[tee8z]

What

Change one agent profile credential without entering all of them again, and see what is already on file.

Before this PR, enroll replaced the whole profile. The form rebuilt it from blank fields and never saved tokens, and the manager could only write profiles. So adding one token, such as a Codex access token, meant entering the GitHub token, via profile, 1Password token and every model credential again. Leaving one blank dropped it. Nothing showed what was stored, and every enroll also created and registered a new signing key.

Change

Protocol (buzz-session-control)

A new profile operation. Like enroll, it is signed by the owner key itself, with no auth tag. Its payload is {}.

Manager (buzz-sandbox-reaper)

• Partial enroll: the request may leave out any section (git, github, via, models) or any key inside one. Admission checks only the shape (profile::check_partial). The job then works in this order:
  1. It reads the stored profile (GetSecretValue).
  2. It merges the request into it (profile::merge).
  3. It validates the merged profile with the existing profile.py port.
  4. It checks the GitHub login only when the request carries a new token.
  5. It writes the merged profile.
• Merge rules: in models, null removes a credential. Setting one of an exclusive pair (OpenAI key and Codex token, or Anthropic key and Claude token) removes the other. With nothing stored, the request must be complete.
• Summary: profile, and every successful enroll, returns a summary: the GitHub login, the Git name and email, and which credentials are present. It never contains a credential value.

GPUI (apps/buzz-gpui)

• When Settings opens, the Enroll form asks what is on file and shows one line, for example: On file: GitHub @tee8z · Git email … · signing key · via profile · 1Password token · Claude subscription token. Updated …
• Each field that is on file shows On file · leave blank to keep. The Git email field starts with the stored email.
• Enrolling sends only the filled fields. A blank GitHub token keeps the stored one, without a GitHub call. The signing key stays unless Replace the signing key is selected. Remove … drops a stored model credential.
• With nothing on file, the complete profile is required, as before. The same applies if the manager cannot answer, for example an older manager, and Check again retries.

Docs

• docs/remote-agents.md: the profile operation, partial enrollment and the summary.
• voltage/remote-agents.md: a new section, Change one credential.

Deploy

• voltage-terraform Refine app loading skeletons block/buzz#1001 (merged and applied) gives the manager secretsmanager:GetSecretValue on the developer profile secrets only. Without it, every enroll would fail when it reads the stored profile.
• After this merges, repin the staging manager image (cd), and rebuild the Buzz app from this commit.

Tested

• buzz-sandbox-reaper: 97 tests pass. New tests cover:
  • a partial enroll keeping every field it leaves out;
  • null removal, and an exclusive pair replacing its other;
  • a new token checked against GitHub, and a merged profile validated before any write;
  • a first enroll that must be complete;
  • describe naming no credential;
  • partial-shape refusals;
  • profile admission (owner-signed only, empty payload).
• buzz-session-control: the envelope round trip covers profile.
• GPUI: the workspace passes with --features buzz-gpui/voltage-sandbox (1,065 app tests). New tests cover:
  • a change that sends only the filled fields, with null for a removal and no github or signing key when they are kept;
  • per-field profile.py refusals;
  • the profile reply and the On file text;
  • the enroll reply's summary.
• Checks: clippy (-D warnings) and fmt are clean in both workspaces.

Summary by CodeRabbit

• New Features
  • View the status and a summary of your stored remote-workspace profile, including which credentials are on file—without revealing credential values.
  • Update stored profile details by filling in only the fields you want to change. Blank fields keep their current values.
  • Remove stored model credentials or replace the signing key using the new enrollment controls.
  • Check the stored profile again if its status is unknown.
• Documentation
  • Added instructions for changing one credential while retaining other stored settings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: voltagecloud/buzz
• Branch: feat/profile-partial-enroll
• File: .coderabbit.yaml
• Commit: 13152cf
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Essentials
• Run ID: f39faa43-6128-4694-b483-792e4648419e

📥 Commits

Reviewing files that changed from the base of the PR and between 42852a8 and 13152cf.

📒 Files selected for processing: 16

• apps/buzz-gpui/crates/app/src/agent_plugins/remote_workspace/enroll.rs
• apps/buzz-gpui/crates/app/src/agent_plugins/remote_workspace/enroll_form.rs
• apps/buzz-gpui/crates/app/src/agent_plugins/remote_workspace/enroll_tests.rs
• apps/buzz-gpui/crates/app/src/agent_plugins/remote_workspace/settings.rs
• apps/buzz-gpui/crates/identity/src/session_control.rs
• crates/buzz-sandbox-reaper/src/enroll.rs
• crates/buzz-sandbox-reaper/src/enroll_tests.rs
• crates/buzz-sandbox-reaper/src/manager.rs
• crates/buzz-sandbox-reaper/src/manager_tests.rs
• crates/buzz-sandbox-reaper/src/profile.rs
• crates/buzz-sandbox-reaper/src/profile_tests.rs
• crates/buzz-sandbox-reaper/src/serve_tests.rs
• crates/buzz-session-control/src/lib.rs
• crates/buzz-session-control/src/tests.rs
• docs/remote-agents.md
• voltage/remote-agents.md

+-----------------------------------------------+
| This is O(n) in theory and O(🤡) in practice. |
+-----------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}