Fix airflowctl tracebacks on an unusable credentials file

[Eason09053360]

Why

Credentials.load() guarded only against the credentials file being absent. Every other way that file can be unusable reached the operator as a stack trace, because safe_call_command recognises none of those exception types:

file state	before
wrong permissions	PermissionError
non-UTF-8 bytes	UnicodeDecodeError
truncated or empty	JSONDecodeError
valid JSON, wrong shape	TypeError
no api_url key	KeyError: 'api_url'

$AIRFLOW_HOME/production.json is a generic name in a shared directory, so a foreign or half-written file is not far-fetched. The traceback was also a dead end: the fix is to log in again, but auth login loads the same file and failed the same way, leaving deleting the file by hand as the only way out.

What

_read_cli_config(path) in airflow-ctl/src/airflowctl/api/client.py takes over the open and the parse, which is what puts all of those cases in one place — OSError for unreadable paths, ValueError for both malformed JSON and non-UTF-8 bytes (siblings, not parent and child), plus an explicit check that the parsed result is a JSON object with an api_url. They raise AirflowCtlCredentialInvalidException, a new AirflowCtlException subclass. FileNotFoundError is re-raised untouched so callers keep handling an absent file as the distinct case it is, and the debug-credentials read goes through the same helper.

load() extends the tolerance it already had for a missing file to an unusable one, so auth login — the recovery the message recommends — can run and replace it.

safe_call_command catches AirflowCtlException rather than a hand-maintained tuple of subclasses. The tuple was already equivalent to the base class, and keeping it manual means the next exception class added anywhere regresses to a traceback, which is the failure this PR is fixing. One side effect: the path-traversal guard in _safe_path_under_airflow_home raises AirflowCtlException directly and so was not caught before; it now renders as a message.

Tests cover each of the file states above and that AUTH / NO_AUTH clients still load past an unusable file.

Deliberately out of scope: {"api_url": null} still loads as None and lets get_client fall back to localhost:8080. That is a silently-wrong-server bug rather than a traceback, Credentials.save() itself writes such a file, and an existing test pins the current behaviour — it wants its own change. auth list-envs also reads the same file through its own logic, which now defines "unusable" slightly differently.

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 5)

Generated-by: Claude Code (Opus 5) following the guidelines

[potiuk]

Hello @Eason09053360 - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 33 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

• Return only the latest Dag version from iter_all_latest_version_dags #70935 - Return only the latest Dag version from iter_all_latest_version_dags
• Fix airflow config get-value silently succeeding on a missing option #72145 - Fix airflow config get-value silently succeeding on a missing option
• Fix airflowctl tracebacks on an unusable credentials file #72468 - Fix airflowctl tracebacks on an unusable credentials file
• Make suppress_logs_and_warning CLI decorator return the wrapped result #72600 - Make suppress_logs_and_warning CLI decorator return the wrapped result
• Fix dateless dag.test and tasks test destroying unrelated Dag runs #72656 - Fix dateless dag.test and tasks test destroying unrelated Dag runs
• Fix airflowctl commands crashing instead of printing their result #72675 - Fix airflowctl commands crashing instead of printing their result
• Show a clean error when airflow backfill create targets an unknown Dag #72893 - Show a clean error when airflow backfill create targets an unknown Dag
• Fix tasks clear --task-regex matching as a plain substring #72941 - Fix tasks clear --task-regex matching as a plain substring
• Speed up airflow dags list on deployments with many Dags #73033 - Speed up airflow dags list on deployments with many Dags
• Fix airflow dags next-execution crashing on --field data_interval.start #73070 - Fix airflow dags next-execution crashing on --field data_interval.start
• Fix airflow connections import corrupting JSON values in .env files #73083 - Fix airflow connections import corrupting JSON values in .env files
• Fix structlog log assertions never matching a single-field dict #73112 - Fix structlog log assertions never matching a single-field dict
• Fix misleading type errors from expand_kwargs and default_args #73120 - Fix misleading type errors from expand_kwargs and default_args
• Fix bare traceback from kubernetes cleanup-pods without kube config #73121 - Fix bare traceback from kubernetes cleanup-pods without kube config
• Fix airflowctl pools export/import dropping pool team ownership #73132 - Fix airflowctl pools export/import dropping pool team ownership
• Mask extra and credentials in connections list --hide-sensitive #73157 - Mask extra and credentials in connections list --hide-sensitive
• Fix missing task alert emails on Dags using native template rendering #73228 - Fix missing task alert emails on Dags using native template rendering
• Stop providers lazy-loaded from writing the default config #73348 - Stop providers lazy-loaded from writing the default config
• Fix api-server --apps silently dropping apps and accepting typos #73371 - Fix api-server --apps silently dropping apps and accepting typos
• Fix Task SDK dry-run mode crashing on task instance start #73373 - Fix Task SDK dry-run mode crashing on task instance start
• Fix CLI --bundle-name finding no Dags in Git bundles #73377 - Fix CLI --bundle-name finding no Dags in Git bundles
• Fix empty audit log dag_id for DAG.cli() subcommands #73379 - Fix empty audit log dag_id for DAG.cli() subcommands
• Drop ignored --bundle-name and --dagfile-path from DAG.cli() #73387 - Drop ignored --bundle-name and --dagfile-path from DAG.cli()
• Fix indexing mapped task results with a NumPy integer #73400 - Fix indexing mapped task results with a NumPy integer
• Respect maximum_page_limit in batch list endpoints #73409 - Respect maximum_page_limit in batch list endpoints
• Stop the JWT revocation check stalling the API server event loop #73422 - Stop the JWT revocation check stalling the API server event loop
• Fix task instance 404 detail being a JSON array instead of a string #73424 - Fix task instance 404 detail being a JSON array instead of a string
• API: Remove unreachable Accept branch and last deprecated 422 alias #73463 - API: Remove unreachable Accept branch and last deprecated 422 alias
• API: Cap run_ids on the grid TI summaries stream endpoint #73465 - API: Cap run_ids on the grid TI summaries stream endpoint
• Rate-limit JWKS fetch attempts while the endpoint is down #73472 - Rate-limit JWKS fetch attempts while the endpoint is down
• UI: Fix grid columns vanishing when a Dag version has been cleaned #73514 - UI: Fix grid columns vanishing when a Dag version has been cleaned

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

• Fix scheduler refusing to start when [scheduler] only_idle is enabled #73141 - Fix scheduler refusing to start when [scheduler] only_idle is enabled
• Batch Team lookups when syncing Dag bundles to the database #73154 - Batch Team lookups when syncing Dag bundles to the database

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting