fix(desktop): show the token-storage remedy in the agent dialog

The model field in the agent create/edit dialog formats discovery errors
through `formatModelDiscoveryErrorStatus`, which recognized only the
Databricks sign-in strings. A token that could not be saved privately
therefore read as "Using built-in model options", or, after a completed
browser sign-in, as "sign-in didn't complete; open the model picker to
retry": the sign-in-again advice a storage failure must not get.

Match the `llm credential storage: ` prefix before the sign-in cases and
show the backend's message. The Rust picker test now pins that prefix.

Signed-off-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz>

desktop/src-tauri/src/commands/agent_models_databricks_tests.rs

@@ -145,7 +145,11 @@ async fn databricks_storage_failure_shows_its_message_without_opening_a_browser(
 
             assert_eq!(launched.load(Ordering::SeqCst), sign_ins, "{failure:?}");
             assert_eq!(
-                error.contains("could not securely save the Databricks token cache"),
+                // The `llm credential storage: ` prefix is what the draft-dialog
+                // formatter (personaModelDiscoveryStatus.ts) matches on.
+                error.contains(
+                    "llm credential storage: could not securely save the Databricks token cache"
+                ),
                 failure == AuthError::CacheUnavailable,
                 "{error}"
             );

desktop/src/features/agents/ui/personaModelDiscoveryStatus.test.mjs

@@ -106,6 +106,30 @@ test("Databricks sign-in timeout warns and points at the explicit retry", () =>
   assert.match(status?.message ?? "", /buzz-agent auth databricks/);
 });
 
+// Real shapes from agent_models_databricks.rs when a token cannot be saved
+// privately: a refresh during discovery, and a completed browser sign-in.
+for (const [surface, prefix] of [
+  ["discovery refresh", "Databricks model discovery failed"],
+  ["browser sign-in", "Databricks sign-in failed"],
+]) {
+  test(`Databricks token-storage failure on ${surface} shows the storage remedy, not sign-in advice`, () => {
+    const status = formatModelDiscoveryErrorStatus(
+      `${prefix}: llm credential storage: could not securely save the Databricks token cache; use a writable cache location with owner-only file permissions (Windows FAT/exFAT volumes are not supported)`,
+      "databricks_v2",
+    );
+
+    assert.equal(status?.tone, "warning");
+    assert.equal(
+      status?.message,
+      "Could not securely save the Databricks token cache; use a writable cache location with owner-only file permissions (Windows FAT/exFAT volumes are not supported).",
+    );
+    assert.doesNotMatch(
+      status?.message ?? "",
+      /didn't complete|model picker|built-in model options/,
+    );
+  });
+}
+
 test("other Databricks discovery failures fall through to the generic notice", () => {
   const status = formatModelDiscoveryErrorStatus(
     new Error("Databricks model discovery failed: relay offline"),

desktop/src/features/agents/ui/personaModelDiscoveryStatus.ts

@@ -142,6 +142,9 @@ export function formatModelDiscoveryErrorStatus(
   };
 }
 
+/** Display prefix of `AgentError::LlmCredentialStorage` (buzz-agent `types.rs`). */
+const CREDENTIAL_STORAGE_MARKER = "llm credential storage: ";
+
 /**
  * Maps the terminal Databricks sign-in states to user-facing guidance, or null
  * when the error is not a Databricks sign-in outcome. "Sign-in required" is a
@@ -152,6 +155,20 @@ export function formatModelDiscoveryErrorStatus(
 function formatDatabricksAuthStatus(
   message: string,
 ): PersonaModelDiscoveryStatus | null {
+  // A token that could not be saved privately (`AgentError::LlmCredentialStorage`).
+  // Checked first: it also arrives wrapped as "Databricks sign-in failed", and
+  // another sign-in cannot repair the cache, so show the backend's remedy.
+  const storageAt = message.indexOf(CREDENTIAL_STORAGE_MARKER);
+  if (storageAt !== -1) {
+    const detail = message
+      .slice(storageAt + CREDENTIAL_STORAGE_MARKER.length)
+      .trim();
+    return {
+      message: `${detail.charAt(0).toUpperCase()}${detail.slice(1)}.`,
+      tone: "warning",
+    };
+  }
+
   if (message.includes("Databricks sign-in is required")) {
     return {
       message: