Refactor OpenShell client capabilities

internal/openshell/client.go

@@ -74,6 +74,30 @@ type SandboxExecutionClient interface {
 	DeleteSandbox(ctx context.Context, name string) error
 }
 
+// StateReader reads the gateway state needed to build a workflow plan.
+type StateReader interface {
+	Health(ctx context.Context) (Health, error)
+	Providers(ctx context.Context) ([]Provider, error)
+	InferenceRouteReader
+}
+
+// InferenceRouteReader reads one inference route from the bound workspace.
+type InferenceRouteReader interface {
+	GetInferenceRoute(ctx context.Context, route string) (InferenceRoute, error)
+}
+
+// ProviderReconciler reads and updates non-secret provider configuration.
+type ProviderReconciler interface {
+	GetProvider(ctx context.Context, name string) (Provider, error)
+	UpdateProvider(ctx context.Context, p Provider) (Provider, error)
+}
+
+// InferenceReconciler reads and upserts inference routes.
+type InferenceReconciler interface {
+	InferenceRouteReader
+	SetInferenceRoute(ctx context.Context, cfg InferenceRouteConfig) (InferenceRoute, error)
+}
+
 // InteractiveSession is the SDK-native bidirectional terminal stream without
 // exposing an SDK type outside sdkclient.
 type InteractiveSession interface {

internal/openshell/sdkclient/client.go

@@ -26,6 +26,9 @@ var (
 	_ openshell.Factory                = New
 	_ openshell.Client                 = (*client)(nil)
 	_ openshell.SandboxExecutionClient = (*client)(nil)
+	_ openshell.StateReader            = (*client)(nil)
+	_ openshell.ProviderReconciler     = (*client)(nil)
+	_ openshell.InferenceReconciler    = (*client)(nil)
 )
 
 // client wraps the SDK client interface, binding it to one workspace. It holds

internal/plan/state.go

@@ -43,7 +43,7 @@ type CurrentState struct {
 // unreachable or unauthenticated, Reachable is set to false and a nil error is
 // returned; other errors are escalated. When desired configures inference, it
 // reads the current route so the plan can show a real create/update/noop diff.
-func ReadCurrentState(ctx context.Context, c openshell.Client, desired *config.Harness) (CurrentState, error) {
+func ReadCurrentState(ctx context.Context, c openshell.StateReader, desired *config.Harness) (CurrentState, error) {
 	var state CurrentState
 
 	// Read health.
@@ -98,7 +98,7 @@ func ReadCurrentState(ctx context.Context, c openshell.Client, desired *config.H
 // back to a config-only validate. Transient errors (unavailable/unauthenticated)
 // and ErrPermission are propagated so the caller decides whether to degrade
 // (the read-only plan) or fail (the reconcile write path).
-func ReadInferenceState(ctx context.Context, c openshell.Client, desired config.Inference) (InferenceState, error) {
+func ReadInferenceState(ctx context.Context, c openshell.InferenceRouteReader, desired config.Inference) (InferenceState, error) {
 	route, err := c.GetInferenceRoute(ctx, ResolveInferenceRoute(desired.Route))
 	switch {
 	case err == nil:

internal/reconcile/inference.go

@@ -43,7 +43,7 @@ type InferenceResult struct {
 // changes. Likewise, an update triggered by a provider/model change with an unset
 // timeout writes 0, resetting any non-default gateway timeout to the default —
 // "unset timeout" always means "let the gateway decide".
-func ReconcileInference(ctx context.Context, c openshell.Client, desired config.Inference) (InferenceResult, error) {
+func ReconcileInference(ctx context.Context, c openshell.InferenceReconciler, desired config.Inference) (InferenceResult, error) {
 	cur, err := plan.ReadInferenceState(ctx, c, desired)
 	if err != nil {
 		return InferenceResult{}, fmt.Errorf("reading inference route: %w", err)

internal/reconcile/provider.go

@@ -45,7 +45,7 @@ type ProviderResult struct {
 // On Update the write is credential-preserving by construction (the firewall
 // Provider has no credentials field) and is reached only on a real non-secret
 // delta, so the empty-credential copy-through is never sent spuriously.
-func ReconcileProviders(ctx context.Context, c openshell.Client, desired []config.Provider) ([]ProviderResult, error) {
+func ReconcileProviders(ctx context.Context, c openshell.ProviderReconciler, desired []config.Provider) ([]ProviderResult, error) {
 	results := make([]ProviderResult, 0, len(desired))
 
 	for _, d := range desired {