Merge branch 'main' into mgrossman/remove-sandbox-user

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

examples/agent-driven-policy-management/demo.sh

@@ -34,7 +34,7 @@ DEMO_BRANCH="${DEMO_BRANCH:-main}"
 DEMO_RUN_ID="${DEMO_RUN_ID:-$(date +%Y%m%d-%H%M%S)}"
 DEMO_FILE_DIR="${DEMO_FILE_DIR:-openshell-policy-advisor-demo}"
 DEMO_FILE_PATH="${DEMO_FILE_DIR}/${DEMO_RUN_ID}.md"
-DEMO_SANDBOX_NAME="${DEMO_SANDBOX_NAME:-policy-demo-${DEMO_RUN_ID}}"
+DEMO_SANDBOX_NAME="${DEMO_SANDBOX_NAME:-pd-${DEMO_RUN_ID}}"
 DEMO_CODEX_PROVIDER_NAME="${DEMO_CODEX_PROVIDER_NAME:-codex-policy-demo-${DEMO_RUN_ID}}"
 DEMO_GITHUB_PROVIDER_NAME="${DEMO_GITHUB_PROVIDER_NAME:-github-policy-demo-${DEMO_RUN_ID}}"
 DEMO_CODEX_MODEL="${DEMO_CODEX_MODEL:-gpt-5.4-mini}"

examples/governance-interceptor/Cargo.lock

@@ -865,6 +865,7 @@ name = "openshell-core"
 version = "0.0.0"
 dependencies = [
  "base64",
+ "glob",
  "ipnet",
  "miette",
  "prost",
@@ -907,6 +908,7 @@ version = "0.0.0"
 dependencies = [
  "miette",
  "openshell-core",
+ "prost-types",
  "serde",
  "serde_json",
  "serde_yml",

examples/governance-interceptor/smoke.sh

@@ -53,7 +53,9 @@ if [[ "$RUN_TEST_SUITE" -eq 1 ]]; then
 else
   RUN_ID="governance-interactive-$$-$RANDOM"
 fi
-SANDBOX_NAME="$RUN_ID-sandbox"
+# Sandbox names are capped at 19 characters. Use a short prefix with
+# the PID for uniqueness; the full RUN_ID is kept for log directory naming.
+SANDBOX_NAME="gs-$$-$RANDOM"
 
 mkdir -p "$LOG_DIR" "$PROFILE_DIR"
 cp "$EXAMPLE_DIR"/profiles/*.yaml "$PROFILE_DIR"/

examples/governance-interceptor/src/main.rs

@@ -1235,6 +1235,8 @@ async fn propagate_policy_to_running_sandboxes(
                 limit,
                 offset,
                 label_selector: String::new(),
+                workspace: String::new(),
+                all_workspaces: true,
             })
             .await
             .map_err(|status| format!("list sandboxes failed: {status}"))?

examples/multi-agent-notepad/demo.sh

@@ -14,6 +14,10 @@ DEMO_TOPIC="${DEMO_TOPIC:-How should teams evaluate sandboxed coding agents?}"
 DEMO_AGENT_COUNT="${DEMO_AGENT_COUNT:-5}"
 DEMO_BRANCH="${DEMO_BRANCH:-main}"
 DEMO_RUN_ID="${DEMO_RUN_ID:-$(date +%Y%m%d-%H%M%S)}"
+# Sandbox names are capped at 19 characters. Derive a short tag from the
+# run ID for sandbox naming while keeping the full ID for providers and
+# GitHub paths.
+SANDBOX_TAG="${DEMO_RUN_ID:2:12}"  # e.g. "260718-12345" (12 chars)
 DEMO_KEEP_SANDBOXES="${DEMO_KEEP_SANDBOXES:-0}"
 DEMO_CODEX_PROVIDER_NAME="${DEMO_CODEX_PROVIDER_NAME:-codex-oauth-${DEMO_RUN_ID}}"
 DEMO_GITHUB_PROVIDER_NAME="${DEMO_GITHUB_PROVIDER_NAME:-github-memory-${DEMO_RUN_ID}}"
@@ -63,9 +67,9 @@ cleanup() {
 
     if [[ "$DEMO_KEEP_SANDBOXES" != "1" ]]; then
         for i in $(seq 1 "$DEMO_AGENT_COUNT"); do
-            "$OPENSHELL_BIN" sandbox delete "codex-gh-${DEMO_RUN_ID}-a${i}" >/dev/null 2>&1 || true
+            "$OPENSHELL_BIN" sandbox delete "mn-${SANDBOX_TAG}-a${i}" >/dev/null 2>&1 || true
         done
-        "$OPENSHELL_BIN" sandbox delete "codex-gh-${DEMO_RUN_ID}-summary" >/dev/null 2>&1 || true
+        "$OPENSHELL_BIN" sandbox delete "mn-${SANDBOX_TAG}-sum" >/dev/null 2>&1 || true
     else
         printf "\n${YELLOW}Keeping sandboxes because DEMO_KEEP_SANDBOXES=1.${RESET}\n"
     fi
@@ -167,7 +171,7 @@ run_sandbox() {
 run_worker() {
     local index="$1"
     local slice_index=$(( (index - 1) % ${#WORKER_SLICES[@]} ))
-    local name="codex-gh-${DEMO_RUN_ID}-a${index}"
+    local name="mn-${SANDBOX_TAG}-a${index}"
     run_sandbox "$name" worker "$DEMO_GITHUB_OWNER" "$DEMO_GITHUB_REPO" "$DEMO_BRANCH" "$DEMO_RUN_ID" "$index" "$DEMO_AGENT_COUNT" "$DEMO_TOPIC" "${WORKER_SLICES[$slice_index]}"
 }
 
@@ -197,7 +201,7 @@ run_workers() {
 }
 
 run_synthesis() {
-    local name="codex-gh-${DEMO_RUN_ID}-summary"
+    local name="mn-${SANDBOX_TAG}-sum"
     run_sandbox "$name" synthesis "$DEMO_GITHUB_OWNER" "$DEMO_GITHUB_REPO" "$DEMO_BRANCH" "$DEMO_RUN_ID" "0" "$DEMO_AGENT_COUNT" "$DEMO_TOPIC" \
         >"${LOG_DIR}/summary.log" 2>&1 || {
             printf "\n${RED}synthesis failed; log follows:${RESET}\n"

examples/vscode-remote-sandbox.md

@@ -32,7 +32,7 @@ To reopen an existing sandbox in VS Code:
 openshell sandbox connect my-sandbox --editor vscode
 ```
 
-OpenShell maintains the generated `Host openshell-my-sandbox` entry in its own
+OpenShell maintains the generated `Host openshell-my-sandbox.default` entry in its own
 managed SSH config include file.
 
 ### 3. Optional manual workflow
@@ -40,7 +40,7 @@ managed SSH config include file.
 If you want to inspect the generated SSH stanza directly:
 
 ```text
-Host openshell-my-sandbox
+Host openshell-my-sandbox.default
     User sandbox
     StrictHostKeyChecking no
     UserKnownHostsFile /dev/null
@@ -58,13 +58,13 @@ openshell sandbox ssh-config my-sandbox
 ### 4. Open VS Code manually
 
 Open VSCode and run **Remote-SSH: Connect to Host...** from the command
-palette (`Cmd+Shift+P` / `Ctrl+Shift+P`). Select `openshell-my-sandbox` from the
+palette (`Cmd+Shift+P` / `Ctrl+Shift+P`). Select `openshell-my-sandbox.default` from the
 list. VSCode will open a remote window connected to the sandbox.
 
 Alternatively, from the terminal:
 
 ```bash
-code --remote ssh-remote+openshell-my-sandbox /sandbox
+code --remote ssh-remote+openshell-my-sandbox.default /sandbox
 ```
 
 ### 5. Clean up