@rivet-dev/agentos-core 0.0.0-codex-agentos-native-platform-e2e.78ef941 → 0.0.0-feat-on-limit-warning.62a2bc2

package/dist/agent-os.d.ts

@@ -198,6 +198,33 @@ export interface AgentStderrEvent {
     chunk: Uint8Array;
 }
 export type AgentStderrHandler = (event: AgentStderrEvent) => void;
+/**
+ * A near-capacity warning for one bounded limit (a queue/buffer, a saturating
+ * resource cap, or a memory envelope) inside the VM runtime. Delivered the moment
+ * usage crosses the runtime's warning threshold (~80%), once per crossing — the
+ * runtime applies edge-triggering + hysteresis, so this never spams.
+ */
+export interface LimitWarning {
+    /** Stable limit name, e.g. `"v8_event_channel"` or `"vm_open_fds"`. */
+    limit: string;
+    /** Limit class: `"queue"`, `"resource"`, or `"memory"`. */
+    category: string;
+    /** Current observed usage. */
+    observed: number;
+    /** Configured capacity. */
+    capacity: number;
+    /** Observed fill as a percentage of capacity (0–100). */
+    fillPercent: number;
+}
+export type LimitWarningHandler = (warning: LimitWarning) => void;
+/**
+ * Public core VM options.
+ *
+ * Keep this interface in sync with
+ * `packages/core/src/options-schema.ts::agentOsOptionsSchema`. The Rivet
+ * native actor intentionally accepts only a subset via
+ * `packages/agentos/src/config.ts::nativeAgentOsOptionsSchema`.
+ */
 export interface AgentOsOptions {
     /**
      * Software to install in the VM. Each entry provides agents, tools,
@@ -259,6 +286,12 @@ export interface AgentOsOptions {
      * `process.stderr`.
      */
     onAgentStderr?: AgentStderrHandler;
+    /**
+     * Called when a bounded limit inside the VM runtime approaches capacity
+     * (~80%, edge-triggered with hysteresis so it does not spam). Use it to alert
+     * on a slow consumer or a runaway guest before the limit is actually hit.
+     */
+    onLimitWarning?: LimitWarningHandler;
 }
 /** Configuration for a local MCP server (spawned as a child process). */
 export interface McpServerConfigLocal {
@@ -376,6 +409,7 @@ export declare class AgentOs {
     private readonly _sidecarVm;
     private readonly _disposeSidecarEventListener;
     private readonly _agentStderrHandler?;
+    private readonly _limitWarningHandler?;
     private constructor();
     static createSidecar(options?: AgentOsCreateSidecarOptions): Promise<AgentOsSidecar>;
     static getSharedSidecar(options?: AgentOsSharedSidecarOptions): Promise<AgentOsSidecar>;
@@ -464,6 +498,7 @@ export declare class AgentOs {
     private _recordAgentStderr;
     private _applySyntheticConfigOverrides;
     private _handleSidecarEvent;
+    private _handleLimitWarning;
     private _handleAcpExtEvent;
     private _unsupportedConfigResponse;
     private _sendAcpRequest;

package/dist/agent-os.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import commonSoftware from "@agentos-software/common";
 import { validateToolkits } from "./host-tools.js";
 import { zodToJsonSchema } from "./host-tools-zod.js";
+import { parseAgentOsOptions } from "./options-schema.js";
 import { resolvePublishedSidecarBinary } from "./sidecar/binary.js";
 import { findCargoBinary, resolveCargoBinary } from "./sidecar/cargo.js";
 export { isAcpTimeoutErrorData } from "./json-rpc.js";
@@ -1408,7 +1409,8 @@ export class AgentOs {
     _sidecarVm;
     _disposeSidecarEventListener;
     _agentStderrHandler;
-    constructor(kernel, sidecar, softwareRoots, softwareAgentConfigs, hostMounts, env, rootFilesystem, sidecarClient, sidecarSession, sidecarVm, agentStderrHandler) {
+    _limitWarningHandler;
+    constructor(kernel, sidecar, softwareRoots, softwareAgentConfigs, hostMounts, env, rootFilesystem, sidecarClient, sidecarSession, sidecarVm, agentStderrHandler, limitWarningHandler) {
         this.#kernel = kernel;
         this.sidecar = sidecar;
         this._softwareRoots = softwareRoots;
@@ -1420,6 +1422,7 @@ export class AgentOs {
         this._sidecarSession = sidecarSession;
         this._sidecarVm = sidecarVm;
         this._agentStderrHandler = agentStderrHandler;
+        this._limitWarningHandler = limitWarningHandler;
         this._disposeSidecarEventListener = this._sidecarClient.onEvent((event) => {
             this._handleSidecarEvent(event);
         });
@@ -1437,6 +1440,7 @@ export class AgentOs {
         return getSharedAgentOsSidecarInternal(options);
     }
     static async create(options) {
+        options = parseAgentOsOptions(options);
         const software = options?.defaultSoftware === false
             ? (options.software ?? [])
             : [commonSoftware, ...(options?.software ?? [])];
@@ -1611,7 +1615,7 @@ export class AgentOs {
                 createVm: async () => createVmAdmin(),
             });
             const vmAdmin = sidecarLease.admin;
-            const vm = new AgentOs(vmAdmin.kernel, sidecar, processed.softwareRoots, processed.agentConfigs, vmAdmin.hostMounts, vmAdmin.env, vmAdmin.rootView, vmAdmin.sidecarClient, vmAdmin.sidecarSession, vmAdmin.sidecarVm, options?.onAgentStderr ?? defaultAgentStderrHandler);
+            const vm = new AgentOs(vmAdmin.kernel, sidecar, processed.softwareRoots, processed.agentConfigs, vmAdmin.hostMounts, vmAdmin.env, vmAdmin.rootView, vmAdmin.sidecarClient, vmAdmin.sidecarSession, vmAdmin.sidecarVm, options?.onAgentStderr ?? defaultAgentStderrHandler, options?.onLimitWarning);
             vm._sidecarLease = sidecarLease;
             vm._toolKits = vmAdmin.toolKits;
             vm._toolReference = vmAdmin.toolReference;
@@ -2300,6 +2304,10 @@ export class AgentOs {
         if (event.payload.type !== "structured") {
             return;
         }
+        if (event.payload.name === "limit_warning") {
+            this._handleLimitWarning(event.payload.detail);
+            return;
+        }
         if (event.payload.name !== "acp.session_event") {
             return;
         }
@@ -2319,6 +2327,27 @@ export class AgentOs {
             // Ignore malformed event payloads from the sidecar.
         }
     }
+    _handleLimitWarning(detail) {
+        if (!this._limitWarningHandler) {
+            return;
+        }
+        const toNumber = (value) => {
+            const parsed = Number(value);
+            return Number.isFinite(parsed) ? parsed : 0;
+        };
+        try {
+            this._limitWarningHandler({
+                limit: detail.limit ?? "",
+                category: detail.category ?? "",
+                observed: toNumber(detail.observed),
+                capacity: toNumber(detail.capacity),
+                fillPercent: toNumber(detail.fillPercent),
+            });
+        }
+        catch {
+            // A throwing handler must never break the sidecar event loop.
+        }
+    }
     _handleAcpExtEvent(envelope) {
         if (envelope.namespace !== ACP_EXTENSION_NAMESPACE) {
             return;

package/dist/host-tools-zod.js

@@ -1,3 +1,4 @@
+import { zodToJsonSchema as zodV3ToJsonSchema } from "zod-to-json-schema";
 const OPTIONAL_WRAPPER_TYPES = new Set(["default", "optional"]);
 const TRANSPARENT_WRAPPER_TYPES = new Set([
     ...OPTIONAL_WRAPPER_TYPES,
@@ -30,6 +31,9 @@ export class HostToolSchemaConversionError extends Error {
     }
 }
 function getSchemaDef(schema) {
+    if (!schema || typeof schema !== "object") {
+        return {};
+    }
     return (schema._def ??
         schema.def ??
         {});
@@ -131,7 +135,8 @@ function validateSchema(schema, path) {
         return;
     }
     if (typeName === "array") {
-        const itemSchema = getSchemaDef(schema).element;
+        const def = getSchemaDef(schema);
+        const itemSchema = (def.element ?? def.type);
         if (!itemSchema) {
             throw new HostToolSchemaConversionError(path, displayTypeName(typeName), "array schema is missing its item schema");
         }
@@ -163,8 +168,12 @@ function validateSchema(schema, path) {
         return;
     }
     if (typeName === "literal") {
-        const values = getSchemaDef(schema).values;
-        const literalValues = Array.isArray(values) ? values : [];
+        const def = getSchemaDef(schema);
+        const literalValues = Array.isArray(def.values)
+            ? def.values
+            : "value" in def
+                ? [def.value]
+                : [];
         const [literalValue] = literalValues;
         if (literalValues.length !== 1 ||
             !("string number boolean".split(" ").includes(typeof literalValue) || literalValue === null)) {
@@ -225,12 +234,23 @@ function findUnsupportedGeneratedKeyword(value, path) {
     }
     return null;
 }
+function generateJsonSchema(schema) {
+    const nativeJsonSchema = schema.toJSONSchema?.();
+    if (nativeJsonSchema) {
+        return nativeJsonSchema;
+    }
+    const generated = zodV3ToJsonSchema(schema, {
+        $refStrategy: "none",
+        target: "jsonSchema7",
+    });
+    if (!generated || (typeof generated === "object" && Object.keys(generated).length === 0)) {
+        throw new HostToolSchemaConversionError("$", displayTypeName(normalizeTypeName(schema)), "schema cannot be converted to JSON Schema");
+    }
+    return generated;
+}
 export function zodToJsonSchema(schema) {
     validateSchema(schema, "$");
-    const jsonSchema = schema.toJSONSchema?.();
-    if (!jsonSchema) {
-        throw new HostToolSchemaConversionError("$", displayTypeName(normalizeTypeName(schema)), "schema does not expose toJSONSchema()");
-    }
+    const jsonSchema = generateJsonSchema(schema);
     const unsupportedKeyword = findUnsupportedGeneratedKeyword(jsonSchema, "$");
     if (unsupportedKeyword) {
         throw new HostToolSchemaConversionError("$", displayTypeName(normalizeTypeName(schema)), `${unsupportedKeyword.keyword} emitted at ${unsupportedKeyword.path} is not supported`);

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { AGENT_CONFIGS } from "./agents.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { hostTool, MAX_TOOL_DESCRIPTION_LENGTH, toolKit, validateToolkits, } from "./host-tools.js";
+export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, hostToolSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, toolKitSchema, } from "./options-schema.js";
 export { createInMemoryLayerStore, createSnapshotExport, } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isAcpTimeoutErrorData, isUnknownSessionErrorData, } from "./json-rpc.js";

package/dist/index.js

@@ -4,6 +4,7 @@ export { AGENT_CONFIGS } from "./agents.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { hostTool, MAX_TOOL_DESCRIPTION_LENGTH, toolKit, validateToolkits, } from "./host-tools.js";
+export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, hostToolSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, toolKitSchema, } from "./options-schema.js";
 export { createInMemoryLayerStore, createSnapshotExport, } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isAcpTimeoutErrorData, isUnknownSessionErrorData, } from "./json-rpc.js";

package/dist/options-schema.d.ts

@@ -0,0 +1,438 @@
+import { z } from "zod/v4";
+import type { AgentOsOptions, AgentStderrHandler, LimitWarningHandler, NativeMountConfig } from "./agent-os.js";
+import type { HostTool, ToolKit } from "./host-tools.js";
+export declare const permissionsSchema: z.ZodObject<{
+    fs: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>, z.ZodObject<{
+        default: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>>;
+        rules: z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+    network: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>, z.ZodObject<{
+        default: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>>;
+        rules: z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+    childProcess: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>, z.ZodObject<{
+        default: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>>;
+        rules: z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+    process: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>, z.ZodObject<{
+        default: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>>;
+        rules: z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+    env: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>, z.ZodObject<{
+        default: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>>;
+        rules: z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+    tool: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>, z.ZodObject<{
+        default: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>>;
+        rules: z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>;
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+export declare const agentOsLimitsSchema: z.ZodObject<{
+    resources: z.ZodOptional<z.ZodObject<{
+        cpuCount: z.ZodOptional<z.ZodNumber>;
+        maxProcesses: z.ZodOptional<z.ZodNumber>;
+        maxOpenFds: z.ZodOptional<z.ZodNumber>;
+        maxPipes: z.ZodOptional<z.ZodNumber>;
+        maxPtys: z.ZodOptional<z.ZodNumber>;
+        maxSockets: z.ZodOptional<z.ZodNumber>;
+        maxConnections: z.ZodOptional<z.ZodNumber>;
+        maxSocketBufferedBytes: z.ZodOptional<z.ZodNumber>;
+        maxSocketDatagramQueueLen: z.ZodOptional<z.ZodNumber>;
+        maxFilesystemBytes: z.ZodOptional<z.ZodNumber>;
+        maxInodeCount: z.ZodOptional<z.ZodNumber>;
+        maxBlockingReadMs: z.ZodOptional<z.ZodNumber>;
+        maxPreadBytes: z.ZodOptional<z.ZodNumber>;
+        maxFdWriteBytes: z.ZodOptional<z.ZodNumber>;
+        maxProcessArgvBytes: z.ZodOptional<z.ZodNumber>;
+        maxProcessEnvBytes: z.ZodOptional<z.ZodNumber>;
+        maxReaddirEntries: z.ZodOptional<z.ZodNumber>;
+        maxWasmFuel: z.ZodOptional<z.ZodNumber>;
+        maxWasmMemoryBytes: z.ZodOptional<z.ZodNumber>;
+        maxWasmStackBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    http: z.ZodOptional<z.ZodObject<{
+        maxFetchResponseBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    tools: z.ZodOptional<z.ZodObject<{
+        defaultToolTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        maxToolTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        maxRegisteredToolkits: z.ZodOptional<z.ZodNumber>;
+        maxRegisteredToolsPerVm: z.ZodOptional<z.ZodNumber>;
+        maxToolsPerToolkit: z.ZodOptional<z.ZodNumber>;
+        maxToolSchemaBytes: z.ZodOptional<z.ZodNumber>;
+        maxToolExamplesPerTool: z.ZodOptional<z.ZodNumber>;
+        maxToolExampleInputBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    plugins: z.ZodOptional<z.ZodObject<{
