feat(cli): add buzz onboard wizard for Paseo developers

crates/buzz-cli/Cargo.toml

@@ -86,9 +86,27 @@ rustls = { version = "0.23", default-features = false, features = ["ring", "std"
 # Random number generation — full jitter for exponential backoff in with_retry
 rand = { workspace = true }
 
-[dev-dependencies]
-# Scratch files for channel-templates.json fixtures in tests
+# `buzz onboard`: kind 24210 Sandbox session control (enroll, profile, the
+# first agent-signed deploy), NIP-44 encrypted to the Sandbox manager.
+buzz-session-control = { workspace = true }
+# `buzz onboard`: secrets held in memory are wiped on drop.
+zeroize = { workspace = true }
+# `buzz onboard`: hidden terminal input for keys and tokens.
+rpassword = "7.5"
+# `buzz onboard`: the Paseo offer URL as a terminal QR code (no image backend).
+qrcode = { version = "0.14", default-features = false }
+# `buzz onboard`: the via profile check that profile.py makes.
+toml = "1.0"
+# `buzz onboard`: ssh-keygen writes the agent signing key into a private
+# temporary directory, as the GPUI enroll form does.
 tempfile = "3"
+# `buzz onboard`: the agents' first starts run concurrently.
+futures-util = { workspace = true }
+
+[dev-dependencies]
+# `buzz onboard` tests: the Sandbox manager's own deploy checks
+# (`provider::parse`, `check_sandbox_request`) accept the first-start payload.
+buzz-backend-kubernetes = { path = "../buzz-backend-kubernetes" }
 # Minimal HTTP test server for retry/policy integration tests
 axum = { workspace = true }
 # `test-util` enables paused-time control for deterministic timeout tests

crates/buzz-cli/README.md

@@ -20,6 +20,33 @@ export BUZZ_PRIVATE_KEY="nsec1..."
 buzz channels list
 ```
 
+## Onboarding (`buzz onboard`)
+
+`buzz onboard` is an interactive wizard that sets up a developer for Remote
+workspace agents without the Buzz app: a Buzz identity (generated, or imported
+with `--import-key`), the community invite, GitHub, model and 1Password
+credentials, agents from presets in a workspace channel, the encrypted profile
+enrollment, and the Paseo pairing for desktop, web, and mobile. It sends the same events and Sandbox manager
+requests as the Buzz app, so the result works in every Buzz app.
+
+```bash
+buzz onboard                                   # interactive
+buzz onboard --yes --agents brokkr,bifrost     # no prompts; secrets from BUZZ_ONBOARD_* env vars
+buzz onboard --reenroll                        # change a stored credential
+```
+
+It does not need `BUZZ_PRIVATE_KEY` and ignores `BUZZ_RELAY_URL`: the relay is
+`--relay` (default `wss://buzz.voltage.cloud`, `wss://` only). The owner key is
+saved to `<config dir>/buzz/identity.nsec` and progress to `onboard.json` (both
+mode `0600`); a re-run resumes the setup. Credentials are never saved
+or printed. Progress goes to stderr and a JSON summary without secrets to
+stdout. A daemon gateway key is checked against your owner and agent keys.
+Until the gateway SDK is included, the wizard prints the exact grant command
+under **Action needed** and never reports a successful grant. The default and
+maximum lifetime is 90 days (`--gateway-expires`); use `--skip-gateway-grant`
+to defer authorization. The final step also prints your workflow command.
+See [voltage/remote-agents.md](../../voltage/remote-agents.md#set-up-with-paseo-no-buzz-app).
+
 ## Usage
 
 All output is JSON on stdout. Errors are JSON on stderr. Exit codes: 0=ok, 1=user error, 2=network, 3=auth, 4=other, 5=write conflict.
@@ -120,6 +147,7 @@ The table below mirrors that tree for readers who are not at a terminal.
 
 | Group | Subcommand | Description |
 |-------|-----------|-------------|
+| `onboard` | | Set up identity, credentials and Remote workspace agents without the Buzz app |
 | `messages` | `send` | Send a message to a channel |
 | | `send-diff` | Send a code diff with metadata |
 | | `edit` | Edit a message you sent |

crates/buzz-cli/src/commands/mod.rs

@@ -11,6 +11,7 @@ pub mod mem;
 pub mod messages;
 pub mod moderation;
 pub mod notes;
+pub mod onboard;
 pub mod pack;
 pub mod patches;
 pub mod pr;