Skip to content

fix(inference): allowlist routed request headers#826

Merged
johntmyers merged 1 commit intomainfrom
fix/os-70-inference-header-allowlist
Apr 15, 2026
Merged

fix(inference): allowlist routed request headers#826
johntmyers merged 1 commit intomainfrom
fix/os-70-inference-header-allowlist

Conversation

@johntmyers
Copy link
Copy Markdown
Collaborator

@johntmyers johntmyers commented Apr 14, 2026

Summary

Switch inference.local request sanitization from a denylist to a route-aware allowlist so unexpected sensitive headers cannot piggyback on the inference path.
Preserve provider-specific headers through explicit provider metadata and document the new behavior.

Related Issue

Fixes OS-70

Changes

  • add provider-level passthrough header metadata and propagate it onto resolved inference routes
  • enforce a route-aware request header allowlist in openshell-router and strip unknown/sensitive headers before forwarding upstream
  • remove sandbox-side pre-filtering so header policy is enforced at the selected route boundary
  • add router and sandbox regression coverage for allowed provider headers and stripped sensitive headers
  • update architecture and published inference docs to describe the allowlist behavior

Testing

  • mise run pre-commit passes
  • Unit tests added/updated
  • E2E tests added/updated (if applicable)

Ran:

  • RUSTC_WRAPPER= cargo test -p openshell-core --lib inference
  • RUSTC_WRAPPER= cargo test -p openshell-router
  • RUSTC_WRAPPER= cargo test -p openshell-sandbox inference_interception_applies_router_header_allowlist --lib
  • RUSTC_WRAPPER= cargo test -p openshell-sandbox --test system_inference

mise run pre-commit is currently blocked locally by two pre-existing environment/repo issues outside this branch:

  • existing SPDX check failures under ignored architecture/plans/*
  • missing local z3.h for workspace z3-sys during the full workspace cargo check path

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable)

@johntmyers johntmyers requested a review from a team as a code owner April 14, 2026 05:17
@johntmyers johntmyers self-assigned this Apr 14, 2026
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot Bot commented Apr 14, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 14, 2026

🌿 Preview your docs: https://nvidia-preview-pr-826.docs.buildwithfern.com/openshell

@johntmyers johntmyers added the test:e2e Requires end-to-end coverage label Apr 14, 2026
@johntmyers
fix(inference): allowlist routed request headers
f582b3a 
Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
@johntmyers johntmyers force-pushed the fix/os-70-inference-header-allowlist branch from d73f865 to f582b3a Compare April 14, 2026 20:41
@johntmyers johntmyers merged commit 25d2530 into main Apr 15, 2026
12 checks passed
@johntmyers johntmyers deleted the fix/os-70-inference-header-allowlist branch April 15, 2026 22:19
@miyoungc miyoungc mentioned this pull request Apr 16, 2026
Merged
7 tasks
@prekshivyas prekshivyas mentioned this pull request Apr 22, 2026
Merged
4 tasks
ericksoa pushed a commit to NVIDIA/NemoClaw that referenced this pull request Apr 23, 2026
@prekshivyas @claude
chore(install): bump OpenShell version to 0.0.32 (#2307)
fafbaec 
## Summary
Bumps the pinned OpenShell version range from `0.0.29` → `0.0.32` so
fresh NemoClaw installs pick up sandbox hardening and TLS improvements
from the last three OpenShell releases.

## Notable upstream changes

**0.0.30**
([NVIDIA/OpenShell@v0.0.29...v0.0.30](NVIDIA/OpenShell@v0.0.29...v0.0.30))
- Network policy deny rules
([OpenShell#822](NVIDIA/OpenShell#822))
- Preserve ownership on existing `read_write` paths
([OpenShell#827](NVIDIA/OpenShell#827))
- Disable child core dumps
([OpenShell#821](NVIDIA/OpenShell#821))
- Escape control characters in SSE error formatting
([OpenShell#842](NVIDIA/OpenShell#842))
- Fix silent truncation of large streaming inference responses
([OpenShell#834](NVIDIA/OpenShell#834))

**0.0.31**
([NVIDIA/OpenShell@v0.0.30...v0.0.31](NVIDIA/OpenShell@v0.0.30...v0.0.31))
- Inference routed-request header allowlist
([OpenShell#826](NVIDIA/OpenShell#826))

**0.0.32**
([NVIDIA/OpenShell@v0.0.31...v0.0.32](NVIDIA/OpenShell@v0.0.31...v0.0.32))
- **Load system CA certificates for upstream TLS connections**
([OpenShell#862](NVIDIA/OpenShell#862))
- Publish standalone `openshell-gateway` binaries
([OpenShell#853](NVIDIA/OpenShell#853))

## Changes
- `nemoclaw-blueprint/blueprint.yaml`: `min_openshell_version` and
`max_openshell_version` → `0.0.32`
- `scripts/install-openshell.sh`: `MIN_VERSION` and `MAX_VERSION` →
`0.0.32` (`PIN_VERSION` follows `MAX`)
- `scripts/brev-launchable-ci-cpu.sh`: default `OPENSHELL_VERSION` →
`v0.0.32`
- `src/lib/onboard.ts`: blueprint-fallback min version → `0.0.32`
- `test/onboard.test.ts`,
`test/install-openshell-version-check.test.ts`: fixtures updated; "above
MAX" test case moved from `0.0.30` to `0.0.33`

Historical `m-dev` comments referencing `0.0.29` left in place — they
describe a self-report quirk the sidecar fallback still handles.

## Why not 0.0.33+?
`0.0.34` introduced incremental sandbox policy updates and L7
request-target canonicalization — changes with larger surface area
against how NemoClaw delivers policy via gRPC. Worth a follow-up PR
rather than bundling here. `0.0.35` released hours before this PR was
cut — too fresh.

## Type of Change
- [x] Code change for a new feature, bug fix, or refactor.

## Testing
- [x] `npx vitest run test/install-openshell-version-check.test.ts` — 9
passed
- [x] pre-commit hooks (prek) clean: shellcheck, commitlint, gitleaks,
YAML validator, CLI test suite
- [ ] Nightly E2E on this branch — will be kicked off after PR opens

## Notes
- No user-facing CLI behavior changes — just the pinned version range.
- Two pre-existing failures in `test/onboard.test.ts` reproduce on clean
`main` and are unrelated to this bump.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated OpenShell version constraints and default pinned version to
v0.0.32 across configuration, install, and onboarding flows.

* **Tests**
* Updated test fixtures and expectations to match the new OpenShell
version (v0.0.32).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
FloHofstetter added a commit to FloHofstetter/shoreguard that referenced this pull request Apr 23, 2026
@FloHofstetter @claude
release: ShoreGuard v0.32.2 — M31 upstream-sync confirmation (docs + …
7ee5264 
…pin bump)

Re-verified parity against NVIDIA/OpenShell v0.0.32 and
origin/main@e39bb380. All four upstream .proto files are
byte-identical across v0.0.30 → v0.0.32 → origin/main, so the
generated stubs remain wire-parity without regeneration.

Docs bumped from v0.0.26 to v0.0.32 as the recommended pin.
Added a routed-inference admonition for the upstream header
sanitization added in NVIDIA/OpenShell#826 and an installation
tip about the standalone openshell-gateway binary published in
NVIDIA/OpenShell#853. Internal watchlist of unmerged upstream
feature branches (os-81 incremental policy merge,
supervisor-session relay, l7-path-canonicalization,
runtime-policy-revision) recorded in the CHANGELOG for a future
milestone.

No code changes, no schema changes, no new dependencies. Full
pytest -n auto baseline stayed green at 3042 passed, 1 skipped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@drew drew drew approved these changes

@pimlock pimlock pimlock approved these changes

Assignees

@johntmyers johntmyers

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@johntmyers @drew @pimlock