Drew Newberry d4f5034d7f fix(gateway)!: make the WebSocket tunnel opt-in (#3727) ...

The /_ws_tunnel endpoint pipes a WebSocket into the full gRPC service. On a
plaintext loopback gateway any web page could open it, since browsers do not
apply CORS to WebSocket upgrades. Mount the tunnel only when
enable_websocket_tunnel is set (config file, --enable-websocket-tunnel, or
OPENSHELL_ENABLE_WEBSOCKET_TUNNEL; server.enableWebsocketTunnel in Helm).

BREAKING CHANGE: gateways behind an authenticating edge proxy must set
enable_websocket_tunnel = true for CLI edge-tunnel connections.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

2026-09-25 23:43:18 +00:00

..

proto

feat(extensions)!: normalize protocol negotiation (#3352)

2026-09-21 13:19:39 -07:00

activity.rs

refactor(openshell-sandbox): Split sandbox into process and network subcrates. (#1650)

2026-06-15 15:16:23 -04:00

auth.rs

feat(auth): per-sandbox authentication to gateway (#1404)

2026-05-21 17:58:55 -07:00

config.rs

fix(gateway)!: make the WebSocket tunnel opt-in (#3727)

2026-09-25 23:43:18 +00:00

container_paths.rs

refactor(config): normalize and enforce gateway schema v2 (#2814)

2026-09-11 05:00:24 +00:00

denial.rs

refactor(openshell-sandbox): Split sandbox into process and network subcrates. (#1650)

2026-06-15 15:16:23 -04:00

driver_mounts.rs

feat(gateway,cli): windows compilation support (#2496)

2026-08-11 21:00:36 +00:00

driver_utils.rs

feat(kubernetes): support corporate proxy CA bundle (#3447)

2026-09-22 17:57:40 +00:00

dynamic_string_allowlist.rs

refactor(compute): decouple gateway driver composition (#2823)

2026-09-01 21:13:45 +00:00

endpoint_path.rs

feat(proxy): bind static credentials to provider endpoints (#2510)

2026-08-10 19:19:45 +00:00

endpoint_status.rs

refactor(proto)!: use well-known time types (#3113)

2026-09-16 19:51:45 +00:00

error.rs

refactor(compute): decouple gateway driver composition (#2823)

2026-09-01 21:13:45 +00:00

extension_protocol.rs

feat(extensions)!: normalize protocol negotiation (#3352)

2026-09-21 13:19:39 -07:00

external_driver_socket.rs

feat(compute): add standalone first-party drivers (#2822)

2026-08-21 02:49:55 +00:00

forward.rs

feat(api)!: use sandbox names as canonical RPC references (#3272)

2026-09-18 11:39:55 -07:00

google_cloud.rs

feat(sandbox): add GCE metadata emulator for Google Cloud (#1763)

2026-06-23 15:05:07 -05:00

gpu.rs

feat(cli): add GPU count requests (#1812)

2026-06-23 21:49:02 -07:00

grpc_client.rs

fix(auth): skip renewal for non-expiring sandbox JWTs (#3686)

2026-09-25 03:40:09 +00:00

host_pattern.rs

feat(proxy): bind static credentials to provider endpoints (#2510)

2026-08-10 19:19:45 +00:00

image.rs

refactor(runtime): retire Community image dependencies (#3386)

2026-09-22 14:43:51 +02:00

jwt.rs

fix(sandbox): preserve local sessions across host sleep (#3573)

2026-09-24 17:22:30 +00:00

lib.rs

fix(drivers): require admission labels for external resources (#3538)

2026-09-22 21:22:30 +00:00

local_api_socket.rs

refactor(compute): decouple gateway driver composition (#2823)

2026-09-01 21:13:45 +00:00

mcp.rs

feat(policy): establish one canonical authored policy representation (#3334)

2026-09-16 17:36:31 +00:00

metadata.rs

refactor(proto): isolate gateway storage messages (#3169)

2026-09-10 16:36:07 +00:00

middleware.rs

feat(extensions)!: normalize protocol negotiation (#3352)

2026-09-21 13:19:39 -07:00

net.rs

perf(net): set TCP_NODELAY on latency-sensitive TCP hops (#2220)

2026-08-04 17:59:13 +00:00

oauth.rs

chore(deps): replace ring with AWS-LC (#3243)

2026-09-09 17:57:42 +00:00

paths.rs

feat(policy): establish one canonical authored policy representation (#3334)

2026-09-16 17:36:31 +00:00

policy_identity.rs

feat(sandbox): explain failed calls to external tool servers (#3207)

2026-09-15 13:46:38 +00:00

policy.rs

refactor(inference): remove managed inference routes (#3195)

2026-09-09 18:47:22 +00:00

progress.rs

refactor: deduplicate shared utilities across driver crates (#1660)

2026-06-01 15:38:15 -07:00

proposals.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

proto_struct.rs

feat(supervisor-middleware): add network egress middleware (#2027)

2026-07-16 17:47:49 -07:00

provider_credentials.rs

feat(sandbox): validate configuration before workload activation (#3259)

2026-09-18 00:16:18 +00:00

resource_admission.rs

fix(drivers): require admission labels for external resources (#3538)

2026-09-22 21:22:30 +00:00

rpc_error.rs

feat(api): add structured gateway errors and SDK decoding (#3313)

2026-09-15 17:51:11 +00:00

sandbox_env.rs

refactor(runtime): retire Community image dependencies (#3386)

2026-09-22 14:43:51 +02:00

sandbox_generation.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

sandbox_session.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

secrets_body.rs

fix(supervisor): classify credential placeholders in request bodies (#3246)

2026-09-10 23:10:01 +00:00

secrets.rs

fix(supervisor): classify credential placeholders in request bodies (#3246)

2026-09-10 23:10:01 +00:00

settings.rs

feat(ocsf): configurable schema version for SIEM backward compatibility (#2717)

2026-09-04 18:43:58 +00:00

shell.rs

refactor(runtime): retire Community image dependencies (#3386)

2026-09-22 14:43:51 +02:00

spiffe.rs

feat(provider): support for SPIFFE backed token exchange (#1970)

2026-08-24 05:42:30 +00:00

telemetry.rs

chore(deps): replace ring with AWS-LC (#3243)

2026-09-09 17:57:42 +00:00

time.rs

refactor(proto)!: use well-known time types (#3113)

2026-09-16 19:51:45 +00:00

transport_errors.rs

fix(podman): tolerate shutdown transport closes (#2498)

2026-07-28 08:00:37 +00:00