mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-19 05:50:41 +08:00

Files

T

History

Max Dubrinsky 5d5cfe9a0d feat(sdk): extract openshell-sdk crate

Per RFC 0005, lift the gRPC client, TLS, OIDC, edge-tunnel, and refresh
plumbing out of openshell-cli into a new openshell-sdk crate. CLI and
TUI now consume the SDK; openshell-cli/src/{tls.rs,oidc_auth.rs} shrink
to thin wrappers over the SDK's transport and OIDC modules.

- New crate openshell-sdk exposes a typed gRPC client, TLS resolver,
  OidcRefresher with single-flight semantics, edge-tunnel dialer, and a
  Sandbox-API surface that mirrors the existing CLI behavior.
- crates/openshell-core/src/auth.rs moves into the SDK as auth.rs.
- crates/openshell-cli/src/edge_tunnel.rs moves into the SDK as
  edge_tunnel.rs.

Tests: 3 unit + 10 mock-gateway integration tests in openshell-sdk.
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>

2026-06-26 12:42:11 -04:00

src

feat(sdk): extract openshell-sdk crate

2026-06-26 12:42:11 -04:00

build.rs

feat(providers): support SPIFFE-backed token grants (#1784 )

2026-06-10 10:54:39 -07:00

Cargo.toml

test(e2e): stop using custom e2e binary builds (#2000 )

2026-06-25 13:08:04 +00:00

README.md

docs(architecture): reset subsystem docs (#1184 )

2026-05-07 08:59:02 -07:00

README.md

openshell-core

Shared types, constants, configuration, and helpers used across OpenShell crates.

Object Metadata

Top-level user-facing objects use a Kubernetes-style metadata convention. The metadata shape provides:

Stable server-generated ID.
Human-readable name.
Creation timestamp.
Optional labels for filtering and automation.

Code that works with object metadata should use the traits in openshell_core::metadata instead of reaching into protobuf fields directly:

use openshell_core::{ObjectId, ObjectLabels, ObjectName};

let id = sandbox.object_id();
let name = sandbox.object_name();
let labels = sandbox.object_labels();

Trait methods must tolerate missing metadata and return safe empty values rather than panicking.

Label Rules

Labels follow Kubernetes-style key and value conventions:

Keys may include an optional DNS-prefix followed by /.
Names are limited to alphanumeric characters plus -, _, and ..
Values use the same character set and may be empty.
Selectors use comma-separated key=value pairs with AND semantics.

Validate labels at API ingress before persisting objects.

Inference Profiles

Provider inference profiles live in this crate so the gateway, sandbox, and router agree on provider defaults. Profiles define:

Auth header style.
Default upstream headers.
Client-supplied passthrough headers.
Supported inference protocol shapes.

Do not duplicate provider-specific inference behavior in callers. Add shared behavior here, then consume it from the gateway, sandbox, and router.