Repository navigation
Run OpenShell supervisors in separate E2B sandboxes with native CLI demo - #8
Open
mattteufel-e2b wants to merge 3 commits into
Open
mattteufel-e2b wants to merge 3 commits into
mattteufel-e2b wants to merge 3 commits into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Run each task's OpenShell supervisor/proxy in its own E2B microVM, separate from both the worker and shared gateway/driver. The worker has host-enforced outbound denial; authenticated tunnels carry its mediated traffic to the supervisor.
Adds the native OpenShell CLI/TUI dashboard walkthrough, live worker observation, policy/audit demonstrations, supervisor-loss drill, reproducible recording scripts, and demo recordings. Includes pair lifecycle/rollback cleanup, health monitoring, supervisor template/bootstrap, and updated run instructions.
Validation:
npm run typecheckpassed.git diff --checkpassed.npm run demo:verifypassed all 13 live checks: distinct supervisor/worker VMs; correct credential placement; root HTTPS blocked in worker; GET allowed; POST and wget denied; audit delivery; agent frozen after supervisor loss; worker fence retained; task pair deleted while shared control remains available.verification/separated-supervisor.md; these were not rerun for this PR preparation. The interactive TUI recording was not recaptured today.This remains a demo pinned to OpenShell v0.1.2. The inherited Landlock ABI-v2 compatibility patch lacks truncate protection. Supervisors still use the demo gateway client certificate; inventory is in-memory, lifetimes are capped, and E2B Secrets/request transforms are not integrated. These limitations are documented in the README; this PR does not claim production readiness or compatibility with latest upstream.