OpenShell v0.1.4

OpenShell v0.1.4

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.4 sh

What's Changed

• feat(snap): run gateway as a user service by default by @olivercalder in #4099
• chore(test-guest): remove snap reproduction helper by @elezar in #4368
• fix(ci): publish merge queue E2E statuses by @elezar in #4370
• chore(deps): bump mermaid from 11.16.0 to 11.16.1 in /scripts/lint-mermaid by @dependabot[bot] in #4369
• feat(server): add operator-only provider credential retrieval by @sjenning in #4357
• feat(ci): gate merges on maintainer approval via a required status check by @purp in #3176
• test(tmachine): use K3s ClusterIP, wait for gateway, add failure diagnostics by @matthewgrossman in #4258
• fix(core): resolve credential aliases after revision eviction by @stevenlee-oai in #4390
• refactor(runtime): confine and reduce unsafe code by @drew in #4130
• fix(cli): name the sandbox in service not-found errors by @ericcurtin in #3798
• feat(gateway): add gRPC server reflection by @2000krysztof in #3161
• test(conformance): run driver suites with cargo by @elezar in #3866
• feat(providers): support stable credential placeholders by @shiju-nv in #3339
• fix(gator): surface PR-owned security regressions in reviews by @johntmyers in #4338
• feat(sdk/ts): add createdAtMs to SandboxRef by @ericcurtin in #4347
• fix(server): retry stop lifecycle writes after concurrent updates by @pimlock in #4395
• fix(docs): use lowercase "snap" as it is not a proper noun by @olivercalder in #4387
• feat(python): expose sandbox status conditions in the SDK by @maxdubrinsky in #4436
• fix(python): close client when Sandbox entry fails by @ericcurtin in #4367
• fix(network): enforce consistent HTTP framing by @alangou in #4414
• docs: clarify vouch timing, DCO vs signing, Cargo feature conventions by @politerealism in #2810
• fix(sandbox): name Landlock ABI in startup error by @ericcurtin in #4413
• fix(server): return SQLite write versions atomically by @ericcurtin in #4408
• fix(cli): disable ssh connection sharing for sandbox sessions by @ericcurtin in #4157
• fix(cli): preserve external TLS for SSH forwarding by @danehans in #4344
• fix(kubernetes): refresh sandbox runtime image on start by @lunarwhite in #4376
• docs(runtimes): show required schema version in gateway TOML examples by @fede-kamel in #3910
• docs(extensibility): name extension base capabilities by @ericcurtin in #4405
• test(tmachine): add a K3s HA conformance lane with PostgreSQL and mTLS by @matthewgrossman in #4081
• chore(ci): close stale issues after 14 additional days by @purp in #3985
• chore(codeowners): disable wildcard ownership rule by @purp in #3168
• test(vm): avoid inherited lease race in restart cleanup test by @grs in #4316
• fix(windows): restore MSVC lint for CLI and MXC by @feloy in #4194
• chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 by @dependabot[bot] in #2767
• feat(sdk-ts): add watchLogs with loss-aware resume by @letv1nnn in #3778
• fix(server): audit proposal rejections in the gateway by @ericcurtin in #4281
• test(e2e): remove stale policy retries by @TaylorMutch in #4453
• ci: require accepted issues for community pull requests by @elezar in #4340
• refactor(vm): source runtime pins only from pins.env by @benoitf in #4373
• fix(release): qualify prerelease tag pushes by @SDAChess in #4335
• test(oci): add a shared Docker and Podman suite for image USER and WORKDIR by @matthewgrossman in #3931
• fix(kubernetes): time out kube requests per request instead of per idle connection by @matthewgrossman in #4452
• fix(prover): distinguish sibling endpoints and fail closed on solver errors by @alangou in #4326
• fix(vm): bind cached registry images to verified manifest digests by @alangou in #4342
• test(podman): run the e2e binaries that pass in the tmachine guest by @politerealism in #4422
• refactor(prover): remove legacy unused reachability constraints by @eviehoward in #2441
• fix(cli): backpressure sandbox uploads by @shiju-nv in #4448
• ci(security): temporarily remove Codex from release scans by @alangou in #4469
• fix(sandbox): release broker-owned listening sockets by @johntmyers in #4444
• feat(providers): add CLI label creation and filtering by @johntmyers in #4265
• refactor(prover): separate outcome evaluation from rendering by @eviehoward in #2632
• fix(sdk-ts): preserve rpc errors for out-of-range responses by @SDAChess in #4495
• ci(compatibility): review PR breaks and acknowledge release risks by @SDAChess in #4488
• fix(ci): skip maintainer approval in merge queue by @purp in #4496

New Contributors

• @stevenlee-oai made their first contribution in #4390

Full Changelog: v0.1.3...v0.1.4