fix(providers): serialize profile update validation

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Author: johntmyers

architecture/gateway.md

@@ -253,6 +253,12 @@ responses copy the stored version onto the profile payload so exported YAML can
 carry the expected version for safe single-profile updates. Database migrations
 backfill existing rows with version 1.
 
+Provider profile updates also hold the sandbox synchronization guard while
+checking attached-sandbox dynamic token grant ambiguity and writing the updated
+profile. Sandbox provider attach/detach uses the same guard, so one gateway
+process cannot interleave an attach with a profile update that would leave an
+ambiguous final dynamic-token state.
+
 Policy and runtime settings are delivered together through the effective sandbox
 config path. A gateway-global policy can override sandbox-scoped policy. The
 sandbox supervisor polls for config revisions and hot-reloads dynamic policy

crates/openshell-cli/src/run.rs

@@ -4955,6 +4955,21 @@ pub async fn provider_profile_export(
     output: &str,
     tls: &TlsOptions,
 ) -> Result<()> {
+    let rendered = provider_profile_export_text(server, id, output, tls).await?;
+    if output == "json" {
+        println!("{rendered}");
+    } else {
+        print!("{rendered}");
+    }
+    Ok(())
+}
+
+pub async fn provider_profile_export_text(
+    server: &str,
+    id: &str,
+    output: &str,
+    tls: &TlsOptions,
+) -> Result<String> {
     let mut client = grpc_client(server, tls).await?;
     let response = client
         .get_provider_profile(GetProviderProfileRequest { id: id.to_string() })
@@ -4966,16 +4981,14 @@ pub async fn provider_profile_export(
         .ok_or_else(|| miette!("provider profile '{id}' not found"))?;
     let profile = ProviderTypeProfile::from_proto(&profile);
 
-    if !crate::output::print_output_direct(
-        output,
-        || profile_to_json(&profile).into_diagnostic(),
-        || profile_to_yaml(&profile).into_diagnostic(),
-    )? {
-        return Err(miette!(
+    match output {
+        "json" => profile_to_json(&profile).into_diagnostic(),
+        "yaml" => profile_to_yaml(&profile).into_diagnostic(),
+        "table" => Err(miette!(
             "profile export supports '-o yaml' and '-o json'; table output is not supported"
-        ));
+        )),
+        _ => Err(miette!("unsupported output format: {output}")),
     }
-    Ok(())
 }
 
 pub async fn provider_profile_import(

crates/openshell-cli/tests/provider_commands_integration.rs

@@ -1417,37 +1417,18 @@ binaries: [/usr/bin/custom]
     run::provider_profile_import(&ts.endpoint, Some(&profile_path), None, &ts.tls)
         .await
         .expect("profile import");
-    let resource_version = ts
-        .state
-        .profiles
-        .lock()
-        .await
-        .get("custom-api")
-        .expect("custom profile")
-        .resource_version;
-    std::fs::write(
-        &profile_path,
-        format!(
-            r"
-id: custom-api
-resource_version: {resource_version}
-display_name: Custom API Updated
-category: other
-credentials:
-  - name: api_key
-    env_vars: [CUSTOM_API_KEY]
-    auth_style: bearer
-    header_name: authorization
-discovery:
-  credentials: [api_key]
-endpoints:
-  - host: api.updated.example
-    port: 443
-binaries: [/usr/bin/custom]
-"
-        ),
-    )
-    .unwrap();
+    let exported_yaml =
+        run::provider_profile_export_text(&ts.endpoint, "custom-api", "yaml", &ts.tls)
+            .await
+            .expect("profile export text");
+    assert!(exported_yaml.contains("resource_version: 1"));
+    let updated_yaml = exported_yaml
+        .replace(
+            "display_name: Custom API",
+            "display_name: Custom API Updated",
+        )
+        .replace("host: api.custom.example", "host: api.updated.example");
+    std::fs::write(&profile_path, updated_yaml).unwrap();
     run::provider_profile_update(&ts.endpoint, &profile_path, &ts.tls)
         .await
         .expect("profile update");

crates/openshell-server/src/grpc/provider.rs

@@ -1375,6 +1375,11 @@ pub(super) async fn handle_update_provider_profiles(
             severity: "error".to_string(),
         });
     }
+    let _sandbox_sync_guard = if has_errors(&diagnostics) {
+        None
+    } else {
+        Some(state.compute.sandbox_sync_guard().await)
+    };
     if !has_errors(&diagnostics) {
         diagnostics.extend(
             profile_attached_sandbox_diagnostics(state.store.as_ref(), &profiles, "update").await?,