From a7738b35f97ce711c16250c097428fc4c78bd984 Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Mon, 28 Sep 2026 14:09:14 +0200 Subject: [PATCH 01/10] refactor(providers)!: declare imported profile behavior safely Move non-secret environment defaults and discovery keys into bounded profile declarations. Validate credential collisions and required platform adapters, and keep profile revision encoding deterministic. Preserve sandbox template and spec environment values, including empty values, over non-secret profile defaults in both launch paths. Keep provider credential placeholders authoritative. Allow identical non-secret values from attached providers while rejecting conflicting values and credential key collisions. Never expose GOOGLE_SERVICE_ACCOUNT_KEY through credentials or non-secret defaults, including older stored profiles. Omit stale private-key records without withholding remaining Vertex tokens or SDK configuration. Remove ID-selected adapters and orphaned GCP metadata helpers; document migration and compatible example imports. Validation: provider profile parsing, environment, and discovery tests passed. Closes #3442 BREAKING CHANGE: Google Cloud and Vertex profiles must declare their environment and discovery effects. Configure Vertex private key material through credential refresh instead of GOOGLE_SERVICE_ACCOUNT_KEY. Signed-off-by: Philippe Martin --- crates/openshell-cli/src/commands/provider.rs | 23 - .../tests/provider_commands_integration.rs | 9 +- crates/openshell-core/build.rs | 3 + .../src/provider_credentials.rs | 219 +- crates/openshell-providers/README.md | 39 +- crates/openshell-providers/src/discovery.rs | 50 +- .../src/environment_tests.rs | 282 +++ crates/openshell-providers/src/lib.rs | 95 +- crates/openshell-providers/src/profiles.rs | 226 +- .../src/providers/google_cloud.rs | 161 -- .../openshell-providers/src/providers/mod.rs | 5 - .../src/providers/vertex.rs | 149 -- crates/openshell-sandbox/src/boundary_exec.rs | 5 +- crates/openshell-server/src/grpc/policy.rs | 89 + crates/openshell-server/src/grpc/provider.rs | 887 ++++--- .../src/provider_profile_sources.rs | 45 + crates/openshell-server/src/storage_proto.rs | 26 +- .../src/config_runtime.rs | 4 +- docs/how-it-works/providers/google.mdx | 59 +- docs/how-it-works/providers/profiles.mdx | 60 +- docs/upgrade/0-1-0.mdx | 25 +- e2e/rust/tests/provider_refresh_handles.rs | 45 +- e2e/support/gateway-common.sh | 18 +- proto/openshell.proto | 22 +- providers/README.md | 11 +- providers/google-cloud.yaml | 20 +- providers/google-vertex-ai.yaml | 24 +- .../v1/internal/converter/coverage_test.go | 30 +- .../v1/internal/converter/profile.go | 58 +- .../v1/internal/converter/profile_test.go | 29 + sdk/go/openshell/v1/profile.go | 3 + sdk/go/openshell/v1/types/profile.go | 31 +- sdk/go/proto/openshellv1/openshell.pb.go | 2229 +++++++++-------- skills/debug-openshell-cluster/SKILL.md | 2 +- skills/openshell-cli/SKILL.md | 2 +- tasks/scripts/test-e2e-provider-profiles.sh | 37 + tasks/test.toml | 7 + 37 files changed, 2869 insertions(+), 2160 deletions(-) create mode 100644 crates/openshell-providers/src/environment_tests.rs delete mode 100644 crates/openshell-providers/src/providers/google_cloud.rs delete mode 100644 crates/openshell-providers/src/providers/mod.rs delete mode 100644 crates/openshell-providers/src/providers/vertex.rs create mode 100644 tasks/scripts/test-e2e-provider-profiles.sh diff --git a/crates/openshell-cli/src/commands/provider.rs b/crates/openshell-cli/src/commands/provider.rs index efc3d1bb12..6cf2fa18ec 100644 --- a/crates/openshell-cli/src/commands/provider.rs +++ b/crates/openshell-cli/src/commands/provider.rs @@ -890,30 +890,7 @@ async fn discover_existing_provider_data( Ok(discovered) } -/// Canonical provider type string for Google Vertex AI. -const VERTEX_AI_PROVIDER_TYPE: &str = "google-vertex-ai"; - -/// Canonical provider type string for Google Cloud (GCP APIs). -const GOOGLE_CLOUD_PROVIDER_TYPE: &str = "google-cloud"; - fn missing_credentials_error(provider_type: &str) -> miette::Report { - if provider_type == VERTEX_AI_PROVIDER_TYPE { - return miette::miette!( - "no credentials resolved for provider type '{provider_type}'. \ - Set GOOGLE_VERTEX_AI_TOKEN, VERTEX_AI_TOKEN, \ - GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN, or VERTEX_AI_SERVICE_ACCOUNT_TOKEN; \ - or use --from-gcloud-adc or --from-existing with those env vars set." - ); - } - - if provider_type == GOOGLE_CLOUD_PROVIDER_TYPE { - return miette::miette!( - "no credentials resolved for provider type '{provider_type}'. \ - Set GCP_ADC_ACCESS_TOKEN or GCP_SA_ACCESS_TOKEN; \ - or use --from-gcloud-adc / --from-existing with those env vars set." - ); - } - miette::miette!( "no credentials resolved for provider type '{provider_type}'. \ Use --credential KEY[=VALUE], --runtime-credentials for runtime-resolved profile credentials, or --from-existing \ diff --git a/crates/openshell-cli/tests/provider_commands_integration.rs b/crates/openshell-cli/tests/provider_commands_integration.rs index 89247ba718..75a6f50dea 100644 --- a/crates/openshell-cli/tests/provider_commands_integration.rs +++ b/crates/openshell-cli/tests/provider_commands_integration.rs @@ -4639,6 +4639,7 @@ async fn provider_create_from_existing_uses_profile_discovery() { }], discovery: Some(ProviderProfileDiscovery { credentials: vec!["api_key".to_string()], + config_env_vars: Vec::new(), }), ..Default::default() }, @@ -4826,6 +4827,7 @@ async fn provider_create_from_existing_fails_when_profile_discovery_finds_nothin }], discovery: Some(ProviderProfileDiscovery { credentials: vec!["api_key".to_string()], + config_env_vars: Vec::new(), }), ..Default::default() }, @@ -4875,6 +4877,7 @@ async fn provider_update_from_existing_uses_profile_discovery() { }], discovery: Some(ProviderProfileDiscovery { credentials: vec!["api_key".to_string()], + config_env_vars: Vec::new(), }), ..Default::default() }, @@ -4949,6 +4952,7 @@ async fn provider_update_from_existing_preserves_global_profile_scope() { }], discovery: Some(ProviderProfileDiscovery { credentials: vec!["api_key".to_string()], + config_env_vars: Vec::new(), }), ..Default::default() }, @@ -6010,7 +6014,7 @@ async fn provider_create_from_gcloud_adc_rolls_back_provider_when_initial_rotate } #[tokio::test] -async fn provider_create_from_existing_vertex_config_only_reports_missing_vertex_credentials() { +async fn provider_create_from_existing_vertex_config_only_reports_missing_credentials() { let ts = run_server().await; Environment::from_pairs(&[ @@ -6034,8 +6038,7 @@ async fn provider_create_from_existing_vertex_config_only_reports_missing_vertex let msg = err.to_string(); assert!( - msg.contains("GOOGLE_VERTEX_AI_TOKEN") - && msg.contains("VERTEX_AI_SERVICE_ACCOUNT_TOKEN"), + msg.contains("no credentials resolved") && msg.contains("--credential KEY[=VALUE]"), "unexpected error: {msg}" ); assert!( diff --git a/crates/openshell-core/build.rs b/crates/openshell-core/build.rs index 2779e78fb9..9481ef89ad 100644 --- a/crates/openshell-core/build.rs +++ b/crates/openshell-core/build.rs @@ -80,6 +80,9 @@ fn main() -> Result<(), Box> { .build_server(true) .build_client(true) .include_file("openshell.rs") + // Profile snapshots hash their protobuf encoding. Keep environment + // maps ordered across storage round trips so revisions remain stable. + .btree_map(".openshell.v1.ProviderProfileEnvironment") // Emit a binary FileDescriptorSet so the server can enumerate every // RPC at runtime (used by the per-handler auth exhaustiveness test). .file_descriptor_set_path(&descriptor_path) diff --git a/crates/openshell-core/src/provider_credentials.rs b/crates/openshell-core/src/provider_credentials.rs index ab9bd26195..b2cf162f03 100644 --- a/crates/openshell-core/src/provider_credentials.rs +++ b/crates/openshell-core/src/provider_credentials.rs @@ -521,21 +521,10 @@ impl ProviderCredentialState { inner.current = Arc::new(env); } - /// Return `child_env` with explicitly non-secret config vars resolved. - /// - /// The credential pipeline placeholderizes all env values. Workloads need - /// non-secret configuration, including provider file paths, at process - /// startup before any HTTP request flows through the proxy. Credential - /// values remain placeholders. - /// - /// Three layers of env var injection: - /// 1. **Synthetic vars** (`GCE_METADATA_IP`, `METADATA_SERVER_DETECTION`) - /// — sandbox-internal config not from user - /// input, inserted directly here with real values. - /// 2. **Classified non-secret keys** — user-provided config and provider - /// file paths un-placeholderized so workloads can read them at startup. - /// 3. Everything else stays as placeholders for proxy-time resolution. - pub fn child_env_with_gcp_resolved(&self) -> HashMap { + /// Resolve only environment keys explicitly classified as non-secret by + /// the gateway, including provider file paths needed at process startup. + /// Credentials remain placeholders for proxy-time resolution. + pub fn child_env_with_non_secret_resolved(&self) -> HashMap { let inner = self .inner .read() @@ -550,7 +539,7 @@ impl ProviderCredentialState { /// revision must describe the exact environment sent across the boundary, /// so callers must not obtain the two values through separate lock /// acquisitions. - pub fn child_env_snapshot_with_gcp_resolved( + pub fn child_env_snapshot_with_non_secret_resolved( &self, ) -> std::io::Result<(u64, HashMap)> { let inner = self @@ -586,47 +575,12 @@ impl ProviderCredentialState { fn resolve_child_env_snapshot( inner: &ProviderCredentialStateInner, ) -> (u64, HashMap) { - use crate::google_cloud; - let mut env = inner.current.child_env.clone(); - - let has_gcp_metadata = env.contains_key("GCE_METADATA_HOST") - && inner - .non_secret_environment_keys - .contains("GCE_METADATA_HOST"); - if !has_gcp_metadata && inner.non_secret_environment_keys.is_empty() { - return (inner.current.revision, env); - } - - if has_gcp_metadata { - // Synthetic vars: sandbox-internal config that doesn't originate - // from user input and was never placeholderized. - env.insert( - "GCE_METADATA_HOST".to_string(), - google_cloud::METADATA_LOOPBACK_ADDR.to_string(), - ); - // Python's google-auth builds its ping URL as http://{GCE_METADATA_IP} - // so the value must include the port. - env.insert( - "GCE_METADATA_IP".to_string(), - google_cloud::METADATA_LOOPBACK_ADDR.to_string(), - ); - // Node.js gcp-metadata uses METADATA_SERVER_DETECTION to skip the - // runtime ping that otherwise fails in sandboxed environments. - env.insert( - "METADATA_SERVER_DETECTION".to_string(), - "assume-present".to_string(), - ); - } - - // Only explicitly classified non-secret values may be unwrapped. - if let Some(ref resolver) = inner.combined_resolver { + if let Some(resolver) = &inner.current_resolver { for key in &inner.non_secret_environment_keys { - if !env.contains_key(key) || (has_gcp_metadata && key == "GCE_METADATA_HOST") { - continue; - } - let placeholder = crate::secrets::placeholder_for_env_key(key); - if let Some(value) = resolver.resolve_placeholder(&placeholder) { + if let Some(placeholder) = env.get(key) + && let Some(value) = resolver.resolve_placeholder(placeholder) + { env.insert(key.clone(), value.to_string()); } } @@ -1301,7 +1255,6 @@ fn merge_resolvers( #[cfg(test)] mod tests { use super::*; - use crate::google_cloud; fn jwt_alias(placeholder: &str) -> String { // Claims are irrelevant to injection authority: retain the exact issued @@ -3296,14 +3249,14 @@ mod tests { } #[test] - fn child_env_with_gcp_resolved_without_gcp_returns_unchanged() { + fn child_env_with_non_secret_resolved_without_classified_keys_returns_unchanged() { let state = ProviderCredentialState::from_environment( 1, HashMap::from([("GITHUB_TOKEN".to_string(), "ghp_abc".to_string())]), HashMap::new(), HashMap::new(), ); - let env = state.child_env_with_gcp_resolved(); + let env = state.child_env_with_non_secret_resolved(); assert_eq!( env.get("GITHUB_TOKEN").map(String::as_str), Some("openshell:resolve:env:v1_GITHUB_TOKEN"), @@ -3332,7 +3285,7 @@ mod tests { ) .expect("classified provider environment"); - let env = state.child_env_with_gcp_resolved(); + let env = state.child_env_with_non_secret_resolved(); assert_eq!(env.get("ACME_CONFIG_FILE").map(String::as_str), Some(path)); assert_eq!( env.get("ACME_TOKEN").map(String::as_str), @@ -3341,17 +3294,17 @@ mod tests { } #[test] - fn child_env_with_gcp_resolved_overrides_gcp_static_vars() { + fn child_env_with_non_secret_resolved_resolves_declared_custom_config() { let state = ProviderCredentialState::from_bound_environment( 1, HashMap::from([ - ("GCE_METADATA_HOST".to_string(), "marker".to_string()), + ("CUSTOM_ENDPOINT".to_string(), "marker".to_string()), ( "GCP_ADC_ACCESS_TOKEN".to_string(), "ya29.secret".to_string(), ), - ("GCP_PROJECT_ID".to_string(), "my-project".to_string()), - ("CLOUD_ML_REGION".to_string(), "us-central1".to_string()), + ("CUSTOM_PROJECT".to_string(), "my-project".to_string()), + ("CUSTOM_REGION".to_string(), "us-central1".to_string()), ]), HashMap::new(), HashMap::new(), @@ -3360,30 +3313,30 @@ mod tests { binding("oauth2.googleapis.com", 443, "/**"), )]), vec![ - "GCE_METADATA_HOST".to_string(), - "GCP_PROJECT_ID".to_string(), - "CLOUD_ML_REGION".to_string(), + "CUSTOM_ENDPOINT".to_string(), + "CUSTOM_PROJECT".to_string(), + "CUSTOM_REGION".to_string(), ], ) - .expect("classified GCP environment"); - let env = state.child_env_with_gcp_resolved(); + .expect("classified provider environment"); + let env = state.child_env_with_non_secret_resolved(); assert_eq!( - env.get("GCE_METADATA_HOST").map(String::as_str), - Some(google_cloud::METADATA_LOOPBACK_ADDR), - "GCE_METADATA_HOST should be the loopback address" + env.get("CUSTOM_ENDPOINT").map(String::as_str), + Some("marker"), + "non-secret values must be preserved without GCP-specific rewriting" ); assert!( !env.contains_key("CLAUDE_CODE_USE_VERTEX"), "inference-specific vars should not be injected" ); assert_eq!( - env.get("GCP_PROJECT_ID").map(String::as_str), + env.get("CUSTOM_PROJECT").map(String::as_str), Some("my-project"), "static config should be resolved to real value" ); assert_eq!( - env.get("CLOUD_ML_REGION").map(String::as_str), + env.get("CUSTOM_REGION").map(String::as_str), Some("us-central1"), ); @@ -3395,7 +3348,7 @@ mod tests { } #[test] - fn child_env_with_gcp_resolved_handles_missing_config_keys() { + fn child_env_with_non_secret_resolved_handles_missing_config_keys() { let state = ProviderCredentialState::from_bound_environment( 1, HashMap::from([ @@ -3411,11 +3364,11 @@ mod tests { vec!["GCE_METADATA_HOST".to_string()], ) .expect("classified GCP environment"); - let env = state.child_env_with_gcp_resolved(); + let env = state.child_env_with_non_secret_resolved(); assert_eq!( env.get("GCE_METADATA_HOST").map(String::as_str), - Some(google_cloud::METADATA_LOOPBACK_ADDR), + Some("marker"), ); assert!( !env.contains_key("GCP_PROJECT_ID") @@ -3428,109 +3381,7 @@ mod tests { } #[test] - fn gcp_token_response_returns_sa_over_adc() { - let state = ProviderCredentialState::from_environment( - 1, - HashMap::from([ - ("GCP_SA_ACCESS_TOKEN".to_string(), "sa-tok".to_string()), - ("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string()), - ]), - HashMap::new(), - HashMap::new(), - ); - let (placeholder, _) = state.gcp_token_response().expect("should find token"); - assert_eq!( - placeholder, "openshell:resolve:env:v1_GCP_SA_ACCESS_TOKEN", - "metadata must return the current revision-scoped SA placeholder" - ); - } - - #[test] - fn gcp_token_response_falls_back_to_adc() { - let state = ProviderCredentialState::from_environment( - 1, - HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), - HashMap::new(), - HashMap::new(), - ); - let (placeholder, _) = state.gcp_token_response().expect("should find ADC token"); - assert_eq!( - placeholder, "openshell:resolve:env:v1_GCP_ADC_ACCESS_TOKEN", - "metadata must return the current revision-scoped ADC placeholder" - ); - } - - #[test] - fn gcp_token_response_returns_none_without_gcp() { - let state = ProviderCredentialState::from_environment( - 1, - HashMap::from([("GITHUB_TOKEN".to_string(), "ghp_abc".to_string())]), - HashMap::new(), - HashMap::new(), - ); - assert!(state.gcp_token_response().is_none()); - } - - #[test] - fn gcp_token_response_defaults_expires_in_to_3600() { - let state = ProviderCredentialState::from_environment( - 1, - HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), - HashMap::new(), - HashMap::new(), - ); - let (_, expires_in) = state.gcp_token_response().unwrap(); - assert_eq!( - expires_in, 3600, - "should default to 3600 when no expiry set" - ); - } - - #[test] - fn gcp_token_response_calculates_remaining() { - let now_ms = i64::try_from( - std::time::SystemTime::now() - .duration_since(std::time::UNIX_EPOCH) - .unwrap() - .as_millis(), - ) - .unwrap(); - let state = ProviderCredentialState::from_environment( - 1, - HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), - HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), now_ms + 120_000)]), - HashMap::new(), - ); - let (_, expires_in) = state.gcp_token_response().unwrap(); - assert!( - (110..=120).contains(&expires_in), - "expected ~120s remaining, got {expires_in}" - ); - } - - #[test] - fn gcp_token_response_handles_already_expired_token_without_panic() { - let now_ms = i64::try_from( - std::time::SystemTime::now() - .duration_since(std::time::UNIX_EPOCH) - .unwrap() - .as_millis(), - ) - .unwrap(); - let state = ProviderCredentialState::from_environment( - 1, - HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), - HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), now_ms - 1_000)]), - HashMap::new(), - ); - assert!( - state.gcp_token_response().is_none(), - "expired token should be skipped rather than panic" - ); - } - - #[test] - fn child_env_with_gcp_resolved_resolves_vertex_vars_without_metadata_host() { + fn child_env_with_non_secret_resolved_resolves_vertex_vars_without_metadata_host() { let state = ProviderCredentialState::from_bound_environment( 1, HashMap::from([ @@ -3551,7 +3402,7 @@ mod tests { ], ) .expect("classified Vertex environment"); - let env = state.child_env_with_gcp_resolved(); + let env = state.child_env_with_non_secret_resolved(); assert_eq!( env.get("GOOSE_PROVIDER").map(String::as_str), Some("gcp_vertex_ai"), @@ -3572,7 +3423,7 @@ mod tests { } #[test] - fn child_env_with_gcp_resolved_only_unwraps_explicitly_non_secret_config() { + fn child_env_with_non_secret_resolved_only_unwraps_explicitly_non_secret_config() { let state = ProviderCredentialState::from_bound_environment( 1, HashMap::from([ @@ -3618,7 +3469,7 @@ mod tests { ) .expect("refreshed GCP environment"); - let env = state.child_env_with_gcp_resolved(); + let env = state.child_env_with_non_secret_resolved(); assert_eq!( env.get("GCP_PROJECT_ID").map(String::as_str), Some("visible-project-config"), @@ -3826,7 +3677,7 @@ mod tests { "opaque revisions may move numerically backwards" ); - let (revision, env) = state.child_env_snapshot_with_gcp_resolved().unwrap(); + let (revision, env) = state.child_env_snapshot_with_non_secret_resolved().unwrap(); assert_eq!(revision, 2); assert!(env.is_empty(), "an empty snapshot must revoke the old env"); } @@ -3868,7 +3719,7 @@ mod tests { .compare_and_install_child_env_snapshot(4, 5, HashMap::new()) .is_err() ); - assert!(state.child_env_snapshot_with_gcp_resolved().is_err()); + assert!(state.child_env_snapshot_with_non_secret_resolved().is_err()); } #[test] diff --git a/crates/openshell-providers/README.md b/crates/openshell-providers/README.md index 2a9b686019..c7eef1af15 100644 --- a/crates/openshell-providers/README.md +++ b/crates/openshell-providers/README.md @@ -1,18 +1,20 @@ # openshell-providers -Provider discovery and normalization for credentials that sandboxes need at -runtime. +Imported provider profile parsing, validation, discovery, and environment +defaults. The gateway persists provider records. The sandbox supervisor fetches resolved provider environment from the gateway and injects credentials into agent child -processes. This crate keeps provider-specific discovery and normalization logic -out of the CLI and gateway control flow. +processes. Profile declarations determine the behavior; profile IDs do not +select compiled provider plugins. ## Responsibilities -- Discover local credentials from environment variables and known config files. -- Normalize discovered data into provider records. -- Keep provider-specific parsing rules in provider modules. +- Parse and round-trip the YAML, JSON, and protobuf profile schema. +- Discover credentials and non-secret config from declared environment keys. +- Apply bounded, literal non-secret environment defaults without overwriting + existing values. +- Validate credential collisions and named platform adapter requirements. - Use the shared authored-YAML compatibility boundary for profile imports and exports: reject duplicate keys and null objects without coercion, retain optional nulls, and preserve string types for YAML 1.1 readers. @@ -25,7 +27,28 @@ out of the CLI and gateway control flow. - Injecting credentials into sandbox child processes. - Routing inference requests. -Those are owned by the gateway, sandbox supervisor, and router. +Those are owned by the gateway and sandbox supervisor. + +## Provider Behavior Inventory + +| Behavior | Declaration or disposition | +|---|---| +| GCP and Vertex project, region, and SDK aliases | `environment.config` | +| Metadata SDK variables and Goose provider default | `environment.fixed` | +| Credential discovery | `discovery.credentials` and credential `env_vars` | +| Vertex config discovery | `discovery.config_env_vars` | +| Workload resolution of non-secret values | Gateway key classification, independent of provider names | +| Platform service dependency | `required_platform_adapter`; GCP metadata is available for non-Windows sandbox runtimes | +| Vertex service account JSON credential | Removed from the example; configure gateway refresh material directly | +| ID-selected provider plugins | Removed | +| ID-selected CLI credential hints | Removed; setup guidance applies to the imported profile | +| `ProviderDiscoverySpec` and `discover_with_spec` | Removed; no supported caller | +| GCP token response helper | Retained in `openshell-core` for the supervisor metadata service | +| GCP project and region config-key catalog | Removed; profile data supplies these declarations | + +Credential refresh strategies remain explicitly declared in credential metadata. +The supervisor provides the `gcp-metadata` adapter for Linux sandboxes; the +Windows/MXC runtime does not provide it. ## Security Notes diff --git a/crates/openshell-providers/src/discovery.rs b/crates/openshell-providers/src/discovery.rs index 7a4fcdfd69..706267f340 100644 --- a/crates/openshell-providers/src/discovery.rs +++ b/crates/openshell-providers/src/discovery.rs @@ -1,35 +1,9 @@ // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. // SPDX-License-Identifier: Apache-2.0 -use crate::{ - DiscoveredProvider, DiscoveryContext, ProviderDiscoverySpec, ProviderError, ProviderTypeProfile, -}; +use crate::{DiscoveredProvider, DiscoveryContext, ProviderError, ProviderTypeProfile}; use std::collections::HashSet; -pub fn discover_with_spec( - spec: &ProviderDiscoverySpec, - context: &dyn DiscoveryContext, -) -> Result, ProviderError> { - let mut discovered = DiscoveredProvider::default(); - - for key in spec.credential_env_vars { - if let Some(value) = context.env_var(key) - && !value.trim().is_empty() - { - discovered - .credentials - .entry((*key).to_string()) - .or_insert(value); - } - } - - if discovered.is_empty() { - Ok(None) - } else { - Ok(Some(discovered)) - } -} - pub fn discover_from_profile( profile: &ProviderTypeProfile, context: &dyn DiscoveryContext, @@ -66,13 +40,11 @@ pub fn discover_from_profile( } } - if profile.id == "google-vertex-ai" { - for key in crate::VERTEX_AI_CONFIG_KEY_NAMES { - if let Some(value) = context.env_var(key) - && !value.trim().is_empty() - { - discovered.config.entry((*key).to_string()).or_insert(value); - } + for key in &profile.discovery.config_env_vars { + if let Some(value) = context.env_var(key) + && !value.trim().is_empty() + { + discovered.config.entry(key.clone()).or_insert(value); } } @@ -88,7 +60,7 @@ mod tests { use super::discover_from_profile; use crate::profiles::{CredentialProfile, DiscoveryProfile}; use crate::test_helpers::MockDiscoveryContext; - use crate::{ProviderError, ProviderTypeProfile}; + use crate::{EnvironmentProfile, ProviderError, ProviderTypeProfile}; fn profile() -> ProviderTypeProfile { ProviderTypeProfile { @@ -132,7 +104,10 @@ mod tests { inference_capable: false, discovery: DiscoveryProfile { credentials: vec!["api_key".to_string(), "secondary".to_string()], + config_env_vars: Vec::new(), }, + environment: EnvironmentProfile::default(), + required_platform_adapter: String::new(), source: String::new(), scope: String::new(), } @@ -180,9 +155,10 @@ mod tests { } #[test] - fn vertex_profile_discovery_includes_supported_configuration() { + fn profile_discovery_includes_declared_configuration() { let mut profile = profile(); - profile.id = "google-vertex-ai".to_string(); + profile.discovery.config_env_vars = + vec!["VERTEX_AI_PROJECT_ID".into(), "VERTEX_AI_REGION".into()]; let ctx = MockDiscoveryContext::new() .with_env("CUSTOM_API_KEY", "vertex-token") .with_env("VERTEX_AI_PROJECT_ID", "project-a") diff --git a/crates/openshell-providers/src/environment_tests.rs b/crates/openshell-providers/src/environment_tests.rs new file mode 100644 index 0000000000..529d404328 --- /dev/null +++ b/crates/openshell-providers/src/environment_tests.rs @@ -0,0 +1,282 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use std::collections::HashMap; + +use crate::test_helpers::MockDiscoveryContext; +use crate::{ + EnvironmentProfile, ProviderTypeProfile, discover_from_profile, parse_profile_yaml, + profile_to_yaml, validate_profile_set, +}; + +fn profile() -> ProviderTypeProfile { + parse_profile_yaml( + r" +id: custom +display_name: Custom +credentials: + - name: token + env_vars: [CUSTOM_TOKEN] +environment: + config: + CUSTOM_PROJECT: project + fixed: + CUSTOM_MODE: native +discovery: + credentials: [token] + config_env_vars: [CUSTOM_PROJECT] +required_platform_adapter: gcp-metadata +", + ) + .unwrap() +} + +#[test] +fn environment_and_discovery_declarations_round_trip() { + let profile = profile(); + let proto = profile.to_proto(); + let restored = ProviderTypeProfile::from_proto(&proto); + assert_eq!(restored.to_proto(), proto); + let yaml = profile_to_yaml(&restored).unwrap(); + assert_eq!(parse_profile_yaml(&yaml).unwrap().to_proto(), proto); + assert!(validate_profile_set(&[("custom.yaml".into(), profile)]).is_empty()); +} + +#[test] +fn projection_preserves_existing_values_and_skips_blank_config() { + let profile = profile(); + let config = HashMap::from([("project".into(), " project-a ".into())]); + let mut env = HashMap::new(); + profile.environment.inject(&config, &mut env); + assert_eq!( + env, + HashMap::from([ + ("CUSTOM_PROJECT".into(), "project-a".into()), + ("CUSTOM_MODE".into(), "native".into()) + ]) + ); + + let mut existing = HashMap::from([ + ("CUSTOM_PROJECT".into(), String::new()), + ("CUSTOM_MODE".into(), "caller".into()), + ]); + let before = existing.clone(); + profile.environment.inject(&config, &mut existing); + assert_eq!(existing, before); + + for config in [ + HashMap::new(), + HashMap::from([("project".into(), " \t ".into())]), + ] { + let mut env = HashMap::new(); + profile.environment.inject(&config, &mut env); + assert!(!env.contains_key("CUSTOM_PROJECT")); + assert_eq!(env["CUSTOM_MODE"], "native"); + } +} + +#[test] +fn projection_skips_legacy_private_key_defaults_in_stored_profiles() { + let mut profile = profile(); + profile.environment.config.insert( + crate::LEGACY_VERTEX_PRIVATE_KEY_ENV.into(), + "private_key".into(), + ); + let config = HashMap::from([("private_key".into(), "secret".into())]); + let mut env = HashMap::new(); + profile.environment.inject(&config, &mut env); + assert!(!env.contains_key(crate::LEGACY_VERTEX_PRIVATE_KEY_ENV)); + + profile.environment.config.clear(); + profile + .environment + .fixed + .insert(crate::LEGACY_VERTEX_PRIVATE_KEY_ENV.into(), "secret".into()); + profile.environment.inject(&config, &mut env); + assert!(!env.contains_key(crate::LEGACY_VERTEX_PRIVATE_KEY_ENV)); +} + +#[test] +fn renamed_google_examples_keep_environment_and_discovery_behavior() { + let config = HashMap::from([ + ("project_id".into(), "cloud-project".into()), + ("region".into(), "us-east1".into()), + ("service_account_email".into(), "sa@example.com".into()), + ("VERTEX_AI_PROJECT_ID".into(), "vertex-project".into()), + ("VERTEX_AI_REGION".into(), "us-central1".into()), + ]); + let context = MockDiscoveryContext::new() + .with_env("GOOGLE_VERTEX_AI_TOKEN", "test-token") + .with_env("GCP_ADC_ACCESS_TOKEN", "test-adc-token") + .with_env("VERTEX_AI_PROJECT_ID", "vertex-project") + .with_env("VERTEX_AI_REGION", "us-central1"); + for id in ["google-cloud", "google-vertex-ai"] { + let canonical = crate::example_profiles::load(id); + let mut renamed = canonical.clone(); + renamed.id = "acme-fork".into(); + let mut canonical_env = HashMap::new(); + let mut renamed_env = HashMap::new(); + canonical.environment.inject(&config, &mut canonical_env); + renamed.environment.inject(&config, &mut renamed_env); + assert!(!canonical_env.is_empty()); + assert_eq!(canonical_env, renamed_env); + assert_eq!( + canonical + .ensure_platform_adapter_available() + .map_err(|error| error.to_string()), + renamed + .ensure_platform_adapter_available() + .map_err(|error| error.to_string()), + ); + assert_eq!( + discover_from_profile(&canonical, &context).unwrap(), + discover_from_profile(&renamed, &context).unwrap() + ); + } +} + +#[test] +fn canonical_id_without_declarations_has_no_special_behavior() { + let mut profile = profile(); + profile.id = "google-vertex-ai".into(); + profile.environment = EnvironmentProfile::default(); + profile.discovery.config_env_vars.clear(); + let mut env = HashMap::new(); + profile.environment.inject( + &HashMap::from([("VERTEX_AI_PROJECT_ID".into(), "project".into())]), + &mut env, + ); + assert!(env.is_empty()); + assert!( + discover_from_profile( + &profile, + &MockDiscoveryContext::new().with_env("VERTEX_AI_PROJECT_ID", "project") + ) + .unwrap() + .is_none() + ); +} + +#[test] +fn lint_rejects_non_secret_credential_collisions_and_duplicate_targets() { + let mut profile = profile(); + profile + .environment + .fixed + .insert("CUSTOM_TOKEN".into(), "value".into()); + profile + .environment + .fixed + .insert("CUSTOM_PROJECT".into(), "other".into()); + profile + .discovery + .config_env_vars + .push("CUSTOM_TOKEN".into()); + let diagnostics = validate_profile_set(&[("custom.yaml".into(), profile)]); + assert!( + diagnostics + .iter() + .any(|d| d.field == "environment" && d.message.contains("credential env_vars")) + ); + assert!( + diagnostics + .iter() + .any(|d| d.message.contains("both config and fixed")) + ); + assert!(diagnostics.iter().any( + |d| d.field == "discovery.config_env_vars" && d.message.contains("credential env_vars") + )); +} + +#[test] +fn lint_bounds_environment_and_discovery_declarations() { + let mut profile = profile(); + profile + .environment + .fixed + .insert("INVALID=NAME".into(), "value".into()); + profile + .environment + .fixed + .insert("LONG_VALUE".into(), "x".repeat(4097)); + profile + .discovery + .config_env_vars + .push("CUSTOM_PROJECT".into()); + profile.discovery.config_env_vars.push(" padded ".into()); + let diagnostics = validate_profile_set(&[("custom.yaml".into(), profile)]); + assert!(diagnostics.iter().any(|d| d.field == "environment")); + assert!(diagnostics.iter().any(|d| d.field == "environment.fixed")); + assert!( + diagnostics + .iter() + .any(|d| d.message == "duplicate discovery config key") + ); + assert!( + diagnostics + .iter() + .any(|d| d.message.contains("discovery config keys must")) + ); +} + +#[test] +fn lint_enforces_declaration_count_limits() { + let mut profile = profile(); + profile.environment.config.clear(); + profile.environment.fixed = (0..64) + .map(|index| (format!("CONFIG_{index}"), String::new())) + .collect(); + profile.discovery.config_env_vars = profile.environment.fixed.keys().cloned().collect(); + assert!(validate_profile_set(&[("custom.yaml".into(), profile.clone())]).is_empty()); + + profile + .environment + .config + .insert("EXTRA".into(), "extra".into()); + profile.discovery.config_env_vars.push("EXTRA".into()); + let diagnostics = validate_profile_set(&[("custom.yaml".into(), profile)]); + assert!( + diagnostics + .iter() + .any(|diagnostic| diagnostic.message == "at most 64 environment defaults are allowed") + ); + assert!( + diagnostics + .iter() + .any(|diagnostic| diagnostic.message == "at most 64 discovery config keys are allowed") + ); +} + +#[test] +fn platform_adapter_availability_and_unknown_adapter_errors() { + let mut profile = profile(); + let availability = profile.ensure_platform_adapter_available(); + if cfg!(windows) { + assert!( + availability + .unwrap_err() + .to_string() + .contains("unavailable") + ); + } else { + assert!(availability.is_ok()); + } + profile.required_platform_adapter = "unknown".repeat(10_000); + let diagnostics = validate_profile_set(&[("custom.yaml".into(), profile.clone())]); + assert!( + diagnostics + .iter() + .any(|d| d.field == "required_platform_adapter") + ); + assert!(diagnostics.iter().all(|d| d.message.len() < 256)); + assert!( + profile + .ensure_platform_adapter_available() + .unwrap_err() + .to_string() + .len() + < 128 + ); + profile.required_platform_adapter.clear(); + assert!(profile.ensure_platform_adapter_available().is_ok()); +} diff --git a/crates/openshell-providers/src/lib.rs b/crates/openshell-providers/src/lib.rs index 87ac5d8007..393ff39345 100644 --- a/crates/openshell-providers/src/lib.rs +++ b/crates/openshell-providers/src/lib.rs @@ -5,10 +5,11 @@ mod context; mod discovery; +#[cfg(test)] +mod environment_tests; #[cfg(any(test, feature = "example-profiles"))] pub mod example_profiles; mod profiles; -mod providers; #[cfg(test)] mod test_helpers; @@ -16,25 +17,19 @@ use std::collections::HashMap; pub use openshell_core::proto::Provider; +/// Legacy Vertex bootstrap material must never become a workload credential. +/// Older stored profiles may still declare this key as an injectable env var. +pub const LEGACY_VERTEX_PRIVATE_KEY_ENV: &str = "GOOGLE_SERVICE_ACCOUNT_KEY"; + pub use context::{DiscoveryContext, RealDiscoveryContext}; -pub use discovery::{discover_from_profile, discover_with_spec}; +pub use discovery::discover_from_profile; pub use profiles::{ - CredentialRefreshProfile, ProfileError, ProfileValidationDiagnostic, ProviderTypeProfile, - is_gateway_mintable_strategy, normalize_profile_id, parse_profile_json, parse_profile_yaml, - profile_to_json, profile_to_yaml, profiles_to_json, profiles_to_yaml, strategy_output_env_key, - strategy_output_spec, strategy_primary_env_key, validate_profile_set, + CredentialRefreshProfile, EnvironmentProfile, ProfileError, ProfileValidationDiagnostic, + ProviderTypeProfile, is_gateway_mintable_strategy, normalize_profile_id, parse_profile_json, + parse_profile_yaml, profile_to_json, profile_to_yaml, profiles_to_json, profiles_to_yaml, + strategy_output_env_key, strategy_output_spec, strategy_primary_env_key, validate_profile_set, }; -pub const VERTEX_AI_PROJECT_ID_KEY: &str = "VERTEX_AI_PROJECT_ID"; -pub const VERTEX_AI_REGION_KEY: &str = "VERTEX_AI_REGION"; -pub const VERTEX_AI_CONFIG_KEY_NAMES: &[&str] = &[ - VERTEX_AI_PROJECT_ID_KEY, - VERTEX_AI_REGION_KEY, - "GOOGLE_VERTEX_AI_BASE_URL", - "VERTEX_AI_BASE_URL", - "VERTEX_AI_PUBLISHER", -]; - #[derive(Debug, thiserror::Error)] pub enum ProviderError { #[error("unsupported provider type: {0}")] @@ -46,6 +41,10 @@ pub enum ProviderError { profile_id: String, credential_name: String, }, + #[error("required platform adapter 'gcp-metadata' is unavailable in this build")] + UnavailableGcpMetadataAdapter, + #[error("unknown required platform adapter")] + UnknownPlatformAdapter, } #[derive(Debug, Clone, Default, PartialEq, Eq)] @@ -60,67 +59,3 @@ impl DiscoveredProvider { self.credentials.is_empty() && self.config.is_empty() } } - -#[derive(Debug, Clone, Copy)] -pub struct ProviderDiscoverySpec { - pub id: &'static str, - pub credential_env_vars: &'static [&'static str], -} - -trait ProviderPlugin: Send + Sync { - /// Canonical provider id. - fn id(&self) -> &'static str; - - /// Inject provider-specific environment variables into the sandbox env. - /// - /// Called during sandbox creation to project provider config (project IDs, - /// regions, SDK flags) into env vars the sandbox process will inherit. - /// Default is a no-op; GCP and Vertex providers override this. - fn inject_env(&self, _provider: &Provider, _env: &mut HashMap) {} -} - -#[derive(Default)] -pub struct ProviderRegistry { - plugins: HashMap<&'static str, Box>, -} - -impl ProviderRegistry { - #[must_use] - pub fn new() -> Self { - let mut registry = Self::default(); - // Keep only the legacy config projectors required to run existing - // Google Cloud and Vertex records. Public provider discovery is - // profile-driven; this registry is an internal compatibility adapter. - registry.register(providers::google_cloud::GoogleCloudProvider); - registry.register(providers::vertex::VertexProvider); - registry - } - - fn register

(&mut self, plugin: P) - where - P: ProviderPlugin + 'static, - { - self.plugins.insert(plugin.id(), Box::new(plugin)); - } - - #[must_use] - fn get(&self, id: &str) -> Option<&dyn ProviderPlugin> { - self.plugins.get(id).map(Box::as_ref) - } - - /// Inject provider-specific config for a resolved profile ID. - /// - /// Plugins are selected by the exact ID of the profile the gateway - /// resolved. There is no alias table: a profile activates the plugin whose - /// ID it matches, and nothing else does. - pub fn inject_env_for_profile_id( - &self, - provider: &Provider, - profile_id: &str, - env: &mut HashMap, - ) { - if let Some(plugin) = self.get(profile_id) { - plugin.inject_env(provider, env); - } - } -} diff --git a/crates/openshell-providers/src/profiles.rs b/crates/openshell-providers/src/profiles.rs index b56dc2c7e4..1b64dc1016 100644 --- a/crates/openshell-providers/src/profiles.rs +++ b/crates/openshell-providers/src/profiles.rs @@ -13,7 +13,8 @@ use openshell_core::proto::{ ProviderCredentialRefreshMaterial, ProviderCredentialRefreshOutput, ProviderCredentialRefreshStrategy, ProviderCredentialTokenGrantSubjectToken, ProviderCredentialTokenGrantType, ProviderProfile, ProviderProfileCategory, - ProviderProfileCredential, ProviderProfileDiscovery, ProviderProfileFile, + ProviderProfileCredential, ProviderProfileDiscovery, ProviderProfileEnvironment, + ProviderProfileFile, }; use openshell_core::secrets::uses_reserved_revision_namespace; use openshell_policy::{ @@ -23,7 +24,7 @@ use openshell_policy::{ validate_l7_endpoint_semantics, }; use serde::{Deserialize, Deserializer, Serialize, Serializer, de}; -use std::collections::{BTreeSet, HashMap, HashSet}; +use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet}; use std::net::IpAddr; const PATH_TEMPLATE_CREDENTIAL_PLACEHOLDER: &str = "{credential}"; @@ -322,6 +323,47 @@ pub struct CredentialRefreshOutputProfile { pub struct DiscoveryProfile { #[serde(default, skip_serializing_if = "Vec::is_empty")] pub credentials: Vec, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub config_env_vars: Vec, +} + +/// Literal, non-secret workload environment defaults. +#[derive(Debug, Clone, Default, Deserialize, Serialize, PartialEq, Eq)] +#[serde(deny_unknown_fields)] +pub struct EnvironmentProfile { + /// Destination environment key -> provider config key. + #[serde(default, skip_serializing_if = "BTreeMap::is_empty")] + pub config: BTreeMap, + /// Destination environment key -> literal value. + #[serde(default, skip_serializing_if = "BTreeMap::is_empty")] + pub fixed: BTreeMap, +} + +impl EnvironmentProfile { + fn is_empty(&self) -> bool { + self.config.is_empty() && self.fixed.is_empty() + } + + /// Fill missing values only. Projection never changes a caller's value, + /// including an explicitly empty value. + pub fn inject(&self, config: &HashMap, env: &mut HashMap) { + for (key, config_key) in &self.config { + if key == crate::LEGACY_VERTEX_PRIVATE_KEY_ENV { + continue; + } + if let Some(value) = config.get(config_key).map(|value| value.trim()) + && !value.is_empty() + { + env.entry(key.clone()).or_insert_with(|| value.to_string()); + } + } + for (key, value) in &self.fixed { + if key == crate::LEGACY_VERTEX_PRIVATE_KEY_ENV { + continue; + } + env.entry(key.clone()).or_insert_with(|| value.clone()); + } + } } // These YAML/JSON DTOs mirror the network policy protos intentionally. Keep @@ -713,6 +755,10 @@ pub struct ProviderTypeProfile { pub inference_capable: bool, #[serde(default, skip_serializing_if = "discovery_is_empty")] pub discovery: DiscoveryProfile, + #[serde(default, skip_serializing_if = "EnvironmentProfile::is_empty")] + pub environment: EnvironmentProfile, + #[serde(default, skip_serializing_if = "String::is_empty")] + pub required_platform_adapter: String, #[serde(default, skip_serializing_if = "String::is_empty")] pub source: String, #[serde(default, skip_serializing_if = "String::is_empty")] @@ -799,6 +845,18 @@ fn valid_file_config_key(key: &str) -> bool { // narrower shape; direct gRPC imports and CLI YAML imports must preserve the // same policy intent through storage and JIT composition. impl ProviderTypeProfile { + /// Check runtime capability separately from schema lint. The supervisor + /// provides GCP metadata for non-Windows sandbox runtimes. + pub fn ensure_platform_adapter_available(&self) -> Result<(), crate::ProviderError> { + match self.required_platform_adapter.as_str() { + "gcp-metadata" if cfg!(windows) => { + Err(crate::ProviderError::UnavailableGcpMetadataAdapter) + } + "" | "gcp-metadata" => Ok(()), + _ => Err(crate::ProviderError::UnknownPlatformAdapter), + } + } + #[must_use] pub fn from_proto(profile: &ProviderProfile) -> Self { Self { @@ -848,6 +906,14 @@ impl ProviderTypeProfile { .unwrap_or_default(), source: profile.source.clone(), scope: profile.scope.clone(), + environment: profile.environment.as_ref().map_or_else( + EnvironmentProfile::default, + |environment| EnvironmentProfile { + config: environment.config.clone(), + fixed: environment.fixed.clone(), + }, + ), + required_platform_adapter: profile.required_platform_adapter.clone(), } } @@ -1022,6 +1088,11 @@ impl ProviderTypeProfile { .then(|| discovery_to_proto(&self.discovery)), source: self.source.clone(), scope: self.scope.clone(), + environment: (!self.environment.is_empty()).then(|| ProviderProfileEnvironment { + config: self.environment.config.clone(), + fixed: self.environment.fixed.clone(), + }), + required_platform_adapter: self.required_platform_adapter.clone(), } } @@ -1213,7 +1284,7 @@ pub fn strategy_output_env_key( } fn discovery_is_empty(discovery: &DiscoveryProfile) -> bool { - discovery.credentials.is_empty() + discovery.credentials.is_empty() && discovery.config_env_vars.is_empty() } impl Serialize for BinaryProfile { @@ -1628,12 +1699,14 @@ fn token_grant_audience_override_to_proto( fn discovery_from_proto(discovery: &ProviderProfileDiscovery) -> DiscoveryProfile { DiscoveryProfile { credentials: discovery.credentials.clone(), + config_env_vars: discovery.config_env_vars.clone(), } } fn discovery_to_proto(discovery: &DiscoveryProfile) -> ProviderProfileDiscovery { ProviderProfileDiscovery { credentials: discovery.credentials.clone(), + config_env_vars: discovery.config_env_vars.clone(), } } @@ -2141,6 +2214,7 @@ pub fn validate_profile_set( let mut diagnostics = Vec::new(); let mut ids = HashSet::new(); for (source, profile) in profiles { + collect_environment_diagnostics(source, profile, &mut diagnostics); let raw_profile_id = profile.id.as_str(); let profile_id = raw_profile_id.trim(); if profile_id.is_empty() { @@ -3155,6 +3229,134 @@ pub fn validate_profile_set( diagnostics } +// Keep this declaration surface bounded and data-only. These limits apply to +// both YAML and protobuf imports through the shared profile validator. +const MAX_ENVIRONMENT_ENTRIES: usize = 64; +const MAX_ENVIRONMENT_KEY_BYTES: usize = 128; +const MAX_FIXED_ENVIRONMENT_VALUE_BYTES: usize = 4096; + +fn valid_environment_key(key: &str) -> bool { + let mut bytes = key.bytes(); + key.len() <= MAX_ENVIRONMENT_KEY_BYTES + && bytes + .next() + .is_some_and(|byte| byte == b'_' || byte.is_ascii_alphabetic()) + && bytes.all(|byte| byte == b'_' || byte.is_ascii_alphanumeric()) + && !uses_reserved_revision_namespace(key) +} + +fn collect_environment_diagnostics( + source: &str, + profile: &ProviderTypeProfile, + diagnostics: &mut Vec, +) { + let mut error = |field: &str, message: &str| { + diagnostics.push(ProfileValidationDiagnostic::error( + source, + &profile.id, + field, + message, + )); + }; + if !matches!( + profile.required_platform_adapter.as_str(), + "" | "gcp-metadata" + ) { + error( + "required_platform_adapter", + "unknown platform adapter; the only recognized adapter is gcp-metadata", + ); + } + let environment = &profile.environment; + if environment.config.len() + environment.fixed.len() > MAX_ENVIRONMENT_ENTRIES { + error("environment", "at most 64 environment defaults are allowed"); + } + let credential_keys = profile.credential_env_vars(); + for key in environment + .config + .keys() + .chain(environment.fixed.keys()) + .take(MAX_ENVIRONMENT_ENTRIES) + { + if key == crate::LEGACY_VERTEX_PRIVATE_KEY_ENV { + error( + "environment", + "GOOGLE_SERVICE_ACCOUNT_KEY contains private key material and cannot be a non-secret environment default", + ); + } + if !valid_environment_key(key) { + error( + "environment", + "environment keys must be valid non-reserved variable names of at most 128 bytes", + ); + } + if credential_keys.contains(&key.as_str()) { + error( + "environment", + "non-secret environment defaults must not collide with credential env_vars", + ); + } + } + for (key, config_key) in environment.config.iter().take(MAX_ENVIRONMENT_ENTRIES) { + if config_key.is_empty() + || config_key.trim() != config_key + || config_key.len() > MAX_ENVIRONMENT_KEY_BYTES + || config_key.contains('\0') + { + error( + "environment.config", + "config keys must be nonempty, unpadded strings of at most 128 bytes without NUL", + ); + } + if environment.fixed.contains_key(key) { + error( + "environment", + "an environment key cannot have both config and fixed defaults", + ); + } + } + for value in environment.fixed.values().take(MAX_ENVIRONMENT_ENTRIES) { + if value.len() > MAX_FIXED_ENVIRONMENT_VALUE_BYTES || value.contains('\0') { + error( + "environment.fixed", + "fixed values must contain at most 4096 bytes and no NUL", + ); + } + } + if profile.discovery.config_env_vars.len() > MAX_ENVIRONMENT_ENTRIES { + error( + "discovery.config_env_vars", + "at most 64 discovery config keys are allowed", + ); + } + let mut discovered = HashSet::new(); + for key in profile + .discovery + .config_env_vars + .iter() + .take(MAX_ENVIRONMENT_ENTRIES) + { + if !valid_environment_key(key) { + error( + "discovery.config_env_vars", + "discovery config keys must be valid non-reserved variable names of at most 128 bytes", + ); + } + if !discovered.insert(key) { + error( + "discovery.config_env_vars", + "duplicate discovery config key", + ); + } + if credential_keys.contains(&key.as_str()) { + error( + "discovery.config_env_vars", + "non-secret discovery config must not collide with credential env_vars", + ); + } + } +} + fn collect_mcp_profile_diagnostics( source: &str, profile_id: &str, @@ -3741,12 +3943,12 @@ mod tests { use openshell_core::proto::{ProviderCredentialTokenGrantType, ProviderProfileCategory}; use super::{ - DiscoveryProfile, EndpointProfile, L7AllowProfile, L7QueryMatcherProfile, - ProfileDurationWkt, ProfileError, ProviderTypeProfile, is_mcp_diagnostic_field, - normalize_profile_id, parse_profile_catalog_yamls, parse_profile_json, parse_profile_yaml, - profile_duration_to_proto, profile_to_json, profile_to_yaml, profiles_to_json, - profiles_to_yaml, token_grant_from_proto, token_grant_to_proto, validate_profile_duration, - validate_profile_set, + DiscoveryProfile, EndpointProfile, EnvironmentProfile, L7AllowProfile, + L7QueryMatcherProfile, ProfileDurationWkt, ProfileError, ProviderTypeProfile, + is_mcp_diagnostic_field, normalize_profile_id, parse_profile_catalog_yamls, + parse_profile_json, parse_profile_yaml, profile_duration_to_proto, profile_to_json, + profile_to_yaml, profiles_to_json, profiles_to_yaml, token_grant_from_proto, + token_grant_to_proto, validate_profile_duration, validate_profile_set, }; /// The example profiles in `providers/`, parsed once per test binary. @@ -6385,6 +6587,8 @@ binaries: binaries: Vec::new(), inference_capable: false, discovery: DiscoveryProfile::default(), + environment: EnvironmentProfile::default(), + required_platform_adapter: String::new(), source: String::new(), scope: String::new(), }, @@ -6404,6 +6608,8 @@ binaries: binaries: Vec::new(), inference_capable: false, discovery: DiscoveryProfile::default(), + environment: EnvironmentProfile::default(), + required_platform_adapter: String::new(), source: String::new(), scope: String::new(), }, @@ -6423,6 +6629,8 @@ binaries: binaries: Vec::new(), inference_capable: false, discovery: DiscoveryProfile::default(), + environment: EnvironmentProfile::default(), + required_platform_adapter: String::new(), source: String::new(), scope: String::new(), }, diff --git a/crates/openshell-providers/src/providers/google_cloud.rs b/crates/openshell-providers/src/providers/google_cloud.rs deleted file mode 100644 index 3bea53d825..0000000000 --- a/crates/openshell-providers/src/providers/google_cloud.rs +++ /dev/null @@ -1,161 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -use std::collections::HashMap; - -use openshell_core::google_cloud; - -use crate::{Provider, ProviderPlugin}; - -pub struct GoogleCloudProvider; - -impl ProviderPlugin for GoogleCloudProvider { - fn id(&self) -> &'static str { - "google-cloud" - } - - fn inject_env(&self, provider: &Provider, env: &mut HashMap) { - if let Some(project) = provider - .config - .get(google_cloud::GCP_PROJECT_ID_CONFIG_KEY) - .filter(|v| !v.trim().is_empty()) - { - for var in google_cloud::PROJECT_ID_ENV_VARS { - env.entry((*var).to_string()) - .or_insert_with(|| project.trim().to_string()); - } - } - - if let Some(region) = provider - .config - .get(google_cloud::GCP_REGION_CONFIG_KEY) - .filter(|v| !v.trim().is_empty()) - { - for var in google_cloud::REGION_ENV_VARS { - env.entry((*var).to_string()) - .or_insert_with(|| region.trim().to_string()); - } - } - - env.entry("GCE_METADATA_HOST".to_string()) - .or_insert_with(|| google_cloud::METADATA_HOST.to_string()); - - if let Some(email) = provider - .config - .get(google_cloud::GCP_SERVICE_ACCOUNT_EMAIL_CONFIG_KEY) - .filter(|v| !v.trim().is_empty()) - { - for var in google_cloud::SERVICE_ACCOUNT_EMAIL_ENV_VARS { - env.entry((*var).to_string()) - .or_insert_with(|| email.trim().to_string()); - } - } - } -} - -#[cfg(test)] -mod tests { - use super::*; - - fn make_provider(config: HashMap) -> Provider { - Provider { - config, - r#type: "google-cloud".to_string(), - ..Default::default() - } - } - - #[test] - fn injects_project_id_aliases() { - let provider = make_provider(HashMap::from([( - "project_id".to_string(), - "my-project".to_string(), - )])); - let mut env = HashMap::new(); - GoogleCloudProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("GCP_PROJECT_ID").map(String::as_str), - Some("my-project") - ); - assert_eq!( - env.get("GOOGLE_CLOUD_PROJECT").map(String::as_str), - Some("my-project") - ); - } - - #[test] - fn injects_region_aliases() { - let provider = make_provider(HashMap::from([( - "region".to_string(), - "us-central1".to_string(), - )])); - let mut env = HashMap::new(); - GoogleCloudProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("CLOUD_ML_REGION").map(String::as_str), - Some("us-central1") - ); - assert_eq!( - env.get("GCP_LOCATION").map(String::as_str), - Some("us-central1") - ); - } - - #[test] - fn injects_metadata_host() { - let provider = make_provider(HashMap::new()); - let mut env = HashMap::new(); - GoogleCloudProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("GCE_METADATA_HOST").map(String::as_str), - Some(google_cloud::METADATA_HOST) - ); - } - - #[test] - fn injects_service_account_email() { - let provider = make_provider(HashMap::from([( - "service_account_email".to_string(), - "sa@project.iam.gserviceaccount.com".to_string(), - )])); - let mut env = HashMap::new(); - GoogleCloudProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("GCP_SERVICE_ACCOUNT_EMAIL").map(String::as_str), - Some("sa@project.iam.gserviceaccount.com") - ); - } - - #[test] - fn does_not_overwrite_existing_env() { - let provider = make_provider(HashMap::from([( - "project_id".to_string(), - "new-project".to_string(), - )])); - let mut env = - HashMap::from([("GCP_PROJECT_ID".to_string(), "existing-project".to_string())]); - GoogleCloudProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("GCP_PROJECT_ID").map(String::as_str), - Some("existing-project"), - "should not overwrite existing env" - ); - } - - #[test] - fn skips_empty_config_values() { - let provider = make_provider(HashMap::from([( - "project_id".to_string(), - " ".to_string(), - )])); - let mut env = HashMap::new(); - GoogleCloudProvider.inject_env(&provider, &mut env); - - assert!(!env.contains_key("GCP_PROJECT_ID")); - } -} diff --git a/crates/openshell-providers/src/providers/mod.rs b/crates/openshell-providers/src/providers/mod.rs deleted file mode 100644 index b6450e170e..0000000000 --- a/crates/openshell-providers/src/providers/mod.rs +++ /dev/null @@ -1,5 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -pub mod google_cloud; -pub mod vertex; diff --git a/crates/openshell-providers/src/providers/vertex.rs b/crates/openshell-providers/src/providers/vertex.rs deleted file mode 100644 index e8e1857a91..0000000000 --- a/crates/openshell-providers/src/providers/vertex.rs +++ /dev/null @@ -1,149 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -use std::collections::HashMap; - -use openshell_core::google_cloud; - -use crate::{Provider, ProviderPlugin, VERTEX_AI_PROJECT_ID_KEY, VERTEX_AI_REGION_KEY}; - -pub struct VertexProvider; - -impl ProviderPlugin for VertexProvider { - fn id(&self) -> &'static str { - "google-vertex-ai" - } - - fn inject_env(&self, provider: &Provider, env: &mut HashMap) { - if let Some(project) = provider - .config - .get(VERTEX_AI_PROJECT_ID_KEY) - .filter(|v| !v.trim().is_empty()) - { - let trimmed = project.trim().to_string(); - for var in google_cloud::PROJECT_ID_ENV_VARS { - env.entry((*var).to_string()) - .or_insert_with(|| trimmed.clone()); - } - env.entry(google_cloud::ANTHROPIC_VERTEX_PROJECT_ID_ENV_VAR.to_string()) - .or_insert_with(|| trimmed.clone()); - } - - if let Some(region) = provider - .config - .get(VERTEX_AI_REGION_KEY) - .filter(|v| !v.trim().is_empty()) - { - let trimmed = region.trim().to_string(); - for var in google_cloud::REGION_ENV_VARS { - env.entry((*var).to_string()) - .or_insert_with(|| trimmed.clone()); - } - env.entry(google_cloud::VERTEX_LOCATION_ENV_VAR.to_string()) - .or_insert_with(|| trimmed.clone()); - } - - env.entry(google_cloud::GOOSE_PROVIDER_ENV_VAR.to_string()) - .or_insert_with(|| "gcp_vertex_ai".to_string()); - } -} - -#[cfg(test)] -mod tests { - use super::*; - - fn make_provider(config: HashMap) -> Provider { - Provider { - config, - r#type: "google-vertex-ai".to_string(), - ..Default::default() - } - } - - #[test] - fn injects_project_id_and_anthropic_alias() { - let provider = make_provider(HashMap::from([( - "VERTEX_AI_PROJECT_ID".to_string(), - "my-vertex-project".to_string(), - )])); - let mut env = HashMap::new(); - VertexProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("GCP_PROJECT_ID").map(String::as_str), - Some("my-vertex-project") - ); - assert_eq!( - env.get("GOOGLE_CLOUD_PROJECT").map(String::as_str), - Some("my-vertex-project") - ); - assert_eq!( - env.get("ANTHROPIC_VERTEX_PROJECT_ID").map(String::as_str), - Some("my-vertex-project") - ); - } - - #[test] - fn injects_region_and_vertex_location() { - let provider = make_provider(HashMap::from([( - "VERTEX_AI_REGION".to_string(), - "us-east4".to_string(), - )])); - let mut env = HashMap::new(); - VertexProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("CLOUD_ML_REGION").map(String::as_str), - Some("us-east4") - ); - assert_eq!( - env.get("GCP_LOCATION").map(String::as_str), - Some("us-east4") - ); - assert_eq!( - env.get("VERTEX_LOCATION").map(String::as_str), - Some("us-east4") - ); - } - - #[test] - fn injects_inference_flags() { - let provider = make_provider(HashMap::new()); - let mut env = HashMap::new(); - VertexProvider.inject_env(&provider, &mut env); - - assert!(!env.contains_key("CLAUDE_CODE_USE_VERTEX")); - assert_eq!( - env.get("GOOSE_PROVIDER").map(String::as_str), - Some("gcp_vertex_ai") - ); - } - - #[test] - fn does_not_overwrite_existing_env() { - let provider = make_provider(HashMap::from([( - "VERTEX_AI_PROJECT_ID".to_string(), - "new".to_string(), - )])); - let mut env = HashMap::from([("GCP_PROJECT_ID".to_string(), "existing".to_string())]); - VertexProvider.inject_env(&provider, &mut env); - - assert_eq!( - env.get("GCP_PROJECT_ID").map(String::as_str), - Some("existing") - ); - } - - #[test] - fn skips_empty_config_values() { - let provider = make_provider(HashMap::from([( - "VERTEX_AI_PROJECT_ID".to_string(), - " ".to_string(), - )])); - let mut env = HashMap::new(); - VertexProvider.inject_env(&provider, &mut env); - - assert!(!env.contains_key("GCP_PROJECT_ID")); - assert!(!env.contains_key("ANTHROPIC_VERTEX_PROJECT_ID")); - } -} diff --git a/crates/openshell-sandbox/src/boundary_exec.rs b/crates/openshell-sandbox/src/boundary_exec.rs index d823fef977..7f688eff2d 100644 --- a/crates/openshell-sandbox/src/boundary_exec.rs +++ b/crates/openshell-sandbox/src/boundary_exec.rs @@ -180,7 +180,10 @@ impl LocalBoundaryExec { command.env(key, value); } } - for (key, value) in self.provider_credentials.child_env_with_gcp_resolved() { + for (key, value) in self + .provider_credentials + .child_env_with_non_secret_resolved() + { if !crate::process::is_supervisor_only_env_var(&key) { command.env(key, value); } diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs index cc83789417..33ecedb75a 100644 --- a/crates/openshell-server/src/grpc/policy.rs +++ b/crates/openshell-server/src/grpc/policy.rs @@ -3992,6 +3992,20 @@ pub async fn build_provider_environment_snapshot_from_inputs( credential.token_grant_owners.clone_from(&owners); } } + // Sandbox template and spec values are caller-owned. Drop only non-secret + // profile defaults for those keys before sending the snapshot to either + // the canonical process or later execs. Credential keys keep their + // existing binding and placeholder precedence. + let caller_has_key = |key: &str| { + spec.environment.contains_key(key) + || spec + .template + .as_ref() + .is_some_and(|template| template.environment.contains_key(key)) + }; + provider_environment.environment.retain(|key, _| { + provider_environment.static_credential_keys.contains(key) || !caller_has_key(key) + }); let mut readiness_reason = provider_environment.readiness_reason; @@ -12493,6 +12507,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), }) .await @@ -12600,6 +12615,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), }) .await @@ -12659,6 +12675,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), }) .await @@ -14151,6 +14168,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), } } @@ -14433,6 +14451,74 @@ mod tests { ); } + #[tokio::test] + async fn caller_environment_wins_over_non_secret_profile_defaults_only() { + let state = test_server_state().await; + let mut profile = openshell_providers::example_profiles::load("github"); + profile.id = "declared-env".to_string(); + profile + .environment + .config + .insert("CUSTOM_PROJECT".to_string(), "project".to_string()); + profile + .environment + .fixed + .insert("CUSTOM_MODE".to_string(), "native".to_string()); + profile + .environment + .fixed + .insert("CUSTOM_UNSET".to_string(), "default".to_string()); + state + .store + .put_message(&crate::provider_profile_sources::stored_provider_profile( + profile.to_proto(), + )) + .await + .unwrap(); + + let mut provider = test_provider("work-env", "declared-env"); + provider + .config + .insert("project".to_string(), "profile-project".to_string()); + state.store.put_message(&provider).await.unwrap(); + let mut sandbox = test_sandbox( + "sb-caller-env", + "caller-env", + ProtoSandboxPolicy::default(), + vec!["work-env".to_string()], + ); + let spec = sandbox.spec.as_mut().unwrap(); + spec.environment + .insert("CUSTOM_PROJECT".to_string(), "caller-project".to_string()); + spec.environment + .insert("GITHUB_TOKEN".to_string(), "caller-token".to_string()); + spec.template + .get_or_insert_with(Default::default) + .environment + .insert("CUSTOM_MODE".to_string(), String::new()); + state.store.put_message(&sandbox).await.unwrap(); + + let snapshot = load_sandbox_provider_environment(&state, &sandbox, true, true) + .await + .unwrap(); + assert!(!snapshot.environment.contains_key("CUSTOM_PROJECT")); + assert!(!snapshot.environment.contains_key("CUSTOM_MODE")); + assert_eq!( + snapshot.environment.get("CUSTOM_UNSET").map(String::as_str), + Some("default") + ); + assert_eq!( + snapshot.environment.get("GITHUB_TOKEN").map(String::as_str), + Some("ghp-test") + ); + assert!( + snapshot + .static_credential_bindings + .contains_key("GITHUB_TOKEN") + ); + assert_eq!(snapshot.non_secret_environment_keys, ["CUSTOM_UNSET"]); + } + #[tokio::test] async fn provider_readiness_snapshot_uses_baseline_static_binding_contract() { let state = test_server_state().await; @@ -15610,6 +15696,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), } } @@ -15949,6 +16036,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), }], workspace_scope: Some(openshell_core::proto::workspace_selector( @@ -20321,6 +20409,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), }) .await diff --git a/crates/openshell-server/src/grpc/provider.rs b/crates/openshell-server/src/grpc/provider.rs index 6ef3c3b15d..031720e11f 100644 --- a/crates/openshell-server/src/grpc/provider.rs +++ b/crates/openshell-server/src/grpc/provider.rs @@ -35,6 +35,7 @@ use openshell_core::telemetry::{ }; use openshell_credential_issuer::refresh::CredentialRefresh; use openshell_policy::ProviderPolicyLayer; +use openshell_providers::LEGACY_VERTEX_PRIVATE_KEY_ENV; use prost::Message; use sha2::{Digest, Sha256}; use std::collections::{HashMap, HashSet}; @@ -1219,7 +1220,6 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin let mut expired_static_keys = HashSet::new(); let now_ms = crate::persistence::current_time_ms(); validate_provider_environment_records_unique_at(catalog, records, now_ms)?; - let registry = openshell_providers::ProviderRegistry::new(); for record in records { let name = &record.name; @@ -1253,10 +1253,10 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin .as_ref() .is_none_or(|profile| provider_profile_endpoints_are_active(profile, provider)); let profile_proto = profile.as_ref().map(ProviderTypeProfile::to_proto); - let broker_only_credential_keys = profile_proto - .as_ref() - .map(broker_only_provider_credential_keys) - .unwrap_or_default(); + let broker_only_credential_keys = profile_proto.as_ref().map_or_else( + reserved_bootstrap_credential_keys, + broker_only_provider_credential_keys, + ); let profile_endpoints = profile_proto.as_ref().map(|profile| { if !profile_endpoints_are_active { return Vec::new(); @@ -1300,27 +1300,25 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin let refresh_epochs = refresh_authorization_epochs_by_key(record)?; for (key, value) in &provider.credentials { - if accepted_stored_credential_keys - .as_ref() - .is_some_and(|accepted| !accepted.contains(key)) - { + if broker_only_credential_keys.contains(key) { warn!( provider_name = %name, key = %key, - "withholding provider credential not declared by resolved profile" + "skipping non-injectable provider credential" ); - readiness_reason = - openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } - if is_non_injectable_provider_credential(provider, key) - || broker_only_credential_keys.contains(key) + if accepted_stored_credential_keys + .as_ref() + .is_some_and(|accepted| !accepted.contains(key)) { warn!( provider_name = %name, key = %key, - "skipping non-injectable provider credential" + "withholding provider credential not declared by resolved profile" ); + readiness_reason = + openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } if is_valid_env_key(key) { @@ -1394,34 +1392,30 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin // Expired handles are removed by the credential runtime before values // reach this loop. Preserve omission evidence without exposing handles. if provider.credential_handles.keys().any(|key| { - !is_non_injectable_provider_credential(provider, key) - && !broker_only_credential_keys.contains(key) - && !resolved_refs.values.contains_key(key) + !broker_only_credential_keys.contains(key) && !resolved_refs.values.contains_key(key) }) { readiness_reason = openshell_core::proto::ProviderReadinessReason::CredentialExpired; } for (key, value) in resolved_refs.values { - if accepted_stored_credential_keys - .as_ref() - .is_some_and(|accepted| !accepted.contains(&key)) - { + if broker_only_credential_keys.contains(&key) { warn!( provider_name = %name, key = %key, - "withholding provider credential handle not declared by resolved profile" + "skipping non-injectable provider credential handle" ); - readiness_reason = - openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } - if is_non_injectable_provider_credential(provider, &key) - || broker_only_credential_keys.contains(&key) + if accepted_stored_credential_keys + .as_ref() + .is_some_and(|accepted| !accepted.contains(&key)) { warn!( provider_name = %name, key = %key, - "skipping non-injectable provider credential handle" + "withholding provider credential handle not declared by resolved profile" ); + readiness_reason = + openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } if is_valid_env_key(&key) { @@ -1487,7 +1481,7 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin // provider's earlier output cannot change how this provider classifies // or populates its own keys. Cross-provider credential/config // collisions have already been rejected by the validation above. - inject_provider_plugin_environment(catalog, provider, ®istry, &mut provider_env); + inject_provider_profile_environment(catalog, provider, &mut provider_env)?; for key in profile_stable_placeholder_keys { // A stable placeholder is emitted only when the binding carries // the opaque handle that binds it to the sandbox, provider, @@ -2085,13 +2079,14 @@ pub async fn validate_provider_profiles_present( else { continue; }; - if get_provider_type_profile_for_scope( + if let Some(profile) = get_provider_type_profile_for_scope( catalog, &provider.r#type, &provider.profile_workspace, - ) - .is_some() - { + ) { + profile + .ensure_platform_adapter_available() + .map_err(|error| Status::failed_precondition(error.to_string()))?; continue; } let requested = provider.r#type.trim(); @@ -2179,7 +2174,7 @@ pub async fn validate_provider_update_against_attached_sandboxes_with_catalog( store, refresh, catalog, - workspace, + workspace, &spec.providers, Some(provider), crate::persistence::current_time_ms(), @@ -2205,7 +2200,7 @@ async fn validate_provider_environment_keys_unique_at( now_ms: i64, ) -> Result<(), Status> { let mut seen_credentials = HashMap::::new(); - let mut seen_plugin_config = HashMap::::new(); + let mut seen_profile_config = HashMap::::new(); let mut dynamic_bindings = Vec::new(); for name in provider_names { let provider = match candidate_provider { @@ -2221,10 +2216,10 @@ async fn validate_provider_environment_keys_unique_at( let provider_name = provider.object_name().to_string(); validate_provider_environment_key_ownership( &mut seen_credentials, - &mut seen_plugin_config, + &mut seen_profile_config, &provider_name, active_provider_environment_keys(refresh, catalog, &provider, now_ms).await?, - provider_plugin_environment_keys(catalog, &provider), + provider_profile_environment_values(catalog, &provider)?, )?; dynamic_bindings.extend(dynamic_token_grant_bindings_for_provider_with_catalog( catalog, &provider, @@ -2240,16 +2235,16 @@ fn validate_provider_environment_records_unique_at( now_ms: i64, ) -> Result<(), Status> { let mut seen_credentials = HashMap::::new(); - let mut seen_plugin_config = HashMap::::new(); + let mut seen_profile_config = HashMap::::new(); let mut dynamic_bindings = Vec::new(); for record in records { let provider = &record.provider; validate_provider_environment_key_ownership( &mut seen_credentials, - &mut seen_plugin_config, + &mut seen_profile_config, &record.name, active_keys_with_refresh_states(catalog, provider, &record.refresh_states, now_ms), - provider_plugin_environment_keys(catalog, provider), + provider_profile_environment_values(catalog, provider)?, )?; dynamic_bindings.extend(dynamic_token_grant_bindings_for_provider_with_catalog( catalog, provider, @@ -2259,37 +2254,40 @@ fn validate_provider_environment_records_unique_at( Ok(()) } -fn provider_plugin_environment_keys( +fn provider_profile_environment_values( catalog: &EffectiveProviderProfileCatalog, provider: &Provider, -) -> Vec { - let mut plugin_environment = HashMap::new(); - let registry = openshell_providers::ProviderRegistry::new(); - inject_provider_plugin_environment(catalog, provider, ®istry, &mut plugin_environment); - plugin_environment.into_keys().collect() +) -> Result, Status> { + let mut profile_environment = HashMap::new(); + inject_provider_profile_environment(catalog, provider, &mut profile_environment)?; + let mut values: Vec<_> = profile_environment.into_iter().collect(); + values.sort_unstable_by(|left, right| left.0.cmp(&right.0)); + Ok(values) } -fn inject_provider_plugin_environment( +fn inject_provider_profile_environment( catalog: &EffectiveProviderProfileCatalog, provider: &Provider, - registry: &openshell_providers::ProviderRegistry, environment: &mut HashMap, -) { - // A plugin activates only for a profile the gateway actually resolved. With - // no profile there is nothing to project. +) -> Result<(), Status> { + // Only the resolved profile declares non-secret environment defaults. if let Some(profile) = get_provider_type_profile_for_scope(catalog, &provider.r#type, &provider.profile_workspace) { - registry.inject_env_for_profile_id(provider, &profile.id, environment); + profile + .ensure_platform_adapter_available() + .map_err(|error| Status::failed_precondition(error.to_string()))?; + profile.environment.inject(&provider.config, environment); } + Ok(()) } fn validate_provider_environment_key_ownership( seen_credentials: &mut HashMap, - seen_plugin_config: &mut HashMap, + seen_profile_config: &mut HashMap, provider_name: &str, credential_keys: Vec, - plugin_config_keys: Vec, + profile_config_values: Vec<(String, String)>, ) -> Result<(), Status> { for key in credential_keys { if let Some(first_provider) = seen_credentials.get(&key) { @@ -2301,7 +2299,7 @@ fn validate_provider_environment_key_ownership( } else { seen_credentials.insert(key.clone(), provider_name.to_string()); } - if let Some(config_provider) = seen_plugin_config.get(&key) + if let Some((config_provider, _)) = seen_profile_config.get(&key) && config_provider != provider_name { return Err(provider_credential_config_key_collision( @@ -2312,7 +2310,18 @@ fn validate_provider_environment_key_ownership( } } - for key in plugin_config_keys { + for (key, value) in profile_config_values { + if let Some((config_provider, config_value)) = seen_profile_config.get(&key) + && config_provider != provider_name + && config_value != &value + { + let mut providers = [config_provider.as_str(), provider_name]; + providers.sort_unstable(); + return Err(Status::failed_precondition(format!( + "non-secret env key '{key}' is provided by both provider '{}' and provider '{}'; use provider-specific env names", + providers[0], providers[1] + ))); + } if let Some(credential_provider) = seen_credentials.get(&key) && credential_provider != provider_name { @@ -2322,9 +2331,9 @@ fn validate_provider_environment_key_ownership( provider_name, )); } - seen_plugin_config + seen_profile_config .entry(key) - .or_insert_with(|| provider_name.to_string()); + .or_insert_with(|| (provider_name.to_string(), value)); } Ok(()) } @@ -2568,7 +2577,6 @@ fn active_provider_credential_keys( let mut keys: Vec = provider .credentials .keys() - .filter(|key| !is_non_injectable_provider_credential(provider, key)) .filter(|key| !broker_only_credential_keys.contains(*key)) .filter(|key| is_valid_env_key(key)) .filter(|key| provider_credential_not_expired(provider, key, now_ms)) @@ -2578,7 +2586,6 @@ fn active_provider_credential_keys( provider .credential_handles .keys() - .filter(|key| !is_non_injectable_provider_credential(provider, key)) .filter(|key| !broker_only_credential_keys.contains(*key)) .filter(|key| is_valid_env_key(key)) .filter(|key| provider_credential_not_expired(provider, key, now_ms)) @@ -2594,12 +2601,13 @@ fn broker_only_provider_credential_keys_for_provider( get_provider_type_profile_for_scope(catalog, &provider.r#type, &provider.profile_workspace) .as_ref() .map(ProviderTypeProfile::to_proto) - .map(|profile| broker_only_provider_credential_keys(&profile)) - .unwrap_or_default() + .map_or_else(reserved_bootstrap_credential_keys, |profile| { + broker_only_provider_credential_keys(&profile) + }) } pub(super) fn broker_only_provider_credential_keys(profile: &ProviderProfile) -> HashSet { - profile + let mut keys: HashSet<_> = profile .credentials .iter() .filter_map(|credential| credential.token_grant.as_ref()) @@ -2614,7 +2622,13 @@ pub(super) fn broker_only_provider_credential_keys(profile: &ProviderProfile) -> let key = subject_token.credential.trim(); (!key.is_empty()).then(|| key.to_string()) }) - .collect() + .collect(); + keys.insert(LEGACY_VERTEX_PRIVATE_KEY_ENV.to_string()); + keys +} + +fn reserved_bootstrap_credential_keys() -> HashSet { + HashSet::from([LEGACY_VERTEX_PRIVATE_KEY_ENV.to_string()]) } fn provider_credential_not_expired(provider: &Provider, key: &str, now_ms: i64) -> bool { @@ -3100,6 +3114,8 @@ pub(super) async fn handle_import_provider_profiles( profile_conflict_diagnostics(state.store.as_ref(), &catalog, &workspace, &profiles).await?, ); diagnostics.extend(validate_profile_set(&profiles)); + diagnostics.extend(profile_adapter_diagnostics(&profiles)); + diagnostics.extend(profile_legacy_credential_diagnostics(&profiles)); if !has_errors(&diagnostics) { diagnostics.extend( profile_attached_sandbox_diagnostics( @@ -3204,6 +3220,8 @@ pub(super) async fn handle_update_provider_profiles( .await?, ); diagnostics.extend(validate_profile_set(&profiles)); + diagnostics.extend(profile_adapter_diagnostics(&profiles)); + diagnostics.extend(profile_legacy_credential_diagnostics(&profiles)); let expected_resource_version = if request.expected_resource_version != 0 { Some(request.expected_resource_version) } else { @@ -3325,6 +3343,7 @@ pub(super) async fn handle_lint_provider_profiles( profile_conflict_diagnostics(state.store.as_ref(), &catalog, &workspace, &profiles).await?, ); diagnostics.extend(validate_profile_set(&profiles)); + diagnostics.extend(profile_legacy_credential_diagnostics(&profiles)); let valid = !has_errors(&diagnostics); Ok(Response::new(LintProviderProfilesResponse { @@ -3742,6 +3761,48 @@ fn normalize_profile_id_request(id: &str) -> Result { }) } +fn profile_adapter_diagnostics( + profiles: &[(String, ProviderTypeProfile)], +) -> Vec { + profiles + .iter() + .filter_map(|(source, profile)| { + profile + .ensure_platform_adapter_available() + .err() + .map(|error| ProfileValidationDiagnostic { + source: source.clone(), + profile_id: profile.id.clone(), + field: "required_platform_adapter".to_string(), + message: error.to_string(), + severity: "error".to_string(), + }) + }) + .collect() +} + +fn profile_legacy_credential_diagnostics( + profiles: &[(String, ProviderTypeProfile)], +) -> Vec { + profiles + .iter() + .filter(|(_, profile)| { + profile.credentials.iter().any(|credential| { + credential + .accepted_stored_keys() + .contains(&LEGACY_VERTEX_PRIVATE_KEY_ENV) + }) + }) + .map(|(source, profile)| ProfileValidationDiagnostic { + source: source.clone(), + profile_id: profile.id.clone(), + field: "credentials.env_vars".to_string(), + message: "GOOGLE_SERVICE_ACCOUNT_KEY contains legacy service-account private key material and cannot be declared as a provider credential; configure refresh material instead".to_string(), + severity: "error".to_string(), + }) + .collect() +} + fn profiles_from_import_items( items: &[ProviderProfileImportItem], ) -> ( @@ -4010,7 +4071,7 @@ async fn profile_attached_sandbox_diagnostics( let has_static_credentials = provider .credentials .keys() - .any(|key| !is_non_injectable_provider_credential(&provider, key)); + .any(|key| profile.credential_env_vars().contains(&key.as_str())); let has_usable_endpoint = profile.to_proto().endpoints.iter().any(|endpoint| { !endpoint_ports(endpoint.port, &endpoint.ports).is_empty() && !endpoint.host.trim().is_empty() @@ -5646,6 +5707,15 @@ mod tests { .await .expect("store example provider profile"); } + // Binding tests need generic non-secret config, without a metadata + // service. Use an explicit data-only fork for those scenarios. + let mut cloud_config = openshell_providers::example_profiles::load("google-cloud"); + cloud_config.id = "cloud-env-fixture".to_string(); + cloud_config.required_platform_adapter.clear(); + store + .put_message(&stored_provider_profile(cloud_config.to_proto())) + .await + .unwrap(); store } use openshell_core::proto::{ @@ -6167,6 +6237,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }; let mut dynamic_creds = HashMap::new(); @@ -6230,6 +6301,77 @@ mod tests { } } + #[tokio::test] + async fn gcp_metadata_platform_adapter_matches_host_capability() { + let state = test_server_state_without_provider_profiles().await; + let mut profile = custom_profile("requires-adapter"); + profile.required_platform_adapter = "gcp-metadata".to_string(); + let response = handle_import_provider_profiles( + &state, + authed_request(ImportProviderProfilesRequest { + profiles: vec![ProviderProfileImportItem { + profile: Some(profile.clone()), + source: "requires-adapter.yaml".to_string(), + }], + ..Default::default() + }), + ) + .await + .unwrap() + .into_inner(); + if cfg!(windows) { + assert!(!response.imported); + assert!(response.diagnostics.iter().any(|diagnostic| { + diagnostic.field == "required_platform_adapter" + && diagnostic.message.contains("unavailable") + && diagnostic.message.len() < 128 + })); + } else { + assert!(response.imported, "{:?}", response.diagnostics); + } + + // Existing stored profiles and interceptor-vended profiles must also + // fail at attachment, even when they did not pass this build's import. + state + .store + .put_message(&stored_provider_profile(profile)) + .await + .unwrap(); + create_empty_token_grant_provider( + state.store.as_ref(), + "needs-adapter", + "requires-adapter", + ) + .await; + let catalog = ProviderProfileSources::with_default_sources() + .snapshot_catalog(state.store.as_ref(), "default") + .await + .unwrap(); + let validation = validate_provider_profiles_present( + state.store.as_ref(), + &catalog, + "default", + &["needs-adapter".to_string()], + ) + .await; + let environment = resolve_provider_environment( + state.store.as_ref(), + "default", + &["needs-adapter".to_string()], + ) + .await; + if cfg!(windows) { + let error = validation.unwrap_err(); + assert_eq!(error.code(), Code::FailedPrecondition); + assert!(error.message().contains("gcp-metadata")); + assert!(error.message().len() < 128); + assert_eq!(environment.unwrap_err().code(), Code::FailedPrecondition); + } else { + assert!(validation.is_ok()); + assert!(environment.is_ok()); + } + } + #[tokio::test] async fn provider_environment_propagates_dynamic_key_failure() { let state = test_server_state().await; @@ -6309,6 +6451,74 @@ mod tests { })); } + #[tokio::test] + async fn import_rejects_legacy_vertex_private_key_declaration() { + let state = test_server_state_without_provider_profiles().await; + let mut profile = openshell_providers::example_profiles::load("google-vertex-ai"); + profile.id = "legacy-vertex-export".into(); + let mut legacy_credential = profile.credentials[0].clone(); + legacy_credential.name = "legacy_service_account_key".into(); + legacy_credential.env_vars = vec![LEGACY_VERTEX_PRIVATE_KEY_ENV.into()]; + legacy_credential.refresh = None; + profile.credentials.push(legacy_credential); + + let response = handle_import_provider_profiles( + &state, + authed_request(ImportProviderProfilesRequest { + profiles: vec![ProviderProfileImportItem { + profile: Some(profile.to_proto()), + source: "legacy.yaml".into(), + }], + ..Default::default() + }), + ) + .await + .unwrap() + .into_inner(); + assert!(!response.imported); + assert!(response.diagnostics.iter().any(|diagnostic| { + diagnostic.field == "credentials.env_vars" + && diagnostic.message.contains(LEGACY_VERTEX_PRIVATE_KEY_ENV) + })); + } + + #[tokio::test] + async fn import_rejects_legacy_vertex_private_key_environment_defaults() { + for config_default in [false, true] { + let state = test_server_state_without_provider_profiles().await; + let mut profile = openshell_providers::example_profiles::load("google-vertex-ai"); + if config_default { + profile + .environment + .config + .insert(LEGACY_VERTEX_PRIVATE_KEY_ENV.into(), "private_key".into()); + } else { + profile + .environment + .fixed + .insert(LEGACY_VERTEX_PRIVATE_KEY_ENV.into(), "private-key".into()); + } + let response = handle_import_provider_profiles( + &state, + authed_request(ImportProviderProfilesRequest { + profiles: vec![ProviderProfileImportItem { + profile: Some(profile.to_proto()), + source: "legacy.yaml".into(), + }], + ..Default::default() + }), + ) + .await + .unwrap() + .into_inner(); + assert!(!response.imported); + assert!(response.diagnostics.iter().any(|diagnostic| { + diagnostic.field == "environment" + && diagnostic.message.contains(LEGACY_VERTEX_PRIVATE_KEY_ENV) + })); + } + } + async fn import_token_grant_profile( state: &Arc, id: &str, @@ -7243,6 +7453,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() } } @@ -8095,6 +8306,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), source: "advanced-api.yaml".to_string(), }], @@ -11759,6 +11971,7 @@ mod tests { discovery: None, source: String::new(), scope: String::new(), + ..Default::default() }), source: "delegated-refresh-api.yaml".to_string(), }], @@ -13814,7 +14027,7 @@ mod tests { } #[tokio::test] - async fn provider_environment_rejects_plugin_config_credential_collision_in_both_orders() { + async fn provider_environment_rejects_profile_config_credential_collision_in_both_orders() { let store = test_store().await; create_provider_record( &store, @@ -13830,7 +14043,7 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "google-cloud".to_string(), + r#type: "cloud-env-fixture".to_string(), credentials: std::iter::once(( "GCP_ACCESS_TOKEN".to_string(), "google-token".to_string(), @@ -13903,134 +14116,299 @@ mod tests { } #[tokio::test] - async fn resolve_provider_env_injects_vertex_agent_config() { + async fn provider_environment_rejects_non_secret_overlap_in_both_orders() { let store = test_store().await; - create_provider_record( - &store, - "default", - Provider { - metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { - id: String::new(), - name: "vertex-local".to_string(), - created_time: None, - labels: HashMap::new(), - resource_version: 0, - annotations: HashMap::new(), - workspace: "default".to_string(), - deletion_time: None, - }), - r#type: "google-vertex-ai".to_string(), - credentials: std::iter::once(( - "GOOGLE_VERTEX_AI_TOKEN".to_string(), - "ya29.token".to_string(), - )) - .collect(), - config: [ - ( - "VERTEX_AI_PROJECT_ID".to_string(), - "my-gcp-project".to_string(), - ), - ("VERTEX_AI_REGION".to_string(), "us-central1".to_string()), - ] - .into_iter() - .collect(), - credential_expiration_times: HashMap::new(), - profile_workspace: "default".to_string(), - credential_handles: HashMap::new(), - }, - ) - .await - .unwrap(); - - let result = resolve_provider_environment(&store, "default", &["vertex-local".to_string()]) + let mut project_profile = openshell_providers::example_profiles::load("google-cloud"); + project_profile.id = "project-env-fixture".into(); + project_profile.required_platform_adapter.clear(); + project_profile.environment.fixed.clear(); + project_profile + .environment + .config + .retain(|key, _| key == "GCP_PROJECT_ID"); + store + .put_message(&stored_provider_profile(project_profile.to_proto())) .await .unwrap(); + for (name, project) in [("project-a", "first"), ("project-b", "second")] { + create_provider_record( + &store, + "default", + Provider { + metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { + id: String::new(), + name: name.to_string(), + created_time: None, + labels: HashMap::new(), + resource_version: 0, + annotations: HashMap::new(), + workspace: "default".to_string(), + deletion_time: None, + }), + r#type: "project-env-fixture".to_string(), + credentials: HashMap::new(), + config: HashMap::from([("project_id".to_string(), project.to_string())]), + credential_expiration_times: HashMap::new(), + profile_workspace: "default".to_string(), + credential_handles: HashMap::new(), + }, + ) + .await + .unwrap(); + } - // Credential still injected. - assert_eq!