mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
krishicksandddurst
7bce1223dc
Add policy schema, proto, provider profile, OPA, and L7 proxy support for `protocol: json-rpc` and `protocol: mcp`. Generic JSON-RPC endpoints match exact method names only, with `method: "*"` as the all-method sentinel; wildcard/glob methods and params matchers are rejected. Parse JSON-RPC request bodies and batches in the forward proxy, deny response-shaped client frames, limit receive-stream GET allowance to MCP endpoints, and redact params in decision logs. Preserve L7 rule params on the proto load path so MCP `tools/call` tool filters behave like YAML-loaded policies. Add MCP conformance coverage, JSON-RPC L7 e2e coverage, and docs for the new protocols and current matcher limitations. Signed-off-by: Kris Hicks <khicks@nvidia.com> Co-authored-by: ddurst <267424412+ddurst-nvidia@users.noreply.github.com>
157 lines
4.2 KiB
TOML
157 lines
4.2 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[workspace]
|
|
resolver = "2"
|
|
members = ["crates/*"]
|
|
|
|
[workspace.package]
|
|
version = "0.0.0"
|
|
edition = "2024"
|
|
rust-version = "1.90"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/NVIDIA/OpenShell"
|
|
|
|
[workspace.dependencies]
|
|
# Async runtime
|
|
tokio = { version = "1.43", features = ["full"] }
|
|
|
|
# gRPC/Protobuf
|
|
tonic = "0.14"
|
|
tonic-prost = "0.14"
|
|
tonic-prost-build = "0.14"
|
|
prost = "0.14"
|
|
prost-types = "0.14"
|
|
|
|
# HTTP server
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["cors", "trace", "request-id"] }
|
|
hyper = { version = "1.6", features = ["full"] }
|
|
hyper-util = { version = "0.1", features = ["tokio", "server-auto"] }
|
|
http = "1.2"
|
|
http-body = "1.0"
|
|
http-body-util = "0.1"
|
|
|
|
# TLS
|
|
tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
|
|
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }
|
|
rustls-pemfile = "2"
|
|
rcgen = { version = "0.13", features = ["crypto", "pem"] }
|
|
webpki-roots = "1"
|
|
|
|
# CLI
|
|
clap = { version = "4.5", features = ["derive", "env"] }
|
|
clap_complete = { version = "4.5", features = ["unstable-dynamic"] }
|
|
indicatif = "0.17"
|
|
owo-colors = "4"
|
|
ratatui = "0.26"
|
|
crossterm = "0.28"
|
|
terminal-colorsaurus = "1.0"
|
|
|
|
# Error handling
|
|
miette = { version = "7", features = ["fancy"] }
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
|
|
# Logging/Tracing
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
tracing-appender = "0.2"
|
|
|
|
# Metrics
|
|
metrics = "0.24"
|
|
metrics-exporter-prometheus = { version = "0.18", default-features = false, features = ["http-listener"] }
|
|
|
|
# Unix/Process
|
|
nix = { version = "0.29", features = ["signal", "process", "user", "fs", "term"] }
|
|
rustix = { version = "1.1", features = ["process"] }
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yml = "0.0.12"
|
|
toml = "0.8"
|
|
apollo-parser = "0.8.5"
|
|
tower-mcp-types = "0.12.0"
|
|
|
|
# HTTP client
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }
|
|
|
|
# WebSocket
|
|
tokio-tungstenite = { version = "0.26", features = ["rustls-tls-native-roots"] }
|
|
|
|
# Clipboard (OSC 52)
|
|
base64 = "0.22"
|
|
|
|
# Crypto / Auth
|
|
sha2 = "0.10"
|
|
rand = "0.9"
|
|
jsonwebtoken = "9"
|
|
getrandom = "0.3"
|
|
spiffe = { version = "0.15", default-features = false, features = ["workload-api-jwt", "tracing"] }
|
|
|
|
# Filesystem embedding
|
|
include_dir = "0.7"
|
|
|
|
# Glob matching
|
|
glob = "0.3"
|
|
|
|
# Utilities
|
|
futures = "0.3"
|
|
bytes = "1"
|
|
pin-project-lite = "0.2"
|
|
tokio-stream = "0.1"
|
|
protobuf-src = "1.1.0"
|
|
url = "2"
|
|
|
|
# Database
|
|
sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "sqlite", "migrate"] }
|
|
|
|
# Kubernetes
|
|
kube = { version = "0.90", features = ["runtime", "derive"] }
|
|
kube-runtime = "0.90"
|
|
k8s-openapi = { version = "0.21.1", features = ["v1_26"] }
|
|
|
|
# IDs
|
|
uuid = { version = "1.10", features = ["v4"] }
|
|
|
|
# SMT solver (uses system libz3; enable z3/bundled via the prover's bundled-z3 feature for local dev without system z3)
|
|
z3 = "0.19"
|
|
|
|
[workspace.lints.rust]
|
|
unsafe_code = "warn"
|
|
rust_2018_idioms = { level = "warn", priority = -1 }
|
|
trivial_casts = "warn"
|
|
trivial_numeric_casts = "warn"
|
|
unused_lifetimes = "warn"
|
|
unused_qualifications = "warn"
|
|
|
|
[workspace.lints.clippy]
|
|
all = { level = "warn", priority = -1 }
|
|
pedantic = { level = "warn", priority = -1 }
|
|
nursery = { level = "warn", priority = -1 }
|
|
|
|
# Allow certain pedantic lints that are too noisy
|
|
module_name_repetitions = "allow"
|
|
must_use_candidate = "allow"
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
|
|
# Allow noisy nursery lints
|
|
significant_drop_tightening = "allow" # Often gives incorrect suggestions
|
|
missing_const_for_fn = "allow" # Too noisy for async code patterns
|
|
|
|
# Allow noisy pedantic lints
|
|
too_many_lines = "allow" # Function length limits are subjective
|
|
needless_pass_by_value = "allow" # Common pattern in async handlers
|
|
ref_option = "allow" # Common pattern for optional references
|
|
missing_fields_in_debug = "allow" # Manual Debug impls often intentionally omit fields
|
|
|
|
[profile.release]
|
|
strip = true
|
|
|
|
[profile.dev]
|
|
# Faster compile times for dev builds
|
|
debug = 1
|