OpenShell v0.1.0

OpenShell v0.1.0

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.0 sh

What's Changed

• ci(codeql): run nightly scans on main by @alangou in #3007
• feat!(ci): remove daily minor release automatic workflow by @SDAChess in #3008
• fix(kubernetes): recover compute driver watches by @jhjaggars in #2842
• fix(cli): include provider identity metadata for interceptors on update by @slopp in #3014
• fix(sandbox): complete successful main processes by @drew in #2884
• fix(ci): preserve VM runtime embedding inputs by @SDAChess in #3040
• feat(sandbox): add --no-login-shell to skip shell startup files on exec by @letv1nnn in #2852
• fix(compute): recover Error-phase sandboxes on gateway startup by @r3v5 in #2269
• feat(compute): delegate sandbox authentication to drivers by @drew in #2968
• fix(cli): reject out-of-range durations instead of overflowing by @natedemoss in #3044
• docs: correct some comments and references by @krishicks in #3059
• test: backfill coverage for OCSF logging by @krishicks in #3065
• fix(kubernetes): prevent stop-start relay race by @johntmyers in #3064
• fix(policy): compose advisor proposals with provider endpoints by @johntmyers in #2935
• chore(deps): remove legacy rustls webpki path by @elezar in #3013
• test(e2e): run conformance in gateway lanes by @elezar in #2925
• feat(ci): add Codex Security release qualification by @alangou in #3087
• fix(cli): fail sandbox exec when relay closes without exit status by @rootkiller6788 in #2957
• fix(podman): restore rootless workload SIGTERM shutdown by @elezar in #3036
• ci(release): publish prerelease artifacts by @SDAChess in #3093
• fix(release): handle prerelease tag builds by @SDAChess in #3094
• feat(cli): add structured output to list commands by @mrunalp in #3067
• fix(release): provide conformance binary to e2e by @SDAChess in #3097
• fix(policy): ignore advisor provenance during contract inference by @johntmyers in #3069
• fix(gateway): batch SSH session cleanup writes by @drew in #3000
• fix(helm): honor empty clientCaSecretName for HTTPS-only mode by @lunarwhite in #2235
• fix(server): release driver-owned sandbox resources on out-of-band removal by @politerealism in #3042
• fix(sandbox): reconcile early container exits by @johntmyers in #3101
• feat(providers): make profiles authoritative by @johntmyers in #2962
• fix(cli): size auto-detected interactive exec terminals by @elezar in #3084
• fix(cli): allow multiple provider profiles to be deleted by @grs in #3032
• feat(build): add defaults-without-telemetry feature alias by @russellb in #2843
• fix(cli): suppress ANSI color when stdout is not a terminal by @mrunalp in #3026
• refactor(compute): decouple gateway driver composition by @drew in #2823
• fix(cli): continue multi-item deletes after failures by @grs in #3111
• feat(helm): split gateway and workspace charts by @dhirajsb in #2643
• fix(tui): expose workspace switching from providers by @johntmyers in #3115
• chore(gator): adopt authoritative provider profiles by @johntmyers in #3108
• feat(server): add sandbox templates by @grs in #2833
• fix(release): publish prerelease helm charts by @SDAChess in #3126
• test(guest): consolidate rootless Podman provisioning by @elezar in #3125
• ci: add Fedora conformance workflow by @SDAChess in #3086
• fix(ci): use multi-arch Fedora image for RPM builds by @SDAChess in #3130
• feat(vm): support corporate HTTP forward proxy egress for microVM sandboxes by @feloy in #3090
• fix(cli): require ANSI-capable terminal before colorizing by @mrunalp in #3121
• fix(tui): replace alpha badges with version by @johntmyers in #3114
• feat(skills): separate public and contributor workflows by @johnnygreco in #2899
• fix(go-sdk): prevent duplicate credential renewal by @johntmyers in #3133
• fix(cli): preserve provider type on credential updates by @natedemoss in #3109
• test(e2e): keep lifecycle sandboxes running by @elezar in #3128
• fix(vm): retry transient registry requests by @drew in #3134
• fix(compute): fence stale container exits during start by @drew in #3132
• ci: add branch check and test timeouts by @pimlock in #3139
• fix(middleware): drain websocket session end streams by @pimlock in #3143
• fix(deps): remediate h2 advisory by @elezar in #3085
• docs: fix first-network-policy sandbox lifecycle flow by @russellb in #3140
• chore(ci): remove obsolete Rust cache seeder by @pimlock in #3148
• fix(sdk-go): update Go IDNA dependencies by @johntmyers in #3137
• feat(middleware): broaden HTTP header mutation authority by @pimlock in #3072
• fix(ci): restore Codex Security scan execution by @alangou in #3124
• fix(snap): recover gateway after Docker connection by @elezar in #2866
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /sdk/go by @dependabot[bot] in #3119
• test(conformance): add plan-driven continuity verification by @elezar in #3107
• feat(test-guest): allow copy mode overrides by @elezar in #3091
• feat(docs): fix Windows bundled-z3 build command in CONTRIBUTING.md by @pkhodade-NV in #3141
• refactor(otel): unify compute driver tracing by @krishicks in #2995
• docs: add project maintainers by @johntmyers in #3166
• fix(driver-mxc): implement authenticate_sandbox trait method by @jeffmaury in #3158
• refactor(cli): extract provider commands into commands/provider module by @varshaprasad96 in #2605
• fix(sandbox): detect an available login shell instead of hardcoding /bin/bash by @akram in #3147
• feat(server): support EC and EdDSA keys in OIDC JWKS validation by @lunarwhite in #2593
• docs(gateway-config): fix stale community sandbox image path by @lunarwhite in #2800
• fix(dev): inherit non-expiring sandbox JWT in local gateway scripts by @pimlock in #2636
• fix(tui): keep sandbox actions visible by @johntmyers in #3189
• fix(server): preserve in-memory SQLite across reconnects by @EmilienM in #3175
• feat(ocsf): configurable schema version for SIEM backward compatibility by @zanetworker in #2717
• docs: add project governance by @johntmyers in #3191
• fix(policy): harden advisor transport proposals by @johntmyers in #3136
• fix(supervisor): reject MCP initialize batches by @shiju-nv in #3192
• feat(middleware): define HTTP response pre-return interface by @pimlock in #3073
• feat(policy): preserve exact MCP revision allowlists by @shiju-nv in #3027
• fix(supervisor-network): omit absent L7 selectors from policy data by @shiju-nv in #3200
• perf(supervisor-network): cache proposal coverage by policy snapshot by @shiju-nv in #3201
• test(test-guest): support rootful Podman gateways by @elezar in #3184
• chore(deps): replace serde_yml with noyalib by @elezar in #3031
• feat(compute): advertise resource capabilities by @elezar in #3010
• ci(kubernetes): expose e2e test selection by @elezar in #2260
• fix(cli): fail closed when OIDC refresh fails by @jhjaggars in #2817
• fix(supervisor): preserve MCP versions in runtime config by @shiju-nv in #3199
• docs: add code of conduct by @johntmyers in #3223
• fix(helm): omit podSecurityContext block when value is null by @jgarciao in #3034
• feat(e2e): make e2e:kubernetes work transparently on OpenShift by @jgarciao in #3183
• test(server): stabilize JWKS validation tests by @grs in #3225
• chore(example): refresh content guard lockfile by @grs in #3226
• feat(sandbox): support rootfs tar as --from source for VM driver by @feloy in #2863
• refactor(sdk/go): unify functional-option handling with shared applier by @rhuss in #3232
• refactor(cli): remove local Dockerfile image builds by @eviehoward in #3214
• ci(trivy): add artifact and PR configuration scans by @alangou in #3185
• fix(podman): resolve macOS Podman socket dynamically by @gmenher in #3135
• chore(deps): replace ring with AWS-LC by @SDAChess in #3243
• fix(policy): harden landlock.compatibility validation by @letv1nnn in #2541
• refactor(inference): remove managed inference routes by @johntmyers in #3195
