@rivet-dev/agentos-core 0.0.0-main.29b0797 → 0.0.0-main.5ac5a14

package/dist/agentos-package.d.ts

@@ -3,7 +3,7 @@
  *
  * A package is a self-contained directory produced by `@rivet-dev/agentos-toolchain
  * pack`. The HOST no longer projects it: the client forwards only the package
- * directory over the wire and the secure-exec sidecar owns the `/opt/agentos`
+ * directory over the wire and the agentos sidecar owns the `/opt/agentos`
  * projection. Package metadata lives in `<dir>/agentos-package.json`.
  *
  * This module is therefore only the client-facing package-dir surface plus the
@@ -25,7 +25,7 @@ export type SoftwarePackageRef = {
 export interface PackageDescriptor {
     path: string;
 }
-/** Discriminate the dir-only package reference. */
+/** Discriminate the path-only package reference. */
 export declare function isPackageDescriptor(value: unknown): value is PackageDescriptor;
 export declare function readAgentosPackageManifest(dir: string): AgentosPackageManifest;
 export declare function tryReadAgentosPackageManifest(dir: string): AgentosPackageManifest | undefined;

package/dist/agentos-package.js

@@ -3,7 +3,7 @@
  *
  * A package is a self-contained directory produced by `@rivet-dev/agentos-toolchain
  * pack`. The HOST no longer projects it: the client forwards only the package
- * directory over the wire and the secure-exec sidecar owns the `/opt/agentos`
+ * directory over the wire and the agentos sidecar owns the `/opt/agentos`
  * projection. Package metadata lives in `<dir>/agentos-package.json`.
  *
  * This module is therefore only the client-facing package-dir surface plus the
@@ -17,7 +17,7 @@ import { join } from "node:path";
 export const OPT_AGENTOS_ROOT = "/opt/agentos";
 /** The symlink farm on `$PATH` (commands link here). */
 export const OPT_AGENTOS_BIN = "/opt/agentos/bin";
-/** Discriminate the dir-only package reference. */
+/** Discriminate the path-only package reference. */
 export function isPackageDescriptor(value) {
     return (typeof value === "object" &&
         value !== null &&

package/dist/base-filesystem.js

@@ -2,13 +2,13 @@
  * The base VM environment, baked in as a constant (verbatim from the single
  * `base-filesystem.json` the sidecar embeds). The host no longer reads that JSON
  * — the sidecar owns the base filesystem, and there is exactly one committed copy
- * of it (`secure-exec/crates/vfs/assets/base-filesystem.json`). Regenerate both
+ * of it (`agentos/crates/vfs/assets/base-filesystem.json`). Regenerate both
  * this constant and that file together with the build-tools snapshot script.
  */
 const BASE_ENVIRONMENT = Object.freeze({
     CHARSET: "UTF-8",
     HOME: "/home/agentos",
-    HOSTNAME: "secure-exec",
+    HOSTNAME: "agentos",
     LANG: "C.UTF-8",
     LC_COLLATE: "C",
     LOGNAME: "agentos",

package/dist/code-execution.d.ts

@@ -0,0 +1,70 @@
+export interface CodeExecutionSpawnOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    stdin?: string | Uint8Array;
+    streamStdin?: boolean;
+    captureStdio?: boolean;
+}
+export interface CodeExecutionProcessOutput {
+    pid: number;
+    stream: "stdout" | "stderr";
+    data: Uint8Array;
+}
+export interface CodeExecutionVm {
+    spawn(command: string, args: string[], options?: CodeExecutionSpawnOptions): {
+        pid: number;
+    };
+    onProcessOutput(pid: number, handler: (event: CodeExecutionProcessOutput) => void): () => void;
+    waitProcess(pid: number): Promise<number>;
+    writeProcessStdin(pid: number, data: string | Uint8Array): Promise<void>;
+    closeProcessStdin(pid: number): Promise<void>;
+    killProcess(pid: number): void;
+    stopProcess(pid: number): void;
+}
+export interface CodeExecutionOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    argv?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    onStdout?: (chunk: string) => void;
+    onStderr?: (chunk: string) => void;
+}
+export interface CodeExecutionResult {
+    success: boolean;
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export interface GuestError {
+    name: string;
+    message: string;
+    stack?: string;
+}
+export type CodeEvaluationResult<T> = {
+    success: true;
+    exitCode: 0;
+    value: T;
+    stdout: string;
+    stderr: string;
+} | {
+    success: false;
+    exitCode: number;
+    error: GuestError;
+    stdout: string;
+    stderr: string;
+};
+export interface CodeProcess {
+    readonly pid: number;
+    writeStdin(data: string | Uint8Array): Promise<void>;
+    closeStdin(): Promise<void>;
+    kill(signal?: "SIGTERM" | "SIGKILL"): void;
+    wait(): Promise<CodeExecutionResult>;
+}
+export interface SpawnCodeProcessOptions extends CodeExecutionOptions {
+    onComplete?: () => Promise<void>;
+    streamStdin?: boolean;
+}
+export declare function spawnCodeProcess(vm: CodeExecutionVm, command: string, args: string[], options?: SpawnCodeProcessOptions): CodeProcess;
+export declare function executeArgv(vm: CodeExecutionVm, command: string, args: string[], options?: SpawnCodeProcessOptions): Promise<CodeExecutionResult>;

package/dist/code-execution.js

@@ -0,0 +1,115 @@
+function toSpawnOptions(options) {
+    return {
+        cwd: options.cwd,
+        env: options.env,
+        stdin: options.stdin,
+        streamStdin: options.streamStdin ?? true,
+        captureStdio: true,
+    };
+}
+export function spawnCodeProcess(vm, command, args, options = {}) {
+    if (options.signal?.aborted) {
+        throw abortReason(options.signal);
+    }
+    if (options.timeoutMs !== undefined &&
+        (!Number.isFinite(options.timeoutMs) || options.timeoutMs < 0)) {
+        throw new RangeError("timeoutMs must be a finite, non-negative number");
+    }
+    const { pid } = vm.spawn(command, args, toSpawnOptions(options));
+    const stdoutDecoder = new TextDecoder();
+    const stderrDecoder = new TextDecoder();
+    let stdout = "";
+    let stderr = "";
+    let callbackError;
+    let aborted = false;
+    let finalized = false;
+    let waitPromise;
+    const unsubscribeOutput = vm.onProcessOutput(pid, (event) => {
+        try {
+            if (event.stream === "stdout") {
+                const text = stdoutDecoder.decode(event.data, { stream: true });
+                stdout += text;
+                options.onStdout?.(text);
+            }
+            else {
+                const text = stderrDecoder.decode(event.data, { stream: true });
+                stderr += text;
+                options.onStderr?.(text);
+            }
+        }
+        catch (error) {
+            callbackError ??= error;
+            vm.killProcess(pid);
+        }
+    });
+    const abort = () => {
+        aborted = true;
+        vm.killProcess(pid);
+    };
+    options.signal?.addEventListener("abort", abort, { once: true });
+    const timeout = options.timeoutMs === undefined
+        ? undefined
+        : setTimeout(() => vm.killProcess(pid), options.timeoutMs);
+    const finalize = async () => {
+        if (finalized)
+            return;
+        finalized = true;
+        unsubscribeOutput();
+        options.signal?.removeEventListener("abort", abort);
+        if (timeout !== undefined)
+            clearTimeout(timeout);
+        stdout += stdoutDecoder.decode();
+        stderr += stderrDecoder.decode();
+        await options.onComplete?.();
+    };
+    const wait = () => {
+        waitPromise ??= (async () => {
+            let exitCode;
+            try {
+                exitCode = await vm.waitProcess(pid);
+            }
+            catch (waitError) {
+                try {
+                    await finalize();
+                }
+                catch (cleanupError) {
+                    console.error("[agentos] process cleanup also failed after waitProcess rejected:", cleanupError);
+                }
+                throw waitError;
+            }
+            await finalize();
+            if (aborted && options.signal)
+                throw abortReason(options.signal);
+            if (callbackError !== undefined)
+                throw callbackError;
+            return {
+                success: exitCode === 0,
+                exitCode,
+                stdout,
+                stderr,
+            };
+        })();
+        return waitPromise;
+    };
+    return {
+        pid,
+        writeStdin: (data) => vm.writeProcessStdin(pid, data),
+        closeStdin: () => vm.closeProcessStdin(pid),
+        kill: (signal) => {
+            if (signal === "SIGKILL")
+                vm.killProcess(pid);
+            else
+                vm.stopProcess(pid);
+        },
+        wait,
+    };
+}
+function abortReason(signal) {
+    return signal.reason ?? new DOMException("Execution aborted", "AbortError");
+}
+export async function executeArgv(vm, command, args, options = {}) {
+    return spawnCodeProcess(vm, command, args, {
+        ...options,
+        streamStdin: false,
+    }).wait();
+}

package/dist/index.d.ts

@@ -1,11 +1,14 @@
 export { AgentOs, AgentOsSidecar } from "./agent-os.js";
+export type * from "./language-execution.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { binding, MAX_BINDING_DESCRIPTION_LENGTH, bindings, validateBindings, } from "./bindings.js";
+export type { Binding, BindingExample, Bindings } from "./bindings.js";
 export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, bindingSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, bindingsSchema, } from "./options-schema.js";
-export { createSnapshotExport, } from "./layers.js";
+export { createSnapshotExport } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { KernelError } from "./runtime-compat.js";
 export type { ExecOptions, ExecResult, ManagedProcess, ProcessInfo, ShellHandle, VirtualDirEntry, VirtualStat, } from "./runtime.js";
+export { createSandboxBindings, createSandboxFs, getSandboxDisposeHooks, resolveSandboxOptions, } from "./sandbox.js";
 export type * from "./types.js";

package/dist/index.js

@@ -4,7 +4,8 @@ export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriv
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { binding, MAX_BINDING_DESCRIPTION_LENGTH, bindings, validateBindings, } from "./bindings.js";
 export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, bindingSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, bindingsSchema, } from "./options-schema.js";
-export { createSnapshotExport, } from "./layers.js";
+export { createSnapshotExport } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { KernelError } from "./runtime-compat.js";
+export { createSandboxBindings, createSandboxFs, getSandboxDisposeHooks, resolveSandboxOptions, } from "./sandbox.js";

package/dist/language-execution.d.ts

@@ -0,0 +1,170 @@
+import type { JsonValue } from "./session-api.js";
+export type ExecutionSignal = "SIGHUP" | "SIGINT" | "SIGQUIT" | "SIGTERM" | "SIGKILL" | "SIGSTOP" | "SIGCONT" | "SIGUSR1" | "SIGUSR2";
+export interface LanguageExecutionOptions {
+    contextId?: string;
+    cwd?: string;
+    env?: Record<string, string>;
+    args?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    pty?: {
+        cols?: number;
+        rows?: number;
+    };
+    signal?: AbortSignal;
+    onStdout?: (chunk: Uint8Array) => void;
+    onStderr?: (chunk: Uint8Array) => void;
+    output?: ExecutionOutputOptions;
+}
+export type OutputCapture = "none" | "stderr" | "all";
+export interface ExecutionOutputOptions {
+    capture?: OutputCapture;
+    retainEvents?: boolean;
+}
+export interface InlineExecutionOptions extends LanguageExecutionOptions {
+    inputs?: Record<string, JsonValue>;
+}
+export interface JavaScriptExecutionOptions extends InlineExecutionOptions {
+    format?: "module" | "commonjs";
+    filePath?: string;
+}
+export type JavaScriptEvaluationOptions = JavaScriptExecutionOptions;
+export interface TypeScriptExecutionOptions extends InlineExecutionOptions {
+    filePath?: string;
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+}
+export type TypeScriptEvaluationOptions = TypeScriptExecutionOptions;
+export interface TypeScriptFileExecutionOptions extends LanguageExecutionOptions {
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+}
+export interface TypeScriptCheckOptions {
+    contextId?: string;
+    cwd?: string;
+    filePath?: string;
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    output?: ExecutionOutputOptions;
+}
+export interface NpmProjectInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    frozen?: boolean;
+}
+export interface NpmPackageInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    dev?: boolean;
+    global?: boolean;
+}
+export interface PythonInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    upgrade?: boolean;
+    requirementsFile?: string;
+    indexUrl?: string;
+    extraIndexUrls?: string[];
+}
+export type ContextState = "idle" | "running" | "resetting" | "deleting" | "failed";
+export type ExecutionOutcome = "succeeded" | "failed" | "cancelled" | "timed_out";
+export interface ContextDescriptor {
+    contextId: string;
+    state: ContextState;
+    language?: "javascript" | "python";
+    createdAtMs: number;
+    lastStartedAtMs?: number;
+    lastCompletedAtMs?: number;
+}
+export interface ProcessDescriptor {
+    pid: number;
+    state: "running" | "exited";
+    language?: "javascript" | "python";
+    command?: string;
+    startedAtMs: number;
+}
+export interface ProcessExit {
+    pid: number;
+    outcome: "exited" | "signalled" | "timed_out";
+    exitCode?: number;
+    signal?: ExecutionSignal;
+}
+export interface SpawnOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    args?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    pty?: {
+        cols?: number;
+        rows?: number;
+    };
+    signal?: AbortSignal;
+    onStdout?: (chunk: Uint8Array) => void;
+    onStderr?: (chunk: Uint8Array) => void;
+    output?: {
+        retainEvents?: boolean;
+    };
+}
+export type LanguageSpawnOptions = SpawnOptions;
+export interface ExecutionErrorData {
+    code: string;
+    name: string;
+    message: string;
+    stack?: string;
+    details?: JsonValue;
+}
+interface CodeExecutionResultBase {
+    exitCode?: number;
+    stdout?: string;
+    stderr?: string;
+    stdoutTruncated?: boolean;
+    stderrTruncated?: boolean;
+}
+type ExecutionResultOutcome<TIdentity> = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+} & TIdentity) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+} & TIdentity);
+export type CodeExecutionResult = ExecutionResultOutcome<Record<never, never>>;
+export type CodeEvaluationResult<T = JsonValue> = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+    value: T;
+}) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+    value?: never;
+});
+export interface TypeScriptDiagnostic {
+    code: number;
+    category: "error" | "warning" | "suggestion" | "message";
+    message: string;
+    filePath?: string;
+    line?: number;
+    column?: number;
+}
+export type TypeScriptCheckResult = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+    hasErrors: boolean;
+    diagnostics: TypeScriptDiagnostic[];
+}) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+    hasErrors?: never;
+    diagnostics: TypeScriptDiagnostic[];
+});
+export interface ProcessOutputEvent<TChunk = Uint8Array> {
+    pid: number;
+    sequence: number;
+    channel: "stdout" | "stderr" | "pty";
+    chunk: TChunk;
+    timestampMs: number;
+}
+export interface OutputReplay<TChunk = Uint8Array> {
+    pid: number;
+    events: ProcessOutputEvent<TChunk>[];
+    nextCursor: string;
+    hasMore: boolean;
+    truncated: boolean;
+}
+export {};

package/dist/language-execution.js

@@ -0,0 +1 @@
+export {};

package/dist/options-schema.d.ts

@@ -131,11 +131,14 @@ export declare const agentOsLimitsSchema: z.ZodObject<{
     http: z.ZodOptional<z.ZodObject<{
         maxFetchResponseBytes: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
+    tls: z.ZodOptional<z.ZodObject<{
+        maxBufferedBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
     bindings: z.ZodOptional<z.ZodObject<{
         defaultBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
         maxBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
         maxRegisteredCollections: z.ZodOptional<z.ZodNumber>;
-        maxRegisteredCollectionsPerVm: z.ZodOptional<z.ZodNumber>;
+        maxRegisteredBindingsPerVm: z.ZodOptional<z.ZodNumber>;
         maxBindingsPerCollection: z.ZodOptional<z.ZodNumber>;
         maxBindingSchemaBytes: z.ZodOptional<z.ZodNumber>;
         maxExamplesPerBinding: z.ZodOptional<z.ZodNumber>;
@@ -193,6 +196,11 @@ export declare const agentOsLimitsSchema: z.ZodObject<{
         runnerHeapLimitMb: z.ZodOptional<z.ZodNumber>;
         runnerCpuTimeLimitMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
+    execution: z.ZodOptional<z.ZodObject<{
+        completedTtlMs: z.ZodOptional<z.ZodNumber>;
+        maxCompletedExecutions: z.ZodOptional<z.ZodNumber>;
+        liveExecutionWarningThreshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
     process: z.ZodOptional<z.ZodObject<{
         maxSpawnFileActions: z.ZodOptional<z.ZodNumber>;
         maxSpawnFileActionBytes: z.ZodOptional<z.ZodNumber>;
@@ -295,7 +303,6 @@ export declare const agentOsOptionFieldSchemas: {
     readonly database: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"actor_uds">;
         path: z.ZodString;
-        token: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
         type: z.ZodLiteral<"sqlite_file">;
         path: z.ZodString;
@@ -339,6 +346,7 @@ export declare const agentOsOptionFieldSchemas: {
             lowers: z.ZodArray<z.ZodUnknown>;
         }, z.core.$strict>;
     }, z.core.$strict>]>>>;
+    readonly sandbox: z.ZodOptional<z.ZodCustom<unknown, unknown>>;
     readonly scheduleDriver: z.ZodOptional<z.ZodCustom<unknown, unknown>>;
     readonly bindings: z.ZodOptional<z.ZodArray<z.ZodType<Bindings, unknown, z.core.$ZodTypeInternals<Bindings, unknown>>>>;
     readonly permissions: z.ZodOptional<z.ZodObject<{
@@ -478,11 +486,14 @@ export declare const agentOsOptionFieldSchemas: {
         http: z.ZodOptional<z.ZodObject<{
             maxFetchResponseBytes: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
+        tls: z.ZodOptional<z.ZodObject<{
+            maxBufferedBytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
         bindings: z.ZodOptional<z.ZodObject<{
             defaultBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
             maxBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
             maxRegisteredCollections: z.ZodOptional<z.ZodNumber>;
-            maxRegisteredCollectionsPerVm: z.ZodOptional<z.ZodNumber>;
+            maxRegisteredBindingsPerVm: z.ZodOptional<z.ZodNumber>;
             maxBindingsPerCollection: z.ZodOptional<z.ZodNumber>;
             maxBindingSchemaBytes: z.ZodOptional<z.ZodNumber>;
             maxExamplesPerBinding: z.ZodOptional<z.ZodNumber>;
@@ -540,6 +551,11 @@ export declare const agentOsOptionFieldSchemas: {
             runnerHeapLimitMb: z.ZodOptional<z.ZodNumber>;
             runnerCpuTimeLimitMs: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
+        execution: z.ZodOptional<z.ZodObject<{
+            completedTtlMs: z.ZodOptional<z.ZodNumber>;
+            maxCompletedExecutions: z.ZodOptional<z.ZodNumber>;
+            liveExecutionWarningThreshold: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
         process: z.ZodOptional<z.ZodObject<{
             maxSpawnFileActions: z.ZodOptional<z.ZodNumber>;
             maxSpawnFileActionBytes: z.ZodOptional<z.ZodNumber>;

package/dist/options-schema.js

@@ -119,12 +119,16 @@ export const agentOsLimitsSchema = z
         .object({ maxFetchResponseBytes: positiveInteger.optional() })
         .strict()
         .optional(),
+    tls: z
+        .object({ maxBufferedBytes: positiveInteger.optional() })
+        .strict()
+        .optional(),
     bindings: z
         .object({
         defaultBindingTimeoutMs: nonNegativeInteger.optional(),
         maxBindingTimeoutMs: nonNegativeInteger.optional(),
         maxRegisteredCollections: positiveInteger.optional(),
-        maxRegisteredCollectionsPerVm: positiveInteger.optional(),
+        maxRegisteredBindingsPerVm: positiveInteger.optional(),
         maxBindingsPerCollection: positiveInteger.optional(),
         maxBindingSchemaBytes: positiveInteger.optional(),
         maxExamplesPerBinding: nonNegativeInteger.optional(),
@@ -200,6 +204,14 @@ export const agentOsLimitsSchema = z
     })
         .strict()
         .optional(),
+    execution: z
+        .object({
+        completedTtlMs: positiveInteger.optional(),
+        maxCompletedExecutions: positiveInteger.optional(),
+        liveExecutionWarningThreshold: positiveInteger.optional(),
+    })
+        .strict()
+        .optional(),
     process: z
         .object({
         maxSpawnFileActions: positiveInteger.optional(),
@@ -340,7 +352,6 @@ export const agentOsOptionFieldSchemas = {
             .object({
             type: z.literal("actor_uds"),
             path: z.string().min(1),
-            token: z.string().min(1).max(4096),
         })
             .strict(),
         z
@@ -353,6 +364,10 @@ export const agentOsOptionFieldSchemas = {
         .optional(),
     rootFilesystem: rootFilesystemConfigSchema.optional(),
     mounts: z.array(mountConfigSchema).optional(),
+    sandbox: z
+        .custom((value) => value === undefined ||
+        (typeof value === "object" && value !== null && !Array.isArray(value)), { message: "Expected sandbox options object" })
+        .optional(),
     scheduleDriver: z
         .custom((value) => typeof value === "object" && value !== null, {
         message: "Expected schedule driver object",

