@rivet-dev/agentos-core 0.2.13 → 0.2.15

package/dist/agentos-package.d.ts

@@ -3,7 +3,7 @@
  *
  * A package is a self-contained directory produced by `@rivet-dev/agentos-toolchain
  * pack`. The HOST no longer projects it: the client forwards only the package
- * directory over the wire and the secure-exec sidecar owns the `/opt/agentos`
+ * directory over the wire and the agentos sidecar owns the `/opt/agentos`
  * projection. Package metadata lives in `<dir>/agentos-package.json`.
  *
  * This module is therefore only the client-facing package-dir surface plus the

package/dist/agentos-package.js

@@ -3,7 +3,7 @@
  *
  * A package is a self-contained directory produced by `@rivet-dev/agentos-toolchain
  * pack`. The HOST no longer projects it: the client forwards only the package
- * directory over the wire and the secure-exec sidecar owns the `/opt/agentos`
+ * directory over the wire and the agentos sidecar owns the `/opt/agentos`
  * projection. Package metadata lives in `<dir>/agentos-package.json`.
  *
  * This module is therefore only the client-facing package-dir surface plus the

package/dist/base-filesystem.js

@@ -2,13 +2,13 @@
  * The base VM environment, baked in as a constant (verbatim from the single
  * `base-filesystem.json` the sidecar embeds). The host no longer reads that JSON
  * — the sidecar owns the base filesystem, and there is exactly one committed copy
- * of it (`secure-exec/crates/vfs/assets/base-filesystem.json`). Regenerate both
+ * of it (`agentos/crates/vfs/assets/base-filesystem.json`). Regenerate both
  * this constant and that file together with the build-tools snapshot script.
  */
 const BASE_ENVIRONMENT = Object.freeze({
     CHARSET: "UTF-8",
     HOME: "/home/agentos",
-    HOSTNAME: "secure-exec",
+    HOSTNAME: "agentos",
     LANG: "C.UTF-8",
     LC_COLLATE: "C",
     LOGNAME: "agentos",

package/dist/code-execution.d.ts

@@ -0,0 +1,70 @@
+export interface CodeExecutionSpawnOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    stdin?: string | Uint8Array;
+    streamStdin?: boolean;
+    captureStdio?: boolean;
+}
+export interface CodeExecutionProcessOutput {
+    pid: number;
+    stream: "stdout" | "stderr";
+    data: Uint8Array;
+}
+export interface CodeExecutionVm {
+    spawn(command: string, args: string[], options?: CodeExecutionSpawnOptions): {
+        pid: number;
+    };
+    onProcessOutput(pid: number, handler: (event: CodeExecutionProcessOutput) => void): () => void;
+    waitProcess(pid: number): Promise<number>;
+    writeProcessStdin(pid: number, data: string | Uint8Array): Promise<void>;
+    closeProcessStdin(pid: number): Promise<void>;
+    killProcess(pid: number): void;
+    stopProcess(pid: number): void;
+}
+export interface CodeExecutionOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    argv?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    onStdout?: (chunk: string) => void;
+    onStderr?: (chunk: string) => void;
+}
+export interface CodeExecutionResult {
+    success: boolean;
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export interface GuestError {
+    name: string;
+    message: string;
+    stack?: string;
+}
+export type CodeEvaluationResult<T> = {
+    success: true;
+    exitCode: 0;
+    value: T;
+    stdout: string;
+    stderr: string;
+} | {
+    success: false;
+    exitCode: number;
+    error: GuestError;
+    stdout: string;
+    stderr: string;
+};
+export interface CodeProcess {
+    readonly pid: number;
+    writeStdin(data: string | Uint8Array): Promise<void>;
+    closeStdin(): Promise<void>;
+    kill(signal?: "SIGTERM" | "SIGKILL"): void;
+    wait(): Promise<CodeExecutionResult>;
+}
+export interface SpawnCodeProcessOptions extends CodeExecutionOptions {
+    onComplete?: () => Promise<void>;
+    streamStdin?: boolean;
+}
+export declare function spawnCodeProcess(vm: CodeExecutionVm, command: string, args: string[], options?: SpawnCodeProcessOptions): CodeProcess;
+export declare function executeArgv(vm: CodeExecutionVm, command: string, args: string[], options?: SpawnCodeProcessOptions): Promise<CodeExecutionResult>;

