mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Grace Smith
deced8716b
Move L7 endpoint semantic checks into the openshell-policy crate so both
profile lint and the runtime validator share one implementation. This
eliminates drift between the two validation paths.
The shared validator covers 9 checks: unknown protocol, rules/access
mutual exclusivity, JSON-RPC family access rejection, json-rpc requires
rules, non-JSON-RPC protocol requires rules or access, MCP requires
rules when allow_all is false, rules-would-deny-all detection,
deny_rules require protocol, and deny_rules require base allow set.
Changes rules/deny_rules fields to Option<Vec<...>> so absent vs empty
is distinguishable at lint time. Adds is_effectively_empty() to
L7AllowProfile for deny-all detection of allow: {} objects. Makes
rules_would_deny_all MCP-aware by checking tool/params.name selectors
before classifying a rule as deny-all. Adds params field to
L7AllowProfile so MCP tool selectors survive proto round-trip.
Signed-off-by: Grace Smith <gsmith@redhat.com>
Signed-off-by: Grace Smith <grasmith@redhat.com>
openshell-providers
Provider discovery and normalization for credentials that sandboxes need at runtime.
The gateway persists provider records. The sandbox supervisor fetches resolved provider environment from the gateway and injects credentials into agent child processes. This crate keeps provider-specific discovery and normalization logic out of the CLI and gateway control flow.
Responsibilities
- Discover local credentials from environment variables and known config files.
- Normalize discovered data into provider records.
- Keep provider-specific parsing rules in provider modules.
- Avoid logging credential values.
Non-Responsibilities
- Persisting provider records.
- Authorizing provider CRUD operations.
- Injecting credentials into sandbox child processes.
- Routing inference requests.
Those are owned by the gateway, sandbox supervisor, and router.
Security Notes
Provider data often contains API keys, bearer tokens, or local account configuration. Discovery code should return structured values without printing or tracing secrets. Callers that display provider data must redact sensitive fields by default.