[elainewang-db]

Agent Bricks commands and the local agent could use different Databricks profiles, and unauthenticated workspace commands could hang on browser consent. This PR resolves one profile per project command, passes it to the local agent, and checks authentication before dev or deploy starts work. Addresses ML-70351.

Behavior

• Profile order inside a project: -p, then the project's .env (the --source project's when given), then DATABRICKS_CONFIG_PROFILE, then SDK default authentication. Exported SDK credential variables keep their SDK precedence.
• The profile is chosen once per command, before it runs, and the API client is built from that choice.
• The CLI reads .env with python-dotenv, the same parser the agent uses, so both see the same profile.
• init pins a profile in .env unless environment authentication is in use.
• auth switch changes the project's profile, auth describe reports it, and auth login signs in. With no profile, auth login hands off to databricks auth login's picker. The old login and logout commands point to these.
• dev and deploy fail fast with an auth login hint when the profile is unknown, signed out, or set to external-browser. They never open a browser.
• Text output shows one workspace notice with the profile and the host actually used.

Code layout

• projects/profiles.py: profile resolution and ~/.databrickscfg lookups.
• projects/env_file.py: reads .env with dotenv and rewrites the profile line atomically.
• services/workspace_auth.py: auth checks with a time limit, and error classification.
• clients/databricks_cli.py: runs databricks auth login.
• cli/auth.py: the auth commands. cli/app.py: chooses the profile per command, and the removed-command pointers.
• presentation/profile.py: workspace notices and profile warnings.

Reading order
projects/profiles.py, then projects/env_file.py, services/workspace_auth.py, cli/app.py (CliContext.select_profile) and cli/auth.py, then cli/init.py, cli/dev.py and cli/deploy.py. Docs last.

Testing

• Unit tests cover profile order, .env parsing and rewriting, auth-check classification, and the auth commands. Unit suite: 2331 passed. Functional smoke tests: 53 passed.
• Local end-to-end tests on commit 3786c31: tests/functional/dev_runtime_test.py passed 6/6. Fresh LangGraph and OpenAI projects booted and answered an invocation across the built-in server (with and without chat UI) and custom server, using a fake model-serving endpoint.
• Isolated CLI journeys on the same commit passed: init pinned an explicit or SDK-default profile; environment credentials left .env absent; auth describe reported the selected workspace; trailing -p overrode it; auth switch persisted the new profile; and dev rejected an external-browser profile before agent startup with a login hint.
• These current-head end-to-end runs were local. Live workspace deployment and invocation were not rerun without a test profile or App URL.
• Live checks on ml and e2-dogfood before the latest changes:
  • Unknown or rejected profiles failed in about 1 second with the login hint.
  • dev served HTTP 200.
  • init sign-in worked.
  • init with token-only environment auth wrote no .env.

Reusing cached external-browser credentials (by @jamesbxwu) moves to a follow-up PR after this merges.

This pull request and its description were written by Isaac.

[shivam5]

agentbricks profile login --profile - this might sound weird

We could do what databricks cli does:
agentbricks auth describe/login/logout/profiles/switch

Can we quickly ask others for opinion on the rename in the channel?