#!/bin/bash
set -euo pipefail

# Inspect the relevant section with line numbers
sed -n '2900,2975p' crates/openshell-driver-docker/src/lib.rs | cat -n

# Find the helper and related constants/usages
rg -n "CONTAINER_NAME_PREFIX|MAX_CONTAINER_NAME_LEN|trim_container_name_tail|id_suffix|container name" crates/openshell-driver-docker/src/lib.rs

# Show the full helper implementation if present nearby
ast-grep outline crates/openshell-driver-docker/src/lib.rs --view expanded | sed -n '1,220p'

#!/bin/bash
set -euo pipefail

# Inspect nearby tests and references to container_name_for_sandbox
rg -n "container_name_for_sandbox|MAX_CONTAINER_NAME_LEN|trim_container_name_tail|oversized|truncate" crates/openshell-driver-docker/src/lib.rs crates/openshell-driver-docker -g '*test*' -g '*.rs'

# Read the test module area around the relevant function
start=$(rg -n "^#\[cfg\(test\)\]" crates/openshell-driver-docker/src/lib.rs | head -n 1 | cut -d: -f1 || true)
if [ -n "${start:-}" ]; then
  sed -n "${start},$((start+260))p" crates/openshell-driver-docker/src/lib.rs | cat -n
fi

#!/bin/bash
set -euo pipefail

# Read the container-name tests around the relevant area
sed -n '1960,2045p' crates/openshell-driver-docker/src/tests.rs | cat -n

#!/bin/bash
set -euo pipefail

# Search for validation or limits on workspace/name lengths
rg -n "workspace.*len|name.*len|validate.*workspace|workspace.*validate|sandbox.*workspace|DriverSandboxTemplate|DriverSandbox" crates -g '*.rs'

# Inspect the sandbox validation area
sed -n '410,520p' crates/openshell-driver-docker/src/lib.rs | cat -n

python3 - <<'PY'
MAX_CONTAINER_NAME_LEN = 200
PREFIX = "openshell-"

def sanitize(value: str) -> str:
    out = []
    for ch in value:
        if ch.isascii() and (ch.isalnum() or ch in "_.-"):
            out.append(ch.lower())
        else:
            out.append("-")
    return "".join(out)

def trim_tail(value: str) -> str:
    while value and value[-1] in "-._":
        value = value[:-1]
    return value

def container_name(workspace: str, name: str, sid: str) -> str:
    id_suffix = sanitize(sid)
    workspace = sanitize(workspace)
    name = sanitize(name)

    if not name:
        base = f"{PREFIX}{workspace}---{id_suffix}"
        if len(base) > MAX_CONTAINER_NAME_LEN:
            base = base[:MAX_CONTAINER_NAME_LEN]
        return trim_tail(base)

    reserved = len(PREFIX) + len(workspace) + 2 + 1 + len(id_suffix)
    if reserved >= MAX_CONTAINER_NAME_LEN:
        base = f"{PREFIX}{workspace}---{id_suffix}"
        base = base[:MAX_CONTAINER_NAME_LEN]
        return trim_tail(base)

    budget = MAX_CONTAINER_NAME_LEN - reserved
    truncated_name = trim_tail(name[:budget]) if len(name) > budget else name
    return f"{PREFIX}{workspace}--{truncated_name}-{id_suffix}"

# Find examples where the ID suffix is truncated away.
cases = [
    ("w" * 180, "n", "id-1234567890"),
    ("w" * 190, "n", "id-1234567890"),
    ("w" * 195, "n", "id-1234567890"),
]
for ws, nm, sid in cases:
    cn = container_name(ws, nm, sid)
    print("len(workspace)=", len(ws), "len(id)=", len(sid), "len(name)=", len(cn), "endswith id?", cn.endswith(sanitize(sid)))
    print(cn)
    print()

# Search for a collision by varying only the ID while keeping a long workspace.
ws = "w" * 190
nm = "n"
a = container_name(ws, nm, "id-aaaaaaaaaaaaaaaaaaaaaaaaaaaa")
b = container_name(ws, nm, "id-bbbbbbbbbbbbbbbbbbbbbbbbbbbb")
print("collision?", a == b)
print(a)
print(b)
PY

#!/bin/bash
set -euo pipefail

# Map the relevant file and search for validation helpers and create_sandbox call sites.
ast-grep outline crates/openshell-driver-kubernetes/src/driver.rs --view expanded || true
printf '\n--- search ---\n'
rg -n "validate_sandbox_create|validate_kube_resource_name_length|create_sandbox\(" crates/openshell-driver-kubernetes/src/driver.rs crates/openshell-driver-kubernetes/src -S
printf '\n--- file excerpt around create_sandbox ---\n'
sed -n '780,900p' crates/openshell-driver-kubernetes/src/driver.rs
printf '\n--- file excerpt around validation helpers ---\n'
rg -n "fn validate_sandbox_create|fn validate_kube_resource_name_length|kube_resource_name\(" crates/openshell-driver-kubernetes/src/driver.rs -n -S

#!/bin/bash
set -euo pipefail
sed -n '1,260p' crates/openshell-driver-kubernetes/src/driver.rs

#!/bin/bash
set -euo pipefail
grep -n "validate_sandbox_create\|validate_kube_resource_name_length\|create_sandbox(" -n crates/openshell-driver-kubernetes/src/driver.rs
sed -n '820,880p' crates/openshell-driver-kubernetes/src/driver.rs

#!/bin/bash
set -euo pipefail

sed -n '1,160p' crates/openshell-driver-kubernetes/src/grpc.rs
printf '\n--- callers of create_sandbox within repo ---\n'
rg -n "\.create_sandbox\(" crates/openshell-driver-kubernetes/src -S

#!/bin/bash
set -euo pipefail

# Inspect how compute driver errors map to gRPC statuses.
rg -n "impl From<ComputeDriverError> for tonic::Status|enum ComputeDriverError|impl From<KubernetesDriverError> for openshell_core::ComputeDriverError" crates -S
printf '\n--- relevant core mapping ---\n'
rg -n "ComputeDriverError" crates/openshell-core -S

#!/bin/bash
set -euo pipefail

# Locate the helper and its callers.
rg -n "fn kube_resource_name|kube_resource_name\\(" crates/openshell-driver-kubernetes/src/driver.rs crates/openshell-driver-kubernetes/src -S

# Show the relevant section around the helper.
sed -n '1120,1195p' crates/openshell-driver-kubernetes/src/driver.rs

#!/bin/bash
set -euo pipefail

# Inspect nearby resource-name construction for collision implications.
rg -n "format!\\(\"\\{workspace\\}--\\{name\\}\"|--" crates/openshell-driver-kubernetes/src/driver.rs -S

#!/bin/bash
set -euo pipefail

# Find any Kubernetes API objects or caches keyed by this name.
rg -n "resource name|resource_name|kube_resource_name|ConfigMap|Secret|ServiceAccount|PersistentVolumeClaim|Job|Pod" crates/openshell-driver-kubernetes/src -S

#!/bin/bash
set -euo pipefail

sed -n '1,220p' crates/openshell-driver-kubernetes/src/driver.rs

#!/bin/bash
set -euo pipefail

# Print the surrounding context of the helper and its uses.
python3 - <<'PY'
from pathlib import Path
p = Path('crates/openshell-driver-kubernetes/src/driver.rs')
text = p.read_text()
for needle in ['fn kube_resource_name', 'kube_resource_name(']:
    idx = text.find(needle)
    print(f'NEEDLE={needle} IDX={idx}')
PY

#!/bin/bash
set -euo pipefail

# Inspect the helper and its immediate callers.
sed -n '1140,1185p' crates/openshell-driver-kubernetes/src/driver.rs
printf '\n---\n'
rg -n "kube_resource_name\\(" crates/openshell-driver-kubernetes/src/driver.rs -n -S

#!/bin/bash
set -euo pipefail

# Inspect workspace/name validation and the tests around kube_resource_name.
sed -n '5708,5765p' crates/openshell-driver-kubernetes/src/driver.rs
printf '\n---\n'
rg -n "workspace|name.*validate|validate.*workspace|DNS-1123|kube_resource_name_length" crates/openshell-driver-kubernetes/src/driver.rs -S

#!/bin/bash
set -euo pipefail

# Look for other validation paths for sandbox workspace/name in the driver and shared core.
rg -n "workspace.*invalid|invalid.*workspace|sandbox\.workspace|sandbox\.name|name.*invalid|DNS-1123|validate_kube_resource_name_length|LABEL_SANDBOX_WORKSPACE|LABEL_SANDBOX_NAME" crates/openshell-driver-kubernetes/src crates/openshell-core/src -S

#!/bin/bash
set -euo pipefail

# Narrowly inspect the call site that uses the generated Kubernetes name.
sed -n '820,855p' crates/openshell-driver-kubernetes/src/driver.rs

#!/bin/bash
set -euo pipefail

sed -n '5708,5765p' crates/openshell-driver-kubernetes/src/driver.rs
printf '\n---\n'
rg -n "workspace.*invalid|invalid.*workspace|sandbox\\.workspace|sandbox\\.name|name.*invalid|DNS-1123|validate_kube_resource_name_length|LABEL_SANDBOX_WORKSPACE|LABEL_SANDBOX_NAME" crates/openshell-driver-kubernetes/src crates/openshell-core/src -S
printf '\n---\n'
sed -n '820,855p' crates/openshell-driver-kubernetes/src/driver.rs

#!/bin/bash
set -euo pipefail

# Inspect the validation helpers and the create path around sandbox identifiers.
sed -n '300,380p' crates/openshell-driver-kubernetes/src/driver.rs
printf '\n---\n'
sed -n '640,690p' crates/openshell-driver-kubernetes/src/driver.rs
printf '\n---\n'
rg -n "validate_.*workspace|validate_.*name|DNS-1123 label|DNS-1123 subdomain|sandbox\\.workspace|sandbox\\.name" crates/openshell-driver-kubernetes/src/driver.rs -n -S

#!/bin/bash
set -euo pipefail

# Check whether sandbox.workspace / sandbox.name have any stricter validation in shared proto/core code.
rg -n "workspace|sandbox name|sandbox_name|sandbox\\.workspace|sandbox\\.name|DNS-1123|validate_.*sandbox" crates/openshell-core crates/openshell-driver-kubernetes -S

#!/bin/bash
set -euo pipefail

# Find the protobuf/struct definitions for DriverSandbox fields and any validators on them.
rg -n "message DriverSandbox|struct DriverSandbox|workspace =|name =" crates -g '!target' -S

#!/bin/bash
set -euo pipefail

# Inspect the sandbox type definition and any docs on field constraints.
rg -n "DriverSandbox|workspace|name" crates/openshell-core/src/proto -S

#!/bin/bash
set -euo pipefail

# Show all direct uses of the generated Kubernetes name.
rg -n "kube_resource_name\\(|DynamicObject::new\\(&kube_name|metadata\\.name|name: Some\\(\".*--.*\"\\)" crates/openshell-driver-kubernetes/src/driver.rs -S

#!/bin/bash
set -euo pipefail

# Inspect the sandbox create/update validators in the gateway for workspace/name character rules.
sed -n '120,260p' crates/openshell-server/src/grpc/sandbox.rs
printf '\n---\n'
sed -n '820,920p' crates/openshell-server/src/grpc/validation.rs
printf '\n---\n'
rg -n "MAX_NAME_LEN|DNS-1123|workspace.*validation|name.*validation|sandbox_name|workspace" crates/openshell-server/src/grpc/validation.rs crates/openshell-server/src/grpc/sandbox.rs -S

#!/bin/bash
set -euo pipefail

# Locate the relevant files and inspect the surrounding functions.
git ls-files 'crates/openshell-driver-podman/src/driver.rs' 'crates/openshell-driver-kubernetes/src/driver.rs'

echo '--- PODMAN outline ---'
ast-grep outline crates/openshell-driver-podman/src/driver.rs --view expanded | sed -n '1,260p'

echo '--- KUBERNETES outline ---'
ast-grep outline crates/openshell-driver-kubernetes/src/driver.rs --view expanded | sed -n '1,260p'

echo '--- PODMAN label/search snippets ---'
rg -n 'LABEL_SANDBOX_ID|managed|list_containers|inspect_container|sandbox_exists|get_sandbox|find_container_name_by_id' crates/openshell-driver-podman/src/driver.rs

echo '--- KUBERNETES label/search snippets ---'
rg -n 'LABEL_SANDBOX_ID|managed|ListParams::default\(\)\.labels|delete|exists|get_sandbox' crates/openshell-driver-kubernetes/src/driver.rs

#!/bin/bash
set -euo pipefail

# Read only the relevant line ranges around the cited sites.
echo '--- PODMAN 560-730 ---'
sed -n '560,730p' crates/openshell-driver-podman/src/driver.rs | cat -n

echo '--- KUBERNETES 670-1010 ---'
sed -n '670,1010p' crates/openshell-driver-kubernetes/src/driver.rs | cat -n

#!/bin/bash
set -euo pipefail

# Inspect how managed labels are defined and applied in both drivers.
echo '--- PODMAN container label definitions/usages ---'
rg -n 'LABEL_MANAGED_FILTER|LABEL_MANAGED_BY|LABEL_MANAGED_BY_VALUE|LABEL_SANDBOX_ID|labels' crates/openshell-driver-podman/src crates/openshell-driver-kubernetes/src

echo '--- PODMAN create path around labels ---'
sed -n '470,560p' crates/openshell-driver-podman/src/driver.rs | cat -n

echo '--- KUBERNETES sandbox_labels and managed-by related code ---'
sed -n '1160,1205p' crates/openshell-driver-kubernetes/src/driver.rs | cat -n

#!/bin/bash
set -euo pipefail

# Read the label definitions and the Podman create path to assess ownership scoping.
echo '--- PODMAN container module ---'
sed -n '1,220p' crates/openshell-driver-podman/src/container.rs | cat -n

echo '--- PODMAN create path ---'
sed -n '439,596p' crates/openshell-driver-podman/src/driver.rs | cat -n

echo '--- KUBERNETES sandbox labels ---'
sed -n '1170,1195p' crates/openshell-driver-kubernetes/src/driver.rs | cat -n

#!/bin/bash
set -euo pipefail

# Check whether Kubernetes sandbox objects carry a managed-by label and whether Podman containers use managed labels on create.
rg -n 'LABEL_MANAGED_BY_VALUE|LABEL_MANAGED_BY|sandbox_labels\(|LABEL_MANAGED_FILTER|set_labels|labels.insert|managed' crates/openshell-driver-kubernetes/src/driver.rs crates/openshell-driver-podman/src/container.rs crates/openshell-driver-podman/src/driver.rs

echo '--- KUBERNETES sandbox_labels implementation ---'
sed -n '1170,1192p' crates/openshell-driver-kubernetes/src/driver.rs | cat -n

echo '--- PODMAN container label helpers ---'
sed -n '1,220p' crates/openshell-driver-podman/src/container.rs | cat -n

#!/bin/bash
set -euo pipefail

file="crates/openshell-server/src/grpc/policy.rs"

# Show the surrounding function in manageable chunks
wc -l "$file"
sed -n '2050,2235p' "$file"

# Find response construction helpers and the annotations variable usage
rg -n "response_annotations|update_config_response|UpdateConfigResponse|annotations" "$file"

#!/bin/bash
set -euo pipefail

file="crates/openshell-server/src/grpc/policy.rs"

# Locate the handler and response helper definitions precisely
rg -n "fn .*update_config|response_annotations|update_config_response" "$file"

# Print the specific region around the handler tail
start=$(rg -n "response_annotations" "$file" | head -n 1 | cut -d: -f1)
if [ -n "${start:-}" ]; then
  s=$((start-40)); [ "$s" -lt 1 ] && s=1
  e=$((start+120))
  sed -n "${s},${e}p" "$file"
fi

#!/bin/bash
set -euo pipefail

# Locate the function and referenced call sites/tests.
rg -n "dynamic_token_grant_bindings_for_provider|state_with_authoritative_profiles_over_default_grants|configure_provider_refresh_uses_authoritative_profile_sources_for_expiry_update|delete_provider_refresh_uses_authoritative_profile_sources_for_expiry_update|get_message_by_name::<Provider>|new_refresh_state\\(" crates/openshell-server/src/grpc/provider.rs

# Show the relevant implementation block.
sed -n '1000,1045p' crates/openshell-server/src/grpc/provider.rs

# Show the three test regions mentioned in the comment.
sed -n '4080,4215p' crates/openshell-server/src/grpc/provider.rs

#!/bin/bash
set -euo pipefail

# Inspect surrounding type signatures and uses for the provider helper.
sed -n '960,1035p' crates/openshell-server/src/grpc/provider.rs
sed -n '1935,1965p' crates/openshell-server/src/grpc/provider.rs

# Check for the request/message field shapes used in the tests.
rg -n "struct (ObjectMeta|Provider|ConfigureProviderRefreshRequest|DeleteProviderRefreshRequest)|workspace:|profile_workspace:" crates/openshell-server/src/grpc/provider.rs crates -g '!target'

#!/bin/bash
set -euo pipefail

# Determine whether the provider helper's signature is used elsewhere in the file.
rg -n "dynamic_token_grant_bindings_for_provider\\(" crates/openshell-server/src/grpc/provider.rs

# Inspect request/message construction around the cited tests.
sed -n '4090,4210p' crates/openshell-server/src/grpc/provider.rs

#!/bin/bash
set -euo pipefail

# Inspect the exact signatures for the helpers/types mentioned in the tests.
rg -n "fn new_refresh_state|struct NewRefreshStateConfig|trait .*get_message_by_name|fn get_message_by_name|struct ConfigureProviderRefreshRequest|struct DeleteProviderRefreshRequest|workspace:" crates/openshell-server/src crates/openshell-core/src

# Show the definitions around new_refresh_state and the request structs.
sed -n '1,260p' crates/openshell-server/src/provider_refresh.rs
sed -n '1,220p' crates/openshell-server/src/grpc/provider.rs

#!/bin/bash
set -euo pipefail

# Inspect the exact signatures for the test-side helpers and request structs.
rg -n "fn new_refresh_state|struct NewRefreshStateConfig|get_message_by_name<|struct ConfigureProviderRefreshRequest|struct DeleteProviderRefreshRequest" crates/openshell-server/src crates/openshell-core/src

# Read the implementation areas around the relevant signatures.
sed -n '1,260p' crates/openshell-server/src/provider_refresh.rs
sed -n '1,180p' crates/openshell-server/src/grpc/provider.rs

#!/bin/bash
ast-grep outline crates/openshell-server/src/grpc/workspace.rs \
  --match resolve_workspace --view expanded
rg -n -C5 'async fn (create_sandbox|get_sandbox|list_sandboxes|expose_service|get_service|list_services|delete_service)' \
  crates/openshell-server/src/grpc/mod.rs

#!/bin/bash
set -euo pipefail

# Locate workspace-related grpc files
fd -a 'workspace.rs' crates/openshell-server/src || true
fd -a 'sandbox.rs' crates/openshell-server/src/grpc || true
fd -a 'service.rs' crates/openshell-server/src/grpc || true

# Map the relevant handlers and workspace resolver
ast-grep outline crates/openshell-server/src/grpc/sandbox.rs --view expanded || true
printf '\n--- service.rs ---\n'
ast-grep outline crates/openshell-server/src/grpc/service.rs --view expanded || true

# Find workspace resolution helper usage/definition
rg -n -C3 'resolve_workspace|workspace.*authorize|platform admin|Platform Admin|all_workspaces' crates/openshell-server/src/grpc

#!/bin/bash
set -euo pipefail

# Find the workspace resolver and any membership/authorization helpers it uses
rg -n -C4 'async fn resolve_workspace|fn resolve_workspace|resolve_workspace\(' crates/openshell-server/src
printf '\n--- workspace-related auth helpers ---\n'
rg -n -C3 'workspace.*member|member.*workspace|authorize.*workspace|platform admin|PlatformAdmin|is_platform_admin|admin role|role = "admin"|role = "platform"' crates/openshell-server/src

