feat(devshell): add provider-backed VM dev sandbox

2026-10-29 07:23:25 +08:00 · 2026-05-27 00:19:04 -07:00
parent fa84e437ab
commit 5bb970a7cc
12 changed files with 956 additions and 53 deletions
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+id: codex
+display_name: Codex
+description: Codex CLI access for OpenShell development sandboxes
+category: agent
+inference_capable: true
+credentials:
+  - name: api_key
+    description: OpenAI API key used by Codex
+    env_vars: [OPENAI_API_KEY]
+    required: false
+    auth_style: bearer
+    header_name: authorization
+discovery:
+  credentials: [api_key]
+endpoints:
+  - host: api.openai.com
+    port: 443
+    protocol: rest
+    access: full
+    enforcement: enforce
+  - host: auth.openai.com
+    port: 443
+    protocol: rest
+    access: full
+    enforcement: enforce
+  - host: chatgpt.com
+    port: 443
+    protocol: rest
+    access: full
+    enforcement: enforce
+  - host: ab.chatgpt.com
+    port: 443
+    protocol: rest
+    access: full
+    enforcement: enforce
+binaries:
+  - /usr/bin/codex
+  - /usr/local/bin/codex
+  - /usr/bin/node
+  - /usr/local/bin/node
@@ -0,0 +1,77 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+id: openshell-dev-toolchains
+display_name: OpenShell Dev Toolchains
+description: Network access for OpenShell development toolchain bootstrap
+category: other
+credentials:
+  - name: activation
+    description: Non-secret marker credential used to attach this policy bundle
+    env_vars: [OPENSHELL_DEVSHELL_ACCESS]
+    required: false
+discovery:
+  credentials: [activation]
+endpoints:
+  - { host: github.com, port: 443 }
+  - { host: api.github.com, port: 443 }
+  - { host: raw.githubusercontent.com, port: 443 }
+  - { host: objects.githubusercontent.com, port: 443 }
+  - { host: codeload.github.com, port: 443 }
+  - { host: release-assets.githubusercontent.com, port: 443 }
+  - { host: crates.io, port: 443 }
+  - { host: index.crates.io, port: 443 }
+  - { host: static.crates.io, port: 443 }
+  - { host: static.rust-lang.org, port: 443 }
+  - { host: sh.rustup.rs, port: 443 }
+  - { host: pypi.org, port: 443 }
+  - { host: files.pythonhosted.org, port: 443 }
+  - { host: astral.sh, port: 443 }
+  - host: registry.npmjs.org
+    port: 443
+    protocol: rest
+    enforcement: enforce
+    access: read-only
+    allow_encoded_slash: true
+  - { host: nodejs.org, port: 443 }
+  - { host: dl.k8s.io, port: 443 }
+  - { host: get.helm.sh, port: 443 }
+  - { host: storage.googleapis.com, port: 443 }
+  - { host: ziglang.org, port: 443 }
+  - { host: zig.linus.dev, port: 443 }
+  - { host: zig.tilok.dev, port: 443 }
+  - { host: zig.chainsafe.dev, port: 443 }
+  - { host: mise.run, port: 443 }
+  - { host: mise.en.dev, port: 443 }
+  - { host: mise.jdx.dev, port: 443 }
+  - { host: mise-versions.jdx.dev, port: 443 }
+  - { host: fulcio.sigstore.dev, port: 443 }
+  - { host: rekor.sigstore.dev, port: 443 }
+  - { host: tuf-repo-cdn.sigstore.dev, port: 443 }
+  - { host: oauth2.sigstore.dev, port: 443 }
+  - { host: ports.ubuntu.com, port: 80 }
+  - { host: ports.ubuntu.com, port: 443 }
+  - { host: archive.ubuntu.com, port: 80 }
+  - { host: archive.ubuntu.com, port: 443 }
+  - { host: security.ubuntu.com, port: 80 }
+  - { host: security.ubuntu.com, port: 443 }
+binaries:
+  - /usr/local/bin/mise
+  - /usr/local/share/openshell/mise/**
+  - /sandbox/.local/bin/mise
+  - /sandbox/.local/share/mise/**
+  - /sandbox/.cargo/**
+  - /usr/bin/git
+  - /usr/local/bin/git
+  - /usr/lib/git-core/git-remote-http
+  - /usr/bin/curl
+  - /usr/local/bin/curl
+  - /usr/bin/python3
+  - /usr/local/bin/python3
+  - /usr/bin/node
+  - /usr/local/bin/node
+  - /usr/bin/npm
+  - /usr/local/bin/npm
+  - /usr/bin/apt-get
+  - /usr/bin/apt-cache
+  - /usr/lib/apt/**