package/dist/packages.d.ts

@@ -1,7 +1,7 @@
 import type { SoftwarePackageRef } from "./agentos-package.js";
 /**
  * Input type for the `software` option. Software is a self-contained package
- * directory that the secure-exec sidecar materializes into the `/opt/agentos`
+ * directory that the agentos sidecar materializes into the `/opt/agentos`
  * projection. Accepts a package-dir ref or an array of refs for meta-packages.
  */
 export type SoftwareEntry = SoftwarePackageRef;

package/dist/runtime-compat.js

@@ -870,9 +870,13 @@ function createBootstrapEntries() {
         ...KERNEL_POSIX_BOOTSTRAP_DIRS.map((entryPath) => ({
             path: entryPath,
             kind: "directory",
-            mode: entryPath === "/tmp" || entryPath === "/var/tmp" ? 0o1777 : 0o755,
-            uid: 0,
-            gid: 0,
+            mode: entryPath === "/tmp" || entryPath === "/var/tmp"
+                ? 0o1777
+                : entryPath === "/home/agentos"
+                    ? 0o2755
+                    : 0o755,
+            uid: entryPath === "/home/agentos" || entryPath === "/workspace" ? 1000 : 0,
+            gid: entryPath === "/home/agentos" || entryPath === "/workspace" ? 1000 : 0,
             executable: false,
         })),
         {
@@ -1187,9 +1191,15 @@ async function syncLiveFilesystemToBoundMethods(live, methods, paths, maxBytes)
 }
 async function snapshotLiveFilesystemPath(live, targetPath, snapshot, usage, maxBytes, knownEntry) {
     const stat = knownEntry ??
-        (targetPath === "/" ? await live.stat(targetPath) : await live.lstat(targetPath));
+        (targetPath === "/"
+            ? await live.stat(targetPath)
+            : await live.lstat(targetPath));
     if (stat.isSymbolicLink) {
-        snapshot.push({ kind: "symlink", path: targetPath, target: await live.readlink(targetPath) });
+        snapshot.push({
+            kind: "symlink",
+            path: targetPath,
+            target: await live.readlink(targetPath),
+        });
         return;
     }
     if (stat.isDirectory) {
@@ -1221,7 +1231,9 @@ async function snapshotLiveFilesystemPath(live, targetPath, snapshot, usage, max
 }
 async function applyLiveFilesystemSnapshotEntry(methods, entry) {
     if (entry.kind === "directory") {
-        await callBoundFilesystemMethod(methods, "mkdir", entry.path, { recursive: true });
+        await callBoundFilesystemMethod(methods, "mkdir", entry.path, {
+            recursive: true,
+        });
         return;
     }
     await ensureBoundParentDirectory(methods, entry.path);
@@ -1351,7 +1363,7 @@ class NativeKernel {
             throw new Error("kernel is not ready");
         }
         const sidecarMounts = commandDirs.map((commandDir, index) => serializeMountConfigForSidecar({
-            path: `/__secure_exec/commands/${index}`,
+            path: `/__agentos/commands/${index}`,
             readOnly: true,
             plugin: {
                 id: "host_dir",