chore(sdk/ts): migrate the TypeScript SDK to ai-openshell/sdk-typescript #5480

User Story

As a maintainer of the TypeScript SDK, I want to move it out of core into ai-openshell/sdk-typescript the way the Go SDK (#5031) and the Python SDK (#5287) moved, so that it gets its own CI, reviews and releases.

Problem Statement

RFC 0019 (#4426) moves the SDKs out of core first. The TypeScript SDK lives in one core directory, sdk/typescript/, but core also owns its tooling:

• tasks/typescript.toml (sdk:ts:* tasks) and the Windows wrappers tasks/scripts/typescript-{install,proto}.ps1;
• the TypeScript SDK job in branch-checks.yml, which runs sdk:ts:ci and an npm publish --dry-run;
• sdk-typescript-publish.yml, called by release-publish.yml for every stable release, which publishes @nvidia/openshell-sdk to GitHub Packages;
• the e2e:sdk:ts:exec task;
• proto:lint, which runs buf from the SDK's node_modules;
• ci:check, ci:format, ci:lint and test, which include the sdk:ts:* tasks;
• CodeQL paths, license-header exclusions, and docs/sdk/typescript.mdx.

Impact / Why This Matters

• SDK maintainers own CI, reviews and releases without core review bandwidth, which is the goal of RFC 0019.
• Users have to change the package name once, from @nvidia/openshell-sdk to @ai-openshell/sdk. GitHub Packages ties an npm scope to the account that owns it, so a workflow in ai-openshell can't publish @nvidia/openshell-sdk. Known consumers include NVIDIA/NemoClaw. The entry points (. and ./raw) and the API stay the same.
• Core stops building and publishing the package, and core proto PRs no longer have to update the SDK in the same PR.

Proposed Design

Follow the Python SDK's phases (#5287), adapted to TypeScript:

1. Prerequisites.
   • Decide the package name and registry (decided: @ai-openshell/sdk, see below), and announce the rename to known consumers.
   • Freeze at v0.1.8. Core main has no sdk/typescript changes after that tag.
   • Make the repository public and allow merge commits for the import.
2. Import.
   • Extract sdk/typescript/ with history using git filter-repo --subdirectory-filter, as for the Go SDK, and rewrite #N references to NVIDIA/OpenShell#N.
   • A second PR makes the package build on its own: protos fetched from core at the pinned tag (OPENSHELL_CORE_REF), the generated bindings committed with a staleness check, the new package name, standalone CI on the supported Node versions, and the repository template applied.
3. Cutover in core.
   • Remove the TypeScript SDK job from PR gating, and move proto:lint onto a core-owned buf (mise tool).
   • Add a TypeScript SDK Freeze required check that fails on changes to sdk/typescript/.
   • Port the open PRs that edit sdk/typescript/ (15 today). Most are API changes that update the SDK alongside the protos; their SDK half lands in sdk-typescript after the core change ships.
   • Move the open TypeScript SDK issues (today: the TypeScript half of bug(sdk): TCP forward drops the response after the local client half-closes (Go Listen and TS forward) #4511), and point the issue templates and CONTRIBUTING at sdk-typescript.
4. Automation in sdk-typescript. As in sdk-python: bump PRs for each core release, E2E against that release's gateway (the interactive-exec test moves with the SDK), release tagging and a nightly drift check.
5. Retire in core.
   • Stop publishing from core: remove publish-sdk-typescript from release-publish.yml and delete sdk-typescript-publish.yml.
   • Remove sdk/typescript/, tasks/typescript.toml, the PowerShell wrappers, the CodeQL and license-header entries.
   • Update docs/sdk/typescript.mdx, AGENTS.md, CONTRIBUTING, TESTING and the skills.
6. Release. Publish the first release from sdk-typescript as @ai-openshell/sdk.

Progress:

• History import, frozen at v0.1.8: ai-openshell/sdk-typescript#1. Extraction scripts on the migration/v0.1.8 branch.
• Standalone build, the rename to @ai-openshell/sdk, committed bindings and CI on Node 20, 22 and 24: ai-openshell/sdk-typescript#2 (stacked on ci: add GitHub Actions CI workflow with lint, test, and image build #1).

Decisions:

• Package name: @ai-openshell/sdk, kept for good. It reads like other JavaScript SDKs (@anthropic-ai/sdk, @modelcontextprotocol/sdk), and npm only hosts JavaScript, so it doesn't clash with the Python or Go SDKs.
• Registry: GitHub Packages first, because a workflow in ai-openshell can publish @ai-openshell/* there today. Then npmjs.org, once ownership of the ai-openshell npm org is confirmed, with trusted publishing. Because the name doesn't change, the switch only means removing the @ai-openshell:registry=https://npm.pkg.github.com line from .npmrc and regenerating the lockfile. It also removes the token that GitHub Packages requires even for public packages.

Acceptance Criteria

• ai-openshell/sdk-typescript builds, tests and packages the SDK without a core checkout.
• The first release from sdk-typescript has the same exports as the last core-built @nvidia/openshell-sdk, as @ai-openshell/sdk.
• Core CI and releases no longer build, test or publish the SDK, and core proto PRs no longer touch sdk/typescript/.
• The package is published only from sdk-typescript.
• No open TypeScript SDK issues remain in core, and core's issue templates send new reports to sdk-typescript.

Alternatives Considered

• Keep publishing @nvidia/openshell-sdk from core after the move. Core would still build a package it no longer owns, which is what the move removes.
• Generate the bindings at build time (as core does today). Builds would then need core's protos, so installing from a git ref and rebuilding a release would need network access to core. Go and Python commit their bindings.
• Keep the SDK in core and delegate through CODEOWNERS. RFC 0019 already weighs this option.

Agent Investigation

An agent mapped the SDK's footprint in core and rehearsed the history extraction locally: 38 commits from 20 authors, with a tip tree (c5a55ea8) identical to sdk/typescript at v0.1.8. One imported commit (#2884) lacks Signed-off-by, so the import PR needs a DCO override.