refactor: migrate BFF from direct gRPC to openshell-sdk-go - #2
Open
rhuss wants to merge 3 commits into
Open
Conversation
rhuss
marked this pull request as draft
July 31, 2026 19:08
Contributor
Author
|
I haven't tested it yet, so please hold on a bit. 'will do a sanity check tomorrow. |
rhuss
force-pushed
the
002-sdk-migration
branch
7 times, most recently
from
August 1, 2026 07:44
bab975d to
4f52847
Compare
rhuss
force-pushed
the
002-sdk-migration
branch
from
August 1, 2026 07:47
4f52847 to
c3d3cc7
Compare
5 tasks
rhuss
marked this pull request as ready for review
August 1, 2026 07:57
Contributor
Author
|
Ready for prime time, I will keep it updated and incorporate fixes while we are going. Fully up to you if and when you want to do the switch. |
rhuss
force-pushed
the
002-sdk-migration
branch
3 times, most recently
from
August 1, 2026 12:26
c54f355 to
138fc5c
Compare
DX improvements: - dev-env.sh writes scripts/.env.dev with all config (including OPENSHELL_DIR) - Makefile auto-sources scripts/.env.dev via -include (zero manual exports) - make dev-full: one command starts infra + dashboard - make dev: auto-reads config from previous dev-env.sh start OPENSHELL_DIR resolution: - Checks env var first, then scripts/.env.dev, then prompts interactively - Offers to clone NVIDIA/OpenShell if no checkout exists - Persists the path to .env.dev for future runs Robust shutdown: - Graceful stop with 10s timeout, then SIGKILL - Detects and kills orphaned gateway processes on the expected port - Force-removes Keycloak containers regardless of state - Cleans up stale PID/log/config files (preserves PKI, DB, env config) Also: fix grpcurl to use proto descriptor instead of server reflection Assisted-By: 🤖 Claude Code
* Redesign sandbox cards, table, and attention alerts Card view: status dot + name + uptime header, PF Alert-based attention section with paginated prev/next for multiple items, DescriptionList for providers/labels, policy egress summary with expandable rule list showing rule name + host/binary counts + enforcement labels. Table view: new columns — Name (with image subtitle), Status (dot + phase text), Policy (shield icon + version + host summary + proposed badge), Providers (teal labels with overflow). Actions kebab has Terminal, Logs, Delete. Attention system: shared SandboxAttention component with two modes — card (single alert with top-right 1/N pager) and detail (AlertGroup stack with dismiss). Builds severity-ranked items from sandbox phase, policy revision status, and draft proposal summary. Shared utilities: StatusDot component, getStatusDotColor, countEgressHosts, getEnforcementLabel/Color extracted to utils.ts. Policy data sourced from policy view API (not stale spec.policy). Draft summary endpoint re-added and wired to card view. Also: BFF draft-summary route fix (binary was stale), advisorProposed added to NetworkEndpoint type, PF6 consistency pass (DescriptionList, Content, Alert, Divider, CardTitle removal, no hardcoded pixels). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Labels column to sandbox table LabelsList now accepts numLabels prop (default 3). Table shows labels with overflow at 2. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude project settings with PatternFly plugins Enables patternfly-mcp and design-audit plugins for PF6 component docs, token checking, and design compliance. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address PR review findings - Replace 'rhoai' with 'managed' in DeploymentContext type - Feature-gate Terminal button and table action behind features.terminal - Gate draft-summary polling on features.draftPolicy (enabled param) - Gate onReviewDrafts callback on features.draftPolicy - Extract SandboxEgressSummary component (97 lines out of card) - Share getPolicySummary between card and table (remove duplicate) - Export SandboxAttention, SandboxEgressSummary, StatusDot from barrel - Replace hardcoded logo height with PF spacer token - Add useSlots to SandboxCard for sandboxActions/sandboxMetadata slots - Move attention pager out of Alert actionClose into sibling flex Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace internal/gateway/ (~50 gRPC wrapper methods) with the openshell-sdk-go SDK client. All handlers now use typed sub-clients (Sandboxes, Workspaces, Providers, Policy, Config, Inference, Services, Exec, Files, Health). - New internal/sdkclient/auth.go: context-based AuthProvider for per-request JWT forwarding through the SDK - All From* DTO converters updated for SDK domain types - SDK error mapping (11 gRPC codes) replaces direct status handling - CA cert support via SDK Config.TLS.CAFile - Deleted: internal/gateway/, proto/, gen/, terminal_handler.go - Removed: make proto target, PROTO_* Makefile variables - Updated: CLAUDE.md and .claude/rules/bff-go.md architecture rules Assisted-By: 🤖 Claude Code
rhuss
force-pushed
the
002-sdk-migration
branch
2 times, most recently
from
August 3, 2026 09:14
6931e7b to
f44bff4
Compare
Gkrumbach07
added a commit
that referenced
this pull request
Aug 7, 2026
…extension surface Rewrites the auth ADRs to match post-#24 reality and adds three new ADRs that take firm architectural stances: - ADR 0001 v2: auth described as modes (dev/standalone/federated) x patterns (token relay / session custodian / future token exchange), replacing the conflated 'three-mode' framing - ADR 0003 v2: 'token custody, not token validation' replaces the no-longer- accurate 'dumb pipe' doctrine; the custody/validation line is the boundary - ADR 0005: adds Aug 6-7 #team-openshell outcomes (standalone-first, shared OIDC recommended, own-flow vs token-exchange mechanisms) - ADR 0008 v2: polling for data, WebSocket for the terminal only — reconciles the ADR with the shipped terminal relay - ADR 0011 (new): BFF scope boundary — four jobs, an explicit never-list, and rulings on previously ambiguous proposals - ADR 0012 (new): the extension surface — five downstream mechanisms (barrels, slots, callbacks, flags, runtime config) and the zero-CSS policy - ADR 0013 (new, Proposed): adopt openshell-sdk-go (PR #2) with provenance, parity, and secret-hygiene conditions CLAUDE.md and .claude rules updated to match (cookie sessions replace the stale sessionStorage guidance; bearer precedence chain; scope never-list). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace the BFF's direct gRPC/protoc gateway layer with the
openshell-sdk-goSDK client.Net diff: +1,000 / -26,000 lines (proto stubs + generated code removed).
What changed
internal/gateway/(8 files, raw gRPC)ClientInterface(single import)backend/proto/(5 files)backend/gen/(7 files, 26K lines)PerRPCCredentialssdkclient.ContextAuthProvidergrpc/statuscodes directlyIsNotFound()etc. helpersprotocformake protoMerge order
Merge PR #4 first (dev setup DX), then this PR. This branch is rebased on PR #4.
Known SDK gaps
WithGlobal(true)option (openshell-sdk-go#44). The handler is in place but will error until the SDK fix lands.SDK dependency
Uses
github.com/rhuss/openshell-sdk-gov0.3.1. This is a private fork that will eventually move to the OpenShell org. Issues and feedback welcome on that repo.Test plan
go build ./...passesgo test ./...passes (5 packages)🤖 Generated with Claude Code