@rivet-dev/agentos-core 0.0.0-feat-on-limit-warning.62a2bc2 → 0.0.0-main.ab2ce7c

package/dist/generated/RootFilesystemConfig.d.ts

@@ -0,0 +1,9 @@
+import type { RootFilesystemEntry } from "./RootFilesystemEntry.js";
+import type { RootFilesystemLowerDescriptor } from "./RootFilesystemLowerDescriptor.js";
+import type { RootFilesystemMode } from "./RootFilesystemMode.js";
+export type RootFilesystemConfig = {
+    mode: RootFilesystemMode;
+    disableDefaultBaseLayer: boolean;
+    lowers: Array<RootFilesystemLowerDescriptor>;
+    bootstrapEntries: Array<RootFilesystemEntry>;
+};

package/dist/generated/RootFilesystemConfig.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/RootFilesystemEntry.d.ts

@@ -0,0 +1,13 @@
+import type { RootFilesystemEntryEncoding } from "./RootFilesystemEntryEncoding.js";
+import type { RootFilesystemEntryKind } from "./RootFilesystemEntryKind.js";
+export type RootFilesystemEntry = {
+    path: string;
+    kind: RootFilesystemEntryKind;
+    mode?: number;
+    uid?: number;
+    gid?: number;
+    content?: string;
+    encoding?: RootFilesystemEntryEncoding;
+    target?: string;
+    executable: boolean;
+};

package/dist/generated/RootFilesystemEntry.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/RootFilesystemEntryEncoding.d.ts

@@ -0,0 +1 @@
+export type RootFilesystemEntryEncoding = "utf8" | "base64";

package/dist/generated/RootFilesystemEntryEncoding.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/RootFilesystemEntryKind.d.ts

@@ -0,0 +1 @@
+export type RootFilesystemEntryKind = "file" | "directory" | "symlink";

package/dist/generated/RootFilesystemEntryKind.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/RootFilesystemLowerDescriptor.d.ts

@@ -0,0 +1,7 @@
+import type { RootFilesystemEntry } from "./RootFilesystemEntry.js";
+export type RootFilesystemLowerDescriptor = {
+    "kind": "snapshot";
+    entries: Array<RootFilesystemEntry>;
+} | {
+    "kind": "bundledBaseFilesystem";
+};

package/dist/generated/RootFilesystemLowerDescriptor.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/RootFilesystemMode.d.ts

@@ -0,0 +1 @@
+export type RootFilesystemMode = "ephemeral" | "read-only";

package/dist/generated/RootFilesystemMode.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/ToolLimitsConfig.d.ts

@@ -0,0 +1,10 @@
+export type ToolLimitsConfig = {
+    defaultToolTimeoutMs?: number;
+    maxToolTimeoutMs?: number;
+    maxRegisteredToolkits?: number;
+    maxRegisteredToolsPerVm?: number;
+    maxToolsPerToolkit?: number;
+    maxToolSchemaBytes?: number;
+    maxToolExamplesPerTool?: number;
+    maxToolExampleInputBytes?: number;
+};

package/dist/generated/ToolLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/VmDnsConfig.d.ts

@@ -0,0 +1,6 @@
+export type VmDnsConfig = {
+    nameServers: Array<string>;
+    overrides: {
+        [key in string]?: Array<string>;
+    };
+};

package/dist/generated/VmDnsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/VmLimitsConfig.d.ts

@@ -0,0 +1,18 @@
+import type { AcpLimitsConfig } from "./AcpLimitsConfig.js";
+import type { HttpLimitsConfig } from "./HttpLimitsConfig.js";
+import type { JsRuntimeLimitsConfig } from "./JsRuntimeLimitsConfig.js";
+import type { PluginLimitsConfig } from "./PluginLimitsConfig.js";
+import type { PythonLimitsConfig } from "./PythonLimitsConfig.js";
+import type { ResourceLimitsConfig } from "./ResourceLimitsConfig.js";
+import type { ToolLimitsConfig } from "./ToolLimitsConfig.js";
+import type { WasmLimitsConfig } from "./WasmLimitsConfig.js";
+export type VmLimitsConfig = {
+    resources?: ResourceLimitsConfig;
+    http?: HttpLimitsConfig;
+    tools?: ToolLimitsConfig;
+    plugins?: PluginLimitsConfig;
+    acp?: AcpLimitsConfig;
+    jsRuntime?: JsRuntimeLimitsConfig;
+    python?: PythonLimitsConfig;
+    wasm?: WasmLimitsConfig;
+};

package/dist/generated/VmLimitsConfig.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/VmListenPolicyConfig.d.ts

@@ -0,0 +1,5 @@
+export type VmListenPolicyConfig = {
+    portMin?: number;
+    portMax?: number;
+    allowPrivileged?: boolean;
+};

package/dist/generated/VmListenPolicyConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/WasmLimitsConfig.d.ts

@@ -0,0 +1,7 @@
+export type WasmLimitsConfig = {
+    maxModuleFileBytes?: number;
+    capturedOutputLimitBytes?: number;
+    syncReadLimitBytes?: number;
+    prewarmTimeoutMs?: number;
+    runnerHeapLimitMb?: number;
+};

package/dist/generated/WasmLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/host-dir-mount.d.ts

@@ -1,4 +1,4 @@
-import type { MountConfigJsonObject, NativeMountPluginDescriptor } from "@secure-exec/core/descriptors";
+import type { MountConfigJsonObject, NativeMountPluginDescriptor } from "@rivet-dev/agentos-runtime-core/descriptors";
 export interface HostDirBackendOptions {
     /** Absolute path to the host directory to project into the VM. */
     hostPath: string;

package/dist/host-tools.js

@@ -8,16 +8,25 @@ export function hostTool(def) {
 export function toolKit(def) {
     return def;
 }
+const TOOLKIT_COMMAND_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function validateToolCommandName(kind, name) {
+    if (TOOLKIT_COMMAND_NAME_RE.test(name)) {
+        return;
+    }
+    throw new Error(`${kind} name "${name}" must be lowercase alphanumeric with optional single hyphen separators`);
+}
 /**
  * Validate all description lengths in the given toolkits.
  * Throws if any toolkit or tool description exceeds MAX_TOOL_DESCRIPTION_LENGTH.
  */
 export function validateToolkits(toolKits) {
     for (const tk of toolKits) {
+        validateToolCommandName("Toolkit", tk.name);
         if (tk.description.length > MAX_TOOL_DESCRIPTION_LENGTH) {
             throw new Error(`Toolkit "${tk.name}" description is ${tk.description.length} characters, max is ${MAX_TOOL_DESCRIPTION_LENGTH}`);
         }
         for (const [toolName, tool] of Object.entries(tk.tools)) {
+            validateToolCommandName("Tool", toolName);
             if (tool.description.length > MAX_TOOL_DESCRIPTION_LENGTH) {
                 throw new Error(`Tool "${tk.name}/${toolName}" description is ${tool.description.length} characters, max is ${MAX_TOOL_DESCRIPTION_LENGTH}`);
             }

package/dist/index.d.ts

@@ -1,11 +1,12 @@
 export { AgentOs, AgentOsSidecar } from "./agent-os.js";
-export { AGENT_CONFIGS } from "./agents.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { hostTool, MAX_TOOL_DESCRIPTION_LENGTH, toolKit, validateToolkits, } from "./host-tools.js";
 export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, hostToolSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, toolKitSchema, } from "./options-schema.js";
 export { createInMemoryLayerStore, createSnapshotExport, } from "./layers.js";
 export { defineSoftware } from "./packages.js";
+export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { isAcpTimeoutErrorData, isUnknownSessionErrorData, } from "./json-rpc.js";
 export { createInMemoryFileSystem, KernelError } from "./runtime-compat.js";
+export type { ExecOptions, ExecResult, ManagedProcess, ProcessInfo, ShellHandle, VirtualDirEntry, VirtualStat, } from "./runtime.js";
 export type * from "./types.js";

package/dist/index.js

@@ -1,11 +1,11 @@
 // @rivet-dev/agentos
 export { AgentOs, AgentOsSidecar } from "./agent-os.js";
-export { AGENT_CONFIGS } from "./agents.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { hostTool, MAX_TOOL_DESCRIPTION_LENGTH, toolKit, validateToolkits, } from "./host-tools.js";
 export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, hostToolSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, toolKitSchema, } from "./options-schema.js";
 export { createInMemoryLayerStore, createSnapshotExport, } from "./layers.js";
 export { defineSoftware } from "./packages.js";
+export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { isAcpTimeoutErrorData, isUnknownSessionErrorData, } from "./json-rpc.js";
 export { createInMemoryFileSystem, KernelError } from "./runtime-compat.js";

package/dist/layers.d.ts

@@ -1,4 +1,4 @@
-import { type BaseFilesystemSnapshot } from "./base-filesystem.js";
+import type { BaseFilesystemSnapshot } from "./base-filesystem.js";
 import { type FilesystemEntry } from "./filesystem-snapshot.js";
 import type { VirtualFileSystem } from "./runtime-compat.js";
 export type OverlayFilesystemMode = "ephemeral" | "read-only";
@@ -45,7 +45,7 @@ export interface LayerStore {
         mode: "read-only";
         lowers: SnapshotLayerHandle[];
     }): VirtualFileSystem;
+    dispose(): void;
 }
 export declare function createSnapshotExport(entries: FilesystemEntry[]): RootSnapshotExport;
 export declare function createInMemoryLayerStore(): LayerStore;
-export declare function createDefaultRootLowerInput(): SnapshotImportSource;

package/dist/layers.js

@@ -1,5 +1,4 @@
 import { randomUUID } from "node:crypto";
-import { getBaseFilesystemSnapshot, } from "./base-filesystem.js";
 import { createFilesystemFromEntries, snapshotVirtualFilesystem, } from "./filesystem-snapshot.js";
 import { createOverlayBackend } from "./overlay-filesystem.js";
 function cloneSnapshotHandle(storeId, layerId) {
@@ -73,8 +72,11 @@ export function createInMemoryLayerStore() {
         }
         return state;
     }
-    return {
+    const store = {
         storeId,
+        get retainedLayerCount() {
+            return layers.size;
+        },
         async createWritableLayer() {
             const layerId = randomUUID();
             const leaseId = randomUUID();
@@ -117,10 +119,11 @@ export function createInMemoryLayerStore() {
             if (state.kind !== "writable") {
                 throw new Error(`Layer ${layer.layerId} is not writable`);
             }
-            if (!state.valid || state.leaseId !== layer.leaseId) {
+            const baseFs = state.activeOverlay ?? state.fs;
+            if (!state.valid || state.leaseId !== layer.leaseId || !baseFs) {
                 throw new Error(`Writable layer ${layer.layerId} is no longer valid`);
             }
-            const entries = await snapshotVirtualFilesystem(state.activeOverlay ?? state.fs);
+            const entries = await snapshotVirtualFilesystem(baseFs);
             const snapshot = createSnapshotExport(entries).source;
             const layerId = randomUUID();
             layers.set(layerId, {
@@ -128,8 +131,11 @@ export function createInMemoryLayerStore() {
                 snapshot,
                 fs: await createFilesystemFromEntries(snapshot.filesystem.entries),
             });
+            // Release the writable layer's filesystem payload now that it is sealed;
+            // the invalid tombstone is retained so stale handles still report cleanly.
             state.valid = false;
             state.activeOverlay = null;
+            state.fs = null;
             return cloneSnapshotHandle(storeId, layerId);
         },
         createOverlayFilesystem(options) {
@@ -162,6 +168,9 @@ export function createInMemoryLayerStore() {
             if (upperState.activeOverlay) {
                 throw new Error(`Writable layer ${options.upper.layerId} is already attached to an overlay`);
             }
+            if (!upperState.fs) {
+                throw new Error(`Writable layer ${options.upper.layerId} is no longer valid`);
+            }
             const overlay = createOverlayBackend({
                 upper: upperState.fs,
                 lowers: lowers.map((lower) => {
@@ -175,11 +184,11 @@ export function createInMemoryLayerStore() {
             upperState.activeOverlay = overlay;
             return overlay;
         },
+        dispose() {
+            // Release every retained layer's filesystem payload so the store does
+            // not accumulate snapshots/writable layers for the process lifetime.
+            layers.clear();
+        },
     };
-}
-export function createDefaultRootLowerInput() {
-    return {
-        kind: "base-filesystem-artifact",
-        source: getBaseFilesystemSnapshot(),
-    };
+    return store;
 }

package/dist/options-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod/v4";
-import type { AgentOsOptions, AgentStderrHandler, LimitWarningHandler, NativeMountConfig } from "./agent-os.js";
+import type { AgentExitHandler, AgentOsOptions, AgentStderrHandler, LimitWarningHandler, NativeMountConfig } from "./agent-os.js";
 import type { HostTool, ToolKit } from "./host-tools.js";
 export declare const permissionsSchema: z.ZodObject<{
     fs: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
@@ -87,7 +87,7 @@ export declare const permissionsSchema: z.ZodObject<{
             patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
     }, z.core.$strict>]>>;
-    tool: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+    binding: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
         allow: "allow";
         deny: "deny";
     }>, z.ZodObject<{
@@ -151,6 +151,10 @@ export declare const agentOsLimitsSchema: z.ZodObject<{
     }, z.core.$strict>>;
     jsRuntime: z.ZodOptional<z.ZodObject<{
         v8HeapLimitMb: z.ZodOptional<z.ZodNumber>;
+        syncRpcWaitTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        cpuTimeLimitMs: z.ZodOptional<z.ZodNumber>;
+        wallClockLimitMs: z.ZodOptional<z.ZodNumber>;
+        importCacheMaterializeTimeoutMs: z.ZodOptional<z.ZodNumber>;
         capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
         stdinBufferLimitBytes: z.ZodOptional<z.ZodNumber>;
         eventPayloadLimitBytes: z.ZodOptional<z.ZodNumber>;
@@ -159,12 +163,15 @@ export declare const agentOsLimitsSchema: z.ZodObject<{
     python: z.ZodOptional<z.ZodObject<{
         outputBufferMaxBytes: z.ZodOptional<z.ZodNumber>;
         executionTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        maxOldSpaceMb: z.ZodOptional<z.ZodNumber>;
         vfsRpcTimeoutMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     wasm: z.ZodOptional<z.ZodObject<{
         maxModuleFileBytes: z.ZodOptional<z.ZodNumber>;
         capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
         syncReadLimitBytes: z.ZodOptional<z.ZodNumber>;
+        prewarmTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        runnerHeapLimitMb: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const rootFilesystemConfigSchema: z.ZodObject<{
@@ -224,6 +231,7 @@ export declare const agentOsOptionFieldSchemas: {
     readonly defaultSoftware: z.ZodOptional<z.ZodBoolean>;
     readonly loopbackExemptPorts: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     readonly allowedNodeBuiltins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    readonly highResolutionTime: z.ZodOptional<z.ZodBoolean>;
     readonly rootFilesystem: z.ZodOptional<z.ZodObject<{
         type: z.ZodOptional<z.ZodLiteral<"overlay">>;
         mode: z.ZodOptional<z.ZodEnum<{
@@ -254,7 +262,6 @@ export declare const agentOsOptionFieldSchemas: {
             lowers: z.ZodArray<z.ZodUnknown>;
         }, z.core.$strict>;
     }, z.core.$strict>]>>>;
-    readonly moduleAccessCwd: z.ZodOptional<z.ZodString>;
     readonly additionalInstructions: z.ZodOptional<z.ZodString>;
     readonly scheduleDriver: z.ZodOptional<z.ZodCustom<unknown, unknown>>;
     readonly toolKits: z.ZodOptional<z.ZodArray<z.ZodType<ToolKit, unknown, z.core.$ZodTypeInternals<ToolKit, unknown>>>>;
@@ -344,7 +351,7 @@ export declare const agentOsOptionFieldSchemas: {
                 patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strict>>;
         }, z.core.$strict>]>>;
-        tool: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        binding: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
             allow: "allow";
             deny: "deny";
         }>, z.ZodObject<{
@@ -415,6 +422,10 @@ export declare const agentOsOptionFieldSchemas: {
         }, z.core.$strict>>;
         jsRuntime: z.ZodOptional<z.ZodObject<{
             v8HeapLimitMb: z.ZodOptional<z.ZodNumber>;
+            syncRpcWaitTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            cpuTimeLimitMs: z.ZodOptional<z.ZodNumber>;
+            wallClockLimitMs: z.ZodOptional<z.ZodNumber>;
+            importCacheMaterializeTimeoutMs: z.ZodOptional<z.ZodNumber>;
             capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
             stdinBufferLimitBytes: z.ZodOptional<z.ZodNumber>;
             eventPayloadLimitBytes: z.ZodOptional<z.ZodNumber>;
@@ -423,15 +434,19 @@ export declare const agentOsOptionFieldSchemas: {
         python: z.ZodOptional<z.ZodObject<{
             outputBufferMaxBytes: z.ZodOptional<z.ZodNumber>;
             executionTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            maxOldSpaceMb: z.ZodOptional<z.ZodNumber>;
             vfsRpcTimeoutMs: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
         wasm: z.ZodOptional<z.ZodObject<{
             maxModuleFileBytes: z.ZodOptional<z.ZodNumber>;
             capturedOutputLimitBytes: z.ZodOptional<z.ZodNumber>;
             syncReadLimitBytes: z.ZodOptional<z.ZodNumber>;
+            prewarmTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            runnerHeapLimitMb: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     readonly onAgentStderr: z.ZodOptional<z.ZodCustom<AgentStderrHandler, AgentStderrHandler>>;
+    readonly onAgentExit: z.ZodOptional<z.ZodCustom<AgentExitHandler, AgentExitHandler>>;
     readonly onLimitWarning: z.ZodOptional<z.ZodCustom<LimitWarningHandler, LimitWarningHandler>>;
 };
 export declare const agentOsOptionsSchema: z.ZodType<AgentOsOptions>;

package/dist/options-schema.js

@@ -42,7 +42,7 @@ export const permissionsSchema = z
     childProcess: patternPermissionsSchema.optional(),
     process: patternPermissionsSchema.optional(),
     env: patternPermissionsSchema.optional(),
-    tool: patternPermissionsSchema.optional(),
+    binding: patternPermissionsSchema.optional(),
 })
     .strict();
 export const agentOsLimitsSchema = z
@@ -73,59 +73,66 @@ export const agentOsLimitsSchema = z
         .strict()
         .optional(),
     http: z
-        .object({ maxFetchResponseBytes: nonNegativeInteger.optional() })
+        .object({ maxFetchResponseBytes: positiveInteger.optional() })
         .strict()
         .optional(),
     tools: z
         .object({
         defaultToolTimeoutMs: nonNegativeInteger.optional(),
         maxToolTimeoutMs: nonNegativeInteger.optional(),
-        maxRegisteredToolkits: nonNegativeInteger.optional(),
-        maxRegisteredToolsPerVm: nonNegativeInteger.optional(),
-        maxToolsPerToolkit: nonNegativeInteger.optional(),
-        maxToolSchemaBytes: nonNegativeInteger.optional(),
+        maxRegisteredToolkits: positiveInteger.optional(),
+        maxRegisteredToolsPerVm: positiveInteger.optional(),
+        maxToolsPerToolkit: positiveInteger.optional(),
+        maxToolSchemaBytes: positiveInteger.optional(),
         maxToolExamplesPerTool: nonNegativeInteger.optional(),
-        maxToolExampleInputBytes: nonNegativeInteger.optional(),
+        maxToolExampleInputBytes: positiveInteger.optional(),
     })
         .strict()
         .optional(),
     plugins: z
         .object({
-        maxPersistedManifestBytes: nonNegativeInteger.optional(),
+        maxPersistedManifestBytes: positiveInteger.optional(),
         maxPersistedManifestFileBytes: nonNegativeInteger.optional(),
     })
         .strict()
         .optional(),
     acp: z
         .object({
-        maxReadLineBytes: nonNegativeInteger.optional(),
-        stdoutBufferByteLimit: nonNegativeInteger.optional(),
+        maxReadLineBytes: positiveInteger.optional(),
+        stdoutBufferByteLimit: positiveInteger.optional(),
     })
         .strict()
         .optional(),
     jsRuntime: z
         .object({
-        v8HeapLimitMb: nonNegativeInteger.optional(),
-        capturedOutputLimitBytes: nonNegativeInteger.optional(),
-        stdinBufferLimitBytes: nonNegativeInteger.optional(),
-        eventPayloadLimitBytes: nonNegativeInteger.optional(),
-        v8IpcMaxFrameBytes: nonNegativeInteger.optional(),
+        v8HeapLimitMb: positiveInteger.optional(),
+        syncRpcWaitTimeoutMs: nonNegativeInteger.optional(),