#!/bin/bash
set -euo pipefail

# Find the actual resolve_workspace definition and any membership checks around it.
rg -n -C6 'resolve_workspace' crates/openshell-server/src
printf '\n--- workspace member checks ---\n'
rg -n -C4 'workspace member|workspace_members|is_workspace|member.*workspace|principal.*workspace|authorized.*workspace|authorize.*membership' crates/openshell-server/src/grpc crates/openshell-server/src

#!/bin/bash
set -euo pipefail

# Find the actual workspace resolver definition and workspace membership helpers.
rg -n -C5 'pub\(super\)? async fn resolve_workspace|fn resolve_workspace|resolve_workspace\(' crates openshell-core
printf '\n--- workspace membership / authorization helpers ---\n'
rg -n -C4 'workspace member|workspace_members|principal.*workspace|authorize.*membership|is_workspace_member|resolve_.*for_principal|for_principal' crates/openshell-server/src crates/openshell-core/src

#!/bin/bash
set -euo pipefail

# Locate the workspace module and any resolver definition.
fd -a 'workspace*.rs' crates/openshell-server/src || true
fd -a 'workspace*' crates/openshell-server/src || true

# Search for the workspace resolver and any membership enforcement around it.
rg -n -C6 'resolve_workspace|workspace member|workspace_members|member.*workspace|principal.*workspace|authorize.*workspace|is_workspace_member' crates/openshell-server/src

#!/bin/bash
set -euo pipefail

# Find the workspace module and any functions that gate access by principal/membership.
git ls-files 'crates/openshell-server/src/**' | rg '/workspace(\.rs|/|$)'
printf '\n--- module declarations ---\n'
rg -n -C3 'mod workspace|pub mod workspace|workspace::' crates/openshell-server/src/grpc/mod.rs crates/openshell-server/src/grpc/*.rs crates/openshell-server/src/*.rs
printf '\n--- resolver / membership checks ---\n'
rg -n -C5 'resolve_workspace|workspace.*member|member.*workspace|principal.*workspace|authorize.*workspace|is_workspace_member|for_principal' crates/openshell-server/src

#!/bin/bash
set -euo pipefail

# Locate the workspace module / resolver anywhere in openshell-server.
git ls-files 'crates/openshell-server/src/**' | rg 'workspace'
printf '\n--- possible resolver definitions ---\n'
rg -n -C5 'resolve_workspace|handle_(add|remove|list)_workspace_members|workspace member|member.*workspace|principal.*workspace|authorize.*workspace|is_workspace_member' crates/openshell-server/src

#!/bin/bash
set -euo pipefail

# Find the resolver and any membership/authorization logic anywhere in the repo.
printf '%s\n' '--- files named workspace ---'
fd -a 'workspace.rs' . || true
fd -a 'workspace' . || true

printf '\n%s\n' '--- resolve_workspace usages/definitions ---'
rg -n -C6 'resolve_workspace' .

printf '\n%s\n' '--- workspace access checks ---'
rg -n -C4 'workspace member|workspace_members|member.*workspace|principal.*workspace|authorize.*workspace|is_workspace_member|for_principal|membership' .

#!/bin/bash
ast-grep outline crates/openshell-server/src/grpc/provider.rs \
  --match 'validate_provider_environment_keys_unique|validate_provider_environment_keys_unique_with_catalog' \
  --view expanded
rg -n -C6 'validate_provider_environment_keys_unique' \
  crates/openshell-server/src/grpc/provider.rs

#!/bin/bash
set -euo pipefail

sed -n '884,980p' crates/openshell-server/src/grpc/provider.rs
printf '\n---\n'
sed -n '140,170p' crates/openshell-server/src/grpc/sandbox.rs
printf '\n---\n'
rg -n -C2 'validate_provider_environment_keys_unique_with_catalog|validate_provider_environment_keys_unique_at|validate_provider_environment_keys_unique\(' crates/openshell-server/src/grpc/provider.rs crates/openshell-server/src/grpc/sandbox.rs