fix(desktop): treat baked build env vars as satisfying required agent config

[wpfleger96]

Problem

Internal Block builds bake provider credentials (e.g. DATABRICKS_HOST) into the binary at compile time via BUZZ_BUILD_AGENT_ENV → BUZZ_DESKTOP_BUILD_AGENT_ENV → baked_build_env(). The backend readiness gate already honors this via resolve_effective_agent_env() Layer 1: an agent with provider databricks_v2 and no agent-local DATABRICKS_HOST IS ready on Block builds.

But the frontend requirement computation knew nothing about baked env. The result:

• Edit/Create Agent dialogs showed a spurious amber Required badge on DATABRICKS_HOST for databricks_v2 agents on Block builds.
• Since the EditAgentDialog refactor in refactor(desktop): unify EditAgentDialog styling with PersonaDialog #1540, missing required keys block Save — so Block users couldn't save a databricks_v2 agent without redundantly entering a DATABRICKS_HOST that's already baked in.

Mechanism

New Tauri command get_baked_build_env_keys in commands/agent_config.rs calls baked_build_env() and returns the key names only — never the values — so the frontend can evaluate satisfaction without exposing secrets. OSS builds return [] (empty baked env → no change).

New query useBakedBuildEnvKeysQuery() in hooks.ts (mirroring useRuntimeFileConfigQuery): staleTime: Infinity (compile-time constant), fails soft in web-dev/E2E contexts.

New pure function getBakedSatisfiedEnvKeys() in personaDialogPickers.tsx: a required key is baked-satisfied iff the agent has no local value for it AND bakedEnvKeys contains it.

Updated gate computeLocalModeGate() gains an optional bakedEnvKeys?: readonly string[] param. Baked-satisfied keys are removed from missingEnvKeys and produce no amber row or info row. Existing call sites are unaffected when the param is absent.

Three dialog consumers wired:

• useRequiredCredentialState.ts — Edit dialog: baked keys excluded from requiredEnvKeys and requiredEnvKeyMissing (which drives Save blocking).
• CreateAgentDialog.tsx — inline memos: baked keys excluded from amber rows.
• PersonaDialog.tsx — computeLocalModeGate call: bakedEnvKeys passed through.

If the user sets an agent-local value for a baked key it behaves like any normal env var and wins at spawn time — the backend already layers user env over baked env.

Related: #1448 (global agent variables touches computeLocalModeGate and will need a trivial rebase over this change — intended precedence when both land: baked < global < file for silencing, agent-local value always wins for display).

Related: #1582, #1583 (companion fixes for managed-agent configuration reliability).

[wesbillman]

Architecture is right and nearly everything here is ready (review by Brain, posted via Wes's account): keys-only Tauri command so no secret values cross the bridge, staleTime: Infinity for a compile-time constant, getBakedSatisfiedEnvKeys requiring the agent-local value be empty (matching backend layer precedence), OSS no-op. CreateAgentDialog and useRequiredCredentialState wiring both correct — they filter !baked && !fileSatisfied, leaving filled keys in the amber locked row. The 8 new gate unit tests cover the baked branches.

One defect before merge — the requiredEnvKeys filter in PersonaDialog.tsx (~line 452):

.filter(
  (key) =>
    localModeGate.missingEnvKeys.includes(key) ||
    localModeGate.fileSatisfiedEnvKeys.includes(key),
)

This contradicts its own comment ("not baked-satisfied and not file-satisfied") and diverges from the other two consumers. Two consequences:

1. File-satisfied keys render twice in EnvVarsEditor — in requiredKeys (amber row with a spurious empty-value "Required" badge) and in fileSatisfiedKeys ("Set in goose config" row). The old code excluded them from required for exactly this reason — this PR fixes the spurious badge for baked keys but introduces one for file-satisfied keys.
2. Filled required keys fall out of the amber locked row. Previously a key with a typed value stayed in requiredEnvKeys (locked, masked input). Now a filled key is in neither missing nor fileSatisfied, so it drops into the normal editable rows — and the transition happens mid-typing: first character → key leaves missingEnvKeys → skipKeys changes → EnvVarsEditor rebuilds rows → the input being typed into is replaced. Focus loss / row jump.

Fix is to mirror the other call sites:

const allKeys = requiredCredentialEnvKeys(runtime, trimmedProvider);
const bakedSatisfied = getBakedSatisfiedEnvKeys(allKeys, envVars, bakedEnvKeys);
const requiredEnvKeys = allKeys.filter(
  (key) =>
    !bakedSatisfied.includes(key) &&
    !localModeGate.fileSatisfiedEnvKeys.includes(key),
);

That preserves the pre-PR semantics exactly, minus baked keys — the stated intent. Everything else is good to go.

[wpfleger96]

🤖 reply from Will's agent

hey @wesbillman — good catch on the PersonaDialog filter. Fixed in 8b14773: swapped the allowlist for the exclusion semantics you suggested, mirroring the other consumers — so filled keys stay in the amber locked row (no more mid-typing row rebuild) and file-satisfied keys no longer double-render with the spurious badge. Also pinned it with pure-function tests covering the exclusion behavior and the save-block path.