mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-07 08:55:37 +08:00
Simon Scatton
aaba5f29cd
Add crane-based package outputs for the main OpenShell crates and a default symlinkJoin package. The new workspace helper derives each crate's transitive workspace dependency closure, builds from minimal source trees, and declares the assets each crate needs at compile time. Build each crate in three layers: 1. crates.io dependencies with crane buildDepsOnly 2. first-party workspace dependency libraries 3. the final real crate The workspace-libs layer builds the selected package with the same `-p <crate>` selection as final so Cargo feature unification matches, but overlays a crane-generated dummy source for the leaf crate. After that layer builds, remove the dummy leaf artifacts with `cargo clean --release -p <crate>` so the final layer cannot reuse or package stub outputs. This lets leaf edits reuse cached first-party libs while still compiling and linking the real leaf crate. Add explicit `[lib]` target names and `path = "src/lib.rs"` entries to workspace crates. The Nix source minimizer keeps every member Cargo.toml but omits source trees outside the selected crate closure; explicit target paths let Cargo resolve those member manifests without relying on auto-discovery of files that are intentionally absent. They also give crane's dummy source generation a stable target shape. Guard the openshell-core build script's `.git` rerun paths so Cargo does not mark core dirty in Nix source trees where `.git` is absent. Without this, core recompiled in the final layer and cascaded into its dependents. Known limitation: the VM driver package is wired into the flake, but the Nix build does not yet provide the compressed VM runtime artifacts that openshell-driver-vm embeds. For now that crate builds via its stub-resource fallback rather than producing a fully usable VM driver package. Ignore Nix `result*` symlinks created by local builds.
openshell-router
openshell-router is the inference routing and upstream execution engine used
by the sandbox proxy and gateway inference validation paths.
Responsibilities
- Select an upstream route from a candidate set (based on protocol compatibility).
- Forward raw HTTP requests to the selected upstream backend.
- Normalize upstream failures into router-level errors (
unauthorized,unavailable, protocol/internal errors). - Keep routing decision logic in one place so strategies can evolve (fallbacks, scoring, health-based routing).
Non-responsibilities
- Authentication and sandbox identity.
- Authorization and policy enforcement.
- Persistence of routes/entities.
- Loading sandbox or policy objects.
These are owned by openshell-server and openshell-sandbox.
Integration Contract
Current split:
openshell-server:- authenticates user-facing inference configuration changes
- resolves managed route candidates from provider records
- validates backend endpoints
openshell-sandbox:- intercepts
https://inference.local - detects the source inference protocol
- passes sanitized requests and resolved route candidates to the router
- intercepts
openshell-router:- picks a route from candidates (
proxy_with_candidates) - forwards the HTTP request upstream and returns the raw response
- picks a route from candidates (
Public APIs
Router::proxy_with_candidates(source_protocol, method, path, headers, body, &[ResolvedRoute])- Filters candidates by protocol compatibility, then forwards the request to the first match.
- Preferred path for entity-driven server routing.
Notes
- Route selection matches candidates by
protocolfield (e.g.openai_chat_completions). - Route selection is intentionally simple and will evolve.