@rivet-dev/agentos-core 0.2.0 → 0.2.1

package/dist/agent-os.d.ts

@@ -198,6 +198,25 @@ export interface AgentStderrEvent {
     chunk: Uint8Array;
 }
 export type AgentStderrHandler = (event: AgentStderrEvent) => void;
+/**
+ * A near-capacity warning for one bounded limit (a queue/buffer, a saturating
+ * resource cap, or a memory envelope) inside the VM runtime. Delivered the moment
+ * usage crosses the runtime's warning threshold (~80%), once per crossing — the
+ * runtime applies edge-triggering + hysteresis, so this never spams.
+ */
+export interface LimitWarning {
+    /** Stable limit name, e.g. `"javascript_event_channel"` or `"vm_open_fds"`. */
+    limit: string;
+    /** Limit class: `"queue"`, `"resource"`, or `"memory"`. */
+    category: string;
+    /** Current observed usage. */
+    observed: number;
+    /** Configured capacity. */
+    capacity: number;
+    /** Observed fill as a percentage of capacity (0–100). */
+    fillPercent: number;
+}
+export type LimitWarningHandler = (warning: LimitWarning) => void;
 /**
  * Public core VM options.
  *
@@ -267,6 +286,12 @@ export interface AgentOsOptions {
      * `process.stderr`.
      */
     onAgentStderr?: AgentStderrHandler;
+    /**
+     * Called when a bounded limit inside the VM runtime approaches capacity
+     * (~80%, edge-triggered with hysteresis so it does not spam). Use it to alert
+     * on a slow consumer or a runaway guest before the limit is actually hit.
+     */
+    onLimitWarning?: LimitWarningHandler;
 }
 /** Configuration for a local MCP server (spawned as a child process). */
 export interface McpServerConfigLocal {
@@ -385,6 +410,7 @@ export declare class AgentOs {
     private readonly _sidecarVm;
     private readonly _disposeSidecarEventListener;
     private readonly _agentStderrHandler?;
+    private readonly _limitWarningHandler?;
     private constructor();
     static createSidecar(options?: AgentOsCreateSidecarOptions): Promise<AgentOsSidecar>;
     static getSharedSidecar(options?: AgentOsSharedSidecarOptions): Promise<AgentOsSidecar>;
@@ -473,6 +499,7 @@ export declare class AgentOs {
     private _recordAgentStderr;
     private _applySyntheticConfigOverrides;
     private _handleSidecarEvent;
+    private _handleLimitWarning;
     private _handleAcpExtEvent;
     private _unsupportedConfigResponse;
     private _sendAcpRequest;

package/dist/agent-os.js

@@ -1548,7 +1548,8 @@ export class AgentOs {
     _sidecarVm;
     _disposeSidecarEventListener;
     _agentStderrHandler;
-    constructor(kernel, sidecar, softwareRoots, softwareAgentConfigs, hostMounts, env, rootFilesystem, sidecarClient, sidecarSession, sidecarVm, additionalInstructions, agentStderrHandler) {
+    _limitWarningHandler;
+    constructor(kernel, sidecar, softwareRoots, softwareAgentConfigs, hostMounts, env, rootFilesystem, sidecarClient, sidecarSession, sidecarVm, additionalInstructions, agentStderrHandler, limitWarningHandler) {
         this.#kernel = kernel;
         this.sidecar = sidecar;
         this._softwareRoots = softwareRoots;
@@ -1561,6 +1562,7 @@ export class AgentOs {
         this._sidecarVm = sidecarVm;
         this._additionalInstructions = additionalInstructions;
         this._agentStderrHandler = agentStderrHandler;
+        this._limitWarningHandler = limitWarningHandler;
         this._disposeSidecarEventListener = this._sidecarClient.onEvent((event) => {
             this._handleSidecarEvent(event);
         });
@@ -1787,7 +1789,7 @@ export class AgentOs {
                 createVm: async () => createVmAdmin(),
             });
             const vmAdmin = sidecarLease.admin;
-            const vm = new AgentOs(vmAdmin.kernel, sidecar, processed.softwareRoots, processed.agentConfigs, vmAdmin.hostMounts, vmAdmin.env, vmAdmin.rootView, vmAdmin.sidecarClient, vmAdmin.sidecarSession, vmAdmin.sidecarVm, options?.additionalInstructions, options?.onAgentStderr ?? defaultAgentStderrHandler);
+            const vm = new AgentOs(vmAdmin.kernel, sidecar, processed.softwareRoots, processed.agentConfigs, vmAdmin.hostMounts, vmAdmin.env, vmAdmin.rootView, vmAdmin.sidecarClient, vmAdmin.sidecarSession, vmAdmin.sidecarVm, options?.additionalInstructions, options?.onAgentStderr ?? defaultAgentStderrHandler, options?.onLimitWarning);
             vm._sidecarLease = sidecarLease;
             vm._toolKits = vmAdmin.toolKits;
             vm._toolReference = vmAdmin.toolReference;
@@ -1818,6 +1820,11 @@ export class AgentOs {
             exitHandlers,
         };
         this._processes.set(proc.pid, entry);
+        // NOTE: do NOT delete from `_processes` on exit — the public API contract
+        // (getProcess/listProcesses/stopProcess, see process-management.test.ts)
+        // requires exited processes to stay queryable (running:false, exitCode set).
+        // `_processes` is a process table for this VM's lifetime; it is freed wholesale
+        // in dispose(). (H5: the leak was that dispose() never cleared it.)
         void proc.wait().then((code) => {
             for (const h of exitHandlers)
                 h(code);
@@ -2000,14 +2007,13 @@ export class AgentOs {
     /** Recursively create directories (mkdir -p). */
     async _mkdirp(path) {
         this._assertWritableAbsolutePath(path);
-        const parts = path.split("/").filter(Boolean);
-        let current = "";
-        for (const part of parts) {
-            current += `/${part}`;
-            if (!(await this.#kernel.exists(current))) {
-                await this.#kernel.mkdir(current);
-            }
-        }
+        // `kernel.mkdir` is already recursive (it defaults to recursive=true on both
+        // the native sidecar and compat kernels) and creating an existing directory is
+        // a no-op, so a single call is sufficient. Do NOT probe each ancestor with
+        // `exists()` first: on the native sidecar every read-side op
+        // (exists/stat/readFile) triggers a full shadow-tree walk, so a per-component
+        // exists() loop makes `mkdir -p` cost O(components * tree).
+        await this.#kernel.mkdir(path);
     }
     async mkdir(path, options) {
         if (options?.recursive) {
@@ -2476,6 +2482,10 @@ export class AgentOs {
         if (event.payload.type !== "structured") {
             return;
         }
+        if (event.payload.name === "limit_warning") {
+            this._handleLimitWarning(event.payload.detail);
+            return;
+        }
         if (event.payload.name !== "acp.session_event") {
             return;
         }
@@ -2495,6 +2505,27 @@ export class AgentOs {
             // Ignore malformed event payloads from the sidecar.
         }
     }
+    _handleLimitWarning(detail) {
+        if (!this._limitWarningHandler) {
+            return;
+        }
+        const toNumber = (value) => {
+            const parsed = Number(value);
+            return Number.isFinite(parsed) ? parsed : 0;
+        };
+        try {
+            this._limitWarningHandler({
+                limit: detail.limit ?? "",
+                category: detail.category ?? "",
+                observed: toNumber(detail.observed),
+                capacity: toNumber(detail.capacity),
+                fillPercent: toNumber(detail.fillPercent),
+            });
+        }
+        catch {
+            // A throwing handler must never break the sidecar event loop.
+        }
+    }
     _handleAcpExtEvent(envelope) {
         if (envelope.namespace !== ACP_EXTENSION_NAMESPACE) {
             return;
@@ -2936,7 +2967,9 @@ export class AgentOs {
                 case "host_callback":
                     return handleHostCallback(request, context);
                 case "js_bridge_call":
-                    return handleJsBridgeCall(request.payload, { filesystem: this.#kernel.vfs });
+                    return handleJsBridgeCall(request.payload, {
+                        filesystem: this.#kernel.vfs,
+                    });
                 case "ext":
                     return this._handleAcpExtSidecarRequest(request.payload.envelope);
             }
@@ -3624,6 +3657,7 @@ export class AgentOs {
             terminalExitPromises.push(terminal.waitPromise.then(() => undefined, () => undefined));
         }
         this._acpTerminals.clear();
+        this._processes.clear();
         await waitForTrackedExitPromises([...shellExitPromises, ...terminalExitPromises], SHELL_DISPOSE_TIMEOUT_MS);
         this._disposeSidecarEventListener();
         const sidecarLease = this._sidecarLease;

package/dist/layers.d.ts

@@ -45,6 +45,7 @@ export interface LayerStore {
         mode: "read-only";
         lowers: SnapshotLayerHandle[];
     }): VirtualFileSystem;
+    dispose(): void;
 }
 export declare function createSnapshotExport(entries: FilesystemEntry[]): RootSnapshotExport;
 export declare function createInMemoryLayerStore(): LayerStore;

package/dist/layers.js

@@ -73,8 +73,11 @@ export function createInMemoryLayerStore() {
         }
         return state;
     }
-    return {
+    const store = {
         storeId,
+        get retainedLayerCount() {
+            return layers.size;
+        },
         async createWritableLayer() {
             const layerId = randomUUID();
             const leaseId = randomUUID();
@@ -117,10 +120,11 @@ export function createInMemoryLayerStore() {
             if (state.kind !== "writable") {
                 throw new Error(`Layer ${layer.layerId} is not writable`);
             }
-            if (!state.valid || state.leaseId !== layer.leaseId) {
+            const baseFs = state.activeOverlay ?? state.fs;
+            if (!state.valid || state.leaseId !== layer.leaseId || !baseFs) {
                 throw new Error(`Writable layer ${layer.layerId} is no longer valid`);
             }
-            const entries = await snapshotVirtualFilesystem(state.activeOverlay ?? state.fs);
+            const entries = await snapshotVirtualFilesystem(baseFs);
             const snapshot = createSnapshotExport(entries).source;
             const layerId = randomUUID();
             layers.set(layerId, {
@@ -128,8 +132,11 @@ export function createInMemoryLayerStore() {
                 snapshot,
                 fs: await createFilesystemFromEntries(snapshot.filesystem.entries),
             });
+            // Release the writable layer's filesystem payload now that it is sealed;
+            // the invalid tombstone is retained so stale handles still report cleanly.
             state.valid = false;
             state.activeOverlay = null;
+            state.fs = null;
             return cloneSnapshotHandle(storeId, layerId);
         },
         createOverlayFilesystem(options) {
@@ -162,6 +169,9 @@ export function createInMemoryLayerStore() {
             if (upperState.activeOverlay) {
                 throw new Error(`Writable layer ${options.upper.layerId} is already attached to an overlay`);
             }
+            if (!upperState.fs) {
+                throw new Error(`Writable layer ${options.upper.layerId} is no longer valid`);
+            }
             const overlay = createOverlayBackend({
                 upper: upperState.fs,
                 lowers: lowers.map((lower) => {
@@ -175,7 +185,13 @@ export function createInMemoryLayerStore() {
             upperState.activeOverlay = overlay;
             return overlay;
         },
+        dispose() {
+            // Release every retained layer's filesystem payload so the store does
+            // not accumulate snapshots/writable layers for the process lifetime.
+            layers.clear();
+        },
     };
+    return store;
 }
 export function createDefaultRootLowerInput() {
     return {

package/dist/options-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod/v4";
-import type { AgentOsOptions, AgentStderrHandler, NativeMountConfig } from "./agent-os.js";
+import type { AgentOsOptions, AgentStderrHandler, LimitWarningHandler, NativeMountConfig } from "./agent-os.js";
 import type { HostTool, ToolKit } from "./host-tools.js";
 export declare const permissionsSchema: z.ZodObject<{
     fs: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
@@ -432,6 +432,7 @@ export declare const agentOsOptionFieldSchemas: {
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     readonly onAgentStderr: z.ZodOptional<z.ZodCustom<AgentStderrHandler, AgentStderrHandler>>;
+    readonly onLimitWarning: z.ZodOptional<z.ZodCustom<LimitWarningHandler, LimitWarningHandler>>;
 };
 export declare const agentOsOptionsSchema: z.ZodType<AgentOsOptions>;
 export declare function parseAgentOsOptions(options?: AgentOsOptions): AgentOsOptions;

package/dist/options-schema.js

@@ -250,6 +250,7 @@ export const agentOsOptionFieldSchemas = {
     sidecar: sidecarConfigSchema.optional(),
     limits: agentOsLimitsSchema.optional(),
     onAgentStderr: z.custom((value) => typeof value === "function", { message: "Expected function" }).optional(),
+    onLimitWarning: z.custom((value) => typeof value === "function", { message: "Expected function" }).optional(),
 };
 export const agentOsOptionsSchema = z
     .object(agentOsOptionFieldSchemas)

package/dist/packages.js

@@ -32,7 +32,7 @@ export function resolvePackageDir(startDir, packageName) {
     throw new Error(`Package "${packageName}" not found starting from ${startDir}. ` +
         `Ensure it is installed.`);
 }
-const LOCAL_REGISTRY_COMMAND_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "../../..", "registry/native/target/wasm32-wasip1/release/commands");
+const LOCAL_REGISTRY_COMMAND_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "../../../../secure-exec", "registry/native/target/wasm32-wasip1/release/commands");
 function readPackageName(packageDir) {
     const pkg = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf-8"));
     if (typeof pkg.name !== "string" || pkg.name.length === 0) {

package/dist/sidecar/rpc-client.d.ts

@@ -2,7 +2,7 @@ import type { RootFilesystemConfig as VmConfigRootFilesystemConfig, RootFilesyst
 import type { NativeMountConfig, PlainMountConfig, RootFilesystemConfig } from "../agent-os.js";
 import type { RootSnapshotExport } from "../layers.js";
 import type { ConnectTerminalOptions, KernelExecOptions, KernelExecResult, KernelSpawnOptions, ManagedProcess, OpenShellOptions, ProcessInfo, ShellHandle, VirtualFileSystem, VirtualStat } from "../runtime-compat.js";
-import type { AuthenticatedSession, CreatedVm, SidecarProcess, SidecarPermissionsPolicy, SidecarSignalHandlerRegistration } from "./native-process-client.js";
+import type { AuthenticatedSession, CreatedVm, SidecarPermissionsPolicy, SidecarProcess, SidecarSignalHandlerRegistration } from "./native-process-client.js";
 export declare function toSidecarSignalName(signal: number): string;
 export interface LocalCompatMount {
     path: string;
@@ -89,6 +89,21 @@ export declare class NativeSidecarKernelProxy {
     get zombieTimerCount(): number;
     registerCommandGuestPaths(commandGuestPaths: ReadonlyMap<string, string>): void;
     dispose(): Promise<void>;
+    /** Test-only snapshot of the per-VM tracking collection sizes. */
+    __trackingSizesForTest(): {
+        trackedProcesses: number;
+        trackedProcessesById: number;
+        signalStates: number;
+        signalRefreshes: number;
+        localMounts: number;
+    };
+    /** Test-only handle to a tracked entry so its listener Sets can be inspected. */
+    __trackedEntryForTest(pid: number): {
+        onStdout: ReadonlySet<unknown>;
+        onStderr: ReadonlySet<unknown>;
+    } | undefined;
+    /** Test-only join point for in-flight signal-state refreshes. */
+    __awaitSignalRefreshesForTest(): Promise<void>;
     exec(command: string, options?: KernelExecOptions): Promise<KernelExecResult>;
     execArgv(command: string, args?: readonly string[], options?: KernelExecOptions): Promise<KernelExecResult>;
     spawn(command: string, args: string[], options?: KernelSpawnOptions): ManagedProcess;
@@ -130,6 +145,7 @@ export declare class NativeSidecarKernelProxy {
     private startTrackedProcess;
     private runEventPump;
     private finishProcess;
+    private releaseProcessTrackingAfterDrain;
     private waitForTrackedProcess;
     private signalProcess;
     private flushPendingStdin;

package/dist/sidecar/rpc-client.js

@@ -273,6 +273,34 @@ export class NativeSidecarKernelProxy {
         }
         await this.eventPump.catch(() => { });
         await this.onDispose?.().catch(() => { });
+        // Drop all per-VM tracking state so a disposed proxy retains nothing.
+        for (const entry of this.trackedProcesses.values()) {
+            entry.onStdout.clear();
+            entry.onStderr.clear();
+        }
+        this.trackedProcesses.clear();
+        this.trackedProcessesById.clear();
+        this.signalStates.clear();
+        this.signalRefreshes.clear();
+        this.localMounts.length = 0;
+    }
+    /** Test-only snapshot of the per-VM tracking collection sizes. */
+    __trackingSizesForTest() {
+        return {
+            trackedProcesses: this.trackedProcesses.size,
+            trackedProcessesById: this.trackedProcessesById.size,
+            signalStates: this.signalStates.size,
+            signalRefreshes: this.signalRefreshes.size,
+            localMounts: this.localMounts.length,
+        };
+    }
+    /** Test-only handle to a tracked entry so its listener Sets can be inspected. */
+    __trackedEntryForTest(pid) {
+        return this.trackedProcesses.get(pid);
+    }
+    /** Test-only join point for in-flight signal-state refreshes. */
+    async __awaitSignalRefreshesForTest() {
+        await Promise.allSettled([...this.signalRefreshes.values()]);
     }
     async exec(command, options) {
         if (!this.commands.has("sh")) {
@@ -1226,8 +1254,7 @@ export class NativeSidecarKernelProxy {
         const vmId = this.vm.vmId;
         while (!this.disposed) {
             try {
-                const event = await this.client.waitForEvent((frame) => frame.ownership.scope === "vm" &&
-                    frame.ownership.vm_id === vmId, undefined, { signal: this.eventPumpAbortController.signal });
+                const event = await this.client.waitForEvent((frame) => frame.ownership.scope === "vm" && frame.ownership.vm_id === vmId, undefined, { signal: this.eventPumpAbortController.signal });
                 if (event.payload.type === "process_output") {
                     const entry = this.trackedProcessesById.get(event.payload.process_id);
                     if (!entry) {
@@ -1254,7 +1281,6 @@ export class NativeSidecarKernelProxy {
                         continue;
                     }
                     void this.refreshProcessSnapshot().catch(() => { });
-                    this.signalRefreshes.delete(entry.pid);
                     this.finishProcess(entry, event.payload.exit_code);
                 }
             }
@@ -1286,6 +1312,25 @@ export class NativeSidecarKernelProxy {
         entry.exitTime = Date.now();
         this.updateTrackedProcessSnapshot(entry);
         entry.resolveWait(exitCode);
+        // Release per-process tracking now that the process has terminated so these
+        // maps/Sets don't grow without bound. Defer the release until trailing
+        // output has drained: `wait()`'s drain and late `process_output` events
+        // still need the entry + its listeners during the drain window. The exited
+        // record lives on in `processes` for listing.
+        void this.releaseProcessTrackingAfterDrain(entry);
+    }
+    async releaseProcessTrackingAfterDrain(entry) {
+        try {
+            await this.drainTrailingProcessOutput(entry);
+        }
+        finally {
+            this.trackedProcesses.delete(entry.pid);
+            this.trackedProcessesById.delete(entry.processId);
+            this.signalRefreshes.delete(entry.pid);
+            this.signalStates.delete(entry.pid);
+            entry.onStdout.clear();
+            entry.onStderr.clear();
+        }
     }
     waitForTrackedProcess(entry) {
         if (entry.exitCode !== null) {

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export type { AgentCapabilities, AgentInfo, AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentStderrEvent, AgentStderrHandler, AgentRegistryEntry, BatchReadResult, BatchWriteEntry, BatchWriteResult, CreateSessionOptions, DirEntry, McpServerConfig, McpServerConfigLocal, McpServerConfigRemote, MountConfig, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountConfig, NativeMountPluginDescriptor, OverlayMountConfig, PermissionReply, PermissionRequest, PermissionRequestHandler, PlainMountConfig, ProcessTreeNode, PromptResult, ReaddirRecursiveOptions, ResumeSessionOptions, ResumeSessionResult, RootFilesystemConfig, RootLowerInput, SessionConfigOption, SessionEventHandler, SessionInfo, SessionInitData, SessionMode, SessionModeState, SpawnedProcessInfo, } from "./agent-os.js";
+export type { AgentCapabilities, AgentInfo, AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentStderrEvent, AgentStderrHandler, AgentRegistryEntry, BatchReadResult, BatchWriteEntry, BatchWriteResult, CreateSessionOptions, DirEntry, LimitWarning, LimitWarningHandler, McpServerConfig, McpServerConfigLocal, McpServerConfigRemote, MountConfig, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountConfig, NativeMountPluginDescriptor, OverlayMountConfig, PermissionReply, PermissionRequest, PermissionRequestHandler, PlainMountConfig, ProcessTreeNode, PromptResult, ReaddirRecursiveOptions, ResumeSessionOptions, ResumeSessionResult, RootFilesystemConfig, RootLowerInput, SessionConfigOption, SessionEventHandler, SessionInfo, SessionInitData, SessionMode, SessionModeState, SpawnedProcessInfo, } from "./agent-os.js";
 export type { AgentConfig, AgentType } from "./agents.js";
 export type { CronAction, CronEvent, CronEventHandler, CronJob, CronJobInfo, CronJobOptions, ScheduleDriver, ScheduleEntry, ScheduleHandle, } from "./cron/index.js";
 export type { HostDirBackendOptions, HostDirMountPluginConfig, NodeModulesMountConfig, } from "./host-dir-mount.js";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rivet-dev/agentos-core",
-	"version": "0.2.0",
+	"version": "0.2.1",
 	"type": "module",
 	"license": "Apache-2.0",
 	"main": "./dist/index.js",
@@ -56,9 +56,9 @@
 	"dependencies": {
 		"@agentos-software/common": "0.3.0-rc.2",
 		"@aws-sdk/client-s3": "^3.1019.0",
-		"@rivet-dev/agentos-sidecar": "0.2.0",
+		"@rivet-dev/agentos-sidecar": "0.2.1",
 		"@rivetkit/bare-ts": "^0.6.2",
-		"@secure-exec/core": "0.3.1",
+		"@secure-exec/core": "0.3.2",
 		"@xterm/headless": "^6.0.0",
 		"better-sqlite3": "^12.8.0",
 		"croner": "^10.0.1",
@@ -79,8 +79,8 @@
 		"@copilotkit/llmock": "^1.6.0",
 		"@rivet-dev/agentos-sandbox": "link:../agentos-sandbox",
 		"@agentos-software/git": "0.3.0-rc.2",
-		"@secure-exec/google-drive": "0.3.1",
-		"@secure-exec/s3": "0.3.1",
+		"@secure-exec/google-drive": "0.3.2",
+		"@secure-exec/s3": "0.3.2",
 		"@mariozechner/pi-coding-agent": "^0.60.0",
 		"@agentos-software/claude-code": "0.0.0-nathan-binding-workspace.9be0a88",
 		"@agentos-software/codex-cli": "0.0.0-codex-claude-runtime-fixes.9cbef3a",