mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-11-07 08:55:37 +08:00

Files

T

Simon Scatton aaba5f29cd build(nix): add per-crate crane workspace builds

Add crane-based package outputs for the main OpenShell crates and a default
symlinkJoin package. The new workspace helper derives each crate's transitive
workspace dependency closure, builds from minimal source trees, and declares the
assets each crate needs at compile time.

Build each crate in three layers:

1. crates.io dependencies with crane buildDepsOnly
2. first-party workspace dependency libraries
3. the final real crate

The workspace-libs layer builds the selected package with the same `-p <crate>`
selection as final so Cargo feature unification matches, but overlays a
crane-generated dummy source for the leaf crate. After that layer builds, remove
the dummy leaf artifacts with `cargo clean --release -p <crate>` so the final
layer cannot reuse or package stub outputs. This lets leaf edits reuse cached
first-party libs while still compiling and linking the real leaf crate.

Add explicit `[lib]` target names and `path = "src/lib.rs"` entries to
workspace crates. The Nix source minimizer keeps every member Cargo.toml but
omits source trees outside the selected crate closure; explicit target paths let
Cargo resolve those member manifests without relying on auto-discovery of files
that are intentionally absent. They also give crane's dummy source generation a
stable target shape.

Guard the openshell-core build script's `.git` rerun paths so Cargo does not
mark core dirty in Nix source trees where `.git` is absent. Without this, core
recompiled in the final layer and cascaded into its dependents.

Known limitation: the VM driver package is wired into the flake, but the Nix
build does not yet provide the compressed VM runtime artifacts that
openshell-driver-vm embeds. For now that crate builds via its stub-resource
fallback rather than producing a fully usable VM driver package.

Ignore Nix `result*` symlinks created by local builds.

2026-06-24 11:24:32 +02:00

src

feat(sandbox,providers): add aws-bedrock as a recognized inference provider (#1704 )

2026-06-23 13:10:37 -07:00

Cargo.toml

build(nix): add per-crate crane workspace builds

2026-06-24 11:24:32 +02:00

README.md

docs(architecture): reset subsystem docs (#1184 )

2026-05-07 08:59:02 -07:00

README.md

openshell-providers

Provider discovery and normalization for credentials that sandboxes need at runtime.

The gateway persists provider records. The sandbox supervisor fetches resolved provider environment from the gateway and injects credentials into agent child processes. This crate keeps provider-specific discovery and normalization logic out of the CLI and gateway control flow.

Responsibilities

Discover local credentials from environment variables and known config files.
Normalize discovered data into provider records.
Keep provider-specific parsing rules in provider modules.
Avoid logging credential values.

Non-Responsibilities

Persisting provider records.
Authorizing provider CRUD operations.
Injecting credentials into sandbox child processes.
Routing inference requests.

Those are owned by the gateway, sandbox supervisor, and router.

Security Notes

Provider data often contains API keys, bearer tokens, or local account configuration. Discovery code should return structured values without printing or tracing secrets. Callers that display provider data must redact sensitive fields by default.