feat(agents): broker shared ChatGPT logins for remote Codex sessions

.github/workflows/voltage-agent-images.yml

@@ -257,6 +257,7 @@ jobs:
             echo "==> test-$test.py"
             python3 "test-$test.py" "$IMAGE"
           done
+          python3 test-codex-login.py "$IMAGE"
           python3 -O test-profile.py "$IMAGE"
           python3 test-cluster.py "$IMAGE"
 

.github/workflows/voltage-buzz-gpui.yml

@@ -50,6 +50,8 @@ jobs:
         run: nix develop --command cargo fmt --all --check
       - name: Clippy
         run: nix develop --command cargo clippy --workspace --all-targets --locked -- -D warnings
+      - name: Voltage agent Clippy
+        run: nix develop --command cargo clippy -p buzz-gpui --all-targets --locked --features voltage-sandbox -- -D warnings
 
   test:
     name: GPUI Test
@@ -76,6 +78,8 @@ jobs:
       # Tests that need the local test relay skip themselves without it.
       - name: Test
         run: nix develop --command cargo test --workspace --locked
+      - name: Voltage agent tests
+        run: nix develop --command cargo test -p buzz-gpui -p buzz-identity --locked --features buzz-gpui/voltage-sandbox,buzz-identity/session-control
 
   plugins:
     name: GPUI Node plugins
@@ -169,3 +173,8 @@ jobs:
         working-directory: apps/buzz-gpui
         env:
           RUSTUP_TOOLCHAIN: 1.98.1
+      - name: Voltage agent Clippy
+        run: cargo clippy -p buzz-gpui --locked --features voltage-sandbox -- -D warnings
+        working-directory: apps/buzz-gpui
+        env:
+          RUSTUP_TOOLCHAIN: 1.98.1

apps/buzz-gpui/crates/app/Cargo.toml

@@ -67,7 +67,7 @@ sha2 = "0.10"
 # The voice-note encoder writes into a private directory of its own.
 tempfile = "3"
 serde_yaml = "0.9"
-tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "macros", "net", "io-util", "process"] }
+tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "macros", "net", "io-util", "process", "fs"] }
 toml = "0.9"
 toml_edit = "0.25"
 unicode-normalization = "0.1"
@@ -115,6 +115,10 @@ tray-icon = { version = "0.26", default-features = false }
 # Only to turn on its runtime_shaders feature (see [features]).
 gpui-pre-macos = { version = "=0.3.8", optional = true }
 
+[target.'cfg(unix)'.dependencies]
+# Stop the device-login CLI and its npm/native child as one owned process group.
+nix = { version = "0.31", features = ["signal", "process"] }
+
 [target.'cfg(windows)'.dependencies]
 # The user's `buzz://` registration; GPUI already uses it.
 windows-registry = "0.6"