ssh: move command group out of experimental into cmd/ssh

.agents/skills/onboard-team-area/SKILL.md

@@ -60,5 +60,5 @@ No `.nextchanges/` entry; this is ownership/config only. Write the PR using the
 
 ## Experimental vs stable, and graduation
 
-- **Experimental** — code under `experimental/<area>/`, tests under `acceptance/experimental/<area>/`. Register it under the hidden parent in `cmd/experimental/experimental.go`, or top-level in `cmd/cmd.go` with `Hidden: true` (as `ssh` does). Experimental commands still ship enabled in every release; `Hidden` only removes them from `--help`, it does not gate or compile them out. No `.nextchanges/` entries while experimental. To hand a build to testers, push a `bugbash-<topic>` branch (auto-builds a snapshot) and share the `internal/bugbash/exec.sh` one-liner.
+- **Experimental** — code under `experimental/<area>/`, tests under `acceptance/experimental/<area>/`. Register it under the hidden parent in `cmd/experimental/experimental.go`, or top-level in `cmd/cmd.go` with `Hidden: true` (as `sandbox` does). Experimental commands still ship enabled in every release; `Hidden` only removes them from `--help`, it does not gate or compile them out. No `.nextchanges/` entries while experimental. To hand a build to testers, push a `bugbash-<topic>` branch (auto-builds a snapshot) and share the `internal/bugbash/exec.sh` one-liner.
 - **Graduating to stable** — `git mv` the feature-complete commands to `cmd/<area>/` + `libs/<area>/`, register them top-level in `cmd/cmd.go`, keep the old `experimental` paths as deprecated cobra aliases (`sub.Hidden = true`, `sub.Deprecated = '...'`), add OWNERS rules for the new stable paths, and add a `.nextchanges/` entry. See `experimental/aitools` graduating to top-level `aitools` (PR #4917) as the worked example.

.agents/skills/pr-checklist/SKILL.md

@@ -23,9 +23,9 @@ Before submitting a PR, run these commands to match what CI checks. CI uses the
 # 5. If you changed files in python/:
 ./task pydabs-codegen pydabs-test pydabs-lint pydabs-docs
 
