OpenShell v0.0.20

OpenShell v0.0.20

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.20 sh

What's Changed

• feat(bootstrap,cli): switch GPU injection to CDI where supported by @elezar in #495
• feat(sandbox): switch device plugin to CDI injection mode by @elezar in #503
• fix(docker): restore apt cleanup chaining in cluster image by @pimlock in #702
• fix(cluster): pass resolv-conf as kubelet arg and pin k3s image digest by @drew in #701
• fix(server): return already_exists for duplicate sandbox names by @drew in #695
• fix(bootstrap): stream image push through temp file to prevent OOM by @drew in #700
• docs(agents): add security analysis protocol to principal-engineer-reviewer by @johntmyers in #711
• feat(sandbox): extend L7 credential injection to query params, Basic auth, and URL paths by @johntmyers in #708
• fix(sandbox): eliminate Box::leak memory leak in rewrite_forward_request by @johntmyers in #715
• chore(mise): use install_only_stripped precompiled Python flavor by @drew in #693
• fix(bootstrap): handle tar paths exceeding 100 bytes by @johntmyers in #721

Full Changelog: v0.0.19...v0.0.20

OpenShell Development Build

This build is automatically published on every commit to main that passes CI.

NOTE: This is a development build, not a tagged release, and may be unstable.

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=dev sh

OpenShell v0.0.19

OpenShell v0.0.19

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.19 sh

What's Changed

• fix(proxy): add L7 inspection to forward proxy path by @latenighthackathon in #666
• fix(ci): skip docs preview deploy for fork PRs by @johntmyers in #679
• docs(rfc): add RFC process with draft/review/accepted lifecycle by @drew in #678
• fix(e2e): add uv-managed python binary glob to forward proxy L7 test by @johntmyers in #686
• fix(l7): reject requests with both CL and TE headers in inference parser (CWE-444) by @latenighthackathon in #671
• fix(sandbox): handle per-path Landlock errors instead of abandoning entire ruleset by @johntmyers in #677
• Missed input parameter to init OpenClaw container by @vcorrea-ppc in #645
• feat(sandbox): add L7 query parameter matchers by @johntmyers in #617
• perf(sandbox): streaming SHA256 and spawn_blocking for identity resolution by @koiker in #555
• feat(inference): allow setting custom inference timeout by @pentschev in #672
• fix(sandbox): track PTY state per SSH channel to fix terminal resize by @johntmyers in #687

New Contributors

• @vcorrea-ppc made their first contribution in #645
• @koiker made their first contribution in #555
• @pentschev made their first contribution in #672

Full Changelog: v0.0.18...v0.0.19

OpenShell v0.0.16

OpenShell v0.0.16

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.16 sh

What's Changed

• feat(tasks): add cluster:gpu task and wire e2e:gpu to use it by @elezar in #547
• fix(ci): harden CI image tool installation by @pimlock in #572
• fix(server): preserve credential key names in redacted provider responses by @johntmyers in #569
• fix(sandbox): treat literal IP in policy host as implicit allowed_ips by @johntmyers in #570
• fix(sandbox,server): fix chunk merge duplicates and OPA variable collision with overlapping policies by @johntmyers in #571
• fix(sandbox): block unspecified addresses in SSRF guards by @johntmyers in #598

Full Changelog: v0.0.15...v0.0.16

OpenShell v0.0.15

OpenShell v0.0.15

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.15 sh

What's Changed

• fix: security hardening batch 1 (SEC-002 through SEC-010) by @johntmyers in #548
• fix(cli): clear stale last-used sandbox on deletion by @Kh4L in #510
• fix(docker): enable dev-settings feature by default in local builds by @drew in #523
• feat(sandbox): auto-detect TLS and terminate unconditionally for credential injection by @johntmyers in #544

Full Changelog: v0.0.14...v0.0.15

OpenShell v0.0.14

OpenShell v0.0.14

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.14 sh

What's Changed

• docs(providers): add Groq to the supported providers table by @khaile in #518

New Contributors

• @khaile made their first contribution in #518

Full Changelog: v0.0.13...v0.0.14

OpenShell v0.0.13

OpenShell v0.0.13

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.13 sh

What's Changed

• feat(providers): add GitHub Copilot CLI agent provider by @htekdev in #476
• feat(gpu): disable NFD/GFD and remove nodeAffinity from device plugin chart by @elezar in #497
• feat(ocsf): create openshell-ocsf crate — standalone OCSF event types, formatters, and tracing layers by @johntmyers in #489
• feat(settings): gateway-to-sandbox runtime settings channel by @johntmyers in #474
• docs(ollama): update ollama tutorial and references to match latest ollama features by @ParthSareen in #511
• docs(ollama): fix references to renamed tutorial file by @ParthSareen in #513
• ci(release): restrict auto-tag to weekdays only by @drew in #507
• refactor(proto): rename UpdateSettings to UpdateConfig for consistency with read path by @johntmyers in #515
• refactor(sandbox): remove unused pod_template field from CreateSandbox RPC by @drew in #522
• fix(docker): propagate OPENSHELL_IMAGE_TAG to cross-compile Dockerfiles by @drew in #530

New Contributors

• @htekdev made their first contribution in #476

Full Changelog: v0.0.12...v0.0.13

OpenShell v0.0.12

OpenShell v0.0.12

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.12 sh

What's Changed

• fix(bootstrap): surface diagnostics for K8s namespace not ready failures by @drew in #466
• docs: add guidance for OpenAI-compatible cloud providers by @miyoungc in #458
• fix(sandbox): rotate openshell.log daily, keep 3 files by @Kh4L in #431
• fix(e2e): update log-reading helpers for rolling file appender by @drew in #481
• fix(router): increase inference validation token budget by @geelen in #432
• fix(gateway): allow updating network policy for sandboxes started with an empty one by @pimlock in #493
• fix(docker): set migrations dir permissions to 755 on COPY by @elezar in #475

New Contributors

• @Kh4L made their first contribution in #431
• @geelen made their first contribution in #432
• @elezar made their first contribution in #475

Full Changelog: v0.0.11...v0.0.12

OpenShell v0.0.11

OpenShell v0.0.11

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.11 sh

What's Changed

• fix(ci): use published install script in release workflows by @drew in #416
• fix(deploy): remove duplicate glob pattern in manifest cleanup loop by @leoshi01 in #428
• fix(ci): check author_association before API calls in vouch gate by @johntmyers in #442
• fix(ci): fetch author_association via REST API instead of webhook payload by @johntmyers in #444
• fix(ci): pass wheel filenames as job output instead of re-downloading by @pimlock in #418
• fix(ci): use ORG_READ_TOKEN for org membership check in vouch gate by @johntmyers in #445
• fix(ci): split vouch gate into two steps with separate tokens by @johntmyers in #446
• fix(cli): suppress browser popup during auth via OPENSHELL_NO_BROWSER env var by @drew in #419
• fix(ci): use env context instead of secrets in step-level if condition by @johntmyers in #452
• fix(ci): simplify dev release install instructions to use install.sh by @drew in #453
• chore(repo): migrate github label taxonomy by @drew in #454
• refactor(build): unify image build graph for cache reuse by @drew in #390
• fix(bootstrap): auto-cleanup Docker resources on failed gateway deploy by @drew in #464

New Contributors

• @leoshi01 made their first contribution in #428

Full Changelog: v0.0.10...v0.0.11

OpenShell v0.0.10

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.10 sh

What's Changed

• fix(server): add startup probe for gateway boot by @drew in #417

Full Changelog: v0.0.9...v0.0.10