Sensitive files in the OpenShell config directory (~/.config/openshell/)
were created with default umask permissions, making them world-readable.
This is a security concern for mTLS private keys (tls.key) and auth
tokens.
- Add centralized paths module to openshell-core with permission helpers
(create_dir_restricted 0o700, set_file_owner_only 0o600)
- Set 0o600 on tls.key in mtls.rs (was inheriting umask, typically 0o644)
- Set 0o700 on all config directories (mtls/, gateways/, forwards/, etc.)
- Migrate legacy cf_token files to new edge_token path with proper perms
- Deduplicate xdg_config_dir() from 6 locations into openshell-core
Compute version strings from git describe in openshell-core's build.rs
using the guess-next-dev scheme (e.g. 0.0.4-dev.6+g2bf9969). All binary
crates and the TUI splash screen now use the shared openshell_core::VERSION
constant instead of CARGO_PKG_VERSION.
In Docker/CI builds where .git is absent, falls back to CARGO_PKG_VERSION
which is already set correctly by the sed-patch pipeline. Also adds
OPENSHELL_CARGO_VERSION support to the cluster image and fast-deploy
supervisor builds for parity with the gateway.
* feat(sandbox): add gpu sandbox scheduling support
Allow sandbox creation to request GPU resources explicitly or infer them from GPU image names. This wires GPU intent through bootstrap, validates gateway support, and adds dedicated GPU E2E coverage for follow-up cluster testing.
Drew Newberry