Tell AI agents to pass the device code login on to the user

When an AI agent is detected, the first step of the non-interactive
login also prints a note that tells it to give the URL and the user code
to the user, not to approve the login itself, and to ask the user for
the confirmation code.

Co-authored-by: Isaac <no-reply@databricks.com>

Author: maksim-zuev-db

acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.databrickscfg

@@ -8,3 +8,8 @@ auth_type    = databricks-cli
 
 [__settings__]
 default_profile = test
+
+[agent]
+host         = [DATABRICKS_URL]
+workspace_id = [WORKSPACE_ID]
+auth_type    = databricks-cli

acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt

@@ -91,3 +91,23 @@ Profile test was successfully saved
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+
+=== An AI agent gets notes on passing the login on to the user
+
+>>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code
+Using a browser on another device, visit:
+[DATABRICKS_URL]/device/verification
+
+And enter the code:
+WDJB-MJHT
+
+Note for AI agents (test-agent): give the URL and the code above to the user.
+Do not open the URL or approve the login yourself: the user must approve it.
+Ask the user for the confirmation code their browser shows.
+
+Once finished, complete the login by running the same command with
+--user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+provided in your browser.
+
+>>> AGENT=test-agent [CLI] auth login --host [DATABRICKS_URL] --profile agent --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile agent was successfully saved

acceptance/cmd/auth/login/device-code/non-interactive/nominal/script

@@ -31,5 +31,9 @@ trace $CLI auth login --profile test --use-device-code --user-code WDJB-MJHT --c
 trace cache_keys
 trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 
+title "An AI agent gets notes on passing the login on to the user\n"
+trace AGENT=test-agent $CLI auth login --host $DATABRICKS_HOST --profile agent --use-device-code
+trace AGENT=test-agent $CLI auth login --host $DATABRICKS_HOST --profile agent --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
 # Track the .databrickscfg file that was created to surface changes.
 mv "./home/.databrickscfg" "./out.databrickscfg"

cmd/auth/README.md

@@ -120,6 +120,10 @@ in two steps instead:
    flags exchanges the pending device code instead of requesting a new one,
    and the rest of the login runs as usual.
 
+Agent detection (`useragent.AgentProvider()`) does not pick the flow. It only
+adds a note to the first step's output that tells the agent to pass the login
+on to the user.
+
 The pending login is a token store entry with `PendingLogin` set instead of a
 token. Its key is the login's cache key (the profile name, or the host without
 a profile) with a `#device-code` suffix, so the target's current token keeps

cmd/auth/login_device_code.go

@@ -12,6 +12,7 @@ import (
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go/useragent"
 	"github.com/spf13/cobra"
 	"golang.org/x/oauth2"
 )
@@ -169,17 +170,30 @@ func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("store pending login: %w", err)
 	}
-	cmdio.LogString(ctx, strings.Join([]string{
+	lines := []string{
 		"Using a browser on another device, visit:",
 		da.VerificationURI,
 		"",
 		"And enter the code:",
 		formatCode(da.UserCode),
 		"",
+	}
+	// An agent passes the login on to the user, who approves it in the
+	// browser.
+	if agent := useragent.AgentProvider(); agent != "" {
+		lines = append(lines,
+			"Note for AI agents ("+agent+"): give the URL and the code above to the user.",
+			"Do not open the URL or approve the login yourself: the user must approve it.",
+			"Ask the user for the confirmation code their browser shows.",
+			"",
+		)
+	}
+	lines = append(lines,
 		"Once finished, complete the login by running the same command with",
-		"--user-code " + formatCode(da.UserCode) + " and --confirmation-code set to the confirmation code",
+		"--user-code "+formatCode(da.UserCode)+" and --confirmation-code set to the confirmation code",
 		"provided in your browser.",
-	}, "\n"))
+	)
+	cmdio.LogString(ctx, strings.Join(lines, "\n"))
 	return nil
 }
 

docs/device-code-login.md

@@ -85,6 +85,16 @@ Profile my-profile was successfully saved
    confirmation code. It saves the profile and the token. Without
    `--profile`, it only stores the token for the host.
 
+When the CLI detects an AI agent, it also prints a note that tells the agent to
+pass the URL and the code on to you, not to approve the login itself, and to
+ask you for the confirmation code:
+
+```console
+Note for AI agents (claude-code): give the URL and the code above to the user.
+Do not open the URL or approve the login yourself: the user must approve it.
+Ask the user for the confirmation code their browser shows.
+```
+
 The pending login stays on your machine, so a confirmation code that ends up
 somewhere else, such as an agent's conversation, cannot complete the login on
 another machine.