package/dist/code-execution.js

@@ -0,0 +1,115 @@
+function toSpawnOptions(options) {
+    return {
+        cwd: options.cwd,
+        env: options.env,
+        stdin: options.stdin,
+        streamStdin: options.streamStdin ?? true,
+        captureStdio: true,
+    };
+}
+export function spawnCodeProcess(vm, command, args, options = {}) {
+    if (options.signal?.aborted) {
+        throw abortReason(options.signal);
+    }
+    if (options.timeoutMs !== undefined &&
+        (!Number.isFinite(options.timeoutMs) || options.timeoutMs < 0)) {
+        throw new RangeError("timeoutMs must be a finite, non-negative number");
+    }
+    const { pid } = vm.spawn(command, args, toSpawnOptions(options));
+    const stdoutDecoder = new TextDecoder();
+    const stderrDecoder = new TextDecoder();
+    let stdout = "";
+    let stderr = "";
+    let callbackError;
+    let aborted = false;
+    let finalized = false;
+    let waitPromise;
+    const unsubscribeOutput = vm.onProcessOutput(pid, (event) => {
+        try {
+            if (event.stream === "stdout") {
+                const text = stdoutDecoder.decode(event.data, { stream: true });
+                stdout += text;
+                options.onStdout?.(text);
+            }
+            else {
+                const text = stderrDecoder.decode(event.data, { stream: true });
+                stderr += text;
+                options.onStderr?.(text);
+            }
+        }
+        catch (error) {
+            callbackError ??= error;
+            vm.killProcess(pid);
+        }
+    });
+    const abort = () => {
+        aborted = true;
+        vm.killProcess(pid);
+    };
+    options.signal?.addEventListener("abort", abort, { once: true });
+    const timeout = options.timeoutMs === undefined
+        ? undefined
+        : setTimeout(() => vm.killProcess(pid), options.timeoutMs);
+    const finalize = async () => {
+        if (finalized)
+            return;
+        finalized = true;
+        unsubscribeOutput();
+        options.signal?.removeEventListener("abort", abort);
+        if (timeout !== undefined)
+            clearTimeout(timeout);
+        stdout += stdoutDecoder.decode();
+        stderr += stderrDecoder.decode();
+        await options.onComplete?.();
+    };
+    const wait = () => {
+        waitPromise ??= (async () => {
+            let exitCode;
+            try {
+                exitCode = await vm.waitProcess(pid);
+            }
+            catch (waitError) {
+                try {
+                    await finalize();
+                }
+                catch (cleanupError) {
+                    console.error("[agentos] process cleanup also failed after waitProcess rejected:", cleanupError);
+                }
+                throw waitError;
+            }
+            await finalize();
+            if (aborted && options.signal)
+                throw abortReason(options.signal);
+            if (callbackError !== undefined)
+                throw callbackError;
+            return {
+                success: exitCode === 0,
+                exitCode,
+                stdout,
+                stderr,
+            };
+        })();
+        return waitPromise;
+    };
+    return {
+        pid,
+        writeStdin: (data) => vm.writeProcessStdin(pid, data),
+        closeStdin: () => vm.closeProcessStdin(pid),
+        kill: (signal) => {
+            if (signal === "SIGKILL")
+                vm.killProcess(pid);
+            else
+                vm.stopProcess(pid);
+        },
+        wait,
+    };
+}
+function abortReason(signal) {
+    return signal.reason ?? new DOMException("Execution aborted", "AbortError");
+}
+export async function executeArgv(vm, command, args, options = {}) {
+    return spawnCodeProcess(vm, command, args, {
+        ...options,
+        streamStdin: false,
+    }).wait();
+}

package/dist/index.d.ts

@@ -1,9 +1,11 @@
 export { AgentOs, AgentOsSidecar } from "./agent-os.js";
+export type * from "./language-execution.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { binding, MAX_BINDING_DESCRIPTION_LENGTH, bindings, validateBindings, } from "./bindings.js";
+export type { Binding, BindingExample, Bindings } from "./bindings.js";
 export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, bindingSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, bindingsSchema, } from "./options-schema.js";
-export { createSnapshotExport, } from "./layers.js";
+export { createSnapshotExport } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { KernelError } from "./runtime-compat.js";

