From 9bc6a69591d21cc346d7c7cd8e9d4e048883425f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 19:55:14 +0000 Subject: [PATCH] docs(website): sync dev docs from f6a39833c34f2ff9b74d07c8c87370f86ffc2a49 --- fern/.docs-snapshots.yml | 6 +++--- fern/pages-dev/CONTRIBUTING.mdx | 1 + fern/pages-dev/about/installation.mdx | 8 ++++---- fern/pages-dev/about/support-matrix.mdx | 4 ++-- fern/pages-dev/how-it-works/gateways/configuration.mdx | 4 ++-- fern/pages-dev/how-it-works/policies/prover.mdx | 8 ++++---- 6 files changed, 16 insertions(+), 15 deletions(-) diff --git a/fern/.docs-snapshots.yml b/fern/.docs-snapshots.yml index 72c8c21c1..dc4ea103b 100644 --- a/fern/.docs-snapshots.yml +++ b/fern/.docs-snapshots.yml @@ -1,8 +1,8 @@ snapshots: dev: - source-ref: 749d09e34459d86d402057f1c9564247ef3cc74e - source-sha: 749d09e34459d86d402057f1c9564247ef3cc74e - version: 0.1.4.dev16 + source-ref: f6a39833c34f2ff9b74d07c8c87370f86ffc2a49 + source-sha: f6a39833c34f2ff9b74d07c8c87370f86ffc2a49 + version: 0.1.4.dev20 latest: source-ref: e1f3c82caa3ed3b65de22889ae7ef32a774878ef source-sha: e1f3c82caa3ed3b65de22889ae7ef32a774878ef diff --git a/fern/pages-dev/CONTRIBUTING.mdx b/fern/pages-dev/CONTRIBUTING.mdx index e6676056a..bd3e66350 100644 --- a/fern/pages-dev/CONTRIBUTING.mdx +++ b/fern/pages-dev/CONTRIBUTING.mdx @@ -153,6 +153,7 @@ Use these consistently: | NVIDIA | Nvidia, nvidia | | OpenShell | Open Shell, openShell, Openshell, openshell | | mTLS | MTLS, mtls | +| snap, or Snap when required by sentence or title case | Snap as an inherent proper noun | | YAML | yaml, Yaml | ## Submitting Doc Changes diff --git a/fern/pages-dev/about/installation.mdx b/fern/pages-dev/about/installation.mdx index 36b03c943..2a2057ddb 100644 --- a/fern/pages-dev/about/installation.mdx +++ b/fern/pages-dev/about/installation.mdx @@ -86,7 +86,7 @@ The gateway reads `~/.config/openshell/gateway.toml` if it exists, otherwise the ## Linux -The script installs a Debian package on Debian and Ubuntu or an RPM package on Fedora and RHEL. Set `OPENSHELL_INSTALL_METHOD=snap` to install the [Snap](#snap) package instead; hosts that already have the OpenShell snap keep refreshing it. Linux packages require glibc 2.28 or newer. +The script installs a Debian package on Debian and Ubuntu or an RPM package on Fedora and RHEL. Set `OPENSHELL_INSTALL_METHOD=snap` to install the [snap](#snap) package instead; hosts that already have the OpenShell snap keep refreshing it. Linux packages require glibc 2.28 or newer. The gateway runs as a systemd user service at `https://127.0.0.1:17670` and reads `~/.config/openshell/gateway.toml`. @@ -142,7 +142,7 @@ openshell status Existing installations upgraded from the former `openshell.gateway` service retain their state under `/var/snap/openshell/common` through `openshell.system-gateway`. Existing HTTPS registrations continue to work because the endpoint and TLS identity do not change. -If this user still has an old HTTP registration, or has not previously been enrolled, wait for the system gateway to be active, copy its client credentials into the user's Snap state, and register its HTTPS endpoint: +If this user still has an old HTTP registration, or has not previously been enrolled, wait for the system gateway to be active, copy its client credentials into the user's snap state, and register its HTTPS endpoint: ```shell snap services openshell.system-gateway @@ -161,9 +161,9 @@ openshell gateway add https://127.0.0.1:17670 --local --name openshell openshell status ``` -Set `old_registration` to the name shown by `openshell gateway list`, and omit the variable assignment and `openshell gateway remove` when no registration exists. Older direct Snap instructions may have used `openshell-gateway`, while the install script uses `openshell`. +Set `old_registration` to the name shown by `openshell gateway list`, and omit the variable assignment and `openshell gateway remove` when no registration exists. Older direct snap instructions may have used `openshell-gateway`, while the install script uses `openshell`. -### Change the Snap gateway mode +### Change the snap gateway mode The user and system gateways have separate configuration, databases, and cryptographic identities. Changing modes does not migrate gateway or sandbox state and interrupts active sandbox sessions. Back up any state you need and delete active sandboxes before changing modes. diff --git a/fern/pages-dev/about/support-matrix.mdx b/fern/pages-dev/about/support-matrix.mdx index 3edbdafd0..25546e030 100644 --- a/fern/pages-dev/about/support-matrix.mdx +++ b/fern/pages-dev/about/support-matrix.mdx @@ -112,9 +112,9 @@ OpenShell publishes standalone `openshell-prover` release assets for manual down These artifacts are attached to GitHub releases. The Linux binaries are static and do not require glibc. All prover archives include the required solver linkage. -The Debian, RPM, Homebrew, and Snap packages also include the prover. Debian, +The Debian, RPM, Homebrew, and snap packages also include the prover. Debian, RPM, and Homebrew installations expose it as `openshell-prover`; use -`openshell.prover` with the Snap. The `openshell-prover` Snap alias requires +`openshell.prover` with the snap. The `openshell-prover` snap alias requires Store approval and may not be available. ## Runtimes diff --git a/fern/pages-dev/how-it-works/gateways/configuration.mdx b/fern/pages-dev/how-it-works/gateways/configuration.mdx index d3910f9fd..e14131264 100644 --- a/fern/pages-dev/how-it-works/gateways/configuration.mdx +++ b/fern/pages-dev/how-it-works/gateways/configuration.mdx @@ -65,7 +65,7 @@ Package-managed gateways use either built-in defaults or a package-seeded TOML f | Homebrew | `$XDG_CONFIG_HOME/openshell/gateway.toml` when it exists, otherwise the Homebrew prefix config such as `/opt/homebrew/var/openshell/gateway.toml`. | | Debian/Ubuntu | `$XDG_CONFIG_HOME/openshell/gateway.toml`, usually `~/.config/openshell/gateway.toml` for the systemd user service. | | Fedora/RHEL RPM | `$XDG_CONFIG_HOME/openshell/gateway.toml`, usually `~/.config/openshell/gateway.toml`; the systemd user service seeds this file from the packaged template on first start. | -| Snap | New installations use `$SNAP_USER_COMMON/.config/openshell/gateway.toml`, usually `~/snap/openshell/common/.config/openshell/gateway.toml`. Upgraded legacy installations retain `$SNAP_COMMON/gateway.toml`, usually `/var/snap/openshell/common/gateway.toml`. | +| snap | New installations use `$SNAP_USER_COMMON/.config/openshell/gateway.toml`, usually `~/snap/openshell/common/.config/openshell/gateway.toml`. Upgraded legacy installations retain `$SNAP_COMMON/gateway.toml`, usually `/var/snap/openshell/common/gateway.toml`. | The Fedora/RHEL RPM template leaves `[openshell.gateway].bind_address` unset. The gateway therefore uses its built-in `127.0.0.1:17670` primary listener. Host-networked Podman supervisors use that same loopback endpoint, so the primary listener does not need a wildcard address. Set `bind_address` explicitly only when clients must reach the primary multiplexed API through another interface. @@ -1335,7 +1335,7 @@ openshell-gateway config preflight -- --config /etc/openshell/gateway.toml --grp Debian and Ubuntu run preflight from the systemd user unit before local certificate generation. The unit still loads the `gateway.env` environment file and starts the -gateway with no configuration arguments. Snap replays the exact effective daemon +gateway with no configuration arguments. snap replays the exact effective daemon arguments through preflight. It gives a nonempty `OPENSHELL_GATEWAY_CONFIG` precedence; otherwise it validates and passes its canonical service-specific path only when that path exists in the filesystem. The legacy system service diff --git a/fern/pages-dev/how-it-works/policies/prover.mdx b/fern/pages-dev/how-it-works/policies/prover.mdx index 85a6096f6..87bacbc94 100644 --- a/fern/pages-dev/how-it-works/policies/prover.mdx +++ b/fern/pages-dev/how-it-works/policies/prover.mdx @@ -36,8 +36,8 @@ contain access that the proposal risk check would flag. This page covers the boundary check. To learn about the proposal risk check, refer to [Policy Advisor](/how-it-works/policies/advisor). -For Snap installations, replace `openshell-prover` in these examples with -`openshell.prover`. The `openshell-prover` Snap alias requires Store approval +For snap installations, replace `openshell-prover` in these examples with +`openshell.prover`. The `openshell-prover` snap alias requires Store approval and may not be available. The prover remains independent of the gateway at runtime. If you only need the @@ -60,9 +60,9 @@ or MCP rules, the prover reports that it cannot check the policy instead of ignoring those rules. [What the Boundary Check Covers](#what-the-boundary-check-covers) describes each part and its limits. -The Homebrew, Debian, RPM, and Snap packages install the prover. Homebrew, +The Homebrew, Debian, RPM, and snap packages install the prover. Homebrew, Debian, and RPM expose it as `openshell-prover`; use `openshell.prover` with the -Snap. The CLI reads policy files on your machine, does not need a gateway, and +snap. The CLI reads policy files on your machine, does not need a gateway, and does not apply or approve policies. Create `boundary.yaml`, a boundary that allows reading `/usr` and `/etc`: