feat(appkit): support explicit standalone agent caller identity

[MarioCadenas]

Summary

Standalone scripts and evaluations can run agents as a user by explicitly supplying RunAgentInput.caller: token, user principal, host, and workspace ID. The scope covers plugin setup, adapters, inline and plugin tools, and nested agents without initializing an SP identity or selecting a CLI profile.

This is layer 3 of the stack, based on #594 (execution-user-scope). The atomic HTTP default and tool inheritance change is in that parent, as required by design section 9.

Omitting credentials preserves the ambient caller, or defaults to SP when no scope is open. Incomplete explicit credentials fail closed even in development. Group remains deferred. Credentials are not passed into adapter or sub-agent inputs, and only a token fingerprint is retained in the caller context.

Standalone execution still has no approval gate. This option is for trusted scripts and evaluations, not a new unauthenticated entrypoint.

Design: design-docs/execution-identity-e2e.md, section 5.1.3.

Verification

• pnpm -r typecheck
• Full monorepo unit suite: 5,241 passed, one existing skip
• Original dev-playground OBO tests pass unchanged after rebasing onto the fail-closed feat(appkit): establish ambient user execution scopes #594 fix
• Coverage includes standalone SP defaults, user inheritance across all dispatch paths, concurrency, failure restoration, and invalid credential rejection
• pnpm build, pnpm docs:build, and pnpm check:fix

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 1.2 MB (+13 KB) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	1.2 MB (+13 KB)	433 KB (+4.8 KB)
Type declarations	451 KB (+5.3 KB)	163 KB (+1.9 KB)
Source maps	2.4 MB (+24 KB)	811 KB (+9.2 KB)
Other	11 KB	3.7 KB
Total	4.0 MB (+42 KB)	1.4 MB (+16 KB)

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	98 KB (+1.4 KB)	2.5 KB	100 KB (+1.4 KB)	external	320 KB (+4.5 KB)
./beta	95 KB (+1.3 KB)	479 B (+1 B)	95 KB (+1.3 KB)	external	286 KB (+3.3 KB)
./testing	40 KB (+1.5 KB)	31 KB (-22 B)	71 KB (+1.5 KB)	external	206 KB (+3.7 KB)
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	23 KB	0 B	23 KB	external	65 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	93 KB
.	utils.js	initial	4.6 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	78 KB
./beta	stream-manager.js	initial	5.8 KB
./beta	databricks.js	initial	3.3 KB
./beta	wide-event-emitter.js	initial	3.1 KB
./beta	configuration.js	initial	2.3 KB
./beta	service-context.js	initial	1.9 KB
./beta	client.js	initial	593 B
./beta	client-options.js	initial	219 B
./beta	supervisor-api.js	lazy	191 B
./beta	databricks.js	lazy	165 B
./beta	index.js	lazy	123 B
./testing	manifest.js	initial	27 KB
./testing	index.js	initial	10 KB
./testing	wide-event-emitter.js	initial	2.9 KB
./testing	index.js	lazy	26 KB
./testing	remote-tunnel-manager.js	lazy	2.5 KB
./testing	utils.js	lazy	1.8 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	23 KB

@databricks/appkit-ui

npm tarball (packed): 350 KB — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	395 KB	132 KB
Type declarations	229 KB	84 KB
Source maps	766 KB	253 KB (+1 B)
CSS	16 KB	3.2 KB
Total	1.4 MB	472 KB (+1 B)

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	20 B	0 B	20 B	0 B	0 B
./react	432 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	1.0 KB	0 B	1.0 KB	0 B	1.9 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	20 B
./react	index.js	initial	430 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	1.0 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 36878386278 -R databricks/appkit -n appkit-template-0.81.0-pr.03df2a7-execution-standalone-user-595 -D appkit-pr-595 \
  && unzip -o "appkit-pr-595/appkit-template-0.81.0-pr.03df2a7-execution-standalone-user-595.zip" -d "appkit-pr-595" \
  && databricks apps init --template "appkit-pr-595"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.