Skip to content

feat(python): add from_env configuration - #2646

Draft
dhirajsb wants to merge 1 commit into
NVIDIA:mainfrom
dhirajsb:feat/from-env-config-rebased
Draft

feat(python): add from_env configuration#2646
dhirajsb wants to merge 1 commit into
NVIDIA:mainfrom
dhirajsb:feat/from-env-config-rebased

Conversation

@dhirajsb

@dhirajsb dhirajsb commented Aug 6, 2026

Copy link
Copy Markdown

Summary

Add SandboxClient.from_env() as a disk-free configuration path for CI jobs, containers, serverless applications, and other environments that inject gateway settings directly instead of mounting the OpenShell CLI gateway directory.

Related Issue

Closes #1817

Changes

  • Read the gateway endpoint, bearer token, TLS mode and material, timeout, and friendly gateway name from explicit OPENSHELL_* variables.
  • Support bare host:port, HTTP, and HTTPS endpoint forms with explicit TLS override precedence.
  • Validate boolean and timeout inputs and reject partial mTLS client identity.
  • Preserve the existing from_active_cluster() path for CLI-managed state and refreshable OIDC sessions.
  • Document every environment variable and security/lifecycle difference.
  • Add unit coverage for endpoint normalization, TLS profiles, bearer injection, timeout precedence, and invalid configuration.

Testing

  • mise run pre-commit passes
  • mise run python:typecheck passes
  • mise run test:python (103 tests)
  • Unit tests added/updated
  • E2E tests added/updated (not applicable; configuration and transport selection are covered with unit-level channel instrumentation)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (not applicable; user-facing documentation updated)

Add SandboxClient.from_env(), a disk-free constructor that builds a
client entirely from OPENSHELL_* environment variables. It complements
the existing $OPENSHELL_GATEWAY + XDG gateway-directory discovery used
by from_active_cluster() for callers (CI runners, containers, serverless
functions) that inject configuration through the environment rather than
the CLI's on-disk gateway directory.

Environment variables (all follow the existing OPENSHELL_* convention):
- OPENSHELL_ENDPOINT (required): host:port or URL; https selects TLS
- OPENSHELL_TOKEN: OIDC access token attached as Bearer to every RPC
- OPENSHELL_TLS: force TLS on/off, overriding scheme inference
- OPENSHELL_TLS_CA / OPENSHELL_TLS_CERT / OPENSHELL_TLS_KEY: TLS material
- OPENSHELL_TIMEOUT: per-call gRPC timeout in seconds
- OPENSHELL_CLUSTER_NAME: friendly name for error messages

The TLS trust profile mirrors from_active_cluster (full mTLS, CA-only, or
system roots). Uses only stdlib os.environ parsing plus the existing
TlsConfig validation; no new dependencies. Upstreamed from the internal
Astra Sandbox SDK (config.py); contribution O2.

Adds unit tests mirroring the existing *_test.py patterns and documents
the variables under docs/sandboxes/manage-sandboxes.mdx.

Signed-off-by: Dhiraj Bokde <dbokde@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Aug 6, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add from_env() configuration helper for OpenShell Python SDK

1 participant