feat(supervisor): expose sandbox name to middleware request context

[letv1nnn]

Summary

Adds the originating sandbox name to the supervisor middleware request context. Operator-run middleware already receives the sandbox ID; passing the name alongside it lets audit and approval interfaces show a human-readable identifier instead of an opaque UUID, using data the supervisor already owns.

Related Issue

Closes NVIDIA#2754

Changes

• Add sandbox_name field to RequestContext in proto/supervisor_middleware.proto; existing field numbers are unchanged for wire compatibility.
• Add sandbox_name to openshell_supervisor_middleware::HttpRequestInput and carry it into the gRPC RequestContext.
• Populate sandbox_id and sandbox_name from the process-wide openshell_ocsf::SandboxContext when the network supervisor builds middleware input.
• Inject the SandboxContext into middleware_request_input instead of reading the global inside it, making the identifier copy unit-testable with a real name.
• Document the request-context identifiers and their empty-string fallback in docs/extensibility/supervisor-middleware.mdx.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

Summary by CodeRabbit

• New Features

  • Middleware request context now includes the originating sandbox’s ID and name.
  • Added sandbox name information to HTTP and WebSocket request metadata for downstream services.

• Documentation

  • Documented sandbox identity availability and fallback behavior when a name is unavailable.

• Bug Fixes

  • Preserved the correct sandbox identity across buffered, unbuffered, and WebSocket middleware request paths.
  • Improved cross-platform compatibility for container-related functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7ffa2c98-b0e0-4ac8-85e9-cb84e6b9685d

📥 Commits

Reviewing files that changed from the base of the PR and between 9fc5d13 and 8ce06aa.

📒 Files selected for processing (9)

• crates/openshell-driver-podman/src/container.rs
• crates/openshell-supervisor-middleware/src/lib.rs
• crates/openshell-supervisor-middleware/src/websocket.rs
• crates/openshell-supervisor-network/src/l7/middleware.rs
• crates/openshell-supervisor-network/src/l7/relay.rs
• crates/openshell-supervisor-network/src/l7/websocket.rs
• crates/openshell-supervisor-network/src/opa.rs
• docs/extensibility/supervisor-middleware.mdx
• proto/supervisor_middleware.proto

💤 Files with no reviewable changes (2)

• crates/openshell-supervisor-network/src/l7/websocket.rs
• crates/openshell-supervisor-middleware/src/lib.rs

🚧 Files skipped from review as they are similar to previous changes (3)

• proto/supervisor_middleware.proto
• docs/extensibility/supervisor-middleware.mdx
• crates/openshell-supervisor-network/src/l7/middleware.rs

Included review availability: Your plan includes up to 3 reviews per rolling hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

Middleware request context now carries both the originating sandbox ID and name. Network middleware obtains these values from the explicit OCSF sandbox context. Protobuf definitions, tests, documentation, and platform imports reflect the changes.

Changes

Sandbox identity propagation

Layer / File(s)	Summary
Request context contract and propagation proto/supervisor_middleware.proto, crates/openshell-supervisor-middleware/src/lib.rs, crates/openshell-supervisor-middleware/src/websocket.rs	RequestContext, HttpRequestInput, and WebSocketPreflightInput include sandbox_name. HTTP and WebSocket evaluation propagates both sandbox identity fields.
Network input construction crates/openshell-supervisor-network/src/l7/middleware.rs, crates/openshell-supervisor-network/src/l7/relay.rs, crates/openshell-supervisor-network/src/l7/websocket.rs, crates/openshell-supervisor-network/src/opa.rs	Network middleware passes the explicit SandboxContext into request input construction. Tests verify sandbox ID and name handling.
Middleware context documentation docs/extensibility/supervisor-middleware.mdx	The documentation describes the sandbox identity fields and name fallback behavior.

Platform import cleanup

Layer / File(s)	Summary
Cross-platform path import crates/openshell-driver-podman/src/container.rs	The Path import is no longer limited to Linux targets.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 8ce06

This change adds the sandbox name to middleware request context with an empty-string fallback and preserves existing wire field numbers; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: pimlock, shiju-nv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes exposing the sandbox name through the supervisor middleware request context.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch expose-sandbox-name-to-supervisor-middleware

---

_{Comment @coderabbitai help to get the list of available commands.}