@rivet-dev/agentos-core 0.0.0-agentos-dylib-plugin.bbfdf95 → 0.0.0-codex-on-agent-stderr.dd7a603

package/README.md

@@ -1,4 +1,4 @@
-# @rivet-dev/agent-os-core
+# @rivet-dev/agentos-core
 
 A high-level SDK for running coding agents in isolated VMs. agentOS manages the full lifecycle of virtual machines -- from filesystem setup and process management to launching AI agents via the Agent Communication Protocol (ACP).
 
@@ -19,13 +19,13 @@ Agents run inside isolated VMs with their own filesystem, process table, and net
 ## Quick Start
 
 ```bash
-npm install @rivet-dev/agent-os-core
+npm install @rivet-dev/agentos-core
 # Install an agent adapter + its underlying agent
-npm install @rivet-dev/agent-os-pi @mariozechner/pi-coding-agent
+npm install @agentos-software/pi @mariozechner/pi-coding-agent
 ```
 
 ```typescript
-import { AgentOs } from "@rivet-dev/agent-os-core";
+import { AgentOs } from "@rivet-dev/agentos-core";
 
 // 1. Create a VM
 const vm = await AgentOs.create();

package/dist/agent-os.d.ts

@@ -190,15 +190,31 @@ export interface AgentOsLimits {
         syncReadLimitBytes?: number;
     };
 }
+export interface AgentStderrEvent {
+    sessionId: string;
+    agentType: string;
+    processId: string;
+    pid: number | null;
+    chunk: Uint8Array;
+}
+export type AgentStderrHandler = (event: AgentStderrEvent) => void;
 export interface AgentOsOptions {
     /**
      * Software to install in the VM. Each entry provides agents, tools,
      * or WASM commands. Any object with a `commandDir` property (e.g.,
-     * registry packages like @agent-os-pkgs/coreutils) is treated
+     * registry packages like @agentos-software/coreutils) is treated
      * as a WASM command source automatically. Arrays are flattened, so
      * meta-packages that export arrays of sub-packages work directly.
      */
     software?: SoftwareInput[];
+    /**
+     * Whether to auto-include the default software bundle (`@agentos-software/common`
+     * — `sh` + coreutils + the standard CLI tools agents rely on) in addition to
+     * any `software` you pass. Defaults to `true`; set `false` for a bare VM with
+     * only the software you list explicitly. Entries already present in `software`
+     * are not duplicated.
+     */
+    defaultSoftware?: boolean;
     /** Loopback ports to exempt from SSRF checks (for testing with host-side mock servers). */
     loopbackExemptPorts?: number[];
     /**
@@ -210,6 +226,11 @@ export interface AgentOsOptions {
     rootFilesystem?: RootFilesystemConfig;
     /** Filesystems to mount at boot time. */
     mounts?: MountConfig[];
+    /**
+     * @deprecated Use `mounts: [nodeModulesMount(path)]` instead.
+     * Compatibility alias for mounting `<moduleAccessCwd>/node_modules` at `/root/node_modules`.
+     */
+    moduleAccessCwd?: string;
     /** Additional instructions appended to the base OS system prompt injected at session start. */
     additionalInstructions?: string;
     /** Custom schedule driver for cron jobs. Defaults to TimerScheduleDriver. */
@@ -231,6 +252,13 @@ export interface AgentOsOptions {
      * runtime's historical constants, so omitting this leaves behavior unchanged.
      */
     limits?: AgentOsLimits;
+    /**
+     * Called with stderr chunks from the top-level ACP-speaking agent process.
+     * The agent process uses stdout for ACP JSON-RPC protocol traffic, so only
+     * stderr is forwarded through this hook. Defaults to writing chunks to
+     * `process.stderr`.
+     */
+    onAgentStderr?: AgentStderrHandler;
 }
 /** Configuration for a local MCP server (spawned as a child process). */
 export interface McpServerConfigLocal {
@@ -284,7 +312,7 @@ export interface ResumeSessionOptions {
      * fallback tier arms a continuation preamble pointing the agent at it.
      */
     transcriptPath?: string;
-    /** Working directory for the resumed agent session (default `/home/user`). */
+    /** Working directory for the resumed agent session (default `/workspace`). */
     cwd?: string;
     /** Environment variables to pass to the resumed agent process. */
     env?: Record<string, string>;
@@ -347,11 +375,13 @@ export declare class AgentOs {
     private readonly _sidecarSession;
     private readonly _sidecarVm;
     private readonly _disposeSidecarEventListener;
+    private readonly _agentStderrHandler?;
     private constructor();
     static createSidecar(options?: AgentOsCreateSidecarOptions): Promise<AgentOsSidecar>;
     static getSharedSidecar(options?: AgentOsSharedSidecarOptions): Promise<AgentOsSidecar>;
     static create(options?: AgentOsOptions): Promise<AgentOs>;
     exec(command: string, options?: KernelExecOptions): Promise<KernelExecResult>;
+    execArgv(command: string, args?: readonly string[], options?: KernelExecOptions): Promise<KernelExecResult>;
     private _trackProcess;
     spawn(command: string, args: string[], options?: KernelSpawnOptions): {
         pid: number;
@@ -431,6 +461,7 @@ export declare class AgentOs {
     private _recordSessionNotification;
     private _dispatchSessionEvent;
     private _subscribeSessionEvents;
+    private _recordAgentStderr;
     private _applySyntheticConfigOverrides;
     private _handleSidecarEvent;
     private _handleAcpExtEvent;

package/dist/agent-os.js

@@ -4,6 +4,7 @@ import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, w
 import { tmpdir } from "node:os";
 import { dirname, join, posix as posixPath, resolve as resolveHostPath, } from "node:path";
 import { fileURLToPath } from "node:url";
+import commonSoftware from "@agentos-software/common";
 import { validateToolkits } from "./host-tools.js";
 import { zodToJsonSchema } from "./host-tools-zod.js";
 import { resolvePublishedSidecarBinary } from "./sidecar/binary.js";
@@ -50,9 +51,12 @@ import { serializeMountConfigForSidecar, } from "./js-bridge.js";
 import { createSnapshotExport, } from "./layers.js";
 import { processSoftware, resolvePackageDir, } from "./packages.js";
 import { allowAll } from "./runtime-compat.js";
-import { AcpRuntimeKind, decodeAcpCallback, decodeAcpEvent, decodeAcpResponse, encodeAcpCallbackResponse, encodeAcpRequest, } from "./sidecar/agent-os-protocol.js";
+import { AcpRuntimeKind, decodeAcpCallback, decodeAcpEvent, decodeAcpResponse, encodeAcpCallbackResponse, encodeAcpRequest, } from "./sidecar/agentos-protocol.js";
 import { serializePermissionsForSidecar } from "./sidecar/permissions.js";
 import { createAgentOsSidecarClient, NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarKernelProxy, SidecarProcess, serializeRootFilesystemForSidecar, } from "./sidecar/rpc-client.js";
+function defaultAgentStderrHandler(event) {
+    process.stderr.write(event.chunk);
+}
 const LEGACY_PERMISSION_METHOD = "request/permission";
 const ACP_PERMISSION_METHOD = "session/request_permission";
 class AcpDispatchError extends Error {
@@ -366,7 +370,8 @@ const KERNEL_POSIX_BOOTSTRAP_DIRS = [
     "/mnt",
     "/media",
     "/home",
-    "/home/user",
+    "/home/agentos",
+    "/workspace",
     "/usr",
     "/usr/bin",
     "/usr/games",
@@ -488,7 +493,7 @@ function prepareCommandDirs(commandPackages) {
             if (aliasEntries.length === 0) {
                 continue;
             }
-            const aliasDir = mkdtempSync(join(tmpdir(), "agent-os-command-aliases-"));
+            const aliasDir = mkdtempSync(join(tmpdir(), "agentos-command-aliases-"));
             for (const [aliasName, sourcePath] of aliasEntries) {
                 writeFileSync(join(aliasDir, aliasName), readFileSync(sourcePath));
             }
@@ -835,7 +840,7 @@ function collectSidecarMountPlan(options) {
     return { sidecarMounts, hostMounts, hostPathMappings };
 }
 function materializeToolShimDir(toolKits) {
-    const shimDir = mkdtempSync(join(tmpdir(), "agent-os-host-tools-shims-"));
+    const shimDir = mkdtempSync(join(tmpdir(), "agentos-host-tools-shims-"));
     writeFileSync(join(shimDir, "agentos"), KERNEL_COMMAND_STUB, { mode: 0o755 });
     for (const toolKit of toolKits) {
         writeFileSync(join(shimDir, `agentos-${toolKit.name}`), KERNEL_COMMAND_STUB, { mode: 0o755 });
@@ -1402,7 +1407,8 @@ export class AgentOs {
     _sidecarSession;
     _sidecarVm;
     _disposeSidecarEventListener;
-    constructor(kernel, sidecar, softwareRoots, softwareAgentConfigs, hostMounts, env, rootFilesystem, sidecarClient, sidecarSession, sidecarVm) {
+    _agentStderrHandler;
+    constructor(kernel, sidecar, softwareRoots, softwareAgentConfigs, hostMounts, env, rootFilesystem, sidecarClient, sidecarSession, sidecarVm, agentStderrHandler) {
         this.#kernel = kernel;
         this.sidecar = sidecar;
         this._softwareRoots = softwareRoots;
@@ -1413,6 +1419,7 @@ export class AgentOs {
         this._sidecarClient = sidecarClient;
         this._sidecarSession = sidecarSession;
         this._sidecarVm = sidecarVm;
+        this._agentStderrHandler = agentStderrHandler;
         this._disposeSidecarEventListener = this._sidecarClient.onEvent((event) => {
             this._handleSidecarEvent(event);
         });
@@ -1430,7 +1437,10 @@ export class AgentOs {
         return getSharedAgentOsSidecarInternal(options);
     }
     static async create(options) {
-        const processed = processSoftware(options?.software ?? []);
+        const software = options?.defaultSoftware === false
+            ? (options.software ?? [])
+            : [commonSoftware, ...(options?.software ?? [])];
+        const processed = processSoftware(software);
         const localMounts = await resolveCompatLocalMounts(options?.mounts);
         const toolKits = options?.toolKits;
         if (toolKits && toolKits.length > 0) {
@@ -1467,8 +1477,21 @@ export class AgentOs {
                     toolShimDir = materializeToolShimDir(toolKits);
                 }
                 const commandGuestPaths = collectGuestCommandPaths(preparedCommandDirs.commandDirs);
+                const requestedMounts = options?.moduleAccessCwd
+                    ? [
+                        ...(options.mounts ?? []),
+                        {
+                            path: "/root/node_modules",
+                            plugin: createHostDirBackend({
+                                hostPath: join(options.moduleAccessCwd, "node_modules"),
+                                readOnly: true,
+                            }),
+                            readOnly: true,
+                        },
+                    ]
+                    : options?.mounts;
                 const { sidecarMounts, hostMounts, hostPathMappings } = collectSidecarMountPlan({
-                    mounts: options?.mounts,
+                    mounts: requestedMounts,
                     softwareRoots: processed.softwareRoots,
                     commandDirs: preparedCommandDirs.commandDirs,
                     shimDir: toolShimDir,
@@ -1531,7 +1554,7 @@ export class AgentOs {
                     session,
                     vm: nativeVm,
                     env,
-                    cwd: "/home/user",
+                    cwd: "/workspace",
                     localMounts,
                     commandGuestPaths,
                     onDispose: cleanup,
@@ -1588,7 +1611,7 @@ export class AgentOs {
                 createVm: async () => createVmAdmin(),
             });
             const vmAdmin = sidecarLease.admin;
-            const vm = new AgentOs(vmAdmin.kernel, sidecar, processed.softwareRoots, processed.agentConfigs, vmAdmin.hostMounts, vmAdmin.env, vmAdmin.rootView, vmAdmin.sidecarClient, vmAdmin.sidecarSession, vmAdmin.sidecarVm);
+            const vm = new AgentOs(vmAdmin.kernel, sidecar, processed.softwareRoots, processed.agentConfigs, vmAdmin.hostMounts, vmAdmin.env, vmAdmin.rootView, vmAdmin.sidecarClient, vmAdmin.sidecarSession, vmAdmin.sidecarVm, options?.onAgentStderr ?? defaultAgentStderrHandler);
             vm._sidecarLease = sidecarLease;
             vm._toolKits = vmAdmin.toolKits;
             vm._toolReference = vmAdmin.toolReference;
@@ -1605,6 +1628,10 @@ export class AgentOs {
     async exec(command, options) {
         return this.#kernel.exec(command, options);
     }
+    async execArgv(command, args = [], options) {
+        const kernel = this.#kernel;
+        return kernel.execArgv(command, args, options);
+    }
     _trackProcess(proc, command, args, stdoutHandlers, stderrHandlers, exitHandlers) {
         const entry = {
             proc,
@@ -2227,6 +2254,30 @@ export class AgentOs {
             session.eventHandlers.delete(subscriber);
         };
     }
+    _recordAgentStderr(event) {
+        const session = (event.sessionId ? this._sessions.get(event.sessionId) : undefined) ??
+            [...this._sessions.values()].find((candidate) => candidate.processId === event.processId);
+        const sessionId = event.sessionId || session?.sessionId;
+        if (!sessionId) {
+            return;
+        }
+        const handler = this._agentStderrHandler;
+        if (!handler) {
+            return;
+        }
+        try {
+            handler({
+                sessionId,
+                agentType: event.agentType || session?.agentType || "",
+                processId: event.processId,
+                pid: session?.pid ?? null,
+                chunk: new Uint8Array(event.chunk),
+            });
+        }
+        catch {
+            // Ignore subscriber callback failures and keep event delivery moving.
+        }
+    }
     _applySyntheticConfigOverrides(session) {
         if (session.configOverrides.size === 0) {
             return;
@@ -2283,6 +2334,10 @@ export class AgentOs {
                     this._recordSessionNotification(session, toJsonRpcNotification(JSON.parse(event.val.notification)));
                     return;
                 }
+                case "AcpAgentStderrEvent": {
+                    this._recordAgentStderr(event.val);
+                    return;
+                }
             }
         }
         catch {
@@ -2507,7 +2562,7 @@ export class AgentOs {
         // skipOsInstructions plus the agent's static launch args and env.
         const launchArgs = [...(config.launchArgs ?? [])];
         let launchEnv = { ...config.defaultEnv, ...options?.env };
-        const sessionCwd = options?.cwd ?? "/home/user";
+        const sessionCwd = options?.cwd ?? "/workspace";
         const adapterEntrypoint = this._resolveAdapterBin(config.acpAdapter);
         if ((agentType === "pi" || agentType === "pi-cli") &&
             !launchEnv.PI_ACP_PI_COMMAND) {
@@ -2585,7 +2640,7 @@ export class AgentOs {
         }
         const adapterEntrypoint = this._resolveAdapterBin(config.acpAdapter);
         let launchEnv = { ...config.defaultEnv, ...options?.env };
-        const sessionCwd = options?.cwd ?? "/home/user";
+        const sessionCwd = options?.cwd ?? "/workspace";
         if ((agentType === "pi" || agentType === "pi-cli") &&
             !launchEnv.PI_ACP_PI_COMMAND) {
             launchEnv = {
@@ -3498,7 +3553,7 @@ function getSharedAgentOsSidecarInternal(options = {}) {
     if (existing && existing.describe().state !== "disposed") {
         return existing;
     }
-    const sidecar = new AgentOsSidecar(`agent-os-shared-sidecar:${pool}`, { kind: "shared", ...(pool ? { pool } : {}) }, pool);
+    const sidecar = new AgentOsSidecar(`agentos-shared-sidecar:${pool}`, { kind: "shared", ...(pool ? { pool } : {}) }, pool);
     sharedSidecars.set(pool, sidecar);
     return sidecar;
 }

package/dist/agents.js

@@ -1,7 +1,7 @@
 // Agent configurations for ACP-compatible coding agents
 export const AGENT_CONFIGS = {
     pi: {
-        acpAdapter: "@rivet-dev/agentos-pi",
+        acpAdapter: "@agentos-software/pi",
         agentPackage: "@mariozechner/pi-coding-agent",
     },
     "pi-cli": {
@@ -9,18 +9,18 @@ export const AGENT_CONFIGS = {
         agentPackage: "@mariozechner/pi-coding-agent",
     },
     opencode: {
-        acpAdapter: "@rivet-dev/agentos-opencode",
-        agentPackage: "@rivet-dev/agentos-opencode",
+        acpAdapter: "@agentos-software/opencode",
+        agentPackage: "@agentos-software/opencode",
         defaultEnv: {
             OPENCODE_DISABLE_CONFIG_DEP_INSTALL: "1",
             OPENCODE_DISABLE_EMBEDDED_WEB_UI: "1",
         },
     },
     claude: {
-        acpAdapter: "@rivet-dev/agentos-claude",
+        acpAdapter: "@agentos-software/claude-code",
         agentPackage: "@anthropic-ai/claude-agent-sdk",
         defaultEnv: {
-            CLAUDE_AGENT_SDK_CLIENT_APP: "@rivet-dev/agent-os",
+            CLAUDE_AGENT_SDK_CLIENT_APP: "@rivet-dev/agentos",
             CLAUDE_CODE_SIMPLE: "1",
             CLAUDE_CODE_FORCE_AGENT_OS_RIPGREP: "1",
             CLAUDE_CODE_DEFER_GROWTHBOOK_INIT: "1",

package/dist/cron/cron-manager.js

@@ -145,10 +145,7 @@ export class CronManager {
                 break;
             }
             case "exec": {
-                const cmd = action.args?.length
-                    ? `${action.command} ${action.args.join(" ")}`
-                    : action.command;
-                await this.vm.exec(cmd);
+                await this.vm.execArgv(action.command, action.args ?? []);
                 break;
             }
             case "callback": {

package/dist/index.js

@@ -1,4 +1,4 @@
-// @rivet-dev/agent-os
+// @rivet-dev/agentos
 export { AgentOs, AgentOsSidecar } from "./agent-os.js";
 export { AGENT_CONFIGS } from "./agents.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";

package/dist/layers.d.ts

@@ -3,7 +3,7 @@ import { type FilesystemEntry } from "./filesystem-snapshot.js";
 import type { VirtualFileSystem } from "./runtime-compat.js";
 export type OverlayFilesystemMode = "ephemeral" | "read-only";
 export interface FilesystemSnapshotExport {
-    format: "agent-os-filesystem-snapshot-v1";
+    format: "agentos-filesystem-snapshot-v1";
     filesystem: {
         entries: FilesystemEntry[];
     };

package/dist/layers.js

@@ -22,7 +22,7 @@ function isFilesystemSnapshotExport(value) {
     if (!value || typeof value !== "object") {
         return false;
     }
-    if (value.format !== "agent-os-filesystem-snapshot-v1") {
+    if (value.format !== "agentos-filesystem-snapshot-v1") {
         return false;
     }
     const filesystem = value.filesystem;
@@ -37,7 +37,7 @@ function normalizeSnapshotExport(source) {
             throw new Error("Invalid base filesystem artifact");
         }
         return {
-            format: "agent-os-filesystem-snapshot-v1",
+            format: "agentos-filesystem-snapshot-v1",
             filesystem: {
                 entries: source.source.filesystem.entries,
             },
@@ -52,7 +52,7 @@ export function createSnapshotExport(entries) {
     return {
         kind: "snapshot-export",
         source: {
-            format: "agent-os-filesystem-snapshot-v1",
+            format: "agentos-filesystem-snapshot-v1",
             filesystem: { entries },
         },
     };

package/dist/packages.d.ts

@@ -61,7 +61,7 @@ export interface WasmCommandSoftwareDescriptor extends SoftwareDescriptor {
 }
 /**
  * Any object with a commandDir property is treated as a WASM command package.
- * This allows registry packages (e.g., @agent-os-pkgs/coreutils) to be
+ * This allows registry packages (e.g., @agentos-software/coreutils) to be
  * passed directly to the `software` option without wrapping.
  */
 export interface WasmCommandDirDescriptor {

package/dist/runtime-compat.d.ts

@@ -304,6 +304,9 @@ export interface BindingTree {
     [key: string]: BindingFunction | BindingTree;
 }
 export type BindingFunction = (...args: unknown[]) => unknown;
+export interface ModuleAccessOptions {
+    cwd?: string;
+}
 export interface NodeDriverOptions {
     filesystem?: VirtualFileSystem;
     networkAdapter?: NetworkAdapter;
@@ -311,6 +314,7 @@ export interface NodeDriverOptions {
     permissions?: Permissions;
     processConfig?: ProcessConfig;
     osConfig?: OSConfig;
+    moduleAccess?: ModuleAccessOptions;
 }
 export interface DefaultNetworkAdapterOptions {
     loopbackExemptPorts?: number[];

package/dist/runtime-compat.js

@@ -36,7 +36,8 @@ const KERNEL_POSIX_BOOTSTRAP_DIRS = [
     "/mnt",
     "/media",
     "/home",
-    "/home/user",
+    "/home/agentos",
+    "/workspace",
     "/usr",
     "/usr/bin",
     "/usr/games",
@@ -1632,7 +1633,7 @@ class NativeKernel {
     constructor(options) {
         this.options = options;
         this.env = { ...(options.env ?? {}) };
-        this.cwd = options.cwd ?? "/home/user";
+        this.cwd = options.cwd ?? "/workspace";
         this.socketTable = {
             hasHostNetworkAdapter: () => Boolean(options.hostNetworkAdapter),
             findListener: (request) => this.proxy?.findListener(request) ?? null,
@@ -1987,7 +1988,7 @@ class NativeKernel {
             vm,
             env: this.env,
             cwd: this.cwd,
-            defaultExecCwd: this.options.cwd === undefined ? "/home/user" : this.cwd,
+            defaultExecCwd: this.options.cwd === undefined ? "/workspace" : this.cwd,
             localMounts: this.pendingLocalMounts,
             commandGuestPaths: new Map(),
             onWasmCommandResolved: (command) => {

package/dist/sidecar/{agent-os-protocol.d.ts → agentos-protocol.d.ts}

@@ -163,9 +163,20 @@ export type AcpSessionEvent = {
 };
 export declare function readAcpSessionEvent(bc: bare.ByteCursor): AcpSessionEvent;
 export declare function writeAcpSessionEvent(bc: bare.ByteCursor, x: AcpSessionEvent): void;
+export type AcpAgentStderrEvent = {
+    readonly sessionId: string;
+    readonly agentType: string;
+    readonly processId: string;
+    readonly chunk: ArrayBuffer;
+};
+export declare function readAcpAgentStderrEvent(bc: bare.ByteCursor): AcpAgentStderrEvent;
+export declare function writeAcpAgentStderrEvent(bc: bare.ByteCursor, x: AcpAgentStderrEvent): void;
 export type AcpEvent = {
     readonly tag: "AcpSessionEvent";
     readonly val: AcpSessionEvent;
+} | {
+    readonly tag: "AcpAgentStderrEvent";
+    readonly val: AcpAgentStderrEvent;
 };
 export declare function readAcpEvent(bc: bare.ByteCursor): AcpEvent;
 export declare function writeAcpEvent(bc: bare.ByteCursor, x: AcpEvent): void;

package/dist/sidecar/{agent-os-protocol.js → agentos-protocol.js}

@@ -1,4 +1,4 @@
-// @generated - run pnpm --dir packages/core build:agent-os-protocol
+// @generated - run pnpm --dir packages/core build:agentos-protocol
 import * as bare from "@rivetkit/bare-ts";
 const DEFAULT_CONFIG = /* @__PURE__ */ bare.Config({});
 export function readJsonUtf8(bc) {
@@ -433,12 +433,28 @@ export function writeAcpSessionEvent(bc, x) {
     bare.writeString(bc, x.sessionId);
     writeJsonUtf8(bc, x.notification);
 }
+export function readAcpAgentStderrEvent(bc) {
+    return {
+        sessionId: bare.readString(bc),
+        agentType: bare.readString(bc),
+        processId: bare.readString(bc),
+        chunk: bare.readData(bc),
+    };
+}
+export function writeAcpAgentStderrEvent(bc, x) {
+    bare.writeString(bc, x.sessionId);
+    bare.writeString(bc, x.agentType);
+    bare.writeString(bc, x.processId);
+    bare.writeData(bc, x.chunk);
+}
 export function readAcpEvent(bc) {
     const offset = bc.offset;
     const tag = bare.readU8(bc);
     switch (tag) {
         case 0:
             return { tag: "AcpSessionEvent", val: readAcpSessionEvent(bc) };
+        case 1:
+            return { tag: "AcpAgentStderrEvent", val: readAcpAgentStderrEvent(bc) };
         default: {
             bc.offset = offset;
             throw new bare.BareError(offset, "invalid tag");
@@ -452,6 +468,11 @@ export function writeAcpEvent(bc, x) {
             writeAcpSessionEvent(bc, x.val);
             break;
         }
+        case "AcpAgentStderrEvent": {
+            bare.writeU8(bc, 1);
+            writeAcpAgentStderrEvent(bc, x.val);
+            break;
+        }
     }
 }
 export function encodeAcpEvent(x, config) {

package/dist/sidecar/native-process-client.d.ts

@@ -1,2 +1,3 @@
-export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarProcessClient as SidecarProcess, SidecarEventBufferOverflow, SidecarProcessError, SidecarProcessExited, } from "@secure-exec/core/sidecar-client";
-export type { AuthenticatedSession, CreatedVm, ExtEnvelope, GuestFilesystemStat, NativeSidecarSpawnOptions as SidecarSpawnOptions, RootFilesystemEntry, RootFilesystemLowerDescriptor, SidecarEventSelector, SidecarFsPermissionRule, SidecarMountDescriptor, SidecarMountPluginDescriptor, SidecarPatternPermissionRule, SidecarPermissionMode, SidecarPermissionScope, SidecarPermissionsPolicy, SidecarProcessSnapshotEntry, SidecarProjectedModuleDescriptor, SidecarRegisteredHostCallbackDefinition, SidecarRegisteredHostCallbackExample, SidecarRequestFrame, SidecarRequestHandler, SidecarRequestPayload, SidecarResponseFrame, SidecarResponsePayload, SidecarRulePermissions, SidecarSessionState, SidecarSignalHandlerRegistration, SidecarSignalState, SidecarSocketStateEntry, SidecarSoftwareDescriptor, SidecarZombieTimerCount, } from "@secure-exec/core/sidecar-client";
+import "@secure-exec/core/native-client";
+export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, SidecarProcess, SidecarProcess as NativeSidecarProcessClient, SidecarEventBufferOverflow, SidecarProcessError, SidecarProcessExited, } from "@secure-exec/core/sidecar-client";
+export type { AuthenticatedSession, CreatedVm, ExtEnvelope, GuestFilesystemStat, RootFilesystemEntry, RootFilesystemLowerDescriptor, SidecarEventSelector, SidecarFsPermissionRule, SidecarMountDescriptor, SidecarMountPluginDescriptor, SidecarPatternPermissionRule, SidecarPermissionMode, SidecarPermissionScope, SidecarPermissionsPolicy, SidecarProcessSnapshotEntry, SidecarProjectedModuleDescriptor, SidecarRegisteredHostCallbackDefinition, SidecarRegisteredHostCallbackExample, SidecarRequestFrame, SidecarRequestHandler, SidecarRequestPayload, SidecarResponseFrame, SidecarResponsePayload, SidecarRulePermissions, SidecarSessionState, SidecarSignalHandlerRegistration, SidecarSignalState, SidecarSocketStateEntry, SidecarSoftwareDescriptor, SidecarSpawnOptions, SidecarSpawnOptions as NativeSidecarSpawnOptions, SidecarZombieTimerCount, } from "@secure-exec/core/sidecar-client";

package/dist/sidecar/native-process-client.js

@@ -1 +1,6 @@
-export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarProcessClient as SidecarProcess, SidecarEventBufferOverflow, SidecarProcessError, SidecarProcessExited, } from "@secure-exec/core/sidecar-client";
+// Register the native sidecar spawn factory (side effect). After the
+// @secure-exec/core SidecarProcess refactor, native spawn is provided by a
+// separately-registered factory; importing native-client wires it up so
+// SidecarProcess.spawn works in this native runtime.
+import "@secure-exec/core/native-client";
+export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, SidecarProcess, SidecarProcess as NativeSidecarProcessClient, SidecarEventBufferOverflow, SidecarProcessError, SidecarProcessExited, } from "@secure-exec/core/sidecar-client";

package/dist/sidecar/permissions.js

@@ -28,7 +28,7 @@ export function serializePermissionsForSidecar(permissions) {
             childProcess: "deny",
             process: "deny",
             env: "deny",
-            tool: "deny",
+            binding: "deny",
         };
     }
     return {
@@ -47,7 +47,7 @@ export function serializePermissionsForSidecar(permissions) {
         env: typeof permissions.env === "string" || !permissions.env
             ? permissions.env
             : serializePatternScope(permissions.env),
-        tool: typeof permissions.tool === "string" || !permissions.tool
+        binding: typeof permissions.tool === "string" || !permissions.tool
             ? permissions.tool
             : serializePatternScope(permissions.tool),
     };

package/dist/sidecar/rpc-client.d.ts

@@ -71,6 +71,7 @@ export declare class NativeSidecarKernelProxy {
     registerCommandGuestPaths(commandGuestPaths: ReadonlyMap<string, string>): void;
     dispose(): Promise<void>;
     exec(command: string, options?: KernelExecOptions): Promise<KernelExecResult>;
+    execArgv(command: string, args?: readonly string[], options?: KernelExecOptions): Promise<KernelExecResult>;
     spawn(command: string, args: string[], options?: KernelSpawnOptions): ManagedProcess;
     openShell(options?: OpenShellOptions): ShellHandle;
     connectTerminal(options?: ConnectTerminalOptions): Promise<number>;

package/dist/sidecar/rpc-client.js

@@ -376,6 +376,51 @@ export class NativeSidecarKernelProxy {
         });
         return runAndCapture(proc);
     }
+    async execArgv(command, args = [], options) {
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        const effectiveCwd = options?.cwd ?? this.defaultExecCwd ?? this.cwd;
+        const runAndCapture = async (proc) => {
+            if (options?.stdin !== undefined) {
+                proc.writeStdin(options.stdin);
+            }
+            proc.closeStdin();
+            const waitPromise = proc.wait();
+            const exitCode = typeof options?.timeout === "number"
+                ? await new Promise((resolve) => {
+                    const timer = setTimeout(() => {
+                        proc.kill(9);
+                        void proc.wait().then(resolve);
+                    }, options.timeout);
+                    void waitPromise.then((code) => {
+                        clearTimeout(timer);
+                        resolve(code);
+                    });
+                })
+                : await waitPromise;
+            await drainTrailingProcessOutputTurn();
+            return {
+                exitCode,
+                stdout: Buffer.concat(stdoutChunks.map((chunk) => Buffer.from(chunk))).toString("utf8"),
+                stderr: Buffer.concat(stderrChunks.map((chunk) => Buffer.from(chunk))).toString("utf8"),
+            };
+        };
+        if (this.commands.get(command) === "wasmvm") {
+            this.onWasmCommandResolved?.(command);
+        }
+        return runAndCapture(this.spawn(command, [...args], {
+            ...options,
+            cwd: effectiveCwd,
+            onStdout: (chunk) => {
+                stdoutChunks.push(chunk);
+                options?.onStdout?.(chunk);
+            },
+            onStderr: (chunk) => {
+                stderrChunks.push(chunk);
+                options?.onStderr?.(chunk);
+            },
+        }));
+    }
     spawn(command, args, options) {
         let spawnCommand = command;
         let spawnArgs = [...args];

package/dist/test/sandbox-agent.js

@@ -152,7 +152,7 @@ async function runCommand(request) {
     });
 }
 export async function startMockSandboxAgent() {
-    const rootDir = await mkdtemp(resolve(tmpdir(), "agent-os-sandbox-agent-"));
+    const rootDir = await mkdtemp(resolve(tmpdir(), "agentos-sandbox-agent-"));
     const processes = new Map();
     const server = createServer(async (request, response) => {
         try {

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export type { AgentCapabilities, AgentInfo, AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentRegistryEntry, BatchReadResult, BatchWriteEntry, BatchWriteResult, CreateSessionOptions, DirEntry, McpServerConfig, McpServerConfigLocal, McpServerConfigRemote, MountConfig, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountConfig, NativeMountPluginDescriptor, OverlayMountConfig, PermissionReply, PermissionRequest, PermissionRequestHandler, PlainMountConfig, ProcessTreeNode, PromptResult, ReaddirRecursiveOptions, ResumeSessionOptions, ResumeSessionResult, RootFilesystemConfig, RootLowerInput, SessionConfigOption, SessionEventHandler, SessionInfo, SessionInitData, SessionMode, SessionModeState, SpawnedProcessInfo, } from "./agent-os.js";
+export type { AgentCapabilities, AgentInfo, AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentStderrEvent, AgentStderrHandler, AgentRegistryEntry, BatchReadResult, BatchWriteEntry, BatchWriteResult, CreateSessionOptions, DirEntry, McpServerConfig, McpServerConfigLocal, McpServerConfigRemote, MountConfig, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountConfig, NativeMountPluginDescriptor, OverlayMountConfig, PermissionReply, PermissionRequest, PermissionRequestHandler, PlainMountConfig, ProcessTreeNode, PromptResult, ReaddirRecursiveOptions, ResumeSessionOptions, ResumeSessionResult, RootFilesystemConfig, RootLowerInput, SessionConfigOption, SessionEventHandler, SessionInfo, SessionInitData, SessionMode, SessionModeState, SpawnedProcessInfo, } from "./agent-os.js";
 export type { AgentConfig, AgentType } from "./agents.js";
 export type { CronAction, CronEvent, CronEventHandler, CronJob, CronJobInfo, CronJobOptions, ScheduleDriver, ScheduleEntry, ScheduleHandle, } from "./cron/index.js";
 export type { HostDirBackendOptions, HostDirMountPluginConfig, NodeModulesMountConfig, } from "./host-dir-mount.js";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rivet-dev/agentos-core",
-	"version": "0.0.0-agentos-dylib-plugin.bbfdf95",
+	"version": "0.0.0-codex-on-agent-stderr.dd7a603",
 	"type": "module",
 	"license": "Apache-2.0",
 	"main": "./dist/index.js",
@@ -49,15 +49,16 @@
 	"scripts": {
 		"check-types": "pnpm run build:protocols && tsc --noEmit",
 		"build": "pnpm run build:protocols && tsc",
-		"build:agent-os-protocol": "node ./scripts/compile-agent-os-protocol.mjs",
-		"build:protocols": "pnpm run build:agent-os-protocol",
+		"build:agentos-protocol": "node ./scripts/compile-agentos-protocol.mjs",
+		"build:protocols": "pnpm run build:agentos-protocol",
 		"test": "vitest run --reporter=verbose"
 	},
 	"dependencies": {
+		"@agentos-software/common": "0.3.0-rc.2",
 		"@aws-sdk/client-s3": "^3.1019.0",
-		"@rivet-dev/agentos-sidecar": "0.0.0-agentos-dylib-plugin.bbfdf95",
+		"@rivet-dev/agentos-sidecar": "0.0.0-codex-on-agent-stderr.dd7a603",
 		"@rivetkit/bare-ts": "^0.6.2",
-		"@secure-exec/core": "0.3.0",
+		"@secure-exec/core": "0.0.0-nathan-workspace-binding-agentos.83db3e3",
 		"@xterm/headless": "^6.0.0",
 		"better-sqlite3": "^12.8.0",
 		"croner": "^10.0.1",
@@ -74,32 +75,32 @@
 		"@browserbasehq/sdk": "2.10.0",
 		"@bare-ts/tools": "0.15.0",
 		"@copilotkit/llmock": "^1.6.0",
-		"@rivet-dev/agentos-sandbox": "link:../agent-os-sandbox",
-		"@agent-os-pkgs/git": "0.0.0-split-runtime-preview.5d46b14",
-		"@secure-exec/google-drive": "0.3.0",
-		"@secure-exec/s3": "0.3.0",
+		"@rivet-dev/agentos-sandbox": "link:../agentos-sandbox",
+		"@agentos-software/git": "0.3.0-rc.2",
+		"@secure-exec/google-drive": "0.0.0-nathan-workspace-binding-agentos.83db3e3",
+		"@secure-exec/s3": "0.0.0-nathan-workspace-binding-agentos.83db3e3",
 		"@mariozechner/pi-coding-agent": "^0.60.0",
-		"@rivet-dev/agentos-claude": "link:../../registry/agent/claude",
-		"@agent-os-pkgs/codex": "0.0.0-split-runtime-preview.5d46b14",
-		"@rivet-dev/agentos-codex-agent": "link:../../registry/agent/codex",
-		"@agent-os-pkgs/coreutils": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/curl": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/diffutils": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/fd": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/file": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/findutils": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/gawk": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/grep": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/gzip": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/jq": "0.0.0-split-runtime-preview.5d46b14",
-		"@rivet-dev/agentos-opencode": "link:../../registry/agent/opencode",
-		"@rivet-dev/agentos-pi": "link:../../registry/agent/pi",
-		"@rivet-dev/agentos-pi-cli": "link:../../registry/agent/pi-cli",
-		"@agent-os-pkgs/ripgrep": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/sed": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/tar": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/tree": "0.0.0-split-runtime-preview.5d46b14",
-		"@agent-os-pkgs/yq": "0.0.0-split-runtime-preview.5d46b14",
+		"@agentos-software/claude-code": "link:../../registry/agent/claude",
+		"@agentos-software/codex-cli": "0.3.0-rc.2",
+		"@agentos-software/codex": "link:../../registry/agent/codex",
+		"@agentos-software/coreutils": "0.3.0-rc.2",
+		"@agentos-software/curl": "0.3.0-rc.2",
+		"@agentos-software/diffutils": "0.3.0-rc.2",
+		"@agentos-software/fd": "0.3.0-rc.2",
+		"@agentos-software/file": "0.3.0-rc.2",
+		"@agentos-software/findutils": "0.3.0-rc.2",
+		"@agentos-software/gawk": "0.3.0-rc.2",
+		"@agentos-software/grep": "0.3.0-rc.2",
+		"@agentos-software/gzip": "0.3.0-rc.2",
+		"@agentos-software/jq": "0.3.0-rc.2",
+		"@agentos-software/opencode": "link:../../registry/agent/opencode",
+		"@agentos-software/pi": "link:../../registry/agent/pi",
+		"@agentos-software/pi-cli": "link:../../registry/agent/pi-cli",
+		"@agentos-software/ripgrep": "0.3.0-rc.2",
+		"@agentos-software/sed": "0.3.0-rc.2",
+		"@agentos-software/tar": "0.3.0-rc.2",
+		"@agentos-software/tree": "0.3.0-rc.2",
+		"@agentos-software/yq": "0.3.0-rc.2",
 		"@types/node": "^22.10.2",
 		"pi-acp": "^0.0.23",
 		"sandbox-agent": "^0.4.2",