-# 6. If you changed cmd/aitools/, libs/aitools/, experimental/aitools/, or experimental/ssh/:
+# 6. If you changed cmd/aitools/, libs/aitools/, experimental/aitools/, or cmd/ssh/:
 ./task test-exp-aitools   # only if aitools code changed (top-level or experimental)
-./task test-exp-ssh       # only if ssh code changed
+./task test-ssh           # only if ssh code changed
 ```
 
 ## Final cleanup scan

.github/workflows/push.yml

@@ -245,14 +245,14 @@ jobs:
         run: |
           go tool -modfile=tools/task/go.mod task test-exp-aitools
 
-  test-exp-ssh:
+  test-ssh:
     needs:
       - cleanups
       - testmask
 
     # Only run if the target is in the list of targets from testmask
-    if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-ssh') }}
-    name: "task test-exp-ssh (${{matrix.os.name}})"
+    if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test-ssh') }}
+    name: "task test-ssh (${{matrix.os.name}})"
     runs-on: ${{ matrix.os.runner }}
 
     defaults:
@@ -291,7 +291,7 @@ jobs:
       - name: Setup build environment
         uses: ./.github/actions/setup-build-environment
         with:
-          cache-key: test-exp-ssh
+          cache-key: test-ssh
 
       # The ssh acceptance test drives a real sshd behind the tunnel; the runner
       # ships only the client. Install it on Linux (the OS the test is gated to);
@@ -302,7 +302,7 @@ jobs:
 
       - name: Run tests
         run: |
-          go tool -modfile=tools/task/go.mod task test-exp-ssh
+          go tool -modfile=tools/task/go.mod task test-ssh
 
   test-pipelines:
     needs:
@@ -421,7 +421,7 @@ jobs:
     needs:
       - test
       - test-exp-aitools
-      - test-exp-ssh
+      - test-ssh
       - test-pipelines
       - test-sandbox
 
@@ -504,7 +504,7 @@ jobs:
       - name: Generate GitHub App Token (check runs)
         if: >-
           (github.event_name == 'merge_group') ||
-          (github.event_name == 'pull_request' && !contains(fromJSON(needs.testmask.outputs.targets), 'test') && !contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-ssh'))
+          (github.event_name == 'pull_request' && !contains(fromJSON(needs.testmask.outputs.targets), 'test') && !contains(fromJSON(needs.testmask.outputs.targets), 'test-ssh'))
         id: generate-check-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
@@ -517,7 +517,7 @@ jobs:
       # Skip integration tests if the primary "test" target is not triggered by this change.
       # Use Checks API (not Statuses API) to match the required "Integration Tests" check.
       - name: Skip integration tests (pull request)
-        if: ${{ github.event_name == 'pull_request' && !contains(fromJSON(needs.testmask.outputs.targets), 'test') && !contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-ssh') }}
+        if: ${{ github.event_name == 'pull_request' && !contains(fromJSON(needs.testmask.outputs.targets), 'test') && !contains(fromJSON(needs.testmask.outputs.targets), 'test-ssh') }}
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate-check-token.outputs.token }}
@@ -563,7 +563,7 @@ jobs:
       - testmask
 
     if: >-
-      (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && (contains(fromJSON(needs.testmask.outputs.targets), 'test') || contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-ssh'))) ||
+      (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && (contains(fromJSON(needs.testmask.outputs.targets), 'test') || contains(fromJSON(needs.testmask.outputs.targets), 'test-ssh'))) ||
       (github.event_name == 'push')
 
     runs-on:

.nextchanges/cli/ssh-out-of-experimental.md

@@ -0,0 +1 @@
+The `databricks ssh` command group is no longer experimental and now appears in `databricks --help`.

Taskfile.yml

@@ -7,7 +7,7 @@ vars:
   # Pinned ruff (linter + formatter). Keep in sync with the version in
   # .github/workflows/check.yml and python/Taskfile.yml.
   RUFF: uvx ruff@0.15.17
-  TEST_PACKAGES: ./acceptance/internal ./libs/... ./internal/... ./cmd/... ./bundle/... ./experimental/ssh/... .
+  TEST_PACKAGES: ./acceptance/internal ./libs/... ./internal/... ./cmd/... ./bundle/... .
   ACCEPTANCE_TEST_FILTER: ""
   # Single brace-expansion glob covering every //go:embed target in the repo,
   # computed by grepping `//go:embed` directives. Evaluated lazily by Task so
@@ -675,18 +675,18 @@ tasks:
           --packages ./acceptance/... \
           -- -timeout=${LOCAL_TIMEOUT:-60m} -run "TestAccept/(apps|experimental/aitools)"
 