• feat(supervisor): enforce MCP request protocol versions by @shiju-nv in #3241
• fix(e2e): use provider identity for managed credential paths by @shiju-nv in #3202
• fix(cli): reconcile provisional container exits by @shiju-nv in #3204
• feat(docs): publish versioned release snapshots by @pimlock in #3149
• chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /sdk/go by @dependabot[bot] in #3228
• chore(nix): unify Linux cross-compilation toolchains by @SDAChess in #3242
• fix(driver-docker): scope pending sandbox matching by id and workspace by @letv1nnn in #3240
• fix(ocsf): emit schema-valid event identities by @krishicks in #3247
• refactor(proto): isolate gateway storage messages by @varshaprasad96 in #3169
• fix(docker): reclaim sandbox token files on out-of-band removal by @letv1nnn in #3220
• feat(api): add typed workspace selectors by @mrunalp in #3245
• fix(policy): normalize protocol names before OPA validation by @shiju-nv in #3251
• rfc-0012: Isolation Backend interface by @jganoff in #2048
• refactor(ocsf): rename SandboxContext to EventContext by @krishicks in #3263
• fix(supervisor): classify credential placeholders in request bodies by @johntmyers in #3246
• fix(build): honor Cargo target directory when staging binaries by @pimlock in #3262
• ci(windows): add Windows MSVC CI jobs by @pimlock in #2738
• refactor(persistence): adopt continuation-token pagination by @drew in #3249
• feat(sdk): add lazy pagination pagers by @drew in #3256
• feat(gateway): support selective compute driver builds by @drew in #3118
• fix(packaging): refresh root Cargo lockfile by @pimlock in #3267
• ci(windows): make PR checks opt-in and main jobs advisory by @pimlock in #3268
• feat(mxc): add Windows ETW-to-OCSF audit trail by @araza008 in #3015
• fix(mxc): resolve Windows ETW Clippy lints by @pimlock in #3270
• refactor(config): normalize and enforce gateway schema v2 by @jhjaggars in #2814
• ci(rust): reject stale Cargo lockfiles by @pimlock in #3227
• ci(security): orchestrate scans with high/critical gating by @alangou in #3255
• fix(deps): update DOMPurify and runtime image packages by @alangou in #3276
• fix(ci): align Trivy change detection and scan baselines by @alangou in #3277
• refactor(policy)!: remove NetworkBinary harness field by @varshaprasad96 in #3222
• feat(helm): scope ClusterRole/ClusterRoleBinding names by release namespace by @bsquizz in #2939
• test(supervisor-network): show response body on ssrf_denied assertion failure by @politerealism in #3290
• fix(mise): run mise lock --platform linux-x64 by @krishicks in #3291
• fix(ci): restore Windows test portability by @pimlock in #3288
• fix(ci): restore mise run ci on macOS by @krishicks in #3294
• fix(bootstrap): emit RFC 5280 extensions on generated gateway PKI by @maxdubrinsky in #3286
• feat(helm): add BackendTLSPolicy support by @bsquizz in #2728
• feat(e2e): support the Vault credential-driver lane on OpenShift by @jgarciao in #3312
• chore(security): document Kubernetes runtime RBAC by @drew in #3328
• feat(mxc): add Windows host proxy for MXC sandbox network egress by @araza008 in #3163
• feat(sandbox): explain failed calls to external tool servers by @shiju-nv in #3207
• test(conformance): remove plan-driven continuity tests by @elezar in #3342
• fix(auth): harden OIDC trust root retrieval by @mrunalp in #3332
• feat(api): add structured gateway errors and SDK decoding by @mrunalp in #3313
• fix(ocsf): correct HTTP activity context by @krishicks in #3316
• fix(gator): make supervised lifecycle sandbox-native by @johntmyers in #3343
• fix(deps): refresh gateway Debian runtime image by @johntmyers in #3350
• fix(security): harden Vault credential transport by @sjenning in #3329
• fix(supervisor-network): reject malformed OPA policy containers by @shiju-nv in #3337
• fix(ci): upstream Windows SDK validation support by @prekshivyas in #3327
• feat(isolation): implement the RFC 0012 sandbox architecture by @drew in #2942
• fix(ci): restore prebuilt Z3 on Windows by @prekshivyas in #3353
• fix(ci): repair RFC 0012 post-merge checks by @drew in #3360
• ci(release): advance seeded prereleases daily at Zurich time by @SDAChess in #3239
• test(tmachine): add portable VM-based container runtime testing by @SDAChess in #3371
• test(tmachine): run smoke tests from nextest archives by @elezar in #3372
• chore(tools): upgrade mise to 2026.9.9 by @krishicks in #3385
• fix(python): stabilize development tasks under jj by @krishicks in #3354
• feat(policy): establish one canonical authored policy representation by @johnnygreco in #3334
• chore(ci): preserve Windows ARM64 locks and test routing by @pimlock in #3347
• refactor(proto)!: use well-known time types by @derekwaynecarr in #3113
• feat(api): return typed deletion outcomes with explicit missing-target semantics by @mrunalp in #3317
• fix(supervisor-network): bound OPA policy load diagnostics by @shiju-nv in #3369
• fix(container): use distroless Debian 13 for supervisor by @johntmyers in #3393
• fix(sandbox): pass declared environment to the initial process by @cv in #3392
• ci: consolidate release binary builds by @SDAChess in #3405
• fix(supervisor-network): validate and normalize OPA matchers by @shiju-nv in #3373
• fix(ci): restore release tag push authentication by @SDAChess in #3410
• ci: consolidate multi-platform image builds by @SDAChess in #3408
• ci(conformance): run smoke tests with tmachine by @SDAChess in #3382
• feat(api): add durable workspace mutation admission and replay by @mrunalp in #3321
• fix(sandbox-backend): confirm renewed boundary credentials within an epoch by @shiju-nv in #3411
• test(parity): align fixture supervisor provenance by @krishicks in #3387
• test(conformance): cover sandbox lifecycle in archives by @elezar in #3375
• fix(python): use portable empty-array expansion for macOS Bash 3.x by @benoitf in #3413
• fix(supervisor): serialize child registration with reaping by @drew in #3142
• feat(prover): add standalone policy boundary checker by @johnnygreco in #3289
• fix(dev): extract Docker sandbox runtime from sandbox image by @johntmyers in #3422
• feat(middleware): add a hook to inspect HTTP responses by @pimlock in #3074
• feat(providers): report applied sandbox provider changes by @shiju-nv in #3391
• fix(helm): grant secret cleanup permissions by @drew in #3363
• fix(ci): use renamed conformance suite in release dev by @pimlock in #3425
• test(tmachine): accept scalar playbook inputs by @SDAChess in #3418
• fix(sandbox): harden isolated supervisor startup by @krishicks in #3426
• fix(sandbox-backend): recover TCP mediation after boundary disconnects by @shiju-nv in #3403
• fix(e2e): support distroless supervisor fixture by @pimlock in #3431
• fix(policy)!: require explicit L7 append targets and scope by @shiju-nv in #3380
• docs(inference): remove stale managed endpoint references by @johntmyers in #3428
• refactor(providers)!: make provider profiles import-only by @feloy in #3383
• refactor(compute): remove legacy host users encoding by @drew in #3248
• fix(kubernetes): stop supervisor before workload by @pimlock in #3424
• feat(sandbox): validate configuration before workload activation by @johntmyers in #3259
• feat(installer): support prerelease installations by @drew in #3364
• fix(supervisor): allow withheld credentials at startup by @drew in #3438
• docs(fern): sync announcement configuration by @pimlock in #3436
• docs(fern): restore dev announcement by @pimlock in #3441
• test(tmachine): migrate Keycloak provider refresh coverage by @elezar in #3404
• test(tmachine): verify SELinux in Fedora scenarios by @SDAChess in #3457
• refactor(tmachine): separate installation profiles by @SDAChess in #3419
• chore(vm): bump libkrun to v1.19.4 and libkrunfw to v5.6.1 by @benoitf in #3451
• feat(e2e): run the Kubernetes e2e suite on cargo-nextest with machine- and human-readable reports by @jgarciao in #3344
• fix(policy): reject unknown endpoint security modes by @2000krysztof in #3187
• chore(license): align repository compliance text by @johntmyers in #3467
• feat(api)!: use sandbox names as canonical RPC references by @drew in #3272
• fix(ci)!: remove gateway callback listener dependency by @drew in #3365
• feat(prover): check process, Landlock, and destination IP containment by @johnnygreco in #3394
• fix(server): close SQLite stores in policy tests by @kjlubick in #3466
• fix(packaging): keep SPDX comments out of Debian control by @drew in #3483
• fix(deps): update rustls past RUSTSEC-2026-0285 by @drew in #3484
• fix(windows): restore MXC MSVC builds by @drew in #3488
• feat(sandbox): expose services during creation by @drew in #3439
• test(tmachine): add Debian installer profile by @SDAChess in #3461
• chore(vm): refresh runtime defaults and hardening by @drew in #3446
• fix(server): serialize sandbox restart authentication by @drew in #3485
• fix(ocsf): require network activity endpoints by @krishicks in #3355
• feat(cli): promote profile commands to top level by @shiju-nv in #3258
• ci(security): gate tagged releases on scans by @elezar in #3523
• feat(extensions)!: normalize protocol negotiation by @sjenning in #3352
• fix(vm): unpack registry images correctly and validate prepared disks by @EmilienM in #3524
• feat(kubernetes): support HA gateway rebalancing by @TaylorMutch in #1868
• refactor(isolation)!: make confirmation backend-neutral by @drew in #3366
• chore(build): remove stale static-supervisor leftovers by @EmilienM in #3520
• fix(kubernetes): bind bootstrap to runtime identity by @johntmyers in #3531
• test(tmachine): add interactive shell testsuite by @elezar in #3522
• ci(rust): parallelize branch checks by @SDAChess in #3462
• refactor(runtime): retire Community image dependencies by @akram in #3386
• fix(driver-vm): resolve lifecycle requests on sandbox_id alone by @letv1nnn in #3305
• fix(exec): preserve output after stdin EOF and verify stream completion by @varshaprasad96 in #3359
• fix(supervisor): restore OCSF schema downgrade by @krishicks in #3554
• ci(security): stage release finding enforcement by @elezar in #3552
• feat(kubernetes): support corporate proxy CA bundle by @feloy in #3447
• fix(policy)!: reject unsupported TLS endpoint values by @lunarwhite in #3414
• fix(network): preserve chunked request boundaries by @pimlock in #3530
• fix(sandbox): reclaim socket descriptors before exhaustion by @pimlock in #3532
• docs(windows): align Z3 pin with z3-sys 0.13 by @purp in #3561
• fix(api): make WatchSandbox loss-aware and resumable by @letv1nnn in #3209
• fix(network): bound chunked relay memory by @pimlock in #3537
• fix(sandbox): support kernels < 5.19 via seccomp WAIT_KILLABLE_RECV fallback by @akram in #3420
• fix(e2e): repair the credential driver test by @krishicks in #3565
• fix(drivers): require admission labels for external resources by @drew in #3538
• feat(api): add durable exec launch admission by @mrunalp in #3324
• fix(server): drain supervisor ownership cleanup on shutdown by @elezar in #3547
• fix(sandbox): await SFTP writes before acknowledging by @drew in #3568
• fix(kubernetes): scope resource admission RBAC by @drew in #3571
• fix(podman): support rootless user namespace configurations by @elezar in #3527
• fix(sandbox): qualify task memory against workload child by @drew in #3574
• ci(windows): seed caches on windows branch by @drew in #3576
• fix(kubernetes): prevent false sandbox suspension by @FrostGod in #3567
• fix(vm): scope GPU filesystem enrichment to assigned workloads by @drew in #3580
• fix(sandbox-backend): use String for CA cert/bundle in boundary protocol by @benoitf in #3456
• ci(release): publish prereleases with qualification summary by @elezar in #3593
• fix(drivers): normalize label namespace by @elezar in #3609
• fix(vm): relocate per-sandbox Unix sockets to /tmp to fit macOS sun_path by @benoitf in #3544
• fix(ci): use approved setup-oras revision by @purp in #3625
• ci(e2e): run the Kubernetes HA and credential-driver suites on test:e2e-kubernetes by @krishicks in #3626
• chore(deps): bump anyio from 4.13.0 to 4.14.2 by @dependabot[bot] in #3474
• fix(supervisor): use better error message when sandbox connect is not available by @pimlock in #3572
• chore(kubernetes): update Agent Sandbox to v1.0.3 by @mrunalp in #3578
• fix(server): make HA sandbox create and HA e2e tests reliable by @krishicks in #3635
• fix(network): honor HTTP response connection closure by @drew in #3581
• fix(pagination): document list contract and harden SDK pagers by @gmenher in #3279
• docs: add 0.1.0 upgrade guide outline by @drew in #3540
• fix(identity): assess leaf and ancestor executable identities by @purp in #3633
• fix(helm)!: reduce gateway Secret privileges by @krishicks in #3616
• fix(e2e): use POSIX-compatible lowercase conversion in parity runner script by @benoitf in #3465
• fix(sandbox): keep boundary connection live under stalled relays by @drew in #3642
• feat(testing): support independent gateway and supervisor image overrides by @Bobbins228 in #3341
• fix(auth): remove legacy sandbox JWT admission by @pimlock in #3562
• fix(snap): install openshell snap via install.sh when snap available by @olivercalder in #3656
• fix(vm): confine OCI layer application to the rootfs by @elezar in #3550
• fix(sandbox): preserve local sessions across host sleep by @drew in #3573
• perf(server): enable WAL for the SQLite store; relax sync only for SSH session issuance by @n1hility in #3543
• fix(podman): restore host gateway alias mediation by @grs in #3606
• fix(install): avoid installing incompatible docker snap by @olivercalder in #3666
• fix(test): use portable file mode checks in snap installer tests by @krishicks in #3670
• fix(kubernetes): remove NetworkPolicy acknowledgement by @drew in #3677
• ci: restrict copy-pr-bot manual vetters by @purp in #3678
• docs(middleware): reorganize and expand middleware guides by @pimlock in #3636
• fix(install): honor pinned releases and speed up prerelease discovery by @drew in #3681
• ci(release): move CodeQL, Trivy, and Zizmor to advisory by @purp in #3693
• fix(helm): restore Kubernetes e2e chart rendering by @drew in #3692
• test(podman): close rootful userns, resource-limit, and daemon-failure CI gaps by @politerealism in #3690
• fix(auth): skip renewal for non-expiring sandbox JWTs by @pimlock in #3686
• fix(policy): restore policy.local and proposal conformance by @pimlock in #3689
• fix(sandbox): deliver complete exec output before success by @drew in #3688
• fix(cli): stream piped exec stdin beyond gRPC request limit by @drew in #3687
• feat(cli): import provider profiles from HTTP URLs by @drew in #3706
• fix(policy): propose rules for unknown DNS hosts by @pimlock in #3707
• docs: refresh architecture and agent guides by @drew in #3705
• fix(policy): align quickstart, policy skills, and pypi profile with current behavior by @johnnygreco in #3695
• (Fix) ha sandbox resilience with k8s by @FrostGod in #3644
• docs(policy): refresh policy documentation and references by @johnnygreco in #3563
• docs(fern): publish ordered version snapshots by @pimlock in #3721
• docs: streamline README, add policy prover to architecture docs by @drew in #3718
• docs(readme): remove alpha status badge by @drew in #3723

New Contributors

• @slopp made their first contribution in #3014
• @natedemoss made their first contribution in #3044
• @rootkiller6788 made their first contribution in #2957
• @dhirajsb made their first contribution in #2643
• @gmenher made their first contribution in #3135
• @jganoff made their first contribution in #2048
• @bsquizz made their first contribution in #2939
• @cv made their first contribution in #3392
• @kjlubick made their first contribution in #3466
• @Bobbins228 made their first contribution in #3341
• @n1hility made their first contribution in #3543

Full Changelog: v0.0.116...v0.1.0