feat(cli): add --output json/yaml to sandbox get, status, and sandbox create

.github/workflows/branch-e2e.yml

@@ -115,12 +115,22 @@ jobs:
   kubernetes-e2e:
     needs: [pr_metadata, build-gateway, build-supervisor]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - agent_sandbox_api: v1beta1
+            agent_sandbox_version: v0.5.0
+          - agent_sandbox_api: v1alpha1
+            agent_sandbox_version: v0.4.6
     permissions:
       contents: read
       packages: read
     uses: ./.github/workflows/e2e-kubernetes-test.yml
     with:
       image-tag: ${{ github.sha }}
+      job-name: Kubernetes E2E (Rust smoke, Agent Sandbox ${{ matrix.agent_sandbox_api }})
+      agent-sandbox-version: ${{ matrix.agent_sandbox_version }}
 
   kubernetes-ha-e2e:
     needs: [pr_metadata, build-gateway, build-supervisor]

.github/workflows/docker-build.yml

@@ -84,13 +84,13 @@ jobs:
             gateway)
               binary_component=gateway
               binary_name=openshell-gateway
-              features="openshell-core/dev-settings bundled-z3"
+              features="bundled-z3"
               has_image=true
               ;;
             supervisor)
               binary_component=sandbox
               binary_name=openshell-sandbox
-              features="openshell-core/dev-settings"
+              features=""
               has_image=true
               ;;
             cli)

.github/workflows/e2e-kubernetes-test.yml

@@ -32,6 +32,11 @@ on:
         required: false
         type: string
         default: ""
+      agent-sandbox-version:
+        description: "Agent Sandbox release to install before OpenShell"
+        required: false
+        type: string
+        default: "v0.5.0"
       mise-version:
         description: "mise version to install on the bare Kubernetes e2e runner"
         required: false
@@ -114,6 +119,7 @@ jobs:
 
       - name: Run Kubernetes E2E (Rust smoke)
         env:
+          AGENT_SANDBOX_VERSION: ${{ inputs.agent-sandbox-version }}
           OPENSHELL_E2E_KUBE_CONTEXT: kind-${{ env.KIND_CLUSTER_NAME }}
           OPENSHELL_E2E_KUBE_EXTRA_VALUES: ${{ inputs.extra-helm-values }}
           OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET: ${{ inputs.external-postgres-secret }}

.github/workflows/e2e-test.yml

@@ -44,6 +44,9 @@ jobs:
             cmd: "mise run --no-deps --skip-deps e2e:podman:rootless"
             apt_packages: "openssh-client podman uidmap"
             rootless: true
+          - suite: mcp
+            cmd: "mise run --no-deps --skip-deps e2e:mcp"
+            apt_packages: ""
     container:
       image: ghcr.io/nvidia/openshell/ci:latest
       credentials:
@@ -65,6 +68,17 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs['checkout-ref'] || github.sha }}
+          persist-credentials: false
+
+      - name: Check out MCP conformance tests
+        if: matrix.suite == 'mcp'
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          repository: modelcontextprotocol/conformance
+          # Pin after v0.1.16 to include the tools_call client scenario fix.
+          ref: b9041ea41b0188581803459dbae71bc7e02fd995
+          path: .cache/mcp-conformance
+          persist-credentials: false
 
       - name: Install OS test dependencies
         if: matrix.apt_packages != ''
@@ -104,6 +118,7 @@ jobs:
       - name: Run tests
         env:
           OPENSHELL_SUPERVISOR_IMAGE: ${{ format('ghcr.io/nvidia/openshell/supervisor:{0}', inputs.image-tag) }}
+          OPENSHELL_MCP_CONFORMANCE_CLIENT_IMAGE: ${{ format('openshell-mcp-conformance-client:{0}', inputs.image-tag) }}
           E2E_CMD: ${{ matrix.cmd }}
         run: |
           if [ "${{ matrix.rootless }}" = "true" ]; then

.github/workflows/release-canary.yml

@@ -208,7 +208,7 @@ jobs:
       KIND_GATEWAY_NAME: kind
     steps:
       - name: Install Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
       - name: Create kind cluster
         uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0

.github/workflows/release-dev.yml

@@ -679,7 +679,7 @@ jobs:
 
   smoke-linux-dev-artifacts:
     name: Smoke Linux Dev Artifacts (${{ matrix.name }})
-    needs: [build-gateway-binary-linux, build-driver-vm-linux, build-deb, build-rpm]
+    needs: [build-gateway-binary-linux, build-driver-vm-linux, build-deb, build-rpm, build-python-wheels-linux]
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -709,6 +709,18 @@ jobs:
             kind: rpm
             artifact_arch: arm64
             rpm_arch: aarch64
+          - name: python-wheel-amd64
+            runner: linux-amd64-cpu8
+            image: python:3.12-slim
+            kind: wheel
+            artifact_arch: amd64
+            rpm_arch: x86_64
+          - name: python-wheel-arm64
+            runner: linux-arm64-cpu8
+            image: python:3.12-slim
+            kind: wheel
+            artifact_arch: arm64
+            rpm_arch: aarch64
     runs-on: ${{ matrix.runner }}
     container:
       image: ${{ matrix.image }}
@@ -743,6 +755,25 @@ jobs:
           dnf install -y ./package-input/openshell-[0-9]*.rpm ./package-input/openshell-gateway-*.rpm
           LD_BIND_NOW=1 openshell-gateway --version
 
+      - name: Download Python wheel artifact
+        if: matrix.kind == 'wheel'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-wheels-linux-${{ matrix.artifact_arch }}
+          path: wheel-input/
+
+      - name: Smoke Python wheel
+        if: matrix.kind == 'wheel'
+        run: |
+          set -euo pipefail
+          pip install --no-cache-dir wheel-input/*.whl
+          python - <<'PY'
+          import importlib
+          for name in ("openshell", "openshell._proto", "openshell.sandbox"):
+              importlib.import_module(name)
+              print(name, "OK")
+          PY
+
   # ---------------------------------------------------------------------------
   # Create / update the dev GitHub Release with CLI, gateway, driver, and wheels
   # ---------------------------------------------------------------------------

.github/workflows/release-tag.yml

@@ -715,7 +715,7 @@ jobs:
 
   smoke-linux-release-artifacts:
     name: Smoke Linux Release Artifacts (${{ matrix.name }})
-    needs: [build-gateway-binary-linux, build-driver-vm-linux, build-deb, build-rpm]
+    needs: [build-gateway-binary-linux, build-driver-vm-linux, build-deb, build-rpm, build-python-wheels-linux]
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -763,6 +763,20 @@ jobs:
             artifact_arch: arm64
             rpm_arch: aarch64
             target: aarch64-unknown-linux-gnu
+          - name: python-wheel
+            runner: linux-amd64-cpu8
+            image: python:3.12-slim
+            kind: wheel
+            artifact_arch: amd64
+            rpm_arch: x86_64
+            target: x86_64-unknown-linux-gnu
+          - name: python-wheel-arm64
+            runner: linux-arm64-cpu8
+            image: python:3.12-slim
+            kind: wheel
+            artifact_arch: arm64
+            rpm_arch: aarch64
+            target: aarch64-unknown-linux-gnu
     runs-on: ${{ matrix.runner }}
     container:
       image: ${{ matrix.image }}
@@ -822,6 +836,25 @@ jobs:
           dnf install -y ./package-input/openshell-[0-9]*.rpm ./package-input/openshell-gateway-*.rpm
           LD_BIND_NOW=1 openshell-gateway --version
 
+      - name: Download Python wheel artifact
+        if: matrix.kind == 'wheel'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-wheels-linux-${{ matrix.artifact_arch }}
+          path: wheel-input/
+
+      - name: Smoke Python wheel
+        if: matrix.kind == 'wheel'
+        run: |
+          set -euo pipefail
+          pip install --no-cache-dir wheel-input/*.whl
+          python - <<'PY'
+          import importlib
+          for name in ("openshell", "openshell._proto", "openshell.sandbox"):
+              importlib.import_module(name)
+              print(name, "OK")
+          PY
+
   # ---------------------------------------------------------------------------
   # Create a tagged GitHub Release with CLI, gateway, driver, and wheels
   # ---------------------------------------------------------------------------

.github/workflows/rust-native-build.yml

@@ -30,7 +30,7 @@ on:
         description: "Cargo features to enable"
         required: false
         type: string
-        default: "openshell-core/dev-settings"
+        default: ""
       retention-days:
         description: "Artifact retention period"
         required: false

.gitignore

@@ -225,3 +225,7 @@ rfc.md
 
 # Markdown/mermaid lint tooling deps
 scripts/lint-mermaid/node_modules/
+
+# Nix
+/result
+/result-*