feat(sdk): shared SDK core and TypeScript binding (RFC 0005)

.github/workflows/branch-checks.yml

@@ -181,3 +181,34 @@ jobs:
 
       - name: Lint
         run: mise run markdown:lint
+
+  sdk-node:
+    name: TypeScript SDK (openshell-sdk-node)
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    runs-on: linux-amd64-cpu8
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      SCCACHE_GHA_VERSION: branch-checks-sdk-node
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Configure GHA sccache backend
+        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
+
+      - name: Install tools
+        run: mise install --locked
+
+      - name: Cache Rust target and registry
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
+        with:
+          shared-key: rust-sdk-node
+          cache-on-failure: "true"
+
+      - name: Verify SDK binding is in sync and smoke tests pass
+        run: mise run sdk-node:check

crates/openshell-cli/Cargo.toml

@@ -20,6 +20,7 @@ openshell-core = { path = "../openshell-core" }
 openshell-policy = { path = "../openshell-policy" }
 openshell-providers = { path = "../openshell-providers" }
 openshell-prover = { path = "../openshell-prover" }
+openshell-sdk = { path = "../openshell-sdk" }
 openshell-tui = { path = "../openshell-tui" }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -49,8 +50,6 @@ hyper-util = { workspace = true }
 hyper-rustls = { version = "0.27", default-features = false, features = ["native-tokio", "http1", "http2", "tls12", "logging", "ring", "webpki-tokio"] }
 rustls = { workspace = true }
 rustls-pemfile = { workspace = true }
-tokio-rustls = { workspace = true }
-tower = { workspace = true }
 reqwest = { workspace = true }
 
 # Error handling
@@ -66,9 +65,6 @@ tempfile = "3"
 oauth2 = "5"
 base64 = { workspace = true }
 
-# WebSocket (Cloudflare tunnel proxy)
-tokio-tungstenite = { workspace = true }
-
 # Streams
 futures = { workspace = true }
 tokio-stream = { workspace = true }

crates/openshell-cli/src/completers.rs

@@ -9,9 +9,9 @@ use openshell_bootstrap::edge_token::load_edge_token;
 use openshell_bootstrap::oidc_token::{is_token_expired, load_oidc_token, store_oidc_token};
 use openshell_bootstrap::{list_gateways, load_active_gateway, load_gateway_metadata};
 use openshell_core::ObjectName;
-use openshell_core::auth::EdgeAuthInterceptor;
 use openshell_core::proto::open_shell_client::OpenShellClient;
 use openshell_core::proto::{ListProvidersRequest, ListSandboxesRequest};
+use openshell_sdk::EdgeAuthInterceptor;
 use tonic::service::interceptor::InterceptedService;
 use tonic::transport::Channel;
 

crates/openshell-cli/src/lib.rs

@@ -10,7 +10,6 @@ pub(crate) static TEST_ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(()
 
 pub mod auth;
 pub mod completers;
-pub mod edge_tunnel;
 pub mod oidc_auth;
 pub(crate) mod policy_update;
 pub mod run;

crates/openshell-cli/src/main.rs

@@ -2899,7 +2899,7 @@ async fn main() -> Result<()> {
             let mut tls = tls.with_gateway_name(&ctx.name);
             apply_auth(&mut tls, &ctx.name);
             let channel = openshell_cli::tls::build_channel(&ctx.endpoint, &tls).await?;
-            let interceptor = openshell_core::auth::EdgeAuthInterceptor::new(
+            let interceptor = openshell_sdk::EdgeAuthInterceptor::new(
                 tls.oidc_token.as_deref(),
                 tls.edge_token.as_deref(),
             )?;