( - result.get("GOOGLE_VERTEX_AI_TOKEN"), - Some(&"ya29.token".to_string()) - ); - // Static flags. - assert!(!result.contains_key("CLAUDE_CODE_USE_VERTEX")); - assert_eq!( - result.get("GOOSE_PROVIDER"), - Some(&"gcp_vertex_ai".to_string()) - ); - // Project ID derived vars. - assert_eq!( - result.get("ANTHROPIC_VERTEX_PROJECT_ID"), - Some(&"my-gcp-project".to_string()) - ); - assert_eq!( - result.get("GCP_PROJECT_ID"), - Some(&"my-gcp-project".to_string()) - ); - assert_eq!( - result.get("GOOGLE_CLOUD_PROJECT"), - Some(&"my-gcp-project".to_string()) - ); - // Region derived vars. - assert_eq!( - result.get("CLOUD_ML_REGION"), - Some(&"us-central1".to_string()) - ); - assert_eq!(result.get("GCP_LOCATION"), Some(&"us-central1".to_string())); - assert_eq!( - result.get("VERTEX_LOCATION"), - Some(&"us-central1".to_string()) - ); + let mut messages = Vec::new(); + for providers in [ + vec!["project-a".to_string(), "project-b".to_string()], + vec!["project-b".to_string(), "project-a".to_string()], + ] { + let validation_error = + validate_provider_environment_keys_unique(&store, "default", &providers) + .await + .unwrap_err(); + let resolution_error = resolve_provider_environment(&store, "default", &providers) + .await + .unwrap_err(); + assert_eq!(validation_error.code(), Code::FailedPrecondition); + assert_eq!(validation_error.message(), resolution_error.message()); + assert!(validation_error.message().contains("GCP_PROJECT_ID")); + assert!(validation_error.message().contains("project-a")); + assert!(validation_error.message().contains("project-b")); + messages.push(validation_error.message().to_string()); + } + assert_eq!(messages[0], messages[1]); } #[tokio::test] - async fn resolve_provider_env_vertex_never_injects_service_account_key() { + async fn provider_environment_allows_identical_vertex_defaults_from_two_providers() { let store = test_store().await; - create_provider_record( - &store, - "default", - Provider { - metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { - id: String::new(), - name: "vertex-bootstrap".to_string(), - created_time: None, - labels: HashMap::new(), - resource_version: 0, - annotations: HashMap::new(), - workspace: "default".to_string(), - deletion_time: None, - }), - r#type: "google-vertex-ai".to_string(), - credentials: [ - ( - "GOOGLE_SERVICE_ACCOUNT_KEY".to_string(), - r#"{"type":"service_account","private_key":"secret"}"#.to_string(), - ), - ( - "GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN".to_string(), - "ya29.short-lived".to_string(), - ), - ] - .into_iter() - .collect(), - config: HashMap::new(), - credential_expiration_times: HashMap::new(), - profile_workspace: "default".to_string(), - credential_handles: HashMap::new(), - }, - ) - .await - .unwrap(); + let profile = openshell_providers::example_profiles::load("google-vertex-ai"); + store + .put_message(&stored_provider_profile(profile.to_proto())) + .await + .unwrap(); + for (name, credential_key, token) in [ + ("vertex-a", "GOOGLE_VERTEX_AI_TOKEN", "token-a"), + ( + "vertex-b", + "GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN", + "token-b", + ), + ] { + let mut provider = + provider_with_credential_value(name, "google-vertex-ai", credential_key, token); + provider.config = HashMap::from([ + ("VERTEX_AI_PROJECT_ID".into(), "shared-project".into()), + ("VERTEX_AI_REGION".into(), "us-central1".into()), + ]); + create_provider_record(&store, "default", provider) + .await + .unwrap(); + } - let result = - resolve_provider_environment(&store, "default", &["vertex-bootstrap".to_string()]) + for names in [ + ["vertex-a".to_string(), "vertex-b".to_string()], + ["vertex-b".to_string(), "vertex-a".to_string()], + ] { + validate_provider_environment_keys_unique(&store, "default", &names) + .await + .unwrap(); + let result = resolve_provider_environment(&store, "default", &names) + .await + .unwrap(); + assert_eq!(result.get("GOOSE_PROVIDER"), Some(&"gcp_vertex_ai".into())); + assert_eq!(result.get("GCP_PROJECT_ID"), Some(&"shared-project".into())); + assert_eq!( + result.get("GOOGLE_VERTEX_AI_TOKEN"), + Some(&"token-a".into()) + ); + assert_eq!( + result.get("GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN"), + Some(&"token-b".into()) + ); + } + } + + #[tokio::test] + async fn resolve_provider_env_injects_vertex_agent_config() { + for profile_id in ["google-vertex-ai", "acme-vertex"] { + let store = test_store().await; + let mut fork = openshell_providers::example_profiles::load("google-vertex-ai"); + fork.id = "acme-vertex".to_string(); + store + .put_message(&stored_provider_profile(fork.to_proto())) .await .unwrap(); + create_provider_record( + &store, + "default", + Provider { + metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { + id: String::new(), + name: "vertex-local".to_string(), + created_time: None, + labels: HashMap::new(), + resource_version: 0, + annotations: HashMap::new(), + workspace: "default".to_string(), + deletion_time: None, + }), + r#type: profile_id.to_string(), + credentials: std::iter::once(( + "GOOGLE_VERTEX_AI_TOKEN".to_string(), + "ya29.token".to_string(), + )) + .collect(), + config: [ + ( + "VERTEX_AI_PROJECT_ID".to_string(), + "my-gcp-project".to_string(), + ), + ("VERTEX_AI_REGION".to_string(), "us-central1".to_string()), + ] + .into_iter() + .collect(), + credential_expiration_times: HashMap::new(), + profile_workspace: "default".to_string(), + credential_handles: HashMap::new(), + }, + ) + .await + .unwrap(); - assert!(!result.contains_key("GOOGLE_SERVICE_ACCOUNT_KEY")); - assert_eq!( - result.get("GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN"), - Some(&"ya29.short-lived".to_string()) - ); + let result = + resolve_provider_environment(&store, "default", &["vertex-local".to_string()]) + .await + .unwrap(); + + // Credential still injected. + assert_eq!( + result.get("GOOGLE_VERTEX_AI_TOKEN"), + Some(&"ya29.token".to_string()) + ); + // Static flags. + assert!(!result.contains_key("CLAUDE_CODE_USE_VERTEX")); + assert_eq!( + result.get("GOOSE_PROVIDER"), + Some(&"gcp_vertex_ai".to_string()) + ); + // Project ID derived vars. + assert_eq!( + result.get("ANTHROPIC_VERTEX_PROJECT_ID"), + Some(&"my-gcp-project".to_string()) + ); + assert_eq!( + result.get("GCP_PROJECT_ID"), + Some(&"my-gcp-project".to_string()) + ); + assert_eq!( + result.get("GOOGLE_CLOUD_PROJECT"), + Some(&"my-gcp-project".to_string()) + ); + // Region derived vars. + assert_eq!( + result.get("CLOUD_ML_REGION"), + Some(&"us-central1".to_string()) + ); + assert_eq!(result.get("GCP_LOCATION"), Some(&"us-central1".to_string())); + assert_eq!( + result.get("VERTEX_LOCATION"), + Some(&"us-central1".to_string()) + ); + } + } + + #[tokio::test] + async fn resolve_provider_env_vertex_never_injects_service_account_key() { + for (profile_id, declares_legacy_key) in + [("google-vertex-ai", false), ("acme-vertex", true)] + { + let store = test_store().await; + let mut fork = openshell_providers::example_profiles::load("google-vertex-ai"); + fork.id = profile_id.to_string(); + if declares_legacy_key { + let mut legacy_credential = fork.credentials[0].clone(); + legacy_credential.name = "legacy_service_account_key".into(); + legacy_credential.env_vars = vec![LEGACY_VERTEX_PRIVATE_KEY_ENV.into()]; + legacy_credential.refresh = None; + fork.credentials.push(legacy_credential); + } + store + .put_message(&stored_provider_profile(fork.to_proto())) + .await + .unwrap(); + create_provider_record( + &store, + "default", + Provider { + metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { + id: String::new(), + name: "vertex-bootstrap".to_string(), + created_time: None, + labels: HashMap::new(), + resource_version: 0, + annotations: HashMap::new(), + workspace: "default".to_string(), + deletion_time: None, + }), + r#type: profile_id.to_string(), + credentials: [ + ( + "GOOGLE_SERVICE_ACCOUNT_KEY".to_string(), + r#"{"type":"service_account","private_key":"secret"}"#.to_string(), + ), + ( + "GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN".to_string(), + "ya29.short-lived".to_string(), + ), + ] + .into_iter() + .collect(), + config: HashMap::from([ + ("VERTEX_AI_PROJECT_ID".to_string(), "my-project".to_string()), + ("VERTEX_AI_REGION".to_string(), "us-central1".to_string()), + ]), + credential_expiration_times: HashMap::new(), + profile_workspace: "default".to_string(), + credential_handles: HashMap::new(), + }, + ) + .await + .unwrap(); + + let result = + resolve_provider_environment(&store, "default", &["vertex-bootstrap".to_string()]) + .await + .unwrap(); + + assert!(!result.contains_key("GOOGLE_SERVICE_ACCOUNT_KEY")); + assert!( + !result + .static_credential_bindings + .contains_key("GOOGLE_SERVICE_ACCOUNT_KEY") + ); + assert!( + !result + .static_credential_keys + .contains("GOOGLE_SERVICE_ACCOUNT_KEY") + ); + assert_eq!( + result.get("GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN"), + Some(&"ya29.short-lived".to_string()) + ); + assert_eq!( + result.readiness_reason, + openshell_core::proto::ProviderReadinessReason::Unspecified + ); + assert_eq!( + result.get("GCP_PROJECT_ID"), + Some(&"my-project".to_string()) + ); + assert_eq!( + result.get("CLOUD_ML_REGION"), + Some(&"us-central1".to_string()) + ); + } } #[tokio::test] @@ -14300,7 +14678,7 @@ mod tests { } #[tokio::test] - async fn update_provider_rejects_plugin_config_credential_collision() { + async fn update_provider_rejects_profile_config_credential_collision() { let store = test_store().await; create_provider_record( &store, @@ -14316,7 +14694,7 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "google-cloud".to_string(), + r#type: "cloud-env-fixture".to_string(), credentials: std::iter::once(( "GCP_ACCESS_TOKEN".to_string(), "google-token".to_string(), @@ -15954,7 +16332,7 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "google-cloud".to_string(), + r#type: "cloud-env-fixture".to_string(), credentials: HashMap::new(), config, credential_expiration_times: HashMap::new(), @@ -15963,143 +16341,6 @@ mod tests { } } - #[test] - fn inject_gcp_env_sets_metadata_host() { - use openshell_core::google_cloud; - let provider = google_cloud_provider(HashMap::new()); - let mut env = HashMap::new(); - openshell_providers::ProviderRegistry::new().inject_env_for_profile_id( - &provider, - &provider.r#type, - &mut env, - ); - assert_eq!( - env.get("GCE_METADATA_HOST").map(String::as_str), - Some(google_cloud::METADATA_HOST), - ); - assert!( - !env.contains_key("CLAUDE_CODE_USE_VERTEX"), - "CLAUDE_CODE_USE_VERTEX is synthetic, should not be injected here" - ); - } - - #[test] - fn inject_gcp_env_propagates_project_id() { - use openshell_core::google_cloud; - let provider = google_cloud_provider(HashMap::from([( - "project_id".to_string(), - "my-project".to_string(), - )])); - let mut env = HashMap::new(); - openshell_providers::ProviderRegistry::new().inject_env_for_profile_id( - &provider, - &provider.r#type, - &mut env, - ); - for var in google_cloud::PROJECT_ID_ENV_VARS { - assert_eq!( - env.get(*var).map(String::as_str), - Some("my-project"), - "{var} should be set to project_id config value" - ); - } - } - - #[test] - fn inject_gcp_env_propagates_region() { - use openshell_core::google_cloud; - let provider = google_cloud_provider(HashMap::from([( - "region".to_string(), - "us-central1".to_string(), - )])); - let mut env = HashMap::new(); - openshell_providers::ProviderRegistry::new().inject_env_for_profile_id( - &provider, - &provider.r#type, - &mut env, - ); - for var in google_cloud::REGION_ENV_VARS { - assert_eq!( - env.get(*var).map(String::as_str), - Some("us-central1"), - "{var} should be set to region config value" - ); - } - } - - #[test] - fn inject_gcp_env_propagates_service_account_email() { - use openshell_core::google_cloud; - let provider = google_cloud_provider(HashMap::from([( - "service_account_email".to_string(), - "sa@proj.iam.gserviceaccount.com".to_string(), - )])); - let mut env = HashMap::new(); - openshell_providers::ProviderRegistry::new().inject_env_for_profile_id( - &provider, - &provider.r#type, - &mut env, - ); - for var in google_cloud::SERVICE_ACCOUNT_EMAIL_ENV_VARS { - assert_eq!( - env.get(*var).map(String::as_str), - Some("sa@proj.iam.gserviceaccount.com"), - "{var} should be set to service_account_email config value" - ); - } - } - - #[test] - fn inject_gcp_env_does_not_overwrite_existing_values() { - let provider = google_cloud_provider(HashMap::from([( - "project_id".to_string(), - "from-config".to_string(), - )])); - let mut env = HashMap::from([("GCP_PROJECT_ID".to_string(), "user-override".to_string())]); - openshell_providers::ProviderRegistry::new().inject_env_for_profile_id( - &provider, - &provider.r#type, - &mut env, - ); - assert_eq!( - env.get("GCP_PROJECT_ID").map(String::as_str), - Some("user-override"), - "user-provided value should not be overwritten" - ); - } - - #[test] - fn inject_non_gcp_provider_does_nothing() { - let provider = Provider { - metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { - id: String::new(), - name: "github".to_string(), - created_time: None, - labels: HashMap::new(), - resource_version: 0, - annotations: HashMap::new(), - workspace: "default".to_string(), - deletion_time: None, - }), - r#type: "github".to_string(), - credentials: HashMap::new(), - config: HashMap::from([("project_id".to_string(), "should-be-ignored".to_string())]), - credential_expiration_times: HashMap::new(), - profile_workspace: "default".to_string(), - credential_handles: HashMap::new(), - }; - let mut env = HashMap::new(); - openshell_providers::ProviderRegistry::new().inject_env_for_profile_id( - &provider, - &provider.r#type, - &mut env, - ); - assert!( - env.is_empty(), - "non-GCP provider should not inject any env vars" - ); - } - #[tokio::test] async fn provider_crud_is_workspace_isolated() { use openshell_core::proto::{ diff --git a/crates/openshell-server/src/provider_profile_sources.rs b/crates/openshell-server/src/provider_profile_sources.rs index 77230e5cce..fef2dc9887 100644 --- a/crates/openshell-server/src/provider_profile_sources.rs +++ b/crates/openshell-server/src/provider_profile_sources.rs @@ -1191,6 +1191,51 @@ mod tests { .expect("canonical provider profile MCP options") } + #[test] + fn environment_profile_fingerprints_survive_storage_round_trips() { + let profile = openshell_providers::example_profiles::load("google-vertex-ai").to_proto(); + let encoded = profile.encode_to_vec(); + let revision = profile_snapshot_revision(std::slice::from_ref(&profile)); + let fingerprint = |profile| { + let catalog = build_effective_profiles(vec![CollectedProviderProfileSnapshot { + source_id: "external/test".to_string(), + revision: "same-revision".to_string(), + profiles: vec![ScopedSnapshotProfile { + scope: ProfileScope::Static, + profile, + }], + user_managed: false, + allow_empty: false, + }]) + .expect("valid environment profile"); + let mut hash = Sha256::new(); + catalog.hash_type_profile_revision_for_scope("google-vertex-ai", "", &mut hash); + hash.finalize() + }; + let original_fingerprint = fingerprint(profile.clone()); + for _ in 0..16 { + let decoded = ProviderProfile::decode(encoded.as_slice()).unwrap(); + assert_eq!( + profile_snapshot_revision(std::slice::from_ref(&decoded)), + revision + ); + assert_eq!(fingerprint(decoded), original_fingerprint); + } + + let mut changed = profile; + changed + .environment + .as_mut() + .unwrap() + .fixed + .insert("GOOSE_PROVIDER".to_string(), "custom_vertex".to_string()); + assert_ne!( + profile_snapshot_revision(std::slice::from_ref(&changed)), + revision + ); + assert_ne!(fingerprint(changed), original_fingerprint); + } + #[test] fn equivalent_mcp_version_order_produces_identical_source_profile_fingerprints() { let catalog = |versions: &[&str]| { diff --git a/crates/openshell-server/src/storage_proto.rs b/crates/openshell-server/src/storage_proto.rs index d8da420871..1a04a10377 100644 --- a/crates/openshell-server/src/storage_proto.rs +++ b/crates/openshell-server/src/storage_proto.rs @@ -126,12 +126,12 @@ mod tests { // Restart policy is stored in SandboxSpec, and the count and well-known // timestamps are stored in SandboxStatus. Legacy payloads decode with // Unspecified (treated as Never), zero count, and absent timestamps. - // ProviderProfileFile is reachable from stored provider profiles. Its - // additive declaration changes the durable and public/durable overlap - // inventories; the provider-environment file map and peer configuration - // notification are public-only. The - // request has no provider-file capability field: older supervisors ignore - // the additive file map while retaining the rest of the response. + // ProviderProfileFile and ProviderProfileEnvironment are reachable from + // stored provider profiles. Their additive declarations change the public, + // durable, and overlap inventories while preserving existing field tags and + // legacy payload decoding. The provider-environment file map and peer + // configuration notification are public-only. Older supervisors ignore the + // additive file map while retaining the rest of the response. // Preparation timing adds two optional timestamps to SandboxProvisioning. // Existing rows decode with both absent and retain their active deadline; // no stored attempt gains another phase or time budget on upgrade. @@ -178,11 +178,11 @@ mod tests { // image wire identity, now with explicit presence. Compute configuration // updates use a separate capability/service and add one classified RPC. const PUBLIC_RPC_SCHEMA_SHA256: &str = - "3b4c2af6cf22e7ed1d84279ff865acb0db7199717bee9bc041caef791334104d"; + "6a48aa216b6e58c3b988d4468a2bce48f191cde442cd16431a6745c31b633af5"; const DURABLE_SCHEMA_SHA256: &str = - "cb15f8f79a855064a43fe8c6cd908bf07eca6604e2bf8ab7d2de0ef33e97da4e"; + "5007cbc16f1791107fd8084f34093e39de7b0e129a481d2bebd6978627278be1"; const PUBLIC_DURABLE_OVERLAP_SHA256: &str = - "c0c3ea17f105aaa6d843c466fd4240451c2105dce7675384935d4aaecdac8abf"; + "324526d75a8d523328a4c902f867400105826e6f540123f88a3ba1bbe8925958"; // Encoded with the schema that omitted stable_placeholder. Keep these // bytes fixed so the current encoder cannot hide a compatibility change. const LEGACY_STATIC_PROFILE: &str = "0a240a116c65676163792d70726f66696c652d6964120d6c65676163792d737461746963280712510a0d6c65676163792d73746174696312184c6567616379207374617469632063726564656e7469616c2a260a076170695f6b65791a1153594e5448455449435f4150495f4b455920012a06626561726572"; @@ -723,9 +723,9 @@ mod tests { overlap_hash.as_str(), ), ( - (337, 31), - (100, 22), - (86, 22), + (340, 31), + (103, 22), + (89, 22), PUBLIC_RPC_SCHEMA_SHA256, DURABLE_SCHEMA_SHA256, PUBLIC_DURABLE_OVERLAP_SHA256 @@ -867,6 +867,8 @@ mod tests { let profile = profile.profile.expect("profile"); assert_eq!(profile.id, "profile"); assert_eq!(profile.display_name, "Legacy"); + assert!(profile.environment.is_none()); + assert!(profile.required_platform_adapter.is_empty()); let policy_payload = PolicyRevisionPayload::decode(legacy_bytes(V0_0_116_POLICY_PAYLOAD).as_slice()) diff --git a/crates/openshell-supervisor/src/config_runtime.rs b/crates/openshell-supervisor/src/config_runtime.rs index 02736ad184..157c60b359 100644 --- a/crates/openshell-supervisor/src/config_runtime.rs +++ b/crates/openshell-supervisor/src/config_runtime.rs @@ -1997,7 +1997,7 @@ mod tests { static_provider_environment(1, Some("initial")), &readiness, ); - let (revision, child_env) = state.child_env_snapshot_with_gcp_resolved().unwrap(); + let (revision, child_env) = state.child_env_snapshot_with_non_secret_resolved().unwrap(); let reference = &child_env["EXTERNAL_TOKEN"]; assert_eq!(revision, 1); assert_eq!(reference, "openshell:resolve:env:v1_EXTERNAL_TOKEN"); @@ -2067,7 +2067,7 @@ mod tests { ); assert!(state.requires_stable_placeholders()); assert!(readiness.observation(&state).credentials_installed); - let (revision, child_env) = state.child_env_snapshot_with_gcp_resolved().unwrap(); + let (revision, child_env) = state.child_env_snapshot_with_non_secret_resolved().unwrap(); assert_eq!(prepared.snapshot().child_env, child_env); let reference = &child_env["EXTERNAL_TOKEN"]; assert_eq!(revision, 1); diff --git a/docs/how-it-works/providers/google.mdx b/docs/how-it-works/providers/google.mdx index 6d5b0c1256..7db7be00cb 100644 --- a/docs/how-it-works/providers/google.mdx +++ b/docs/how-it-works/providers/google.mdx @@ -7,37 +7,30 @@ description: "Authenticate with Google Cloud APIs and Vertex AI inside OpenShell keywords: "Generative AI, Google Cloud, Vertex AI, GCP, OAuth2, Credentials, Sandbox" --- -The `google-cloud` provider gives sandboxes native GCP credentials so -any Google Cloud SDK works out of the box — Cloud Storage, BigQuery, Drive, -Maps, Discovery Engine, or any other GCP API. A GCE metadata server emulator -on loopback provides credential placeholders that the -sandbox proxy resolves to real tokens at request time. The sandbox process -never holds a real GCP credential. +Google provider profiles declare credential refresh, environment defaults, and +local discovery behavior. The Google Cloud profile supports SDK metadata +discovery; the Vertex AI profile supports native API requests with +gateway-refreshed bearer tokens. -## Quick Start +## Google Cloud Metadata -Import the `google-cloud` profile first; a gateway serves only the profiles you -imported: +The `google-cloud` example declares the `gcp-metadata` platform adapter and +the SDK environment variables that use it. The sandbox relays metadata requests +to the supervisor on Linux sandboxes using Docker, Podman, Kubernetes, or VM. +Windows/MXC does not provide this adapter. -```shell -openshell profile import --url https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/google-cloud.yaml --global -``` - -If you already have `gcloud` configured with Application Default Credentials, -create a provider with automatic credential refresh in one command: +Import the profile before creating a provider. This example has no API +endpoints, so bind the provider to each Google API host in sandbox policy as +shown below. ```shell -openshell provider create \ - --name my-gcp \ - --type google-cloud \ - --from-gcloud-adc \ - --config project_id="$(gcloud config get-value project)" \ - --config region=global +curl -fsSLo google-cloud.yaml https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/google-cloud.yaml +openshell profile import -f google-cloud.yaml --global ``` -`--from-gcloud-adc` reads your ADC file, configures OAuth2 refresh on the -gateway, and mints the first access token before the command returns. The -gateway rotates the token automatically — no manual refresh needed. +The profile's `environment` declarations provide the non-secret metadata and +project values listed below. A copy imported under another ID keeps those +declarations and the same adapter requirement. ## Authentication Flows @@ -52,6 +45,7 @@ exchanges the refresh token for short-lived access tokens automatically. openshell provider create \ --name my-gcp \ --type google-cloud \ + --global-profile \ --config project_id=my-project \ --config region=us-central1 \ --credential GCP_ADC_ACCESS_TOKEN=placeholder @@ -90,6 +84,7 @@ strategy. openshell provider create \ --name my-gcp \ --type google-cloud \ + --global-profile \ --config project_id=my-project \ --config region=us-central1 \ --credential GCP_SA_ACCESS_TOKEN=placeholder @@ -250,13 +245,13 @@ openshell profile import --url https://raw.githubusercontent.com/NVIDIA/OpenShel #### Service Account Key -Create the provider with the JSON key as gateway-only bootstrap material: +Create the provider for runtime credentials: ```shell openshell provider create \ --name vertex-prod \ --type google-vertex-ai \ - --credential GOOGLE_SERVICE_ACCOUNT_KEY="$(cat /path/to/key.json)" \ + --runtime-credentials \ --config VERTEX_AI_PROJECT_ID=my-gcp-project \ --config VERTEX_AI_REGION=us-central1 ``` @@ -275,6 +270,16 @@ openshell provider refresh configure vertex-prod \ The private key remains in the gateway credential store. Sandboxes receive only an opaque placeholder for the short-lived access token. +The profile's `environment` and `discovery.config_env_vars` declarations supply +SDK configuration and local discovery behavior. A copy imported under another +ID keeps those effects. Do not store `GOOGLE_SERVICE_ACCOUNT_KEY` as a provider +credential or non-secret environment default; supply the private key through +refresh configuration. If an older provider record still holds that key after +the profile declaration is removed, the gateway omits it and continues to +provide the access token and SDK configuration. Two Vertex providers can share +the same non-secret SDK defaults when their values match and their credential +environment keys differ. + #### gcloud Application Default Credentials For local development: @@ -299,7 +304,7 @@ file and refresh token do not enter the sandbox. | Key | Required | Default | Description | |---|---|---|---| | `VERTEX_AI_PROJECT_ID` | Yes | — | GCP project ID exposed as non-secret workload configuration. | -| `VERTEX_AI_REGION` | No | `us-central1` | Vertex location exposed as non-secret workload configuration. | +| `VERTEX_AI_REGION` | Client dependent | — | Vertex location exposed as non-secret workload configuration. Set it explicitly for regional endpoints. | When the provider is attached, OpenShell also projects standard project and location aliases such as `GOOGLE_CLOUD_PROJECT`, `ANTHROPIC_VERTEX_PROJECT_ID`, diff --git a/docs/how-it-works/providers/profiles.mdx b/docs/how-it-works/providers/profiles.mdx index 359b59c486..90429ca2c6 100644 --- a/docs/how-it-works/providers/profiles.mdx +++ b/docs/how-it-works/providers/profiles.mdx @@ -38,7 +38,7 @@ Provider profiles include these user-facing features: - `openshell profile export`, `import`, `update`, `lint`, and `delete` for custom profiles. - Provider instances created from imported profile IDs with `openshell provider create --type `. - Provider instances whose submitted credentials can be stored by a configured gateway credential driver. -- Profile-backed credential discovery for explicit `openshell provider create --from-existing` and `openshell provider update --from-existing` flows. The `google-vertex-ai` profile also supplements discovery with Vertex config env vars such as `VERTEX_AI_PROJECT_ID` and `VERTEX_AI_REGION`. +- Profile-backed discovery for explicit `openshell provider create --from-existing` and `openshell provider update --from-existing` flows. `discovery.credentials` selects credentials, and `discovery.config_env_vars` selects non-secret configuration variables. - Just-in-time effective policy composition from sandbox policy plus attached provider profiles. - Runtime sandbox provider commands under `openshell sandbox provider list|attach|detach|status`, with an option to wait until the sandbox applies a change. - Credential refresh configuration with `openshell provider refresh status|configure|rotate|delete`. @@ -46,6 +46,53 @@ Provider profiles include these user-facing features: - Dynamic token grants that use the sandbox's SPIFFE JWT-SVID as an OAuth2 client assertion and inject short-lived tokens into supported headers for matching profile endpoints. - Endpoint-bound static credential placeholders. The sandbox proxy resolves a static credential only for request hosts, ports, and paths declared by its provider profile or explicitly bound in sandbox policy for an endpointless profile. +## Declare Environment and Discovery Behavior + +The profile ID identifies a definition. Renaming a profile does not activate or +disable SDK configuration. Declare every non-secret environment default in the +profile: + +```yaml +environment: + config: + CUSTOM_PROJECT: CUSTOM_PROJECT + CUSTOM_REGION: CUSTOM_REGION + fixed: + CUSTOM_MODE: native +discovery: + credentials: [api_key] + config_env_vars: [CUSTOM_PROJECT, CUSTOM_REGION] +``` + +`environment.config` maps each destination environment variable to a provider +config key. OpenShell trims the config value and skips missing or blank values. +`environment.fixed` supplies literal values, including an explicitly empty +string. Sandbox template and create-time environment values, including an +explicitly empty value, take precedence over these non-secret defaults. +Provider credential keys remain credential-owned and reach the workload as +opaque placeholders. + +`discovery.config_env_vars` copies nonempty local environment values into +provider config under the same key. Use that key in `environment.config` if the +discovered value should become a workload environment default. Discovery does +not read undeclared keys or infer behavior from the profile ID. + +Profiles allow at most 64 environment defaults and 64 discovery config keys. +Environment names and config keys are limited to 128 bytes; fixed values are +limited to 4096 bytes. Values do not support interpolation or scripts. Lint +rejects invalid environment names, duplicate destinations across `config` and +`fixed`, and collisions with credential `env_vars`. The legacy +`GOOGLE_SERVICE_ACCOUNT_KEY` cannot be a non-secret default. Attachment accepts +the same non-secret destination from multiple providers when their values +match. It rejects differing values and overlapping credential keys. Use +distinct destination names when providers need different values. + +Use `required_platform_adapter` when a profile depends on a named runtime +capability. Lint rejects unknown adapter names. Import, update, and attachment +reject a recognized adapter that the deployment cannot provide, with a bounded +diagnostic. The `gcp-metadata` adapter is available for Linux sandboxes using +Docker, Podman, Kubernetes, or VM. Windows/MXC does not provide it. + ## Understand Static Credential Endpoint Binding Static credential endpoint binding prevents a placeholder for one service from @@ -339,12 +386,19 @@ Import one profile file at platform scope: openshell profile import -f providers/github.yaml --global ``` -Import all non-recursive `*.yaml`, `*.yml`, and `*.json` files from a directory: +Import all non-recursive `*.yaml`, `*.yml`, and `*.json` files from a directory +of profiles you reviewed and selected: ```shell -openshell profile import --from ./providers --global +mkdir -p selected-profiles +cp providers/github.yaml providers/openai.yaml selected-profiles/ +openshell profile import --from ./selected-profiles --global ``` +Include only profiles whose platform requirements the deployment supports. +Imports are atomic: a batch containing the Google Cloud metadata example fails +on Windows/MXC because the `gcp-metadata` adapter is unavailable there. + Omit `--global` to import into the current workspace instead. Export a profile as YAML, to edit or to keep before an upgrade: diff --git a/docs/upgrade/0-1-0.mdx b/docs/upgrade/0-1-0.mdx index 2e7ea7a37a..4c6ebdd5f6 100644 --- a/docs/upgrade/0-1-0.mdx +++ b/docs/upgrade/0-1-0.mdx @@ -28,9 +28,32 @@ If you run OpenShell for a team, start here. - **Export provider profiles before upgrading.** The gateway no longer includes built-in profiles. Import the saved profiles after the upgrade at the same global or workspace scope. Replace profile aliases such as `claude` and `gh` with the canonical IDs `claude-code` and `github` ([PR #2962](https://github.com/NVIDIA/OpenShell/pull/2962), [PR #3383](https://github.com/NVIDIA/OpenShell/pull/3383)). + Google Cloud and Vertex profiles must also declare their environment and + discovery effects. Merge `environment.config`, `environment.fixed`, and + `discovery.config_env_vars` from the current examples into existing profiles. + Their IDs no longer activate SDK defaults or discovery keys. Keep credentials + out of these non-secret fields; lint rejects collisions with credential + `env_vars`. For Vertex service accounts, create with `--runtime-credentials` + and configure refresh material directly. Remove the obsolete + `GOOGLE_SERVICE_ACCOUNT_KEY` credential declaration. See + [profile environment declarations](/how-it-works/providers/profiles#declare-environment-and-discovery-behavior). + New imports reject that legacy credential key. Gateways also withhold it + from workloads when an older profile remains stored, but operators should + remove the obsolete declaration and migrate its private key to refresh + material. A stored provider record may retain the old key during the upgrade; + it remains excluded from the workload without withholding the provider's + access token or non-secret SDK settings. The key is also rejected in + `environment.config` and `environment.fixed`. + + The Google Cloud metadata example also declares + `required_platform_adapter: gcp-metadata`. The supervisor provides this + adapter for Linux sandboxes using Docker, Podman, Kubernetes, or VM. + Windows/MXC rejects that requirement during import or attachment. Native + Vertex bearer-token authentication does not require this adapter. + ```shell openshell provider profile export -o yaml --global > .yaml - openshell profile import --from ./profiles --global + openshell profile import -f --global ``` - **Migrate `gateway.toml` to schema version 2.** Add the version, replace the plural compute-driver selector, move driver settings under `[openshell.drivers.]`, and apply the renamed Docker, Podman, and VM fields. Validate the file before restarting. See [Gateway Configuration](/how-it-works/gateways/configuration#migrate-to-schema-version-2) for the complete field mapping and [PR #2814](https://github.com/NVIDIA/OpenShell/pull/2814) for the implementation. diff --git a/e2e/rust/tests/provider_refresh_handles.rs b/e2e/rust/tests/provider_refresh_handles.rs index 1de651415d..4204494961 100644 --- a/e2e/rust/tests/provider_refresh_handles.rs +++ b/e2e/rust/tests/provider_refresh_handles.rs @@ -9,6 +9,8 @@ //! retains its original environment while the gateway rotates the provider 12 //! times. The shell must continue reaching the resource with the newest token, //! and explicit refresh reconfiguration must revoke its old handle. +//! Declared non-secret defaults must reach the shell as literal values, while +//! caller environment takes precedence in both main and exec processes. use std::io::Write; use std::process::Stdio; @@ -113,6 +115,13 @@ fn write_profile(resource_port: u16, token_port: u16) -> Result Result<(), String> { PROFILE_ID, "--credential", TOKEN_ENV, + "--config", + "project=custom-profile-project", ], &[(TOKEN_ENV, "bootstrap-token")], ) @@ -301,8 +312,9 @@ async fn long_running_process_survives_rotations_and_reconfigure_revokes() -> Re delete_provider_resources().await; let fixture_port = find_free_port(); let fixture_script = FIXTURE_SCRIPT.replace("__PORT__", &fixture_port.to_string()); - let fixture = - HostSupportContainer::start_python_on_host_network(&fixture_script, fixture_port).await?; + // Publish the fixture for both the native gateway and the supervisor. On + // macOS, Podman's host network is inside its VM, not the gateway's host. + let fixture = HostSupportContainer::start_python(&fixture_script, fixture_port).await?; let profile = write_profile(fixture.port, fixture.port)?; let policy = write_policy(fixture.port)?; configure_refresh(&profile).await?; @@ -314,6 +326,10 @@ async fn long_running_process_survives_rotations_and_reconfigure_revokes() -> Re openshell:resolve:env:s*_REFRESH_E2E_ACCESS_TOKEN) ;; *) exit 64 ;; esac +test "$REFRESH_E2E_PROJECT" = caller-project || exit 65 +test "${{REFRESH_E2E_MODE+x}}" = x && test -z "$REFRESH_E2E_MODE" || exit 66 +test "$REFRESH_E2E_DEFAULT_PROJECT" = custom-profile-project || exit 67 +test "$REFRESH_E2E_DEFAULT_MODE" = native || exit 68 echo {READY_MARKER} while true; do if [ -f /sandbox/probe-trigger ]; then @@ -328,13 +344,36 @@ while true; do done"# ); let mut sandbox = SandboxGuard::create_keep_with_args( - &["--provider", PROVIDER_NAME, "--policy", &policy_path], + &[ + "--provider", + PROVIDER_NAME, + "--policy", + &policy_path, + "--env", + "REFRESH_E2E_PROJECT=caller-project", + "--env", + "REFRESH_E2E_MODE=", + "--env", + "REFRESH_E2E_ACCESS_TOKEN=caller-token", + ], &["sh", "-c", &parent_script], READY_MARKER, ) .await?; let result = async { + sandbox + .exec(&[ + "sh", + "-c", + r#"test "$REFRESH_E2E_PROJECT" = caller-project && +test "${REFRESH_E2E_MODE+x}" = x && test -z "$REFRESH_E2E_MODE" && +test "$REFRESH_E2E_DEFAULT_PROJECT" = custom-profile-project && +test "$REFRESH_E2E_DEFAULT_MODE" = native && +case "$REFRESH_E2E_ACCESS_TOKEN" in openshell:resolve:env:s*_REFRESH_E2E_ACCESS_TOKEN) true;; *) false;; esac"#, + ]) + .await?; + if trigger_probe(&sandbox).await? != "ok" { return Err(format!( "initial long-running credential probe failed; fixture logs:\n{}", diff --git a/e2e/support/gateway-common.sh b/e2e/support/gateway-common.sh index f69518f0bc..268c06ece4 100644 --- a/e2e/support/gateway-common.sh +++ b/e2e/support/gateway-common.sh @@ -329,12 +329,22 @@ EOF e2e_import_example_provider_profiles() { local cli_bin=$1 local root=$2 + local profile adapter echo "Importing example provider profiles from ${root}/providers..." - if ! "${cli_bin}" provider profile import --from "${root}/providers" --global; then - echo "ERROR: failed to import example provider profiles" >&2 - return 1 - fi + for profile in "${root}"/providers/*.yaml; do + adapter="$(yq -r '.required_platform_adapter // ""' "${profile}")" || return 1 + # The standard test runtimes provide no platform adapters. Specialized + # suites must provision the capability before importing a profile needing it. + if [ -n "${adapter}" ]; then + echo "Skipping ${profile}: requires platform adapter ${adapter}" + continue + fi + if ! "${cli_bin}" provider profile import --file "${profile}" --global; then + echo "ERROR: failed to import example provider profile ${profile}" >&2 + return 1 + fi + done } # Register an administrator OIDC session for a gateway, non-interactively. diff --git a/proto/openshell.proto b/proto/openshell.proto index b40ec68263..538921881b 100644 --- a/proto/openshell.proto +++ b/proto/openshell.proto @@ -2545,6 +2545,17 @@ message ProviderCredentialRefreshStatus { message ProviderProfileDiscovery { // Credential names from ProviderProfile.credentials eligible for local discovery. repeated string credentials = 1; + // Non-secret environment keys copied into provider config under the same key. + repeated string config_env_vars = 2; +} + +// Bounded, non-secret environment defaults. Existing workload values win. +// Values are literal strings; interpolation and scripts are not supported. +message ProviderProfileEnvironment { + // Destination environment key -> provider config key. Blank config is skipped. + map config = 1; + // Destination environment key -> literal non-secret value. + map fixed = 2; } message GetProviderRefreshStatusRequest { @@ -2635,13 +2646,13 @@ message ProviderProfile { repeated openshell.sandbox.v1.NetworkBinary binaries = 7; bool inference_capable = 8; ProviderProfileDiscovery discovery = 9; - // Storage resource version for custom profiles. Built-in profiles and new - // profile files use 0. Gateway responses set this for stored custom profiles. + // Storage resource version. New profile files use 0; gateway responses set + // this for stored profiles. // Update calls use this for optimistic concurrency. uint64 resource_version = 10; // Optional non-secret annotations attached by profile sources or importers. map annotations = 11; - // Server-set provenance: "builtin", "user", or "interceptor/{name}". + // Server-set provenance: "user" or "interceptor/{name}". // Ignored on import/update payloads. string source = 12; // Server-set visibility: "platform", "workspace", or empty for @@ -2650,6 +2661,11 @@ message ProviderProfile { // EXPERIMENTAL: Non-secret files rendered from provider configuration for the // workload. This API and its behavior may change or be removed. repeated ProviderProfileFile files = 14; + // Non-secret environment defaults declared by this profile. + ProviderProfileEnvironment environment = 15; + // Named runtime capability required by this profile. Empty requires none. + // Import and attachment reject requirements unavailable in this deployment. + string required_platform_adapter = 16; } // EXPERIMENTAL: Provider file templates may change or be removed. diff --git a/providers/README.md b/providers/README.md index 9a721af9a8..5854280f17 100644 --- a/providers/README.md +++ b/providers/README.md @@ -16,14 +16,19 @@ openshell provider profile lint -f providers/github.yaml openshell provider profile import -f providers/github.yaml --global ``` -Or import the whole directory: +To import several profiles, put compatible copies in a separate directory: ```shell -openshell provider profile import --from providers --global +openshell provider profile import --from ./selected-profiles --global ``` Drop `--global` to import into the current workspace instead. +The `google-cloud.yaml` example requires the `gcp-metadata` platform adapter, +provided for Linux sandboxes by the supervisor. Windows/MXC does not provide +this adapter. The Vertex example uses bearer-token authentication and does not +require it. + ## Read the header before importing Every file opens with a comment block naming its expected client binaries, the @@ -48,6 +53,8 @@ workload, and import your copy. injection safe. - Keep `endpoints` limited to the hosts the credential should reach. A credential is only sent to the endpoints its profile declares. +- Review non-secret `environment` defaults, `discovery.config_env_vars`, and + `required_platform_adapter`. Renaming the profile preserves these declarations. - Run `openshell provider profile lint` before importing. See [Provider profiles](https://docs.nvidia.com/openshell/latest/how-it-works/providers/profiles) for the diff --git a/providers/google-cloud.yaml b/providers/google-cloud.yaml index 17fa04fa14..13f2ef3b1c 100644 --- a/providers/google-cloud.yaml +++ b/providers/google-cloud.yaml @@ -10,10 +10,9 @@ # below, so it has to name the paths in *your* image. # # Client binaries: none declared — this profile grants no egress. -# Reference layout: any image whose GCP SDKs honour the metadata server. The -# sandbox reaches credentials through OpenShell's GCE metadata -# emulator, so gcloud, google-cloud-* libraries and anything -# else using Application Default Credentials work unmodified. +# Reference layout: requires the gcp-metadata platform adapter, provided by +# the supervisor for Linux sandboxes. Windows/MXC does not +# provide this service. # Credential scope: a gateway-refreshed GCP access token, as GCP_SA_ACCESS_TOKEN # (service-account JWT flow) or GCP_ADC_ACCESS_TOKEN (gcloud # ADC flow). Configure the refresh material with @@ -31,6 +30,19 @@ display_name: Google Cloud (GCP APIs) description: Native GCP SDK credentials for sandboxes via metadata emulator category: other inference_capable: false +required_platform_adapter: gcp-metadata + +environment: + config: + GCP_PROJECT_ID: project_id + GOOGLE_CLOUD_PROJECT: project_id + CLOUD_ML_REGION: region + GCP_LOCATION: region + GCP_SERVICE_ACCOUNT_EMAIL: service_account_email + fixed: + GCE_METADATA_HOST: "127.0.0.1:8174" + GCE_METADATA_IP: "127.0.0.1:8174" + METADATA_SERVER_DETECTION: assume-present credentials: # Service account JWT flow: gateway signs a JWT and exchanges it for an diff --git a/providers/google-vertex-ai.yaml b/providers/google-vertex-ai.yaml index a0994e413e..15d2576169 100644 --- a/providers/google-vertex-ai.yaml +++ b/providers/google-vertex-ai.yaml @@ -18,8 +18,8 @@ # Credential scope: a gateway-refreshed Google access token, as # GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN (service-account JWT) # or GOOGLE_VERTEX_AI_TOKEN (gcloud ADC), sent as a bearer -# authorization header. GOOGLE_SERVICE_ACCOUNT_KEY is refresh -# bootstrap material and is never injected into the sandbox. +# authorization header. Supply service account private keys +# through refresh configuration, not provider credentials. # Endpoint access: the aiplatform.googleapis.com regional and replicated hosts, # read-write, L7 enforced. # Smoke test: openshell sandbox create --provider -- \ @@ -31,11 +31,17 @@ display_name: Google Vertex AI description: Google Vertex AI inference provider (Anthropic Claude, Gemini, and third-party models) category: inference inference_capable: true +environment: + config: + GCP_PROJECT_ID: VERTEX_AI_PROJECT_ID + GOOGLE_CLOUD_PROJECT: VERTEX_AI_PROJECT_ID + ANTHROPIC_VERTEX_PROJECT_ID: VERTEX_AI_PROJECT_ID + CLOUD_ML_REGION: VERTEX_AI_REGION + GCP_LOCATION: VERTEX_AI_REGION + VERTEX_LOCATION: VERTEX_AI_REGION + fixed: + GOOSE_PROVIDER: gcp_vertex_ai credentials: - - name: service_account_key - description: Google service account JSON refresh bootstrap material; not injected into sandboxes - env_vars: [GOOGLE_SERVICE_ACCOUNT_KEY] - required: false - name: service_account_token description: Google Cloud access token refreshed from service account JWT material env_vars: [GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN, VERTEX_AI_SERVICE_ACCOUNT_TOKEN] @@ -84,6 +90,12 @@ credentials: secret: true discovery: credentials: [service_account_token, gcloud_adc_token] + config_env_vars: + - VERTEX_AI_PROJECT_ID + - VERTEX_AI_REGION + - GOOGLE_VERTEX_AI_BASE_URL + - VERTEX_AI_BASE_URL + - VERTEX_AI_PUBLISHER endpoints: - host: "*-aiplatform.googleapis.com" port: 443 diff --git a/sdk/go/openshell/v1/internal/converter/coverage_test.go b/sdk/go/openshell/v1/internal/converter/coverage_test.go index 8a457d0014..d3b6fb8907 100644 --- a/sdk/go/openshell/v1/internal/converter/coverage_test.go +++ b/sdk/go/openshell/v1/internal/converter/coverage_test.go @@ -336,20 +336,22 @@ func TestConverterCoversAllProtoFields_SandboxPolicyRevision(t *testing.T) { func TestConverterCoversAllProtoFields_ProviderProfile(t *testing.T) { handled := fieldSet{ - "id": true, - "display_name": true, - "description": true, - "category": true, - "credentials": true, - "files": true, - "endpoints": true, - "binaries": true, - "inference_capable": true, - "discovery": true, - "resource_version": true, - "annotations": true, - "source": true, - "scope": true, + "id": true, + "display_name": true, + "description": true, + "category": true, + "credentials": true, + "files": true, + "endpoints": true, + "binaries": true, + "inference_capable": true, + "discovery": true, + "resource_version": true, + "annotations": true, + "source": true, + "scope": true, + "environment": true, + "required_platform_adapter": true, } assertAllFieldsCovered(t, (&pb.ProviderProfile{}).ProtoReflect().Descriptor(), handled, nil) diff --git a/sdk/go/openshell/v1/internal/converter/profile.go b/sdk/go/openshell/v1/internal/converter/profile.go index b3a5ee88c8..cf749b7374 100644 --- a/sdk/go/openshell/v1/internal/converter/profile.go +++ b/sdk/go/openshell/v1/internal/converter/profile.go @@ -344,15 +344,16 @@ func ProviderProfileFromProto(p *pb.ProviderProfile) *types.ProviderProfile { } result := &types.ProviderProfile{ - ID: p.GetId(), - DisplayName: p.GetDisplayName(), - Description: p.GetDescription(), - Category: ProfileCategoryFromProto(p.GetCategory()), - InferenceCapable: p.GetInferenceCapable(), - ResourceVersion: p.GetResourceVersion(), - Annotations: CopyStringMap(p.GetAnnotations()), - Source: p.GetSource(), - Scope: p.GetScope(), + ID: p.GetId(), + DisplayName: p.GetDisplayName(), + Description: p.GetDescription(), + Category: ProfileCategoryFromProto(p.GetCategory()), + InferenceCapable: p.GetInferenceCapable(), + ResourceVersion: p.GetResourceVersion(), + Annotations: CopyStringMap(p.GetAnnotations()), + Source: p.GetSource(), + Scope: p.GetScope(), + RequiredPlatformAdapter: p.GetRequiredPlatformAdapter(), } // Credentials @@ -400,7 +401,14 @@ func ProviderProfileFromProto(p *pb.ProviderProfile) *types.ProviderProfile { // Discovery if d := p.GetDiscovery(); d != nil { result.Discovery = types.ProfileDiscovery{ - Credentials: CopyStringSlice(d.GetCredentials()), + Credentials: CopyStringSlice(d.GetCredentials()), + ConfigEnvVars: CopyStringSlice(d.GetConfigEnvVars()), + } + } + if e := p.GetEnvironment(); e != nil { + result.Environment = &types.ProfileEnvironment{ + Config: CopyStringMap(e.GetConfig()), + Fixed: CopyStringMap(e.GetFixed()), } } @@ -414,15 +422,16 @@ func ProviderProfileToProto(p *types.ProviderProfile) *pb.ProviderProfile { } result := &pb.ProviderProfile{ - Id: p.ID, - DisplayName: p.DisplayName, - Description: p.Description, - Category: ProfileCategoryToProto(p.Category), - InferenceCapable: p.InferenceCapable, - ResourceVersion: p.ResourceVersion, - Annotations: CopyStringMap(p.Annotations), - Source: p.Source, - Scope: p.Scope, + Id: p.ID, + DisplayName: p.DisplayName, + Description: p.Description, + Category: ProfileCategoryToProto(p.Category), + InferenceCapable: p.InferenceCapable, + ResourceVersion: p.ResourceVersion, + Annotations: CopyStringMap(p.Annotations), + Source: p.Source, + Scope: p.Scope, + RequiredPlatformAdapter: p.RequiredPlatformAdapter, } // Credentials @@ -460,9 +469,16 @@ func ProviderProfileToProto(p *types.ProviderProfile) *pb.ProviderProfile { } // Discovery - if len(p.Discovery.Credentials) > 0 { + if len(p.Discovery.Credentials) > 0 || len(p.Discovery.ConfigEnvVars) > 0 { result.Discovery = &pb.ProviderProfileDiscovery{ - Credentials: CopyStringSlice(p.Discovery.Credentials), + Credentials: CopyStringSlice(p.Discovery.Credentials), + ConfigEnvVars: CopyStringSlice(p.Discovery.ConfigEnvVars), + } + } + if p.Environment != nil { + result.Environment = &pb.ProviderProfileEnvironment{ + Config: CopyStringMap(p.Environment.Config), + Fixed: CopyStringMap(p.Environment.Fixed), } } diff --git a/sdk/go/openshell/v1/internal/converter/profile_test.go b/sdk/go/openshell/v1/internal/converter/profile_test.go index 28f58533ba..965336af5c 100644 --- a/sdk/go/openshell/v1/internal/converter/profile_test.go +++ b/sdk/go/openshell/v1/internal/converter/profile_test.go @@ -465,6 +465,35 @@ func TestProfileDiagnosticFromProto_Nil(t *testing.T) { // --- ProviderProfile --- +func TestProviderProfileEnvironmentRoundTripAndCopies(t *testing.T) { + profile := &v1.ProviderProfile{ + ID: "custom", + RequiredPlatformAdapter: "gcp-metadata", + Environment: &v1.ProfileEnvironment{ + Config: map[string]string{"CUSTOM_PROJECT": "project"}, + Fixed: map[string]string{"CUSTOM_MODE": "native"}, + }, + Discovery: v1.ProfileDiscovery{ConfigEnvVars: []string{"CUSTOM_PROJECT"}}, + } + wire := ProviderProfileToProto(profile) + restored := ProviderProfileFromProto(wire) + assert.Equal(t, profile.Environment, restored.Environment) + assert.Equal(t, profile.Discovery, restored.Discovery) + assert.Equal(t, profile.RequiredPlatformAdapter, restored.RequiredPlatformAdapter) + profile.Environment.Config["CUSTOM_PROJECT"] = "changed-source" + profile.Environment.Fixed["CUSTOM_MODE"] = "changed-source" + profile.Discovery.ConfigEnvVars[0] = "CHANGED_SOURCE" + assert.Equal(t, "project", wire.Environment.Config["CUSTOM_PROJECT"]) + assert.Equal(t, "native", wire.Environment.Fixed["CUSTOM_MODE"]) + assert.Equal(t, "CUSTOM_PROJECT", wire.Discovery.ConfigEnvVars[0]) + wire.Environment.Config["CUSTOM_PROJECT"] = "changed-wire" + wire.Environment.Fixed["CUSTOM_MODE"] = "changed-wire" + wire.Discovery.ConfigEnvVars[0] = "CHANGED_WIRE" + assert.Equal(t, "project", restored.Environment.Config["CUSTOM_PROJECT"]) + assert.Equal(t, "native", restored.Environment.Fixed["CUSTOM_MODE"]) + assert.Equal(t, "CUSTOM_PROJECT", restored.Discovery.ConfigEnvVars[0]) +} + func TestProviderProfileFromProto(t *testing.T) { proto := &pb.ProviderProfile{ Id: "prof-1", diff --git a/sdk/go/openshell/v1/profile.go b/sdk/go/openshell/v1/profile.go index 7de1951e4f..6fec20a05c 100644 --- a/sdk/go/openshell/v1/profile.go +++ b/sdk/go/openshell/v1/profile.go @@ -27,6 +27,9 @@ type NetworkBinary = types.NetworkBinary // ProfileDiscovery holds local discovery configuration for a profile. type ProfileDiscovery = types.ProfileDiscovery +// ProfileEnvironment declares non-secret workload environment defaults. +type ProfileEnvironment = types.ProfileEnvironment + // ProfileImportItem is an item submitted for profile import or lint validation. type ProfileImportItem = types.ProfileImportItem diff --git a/sdk/go/openshell/v1/types/profile.go b/sdk/go/openshell/v1/types/profile.go index 1589eb2ab9..2242092672 100644 --- a/sdk/go/openshell/v1/types/profile.go +++ b/sdk/go/openshell/v1/types/profile.go @@ -26,15 +26,25 @@ type ProviderProfile struct { Category ProfileCategory Credentials []ProfileCredential // Files is EXPERIMENTAL. This API and its behavior may change or be removed. - Files []ProfileFile - Endpoints []NetworkEndpoint - Binaries []NetworkBinary - InferenceCapable bool - Discovery ProfileDiscovery - ResourceVersion uint64 - Annotations map[string]string - Source string - Scope string + Files []ProfileFile + Endpoints []NetworkEndpoint + Binaries []NetworkBinary + InferenceCapable bool + Discovery ProfileDiscovery + ResourceVersion uint64 + Annotations map[string]string + Source string + Scope string + Environment *ProfileEnvironment + RequiredPlatformAdapter string +} + +// ProfileEnvironment declares non-secret workload environment defaults. +type ProfileEnvironment struct { + // Config maps destination environment keys to provider config keys. + Config map[string]string + // Fixed maps destination environment keys to literal values. + Fixed map[string]string } // ProfileFile declares non-secret content served at a virtual sandbox path. @@ -153,7 +163,8 @@ type NetworkBinary struct { // ProfileDiscovery holds local discovery configuration for a profile. type ProfileDiscovery struct { - Credentials []string + Credentials []string + ConfigEnvVars []string } // ProfileImportItem is an item submitted for profile import or lint validation. diff --git a/sdk/go/proto/openshellv1/openshell.pb.go b/sdk/go/proto/openshellv1/openshell.pb.go index bb665f05ad..6894ed3e41 100644 --- a/sdk/go/proto/openshellv1/openshell.pb.go +++ b/sdk/go/proto/openshellv1/openshell.pb.go @@ -10252,7 +10252,9 @@ func (x *ProviderCredentialRefreshStatus) GetLastErrorTime() *timestamppb.Timest type ProviderProfileDiscovery struct { state protoimpl.MessageState `protogen:"open.v1"` // Credential names from ProviderProfile.credentials eligible for local discovery. - Credentials []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` + Credentials []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` + // Non-secret environment keys copied into provider config under the same key. + ConfigEnvVars []string `protobuf:"bytes,2,rep,name=config_env_vars,json=configEnvVars,proto3" json:"config_env_vars,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -10294,6 +10296,69 @@ func (x *ProviderProfileDiscovery) GetCredentials() []string { return nil } +func (x *ProviderProfileDiscovery) GetConfigEnvVars() []string { + if x != nil { + return x.ConfigEnvVars + } + return nil +} + +// Bounded, non-secret environment defaults. Existing workload values win. +// Values are literal strings; interpolation and scripts are not supported. +type ProviderProfileEnvironment struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Destination environment key -> provider config key. Blank config is skipped. + Config map[string]string `protobuf:"bytes,1,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + // Destination environment key -> literal non-secret value. + Fixed map[string]string `protobuf:"bytes,2,rep,name=fixed,proto3" json:"fixed,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ProviderProfileEnvironment) Reset() { + *x = ProviderProfileEnvironment{} + mi := &file_openshell_proto_msgTypes[121] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ProviderProfileEnvironment) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ProviderProfileEnvironment) ProtoMessage() {} + +func (x *ProviderProfileEnvironment) ProtoReflect() protoreflect.Message { + mi := &file_openshell_proto_msgTypes[121] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ProviderProfileEnvironment.ProtoReflect.Descriptor instead. +func (*ProviderProfileEnvironment) Descriptor() ([]byte, []int) { + return file_openshell_proto_rawDescGZIP(), []int{121} +} + +func (x *ProviderProfileEnvironment) GetConfig() map[string]string { + if x != nil { + return x.Config + } + return nil +} + +func (x *ProviderProfileEnvironment) GetFixed() map[string]string { + if x != nil { + return x.Fixed + } + return nil +} + type GetProviderRefreshStatusRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // Workspace scope. Only a named workspace selection is accepted. @@ -10306,7 +10371,7 @@ type GetProviderRefreshStatusRequest struct { func (x *GetProviderRefreshStatusRequest) Reset() { *x = GetProviderRefreshStatusRequest{} - mi := &file_openshell_proto_msgTypes[121] + mi := &file_openshell_proto_msgTypes[122] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10318,7 +10383,7 @@ func (x *GetProviderRefreshStatusRequest) String() string { func (*GetProviderRefreshStatusRequest) ProtoMessage() {} func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[121] + mi := &file_openshell_proto_msgTypes[122] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10331,7 +10396,7 @@ func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetProviderRefreshStatusRequest.ProtoReflect.Descriptor instead. func (*GetProviderRefreshStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{121} + return file_openshell_proto_rawDescGZIP(), []int{122} } func (x *GetProviderRefreshStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10364,7 +10429,7 @@ type GetProviderRefreshStatusResponse struct { func (x *GetProviderRefreshStatusResponse) Reset() { *x = GetProviderRefreshStatusResponse{} - mi := &file_openshell_proto_msgTypes[122] + mi := &file_openshell_proto_msgTypes[123] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10376,7 +10441,7 @@ func (x *GetProviderRefreshStatusResponse) String() string { func (*GetProviderRefreshStatusResponse) ProtoMessage() {} func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[122] + mi := &file_openshell_proto_msgTypes[123] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10389,7 +10454,7 @@ func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetProviderRefreshStatusResponse.ProtoReflect.Descriptor instead. func (*GetProviderRefreshStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{122} + return file_openshell_proto_rawDescGZIP(), []int{123} } func (x *GetProviderRefreshStatusResponse) GetCredentials() []*ProviderCredentialRefreshStatus { @@ -10421,7 +10486,7 @@ type ConfigureProviderRefreshRequest struct { func (x *ConfigureProviderRefreshRequest) Reset() { *x = ConfigureProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[123] + mi := &file_openshell_proto_msgTypes[124] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10433,7 +10498,7 @@ func (x *ConfigureProviderRefreshRequest) String() string { func (*ConfigureProviderRefreshRequest) ProtoMessage() {} func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[123] + mi := &file_openshell_proto_msgTypes[124] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10446,7 +10511,7 @@ func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigureProviderRefreshRequest.ProtoReflect.Descriptor instead. func (*ConfigureProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{123} + return file_openshell_proto_rawDescGZIP(), []int{124} } func (x *ConfigureProviderRefreshRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10514,7 +10579,7 @@ type ConfigureProviderRefreshResponse struct { func (x *ConfigureProviderRefreshResponse) Reset() { *x = ConfigureProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[124] + mi := &file_openshell_proto_msgTypes[125] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10526,7 +10591,7 @@ func (x *ConfigureProviderRefreshResponse) String() string { func (*ConfigureProviderRefreshResponse) ProtoMessage() {} func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[124] + mi := &file_openshell_proto_msgTypes[125] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10539,7 +10604,7 @@ func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigureProviderRefreshResponse.ProtoReflect.Descriptor instead. func (*ConfigureProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{124} + return file_openshell_proto_rawDescGZIP(), []int{125} } func (x *ConfigureProviderRefreshResponse) GetStatus() *ProviderCredentialRefreshStatus { @@ -10564,7 +10629,7 @@ type RotateProviderCredentialRequest struct { func (x *RotateProviderCredentialRequest) Reset() { *x = RotateProviderCredentialRequest{} - mi := &file_openshell_proto_msgTypes[125] + mi := &file_openshell_proto_msgTypes[126] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10576,7 +10641,7 @@ func (x *RotateProviderCredentialRequest) String() string { func (*RotateProviderCredentialRequest) ProtoMessage() {} func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[125] + mi := &file_openshell_proto_msgTypes[126] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10589,7 +10654,7 @@ func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RotateProviderCredentialRequest.ProtoReflect.Descriptor instead. func (*RotateProviderCredentialRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{125} + return file_openshell_proto_rawDescGZIP(), []int{126} } func (x *RotateProviderCredentialRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10629,7 +10694,7 @@ type RotateProviderCredentialResponse struct { func (x *RotateProviderCredentialResponse) Reset() { *x = RotateProviderCredentialResponse{} - mi := &file_openshell_proto_msgTypes[126] + mi := &file_openshell_proto_msgTypes[127] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10641,7 +10706,7 @@ func (x *RotateProviderCredentialResponse) String() string { func (*RotateProviderCredentialResponse) ProtoMessage() {} func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[126] + mi := &file_openshell_proto_msgTypes[127] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10654,7 +10719,7 @@ func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RotateProviderCredentialResponse.ProtoReflect.Descriptor instead. func (*RotateProviderCredentialResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{126} + return file_openshell_proto_rawDescGZIP(), []int{127} } func (x *RotateProviderCredentialResponse) GetStatus() *ProviderCredentialRefreshStatus { @@ -10680,7 +10745,7 @@ type DeleteProviderRefreshRequest struct { func (x *DeleteProviderRefreshRequest) Reset() { *x = DeleteProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[127] + mi := &file_openshell_proto_msgTypes[128] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10692,7 +10757,7 @@ func (x *DeleteProviderRefreshRequest) String() string { func (*DeleteProviderRefreshRequest) ProtoMessage() {} func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[127] + mi := &file_openshell_proto_msgTypes[128] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10705,7 +10770,7 @@ func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderRefreshRequest.ProtoReflect.Descriptor instead. func (*DeleteProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{127} + return file_openshell_proto_rawDescGZIP(), []int{128} } func (x *DeleteProviderRefreshRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10752,7 +10817,7 @@ type DeleteProviderRefreshResponse struct { func (x *DeleteProviderRefreshResponse) Reset() { *x = DeleteProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[128] + mi := &file_openshell_proto_msgTypes[129] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10764,7 +10829,7 @@ func (x *DeleteProviderRefreshResponse) String() string { func (*DeleteProviderRefreshResponse) ProtoMessage() {} func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[128] + mi := &file_openshell_proto_msgTypes[129] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10777,7 +10842,7 @@ func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderRefreshResponse.ProtoReflect.Descriptor instead. func (*DeleteProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{128} + return file_openshell_proto_rawDescGZIP(), []int{129} } func (x *DeleteProviderRefreshResponse) GetOutcome() DeletionOutcome { @@ -10799,13 +10864,13 @@ type ProviderProfile struct { Binaries []*sandboxv1.NetworkBinary `protobuf:"bytes,7,rep,name=binaries,proto3" json:"binaries,omitempty"` InferenceCapable bool `protobuf:"varint,8,opt,name=inference_capable,json=inferenceCapable,proto3" json:"inference_capable,omitempty"` Discovery *ProviderProfileDiscovery `protobuf:"bytes,9,opt,name=discovery,proto3" json:"discovery,omitempty"` - // Storage resource version for custom profiles. Built-in profiles and new - // profile files use 0. Gateway responses set this for stored custom profiles. + // Storage resource version. New profile files use 0; gateway responses set + // this for stored profiles. // Update calls use this for optimistic concurrency. ResourceVersion uint64 `protobuf:"varint,10,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"` // Optional non-secret annotations attached by profile sources or importers. Annotations map[string]string `protobuf:"bytes,11,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Server-set provenance: "builtin", "user", or "interceptor/{name}". + // Server-set provenance: "user" or "interceptor/{name}". // Ignored on import/update payloads. Source string `protobuf:"bytes,12,opt,name=source,proto3" json:"source,omitempty"` // Server-set visibility: "platform", "workspace", or empty for @@ -10813,14 +10878,19 @@ type ProviderProfile struct { Scope string `protobuf:"bytes,13,opt,name=scope,proto3" json:"scope,omitempty"` // EXPERIMENTAL: Non-secret files rendered from provider configuration for the // workload. This API and its behavior may change or be removed. - Files []*ProviderProfileFile `protobuf:"bytes,14,rep,name=files,proto3" json:"files,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + Files []*ProviderProfileFile `protobuf:"bytes,14,rep,name=files,proto3" json:"files,omitempty"` + // Non-secret environment defaults declared by this profile. + Environment *ProviderProfileEnvironment `protobuf:"bytes,15,opt,name=environment,proto3" json:"environment,omitempty"` + // Named runtime capability required by this profile. Empty requires none. + // Import and attachment reject requirements unavailable in this deployment. + RequiredPlatformAdapter string `protobuf:"bytes,16,opt,name=required_platform_adapter,json=requiredPlatformAdapter,proto3" json:"required_platform_adapter,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ProviderProfile) Reset() { *x = ProviderProfile{} - mi := &file_openshell_proto_msgTypes[129] + mi := &file_openshell_proto_msgTypes[130] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10832,7 +10902,7 @@ func (x *ProviderProfile) String() string { func (*ProviderProfile) ProtoMessage() {} func (x *ProviderProfile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[129] + mi := &file_openshell_proto_msgTypes[130] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10845,7 +10915,7 @@ func (x *ProviderProfile) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderProfile.ProtoReflect.Descriptor instead. func (*ProviderProfile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{129} + return file_openshell_proto_rawDescGZIP(), []int{130} } func (x *ProviderProfile) GetId() string { @@ -10946,6 +11016,20 @@ func (x *ProviderProfile) GetFiles() []*ProviderProfileFile { return nil } +func (x *ProviderProfile) GetEnvironment() *ProviderProfileEnvironment { + if x != nil { + return x.Environment + } + return nil +} + +func (x *ProviderProfile) GetRequiredPlatformAdapter() string { + if x != nil { + return x.RequiredPlatformAdapter + } + return "" +} + // EXPERIMENTAL: Provider file templates may change or be removed. type ProviderProfileFile struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -10961,7 +11045,7 @@ type ProviderProfileFile struct { func (x *ProviderProfileFile) Reset() { *x = ProviderProfileFile{} - mi := &file_openshell_proto_msgTypes[130] + mi := &file_openshell_proto_msgTypes[131] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10973,7 +11057,7 @@ func (x *ProviderProfileFile) String() string { func (*ProviderProfileFile) ProtoMessage() {} func (x *ProviderProfileFile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[130] + mi := &file_openshell_proto_msgTypes[131] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10986,7 +11070,7 @@ func (x *ProviderProfileFile) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderProfileFile.ProtoReflect.Descriptor instead. func (*ProviderProfileFile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{130} + return file_openshell_proto_rawDescGZIP(), []int{131} } func (x *ProviderProfileFile) GetPath() string { @@ -11020,7 +11104,7 @@ type ProviderProfileResponse struct { func (x *ProviderProfileResponse) Reset() { *x = ProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[131] + mi := &file_openshell_proto_msgTypes[132] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11032,7 +11116,7 @@ func (x *ProviderProfileResponse) String() string { func (*ProviderProfileResponse) ProtoMessage() {} func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[131] + mi := &file_openshell_proto_msgTypes[132] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11045,7 +11129,7 @@ func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderProfileResponse.ProtoReflect.Descriptor instead. func (*ProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{131} + return file_openshell_proto_rawDescGZIP(), []int{132} } func (x *ProviderProfileResponse) GetProfile() *ProviderProfile { @@ -11067,7 +11151,7 @@ type ListProviderProfilesResponse struct { func (x *ListProviderProfilesResponse) Reset() { *x = ListProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[132] + mi := &file_openshell_proto_msgTypes[133] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11079,7 +11163,7 @@ func (x *ListProviderProfilesResponse) String() string { func (*ListProviderProfilesResponse) ProtoMessage() {} func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[132] + mi := &file_openshell_proto_msgTypes[133] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11092,7 +11176,7 @@ func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*ListProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{132} + return file_openshell_proto_rawDescGZIP(), []int{133} } func (x *ListProviderProfilesResponse) GetProfiles() []*ProviderProfile { @@ -11124,7 +11208,7 @@ type ImportProviderProfilesRequest struct { func (x *ImportProviderProfilesRequest) Reset() { *x = ImportProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[133] + mi := &file_openshell_proto_msgTypes[134] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11136,7 +11220,7 @@ func (x *ImportProviderProfilesRequest) String() string { func (*ImportProviderProfilesRequest) ProtoMessage() {} func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[133] + mi := &file_openshell_proto_msgTypes[134] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11149,7 +11233,7 @@ func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ImportProviderProfilesRequest.ProtoReflect.Descriptor instead. func (*ImportProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{133} + return file_openshell_proto_rawDescGZIP(), []int{134} } func (x *ImportProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11185,7 +11269,7 @@ type ImportProviderProfilesResponse struct { func (x *ImportProviderProfilesResponse) Reset() { *x = ImportProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[134] + mi := &file_openshell_proto_msgTypes[135] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11197,7 +11281,7 @@ func (x *ImportProviderProfilesResponse) String() string { func (*ImportProviderProfilesResponse) ProtoMessage() {} func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[134] + mi := &file_openshell_proto_msgTypes[135] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11210,7 +11294,7 @@ func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ImportProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*ImportProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{134} + return file_openshell_proto_rawDescGZIP(), []int{135} } func (x *ImportProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { @@ -11256,7 +11340,7 @@ type UpdateProviderProfilesRequest struct { func (x *UpdateProviderProfilesRequest) Reset() { *x = UpdateProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[135] + mi := &file_openshell_proto_msgTypes[136] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11268,7 +11352,7 @@ func (x *UpdateProviderProfilesRequest) String() string { func (*UpdateProviderProfilesRequest) ProtoMessage() {} func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[135] + mi := &file_openshell_proto_msgTypes[136] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11281,7 +11365,7 @@ func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateProviderProfilesRequest.ProtoReflect.Descriptor instead. func (*UpdateProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{135} + return file_openshell_proto_rawDescGZIP(), []int{136} } func (x *UpdateProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11331,7 +11415,7 @@ type UpdateProviderProfilesResponse struct { func (x *UpdateProviderProfilesResponse) Reset() { *x = UpdateProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[136] + mi := &file_openshell_proto_msgTypes[137] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11343,7 +11427,7 @@ func (x *UpdateProviderProfilesResponse) String() string { func (*UpdateProviderProfilesResponse) ProtoMessage() {} func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[136] + mi := &file_openshell_proto_msgTypes[137] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11356,7 +11440,7 @@ func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*UpdateProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{136} + return file_openshell_proto_rawDescGZIP(), []int{137} } func (x *UpdateProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { @@ -11392,7 +11476,7 @@ type LintProviderProfilesRequest struct { func (x *LintProviderProfilesRequest) Reset() { *x = LintProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[137] + mi := &file_openshell_proto_msgTypes[138] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11404,7 +11488,7 @@ func (x *LintProviderProfilesRequest) String() string { func (*LintProviderProfilesRequest) ProtoMessage() {} func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[137] + mi := &file_openshell_proto_msgTypes[138] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11417,7 +11501,7 @@ func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use LintProviderProfilesRequest.ProtoReflect.Descriptor instead. func (*LintProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{137} + return file_openshell_proto_rawDescGZIP(), []int{138} } func (x *LintProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11448,7 +11532,7 @@ type LintProviderProfilesResponse struct { func (x *LintProviderProfilesResponse) Reset() { *x = LintProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[138] + mi := &file_openshell_proto_msgTypes[139] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11460,7 +11544,7 @@ func (x *LintProviderProfilesResponse) String() string { func (*LintProviderProfilesResponse) ProtoMessage() {} func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[138] + mi := &file_openshell_proto_msgTypes[139] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11473,7 +11557,7 @@ func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use LintProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*LintProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{138} + return file_openshell_proto_rawDescGZIP(), []int{139} } func (x *LintProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { @@ -11507,7 +11591,7 @@ type DeleteProviderResponse struct { func (x *DeleteProviderResponse) Reset() { *x = DeleteProviderResponse{} - mi := &file_openshell_proto_msgTypes[139] + mi := &file_openshell_proto_msgTypes[140] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11519,7 +11603,7 @@ func (x *DeleteProviderResponse) String() string { func (*DeleteProviderResponse) ProtoMessage() {} func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[139] + mi := &file_openshell_proto_msgTypes[140] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11532,7 +11616,7 @@ func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderResponse.ProtoReflect.Descriptor instead. func (*DeleteProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{139} + return file_openshell_proto_rawDescGZIP(), []int{140} } func (x *DeleteProviderResponse) GetOutcome() DeletionOutcome { @@ -11558,7 +11642,7 @@ type DeleteProviderProfileRequest struct { func (x *DeleteProviderProfileRequest) Reset() { *x = DeleteProviderProfileRequest{} - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[141] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11570,7 +11654,7 @@ func (x *DeleteProviderProfileRequest) String() string { func (*DeleteProviderProfileRequest) ProtoMessage() {} func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[141] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11583,7 +11667,7 @@ func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderProfileRequest.ProtoReflect.Descriptor instead. func (*DeleteProviderProfileRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{140} + return file_openshell_proto_rawDescGZIP(), []int{141} } func (x *DeleteProviderProfileRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11624,7 +11708,7 @@ type DeleteProviderProfileResponse struct { func (x *DeleteProviderProfileResponse) Reset() { *x = DeleteProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[142] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11636,7 +11720,7 @@ func (x *DeleteProviderProfileResponse) String() string { func (*DeleteProviderProfileResponse) ProtoMessage() {} func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[142] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11649,7 +11733,7 @@ func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderProfileResponse.ProtoReflect.Descriptor instead. func (*DeleteProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{141} + return file_openshell_proto_rawDescGZIP(), []int{142} } func (x *DeleteProviderProfileResponse) GetOutcome() DeletionOutcome { @@ -11678,7 +11762,7 @@ type GetSandboxProviderEnvironmentRequest struct { func (x *GetSandboxProviderEnvironmentRequest) Reset() { *x = GetSandboxProviderEnvironmentRequest{} - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[143] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11690,7 +11774,7 @@ func (x *GetSandboxProviderEnvironmentRequest) String() string { func (*GetSandboxProviderEnvironmentRequest) ProtoMessage() {} func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[143] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11703,7 +11787,7 @@ func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Messa // Deprecated: Use GetSandboxProviderEnvironmentRequest.ProtoReflect.Descriptor instead. func (*GetSandboxProviderEnvironmentRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{142} + return file_openshell_proto_rawDescGZIP(), []int{143} } func (x *GetSandboxProviderEnvironmentRequest) GetSandboxId() string { @@ -11739,7 +11823,7 @@ type StaticCredentialEndpointBinding struct { func (x *StaticCredentialEndpointBinding) Reset() { *x = StaticCredentialEndpointBinding{} - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[144] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11751,7 +11835,7 @@ func (x *StaticCredentialEndpointBinding) String() string { func (*StaticCredentialEndpointBinding) ProtoMessage() {} func (x *StaticCredentialEndpointBinding) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[144] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11764,7 +11848,7 @@ func (x *StaticCredentialEndpointBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use StaticCredentialEndpointBinding.ProtoReflect.Descriptor instead. func (*StaticCredentialEndpointBinding) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{143} + return file_openshell_proto_rawDescGZIP(), []int{144} } func (x *StaticCredentialEndpointBinding) GetHost() string { @@ -11808,7 +11892,7 @@ type StaticCredentialBinding struct { func (x *StaticCredentialBinding) Reset() { *x = StaticCredentialBinding{} - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[145] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11820,7 +11904,7 @@ func (x *StaticCredentialBinding) String() string { func (*StaticCredentialBinding) ProtoMessage() {} func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[145] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11833,7 +11917,7 @@ func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use StaticCredentialBinding.ProtoReflect.Descriptor instead. func (*StaticCredentialBinding) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{144} + return file_openshell_proto_rawDescGZIP(), []int{145} } func (x *StaticCredentialBinding) GetEndpoints() []*StaticCredentialEndpointBinding { @@ -11903,7 +11987,7 @@ type GetSandboxProviderEnvironmentResponse struct { func (x *GetSandboxProviderEnvironmentResponse) Reset() { *x = GetSandboxProviderEnvironmentResponse{} - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[146] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11915,7 +11999,7 @@ func (x *GetSandboxProviderEnvironmentResponse) String() string { func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {} func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[146] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11928,7 +12012,7 @@ func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Mess // Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead. func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{145} + return file_openshell_proto_rawDescGZIP(), []int{146} } func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string { @@ -12037,7 +12121,7 @@ type ProviderEnvironmentValue struct { func (x *ProviderEnvironmentValue) Reset() { *x = ProviderEnvironmentValue{} - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[147] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12049,7 +12133,7 @@ func (x *ProviderEnvironmentValue) String() string { func (*ProviderEnvironmentValue) ProtoMessage() {} func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[147] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12062,7 +12146,7 @@ func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentValue.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentValue) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{146} + return file_openshell_proto_rawDescGZIP(), []int{147} } func (x *ProviderEnvironmentValue) GetName() string { @@ -12128,7 +12212,7 @@ type ProviderEnvironmentSnapshot struct { func (x *ProviderEnvironmentSnapshot) Reset() { *x = ProviderEnvironmentSnapshot{} - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[148] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12140,7 +12224,7 @@ func (x *ProviderEnvironmentSnapshot) String() string { func (*ProviderEnvironmentSnapshot) ProtoMessage() {} func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[148] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12153,7 +12237,7 @@ func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentSnapshot.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentSnapshot) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{147} + return file_openshell_proto_rawDescGZIP(), []int{148} } func (x *ProviderEnvironmentSnapshot) GetProviderEnvRevision() uint64 { @@ -12222,7 +12306,7 @@ type ExchangeProviderSubjectTokenRequest struct { func (x *ExchangeProviderSubjectTokenRequest) Reset() { *x = ExchangeProviderSubjectTokenRequest{} - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[149] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12234,7 +12318,7 @@ func (x *ExchangeProviderSubjectTokenRequest) String() string { func (*ExchangeProviderSubjectTokenRequest) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[149] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12247,7 +12331,7 @@ func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Messag // Deprecated: Use ExchangeProviderSubjectTokenRequest.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{148} + return file_openshell_proto_rawDescGZIP(), []int{149} } func (x *ExchangeProviderSubjectTokenRequest) GetSandboxId() string { @@ -12289,7 +12373,7 @@ type ExchangeProviderSubjectTokenResponse struct { func (x *ExchangeProviderSubjectTokenResponse) Reset() { *x = ExchangeProviderSubjectTokenResponse{} - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[150] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12301,7 +12385,7 @@ func (x *ExchangeProviderSubjectTokenResponse) String() string { func (*ExchangeProviderSubjectTokenResponse) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[150] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12314,7 +12398,7 @@ func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Messa // Deprecated: Use ExchangeProviderSubjectTokenResponse.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{149} + return file_openshell_proto_rawDescGZIP(), []int{150} } func (x *ExchangeProviderSubjectTokenResponse) GetAccessToken() string { @@ -12388,7 +12472,7 @@ type UpdateConfigRequest struct { func (x *UpdateConfigRequest) Reset() { *x = UpdateConfigRequest{} - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[151] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12400,7 +12484,7 @@ func (x *UpdateConfigRequest) String() string { func (*UpdateConfigRequest) ProtoMessage() {} func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[151] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12413,7 +12497,7 @@ func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead. func (*UpdateConfigRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{150} + return file_openshell_proto_rawDescGZIP(), []int{151} } func (x *UpdateConfigRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -12510,7 +12594,7 @@ type PolicyMergeOperation struct { func (x *PolicyMergeOperation) Reset() { *x = PolicyMergeOperation{} - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[152] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12522,7 +12606,7 @@ func (x *PolicyMergeOperation) String() string { func (*PolicyMergeOperation) ProtoMessage() {} func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[152] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12535,7 +12619,7 @@ func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead. func (*PolicyMergeOperation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{151} + return file_openshell_proto_rawDescGZIP(), []int{152} } func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation { @@ -12649,7 +12733,7 @@ type AddNetworkRule struct { func (x *AddNetworkRule) Reset() { *x = AddNetworkRule{} - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[153] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12661,7 +12745,7 @@ func (x *AddNetworkRule) String() string { func (*AddNetworkRule) ProtoMessage() {} func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[153] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12674,7 +12758,7 @@ func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead. func (*AddNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{152} + return file_openshell_proto_rawDescGZIP(), []int{153} } func (x *AddNetworkRule) GetRuleName() string { @@ -12702,7 +12786,7 @@ type RemoveNetworkEndpoint struct { func (x *RemoveNetworkEndpoint) Reset() { *x = RemoveNetworkEndpoint{} - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[154] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12714,7 +12798,7 @@ func (x *RemoveNetworkEndpoint) String() string { func (*RemoveNetworkEndpoint) ProtoMessage() {} func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[154] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12727,7 +12811,7 @@ func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead. func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{153} + return file_openshell_proto_rawDescGZIP(), []int{154} } func (x *RemoveNetworkEndpoint) GetRuleName() string { @@ -12760,7 +12844,7 @@ type RemoveNetworkRule struct { func (x *RemoveNetworkRule) Reset() { *x = RemoveNetworkRule{} - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[155] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12772,7 +12856,7 @@ func (x *RemoveNetworkRule) String() string { func (*RemoveNetworkRule) ProtoMessage() {} func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[155] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12785,7 +12869,7 @@ func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead. func (*RemoveNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{154} + return file_openshell_proto_rawDescGZIP(), []int{155} } func (x *RemoveNetworkRule) GetRuleName() string { @@ -12814,7 +12898,7 @@ type L7RuleTarget struct { func (x *L7RuleTarget) Reset() { *x = L7RuleTarget{} - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[156] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12826,7 +12910,7 @@ func (x *L7RuleTarget) String() string { func (*L7RuleTarget) ProtoMessage() {} func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[156] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12839,7 +12923,7 @@ func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RuleTarget.ProtoReflect.Descriptor instead. func (*L7RuleTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{155} + return file_openshell_proto_rawDescGZIP(), []int{156} } func (x *L7RuleTarget) GetRuleName() string { @@ -12894,7 +12978,7 @@ type AddDenyRules struct { func (x *AddDenyRules) Reset() { *x = AddDenyRules{} - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[157] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12906,7 +12990,7 @@ func (x *AddDenyRules) String() string { func (*AddDenyRules) ProtoMessage() {} func (x *AddDenyRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[157] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12919,7 +13003,7 @@ func (x *AddDenyRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead. func (*AddDenyRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{156} + return file_openshell_proto_rawDescGZIP(), []int{157} } func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule { @@ -12946,7 +13030,7 @@ type AddAllowRules struct { func (x *AddAllowRules) Reset() { *x = AddAllowRules{} - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[158] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12958,7 +13042,7 @@ func (x *AddAllowRules) String() string { func (*AddAllowRules) ProtoMessage() {} func (x *AddAllowRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[158] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12971,7 +13055,7 @@ func (x *AddAllowRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead. func (*AddAllowRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{157} + return file_openshell_proto_rawDescGZIP(), []int{158} } func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule { @@ -12998,7 +13082,7 @@ type RemoveNetworkBinary struct { func (x *RemoveNetworkBinary) Reset() { *x = RemoveNetworkBinary{} - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[159] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13010,7 +13094,7 @@ func (x *RemoveNetworkBinary) String() string { func (*RemoveNetworkBinary) ProtoMessage() {} func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[159] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13023,7 +13107,7 @@ func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead. func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{158} + return file_openshell_proto_rawDescGZIP(), []int{159} } func (x *RemoveNetworkBinary) GetRuleName() string { @@ -13059,7 +13143,7 @@ type UpdateConfigResponse struct { func (x *UpdateConfigResponse) Reset() { *x = UpdateConfigResponse{} - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[160] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13071,7 +13155,7 @@ func (x *UpdateConfigResponse) String() string { func (*UpdateConfigResponse) ProtoMessage() {} func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[160] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13084,7 +13168,7 @@ func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead. func (*UpdateConfigResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{159} + return file_openshell_proto_rawDescGZIP(), []int{160} } func (x *UpdateConfigResponse) GetVersion() uint32 { @@ -13138,7 +13222,7 @@ type GetSandboxPolicyStatusRequest struct { func (x *GetSandboxPolicyStatusRequest) Reset() { *x = GetSandboxPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[161] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13150,7 +13234,7 @@ func (x *GetSandboxPolicyStatusRequest) String() string { func (*GetSandboxPolicyStatusRequest) ProtoMessage() {} func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[161] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13163,7 +13247,7 @@ func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{160} + return file_openshell_proto_rawDescGZIP(), []int{161} } func (x *GetSandboxPolicyStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13207,7 +13291,7 @@ type GetSandboxPolicyStatusResponse struct { func (x *GetSandboxPolicyStatusResponse) Reset() { *x = GetSandboxPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[162] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13219,7 +13303,7 @@ func (x *GetSandboxPolicyStatusResponse) String() string { func (*GetSandboxPolicyStatusResponse) ProtoMessage() {} func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[162] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13232,7 +13316,7 @@ func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{161} + return file_openshell_proto_rawDescGZIP(), []int{162} } func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision { @@ -13269,7 +13353,7 @@ type ListSandboxPoliciesRequest struct { func (x *ListSandboxPoliciesRequest) Reset() { *x = ListSandboxPoliciesRequest{} - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[163] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13281,7 +13365,7 @@ func (x *ListSandboxPoliciesRequest) String() string { func (*ListSandboxPoliciesRequest) ProtoMessage() {} func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[163] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13294,7 +13378,7 @@ func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{162} + return file_openshell_proto_rawDescGZIP(), []int{163} } func (x *ListSandboxPoliciesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13346,7 +13430,7 @@ type ListSandboxPoliciesResponse struct { func (x *ListSandboxPoliciesResponse) Reset() { *x = ListSandboxPoliciesResponse{} - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[164] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13358,7 +13442,7 @@ func (x *ListSandboxPoliciesResponse) String() string { func (*ListSandboxPoliciesResponse) ProtoMessage() {} func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[164] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13371,7 +13455,7 @@ func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{163} + return file_openshell_proto_rawDescGZIP(), []int{164} } func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision { @@ -13405,7 +13489,7 @@ type ReportPolicyStatusRequest struct { func (x *ReportPolicyStatusRequest) Reset() { *x = ReportPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[165] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13417,7 +13501,7 @@ func (x *ReportPolicyStatusRequest) String() string { func (*ReportPolicyStatusRequest) ProtoMessage() {} func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[165] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13430,7 +13514,7 @@ func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{164} + return file_openshell_proto_rawDescGZIP(), []int{165} } func (x *ReportPolicyStatusRequest) GetSandboxId() string { @@ -13470,7 +13554,7 @@ type ReportPolicyStatusResponse struct { func (x *ReportPolicyStatusResponse) Reset() { *x = ReportPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[166] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13482,7 +13566,7 @@ func (x *ReportPolicyStatusResponse) String() string { func (*ReportPolicyStatusResponse) ProtoMessage() {} func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[166] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13495,7 +13579,7 @@ func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{165} + return file_openshell_proto_rawDescGZIP(), []int{166} } type SandboxConfigurationAdmission struct { @@ -13513,7 +13597,7 @@ type SandboxConfigurationAdmission struct { func (x *SandboxConfigurationAdmission) Reset() { *x = SandboxConfigurationAdmission{} - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[167] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13525,7 +13609,7 @@ func (x *SandboxConfigurationAdmission) String() string { func (*SandboxConfigurationAdmission) ProtoMessage() {} func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[167] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13538,7 +13622,7 @@ func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxConfigurationAdmission.ProtoReflect.Descriptor instead. func (*SandboxConfigurationAdmission) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{166} + return file_openshell_proto_rawDescGZIP(), []int{167} } func (x *SandboxConfigurationAdmission) GetInstanceId() string { @@ -13602,7 +13686,7 @@ type ReportSandboxConfigurationRequest struct { func (x *ReportSandboxConfigurationRequest) Reset() { *x = ReportSandboxConfigurationRequest{} - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[168] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13614,7 +13698,7 @@ func (x *ReportSandboxConfigurationRequest) String() string { func (*ReportSandboxConfigurationRequest) ProtoMessage() {} func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[168] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13627,7 +13711,7 @@ func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationRequest.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{167} + return file_openshell_proto_rawDescGZIP(), []int{168} } func (x *ReportSandboxConfigurationRequest) GetSandboxId() string { @@ -13659,7 +13743,7 @@ type ReportSandboxConfigurationResponse struct { func (x *ReportSandboxConfigurationResponse) Reset() { *x = ReportSandboxConfigurationResponse{} - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[169] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13671,7 +13755,7 @@ func (x *ReportSandboxConfigurationResponse) String() string { func (*ReportSandboxConfigurationResponse) ProtoMessage() {} func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[169] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13684,7 +13768,7 @@ func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationResponse.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{168} + return file_openshell_proto_rawDescGZIP(), []int{169} } // A versioned policy revision with metadata. @@ -13717,7 +13801,7 @@ type SandboxPolicyRevision struct { func (x *SandboxPolicyRevision) Reset() { *x = SandboxPolicyRevision{} - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[170] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13729,7 +13813,7 @@ func (x *SandboxPolicyRevision) String() string { func (*SandboxPolicyRevision) ProtoMessage() {} func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[170] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13742,7 +13826,7 @@ func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead. func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{169} + return file_openshell_proto_rawDescGZIP(), []int{170} } func (x *SandboxPolicyRevision) GetVersion() uint32 { @@ -13822,7 +13906,7 @@ type GetSandboxLogsRequest struct { func (x *GetSandboxLogsRequest) Reset() { *x = GetSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[171] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13834,7 +13918,7 @@ func (x *GetSandboxLogsRequest) String() string { func (*GetSandboxLogsRequest) ProtoMessage() {} func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[171] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13847,7 +13931,7 @@ func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{170} + return file_openshell_proto_rawDescGZIP(), []int{171} } func (x *GetSandboxLogsRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13905,7 +13989,7 @@ type PushSandboxLogsRequest struct { func (x *PushSandboxLogsRequest) Reset() { *x = PushSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[172] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13917,7 +14001,7 @@ func (x *PushSandboxLogsRequest) String() string { func (*PushSandboxLogsRequest) ProtoMessage() {} func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[172] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13930,7 +14014,7 @@ func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{171} + return file_openshell_proto_rawDescGZIP(), []int{172} } func (x *PushSandboxLogsRequest) GetSandboxId() string { @@ -13956,7 +14040,7 @@ type PushSandboxLogsResponse struct { func (x *PushSandboxLogsResponse) Reset() { *x = PushSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[173] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13968,7 +14052,7 @@ func (x *PushSandboxLogsResponse) String() string { func (*PushSandboxLogsResponse) ProtoMessage() {} func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[173] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13981,7 +14065,7 @@ func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{172} + return file_openshell_proto_rawDescGZIP(), []int{173} } // Get sandbox logs response. @@ -13997,7 +14081,7 @@ type GetSandboxLogsResponse struct { func (x *GetSandboxLogsResponse) Reset() { *x = GetSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[174] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14009,7 +14093,7 @@ func (x *GetSandboxLogsResponse) String() string { func (*GetSandboxLogsResponse) ProtoMessage() {} func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[174] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14022,7 +14106,7 @@ func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{173} + return file_openshell_proto_rawDescGZIP(), []int{174} } func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine { @@ -14056,7 +14140,7 @@ type SupervisorMessage struct { func (x *SupervisorMessage) Reset() { *x = SupervisorMessage{} - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[175] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14068,7 +14152,7 @@ func (x *SupervisorMessage) String() string { func (*SupervisorMessage) ProtoMessage() {} func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[175] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14081,7 +14165,7 @@ func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead. func (*SupervisorMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{174} + return file_openshell_proto_rawDescGZIP(), []int{175} } func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload { @@ -14189,7 +14273,7 @@ type GatewayMessage struct { func (x *GatewayMessage) Reset() { *x = GatewayMessage{} - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[176] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14201,7 +14285,7 @@ func (x *GatewayMessage) String() string { func (*GatewayMessage) ProtoMessage() {} func (x *GatewayMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[176] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14214,7 +14298,7 @@ func (x *GatewayMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead. func (*GatewayMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{175} + return file_openshell_proto_rawDescGZIP(), []int{176} } func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload { @@ -14365,7 +14449,7 @@ type SupervisorHello struct { func (x *SupervisorHello) Reset() { *x = SupervisorHello{} - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[177] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14377,7 +14461,7 @@ func (x *SupervisorHello) String() string { func (*SupervisorHello) ProtoMessage() {} func (x *SupervisorHello) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[177] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14390,7 +14474,7 @@ func (x *SupervisorHello) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead. func (*SupervisorHello) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{176} + return file_openshell_proto_rawDescGZIP(), []int{177} } func (x *SupervisorHello) GetSandboxId() string { @@ -14463,7 +14547,7 @@ type SessionAccepted struct { func (x *SessionAccepted) Reset() { *x = SessionAccepted{} - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[178] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14475,7 +14559,7 @@ func (x *SessionAccepted) String() string { func (*SessionAccepted) ProtoMessage() {} func (x *SessionAccepted) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[178] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14488,7 +14572,7 @@ func (x *SessionAccepted) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead. func (*SessionAccepted) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{177} + return file_openshell_proto_rawDescGZIP(), []int{178} } func (x *SessionAccepted) GetSessionId() string { @@ -14537,7 +14621,7 @@ type ConfigUpdate struct { func (x *ConfigUpdate) Reset() { *x = ConfigUpdate{} - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[179] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14549,7 +14633,7 @@ func (x *ConfigUpdate) String() string { func (*ConfigUpdate) ProtoMessage() {} func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[179] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14562,7 +14646,7 @@ func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdate.ProtoReflect.Descriptor instead. func (*ConfigUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{178} + return file_openshell_proto_rawDescGZIP(), []int{179} } func (x *ConfigUpdate) GetUpdateId() string { @@ -14599,7 +14683,7 @@ type ConfigApplyFailure struct { func (x *ConfigApplyFailure) Reset() { *x = ConfigApplyFailure{} - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[180] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14611,7 +14695,7 @@ func (x *ConfigApplyFailure) String() string { func (*ConfigApplyFailure) ProtoMessage() {} func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[180] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14624,7 +14708,7 @@ func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigApplyFailure.ProtoReflect.Descriptor instead. func (*ConfigApplyFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{179} + return file_openshell_proto_rawDescGZIP(), []int{180} } func (x *ConfigApplyFailure) GetCode() string { @@ -14668,7 +14752,7 @@ type ConfigUpdateResult struct { func (x *ConfigUpdateResult) Reset() { *x = ConfigUpdateResult{} - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[181] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14680,7 +14764,7 @@ func (x *ConfigUpdateResult) String() string { func (*ConfigUpdateResult) ProtoMessage() {} func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[181] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14693,7 +14777,7 @@ func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdateResult.ProtoReflect.Descriptor instead. func (*ConfigUpdateResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{180} + return file_openshell_proto_rawDescGZIP(), []int{181} } func (x *ConfigUpdateResult) GetUpdateId() string { @@ -14744,7 +14828,7 @@ type PolicyLoadResult struct { func (x *PolicyLoadResult) Reset() { *x = PolicyLoadResult{} - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[182] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14756,7 +14840,7 @@ func (x *PolicyLoadResult) String() string { func (*PolicyLoadResult) ProtoMessage() {} func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[182] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14769,7 +14853,7 @@ func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyLoadResult.ProtoReflect.Descriptor instead. func (*PolicyLoadResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{181} + return file_openshell_proto_rawDescGZIP(), []int{182} } func (x *PolicyLoadResult) GetVersion() uint32 { @@ -14804,7 +14888,7 @@ type SessionRejected struct { func (x *SessionRejected) Reset() { *x = SessionRejected{} - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[183] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14816,7 +14900,7 @@ func (x *SessionRejected) String() string { func (*SessionRejected) ProtoMessage() {} func (x *SessionRejected) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[183] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14829,7 +14913,7 @@ func (x *SessionRejected) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead. func (*SessionRejected) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{182} + return file_openshell_proto_rawDescGZIP(), []int{183} } func (x *SessionRejected) GetReason() string { @@ -14858,7 +14942,7 @@ type SessionRedirect struct { func (x *SessionRedirect) Reset() { *x = SessionRedirect{} - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[184] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14870,7 +14954,7 @@ func (x *SessionRedirect) String() string { func (*SessionRedirect) ProtoMessage() {} func (x *SessionRedirect) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[184] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14883,7 +14967,7 @@ func (x *SessionRedirect) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRedirect.ProtoReflect.Descriptor instead. func (*SessionRedirect) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{183} + return file_openshell_proto_rawDescGZIP(), []int{184} } func (x *SessionRedirect) GetPeerEndpoint() string { @@ -14909,7 +14993,7 @@ type SupervisorHeartbeat struct { func (x *SupervisorHeartbeat) Reset() { *x = SupervisorHeartbeat{} - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[185] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14921,7 +15005,7 @@ func (x *SupervisorHeartbeat) String() string { func (*SupervisorHeartbeat) ProtoMessage() {} func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[185] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14934,7 +15018,7 @@ func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead. func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{184} + return file_openshell_proto_rawDescGZIP(), []int{185} } // Gateway heartbeat. @@ -14946,7 +15030,7 @@ type GatewayHeartbeat struct { func (x *GatewayHeartbeat) Reset() { *x = GatewayHeartbeat{} - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[186] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14958,7 +15042,7 @@ func (x *GatewayHeartbeat) String() string { func (*GatewayHeartbeat) ProtoMessage() {} func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[186] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14971,7 +15055,7 @@ func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead. func (*GatewayHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{185} + return file_openshell_proto_rawDescGZIP(), []int{186} } // Terminal result reported before the supervisor shuts down. A successful RPC @@ -14988,7 +15072,7 @@ type ReportMainProcessExitRequest struct { func (x *ReportMainProcessExitRequest) Reset() { *x = ReportMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[187] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15000,7 +15084,7 @@ func (x *ReportMainProcessExitRequest) String() string { func (*ReportMainProcessExitRequest) ProtoMessage() {} func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[187] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15013,7 +15097,7 @@ func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{186} + return file_openshell_proto_rawDescGZIP(), []int{187} } func (x *ReportMainProcessExitRequest) GetSandboxId() string { @@ -15045,7 +15129,7 @@ type ReportMainProcessExitResponse struct { func (x *ReportMainProcessExitResponse) Reset() { *x = ReportMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[188] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15057,7 +15141,7 @@ func (x *ReportMainProcessExitResponse) String() string { func (*ReportMainProcessExitResponse) ProtoMessage() {} func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[188] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15070,7 +15154,7 @@ func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{187} + return file_openshell_proto_rawDescGZIP(), []int{188} } // Terminal-delivery completion reported after all expected foreground SSH @@ -15085,7 +15169,7 @@ type FinalizeMainProcessExitRequest struct { func (x *FinalizeMainProcessExitRequest) Reset() { *x = FinalizeMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[189] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15097,7 +15181,7 @@ func (x *FinalizeMainProcessExitRequest) String() string { func (*FinalizeMainProcessExitRequest) ProtoMessage() {} func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[189] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15110,7 +15194,7 @@ func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{188} + return file_openshell_proto_rawDescGZIP(), []int{189} } func (x *FinalizeMainProcessExitRequest) GetSandboxId() string { @@ -15135,7 +15219,7 @@ type FinalizeMainProcessExitResponse struct { func (x *FinalizeMainProcessExitResponse) Reset() { *x = FinalizeMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[190] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15147,7 +15231,7 @@ func (x *FinalizeMainProcessExitResponse) String() string { func (*FinalizeMainProcessExitResponse) ProtoMessage() {} func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[190] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15160,7 +15244,7 @@ func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{189} + return file_openshell_proto_rawDescGZIP(), []int{190} } // Gateway requests the supervisor to open a relay channel. @@ -15189,7 +15273,7 @@ type RelayOpen struct { func (x *RelayOpen) Reset() { *x = RelayOpen{} - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[191] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15201,7 +15285,7 @@ func (x *RelayOpen) String() string { func (*RelayOpen) ProtoMessage() {} func (x *RelayOpen) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[191] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15214,7 +15298,7 @@ func (x *RelayOpen) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead. func (*RelayOpen) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{190} + return file_openshell_proto_rawDescGZIP(), []int{191} } func (x *RelayOpen) GetChannelId() string { @@ -15281,7 +15365,7 @@ type SshRelayTarget struct { func (x *SshRelayTarget) Reset() { *x = SshRelayTarget{} - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[192] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15293,7 +15377,7 @@ func (x *SshRelayTarget) String() string { func (*SshRelayTarget) ProtoMessage() {} func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[192] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15306,7 +15390,7 @@ func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead. func (*SshRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{191} + return file_openshell_proto_rawDescGZIP(), []int{192} } // TCP target dialed by the supervisor from inside the sandbox. @@ -15322,7 +15406,7 @@ type TcpRelayTarget struct { func (x *TcpRelayTarget) Reset() { *x = TcpRelayTarget{} - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[193] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15334,7 +15418,7 @@ func (x *TcpRelayTarget) String() string { func (*TcpRelayTarget) ProtoMessage() {} func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[193] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15347,7 +15431,7 @@ func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead. func (*TcpRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{192} + return file_openshell_proto_rawDescGZIP(), []int{193} } func (x *TcpRelayTarget) GetHost() string { @@ -15375,7 +15459,7 @@ type RelayInit struct { func (x *RelayInit) Reset() { *x = RelayInit{} - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[194] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15387,7 +15471,7 @@ func (x *RelayInit) String() string { func (*RelayInit) ProtoMessage() {} func (x *RelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[194] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15400,7 +15484,7 @@ func (x *RelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayInit.ProtoReflect.Descriptor instead. func (*RelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{193} + return file_openshell_proto_rawDescGZIP(), []int{194} } func (x *RelayInit) GetChannelId() string { @@ -15427,7 +15511,7 @@ type RelayFrame struct { func (x *RelayFrame) Reset() { *x = RelayFrame{} - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[195] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15439,7 +15523,7 @@ func (x *RelayFrame) String() string { func (*RelayFrame) ProtoMessage() {} func (x *RelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[195] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15452,7 +15536,7 @@ func (x *RelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead. func (*RelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{194} + return file_openshell_proto_rawDescGZIP(), []int{195} } func (x *RelayFrame) GetPayload() isRelayFrame_Payload { @@ -15512,7 +15596,7 @@ type PeerRelayInit struct { func (x *PeerRelayInit) Reset() { *x = PeerRelayInit{} - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[196] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15524,7 +15608,7 @@ func (x *PeerRelayInit) String() string { func (*PeerRelayInit) ProtoMessage() {} func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[196] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15537,7 +15621,7 @@ func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayInit.ProtoReflect.Descriptor instead. func (*PeerRelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{195} + return file_openshell_proto_rawDescGZIP(), []int{196} } func (x *PeerRelayInit) GetSandboxId() string { @@ -15575,7 +15659,7 @@ type PeerRelayFrame struct { func (x *PeerRelayFrame) Reset() { *x = PeerRelayFrame{} - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[197] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15587,7 +15671,7 @@ func (x *PeerRelayFrame) String() string { func (*PeerRelayFrame) ProtoMessage() {} func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[197] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15600,7 +15684,7 @@ func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayFrame.ProtoReflect.Descriptor instead. func (*PeerRelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{196} + return file_openshell_proto_rawDescGZIP(), []int{197} } func (x *PeerRelayFrame) GetPayload() isPeerRelayFrame_Payload { @@ -15655,7 +15739,7 @@ type PeerConfigSandboxTarget struct { func (x *PeerConfigSandboxTarget) Reset() { *x = PeerConfigSandboxTarget{} - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[198] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15667,7 +15751,7 @@ func (x *PeerConfigSandboxTarget) String() string { func (*PeerConfigSandboxTarget) ProtoMessage() {} func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[198] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15680,7 +15764,7 @@ func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigSandboxTarget.ProtoReflect.Descriptor instead. func (*PeerConfigSandboxTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{197} + return file_openshell_proto_rawDescGZIP(), []int{198} } func (x *PeerConfigSandboxTarget) GetSandboxId() string { @@ -15708,7 +15792,7 @@ type PeerConfigProviderTarget struct { func (x *PeerConfigProviderTarget) Reset() { *x = PeerConfigProviderTarget{} - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[199] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15720,7 +15804,7 @@ func (x *PeerConfigProviderTarget) String() string { func (*PeerConfigProviderTarget) ProtoMessage() {} func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[199] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15733,7 +15817,7 @@ func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigProviderTarget.ProtoReflect.Descriptor instead. func (*PeerConfigProviderTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{198} + return file_openshell_proto_rawDescGZIP(), []int{199} } func (x *PeerConfigProviderTarget) GetWorkspace() string { @@ -15765,7 +15849,7 @@ type PeerNotifyConfigUpdateRequest struct { func (x *PeerNotifyConfigUpdateRequest) Reset() { *x = PeerNotifyConfigUpdateRequest{} - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[200] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15777,7 +15861,7 @@ func (x *PeerNotifyConfigUpdateRequest) String() string { func (*PeerNotifyConfigUpdateRequest) ProtoMessage() {} func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[200] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15790,7 +15874,7 @@ func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateRequest.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{199} + return file_openshell_proto_rawDescGZIP(), []int{200} } func (x *PeerNotifyConfigUpdateRequest) GetScope() isPeerNotifyConfigUpdateRequest_Scope { @@ -15874,7 +15958,7 @@ type PeerNotifyConfigUpdateResponse struct { func (x *PeerNotifyConfigUpdateResponse) Reset() { *x = PeerNotifyConfigUpdateResponse{} - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[201] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15886,7 +15970,7 @@ func (x *PeerNotifyConfigUpdateResponse) String() string { func (*PeerNotifyConfigUpdateResponse) ProtoMessage() {} func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[201] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15899,7 +15983,7 @@ func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateResponse.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{200} + return file_openshell_proto_rawDescGZIP(), []int{201} } func (x *PeerNotifyConfigUpdateResponse) GetStaleOwner() bool { @@ -15924,7 +16008,7 @@ type RelayOpenResult struct { func (x *RelayOpenResult) Reset() { *x = RelayOpenResult{} - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[202] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15936,7 +16020,7 @@ func (x *RelayOpenResult) String() string { func (*RelayOpenResult) ProtoMessage() {} func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[202] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15949,7 +16033,7 @@ func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead. func (*RelayOpenResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{201} + return file_openshell_proto_rawDescGZIP(), []int{202} } func (x *RelayOpenResult) GetChannelId() string { @@ -15986,7 +16070,7 @@ type RelayClose struct { func (x *RelayClose) Reset() { *x = RelayClose{} - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[203] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15998,7 +16082,7 @@ func (x *RelayClose) String() string { func (*RelayClose) ProtoMessage() {} func (x *RelayClose) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[203] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16011,7 +16095,7 @@ func (x *RelayClose) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayClose.ProtoReflect.Descriptor instead. func (*RelayClose) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{202} + return file_openshell_proto_rawDescGZIP(), []int{203} } func (x *RelayClose) GetChannelId() string { @@ -16045,7 +16129,7 @@ type L7RequestSample struct { func (x *L7RequestSample) Reset() { *x = L7RequestSample{} - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[204] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16057,7 +16141,7 @@ func (x *L7RequestSample) String() string { func (*L7RequestSample) ProtoMessage() {} func (x *L7RequestSample) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[204] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16070,7 +16154,7 @@ func (x *L7RequestSample) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead. func (*L7RequestSample) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{203} + return file_openshell_proto_rawDescGZIP(), []int{204} } func (x *L7RequestSample) GetMethod() string { @@ -16144,7 +16228,7 @@ type DenialSummary struct { func (x *DenialSummary) Reset() { *x = DenialSummary{} - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[205] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16156,7 +16240,7 @@ func (x *DenialSummary) String() string { func (*DenialSummary) ProtoMessage() {} func (x *DenialSummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[205] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16169,7 +16253,7 @@ func (x *DenialSummary) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead. func (*DenialSummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{204} + return file_openshell_proto_rawDescGZIP(), []int{205} } func (x *DenialSummary) GetSandboxId() string { @@ -16304,7 +16388,7 @@ type DenialGroupCount struct { func (x *DenialGroupCount) Reset() { *x = DenialGroupCount{} - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[206] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16316,7 +16400,7 @@ func (x *DenialGroupCount) String() string { func (*DenialGroupCount) ProtoMessage() {} func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[206] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16329,7 +16413,7 @@ func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead. func (*DenialGroupCount) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{205} + return file_openshell_proto_rawDescGZIP(), []int{206} } func (x *DenialGroupCount) GetDenyGroup() string { @@ -16362,7 +16446,7 @@ type NetworkActivitySummary struct { func (x *NetworkActivitySummary) Reset() { *x = NetworkActivitySummary{} - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[207] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16374,7 +16458,7 @@ func (x *NetworkActivitySummary) String() string { func (*NetworkActivitySummary) ProtoMessage() {} func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[207] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16387,7 +16471,7 @@ func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { // Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead. func (*NetworkActivitySummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{206} + return file_openshell_proto_rawDescGZIP(), []int{207} } func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 { @@ -16475,7 +16559,7 @@ type PolicyChunk struct { func (x *PolicyChunk) Reset() { *x = PolicyChunk{} - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[208] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16487,7 +16571,7 @@ func (x *PolicyChunk) String() string { func (*PolicyChunk) ProtoMessage() {} func (x *PolicyChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[208] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16500,7 +16584,7 @@ func (x *PolicyChunk) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead. func (*PolicyChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{207} + return file_openshell_proto_rawDescGZIP(), []int{208} } func (x *PolicyChunk) GetId() string { @@ -16688,7 +16772,7 @@ type DraftPolicyUpdate struct { func (x *DraftPolicyUpdate) Reset() { *x = DraftPolicyUpdate{} - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[209] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16700,7 +16784,7 @@ func (x *DraftPolicyUpdate) String() string { func (*DraftPolicyUpdate) ProtoMessage() {} func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[209] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16713,7 +16797,7 @@ func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead. func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{208} + return file_openshell_proto_rawDescGZIP(), []int{209} } func (x *DraftPolicyUpdate) GetDraftVersion() uint64 { @@ -16772,7 +16856,7 @@ type SubmitPolicyAnalysisRequest struct { func (x *SubmitPolicyAnalysisRequest) Reset() { *x = SubmitPolicyAnalysisRequest{} - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[210] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16784,7 +16868,7 @@ func (x *SubmitPolicyAnalysisRequest) String() string { func (*SubmitPolicyAnalysisRequest) ProtoMessage() {} func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[210] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16797,7 +16881,7 @@ func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{209} + return file_openshell_proto_rawDescGZIP(), []int{210} } func (x *SubmitPolicyAnalysisRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16860,7 +16944,7 @@ type SubmitPolicyAnalysisResponse struct { func (x *SubmitPolicyAnalysisResponse) Reset() { *x = SubmitPolicyAnalysisResponse{} - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[211] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16872,7 +16956,7 @@ func (x *SubmitPolicyAnalysisResponse) String() string { func (*SubmitPolicyAnalysisResponse) ProtoMessage() {} func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[211] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16885,7 +16969,7 @@ func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{210} + return file_openshell_proto_rawDescGZIP(), []int{211} } func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 { @@ -16930,7 +17014,7 @@ type GetDraftPolicyRequest struct { func (x *GetDraftPolicyRequest) Reset() { *x = GetDraftPolicyRequest{} - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[212] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16942,7 +17026,7 @@ func (x *GetDraftPolicyRequest) String() string { func (*GetDraftPolicyRequest) ProtoMessage() {} func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[212] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16955,7 +17039,7 @@ func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead. func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{211} + return file_openshell_proto_rawDescGZIP(), []int{212} } func (x *GetDraftPolicyRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16995,7 +17079,7 @@ type GetDraftPolicyResponse struct { func (x *GetDraftPolicyResponse) Reset() { *x = GetDraftPolicyResponse{} - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[213] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17007,7 +17091,7 @@ func (x *GetDraftPolicyResponse) String() string { func (*GetDraftPolicyResponse) ProtoMessage() {} func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[213] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17020,7 +17104,7 @@ func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead. func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{212} + return file_openshell_proto_rawDescGZIP(), []int{213} } func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk { @@ -17071,7 +17155,7 @@ type ApproveDraftChunkRequest struct { func (x *ApproveDraftChunkRequest) Reset() { *x = ApproveDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[214] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17083,7 +17167,7 @@ func (x *ApproveDraftChunkRequest) String() string { func (*ApproveDraftChunkRequest) ProtoMessage() {} func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[214] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17096,7 +17180,7 @@ func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{213} + return file_openshell_proto_rawDescGZIP(), []int{214} } func (x *ApproveDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17146,7 +17230,7 @@ type ApproveDraftChunkResponse struct { func (x *ApproveDraftChunkResponse) Reset() { *x = ApproveDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[215] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17158,7 +17242,7 @@ func (x *ApproveDraftChunkResponse) String() string { func (*ApproveDraftChunkResponse) ProtoMessage() {} func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[215] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17171,7 +17255,7 @@ func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{214} + return file_openshell_proto_rawDescGZIP(), []int{215} } func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 { @@ -17207,7 +17291,7 @@ type RejectDraftChunkRequest struct { func (x *RejectDraftChunkRequest) Reset() { *x = RejectDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[216] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17219,7 +17303,7 @@ func (x *RejectDraftChunkRequest) String() string { func (*RejectDraftChunkRequest) ProtoMessage() {} func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[216] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17232,7 +17316,7 @@ func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead. func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{215} + return file_openshell_proto_rawDescGZIP(), []int{216} } func (x *RejectDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17278,7 +17362,7 @@ type RejectDraftChunkResponse struct { func (x *RejectDraftChunkResponse) Reset() { *x = RejectDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[217] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17290,7 +17374,7 @@ func (x *RejectDraftChunkResponse) String() string { func (*RejectDraftChunkResponse) ProtoMessage() {} func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[217] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17303,7 +17387,7 @@ func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead. func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{216} + return file_openshell_proto_rawDescGZIP(), []int{217} } // Approve all pending chunks. @@ -17317,7 +17401,7 @@ type DraftChunkApproval struct { func (x *DraftChunkApproval) Reset() { *x = DraftChunkApproval{} - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[218] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17329,7 +17413,7 @@ func (x *DraftChunkApproval) String() string { func (*DraftChunkApproval) ProtoMessage() {} func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[218] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17342,7 +17426,7 @@ func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftChunkApproval.ProtoReflect.Descriptor instead. func (*DraftChunkApproval) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{217} + return file_openshell_proto_rawDescGZIP(), []int{218} } func (x *DraftChunkApproval) GetChunkId() string { @@ -17378,7 +17462,7 @@ type ApproveAllDraftChunksRequest struct { func (x *ApproveAllDraftChunksRequest) Reset() { *x = ApproveAllDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[219] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17390,7 +17474,7 @@ func (x *ApproveAllDraftChunksRequest) String() string { func (*ApproveAllDraftChunksRequest) ProtoMessage() {} func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[219] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17403,7 +17487,7 @@ func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{218} + return file_openshell_proto_rawDescGZIP(), []int{219} } func (x *ApproveAllDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17458,7 +17542,7 @@ type ApproveAllDraftChunksResponse struct { func (x *ApproveAllDraftChunksResponse) Reset() { *x = ApproveAllDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[220] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17470,7 +17554,7 @@ func (x *ApproveAllDraftChunksResponse) String() string { func (*ApproveAllDraftChunksResponse) ProtoMessage() {} func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[220] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17483,7 +17567,7 @@ func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{219} + return file_openshell_proto_rawDescGZIP(), []int{220} } func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 { @@ -17533,7 +17617,7 @@ type EditDraftChunkRequest struct { func (x *EditDraftChunkRequest) Reset() { *x = EditDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[221] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17545,7 +17629,7 @@ func (x *EditDraftChunkRequest) String() string { func (*EditDraftChunkRequest) ProtoMessage() {} func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[221] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17558,7 +17642,7 @@ func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead. func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{220} + return file_openshell_proto_rawDescGZIP(), []int{221} } func (x *EditDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17604,7 +17688,7 @@ type EditDraftChunkResponse struct { func (x *EditDraftChunkResponse) Reset() { *x = EditDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[222] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17616,7 +17700,7 @@ func (x *EditDraftChunkResponse) String() string { func (*EditDraftChunkResponse) ProtoMessage() {} func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[222] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17629,7 +17713,7 @@ func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead. func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{221} + return file_openshell_proto_rawDescGZIP(), []int{222} } // Reverse an approval (remove merged rule from active policy). @@ -17649,7 +17733,7 @@ type UndoDraftChunkRequest struct { func (x *UndoDraftChunkRequest) Reset() { *x = UndoDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[223] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17661,7 +17745,7 @@ func (x *UndoDraftChunkRequest) String() string { func (*UndoDraftChunkRequest) ProtoMessage() {} func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[223] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17674,7 +17758,7 @@ func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead. func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{222} + return file_openshell_proto_rawDescGZIP(), []int{223} } func (x *UndoDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17717,7 +17801,7 @@ type UndoDraftChunkResponse struct { func (x *UndoDraftChunkResponse) Reset() { *x = UndoDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[224] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17729,7 +17813,7 @@ func (x *UndoDraftChunkResponse) String() string { func (*UndoDraftChunkResponse) ProtoMessage() {} func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[224] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17742,7 +17826,7 @@ func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead. func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{223} + return file_openshell_proto_rawDescGZIP(), []int{224} } func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 { @@ -17774,7 +17858,7 @@ type ClearDraftChunksRequest struct { func (x *ClearDraftChunksRequest) Reset() { *x = ClearDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[225] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17786,7 +17870,7 @@ func (x *ClearDraftChunksRequest) String() string { func (*ClearDraftChunksRequest) ProtoMessage() {} func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[225] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17799,7 +17883,7 @@ func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{224} + return file_openshell_proto_rawDescGZIP(), []int{225} } func (x *ClearDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17833,7 +17917,7 @@ type ClearDraftChunksResponse struct { func (x *ClearDraftChunksResponse) Reset() { *x = ClearDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[226] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17845,7 +17929,7 @@ func (x *ClearDraftChunksResponse) String() string { func (*ClearDraftChunksResponse) ProtoMessage() {} func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[226] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17858,7 +17942,7 @@ func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{225} + return file_openshell_proto_rawDescGZIP(), []int{226} } func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 { @@ -17880,7 +17964,7 @@ type GetDraftHistoryRequest struct { func (x *GetDraftHistoryRequest) Reset() { *x = GetDraftHistoryRequest{} - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[227] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17892,7 +17976,7 @@ func (x *GetDraftHistoryRequest) String() string { func (*GetDraftHistoryRequest) ProtoMessage() {} func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[227] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17905,7 +17989,7 @@ func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead. func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{226} + return file_openshell_proto_rawDescGZIP(), []int{227} } func (x *GetDraftHistoryRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17939,7 +18023,7 @@ type DraftHistoryEntry struct { func (x *DraftHistoryEntry) Reset() { *x = DraftHistoryEntry{} - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[228] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17951,7 +18035,7 @@ func (x *DraftHistoryEntry) String() string { func (*DraftHistoryEntry) ProtoMessage() {} func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[228] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17964,7 +18048,7 @@ func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead. func (*DraftHistoryEntry) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{227} + return file_openshell_proto_rawDescGZIP(), []int{228} } func (x *DraftHistoryEntry) GetEventTime() *timestamppb.Timestamp { @@ -18005,7 +18089,7 @@ type GetDraftHistoryResponse struct { func (x *GetDraftHistoryResponse) Reset() { *x = GetDraftHistoryResponse{} - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[229] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18017,7 +18101,7 @@ func (x *GetDraftHistoryResponse) String() string { func (*GetDraftHistoryResponse) ProtoMessage() {} func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[229] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18030,7 +18114,7 @@ func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead. func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{228} + return file_openshell_proto_rawDescGZIP(), []int{229} } func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry { @@ -18055,7 +18139,7 @@ type CreateWorkspaceRequest struct { func (x *CreateWorkspaceRequest) Reset() { *x = CreateWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[230] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18067,7 +18151,7 @@ func (x *CreateWorkspaceRequest) String() string { func (*CreateWorkspaceRequest) ProtoMessage() {} func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[230] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18080,7 +18164,7 @@ func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead. func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{229} + return file_openshell_proto_rawDescGZIP(), []int{230} } func (x *CreateWorkspaceRequest) GetName() string { @@ -18114,7 +18198,7 @@ type CreateWorkspaceResponse struct { func (x *CreateWorkspaceResponse) Reset() { *x = CreateWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[231] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18126,7 +18210,7 @@ func (x *CreateWorkspaceResponse) String() string { func (*CreateWorkspaceResponse) ProtoMessage() {} func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[231] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18139,7 +18223,7 @@ func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead. func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{230} + return file_openshell_proto_rawDescGZIP(), []int{231} } func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -18160,7 +18244,7 @@ type GetWorkspaceRequest struct { func (x *GetWorkspaceRequest) Reset() { *x = GetWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[232] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18172,7 +18256,7 @@ func (x *GetWorkspaceRequest) String() string { func (*GetWorkspaceRequest) ProtoMessage() {} func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[232] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18185,7 +18269,7 @@ func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead. func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{231} + return file_openshell_proto_rawDescGZIP(), []int{232} } func (x *GetWorkspaceRequest) GetName() string { @@ -18205,7 +18289,7 @@ type GetWorkspaceResponse struct { func (x *GetWorkspaceResponse) Reset() { *x = GetWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[233] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18217,7 +18301,7 @@ func (x *GetWorkspaceResponse) String() string { func (*GetWorkspaceResponse) ProtoMessage() {} func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[233] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18230,7 +18314,7 @@ func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead. func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{232} + return file_openshell_proto_rawDescGZIP(), []int{233} } func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -18257,7 +18341,7 @@ type ListWorkspacesRequest struct { func (x *ListWorkspacesRequest) Reset() { *x = ListWorkspacesRequest{} - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[234] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18269,7 +18353,7 @@ func (x *ListWorkspacesRequest) String() string { func (*ListWorkspacesRequest) ProtoMessage() {} func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[234] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18282,7 +18366,7 @@ func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead. func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{233} + return file_openshell_proto_rawDescGZIP(), []int{234} } func (x *ListWorkspacesRequest) GetPageSize() int32 { @@ -18318,7 +18402,7 @@ type ListWorkspacesResponse struct { func (x *ListWorkspacesResponse) Reset() { *x = ListWorkspacesResponse{} - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[235] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18330,7 +18414,7 @@ func (x *ListWorkspacesResponse) String() string { func (*ListWorkspacesResponse) ProtoMessage() {} func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[235] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18343,7 +18427,7 @@ func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead. func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{234} + return file_openshell_proto_rawDescGZIP(), []int{235} } func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace { @@ -18374,7 +18458,7 @@ type DeleteWorkspaceRequest struct { func (x *DeleteWorkspaceRequest) Reset() { *x = DeleteWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[236] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18386,7 +18470,7 @@ func (x *DeleteWorkspaceRequest) String() string { func (*DeleteWorkspaceRequest) ProtoMessage() {} func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[236] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18399,7 +18483,7 @@ func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{235} + return file_openshell_proto_rawDescGZIP(), []int{236} } func (x *DeleteWorkspaceRequest) GetName() string { @@ -18433,7 +18517,7 @@ type DeleteWorkspaceResponse struct { func (x *DeleteWorkspaceResponse) Reset() { *x = DeleteWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[237] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18445,7 +18529,7 @@ func (x *DeleteWorkspaceResponse) String() string { func (*DeleteWorkspaceResponse) ProtoMessage() {} func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[237] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18458,7 +18542,7 @@ func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{236} + return file_openshell_proto_rawDescGZIP(), []int{237} } func (x *DeleteWorkspaceResponse) GetOutcome() DeletionOutcome { @@ -18482,7 +18566,7 @@ type WorkspaceMember struct { func (x *WorkspaceMember) Reset() { *x = WorkspaceMember{} - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[238] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18494,7 +18578,7 @@ func (x *WorkspaceMember) String() string { func (*WorkspaceMember) ProtoMessage() {} func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[238] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18507,7 +18591,7 @@ func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead. func (*WorkspaceMember) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{237} + return file_openshell_proto_rawDescGZIP(), []int{238} } func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta { @@ -18548,7 +18632,7 @@ type AddWorkspaceMemberRequest struct { func (x *AddWorkspaceMemberRequest) Reset() { *x = AddWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[239] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18560,7 +18644,7 @@ func (x *AddWorkspaceMemberRequest) String() string { func (*AddWorkspaceMemberRequest) ProtoMessage() {} func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[239] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18573,7 +18657,7 @@ func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{238} + return file_openshell_proto_rawDescGZIP(), []int{239} } func (x *AddWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18614,7 +18698,7 @@ type AddWorkspaceMemberResponse struct { func (x *AddWorkspaceMemberResponse) Reset() { *x = AddWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[240] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18626,7 +18710,7 @@ func (x *AddWorkspaceMemberResponse) String() string { func (*AddWorkspaceMemberResponse) ProtoMessage() {} func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[240] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18639,7 +18723,7 @@ func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{239} + return file_openshell_proto_rawDescGZIP(), []int{240} } func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember { @@ -18665,7 +18749,7 @@ type RemoveWorkspaceMemberRequest struct { func (x *RemoveWorkspaceMemberRequest) Reset() { *x = RemoveWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[241] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18677,7 +18761,7 @@ func (x *RemoveWorkspaceMemberRequest) String() string { func (*RemoveWorkspaceMemberRequest) ProtoMessage() {} func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[241] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18690,7 +18774,7 @@ func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{240} + return file_openshell_proto_rawDescGZIP(), []int{241} } func (x *RemoveWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18731,7 +18815,7 @@ type RemoveWorkspaceMemberResponse struct { func (x *RemoveWorkspaceMemberResponse) Reset() { *x = RemoveWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[242] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18743,7 +18827,7 @@ func (x *RemoveWorkspaceMemberResponse) String() string { func (*RemoveWorkspaceMemberResponse) ProtoMessage() {} func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[242] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18756,7 +18840,7 @@ func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{241} + return file_openshell_proto_rawDescGZIP(), []int{242} } func (x *RemoveWorkspaceMemberResponse) GetOutcome() DeletionOutcome { @@ -18783,7 +18867,7 @@ type ListWorkspaceMembersRequest struct { func (x *ListWorkspaceMembersRequest) Reset() { *x = ListWorkspaceMembersRequest{} - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[243] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18795,7 +18879,7 @@ func (x *ListWorkspaceMembersRequest) String() string { func (*ListWorkspaceMembersRequest) ProtoMessage() {} func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[243] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18808,7 +18892,7 @@ func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{242} + return file_openshell_proto_rawDescGZIP(), []int{243} } func (x *ListWorkspaceMembersRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18844,7 +18928,7 @@ type ListWorkspaceMembersResponse struct { func (x *ListWorkspaceMembersResponse) Reset() { *x = ListWorkspaceMembersResponse{} - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[244] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18856,7 +18940,7 @@ func (x *ListWorkspaceMembersResponse) String() string { func (*ListWorkspaceMembersResponse) ProtoMessage() {} func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[244] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18869,7 +18953,7 @@ func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{243} + return file_openshell_proto_rawDescGZIP(), []int{244} } func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember { @@ -18904,7 +18988,7 @@ type ExtensionServiceCredential struct { func (x *ExtensionServiceCredential) Reset() { *x = ExtensionServiceCredential{} - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[245] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18916,7 +19000,7 @@ func (x *ExtensionServiceCredential) String() string { func (*ExtensionServiceCredential) ProtoMessage() {} func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[245] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18929,7 +19013,7 @@ func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use ExtensionServiceCredential.ProtoReflect.Descriptor instead. func (*ExtensionServiceCredential) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{244} + return file_openshell_proto_rawDescGZIP(), []int{245} } func (x *ExtensionServiceCredential) GetServiceName() string { @@ -18969,7 +19053,7 @@ type EndpointObservation struct { func (x *EndpointObservation) Reset() { *x = EndpointObservation{} - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[246] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18981,7 +19065,7 @@ func (x *EndpointObservation) String() string { func (*EndpointObservation) ProtoMessage() {} func (x *EndpointObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[246] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18994,7 +19078,7 @@ func (x *EndpointObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointObservation.ProtoReflect.Descriptor instead. func (*EndpointObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{245} + return file_openshell_proto_rawDescGZIP(), []int{246} } func (x *EndpointObservation) GetEndpointId() string { @@ -19047,7 +19131,7 @@ type ReportEndpointStatusRequest struct { func (x *ReportEndpointStatusRequest) Reset() { *x = ReportEndpointStatusRequest{} - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[247] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19059,7 +19143,7 @@ func (x *ReportEndpointStatusRequest) String() string { func (*ReportEndpointStatusRequest) ProtoMessage() {} func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[247] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19072,7 +19156,7 @@ func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusRequest.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{246} + return file_openshell_proto_rawDescGZIP(), []int{247} } func (x *ReportEndpointStatusRequest) GetSandboxId() string { @@ -19141,7 +19225,7 @@ type TokenGrantStatus struct { func (x *TokenGrantStatus) Reset() { *x = TokenGrantStatus{} - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[248] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19153,7 +19237,7 @@ func (x *TokenGrantStatus) String() string { func (*TokenGrantStatus) ProtoMessage() {} func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[248] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19166,7 +19250,7 @@ func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantStatus.ProtoReflect.Descriptor instead. func (*TokenGrantStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{247} + return file_openshell_proto_rawDescGZIP(), []int{248} } func (x *TokenGrantStatus) GetLastFailure() *TokenGrantFailureObservation { @@ -19193,7 +19277,7 @@ type TokenGrantFailureObservation struct { func (x *TokenGrantFailureObservation) Reset() { *x = TokenGrantFailureObservation{} - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[249] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19205,7 +19289,7 @@ func (x *TokenGrantFailureObservation) String() string { func (*TokenGrantFailureObservation) ProtoMessage() {} func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[249] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19218,7 +19302,7 @@ func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantFailureObservation.ProtoReflect.Descriptor instead. func (*TokenGrantFailureObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{248} + return file_openshell_proto_rawDescGZIP(), []int{249} } func (x *TokenGrantFailureObservation) GetDestinationHost() string { @@ -19251,7 +19335,7 @@ type ReportEndpointStatusResponse struct { func (x *ReportEndpointStatusResponse) Reset() { *x = ReportEndpointStatusResponse{} - mi := &file_openshell_proto_msgTypes[249] + mi := &file_openshell_proto_msgTypes[250] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19263,7 +19347,7 @@ func (x *ReportEndpointStatusResponse) String() string { func (*ReportEndpointStatusResponse) ProtoMessage() {} func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[249] + mi := &file_openshell_proto_msgTypes[250] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19276,7 +19360,7 @@ func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusResponse.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{249} + return file_openshell_proto_rawDescGZIP(), []int{250} } // A configured endpoint and its last accepted network result in one record. @@ -19310,7 +19394,7 @@ type EndpointStatus struct { func (x *EndpointStatus) Reset() { *x = EndpointStatus{} - mi := &file_openshell_proto_msgTypes[250] + mi := &file_openshell_proto_msgTypes[251] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19322,7 +19406,7 @@ func (x *EndpointStatus) String() string { func (*EndpointStatus) ProtoMessage() {} func (x *EndpointStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[250] + mi := &file_openshell_proto_msgTypes[251] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19335,7 +19419,7 @@ func (x *EndpointStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointStatus.ProtoReflect.Descriptor instead. func (*EndpointStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{250} + return file_openshell_proto_rawDescGZIP(), []int{251} } func (x *EndpointStatus) GetEndpointId() string { @@ -19430,7 +19514,7 @@ type SandboxProvisioning struct { func (x *SandboxProvisioning) Reset() { *x = SandboxProvisioning{} - mi := &file_openshell_proto_msgTypes[251] + mi := &file_openshell_proto_msgTypes[252] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19442,7 +19526,7 @@ func (x *SandboxProvisioning) String() string { func (*SandboxProvisioning) ProtoMessage() {} func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[251] + mi := &file_openshell_proto_msgTypes[252] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19455,7 +19539,7 @@ func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxProvisioning.ProtoReflect.Descriptor instead. func (*SandboxProvisioning) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{251} + return file_openshell_proto_rawDescGZIP(), []int{252} } func (x *SandboxProvisioning) GetAttemptId() string { @@ -19578,7 +19662,7 @@ type SandboxServiceExposure struct { func (x *SandboxServiceExposure) Reset() { *x = SandboxServiceExposure{} - mi := &file_openshell_proto_msgTypes[252] + mi := &file_openshell_proto_msgTypes[253] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19590,7 +19674,7 @@ func (x *SandboxServiceExposure) String() string { func (*SandboxServiceExposure) ProtoMessage() {} func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[252] + mi := &file_openshell_proto_msgTypes[253] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19603,7 +19687,7 @@ func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxServiceExposure.ProtoReflect.Descriptor instead. func (*SandboxServiceExposure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{252} + return file_openshell_proto_rawDescGZIP(), []int{253} } func (x *SandboxServiceExposure) GetService() string { @@ -19657,7 +19741,7 @@ type EndpointFailure struct { func (x *EndpointFailure) Reset() { *x = EndpointFailure{} - mi := &file_openshell_proto_msgTypes[253] + mi := &file_openshell_proto_msgTypes[254] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19669,7 +19753,7 @@ func (x *EndpointFailure) String() string { func (*EndpointFailure) ProtoMessage() {} func (x *EndpointFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[253] + mi := &file_openshell_proto_msgTypes[254] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19682,7 +19766,7 @@ func (x *EndpointFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointFailure.ProtoReflect.Descriptor instead. func (*EndpointFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{253} + return file_openshell_proto_rawDescGZIP(), []int{254} } func (x *EndpointFailure) GetDomain() EndpointFailureDomain { @@ -20468,9 +20552,20 @@ const file_openshell_proto_rawDesc = "" + " \x01(\x0e25.openshell.v1.ProviderCredentialRefreshRecoveryActionR\x0erecoveryAction\x12!\n" + "\ffailure_code\x18\v \x01(\tR\vfailureCode\x124\n" + "\x16provider_error_subtype\x18\f \x01(\tR\x14providerErrorSubtype\x12B\n" + - "\x0flast_error_time\x18q \x01(\v2\x1a.google.protobuf.TimestampR\rlastErrorTimeJ\x04\b\x06\x10\aJ\x04\b\a\x10\bJ\x04\b\b\x10\tJ\x04\b\r\x10\x0eR\rexpires_at_msR\x12next_refresh_at_msR\x12last_refresh_at_msR\x10last_error_at_ms\"<\n" + + "\x0flast_error_time\x18q \x01(\v2\x1a.google.protobuf.TimestampR\rlastErrorTimeJ\x04\b\x06\x10\aJ\x04\b\a\x10\bJ\x04\b\b\x10\tJ\x04\b\r\x10\x0eR\rexpires_at_msR\x12next_refresh_at_msR\x12last_refresh_at_msR\x10last_error_at_ms\"d\n" + "\x18ProviderProfileDiscovery\x12 \n" + - "\vcredentials\x18\x01 \x03(\tR\vcredentials\"\xb8\x01\n" + + "\vcredentials\x18\x01 \x03(\tR\vcredentials\x12&\n" + + "\x0fconfig_env_vars\x18\x02 \x03(\tR\rconfigEnvVars\"\xaa\x02\n" + + "\x1aProviderProfileEnvironment\x12L\n" + + "\x06config\x18\x01 \x03(\v24.openshell.v1.ProviderProfileEnvironment.ConfigEntryR\x06config\x12I\n" + + "\x05fixed\x18\x02 \x03(\v23.openshell.v1.ProviderProfileEnvironment.FixedEntryR\x05fixed\x1a9\n" + + "\vConfigEntry\x12\x10\n" + + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a8\n" + + "\n" + + "FixedEntry\x12\x10\n" + + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xb8\x01\n" + "\x1fGetProviderRefreshStatusRequest\x12R\n" + "\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1a\n" + "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + @@ -20508,7 +20603,7 @@ const file_openshell_proto_rawDesc = "" + "\n" + "request_id\x18\x06 \x01(\tR\trequestId\"g\n" + "\x1dDeleteProviderRefreshResponse\x127\n" + - "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\x91\x06\n" + + "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\x99\a\n" + "\x0fProviderProfile\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x12!\n" + "\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12 \n" + @@ -20524,7 +20619,9 @@ const file_openshell_proto_rawDesc = "" + "\vannotations\x18\v \x03(\v2..openshell.v1.ProviderProfile.AnnotationsEntryR\vannotations\x12\x16\n" + "\x06source\x18\f \x01(\tR\x06source\x12\x14\n" + "\x05scope\x18\r \x01(\tR\x05scope\x127\n" + - "\x05files\x18\x0e \x03(\v2!.openshell.v1.ProviderProfileFileR\x05files\x1a>\n" + + "\x05files\x18\x0e \x03(\v2!.openshell.v1.ProviderProfileFileR\x05files\x12J\n" + + "\venvironment\x18\x0f \x01(\v2(.openshell.v1.ProviderProfileEnvironmentR\venvironment\x12:\n" + + "\x19required_platform_adapter\x18\x10 \x01(\tR\x17requiredPlatformAdapter\x1a>\n" + "\x10AnnotationsEntry\x12\x10\n" + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\\\n" + @@ -21574,7 +21671,7 @@ func file_openshell_proto_rawDescGZIP() []byte { } var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 22) -var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 281) +var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 284) var file_openshell_proto_goTypes = []any{ (ExtensionKind)(0), // 0: openshell.v1.ExtensionKind (SandboxPhase)(0), // 1: openshell.v1.SandboxPhase @@ -21719,192 +21816,195 @@ var file_openshell_proto_goTypes = []any{ (*ProviderCredentialRefresh)(nil), // 140: openshell.v1.ProviderCredentialRefresh (*ProviderCredentialRefreshStatus)(nil), // 141: openshell.v1.ProviderCredentialRefreshStatus (*ProviderProfileDiscovery)(nil), // 142: openshell.v1.ProviderProfileDiscovery - (*GetProviderRefreshStatusRequest)(nil), // 143: openshell.v1.GetProviderRefreshStatusRequest - (*GetProviderRefreshStatusResponse)(nil), // 144: openshell.v1.GetProviderRefreshStatusResponse - (*ConfigureProviderRefreshRequest)(nil), // 145: openshell.v1.ConfigureProviderRefreshRequest - (*ConfigureProviderRefreshResponse)(nil), // 146: openshell.v1.ConfigureProviderRefreshResponse - (*RotateProviderCredentialRequest)(nil), // 147: openshell.v1.RotateProviderCredentialRequest - (*RotateProviderCredentialResponse)(nil), // 148: openshell.v1.RotateProviderCredentialResponse - (*DeleteProviderRefreshRequest)(nil), // 149: openshell.v1.DeleteProviderRefreshRequest - (*DeleteProviderRefreshResponse)(nil), // 150: openshell.v1.DeleteProviderRefreshResponse - (*ProviderProfile)(nil), // 151: openshell.v1.ProviderProfile - (*ProviderProfileFile)(nil), // 152: openshell.v1.ProviderProfileFile - (*ProviderProfileResponse)(nil), // 153: openshell.v1.ProviderProfileResponse - (*ListProviderProfilesResponse)(nil), // 154: openshell.v1.ListProviderProfilesResponse - (*ImportProviderProfilesRequest)(nil), // 155: openshell.v1.ImportProviderProfilesRequest - (*ImportProviderProfilesResponse)(nil), // 156: openshell.v1.ImportProviderProfilesResponse - (*UpdateProviderProfilesRequest)(nil), // 157: openshell.v1.UpdateProviderProfilesRequest - (*UpdateProviderProfilesResponse)(nil), // 158: openshell.v1.UpdateProviderProfilesResponse - (*LintProviderProfilesRequest)(nil), // 159: openshell.v1.LintProviderProfilesRequest - (*LintProviderProfilesResponse)(nil), // 160: openshell.v1.LintProviderProfilesResponse - (*DeleteProviderResponse)(nil), // 161: openshell.v1.DeleteProviderResponse - (*DeleteProviderProfileRequest)(nil), // 162: openshell.v1.DeleteProviderProfileRequest - (*DeleteProviderProfileResponse)(nil), // 163: openshell.v1.DeleteProviderProfileResponse - (*GetSandboxProviderEnvironmentRequest)(nil), // 164: openshell.v1.GetSandboxProviderEnvironmentRequest - (*StaticCredentialEndpointBinding)(nil), // 165: openshell.v1.StaticCredentialEndpointBinding - (*StaticCredentialBinding)(nil), // 166: openshell.v1.StaticCredentialBinding - (*GetSandboxProviderEnvironmentResponse)(nil), // 167: openshell.v1.GetSandboxProviderEnvironmentResponse - (*ProviderEnvironmentValue)(nil), // 168: openshell.v1.ProviderEnvironmentValue - (*ProviderEnvironmentSnapshot)(nil), // 169: openshell.v1.ProviderEnvironmentSnapshot - (*ExchangeProviderSubjectTokenRequest)(nil), // 170: openshell.v1.ExchangeProviderSubjectTokenRequest - (*ExchangeProviderSubjectTokenResponse)(nil), // 171: openshell.v1.ExchangeProviderSubjectTokenResponse - (*UpdateConfigRequest)(nil), // 172: openshell.v1.UpdateConfigRequest - (*PolicyMergeOperation)(nil), // 173: openshell.v1.PolicyMergeOperation - (*AddNetworkRule)(nil), // 174: openshell.v1.AddNetworkRule - (*RemoveNetworkEndpoint)(nil), // 175: openshell.v1.RemoveNetworkEndpoint - (*RemoveNetworkRule)(nil), // 176: openshell.v1.RemoveNetworkRule - (*L7RuleTarget)(nil), // 177: openshell.v1.L7RuleTarget - (*AddDenyRules)(nil), // 178: openshell.v1.AddDenyRules - (*AddAllowRules)(nil), // 179: openshell.v1.AddAllowRules - (*RemoveNetworkBinary)(nil), // 180: openshell.v1.RemoveNetworkBinary - (*UpdateConfigResponse)(nil), // 181: openshell.v1.UpdateConfigResponse - (*GetSandboxPolicyStatusRequest)(nil), // 182: openshell.v1.GetSandboxPolicyStatusRequest - (*GetSandboxPolicyStatusResponse)(nil), // 183: openshell.v1.GetSandboxPolicyStatusResponse - (*ListSandboxPoliciesRequest)(nil), // 184: openshell.v1.ListSandboxPoliciesRequest - (*ListSandboxPoliciesResponse)(nil), // 185: openshell.v1.ListSandboxPoliciesResponse - (*ReportPolicyStatusRequest)(nil), // 186: openshell.v1.ReportPolicyStatusRequest - (*ReportPolicyStatusResponse)(nil), // 187: openshell.v1.ReportPolicyStatusResponse - (*SandboxConfigurationAdmission)(nil), // 188: openshell.v1.SandboxConfigurationAdmission - (*ReportSandboxConfigurationRequest)(nil), // 189: openshell.v1.ReportSandboxConfigurationRequest - (*ReportSandboxConfigurationResponse)(nil), // 190: openshell.v1.ReportSandboxConfigurationResponse - (*SandboxPolicyRevision)(nil), // 191: openshell.v1.SandboxPolicyRevision - (*GetSandboxLogsRequest)(nil), // 192: openshell.v1.GetSandboxLogsRequest - (*PushSandboxLogsRequest)(nil), // 193: openshell.v1.PushSandboxLogsRequest - (*PushSandboxLogsResponse)(nil), // 194: openshell.v1.PushSandboxLogsResponse - (*GetSandboxLogsResponse)(nil), // 195: openshell.v1.GetSandboxLogsResponse - (*SupervisorMessage)(nil), // 196: openshell.v1.SupervisorMessage - (*GatewayMessage)(nil), // 197: openshell.v1.GatewayMessage - (*SupervisorHello)(nil), // 198: openshell.v1.SupervisorHello - (*SessionAccepted)(nil), // 199: openshell.v1.SessionAccepted - (*ConfigUpdate)(nil), // 200: openshell.v1.ConfigUpdate - (*ConfigApplyFailure)(nil), // 201: openshell.v1.ConfigApplyFailure - (*ConfigUpdateResult)(nil), // 202: openshell.v1.ConfigUpdateResult - (*PolicyLoadResult)(nil), // 203: openshell.v1.PolicyLoadResult - (*SessionRejected)(nil), // 204: openshell.v1.SessionRejected - (*SessionRedirect)(nil), // 205: openshell.v1.SessionRedirect - (*SupervisorHeartbeat)(nil), // 206: openshell.v1.SupervisorHeartbeat - (*GatewayHeartbeat)(nil), // 207: openshell.v1.GatewayHeartbeat - (*ReportMainProcessExitRequest)(nil), // 208: openshell.v1.ReportMainProcessExitRequest - (*ReportMainProcessExitResponse)(nil), // 209: openshell.v1.ReportMainProcessExitResponse - (*FinalizeMainProcessExitRequest)(nil), // 210: openshell.v1.FinalizeMainProcessExitRequest - (*FinalizeMainProcessExitResponse)(nil), // 211: openshell.v1.FinalizeMainProcessExitResponse - (*RelayOpen)(nil), // 212: openshell.v1.RelayOpen - (*SshRelayTarget)(nil), // 213: openshell.v1.SshRelayTarget - (*TcpRelayTarget)(nil), // 214: openshell.v1.TcpRelayTarget - (*RelayInit)(nil), // 215: openshell.v1.RelayInit - (*RelayFrame)(nil), // 216: openshell.v1.RelayFrame - (*PeerRelayInit)(nil), // 217: openshell.v1.PeerRelayInit - (*PeerRelayFrame)(nil), // 218: openshell.v1.PeerRelayFrame - (*PeerConfigSandboxTarget)(nil), // 219: openshell.v1.PeerConfigSandboxTarget - (*PeerConfigProviderTarget)(nil), // 220: openshell.v1.PeerConfigProviderTarget - (*PeerNotifyConfigUpdateRequest)(nil), // 221: openshell.v1.PeerNotifyConfigUpdateRequest - (*PeerNotifyConfigUpdateResponse)(nil), // 222: openshell.v1.PeerNotifyConfigUpdateResponse - (*RelayOpenResult)(nil), // 223: openshell.v1.RelayOpenResult - (*RelayClose)(nil), // 224: openshell.v1.RelayClose - (*L7RequestSample)(nil), // 225: openshell.v1.L7RequestSample - (*DenialSummary)(nil), // 226: openshell.v1.DenialSummary - (*DenialGroupCount)(nil), // 227: openshell.v1.DenialGroupCount - (*NetworkActivitySummary)(nil), // 228: openshell.v1.NetworkActivitySummary - (*PolicyChunk)(nil), // 229: openshell.v1.PolicyChunk - (*DraftPolicyUpdate)(nil), // 230: openshell.v1.DraftPolicyUpdate - (*SubmitPolicyAnalysisRequest)(nil), // 231: openshell.v1.SubmitPolicyAnalysisRequest - (*SubmitPolicyAnalysisResponse)(nil), // 232: openshell.v1.SubmitPolicyAnalysisResponse - (*GetDraftPolicyRequest)(nil), // 233: openshell.v1.GetDraftPolicyRequest - (*GetDraftPolicyResponse)(nil), // 234: openshell.v1.GetDraftPolicyResponse - (*ApproveDraftChunkRequest)(nil), // 235: openshell.v1.ApproveDraftChunkRequest - (*ApproveDraftChunkResponse)(nil), // 236: openshell.v1.ApproveDraftChunkResponse - (*RejectDraftChunkRequest)(nil), // 237: openshell.v1.RejectDraftChunkRequest - (*RejectDraftChunkResponse)(nil), // 238: openshell.v1.RejectDraftChunkResponse - (*DraftChunkApproval)(nil), // 239: openshell.v1.DraftChunkApproval - (*ApproveAllDraftChunksRequest)(nil), // 240: openshell.v1.ApproveAllDraftChunksRequest - (*ApproveAllDraftChunksResponse)(nil), // 241: openshell.v1.ApproveAllDraftChunksResponse - (*EditDraftChunkRequest)(nil), // 242: openshell.v1.EditDraftChunkRequest - (*EditDraftChunkResponse)(nil), // 243: openshell.v1.EditDraftChunkResponse - (*UndoDraftChunkRequest)(nil), // 244: openshell.v1.UndoDraftChunkRequest - (*UndoDraftChunkResponse)(nil), // 245: openshell.v1.UndoDraftChunkResponse - (*ClearDraftChunksRequest)(nil), // 246: openshell.v1.ClearDraftChunksRequest - (*ClearDraftChunksResponse)(nil), // 247: openshell.v1.ClearDraftChunksResponse - (*GetDraftHistoryRequest)(nil), // 248: openshell.v1.GetDraftHistoryRequest - (*DraftHistoryEntry)(nil), // 249: openshell.v1.DraftHistoryEntry - (*GetDraftHistoryResponse)(nil), // 250: openshell.v1.GetDraftHistoryResponse - (*CreateWorkspaceRequest)(nil), // 251: openshell.v1.CreateWorkspaceRequest - (*CreateWorkspaceResponse)(nil), // 252: openshell.v1.CreateWorkspaceResponse - (*GetWorkspaceRequest)(nil), // 253: openshell.v1.GetWorkspaceRequest - (*GetWorkspaceResponse)(nil), // 254: openshell.v1.GetWorkspaceResponse - (*ListWorkspacesRequest)(nil), // 255: openshell.v1.ListWorkspacesRequest - (*ListWorkspacesResponse)(nil), // 256: openshell.v1.ListWorkspacesResponse - (*DeleteWorkspaceRequest)(nil), // 257: openshell.v1.DeleteWorkspaceRequest - (*DeleteWorkspaceResponse)(nil), // 258: openshell.v1.DeleteWorkspaceResponse - (*WorkspaceMember)(nil), // 259: openshell.v1.WorkspaceMember - (*AddWorkspaceMemberRequest)(nil), // 260: openshell.v1.AddWorkspaceMemberRequest - (*AddWorkspaceMemberResponse)(nil), // 261: openshell.v1.AddWorkspaceMemberResponse - (*RemoveWorkspaceMemberRequest)(nil), // 262: openshell.v1.RemoveWorkspaceMemberRequest - (*RemoveWorkspaceMemberResponse)(nil), // 263: openshell.v1.RemoveWorkspaceMemberResponse - (*ListWorkspaceMembersRequest)(nil), // 264: openshell.v1.ListWorkspaceMembersRequest - (*ListWorkspaceMembersResponse)(nil), // 265: openshell.v1.ListWorkspaceMembersResponse - (*ExtensionServiceCredential)(nil), // 266: openshell.v1.ExtensionServiceCredential - (*EndpointObservation)(nil), // 267: openshell.v1.EndpointObservation - (*ReportEndpointStatusRequest)(nil), // 268: openshell.v1.ReportEndpointStatusRequest - (*TokenGrantStatus)(nil), // 269: openshell.v1.TokenGrantStatus - (*TokenGrantFailureObservation)(nil), // 270: openshell.v1.TokenGrantFailureObservation - (*ReportEndpointStatusResponse)(nil), // 271: openshell.v1.ReportEndpointStatusResponse - (*EndpointStatus)(nil), // 272: openshell.v1.EndpointStatus - (*SandboxProvisioning)(nil), // 273: openshell.v1.SandboxProvisioning - (*SandboxServiceExposure)(nil), // 274: openshell.v1.SandboxServiceExposure - (*EndpointFailure)(nil), // 275: openshell.v1.EndpointFailure - nil, // 276: openshell.v1.SandboxSpec.EnvironmentEntry - nil, // 277: openshell.v1.SandboxTemplate.LabelsEntry - nil, // 278: openshell.v1.SandboxTemplate.AnnotationsEntry - nil, // 279: openshell.v1.SandboxTemplate.EnvironmentEntry - nil, // 280: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry - nil, // 281: openshell.v1.PlatformEvent.MetadataEntry - nil, // 282: openshell.v1.CreateSandboxRequest.LabelsEntry - nil, // 283: openshell.v1.CreateSandboxRequest.AnnotationsEntry - nil, // 284: openshell.v1.SandboxMapUpdate.ValuesEntry - nil, // 285: openshell.v1.SandboxResponse.ServiceUrlsEntry - nil, // 286: openshell.v1.ExecSandboxRequest.EnvironmentEntry - nil, // 287: openshell.v1.SandboxLogLine.FieldsEntry - nil, // 288: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - nil, // 289: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - nil, // 290: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - nil, // 291: openshell.v1.ProviderProfile.AnnotationsEntry - nil, // 292: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - nil, // 293: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - nil, // 294: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - nil, // 295: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - nil, // 296: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - nil, // 297: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - nil, // 298: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - nil, // 299: openshell.v1.UpdateConfigRequest.AnnotationsEntry - nil, // 300: openshell.v1.UpdateConfigResponse.AnnotationsEntry - nil, // 301: openshell.v1.SandboxPolicyRevision.ProvenanceEntry - nil, // 302: openshell.v1.CreateWorkspaceRequest.LabelsEntry - (*timestamppb.Timestamp)(nil), // 303: google.protobuf.Timestamp - (*datamodelv1.ObjectMeta)(nil), // 304: openshell.datamodel.v1.ObjectMeta - (*sandboxv1.SandboxPolicy)(nil), // 305: openshell.sandbox.v1.SandboxPolicy - (*structpb.Struct)(nil), // 306: google.protobuf.Struct - (*durationpb.Duration)(nil), // 307: google.protobuf.Duration - (*datamodelv1.WorkspaceSelector)(nil), // 308: openshell.datamodel.v1.WorkspaceSelector - (*datamodelv1.Provider)(nil), // 309: openshell.datamodel.v1.Provider - (sandboxv1.PolicySource)(0), // 310: openshell.sandbox.v1.PolicySource - (*sandboxv1.NetworkEndpoint)(nil), // 311: openshell.sandbox.v1.NetworkEndpoint - (*sandboxv1.NetworkBinary)(nil), // 312: openshell.sandbox.v1.NetworkBinary - (*sandboxv1.SettingValue)(nil), // 313: openshell.sandbox.v1.SettingValue - (*sandboxv1.NetworkPolicyRule)(nil), // 314: openshell.sandbox.v1.NetworkPolicyRule - (*sandboxv1.L7DenyRule)(nil), // 315: openshell.sandbox.v1.L7DenyRule - (*sandboxv1.L7Rule)(nil), // 316: openshell.sandbox.v1.L7Rule - (*sandboxv1.SandboxConfigSnapshot)(nil), // 317: openshell.sandbox.v1.SandboxConfigSnapshot - (*datamodelv1.Workspace)(nil), // 318: openshell.datamodel.v1.Workspace - (*sandboxv1.GetSandboxConfigRequest)(nil), // 319: openshell.sandbox.v1.GetSandboxConfigRequest - (*sandboxv1.GetGatewayConfigRequest)(nil), // 320: openshell.sandbox.v1.GetGatewayConfigRequest - (*sandboxv1.GetSandboxConfigResponse)(nil), // 321: openshell.sandbox.v1.GetSandboxConfigResponse - (*sandboxv1.GetGatewayConfigResponse)(nil), // 322: openshell.sandbox.v1.GetGatewayConfigResponse + (*ProviderProfileEnvironment)(nil), // 143: openshell.v1.ProviderProfileEnvironment + (*GetProviderRefreshStatusRequest)(nil), // 144: openshell.v1.GetProviderRefreshStatusRequest + (*GetProviderRefreshStatusResponse)(nil), // 145: openshell.v1.GetProviderRefreshStatusResponse + (*ConfigureProviderRefreshRequest)(nil), // 146: openshell.v1.ConfigureProviderRefreshRequest + (*ConfigureProviderRefreshResponse)(nil), // 147: openshell.v1.ConfigureProviderRefreshResponse + (*RotateProviderCredentialRequest)(nil), // 148: openshell.v1.RotateProviderCredentialRequest + (*RotateProviderCredentialResponse)(nil), // 149: openshell.v1.RotateProviderCredentialResponse + (*DeleteProviderRefreshRequest)(nil), // 150: openshell.v1.DeleteProviderRefreshRequest + (*DeleteProviderRefreshResponse)(nil), // 151: openshell.v1.DeleteProviderRefreshResponse + (*ProviderProfile)(nil), // 152: openshell.v1.ProviderProfile + (*ProviderProfileFile)(nil), // 153: openshell.v1.ProviderProfileFile + (*ProviderProfileResponse)(nil), // 154: openshell.v1.ProviderProfileResponse + (*ListProviderProfilesResponse)(nil), // 155: openshell.v1.ListProviderProfilesResponse + (*ImportProviderProfilesRequest)(nil), // 156: openshell.v1.ImportProviderProfilesRequest + (*ImportProviderProfilesResponse)(nil), // 157: openshell.v1.ImportProviderProfilesResponse + (*UpdateProviderProfilesRequest)(nil), // 158: openshell.v1.UpdateProviderProfilesRequest + (*UpdateProviderProfilesResponse)(nil), // 159: openshell.v1.UpdateProviderProfilesResponse + (*LintProviderProfilesRequest)(nil), // 160: openshell.v1.LintProviderProfilesRequest + (*LintProviderProfilesResponse)(nil), // 161: openshell.v1.LintProviderProfilesResponse + (*DeleteProviderResponse)(nil), // 162: openshell.v1.DeleteProviderResponse + (*DeleteProviderProfileRequest)(nil), // 163: openshell.v1.DeleteProviderProfileRequest + (*DeleteProviderProfileResponse)(nil), // 164: openshell.v1.DeleteProviderProfileResponse + (*GetSandboxProviderEnvironmentRequest)(nil), // 165: openshell.v1.GetSandboxProviderEnvironmentRequest + (*StaticCredentialEndpointBinding)(nil), // 166: openshell.v1.StaticCredentialEndpointBinding + (*StaticCredentialBinding)(nil), // 167: openshell.v1.StaticCredentialBinding + (*GetSandboxProviderEnvironmentResponse)(nil), // 168: openshell.v1.GetSandboxProviderEnvironmentResponse + (*ProviderEnvironmentValue)(nil), // 169: openshell.v1.ProviderEnvironmentValue + (*ProviderEnvironmentSnapshot)(nil), // 170: openshell.v1.ProviderEnvironmentSnapshot + (*ExchangeProviderSubjectTokenRequest)(nil), // 171: openshell.v1.ExchangeProviderSubjectTokenRequest + (*ExchangeProviderSubjectTokenResponse)(nil), // 172: openshell.v1.ExchangeProviderSubjectTokenResponse + (*UpdateConfigRequest)(nil), // 173: openshell.v1.UpdateConfigRequest + (*PolicyMergeOperation)(nil), // 174: openshell.v1.PolicyMergeOperation + (*AddNetworkRule)(nil), // 175: openshell.v1.AddNetworkRule + (*RemoveNetworkEndpoint)(nil), // 176: openshell.v1.RemoveNetworkEndpoint + (*RemoveNetworkRule)(nil), // 177: openshell.v1.RemoveNetworkRule + (*L7RuleTarget)(nil), // 178: openshell.v1.L7RuleTarget + (*AddDenyRules)(nil), // 179: openshell.v1.AddDenyRules + (*AddAllowRules)(nil), // 180: openshell.v1.AddAllowRules + (*RemoveNetworkBinary)(nil), // 181: openshell.v1.RemoveNetworkBinary + (*UpdateConfigResponse)(nil), // 182: openshell.v1.UpdateConfigResponse + (*GetSandboxPolicyStatusRequest)(nil), // 183: openshell.v1.GetSandboxPolicyStatusRequest + (*GetSandboxPolicyStatusResponse)(nil), // 184: openshell.v1.GetSandboxPolicyStatusResponse + (*ListSandboxPoliciesRequest)(nil), // 185: openshell.v1.ListSandboxPoliciesRequest + (*ListSandboxPoliciesResponse)(nil), // 186: openshell.v1.ListSandboxPoliciesResponse + (*ReportPolicyStatusRequest)(nil), // 187: openshell.v1.ReportPolicyStatusRequest + (*ReportPolicyStatusResponse)(nil), // 188: openshell.v1.ReportPolicyStatusResponse + (*SandboxConfigurationAdmission)(nil), // 189: openshell.v1.SandboxConfigurationAdmission + (*ReportSandboxConfigurationRequest)(nil), // 190: openshell.v1.ReportSandboxConfigurationRequest + (*ReportSandboxConfigurationResponse)(nil), // 191: openshell.v1.ReportSandboxConfigurationResponse + (*SandboxPolicyRevision)(nil), // 192: openshell.v1.SandboxPolicyRevision + (*GetSandboxLogsRequest)(nil), // 193: openshell.v1.GetSandboxLogsRequest + (*PushSandboxLogsRequest)(nil), // 194: openshell.v1.PushSandboxLogsRequest + (*PushSandboxLogsResponse)(nil), // 195: openshell.v1.PushSandboxLogsResponse + (*GetSandboxLogsResponse)(nil), // 196: openshell.v1.GetSandboxLogsResponse + (*SupervisorMessage)(nil), // 197: openshell.v1.SupervisorMessage + (*GatewayMessage)(nil), // 198: openshell.v1.GatewayMessage + (*SupervisorHello)(nil), // 199: openshell.v1.SupervisorHello + (*SessionAccepted)(nil), // 200: openshell.v1.SessionAccepted + (*ConfigUpdate)(nil), // 201: openshell.v1.ConfigUpdate + (*ConfigApplyFailure)(nil), // 202: openshell.v1.ConfigApplyFailure + (*ConfigUpdateResult)(nil), // 203: openshell.v1.ConfigUpdateResult + (*PolicyLoadResult)(nil), // 204: openshell.v1.PolicyLoadResult + (*SessionRejected)(nil), // 205: openshell.v1.SessionRejected + (*SessionRedirect)(nil), // 206: openshell.v1.SessionRedirect + (*SupervisorHeartbeat)(nil), // 207: openshell.v1.SupervisorHeartbeat + (*GatewayHeartbeat)(nil), // 208: openshell.v1.GatewayHeartbeat + (*ReportMainProcessExitRequest)(nil), // 209: openshell.v1.ReportMainProcessExitRequest + (*ReportMainProcessExitResponse)(nil), // 210: openshell.v1.ReportMainProcessExitResponse + (*FinalizeMainProcessExitRequest)(nil), // 211: openshell.v1.FinalizeMainProcessExitRequest + (*FinalizeMainProcessExitResponse)(nil), // 212: openshell.v1.FinalizeMainProcessExitResponse + (*RelayOpen)(nil), // 213: openshell.v1.RelayOpen + (*SshRelayTarget)(nil), // 214: openshell.v1.SshRelayTarget + (*TcpRelayTarget)(nil), // 215: openshell.v1.TcpRelayTarget + (*RelayInit)(nil), // 216: openshell.v1.RelayInit + (*RelayFrame)(nil), // 217: openshell.v1.RelayFrame + (*PeerRelayInit)(nil), // 218: openshell.v1.PeerRelayInit + (*PeerRelayFrame)(nil), // 219: openshell.v1.PeerRelayFrame + (*PeerConfigSandboxTarget)(nil), // 220: openshell.v1.PeerConfigSandboxTarget + (*PeerConfigProviderTarget)(nil), // 221: openshell.v1.PeerConfigProviderTarget + (*PeerNotifyConfigUpdateRequest)(nil), // 222: openshell.v1.PeerNotifyConfigUpdateRequest + (*PeerNotifyConfigUpdateResponse)(nil), // 223: openshell.v1.PeerNotifyConfigUpdateResponse + (*RelayOpenResult)(nil), // 224: openshell.v1.RelayOpenResult + (*RelayClose)(nil), // 225: openshell.v1.RelayClose + (*L7RequestSample)(nil), // 226: openshell.v1.L7RequestSample + (*DenialSummary)(nil), // 227: openshell.v1.DenialSummary + (*DenialGroupCount)(nil), // 228: openshell.v1.DenialGroupCount + (*NetworkActivitySummary)(nil), // 229: openshell.v1.NetworkActivitySummary + (*PolicyChunk)(nil), // 230: openshell.v1.PolicyChunk + (*DraftPolicyUpdate)(nil), // 231: openshell.v1.DraftPolicyUpdate + (*SubmitPolicyAnalysisRequest)(nil), // 232: openshell.v1.SubmitPolicyAnalysisRequest + (*SubmitPolicyAnalysisResponse)(nil), // 233: openshell.v1.SubmitPolicyAnalysisResponse + (*GetDraftPolicyRequest)(nil), // 234: openshell.v1.GetDraftPolicyRequest + (*GetDraftPolicyResponse)(nil), // 235: openshell.v1.GetDraftPolicyResponse + (*ApproveDraftChunkRequest)(nil), // 236: openshell.v1.ApproveDraftChunkRequest + (*ApproveDraftChunkResponse)(nil), // 237: openshell.v1.ApproveDraftChunkResponse + (*RejectDraftChunkRequest)(nil), // 238: openshell.v1.RejectDraftChunkRequest + (*RejectDraftChunkResponse)(nil), // 239: openshell.v1.RejectDraftChunkResponse + (*DraftChunkApproval)(nil), // 240: openshell.v1.DraftChunkApproval + (*ApproveAllDraftChunksRequest)(nil), // 241: openshell.v1.ApproveAllDraftChunksRequest + (*ApproveAllDraftChunksResponse)(nil), // 242: openshell.v1.ApproveAllDraftChunksResponse + (*EditDraftChunkRequest)(nil), // 243: openshell.v1.EditDraftChunkRequest + (*EditDraftChunkResponse)(nil), // 244: openshell.v1.EditDraftChunkResponse + (*UndoDraftChunkRequest)(nil), // 245: openshell.v1.UndoDraftChunkRequest + (*UndoDraftChunkResponse)(nil), // 246: openshell.v1.UndoDraftChunkResponse + (*ClearDraftChunksRequest)(nil), // 247: openshell.v1.ClearDraftChunksRequest + (*ClearDraftChunksResponse)(nil), // 248: openshell.v1.ClearDraftChunksResponse + (*GetDraftHistoryRequest)(nil), // 249: openshell.v1.GetDraftHistoryRequest + (*DraftHistoryEntry)(nil), // 250: openshell.v1.DraftHistoryEntry + (*GetDraftHistoryResponse)(nil), // 251: openshell.v1.GetDraftHistoryResponse + (*CreateWorkspaceRequest)(nil), // 252: openshell.v1.CreateWorkspaceRequest + (*CreateWorkspaceResponse)(nil), // 253: openshell.v1.CreateWorkspaceResponse + (*GetWorkspaceRequest)(nil), // 254: openshell.v1.GetWorkspaceRequest + (*GetWorkspaceResponse)(nil), // 255: openshell.v1.GetWorkspaceResponse + (*ListWorkspacesRequest)(nil), // 256: openshell.v1.ListWorkspacesRequest + (*ListWorkspacesResponse)(nil), // 257: openshell.v1.ListWorkspacesResponse + (*DeleteWorkspaceRequest)(nil), // 258: openshell.v1.DeleteWorkspaceRequest + (*DeleteWorkspaceResponse)(nil), // 259: openshell.v1.DeleteWorkspaceResponse + (*WorkspaceMember)(nil), // 260: openshell.v1.WorkspaceMember + (*AddWorkspaceMemberRequest)(nil), // 261: openshell.v1.AddWorkspaceMemberRequest + (*AddWorkspaceMemberResponse)(nil), // 262: openshell.v1.AddWorkspaceMemberResponse + (*RemoveWorkspaceMemberRequest)(nil), // 263: openshell.v1.RemoveWorkspaceMemberRequest + (*RemoveWorkspaceMemberResponse)(nil), // 264: openshell.v1.RemoveWorkspaceMemberResponse + (*ListWorkspaceMembersRequest)(nil), // 265: openshell.v1.ListWorkspaceMembersRequest + (*ListWorkspaceMembersResponse)(nil), // 266: openshell.v1.ListWorkspaceMembersResponse + (*ExtensionServiceCredential)(nil), // 267: openshell.v1.ExtensionServiceCredential + (*EndpointObservation)(nil), // 268: openshell.v1.EndpointObservation + (*ReportEndpointStatusRequest)(nil), // 269: openshell.v1.ReportEndpointStatusRequest + (*TokenGrantStatus)(nil), // 270: openshell.v1.TokenGrantStatus + (*TokenGrantFailureObservation)(nil), // 271: openshell.v1.TokenGrantFailureObservation + (*ReportEndpointStatusResponse)(nil), // 272: openshell.v1.ReportEndpointStatusResponse + (*EndpointStatus)(nil), // 273: openshell.v1.EndpointStatus + (*SandboxProvisioning)(nil), // 274: openshell.v1.SandboxProvisioning + (*SandboxServiceExposure)(nil), // 275: openshell.v1.SandboxServiceExposure + (*EndpointFailure)(nil), // 276: openshell.v1.EndpointFailure + nil, // 277: openshell.v1.SandboxSpec.EnvironmentEntry + nil, // 278: openshell.v1.SandboxTemplate.LabelsEntry + nil, // 279: openshell.v1.SandboxTemplate.AnnotationsEntry + nil, // 280: openshell.v1.SandboxTemplate.EnvironmentEntry + nil, // 281: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + nil, // 282: openshell.v1.PlatformEvent.MetadataEntry + nil, // 283: openshell.v1.CreateSandboxRequest.LabelsEntry + nil, // 284: openshell.v1.CreateSandboxRequest.AnnotationsEntry + nil, // 285: openshell.v1.SandboxMapUpdate.ValuesEntry + nil, // 286: openshell.v1.SandboxResponse.ServiceUrlsEntry + nil, // 287: openshell.v1.ExecSandboxRequest.EnvironmentEntry + nil, // 288: openshell.v1.SandboxLogLine.FieldsEntry + nil, // 289: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + nil, // 290: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + nil, // 291: openshell.v1.ProviderProfileEnvironment.ConfigEntry + nil, // 292: openshell.v1.ProviderProfileEnvironment.FixedEntry + nil, // 293: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + nil, // 294: openshell.v1.ProviderProfile.AnnotationsEntry + nil, // 295: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + nil, // 296: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + nil, // 297: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + nil, // 298: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + nil, // 299: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + nil, // 300: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + nil, // 301: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + nil, // 302: openshell.v1.UpdateConfigRequest.AnnotationsEntry + nil, // 303: openshell.v1.UpdateConfigResponse.AnnotationsEntry + nil, // 304: openshell.v1.SandboxPolicyRevision.ProvenanceEntry + nil, // 305: openshell.v1.CreateWorkspaceRequest.LabelsEntry + (*timestamppb.Timestamp)(nil), // 306: google.protobuf.Timestamp + (*datamodelv1.ObjectMeta)(nil), // 307: openshell.datamodel.v1.ObjectMeta + (*sandboxv1.SandboxPolicy)(nil), // 308: openshell.sandbox.v1.SandboxPolicy + (*structpb.Struct)(nil), // 309: google.protobuf.Struct + (*durationpb.Duration)(nil), // 310: google.protobuf.Duration + (*datamodelv1.WorkspaceSelector)(nil), // 311: openshell.datamodel.v1.WorkspaceSelector + (*datamodelv1.Provider)(nil), // 312: openshell.datamodel.v1.Provider + (sandboxv1.PolicySource)(0), // 313: openshell.sandbox.v1.PolicySource + (*sandboxv1.NetworkEndpoint)(nil), // 314: openshell.sandbox.v1.NetworkEndpoint + (*sandboxv1.NetworkBinary)(nil), // 315: openshell.sandbox.v1.NetworkBinary + (*sandboxv1.SettingValue)(nil), // 316: openshell.sandbox.v1.SettingValue + (*sandboxv1.NetworkPolicyRule)(nil), // 317: openshell.sandbox.v1.NetworkPolicyRule + (*sandboxv1.L7DenyRule)(nil), // 318: openshell.sandbox.v1.L7DenyRule + (*sandboxv1.L7Rule)(nil), // 319: openshell.sandbox.v1.L7Rule + (*sandboxv1.SandboxConfigSnapshot)(nil), // 320: openshell.sandbox.v1.SandboxConfigSnapshot + (*datamodelv1.Workspace)(nil), // 321: openshell.datamodel.v1.Workspace + (*sandboxv1.GetSandboxConfigRequest)(nil), // 322: openshell.sandbox.v1.GetSandboxConfigRequest + (*sandboxv1.GetGatewayConfigRequest)(nil), // 323: openshell.sandbox.v1.GetGatewayConfigRequest + (*sandboxv1.GetSandboxConfigResponse)(nil), // 324: openshell.sandbox.v1.GetSandboxConfigResponse + (*sandboxv1.GetGatewayConfigResponse)(nil), // 325: openshell.sandbox.v1.GetGatewayConfigResponse } var file_openshell_proto_depIdxs = []int32{ - 303, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 303, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 266, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential - 303, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp + 306, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 306, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 267, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential + 306, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp 14, // 4: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus 14, // 5: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus 33, // 6: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo @@ -21915,538 +22015,541 @@ var file_openshell_proto_depIdxs = []int32{ 36, // 11: openshell.v1.ResourceCapabilities.cpu:type_name -> openshell.v1.CpuResourceCapabilities 37, // 12: openshell.v1.ResourceCapabilities.memory:type_name -> openshell.v1.MemoryResourceCapabilities 38, // 13: openshell.v1.ResourceCapabilities.gpu:type_name -> openshell.v1.GpuResourceCapabilities - 304, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 307, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 40, // 15: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec 51, // 16: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus 50, // 17: openshell.v1.Sandbox.created_from_workload_template:type_name -> openshell.v1.SandboxWorkloadTemplateProvenance - 276, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry + 277, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry 43, // 19: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate - 305, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 308, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy 41, // 21: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements 17, // 22: openshell.v1.SandboxSpec.restart_policy:type_name -> openshell.v1.SandboxRestartPolicy 42, // 23: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements - 277, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry - 278, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry - 279, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry - 306, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct - 306, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct - 304, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 278, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry + 279, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry + 280, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry + 309, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct + 309, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct + 307, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 45, // 30: openshell.v1.SandboxWorkloadTemplate.spec:type_name -> openshell.v1.SandboxWorkloadTemplateSpec 46, // 31: openshell.v1.SandboxWorkloadTemplateSpec.workload:type_name -> openshell.v1.SandboxWorkloadConfig - 306, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct + 309, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct 48, // 33: openshell.v1.SandboxWorkloadTemplateSpec.desired_service_level:type_name -> openshell.v1.SandboxServiceLevel - 280, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + 281, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry 47, // 35: openshell.v1.SandboxWorkloadConfig.resources:type_name -> openshell.v1.SandboxResources 42, // 36: openshell.v1.SandboxResources.gpu:type_name -> openshell.v1.GpuResourceRequirements 49, // 37: openshell.v1.SandboxServiceLevel.startup:type_name -> openshell.v1.SandboxStartup - 307, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration + 310, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration 52, // 39: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition 1, // 40: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase - 272, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus - 188, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 273, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning - 303, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp - 303, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp - 270, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 303, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp - 303, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp - 281, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry - 308, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 273, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus + 189, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 274, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning + 306, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp + 306, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp + 271, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 306, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp + 306, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp + 282, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry + 311, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 40, // 51: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec - 282, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry - 283, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry - 274, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure - 308, // 55: openshell.v1.UpdateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 283, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry + 284, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry + 275, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure + 311, // 55: openshell.v1.UpdateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 56, // 56: openshell.v1.UpdateSandboxRequest.command:type_name -> openshell.v1.SandboxCommandUpdate 57, // 57: openshell.v1.UpdateSandboxRequest.environment:type_name -> openshell.v1.SandboxMapUpdate 57, // 58: openshell.v1.UpdateSandboxRequest.labels:type_name -> openshell.v1.SandboxMapUpdate 57, // 59: openshell.v1.UpdateSandboxRequest.annotations:type_name -> openshell.v1.SandboxMapUpdate - 284, // 60: openshell.v1.SandboxMapUpdate.values:type_name -> openshell.v1.SandboxMapUpdate.ValuesEntry - 308, // 61: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 285, // 60: openshell.v1.SandboxMapUpdate.values:type_name -> openshell.v1.SandboxMapUpdate.ValuesEntry + 311, // 61: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 62: openshell.v1.CreateSandboxTemplateRequest.template:type_name -> openshell.v1.SandboxWorkloadTemplate - 308, // 63: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 64: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 65: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 63: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 64: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 65: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 66: openshell.v1.SandboxTemplateResponse.template:type_name -> openshell.v1.SandboxWorkloadTemplate 44, // 67: openshell.v1.ListSandboxTemplatesResponse.templates:type_name -> openshell.v1.SandboxWorkloadTemplate 18, // 68: openshell.v1.DeleteSandboxTemplateResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 308, // 69: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 70: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp - 308, // 71: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 72: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 73: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 74: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 75: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 76: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 77: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 78: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 79: openshell.v1.SuspendSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 80: openshell.v1.ResumeSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 69: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 306, // 70: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp + 311, // 71: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 72: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 73: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 74: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 75: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 76: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 77: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 78: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 79: openshell.v1.SuspendSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 80: openshell.v1.ResumeSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 39, // 81: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox - 285, // 82: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry + 286, // 82: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry 39, // 83: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox - 309, // 84: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 312, // 84: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider 39, // 85: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 86, // 86: openshell.v1.AttachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 39, // 87: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 86, // 88: openshell.v1.DetachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 84, // 89: openshell.v1.ConfigSnapshotRevision.sandbox_config:type_name -> openshell.v1.SandboxConfigRevision 82, // 90: openshell.v1.ConfigSnapshotRevision.provider_target:type_name -> openshell.v1.ProviderDesiredIdentity - 310, // 91: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource + 313, // 91: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource 5, // 92: openshell.v1.ConfigUpdateOperation.component:type_name -> openshell.v1.ConfigComponent 83, // 93: openshell.v1.ConfigUpdateOperation.target_revision:type_name -> openshell.v1.ConfigSnapshotRevision 7, // 94: openshell.v1.ConfigUpdateOperation.state:type_name -> openshell.v1.ConfigUpdateOperationState 6, // 95: openshell.v1.ConfigUpdateOperation.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 303, // 96: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp - 303, // 97: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp - 303, // 98: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp + 306, // 96: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp + 306, // 97: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp + 306, // 98: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp 2, // 99: openshell.v1.ProviderMutationReceipt.kind:type_name -> openshell.v1.ProviderMutationKind 82, // 100: openshell.v1.ProviderMutationReceipt.desired:type_name -> openshell.v1.ProviderDesiredIdentity - 303, // 101: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp + 306, // 101: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp 4, // 102: openshell.v1.ProviderReadinessObservation.reason:type_name -> openshell.v1.ProviderReadinessReason 86, // 103: openshell.v1.ProviderReadinessStatus.receipt:type_name -> openshell.v1.ProviderMutationReceipt 3, // 104: openshell.v1.ProviderReadinessStatus.state:type_name -> openshell.v1.ProviderReadinessState 4, // 105: openshell.v1.ProviderReadinessStatus.reason:type_name -> openshell.v1.ProviderReadinessReason 87, // 106: openshell.v1.ProviderReadinessStatus.observed:type_name -> openshell.v1.ProviderReadinessObservation - 303, // 107: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp - 303, // 108: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp + 306, // 107: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp + 306, // 108: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp 85, // 109: openshell.v1.ProviderReadinessStatus.operation:type_name -> openshell.v1.ConfigUpdateOperation - 308, // 110: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 110: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 88, // 111: openshell.v1.GetSandboxProviderStatusResponse.status:type_name -> openshell.v1.ProviderReadinessStatus 87, // 112: openshell.v1.ReportProviderReadinessRequest.observation:type_name -> openshell.v1.ProviderReadinessObservation - 307, // 113: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration - 307, // 114: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration + 310, // 113: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration + 310, // 114: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration 18, // 115: openshell.v1.DeleteSandboxResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 308, // 116: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 117: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp - 308, // 118: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 116: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 306, // 117: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp + 311, // 118: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 20, // 119: openshell.v1.ExposeServiceRequest.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 308, // 120: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 121: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 120: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 121: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 103, // 122: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse - 308, // 123: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 123: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 124: openshell.v1.DeleteServiceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 304, // 125: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 307, // 125: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 20, // 126: openshell.v1.ServiceEndpoint.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode 102, // 127: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint 18, // 128: openshell.v1.RevokeSshSessionResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 308, // 129: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 286, // 130: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry - 307, // 131: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration + 311, // 129: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 287, // 130: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry + 310, // 131: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration 107, // 132: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout 108, // 133: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr 109, // 134: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit - 213, // 135: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget - 214, // 136: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget + 214, // 135: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget + 215, // 136: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget 111, // 137: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit 106, // 138: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest 114, // 139: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize - 304, // 140: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 303, // 141: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp - 308, // 142: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 143: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp + 307, // 140: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 306, // 141: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp + 311, // 142: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 306, // 143: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp 39, // 144: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox 118, // 145: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine 53, // 146: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent 119, // 147: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning - 230, // 148: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate - 303, // 149: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp - 287, // 150: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry - 308, // 151: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 309, // 152: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 308, // 153: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 154: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 307, // 155: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration - 303, // 156: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp - 288, // 157: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - 308, // 158: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 159: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 309, // 160: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 289, // 161: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - 308, // 162: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 309, // 163: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider + 231, // 148: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate + 306, // 149: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp + 288, // 150: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry + 311, // 151: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 312, // 152: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 311, // 153: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 154: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 310, // 155: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration + 306, // 156: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp + 289, // 157: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + 311, // 158: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 159: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 312, // 160: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 290, // 161: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + 311, // 162: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 312, // 163: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider 86, // 164: openshell.v1.ProviderResponse.target_receipts:type_name -> openshell.v1.ProviderMutationReceipt - 309, // 165: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 308, // 166: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 167: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 151, // 168: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile - 307, // 169: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration + 312, // 165: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 311, // 166: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 167: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 152, // 168: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile + 310, // 169: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration 134, // 170: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride 8, // 171: openshell.v1.ProviderCredentialTokenGrant.grant_type:type_name -> openshell.v1.ProviderCredentialTokenGrantType 135, // 172: openshell.v1.ProviderCredentialTokenGrant.subject_token:type_name -> openshell.v1.ProviderCredentialTokenGrantSubjectToken 140, // 173: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh 136, // 174: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant 9, // 175: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 307, // 176: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration - 307, // 177: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration + 310, // 176: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration + 310, // 177: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration 138, // 178: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial 139, // 179: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput 9, // 180: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 303, // 181: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp - 303, // 182: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp - 303, // 183: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp + 306, // 181: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp + 306, // 182: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp + 306, // 183: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp 16, // 184: openshell.v1.ProviderCredentialRefreshStatus.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 303, // 185: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp - 308, // 186: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 141, // 187: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 308, // 188: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 9, // 189: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 290, // 190: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - 303, // 191: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp - 141, // 192: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 308, // 193: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 141, // 194: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 308, // 195: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 196: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 10, // 197: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory - 137, // 198: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential - 311, // 199: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 312, // 200: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 142, // 201: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery - 291, // 202: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry - 152, // 203: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile - 151, // 204: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile - 151, // 205: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 308, // 206: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 132, // 207: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 133, // 208: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 151, // 209: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 308, // 210: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 132, // 211: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem - 133, // 212: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 151, // 213: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile - 308, // 214: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 132, // 215: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 133, // 216: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 18, // 217: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 308, // 218: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 219: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 165, // 220: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding - 292, // 221: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - 293, // 222: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - 294, // 223: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - 295, // 224: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - 4, // 225: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 296, // 226: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - 11, // 227: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification - 166, // 228: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding - 303, // 229: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp - 168, // 230: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue - 297, // 231: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - 4, // 232: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 298, // 233: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - 307, // 234: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration - 308, // 235: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 305, // 236: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 313, // 237: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue - 173, // 238: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation - 299, // 239: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry - 174, // 240: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule - 175, // 241: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint - 176, // 242: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule - 178, // 243: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules - 179, // 244: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules - 180, // 245: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary - 314, // 246: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 312, // 247: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 315, // 248: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 177, // 249: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget - 316, // 250: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule - 177, // 251: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget - 300, // 252: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry - 308, // 253: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 191, // 254: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision - 308, // 255: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 191, // 256: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision - 13, // 257: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus - 12, // 258: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState - 188, // 259: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 13, // 260: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus - 303, // 261: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp - 303, // 262: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp - 305, // 263: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 301, // 264: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry - 308, // 265: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 266: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp - 118, // 267: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine - 118, // 268: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine - 198, // 269: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello - 206, // 270: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat - 223, // 271: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult - 224, // 272: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose - 202, // 273: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult - 199, // 274: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted - 204, // 275: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected - 207, // 276: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat - 212, // 277: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen - 224, // 278: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose - 205, // 279: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect - 200, // 280: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate - 200, // 281: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate - 307, // 282: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration - 317, // 283: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot - 169, // 284: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot - 6, // 285: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 201, // 286: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure - 188, // 287: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 203, // 288: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult - 213, // 289: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget - 214, // 290: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget - 215, // 291: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit - 212, // 292: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen - 217, // 293: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit - 219, // 294: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget - 220, // 295: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget - 303, // 296: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp - 303, // 297: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp - 225, // 298: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample - 227, // 299: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount - 314, // 300: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 303, // 301: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp - 303, // 302: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp - 303, // 303: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp - 303, // 304: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp - 305, // 305: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 305, // 306: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 308, // 307: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 226, // 308: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary - 229, // 309: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk - 228, // 310: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary - 308, // 311: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 229, // 312: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk - 303, // 313: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp - 308, // 314: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 315: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 316: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 239, // 317: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval - 308, // 318: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 314, // 319: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 308, // 320: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 321: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 322: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 323: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp - 249, // 324: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry - 302, // 325: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry - 318, // 326: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 318, // 327: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 318, // 328: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace - 18, // 329: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 304, // 330: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 15, // 331: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole - 308, // 332: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 15, // 333: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole - 259, // 334: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember - 308, // 335: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 336: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 308, // 337: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 259, // 338: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember - 303, // 339: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp - 19, // 340: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult - 275, // 341: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure - 267, // 342: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation - 269, // 343: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus - 270, // 344: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 275, // 345: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure - 19, // 346: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult - 303, // 347: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp - 275, // 348: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure - 303, // 349: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp - 303, // 350: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp - 303, // 351: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp - 303, // 352: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp - 303, // 353: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp - 303, // 354: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp - 303, // 355: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp - 303, // 356: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp - 303, // 357: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp - 20, // 358: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 21, // 359: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain - 16, // 360: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 123, // 361: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue - 303, // 362: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 303, // 363: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 137, // 364: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 166, // 365: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding - 137, // 366: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 26, // 367: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest - 28, // 368: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest - 30, // 369: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest - 54, // 370: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest - 65, // 371: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest - 67, // 372: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest - 68, // 373: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest - 58, // 374: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest - 59, // 375: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest - 60, // 376: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest - 61, // 377: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest - 69, // 378: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest - 70, // 379: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest - 71, // 380: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest - 89, // 381: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 72, // 382: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest - 73, // 383: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest - 74, // 384: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest - 75, // 385: openshell.v1.OpenShell.SuspendSandbox:input_type -> openshell.v1.SuspendSandboxRequest - 76, // 386: openshell.v1.OpenShell.ResumeSandbox:input_type -> openshell.v1.ResumeSandboxRequest - 94, // 387: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest - 96, // 388: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest - 97, // 389: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest - 98, // 390: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest - 100, // 391: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest - 104, // 392: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest - 106, // 393: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest - 112, // 394: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame - 113, // 395: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput - 120, // 396: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest - 121, // 397: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest - 122, // 398: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest - 125, // 399: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest - 130, // 400: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest - 131, // 401: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest - 155, // 402: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest - 157, // 403: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest - 159, // 404: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest - 126, // 405: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest - 143, // 406: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest - 145, // 407: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest - 147, // 408: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest - 149, // 409: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest - 127, // 410: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest - 162, // 411: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest - 319, // 412: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest - 320, // 413: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest - 172, // 414: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest - 182, // 415: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest - 184, // 416: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest - 186, // 417: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest - 268, // 418: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 91, // 419: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 189, // 420: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest - 164, // 421: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest - 170, // 422: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest - 192, // 423: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest - 193, // 424: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest - 196, // 425: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage - 208, // 426: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest - 210, // 427: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest - 216, // 428: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame - 218, // 429: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame - 91, // 430: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 268, // 431: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 89, // 432: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 221, // 433: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest - 116, // 434: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest - 231, // 435: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest - 233, // 436: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest - 235, // 437: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest - 237, // 438: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest - 240, // 439: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest - 242, // 440: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest - 244, // 441: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest - 246, // 442: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest - 248, // 443: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest - 22, // 444: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest - 24, // 445: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest - 251, // 446: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest - 253, // 447: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest - 255, // 448: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest - 257, // 449: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest - 260, // 450: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest - 262, // 451: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest - 264, // 452: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest - 55, // 453: openshell.v1.SandboxUpdates.UpdateSandbox:input_type -> openshell.v1.UpdateSandboxRequest - 27, // 454: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse - 29, // 455: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse - 31, // 456: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse - 77, // 457: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse - 66, // 458: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse - 77, // 459: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse - 78, // 460: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse - 62, // 461: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 62, // 462: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 63, // 463: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse - 64, // 464: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse - 79, // 465: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse - 80, // 466: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse - 81, // 467: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse - 90, // 468: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 93, // 469: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse - 77, // 470: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse - 77, // 471: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse - 77, // 472: openshell.v1.OpenShell.SuspendSandbox:output_type -> openshell.v1.SandboxResponse - 77, // 473: openshell.v1.OpenShell.ResumeSandbox:output_type -> openshell.v1.SandboxResponse - 95, // 474: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse - 103, // 475: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse - 103, // 476: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse - 99, // 477: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse - 101, // 478: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse - 105, // 479: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse - 110, // 480: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent - 112, // 481: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame - 110, // 482: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent - 128, // 483: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse - 128, // 484: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse - 124, // 485: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse - 129, // 486: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse - 154, // 487: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse - 153, // 488: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse - 156, // 489: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse - 158, // 490: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse - 160, // 491: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse - 128, // 492: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse - 144, // 493: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse - 146, // 494: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse - 148, // 495: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse - 150, // 496: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse - 161, // 497: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse - 163, // 498: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse - 321, // 499: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse - 322, // 500: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse - 181, // 501: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse - 183, // 502: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse - 185, // 503: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse - 187, // 504: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse - 271, // 505: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 92, // 506: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 190, // 507: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse - 167, // 508: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse - 171, // 509: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse - 195, // 510: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse - 194, // 511: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse - 197, // 512: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage - 209, // 513: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse - 211, // 514: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse - 216, // 515: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame - 218, // 516: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame - 92, // 517: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 271, // 518: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 90, // 519: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 222, // 520: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse - 117, // 521: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent - 232, // 522: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse - 234, // 523: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse - 236, // 524: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse - 238, // 525: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse - 241, // 526: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse - 243, // 527: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse - 245, // 528: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse - 247, // 529: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse - 250, // 530: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse - 23, // 531: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse - 25, // 532: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse - 252, // 533: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse - 254, // 534: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse - 256, // 535: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse - 258, // 536: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse - 261, // 537: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse - 263, // 538: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse - 265, // 539: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse - 77, // 540: openshell.v1.SandboxUpdates.UpdateSandbox:output_type -> openshell.v1.SandboxResponse - 454, // [454:541] is the sub-list for method output_type - 367, // [367:454] is the sub-list for method input_type - 367, // [367:367] is the sub-list for extension type_name - 367, // [367:367] is the sub-list for extension extendee - 0, // [0:367] is the sub-list for field type_name + 306, // 185: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp + 291, // 186: openshell.v1.ProviderProfileEnvironment.config:type_name -> openshell.v1.ProviderProfileEnvironment.ConfigEntry + 292, // 187: openshell.v1.ProviderProfileEnvironment.fixed:type_name -> openshell.v1.ProviderProfileEnvironment.FixedEntry + 311, // 188: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 141, // 189: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus + 311, // 190: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 9, // 191: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy + 293, // 192: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + 306, // 193: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp + 141, // 194: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus + 311, // 195: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 141, // 196: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus + 311, // 197: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 198: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 10, // 199: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory + 137, // 200: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential + 314, // 201: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint + 315, // 202: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 142, // 203: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery + 294, // 204: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry + 153, // 205: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile + 143, // 206: openshell.v1.ProviderProfile.environment:type_name -> openshell.v1.ProviderProfileEnvironment + 152, // 207: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile + 152, // 208: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile + 311, // 209: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 132, // 210: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem + 133, // 211: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic + 152, // 212: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile + 311, // 213: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 132, // 214: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem + 133, // 215: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic + 152, // 216: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile + 311, // 217: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 132, // 218: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem + 133, // 219: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic + 18, // 220: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 311, // 221: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 222: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 166, // 223: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding + 295, // 224: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + 296, // 225: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + 297, // 226: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + 298, // 227: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + 4, // 228: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 299, // 229: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + 11, // 230: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification + 167, // 231: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding + 306, // 232: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp + 169, // 233: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue + 300, // 234: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + 4, // 235: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 301, // 236: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + 310, // 237: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration + 311, // 238: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 239: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 316, // 240: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue + 174, // 241: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation + 302, // 242: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry + 175, // 243: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule + 176, // 244: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint + 177, // 245: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule + 179, // 246: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules + 180, // 247: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules + 181, // 248: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary + 317, // 249: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 315, // 250: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 318, // 251: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule + 178, // 252: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget + 319, // 253: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule + 178, // 254: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget + 303, // 255: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry + 311, // 256: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 192, // 257: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision + 311, // 258: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 192, // 259: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision + 13, // 260: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus + 12, // 261: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState + 189, // 262: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 13, // 263: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus + 306, // 264: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp + 306, // 265: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp + 308, // 266: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 304, // 267: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry + 311, // 268: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 306, // 269: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp + 118, // 270: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine + 118, // 271: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine + 199, // 272: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello + 207, // 273: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat + 224, // 274: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult + 225, // 275: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose + 203, // 276: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult + 200, // 277: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted + 205, // 278: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected + 208, // 279: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat + 213, // 280: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen + 225, // 281: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose + 206, // 282: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect + 201, // 283: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate + 201, // 284: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate + 310, // 285: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration + 320, // 286: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot + 170, // 287: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot + 6, // 288: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome + 202, // 289: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure + 189, // 290: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 204, // 291: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult + 214, // 292: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget + 215, // 293: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget + 216, // 294: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit + 213, // 295: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen + 218, // 296: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit + 220, // 297: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget + 221, // 298: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget + 306, // 299: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp + 306, // 300: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp + 226, // 301: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample + 228, // 302: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount + 317, // 303: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 306, // 304: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp + 306, // 305: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp + 306, // 306: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp + 306, // 307: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp + 308, // 308: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 308, // 309: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 311, // 310: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 227, // 311: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary + 230, // 312: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk + 229, // 313: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary + 311, // 314: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 230, // 315: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk + 306, // 316: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp + 311, // 317: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 318: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 319: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 240, // 320: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval + 311, // 321: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 317, // 322: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 311, // 323: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 324: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 311, // 325: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 306, // 326: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp + 250, // 327: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry + 305, // 328: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry + 321, // 329: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 321, // 330: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 321, // 331: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace + 18, // 332: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 307, // 333: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 15, // 334: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole + 311, // 335: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 15, // 336: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole + 260, // 337: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember + 311, // 338: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 339: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 311, // 340: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 260, // 341: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember + 306, // 342: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp + 19, // 343: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult + 276, // 344: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure + 268, // 345: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation + 270, // 346: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus + 271, // 347: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 276, // 348: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure + 19, // 349: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult + 306, // 350: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp + 276, // 351: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure + 306, // 352: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp + 306, // 353: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp + 306, // 354: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp + 306, // 355: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp + 306, // 356: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp + 306, // 357: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp + 306, // 358: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp + 306, // 359: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp + 306, // 360: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp + 20, // 361: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode + 21, // 362: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain + 16, // 363: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction + 123, // 364: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue + 306, // 365: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 306, // 366: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 137, // 367: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 167, // 368: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding + 137, // 369: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 26, // 370: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest + 28, // 371: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest + 30, // 372: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest + 54, // 373: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest + 65, // 374: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest + 67, // 375: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest + 68, // 376: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest + 58, // 377: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest + 59, // 378: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest + 60, // 379: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest + 61, // 380: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest + 69, // 381: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest + 70, // 382: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest + 71, // 383: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest + 89, // 384: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 72, // 385: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest + 73, // 386: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest + 74, // 387: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest + 75, // 388: openshell.v1.OpenShell.SuspendSandbox:input_type -> openshell.v1.SuspendSandboxRequest + 76, // 389: openshell.v1.OpenShell.ResumeSandbox:input_type -> openshell.v1.ResumeSandboxRequest + 94, // 390: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest + 96, // 391: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest + 97, // 392: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest + 98, // 393: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest + 100, // 394: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest + 104, // 395: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest + 106, // 396: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest + 112, // 397: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame + 113, // 398: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput + 120, // 399: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest + 121, // 400: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest + 122, // 401: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest + 125, // 402: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest + 130, // 403: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest + 131, // 404: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest + 156, // 405: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest + 158, // 406: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest + 160, // 407: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest + 126, // 408: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest + 144, // 409: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest + 146, // 410: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest + 148, // 411: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest + 150, // 412: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest + 127, // 413: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest + 163, // 414: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest + 322, // 415: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest + 323, // 416: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest + 173, // 417: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest + 183, // 418: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest + 185, // 419: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest + 187, // 420: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest + 269, // 421: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 91, // 422: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 190, // 423: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest + 165, // 424: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest + 171, // 425: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest + 193, // 426: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest + 194, // 427: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest + 197, // 428: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage + 209, // 429: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest + 211, // 430: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest + 217, // 431: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame + 219, // 432: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame + 91, // 433: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 269, // 434: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 89, // 435: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 222, // 436: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest + 116, // 437: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest + 232, // 438: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest + 234, // 439: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest + 236, // 440: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest + 238, // 441: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest + 241, // 442: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest + 243, // 443: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest + 245, // 444: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest + 247, // 445: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest + 249, // 446: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest + 22, // 447: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest + 24, // 448: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest + 252, // 449: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest + 254, // 450: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest + 256, // 451: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest + 258, // 452: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest + 261, // 453: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest + 263, // 454: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest + 265, // 455: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest + 55, // 456: openshell.v1.SandboxUpdates.UpdateSandbox:input_type -> openshell.v1.UpdateSandboxRequest + 27, // 457: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse + 29, // 458: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse + 31, // 459: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse + 77, // 460: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse + 66, // 461: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse + 77, // 462: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse + 78, // 463: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse + 62, // 464: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 62, // 465: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 63, // 466: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse + 64, // 467: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse + 79, // 468: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse + 80, // 469: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse + 81, // 470: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse + 90, // 471: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 93, // 472: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse + 77, // 473: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse + 77, // 474: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse + 77, // 475: openshell.v1.OpenShell.SuspendSandbox:output_type -> openshell.v1.SandboxResponse + 77, // 476: openshell.v1.OpenShell.ResumeSandbox:output_type -> openshell.v1.SandboxResponse + 95, // 477: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse + 103, // 478: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse + 103, // 479: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse + 99, // 480: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse + 101, // 481: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse + 105, // 482: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse + 110, // 483: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent + 112, // 484: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame + 110, // 485: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent + 128, // 486: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse + 128, // 487: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse + 124, // 488: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse + 129, // 489: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse + 155, // 490: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse + 154, // 491: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse + 157, // 492: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse + 159, // 493: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse + 161, // 494: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse + 128, // 495: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse + 145, // 496: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse + 147, // 497: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse + 149, // 498: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse + 151, // 499: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse + 162, // 500: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse + 164, // 501: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse + 324, // 502: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse + 325, // 503: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse + 182, // 504: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse + 184, // 505: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse + 186, // 506: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse + 188, // 507: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse + 272, // 508: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 92, // 509: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 191, // 510: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse + 168, // 511: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse + 172, // 512: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse + 196, // 513: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse + 195, // 514: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse + 198, // 515: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage + 210, // 516: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse + 212, // 517: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse + 217, // 518: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame + 219, // 519: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame + 92, // 520: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 272, // 521: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 90, // 522: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 223, // 523: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse + 117, // 524: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent + 233, // 525: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse + 235, // 526: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse + 237, // 527: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse + 239, // 528: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse + 242, // 529: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse + 244, // 530: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse + 246, // 531: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse + 248, // 532: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse + 251, // 533: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse + 23, // 534: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse + 25, // 535: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse + 253, // 536: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse + 255, // 537: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse + 257, // 538: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse + 259, // 539: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse + 262, // 540: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse + 264, // 541: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse + 266, // 542: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse + 77, // 543: openshell.v1.SandboxUpdates.UpdateSandbox:output_type -> openshell.v1.SandboxResponse + 457, // [457:544] is the sub-list for method output_type + 370, // [370:457] is the sub-list for method input_type + 370, // [370:370] is the sub-list for extension type_name + 370, // [370:370] is the sub-list for extension extendee + 0, // [0:370] is the sub-list for field type_name } func init() { file_openshell_proto_init() } @@ -22488,7 +22591,7 @@ func file_openshell_proto_init() { (*SandboxStreamEvent_Warning)(nil), (*SandboxStreamEvent_DraftPolicyUpdate)(nil), } - file_openshell_proto_msgTypes[151].OneofWrappers = []any{ + file_openshell_proto_msgTypes[152].OneofWrappers = []any{ (*PolicyMergeOperation_AddRule)(nil), (*PolicyMergeOperation_RemoveEndpoint)(nil), (*PolicyMergeOperation_RemoveRule)(nil), @@ -22496,15 +22599,15 @@ func file_openshell_proto_init() { (*PolicyMergeOperation_AddAllowRules)(nil), (*PolicyMergeOperation_RemoveBinary)(nil), } - file_openshell_proto_msgTypes[155].OneofWrappers = []any{} - file_openshell_proto_msgTypes[174].OneofWrappers = []any{ + file_openshell_proto_msgTypes[156].OneofWrappers = []any{} + file_openshell_proto_msgTypes[175].OneofWrappers = []any{ (*SupervisorMessage_Hello)(nil), (*SupervisorMessage_Heartbeat)(nil), (*SupervisorMessage_RelayOpenResult)(nil), (*SupervisorMessage_RelayClose)(nil), (*SupervisorMessage_ConfigUpdateResult)(nil), } - file_openshell_proto_msgTypes[175].OneofWrappers = []any{ + file_openshell_proto_msgTypes[176].OneofWrappers = []any{ (*GatewayMessage_SessionAccepted)(nil), (*GatewayMessage_SessionRejected)(nil), (*GatewayMessage_Heartbeat)(nil), @@ -22513,32 +22616,32 @@ func file_openshell_proto_init() { (*GatewayMessage_SessionRedirect)(nil), (*GatewayMessage_ConfigUpdate)(nil), } - file_openshell_proto_msgTypes[190].OneofWrappers = []any{ + file_openshell_proto_msgTypes[191].OneofWrappers = []any{ (*RelayOpen_Ssh)(nil), (*RelayOpen_Tcp)(nil), } - file_openshell_proto_msgTypes[194].OneofWrappers = []any{ + file_openshell_proto_msgTypes[195].OneofWrappers = []any{ (*RelayFrame_Init)(nil), (*RelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[196].OneofWrappers = []any{ + file_openshell_proto_msgTypes[197].OneofWrappers = []any{ (*PeerRelayFrame_Init)(nil), (*PeerRelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[199].OneofWrappers = []any{ + file_openshell_proto_msgTypes[200].OneofWrappers = []any{ (*PeerNotifyConfigUpdateRequest_Sandbox)(nil), (*PeerNotifyConfigUpdateRequest_Workspace)(nil), (*PeerNotifyConfigUpdateRequest_AllConnected)(nil), (*PeerNotifyConfigUpdateRequest_Provider)(nil), } - file_openshell_proto_msgTypes[253].OneofWrappers = []any{} + file_openshell_proto_msgTypes[254].OneofWrappers = []any{} type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)), NumEnums: 22, - NumMessages: 281, + NumMessages: 284, NumExtensions: 0, NumServices: 2, }, diff --git a/skills/debug-openshell-cluster/SKILL.md b/skills/debug-openshell-cluster/SKILL.md index 23d58efa25..8dd6eb8caf 100644 --- a/skills/debug-openshell-cluster/SKILL.md +++ b/skills/debug-openshell-cluster/SKILL.md @@ -1622,7 +1622,7 @@ credential failures. | Gateway fails before serving health after enabling an interceptor | Interceptor endpoint unavailable or manifest/binding validation failed | Gateway and interceptor logs; interceptor socket; `binding_policy`, phases, and failure policy | | Authenticated interceptor or middleware rejects gateway calls | Private CA or hostname mismatch, expected audience or issuer mismatch, stale/unknown `kid`, or malformed extension token | `tls_ca_cert_path`, registration `audience`, service verifier config and logs; fetch well-known metadata only through the already-trusted gateway TLS endpoint | | Provider profiles disappear after enabling an interceptor catalog | `provider_profile_sources` selected only an authoritative interceptor or returned invalid/duplicate IDs | Inspect source list and interceptor `Describe`/catalog logs; include `user` when composition with imported profiles is intended | -| `provider list-profiles` is empty on a new gateway | Profiles are import-only and nothing has been imported | Import with `openshell provider profile import --from providers --global`; an empty catalog is a valid ready state, not a failure | +| `provider list-profiles` is empty on a new gateway | Profiles are import-only and nothing has been imported | Import a reviewed profile with `openshell profile import -f --global`; an empty catalog is a valid ready state, not a failure. A directory import containing a profile that requires an unavailable adapter fails as a batch. | | Sandbox create or provider attach fails naming a missing profile | The provider's profile was never imported, was deleted, or lives at another scope | Import it at the scope the provider uses; the error names the profile ID and the command | | Gateway fails after registering supervisor middleware | Service unavailable, invalid manifest, duplicate binding, reserved name, or invalid payload/timeout limit | Middleware service and gateway logs; `[[openshell.supervisor.middleware]]`; `Describe` response | | Policy update rejects `network_middlewares` | Unknown middleware name, implementation-owned config invalid, duplicate order, broad/invalid host selector, or fail-closed coverage of `tls: skip` | Policy error, gateway logs, middleware `ValidateConfig`, selector and order fields | diff --git a/skills/openshell-cli/SKILL.md b/skills/openshell-cli/SKILL.md index b757172b7a..aa876b3573 100644 --- a/skills/openshell-cli/SKILL.md +++ b/skills/openshell-cli/SKILL.md @@ -207,7 +207,7 @@ openshell profile import --url https://example.com/profiles/my-profile.yaml binary grants before importing it. The URL path must end in `.yaml`, `.yml`, or `.json`; downloads are limited to 1 MiB and 15 seconds. -Use `profile describe` to inspect a definition's credential metadata, endpoints, TLS handling, MCP access settings, rule counts, binaries, source, and scope before creating a provider. Check for `tls: skip` and the uninspected-credential opt-in before relying on displayed L7 rules. List and describe accept table, JSON, and YAML output; use structured output for complete rule definitions, `--workspace` for a workspace catalog, or `--global` for platform scope. Use `profile export` when preparing an editable definition, `profile update --file ` to replace an existing custom profile with its current resource version, and `profile delete ...` to remove custom profiles. Provider instances remain under `provider`. +Use `profile describe` to inspect a definition's credential metadata, endpoints, TLS handling, MCP access settings, rule counts, binaries, source, and scope before creating a provider. Inspect structured output for declared environment defaults, discovery config keys, and required platform adapters. Renaming a profile preserves its declared behavior; the ID does not activate SDK defaults. An unavailable required adapter rejects import or attachment. Check for `tls: skip` and the uninspected-credential opt-in before relying on displayed L7 rules. List and describe accept table, JSON, and YAML output; use structured output for complete rule definitions, `--workspace` for a workspace catalog, or `--global` for platform scope. Use `profile export` when preparing an editable definition, `profile update --file ` to replace an existing custom profile with its current resource version, and `profile delete ...` to remove custom profiles. Provider instances remain under `provider`. Existing scripts can continue using `provider list-profiles` and `provider profile export/import/update/lint/delete`. These commands share the top-level handlers and preserve their arguments, output options, and workspace/global flags. Prefer `profile` when writing new commands. diff --git a/tasks/scripts/test-e2e-provider-profiles.sh b/tasks/scripts/test-e2e-provider-profiles.sh new file mode 100644 index 0000000000..9cf8180b2b --- /dev/null +++ b/tasks/scripts/test-e2e-provider-profiles.sh @@ -0,0 +1,37 @@ +#!/usr/bin/env bash +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +set -euo pipefail + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +# shellcheck source=e2e/support/gateway-common.sh +source "${ROOT}/e2e/support/gateway-common.sh" + +PROFILE_WORK="$(mktemp -d)" +trap 'rm -rf "${PROFILE_WORK}"' EXIT +mkdir -p "${PROFILE_WORK}/providers" +printf 'id: google-cloud\n' > "${PROFILE_WORK}/providers/google-cloud.yaml" +printf 'id: acme\nrequired_platform_adapter: gcp-metadata\n' > "${PROFILE_WORK}/providers/acme.yaml" + +capture_profile_import() { + printf '%s\n' "$*" >> "${PROFILE_WORK}/imports" +} + +e2e_import_example_provider_profiles capture_profile_import "${PROFILE_WORK}" +expected="provider profile import --file ${PROFILE_WORK}/providers/google-cloud.yaml --global" +if [ "$(cat "${PROFILE_WORK}/imports")" != "${expected}" ]; then + echo "FAIL: profile selection must follow adapter declarations, independent of ID" >&2 + exit 1 +fi + +fail_profile_import() { + return 1 +} + +if e2e_import_example_provider_profiles fail_profile_import "${PROFILE_WORK}" > "${PROFILE_WORK}/failure.log" 2>&1; then + echo "FAIL: an import error must fail gateway setup" >&2 + exit 1 +fi + +echo "E2E provider profile setup tests passed." diff --git a/tasks/test.toml b/tasks/test.toml index 2839c1cf0c..24f1da2a2f 100644 --- a/tasks/test.toml +++ b/tasks/test.toml @@ -15,6 +15,7 @@ depends = [ "test:postgres-runner", "test:gateway-pull-policy", "test:e2e-image-overrides", + "test:e2e-provider-profiles", "test:gateway-config", "test:packaging-assets", "test:qualification-summary", @@ -70,6 +71,12 @@ run = "tasks/scripts/test-e2e-image-overrides.sh" run_windows = "echo Skipping test:e2e-image-overrides: Unix E2E wrappers do not apply on Windows." hide = true +["test:e2e-provider-profiles"] +description = "Test E2E provider profile selection and import failures" +run = "bash tasks/scripts/test-e2e-provider-profiles.sh" +run_windows = "echo Skipping test:e2e-provider-profiles: Unix E2E wrappers do not apply on Windows." +hide = true + ["test:packaging-assets"] description = "Run static packaging asset tests" run = "tasks/scripts/test-packaging-assets.sh" From b17acd49f50007ded4ccd384ebaf74bb4879685f Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Mon, 28 Sep 2026 18:17:59 +0200 Subject: [PATCH 02/10] test(e2e): cover endpointless credentials with imported profile Signed-off-by: Philippe Martin --- e2e/python/test_sandbox_providers.py | 81 ++++++++++++++++++++-------- 1 file changed, 59 insertions(+), 22 deletions(-) diff --git a/e2e/python/test_sandbox_providers.py b/e2e/python/test_sandbox_providers.py index 6619c4b465..921fc9aa26 100644 --- a/e2e/python/test_sandbox_providers.py +++ b/e2e/python/test_sandbox_providers.py @@ -157,6 +157,25 @@ def imported_provider_profile( _delete_provider_profile(stub, profile.id) +def _endpointless_credential_profile(profile_id: str) -> openshell_pb2.ProviderProfile: + """Build an endpointless credential profile without a platform adapter.""" + return openshell_pb2.ProviderProfile( + id=profile_id, + display_name=f"{profile_id} display", + category=openshell_pb2.PROVIDER_PROFILE_CATEGORY_OTHER, + credentials=[ + openshell_pb2.ProviderProfileCredential( + name="api_token", + description="E2E endpointless credential", + env_vars=["E2E_ENDPOINTLESS_TOKEN"], + required=True, + auth_style="bearer", + header_name="authorization", + ) + ], + ) + + def _native_inference_profile( *, profile_id: str, @@ -348,24 +367,33 @@ def test_endpointless_profile_credentials_fail_closed_without_policy_binding( sandbox_client: SandboxClient, ) -> None: """Endpointless profile credentials are withheld without an explicit binding.""" - with provider( - sandbox_client._stub, - name="e2e-test-google-cloud-without-policy-binding", - provider_type="google-cloud", - credentials={"GCP_ADC_ACCESS_TOKEN": "gcp-e2e-token"}, - ) as provider_name: + profile_id = "e2e-endpointless-without-policy-binding" + with ( + imported_provider_profile( + sandbox_client._stub, + profile=_endpointless_credential_profile(profile_id), + source=f"{profile_id}.yaml", + ), + provider( + sandbox_client._stub, + name="e2e-test-endpointless-without-policy-binding", + provider_type=profile_id, + credentials={"E2E_ENDPOINTLESS_TOKEN": "e2e-token"}, + profile_workspace="default", + ) as provider_name, + ): spec = datamodel_pb2.SandboxSpec( policy=_default_policy(), providers=[provider_name], ) - def read_gcp_token() -> str: + def read_token() -> str: import os - return os.environ.get("GCP_ADC_ACCESS_TOKEN", "NOT_SET") + return os.environ.get("E2E_ENDPOINTLESS_TOKEN", "NOT_SET") with sandbox(spec=spec, delete_on_exit=True) as sb: - result = sb.exec_python(read_gcp_token) + result = sb.exec_python(read_token) assert result.exit_code == 0, result.stderr assert result.stdout.strip() == "NOT_SET" @@ -395,19 +423,28 @@ def test_endpointless_profile_credentials_use_explicit_policy_binding( sandbox_client: SandboxClient, ) -> None: """An endpointless profile emits credentials only with an explicit binding.""" - with provider( - sandbox_client._stub, - name="e2e-test-google-cloud-policy-binding", - provider_type="google-cloud", - credentials={"GCP_ADC_ACCESS_TOKEN": "gcp-e2e-token"}, - ) as provider_name: + profile_id = "e2e-endpointless-policy-binding" + with ( + imported_provider_profile( + sandbox_client._stub, + profile=_endpointless_credential_profile(profile_id), + source=f"{profile_id}.yaml", + ), + provider( + sandbox_client._stub, + name="e2e-test-endpointless-policy-binding", + provider_type=profile_id, + credentials={"E2E_ENDPOINTLESS_TOKEN": "e2e-token"}, + profile_workspace="default", + ) as provider_name, + ): policy = _default_policy() - policy.network_policies["gcp_storage"].CopyFrom( + policy.network_policies["endpointless_api"].CopyFrom( sandbox_pb2.NetworkPolicyRule( - name="gcp_storage", + name="endpointless_api", endpoints=[ sandbox_pb2.NetworkEndpoint( - host="storage.googleapis.com", + host="api.example.com", port=443, protocol="rest", access=sandbox_pb2.NETWORK_ACCESS_PRESET_FULL, @@ -423,16 +460,16 @@ def test_endpointless_profile_credentials_use_explicit_policy_binding( providers=[provider_name], ) - def read_gcp_token() -> str: + def read_token() -> str: import os - return os.environ.get("GCP_ADC_ACCESS_TOKEN", "NOT_SET") + return os.environ.get("E2E_ENDPOINTLESS_TOKEN", "NOT_SET") with sandbox(spec=spec, delete_on_exit=True) as sb: - result = sb.exec_python(read_gcp_token) + result = sb.exec_python(read_token) assert result.exit_code == 0, result.stderr assert _is_placeholder_for_env_key( - result.stdout.strip(), "GCP_ADC_ACCESS_TOKEN" + result.stdout.strip(), "E2E_ENDPOINTLESS_TOKEN" ) From c22dc222caf4704fc08019e047170052d2daa59c Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Tue, 29 Sep 2026 11:10:35 +0200 Subject: [PATCH 03/10] docs: update provider user documentation Signed-off-by: Philippe Martin --- docs/how-it-works/providers/google.mdx | 64 ++++++++++++++++++++++++-- 1 file changed, 60 insertions(+), 4 deletions(-) diff --git a/docs/how-it-works/providers/google.mdx b/docs/how-it-works/providers/google.mdx index 7db7be00cb..b605acda42 100644 --- a/docs/how-it-works/providers/google.mdx +++ b/docs/how-it-works/providers/google.mdx @@ -218,6 +218,14 @@ endpoints by default. You must add endpoint rules to your sandbox policy for each GCP API the sandbox needs to reach. See "Using with GCP APIs" above for an example. +For a client that accepts bearer-token authentication directly, you can author +a [provider profile](/how-it-works/providers/profiles) with the needed Google +API endpoints, client `binaries`, project and region defaults, and an ADC or +service-account refresh strategy. Configure refresh on the provider and send +the token placeholder in an `Authorization: Bearer` header. If the profile has +no endpoints, bind the attached provider to each allowed host in the +[sandbox policy](/how-it-works/providers/profiles#understand-static-credential-endpoint-binding). + ## Vertex AI The `google-vertex-ai` provider gives selected sandboxes access to native @@ -237,12 +245,24 @@ native Vertex endpoint and request format for its selected model. ### Create a Vertex AI Provider -Import the `google-vertex-ai` profile first: +Copy the example profile and set its top-level `binaries` to the absolute paths +of the clients that will call Vertex AI from your sandbox image. The example +declares no binaries, so importing it unchanged does not authorize a client. +For a Claude Code installation, use the resolved executable path inside the +image; `command -v claude` may return a symlink to a versioned binary. Include +the path to `curl` if you plan to use the native API example below. ```shell -openshell profile import --url https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/google-vertex-ai.yaml --global +curl -fsSLo google-vertex-ai.yaml https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/google-vertex-ai.yaml +# Edit google-vertex-ai.yaml and add, for example: +# binaries: [/usr/bin/curl, /path/to/resolved/claude] +openshell profile lint -f google-vertex-ai.yaml +openshell profile import -f google-vertex-ai.yaml --global ``` +To find the resolved path, run `readlink -f "$(command -v claude)"` inside the +image. + #### Service Account Key Create the provider for runtime credentials: @@ -251,6 +271,7 @@ Create the provider for runtime credentials: openshell provider create \ --name vertex-prod \ --type google-vertex-ai \ + --global-profile \ --runtime-credentials \ --config VERTEX_AI_PROJECT_ID=my-gcp-project \ --config VERTEX_AI_REGION=us-central1 @@ -290,6 +311,7 @@ gcloud auth application-default login openshell provider create \ --name vertex-local \ --type google-vertex-ai \ + --global-profile \ --from-gcloud-adc \ --config VERTEX_AI_PROJECT_ID=my-gcp-project \ --config VERTEX_AI_REGION=us-central1 @@ -331,6 +353,35 @@ Launch a new process after runtime attachment so it receives the provider environment. Existing processes do not gain newly attached environment variables. +### Run Claude Code with Vertex AI + +Use an image with Claude Code installed and include its resolved executable +path in the imported profile's `binaries`. After attaching the provider, start +an interactive shell: + +```shell +openshell sandbox connect vertex-agent +``` + +Then start Claude Code inside the sandbox: + +```shell +vertex_token=${GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN:-${GOOGLE_VERTEX_AI_TOKEN:-}} +test -n "$vertex_token" || { echo "Vertex token unavailable" >&2; exit 1; } +ANTHROPIC_AUTH_TOKEN="$vertex_token" \ + CLAUDE_CODE_USE_VERTEX=1 \ + CLAUDE_CODE_SKIP_VERTEX_AUTH=1 \ + claude +``` + +Run these commands in the sandbox shell so the token comes from the attached +provider. The project and region variables come from the profile. Claude Code +uses `ANTHROPIC_AUTH_TOKEN` for the bearer Authorization header and +`CLAUDE_CODE_SKIP_VERTEX_AUTH=1` to skip its own Google credential lookup. +OpenShell replaces the token placeholder on authorized Vertex requests. See +[Claude Code's gateway authentication settings](https://docs.anthropic.com/en/docs/claude-code/llm-gateway) +for the client environment variables. + ### Call the Native Vertex API Claude models use Vertex's publisher-model endpoint. Run a request from a new @@ -380,8 +431,13 @@ Common failures: provider profile's endpoint binding. - A Vertex 400 or 404 usually means the model, location, publisher path, or request body does not match the native API. -- A Vertex 401 or 403 can indicate an expired refresh grant or missing GCP IAM - permission. Check `provider refresh status` and the Vertex AI User role. +- A Vertex 401 with `CREDENTIALS_MISSING` means the request reached Google + without a usable Authorization header. For Claude Code, pass the provider + token through `ANTHROPIC_AUTH_TOKEN` as shown above; setting only + `CLAUDE_CODE_SKIP_VERTEX_AUTH=1` leaves the request unauthenticated. +- Other 401 responses can indicate an expired refresh grant. Check + `provider refresh status`. A 403 can indicate missing GCP IAM permission or + model access; check the Vertex AI User role and access to the selected model. Provider creation does not verify model access. The native request is the end-to-end check. From 6334bfc306acd68872a7fcb6822a376221a4fe9c Mon Sep 17 00:00:00 2001 From: John Myers <9696606+johntmyers@users.noreply.github.com> Date: Tue, 29 Sep 2026 09:12:35 -0700 Subject: [PATCH 04/10] docs(providers): correct Claude executable guidance Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> Signed-off-by: Philippe Martin --- docs/how-it-works/providers/google.mdx | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/docs/how-it-works/providers/google.mdx b/docs/how-it-works/providers/google.mdx index b605acda42..7668b01199 100644 --- a/docs/how-it-works/providers/google.mdx +++ b/docs/how-it-works/providers/google.mdx @@ -248,20 +248,28 @@ native Vertex endpoint and request format for its selected model. Copy the example profile and set its top-level `binaries` to the absolute paths of the clients that will call Vertex AI from your sandbox image. The example declares no binaries, so importing it unchanged does not authorize a client. -For a Claude Code installation, use the resolved executable path inside the -image; `command -v claude` may return a symlink to a versioned binary. Include -the path to `curl` if you plan to use the native API example below. +For a native Claude Code installation, use the resolved executable path inside +the image; `command -v claude` may return a symlink to a versioned binary. For +an npm or other script installation, use the resolved Node.js interpreter path +instead. OpenShell authorizes the executable and its trusted executable +ancestors, not the script path from the process command line. Include the path +to `curl` if you plan to use the native API example below. ```shell curl -fsSLo google-vertex-ai.yaml https://raw.githubusercontent.com/NVIDIA/OpenShell/main/providers/google-vertex-ai.yaml # Edit google-vertex-ai.yaml and add, for example: +# Native Claude Code: # binaries: [/usr/bin/curl, /path/to/resolved/claude] +# npm-installed Claude Code: +# binaries: [/usr/bin/curl, /path/to/resolved/node] openshell profile lint -f google-vertex-ai.yaml openshell profile import -f google-vertex-ai.yaml --global ``` -To find the resolved path, run `readlink -f "$(command -v claude)"` inside the -image. +For a native installation, find the resolved path with +`readlink -f "$(command -v claude)"`. For an npm installation, find the Node.js +interpreter with `readlink -f "$(command -v node)"`. Run the applicable command +inside the image. #### Service Account Key @@ -355,9 +363,10 @@ variables. ### Run Claude Code with Vertex AI -Use an image with Claude Code installed and include its resolved executable -path in the imported profile's `binaries`. After attaching the provider, start -an interactive shell: +Use an image with Claude Code installed. In the imported profile's `binaries`, +include the resolved Claude executable for a native installation or the +resolved Node.js interpreter for an npm installation. After attaching the +provider, start an interactive shell: ```shell openshell sandbox connect vertex-agent From 804eb203eb482dfbe426c4645998d5c7bb743b36 Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Fri, 2 Oct 2026 18:58:37 +0200 Subject: [PATCH 05/10] fix(providers): import restored GCP metadata profiles in E2E Allow standard non-Windows E2E lanes to import profiles requiring the restored supervisor metadata adapter. Keep the GCP token-response tests and remove unused compiled environment catalogs now declared by profiles. Signed-off-by: Philippe Martin --- crates/openshell-core/src/google_cloud.rs | 84 +-------------- .../src/provider_credentials.rs | 102 ++++++++++++++++++ crates/openshell-server/src/grpc/provider.rs | 4 +- e2e/support/gateway-common.sh | 6 +- tasks/scripts/test-e2e-provider-profiles.sh | 4 +- 5 files changed, 115 insertions(+), 85 deletions(-) diff --git a/crates/openshell-core/src/google_cloud.rs b/crates/openshell-core/src/google_cloud.rs index efc15a6527..a71f03b7b9 100644 --- a/crates/openshell-core/src/google_cloud.rs +++ b/crates/openshell-core/src/google_cloud.rs @@ -1,13 +1,11 @@ // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. // SPDX-License-Identifier: Apache-2.0 -//! Shared GCP constants for the metadata emulator, provider env injection, -//! and credential resolution. +//! Shared destinations and environment keys used by the GCP metadata emulator. //! -//! This module is the single source of truth for GCP naming: env var aliases, -//! provider config keys, token search order, and Vertex-specific env vars. -//! `openshell-server`, `openshell-providers`, and `openshell-sandbox` -//! import from here. +//! Provider environment defaults and discovery keys belong to imported +//! profiles; this module holds only the names required by the supervisor's +//! metadata protocol. // ── Metadata emulator ─────────────────────────────────────────────────────── @@ -23,28 +21,14 @@ pub fn is_metadata_destination(destination: std::net::SocketAddr) -> bool { destination == std::net::SocketAddr::from(([127, 0, 0, 1], 8174)) } -// ── Env var alias arrays ──────────────────────────────────────────────────── +// ── Metadata environment keys ─────────────────────────────────────────────── /// Env vars that carry the GCP project ID inside sandboxes. pub const PROJECT_ID_ENV_VARS: &[&str] = &["GCP_PROJECT_ID", "GOOGLE_CLOUD_PROJECT"]; -/// Env vars that carry the GCP region/location inside sandboxes. -pub const REGION_ENV_VARS: &[&str] = &["CLOUD_ML_REGION", "GCP_LOCATION"]; - /// Env vars that carry the GCP service account email inside sandboxes. pub const SERVICE_ACCOUNT_EMAIL_ENV_VARS: &[&str] = &["GCP_SERVICE_ACCOUNT_EMAIL"]; -// ── Provider config keys ──────────────────────────────────────────────────── - -/// Config key for project ID in `gcp` providers. -pub const GCP_PROJECT_ID_CONFIG_KEY: &str = "project_id"; - -/// Config key for region in `gcp` providers. -pub const GCP_REGION_CONFIG_KEY: &str = "region"; - -/// Config key for service account email in `gcp` providers. -pub const GCP_SERVICE_ACCOUNT_EMAIL_CONFIG_KEY: &str = "service_account_email"; - // ── Token search order ────────────────────────────────────────────────────── /// GCP token env vars searched in priority order by the metadata emulator. @@ -52,43 +36,9 @@ pub const GCP_SERVICE_ACCOUNT_EMAIL_CONFIG_KEY: &str = "service_account_email"; /// credential precedence. pub const TOKEN_ENV_KEYS: &[&str] = &["GCP_SA_ACCESS_TOKEN", "GCP_ADC_ACCESS_TOKEN"]; -// ── Vertex-specific env vars ──────────────────────────────────────────────── - -/// Env var injected to signal Vertex AI usage to Goose. -pub const GOOSE_PROVIDER_ENV_VAR: &str = "GOOSE_PROVIDER"; - -/// Env var for Anthropic Vertex project ID (consumed by Claude Code SDK). -pub const ANTHROPIC_VERTEX_PROJECT_ID_ENV_VAR: &str = "ANTHROPIC_VERTEX_PROJECT_ID"; - -/// Env var for Vertex location (consumed by Claude Code SDK). -pub const VERTEX_LOCATION_ENV_VAR: &str = "VERTEX_LOCATION"; - -/// Non-secret GCP/Vertex config vars that must be resolved to real values -/// in the child environment. Everything else stays as placeholders for -/// proxy-time resolution. -/// -/// This list MUST be the union of all alias arrays above plus all -/// Vertex-specific env vars. If you add an alias to `PROJECT_ID_ENV_VARS`, -/// `REGION_ENV_VARS`, or a Vertex constant, add it here too. -pub const STATIC_CONFIG_KEYS: &[&str] = &[ - // project_id aliases - "GCP_PROJECT_ID", - "GOOGLE_CLOUD_PROJECT", - // region aliases - "CLOUD_ML_REGION", - "GCP_LOCATION", - // service account email - "GCP_SERVICE_ACCOUNT_EMAIL", - // Vertex-specific non-secret config - GOOSE_PROVIDER_ENV_VAR, - ANTHROPIC_VERTEX_PROJECT_ID_ENV_VAR, - VERTEX_LOCATION_ENV_VAR, -]; - #[cfg(test)] mod tests { use super::*; - use std::collections::HashSet; #[test] fn metadata_destination_matches_only_reserved_loopback_endpoint() { @@ -104,28 +54,4 @@ mod tests { assert!(!is_metadata_destination(address.parse().unwrap())); } } - - #[test] - fn static_config_keys_matches_alias_arrays_and_vertex_vars() { - let expected: HashSet<&str> = PROJECT_ID_ENV_VARS - .iter() - .chain(REGION_ENV_VARS) - .chain(SERVICE_ACCOUNT_EMAIL_ENV_VARS) - .copied() - .chain([ - GOOSE_PROVIDER_ENV_VAR, - ANTHROPIC_VERTEX_PROJECT_ID_ENV_VAR, - VERTEX_LOCATION_ENV_VAR, - ]) - .collect(); - let actual: HashSet<&str> = STATIC_CONFIG_KEYS.iter().copied().collect(); - assert_eq!( - expected, - actual, - "STATIC_CONFIG_KEYS must be the union of all alias arrays + Vertex vars. \ - Missing: {:?}, Extra: {:?}", - expected.difference(&actual).collect::>(), - actual.difference(&expected).collect::>(), - ); - } } diff --git a/crates/openshell-core/src/provider_credentials.rs b/crates/openshell-core/src/provider_credentials.rs index b2cf162f03..3eeab6e71e 100644 --- a/crates/openshell-core/src/provider_credentials.rs +++ b/crates/openshell-core/src/provider_credentials.rs @@ -3380,6 +3380,108 @@ mod tests { ); } + #[test] + fn gcp_token_response_returns_sa_over_adc() { + let state = ProviderCredentialState::from_environment( + 1, + HashMap::from([ + ("GCP_SA_ACCESS_TOKEN".to_string(), "sa-tok".to_string()), + ("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string()), + ]), + HashMap::new(), + HashMap::new(), + ); + let (placeholder, _) = state.gcp_token_response().expect("should find token"); + assert_eq!( + placeholder, "openshell:resolve:env:v1_GCP_SA_ACCESS_TOKEN", + "metadata must return the current revision-scoped SA placeholder" + ); + } + + #[test] + fn gcp_token_response_falls_back_to_adc() { + let state = ProviderCredentialState::from_environment( + 1, + HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), + HashMap::new(), + HashMap::new(), + ); + let (placeholder, _) = state.gcp_token_response().expect("should find ADC token"); + assert_eq!( + placeholder, "openshell:resolve:env:v1_GCP_ADC_ACCESS_TOKEN", + "metadata must return the current revision-scoped ADC placeholder" + ); + } + + #[test] + fn gcp_token_response_returns_none_without_gcp() { + let state = ProviderCredentialState::from_environment( + 1, + HashMap::from([("GITHUB_TOKEN".to_string(), "ghp_abc".to_string())]), + HashMap::new(), + HashMap::new(), + ); + assert!(state.gcp_token_response().is_none()); + } + + #[test] + fn gcp_token_response_defaults_expires_in_to_3600() { + let state = ProviderCredentialState::from_environment( + 1, + HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), + HashMap::new(), + HashMap::new(), + ); + let (_, expires_in) = state.gcp_token_response().unwrap(); + assert_eq!( + expires_in, 3600, + "should default to 3600 when no expiry set" + ); + } + + #[test] + fn gcp_token_response_calculates_remaining() { + let now_ms = i64::try_from( + std::time::SystemTime::now() + .duration_since(std::time::UNIX_EPOCH) + .unwrap() + .as_millis(), + ) + .unwrap(); + let state = ProviderCredentialState::from_environment( + 1, + HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), + HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), now_ms + 120_000)]), + HashMap::new(), + ); + let (_, expires_in) = state.gcp_token_response().unwrap(); + assert!( + (110..=120).contains(&expires_in), + "expected ~120s remaining, got {expires_in}" + ); + } + + #[test] + fn gcp_token_response_handles_already_expired_token_without_panic() { + let now_ms = i64::try_from( + std::time::SystemTime::now() + .duration_since(std::time::UNIX_EPOCH) + .unwrap() + .as_millis(), + ) + .unwrap(); + let state = ProviderCredentialState::from_environment( + 1, + HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), "adc-tok".to_string())]), + HashMap::from([("GCP_ADC_ACCESS_TOKEN".to_string(), now_ms - 1_000)]), + HashMap::new(), + ); + assert!( + state.gcp_token_response().is_none(), + "expired token should be skipped rather than panic" + ); + } + #[test] fn child_env_with_non_secret_resolved_resolves_vertex_vars_without_metadata_host() { let state = ProviderCredentialState::from_bound_environment( diff --git a/crates/openshell-server/src/grpc/provider.rs b/crates/openshell-server/src/grpc/provider.rs index 031720e11f..d7599f1dad 100644 --- a/crates/openshell-server/src/grpc/provider.rs +++ b/crates/openshell-server/src/grpc/provider.rs @@ -6330,8 +6330,8 @@ mod tests { assert!(response.imported, "{:?}", response.diagnostics); } - // Existing stored profiles and interceptor-vended profiles must also - // fail at attachment, even when they did not pass this build's import. + // Existing stored and interceptor-vended profiles must pass the same + // capability check at attachment as profiles imported in this build. state .store .put_message(&stored_provider_profile(profile)) diff --git a/e2e/support/gateway-common.sh b/e2e/support/gateway-common.sh index 268c06ece4..f9a9e248c8 100644 --- a/e2e/support/gateway-common.sh +++ b/e2e/support/gateway-common.sh @@ -334,9 +334,9 @@ e2e_import_example_provider_profiles() { echo "Importing example provider profiles from ${root}/providers..." for profile in "${root}"/providers/*.yaml; do adapter="$(yq -r '.required_platform_adapter // ""' "${profile}")" || return 1 - # The standard test runtimes provide no platform adapters. Specialized - # suites must provision the capability before importing a profile needing it. - if [ -n "${adapter}" ]; then + # The standard Linux test runtimes provide the supervisor GCP metadata + # adapter. Other platform adapters need a specialized suite. + if [ -n "${adapter}" ] && [ "${adapter}" != "gcp-metadata" ]; then echo "Skipping ${profile}: requires platform adapter ${adapter}" continue fi diff --git a/tasks/scripts/test-e2e-provider-profiles.sh b/tasks/scripts/test-e2e-provider-profiles.sh index 9cf8180b2b..57f3aa2f34 100644 --- a/tasks/scripts/test-e2e-provider-profiles.sh +++ b/tasks/scripts/test-e2e-provider-profiles.sh @@ -13,13 +13,15 @@ trap 'rm -rf "${PROFILE_WORK}"' EXIT mkdir -p "${PROFILE_WORK}/providers" printf 'id: google-cloud\n' > "${PROFILE_WORK}/providers/google-cloud.yaml" printf 'id: acme\nrequired_platform_adapter: gcp-metadata\n' > "${PROFILE_WORK}/providers/acme.yaml" +printf 'id: future\nrequired_platform_adapter: future-adapter\n' > "${PROFILE_WORK}/providers/future.yaml" capture_profile_import() { printf '%s\n' "$*" >> "${PROFILE_WORK}/imports" } e2e_import_example_provider_profiles capture_profile_import "${PROFILE_WORK}" -expected="provider profile import --file ${PROFILE_WORK}/providers/google-cloud.yaml --global" +expected="provider profile import --file ${PROFILE_WORK}/providers/acme.yaml --global +provider profile import --file ${PROFILE_WORK}/providers/google-cloud.yaml --global" if [ "$(cat "${PROFILE_WORK}/imports")" != "${expected}" ]; then echo "FAIL: profile selection must follow adapter declarations, independent of ID" >&2 exit 1 From e0256709fdf8082274904e85fd581a58485e51f8 Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Fri, 2 Oct 2026 21:26:56 +0200 Subject: [PATCH 06/10] fix(e2e): remove stale GCP metadata check from endpointless test Signed-off-by: Philippe Martin --- e2e/python/test_sandbox_providers.py | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/e2e/python/test_sandbox_providers.py b/e2e/python/test_sandbox_providers.py index 921fc9aa26..a7fe2d57c5 100644 --- a/e2e/python/test_sandbox_providers.py +++ b/e2e/python/test_sandbox_providers.py @@ -397,26 +397,6 @@ def read_token() -> str: assert result.exit_code == 0, result.stderr assert result.stdout.strip() == "NOT_SET" - def read_metadata_token_status() -> int: - import os - import urllib.error - import urllib.request - - request = urllib.request.Request( - f"http://{os.environ['GCE_METADATA_HOST']}/computeMetadata/v1/instance/service-accounts/default/token", - headers={"Metadata-Flavor": "Google"}, - ) - opener = urllib.request.build_opener(urllib.request.ProxyHandler({})) - try: - with opener.open(request, timeout=5) as response: - return response.status - except urllib.error.HTTPError as error: - return error.code - - result = sb.exec_python(read_metadata_token_status) - assert result.exit_code == 0, result.stderr - assert result.stdout.strip() == "503" - def test_endpointless_profile_credentials_use_explicit_policy_binding( sandbox: Callable[..., Sandbox], From 7ac9c173d14979906758515674ff588d87abbeff Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Fri, 6 Nov 2026 14:51:20 +0100 Subject: [PATCH 07/10] docs: clarify provider migrations for OpenShell 0.2.0 Move Google Cloud and Vertex migration guidance out of the shipped 0.1.0 upgrade guide and add the 0.2.0 guide to navigation. Explain profile-declared SDK defaults and discovery, the restriction on GOOGLE_SERVICE_ACCOUNT_KEY across all profile IDs, and migration to gateway-managed credential refresh. Add custom-profile examples and a workload authentication check, with generic release metadata and sections for operators. Validation: docs validation passed with 0 errors and 3 warnings. Markdown lint, YAML and shell example syntax checks, and git diff --check passed. Signed-off-by: Philippe Martin --- docs/index.yml | 2 + docs/upgrade/0-1-0.mdx | 25 +---- docs/upgrade/0-2-0.mdx | 236 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 239 insertions(+), 24 deletions(-) create mode 100644 docs/upgrade/0-2-0.mdx diff --git a/docs/index.yml b/docs/index.yml index 596ac87172..7baee220d7 100644 --- a/docs/index.yml +++ b/docs/index.yml @@ -134,6 +134,8 @@ navigation: - section: "Upgrade Guides" slug: upgrade contents: + - page: "0.2.0" + path: upgrade/0-2-0.mdx - page: "0.1.0" path: upgrade/0-1-0.mdx - folder: resources diff --git a/docs/upgrade/0-1-0.mdx b/docs/upgrade/0-1-0.mdx index 4c6ebdd5f6..2e7ea7a37a 100644 --- a/docs/upgrade/0-1-0.mdx +++ b/docs/upgrade/0-1-0.mdx @@ -28,32 +28,9 @@ If you run OpenShell for a team, start here. - **Export provider profiles before upgrading.** The gateway no longer includes built-in profiles. Import the saved profiles after the upgrade at the same global or workspace scope. Replace profile aliases such as `claude` and `gh` with the canonical IDs `claude-code` and `github` ([PR #2962](https://github.com/NVIDIA/OpenShell/pull/2962), [PR #3383](https://github.com/NVIDIA/OpenShell/pull/3383)). - Google Cloud and Vertex profiles must also declare their environment and - discovery effects. Merge `environment.config`, `environment.fixed`, and - `discovery.config_env_vars` from the current examples into existing profiles. - Their IDs no longer activate SDK defaults or discovery keys. Keep credentials - out of these non-secret fields; lint rejects collisions with credential - `env_vars`. For Vertex service accounts, create with `--runtime-credentials` - and configure refresh material directly. Remove the obsolete - `GOOGLE_SERVICE_ACCOUNT_KEY` credential declaration. See - [profile environment declarations](/how-it-works/providers/profiles#declare-environment-and-discovery-behavior). - New imports reject that legacy credential key. Gateways also withhold it - from workloads when an older profile remains stored, but operators should - remove the obsolete declaration and migrate its private key to refresh - material. A stored provider record may retain the old key during the upgrade; - it remains excluded from the workload without withholding the provider's - access token or non-secret SDK settings. The key is also rejected in - `environment.config` and `environment.fixed`. - - The Google Cloud metadata example also declares - `required_platform_adapter: gcp-metadata`. The supervisor provides this - adapter for Linux sandboxes using Docker, Podman, Kubernetes, or VM. - Windows/MXC rejects that requirement during import or attachment. Native - Vertex bearer-token authentication does not require this adapter. - ```shell openshell provider profile export -o yaml --global > .yaml - openshell profile import -f --global + openshell profile import --from ./profiles --global ``` - **Migrate `gateway.toml` to schema version 2.** Add the version, replace the plural compute-driver selector, move driver settings under `[openshell.drivers.]`, and apply the renamed Docker, Podman, and VM fields. Validate the file before restarting. See [Gateway Configuration](/how-it-works/gateways/configuration#migrate-to-schema-version-2) for the complete field mapping and [PR #2814](https://github.com/NVIDIA/OpenShell/pull/2814) for the implementation. diff --git a/docs/upgrade/0-2-0.mdx b/docs/upgrade/0-2-0.mdx new file mode 100644 index 0000000000..d305d3b36d --- /dev/null +++ b/docs/upgrade/0-2-0.mdx @@ -0,0 +1,236 @@ +--- +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +title: "Upgrade to NVIDIA OpenShell 0.2.0" +sidebar-title: "0.2.0" +description: "Prepare OpenShell operators and users for the breaking changes in version 0.2.0." +keywords: "Generative AI, Cybersecurity, AI Agents, Sandboxing, Upgrade, Migration" +--- + +OpenShell 0.2.0 introduces breaking changes. Review the changes that apply to +your role before upgrading from OpenShell 0.1.x to 0.2.0. + +## Operators + +If you run OpenShell for a team, start here. + +### Migrate Google Cloud and Vertex AI profiles + +In OpenShell 0.1.x, the gateway recognized the Google profile IDs and added SDK +settings that were absent from the imported YAML. Exporting a profile did not +show all of its effects, and copying it under a new ID could lose the automatic +project, region, and client settings. + +Google Cloud and Vertex AI profiles must declare their environment defaults and +local discovery behavior. The `google-cloud` and `google-vertex-ai` IDs no longer +activate SDK configuration or discovery keys. These declarations let you review +and customize the SDK settings in the profile itself. A renamed copy keeps the +same behavior because it carries those settings with it. + +The discovery declarations also make the local setup inputs explicit. You can +review which variables `--from-existing` uses to discover credentials and +non-secret project or region configuration before creating or updating a +provider. + + +An existing profile without an `environment` block still attaches successfully, +without a migration warning. Its sandboxes receive credential placeholders but +no profile-provided project, region, client-selection, or metadata-discovery +settings, including `GOOSE_PROVIDER`, `ANTHROPIC_VERTEX_PROJECT_ID`, and +`GCE_METADATA_HOST`. + +Without the metadata host setting, Google SDKs can fall back to the cloud +metadata address `169.254.169.254`, which OpenShell blocks. Workloads can report +metadata discovery, missing project, or authentication errors even though the +provider attached successfully. + + +Export each existing Google profile before upgrading. For example, export a +platform-scoped Google Cloud profile: + +```shell +openshell profile export google-cloud -o yaml --global > google-cloud.yaml +``` + +Merge `environment.config`, `environment.fixed`, and `discovery.config_env_vars` +from the current [Google Cloud](https://github.com/NVIDIA/OpenShell/blob/main/providers/google-cloud.yaml) +or [Vertex AI](https://github.com/NVIDIA/OpenShell/blob/main/providers/google-vertex-ai.yaml) +example into the exported profile. Preserve its `resource_version`, binary +restrictions, and endpoints. Keep credentials out of these non-secret fields; +lint rejects collisions with credential `env_vars`. See +[profile environment declarations](/how-it-works/providers/profiles#declare-environment-and-discovery-behavior). + +For example, merge these declarations into a Vertex profile whose provider +config uses `VERTEX_AI_PROJECT_ID` and `VERTEX_AI_REGION`. Entries under +`discovery.credentials` refer to names in the profile's top-level `credentials` +list. This example selects `service_account_token`; keep any other valid +selections from your exported profile: + +```yaml +environment: + config: + GCP_PROJECT_ID: VERTEX_AI_PROJECT_ID + GOOGLE_CLOUD_PROJECT: VERTEX_AI_PROJECT_ID + ANTHROPIC_VERTEX_PROJECT_ID: VERTEX_AI_PROJECT_ID + CLOUD_ML_REGION: VERTEX_AI_REGION + GCP_LOCATION: VERTEX_AI_REGION + VERTEX_LOCATION: VERTEX_AI_REGION + fixed: + GOOSE_PROVIDER: gcp_vertex_ai +discovery: + credentials: [service_account_token] + config_env_vars: + - VERTEX_AI_PROJECT_ID + - VERTEX_AI_REGION +``` + +If a profile declares `GOOGLE_SERVICE_ACCOUNT_KEY`, +[migrate its private key](#migrate-service-account-private-keys) before updating +the profile. + +On the upgraded gateway, lint the edited profile and update the existing +definition: + +```shell +openshell profile lint -f google-cloud.yaml --global +openshell profile update google-cloud -f google-cloud.yaml --global +``` + +Repeat for `google-vertex-ai` and any copies imported under other IDs. Use the +same scope as the existing profile; omit `--global` for workspace-scoped +profiles. Import is create-only, so use `profile import` only when the profile +does not already exist. See [profile management](/how-it-works/providers/profiles#provider-profiles). + +The Google Cloud metadata example also declares +`required_platform_adapter: gcp-metadata`. The supervisor provides this service +for Linux sandboxes using Docker, Podman, Kubernetes, or VM. Windows/MXC does not +provide the metadata endpoint. Native Vertex bearer-token authentication does +not require this adapter. + +### Migrate service-account private keys + +OpenShell 0.2.0 stops injecting `GOOGLE_SERVICE_ACCOUNT_KEY` for every provider +profile, including custom profiles and renamed forks. Previously, this +restriction applied only to `google-vertex-ai`. + +Service-account JSON contains a long-lived signing key used to mint access +tokens. Gateway-managed refresh keeps that key in the configured credential +store and renews short-lived access tokens automatically. Workloads receive an +opaque token placeholder that OpenShell resolves on authorized outbound +requests. Applying the restriction to every profile ID keeps the signing key +out of this legacy credential path even when a profile is renamed or customized. + +An older stored provider record can retain this key, but the gateway omits it +from sandbox workloads. Attachment can still succeed, while a client that +depends on the key fails to authenticate. In gateway logs, look for +`skipping non-injectable provider credential` or +`skipping non-injectable provider credential handle` with the key +`GOOGLE_SERVICE_ACCOUNT_KEY`. The gateway continues to supply the provider's +other valid access tokens and declared non-secret SDK settings. + +Before upgrading, remove `GOOGLE_SERVICE_ACCOUNT_KEY` from the profile's +credential declarations and configure its private key as gateway-managed +refresh material. Use refreshed access tokens in workloads. For new Vertex +service-account providers, create with `--runtime-credentials` and configure +refresh directly. Follow the [Vertex service-account workflow](/how-it-works/providers/google#create-a-vertex-ai-provider). + +New profile imports reject `GOOGLE_SERVICE_ACCOUNT_KEY` in credential +declarations and in `environment.config` or `environment.fixed`. Keep the +private key in refresh configuration when migrating custom profiles. + +#### Example custom profile migration + +This example migrates an existing platform-scoped profile named `acme-vertex`, +used by a provider named `acme-vertex-prod`. The profile already declares its +client's Vertex endpoints and binaries, and uses the environment declarations +above. Export its current definition: + +```shell +openshell profile export acme-vertex -o yaml --global > acme-vertex.yaml +``` + +The legacy entry in its `credentials` list might look like this: + +```yaml +- name: service_account_key + env_vars: [GOOGLE_SERVICE_ACCOUNT_KEY] + required: true +``` + +Replace that entry with a refreshable access-token declaration. These snippets +show individual credential entries; preserve the rest of the exported profile, +including its `resource_version`, binary restrictions, and endpoints: + +```yaml +- name: service_account_token + env_vars: [ACME_VERTEX_ACCESS_TOKEN] + required: false + auth_style: bearer + header_name: authorization + refresh: + strategy: google_service_account_jwt + token_url: https://oauth2.googleapis.com/token + scopes: [https://www.googleapis.com/auth/cloud-platform] + refresh_before_seconds: 300 + max_lifetime_seconds: 3600 + material: + - name: client_email + required: true + - name: private_key + required: true + secret: true +``` + +If `discovery.credentials` includes `service_account_key`, replace that selection +with `service_account_token`. Keep any other credential entries and discovery +selections that still apply. On the upgraded gateway, validate and update the +existing profile: + +```shell +openshell profile lint -f acme-vertex.yaml --global +openshell profile update acme-vertex -f acme-vertex.yaml --global +``` + +Configure refresh for the existing provider using your service-account JSON +file. This example requires `jq`; replace `/path/to/key.json` with your file's +path. `--secret-material-env` reads the private key from the local environment +and stores it as secret refresh material: + +```shell +export GCP_PRIVATE_KEY="$(jq -er .private_key /path/to/key.json)" +openshell provider refresh configure acme-vertex-prod \ + --credential-key ACME_VERTEX_ACCESS_TOKEN \ + --strategy google-service-account-jwt \ + --material client_email="$(jq -er .client_email /path/to/key.json)" \ + --secret-material-env private_key=GCP_PRIVATE_KEY +unset GCP_PRIVATE_KEY + +openshell provider refresh rotate acme-vertex-prod \ + --credential-key ACME_VERTEX_ACCESS_TOKEN +openshell provider refresh status acme-vertex-prod +``` + +Wait for refresh to complete, then restart clients so they receive the new token +placeholder. Update clients to send `ACME_VERTEX_ACCESS_TOKEN` as the bearer +token instead of reading service-account JSON from `GOOGLE_SERVICE_ACCOUNT_KEY`. + +#### Verify the migrated credential + +For a sandbox named `vertex-agent` with `acme-vertex-prod` attached, launch a new +process to verify the legacy key is absent and the token authorizes a Vertex +API request. The image must include `curl`, its executable must be authorized +by the profile's `binaries`, and the profile must allow the regional Vertex +endpoint. Set the provider's project and region config to values your service +account can access. The following request lists models without printing the +token or response body: + +```shell +openshell sandbox exec -n vertex-agent -- sh -c ' + test -z "${GOOGLE_SERVICE_ACCOUNT_KEY+x}" && + test -n "${ACME_VERTEX_ACCESS_TOKEN:-}" && + curl --fail --silent --show-error --output /dev/null \ + -H "Authorization: Bearer $ACME_VERTEX_ACCESS_TOKEN" \ + "https://${CLOUD_ML_REGION}-aiplatform.googleapis.com/v1/projects/${GOOGLE_CLOUD_PROJECT}/locations/${CLOUD_ML_REGION}/models" && + printf "%s\n" "Vertex authentication succeeded; legacy key absent." +' +``` From 0d61fd5cbd0819cd1aad2b0f363f98329fb6bbc8 Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Mon, 9 Nov 2026 10:00:47 +0100 Subject: [PATCH 08/10] chore(sdk/go): restore the frozen Go SDK snapshot Drop the six Go SDK updates from this branch after the SDK moved to ai-openshell/sdk-go. Restore the generated protobuf bindings, profile types, converters, and tests together to keep the snapshot consistent. The Go SDK CI gate was removed in #5245 and replaced with a freeze check that rejects additions or modifications under sdk/go. Support for the new provider profile fields belongs in the standalone SDK repository. Validation: mise run go:test passed, including race detection and compatibility tests. Verified sdk/go matches the branch merge base and git diff --check passes. Signed-off-by: Philippe Martin --- .../v1/internal/converter/coverage_test.go | 30 +- .../v1/internal/converter/profile.go | 58 +- .../v1/internal/converter/profile_test.go | 29 - sdk/go/openshell/v1/profile.go | 3 - sdk/go/openshell/v1/types/profile.go | 31 +- sdk/go/proto/openshellv1/openshell.pb.go | 2229 ++++++++--------- 6 files changed, 1108 insertions(+), 1272 deletions(-) diff --git a/sdk/go/openshell/v1/internal/converter/coverage_test.go b/sdk/go/openshell/v1/internal/converter/coverage_test.go index d3b6fb8907..8a457d0014 100644 --- a/sdk/go/openshell/v1/internal/converter/coverage_test.go +++ b/sdk/go/openshell/v1/internal/converter/coverage_test.go @@ -336,22 +336,20 @@ func TestConverterCoversAllProtoFields_SandboxPolicyRevision(t *testing.T) { func TestConverterCoversAllProtoFields_ProviderProfile(t *testing.T) { handled := fieldSet{ - "id": true, - "display_name": true, - "description": true, - "category": true, - "credentials": true, - "files": true, - "endpoints": true, - "binaries": true, - "inference_capable": true, - "discovery": true, - "resource_version": true, - "annotations": true, - "source": true, - "scope": true, - "environment": true, - "required_platform_adapter": true, + "id": true, + "display_name": true, + "description": true, + "category": true, + "credentials": true, + "files": true, + "endpoints": true, + "binaries": true, + "inference_capable": true, + "discovery": true, + "resource_version": true, + "annotations": true, + "source": true, + "scope": true, } assertAllFieldsCovered(t, (&pb.ProviderProfile{}).ProtoReflect().Descriptor(), handled, nil) diff --git a/sdk/go/openshell/v1/internal/converter/profile.go b/sdk/go/openshell/v1/internal/converter/profile.go index cf749b7374..b3a5ee88c8 100644 --- a/sdk/go/openshell/v1/internal/converter/profile.go +++ b/sdk/go/openshell/v1/internal/converter/profile.go @@ -344,16 +344,15 @@ func ProviderProfileFromProto(p *pb.ProviderProfile) *types.ProviderProfile { } result := &types.ProviderProfile{ - ID: p.GetId(), - DisplayName: p.GetDisplayName(), - Description: p.GetDescription(), - Category: ProfileCategoryFromProto(p.GetCategory()), - InferenceCapable: p.GetInferenceCapable(), - ResourceVersion: p.GetResourceVersion(), - Annotations: CopyStringMap(p.GetAnnotations()), - Source: p.GetSource(), - Scope: p.GetScope(), - RequiredPlatformAdapter: p.GetRequiredPlatformAdapter(), + ID: p.GetId(), + DisplayName: p.GetDisplayName(), + Description: p.GetDescription(), + Category: ProfileCategoryFromProto(p.GetCategory()), + InferenceCapable: p.GetInferenceCapable(), + ResourceVersion: p.GetResourceVersion(), + Annotations: CopyStringMap(p.GetAnnotations()), + Source: p.GetSource(), + Scope: p.GetScope(), } // Credentials @@ -401,14 +400,7 @@ func ProviderProfileFromProto(p *pb.ProviderProfile) *types.ProviderProfile { // Discovery if d := p.GetDiscovery(); d != nil { result.Discovery = types.ProfileDiscovery{ - Credentials: CopyStringSlice(d.GetCredentials()), - ConfigEnvVars: CopyStringSlice(d.GetConfigEnvVars()), - } - } - if e := p.GetEnvironment(); e != nil { - result.Environment = &types.ProfileEnvironment{ - Config: CopyStringMap(e.GetConfig()), - Fixed: CopyStringMap(e.GetFixed()), + Credentials: CopyStringSlice(d.GetCredentials()), } } @@ -422,16 +414,15 @@ func ProviderProfileToProto(p *types.ProviderProfile) *pb.ProviderProfile { } result := &pb.ProviderProfile{ - Id: p.ID, - DisplayName: p.DisplayName, - Description: p.Description, - Category: ProfileCategoryToProto(p.Category), - InferenceCapable: p.InferenceCapable, - ResourceVersion: p.ResourceVersion, - Annotations: CopyStringMap(p.Annotations), - Source: p.Source, - Scope: p.Scope, - RequiredPlatformAdapter: p.RequiredPlatformAdapter, + Id: p.ID, + DisplayName: p.DisplayName, + Description: p.Description, + Category: ProfileCategoryToProto(p.Category), + InferenceCapable: p.InferenceCapable, + ResourceVersion: p.ResourceVersion, + Annotations: CopyStringMap(p.Annotations), + Source: p.Source, + Scope: p.Scope, } // Credentials @@ -469,16 +460,9 @@ func ProviderProfileToProto(p *types.ProviderProfile) *pb.ProviderProfile { } // Discovery - if len(p.Discovery.Credentials) > 0 || len(p.Discovery.ConfigEnvVars) > 0 { + if len(p.Discovery.Credentials) > 0 { result.Discovery = &pb.ProviderProfileDiscovery{ - Credentials: CopyStringSlice(p.Discovery.Credentials), - ConfigEnvVars: CopyStringSlice(p.Discovery.ConfigEnvVars), - } - } - if p.Environment != nil { - result.Environment = &pb.ProviderProfileEnvironment{ - Config: CopyStringMap(p.Environment.Config), - Fixed: CopyStringMap(p.Environment.Fixed), + Credentials: CopyStringSlice(p.Discovery.Credentials), } } diff --git a/sdk/go/openshell/v1/internal/converter/profile_test.go b/sdk/go/openshell/v1/internal/converter/profile_test.go index 965336af5c..28f58533ba 100644 --- a/sdk/go/openshell/v1/internal/converter/profile_test.go +++ b/sdk/go/openshell/v1/internal/converter/profile_test.go @@ -465,35 +465,6 @@ func TestProfileDiagnosticFromProto_Nil(t *testing.T) { // --- ProviderProfile --- -func TestProviderProfileEnvironmentRoundTripAndCopies(t *testing.T) { - profile := &v1.ProviderProfile{ - ID: "custom", - RequiredPlatformAdapter: "gcp-metadata", - Environment: &v1.ProfileEnvironment{ - Config: map[string]string{"CUSTOM_PROJECT": "project"}, - Fixed: map[string]string{"CUSTOM_MODE": "native"}, - }, - Discovery: v1.ProfileDiscovery{ConfigEnvVars: []string{"CUSTOM_PROJECT"}}, - } - wire := ProviderProfileToProto(profile) - restored := ProviderProfileFromProto(wire) - assert.Equal(t, profile.Environment, restored.Environment) - assert.Equal(t, profile.Discovery, restored.Discovery) - assert.Equal(t, profile.RequiredPlatformAdapter, restored.RequiredPlatformAdapter) - profile.Environment.Config["CUSTOM_PROJECT"] = "changed-source" - profile.Environment.Fixed["CUSTOM_MODE"] = "changed-source" - profile.Discovery.ConfigEnvVars[0] = "CHANGED_SOURCE" - assert.Equal(t, "project", wire.Environment.Config["CUSTOM_PROJECT"]) - assert.Equal(t, "native", wire.Environment.Fixed["CUSTOM_MODE"]) - assert.Equal(t, "CUSTOM_PROJECT", wire.Discovery.ConfigEnvVars[0]) - wire.Environment.Config["CUSTOM_PROJECT"] = "changed-wire" - wire.Environment.Fixed["CUSTOM_MODE"] = "changed-wire" - wire.Discovery.ConfigEnvVars[0] = "CHANGED_WIRE" - assert.Equal(t, "project", restored.Environment.Config["CUSTOM_PROJECT"]) - assert.Equal(t, "native", restored.Environment.Fixed["CUSTOM_MODE"]) - assert.Equal(t, "CUSTOM_PROJECT", restored.Discovery.ConfigEnvVars[0]) -} - func TestProviderProfileFromProto(t *testing.T) { proto := &pb.ProviderProfile{ Id: "prof-1", diff --git a/sdk/go/openshell/v1/profile.go b/sdk/go/openshell/v1/profile.go index 6fec20a05c..7de1951e4f 100644 --- a/sdk/go/openshell/v1/profile.go +++ b/sdk/go/openshell/v1/profile.go @@ -27,9 +27,6 @@ type NetworkBinary = types.NetworkBinary // ProfileDiscovery holds local discovery configuration for a profile. type ProfileDiscovery = types.ProfileDiscovery -// ProfileEnvironment declares non-secret workload environment defaults. -type ProfileEnvironment = types.ProfileEnvironment - // ProfileImportItem is an item submitted for profile import or lint validation. type ProfileImportItem = types.ProfileImportItem diff --git a/sdk/go/openshell/v1/types/profile.go b/sdk/go/openshell/v1/types/profile.go index 2242092672..1589eb2ab9 100644 --- a/sdk/go/openshell/v1/types/profile.go +++ b/sdk/go/openshell/v1/types/profile.go @@ -26,25 +26,15 @@ type ProviderProfile struct { Category ProfileCategory Credentials []ProfileCredential // Files is EXPERIMENTAL. This API and its behavior may change or be removed. - Files []ProfileFile - Endpoints []NetworkEndpoint - Binaries []NetworkBinary - InferenceCapable bool - Discovery ProfileDiscovery - ResourceVersion uint64 - Annotations map[string]string - Source string - Scope string - Environment *ProfileEnvironment - RequiredPlatformAdapter string -} - -// ProfileEnvironment declares non-secret workload environment defaults. -type ProfileEnvironment struct { - // Config maps destination environment keys to provider config keys. - Config map[string]string - // Fixed maps destination environment keys to literal values. - Fixed map[string]string + Files []ProfileFile + Endpoints []NetworkEndpoint + Binaries []NetworkBinary + InferenceCapable bool + Discovery ProfileDiscovery + ResourceVersion uint64 + Annotations map[string]string + Source string + Scope string } // ProfileFile declares non-secret content served at a virtual sandbox path. @@ -163,8 +153,7 @@ type NetworkBinary struct { // ProfileDiscovery holds local discovery configuration for a profile. type ProfileDiscovery struct { - Credentials []string - ConfigEnvVars []string + Credentials []string } // ProfileImportItem is an item submitted for profile import or lint validation. diff --git a/sdk/go/proto/openshellv1/openshell.pb.go b/sdk/go/proto/openshellv1/openshell.pb.go index 6894ed3e41..bb665f05ad 100644 --- a/sdk/go/proto/openshellv1/openshell.pb.go +++ b/sdk/go/proto/openshellv1/openshell.pb.go @@ -10252,9 +10252,7 @@ func (x *ProviderCredentialRefreshStatus) GetLastErrorTime() *timestamppb.Timest type ProviderProfileDiscovery struct { state protoimpl.MessageState `protogen:"open.v1"` // Credential names from ProviderProfile.credentials eligible for local discovery. - Credentials []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` - // Non-secret environment keys copied into provider config under the same key. - ConfigEnvVars []string `protobuf:"bytes,2,rep,name=config_env_vars,json=configEnvVars,proto3" json:"config_env_vars,omitempty"` + Credentials []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -10296,69 +10294,6 @@ func (x *ProviderProfileDiscovery) GetCredentials() []string { return nil } -func (x *ProviderProfileDiscovery) GetConfigEnvVars() []string { - if x != nil { - return x.ConfigEnvVars - } - return nil -} - -// Bounded, non-secret environment defaults. Existing workload values win. -// Values are literal strings; interpolation and scripts are not supported. -type ProviderProfileEnvironment struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Destination environment key -> provider config key. Blank config is skipped. - Config map[string]string `protobuf:"bytes,1,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Destination environment key -> literal non-secret value. - Fixed map[string]string `protobuf:"bytes,2,rep,name=fixed,proto3" json:"fixed,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileEnvironment) Reset() { - *x = ProviderProfileEnvironment{} - mi := &file_openshell_proto_msgTypes[121] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileEnvironment) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileEnvironment) ProtoMessage() {} - -func (x *ProviderProfileEnvironment) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[121] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileEnvironment.ProtoReflect.Descriptor instead. -func (*ProviderProfileEnvironment) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{121} -} - -func (x *ProviderProfileEnvironment) GetConfig() map[string]string { - if x != nil { - return x.Config - } - return nil -} - -func (x *ProviderProfileEnvironment) GetFixed() map[string]string { - if x != nil { - return x.Fixed - } - return nil -} - type GetProviderRefreshStatusRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // Workspace scope. Only a named workspace selection is accepted. @@ -10371,7 +10306,7 @@ type GetProviderRefreshStatusRequest struct { func (x *GetProviderRefreshStatusRequest) Reset() { *x = GetProviderRefreshStatusRequest{} - mi := &file_openshell_proto_msgTypes[122] + mi := &file_openshell_proto_msgTypes[121] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10383,7 +10318,7 @@ func (x *GetProviderRefreshStatusRequest) String() string { func (*GetProviderRefreshStatusRequest) ProtoMessage() {} func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[122] + mi := &file_openshell_proto_msgTypes[121] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10396,7 +10331,7 @@ func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetProviderRefreshStatusRequest.ProtoReflect.Descriptor instead. func (*GetProviderRefreshStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{122} + return file_openshell_proto_rawDescGZIP(), []int{121} } func (x *GetProviderRefreshStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10429,7 +10364,7 @@ type GetProviderRefreshStatusResponse struct { func (x *GetProviderRefreshStatusResponse) Reset() { *x = GetProviderRefreshStatusResponse{} - mi := &file_openshell_proto_msgTypes[123] + mi := &file_openshell_proto_msgTypes[122] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10441,7 +10376,7 @@ func (x *GetProviderRefreshStatusResponse) String() string { func (*GetProviderRefreshStatusResponse) ProtoMessage() {} func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[123] + mi := &file_openshell_proto_msgTypes[122] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10454,7 +10389,7 @@ func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetProviderRefreshStatusResponse.ProtoReflect.Descriptor instead. func (*GetProviderRefreshStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{123} + return file_openshell_proto_rawDescGZIP(), []int{122} } func (x *GetProviderRefreshStatusResponse) GetCredentials() []*ProviderCredentialRefreshStatus { @@ -10486,7 +10421,7 @@ type ConfigureProviderRefreshRequest struct { func (x *ConfigureProviderRefreshRequest) Reset() { *x = ConfigureProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[124] + mi := &file_openshell_proto_msgTypes[123] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10498,7 +10433,7 @@ func (x *ConfigureProviderRefreshRequest) String() string { func (*ConfigureProviderRefreshRequest) ProtoMessage() {} func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[124] + mi := &file_openshell_proto_msgTypes[123] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10511,7 +10446,7 @@ func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigureProviderRefreshRequest.ProtoReflect.Descriptor instead. func (*ConfigureProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{124} + return file_openshell_proto_rawDescGZIP(), []int{123} } func (x *ConfigureProviderRefreshRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10579,7 +10514,7 @@ type ConfigureProviderRefreshResponse struct { func (x *ConfigureProviderRefreshResponse) Reset() { *x = ConfigureProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[125] + mi := &file_openshell_proto_msgTypes[124] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10591,7 +10526,7 @@ func (x *ConfigureProviderRefreshResponse) String() string { func (*ConfigureProviderRefreshResponse) ProtoMessage() {} func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[125] + mi := &file_openshell_proto_msgTypes[124] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10604,7 +10539,7 @@ func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigureProviderRefreshResponse.ProtoReflect.Descriptor instead. func (*ConfigureProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{125} + return file_openshell_proto_rawDescGZIP(), []int{124} } func (x *ConfigureProviderRefreshResponse) GetStatus() *ProviderCredentialRefreshStatus { @@ -10629,7 +10564,7 @@ type RotateProviderCredentialRequest struct { func (x *RotateProviderCredentialRequest) Reset() { *x = RotateProviderCredentialRequest{} - mi := &file_openshell_proto_msgTypes[126] + mi := &file_openshell_proto_msgTypes[125] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10641,7 +10576,7 @@ func (x *RotateProviderCredentialRequest) String() string { func (*RotateProviderCredentialRequest) ProtoMessage() {} func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[126] + mi := &file_openshell_proto_msgTypes[125] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10654,7 +10589,7 @@ func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RotateProviderCredentialRequest.ProtoReflect.Descriptor instead. func (*RotateProviderCredentialRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{126} + return file_openshell_proto_rawDescGZIP(), []int{125} } func (x *RotateProviderCredentialRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10694,7 +10629,7 @@ type RotateProviderCredentialResponse struct { func (x *RotateProviderCredentialResponse) Reset() { *x = RotateProviderCredentialResponse{} - mi := &file_openshell_proto_msgTypes[127] + mi := &file_openshell_proto_msgTypes[126] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10706,7 +10641,7 @@ func (x *RotateProviderCredentialResponse) String() string { func (*RotateProviderCredentialResponse) ProtoMessage() {} func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[127] + mi := &file_openshell_proto_msgTypes[126] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10719,7 +10654,7 @@ func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RotateProviderCredentialResponse.ProtoReflect.Descriptor instead. func (*RotateProviderCredentialResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{127} + return file_openshell_proto_rawDescGZIP(), []int{126} } func (x *RotateProviderCredentialResponse) GetStatus() *ProviderCredentialRefreshStatus { @@ -10745,7 +10680,7 @@ type DeleteProviderRefreshRequest struct { func (x *DeleteProviderRefreshRequest) Reset() { *x = DeleteProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[128] + mi := &file_openshell_proto_msgTypes[127] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10757,7 +10692,7 @@ func (x *DeleteProviderRefreshRequest) String() string { func (*DeleteProviderRefreshRequest) ProtoMessage() {} func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[128] + mi := &file_openshell_proto_msgTypes[127] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10770,7 +10705,7 @@ func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderRefreshRequest.ProtoReflect.Descriptor instead. func (*DeleteProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{128} + return file_openshell_proto_rawDescGZIP(), []int{127} } func (x *DeleteProviderRefreshRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -10817,7 +10752,7 @@ type DeleteProviderRefreshResponse struct { func (x *DeleteProviderRefreshResponse) Reset() { *x = DeleteProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[129] + mi := &file_openshell_proto_msgTypes[128] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10829,7 +10764,7 @@ func (x *DeleteProviderRefreshResponse) String() string { func (*DeleteProviderRefreshResponse) ProtoMessage() {} func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[129] + mi := &file_openshell_proto_msgTypes[128] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10842,7 +10777,7 @@ func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderRefreshResponse.ProtoReflect.Descriptor instead. func (*DeleteProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{129} + return file_openshell_proto_rawDescGZIP(), []int{128} } func (x *DeleteProviderRefreshResponse) GetOutcome() DeletionOutcome { @@ -10864,13 +10799,13 @@ type ProviderProfile struct { Binaries []*sandboxv1.NetworkBinary `protobuf:"bytes,7,rep,name=binaries,proto3" json:"binaries,omitempty"` InferenceCapable bool `protobuf:"varint,8,opt,name=inference_capable,json=inferenceCapable,proto3" json:"inference_capable,omitempty"` Discovery *ProviderProfileDiscovery `protobuf:"bytes,9,opt,name=discovery,proto3" json:"discovery,omitempty"` - // Storage resource version. New profile files use 0; gateway responses set - // this for stored profiles. + // Storage resource version for custom profiles. Built-in profiles and new + // profile files use 0. Gateway responses set this for stored custom profiles. // Update calls use this for optimistic concurrency. ResourceVersion uint64 `protobuf:"varint,10,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"` // Optional non-secret annotations attached by profile sources or importers. Annotations map[string]string `protobuf:"bytes,11,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Server-set provenance: "user" or "interceptor/{name}". + // Server-set provenance: "builtin", "user", or "interceptor/{name}". // Ignored on import/update payloads. Source string `protobuf:"bytes,12,opt,name=source,proto3" json:"source,omitempty"` // Server-set visibility: "platform", "workspace", or empty for @@ -10878,19 +10813,14 @@ type ProviderProfile struct { Scope string `protobuf:"bytes,13,opt,name=scope,proto3" json:"scope,omitempty"` // EXPERIMENTAL: Non-secret files rendered from provider configuration for the // workload. This API and its behavior may change or be removed. - Files []*ProviderProfileFile `protobuf:"bytes,14,rep,name=files,proto3" json:"files,omitempty"` - // Non-secret environment defaults declared by this profile. - Environment *ProviderProfileEnvironment `protobuf:"bytes,15,opt,name=environment,proto3" json:"environment,omitempty"` - // Named runtime capability required by this profile. Empty requires none. - // Import and attachment reject requirements unavailable in this deployment. - RequiredPlatformAdapter string `protobuf:"bytes,16,opt,name=required_platform_adapter,json=requiredPlatformAdapter,proto3" json:"required_platform_adapter,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + Files []*ProviderProfileFile `protobuf:"bytes,14,rep,name=files,proto3" json:"files,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ProviderProfile) Reset() { *x = ProviderProfile{} - mi := &file_openshell_proto_msgTypes[130] + mi := &file_openshell_proto_msgTypes[129] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10902,7 +10832,7 @@ func (x *ProviderProfile) String() string { func (*ProviderProfile) ProtoMessage() {} func (x *ProviderProfile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[130] + mi := &file_openshell_proto_msgTypes[129] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10915,7 +10845,7 @@ func (x *ProviderProfile) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderProfile.ProtoReflect.Descriptor instead. func (*ProviderProfile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{130} + return file_openshell_proto_rawDescGZIP(), []int{129} } func (x *ProviderProfile) GetId() string { @@ -11016,20 +10946,6 @@ func (x *ProviderProfile) GetFiles() []*ProviderProfileFile { return nil } -func (x *ProviderProfile) GetEnvironment() *ProviderProfileEnvironment { - if x != nil { - return x.Environment - } - return nil -} - -func (x *ProviderProfile) GetRequiredPlatformAdapter() string { - if x != nil { - return x.RequiredPlatformAdapter - } - return "" -} - // EXPERIMENTAL: Provider file templates may change or be removed. type ProviderProfileFile struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -11045,7 +10961,7 @@ type ProviderProfileFile struct { func (x *ProviderProfileFile) Reset() { *x = ProviderProfileFile{} - mi := &file_openshell_proto_msgTypes[131] + mi := &file_openshell_proto_msgTypes[130] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11057,7 +10973,7 @@ func (x *ProviderProfileFile) String() string { func (*ProviderProfileFile) ProtoMessage() {} func (x *ProviderProfileFile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[131] + mi := &file_openshell_proto_msgTypes[130] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11070,7 +10986,7 @@ func (x *ProviderProfileFile) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderProfileFile.ProtoReflect.Descriptor instead. func (*ProviderProfileFile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{131} + return file_openshell_proto_rawDescGZIP(), []int{130} } func (x *ProviderProfileFile) GetPath() string { @@ -11104,7 +11020,7 @@ type ProviderProfileResponse struct { func (x *ProviderProfileResponse) Reset() { *x = ProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[132] + mi := &file_openshell_proto_msgTypes[131] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11116,7 +11032,7 @@ func (x *ProviderProfileResponse) String() string { func (*ProviderProfileResponse) ProtoMessage() {} func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[132] + mi := &file_openshell_proto_msgTypes[131] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11129,7 +11045,7 @@ func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderProfileResponse.ProtoReflect.Descriptor instead. func (*ProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{132} + return file_openshell_proto_rawDescGZIP(), []int{131} } func (x *ProviderProfileResponse) GetProfile() *ProviderProfile { @@ -11151,7 +11067,7 @@ type ListProviderProfilesResponse struct { func (x *ListProviderProfilesResponse) Reset() { *x = ListProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[133] + mi := &file_openshell_proto_msgTypes[132] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11163,7 +11079,7 @@ func (x *ListProviderProfilesResponse) String() string { func (*ListProviderProfilesResponse) ProtoMessage() {} func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[133] + mi := &file_openshell_proto_msgTypes[132] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11176,7 +11092,7 @@ func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*ListProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{133} + return file_openshell_proto_rawDescGZIP(), []int{132} } func (x *ListProviderProfilesResponse) GetProfiles() []*ProviderProfile { @@ -11208,7 +11124,7 @@ type ImportProviderProfilesRequest struct { func (x *ImportProviderProfilesRequest) Reset() { *x = ImportProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[134] + mi := &file_openshell_proto_msgTypes[133] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11220,7 +11136,7 @@ func (x *ImportProviderProfilesRequest) String() string { func (*ImportProviderProfilesRequest) ProtoMessage() {} func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[134] + mi := &file_openshell_proto_msgTypes[133] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11233,7 +11149,7 @@ func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ImportProviderProfilesRequest.ProtoReflect.Descriptor instead. func (*ImportProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{134} + return file_openshell_proto_rawDescGZIP(), []int{133} } func (x *ImportProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11269,7 +11185,7 @@ type ImportProviderProfilesResponse struct { func (x *ImportProviderProfilesResponse) Reset() { *x = ImportProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[135] + mi := &file_openshell_proto_msgTypes[134] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11281,7 +11197,7 @@ func (x *ImportProviderProfilesResponse) String() string { func (*ImportProviderProfilesResponse) ProtoMessage() {} func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[135] + mi := &file_openshell_proto_msgTypes[134] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11294,7 +11210,7 @@ func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ImportProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*ImportProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{135} + return file_openshell_proto_rawDescGZIP(), []int{134} } func (x *ImportProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { @@ -11340,7 +11256,7 @@ type UpdateProviderProfilesRequest struct { func (x *UpdateProviderProfilesRequest) Reset() { *x = UpdateProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[136] + mi := &file_openshell_proto_msgTypes[135] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11352,7 +11268,7 @@ func (x *UpdateProviderProfilesRequest) String() string { func (*UpdateProviderProfilesRequest) ProtoMessage() {} func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[136] + mi := &file_openshell_proto_msgTypes[135] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11365,7 +11281,7 @@ func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateProviderProfilesRequest.ProtoReflect.Descriptor instead. func (*UpdateProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{136} + return file_openshell_proto_rawDescGZIP(), []int{135} } func (x *UpdateProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11415,7 +11331,7 @@ type UpdateProviderProfilesResponse struct { func (x *UpdateProviderProfilesResponse) Reset() { *x = UpdateProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[137] + mi := &file_openshell_proto_msgTypes[136] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11427,7 +11343,7 @@ func (x *UpdateProviderProfilesResponse) String() string { func (*UpdateProviderProfilesResponse) ProtoMessage() {} func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[137] + mi := &file_openshell_proto_msgTypes[136] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11440,7 +11356,7 @@ func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*UpdateProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{137} + return file_openshell_proto_rawDescGZIP(), []int{136} } func (x *UpdateProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { @@ -11476,7 +11392,7 @@ type LintProviderProfilesRequest struct { func (x *LintProviderProfilesRequest) Reset() { *x = LintProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[138] + mi := &file_openshell_proto_msgTypes[137] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11488,7 +11404,7 @@ func (x *LintProviderProfilesRequest) String() string { func (*LintProviderProfilesRequest) ProtoMessage() {} func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[138] + mi := &file_openshell_proto_msgTypes[137] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11501,7 +11417,7 @@ func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use LintProviderProfilesRequest.ProtoReflect.Descriptor instead. func (*LintProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{138} + return file_openshell_proto_rawDescGZIP(), []int{137} } func (x *LintProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11532,7 +11448,7 @@ type LintProviderProfilesResponse struct { func (x *LintProviderProfilesResponse) Reset() { *x = LintProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[139] + mi := &file_openshell_proto_msgTypes[138] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11544,7 +11460,7 @@ func (x *LintProviderProfilesResponse) String() string { func (*LintProviderProfilesResponse) ProtoMessage() {} func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[139] + mi := &file_openshell_proto_msgTypes[138] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11557,7 +11473,7 @@ func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use LintProviderProfilesResponse.ProtoReflect.Descriptor instead. func (*LintProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{139} + return file_openshell_proto_rawDescGZIP(), []int{138} } func (x *LintProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { @@ -11591,7 +11507,7 @@ type DeleteProviderResponse struct { func (x *DeleteProviderResponse) Reset() { *x = DeleteProviderResponse{} - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[139] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11603,7 +11519,7 @@ func (x *DeleteProviderResponse) String() string { func (*DeleteProviderResponse) ProtoMessage() {} func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[139] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11616,7 +11532,7 @@ func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderResponse.ProtoReflect.Descriptor instead. func (*DeleteProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{140} + return file_openshell_proto_rawDescGZIP(), []int{139} } func (x *DeleteProviderResponse) GetOutcome() DeletionOutcome { @@ -11642,7 +11558,7 @@ type DeleteProviderProfileRequest struct { func (x *DeleteProviderProfileRequest) Reset() { *x = DeleteProviderProfileRequest{} - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[140] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11654,7 +11570,7 @@ func (x *DeleteProviderProfileRequest) String() string { func (*DeleteProviderProfileRequest) ProtoMessage() {} func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[140] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11667,7 +11583,7 @@ func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderProfileRequest.ProtoReflect.Descriptor instead. func (*DeleteProviderProfileRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{141} + return file_openshell_proto_rawDescGZIP(), []int{140} } func (x *DeleteProviderProfileRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -11708,7 +11624,7 @@ type DeleteProviderProfileResponse struct { func (x *DeleteProviderProfileResponse) Reset() { *x = DeleteProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[141] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11720,7 +11636,7 @@ func (x *DeleteProviderProfileResponse) String() string { func (*DeleteProviderProfileResponse) ProtoMessage() {} func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[141] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11733,7 +11649,7 @@ func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteProviderProfileResponse.ProtoReflect.Descriptor instead. func (*DeleteProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{142} + return file_openshell_proto_rawDescGZIP(), []int{141} } func (x *DeleteProviderProfileResponse) GetOutcome() DeletionOutcome { @@ -11762,7 +11678,7 @@ type GetSandboxProviderEnvironmentRequest struct { func (x *GetSandboxProviderEnvironmentRequest) Reset() { *x = GetSandboxProviderEnvironmentRequest{} - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[142] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11774,7 +11690,7 @@ func (x *GetSandboxProviderEnvironmentRequest) String() string { func (*GetSandboxProviderEnvironmentRequest) ProtoMessage() {} func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[142] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11787,7 +11703,7 @@ func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Messa // Deprecated: Use GetSandboxProviderEnvironmentRequest.ProtoReflect.Descriptor instead. func (*GetSandboxProviderEnvironmentRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{143} + return file_openshell_proto_rawDescGZIP(), []int{142} } func (x *GetSandboxProviderEnvironmentRequest) GetSandboxId() string { @@ -11823,7 +11739,7 @@ type StaticCredentialEndpointBinding struct { func (x *StaticCredentialEndpointBinding) Reset() { *x = StaticCredentialEndpointBinding{} - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[143] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11835,7 +11751,7 @@ func (x *StaticCredentialEndpointBinding) String() string { func (*StaticCredentialEndpointBinding) ProtoMessage() {} func (x *StaticCredentialEndpointBinding) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[143] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11848,7 +11764,7 @@ func (x *StaticCredentialEndpointBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use StaticCredentialEndpointBinding.ProtoReflect.Descriptor instead. func (*StaticCredentialEndpointBinding) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{144} + return file_openshell_proto_rawDescGZIP(), []int{143} } func (x *StaticCredentialEndpointBinding) GetHost() string { @@ -11892,7 +11808,7 @@ type StaticCredentialBinding struct { func (x *StaticCredentialBinding) Reset() { *x = StaticCredentialBinding{} - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[144] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11904,7 +11820,7 @@ func (x *StaticCredentialBinding) String() string { func (*StaticCredentialBinding) ProtoMessage() {} func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[144] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11917,7 +11833,7 @@ func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use StaticCredentialBinding.ProtoReflect.Descriptor instead. func (*StaticCredentialBinding) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{145} + return file_openshell_proto_rawDescGZIP(), []int{144} } func (x *StaticCredentialBinding) GetEndpoints() []*StaticCredentialEndpointBinding { @@ -11987,7 +11903,7 @@ type GetSandboxProviderEnvironmentResponse struct { func (x *GetSandboxProviderEnvironmentResponse) Reset() { *x = GetSandboxProviderEnvironmentResponse{} - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[145] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11999,7 +11915,7 @@ func (x *GetSandboxProviderEnvironmentResponse) String() string { func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {} func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[145] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12012,7 +11928,7 @@ func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Mess // Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead. func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{146} + return file_openshell_proto_rawDescGZIP(), []int{145} } func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string { @@ -12121,7 +12037,7 @@ type ProviderEnvironmentValue struct { func (x *ProviderEnvironmentValue) Reset() { *x = ProviderEnvironmentValue{} - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[146] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12133,7 +12049,7 @@ func (x *ProviderEnvironmentValue) String() string { func (*ProviderEnvironmentValue) ProtoMessage() {} func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[146] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12146,7 +12062,7 @@ func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentValue.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentValue) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{147} + return file_openshell_proto_rawDescGZIP(), []int{146} } func (x *ProviderEnvironmentValue) GetName() string { @@ -12212,7 +12128,7 @@ type ProviderEnvironmentSnapshot struct { func (x *ProviderEnvironmentSnapshot) Reset() { *x = ProviderEnvironmentSnapshot{} - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[147] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12224,7 +12140,7 @@ func (x *ProviderEnvironmentSnapshot) String() string { func (*ProviderEnvironmentSnapshot) ProtoMessage() {} func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[147] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12237,7 +12153,7 @@ func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentSnapshot.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentSnapshot) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{148} + return file_openshell_proto_rawDescGZIP(), []int{147} } func (x *ProviderEnvironmentSnapshot) GetProviderEnvRevision() uint64 { @@ -12306,7 +12222,7 @@ type ExchangeProviderSubjectTokenRequest struct { func (x *ExchangeProviderSubjectTokenRequest) Reset() { *x = ExchangeProviderSubjectTokenRequest{} - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[148] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12318,7 +12234,7 @@ func (x *ExchangeProviderSubjectTokenRequest) String() string { func (*ExchangeProviderSubjectTokenRequest) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[148] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12331,7 +12247,7 @@ func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Messag // Deprecated: Use ExchangeProviderSubjectTokenRequest.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{149} + return file_openshell_proto_rawDescGZIP(), []int{148} } func (x *ExchangeProviderSubjectTokenRequest) GetSandboxId() string { @@ -12373,7 +12289,7 @@ type ExchangeProviderSubjectTokenResponse struct { func (x *ExchangeProviderSubjectTokenResponse) Reset() { *x = ExchangeProviderSubjectTokenResponse{} - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[149] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12385,7 +12301,7 @@ func (x *ExchangeProviderSubjectTokenResponse) String() string { func (*ExchangeProviderSubjectTokenResponse) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[149] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12398,7 +12314,7 @@ func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Messa // Deprecated: Use ExchangeProviderSubjectTokenResponse.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{150} + return file_openshell_proto_rawDescGZIP(), []int{149} } func (x *ExchangeProviderSubjectTokenResponse) GetAccessToken() string { @@ -12472,7 +12388,7 @@ type UpdateConfigRequest struct { func (x *UpdateConfigRequest) Reset() { *x = UpdateConfigRequest{} - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[150] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12484,7 +12400,7 @@ func (x *UpdateConfigRequest) String() string { func (*UpdateConfigRequest) ProtoMessage() {} func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[150] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12497,7 +12413,7 @@ func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead. func (*UpdateConfigRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{151} + return file_openshell_proto_rawDescGZIP(), []int{150} } func (x *UpdateConfigRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -12594,7 +12510,7 @@ type PolicyMergeOperation struct { func (x *PolicyMergeOperation) Reset() { *x = PolicyMergeOperation{} - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[151] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12606,7 +12522,7 @@ func (x *PolicyMergeOperation) String() string { func (*PolicyMergeOperation) ProtoMessage() {} func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[151] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12619,7 +12535,7 @@ func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead. func (*PolicyMergeOperation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{152} + return file_openshell_proto_rawDescGZIP(), []int{151} } func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation { @@ -12733,7 +12649,7 @@ type AddNetworkRule struct { func (x *AddNetworkRule) Reset() { *x = AddNetworkRule{} - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[152] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12745,7 +12661,7 @@ func (x *AddNetworkRule) String() string { func (*AddNetworkRule) ProtoMessage() {} func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[152] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12758,7 +12674,7 @@ func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead. func (*AddNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{153} + return file_openshell_proto_rawDescGZIP(), []int{152} } func (x *AddNetworkRule) GetRuleName() string { @@ -12786,7 +12702,7 @@ type RemoveNetworkEndpoint struct { func (x *RemoveNetworkEndpoint) Reset() { *x = RemoveNetworkEndpoint{} - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[153] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12798,7 +12714,7 @@ func (x *RemoveNetworkEndpoint) String() string { func (*RemoveNetworkEndpoint) ProtoMessage() {} func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[153] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12811,7 +12727,7 @@ func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead. func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{154} + return file_openshell_proto_rawDescGZIP(), []int{153} } func (x *RemoveNetworkEndpoint) GetRuleName() string { @@ -12844,7 +12760,7 @@ type RemoveNetworkRule struct { func (x *RemoveNetworkRule) Reset() { *x = RemoveNetworkRule{} - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[154] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12856,7 +12772,7 @@ func (x *RemoveNetworkRule) String() string { func (*RemoveNetworkRule) ProtoMessage() {} func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[154] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12869,7 +12785,7 @@ func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead. func (*RemoveNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{155} + return file_openshell_proto_rawDescGZIP(), []int{154} } func (x *RemoveNetworkRule) GetRuleName() string { @@ -12898,7 +12814,7 @@ type L7RuleTarget struct { func (x *L7RuleTarget) Reset() { *x = L7RuleTarget{} - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[155] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12910,7 +12826,7 @@ func (x *L7RuleTarget) String() string { func (*L7RuleTarget) ProtoMessage() {} func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[155] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12923,7 +12839,7 @@ func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RuleTarget.ProtoReflect.Descriptor instead. func (*L7RuleTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{156} + return file_openshell_proto_rawDescGZIP(), []int{155} } func (x *L7RuleTarget) GetRuleName() string { @@ -12978,7 +12894,7 @@ type AddDenyRules struct { func (x *AddDenyRules) Reset() { *x = AddDenyRules{} - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[156] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12990,7 +12906,7 @@ func (x *AddDenyRules) String() string { func (*AddDenyRules) ProtoMessage() {} func (x *AddDenyRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[156] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13003,7 +12919,7 @@ func (x *AddDenyRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead. func (*AddDenyRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{157} + return file_openshell_proto_rawDescGZIP(), []int{156} } func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule { @@ -13030,7 +12946,7 @@ type AddAllowRules struct { func (x *AddAllowRules) Reset() { *x = AddAllowRules{} - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[157] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13042,7 +12958,7 @@ func (x *AddAllowRules) String() string { func (*AddAllowRules) ProtoMessage() {} func (x *AddAllowRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[157] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13055,7 +12971,7 @@ func (x *AddAllowRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead. func (*AddAllowRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{158} + return file_openshell_proto_rawDescGZIP(), []int{157} } func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule { @@ -13082,7 +12998,7 @@ type RemoveNetworkBinary struct { func (x *RemoveNetworkBinary) Reset() { *x = RemoveNetworkBinary{} - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[158] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13094,7 +13010,7 @@ func (x *RemoveNetworkBinary) String() string { func (*RemoveNetworkBinary) ProtoMessage() {} func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[158] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13107,7 +13023,7 @@ func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead. func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{159} + return file_openshell_proto_rawDescGZIP(), []int{158} } func (x *RemoveNetworkBinary) GetRuleName() string { @@ -13143,7 +13059,7 @@ type UpdateConfigResponse struct { func (x *UpdateConfigResponse) Reset() { *x = UpdateConfigResponse{} - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[159] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13155,7 +13071,7 @@ func (x *UpdateConfigResponse) String() string { func (*UpdateConfigResponse) ProtoMessage() {} func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[159] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13168,7 +13084,7 @@ func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead. func (*UpdateConfigResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{160} + return file_openshell_proto_rawDescGZIP(), []int{159} } func (x *UpdateConfigResponse) GetVersion() uint32 { @@ -13222,7 +13138,7 @@ type GetSandboxPolicyStatusRequest struct { func (x *GetSandboxPolicyStatusRequest) Reset() { *x = GetSandboxPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[160] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13234,7 +13150,7 @@ func (x *GetSandboxPolicyStatusRequest) String() string { func (*GetSandboxPolicyStatusRequest) ProtoMessage() {} func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[160] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13247,7 +13163,7 @@ func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{161} + return file_openshell_proto_rawDescGZIP(), []int{160} } func (x *GetSandboxPolicyStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13291,7 +13207,7 @@ type GetSandboxPolicyStatusResponse struct { func (x *GetSandboxPolicyStatusResponse) Reset() { *x = GetSandboxPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[161] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13303,7 +13219,7 @@ func (x *GetSandboxPolicyStatusResponse) String() string { func (*GetSandboxPolicyStatusResponse) ProtoMessage() {} func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[161] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13316,7 +13232,7 @@ func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{162} + return file_openshell_proto_rawDescGZIP(), []int{161} } func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision { @@ -13353,7 +13269,7 @@ type ListSandboxPoliciesRequest struct { func (x *ListSandboxPoliciesRequest) Reset() { *x = ListSandboxPoliciesRequest{} - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[162] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13365,7 +13281,7 @@ func (x *ListSandboxPoliciesRequest) String() string { func (*ListSandboxPoliciesRequest) ProtoMessage() {} func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[162] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13378,7 +13294,7 @@ func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{163} + return file_openshell_proto_rawDescGZIP(), []int{162} } func (x *ListSandboxPoliciesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13430,7 +13346,7 @@ type ListSandboxPoliciesResponse struct { func (x *ListSandboxPoliciesResponse) Reset() { *x = ListSandboxPoliciesResponse{} - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[163] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13442,7 +13358,7 @@ func (x *ListSandboxPoliciesResponse) String() string { func (*ListSandboxPoliciesResponse) ProtoMessage() {} func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[163] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13455,7 +13371,7 @@ func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{164} + return file_openshell_proto_rawDescGZIP(), []int{163} } func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision { @@ -13489,7 +13405,7 @@ type ReportPolicyStatusRequest struct { func (x *ReportPolicyStatusRequest) Reset() { *x = ReportPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[164] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13501,7 +13417,7 @@ func (x *ReportPolicyStatusRequest) String() string { func (*ReportPolicyStatusRequest) ProtoMessage() {} func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[164] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13514,7 +13430,7 @@ func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{165} + return file_openshell_proto_rawDescGZIP(), []int{164} } func (x *ReportPolicyStatusRequest) GetSandboxId() string { @@ -13554,7 +13470,7 @@ type ReportPolicyStatusResponse struct { func (x *ReportPolicyStatusResponse) Reset() { *x = ReportPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[165] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13566,7 +13482,7 @@ func (x *ReportPolicyStatusResponse) String() string { func (*ReportPolicyStatusResponse) ProtoMessage() {} func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[165] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13579,7 +13495,7 @@ func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{166} + return file_openshell_proto_rawDescGZIP(), []int{165} } type SandboxConfigurationAdmission struct { @@ -13597,7 +13513,7 @@ type SandboxConfigurationAdmission struct { func (x *SandboxConfigurationAdmission) Reset() { *x = SandboxConfigurationAdmission{} - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[166] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13609,7 +13525,7 @@ func (x *SandboxConfigurationAdmission) String() string { func (*SandboxConfigurationAdmission) ProtoMessage() {} func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[166] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13622,7 +13538,7 @@ func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxConfigurationAdmission.ProtoReflect.Descriptor instead. func (*SandboxConfigurationAdmission) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{167} + return file_openshell_proto_rawDescGZIP(), []int{166} } func (x *SandboxConfigurationAdmission) GetInstanceId() string { @@ -13686,7 +13602,7 @@ type ReportSandboxConfigurationRequest struct { func (x *ReportSandboxConfigurationRequest) Reset() { *x = ReportSandboxConfigurationRequest{} - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[167] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13698,7 +13614,7 @@ func (x *ReportSandboxConfigurationRequest) String() string { func (*ReportSandboxConfigurationRequest) ProtoMessage() {} func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[167] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13711,7 +13627,7 @@ func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationRequest.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{168} + return file_openshell_proto_rawDescGZIP(), []int{167} } func (x *ReportSandboxConfigurationRequest) GetSandboxId() string { @@ -13743,7 +13659,7 @@ type ReportSandboxConfigurationResponse struct { func (x *ReportSandboxConfigurationResponse) Reset() { *x = ReportSandboxConfigurationResponse{} - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[168] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13755,7 +13671,7 @@ func (x *ReportSandboxConfigurationResponse) String() string { func (*ReportSandboxConfigurationResponse) ProtoMessage() {} func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[168] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13768,7 +13684,7 @@ func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationResponse.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{169} + return file_openshell_proto_rawDescGZIP(), []int{168} } // A versioned policy revision with metadata. @@ -13801,7 +13717,7 @@ type SandboxPolicyRevision struct { func (x *SandboxPolicyRevision) Reset() { *x = SandboxPolicyRevision{} - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[169] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13813,7 +13729,7 @@ func (x *SandboxPolicyRevision) String() string { func (*SandboxPolicyRevision) ProtoMessage() {} func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[169] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13826,7 +13742,7 @@ func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead. func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{170} + return file_openshell_proto_rawDescGZIP(), []int{169} } func (x *SandboxPolicyRevision) GetVersion() uint32 { @@ -13906,7 +13822,7 @@ type GetSandboxLogsRequest struct { func (x *GetSandboxLogsRequest) Reset() { *x = GetSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[170] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13918,7 +13834,7 @@ func (x *GetSandboxLogsRequest) String() string { func (*GetSandboxLogsRequest) ProtoMessage() {} func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[170] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13931,7 +13847,7 @@ func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{171} + return file_openshell_proto_rawDescGZIP(), []int{170} } func (x *GetSandboxLogsRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13989,7 +13905,7 @@ type PushSandboxLogsRequest struct { func (x *PushSandboxLogsRequest) Reset() { *x = PushSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[171] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14001,7 +13917,7 @@ func (x *PushSandboxLogsRequest) String() string { func (*PushSandboxLogsRequest) ProtoMessage() {} func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[171] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14014,7 +13930,7 @@ func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{172} + return file_openshell_proto_rawDescGZIP(), []int{171} } func (x *PushSandboxLogsRequest) GetSandboxId() string { @@ -14040,7 +13956,7 @@ type PushSandboxLogsResponse struct { func (x *PushSandboxLogsResponse) Reset() { *x = PushSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[172] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14052,7 +13968,7 @@ func (x *PushSandboxLogsResponse) String() string { func (*PushSandboxLogsResponse) ProtoMessage() {} func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[172] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14065,7 +13981,7 @@ func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{173} + return file_openshell_proto_rawDescGZIP(), []int{172} } // Get sandbox logs response. @@ -14081,7 +13997,7 @@ type GetSandboxLogsResponse struct { func (x *GetSandboxLogsResponse) Reset() { *x = GetSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[173] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14093,7 +14009,7 @@ func (x *GetSandboxLogsResponse) String() string { func (*GetSandboxLogsResponse) ProtoMessage() {} func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[173] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14106,7 +14022,7 @@ func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{174} + return file_openshell_proto_rawDescGZIP(), []int{173} } func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine { @@ -14140,7 +14056,7 @@ type SupervisorMessage struct { func (x *SupervisorMessage) Reset() { *x = SupervisorMessage{} - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[174] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14152,7 +14068,7 @@ func (x *SupervisorMessage) String() string { func (*SupervisorMessage) ProtoMessage() {} func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[174] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14165,7 +14081,7 @@ func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead. func (*SupervisorMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{175} + return file_openshell_proto_rawDescGZIP(), []int{174} } func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload { @@ -14273,7 +14189,7 @@ type GatewayMessage struct { func (x *GatewayMessage) Reset() { *x = GatewayMessage{} - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[175] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14285,7 +14201,7 @@ func (x *GatewayMessage) String() string { func (*GatewayMessage) ProtoMessage() {} func (x *GatewayMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[175] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14298,7 +14214,7 @@ func (x *GatewayMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead. func (*GatewayMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{176} + return file_openshell_proto_rawDescGZIP(), []int{175} } func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload { @@ -14449,7 +14365,7 @@ type SupervisorHello struct { func (x *SupervisorHello) Reset() { *x = SupervisorHello{} - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[176] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14461,7 +14377,7 @@ func (x *SupervisorHello) String() string { func (*SupervisorHello) ProtoMessage() {} func (x *SupervisorHello) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[176] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14474,7 +14390,7 @@ func (x *SupervisorHello) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead. func (*SupervisorHello) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{177} + return file_openshell_proto_rawDescGZIP(), []int{176} } func (x *SupervisorHello) GetSandboxId() string { @@ -14547,7 +14463,7 @@ type SessionAccepted struct { func (x *SessionAccepted) Reset() { *x = SessionAccepted{} - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[177] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14559,7 +14475,7 @@ func (x *SessionAccepted) String() string { func (*SessionAccepted) ProtoMessage() {} func (x *SessionAccepted) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[177] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14572,7 +14488,7 @@ func (x *SessionAccepted) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead. func (*SessionAccepted) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{178} + return file_openshell_proto_rawDescGZIP(), []int{177} } func (x *SessionAccepted) GetSessionId() string { @@ -14621,7 +14537,7 @@ type ConfigUpdate struct { func (x *ConfigUpdate) Reset() { *x = ConfigUpdate{} - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[178] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14633,7 +14549,7 @@ func (x *ConfigUpdate) String() string { func (*ConfigUpdate) ProtoMessage() {} func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[178] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14646,7 +14562,7 @@ func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdate.ProtoReflect.Descriptor instead. func (*ConfigUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{179} + return file_openshell_proto_rawDescGZIP(), []int{178} } func (x *ConfigUpdate) GetUpdateId() string { @@ -14683,7 +14599,7 @@ type ConfigApplyFailure struct { func (x *ConfigApplyFailure) Reset() { *x = ConfigApplyFailure{} - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[179] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14695,7 +14611,7 @@ func (x *ConfigApplyFailure) String() string { func (*ConfigApplyFailure) ProtoMessage() {} func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[179] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14708,7 +14624,7 @@ func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigApplyFailure.ProtoReflect.Descriptor instead. func (*ConfigApplyFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{180} + return file_openshell_proto_rawDescGZIP(), []int{179} } func (x *ConfigApplyFailure) GetCode() string { @@ -14752,7 +14668,7 @@ type ConfigUpdateResult struct { func (x *ConfigUpdateResult) Reset() { *x = ConfigUpdateResult{} - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[180] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14764,7 +14680,7 @@ func (x *ConfigUpdateResult) String() string { func (*ConfigUpdateResult) ProtoMessage() {} func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[180] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14777,7 +14693,7 @@ func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdateResult.ProtoReflect.Descriptor instead. func (*ConfigUpdateResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{181} + return file_openshell_proto_rawDescGZIP(), []int{180} } func (x *ConfigUpdateResult) GetUpdateId() string { @@ -14828,7 +14744,7 @@ type PolicyLoadResult struct { func (x *PolicyLoadResult) Reset() { *x = PolicyLoadResult{} - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[181] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14840,7 +14756,7 @@ func (x *PolicyLoadResult) String() string { func (*PolicyLoadResult) ProtoMessage() {} func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[181] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14853,7 +14769,7 @@ func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyLoadResult.ProtoReflect.Descriptor instead. func (*PolicyLoadResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{182} + return file_openshell_proto_rawDescGZIP(), []int{181} } func (x *PolicyLoadResult) GetVersion() uint32 { @@ -14888,7 +14804,7 @@ type SessionRejected struct { func (x *SessionRejected) Reset() { *x = SessionRejected{} - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[182] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14900,7 +14816,7 @@ func (x *SessionRejected) String() string { func (*SessionRejected) ProtoMessage() {} func (x *SessionRejected) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[182] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14913,7 +14829,7 @@ func (x *SessionRejected) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead. func (*SessionRejected) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{183} + return file_openshell_proto_rawDescGZIP(), []int{182} } func (x *SessionRejected) GetReason() string { @@ -14942,7 +14858,7 @@ type SessionRedirect struct { func (x *SessionRedirect) Reset() { *x = SessionRedirect{} - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[183] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14954,7 +14870,7 @@ func (x *SessionRedirect) String() string { func (*SessionRedirect) ProtoMessage() {} func (x *SessionRedirect) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[183] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14967,7 +14883,7 @@ func (x *SessionRedirect) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRedirect.ProtoReflect.Descriptor instead. func (*SessionRedirect) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{184} + return file_openshell_proto_rawDescGZIP(), []int{183} } func (x *SessionRedirect) GetPeerEndpoint() string { @@ -14993,7 +14909,7 @@ type SupervisorHeartbeat struct { func (x *SupervisorHeartbeat) Reset() { *x = SupervisorHeartbeat{} - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[184] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15005,7 +14921,7 @@ func (x *SupervisorHeartbeat) String() string { func (*SupervisorHeartbeat) ProtoMessage() {} func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[184] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15018,7 +14934,7 @@ func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead. func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{185} + return file_openshell_proto_rawDescGZIP(), []int{184} } // Gateway heartbeat. @@ -15030,7 +14946,7 @@ type GatewayHeartbeat struct { func (x *GatewayHeartbeat) Reset() { *x = GatewayHeartbeat{} - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[185] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15042,7 +14958,7 @@ func (x *GatewayHeartbeat) String() string { func (*GatewayHeartbeat) ProtoMessage() {} func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[185] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15055,7 +14971,7 @@ func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead. func (*GatewayHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{186} + return file_openshell_proto_rawDescGZIP(), []int{185} } // Terminal result reported before the supervisor shuts down. A successful RPC @@ -15072,7 +14988,7 @@ type ReportMainProcessExitRequest struct { func (x *ReportMainProcessExitRequest) Reset() { *x = ReportMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[186] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15084,7 +15000,7 @@ func (x *ReportMainProcessExitRequest) String() string { func (*ReportMainProcessExitRequest) ProtoMessage() {} func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[186] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15097,7 +15013,7 @@ func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{187} + return file_openshell_proto_rawDescGZIP(), []int{186} } func (x *ReportMainProcessExitRequest) GetSandboxId() string { @@ -15129,7 +15045,7 @@ type ReportMainProcessExitResponse struct { func (x *ReportMainProcessExitResponse) Reset() { *x = ReportMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[187] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15141,7 +15057,7 @@ func (x *ReportMainProcessExitResponse) String() string { func (*ReportMainProcessExitResponse) ProtoMessage() {} func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[187] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15154,7 +15070,7 @@ func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{188} + return file_openshell_proto_rawDescGZIP(), []int{187} } // Terminal-delivery completion reported after all expected foreground SSH @@ -15169,7 +15085,7 @@ type FinalizeMainProcessExitRequest struct { func (x *FinalizeMainProcessExitRequest) Reset() { *x = FinalizeMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[188] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15181,7 +15097,7 @@ func (x *FinalizeMainProcessExitRequest) String() string { func (*FinalizeMainProcessExitRequest) ProtoMessage() {} func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[188] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15194,7 +15110,7 @@ func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{189} + return file_openshell_proto_rawDescGZIP(), []int{188} } func (x *FinalizeMainProcessExitRequest) GetSandboxId() string { @@ -15219,7 +15135,7 @@ type FinalizeMainProcessExitResponse struct { func (x *FinalizeMainProcessExitResponse) Reset() { *x = FinalizeMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[189] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15231,7 +15147,7 @@ func (x *FinalizeMainProcessExitResponse) String() string { func (*FinalizeMainProcessExitResponse) ProtoMessage() {} func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[189] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15244,7 +15160,7 @@ func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{190} + return file_openshell_proto_rawDescGZIP(), []int{189} } // Gateway requests the supervisor to open a relay channel. @@ -15273,7 +15189,7 @@ type RelayOpen struct { func (x *RelayOpen) Reset() { *x = RelayOpen{} - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[190] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15285,7 +15201,7 @@ func (x *RelayOpen) String() string { func (*RelayOpen) ProtoMessage() {} func (x *RelayOpen) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[190] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15298,7 +15214,7 @@ func (x *RelayOpen) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead. func (*RelayOpen) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{191} + return file_openshell_proto_rawDescGZIP(), []int{190} } func (x *RelayOpen) GetChannelId() string { @@ -15365,7 +15281,7 @@ type SshRelayTarget struct { func (x *SshRelayTarget) Reset() { *x = SshRelayTarget{} - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[191] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15377,7 +15293,7 @@ func (x *SshRelayTarget) String() string { func (*SshRelayTarget) ProtoMessage() {} func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[191] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15390,7 +15306,7 @@ func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead. func (*SshRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{192} + return file_openshell_proto_rawDescGZIP(), []int{191} } // TCP target dialed by the supervisor from inside the sandbox. @@ -15406,7 +15322,7 @@ type TcpRelayTarget struct { func (x *TcpRelayTarget) Reset() { *x = TcpRelayTarget{} - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[192] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15418,7 +15334,7 @@ func (x *TcpRelayTarget) String() string { func (*TcpRelayTarget) ProtoMessage() {} func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[192] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15431,7 +15347,7 @@ func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead. func (*TcpRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{193} + return file_openshell_proto_rawDescGZIP(), []int{192} } func (x *TcpRelayTarget) GetHost() string { @@ -15459,7 +15375,7 @@ type RelayInit struct { func (x *RelayInit) Reset() { *x = RelayInit{} - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[193] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15471,7 +15387,7 @@ func (x *RelayInit) String() string { func (*RelayInit) ProtoMessage() {} func (x *RelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[193] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15484,7 +15400,7 @@ func (x *RelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayInit.ProtoReflect.Descriptor instead. func (*RelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{194} + return file_openshell_proto_rawDescGZIP(), []int{193} } func (x *RelayInit) GetChannelId() string { @@ -15511,7 +15427,7 @@ type RelayFrame struct { func (x *RelayFrame) Reset() { *x = RelayFrame{} - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[194] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15523,7 +15439,7 @@ func (x *RelayFrame) String() string { func (*RelayFrame) ProtoMessage() {} func (x *RelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[194] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15536,7 +15452,7 @@ func (x *RelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead. func (*RelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{195} + return file_openshell_proto_rawDescGZIP(), []int{194} } func (x *RelayFrame) GetPayload() isRelayFrame_Payload { @@ -15596,7 +15512,7 @@ type PeerRelayInit struct { func (x *PeerRelayInit) Reset() { *x = PeerRelayInit{} - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[195] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15608,7 +15524,7 @@ func (x *PeerRelayInit) String() string { func (*PeerRelayInit) ProtoMessage() {} func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[195] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15621,7 +15537,7 @@ func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayInit.ProtoReflect.Descriptor instead. func (*PeerRelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{196} + return file_openshell_proto_rawDescGZIP(), []int{195} } func (x *PeerRelayInit) GetSandboxId() string { @@ -15659,7 +15575,7 @@ type PeerRelayFrame struct { func (x *PeerRelayFrame) Reset() { *x = PeerRelayFrame{} - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[196] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15671,7 +15587,7 @@ func (x *PeerRelayFrame) String() string { func (*PeerRelayFrame) ProtoMessage() {} func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[196] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15684,7 +15600,7 @@ func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayFrame.ProtoReflect.Descriptor instead. func (*PeerRelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{197} + return file_openshell_proto_rawDescGZIP(), []int{196} } func (x *PeerRelayFrame) GetPayload() isPeerRelayFrame_Payload { @@ -15739,7 +15655,7 @@ type PeerConfigSandboxTarget struct { func (x *PeerConfigSandboxTarget) Reset() { *x = PeerConfigSandboxTarget{} - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[197] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15751,7 +15667,7 @@ func (x *PeerConfigSandboxTarget) String() string { func (*PeerConfigSandboxTarget) ProtoMessage() {} func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[197] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15764,7 +15680,7 @@ func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigSandboxTarget.ProtoReflect.Descriptor instead. func (*PeerConfigSandboxTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{198} + return file_openshell_proto_rawDescGZIP(), []int{197} } func (x *PeerConfigSandboxTarget) GetSandboxId() string { @@ -15792,7 +15708,7 @@ type PeerConfigProviderTarget struct { func (x *PeerConfigProviderTarget) Reset() { *x = PeerConfigProviderTarget{} - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[198] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15804,7 +15720,7 @@ func (x *PeerConfigProviderTarget) String() string { func (*PeerConfigProviderTarget) ProtoMessage() {} func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[198] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15817,7 +15733,7 @@ func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigProviderTarget.ProtoReflect.Descriptor instead. func (*PeerConfigProviderTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{199} + return file_openshell_proto_rawDescGZIP(), []int{198} } func (x *PeerConfigProviderTarget) GetWorkspace() string { @@ -15849,7 +15765,7 @@ type PeerNotifyConfigUpdateRequest struct { func (x *PeerNotifyConfigUpdateRequest) Reset() { *x = PeerNotifyConfigUpdateRequest{} - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[199] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15861,7 +15777,7 @@ func (x *PeerNotifyConfigUpdateRequest) String() string { func (*PeerNotifyConfigUpdateRequest) ProtoMessage() {} func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[199] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15874,7 +15790,7 @@ func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateRequest.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{200} + return file_openshell_proto_rawDescGZIP(), []int{199} } func (x *PeerNotifyConfigUpdateRequest) GetScope() isPeerNotifyConfigUpdateRequest_Scope { @@ -15958,7 +15874,7 @@ type PeerNotifyConfigUpdateResponse struct { func (x *PeerNotifyConfigUpdateResponse) Reset() { *x = PeerNotifyConfigUpdateResponse{} - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[200] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15970,7 +15886,7 @@ func (x *PeerNotifyConfigUpdateResponse) String() string { func (*PeerNotifyConfigUpdateResponse) ProtoMessage() {} func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[200] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15983,7 +15899,7 @@ func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateResponse.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{201} + return file_openshell_proto_rawDescGZIP(), []int{200} } func (x *PeerNotifyConfigUpdateResponse) GetStaleOwner() bool { @@ -16008,7 +15924,7 @@ type RelayOpenResult struct { func (x *RelayOpenResult) Reset() { *x = RelayOpenResult{} - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[201] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16020,7 +15936,7 @@ func (x *RelayOpenResult) String() string { func (*RelayOpenResult) ProtoMessage() {} func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[201] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16033,7 +15949,7 @@ func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead. func (*RelayOpenResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{202} + return file_openshell_proto_rawDescGZIP(), []int{201} } func (x *RelayOpenResult) GetChannelId() string { @@ -16070,7 +15986,7 @@ type RelayClose struct { func (x *RelayClose) Reset() { *x = RelayClose{} - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[202] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16082,7 +15998,7 @@ func (x *RelayClose) String() string { func (*RelayClose) ProtoMessage() {} func (x *RelayClose) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[202] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16095,7 +16011,7 @@ func (x *RelayClose) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayClose.ProtoReflect.Descriptor instead. func (*RelayClose) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{203} + return file_openshell_proto_rawDescGZIP(), []int{202} } func (x *RelayClose) GetChannelId() string { @@ -16129,7 +16045,7 @@ type L7RequestSample struct { func (x *L7RequestSample) Reset() { *x = L7RequestSample{} - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[203] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16141,7 +16057,7 @@ func (x *L7RequestSample) String() string { func (*L7RequestSample) ProtoMessage() {} func (x *L7RequestSample) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[203] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16154,7 +16070,7 @@ func (x *L7RequestSample) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead. func (*L7RequestSample) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{204} + return file_openshell_proto_rawDescGZIP(), []int{203} } func (x *L7RequestSample) GetMethod() string { @@ -16228,7 +16144,7 @@ type DenialSummary struct { func (x *DenialSummary) Reset() { *x = DenialSummary{} - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[204] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16240,7 +16156,7 @@ func (x *DenialSummary) String() string { func (*DenialSummary) ProtoMessage() {} func (x *DenialSummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[204] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16253,7 +16169,7 @@ func (x *DenialSummary) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead. func (*DenialSummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{205} + return file_openshell_proto_rawDescGZIP(), []int{204} } func (x *DenialSummary) GetSandboxId() string { @@ -16388,7 +16304,7 @@ type DenialGroupCount struct { func (x *DenialGroupCount) Reset() { *x = DenialGroupCount{} - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[205] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16400,7 +16316,7 @@ func (x *DenialGroupCount) String() string { func (*DenialGroupCount) ProtoMessage() {} func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[205] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16413,7 +16329,7 @@ func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead. func (*DenialGroupCount) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{206} + return file_openshell_proto_rawDescGZIP(), []int{205} } func (x *DenialGroupCount) GetDenyGroup() string { @@ -16446,7 +16362,7 @@ type NetworkActivitySummary struct { func (x *NetworkActivitySummary) Reset() { *x = NetworkActivitySummary{} - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[206] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16458,7 +16374,7 @@ func (x *NetworkActivitySummary) String() string { func (*NetworkActivitySummary) ProtoMessage() {} func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[206] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16471,7 +16387,7 @@ func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { // Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead. func (*NetworkActivitySummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{207} + return file_openshell_proto_rawDescGZIP(), []int{206} } func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 { @@ -16559,7 +16475,7 @@ type PolicyChunk struct { func (x *PolicyChunk) Reset() { *x = PolicyChunk{} - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[207] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16571,7 +16487,7 @@ func (x *PolicyChunk) String() string { func (*PolicyChunk) ProtoMessage() {} func (x *PolicyChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[207] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16584,7 +16500,7 @@ func (x *PolicyChunk) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead. func (*PolicyChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{208} + return file_openshell_proto_rawDescGZIP(), []int{207} } func (x *PolicyChunk) GetId() string { @@ -16772,7 +16688,7 @@ type DraftPolicyUpdate struct { func (x *DraftPolicyUpdate) Reset() { *x = DraftPolicyUpdate{} - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[208] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16784,7 +16700,7 @@ func (x *DraftPolicyUpdate) String() string { func (*DraftPolicyUpdate) ProtoMessage() {} func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[208] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16797,7 +16713,7 @@ func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead. func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{209} + return file_openshell_proto_rawDescGZIP(), []int{208} } func (x *DraftPolicyUpdate) GetDraftVersion() uint64 { @@ -16856,7 +16772,7 @@ type SubmitPolicyAnalysisRequest struct { func (x *SubmitPolicyAnalysisRequest) Reset() { *x = SubmitPolicyAnalysisRequest{} - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[209] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16868,7 +16784,7 @@ func (x *SubmitPolicyAnalysisRequest) String() string { func (*SubmitPolicyAnalysisRequest) ProtoMessage() {} func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[209] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16881,7 +16797,7 @@ func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{210} + return file_openshell_proto_rawDescGZIP(), []int{209} } func (x *SubmitPolicyAnalysisRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16944,7 +16860,7 @@ type SubmitPolicyAnalysisResponse struct { func (x *SubmitPolicyAnalysisResponse) Reset() { *x = SubmitPolicyAnalysisResponse{} - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[210] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16956,7 +16872,7 @@ func (x *SubmitPolicyAnalysisResponse) String() string { func (*SubmitPolicyAnalysisResponse) ProtoMessage() {} func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[210] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16969,7 +16885,7 @@ func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{211} + return file_openshell_proto_rawDescGZIP(), []int{210} } func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 { @@ -17014,7 +16930,7 @@ type GetDraftPolicyRequest struct { func (x *GetDraftPolicyRequest) Reset() { *x = GetDraftPolicyRequest{} - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[211] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17026,7 +16942,7 @@ func (x *GetDraftPolicyRequest) String() string { func (*GetDraftPolicyRequest) ProtoMessage() {} func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[211] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17039,7 +16955,7 @@ func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead. func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{212} + return file_openshell_proto_rawDescGZIP(), []int{211} } func (x *GetDraftPolicyRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17079,7 +16995,7 @@ type GetDraftPolicyResponse struct { func (x *GetDraftPolicyResponse) Reset() { *x = GetDraftPolicyResponse{} - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[212] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17091,7 +17007,7 @@ func (x *GetDraftPolicyResponse) String() string { func (*GetDraftPolicyResponse) ProtoMessage() {} func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[212] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17104,7 +17020,7 @@ func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead. func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{213} + return file_openshell_proto_rawDescGZIP(), []int{212} } func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk { @@ -17155,7 +17071,7 @@ type ApproveDraftChunkRequest struct { func (x *ApproveDraftChunkRequest) Reset() { *x = ApproveDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[213] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17167,7 +17083,7 @@ func (x *ApproveDraftChunkRequest) String() string { func (*ApproveDraftChunkRequest) ProtoMessage() {} func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[213] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17180,7 +17096,7 @@ func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{214} + return file_openshell_proto_rawDescGZIP(), []int{213} } func (x *ApproveDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17230,7 +17146,7 @@ type ApproveDraftChunkResponse struct { func (x *ApproveDraftChunkResponse) Reset() { *x = ApproveDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[214] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17242,7 +17158,7 @@ func (x *ApproveDraftChunkResponse) String() string { func (*ApproveDraftChunkResponse) ProtoMessage() {} func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[214] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17255,7 +17171,7 @@ func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{215} + return file_openshell_proto_rawDescGZIP(), []int{214} } func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 { @@ -17291,7 +17207,7 @@ type RejectDraftChunkRequest struct { func (x *RejectDraftChunkRequest) Reset() { *x = RejectDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[215] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17303,7 +17219,7 @@ func (x *RejectDraftChunkRequest) String() string { func (*RejectDraftChunkRequest) ProtoMessage() {} func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[215] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17316,7 +17232,7 @@ func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead. func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{216} + return file_openshell_proto_rawDescGZIP(), []int{215} } func (x *RejectDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17362,7 +17278,7 @@ type RejectDraftChunkResponse struct { func (x *RejectDraftChunkResponse) Reset() { *x = RejectDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[216] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17374,7 +17290,7 @@ func (x *RejectDraftChunkResponse) String() string { func (*RejectDraftChunkResponse) ProtoMessage() {} func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[216] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17387,7 +17303,7 @@ func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead. func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{217} + return file_openshell_proto_rawDescGZIP(), []int{216} } // Approve all pending chunks. @@ -17401,7 +17317,7 @@ type DraftChunkApproval struct { func (x *DraftChunkApproval) Reset() { *x = DraftChunkApproval{} - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[217] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17413,7 +17329,7 @@ func (x *DraftChunkApproval) String() string { func (*DraftChunkApproval) ProtoMessage() {} func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[217] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17426,7 +17342,7 @@ func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftChunkApproval.ProtoReflect.Descriptor instead. func (*DraftChunkApproval) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{218} + return file_openshell_proto_rawDescGZIP(), []int{217} } func (x *DraftChunkApproval) GetChunkId() string { @@ -17462,7 +17378,7 @@ type ApproveAllDraftChunksRequest struct { func (x *ApproveAllDraftChunksRequest) Reset() { *x = ApproveAllDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[218] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17474,7 +17390,7 @@ func (x *ApproveAllDraftChunksRequest) String() string { func (*ApproveAllDraftChunksRequest) ProtoMessage() {} func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[218] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17487,7 +17403,7 @@ func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{219} + return file_openshell_proto_rawDescGZIP(), []int{218} } func (x *ApproveAllDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17542,7 +17458,7 @@ type ApproveAllDraftChunksResponse struct { func (x *ApproveAllDraftChunksResponse) Reset() { *x = ApproveAllDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[219] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17554,7 +17470,7 @@ func (x *ApproveAllDraftChunksResponse) String() string { func (*ApproveAllDraftChunksResponse) ProtoMessage() {} func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[219] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17567,7 +17483,7 @@ func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{220} + return file_openshell_proto_rawDescGZIP(), []int{219} } func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 { @@ -17617,7 +17533,7 @@ type EditDraftChunkRequest struct { func (x *EditDraftChunkRequest) Reset() { *x = EditDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[220] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17629,7 +17545,7 @@ func (x *EditDraftChunkRequest) String() string { func (*EditDraftChunkRequest) ProtoMessage() {} func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[220] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17642,7 +17558,7 @@ func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead. func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{221} + return file_openshell_proto_rawDescGZIP(), []int{220} } func (x *EditDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17688,7 +17604,7 @@ type EditDraftChunkResponse struct { func (x *EditDraftChunkResponse) Reset() { *x = EditDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[221] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17700,7 +17616,7 @@ func (x *EditDraftChunkResponse) String() string { func (*EditDraftChunkResponse) ProtoMessage() {} func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[221] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17713,7 +17629,7 @@ func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead. func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{222} + return file_openshell_proto_rawDescGZIP(), []int{221} } // Reverse an approval (remove merged rule from active policy). @@ -17733,7 +17649,7 @@ type UndoDraftChunkRequest struct { func (x *UndoDraftChunkRequest) Reset() { *x = UndoDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[222] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17745,7 +17661,7 @@ func (x *UndoDraftChunkRequest) String() string { func (*UndoDraftChunkRequest) ProtoMessage() {} func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[222] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17758,7 +17674,7 @@ func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead. func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{223} + return file_openshell_proto_rawDescGZIP(), []int{222} } func (x *UndoDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17801,7 +17717,7 @@ type UndoDraftChunkResponse struct { func (x *UndoDraftChunkResponse) Reset() { *x = UndoDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[223] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17813,7 +17729,7 @@ func (x *UndoDraftChunkResponse) String() string { func (*UndoDraftChunkResponse) ProtoMessage() {} func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[223] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17826,7 +17742,7 @@ func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead. func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{224} + return file_openshell_proto_rawDescGZIP(), []int{223} } func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 { @@ -17858,7 +17774,7 @@ type ClearDraftChunksRequest struct { func (x *ClearDraftChunksRequest) Reset() { *x = ClearDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[224] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17870,7 +17786,7 @@ func (x *ClearDraftChunksRequest) String() string { func (*ClearDraftChunksRequest) ProtoMessage() {} func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[224] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17883,7 +17799,7 @@ func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{225} + return file_openshell_proto_rawDescGZIP(), []int{224} } func (x *ClearDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17917,7 +17833,7 @@ type ClearDraftChunksResponse struct { func (x *ClearDraftChunksResponse) Reset() { *x = ClearDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[225] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17929,7 +17845,7 @@ func (x *ClearDraftChunksResponse) String() string { func (*ClearDraftChunksResponse) ProtoMessage() {} func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[225] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17942,7 +17858,7 @@ func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{226} + return file_openshell_proto_rawDescGZIP(), []int{225} } func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 { @@ -17964,7 +17880,7 @@ type GetDraftHistoryRequest struct { func (x *GetDraftHistoryRequest) Reset() { *x = GetDraftHistoryRequest{} - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[226] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17976,7 +17892,7 @@ func (x *GetDraftHistoryRequest) String() string { func (*GetDraftHistoryRequest) ProtoMessage() {} func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[226] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17989,7 +17905,7 @@ func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead. func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{227} + return file_openshell_proto_rawDescGZIP(), []int{226} } func (x *GetDraftHistoryRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18023,7 +17939,7 @@ type DraftHistoryEntry struct { func (x *DraftHistoryEntry) Reset() { *x = DraftHistoryEntry{} - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[227] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18035,7 +17951,7 @@ func (x *DraftHistoryEntry) String() string { func (*DraftHistoryEntry) ProtoMessage() {} func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[227] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18048,7 +17964,7 @@ func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead. func (*DraftHistoryEntry) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{228} + return file_openshell_proto_rawDescGZIP(), []int{227} } func (x *DraftHistoryEntry) GetEventTime() *timestamppb.Timestamp { @@ -18089,7 +18005,7 @@ type GetDraftHistoryResponse struct { func (x *GetDraftHistoryResponse) Reset() { *x = GetDraftHistoryResponse{} - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[228] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18101,7 +18017,7 @@ func (x *GetDraftHistoryResponse) String() string { func (*GetDraftHistoryResponse) ProtoMessage() {} func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[228] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18114,7 +18030,7 @@ func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead. func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{229} + return file_openshell_proto_rawDescGZIP(), []int{228} } func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry { @@ -18139,7 +18055,7 @@ type CreateWorkspaceRequest struct { func (x *CreateWorkspaceRequest) Reset() { *x = CreateWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[229] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18151,7 +18067,7 @@ func (x *CreateWorkspaceRequest) String() string { func (*CreateWorkspaceRequest) ProtoMessage() {} func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[229] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18164,7 +18080,7 @@ func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead. func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{230} + return file_openshell_proto_rawDescGZIP(), []int{229} } func (x *CreateWorkspaceRequest) GetName() string { @@ -18198,7 +18114,7 @@ type CreateWorkspaceResponse struct { func (x *CreateWorkspaceResponse) Reset() { *x = CreateWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[230] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18210,7 +18126,7 @@ func (x *CreateWorkspaceResponse) String() string { func (*CreateWorkspaceResponse) ProtoMessage() {} func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[230] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18223,7 +18139,7 @@ func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead. func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{231} + return file_openshell_proto_rawDescGZIP(), []int{230} } func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -18244,7 +18160,7 @@ type GetWorkspaceRequest struct { func (x *GetWorkspaceRequest) Reset() { *x = GetWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[231] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18256,7 +18172,7 @@ func (x *GetWorkspaceRequest) String() string { func (*GetWorkspaceRequest) ProtoMessage() {} func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[231] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18269,7 +18185,7 @@ func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead. func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{232} + return file_openshell_proto_rawDescGZIP(), []int{231} } func (x *GetWorkspaceRequest) GetName() string { @@ -18289,7 +18205,7 @@ type GetWorkspaceResponse struct { func (x *GetWorkspaceResponse) Reset() { *x = GetWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[232] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18301,7 +18217,7 @@ func (x *GetWorkspaceResponse) String() string { func (*GetWorkspaceResponse) ProtoMessage() {} func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[232] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18314,7 +18230,7 @@ func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead. func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{233} + return file_openshell_proto_rawDescGZIP(), []int{232} } func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -18341,7 +18257,7 @@ type ListWorkspacesRequest struct { func (x *ListWorkspacesRequest) Reset() { *x = ListWorkspacesRequest{} - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[233] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18353,7 +18269,7 @@ func (x *ListWorkspacesRequest) String() string { func (*ListWorkspacesRequest) ProtoMessage() {} func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[233] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18366,7 +18282,7 @@ func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead. func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{234} + return file_openshell_proto_rawDescGZIP(), []int{233} } func (x *ListWorkspacesRequest) GetPageSize() int32 { @@ -18402,7 +18318,7 @@ type ListWorkspacesResponse struct { func (x *ListWorkspacesResponse) Reset() { *x = ListWorkspacesResponse{} - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[234] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18414,7 +18330,7 @@ func (x *ListWorkspacesResponse) String() string { func (*ListWorkspacesResponse) ProtoMessage() {} func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[234] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18427,7 +18343,7 @@ func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead. func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{235} + return file_openshell_proto_rawDescGZIP(), []int{234} } func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace { @@ -18458,7 +18374,7 @@ type DeleteWorkspaceRequest struct { func (x *DeleteWorkspaceRequest) Reset() { *x = DeleteWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[235] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18470,7 +18386,7 @@ func (x *DeleteWorkspaceRequest) String() string { func (*DeleteWorkspaceRequest) ProtoMessage() {} func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[235] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18483,7 +18399,7 @@ func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{236} + return file_openshell_proto_rawDescGZIP(), []int{235} } func (x *DeleteWorkspaceRequest) GetName() string { @@ -18517,7 +18433,7 @@ type DeleteWorkspaceResponse struct { func (x *DeleteWorkspaceResponse) Reset() { *x = DeleteWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[236] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18529,7 +18445,7 @@ func (x *DeleteWorkspaceResponse) String() string { func (*DeleteWorkspaceResponse) ProtoMessage() {} func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[236] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18542,7 +18458,7 @@ func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{237} + return file_openshell_proto_rawDescGZIP(), []int{236} } func (x *DeleteWorkspaceResponse) GetOutcome() DeletionOutcome { @@ -18566,7 +18482,7 @@ type WorkspaceMember struct { func (x *WorkspaceMember) Reset() { *x = WorkspaceMember{} - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[237] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18578,7 +18494,7 @@ func (x *WorkspaceMember) String() string { func (*WorkspaceMember) ProtoMessage() {} func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[237] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18591,7 +18507,7 @@ func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead. func (*WorkspaceMember) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{238} + return file_openshell_proto_rawDescGZIP(), []int{237} } func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta { @@ -18632,7 +18548,7 @@ type AddWorkspaceMemberRequest struct { func (x *AddWorkspaceMemberRequest) Reset() { *x = AddWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[238] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18644,7 +18560,7 @@ func (x *AddWorkspaceMemberRequest) String() string { func (*AddWorkspaceMemberRequest) ProtoMessage() {} func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[238] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18657,7 +18573,7 @@ func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{239} + return file_openshell_proto_rawDescGZIP(), []int{238} } func (x *AddWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18698,7 +18614,7 @@ type AddWorkspaceMemberResponse struct { func (x *AddWorkspaceMemberResponse) Reset() { *x = AddWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[239] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18710,7 +18626,7 @@ func (x *AddWorkspaceMemberResponse) String() string { func (*AddWorkspaceMemberResponse) ProtoMessage() {} func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[239] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18723,7 +18639,7 @@ func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{240} + return file_openshell_proto_rawDescGZIP(), []int{239} } func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember { @@ -18749,7 +18665,7 @@ type RemoveWorkspaceMemberRequest struct { func (x *RemoveWorkspaceMemberRequest) Reset() { *x = RemoveWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[240] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18761,7 +18677,7 @@ func (x *RemoveWorkspaceMemberRequest) String() string { func (*RemoveWorkspaceMemberRequest) ProtoMessage() {} func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[240] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18774,7 +18690,7 @@ func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{241} + return file_openshell_proto_rawDescGZIP(), []int{240} } func (x *RemoveWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18815,7 +18731,7 @@ type RemoveWorkspaceMemberResponse struct { func (x *RemoveWorkspaceMemberResponse) Reset() { *x = RemoveWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[241] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18827,7 +18743,7 @@ func (x *RemoveWorkspaceMemberResponse) String() string { func (*RemoveWorkspaceMemberResponse) ProtoMessage() {} func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[241] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18840,7 +18756,7 @@ func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{242} + return file_openshell_proto_rawDescGZIP(), []int{241} } func (x *RemoveWorkspaceMemberResponse) GetOutcome() DeletionOutcome { @@ -18867,7 +18783,7 @@ type ListWorkspaceMembersRequest struct { func (x *ListWorkspaceMembersRequest) Reset() { *x = ListWorkspaceMembersRequest{} - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[242] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18879,7 +18795,7 @@ func (x *ListWorkspaceMembersRequest) String() string { func (*ListWorkspaceMembersRequest) ProtoMessage() {} func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[242] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18892,7 +18808,7 @@ func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{243} + return file_openshell_proto_rawDescGZIP(), []int{242} } func (x *ListWorkspaceMembersRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18928,7 +18844,7 @@ type ListWorkspaceMembersResponse struct { func (x *ListWorkspaceMembersResponse) Reset() { *x = ListWorkspaceMembersResponse{} - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[243] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18940,7 +18856,7 @@ func (x *ListWorkspaceMembersResponse) String() string { func (*ListWorkspaceMembersResponse) ProtoMessage() {} func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[243] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18953,7 +18869,7 @@ func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{244} + return file_openshell_proto_rawDescGZIP(), []int{243} } func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember { @@ -18988,7 +18904,7 @@ type ExtensionServiceCredential struct { func (x *ExtensionServiceCredential) Reset() { *x = ExtensionServiceCredential{} - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[244] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19000,7 +18916,7 @@ func (x *ExtensionServiceCredential) String() string { func (*ExtensionServiceCredential) ProtoMessage() {} func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[244] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19013,7 +18929,7 @@ func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use ExtensionServiceCredential.ProtoReflect.Descriptor instead. func (*ExtensionServiceCredential) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{245} + return file_openshell_proto_rawDescGZIP(), []int{244} } func (x *ExtensionServiceCredential) GetServiceName() string { @@ -19053,7 +18969,7 @@ type EndpointObservation struct { func (x *EndpointObservation) Reset() { *x = EndpointObservation{} - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[245] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19065,7 +18981,7 @@ func (x *EndpointObservation) String() string { func (*EndpointObservation) ProtoMessage() {} func (x *EndpointObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[245] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19078,7 +18994,7 @@ func (x *EndpointObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointObservation.ProtoReflect.Descriptor instead. func (*EndpointObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{246} + return file_openshell_proto_rawDescGZIP(), []int{245} } func (x *EndpointObservation) GetEndpointId() string { @@ -19131,7 +19047,7 @@ type ReportEndpointStatusRequest struct { func (x *ReportEndpointStatusRequest) Reset() { *x = ReportEndpointStatusRequest{} - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[246] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19143,7 +19059,7 @@ func (x *ReportEndpointStatusRequest) String() string { func (*ReportEndpointStatusRequest) ProtoMessage() {} func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[246] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19156,7 +19072,7 @@ func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusRequest.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{247} + return file_openshell_proto_rawDescGZIP(), []int{246} } func (x *ReportEndpointStatusRequest) GetSandboxId() string { @@ -19225,7 +19141,7 @@ type TokenGrantStatus struct { func (x *TokenGrantStatus) Reset() { *x = TokenGrantStatus{} - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[247] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19237,7 +19153,7 @@ func (x *TokenGrantStatus) String() string { func (*TokenGrantStatus) ProtoMessage() {} func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[247] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19250,7 +19166,7 @@ func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantStatus.ProtoReflect.Descriptor instead. func (*TokenGrantStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{248} + return file_openshell_proto_rawDescGZIP(), []int{247} } func (x *TokenGrantStatus) GetLastFailure() *TokenGrantFailureObservation { @@ -19277,7 +19193,7 @@ type TokenGrantFailureObservation struct { func (x *TokenGrantFailureObservation) Reset() { *x = TokenGrantFailureObservation{} - mi := &file_openshell_proto_msgTypes[249] + mi := &file_openshell_proto_msgTypes[248] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19289,7 +19205,7 @@ func (x *TokenGrantFailureObservation) String() string { func (*TokenGrantFailureObservation) ProtoMessage() {} func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[249] + mi := &file_openshell_proto_msgTypes[248] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19302,7 +19218,7 @@ func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantFailureObservation.ProtoReflect.Descriptor instead. func (*TokenGrantFailureObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{249} + return file_openshell_proto_rawDescGZIP(), []int{248} } func (x *TokenGrantFailureObservation) GetDestinationHost() string { @@ -19335,7 +19251,7 @@ type ReportEndpointStatusResponse struct { func (x *ReportEndpointStatusResponse) Reset() { *x = ReportEndpointStatusResponse{} - mi := &file_openshell_proto_msgTypes[250] + mi := &file_openshell_proto_msgTypes[249] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19347,7 +19263,7 @@ func (x *ReportEndpointStatusResponse) String() string { func (*ReportEndpointStatusResponse) ProtoMessage() {} func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[250] + mi := &file_openshell_proto_msgTypes[249] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19360,7 +19276,7 @@ func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusResponse.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{250} + return file_openshell_proto_rawDescGZIP(), []int{249} } // A configured endpoint and its last accepted network result in one record. @@ -19394,7 +19310,7 @@ type EndpointStatus struct { func (x *EndpointStatus) Reset() { *x = EndpointStatus{} - mi := &file_openshell_proto_msgTypes[251] + mi := &file_openshell_proto_msgTypes[250] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19406,7 +19322,7 @@ func (x *EndpointStatus) String() string { func (*EndpointStatus) ProtoMessage() {} func (x *EndpointStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[251] + mi := &file_openshell_proto_msgTypes[250] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19419,7 +19335,7 @@ func (x *EndpointStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointStatus.ProtoReflect.Descriptor instead. func (*EndpointStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{251} + return file_openshell_proto_rawDescGZIP(), []int{250} } func (x *EndpointStatus) GetEndpointId() string { @@ -19514,7 +19430,7 @@ type SandboxProvisioning struct { func (x *SandboxProvisioning) Reset() { *x = SandboxProvisioning{} - mi := &file_openshell_proto_msgTypes[252] + mi := &file_openshell_proto_msgTypes[251] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19526,7 +19442,7 @@ func (x *SandboxProvisioning) String() string { func (*SandboxProvisioning) ProtoMessage() {} func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[252] + mi := &file_openshell_proto_msgTypes[251] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19539,7 +19455,7 @@ func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxProvisioning.ProtoReflect.Descriptor instead. func (*SandboxProvisioning) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{252} + return file_openshell_proto_rawDescGZIP(), []int{251} } func (x *SandboxProvisioning) GetAttemptId() string { @@ -19662,7 +19578,7 @@ type SandboxServiceExposure struct { func (x *SandboxServiceExposure) Reset() { *x = SandboxServiceExposure{} - mi := &file_openshell_proto_msgTypes[253] + mi := &file_openshell_proto_msgTypes[252] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19674,7 +19590,7 @@ func (x *SandboxServiceExposure) String() string { func (*SandboxServiceExposure) ProtoMessage() {} func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[253] + mi := &file_openshell_proto_msgTypes[252] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19687,7 +19603,7 @@ func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxServiceExposure.ProtoReflect.Descriptor instead. func (*SandboxServiceExposure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{253} + return file_openshell_proto_rawDescGZIP(), []int{252} } func (x *SandboxServiceExposure) GetService() string { @@ -19741,7 +19657,7 @@ type EndpointFailure struct { func (x *EndpointFailure) Reset() { *x = EndpointFailure{} - mi := &file_openshell_proto_msgTypes[254] + mi := &file_openshell_proto_msgTypes[253] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19753,7 +19669,7 @@ func (x *EndpointFailure) String() string { func (*EndpointFailure) ProtoMessage() {} func (x *EndpointFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[254] + mi := &file_openshell_proto_msgTypes[253] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19766,7 +19682,7 @@ func (x *EndpointFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointFailure.ProtoReflect.Descriptor instead. func (*EndpointFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{254} + return file_openshell_proto_rawDescGZIP(), []int{253} } func (x *EndpointFailure) GetDomain() EndpointFailureDomain { @@ -20552,20 +20468,9 @@ const file_openshell_proto_rawDesc = "" + " \x01(\x0e25.openshell.v1.ProviderCredentialRefreshRecoveryActionR\x0erecoveryAction\x12!\n" + "\ffailure_code\x18\v \x01(\tR\vfailureCode\x124\n" + "\x16provider_error_subtype\x18\f \x01(\tR\x14providerErrorSubtype\x12B\n" + - "\x0flast_error_time\x18q \x01(\v2\x1a.google.protobuf.TimestampR\rlastErrorTimeJ\x04\b\x06\x10\aJ\x04\b\a\x10\bJ\x04\b\b\x10\tJ\x04\b\r\x10\x0eR\rexpires_at_msR\x12next_refresh_at_msR\x12last_refresh_at_msR\x10last_error_at_ms\"d\n" + + "\x0flast_error_time\x18q \x01(\v2\x1a.google.protobuf.TimestampR\rlastErrorTimeJ\x04\b\x06\x10\aJ\x04\b\a\x10\bJ\x04\b\b\x10\tJ\x04\b\r\x10\x0eR\rexpires_at_msR\x12next_refresh_at_msR\x12last_refresh_at_msR\x10last_error_at_ms\"<\n" + "\x18ProviderProfileDiscovery\x12 \n" + - "\vcredentials\x18\x01 \x03(\tR\vcredentials\x12&\n" + - "\x0fconfig_env_vars\x18\x02 \x03(\tR\rconfigEnvVars\"\xaa\x02\n" + - "\x1aProviderProfileEnvironment\x12L\n" + - "\x06config\x18\x01 \x03(\v24.openshell.v1.ProviderProfileEnvironment.ConfigEntryR\x06config\x12I\n" + - "\x05fixed\x18\x02 \x03(\v23.openshell.v1.ProviderProfileEnvironment.FixedEntryR\x05fixed\x1a9\n" + - "\vConfigEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a8\n" + - "\n" + - "FixedEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xb8\x01\n" + + "\vcredentials\x18\x01 \x03(\tR\vcredentials\"\xb8\x01\n" + "\x1fGetProviderRefreshStatusRequest\x12R\n" + "\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1a\n" + "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + @@ -20603,7 +20508,7 @@ const file_openshell_proto_rawDesc = "" + "\n" + "request_id\x18\x06 \x01(\tR\trequestId\"g\n" + "\x1dDeleteProviderRefreshResponse\x127\n" + - "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\x99\a\n" + + "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\x91\x06\n" + "\x0fProviderProfile\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x12!\n" + "\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12 \n" + @@ -20619,9 +20524,7 @@ const file_openshell_proto_rawDesc = "" + "\vannotations\x18\v \x03(\v2..openshell.v1.ProviderProfile.AnnotationsEntryR\vannotations\x12\x16\n" + "\x06source\x18\f \x01(\tR\x06source\x12\x14\n" + "\x05scope\x18\r \x01(\tR\x05scope\x127\n" + - "\x05files\x18\x0e \x03(\v2!.openshell.v1.ProviderProfileFileR\x05files\x12J\n" + - "\venvironment\x18\x0f \x01(\v2(.openshell.v1.ProviderProfileEnvironmentR\venvironment\x12:\n" + - "\x19required_platform_adapter\x18\x10 \x01(\tR\x17requiredPlatformAdapter\x1a>\n" + + "\x05files\x18\x0e \x03(\v2!.openshell.v1.ProviderProfileFileR\x05files\x1a>\n" + "\x10AnnotationsEntry\x12\x10\n" + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\\\n" + @@ -21671,7 +21574,7 @@ func file_openshell_proto_rawDescGZIP() []byte { } var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 22) -var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 284) +var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 281) var file_openshell_proto_goTypes = []any{ (ExtensionKind)(0), // 0: openshell.v1.ExtensionKind (SandboxPhase)(0), // 1: openshell.v1.SandboxPhase @@ -21816,195 +21719,192 @@ var file_openshell_proto_goTypes = []any{ (*ProviderCredentialRefresh)(nil), // 140: openshell.v1.ProviderCredentialRefresh (*ProviderCredentialRefreshStatus)(nil), // 141: openshell.v1.ProviderCredentialRefreshStatus (*ProviderProfileDiscovery)(nil), // 142: openshell.v1.ProviderProfileDiscovery - (*ProviderProfileEnvironment)(nil), // 143: openshell.v1.ProviderProfileEnvironment - (*GetProviderRefreshStatusRequest)(nil), // 144: openshell.v1.GetProviderRefreshStatusRequest - (*GetProviderRefreshStatusResponse)(nil), // 145: openshell.v1.GetProviderRefreshStatusResponse - (*ConfigureProviderRefreshRequest)(nil), // 146: openshell.v1.ConfigureProviderRefreshRequest - (*ConfigureProviderRefreshResponse)(nil), // 147: openshell.v1.ConfigureProviderRefreshResponse - (*RotateProviderCredentialRequest)(nil), // 148: openshell.v1.RotateProviderCredentialRequest - (*RotateProviderCredentialResponse)(nil), // 149: openshell.v1.RotateProviderCredentialResponse - (*DeleteProviderRefreshRequest)(nil), // 150: openshell.v1.DeleteProviderRefreshRequest - (*DeleteProviderRefreshResponse)(nil), // 151: openshell.v1.DeleteProviderRefreshResponse - (*ProviderProfile)(nil), // 152: openshell.v1.ProviderProfile - (*ProviderProfileFile)(nil), // 153: openshell.v1.ProviderProfileFile - (*ProviderProfileResponse)(nil), // 154: openshell.v1.ProviderProfileResponse - (*ListProviderProfilesResponse)(nil), // 155: openshell.v1.ListProviderProfilesResponse - (*ImportProviderProfilesRequest)(nil), // 156: openshell.v1.ImportProviderProfilesRequest - (*ImportProviderProfilesResponse)(nil), // 157: openshell.v1.ImportProviderProfilesResponse - (*UpdateProviderProfilesRequest)(nil), // 158: openshell.v1.UpdateProviderProfilesRequest - (*UpdateProviderProfilesResponse)(nil), // 159: openshell.v1.UpdateProviderProfilesResponse - (*LintProviderProfilesRequest)(nil), // 160: openshell.v1.LintProviderProfilesRequest - (*LintProviderProfilesResponse)(nil), // 161: openshell.v1.LintProviderProfilesResponse - (*DeleteProviderResponse)(nil), // 162: openshell.v1.DeleteProviderResponse - (*DeleteProviderProfileRequest)(nil), // 163: openshell.v1.DeleteProviderProfileRequest - (*DeleteProviderProfileResponse)(nil), // 164: openshell.v1.DeleteProviderProfileResponse - (*GetSandboxProviderEnvironmentRequest)(nil), // 165: openshell.v1.GetSandboxProviderEnvironmentRequest - (*StaticCredentialEndpointBinding)(nil), // 166: openshell.v1.StaticCredentialEndpointBinding - (*StaticCredentialBinding)(nil), // 167: openshell.v1.StaticCredentialBinding - (*GetSandboxProviderEnvironmentResponse)(nil), // 168: openshell.v1.GetSandboxProviderEnvironmentResponse - (*ProviderEnvironmentValue)(nil), // 169: openshell.v1.ProviderEnvironmentValue - (*ProviderEnvironmentSnapshot)(nil), // 170: openshell.v1.ProviderEnvironmentSnapshot - (*ExchangeProviderSubjectTokenRequest)(nil), // 171: openshell.v1.ExchangeProviderSubjectTokenRequest - (*ExchangeProviderSubjectTokenResponse)(nil), // 172: openshell.v1.ExchangeProviderSubjectTokenResponse - (*UpdateConfigRequest)(nil), // 173: openshell.v1.UpdateConfigRequest - (*PolicyMergeOperation)(nil), // 174: openshell.v1.PolicyMergeOperation - (*AddNetworkRule)(nil), // 175: openshell.v1.AddNetworkRule - (*RemoveNetworkEndpoint)(nil), // 176: openshell.v1.RemoveNetworkEndpoint - (*RemoveNetworkRule)(nil), // 177: openshell.v1.RemoveNetworkRule - (*L7RuleTarget)(nil), // 178: openshell.v1.L7RuleTarget - (*AddDenyRules)(nil), // 179: openshell.v1.AddDenyRules - (*AddAllowRules)(nil), // 180: openshell.v1.AddAllowRules - (*RemoveNetworkBinary)(nil), // 181: openshell.v1.RemoveNetworkBinary - (*UpdateConfigResponse)(nil), // 182: openshell.v1.UpdateConfigResponse - (*GetSandboxPolicyStatusRequest)(nil), // 183: openshell.v1.GetSandboxPolicyStatusRequest - (*GetSandboxPolicyStatusResponse)(nil), // 184: openshell.v1.GetSandboxPolicyStatusResponse - (*ListSandboxPoliciesRequest)(nil), // 185: openshell.v1.ListSandboxPoliciesRequest - (*ListSandboxPoliciesResponse)(nil), // 186: openshell.v1.ListSandboxPoliciesResponse - (*ReportPolicyStatusRequest)(nil), // 187: openshell.v1.ReportPolicyStatusRequest - (*ReportPolicyStatusResponse)(nil), // 188: openshell.v1.ReportPolicyStatusResponse - (*SandboxConfigurationAdmission)(nil), // 189: openshell.v1.SandboxConfigurationAdmission - (*ReportSandboxConfigurationRequest)(nil), // 190: openshell.v1.ReportSandboxConfigurationRequest - (*ReportSandboxConfigurationResponse)(nil), // 191: openshell.v1.ReportSandboxConfigurationResponse - (*SandboxPolicyRevision)(nil), // 192: openshell.v1.SandboxPolicyRevision - (*GetSandboxLogsRequest)(nil), // 193: openshell.v1.GetSandboxLogsRequest - (*PushSandboxLogsRequest)(nil), // 194: openshell.v1.PushSandboxLogsRequest - (*PushSandboxLogsResponse)(nil), // 195: openshell.v1.PushSandboxLogsResponse - (*GetSandboxLogsResponse)(nil), // 196: openshell.v1.GetSandboxLogsResponse - (*SupervisorMessage)(nil), // 197: openshell.v1.SupervisorMessage - (*GatewayMessage)(nil), // 198: openshell.v1.GatewayMessage - (*SupervisorHello)(nil), // 199: openshell.v1.SupervisorHello - (*SessionAccepted)(nil), // 200: openshell.v1.SessionAccepted - (*ConfigUpdate)(nil), // 201: openshell.v1.ConfigUpdate - (*ConfigApplyFailure)(nil), // 202: openshell.v1.ConfigApplyFailure - (*ConfigUpdateResult)(nil), // 203: openshell.v1.ConfigUpdateResult - (*PolicyLoadResult)(nil), // 204: openshell.v1.PolicyLoadResult - (*SessionRejected)(nil), // 205: openshell.v1.SessionRejected - (*SessionRedirect)(nil), // 206: openshell.v1.SessionRedirect - (*SupervisorHeartbeat)(nil), // 207: openshell.v1.SupervisorHeartbeat - (*GatewayHeartbeat)(nil), // 208: openshell.v1.GatewayHeartbeat - (*ReportMainProcessExitRequest)(nil), // 209: openshell.v1.ReportMainProcessExitRequest - (*ReportMainProcessExitResponse)(nil), // 210: openshell.v1.ReportMainProcessExitResponse - (*FinalizeMainProcessExitRequest)(nil), // 211: openshell.v1.FinalizeMainProcessExitRequest - (*FinalizeMainProcessExitResponse)(nil), // 212: openshell.v1.FinalizeMainProcessExitResponse - (*RelayOpen)(nil), // 213: openshell.v1.RelayOpen - (*SshRelayTarget)(nil), // 214: openshell.v1.SshRelayTarget - (*TcpRelayTarget)(nil), // 215: openshell.v1.TcpRelayTarget - (*RelayInit)(nil), // 216: openshell.v1.RelayInit - (*RelayFrame)(nil), // 217: openshell.v1.RelayFrame - (*PeerRelayInit)(nil), // 218: openshell.v1.PeerRelayInit - (*PeerRelayFrame)(nil), // 219: openshell.v1.PeerRelayFrame - (*PeerConfigSandboxTarget)(nil), // 220: openshell.v1.PeerConfigSandboxTarget - (*PeerConfigProviderTarget)(nil), // 221: openshell.v1.PeerConfigProviderTarget - (*PeerNotifyConfigUpdateRequest)(nil), // 222: openshell.v1.PeerNotifyConfigUpdateRequest - (*PeerNotifyConfigUpdateResponse)(nil), // 223: openshell.v1.PeerNotifyConfigUpdateResponse - (*RelayOpenResult)(nil), // 224: openshell.v1.RelayOpenResult - (*RelayClose)(nil), // 225: openshell.v1.RelayClose - (*L7RequestSample)(nil), // 226: openshell.v1.L7RequestSample - (*DenialSummary)(nil), // 227: openshell.v1.DenialSummary - (*DenialGroupCount)(nil), // 228: openshell.v1.DenialGroupCount - (*NetworkActivitySummary)(nil), // 229: openshell.v1.NetworkActivitySummary - (*PolicyChunk)(nil), // 230: openshell.v1.PolicyChunk - (*DraftPolicyUpdate)(nil), // 231: openshell.v1.DraftPolicyUpdate - (*SubmitPolicyAnalysisRequest)(nil), // 232: openshell.v1.SubmitPolicyAnalysisRequest - (*SubmitPolicyAnalysisResponse)(nil), // 233: openshell.v1.SubmitPolicyAnalysisResponse - (*GetDraftPolicyRequest)(nil), // 234: openshell.v1.GetDraftPolicyRequest - (*GetDraftPolicyResponse)(nil), // 235: openshell.v1.GetDraftPolicyResponse - (*ApproveDraftChunkRequest)(nil), // 236: openshell.v1.ApproveDraftChunkRequest - (*ApproveDraftChunkResponse)(nil), // 237: openshell.v1.ApproveDraftChunkResponse - (*RejectDraftChunkRequest)(nil), // 238: openshell.v1.RejectDraftChunkRequest - (*RejectDraftChunkResponse)(nil), // 239: openshell.v1.RejectDraftChunkResponse - (*DraftChunkApproval)(nil), // 240: openshell.v1.DraftChunkApproval - (*ApproveAllDraftChunksRequest)(nil), // 241: openshell.v1.ApproveAllDraftChunksRequest - (*ApproveAllDraftChunksResponse)(nil), // 242: openshell.v1.ApproveAllDraftChunksResponse - (*EditDraftChunkRequest)(nil), // 243: openshell.v1.EditDraftChunkRequest - (*EditDraftChunkResponse)(nil), // 244: openshell.v1.EditDraftChunkResponse - (*UndoDraftChunkRequest)(nil), // 245: openshell.v1.UndoDraftChunkRequest - (*UndoDraftChunkResponse)(nil), // 246: openshell.v1.UndoDraftChunkResponse - (*ClearDraftChunksRequest)(nil), // 247: openshell.v1.ClearDraftChunksRequest - (*ClearDraftChunksResponse)(nil), // 248: openshell.v1.ClearDraftChunksResponse - (*GetDraftHistoryRequest)(nil), // 249: openshell.v1.GetDraftHistoryRequest - (*DraftHistoryEntry)(nil), // 250: openshell.v1.DraftHistoryEntry - (*GetDraftHistoryResponse)(nil), // 251: openshell.v1.GetDraftHistoryResponse - (*CreateWorkspaceRequest)(nil), // 252: openshell.v1.CreateWorkspaceRequest - (*CreateWorkspaceResponse)(nil), // 253: openshell.v1.CreateWorkspaceResponse - (*GetWorkspaceRequest)(nil), // 254: openshell.v1.GetWorkspaceRequest - (*GetWorkspaceResponse)(nil), // 255: openshell.v1.GetWorkspaceResponse - (*ListWorkspacesRequest)(nil), // 256: openshell.v1.ListWorkspacesRequest - (*ListWorkspacesResponse)(nil), // 257: openshell.v1.ListWorkspacesResponse - (*DeleteWorkspaceRequest)(nil), // 258: openshell.v1.DeleteWorkspaceRequest - (*DeleteWorkspaceResponse)(nil), // 259: openshell.v1.DeleteWorkspaceResponse - (*WorkspaceMember)(nil), // 260: openshell.v1.WorkspaceMember - (*AddWorkspaceMemberRequest)(nil), // 261: openshell.v1.AddWorkspaceMemberRequest - (*AddWorkspaceMemberResponse)(nil), // 262: openshell.v1.AddWorkspaceMemberResponse - (*RemoveWorkspaceMemberRequest)(nil), // 263: openshell.v1.RemoveWorkspaceMemberRequest - (*RemoveWorkspaceMemberResponse)(nil), // 264: openshell.v1.RemoveWorkspaceMemberResponse - (*ListWorkspaceMembersRequest)(nil), // 265: openshell.v1.ListWorkspaceMembersRequest - (*ListWorkspaceMembersResponse)(nil), // 266: openshell.v1.ListWorkspaceMembersResponse - (*ExtensionServiceCredential)(nil), // 267: openshell.v1.ExtensionServiceCredential - (*EndpointObservation)(nil), // 268: openshell.v1.EndpointObservation - (*ReportEndpointStatusRequest)(nil), // 269: openshell.v1.ReportEndpointStatusRequest - (*TokenGrantStatus)(nil), // 270: openshell.v1.TokenGrantStatus - (*TokenGrantFailureObservation)(nil), // 271: openshell.v1.TokenGrantFailureObservation - (*ReportEndpointStatusResponse)(nil), // 272: openshell.v1.ReportEndpointStatusResponse - (*EndpointStatus)(nil), // 273: openshell.v1.EndpointStatus - (*SandboxProvisioning)(nil), // 274: openshell.v1.SandboxProvisioning - (*SandboxServiceExposure)(nil), // 275: openshell.v1.SandboxServiceExposure - (*EndpointFailure)(nil), // 276: openshell.v1.EndpointFailure - nil, // 277: openshell.v1.SandboxSpec.EnvironmentEntry - nil, // 278: openshell.v1.SandboxTemplate.LabelsEntry - nil, // 279: openshell.v1.SandboxTemplate.AnnotationsEntry - nil, // 280: openshell.v1.SandboxTemplate.EnvironmentEntry - nil, // 281: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry - nil, // 282: openshell.v1.PlatformEvent.MetadataEntry - nil, // 283: openshell.v1.CreateSandboxRequest.LabelsEntry - nil, // 284: openshell.v1.CreateSandboxRequest.AnnotationsEntry - nil, // 285: openshell.v1.SandboxMapUpdate.ValuesEntry - nil, // 286: openshell.v1.SandboxResponse.ServiceUrlsEntry - nil, // 287: openshell.v1.ExecSandboxRequest.EnvironmentEntry - nil, // 288: openshell.v1.SandboxLogLine.FieldsEntry - nil, // 289: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - nil, // 290: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - nil, // 291: openshell.v1.ProviderProfileEnvironment.ConfigEntry - nil, // 292: openshell.v1.ProviderProfileEnvironment.FixedEntry - nil, // 293: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - nil, // 294: openshell.v1.ProviderProfile.AnnotationsEntry - nil, // 295: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - nil, // 296: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - nil, // 297: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - nil, // 298: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - nil, // 299: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - nil, // 300: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - nil, // 301: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - nil, // 302: openshell.v1.UpdateConfigRequest.AnnotationsEntry - nil, // 303: openshell.v1.UpdateConfigResponse.AnnotationsEntry - nil, // 304: openshell.v1.SandboxPolicyRevision.ProvenanceEntry - nil, // 305: openshell.v1.CreateWorkspaceRequest.LabelsEntry - (*timestamppb.Timestamp)(nil), // 306: google.protobuf.Timestamp - (*datamodelv1.ObjectMeta)(nil), // 307: openshell.datamodel.v1.ObjectMeta - (*sandboxv1.SandboxPolicy)(nil), // 308: openshell.sandbox.v1.SandboxPolicy - (*structpb.Struct)(nil), // 309: google.protobuf.Struct - (*durationpb.Duration)(nil), // 310: google.protobuf.Duration - (*datamodelv1.WorkspaceSelector)(nil), // 311: openshell.datamodel.v1.WorkspaceSelector - (*datamodelv1.Provider)(nil), // 312: openshell.datamodel.v1.Provider - (sandboxv1.PolicySource)(0), // 313: openshell.sandbox.v1.PolicySource - (*sandboxv1.NetworkEndpoint)(nil), // 314: openshell.sandbox.v1.NetworkEndpoint - (*sandboxv1.NetworkBinary)(nil), // 315: openshell.sandbox.v1.NetworkBinary - (*sandboxv1.SettingValue)(nil), // 316: openshell.sandbox.v1.SettingValue - (*sandboxv1.NetworkPolicyRule)(nil), // 317: openshell.sandbox.v1.NetworkPolicyRule - (*sandboxv1.L7DenyRule)(nil), // 318: openshell.sandbox.v1.L7DenyRule - (*sandboxv1.L7Rule)(nil), // 319: openshell.sandbox.v1.L7Rule - (*sandboxv1.SandboxConfigSnapshot)(nil), // 320: openshell.sandbox.v1.SandboxConfigSnapshot - (*datamodelv1.Workspace)(nil), // 321: openshell.datamodel.v1.Workspace - (*sandboxv1.GetSandboxConfigRequest)(nil), // 322: openshell.sandbox.v1.GetSandboxConfigRequest - (*sandboxv1.GetGatewayConfigRequest)(nil), // 323: openshell.sandbox.v1.GetGatewayConfigRequest - (*sandboxv1.GetSandboxConfigResponse)(nil), // 324: openshell.sandbox.v1.GetSandboxConfigResponse - (*sandboxv1.GetGatewayConfigResponse)(nil), // 325: openshell.sandbox.v1.GetGatewayConfigResponse + (*GetProviderRefreshStatusRequest)(nil), // 143: openshell.v1.GetProviderRefreshStatusRequest + (*GetProviderRefreshStatusResponse)(nil), // 144: openshell.v1.GetProviderRefreshStatusResponse + (*ConfigureProviderRefreshRequest)(nil), // 145: openshell.v1.ConfigureProviderRefreshRequest + (*ConfigureProviderRefreshResponse)(nil), // 146: openshell.v1.ConfigureProviderRefreshResponse + (*RotateProviderCredentialRequest)(nil), // 147: openshell.v1.RotateProviderCredentialRequest + (*RotateProviderCredentialResponse)(nil), // 148: openshell.v1.RotateProviderCredentialResponse + (*DeleteProviderRefreshRequest)(nil), // 149: openshell.v1.DeleteProviderRefreshRequest + (*DeleteProviderRefreshResponse)(nil), // 150: openshell.v1.DeleteProviderRefreshResponse + (*ProviderProfile)(nil), // 151: openshell.v1.ProviderProfile + (*ProviderProfileFile)(nil), // 152: openshell.v1.ProviderProfileFile + (*ProviderProfileResponse)(nil), // 153: openshell.v1.ProviderProfileResponse + (*ListProviderProfilesResponse)(nil), // 154: openshell.v1.ListProviderProfilesResponse + (*ImportProviderProfilesRequest)(nil), // 155: openshell.v1.ImportProviderProfilesRequest + (*ImportProviderProfilesResponse)(nil), // 156: openshell.v1.ImportProviderProfilesResponse + (*UpdateProviderProfilesRequest)(nil), // 157: openshell.v1.UpdateProviderProfilesRequest + (*UpdateProviderProfilesResponse)(nil), // 158: openshell.v1.UpdateProviderProfilesResponse + (*LintProviderProfilesRequest)(nil), // 159: openshell.v1.LintProviderProfilesRequest + (*LintProviderProfilesResponse)(nil), // 160: openshell.v1.LintProviderProfilesResponse + (*DeleteProviderResponse)(nil), // 161: openshell.v1.DeleteProviderResponse + (*DeleteProviderProfileRequest)(nil), // 162: openshell.v1.DeleteProviderProfileRequest + (*DeleteProviderProfileResponse)(nil), // 163: openshell.v1.DeleteProviderProfileResponse + (*GetSandboxProviderEnvironmentRequest)(nil), // 164: openshell.v1.GetSandboxProviderEnvironmentRequest + (*StaticCredentialEndpointBinding)(nil), // 165: openshell.v1.StaticCredentialEndpointBinding + (*StaticCredentialBinding)(nil), // 166: openshell.v1.StaticCredentialBinding + (*GetSandboxProviderEnvironmentResponse)(nil), // 167: openshell.v1.GetSandboxProviderEnvironmentResponse + (*ProviderEnvironmentValue)(nil), // 168: openshell.v1.ProviderEnvironmentValue + (*ProviderEnvironmentSnapshot)(nil), // 169: openshell.v1.ProviderEnvironmentSnapshot + (*ExchangeProviderSubjectTokenRequest)(nil), // 170: openshell.v1.ExchangeProviderSubjectTokenRequest + (*ExchangeProviderSubjectTokenResponse)(nil), // 171: openshell.v1.ExchangeProviderSubjectTokenResponse + (*UpdateConfigRequest)(nil), // 172: openshell.v1.UpdateConfigRequest + (*PolicyMergeOperation)(nil), // 173: openshell.v1.PolicyMergeOperation + (*AddNetworkRule)(nil), // 174: openshell.v1.AddNetworkRule + (*RemoveNetworkEndpoint)(nil), // 175: openshell.v1.RemoveNetworkEndpoint + (*RemoveNetworkRule)(nil), // 176: openshell.v1.RemoveNetworkRule + (*L7RuleTarget)(nil), // 177: openshell.v1.L7RuleTarget + (*AddDenyRules)(nil), // 178: openshell.v1.AddDenyRules + (*AddAllowRules)(nil), // 179: openshell.v1.AddAllowRules + (*RemoveNetworkBinary)(nil), // 180: openshell.v1.RemoveNetworkBinary + (*UpdateConfigResponse)(nil), // 181: openshell.v1.UpdateConfigResponse + (*GetSandboxPolicyStatusRequest)(nil), // 182: openshell.v1.GetSandboxPolicyStatusRequest + (*GetSandboxPolicyStatusResponse)(nil), // 183: openshell.v1.GetSandboxPolicyStatusResponse + (*ListSandboxPoliciesRequest)(nil), // 184: openshell.v1.ListSandboxPoliciesRequest + (*ListSandboxPoliciesResponse)(nil), // 185: openshell.v1.ListSandboxPoliciesResponse + (*ReportPolicyStatusRequest)(nil), // 186: openshell.v1.ReportPolicyStatusRequest + (*ReportPolicyStatusResponse)(nil), // 187: openshell.v1.ReportPolicyStatusResponse + (*SandboxConfigurationAdmission)(nil), // 188: openshell.v1.SandboxConfigurationAdmission + (*ReportSandboxConfigurationRequest)(nil), // 189: openshell.v1.ReportSandboxConfigurationRequest + (*ReportSandboxConfigurationResponse)(nil), // 190: openshell.v1.ReportSandboxConfigurationResponse + (*SandboxPolicyRevision)(nil), // 191: openshell.v1.SandboxPolicyRevision + (*GetSandboxLogsRequest)(nil), // 192: openshell.v1.GetSandboxLogsRequest + (*PushSandboxLogsRequest)(nil), // 193: openshell.v1.PushSandboxLogsRequest + (*PushSandboxLogsResponse)(nil), // 194: openshell.v1.PushSandboxLogsResponse + (*GetSandboxLogsResponse)(nil), // 195: openshell.v1.GetSandboxLogsResponse + (*SupervisorMessage)(nil), // 196: openshell.v1.SupervisorMessage + (*GatewayMessage)(nil), // 197: openshell.v1.GatewayMessage + (*SupervisorHello)(nil), // 198: openshell.v1.SupervisorHello + (*SessionAccepted)(nil), // 199: openshell.v1.SessionAccepted + (*ConfigUpdate)(nil), // 200: openshell.v1.ConfigUpdate + (*ConfigApplyFailure)(nil), // 201: openshell.v1.ConfigApplyFailure + (*ConfigUpdateResult)(nil), // 202: openshell.v1.ConfigUpdateResult + (*PolicyLoadResult)(nil), // 203: openshell.v1.PolicyLoadResult + (*SessionRejected)(nil), // 204: openshell.v1.SessionRejected + (*SessionRedirect)(nil), // 205: openshell.v1.SessionRedirect + (*SupervisorHeartbeat)(nil), // 206: openshell.v1.SupervisorHeartbeat + (*GatewayHeartbeat)(nil), // 207: openshell.v1.GatewayHeartbeat + (*ReportMainProcessExitRequest)(nil), // 208: openshell.v1.ReportMainProcessExitRequest + (*ReportMainProcessExitResponse)(nil), // 209: openshell.v1.ReportMainProcessExitResponse + (*FinalizeMainProcessExitRequest)(nil), // 210: openshell.v1.FinalizeMainProcessExitRequest + (*FinalizeMainProcessExitResponse)(nil), // 211: openshell.v1.FinalizeMainProcessExitResponse + (*RelayOpen)(nil), // 212: openshell.v1.RelayOpen + (*SshRelayTarget)(nil), // 213: openshell.v1.SshRelayTarget + (*TcpRelayTarget)(nil), // 214: openshell.v1.TcpRelayTarget + (*RelayInit)(nil), // 215: openshell.v1.RelayInit + (*RelayFrame)(nil), // 216: openshell.v1.RelayFrame + (*PeerRelayInit)(nil), // 217: openshell.v1.PeerRelayInit + (*PeerRelayFrame)(nil), // 218: openshell.v1.PeerRelayFrame + (*PeerConfigSandboxTarget)(nil), // 219: openshell.v1.PeerConfigSandboxTarget + (*PeerConfigProviderTarget)(nil), // 220: openshell.v1.PeerConfigProviderTarget + (*PeerNotifyConfigUpdateRequest)(nil), // 221: openshell.v1.PeerNotifyConfigUpdateRequest + (*PeerNotifyConfigUpdateResponse)(nil), // 222: openshell.v1.PeerNotifyConfigUpdateResponse + (*RelayOpenResult)(nil), // 223: openshell.v1.RelayOpenResult + (*RelayClose)(nil), // 224: openshell.v1.RelayClose + (*L7RequestSample)(nil), // 225: openshell.v1.L7RequestSample + (*DenialSummary)(nil), // 226: openshell.v1.DenialSummary + (*DenialGroupCount)(nil), // 227: openshell.v1.DenialGroupCount + (*NetworkActivitySummary)(nil), // 228: openshell.v1.NetworkActivitySummary + (*PolicyChunk)(nil), // 229: openshell.v1.PolicyChunk + (*DraftPolicyUpdate)(nil), // 230: openshell.v1.DraftPolicyUpdate + (*SubmitPolicyAnalysisRequest)(nil), // 231: openshell.v1.SubmitPolicyAnalysisRequest + (*SubmitPolicyAnalysisResponse)(nil), // 232: openshell.v1.SubmitPolicyAnalysisResponse + (*GetDraftPolicyRequest)(nil), // 233: openshell.v1.GetDraftPolicyRequest + (*GetDraftPolicyResponse)(nil), // 234: openshell.v1.GetDraftPolicyResponse + (*ApproveDraftChunkRequest)(nil), // 235: openshell.v1.ApproveDraftChunkRequest + (*ApproveDraftChunkResponse)(nil), // 236: openshell.v1.ApproveDraftChunkResponse + (*RejectDraftChunkRequest)(nil), // 237: openshell.v1.RejectDraftChunkRequest + (*RejectDraftChunkResponse)(nil), // 238: openshell.v1.RejectDraftChunkResponse + (*DraftChunkApproval)(nil), // 239: openshell.v1.DraftChunkApproval + (*ApproveAllDraftChunksRequest)(nil), // 240: openshell.v1.ApproveAllDraftChunksRequest + (*ApproveAllDraftChunksResponse)(nil), // 241: openshell.v1.ApproveAllDraftChunksResponse + (*EditDraftChunkRequest)(nil), // 242: openshell.v1.EditDraftChunkRequest + (*EditDraftChunkResponse)(nil), // 243: openshell.v1.EditDraftChunkResponse + (*UndoDraftChunkRequest)(nil), // 244: openshell.v1.UndoDraftChunkRequest + (*UndoDraftChunkResponse)(nil), // 245: openshell.v1.UndoDraftChunkResponse + (*ClearDraftChunksRequest)(nil), // 246: openshell.v1.ClearDraftChunksRequest + (*ClearDraftChunksResponse)(nil), // 247: openshell.v1.ClearDraftChunksResponse + (*GetDraftHistoryRequest)(nil), // 248: openshell.v1.GetDraftHistoryRequest + (*DraftHistoryEntry)(nil), // 249: openshell.v1.DraftHistoryEntry + (*GetDraftHistoryResponse)(nil), // 250: openshell.v1.GetDraftHistoryResponse + (*CreateWorkspaceRequest)(nil), // 251: openshell.v1.CreateWorkspaceRequest + (*CreateWorkspaceResponse)(nil), // 252: openshell.v1.CreateWorkspaceResponse + (*GetWorkspaceRequest)(nil), // 253: openshell.v1.GetWorkspaceRequest + (*GetWorkspaceResponse)(nil), // 254: openshell.v1.GetWorkspaceResponse + (*ListWorkspacesRequest)(nil), // 255: openshell.v1.ListWorkspacesRequest + (*ListWorkspacesResponse)(nil), // 256: openshell.v1.ListWorkspacesResponse + (*DeleteWorkspaceRequest)(nil), // 257: openshell.v1.DeleteWorkspaceRequest + (*DeleteWorkspaceResponse)(nil), // 258: openshell.v1.DeleteWorkspaceResponse + (*WorkspaceMember)(nil), // 259: openshell.v1.WorkspaceMember + (*AddWorkspaceMemberRequest)(nil), // 260: openshell.v1.AddWorkspaceMemberRequest + (*AddWorkspaceMemberResponse)(nil), // 261: openshell.v1.AddWorkspaceMemberResponse + (*RemoveWorkspaceMemberRequest)(nil), // 262: openshell.v1.RemoveWorkspaceMemberRequest + (*RemoveWorkspaceMemberResponse)(nil), // 263: openshell.v1.RemoveWorkspaceMemberResponse + (*ListWorkspaceMembersRequest)(nil), // 264: openshell.v1.ListWorkspaceMembersRequest + (*ListWorkspaceMembersResponse)(nil), // 265: openshell.v1.ListWorkspaceMembersResponse + (*ExtensionServiceCredential)(nil), // 266: openshell.v1.ExtensionServiceCredential + (*EndpointObservation)(nil), // 267: openshell.v1.EndpointObservation + (*ReportEndpointStatusRequest)(nil), // 268: openshell.v1.ReportEndpointStatusRequest + (*TokenGrantStatus)(nil), // 269: openshell.v1.TokenGrantStatus + (*TokenGrantFailureObservation)(nil), // 270: openshell.v1.TokenGrantFailureObservation + (*ReportEndpointStatusResponse)(nil), // 271: openshell.v1.ReportEndpointStatusResponse + (*EndpointStatus)(nil), // 272: openshell.v1.EndpointStatus + (*SandboxProvisioning)(nil), // 273: openshell.v1.SandboxProvisioning + (*SandboxServiceExposure)(nil), // 274: openshell.v1.SandboxServiceExposure + (*EndpointFailure)(nil), // 275: openshell.v1.EndpointFailure + nil, // 276: openshell.v1.SandboxSpec.EnvironmentEntry + nil, // 277: openshell.v1.SandboxTemplate.LabelsEntry + nil, // 278: openshell.v1.SandboxTemplate.AnnotationsEntry + nil, // 279: openshell.v1.SandboxTemplate.EnvironmentEntry + nil, // 280: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + nil, // 281: openshell.v1.PlatformEvent.MetadataEntry + nil, // 282: openshell.v1.CreateSandboxRequest.LabelsEntry + nil, // 283: openshell.v1.CreateSandboxRequest.AnnotationsEntry + nil, // 284: openshell.v1.SandboxMapUpdate.ValuesEntry + nil, // 285: openshell.v1.SandboxResponse.ServiceUrlsEntry + nil, // 286: openshell.v1.ExecSandboxRequest.EnvironmentEntry + nil, // 287: openshell.v1.SandboxLogLine.FieldsEntry + nil, // 288: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + nil, // 289: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + nil, // 290: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + nil, // 291: openshell.v1.ProviderProfile.AnnotationsEntry + nil, // 292: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + nil, // 293: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + nil, // 294: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + nil, // 295: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + nil, // 296: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + nil, // 297: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + nil, // 298: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + nil, // 299: openshell.v1.UpdateConfigRequest.AnnotationsEntry + nil, // 300: openshell.v1.UpdateConfigResponse.AnnotationsEntry + nil, // 301: openshell.v1.SandboxPolicyRevision.ProvenanceEntry + nil, // 302: openshell.v1.CreateWorkspaceRequest.LabelsEntry + (*timestamppb.Timestamp)(nil), // 303: google.protobuf.Timestamp + (*datamodelv1.ObjectMeta)(nil), // 304: openshell.datamodel.v1.ObjectMeta + (*sandboxv1.SandboxPolicy)(nil), // 305: openshell.sandbox.v1.SandboxPolicy + (*structpb.Struct)(nil), // 306: google.protobuf.Struct + (*durationpb.Duration)(nil), // 307: google.protobuf.Duration + (*datamodelv1.WorkspaceSelector)(nil), // 308: openshell.datamodel.v1.WorkspaceSelector + (*datamodelv1.Provider)(nil), // 309: openshell.datamodel.v1.Provider + (sandboxv1.PolicySource)(0), // 310: openshell.sandbox.v1.PolicySource + (*sandboxv1.NetworkEndpoint)(nil), // 311: openshell.sandbox.v1.NetworkEndpoint + (*sandboxv1.NetworkBinary)(nil), // 312: openshell.sandbox.v1.NetworkBinary + (*sandboxv1.SettingValue)(nil), // 313: openshell.sandbox.v1.SettingValue + (*sandboxv1.NetworkPolicyRule)(nil), // 314: openshell.sandbox.v1.NetworkPolicyRule + (*sandboxv1.L7DenyRule)(nil), // 315: openshell.sandbox.v1.L7DenyRule + (*sandboxv1.L7Rule)(nil), // 316: openshell.sandbox.v1.L7Rule + (*sandboxv1.SandboxConfigSnapshot)(nil), // 317: openshell.sandbox.v1.SandboxConfigSnapshot + (*datamodelv1.Workspace)(nil), // 318: openshell.datamodel.v1.Workspace + (*sandboxv1.GetSandboxConfigRequest)(nil), // 319: openshell.sandbox.v1.GetSandboxConfigRequest + (*sandboxv1.GetGatewayConfigRequest)(nil), // 320: openshell.sandbox.v1.GetGatewayConfigRequest + (*sandboxv1.GetSandboxConfigResponse)(nil), // 321: openshell.sandbox.v1.GetSandboxConfigResponse + (*sandboxv1.GetGatewayConfigResponse)(nil), // 322: openshell.sandbox.v1.GetGatewayConfigResponse } var file_openshell_proto_depIdxs = []int32{ - 306, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 306, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 267, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential - 306, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp + 303, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 303, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 266, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential + 303, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp 14, // 4: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus 14, // 5: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus 33, // 6: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo @@ -22015,541 +21915,538 @@ var file_openshell_proto_depIdxs = []int32{ 36, // 11: openshell.v1.ResourceCapabilities.cpu:type_name -> openshell.v1.CpuResourceCapabilities 37, // 12: openshell.v1.ResourceCapabilities.memory:type_name -> openshell.v1.MemoryResourceCapabilities 38, // 13: openshell.v1.ResourceCapabilities.gpu:type_name -> openshell.v1.GpuResourceCapabilities - 307, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 304, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 40, // 15: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec 51, // 16: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus 50, // 17: openshell.v1.Sandbox.created_from_workload_template:type_name -> openshell.v1.SandboxWorkloadTemplateProvenance - 277, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry + 276, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry 43, // 19: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate - 308, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 305, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy 41, // 21: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements 17, // 22: openshell.v1.SandboxSpec.restart_policy:type_name -> openshell.v1.SandboxRestartPolicy 42, // 23: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements - 278, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry - 279, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry - 280, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry - 309, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct - 309, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct - 307, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 277, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry + 278, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry + 279, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry + 306, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct + 306, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct + 304, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 45, // 30: openshell.v1.SandboxWorkloadTemplate.spec:type_name -> openshell.v1.SandboxWorkloadTemplateSpec 46, // 31: openshell.v1.SandboxWorkloadTemplateSpec.workload:type_name -> openshell.v1.SandboxWorkloadConfig - 309, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct + 306, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct 48, // 33: openshell.v1.SandboxWorkloadTemplateSpec.desired_service_level:type_name -> openshell.v1.SandboxServiceLevel - 281, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + 280, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry 47, // 35: openshell.v1.SandboxWorkloadConfig.resources:type_name -> openshell.v1.SandboxResources 42, // 36: openshell.v1.SandboxResources.gpu:type_name -> openshell.v1.GpuResourceRequirements 49, // 37: openshell.v1.SandboxServiceLevel.startup:type_name -> openshell.v1.SandboxStartup - 310, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration + 307, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration 52, // 39: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition 1, // 40: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase - 273, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus - 189, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 274, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning - 306, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp - 306, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp - 271, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 306, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp - 306, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp - 282, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry - 311, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 272, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus + 188, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 273, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning + 303, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp + 303, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp + 270, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 303, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp + 303, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp + 281, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry + 308, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 40, // 51: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec - 283, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry - 284, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry - 275, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure - 311, // 55: openshell.v1.UpdateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 282, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry + 283, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry + 274, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure + 308, // 55: openshell.v1.UpdateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 56, // 56: openshell.v1.UpdateSandboxRequest.command:type_name -> openshell.v1.SandboxCommandUpdate 57, // 57: openshell.v1.UpdateSandboxRequest.environment:type_name -> openshell.v1.SandboxMapUpdate 57, // 58: openshell.v1.UpdateSandboxRequest.labels:type_name -> openshell.v1.SandboxMapUpdate 57, // 59: openshell.v1.UpdateSandboxRequest.annotations:type_name -> openshell.v1.SandboxMapUpdate - 285, // 60: openshell.v1.SandboxMapUpdate.values:type_name -> openshell.v1.SandboxMapUpdate.ValuesEntry - 311, // 61: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 284, // 60: openshell.v1.SandboxMapUpdate.values:type_name -> openshell.v1.SandboxMapUpdate.ValuesEntry + 308, // 61: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 62: openshell.v1.CreateSandboxTemplateRequest.template:type_name -> openshell.v1.SandboxWorkloadTemplate - 311, // 63: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 64: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 65: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 63: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 64: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 65: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 66: openshell.v1.SandboxTemplateResponse.template:type_name -> openshell.v1.SandboxWorkloadTemplate 44, // 67: openshell.v1.ListSandboxTemplatesResponse.templates:type_name -> openshell.v1.SandboxWorkloadTemplate 18, // 68: openshell.v1.DeleteSandboxTemplateResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 311, // 69: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 306, // 70: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp - 311, // 71: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 72: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 73: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 74: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 75: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 76: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 77: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 78: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 79: openshell.v1.SuspendSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 80: openshell.v1.ResumeSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 69: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 70: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp + 308, // 71: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 72: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 73: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 74: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 75: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 76: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 77: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 78: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 79: openshell.v1.SuspendSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 80: openshell.v1.ResumeSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 39, // 81: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox - 286, // 82: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry + 285, // 82: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry 39, // 83: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox - 312, // 84: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 309, // 84: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider 39, // 85: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 86, // 86: openshell.v1.AttachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 39, // 87: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 86, // 88: openshell.v1.DetachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 84, // 89: openshell.v1.ConfigSnapshotRevision.sandbox_config:type_name -> openshell.v1.SandboxConfigRevision 82, // 90: openshell.v1.ConfigSnapshotRevision.provider_target:type_name -> openshell.v1.ProviderDesiredIdentity - 313, // 91: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource + 310, // 91: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource 5, // 92: openshell.v1.ConfigUpdateOperation.component:type_name -> openshell.v1.ConfigComponent 83, // 93: openshell.v1.ConfigUpdateOperation.target_revision:type_name -> openshell.v1.ConfigSnapshotRevision 7, // 94: openshell.v1.ConfigUpdateOperation.state:type_name -> openshell.v1.ConfigUpdateOperationState 6, // 95: openshell.v1.ConfigUpdateOperation.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 306, // 96: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp - 306, // 97: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp - 306, // 98: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp + 303, // 96: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp + 303, // 97: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp + 303, // 98: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp 2, // 99: openshell.v1.ProviderMutationReceipt.kind:type_name -> openshell.v1.ProviderMutationKind 82, // 100: openshell.v1.ProviderMutationReceipt.desired:type_name -> openshell.v1.ProviderDesiredIdentity - 306, // 101: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp + 303, // 101: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp 4, // 102: openshell.v1.ProviderReadinessObservation.reason:type_name -> openshell.v1.ProviderReadinessReason 86, // 103: openshell.v1.ProviderReadinessStatus.receipt:type_name -> openshell.v1.ProviderMutationReceipt 3, // 104: openshell.v1.ProviderReadinessStatus.state:type_name -> openshell.v1.ProviderReadinessState 4, // 105: openshell.v1.ProviderReadinessStatus.reason:type_name -> openshell.v1.ProviderReadinessReason 87, // 106: openshell.v1.ProviderReadinessStatus.observed:type_name -> openshell.v1.ProviderReadinessObservation - 306, // 107: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp - 306, // 108: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp + 303, // 107: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp + 303, // 108: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp 85, // 109: openshell.v1.ProviderReadinessStatus.operation:type_name -> openshell.v1.ConfigUpdateOperation - 311, // 110: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 110: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 88, // 111: openshell.v1.GetSandboxProviderStatusResponse.status:type_name -> openshell.v1.ProviderReadinessStatus 87, // 112: openshell.v1.ReportProviderReadinessRequest.observation:type_name -> openshell.v1.ProviderReadinessObservation - 310, // 113: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration - 310, // 114: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration + 307, // 113: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration + 307, // 114: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration 18, // 115: openshell.v1.DeleteSandboxResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 311, // 116: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 306, // 117: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp - 311, // 118: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 116: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 117: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp + 308, // 118: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 20, // 119: openshell.v1.ExposeServiceRequest.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 311, // 120: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 121: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 120: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 121: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 103, // 122: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse - 311, // 123: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 123: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 124: openshell.v1.DeleteServiceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 307, // 125: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 304, // 125: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 20, // 126: openshell.v1.ServiceEndpoint.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode 102, // 127: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint 18, // 128: openshell.v1.RevokeSshSessionResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 311, // 129: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 287, // 130: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry - 310, // 131: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration + 308, // 129: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 286, // 130: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry + 307, // 131: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration 107, // 132: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout 108, // 133: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr 109, // 134: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit - 214, // 135: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget - 215, // 136: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget + 213, // 135: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget + 214, // 136: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget 111, // 137: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit 106, // 138: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest 114, // 139: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize - 307, // 140: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 306, // 141: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp - 311, // 142: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 306, // 143: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp + 304, // 140: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 303, // 141: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp + 308, // 142: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 143: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp 39, // 144: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox 118, // 145: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine 53, // 146: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent 119, // 147: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning - 231, // 148: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate - 306, // 149: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp - 288, // 150: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry - 311, // 151: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 312, // 152: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 311, // 153: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 154: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 310, // 155: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration - 306, // 156: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp - 289, // 157: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - 311, // 158: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 159: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 312, // 160: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 290, // 161: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - 311, // 162: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 312, // 163: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider + 230, // 148: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate + 303, // 149: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp + 287, // 150: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry + 308, // 151: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 309, // 152: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 308, // 153: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 154: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 307, // 155: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration + 303, // 156: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp + 288, // 157: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + 308, // 158: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 159: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 309, // 160: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 289, // 161: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + 308, // 162: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 309, // 163: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider 86, // 164: openshell.v1.ProviderResponse.target_receipts:type_name -> openshell.v1.ProviderMutationReceipt - 312, // 165: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 311, // 166: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 167: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 152, // 168: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile - 310, // 169: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration + 309, // 165: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 308, // 166: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 167: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 151, // 168: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile + 307, // 169: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration 134, // 170: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride 8, // 171: openshell.v1.ProviderCredentialTokenGrant.grant_type:type_name -> openshell.v1.ProviderCredentialTokenGrantType 135, // 172: openshell.v1.ProviderCredentialTokenGrant.subject_token:type_name -> openshell.v1.ProviderCredentialTokenGrantSubjectToken 140, // 173: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh 136, // 174: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant 9, // 175: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 310, // 176: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration - 310, // 177: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration + 307, // 176: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration + 307, // 177: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration 138, // 178: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial 139, // 179: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput 9, // 180: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 306, // 181: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp - 306, // 182: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp - 306, // 183: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp + 303, // 181: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp + 303, // 182: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp + 303, // 183: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp 16, // 184: openshell.v1.ProviderCredentialRefreshStatus.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 306, // 185: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp - 291, // 186: openshell.v1.ProviderProfileEnvironment.config:type_name -> openshell.v1.ProviderProfileEnvironment.ConfigEntry - 292, // 187: openshell.v1.ProviderProfileEnvironment.fixed:type_name -> openshell.v1.ProviderProfileEnvironment.FixedEntry - 311, // 188: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 141, // 189: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 311, // 190: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 9, // 191: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 293, // 192: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - 306, // 193: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp - 141, // 194: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 311, // 195: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 141, // 196: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 311, // 197: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 198: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 10, // 199: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory - 137, // 200: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential - 314, // 201: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 315, // 202: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 142, // 203: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery - 294, // 204: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry - 153, // 205: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile - 143, // 206: openshell.v1.ProviderProfile.environment:type_name -> openshell.v1.ProviderProfileEnvironment - 152, // 207: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile - 152, // 208: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 311, // 209: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 132, // 210: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 133, // 211: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 152, // 212: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 311, // 213: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 132, // 214: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem - 133, // 215: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 152, // 216: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile - 311, // 217: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 132, // 218: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 133, // 219: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 18, // 220: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 311, // 221: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 222: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 166, // 223: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding - 295, // 224: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - 296, // 225: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - 297, // 226: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - 298, // 227: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - 4, // 228: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 299, // 229: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - 11, // 230: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification - 167, // 231: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding - 306, // 232: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp - 169, // 233: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue - 300, // 234: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - 4, // 235: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 301, // 236: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - 310, // 237: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration - 311, // 238: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 239: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 316, // 240: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue - 174, // 241: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation - 302, // 242: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry - 175, // 243: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule - 176, // 244: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint - 177, // 245: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule - 179, // 246: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules - 180, // 247: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules - 181, // 248: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary - 317, // 249: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 315, // 250: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 318, // 251: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 178, // 252: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget - 319, // 253: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule - 178, // 254: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget - 303, // 255: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry - 311, // 256: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 192, // 257: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision - 311, // 258: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 192, // 259: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision - 13, // 260: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus - 12, // 261: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState - 189, // 262: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 13, // 263: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus - 306, // 264: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp - 306, // 265: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp - 308, // 266: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 304, // 267: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry - 311, // 268: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 306, // 269: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp - 118, // 270: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine - 118, // 271: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine - 199, // 272: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello - 207, // 273: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat - 224, // 274: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult - 225, // 275: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose - 203, // 276: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult - 200, // 277: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted - 205, // 278: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected - 208, // 279: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat - 213, // 280: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen - 225, // 281: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose - 206, // 282: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect - 201, // 283: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate - 201, // 284: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate - 310, // 285: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration - 320, // 286: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot - 170, // 287: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot - 6, // 288: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 202, // 289: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure - 189, // 290: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 204, // 291: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult - 214, // 292: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget - 215, // 293: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget - 216, // 294: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit - 213, // 295: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen - 218, // 296: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit - 220, // 297: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget - 221, // 298: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget - 306, // 299: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp - 306, // 300: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp - 226, // 301: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample - 228, // 302: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount - 317, // 303: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 306, // 304: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp - 306, // 305: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp - 306, // 306: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp - 306, // 307: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp - 308, // 308: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 308, // 309: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 311, // 310: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 227, // 311: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary - 230, // 312: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk - 229, // 313: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary - 311, // 314: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 230, // 315: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk - 306, // 316: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp - 311, // 317: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 318: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 319: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 240, // 320: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval - 311, // 321: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 317, // 322: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 311, // 323: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 324: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 311, // 325: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 306, // 326: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp - 250, // 327: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry - 305, // 328: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry - 321, // 329: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 321, // 330: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 321, // 331: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace - 18, // 332: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 307, // 333: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 15, // 334: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole - 311, // 335: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 15, // 336: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole - 260, // 337: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember - 311, // 338: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 339: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 311, // 340: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 260, // 341: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember - 306, // 342: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp - 19, // 343: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult - 276, // 344: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure - 268, // 345: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation - 270, // 346: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus - 271, // 347: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 276, // 348: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure - 19, // 349: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult - 306, // 350: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp - 276, // 351: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure - 306, // 352: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp - 306, // 353: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp - 306, // 354: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp - 306, // 355: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp - 306, // 356: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp - 306, // 357: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp - 306, // 358: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp - 306, // 359: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp - 306, // 360: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp - 20, // 361: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 21, // 362: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain - 16, // 363: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 123, // 364: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue - 306, // 365: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 306, // 366: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 137, // 367: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 167, // 368: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding - 137, // 369: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 26, // 370: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest - 28, // 371: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest - 30, // 372: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest - 54, // 373: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest - 65, // 374: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest - 67, // 375: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest - 68, // 376: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest - 58, // 377: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest - 59, // 378: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest - 60, // 379: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest - 61, // 380: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest - 69, // 381: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest - 70, // 382: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest - 71, // 383: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest - 89, // 384: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 72, // 385: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest - 73, // 386: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest - 74, // 387: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest - 75, // 388: openshell.v1.OpenShell.SuspendSandbox:input_type -> openshell.v1.SuspendSandboxRequest - 76, // 389: openshell.v1.OpenShell.ResumeSandbox:input_type -> openshell.v1.ResumeSandboxRequest - 94, // 390: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest - 96, // 391: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest - 97, // 392: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest - 98, // 393: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest - 100, // 394: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest - 104, // 395: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest - 106, // 396: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest - 112, // 397: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame - 113, // 398: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput - 120, // 399: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest - 121, // 400: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest - 122, // 401: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest - 125, // 402: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest - 130, // 403: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest - 131, // 404: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest - 156, // 405: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest - 158, // 406: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest - 160, // 407: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest - 126, // 408: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest - 144, // 409: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest - 146, // 410: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest - 148, // 411: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest - 150, // 412: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest - 127, // 413: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest - 163, // 414: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest - 322, // 415: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest - 323, // 416: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest - 173, // 417: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest - 183, // 418: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest - 185, // 419: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest - 187, // 420: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest - 269, // 421: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 91, // 422: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 190, // 423: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest - 165, // 424: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest - 171, // 425: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest - 193, // 426: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest - 194, // 427: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest - 197, // 428: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage - 209, // 429: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest - 211, // 430: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest - 217, // 431: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame - 219, // 432: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame - 91, // 433: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 269, // 434: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 89, // 435: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 222, // 436: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest - 116, // 437: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest - 232, // 438: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest - 234, // 439: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest - 236, // 440: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest - 238, // 441: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest - 241, // 442: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest - 243, // 443: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest - 245, // 444: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest - 247, // 445: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest - 249, // 446: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest - 22, // 447: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest - 24, // 448: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest - 252, // 449: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest - 254, // 450: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest - 256, // 451: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest - 258, // 452: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest - 261, // 453: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest - 263, // 454: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest - 265, // 455: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest - 55, // 456: openshell.v1.SandboxUpdates.UpdateSandbox:input_type -> openshell.v1.UpdateSandboxRequest - 27, // 457: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse - 29, // 458: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse - 31, // 459: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse - 77, // 460: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse - 66, // 461: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse - 77, // 462: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse - 78, // 463: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse - 62, // 464: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 62, // 465: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 63, // 466: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse - 64, // 467: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse - 79, // 468: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse - 80, // 469: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse - 81, // 470: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse - 90, // 471: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 93, // 472: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse - 77, // 473: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse - 77, // 474: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse - 77, // 475: openshell.v1.OpenShell.SuspendSandbox:output_type -> openshell.v1.SandboxResponse - 77, // 476: openshell.v1.OpenShell.ResumeSandbox:output_type -> openshell.v1.SandboxResponse - 95, // 477: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse - 103, // 478: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse - 103, // 479: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse - 99, // 480: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse - 101, // 481: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse - 105, // 482: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse - 110, // 483: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent - 112, // 484: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame - 110, // 485: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent - 128, // 486: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse - 128, // 487: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse - 124, // 488: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse - 129, // 489: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse - 155, // 490: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse - 154, // 491: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse - 157, // 492: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse - 159, // 493: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse - 161, // 494: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse - 128, // 495: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse - 145, // 496: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse - 147, // 497: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse - 149, // 498: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse - 151, // 499: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse - 162, // 500: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse - 164, // 501: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse - 324, // 502: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse - 325, // 503: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse - 182, // 504: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse - 184, // 505: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse - 186, // 506: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse - 188, // 507: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse - 272, // 508: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 92, // 509: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 191, // 510: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse - 168, // 511: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse - 172, // 512: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse - 196, // 513: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse - 195, // 514: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse - 198, // 515: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage - 210, // 516: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse - 212, // 517: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse - 217, // 518: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame - 219, // 519: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame - 92, // 520: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 272, // 521: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 90, // 522: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 223, // 523: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse - 117, // 524: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent - 233, // 525: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse - 235, // 526: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse - 237, // 527: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse - 239, // 528: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse - 242, // 529: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse - 244, // 530: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse - 246, // 531: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse - 248, // 532: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse - 251, // 533: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse - 23, // 534: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse - 25, // 535: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse - 253, // 536: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse - 255, // 537: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse - 257, // 538: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse - 259, // 539: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse - 262, // 540: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse - 264, // 541: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse - 266, // 542: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse - 77, // 543: openshell.v1.SandboxUpdates.UpdateSandbox:output_type -> openshell.v1.SandboxResponse - 457, // [457:544] is the sub-list for method output_type - 370, // [370:457] is the sub-list for method input_type - 370, // [370:370] is the sub-list for extension type_name - 370, // [370:370] is the sub-list for extension extendee - 0, // [0:370] is the sub-list for field type_name + 303, // 185: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp + 308, // 186: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 141, // 187: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus + 308, // 188: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 9, // 189: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy + 290, // 190: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + 303, // 191: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp + 141, // 192: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus + 308, // 193: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 141, // 194: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus + 308, // 195: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 196: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 10, // 197: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory + 137, // 198: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential + 311, // 199: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint + 312, // 200: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 142, // 201: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery + 291, // 202: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry + 152, // 203: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile + 151, // 204: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile + 151, // 205: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile + 308, // 206: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 132, // 207: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem + 133, // 208: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic + 151, // 209: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile + 308, // 210: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 132, // 211: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem + 133, // 212: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic + 151, // 213: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile + 308, // 214: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 132, // 215: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem + 133, // 216: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic + 18, // 217: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 308, // 218: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 219: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 165, // 220: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding + 292, // 221: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + 293, // 222: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + 294, // 223: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + 295, // 224: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + 4, // 225: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 296, // 226: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + 11, // 227: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification + 166, // 228: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding + 303, // 229: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp + 168, // 230: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue + 297, // 231: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + 4, // 232: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 298, // 233: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + 307, // 234: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration + 308, // 235: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 305, // 236: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 313, // 237: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue + 173, // 238: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation + 299, // 239: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry + 174, // 240: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule + 175, // 241: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint + 176, // 242: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule + 178, // 243: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules + 179, // 244: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules + 180, // 245: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary + 314, // 246: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 312, // 247: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 315, // 248: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule + 177, // 249: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget + 316, // 250: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule + 177, // 251: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget + 300, // 252: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry + 308, // 253: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 191, // 254: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision + 308, // 255: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 191, // 256: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision + 13, // 257: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus + 12, // 258: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState + 188, // 259: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 13, // 260: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus + 303, // 261: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp + 303, // 262: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp + 305, // 263: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 301, // 264: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry + 308, // 265: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 266: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp + 118, // 267: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine + 118, // 268: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine + 198, // 269: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello + 206, // 270: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat + 223, // 271: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult + 224, // 272: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose + 202, // 273: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult + 199, // 274: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted + 204, // 275: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected + 207, // 276: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat + 212, // 277: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen + 224, // 278: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose + 205, // 279: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect + 200, // 280: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate + 200, // 281: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate + 307, // 282: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration + 317, // 283: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot + 169, // 284: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot + 6, // 285: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome + 201, // 286: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure + 188, // 287: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 203, // 288: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult + 213, // 289: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget + 214, // 290: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget + 215, // 291: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit + 212, // 292: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen + 217, // 293: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit + 219, // 294: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget + 220, // 295: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget + 303, // 296: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp + 303, // 297: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp + 225, // 298: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample + 227, // 299: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount + 314, // 300: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 303, // 301: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp + 303, // 302: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp + 303, // 303: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp + 303, // 304: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp + 305, // 305: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 305, // 306: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 308, // 307: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 226, // 308: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary + 229, // 309: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk + 228, // 310: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary + 308, // 311: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 229, // 312: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk + 303, // 313: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp + 308, // 314: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 315: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 316: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 239, // 317: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval + 308, // 318: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 314, // 319: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 308, // 320: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 321: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 322: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 323: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp + 249, // 324: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry + 302, // 325: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry + 318, // 326: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 318, // 327: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 318, // 328: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace + 18, // 329: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 304, // 330: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 15, // 331: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole + 308, // 332: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 15, // 333: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole + 259, // 334: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember + 308, // 335: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 336: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 308, // 337: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 259, // 338: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember + 303, // 339: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp + 19, // 340: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult + 275, // 341: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure + 267, // 342: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation + 269, // 343: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus + 270, // 344: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 275, // 345: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure + 19, // 346: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult + 303, // 347: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp + 275, // 348: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure + 303, // 349: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp + 303, // 350: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp + 303, // 351: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp + 303, // 352: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp + 303, // 353: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp + 303, // 354: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp + 303, // 355: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp + 303, // 356: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp + 303, // 357: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp + 20, // 358: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode + 21, // 359: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain + 16, // 360: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction + 123, // 361: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue + 303, // 362: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 303, // 363: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 137, // 364: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 166, // 365: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding + 137, // 366: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 26, // 367: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest + 28, // 368: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest + 30, // 369: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest + 54, // 370: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest + 65, // 371: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest + 67, // 372: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest + 68, // 373: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest + 58, // 374: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest + 59, // 375: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest + 60, // 376: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest + 61, // 377: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest + 69, // 378: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest + 70, // 379: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest + 71, // 380: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest + 89, // 381: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 72, // 382: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest + 73, // 383: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest + 74, // 384: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest + 75, // 385: openshell.v1.OpenShell.SuspendSandbox:input_type -> openshell.v1.SuspendSandboxRequest + 76, // 386: openshell.v1.OpenShell.ResumeSandbox:input_type -> openshell.v1.ResumeSandboxRequest + 94, // 387: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest + 96, // 388: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest + 97, // 389: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest + 98, // 390: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest + 100, // 391: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest + 104, // 392: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest + 106, // 393: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest + 112, // 394: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame + 113, // 395: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput + 120, // 396: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest + 121, // 397: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest + 122, // 398: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest + 125, // 399: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest + 130, // 400: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest + 131, // 401: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest + 155, // 402: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest + 157, // 403: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest + 159, // 404: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest + 126, // 405: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest + 143, // 406: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest + 145, // 407: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest + 147, // 408: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest + 149, // 409: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest + 127, // 410: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest + 162, // 411: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest + 319, // 412: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest + 320, // 413: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest + 172, // 414: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest + 182, // 415: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest + 184, // 416: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest + 186, // 417: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest + 268, // 418: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 91, // 419: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 189, // 420: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest + 164, // 421: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest + 170, // 422: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest + 192, // 423: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest + 193, // 424: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest + 196, // 425: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage + 208, // 426: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest + 210, // 427: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest + 216, // 428: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame + 218, // 429: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame + 91, // 430: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 268, // 431: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 89, // 432: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 221, // 433: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest + 116, // 434: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest + 231, // 435: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest + 233, // 436: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest + 235, // 437: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest + 237, // 438: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest + 240, // 439: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest + 242, // 440: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest + 244, // 441: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest + 246, // 442: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest + 248, // 443: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest + 22, // 444: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest + 24, // 445: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest + 251, // 446: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest + 253, // 447: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest + 255, // 448: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest + 257, // 449: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest + 260, // 450: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest + 262, // 451: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest + 264, // 452: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest + 55, // 453: openshell.v1.SandboxUpdates.UpdateSandbox:input_type -> openshell.v1.UpdateSandboxRequest + 27, // 454: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse + 29, // 455: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse + 31, // 456: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse + 77, // 457: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse + 66, // 458: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse + 77, // 459: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse + 78, // 460: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse + 62, // 461: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 62, // 462: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 63, // 463: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse + 64, // 464: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse + 79, // 465: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse + 80, // 466: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse + 81, // 467: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse + 90, // 468: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 93, // 469: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse + 77, // 470: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse + 77, // 471: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse + 77, // 472: openshell.v1.OpenShell.SuspendSandbox:output_type -> openshell.v1.SandboxResponse + 77, // 473: openshell.v1.OpenShell.ResumeSandbox:output_type -> openshell.v1.SandboxResponse + 95, // 474: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse + 103, // 475: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse + 103, // 476: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse + 99, // 477: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse + 101, // 478: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse + 105, // 479: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse + 110, // 480: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent + 112, // 481: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame + 110, // 482: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent + 128, // 483: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse + 128, // 484: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse + 124, // 485: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse + 129, // 486: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse + 154, // 487: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse + 153, // 488: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse + 156, // 489: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse + 158, // 490: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse + 160, // 491: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse + 128, // 492: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse + 144, // 493: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse + 146, // 494: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse + 148, // 495: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse + 150, // 496: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse + 161, // 497: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse + 163, // 498: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse + 321, // 499: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse + 322, // 500: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse + 181, // 501: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse + 183, // 502: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse + 185, // 503: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse + 187, // 504: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse + 271, // 505: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 92, // 506: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 190, // 507: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse + 167, // 508: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse + 171, // 509: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse + 195, // 510: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse + 194, // 511: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse + 197, // 512: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage + 209, // 513: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse + 211, // 514: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse + 216, // 515: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame + 218, // 516: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame + 92, // 517: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 271, // 518: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 90, // 519: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 222, // 520: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse + 117, // 521: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent + 232, // 522: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse + 234, // 523: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse + 236, // 524: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse + 238, // 525: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse + 241, // 526: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse + 243, // 527: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse + 245, // 528: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse + 247, // 529: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse + 250, // 530: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse + 23, // 531: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse + 25, // 532: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse + 252, // 533: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse + 254, // 534: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse + 256, // 535: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse + 258, // 536: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse + 261, // 537: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse + 263, // 538: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse + 265, // 539: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse + 77, // 540: openshell.v1.SandboxUpdates.UpdateSandbox:output_type -> openshell.v1.SandboxResponse + 454, // [454:541] is the sub-list for method output_type + 367, // [367:454] is the sub-list for method input_type + 367, // [367:367] is the sub-list for extension type_name + 367, // [367:367] is the sub-list for extension extendee + 0, // [0:367] is the sub-list for field type_name } func init() { file_openshell_proto_init() } @@ -22591,7 +22488,7 @@ func file_openshell_proto_init() { (*SandboxStreamEvent_Warning)(nil), (*SandboxStreamEvent_DraftPolicyUpdate)(nil), } - file_openshell_proto_msgTypes[152].OneofWrappers = []any{ + file_openshell_proto_msgTypes[151].OneofWrappers = []any{ (*PolicyMergeOperation_AddRule)(nil), (*PolicyMergeOperation_RemoveEndpoint)(nil), (*PolicyMergeOperation_RemoveRule)(nil), @@ -22599,15 +22496,15 @@ func file_openshell_proto_init() { (*PolicyMergeOperation_AddAllowRules)(nil), (*PolicyMergeOperation_RemoveBinary)(nil), } - file_openshell_proto_msgTypes[156].OneofWrappers = []any{} - file_openshell_proto_msgTypes[175].OneofWrappers = []any{ + file_openshell_proto_msgTypes[155].OneofWrappers = []any{} + file_openshell_proto_msgTypes[174].OneofWrappers = []any{ (*SupervisorMessage_Hello)(nil), (*SupervisorMessage_Heartbeat)(nil), (*SupervisorMessage_RelayOpenResult)(nil), (*SupervisorMessage_RelayClose)(nil), (*SupervisorMessage_ConfigUpdateResult)(nil), } - file_openshell_proto_msgTypes[176].OneofWrappers = []any{ + file_openshell_proto_msgTypes[175].OneofWrappers = []any{ (*GatewayMessage_SessionAccepted)(nil), (*GatewayMessage_SessionRejected)(nil), (*GatewayMessage_Heartbeat)(nil), @@ -22616,32 +22513,32 @@ func file_openshell_proto_init() { (*GatewayMessage_SessionRedirect)(nil), (*GatewayMessage_ConfigUpdate)(nil), } - file_openshell_proto_msgTypes[191].OneofWrappers = []any{ + file_openshell_proto_msgTypes[190].OneofWrappers = []any{ (*RelayOpen_Ssh)(nil), (*RelayOpen_Tcp)(nil), } - file_openshell_proto_msgTypes[195].OneofWrappers = []any{ + file_openshell_proto_msgTypes[194].OneofWrappers = []any{ (*RelayFrame_Init)(nil), (*RelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[197].OneofWrappers = []any{ + file_openshell_proto_msgTypes[196].OneofWrappers = []any{ (*PeerRelayFrame_Init)(nil), (*PeerRelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[200].OneofWrappers = []any{ + file_openshell_proto_msgTypes[199].OneofWrappers = []any{ (*PeerNotifyConfigUpdateRequest_Sandbox)(nil), (*PeerNotifyConfigUpdateRequest_Workspace)(nil), (*PeerNotifyConfigUpdateRequest_AllConnected)(nil), (*PeerNotifyConfigUpdateRequest_Provider)(nil), } - file_openshell_proto_msgTypes[254].OneofWrappers = []any{} + file_openshell_proto_msgTypes[253].OneofWrappers = []any{} type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)), NumEnums: 22, - NumMessages: 284, + NumMessages: 281, NumExtensions: 0, NumServices: 2, }, From 24efcc8f1095fe723cae9a2eb5bec232adb933e3 Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Mon, 9 Nov 2026 10:45:56 +0100 Subject: [PATCH 09/10] fix(providers): document metadata runtime requirements Remove required_platform_adapter and its gateway OS checks because metadata availability belongs to the sandbox runtime. Reserve the retired protobuf field number and name, update the reviewed schema fingerprints, and remove the adapter-specific validation and tests. Document the Linux runtime requirement in the Google Cloud example, provider reference, and 0.2.0 upgrade guide. Explain that import and attachment do not verify runtime support. Align the CLI skill and E2E profile import setup with this behavior, including atomic batch import guidance. Validation: 140 provider tests, 182 server provider tests, 12 schema tests, 33 Python tests, and all TypeScript SDK checks passed. Focused Clippy, formatting, Markdown, and E2E provider setup checks passed. Fern validation reported 0 errors and 3 existing warnings. git diff --check passed and sdk/go still matches the branch merge base. Signed-off-by: Philippe Martin --- crates/openshell-providers/README.md | 9 +- crates/openshell-providers/src/discovery.rs | 1 - .../src/environment_tests.rs | 43 ------ crates/openshell-providers/src/lib.rs | 4 - crates/openshell-providers/src/profiles.rs | 28 ---- crates/openshell-server/src/grpc/provider.rs | 122 ++---------------- crates/openshell-server/src/storage_proto.rs | 8 +- docs/how-it-works/providers/google.mdx | 13 +- docs/how-it-works/providers/profiles.mdx | 16 +-- docs/upgrade/0-2-0.mdx | 16 ++- e2e/python/test_sandbox_providers.py | 2 +- e2e/support/gateway-common.sh | 9 +- proto/openshell.proto | 6 +- providers/README.md | 14 +- providers/google-cloud.yaml | 8 +- skills/openshell-cli/SKILL.md | 2 +- tasks/scripts/test-e2e-provider-profiles.sh | 7 +- 17 files changed, 70 insertions(+), 238 deletions(-) diff --git a/crates/openshell-providers/README.md b/crates/openshell-providers/README.md index c7eef1af15..10c965c468 100644 --- a/crates/openshell-providers/README.md +++ b/crates/openshell-providers/README.md @@ -14,7 +14,7 @@ select compiled provider plugins. - Discover credentials and non-secret config from declared environment keys. - Apply bounded, literal non-secret environment defaults without overwriting existing values. -- Validate credential collisions and named platform adapter requirements. +- Validate credential collisions and environment declarations. - Use the shared authored-YAML compatibility boundary for profile imports and exports: reject duplicate keys and null objects without coercion, retain optional nulls, and preserve string types for YAML 1.1 readers. @@ -38,7 +38,7 @@ Those are owned by the gateway and sandbox supervisor. | Credential discovery | `discovery.credentials` and credential `env_vars` | | Vertex config discovery | `discovery.config_env_vars` | | Workload resolution of non-secret values | Gateway key classification, independent of provider names | -| Platform service dependency | `required_platform_adapter`; GCP metadata is available for non-Windows sandbox runtimes | +| GCP metadata runtime requirement | Documented in the example profile header; the supervisor provides metadata for Linux sandboxes | | Vertex service account JSON credential | Removed from the example; configure gateway refresh material directly | | ID-selected provider plugins | Removed | | ID-selected CLI credential hints | Removed; setup guidance applies to the imported profile | @@ -47,8 +47,9 @@ Those are owned by the gateway and sandbox supervisor. | GCP project and region config-key catalog | Removed; profile data supplies these declarations | Credential refresh strategies remain explicitly declared in credential metadata. -The supervisor provides the `gcp-metadata` adapter for Linux sandboxes; the -Windows/MXC runtime does not provide it. +The supervisor provides the GCP metadata service for Linux sandboxes; the +Windows/MXC runtime does not provide it. Profile import and attachment do not +validate runtime support. ## Security Notes diff --git a/crates/openshell-providers/src/discovery.rs b/crates/openshell-providers/src/discovery.rs index 706267f340..645e3a705a 100644 --- a/crates/openshell-providers/src/discovery.rs +++ b/crates/openshell-providers/src/discovery.rs @@ -107,7 +107,6 @@ mod tests { config_env_vars: Vec::new(), }, environment: EnvironmentProfile::default(), - required_platform_adapter: String::new(), source: String::new(), scope: String::new(), } diff --git a/crates/openshell-providers/src/environment_tests.rs b/crates/openshell-providers/src/environment_tests.rs index 529d404328..df25f0f725 100644 --- a/crates/openshell-providers/src/environment_tests.rs +++ b/crates/openshell-providers/src/environment_tests.rs @@ -25,7 +25,6 @@ environment: discovery: credentials: [token] config_env_vars: [CUSTOM_PROJECT] -required_platform_adapter: gcp-metadata ", ) .unwrap() @@ -120,14 +119,6 @@ fn renamed_google_examples_keep_environment_and_discovery_behavior() { renamed.environment.inject(&config, &mut renamed_env); assert!(!canonical_env.is_empty()); assert_eq!(canonical_env, renamed_env); - assert_eq!( - canonical - .ensure_platform_adapter_available() - .map_err(|error| error.to_string()), - renamed - .ensure_platform_adapter_available() - .map_err(|error| error.to_string()), - ); assert_eq!( discover_from_profile(&canonical, &context).unwrap(), discover_from_profile(&renamed, &context).unwrap() @@ -246,37 +237,3 @@ fn lint_enforces_declaration_count_limits() { .any(|diagnostic| diagnostic.message == "at most 64 discovery config keys are allowed") ); } - -#[test] -fn platform_adapter_availability_and_unknown_adapter_errors() { - let mut profile = profile(); - let availability = profile.ensure_platform_adapter_available(); - if cfg!(windows) { - assert!( - availability - .unwrap_err() - .to_string() - .contains("unavailable") - ); - } else { - assert!(availability.is_ok()); - } - profile.required_platform_adapter = "unknown".repeat(10_000); - let diagnostics = validate_profile_set(&[("custom.yaml".into(), profile.clone())]); - assert!( - diagnostics - .iter() - .any(|d| d.field == "required_platform_adapter") - ); - assert!(diagnostics.iter().all(|d| d.message.len() < 256)); - assert!( - profile - .ensure_platform_adapter_available() - .unwrap_err() - .to_string() - .len() - < 128 - ); - profile.required_platform_adapter.clear(); - assert!(profile.ensure_platform_adapter_available().is_ok()); -} diff --git a/crates/openshell-providers/src/lib.rs b/crates/openshell-providers/src/lib.rs index 393ff39345..7e7148e2e6 100644 --- a/crates/openshell-providers/src/lib.rs +++ b/crates/openshell-providers/src/lib.rs @@ -41,10 +41,6 @@ pub enum ProviderError { profile_id: String, credential_name: String, }, - #[error("required platform adapter 'gcp-metadata' is unavailable in this build")] - UnavailableGcpMetadataAdapter, - #[error("unknown required platform adapter")] - UnknownPlatformAdapter, } #[derive(Debug, Clone, Default, PartialEq, Eq)] diff --git a/crates/openshell-providers/src/profiles.rs b/crates/openshell-providers/src/profiles.rs index 1b64dc1016..654354ed54 100644 --- a/crates/openshell-providers/src/profiles.rs +++ b/crates/openshell-providers/src/profiles.rs @@ -758,8 +758,6 @@ pub struct ProviderTypeProfile { #[serde(default, skip_serializing_if = "EnvironmentProfile::is_empty")] pub environment: EnvironmentProfile, #[serde(default, skip_serializing_if = "String::is_empty")] - pub required_platform_adapter: String, - #[serde(default, skip_serializing_if = "String::is_empty")] pub source: String, #[serde(default, skip_serializing_if = "String::is_empty")] pub scope: String, @@ -845,18 +843,6 @@ fn valid_file_config_key(key: &str) -> bool { // narrower shape; direct gRPC imports and CLI YAML imports must preserve the // same policy intent through storage and JIT composition. impl ProviderTypeProfile { - /// Check runtime capability separately from schema lint. The supervisor - /// provides GCP metadata for non-Windows sandbox runtimes. - pub fn ensure_platform_adapter_available(&self) -> Result<(), crate::ProviderError> { - match self.required_platform_adapter.as_str() { - "gcp-metadata" if cfg!(windows) => { - Err(crate::ProviderError::UnavailableGcpMetadataAdapter) - } - "" | "gcp-metadata" => Ok(()), - _ => Err(crate::ProviderError::UnknownPlatformAdapter), - } - } - #[must_use] pub fn from_proto(profile: &ProviderProfile) -> Self { Self { @@ -913,7 +899,6 @@ impl ProviderTypeProfile { fixed: environment.fixed.clone(), }, ), - required_platform_adapter: profile.required_platform_adapter.clone(), } } @@ -1092,7 +1077,6 @@ impl ProviderTypeProfile { config: self.environment.config.clone(), fixed: self.environment.fixed.clone(), }), - required_platform_adapter: self.required_platform_adapter.clone(), } } @@ -3258,15 +3242,6 @@ fn collect_environment_diagnostics( message, )); }; - if !matches!( - profile.required_platform_adapter.as_str(), - "" | "gcp-metadata" - ) { - error( - "required_platform_adapter", - "unknown platform adapter; the only recognized adapter is gcp-metadata", - ); - } let environment = &profile.environment; if environment.config.len() + environment.fixed.len() > MAX_ENVIRONMENT_ENTRIES { error("environment", "at most 64 environment defaults are allowed"); @@ -6588,7 +6563,6 @@ binaries: inference_capable: false, discovery: DiscoveryProfile::default(), environment: EnvironmentProfile::default(), - required_platform_adapter: String::new(), source: String::new(), scope: String::new(), }, @@ -6609,7 +6583,6 @@ binaries: inference_capable: false, discovery: DiscoveryProfile::default(), environment: EnvironmentProfile::default(), - required_platform_adapter: String::new(), source: String::new(), scope: String::new(), }, @@ -6630,7 +6603,6 @@ binaries: inference_capable: false, discovery: DiscoveryProfile::default(), environment: EnvironmentProfile::default(), - required_platform_adapter: String::new(), source: String::new(), scope: String::new(), }, diff --git a/crates/openshell-server/src/grpc/provider.rs b/crates/openshell-server/src/grpc/provider.rs index d7599f1dad..a43d80cad3 100644 --- a/crates/openshell-server/src/grpc/provider.rs +++ b/crates/openshell-server/src/grpc/provider.rs @@ -1481,7 +1481,7 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin // provider's earlier output cannot change how this provider classifies // or populates its own keys. Cross-provider credential/config // collisions have already been rejected by the validation above. - inject_provider_profile_environment(catalog, provider, &mut provider_env)?; + inject_provider_profile_environment(catalog, provider, &mut provider_env); for key in profile_stable_placeholder_keys { // A stable placeholder is emitted only when the binding carries // the opaque handle that binds it to the sandbox, provider, @@ -2079,14 +2079,13 @@ pub async fn validate_provider_profiles_present( else { continue; }; - if let Some(profile) = get_provider_type_profile_for_scope( + if get_provider_type_profile_for_scope( catalog, &provider.r#type, &provider.profile_workspace, - ) { - profile - .ensure_platform_adapter_available() - .map_err(|error| Status::failed_precondition(error.to_string()))?; + ) + .is_some() + { continue; } let requested = provider.r#type.trim(); @@ -2219,7 +2218,7 @@ async fn validate_provider_environment_keys_unique_at( &mut seen_profile_config, &provider_name, active_provider_environment_keys(refresh, catalog, &provider, now_ms).await?, - provider_profile_environment_values(catalog, &provider)?, + provider_profile_environment_values(catalog, &provider), )?; dynamic_bindings.extend(dynamic_token_grant_bindings_for_provider_with_catalog( catalog, &provider, @@ -2244,7 +2243,7 @@ fn validate_provider_environment_records_unique_at( &mut seen_profile_config, &record.name, active_keys_with_refresh_states(catalog, provider, &record.refresh_states, now_ms), - provider_profile_environment_values(catalog, provider)?, + provider_profile_environment_values(catalog, provider), )?; dynamic_bindings.extend(dynamic_token_grant_bindings_for_provider_with_catalog( catalog, provider, @@ -2257,29 +2256,25 @@ fn validate_provider_environment_records_unique_at( fn provider_profile_environment_values( catalog: &EffectiveProviderProfileCatalog, provider: &Provider, -) -> Result, Status> { +) -> Vec<(String, String)> { let mut profile_environment = HashMap::new(); - inject_provider_profile_environment(catalog, provider, &mut profile_environment)?; + inject_provider_profile_environment(catalog, provider, &mut profile_environment); let mut values: Vec<_> = profile_environment.into_iter().collect(); values.sort_unstable_by(|left, right| left.0.cmp(&right.0)); - Ok(values) + values } fn inject_provider_profile_environment( catalog: &EffectiveProviderProfileCatalog, provider: &Provider, environment: &mut HashMap, -) -> Result<(), Status> { +) { // Only the resolved profile declares non-secret environment defaults. if let Some(profile) = get_provider_type_profile_for_scope(catalog, &provider.r#type, &provider.profile_workspace) { - profile - .ensure_platform_adapter_available() - .map_err(|error| Status::failed_precondition(error.to_string()))?; profile.environment.inject(&provider.config, environment); } - Ok(()) } fn validate_provider_environment_key_ownership( @@ -3114,7 +3109,6 @@ pub(super) async fn handle_import_provider_profiles( profile_conflict_diagnostics(state.store.as_ref(), &catalog, &workspace, &profiles).await?, ); diagnostics.extend(validate_profile_set(&profiles)); - diagnostics.extend(profile_adapter_diagnostics(&profiles)); diagnostics.extend(profile_legacy_credential_diagnostics(&profiles)); if !has_errors(&diagnostics) { diagnostics.extend( @@ -3220,7 +3214,6 @@ pub(super) async fn handle_update_provider_profiles( .await?, ); diagnostics.extend(validate_profile_set(&profiles)); - diagnostics.extend(profile_adapter_diagnostics(&profiles)); diagnostics.extend(profile_legacy_credential_diagnostics(&profiles)); let expected_resource_version = if request.expected_resource_version != 0 { Some(request.expected_resource_version) @@ -3761,26 +3754,6 @@ fn normalize_profile_id_request(id: &str) -> Result { }) } -fn profile_adapter_diagnostics( - profiles: &[(String, ProviderTypeProfile)], -) -> Vec { - profiles - .iter() - .filter_map(|(source, profile)| { - profile - .ensure_platform_adapter_available() - .err() - .map(|error| ProfileValidationDiagnostic { - source: source.clone(), - profile_id: profile.id.clone(), - field: "required_platform_adapter".to_string(), - message: error.to_string(), - severity: "error".to_string(), - }) - }) - .collect() -} - fn profile_legacy_credential_diagnostics( profiles: &[(String, ProviderTypeProfile)], ) -> Vec { @@ -5711,7 +5684,6 @@ mod tests { // service. Use an explicit data-only fork for those scenarios. let mut cloud_config = openshell_providers::example_profiles::load("google-cloud"); cloud_config.id = "cloud-env-fixture".to_string(); - cloud_config.required_platform_adapter.clear(); store .put_message(&stored_provider_profile(cloud_config.to_proto())) .await @@ -6301,77 +6273,6 @@ mod tests { } } - #[tokio::test] - async fn gcp_metadata_platform_adapter_matches_host_capability() { - let state = test_server_state_without_provider_profiles().await; - let mut profile = custom_profile("requires-adapter"); - profile.required_platform_adapter = "gcp-metadata".to_string(); - let response = handle_import_provider_profiles( - &state, - authed_request(ImportProviderProfilesRequest { - profiles: vec![ProviderProfileImportItem { - profile: Some(profile.clone()), - source: "requires-adapter.yaml".to_string(), - }], - ..Default::default() - }), - ) - .await - .unwrap() - .into_inner(); - if cfg!(windows) { - assert!(!response.imported); - assert!(response.diagnostics.iter().any(|diagnostic| { - diagnostic.field == "required_platform_adapter" - && diagnostic.message.contains("unavailable") - && diagnostic.message.len() < 128 - })); - } else { - assert!(response.imported, "{:?}", response.diagnostics); - } - - // Existing stored and interceptor-vended profiles must pass the same - // capability check at attachment as profiles imported in this build. - state - .store - .put_message(&stored_provider_profile(profile)) - .await - .unwrap(); - create_empty_token_grant_provider( - state.store.as_ref(), - "needs-adapter", - "requires-adapter", - ) - .await; - let catalog = ProviderProfileSources::with_default_sources() - .snapshot_catalog(state.store.as_ref(), "default") - .await - .unwrap(); - let validation = validate_provider_profiles_present( - state.store.as_ref(), - &catalog, - "default", - &["needs-adapter".to_string()], - ) - .await; - let environment = resolve_provider_environment( - state.store.as_ref(), - "default", - &["needs-adapter".to_string()], - ) - .await; - if cfg!(windows) { - let error = validation.unwrap_err(); - assert_eq!(error.code(), Code::FailedPrecondition); - assert!(error.message().contains("gcp-metadata")); - assert!(error.message().len() < 128); - assert_eq!(environment.unwrap_err().code(), Code::FailedPrecondition); - } else { - assert!(validation.is_ok()); - assert!(environment.is_ok()); - } - } - #[tokio::test] async fn provider_environment_propagates_dynamic_key_failure() { let state = test_server_state().await; @@ -14120,7 +14021,6 @@ mod tests { let store = test_store().await; let mut project_profile = openshell_providers::example_profiles::load("google-cloud"); project_profile.id = "project-env-fixture".into(); - project_profile.required_platform_adapter.clear(); project_profile.environment.fixed.clear(); project_profile .environment diff --git a/crates/openshell-server/src/storage_proto.rs b/crates/openshell-server/src/storage_proto.rs index 1a04a10377..3419a8961e 100644 --- a/crates/openshell-server/src/storage_proto.rs +++ b/crates/openshell-server/src/storage_proto.rs @@ -132,6 +132,9 @@ mod tests { // legacy payload decoding. The provider-environment file map and peer // configuration notification are public-only. Older supervisors ignore the // additive file map while retaining the rest of the response. + // ProviderProfile's adapter requirement is removed with its field number + // and name reserved. Prior payloads ignore that field while preserving + // environment declarations at field 15; storage.v1 remains unchanged. // Preparation timing adds two optional timestamps to SandboxProvisioning. // Existing rows decode with both absent and retain their active deadline; // no stored attempt gains another phase or time budget on upgrade. @@ -178,9 +181,9 @@ mod tests { // image wire identity, now with explicit presence. Compute configuration // updates use a separate capability/service and add one classified RPC. const PUBLIC_RPC_SCHEMA_SHA256: &str = - "6a48aa216b6e58c3b988d4468a2bce48f191cde442cd16431a6745c31b633af5"; + "82bafb2d6761f931bd61d779c138bd87029d1616a952671eccce92a15e99d21b"; const DURABLE_SCHEMA_SHA256: &str = - "5007cbc16f1791107fd8084f34093e39de7b0e129a481d2bebd6978627278be1"; + "0428468afb6a08ed0fb2d8c66dbc3c601771c3744f1fd4016b055d5c1a546a6f"; const PUBLIC_DURABLE_OVERLAP_SHA256: &str = "324526d75a8d523328a4c902f867400105826e6f540123f88a3ba1bbe8925958"; // Encoded with the schema that omitted stable_placeholder. Keep these @@ -868,7 +871,6 @@ mod tests { assert_eq!(profile.id, "profile"); assert_eq!(profile.display_name, "Legacy"); assert!(profile.environment.is_none()); - assert!(profile.required_platform_adapter.is_empty()); let policy_payload = PolicyRevisionPayload::decode(legacy_bytes(V0_0_116_POLICY_PAYLOAD).as_slice()) diff --git a/docs/how-it-works/providers/google.mdx b/docs/how-it-works/providers/google.mdx index 7668b01199..37d89bf5e4 100644 --- a/docs/how-it-works/providers/google.mdx +++ b/docs/how-it-works/providers/google.mdx @@ -14,10 +14,13 @@ gateway-refreshed bearer tokens. ## Google Cloud Metadata -The `google-cloud` example declares the `gcp-metadata` platform adapter and -the SDK environment variables that use it. The sandbox relays metadata requests -to the supervisor on Linux sandboxes using Docker, Podman, Kubernetes, or VM. -Windows/MXC does not provide this adapter. +The `google-cloud` example requires a Linux sandbox using Docker, Podman, +Kubernetes, or VM. The sandbox relays metadata requests to the supervisor. +Windows/MXC does not provide this metadata service. Verify the sandbox runtime +before using the profile. Import and attachment do not check runtime support; +on an unsupported runtime, SDK metadata discovery fails when the client tries +to use it. Native Vertex bearer-token authentication does not require this +service. Import the profile before creating a provider. This example has no API endpoints, so bind the provider to each Google API host in sandbox policy as @@ -30,7 +33,7 @@ openshell profile import -f google-cloud.yaml --global The profile's `environment` declarations provide the non-secret metadata and project values listed below. A copy imported under another ID keeps those -declarations and the same adapter requirement. +declarations and still requires a supported sandbox runtime. ## Authentication Flows diff --git a/docs/how-it-works/providers/profiles.mdx b/docs/how-it-works/providers/profiles.mdx index 90429ca2c6..02919d7153 100644 --- a/docs/how-it-works/providers/profiles.mdx +++ b/docs/how-it-works/providers/profiles.mdx @@ -87,11 +87,11 @@ the same non-secret destination from multiple providers when their values match. It rejects differing values and overlapping credential keys. Use distinct destination names when providers need different values. -Use `required_platform_adapter` when a profile depends on a named runtime -capability. Lint rejects unknown adapter names. Import, update, and attachment -reject a recognized adapter that the deployment cannot provide, with a bounded -diagnostic. The `gcp-metadata` adapter is available for Linux sandboxes using -Docker, Podman, Kubernetes, or VM. Windows/MXC does not provide it. +Check each example profile's header for runtime requirements before using it. +Import and attachment validate the profile definition but do not check whether +the sandbox runtime provides services its SDK settings depend on. For example, +[Google Cloud metadata discovery](/how-it-works/providers/google#google-cloud-metadata) +requires a supported Linux sandbox runtime. ## Understand Static Credential Endpoint Binding @@ -395,9 +395,9 @@ cp providers/github.yaml providers/openai.yaml selected-profiles/ openshell profile import --from ./selected-profiles --global ``` -Include only profiles whose platform requirements the deployment supports. -Imports are atomic: a batch containing the Google Cloud metadata example fails -on Windows/MXC because the `gcp-metadata` adapter is unavailable there. +Imports are atomic: an invalid or conflicting profile rejects the whole batch. +A successful import does not confirm runtime compatibility. Check the selected +profiles' documented runtime requirements before attaching their providers. Omit `--global` to import into the current workspace instead. diff --git a/docs/upgrade/0-2-0.mdx b/docs/upgrade/0-2-0.mdx index d305d3b36d..1bb7336ee4 100644 --- a/docs/upgrade/0-2-0.mdx +++ b/docs/upgrade/0-2-0.mdx @@ -101,11 +101,17 @@ same scope as the existing profile; omit `--global` for workspace-scoped profiles. Import is create-only, so use `profile import` only when the profile does not already exist. See [profile management](/how-it-works/providers/profiles#provider-profiles). -The Google Cloud metadata example also declares -`required_platform_adapter: gcp-metadata`. The supervisor provides this service -for Linux sandboxes using Docker, Podman, Kubernetes, or VM. Windows/MXC does not -provide the metadata endpoint. Native Vertex bearer-token authentication does -not require this adapter. +The Google Cloud metadata example requires a Linux sandbox using Docker, +Podman, Kubernetes, or VM. Windows/MXC does not provide the metadata endpoint. +Import and attachment do not check runtime support, so they can succeed even +when SDK metadata discovery will fail. Verify the sandbox runtime before using +this profile. Native Vertex bearer-token authentication does not require the +metadata service. See [Google Cloud metadata discovery](/how-it-works/providers/google#google-cloud-metadata). + +When importing several new profiles with `--from`, put reviewed profiles in a +separate directory and check their runtime requirements first. Import is atomic: +an invalid or conflicting definition rejects the whole batch. A successful +import does not confirm that the selected profiles work with your runtime. ### Migrate service-account private keys diff --git a/e2e/python/test_sandbox_providers.py b/e2e/python/test_sandbox_providers.py index a7fe2d57c5..6b3d8698db 100644 --- a/e2e/python/test_sandbox_providers.py +++ b/e2e/python/test_sandbox_providers.py @@ -158,7 +158,7 @@ def imported_provider_profile( def _endpointless_credential_profile(profile_id: str) -> openshell_pb2.ProviderProfile: - """Build an endpointless credential profile without a platform adapter.""" + """Build an endpointless credential profile for placeholder delivery tests.""" return openshell_pb2.ProviderProfile( id=profile_id, display_name=f"{profile_id} display", diff --git a/e2e/support/gateway-common.sh b/e2e/support/gateway-common.sh index f9a9e248c8..954ec0ce5c 100644 --- a/e2e/support/gateway-common.sh +++ b/e2e/support/gateway-common.sh @@ -329,17 +329,10 @@ EOF e2e_import_example_provider_profiles() { local cli_bin=$1 local root=$2 - local profile adapter + local profile echo "Importing example provider profiles from ${root}/providers..." for profile in "${root}"/providers/*.yaml; do - adapter="$(yq -r '.required_platform_adapter // ""' "${profile}")" || return 1 - # The standard Linux test runtimes provide the supervisor GCP metadata - # adapter. Other platform adapters need a specialized suite. - if [ -n "${adapter}" ] && [ "${adapter}" != "gcp-metadata" ]; then - echo "Skipping ${profile}: requires platform adapter ${adapter}" - continue - fi if ! "${cli_bin}" provider profile import --file "${profile}" --global; then echo "ERROR: failed to import example provider profile ${profile}" >&2 return 1 diff --git a/proto/openshell.proto b/proto/openshell.proto index 538921881b..d404a659db 100644 --- a/proto/openshell.proto +++ b/proto/openshell.proto @@ -2637,6 +2637,9 @@ enum ProviderProfileCategory { // Provider type profile metadata exposed to clients. message ProviderProfile { + reserved 16; + reserved "required_platform_adapter"; + string id = 1; string display_name = 2; string description = 3; @@ -2663,9 +2666,6 @@ message ProviderProfile { repeated ProviderProfileFile files = 14; // Non-secret environment defaults declared by this profile. ProviderProfileEnvironment environment = 15; - // Named runtime capability required by this profile. Empty requires none. - // Import and attachment reject requirements unavailable in this deployment. - string required_platform_adapter = 16; } // EXPERIMENTAL: Provider file templates may change or be removed. diff --git a/providers/README.md b/providers/README.md index 5854280f17..a102081670 100644 --- a/providers/README.md +++ b/providers/README.md @@ -24,10 +24,11 @@ openshell provider profile import --from ./selected-profiles --global Drop `--global` to import into the current workspace instead. -The `google-cloud.yaml` example requires the `gcp-metadata` platform adapter, -provided for Linux sandboxes by the supervisor. Windows/MXC does not provide -this adapter. The Vertex example uses bearer-token authentication and does not -require it. +The `google-cloud.yaml` example requires the supervisor's metadata service in +a Linux sandbox using Docker, Podman, Kubernetes, or VM. Windows/MXC does not +provide this service. Import and attachment do not check runtime support, so +verify it before using the profile. The Vertex example uses bearer-token +authentication and does not require the metadata service. ## Read the header before importing @@ -53,8 +54,9 @@ workload, and import your copy. injection safe. - Keep `endpoints` limited to the hosts the credential should reach. A credential is only sent to the endpoints its profile declares. -- Review non-secret `environment` defaults, `discovery.config_env_vars`, and - `required_platform_adapter`. Renaming the profile preserves these declarations. +- Review non-secret `environment` defaults and `discovery.config_env_vars`. + Renaming the profile preserves these declarations. Check the header for + runtime requirements before using your copy. - Run `openshell provider profile lint` before importing. See [Provider profiles](https://docs.nvidia.com/openshell/latest/how-it-works/providers/profiles) for the diff --git a/providers/google-cloud.yaml b/providers/google-cloud.yaml index 13f2ef3b1c..764248ce67 100644 --- a/providers/google-cloud.yaml +++ b/providers/google-cloud.yaml @@ -10,9 +10,10 @@ # below, so it has to name the paths in *your* image. # # Client binaries: none declared — this profile grants no egress. -# Reference layout: requires the gcp-metadata platform adapter, provided by -# the supervisor for Linux sandboxes. Windows/MXC does not -# provide this service. +# Runtime required: a Linux sandbox using Docker, Podman, Kubernetes, or VM. +# The supervisor provides the metadata service there; +# Windows/MXC does not. Import and attachment do not check +# runtime support, so verify it before using this profile. # Credential scope: a gateway-refreshed GCP access token, as GCP_SA_ACCESS_TOKEN # (service-account JWT flow) or GCP_ADC_ACCESS_TOKEN (gcloud # ADC flow). Configure the refresh material with @@ -30,7 +31,6 @@ display_name: Google Cloud (GCP APIs) description: Native GCP SDK credentials for sandboxes via metadata emulator category: other inference_capable: false -required_platform_adapter: gcp-metadata environment: config: diff --git a/skills/openshell-cli/SKILL.md b/skills/openshell-cli/SKILL.md index aa876b3573..d7fcaccd8e 100644 --- a/skills/openshell-cli/SKILL.md +++ b/skills/openshell-cli/SKILL.md @@ -207,7 +207,7 @@ openshell profile import --url https://example.com/profiles/my-profile.yaml binary grants before importing it. The URL path must end in `.yaml`, `.yml`, or `.json`; downloads are limited to 1 MiB and 15 seconds. -Use `profile describe` to inspect a definition's credential metadata, endpoints, TLS handling, MCP access settings, rule counts, binaries, source, and scope before creating a provider. Inspect structured output for declared environment defaults, discovery config keys, and required platform adapters. Renaming a profile preserves its declared behavior; the ID does not activate SDK defaults. An unavailable required adapter rejects import or attachment. Check for `tls: skip` and the uninspected-credential opt-in before relying on displayed L7 rules. List and describe accept table, JSON, and YAML output; use structured output for complete rule definitions, `--workspace` for a workspace catalog, or `--global` for platform scope. Use `profile export` when preparing an editable definition, `profile update --file ` to replace an existing custom profile with its current resource version, and `profile delete ...` to remove custom profiles. Provider instances remain under `provider`. +Use `profile describe` to inspect a definition's credential metadata, endpoints, TLS handling, MCP access settings, rule counts, binaries, source, and scope before creating a provider. Inspect structured output for declared environment defaults and discovery config keys. Renaming a profile preserves its declared behavior; the ID does not activate SDK defaults. Check documented runtime requirements before attaching providers; import and attachment do not validate runtime support. Google Cloud metadata discovery requires a supported Linux sandbox runtime. Check for `tls: skip` and the uninspected-credential opt-in before relying on displayed L7 rules. List and describe accept table, JSON, and YAML output; use structured output for complete rule definitions, `--workspace` for a workspace catalog, or `--global` for platform scope. Use `profile export` when preparing an editable definition, `profile update --file ` to replace an existing custom profile with its current resource version, and `profile delete ...` to remove custom profiles. Provider instances remain under `provider`. Existing scripts can continue using `provider list-profiles` and `provider profile export/import/update/lint/delete`. These commands share the top-level handlers and preserve their arguments, output options, and workspace/global flags. Prefer `profile` when writing new commands. diff --git a/tasks/scripts/test-e2e-provider-profiles.sh b/tasks/scripts/test-e2e-provider-profiles.sh index 57f3aa2f34..36b48a5f05 100644 --- a/tasks/scripts/test-e2e-provider-profiles.sh +++ b/tasks/scripts/test-e2e-provider-profiles.sh @@ -12,8 +12,8 @@ PROFILE_WORK="$(mktemp -d)" trap 'rm -rf "${PROFILE_WORK}"' EXIT mkdir -p "${PROFILE_WORK}/providers" printf 'id: google-cloud\n' > "${PROFILE_WORK}/providers/google-cloud.yaml" -printf 'id: acme\nrequired_platform_adapter: gcp-metadata\n' > "${PROFILE_WORK}/providers/acme.yaml" -printf 'id: future\nrequired_platform_adapter: future-adapter\n' > "${PROFILE_WORK}/providers/future.yaml" +printf 'id: acme\n' > "${PROFILE_WORK}/providers/acme.yaml" +printf 'id: future\n' > "${PROFILE_WORK}/providers/future.yaml" capture_profile_import() { printf '%s\n' "$*" >> "${PROFILE_WORK}/imports" @@ -21,9 +21,10 @@ capture_profile_import() { e2e_import_example_provider_profiles capture_profile_import "${PROFILE_WORK}" expected="provider profile import --file ${PROFILE_WORK}/providers/acme.yaml --global +provider profile import --file ${PROFILE_WORK}/providers/future.yaml --global provider profile import --file ${PROFILE_WORK}/providers/google-cloud.yaml --global" if [ "$(cat "${PROFILE_WORK}/imports")" != "${expected}" ]; then - echo "FAIL: profile selection must follow adapter declarations, independent of ID" >&2 + echo "FAIL: gateway setup must import every example profile" >&2 exit 1 fi From df02e79498d05f8ebdaff3fac3ee8505ea24443d Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Mon, 9 Nov 2026 11:11:27 +0100 Subject: [PATCH 10/10] fix(providers): retain caller overrides in metadata snapshots Keep effective caller values for profile-declared non-secret environment destinations so supervisor metadata sees the same project ID as workloads. Apply sandbox environment, template environment, then provider default precedence, preserving explicit empty values and credential ownership. Include effective overrides in the provider environment revision to prevent stale snapshots, and document precedence and independent project aliases. Add regression coverage for missing defaults, credential classification, and revision consistency, plus Google SDK discovery cases for overrides. Validation: 73 Rust tests and all 6 focused Podman SDK E2E cases passed. Gateway Clippy, Rust/Python formatting, documentation, Markdown, and git diff --check passed. Python lint and type-check diagnostics match the committed baseline. No Go SDK changes. Signed-off-by: Philippe Martin --- crates/openshell-server/src/grpc/policy.rs | 211 +++++++++++++++++-- crates/openshell-server/src/grpc/provider.rs | 53 ++++- docs/how-it-works/providers/google.mdx | 7 + docs/how-it-works/providers/profiles.mdx | 6 +- e2e/python/test_sandbox_providers.py | 56 ++++- 5 files changed, 302 insertions(+), 31 deletions(-) diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs index 33ecedb75a..5c58d68863 100644 --- a/crates/openshell-server/src/grpc/policy.rs +++ b/crates/openshell-server/src/grpc/policy.rs @@ -3075,6 +3075,11 @@ pub async fn build_sandbox_config_snapshot_from_inputs( &policy_credential_bindings, )?; } + let environment_overrides = super::provider::non_secret_provider_environment_overrides( + provider_profile_catalog, + provider_records, + sandbox, + ); let provider_env_revision = compute_provider_env_revision_from_records_and_policy_bindings( provider_profile_catalog, provider_records, @@ -3082,6 +3087,7 @@ pub async fn build_sandbox_config_snapshot_from_inputs( policy .as_ref() .filter(|_| matches!(policy_source, PolicySource::Global)), + &environment_overrides, )?; let service_routes = super::service::configured_app_routes(state, sandbox).await?; @@ -3381,6 +3387,7 @@ fn compute_provider_env_revision_from_records( records, &HashMap::new(), None, + &BTreeMap::new(), ) } @@ -3389,6 +3396,7 @@ fn compute_provider_env_revision_from_records_and_policy_bindings( records: &[super::provider::ProviderEnvironmentRecord], policy_bindings: &HashMap>, global_policy: Option<&ProtoSandboxPolicy>, + environment_overrides: &BTreeMap, ) -> Result { let mut hasher = Sha256::new(); hasher.update(b"openshell-provider-env-revision-v4"); @@ -3432,6 +3440,18 @@ fn compute_provider_env_revision_from_records_and_policy_bindings( hasher.update(deterministic_policy_hash(policy).as_bytes()); } + if !environment_overrides.is_empty() { + // Hash the same effective values that the environment snapshot installs. + // Length prefixes preserve boundaries, including explicitly empty values. + hasher.update(b"caller-non-secret-environment"); + for (key, value) in environment_overrides { + hasher.update((key.len() as u64).to_le_bytes()); + hasher.update(key.as_bytes()); + hasher.update((value.len() as u64).to_le_bytes()); + hasher.update(value.as_bytes()); + } + } + let digest = hasher.finalize(); Ok(u64::from_le_bytes(digest[..8].try_into().map_err( |_| Status::internal("provider env revision digest too short"), @@ -3898,6 +3918,7 @@ pub async fn build_provider_environment_snapshot( /// is resolved. struct ProviderEnvironmentTarget<'a> { spec: &'a openshell_core::proto::SandboxSpec, + environment_overrides: BTreeMap, effective_policy: ProtoSandboxPolicy, policy_source: PolicySource, policy_credential_bindings: HashMap>, @@ -3929,14 +3950,21 @@ fn provider_environment_target( &effective_policy, &policy_credential_bindings, )?; + let environment_overrides = super::provider::non_secret_provider_environment_overrides( + provider_profile_catalog, + provider_records, + sandbox, + ); let provider_env_revision = compute_provider_env_revision_from_records_and_policy_bindings( provider_profile_catalog, provider_records, &policy_credential_bindings, matches!(policy_source, PolicySource::Global).then_some(&effective_policy), + &environment_overrides, )?; Ok(ProviderEnvironmentTarget { spec, + environment_overrides, effective_policy, policy_source, policy_credential_bindings, @@ -3955,6 +3983,7 @@ pub async fn build_provider_environment_snapshot_from_inputs( let sandbox_id = inputs.sandbox.object_id().to_string(); let ProviderEnvironmentTarget { spec, + environment_overrides, effective_policy, policy_source, policy_credential_bindings, @@ -3992,20 +4021,12 @@ pub async fn build_provider_environment_snapshot_from_inputs( credential.token_grant_owners.clone_from(&owners); } } - // Sandbox template and spec values are caller-owned. Drop only non-secret - // profile defaults for those keys before sending the snapshot to either - // the canonical process or later execs. Credential keys keep their - // existing binding and placeholder precedence. - let caller_has_key = |key: &str| { - spec.environment.contains_key(key) - || spec - .template - .as_ref() - .is_some_and(|template| template.environment.contains_key(key)) - }; - provider_environment.environment.retain(|key, _| { - provider_environment.static_credential_keys.contains(key) || !caller_has_key(key) - }); + // Retain effective non-secret values for both process environments and + // supervisor consumers such as metadata. Credential keys are excluded + // from overrides and keep their binding and placeholder precedence. + provider_environment + .environment + .extend(environment_overrides); let mut readiness_reason = provider_environment.readiness_reason; @@ -14460,6 +14481,10 @@ mod tests { .environment .config .insert("CUSTOM_PROJECT".to_string(), "project".to_string()); + profile + .environment + .config + .insert("CUSTOM_MISSING".to_string(), "missing".to_string()); profile .environment .fixed @@ -14492,17 +14517,39 @@ mod tests { .insert("CUSTOM_PROJECT".to_string(), "caller-project".to_string()); spec.environment .insert("GITHUB_TOKEN".to_string(), "caller-token".to_string()); - spec.template - .get_or_insert_with(Default::default) - .environment - .insert("CUSTOM_MODE".to_string(), String::new()); + spec.environment + .insert("CUSTOM_MISSING".to_string(), " caller value ".to_string()); + spec.environment + .insert("UNRELATED".to_string(), "caller-only".to_string()); + let template = spec.template.get_or_insert_with(Default::default); + template.environment = HashMap::from([ + ("CUSTOM_PROJECT".to_string(), "template-project".to_string()), + ("CUSTOM_MODE".to_string(), String::new()), + ]); state.store.put_message(&sandbox).await.unwrap(); let snapshot = load_sandbox_provider_environment(&state, &sandbox, true, true) .await .unwrap(); - assert!(!snapshot.environment.contains_key("CUSTOM_PROJECT")); - assert!(!snapshot.environment.contains_key("CUSTOM_MODE")); + assert_eq!( + snapshot + .environment + .get("CUSTOM_PROJECT") + .map(String::as_str), + Some("caller-project") + ); + assert_eq!( + snapshot.environment.get("CUSTOM_MODE").map(String::as_str), + Some("") + ); + assert_eq!( + snapshot + .environment + .get("CUSTOM_MISSING") + .map(String::as_str), + Some(" caller value ") + ); + assert!(!snapshot.environment.contains_key("UNRELATED")); assert_eq!( snapshot.environment.get("CUSTOM_UNSET").map(String::as_str), Some("default") @@ -14516,7 +14563,129 @@ mod tests { .static_credential_bindings .contains_key("GITHUB_TOKEN") ); - assert_eq!(snapshot.non_secret_environment_keys, ["CUSTOM_UNSET"]); + assert_eq!( + snapshot.non_secret_environment_keys, + [ + "CUSTOM_MISSING", + "CUSTOM_MODE", + "CUSTOM_PROJECT", + "CUSTOM_UNSET" + ] + ); + } + + #[tokio::test] + async fn caller_environment_revision_tracks_effective_non_secret_values() { + let state = test_server_state().await; + let mut provider = test_provider("work-gcp", "google-cloud"); + provider.credentials.clear(); + state.store.put_message(&provider).await.unwrap(); + let sandbox = test_sandbox( + "sb-caller-revision", + "caller-revision", + ProtoSandboxPolicy::default(), + vec!["work-gcp".to_string()], + ); + let mut inputs = load_sandbox_config_inputs(&state, sandbox).await.unwrap(); + let mut revisions = Vec::new(); + for (spec_value, template_value, unrelated, expected) in [ + (None, None, "one", None), + ( + None, + Some("template-project"), + "one", + Some("template-project"), + ), + ( + Some("caller-project"), + Some("template-project"), + "one", + Some("caller-project"), + ), + ( + Some("caller-project"), + Some("shadowed-project"), + "two", + Some("caller-project"), + ), + (Some(""), Some("template-project"), "one", Some("")), + ] { + let spec = inputs.sandbox.spec.as_mut().unwrap(); + spec.environment = HashMap::from([("UNRELATED".to_string(), unrelated.to_string())]); + if let Some(value) = spec_value { + spec.environment + .insert("GCP_PROJECT_ID".to_string(), value.to_string()); + } + spec.template + .get_or_insert_with(Default::default) + .environment = template_value + .map(|value| HashMap::from([("GCP_PROJECT_ID".to_string(), value.to_string())])) + .unwrap_or_default(); + let config = build_sandbox_config_snapshot_from_inputs(&state, &inputs) + .await + .unwrap(); + let snapshot = + build_provider_environment_snapshot_from_inputs(&state, &inputs, true, true) + .await + .unwrap(); + assert_eq!(config.provider_env_revision, snapshot.provider_env_revision); + let value = snapshot + .values + .iter() + .find(|value| value.name == "GCP_PROJECT_ID"); + assert_eq!(value.map(|value| value.value.as_str()), expected); + if let Some(value) = value { + assert_eq!( + value.classification, + ProviderEnvironmentValueClassification::NonSecret as i32 + ); + } + revisions.push(snapshot.provider_env_revision); + } + assert_ne!(revisions[0], revisions[1]); + assert_ne!(revisions[1], revisions[2]); + assert_eq!(revisions[2], revisions[3]); + assert_ne!(revisions[2], revisions[4]); + assert_ne!(revisions[0], revisions[4]); + } + + #[tokio::test] + async fn caller_environment_does_not_reclassify_expired_credentials_as_non_secret() { + let state = test_server_state().await; + let mut provider = test_provider("work-gcp", "google-cloud"); + provider.credentials.clear(); + state.store.put_message(&provider).await.unwrap(); + let mut legacy_provider = test_provider("legacy-project", "legacy-custom"); + legacy_provider.credentials = + HashMap::from([("GCP_PROJECT_ID".to_string(), "expired-secret".to_string())]); + legacy_provider.credential_expiration_times.insert( + "GCP_PROJECT_ID".to_string(), + openshell_core::time::timestamp_from_millis(1).unwrap(), + ); + state.store.put_message(&legacy_provider).await.unwrap(); + let mut sandbox = test_sandbox( + "sb-caller-expired", + "caller-expired", + ProtoSandboxPolicy::default(), + vec!["work-gcp".to_string(), "legacy-project".to_string()], + ); + sandbox + .spec + .as_mut() + .unwrap() + .environment + .insert("GCP_PROJECT_ID".to_string(), "caller-project".to_string()); + + let snapshot = load_sandbox_provider_environment(&state, &sandbox, true, true) + .await + .unwrap(); + assert!(!snapshot.environment.contains_key("GCP_PROJECT_ID")); + assert!( + !snapshot + .non_secret_environment_keys + .iter() + .any(|key| key == "GCP_PROJECT_ID") + ); } #[tokio::test] diff --git a/crates/openshell-server/src/grpc/provider.rs b/crates/openshell-server/src/grpc/provider.rs index a43d80cad3..c318b3bf82 100644 --- a/crates/openshell-server/src/grpc/provider.rs +++ b/crates/openshell-server/src/grpc/provider.rs @@ -38,7 +38,7 @@ use openshell_policy::ProviderPolicyLayer; use openshell_providers::LEGACY_VERTEX_PRIVATE_KEY_ENV; use prost::Message; use sha2::{Digest, Sha256}; -use std::collections::{HashMap, HashSet}; +use std::collections::{BTreeMap, HashMap, HashSet}; use tonic::Status; use tracing::warn; @@ -2253,6 +2253,57 @@ fn validate_provider_environment_records_unique_at( Ok(()) } +/// Effective caller values for declared non-secret destinations only. Reserve +/// credential keys even when their values are missing, expired, or withheld. +pub(super) fn non_secret_provider_environment_overrides( + catalog: &EffectiveProviderProfileCatalog, + records: &[ProviderEnvironmentRecord], + sandbox: &Sandbox, +) -> BTreeMap { + let Some(spec) = sandbox.spec.as_ref() else { + return BTreeMap::new(); + }; + let mut destinations = HashSet::new(); + let mut credential_keys = reserved_bootstrap_credential_keys(); + for record in records { + let provider = &record.provider; + credential_keys.extend(provider.credentials.keys().cloned()); + credential_keys.extend(provider.credential_handles.keys().cloned()); + for state in &record.refresh_states { + credential_keys.insert(state.credential_key.clone()); + credential_keys.extend(state.additional_output_keys.values().cloned()); + } + if let Some(profile) = get_provider_type_profile_for_scope( + catalog, + &provider.r#type, + &provider.profile_workspace, + ) { + destinations.extend(profile.environment.config.keys().cloned()); + destinations.extend(profile.environment.fixed.keys().cloned()); + credential_keys.extend( + profile + .credentials + .iter() + .flat_map(|credential| credential.accepted_stored_keys()) + .map(str::to_string), + ); + credential_keys.extend(broker_only_provider_credential_keys(&profile.to_proto())); + } + } + destinations + .into_iter() + .filter(|key| is_valid_env_key(key) && !credential_keys.contains(key)) + .filter_map(|key| { + let value = spec.environment.get(&key).or_else(|| { + spec.template + .as_ref() + .and_then(|template| template.environment.get(&key)) + })?; + Some((key, value.clone())) + }) + .collect() +} + fn provider_profile_environment_values( catalog: &EffectiveProviderProfileCatalog, provider: &Provider, diff --git a/docs/how-it-works/providers/google.mdx b/docs/how-it-works/providers/google.mdx index 37d89bf5e4..6c937e9fef 100644 --- a/docs/how-it-works/providers/google.mdx +++ b/docs/how-it-works/providers/google.mdx @@ -172,6 +172,13 @@ as placeholders for proxy-time resolution. | `CLOUD_ML_REGION` | from `region` config | GCP region | | `GCP_LOCATION` | from `region` config | Alternative region var | +For each non-secret variable, a sandbox create-time value overrides its template +value, which overrides the provider default. The metadata project-ID endpoint +uses the effective `GCP_PROJECT_ID`, including an explicitly empty value. A caller +can supply it even when the provider has no `project_id` config. OpenShell resolves +aliases independently; set both `GCP_PROJECT_ID` and `GOOGLE_CLOUD_PROJECT` when +overriding the project so SDKs that read different variables agree. + ## Using with GCP APIs The metadata emulator serves tokens with the `cloud-platform` OAuth2 scope, diff --git a/docs/how-it-works/providers/profiles.mdx b/docs/how-it-works/providers/profiles.mdx index 02919d7153..91030e12bc 100644 --- a/docs/how-it-works/providers/profiles.mdx +++ b/docs/how-it-works/providers/profiles.mdx @@ -67,8 +67,10 @@ discovery: `environment.config` maps each destination environment variable to a provider config key. OpenShell trims the config value and skips missing or blank values. `environment.fixed` supplies literal values, including an explicitly empty -string. Sandbox template and create-time environment values, including an -explicitly empty value, take precedence over these non-secret defaults. +string. Create-time environment values take precedence over sandbox template +values, which take precedence over these non-secret defaults. Overrides preserve +explicitly empty values. Supervisor metadata services read the same effective +non-secret values as the workload. Provider credential keys remain credential-owned and reach the workload as opaque placeholders. diff --git a/e2e/python/test_sandbox_providers.py b/e2e/python/test_sandbox_providers.py index 6b3d8698db..3041cb3cce 100644 --- a/e2e/python/test_sandbox_providers.py +++ b/e2e/python/test_sandbox_providers.py @@ -454,22 +454,53 @@ def read_token() -> str: @pytest.mark.parametrize( - ("service_account_email", "provider_suffix"), + ( + "service_account_email", + "provider_project", + "spec_project", + "template_project", + "provider_suffix", + ), [ - (None, "no-email"), - ("", "empty-email"), - ("sdk@metadata-test-project.iam.gserviceaccount.com", "configured-email"), + (None, "metadata-test-project", None, None, "no-email"), + ("", "metadata-test-project", None, None, "empty-email"), + ( + "sdk@metadata-test-project.iam.gserviceaccount.com", + "metadata-test-project", + None, + None, + "configured-email", + ), + (None, "provider-project", None, "template-project", "template-project"), + ( + None, + "provider-project", + "caller-project", + "template-project", + "spec-project", + ), + (None, None, "caller-project", None, "missing-provider-project"), + ], + ids=[ + "no-email", + "empty-email", + "configured-email", + "template-project", + "spec-project", + "missing-provider-project", ], - ids=["no-email", "empty-email", "configured-email"], ) def test_google_metadata_sdk_discovery( sandbox: Callable[..., Sandbox], sandbox_client: SandboxClient, service_account_email: str | None, + provider_project: str | None, + spec_project: str | None, + template_project: str | None, provider_suffix: str, ) -> None: """Google's SDK discovers project/account metadata and refreshes a placeholder.""" - config = {"project_id": "metadata-test-project"} + config = {"project_id": provider_project} if provider_project is not None else {} if service_account_email is not None: config["service_account_email"] = service_account_email with provider( @@ -497,6 +528,14 @@ def test_google_metadata_sdk_discovery( ) ) spec = datamodel_pb2.SandboxSpec(policy=policy, providers=[provider_name]) + if spec_project is not None: + spec.environment["GCP_PROJECT_ID"] = spec_project + if template_project is not None: + spec.template.CopyFrom( + openshell_pb2.SandboxTemplate( + environment={"GCP_PROJECT_ID": template_project} + ) + ) def discover_metadata() -> str: import json @@ -526,6 +565,7 @@ def discover_metadata() -> str: return json.dumps( { "project": project, + "environment_project": os.environ.get("GCP_PROJECT_ID"), "account": credentials.service_account_email, "token": credentials.token, "expiry_present": credentials.expiry is not None, @@ -538,7 +578,9 @@ def discover_metadata() -> str: result = sb.exec_python(discover_metadata) assert result.exit_code == 0, result.stderr data = json.loads(result.stdout) - assert data["project"] == "metadata-test-project" + expected_project = spec_project or template_project or provider_project + assert data["project"] == expected_project + assert data["environment_project"] == expected_project assert data["account"] == (service_account_email or "default") assert data["metadata_host"] == data["metadata_ip"] == "127.0.0.1:8174" assert data["expiry_present"]