+        cpuTimeLimitMs: nonNegativeInteger.optional(),
+        wallClockLimitMs: nonNegativeInteger.optional(),
+        importCacheMaterializeTimeoutMs: positiveInteger.optional(),
+        capturedOutputLimitBytes: positiveInteger.optional(),
+        stdinBufferLimitBytes: positiveInteger.optional(),
+        eventPayloadLimitBytes: positiveInteger.optional(),
+        v8IpcMaxFrameBytes: positiveInteger.optional(),
     })
         .strict()
         .optional(),
     python: z
         .object({
-        outputBufferMaxBytes: nonNegativeInteger.optional(),
-        executionTimeoutMs: nonNegativeInteger.optional(),
-        vfsRpcTimeoutMs: nonNegativeInteger.optional(),
+        outputBufferMaxBytes: positiveInteger.optional(),
+        executionTimeoutMs: positiveInteger.optional(),
+        maxOldSpaceMb: nonNegativeInteger.optional(),
+        vfsRpcTimeoutMs: positiveInteger.optional(),
     })
         .strict()
         .optional(),
     wasm: z
         .object({
-        maxModuleFileBytes: nonNegativeInteger.optional(),
-        capturedOutputLimitBytes: nonNegativeInteger.optional(),
-        syncReadLimitBytes: nonNegativeInteger.optional(),
+        maxModuleFileBytes: positiveInteger.optional(),
+        capturedOutputLimitBytes: positiveInteger.optional(),
+        syncReadLimitBytes: positiveInteger.optional(),
+        prewarmTimeoutMs: positiveInteger.optional(),
+        runnerHeapLimitMb: positiveInteger.optional(),
     })
         .strict()
         .optional(),
@@ -236,9 +243,9 @@ export const agentOsOptionFieldSchemas = {
     defaultSoftware: z.boolean().optional(),
     loopbackExemptPorts: z.array(z.number().int().min(0).max(65535)).optional(),
     allowedNodeBuiltins: stringArray.optional(),
+    highResolutionTime: z.boolean().optional(),
     rootFilesystem: rootFilesystemConfigSchema.optional(),
     mounts: z.array(mountConfigSchema).optional(),
-    moduleAccessCwd: z.string().optional(),
     additionalInstructions: z.string().optional(),
     scheduleDriver: z
         .custom((value) => typeof value === "object" && value !== null, {
@@ -250,6 +257,7 @@ export const agentOsOptionFieldSchemas = {
     sidecar: sidecarConfigSchema.optional(),
     limits: agentOsLimitsSchema.optional(),
     onAgentStderr: z.custom((value) => typeof value === "function", { message: "Expected function" }).optional(),
+    onAgentExit: z.custom((value) => typeof value === "function", { message: "Expected function" }).optional(),
     onLimitWarning: z.custom((value) => typeof value === "function", { message: "Expected function" }).optional(),
 };
 export const agentOsOptionsSchema = z