Add ucode apply: publish the authored managed config

The publish step for the manifest `ucode setup` authors. Validates, shows what
would change, confirms, then writes it to the workspace via the clients added in
the parent commit.

Updates in place rather than replacing. When the workspace already has a config,
`apply` PATCHes it using its resource name (read back from the existing-config
GET, which `normalize_managed_config` preserves). Delete-then-create was the
original plan — v0's Create returns ALREADY_EXISTS — but it has a window where the
workspace has *no* managed config, and if the create failed there every developer
would silently fall back to their own settings until someone re-ran the command.
The server applies the update mask inside a single entity-store update, so a
failed PATCH leaves the current config intact. It is still a whole-manifest write:
every path ucode owns is sent, so a field the admin dropped on a re-run is cleared
rather than left behind.

Refuses to publish when it cannot tell whether a config already exists. A failed
existence check used to be the one case where "just try the create" would either
duplicate or silently overwrite an admin's work, so an unreadable check is a hard
error naming the reason rather than a warning.

`_explain_publish_failure` maps the failures an admin will actually hit.
FEATURE_DISABLED is the likely first experience — the CRUD flag is off by default —
so it names `codingAgentConfigCrudEnabled` instead of printing an HTTP 400.
INVALID_PARAMETER_VALUE is passed through verbatim: the server names the offending
field, which beats any paraphrase.

`--yes` skips the confirmation for CI; `--dry-run` validates and previews without
writing. The admin gate and validation both run before anything is sent, so an
invalid manifest or a non-admin costs no round trip.

README documents the publish step and drops the "no partial update yet" caveat,
which the PATCH path makes untrue.

Verified against eng-ml-inference.staging: `apply --dry-run` authenticated,
verified admin, rendered the summary, detected the existing config, and chose the
update path without writing.

Tests: 19 cases. Mutation-verified three ways — always-create instead of PATCH,
publishing despite an unreadable existence check, and publishing an invalid
manifest each fail a specific test. Also covers that `typer.Exit(0)` isn't caught
by the command's own RuntimeError handler, the same trap `setup` hit.

Co-authored-by: Isaac

Author: tt-le

README.md

@@ -194,8 +194,23 @@ ucode setup --dry-run
 ucode setup --from-file ./managed-settings.json
 ```
 
-Publishing replaces the workspace's config outright — there is no partial update yet, so anything
-skipped in a re-run is dropped.
+Once the manifest looks right, publish it:
+
+```bash
+# Validate, show what would change, and ask before publishing.
+ucode apply
+
+# Preview without publishing.
+ucode apply --dry-run
+
+# Publish without the confirmation prompt (for CI).
+ucode apply --yes
+```
+
+`apply` updates the workspace's existing config in place rather than replacing it, so a failed
+publish leaves the current config intact. It is still a whole-manifest write: every field ucode
+authors is sent, so anything skipped in a re-run is cleared rather than carried over. Developers
+pick the new config up on their next ucode run.
 
 ---
 
@@ -222,6 +237,8 @@ skipped in a re-run is dropped.
 | `ucode setup` | Author the workspace's managed coding config (workspace admins only) |
 | `ucode setup show` | Print the authored config and the payload `ucode apply` would publish |
 | `ucode setup --from-file <file>` | Load a hand-written managed config instead of running the prompts |
+| `ucode apply` | Publish the authored managed config to the workspace (workspace admins only) |
+| `ucode apply --yes` | Publish without the confirmation prompt |
 
 ## Managed Local Files
 

src/ucode/cli.py

@@ -57,7 +57,7 @@
 )
 from ucode.managed_config import managed_agent_config_enabled, managed_launch_state
 from ucode.managed_resolve import managed_default_model, managed_provider_service
-from ucode.managed_wizard import setup_command, show_command
+from ucode.managed_wizard import apply_command, setup_command, show_command
 from ucode.mcp import (
     MCP_CLIENTS,
     SKILLS_MCP_KIND,
@@ -1967,6 +1967,34 @@ def setup_show_cmd() -> None:
         raise typer.Exit(code)
 
 
+@app.command("apply")
+def apply_cmd(
+    yes: Annotated[
+        bool,
+        typer.Option("--yes", "-y", help="Publish without the confirmation prompt."),
+    ] = False,
+    dry_run: Annotated[
+        bool,
+        typer.Option("--dry-run", help="Validate and preview without publishing."),
+    ] = False,
+) -> None:
+    """Publish this workspace's managed coding config (workspace admins only)."""
+    set_dry_run(dry_run)
+    # See the `setup` callback: `typer.Exit` subclasses RuntimeError, so it must be raised after
+    # the try block or the handler below would report a successful exit as an error.
+    try:
+        install_databricks_cli()
+        code = apply_command(yes=yes)
+    except RuntimeError as exc:
+        print_err(str(exc))
+        raise typer.Exit(1) from None
+    except KeyboardInterrupt:
+        print_err("Interrupted.")
+        raise typer.Exit(130) from None
+    if code:
+        raise typer.Exit(code)
+
+
 @app.command("status")
 def status_cmd() -> None:
     """Show current workspace, tool configs, and saved model selections."""

src/ucode/managed_wizard.py

@@ -15,10 +15,13 @@
 
 import json
 from pathlib import Path
+from typing import cast
 
 from ucode.agents import TOOL_SPECS, check_gateway_endpoint
+from ucode.config_io import is_dry_run
 from ucode.databricks import (
     ANTHROPIC_FAMILIES,
+    create_coding_agent_config,
     discover_claude_models_unbucketed,
     ensure_databricks_auth,
     get_databricks_token,
@@ -27,6 +30,7 @@
     list_model_provider_services,
     list_workspace_budgets,
     service_usable_for_tool,
+    update_coding_agent_config,
 )
 from ucode.managed_config import get_managed_config
 from ucode.managed_setup import (
@@ -876,4 +880,122 @@ def show_command() -> int:
     return 0
 
 
-__all__ = ["setup_command", "setup_from_file", "show_command"]
+# Server-side failures an admin is actually likely to hit, mapped to something they can act on. The
+# raw reasons are `HTTP <code> <reason>: <body>` strings from the transport, and the body carries the
+# API's `error_code`, so matching on that is more robust than on status codes alone.
+def _explain_publish_failure(reason: str) -> str:
+    lowered = reason.lower()
+    if "feature_disabled" in lowered:
+        return (
+            "Managed coding-agent configs aren't enabled on this workspace yet. Ask your Databricks "
+            "contact to enable the `codingAgentConfigCrudEnabled` flag for it, then re-run "
+            "`ucode apply`."
+        )
+    if "permission_denied" in lowered or "http 403" in lowered:
+        return (
+            "Publishing a managed config requires workspace admin. Your account can read the "
+            "workspace but not author its coding config."
+        )
+    if "already_exists" in lowered:
+        return (
+            "This workspace already has a managed config, but ucode couldn't read it to update in "
+            "place. Run `ucode apply` again — if it keeps failing, the existing config may need to "
+            "be deleted by hand."
+        )
+    if "invalid_parameter_value" in lowered:
+        # The server names the offending field; passing it through beats paraphrasing.
+        return f"The workspace rejected the config: {reason}"
+    return f"Could not publish the managed config: {reason}"
+
+
+def apply_command(*, yes: bool = False) -> int:
+    """Publish the authored manifest to the workspace.
+
+    Updates the existing config in place when there is one, rather than deleting and recreating it:
+    a failed recreate would leave the workspace with no managed config at all, and every developer
+    would silently fall back to their own settings. Returns a process exit code.
+    """
+    from ucode.cli import _prompt_for_configuration
+
+    print_section("ucode apply")
+
+    state = load_state()
+    workspace = state.get("workspace")
+    profile = state.get("profile")
+    if not workspace:
+        workspace, profile = _prompt_for_configuration()
+
+    manifest = load_managed_settings(workspace)
+    if manifest is None:
+        raise RuntimeError(
+            "No managed config has been authored for this workspace. Run `ucode setup` first "
+            "(or `ucode setup --from-file <json>`)."
+        )
+
+    errors = validate_manifest(manifest, state)
+    if errors:
+        print_err("The authored config is not valid, so it was not published:")
+        for error in errors:
+            print_note(error)
+        print_note("Re-run `ucode setup` to fix it, or edit ~/.ucode/managed-settings.json.")
+        return 1
+
+    ensure_databricks_auth(workspace, profile)
+    token = get_databricks_token(workspace, profile)
+    _require_admin(workspace, token)
+
+    payload = serialize_managed_config(manifest)
+    _render_summary(workspace, manifest)
+
+    # Read before writing: the resource name tells us whether to create or update, and shows the
+    # admin what they are about to overwrite.
+    with spinner("Checking for an existing managed config..."):
+        existing, reason = get_managed_config(workspace, token)
+    if reason is not None:
+        raise RuntimeError(
+            f"Could not check whether {workspace} already has a managed config: {reason}. "
+            "Refusing to publish without knowing, since that could overwrite a config silently."
+        )
+
+    existing_name = (existing or {}).get("name")
+    if existing is not None and not isinstance(existing_name, str):
+        raise RuntimeError(
+            "This workspace has a managed config but the API didn't return its resource name, so "
+            "ucode can't update it in place. Delete it in the workspace and re-run `ucode apply`."
+        )
+
+    console.print()
+    if existing is None:
+        print_note(f"This will create a new managed config on {workspace}.")
+    else:
+        agents = ", ".join((existing.get("enabled_agents") or {}).keys()) or "no agents"
+        print_warning(
+            f"This will replace the config already published on {workspace} (currently: {agents}). "
+            "Every developer picks the new one up on their next ucode run."
+        )
+    if not yes and not prompt_yes_no_default("Publish this config?", default=False):
+        print_note("Nothing was published.")
+        return 1
+
+    if is_dry_run():
+        print_success("Dry run: the config was validated but not published.")
+        return 0
+
+    if existing is None:
+        with spinner("Publishing the managed config..."):
+            published, publish_reason = create_coding_agent_config(workspace, token, payload)
+    else:
+        with spinner("Updating the managed config..."):
+            published, publish_reason = update_coding_agent_config(
+                workspace, token, cast("str", existing_name), payload
+            )
+    if publish_reason is not None:
+        raise RuntimeError(_explain_publish_failure(publish_reason))
+
+    name = (published or {}).get("name") or existing_name or "coding-agent-configs/?"
+    print_success(f"Published {name} to {workspace}")
+    print_note("Developers pick this up on their next ucode run.")
+    return 0
+
+
+__all__ = ["apply_command", "setup_command", "setup_from_file", "show_command"]