feat(sdk/go): sync proto bindings and add credential handle support

Regenerate Go proto bindings after rebase to pick up new
CredentialHandle message and Provider.credential_handles and
profile_workspace fields from upstream. Add domain types, converter
support, and proto field coverage tests for Provider and
CredentialHandle.

Signed-off-by: Roland Huß <rhuss@redhat.com>

Author: rhuss

sdk/go/openshell/v1/internal/converter/coverage_test.go

@@ -6,6 +6,7 @@ package converter
 import (
 	"testing"
 
+	dm "github.com/NVIDIA/OpenShell/sdk/go/proto/datamodelv1"
 	pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1"
 	sandboxpb "github.com/NVIDIA/OpenShell/sdk/go/proto/sandboxv1"
 	"google.golang.org/protobuf/reflect/protoreflect"
@@ -153,6 +154,30 @@ func TestConverterCoversAllProtoFields_L7DenyRule(t *testing.T) {
 	assertAllFieldsCovered(t, (&sandboxpb.L7DenyRule{}).ProtoReflect().Descriptor(), handled, nil)
 }
 
+func TestConverterCoversAllProtoFields_Provider(t *testing.T) {
+	handled := fieldSet{
+		"metadata":                 true,
+		"type":                     true,
+		"credentials":              true,
+		"config":                   true,
+		"credential_expires_at_ms": true,
+		"profile_workspace":        true,
+		"credential_handles":       true,
+	}
+
+	assertAllFieldsCovered(t, (&dm.Provider{}).ProtoReflect().Descriptor(), handled, nil)
+}
+
+func TestConverterCoversAllProtoFields_CredentialHandle(t *testing.T) {
+	handled := fieldSet{
+		"driver":   true,
+		"handle":   true,
+		"metadata": true,
+	}
+
+	assertAllFieldsCovered(t, (&dm.CredentialHandle{}).ProtoReflect().Descriptor(), handled, nil)
+}
+
 func TestConverterCoversAllProtoFields_McpOptions(t *testing.T) {
 	handled := fieldSet{
 		"strict_tool_names":           true,

sdk/go/openshell/v1/internal/converter/provider.go

@@ -19,7 +19,8 @@ func ProviderFromProto(p *dm.Provider) *types.Provider {
 	result := &types.Provider{
 		Type: p.GetType(),
 		Spec: types.ProviderSpec{
-			Config: CopyStringMap(p.GetConfig()),
+			Config:           CopyStringMap(p.GetConfig()),
+			ProfileWorkspace: p.GetProfileWorkspace(),
 		},
 	}
 
@@ -41,6 +42,17 @@ func ProviderFromProto(p *dm.Provider) *types.Provider {
 		}
 	}
 
+	if handles := p.GetCredentialHandles(); len(handles) > 0 {
+		result.Spec.CredentialHandles = make(map[string]types.CredentialHandle, len(handles))
+		for k, h := range handles {
+			result.Spec.CredentialHandles[k] = types.CredentialHandle{
+				Driver:   h.GetDriver(),
+				Handle:   h.GetHandle(),
+				Metadata: CopyStringMap(h.GetMetadata()),
+			}
+		}
+	}
+
 	return result
 }
 
@@ -61,9 +73,10 @@ func ProviderToProto(p *types.Provider) *dm.Provider {
 			Workspace:           p.Workspace,
 			DeletionTimestampMs: MillisFromTimePtr(p.DeletionTimestamp),
 		},
-		Type:        p.Type,
-		Credentials: CopyStringMap(p.Spec.Credentials),
-		Config:      CopyStringMap(p.Spec.Config),
+		Type:             p.Type,
+		Credentials:      CopyStringMap(p.Spec.Credentials),
+		Config:           CopyStringMap(p.Spec.Config),
+		ProfileWorkspace: p.Spec.ProfileWorkspace,
 	}
 
 	if len(p.Spec.CredentialExpiresAt) > 0 {
@@ -73,5 +86,16 @@ func ProviderToProto(p *types.Provider) *dm.Provider {
 		}
 	}
 
+	if len(p.Spec.CredentialHandles) > 0 {
+		result.CredentialHandles = make(map[string]*dm.CredentialHandle, len(p.Spec.CredentialHandles))
+		for k, h := range p.Spec.CredentialHandles {
+			result.CredentialHandles[k] = &dm.CredentialHandle{
+				Driver:   h.Driver,
+				Handle:   h.Handle,
+				Metadata: CopyStringMap(h.Metadata),
+			}
+		}
+	}
+
 	return result
 }

sdk/go/openshell/v1/types/provider.go

@@ -24,4 +24,15 @@ type ProviderSpec struct {
 	Credentials         map[string]string
 	Config              map[string]string
 	CredentialExpiresAt map[string]time.Time
+	ProfileWorkspace    string
+	CredentialHandles   map[string]CredentialHandle
+}
+
+// CredentialHandle is an opaque handle for a provider credential stored by
+// gateway credential storage. Handles are created by OpenShell and are not
+// accepted as user-authored input.
+type CredentialHandle struct {
+	Driver   string
+	Handle   string
+	Metadata map[string]string
 }