+        maxPersistedManifestBytes: z.ZodOptional<z.ZodNumber>;
+        maxPersistedManifestFileBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    acp: z.ZodOptional<z.ZodObject<{
+        maxReadLineBytes: z.ZodOptional<z.ZodNumber>;
+        stdoutBufferByteLimit: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    jsRuntime: z.ZodOptional<z.ZodObject<{
+        v8HeapLimitMb: z.ZodOptional<z.ZodNumber>;
+        capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
+        stdinBufferLimitBytes: z.ZodOptional<z.ZodNumber>;
+        eventPayloadLimitBytes: z.ZodOptional<z.ZodNumber>;
+        v8IpcMaxFrameBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    python: z.ZodOptional<z.ZodObject<{
+        outputBufferMaxBytes: z.ZodOptional<z.ZodNumber>;
+        executionTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        vfsRpcTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    wasm: z.ZodOptional<z.ZodObject<{
+        maxModuleFileBytes: z.ZodOptional<z.ZodNumber>;
+        capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
+        syncReadLimitBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const rootFilesystemConfigSchema: z.ZodObject<{
+    type: z.ZodOptional<z.ZodLiteral<"overlay">>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        ephemeral: "ephemeral";
+        "read-only": "read-only";
+    }>>;
+    disableDefaultBaseLayer: z.ZodOptional<z.ZodBoolean>;
+    lowers: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"bundled-base-filesystem">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"snapshot-export">;
+        source: z.ZodUnknown;
+    }, z.core.$strict>]>>>;
+}, z.core.$strict>;
+export declare const nativeMountConfigSchema: z.ZodType<NativeMountConfig>;
+export declare const mountConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
+    path: z.ZodString;
+    driver: z.ZodCustom<unknown, unknown>;
+    readOnly: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodType<NativeMountConfig, unknown, z.core.$ZodTypeInternals<NativeMountConfig, unknown>>, z.ZodObject<{
+    path: z.ZodString;
+    filesystem: z.ZodObject<{
+        type: z.ZodLiteral<"overlay">;
+        store: z.ZodUnknown;
+        mode: z.ZodOptional<z.ZodEnum<{
+            ephemeral: "ephemeral";
+            "read-only": "read-only";
+        }>>;
+        lowers: z.ZodArray<z.ZodUnknown>;
+    }, z.core.$strict>;
+}, z.core.$strict>]>;
+export declare const sharedSidecarConfigSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"shared">;
+    pool: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const sidecarConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"shared">;
+    pool: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"explicit">;
+    handle: z.ZodUnknown;
+}, z.core.$strict>]>;
+export declare const hostToolSchema: z.ZodType<HostTool>;
+export declare const toolKitSchema: z.ZodType<ToolKit>;
+/**
+ * Shared AgentOsOptions field schemas.
+ *
+ * Core uses the full object. The Rivet/native actor composes a narrower
+ * native-safe subset in `packages/agentos/src/config.ts`; keep that subset and
+ * `crates/agentos-actor-plugin/src/config.rs::AgentOsConfigJson` aligned when
+ * adding options that cross the native boundary.
+ */
+export declare const agentOsOptionFieldSchemas: {
+    readonly software: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    readonly defaultSoftware: z.ZodOptional<z.ZodBoolean>;
+    readonly loopbackExemptPorts: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    readonly allowedNodeBuiltins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    readonly rootFilesystem: z.ZodOptional<z.ZodObject<{
+        type: z.ZodOptional<z.ZodLiteral<"overlay">>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            ephemeral: "ephemeral";
+            "read-only": "read-only";
+        }>>;
+        disableDefaultBaseLayer: z.ZodOptional<z.ZodBoolean>;
+        lowers: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"bundled-base-filesystem">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"snapshot-export">;
+            source: z.ZodUnknown;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
+    readonly mounts: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodString;
+        driver: z.ZodCustom<unknown, unknown>;
+        readOnly: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodType<NativeMountConfig, unknown, z.core.$ZodTypeInternals<NativeMountConfig, unknown>>, z.ZodObject<{
+        path: z.ZodString;
+        filesystem: z.ZodObject<{
+            type: z.ZodLiteral<"overlay">;
+            store: z.ZodUnknown;
+            mode: z.ZodOptional<z.ZodEnum<{
+                ephemeral: "ephemeral";
+                "read-only": "read-only";
+            }>>;
+            lowers: z.ZodArray<z.ZodUnknown>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>>;
+    readonly moduleAccessCwd: z.ZodOptional<z.ZodString>;
+    readonly additionalInstructions: z.ZodOptional<z.ZodString>;
+    readonly scheduleDriver: z.ZodOptional<z.ZodCustom<unknown, unknown>>;
+    readonly toolKits: z.ZodOptional<z.ZodArray<z.ZodType<ToolKit, unknown, z.core.$ZodTypeInternals<ToolKit, unknown>>>>;
+    readonly permissions: z.ZodOptional<z.ZodObject<{
+        fs: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>, z.ZodObject<{
+            default: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>;
+            rules: z.ZodArray<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    allow: "allow";
+                    deny: "deny";
+                }>;
+                operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>]>>;
+        network: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>, z.ZodObject<{
+            default: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>;
+            rules: z.ZodArray<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    allow: "allow";
+                    deny: "deny";
+                }>;
+                operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>]>>;
+        childProcess: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>, z.ZodObject<{
+            default: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>;
+            rules: z.ZodArray<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    allow: "allow";
+                    deny: "deny";
+                }>;
+                operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>]>>;
+        process: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>, z.ZodObject<{
+            default: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>;
+            rules: z.ZodArray<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    allow: "allow";
+                    deny: "deny";
+                }>;
+                operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>]>>;
+        env: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>, z.ZodObject<{
+            default: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>;
+            rules: z.ZodArray<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    allow: "allow";
+                    deny: "deny";
+                }>;
+                operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>]>>;
+        tool: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>, z.ZodObject<{
+            default: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>;
+            rules: z.ZodArray<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    allow: "allow";
+                    deny: "deny";
+                }>;
+                operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>>;
+    readonly sidecar: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"shared">;
+        pool: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"explicit">;
+        handle: z.ZodUnknown;
+    }, z.core.$strict>]>>;
+    readonly limits: z.ZodOptional<z.ZodObject<{
+        resources: z.ZodOptional<z.ZodObject<{
+            cpuCount: z.ZodOptional<z.ZodNumber>;
+            maxProcesses: z.ZodOptional<z.ZodNumber>;
+            maxOpenFds: z.ZodOptional<z.ZodNumber>;
+            maxPipes: z.ZodOptional<z.ZodNumber>;
+            maxPtys: z.ZodOptional<z.ZodNumber>;
+            maxSockets: z.ZodOptional<z.ZodNumber>;
+            maxConnections: z.ZodOptional<z.ZodNumber>;
+            maxSocketBufferedBytes: z.ZodOptional<z.ZodNumber>;
+            maxSocketDatagramQueueLen: z.ZodOptional<z.ZodNumber>;
+            maxFilesystemBytes: z.ZodOptional<z.ZodNumber>;
+            maxInodeCount: z.ZodOptional<z.ZodNumber>;
+            maxBlockingReadMs: z.ZodOptional<z.ZodNumber>;
+            maxPreadBytes: z.ZodOptional<z.ZodNumber>;
+            maxFdWriteBytes: z.ZodOptional<z.ZodNumber>;
+            maxProcessArgvBytes: z.ZodOptional<z.ZodNumber>;
+            maxProcessEnvBytes: z.ZodOptional<z.ZodNumber>;
+            maxReaddirEntries: z.ZodOptional<z.ZodNumber>;
+            maxWasmFuel: z.ZodOptional<z.ZodNumber>;
+            maxWasmMemoryBytes: z.ZodOptional<z.ZodNumber>;
+            maxWasmStackBytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        http: z.ZodOptional<z.ZodObject<{
+            maxFetchResponseBytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        tools: z.ZodOptional<z.ZodObject<{
+            defaultToolTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            maxToolTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            maxRegisteredToolkits: z.ZodOptional<z.ZodNumber>;
+            maxRegisteredToolsPerVm: z.ZodOptional<z.ZodNumber>;
+            maxToolsPerToolkit: z.ZodOptional<z.ZodNumber>;
+            maxToolSchemaBytes: z.ZodOptional<z.ZodNumber>;
+            maxToolExamplesPerTool: z.ZodOptional<z.ZodNumber>;
+            maxToolExampleInputBytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        plugins: z.ZodOptional<z.ZodObject<{
+            maxPersistedManifestBytes: z.ZodOptional<z.ZodNumber>;
+            maxPersistedManifestFileBytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        acp: z.ZodOptional<z.ZodObject<{
+            maxReadLineBytes: z.ZodOptional<z.ZodNumber>;
+            stdoutBufferByteLimit: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        jsRuntime: z.ZodOptional<z.ZodObject<{
+            v8HeapLimitMb: z.ZodOptional<z.ZodNumber>;
+            capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
+            stdinBufferLimitBytes: z.ZodOptional<z.ZodNumber>;
+            eventPayloadLimitBytes: z.ZodOptional<z.ZodNumber>;
+            v8IpcMaxFrameBytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        python: z.ZodOptional<z.ZodObject<{
+            outputBufferMaxBytes: z.ZodOptional<z.ZodNumber>;
+            executionTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            vfsRpcTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        wasm: z.ZodOptional<z.ZodObject<{
+            maxModuleFileBytes: z.ZodOptional<z.ZodNumber>;
+            capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
+            syncReadLimitBytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    readonly onAgentStderr: z.ZodOptional<z.ZodCustom<AgentStderrHandler, AgentStderrHandler>>;
+    readonly onLimitWarning: z.ZodOptional<z.ZodCustom<LimitWarningHandler, LimitWarningHandler>>;
+};
+export declare const agentOsOptionsSchema: z.ZodType<AgentOsOptions>;
+export declare function parseAgentOsOptions(options?: AgentOsOptions): AgentOsOptions;

package/dist/options-schema.js

@@ -0,0 +1,260 @@
+import { z } from "zod/v4";
+const stringArray = z.array(z.string());
+const nonNegativeInteger = z.number().int().nonnegative();
+const positiveInteger = z.number().int().positive();
+const functionSchema = z.custom((value) => typeof value === "function", { message: "Expected function" });
+const permissionModeSchema = z.enum(["allow", "deny"]);
+const fsPermissionRuleSchema = z
+    .object({
+    mode: permissionModeSchema,
+    operations: stringArray.optional(),
+    paths: stringArray.optional(),
+})
+    .strict();
+const patternPermissionRuleSchema = z
+    .object({
+    mode: permissionModeSchema,
+    operations: stringArray.optional(),
+    patterns: stringArray.optional(),
+})
+    .strict();
+const fsRulePermissionsSchema = z
+    .object({
+    default: permissionModeSchema.optional(),
+    rules: z.array(fsPermissionRuleSchema),
+})
+    .strict();
+const patternRulePermissionsSchema = z
+    .object({
+    default: permissionModeSchema.optional(),
+    rules: z.array(patternPermissionRuleSchema),
+})
+    .strict();
+const fsPermissionsSchema = z.union([permissionModeSchema, fsRulePermissionsSchema]);
+const patternPermissionsSchema = z.union([
+    permissionModeSchema,
+    patternRulePermissionsSchema,
+]);
+export const permissionsSchema = z
+    .object({
+    fs: fsPermissionsSchema.optional(),
+    network: patternPermissionsSchema.optional(),
+    childProcess: patternPermissionsSchema.optional(),
+    process: patternPermissionsSchema.optional(),
+    env: patternPermissionsSchema.optional(),
+    tool: patternPermissionsSchema.optional(),
+})
+    .strict();
+export const agentOsLimitsSchema = z
+    .object({
+    resources: z
+        .object({
+        cpuCount: positiveInteger.optional(),
+        maxProcesses: nonNegativeInteger.optional(),
+        maxOpenFds: nonNegativeInteger.optional(),
+        maxPipes: nonNegativeInteger.optional(),
+        maxPtys: nonNegativeInteger.optional(),
+        maxSockets: nonNegativeInteger.optional(),
+        maxConnections: nonNegativeInteger.optional(),
+        maxSocketBufferedBytes: nonNegativeInteger.optional(),
+        maxSocketDatagramQueueLen: nonNegativeInteger.optional(),
+        maxFilesystemBytes: nonNegativeInteger.optional(),
+        maxInodeCount: nonNegativeInteger.optional(),
+        maxBlockingReadMs: nonNegativeInteger.optional(),
+        maxPreadBytes: nonNegativeInteger.optional(),
+        maxFdWriteBytes: nonNegativeInteger.optional(),
+        maxProcessArgvBytes: nonNegativeInteger.optional(),
+        maxProcessEnvBytes: nonNegativeInteger.optional(),
+        maxReaddirEntries: nonNegativeInteger.optional(),
+        maxWasmFuel: nonNegativeInteger.optional(),
+        maxWasmMemoryBytes: nonNegativeInteger.optional(),
+        maxWasmStackBytes: nonNegativeInteger.optional(),
+    })
+        .strict()
+        .optional(),
+    http: z
+        .object({ maxFetchResponseBytes: nonNegativeInteger.optional() })
+        .strict()
+        .optional(),
+    tools: z
+        .object({
+        defaultToolTimeoutMs: nonNegativeInteger.optional(),
+        maxToolTimeoutMs: nonNegativeInteger.optional(),
+        maxRegisteredToolkits: nonNegativeInteger.optional(),
+        maxRegisteredToolsPerVm: nonNegativeInteger.optional(),
+        maxToolsPerToolkit: nonNegativeInteger.optional(),
+        maxToolSchemaBytes: nonNegativeInteger.optional(),
+        maxToolExamplesPerTool: nonNegativeInteger.optional(),
+        maxToolExampleInputBytes: nonNegativeInteger.optional(),
+    })
+        .strict()
+        .optional(),
+    plugins: z
+        .object({
+        maxPersistedManifestBytes: nonNegativeInteger.optional(),
+        maxPersistedManifestFileBytes: nonNegativeInteger.optional(),
+    })
+        .strict()
+        .optional(),
+    acp: z
+        .object({
+        maxReadLineBytes: nonNegativeInteger.optional(),
+        stdoutBufferByteLimit: nonNegativeInteger.optional(),
+    })
+        .strict()
+        .optional(),
+    jsRuntime: z
+        .object({
+        v8HeapLimitMb: nonNegativeInteger.optional(),
+        capturedOutputLimitBytes: nonNegativeInteger.optional(),
+        stdinBufferLimitBytes: nonNegativeInteger.optional(),
+        eventPayloadLimitBytes: nonNegativeInteger.optional(),
+        v8IpcMaxFrameBytes: nonNegativeInteger.optional(),
+    })
+        .strict()
+        .optional(),
+    python: z
+        .object({
+        outputBufferMaxBytes: nonNegativeInteger.optional(),
+        executionTimeoutMs: nonNegativeInteger.optional(),
+        vfsRpcTimeoutMs: nonNegativeInteger.optional(),
+    })
+        .strict()
+        .optional(),
+    wasm: z
+        .object({
+        maxModuleFileBytes: nonNegativeInteger.optional(),
+        capturedOutputLimitBytes: nonNegativeInteger.optional(),
+        syncReadLimitBytes: nonNegativeInteger.optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const rootLowerInputSchema = z.union([
+    z.object({ kind: z.literal("bundled-base-filesystem") }).strict(),
+    z.object({ kind: z.literal("snapshot-export"), source: z.unknown() }).strict(),
+]);
+export const rootFilesystemConfigSchema = z
+    .object({
+    type: z.literal("overlay").optional(),
+    mode: z.enum(["ephemeral", "read-only"]).optional(),
+    disableDefaultBaseLayer: z.boolean().optional(),
+    lowers: z.array(rootLowerInputSchema).optional(),
+})
+    .strict();
+const nativeMountPluginSchema = z
+    .object({
+    id: z.string(),
+    config: z.unknown().optional(),
+})
+    .strict();
+const plainMountConfigSchema = z
+    .object({
+    path: z.string(),
+    driver: z.custom((value) => typeof value === "object" && value !== null, {
+        message: "Expected filesystem driver object",
+    }),
+    readOnly: z.boolean().optional(),
+})
+    .strict();
+export const nativeMountConfigSchema = z
+    .object({
+    path: z.string(),
+    plugin: nativeMountPluginSchema,
+    readOnly: z.boolean().optional(),
+})
+    .strict();
+const overlayMountConfigSchema = z
+    .object({
+    path: z.string(),
+    filesystem: z
+        .object({
+        type: z.literal("overlay"),
+        store: z.unknown(),
+        mode: z.enum(["ephemeral", "read-only"]).optional(),
+        lowers: z.array(z.unknown()),
+    })
+        .strict(),
+})
+    .strict();
+export const mountConfigSchema = z.union([
+    plainMountConfigSchema,
+    nativeMountConfigSchema,
+    overlayMountConfigSchema,
+]);
+export const sharedSidecarConfigSchema = z
+    .object({
+    kind: z.literal("shared"),
+    pool: z.string().optional(),
+})
+    .strict();
+const explicitSidecarSchema = z
+    .object({
+    kind: z.literal("explicit"),
+    handle: z.unknown(),
+})
+    .strict();
+export const sidecarConfigSchema = z.union([
+    sharedSidecarConfigSchema,
+    explicitSidecarSchema,
+]);
+const toolExampleSchema = z
+    .object({
+    description: z.string(),
+    input: z.unknown(),
+})
+    .strict();
+export const hostToolSchema = z
+    .object({
+    description: z.string(),
+    inputSchema: z.custom((value) => typeof value === "object" && value !== null, {
+        message: "Expected Zod schema object",
+    }),
+    execute: functionSchema,
+    examples: z.array(toolExampleSchema).optional(),
+    timeout: nonNegativeInteger.optional(),
+})
+    .strict();
+export const toolKitSchema = z
+    .object({
+    name: z.string(),
+    description: z.string(),
+    tools: z.record(z.string(), hostToolSchema),
+})
+    .strict();
+/**
+ * Shared AgentOsOptions field schemas.
+ *
+ * Core uses the full object. The Rivet/native actor composes a narrower
+ * native-safe subset in `packages/agentos/src/config.ts`; keep that subset and
+ * `crates/agentos-actor-plugin/src/config.rs::AgentOsConfigJson` aligned when
+ * adding options that cross the native boundary.
+ */
+export const agentOsOptionFieldSchemas = {
+    software: z.array(z.unknown()).optional(),
+    defaultSoftware: z.boolean().optional(),
+    loopbackExemptPorts: z.array(z.number().int().min(0).max(65535)).optional(),
+    allowedNodeBuiltins: stringArray.optional(),
+    rootFilesystem: rootFilesystemConfigSchema.optional(),
+    mounts: z.array(mountConfigSchema).optional(),
+    moduleAccessCwd: z.string().optional(),
+    additionalInstructions: z.string().optional(),
+    scheduleDriver: z
+        .custom((value) => typeof value === "object" && value !== null, {
+        message: "Expected schedule driver object",
+    })
+        .optional(),
+    toolKits: z.array(toolKitSchema).optional(),
+    permissions: permissionsSchema.optional(),
+    sidecar: sidecarConfigSchema.optional(),
+    limits: agentOsLimitsSchema.optional(),
+    onAgentStderr: z.custom((value) => typeof value === "function", { message: "Expected function" }).optional(),
+    onLimitWarning: z.custom((value) => typeof value === "function", { message: "Expected function" }).optional(),
+};
+export const agentOsOptionsSchema = z
+    .object(agentOsOptionFieldSchemas)
+    .strict();
+export function parseAgentOsOptions(options) {
+    return agentOsOptionsSchema.parse(options ?? {});
+}

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export type { AgentCapabilities, AgentInfo, AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentStderrEvent, AgentStderrHandler, AgentRegistryEntry, BatchReadResult, BatchWriteEntry, BatchWriteResult, CreateSessionOptions, DirEntry, McpServerConfig, McpServerConfigLocal, McpServerConfigRemote, MountConfig, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountConfig, NativeMountPluginDescriptor, OverlayMountConfig, PermissionReply, PermissionRequest, PermissionRequestHandler, PlainMountConfig, ProcessTreeNode, PromptResult, ReaddirRecursiveOptions, ResumeSessionOptions, ResumeSessionResult, RootFilesystemConfig, RootLowerInput, SessionConfigOption, SessionEventHandler, SessionInfo, SessionInitData, SessionMode, SessionModeState, SpawnedProcessInfo, } from "./agent-os.js";
+export type { AgentCapabilities, AgentInfo, AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentStderrEvent, AgentStderrHandler, AgentRegistryEntry, BatchReadResult, BatchWriteEntry, BatchWriteResult, CreateSessionOptions, DirEntry, LimitWarning, LimitWarningHandler, McpServerConfig, McpServerConfigLocal, McpServerConfigRemote, MountConfig, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountConfig, NativeMountPluginDescriptor, OverlayMountConfig, PermissionReply, PermissionRequest, PermissionRequestHandler, PlainMountConfig, ProcessTreeNode, PromptResult, ReaddirRecursiveOptions, ResumeSessionOptions, ResumeSessionResult, RootFilesystemConfig, RootLowerInput, SessionConfigOption, SessionEventHandler, SessionInfo, SessionInitData, SessionMode, SessionModeState, SpawnedProcessInfo, } from "./agent-os.js";
 export type { AgentConfig, AgentType } from "./agents.js";
 export type { CronAction, CronEvent, CronEventHandler, CronJob, CronJobInfo, CronJobOptions, ScheduleDriver, ScheduleEntry, ScheduleHandle, } from "./cron/index.js";
 export type { HostDirBackendOptions, HostDirMountPluginConfig, NodeModulesMountConfig, } from "./host-dir-mount.js";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rivet-dev/agentos-core",
-	"version": "0.0.0-codex-agentos-native-platform-e2e.78ef941",
+	"version": "0.0.0-feat-on-limit-warning.62a2bc2",
 	"type": "module",
 	"license": "Apache-2.0",
 	"main": "./dist/index.js",
@@ -56,16 +56,18 @@
 	"dependencies": {
 		"@agentos-software/common": "0.3.0-rc.2",
 		"@aws-sdk/client-s3": "^3.1019.0",
-		"@rivet-dev/agentos-sidecar": "0.0.0-codex-agentos-native-platform-e2e.78ef941",
+		"@rivet-dev/agentos-sidecar": "0.0.0-feat-on-limit-warning.62a2bc2",
 		"@rivetkit/bare-ts": "^0.6.2",
-		"@secure-exec/core": "0.0.0-nathan-workspace-binding-agentos.83db3e3",
+		"@secure-exec/core": "0.0.0-fix-queue-backpressure-and-tracker.f7cc68e",
 		"@xterm/headless": "^6.0.0",
 		"better-sqlite3": "^12.8.0",
 		"croner": "^10.0.1",
 		"googleapis": "^144.0.0",
 		"isolated-vm": "^6.0.0",
 		"long-timeout": "^0.1.1",
-		"minimatch": "^10.2.4"
+		"minimatch": "^10.2.4",
+		"zod": "^4.1.11",
+		"zod-to-json-schema": "^3.25.2"
 	},
 	"devDependencies": {
 		"@anthropic-ai/claude-agent-sdk": "^0.2.87",
@@ -77,8 +79,8 @@
 		"@copilotkit/llmock": "^1.6.0",
 		"@rivet-dev/agentos-sandbox": "link:../agentos-sandbox",
 		"@agentos-software/git": "0.3.0-rc.2",
-		"@secure-exec/google-drive": "0.0.0-nathan-workspace-binding-agentos.83db3e3",
-		"@secure-exec/s3": "0.0.0-nathan-workspace-binding-agentos.83db3e3",
+		"@secure-exec/google-drive": "0.0.0-fix-queue-backpressure-and-tracker.f7cc68e",
+		"@secure-exec/s3": "0.0.0-fix-queue-backpressure-and-tracker.f7cc68e",
 		"@mariozechner/pi-coding-agent": "^0.60.0",
 		"@agentos-software/claude-code": "0.0.0-nathan-binding-workspace.9be0a88",
 		"@agentos-software/codex-cli": "0.3.0-rc.2",
@@ -107,6 +109,6 @@
 		"typescript": "^5.7.2",
 		"vitest": "^2.1.8",
 		"ws": "^8.18.0",
-		"zod": "^4.1.11"
+		"zod3": "npm:zod@^3.25.76"
 	}
 }