[shailendra-nv]

Summary

After a provider credential update, a continuing process can keep its ordinary static reference even when --wait reports readiness. Add actionable table-output guidance to launch a fresh client with openshell sandbox exec or recreate the sandbox for its main process, and point to the existing stable-placeholder and gateway-managed-refresh options for live value-only rotation.

Related Issue

Closes #5293

The issue is not labeled state:accepted; the author's target-repository maintainer access was verified.

Changes

• Print the guidance once after a successful credential update with attached sandboxes, including --wait.
• Preserve JSON/YAML output, credential lifecycle semantics, and write-only caller permissions.
• Omit the reminder for config-only updates and providers without attached sandboxes.
• Add three CLI integration regressions and update the provider docs and public CLI skill.

Testing

• Checks appropriate to the affected code and behavior pass.
• Integration regression tests added: 85 provider-command integration tests pass on native ARM64 Windows.
• Existing credential lifecycle coverage: 50 tests pass, including static reference retention, stable rotation, expiry and detach; 472 unrelated tests filtered out.
• Focused native MXC reproduction: ordinary static update displays guidance and retains its previous reference; stable placeholders rotate live; recreated sandboxes use the new value in both cases. The updated debug CLI ran against verified unchanged runtime binaries from the Windows base commit, with synthetic credentials and completed cleanup.
• Scoped CLI Clippy, Rust formatting, diff whitespace, Markdown lint and docs navigation checks pass.
• Pinned Fern check passes using a PowerShell equivalent of the docs task; the aggregate task's POSIX variable syntax fails under Windows cmd. Fern reports the existing theme contrast warning and skips authenticated redirect checks.

The broad local pre-commit hook was attempted but failed building the unrelated Python dependency grpcio-tools==1.78.0 on Windows ARM64. The commit used the scoped verification allowed by CONTRIBUTING.md; the changed files also passed the standalone license-header check.

Validation used aarch64-pc-windows-msvc through the existing Windows MSVC wrapper on a native ARM64 host. x64 tests, full workspace CI and full MXC conformance were not run for this CLI output change.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant user documentation and CLI skill updated; no architecture change.

The local commit has DCO sign-off but no cryptographic signature, so CI mirroring may require maintainer admission.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T05:21:13.919259Z	96c33ea	PR opened
🔒 Security Review	⚠️ Failed 2026-11-05T05:21:06.337820Z We couldn’t complete this review. Comment @codex security review to try again.	96c33ea	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5294.docs.buildwithfern.com/openshell