openshell: init at 0.0.22 (#506365)

maintainers/maintainer-list.nix

@@ -29235,6 +29235,12 @@
     githubId = 42300264;
     name = "wishfort36";
   };
+  wishstudio = {
+    email = "wishstudio@gmail.com";
+    github = "wishstudio";
+    githubId = 946459;
+    name = "Xiangyan Sun";
+  };
   witchof0x20 = {
     name = "Jade";
     email = "jade@witchof.space";

pkgs/by-name/op/openshell/package.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  versionCheckHook,
+  cacert,
+  gitMinimal,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "openshell";
+  version = "0.0.22";
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "OpenShell";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-98wmBhj1Bqkod9DWh4qhkT3287c56ZKRDf/Z3QCYf4Q=";
+  };
+
+  cargoHash = "sha256-lzS8V8e+wMX8KUfgrftNLdbyivoj0wtRWOThBRS1IdM=";
+
+  nativeCheckInputs = [
+    cacert
+    gitMinimal
+  ];
+
+  postPatch = ''
+    # fill in package version to Cargo
+    substituteInPlace Cargo.toml \
+      --replace-fail 'version = "0.0.0"' 'version = "${finalAttrs.version}"'
+    # only build openshell-cli crate
+    substituteInPlace Cargo.toml \
+      --replace-fail 'members = ["crates/*"]' 'members = ["crates/openshell-cli"]'
+  '';
+
+  env = {
+    # docker image tag baked in at compile time, must match binary version
+    OPENSHELL_IMAGE_TAG = finalAttrs.version;
+  };
+
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    changelog = "https://github.com/NVIDIA/OpenShell/releases/tag/v${finalAttrs.version}";
+    description = "The safe, private runtime for autonomous AI agents.";
+    homepage = "https://docs.nvidia.com/openshell/index.html";
+    license = lib.licenses.asl20;
+    longDescription = ''
+      NVIDIA OpenShell is an open source runtime to build and deploy autonomous,
+      self-evolving agents more safely. OpenShell sits between your agent and
+      your infrastructure to govern how the agent executes, what the agent can
+      see and do, and where inference goes. It enables claws to run in isolated
+      sandboxes, with fine-grained control over privacy and security.
+    '';
+    maintainers = with lib.maintainers; [ wishstudio ];
+    mainProgram = "openshell";
+    platforms = lib.platforms.all;
+  };
+})