mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
Derek Carr
5952a5a23f
* feat(workspace): implement workspace model (Phase 1 of RFC 0011) Implements workspace and membership model providing hard isolation boundaries for multi-player OpenShell deployments. Workspace CRUD with Kubernetes-style Terminating phase for graceful deletion. All resources scoped by workspace via ObjectMeta. Membership RPCs for workspace access control. Persistence migration shifts name uniqueness to (object_type, workspace, name). Provider profiles support platform and workspace scoping. Service routing uses workspace-prefixed DNS labels. Inference routes renamed and workspace-scoped with DeleteInferenceRoute RPC. Python SDK with WorkspaceClient, two-method list pattern (workspace-scoped and for_all_workspaces), and workspace parameter on all methods. CLI workspace flags, TUI workspace cycling. K8s driver filters unmanaged CRs and uses delete preconditions. Podman driver uses immutable container IDs. Label serialization fixed across all put_if call sites. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(cli): delegate sandbox upload command to existing upload function The standalone `sandbox upload` command reimplemented upload logic inline with two bugs: it used `Path::exists()` which follows symlinks (rejecting dangling symlinks), and it ran git-aware filtering on symlink sources. The `run::sandbox_upload()` function already handles both cases correctly via `sandbox_upload_plan()`. Replace the inline logic with a call to the existing function. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(e2e): shorten sandbox names and fix test compatibility Shorten the sandbox name in initial_sparse_policy_is_acknowledged_as_loaded from 'e2e-2159-sparse-enrich' (22 chars) to 'e2e-sparse-enrich' (17 chars) to comply with MAX_ROUTABLE_NAME_LEN (19 chars). Also capture stderr in create_keep_with_args so future sandbox creation failures include the actual CLI error instead of reporting empty output. Signed-off-by: Derek Carr <decarr@redhat.com> * test(workspace): add test coverage for workspace CRUD and persistence isolation Add unit tests for workspace create happy path, get round-trip, get not-found, get empty-name rejection, already-exists error, and resolve_workspace not-found. Add persistence test proving cross-workspace name uniqueness (same name in different workspaces produces separate records). Add workspace name max-length boundary tests. Fix e2e harness to include stderr in name-parse-failure error path. Align Python e2e test_workspace_crud with try/finally pattern. Document provider profile catalog workspace scoping gap in RFC 0011. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(examples): update examples for workspace model compatibility Shorten sandbox names in demo scripts to fit the 19-character MAX_ROUTABLE_NAME_LEN limit: policy-demo prefix to pd-, multi-agent notepad derives a short SANDBOX_TAG from the run ID, governance interceptor uses gs-PID-RANDOM. Update vscode-remote-sandbox.md SSH host aliases from openshell-{name} to openshell-{name}.{workspace} format. Signed-off-by: Derek Carr <decarr@redhat.com> * feat(sdk): add workspace-scoped client and workspace CRUD Add WorkspaceScopedClient modeled after kube::Api::namespaced — captures workspace once and injects it into every sandbox request. Add workspace CRUD methods (create, get, list, delete) and list_sandboxes_all_workspaces on OpenShellClient. Extend SandboxRef with workspace field and add WorkspaceRef type. Include mock tests for all new operations. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(lint): resolve clippy warnings in workspace test assertions Signed-off-by: Derek Carr <decarr@redhat.com> * fix(docs): convert indented code blocks to fenced in RFC 0011 Signed-off-by: Derek Carr <decarr@redhat.com> * fix(lint): resolve clippy warnings and apply cargo fmt across workspace Auto-format with cargo fmt and fix clippy warnings exposed by the reformat: unnecessary qualifications, map_unwrap_or, identical match arms, unused variable prefix, dead code annotations, and let-unit-value in e2e harness. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(workspace): address workspace scoping issues from review - Add workspace field to settings JSON output (CLI) - Skip Podman containers missing workspace label instead of defaulting to empty string, matching K8s driver behavior - Add resource_version to list_by_scope SELECT in both SQLite and Postgres backends, with regression test - Gate PolicyLocalContext proposal/lookup routes on workspace readiness, returning 503 when workspace is not yet discovered - Block sandbox and provider creation in TUI all-workspaces mode - Clear workspace vectors in TUI reset_sandbox_state Signed-off-by: Derek Carr <decarr@redhat.com> * fix(workspace): make provider profile catalog workspace-aware Thread workspace through snapshot_catalog so the EffectiveProviderProfileCatalog enforces workspace boundaries on both read and write paths. UserProviderProfileSource now loads platform-scoped profiles (workspace "") plus the target workspace's profiles, preventing cross-workspace duplicate profile ID collisions that previously caused global catalog failures. Update RFC 0011 to reflect catalog scoping is implemented in Phase 1 rather than deferred to future work. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(persistence): include workspace column in atomic policy revision INSERT put_policy_revision_atomic omitted the workspace column from the INSERT into the objects table in both SQLite and Postgres backends, causing atomically-written policy revisions to lose their workspace association. Add workspace field to AtomicPolicyRevisionWrite and thread it through both backend INSERT statements, matching the non-atomic put_policy_revision path which already included it. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(proxy): skip ancestor walk when socket owner is the entrypoint collect_ancestor_identities walked the entire process tree above the entrypoint when the connecting process was the entrypoint itself, SHA256-hashing every ancestor binary (IDE, shell, container runtime). On dev machines with large binaries in the ancestor chain this exceeded the 30-second test timeout. When start_pid == stop_pid there are no intermediate ancestors to verify, so return an empty list immediately. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(workspace): make provider profile catalog scope-aware Allow the same profile ID at platform and workspace scopes by introducing layered catalog entries where workspace profiles shadow platform profiles. Add source and scope fields to the ProviderProfile proto and CLI output. Migrate List/Get handlers to the catalog, fixing divergence with runtime profile resolution. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(e2e): align podman e2e labels with centralized driver constants The podman driver moved its container labels to the centralized openshell.ai/ prefix, but the e2e test harness and cleanup script still referenced the old openshell.sandbox-* keys, causing the local_driver_token_restart test to fail on container lookup. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(e2e): align python profile isolation test with scope-aware catalog Platform profiles are now visible in workspace listings as fallbacks per the layered catalog design. Update the assertion to match. Signed-off-by: Derek Carr <decarr@redhat.com> * fix(workspace): honor profile_workspace in runtime profile resolution Runtime profile lookups now consult provider.profile_workspace via get_type_profile_for_scope. Providers created with --global-profile (profile_workspace="") resolve to the platform profile even when a workspace profile shadows the same ID. All 6 runtime call sites updated; type-only call sites remain scope-agnostic. Signed-off-by: Derek Carr <decarr@redhat.com> --------- Signed-off-by: Derek Carr <decarr@redhat.com>
Gator Agent
Launch a headless sandbox agent that runs the gator-gate skill against OpenShell issues and pull requests. The default and currently only supported harness is Codex.
Prerequisites
ghis authenticated on the host and has access toNVIDIA/OpenShellandNVIDIA/OpenShell-Community.- For
--harness codex,codex loginhas created$HOME/.codex/auth.json. - For
--harness codex, local Codex auth must include an access token, refresh token, and account ID. - A local gateway is available when using the default local Dockerfile source.
Usage
./scripts/agents/run.sh \
--agent gator \
--gateway docker-dev \
--harness codex \
"Run gator on PR 1536 and keep watching until it closes or merges."
By default the launcher uses scripts/agents/gator/Dockerfile as the sandbox source. Local gateways build scripts/agents/gator/ as the image context, so gator-specific image files such as policy.yaml and bin/gh stay with the gator agent. The launcher bakes rendered prompts, skills, subagents, and shared runtime files into /etc/openshell/agent-payload, so --from must point to a local Dockerfile or directory containing a Dockerfile.
Use --harness codex to select Codex explicitly. Other harness names are rejected until their support is added to agent.yaml and scripts/agents/runtime/harnesses/<name>/. Agent directories do not carry their own harness implementations; they provide prompt templates and optional skills or subagents for the shared runtime to inject.
Use --codex-bin "$(command -v codex)" only when the host executable is compatible with the sandbox OS and architecture.
The manifest-driven launcher at scripts/agents/run.sh reads agent.yaml, which defines the agent prompt template, provider profile IDs, provider credential sources, gateway settings, skills, subagents, sandbox defaults, runtime mode, and harness defaults. The shared sandbox entrypoint at scripts/agents/runtime/entrypoint.sh starts the in-sandbox supervisor, which invokes the selected harness adapter for bounded cycles.
The launcher:
- Scans
profile_pathsin manifest order and importsproviders/github-gator.yaml. - Creates or updates the
github-gatorprovider fromgh auth token. - Selects the requested harness and bakes the common runtime into the immutable sandbox payload.
- For
--harness codex, importsproviders/codex-gator.yaml, creates or updates thecodex-gatorprovider from$HOME/.codex/auth.json, and stores the refresh token as gateway-only refresh material. - For
--harness codex, configures gateway-managed refresh forCODEX_AUTH_ACCESS_TOKENand rotates it before launching the sandbox. - Enables
providers_v2_enabled,agent_policy_proposals_enabled, andproposal_approval_mode=autoat gateway scope. - Uses the gator image policy copied to
/etc/openshell/policy.yaml. - Installs the gator-specific
ghwrapper fromgator/bin/ghas/usr/local/bin/ghto prevent duplicate same-head-SHA gator dispositions. - Bakes
scripts/agents/gator/skills/gator-gate/SKILL.mdinto/etc/openshell/agent-payload. - Bakes
.claude/agents/principal-engineer-reviewer.mdso the selected harness can run a deterministic independent reviewer execution through/etc/openshell/agent-payload/runtime/subagent.sh principal-engineer-reviewer < task.md. - For
--harness codex, optionally bakes a host Codex executable as/etc/openshell/agent-payload/runtime/harnesses/codex/codex. - Starts the selected harness without a TTY.
- Runs gator in
watchmode by default. The sandbox stays alive while the supervisor sleeps between bounded Codex cycles, so Codex is not connected during passive PR waits. The supervisor prints periodic heartbeat lines during active cycles and passive sleeps. The GitHub provider profile allows read-only GraphQL queries onapi.github.com/graphqlsoghread paths can use GraphQL when needed. Write operations remain REST-only and scoped to the two allowed repositories.
Set GATOR_CODEX_ACCESS_CREDENTIAL_KEY or pass --codex-access-key if the gator Codex profile uses a credential key other than CODEX_AUTH_ACCESS_TOKEN for the short-lived access token.
Use --once for a single reconciliation cycle. Use --poll-interval <seconds> to change the default 15-minute watch cadence.
The launcher preserves existing gateway-owned Codex refresh material by default so multiple gator sandboxes do not overwrite each other's refresh-token lineage from host Codex auth. If gateway rotation fails, the launcher automatically resets gateway refresh material from host Codex auth and retries once. After codex logout && codex login, you can also pass --reset-refresh to force that reset before rotation.