[TaylorMutch]

Summary

Route CLI gateway connections through openshell-sdk so TLS, mTLS, OIDC headers, insecure TLS, and Cloudflare edge transport have one owner. Existing commands retain generated RPC coverage through the SDK's raw client while the CLI drops its duplicate transport implementation and direct transport dependencies.

Related Issue

Closes #4816

Changes

• Add an in-memory mTLS client identity to the Rust SDK configuration and transport.
• Adapt the CLI's filesystem-aware TLS options into SDK client configuration.
• Create the CLI's raw gRPC client and dynamic completion client through openshell-sdk.
• Remove the CLI edge tunnel implementation and its direct tokio-rustls, tokio-tungstenite, and tower dependencies.

Release Notes

Testing

• Checks appropriate to the affected code and behavior pass
• Existing SDK and CLI unit tests pass
• Existing provider integration coverage passes against a server that requires a client certificate
• E2E tests added/updated (not applicable; sandbox and deployment behavior is unchanged)

Commands run:

• cargo fmt --all -- --check
• cargo check -p openshell-sdk -p openshell-cli
• cargo test -p openshell-sdk
• cargo test -p openshell-cli --lib tls::tests
• cargo test -p openshell-cli --test provider_commands_integration provider_list_json_empty -- --exact
• cargo clippy -p openshell-sdk --all-targets -- -D warnings
• cargo clippy -p openshell-cli --all-targets -- -D warnings
• git diff --check

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; the SDK README documents the new configuration field)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for dbe5aba. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. cli — No explicit risk acceptance found

openshell_cli::edge_tunnel and tls::build_tonic_tls_config were removed, while tls::GrpcClient changed from the core interceptor client to the SDK interceptor client.

• Impact: Rust consumers importing those helpers or constructing the previous GrpcClient type fail to compile after this patch update.
• Action: Restore deprecated CLI re-exports, a compatibility wrapper, and the prior alias contract for v0.1.6, or defer their removal to an allowed train with migration guidance.
• PR: refactor(cli): use Rust SDK transport #4817

Review details

• Execution: complete
• Candidate: PR #4817 (e7086d44043ad90a06c3d71364deb344665d7454)
• Baseline: 1d880c9acdf0bbd5b5cedeba26c9ee37bb0a5c97 (1d880c9acdf0bbd5b5cedeba26c9ee37bb0a5c97)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[TaylorMutch]

Rust consumers should consume from the SDK not the CLI.