[delete-cloud]

Summary

• add remote admin token and admin token env config fields
• route remote semantic memory maintenance calls through admin auth while keeping user-token fallback
• keep normal remote endpoints on user auth and redact all token values in remote list

Verification

• uv run pytest tests/cli/test_remote_client.py -q
• uv run pytest tests/cli/test_remote_client.py -q -k "remote_memory or admin_token or semantic_memory"
• uv run ruff check src/coding_agent/remote/client.py src/coding_agent/cli/remote_commands.py tests/cli/test_remote_client.py
• uv run ruff format --check src/coding_agent/remote/client.py src/coding_agent/cli/remote_commands.py tests/cli/test_remote_client.py
• git diff --check

Review

• local subagent review: APPROVE no P1/P2

Summary by CodeRabbit

• New Features

  • Added support for separate admin authentication when configuring a remote.
  • Remote listing now shows distinct user and admin authentication status.

• Bug Fixes

  • Semantic-memory status and rebuild actions now use the correct admin credentials when available.
  • Remote configuration validation now rejects invalid admin credential settings sooner.

• Security

  • Admin credential values are hidden in remote list output.

[coderabbitai]

Warning

Review limit reached

@delete-cloud, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 44 minutes and 11 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 31dd52cb-2af0-4d5a-90f6-406706a37512

📥 Commits

Reviewing files that changed from the base of the PR and between ca5ae17 and 69fbacb.

📒 Files selected for processing (2)

• coding-agent/src/coding_agent/cli/remote_commands.py
• coding-agent/tests/cli/test_remote_client.py

📝 Walkthrough

Walkthrough

Adds optional admin credentials (admin_token, admin_token_env) to RemoteEndpoint. The CLI remote add command gains matching options, persistence reads/writes both fields, a new admin_auth_headers() helper resolves the effective admin token (with env-var and blank-value validation), and semantic memory status/rebuild requests now use those admin headers. remote list output is split into user-auth and admin-auth fields.

Changes

Admin credentials for remote endpoints

Layer / File(s)	Summary
RemoteEndpoint fields and persistence coding-agent/src/coding_agent/remote/client.py	RemoteEndpoint gains admin_token and admin_token_env optional fields; _remote_payload() persists them; load_remotes() reads, type-validates, and constructs endpoints with these fields.
add_remote validation and admin_auth_headers resolution coding-agent/src/coding_agent/remote/client.py	add_remote() accepts the new keyword args with mutual-exclusivity validation. admin_auth_headers() resolves the effective token from a direct value or env var, validates non-blank presence, and falls back to regular bearer auth.
HTTP helper headers override coding-agent/src/coding_agent/remote/client.py	_get_remote_json() and _post_remote_json() each gain an optional headers parameter; when provided it replaces the default auth_headers(endpoint) call. Semantic memory status and rebuild calls pass admin_auth_headers(endpoint) through this override.
CLI remote add/list admin options coding-agent/src/coding_agent/cli/remote_commands.py	remote add gains --admin-token and --admin-token-env options forwarded to add_remote. remote list output is split into user-auth and admin-auth fields via _remote_admin_auth_label. RemoteEndpoint import moved under TYPE_CHECKING.
Tests coding-agent/tests/cli/test_remote_client.py	New and updated tests cover admin token HTTP header selection, env-var resolution, fast-fail on missing/blank env tokens, user-token fallback for list endpoints, CLI persistence and secret redaction, conflicting-option rejection, updated semantic memory auth expectations, and invalid-type rejection in remotes.json.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• delete-cloud/Coding-Agent-Loop#116: Introduces the base RemoteEndpoint auth-header construction and remote HTTP request helpers that this PR extends with admin credential support.

Poem

🐇 A token for admins, a token for users,
Two keys in my burrow for two kinds of choosers.
admin_token_env set in the air,
Semantic memory rebuilt with extra care!
The rabbit hops on, credentials in tow,
No more mixed-up headers — off to the show! 🌟

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 4.35% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding admin token support for remote commands and client auth.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/remote-admin-token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

coding-agent/tests/cli/test_remote_client.py (1)

3108-3117: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Keep one semantic-memory CLI test on the user-token fallback path.

Both updated semantic-memory CLI tests now provision admin credentials, so the documented fallback for existing remotes configured with only token is no longer exercised here. A regression in remote memory status/rebuild could now slip by even though admin_auth_headers() is supposed to fall back to normal auth.

Also applies to: 3216-3229

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@coding-agent/tests/cli/test_remote_client.py` around lines 3108 - 3117, Keep
one semantic-memory CLI test exercising the user-token fallback path by leaving
a remote configured with only token and no admin-token. Update one of the
affected remote add setups in the semantic-memory tests so admin_auth_headers()
still has to fall back to normal auth for remote memory status/rebuild. Use the
relevant remote add command block in the remote client tests to remove the admin
credential from just one case, while leaving the other admin-backed test intact.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@coding-agent/src/coding_agent/cli/remote_commands.py`:
- Around line 37-53: Reject blank admin credentials in remote_add before calling
add_remote: normalize admin_token and admin_token_env and fail fast when either
is an empty or whitespace-only string so invalid values are not persisted.
Update the remote_add CLI path in remote_commands to validate these inputs
consistently with admin_auth_headers in coding_agent.remote.client, and only
forward non-blank admin credentials to add_remote.

---

Nitpick comments:
In `@coding-agent/tests/cli/test_remote_client.py`:
- Around line 3108-3117: Keep one semantic-memory CLI test exercising the
user-token fallback path by leaving a remote configured with only token and no
admin-token. Update one of the affected remote add setups in the semantic-memory
tests so admin_auth_headers() still has to fall back to normal auth for remote
memory status/rebuild. Use the relevant remote add command block in the remote
client tests to remove the admin credential from just one case, while leaving
the other admin-backed test intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9156e4be-4d5f-4521-afa1-b8aa35a86039

📥 Commits

Reviewing files that changed from the base of the PR and between 94bedc8 and ca5ae17.

📒 Files selected for processing (3)

• coding-agent/src/coding_agent/cli/remote_commands.py
• coding-agent/src/coding_agent/remote/client.py
• coding-agent/tests/cli/test_remote_client.py