-  test-exp-ssh:
-    desc: Run experimental SSH unit and acceptance tests
+  test-ssh:
+    desc: Run SSH unit and acceptance tests
     sources:
-      - experimental/ssh/**
+      - cmd/ssh/**
       - acceptance/ssh/**
       - "{{.EMBED_SOURCES}}"
     cmds:
       - |
         {{.GO_TOOL}} gotestsum \
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
           --no-summary=skipped \
-          --packages ./experimental/ssh/... \
+          --packages ./cmd/ssh/... \
           -- -timeout=${LOCAL_TIMEOUT:-60m}
       - |
         {{.GO_TOOL}} gotestsum \

acceptance/help/output.txt

@@ -183,6 +183,7 @@ Additional Commands:
   help                                   Help about any command
   labs                                   Manage Databricks Labs installations
   quickstart                             Print an introduction to the Databricks CLI
+  ssh                                    Connect to your Databricks compute and workspace via SSH
   version                                Retrieve information about the current version of this CLI
 
 Flags:

acceptance/ssh/connect-serverless-cpu/script

@@ -9,7 +9,7 @@ if [ -n "${CLOUD_ENV:-}" ]; then
 else
   # Local: the test server backs the /ssh websocket with a real sshd, so this
   # asserts the bootstrap job plus a full handshake over the tunnel. Skip when
-  # sshd is absent (only task test-exp-ssh provisions it).
+  # sshd is absent (only task test-ssh provisions it).
   if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
     echo "SKIP_TEST sshd (openssh-server) not installed"
     exit 0

acceptance/ssh/connect-serverless-gpu/script

@@ -18,7 +18,7 @@ if [ -n "${CLOUD_ENV:-}" ]; then
 else
   # No compute locally: the test server backs the driver-proxy /ssh websocket with a
   # real sshd, so this one run asserts both the bootstrap job and a full handshake +
-  # remote exec over the ws:// tunnel. Needs sshd (only task test-exp-ssh provisions
+  # remote exec over the ws:// tunnel. Needs sshd (only task test-ssh provisions
   # it); the test server probes the same way, so skip where it's absent.
   if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
     echo "SKIP_TEST sshd (openssh-server) not installed"

acceptance/ssh/connect-serverless-gpu/test.toml

@@ -11,7 +11,7 @@ Ignore = [
 ]
 
 # Linux-only: the local run drives a real sshd, reliable only there (and where
-# task test-exp-ssh provisions it). Absent GOOS keys default to enabled, so the
+# task test-ssh provisions it). Absent GOOS keys default to enabled, so the
 # other OSes must be disabled explicitly.
 GOOS.linux = true
 GOOS.darwin = false

acceptance/ssh/connection/script

@@ -18,7 +18,7 @@ if [ -n "${CLOUD_ENV:-}" ]; then
 else
   # No compute locally: the test server backs the driver-proxy /ssh websocket with a
   # real sshd, so this one run asserts both the bootstrap job and a full handshake +
-  # remote exec over the ws:// tunnel. Needs sshd (only task test-exp-ssh provisions
+  # remote exec over the ws:// tunnel. Needs sshd (only task test-ssh provisions
   # it); the test server probes the same way, so skip where it's absent.
   if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
     echo "SKIP_TEST sshd (openssh-server) not installed"

acceptance/ssh/connection/test.toml

@@ -12,7 +12,7 @@ Ignore = [
 ]
 
 # Linux-only: the local run drives a real sshd, reliable only there (and where
-# task test-exp-ssh provisions it). Absent GOOS keys default to enabled, so the
+# task test-ssh provisions it). Absent GOOS keys default to enabled, so the
 # other OSes must be disabled explicitly.
 GOOS.linux = true
 GOOS.darwin = false

cmd/cmd.go

@@ -6,7 +6,7 @@ import (
 
 	aitoolscmd "github.com/databricks/cli/cmd/aitools"
 	"github.com/databricks/cli/cmd/psql"
-	ssh "github.com/databricks/cli/experimental/ssh/cmd"
+	"github.com/databricks/cli/cmd/ssh"
 
 	"github.com/databricks/cli/cmd/account"
 	"github.com/databricks/cli/cmd/api"

experimental/ssh/CLAUDE.md → cmd/ssh/CLAUDE.md

@@ -1,4 +1,4 @@
-# Working on `experimental/ssh`
+# Working on `cmd/ssh`
 
 This file provides guidance to AI assistants working on the SSH tunnel. See the
 repository root `CLAUDE.md` for project-wide rules.

experimental/ssh/FAILURE_MODES.md → cmd/ssh/FAILURE_MODES.md

@@ -154,5 +154,5 @@ The proxy-layer behaviors have unit tests that don't need a cluster:
   (state message, error trace, run-page URL) using SDK mocks.
 
 ```shell
-go test ./experimental/ssh/...
+go test ./cmd/ssh/...
 ```

experimental/ssh/bench.sh → cmd/ssh/bench.sh

@@ -3,7 +3,7 @@
 # SSH Tunnel Performance Test Script
 # Usage:
 # 1. Setup ssh config: ./cli ssh setup --cluster --name
-# 2. Run: ./experimental/ssh/bench.sh <cluster-id> <ssh-config-hostname> [ssh-tunnel-binary-path] [profile]
+# 2. Run: ./cmd/ssh/bench.sh <cluster-id> <ssh-config-hostname> [ssh-tunnel-binary-path] [profile]
 
 set -e
 

experimental/ssh/cmd/connect.go → cmd/ssh/connect.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/experimental/ssh/internal/client"
+	"github.com/databricks/cli/cmd/ssh/internal/client"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/spf13/cobra"
 )

experimental/ssh/internal/client/client.go → cmd/ssh/internal/client/client.go

@@ -20,11 +20,11 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/databricks/cli/experimental/ssh/internal/keys"
-	"github.com/databricks/cli/experimental/ssh/internal/proxy"
-	"github.com/databricks/cli/experimental/ssh/internal/sshconfig"
-	"github.com/databricks/cli/experimental/ssh/internal/vscode"
-	sshWorkspace "github.com/databricks/cli/experimental/ssh/internal/workspace"
+	"github.com/databricks/cli/cmd/ssh/internal/keys"
+	"github.com/databricks/cli/cmd/ssh/internal/proxy"
+	"github.com/databricks/cli/cmd/ssh/internal/sshconfig"
+	"github.com/databricks/cli/cmd/ssh/internal/vscode"
+	sshWorkspace "github.com/databricks/cli/cmd/ssh/internal/workspace"
 	"github.com/databricks/cli/internal/build"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdio"

experimental/ssh/internal/client/client_internal_test.go → cmd/ssh/internal/client/client_internal_test.go

@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/databricks/cli/experimental/ssh/internal/sshconfig"
+	"github.com/databricks/cli/cmd/ssh/internal/sshconfig"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"

experimental/ssh/internal/client/client_test.go → cmd/ssh/internal/client/client_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/databricks/cli/experimental/ssh/internal/client"
+	"github.com/databricks/cli/cmd/ssh/internal/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

experimental/ssh/internal/client/releases.go → cmd/ssh/internal/client/releases.go

@@ -15,7 +15,7 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/databricks/cli/experimental/ssh/internal/workspace"
+	"github.com/databricks/cli/cmd/ssh/internal/workspace"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"

experimental/ssh/internal/fileutil/backup_test.go → cmd/ssh/internal/fileutil/backup_test.go

@@ -7,7 +7,7 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/databricks/cli/experimental/ssh/internal/fileutil"
+	"github.com/databricks/cli/cmd/ssh/internal/fileutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

experimental/ssh/internal/keys/keys_test.go → cmd/ssh/internal/keys/keys_test.go

@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/databricks/cli/experimental/ssh/internal/keys"
+	"github.com/databricks/cli/cmd/ssh/internal/keys"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

experimental/ssh/internal/server/server.go → cmd/ssh/internal/server/server.go

@@ -17,8 +17,8 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/databricks/cli/experimental/ssh/internal/proxy"
-	"github.com/databricks/cli/experimental/ssh/internal/workspace"
+	"github.com/databricks/cli/cmd/ssh/internal/proxy"
+	"github.com/databricks/cli/cmd/ssh/internal/workspace"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"

experimental/ssh/internal/server/sshd.go → cmd/ssh/internal/server/sshd.go

@@ -12,7 +12,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/databricks/cli/experimental/ssh/internal/keys"
+	"github.com/databricks/cli/cmd/ssh/internal/keys"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"

experimental/ssh/internal/setup/setup.go → cmd/ssh/internal/setup/setup.go

@@ -6,9 +6,9 @@ import (
 	"fmt"
 	"time"
 
-	sshclient "github.com/databricks/cli/experimental/ssh/internal/client"
-	"github.com/databricks/cli/experimental/ssh/internal/keys"
-	"github.com/databricks/cli/experimental/ssh/internal/sshconfig"
+	sshclient "github.com/databricks/cli/cmd/ssh/internal/client"
+	"github.com/databricks/cli/cmd/ssh/internal/keys"
+	"github.com/databricks/cli/cmd/ssh/internal/sshconfig"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/compute"

experimental/ssh/internal/setup/setup_test.go → cmd/ssh/internal/setup/setup_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/databricks/cli/experimental/ssh/internal/client"
+	"github.com/databricks/cli/cmd/ssh/internal/client"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"

experimental/ssh/internal/sshconfig/sshconfig.go → cmd/ssh/internal/sshconfig/sshconfig.go

@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/databricks/cli/experimental/ssh/internal/fileutil"
+	"github.com/databricks/cli/cmd/ssh/internal/fileutil"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 )

experimental/ssh/internal/vscode/settings.go → cmd/ssh/internal/vscode/settings.go

@@ -11,7 +11,7 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/databricks/cli/experimental/ssh/internal/fileutil"
+	"github.com/databricks/cli/cmd/ssh/internal/fileutil"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"

experimental/ssh/internal/vscode/settings_test.go → cmd/ssh/internal/vscode/settings_test.go

@@ -9,7 +9,7 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/databricks/cli/experimental/ssh/internal/fileutil"
+	"github.com/databricks/cli/cmd/ssh/internal/fileutil"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 	"github.com/stretchr/testify/assert"

experimental/ssh/cmd/server.go → cmd/ssh/server.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/experimental/ssh/internal/server"
+	"github.com/databricks/cli/cmd/ssh/internal/server"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/spf13/cobra"
 )

experimental/ssh/cmd/setup.go → cmd/ssh/setup.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/experimental/ssh/internal/setup"
+	"github.com/databricks/cli/cmd/ssh/internal/setup"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/spf13/cobra"
 )

experimental/ssh/cmd/ssh.go → cmd/ssh/ssh.go

@@ -6,9 +6,8 @@ import (
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:    "ssh",
-		Short:  "Connect to your Databricks compute and workspace via SSH",
-		Hidden: true,
+		Use:   "ssh",
+		Short: "Connect to your Databricks compute and workspace via SSH",
 		Long: `Connect to your Databricks compute and workspace via SSH.
 
 Common workflows:

libs/process/group.go

@@ -4,6 +4,6 @@ import "time"
 
 // processGroupGracePeriod bounds how long WithProcessGroup waits after the
 // context is cancelled before escalating to SIGKILL. It mirrors the 10s grace
-// period used elsewhere for subprocess termination (see experimental/ssh). It is
+// period used elsewhere for subprocess termination (see cmd/ssh). It is
 // a var, not a const, only so the escalation test can shorten it.
 var processGroupGracePeriod = 10 * time.Second

libs/testserver/ssh.go

@@ -29,7 +29,7 @@ func sshTunnelRemoteUser() string {
 }
 
 // sshClientPublicKeySecretKey is the secret the CLI stores its authorized public key
-// under (mirrors clientPublicKeyName in experimental/ssh); sshd authorizes it below.
+// under (mirrors clientPublicKeyName in cmd/ssh); sshd authorizes it below.
 const sshClientPublicKeySecretKey = "client-public-key"
 
 var sshTunnelUpgrader = websocket.Upgrader{}