fix: restore compatibility with openshell 0.0.85 and OCP deploy

.github/workflows/integration.yml

@@ -18,7 +18,11 @@ jobs:
           go-version-file: go.mod
 
       - name: Install openshell
-        run: curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
+        # Pin to the same version the gateway charts deploy (profiles/gateways/*.yaml).
+        # The install script otherwise grabs the latest tagged release, which can
+        # drift past the chart's supervisor image and break the sandbox ssh/tar
+        # relay with "supervisor session not found".
+        run: curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.85 sh
 
       - name: Wait for gateway
         run: |
@@ -61,7 +65,11 @@ jobs:
           go-version-file: go.mod
 
       - name: Install openshell
-        run: curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
+        # Pin to the same version the gateway charts deploy (profiles/gateways/*.yaml).
+        # The install script otherwise grabs the latest tagged release, which can
+        # drift past the chart's supervisor image and break the sandbox ssh/tar
+        # relay with "supervisor session not found".
+        run: curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.85 sh
 
       - name: Wait for gateway
         run: |

cmd/apply.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -91,7 +92,14 @@ then deploy a sandbox. Use --dry-run to validate without deploying, or
 			}
 
 			gw := gateway.New(cli)
-			if err := gw.CheckMinVersion("0.0.59"); err != nil {
+			if err := gw.CheckMinVersion("0.0.85"); err != nil {
+				// A CLI that is definitively too old will fail deployment later
+				// with far less context, so refuse up front. If we merely could
+				// not read/parse the version, warn and proceed — the CLI may
+				// still be usable and we don't want to block on a format change.
+				if errors.Is(err, gateway.ErrVersionBelowMinimum) {
+					return fmt.Errorf("incompatible openshell CLI: %w", err)
+				}
 				status.Warn(fmt.Sprintf("OpenShell version: %v", err))
 			}
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/stackrox/harness-openshell
 
-go 1.22.4
+go 1.25.0
 
 require (
 	github.com/spf13/cobra v1.10.2

internal/gateway/cli.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -13,6 +14,12 @@ import (
 	"github.com/stackrox/harness-openshell/internal/status"
 )
 
+// ErrVersionBelowMinimum is returned (wrapped) by CheckMinVersion when the
+// installed openshell CLI is definitively older than the required minimum.
+// Callers can distinguish this from a version we simply couldn't read
+// (empty/unparseable output) via errors.Is and treat it as a hard failure.
+var ErrVersionBelowMinimum = errors.New("openshell version below minimum")
+
 var ansiRE = regexp.MustCompile(`\x1b\[[0-9;]*m`)
 
 // CLI implements Gateway by shelling out to the openshell binary.
@@ -87,7 +94,7 @@ func (c *CLI) CheckMinVersion(minVersion string) error {
 		return fmt.Errorf("invalid minimum version %q", minVersion)
 	}
 	if iMaj < mMaj || (iMaj == mMaj && iMin < mMin) || (iMaj == mMaj && iMin == mMin && iPatch < mPatch) {
-		return fmt.Errorf("openshell %s is below minimum %s (upgrade: openshell update)", installed, minVersion)
+		return fmt.Errorf("openshell %s is below minimum %s (upgrade: openshell update): %w", installed, minVersion, ErrVersionBelowMinimum)
 	}
 	return nil
 }
@@ -225,7 +232,9 @@ func (c *CLI) GatewayAdd(endpoint, name string, local, insecure bool) error {
 		args = append(args, "--local")
 	}
 	if insecure {
-		args = append(args, "--insecure")
+		// The per-command --insecure flag was removed; openshell now exposes
+		// this as the global --gateway-insecure flag (verified against v0.0.85).
+		args = append(args, "--gateway-insecure")
 	}
 	return c.silent(args...)
 }

internal/gateway/cli_test.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -407,8 +408,14 @@ func TestCheckMinVersion_Below(t *testing.T) {
 echo "openshell v0.0.57"
 `)
 	gw := New(bin)
-	if err := gw.CheckMinVersion("0.0.59"); err == nil {
-		t.Error("expected error for version below minimum")
+	err := gw.CheckMinVersion("0.0.59")
+	if err == nil {
+		t.Fatal("expected error for version below minimum")
+	}
+	// A definitively-old CLI must report ErrVersionBelowMinimum so callers can
+	// treat it as a hard failure rather than a warning.
+	if !errors.Is(err, ErrVersionBelowMinimum) {
+		t.Errorf("error = %v, want wrapping ErrVersionBelowMinimum", err)
 	}
 }
 
@@ -434,8 +441,14 @@ echo "openshell v0.0.60"
 
 func TestCheckMinVersion_NoCLI(t *testing.T) {
 	gw := New("/nonexistent/openshell")
-	if err := gw.CheckMinVersion("0.0.59"); err == nil {
-		t.Error("expected error when CLI not found")
+	err := gw.CheckMinVersion("0.0.59")
+	if err == nil {
+		t.Fatal("expected error when CLI not found")
+	}
+	// An unreadable version is NOT a below-minimum failure: callers should warn
+	// and proceed, not hard-fail, so it must not wrap ErrVersionBelowMinimum.
+	if errors.Is(err, ErrVersionBelowMinimum) {
+		t.Errorf("error = %v, should not wrap ErrVersionBelowMinimum", err)
 	}
 }
 
@@ -531,6 +544,24 @@ printf '%s\n' "$*" > `+argsFile+`
 	}
 }
 
+func TestGatewayAdd_Insecure(t *testing.T) {
+	dir := t.TempDir()
+	argsFile := filepath.Join(dir, "args")
+	bin := writeStub(t, `#!/bin/bash
+printf '%s\n' "$*" > `+argsFile+`
+`)
+	gw := New(bin)
+	gw.GatewayAdd("https://gw.example.com:443", "my-ocp", false, true)
+	data, _ := os.ReadFile(argsFile)
+	args := strings.TrimSpace(string(data))
+	if !strings.Contains(args, "--gateway-insecure") {
+		t.Errorf("expected --gateway-insecure in: %s", args)
+	}
+	if strings.Contains(args, " --insecure") {
+		t.Errorf("stale --insecure flag present in: %s", args)
+	}
+}
+
 func TestGatewayRemove(t *testing.T) {
 	bin := writeStub(t, `#!/bin/bash
 exit 0

internal/gateway/config.go

@@ -151,7 +151,13 @@ func (c *GatewayConfig) applyDefaults() {
 		c.Chart.OCI = "oci://ghcr.io/nvidia/openshell/helm-chart"
 	}
 	if c.Chart.CRD.URL == "" {
-		c.Chart.CRD.URL = "https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/manifest.yaml"
+		// Pin to the agent-sandbox release OpenShell itself pins (see the
+		// upstream e2e/with-kube-gateway.sh + helm-k3s-local.sh, which use
+		// AGENT_SANDBOX_VERSION=v0.5.0). v0.5.0's manifest.yaml carries both the
+		// v1beta1 and v1alpha1 Sandbox APIs plus the controller. Do NOT track
+		// releases/latest: latest moved to v0.5.6, which renamed the manifest.yaml
+		// asset to sandbox.yaml and would 404 here.
+		c.Chart.CRD.URL = "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.5.0/manifest.yaml"
 	}
 }
 

profiles/gateways/helm.yaml

@@ -17,7 +17,11 @@ gateway:
   mode: direct
 
 chart:
-  version: "0.0.59"
+  # Keep in lockstep with the openshell CLI version (see openshift.yaml and the
+  # OPENSHELL_VERSION pin in .github/workflows/integration.yml). The chart
+  # version determines the supervisor image tag; if it lags the CLI, sandbox
+  # create fails with "supervisor session not found" during the ssh/tar upload.
+  version: "0.0.85"
 
 helm:
   values:

profiles/gateways/openshift.yaml

@@ -11,7 +11,7 @@ gateway:
   name: openshell-remote-ocp
 
 chart:
-  version: "0.0.59"
+  version: "0.0.85"
 
 helm:
   values: