Create default profiles after harness sign-in

[defangdevs]

Summary

• create or reuse a collision-safe starter profile immediately after successful Claude or Codex authentication
• make that profile the box default only when the current default is empty or dangling
• serialize default-profile updates so a concurrent explicit UI choice is preserved
• keep Codex remote-control daemon sessions profile-less while leaving the ensured Codex worker profile available to WhatsApp and other profile-driven entry points

Fixes #818.

Motivation

Codex authentication could auto-start a session without creating codex.env. The Profiles panel stayed empty, and WhatsApp automatic routing then failed because neither a selected WhatsApp profile nor a box default existed.

Safety and compatibility

• existing profiles and their model, effort, prompt, and environment settings are reused without modification
• an existing valid default is never replaced by a later harness sign-in
• a profile-name collision with another harness uses the next available suffix
• authentication credentials are neither read nor copied by this path
• profile/default writes retain the existing per-user env-store and atomic pointer mechanisms

Validation

• python3 tests/test-profile-panel.py (70 tests)
• python3 -m py_compile modules/src/settings-daemon.py
• git diff --check
• nix build -L --keep-going .#ci-native
• regenerated modules/agent-box.nix, native expected fixtures, and golden fixtures

The x86-only connect VM test cannot run on this aarch64 host; this change adds a VM assertion that CI will exercise.

Review

• Code review: PASS
• Security review: PASS - no new credential exposure, privilege boundary, external input surface, or cross-user state

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bc4d6831-6e6a-45ce-a893-91f3cdc9030c

📥 Commits

Reviewing files that changed from the base of the PR and between 35ed460 and ee1198d.

📒 Files selected for processing (10)

• modules/agent-box.nix
• modules/src/default-agents.md
• modules/src/settings-daemon.py
• tests/connect.nix
• tests/golden/vm/etc/agent-box-guides/AGENTS.agent.md
• tests/golden/web/etc/agent-box-guides/AGENTS.agent.md
• tests/golden/web/payloads/agent-box-settings/bin/agent-box-settings
• tests/native/expected/etc/agent-box-guides/AGENTS.agent.md
• tests/native/expected/etc/agent-box-guides/AGENTS.robot.md
• tests/test-profile-panel.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud