Skip to content

feat(python): add from_env configuration - #2646

Draft
dhirajsb wants to merge 1 commit into
NVIDIA:mainfrom
dhirajsb:feat/from-env-config-rebased
Draft

feat(python): add from_env configuration#2646
dhirajsb wants to merge 1 commit into
NVIDIA:mainfrom
dhirajsb:feat/from-env-config-rebased

Conversation

@dhirajsb

@dhirajsb dhirajsb commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Add SandboxClient.from_env() as a disk-free configuration path for CI jobs, containers, serverless applications, and other environments that inject gateway settings directly instead of mounting the OpenShell CLI gateway directory.

Related Issue

Closes #1817

Changes

  • Read the gateway endpoint, bearer token, TLS mode and material, timeout, and friendly gateway name from explicit OPENSHELL_* variables.
  • Support bare host:port, HTTP, and HTTPS endpoint forms with explicit TLS override precedence.
  • Validate boolean and timeout inputs and reject partial mTLS client identity.
  • Preserve the existing from_active_cluster() path for CLI-managed state and refreshable OIDC sessions.
  • Document every environment variable and security/lifecycle difference.
  • Add unit coverage for endpoint normalization, TLS profiles, bearer injection, timeout precedence, and invalid configuration.

Testing

  • mise run pre-commit passes
  • mise run python:typecheck passes
  • mise run test:python (103 tests)
  • Unit tests added/updated
  • E2E tests added/updated (not applicable; configuration and transport selection are covered with unit-level channel instrumentation)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (not applicable; user-facing documentation updated)

@dhirajsb
feat(python): add from_env() environment-variable configuration
e254af1 
Add SandboxClient.from_env(), a disk-free constructor that builds a
client entirely from OPENSHELL_* environment variables. It complements
the existing $OPENSHELL_GATEWAY + XDG gateway-directory discovery used
by from_active_cluster() for callers (CI runners, containers, serverless
functions) that inject configuration through the environment rather than
the CLI's on-disk gateway directory.

Environment variables (all follow the existing OPENSHELL_* convention):
- OPENSHELL_ENDPOINT (required): host:port or URL; https selects TLS
- OPENSHELL_TOKEN: OIDC access token attached as Bearer to every RPC
- OPENSHELL_TLS: force TLS on/off, overriding scheme inference
- OPENSHELL_TLS_CA / OPENSHELL_TLS_CERT / OPENSHELL_TLS_KEY: TLS material
- OPENSHELL_TIMEOUT: per-call gRPC timeout in seconds
- OPENSHELL_CLUSTER_NAME: friendly name for error messages

The TLS trust profile mirrors from_active_cluster (full mTLS, CA-only, or
system roots). Uses only stdlib os.environ parsing plus the existing
TlsConfig validation; no new dependencies. Upstreamed from the internal
Astra Sandbox SDK (config.py); contribution O2.

Adds unit tests mirroring the existing *_test.py patterns and documents
the variables under docs/sandboxes/manage-sandboxes.mdx.

Signed-off-by: Dhiraj Bokde <dbokde@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Aug 6, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

@github-actions github-actions Bot added the state:stale Inactive item at risk of automatic closure. label Aug 21, 2026
@kvnloo

kvnloo commented Oct 16, 2026

Copy link
Copy Markdown

A fresh native transport check on this head (e254af1aad7dafd2c06926aa05b575e6ccc2a9ec) found that IPv6 URL endpoints lose their brackets: http://[::1]:PORT and https://[::1]:PORT become ::1:PORT, and SandboxClient.from_env().health() fails in native gRPC with UNAVAILABLE / Misformatted domain name. Bare [::1]:PORT succeeds against the same loopback service, including TLS with an IPv6 IP-SAN certificate.

A minimal downstream proposal reattaches brackets only when the parsed hostname contains :. The same eight real-loopback transport cases plus the 95 existing SDK tests went from 101 pass / 2 fail on your unchanged source to 103 pass with that proposal. It leaves the separate inherited from_active_cluster parser unchanged.

Reproducible execution receipt and limits: Linux ARM64, Python3.14.8/grpcio1.84.0, generated repository bindings and a real Health-only gRPC service, not a deployed gateway or minimum-version qualification. This is fresh agent-assisted evidence under user direction, not recovery of dot's earlier missing packet. Dhiraj Bokde retains the SDK implementation credit; no competing upstream PR or change to the owner branch.

@github-actions github-actions Bot removed the state:stale Inactive item at risk of automatic closure. label Oct 17, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add from_env() configuration helper for OpenShell Python SDK

2 participants

@dhirajsb @kvnloo