Fix context-backed env resolution and unified-host account classification

Use env.NewConfigLoader(ctx) in the doctor command's config loader chain
so that all SDK config attributes (HOST, TOKEN, PROFILE, etc.) set via
env.Set(ctx, ...) participate in auth resolution, not just CONFIG_FILE.

Fix isAccountLevelConfig to treat unified-host profiles with both
account_id and workspace_id as workspace-level, matching the profiler
classification in libs/databrickscfg/profile/profiler.go.

Co-authored-by: Isaac

Author: simonfaltum

cmd/doctor/checks.go

@@ -143,10 +143,12 @@ func checkCurrentProfile(cmd *cobra.Command, resolvedCfg *config.Config) CheckRe
 
 func resolveConfig(cmd *cobra.Command) (*config.Config, error) {
 	ctx := cmd.Context()
-	cfg := &config.Config{}
-
-	if configFile := env.Get(ctx, "DATABRICKS_CONFIG_FILE"); configFile != "" {
-		cfg.ConfigFile = configFile
+	cfg := &config.Config{
+		Loaders: []config.Loader{
+			env.NewConfigLoader(ctx),
+			config.ConfigAttributes,
+			config.ConfigFile,
+		},
 	}
 
 	profileFlag := cmd.Flag("profile")
@@ -157,7 +159,8 @@ func resolveConfig(cmd *cobra.Command) (*config.Config, error) {
 	// Apply the configured default profile when no explicit profile is set.
 	// This mirrors cmd/root/auth.go's resolveDefaultProfile.
 	if cfg.Profile == "" && env.Get(ctx, "DATABRICKS_CONFIG_PROFILE") == "" {
-		resolvedProfile, err := databrickscfg.GetConfiguredDefaultProfile(ctx, cfg.ConfigFile)
+		configFilePath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+		resolvedProfile, err := databrickscfg.GetConfiguredDefaultProfile(ctx, configFilePath)
 		if err != nil {
 			log.Warnf(ctx, "Failed to load default profile: %v", err)
 		} else if resolvedProfile != "" {
@@ -177,7 +180,8 @@ func isAccountLevelConfig(cfg *config.Config) bool {
 	case config.AccountHost:
 		return true
 	case config.UnifiedHost:
-		return true
+		// Unified host with both account_id and workspace_id is workspace-level.
+		return cfg.WorkspaceID == ""
 	default:
 		return false
 	}

cmd/doctor/doctor_test.go

@@ -295,6 +295,20 @@ func TestResolveConfigUsesEnvVars(t *testing.T) {
 	assert.Equal(t, "env-token", cfg.Token)
 }
 
+func TestResolveConfigUsesContextEnvVars(t *testing.T) {
+	clearConfigEnv(t)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	ctx = env.Set(ctx, "DATABRICKS_HOST", "https://ctx-env.example.com")
+	ctx = env.Set(ctx, "DATABRICKS_TOKEN", "ctx-token")
+	cmd := newTestCmd(ctx)
+
+	cfg, err := resolveConfig(cmd)
+	require.NoError(t, err)
+	assert.Equal(t, "https://ctx-env.example.com", cfg.Host)
+	assert.Equal(t, "ctx-token", cfg.Token)
+}
+
 func TestCheckIdentitySuccess(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/api/2.0/preview/scim/v2/Me" {
@@ -378,6 +392,16 @@ func TestIsAccountLevelConfig(t *testing.T) {
 			},
 			want: true,
 		},
+		{
+			name: "unified host with account and workspace ID is workspace-level",
+			cfg: &config.Config{
+				Host:                       "https://myhost.databricks.com",
+				AccountID:                  "test-account-123",
+				WorkspaceID:                "12345",
+				Experimental_IsUnifiedHost: true,
+			},
+			want: false,
+		},
 		{
 			name: "unified host without account ID is workspace",
 			cfg: &config.Config{