires --confirmation-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --use-device-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Profile name that marks a pending login
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test#device-code --use-device-code
        -Error: profile name "test#device-code" must not end with #device-code, which marks pending device code logins
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-0002
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Account host
         
         >>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --user-code
         
        -=== Profile scoped to resources
        +Usage:
        +  databricks auth login [PROFILE] [flags]
         
        ->>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code cannot be used with profile resources because its login is scoped to resources. Log in without --use-device-code
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
         
        -=== No pending login
        +Global Flags:
... (150 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

TestAccept/cmd/auth/login/device-code/non-interactive/nominal: branch ✅ | main (df305f2) ❌ | latest (v1.23.0) ❌

main (df305f2):

acceptance_test.go:1342: Diff:
        --- cmd/auth/login/device-code/non-interactive/nominal/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactivenominal1172122397/002/output.txt
        @@ -101,10 +101,6 @@
         And enter the code:
         WDJB-0004
         
        -Note for AI agents (test-agent): give the URL and the code above to the user.
        -Do not open the URL or approve the login yourself: the user must approve it.
        -Ask the user for the confirmation code their browser shows.
        -
         Once finished, complete the login by running the same command with
         --user-code WDJB-0004 and --confirmation-code set to the confirmation code
         provided in your browser.

latest (v1.23.0):

acceptance_test.go:1342: Diff:
        --- cmd/auth/login/device-code/non-interactive/nominal/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactivenominal1804331209/002/output.txt
        @@ -8,106 +8,7 @@
         And enter the code:
         WDJB-0001
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0001 and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
         
        -=== The first step stores the device code and saves no profile
        -
        ->>> find.py home
        -home/.databricks/token-cache.json
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]#device-code"
        -]
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth token --host [DATABRICKS_URL]
        -json.access_token = "oauth-token";
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]"
        -]
        -
        -=== Start the login with a profile
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-0002
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0002 and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth profiles
        -Name            Host                    Valid
        -test (Default)  [DATABRICKS_URL]  YES
        -
        -=== Start the login again with the host from the saved profile
        -
        ->>> [CLI] auth login --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-0003
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0003 and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth login --profile test --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== An AI agent gets notes on passing the login on to the user
        -
        ->>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-0004
        -
        -Note for AI agents (test-agent): give the URL and the code above to the user.
        -Do not open the URL or approve the login yourself: the user must approve it.
        -Ask the user for the confirmation code their browser shows.
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0004 and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code --user-code WDJB-0004 --confirmation-code FTFA-QQKY
        -Profile agent was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1313: Missing output file: out.databrickscfg

eng-dev-ecosystem-bot · 2026-10-28T16:16:31Z

Integration test report

Commit: db9fab4

Run: 41623799824

	Env	✅pass	🙈skip	Time
✅	aws linux-2core-8gb	281	17	5:41
✅	aws-windows-latest-4core-16gb	283	15	7:15
✅	azure linux-2core-8gb	280	17	5:34
✅	azure-windows-latest-4core-16gb	282	15	7:08
✅	gcp linux-2core-8gb	281	17	5:36
✅	gcp-windows-latest-4core-16gb	283	15	7:22

Top 6 slowest tests (at least 2 minutes):

duration	env	testname
7:15	gcp-windows-latest-4core-16gb	TestAccept
7:09	aws-windows-latest-4core-16gb	TestAccept
7:01	azure-windows-latest-4core-16gb	TestAccept
4:15	azure linux-2core-8gb	TestAccept
4:13	aws linux-2core-8gb	TestAccept
4:08	gcp linux-2core-8gb	TestAccept

simonfaltum

Thanks, the note reads well and AgentNotice prints the same text as before. The main thing is the terminal-flow note, which I don't think will work for agents (inline). The rest are small.

simonfaltum · 2026-10-29T17:32:00Z

+		agentNote := deviceCodeAgentNote + "Ask the user for the confirmation code their browser shows, and enter it\n" +
+			`at the "Confirmation code" prompt of this command.`


An agent won't have an interactive terminal, so I don't think this note will work for it. Without a terminal it already gets the two-step flow and never sees this text. If the command does run in a PTY (some IDE agent terminals), the agent usually can't type into a running command, so it waits at the prompt until the login times out.

Could agent detection pick the two-step flow (start, then rerun with --user-code and --confirmation-code) even when stdin is a terminal? Then this variant of the note can go, along with the README line that says agent detection doesn't pick the flow. (If the note stays, "Confirmation code" here duplicates the AskCancellable label below, and .agents/rules/style-guide-go.md asks for a shared constant.)

Some agents are able to start commands in a terminal mode, e.g. codex:

I started the command in an interactive terminal (tty: true). When it paused for input, the tool returned a session ID while keeping the
process running.
I then used write_stdin with that session ID to send your code followed by \n, which acts like pressing Enter:
write_stdin({
session_id: 48408,
chars: "XXX\n"
})

simonfaltum

No blocking findings. Reviewed against device-code-agent-login; the change preserves both login flows and the existing AgentNotice output. The PTY explanation addresses the earlier terminal-flow concern: Codex can keep the command running and supply the confirmation code through write_stdin.

Validation: go test ./libs/agent ./cmd/auth ./internal/testutil and the changed non-interactive/nominal and non-interactive/errors acceptance tests pass locally. CI is green, including the cross-platform test matrix and integration tests.

Non-blocking nit at cmd/auth/login_device_code.go:261: the new wrong-code agent note makes the returned error end with a period, contrary to AGENTS.md's error-string rule. Drop the final period and update the snapshot.

When an AI agent is detected, the first step of the non-interactive login also prints a note that tells it to give the URL and the user code to the user, not to approve the login itself, and to ask the user for the confirmation code. Co-authored-by: Isaac <no-reply@databricks.com>

The device code login built the "Note for AI agents (<name>): " prefix by hand, like AgentNotice does. agent.Note now adds it for both, and returns an empty string when no agent is detected. AgentNotice prints the same text as before. Co-authored-by: Isaac <no-reply@databricks.com>

An agent that runs the login in a terminal, e.g. through a pseudo-terminal, got the interactive prompt without the note, so nothing told it to pass the login on to the user. The note is now part of the approval instructions that both logins print. The prompt tests clear the agent environment, so that running them from an agent does not change the output. Co-authored-by: Isaac <no-reply@databricks.com>

The interactive device code login printed the note of the non-interactive one, which tells the agent to ask the user for the confirmation code but not what to do with it. That login waits for the code at its prompt, so its note now tells the agent to enter the code there. Co-authored-by: Isaac <no-reply@databricks.com>

Co-authored-by: Isaac <no-reply@databricks.com>

Each note is used once, so it moves next to its use. Co-authored-by: Isaac <no-reply@databricks.com>

The fake server now issues a new user code for every device code login, so the agent login in the nominal test gets WDJB-0004. Co-authored-by: Isaac <no-reply@databricks.com>

The SDK reports no agent for an empty AGENT, so setting it unconditionally keeps the behavior and makes t.Setenv reject parallel tests, as the comment says. Co-authored-by: Isaac <no-reply@databricks.com>

SDK v0.191.0 detects Pi through PI_CODING_AGENT, so the nominal device code login test showed (pi) instead of (test-agent) when run inside Pi. Co-authored-by: Isaac <no-reply@databricks.com>

…code The agent runs the second step of the non-interactive login, so it reads the error that says to approve the login. The note tells it to ask the user to approve it instead. Co-authored-by: Isaac <no-reply@databricks.com>

Error strings must not end with punctuation. Co-authored-by: Isaac <no-reply@databricks.com>

maksim-zuev-db added this pull request to stack #7236 October 28, 2026 15:48

maksim-zuev-db removed this pull request from stack #7236 October 28, 2026 15:57

maksim-zuev-db added this pull request to stack #7237 October 28, 2026 15:57

maksim-zuev-db requested a review from simonfaltum October 28, 2026 16:02

maksim-zuev-db marked this pull request as ready for review October 28, 2026 16:02

maksim-zuev-db requested review from a team as code owners October 28, 2026 16:02

maksim-zuev-db force-pushed the device-code-agent-notes branch from 6636d4c to 03b79ec Compare October 29, 2026 12:15

maksim-zuev-db force-pushed the device-code-agent-notes branch from 03b79ec to 35d4fe6 Compare October 29, 2026 12:19

maksim-zuev-db mentioned this pull request Oct 29, 2026

Split device code login into authorization and token exchange steps #7217

Merged

maksim-zuev-db removed this pull request from stack #7237 October 29, 2026 12:22

maksim-zuev-db added this pull request to stack #7248 October 29, 2026 12:24

maksim-zuev-db force-pushed the device-code-agent-notes branch from 35d4fe6 to c8a6169 Compare October 29, 2026 12:59

maksim-zuev-db force-pushed the device-code-agent-notes branch from c8a6169 to 03acd36 Compare October 29, 2026 13:37

maksim-zuev-db force-pushed the device-code-agent-notes branch from 03acd36 to 46f6bad Compare October 29, 2026 16:29

simonfaltum reviewed Oct 29, 2026

View reviewed changes

maksim-zuev-db force-pushed the device-code-agent-notes branch from f52b31d to 1f1f5fe Compare October 30, 2026 14:26

maksim-zuev-db force-pushed the device-code-agent-notes branch from 1f1f5fe to 9702fd7 Compare November 2, 2026 12:54

maksim-zuev-db requested a review from simonfaltum November 2, 2026 13:17

simonfaltum approved these changes Nov 3, 2026

View reviewed changes

Base automatically changed from device-code-agent-login to main November 3, 2026 10:58

maksim-zuev-db and others added 10 commits November 3, 2026 10:58

Rename agent.Note to agent.AgentNote

7fbb0c7

Co-authored-by: Isaac <no-reply@databricks.com>

Inline the agent notes of the two device code logins

a287e6d

Each note is used once, so it moves next to its use. Co-authored-by: Isaac <no-reply@databricks.com>

Use the user code the fake server issues in the agent login test

2c8b948

The fake server now issues a new user code for every device code login, so the agent login in the nominal test gets WDJB-0004. Co-authored-by: Isaac <no-reply@databricks.com>

Always set AGENT in testutil.SetAgent

2b07a4e

The SDK reports no agent for an empty AGENT, so setting it unconditionally keeps the behavior and makes t.Setenv reject parallel tests, as the comment says. Co-authored-by: Isaac <no-reply@databricks.com>

Unset PI_CODING_AGENT in acceptance tests

79f7b66

SDK v0.191.0 detects Pi through PI_CODING_AGENT, so the nominal device code login test showed (pi) instead of (test-agent) when run inside Pi. Co-authored-by: Isaac <no-reply@databricks.com>

Drop the final period of the wrong confirmation code agent note

db9fab4

Error strings must not end with punctuation. Co-authored-by: Isaac <no-reply@databricks.com>

maksim-zuev-db force-pushed the device-code-agent-notes branch from 793e6dd to db9fab4 Compare November 3, 2026 10:58

maksim-zuev-db enabled stacked auto-merge November 3, 2026 11:28

maksim-zuev-db added this pull request to the merge queue Nov 3, 2026

Merged via the queue into main with commit 9a1e083 Nov 3, 2026
28 checks passed

maksim-zuev-db deleted the device-code-agent-notes branch November 3, 2026 11:44

Navigation Menu

Repository navigation

Tell AI agents to pass the device code login on to the user - #7235

Tell AI agents to pass the device code login on to the user#7235
maksim-zuev-db merged 11 commits into
mainfrom
device-code-agent-notes

maksim-zuev-db commented Oct 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

eng-dev-ecosystem-bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

simonfaltum left a comment

Uh oh!

simonfaltum Oct 29, 2026

Uh oh!

maksim-zuev-db Nov 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

simonfaltum left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		agentNote := deviceCodeAgentNote + "Ask the user for the confirmation code their browser shows, and enter it\n" +
		`at the "Confirmation code" prompt of this command.`

Conversation

maksim-zuev-db commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Why

Tests

Uh oh!

github-actions Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression test report

Uh oh!

eng-dev-ecosystem-bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Integration test report

Uh oh!

simonfaltum left a comment

Choose a reason for hiding this comment

Uh oh!

simonfaltum Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

maksim-zuev-db Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

simonfaltum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

maksim-zuev-db commented Oct 28, 2026 •

edited

Loading

github-actions Bot commented Oct 28, 2026 •

edited

Loading

eng-dev-ecosystem-bot commented Oct 28, 2026 •

edited

Loading