fix: clarify comments and rename shadowing variable in workspace commands

- Rename `sandbox` variable to `ws` in delete/cmd.go to avoid shadowing
  the `sandbox` package import
- Document that WithPublicKey is Snowflake-only (loginType is hardcoded
  to "snowflake-person-keypair"; BigQuery uses a different auth flow)
- Fix misleading comment in dbt generate env dialog: matching is done
  by ConfigurationID, not by SandboxWorkspace.ID
- Use workspace name (not UUID) in "no active editor session" error
- Note that StorageWorkspaceCreateCredentialsRequest rotates credentials
  on every call, not just fetches them

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Matovidlo

internal/pkg/keboola/sandbox/sandbox.go

@@ -109,6 +109,8 @@ func WithSize(v string) CreateSandboxWorkspaceOption {
 }
 
 // WithPublicKey configures keypair authentication with the given public key PEM.
+// Note: loginType is set to "snowflake-person-keypair"; BigQuery workspaces use a
+// different auth mechanism and should not use this option.
 func WithPublicKey(v string) CreateSandboxWorkspaceOption {
 	return func(p *createParams) {
 		p.PublicKey = v

internal/pkg/service/cli/cmd/dbt/generate/env/dialog.go

@@ -57,7 +57,7 @@ func AskGenerateEnv(
 	}
 
 	// SQL workspace (Snowflake/BigQuery) — fetch StorageWorkspace credentials via the editor session.
-	// workspace.SandboxWorkspace.ID holds the EditorSessionID; find the matching session for WorkspaceID.
+	// Find the editor session for this workspace by matching ConfigurationID.
 	var matchedSession *keboola.EditorSession
 	for _, s := range sessions {
 		if s.ConfigurationID == workspace.Config.ID.String() {
@@ -66,14 +66,16 @@ func AskGenerateEnv(
 		}
 	}
 	if matchedSession == nil {
-		return genenv.Options{}, errors.Errorf(`no active editor session found for workspace "%s"`, workspace.Config.ID)
+		return genenv.Options{}, errors.Errorf(`no active editor session found for workspace %q`, workspace.Config.Name)
 	}
 
 	workspaceIDUint, err := strconv.ParseUint(matchedSession.WorkspaceID, 10, 64)
 	if err != nil {
 		return genenv.Options{}, errors.Errorf("cannot parse workspace ID %q: %w", matchedSession.WorkspaceID, err)
 	}
 
+	// StorageWorkspaceCreateCredentialsRequest creates new credentials on each call,
+	// which rotates any previously issued credentials for this workspace.
 	storageWS, err := api.StorageWorkspaceCreateCredentialsRequest(branchID, workspaceIDUint).Send(ctx)
 	if err != nil {
 		return genenv.Options{}, errors.Errorf("cannot fetch workspace credentials: %w", err)

internal/pkg/service/cli/cmd/remote/workspace/delete/cmd.go

@@ -95,15 +95,15 @@ func Command(p dependencies.Provider) *cobra.Command {
 				})
 			}
 
-			sandbox, err := d.Dialogs().AskWorkspace(allWorkspaces, f.WorkspaceID)
+			ws, err := d.Dialogs().AskWorkspace(allWorkspaces, f.WorkspaceID)
 			if err != nil {
 				return err
 			}
 
 			// Send cmd successful/failed event
 			defer d.EventSender().SendCmdEvent(cmd.Context(), d.Clock().Now(), &cmdErr, "remote-workspace-delete")
 
-			return deleteOp.Run(cmd.Context(), d, branch.ID, sandbox)
+			return deleteOp.Run(cmd.Context(), d, branch.ID, ws)
 		},
 	}