package/dist/index.js

@@ -4,7 +4,7 @@ export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriv
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
 export { binding, MAX_BINDING_DESCRIPTION_LENGTH, bindings, validateBindings, } from "./bindings.js";
 export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, bindingSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, bindingsSchema, } from "./options-schema.js";
-export { createSnapshotExport, } from "./layers.js";
+export { createSnapshotExport } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { KernelError } from "./runtime-compat.js";

package/dist/language-execution.d.ts

@@ -0,0 +1,170 @@
+import type { JsonValue } from "./session-api.js";
+export type ExecutionSignal = "SIGHUP" | "SIGINT" | "SIGQUIT" | "SIGTERM" | "SIGKILL" | "SIGSTOP" | "SIGCONT" | "SIGUSR1" | "SIGUSR2";
+export interface LanguageExecutionOptions {
+    contextId?: string;
+    cwd?: string;
+    env?: Record<string, string>;
+    args?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    pty?: {
+        cols?: number;
+        rows?: number;
+    };
+    signal?: AbortSignal;
+    onStdout?: (chunk: Uint8Array) => void;
+    onStderr?: (chunk: Uint8Array) => void;
+    output?: ExecutionOutputOptions;
+}
+export type OutputCapture = "none" | "stderr" | "all";
+export interface ExecutionOutputOptions {
+    capture?: OutputCapture;
+    retainEvents?: boolean;
+}
+export interface InlineExecutionOptions extends LanguageExecutionOptions {
+    inputs?: Record<string, JsonValue>;
+}
+export interface JavaScriptExecutionOptions extends InlineExecutionOptions {
+    format?: "module" | "commonjs";
+    filePath?: string;
+}
+export type JavaScriptEvaluationOptions = JavaScriptExecutionOptions;
+export interface TypeScriptExecutionOptions extends InlineExecutionOptions {
+    filePath?: string;
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+}
+export type TypeScriptEvaluationOptions = TypeScriptExecutionOptions;
+export interface TypeScriptFileExecutionOptions extends LanguageExecutionOptions {
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+}
+export interface TypeScriptCheckOptions {
+    contextId?: string;
+    cwd?: string;
+    filePath?: string;
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    output?: ExecutionOutputOptions;
+}
+export interface NpmProjectInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    frozen?: boolean;
+}
+export interface NpmPackageInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    dev?: boolean;
+    global?: boolean;
+}
+export interface PythonInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    upgrade?: boolean;
+    requirementsFile?: string;
+    indexUrl?: string;
+    extraIndexUrls?: string[];
+}
+export type ContextState = "idle" | "running" | "resetting" | "deleting" | "failed";
+export type ExecutionOutcome = "succeeded" | "failed" | "cancelled" | "timed_out";
+export interface ContextDescriptor {
+    contextId: string;
+    state: ContextState;
+    language?: "javascript" | "python";
+    createdAtMs: number;
+    lastStartedAtMs?: number;
+    lastCompletedAtMs?: number;
+}
+export interface ProcessDescriptor {
+    pid: number;
+    state: "running" | "exited";
+    language?: "javascript" | "python";
+    command?: string;
+    startedAtMs: number;
+}
+export interface ProcessExit {
+    pid: number;
+    outcome: "exited" | "signalled" | "timed_out";
+    exitCode?: number;
+    signal?: ExecutionSignal;
+}
+export interface SpawnOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    args?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    pty?: {
+        cols?: number;
+        rows?: number;
+    };
+    signal?: AbortSignal;
+    onStdout?: (chunk: Uint8Array) => void;
+    onStderr?: (chunk: Uint8Array) => void;
+    output?: {
+        retainEvents?: boolean;
+    };
+}
+export type LanguageSpawnOptions = SpawnOptions;
+export interface ExecutionErrorData {
+    code: string;
+    name: string;
+    message: string;
+    stack?: string;
+    details?: JsonValue;
+}
+interface CodeExecutionResultBase {
+    exitCode?: number;
+    stdout?: string;
+    stderr?: string;
+    stdoutTruncated?: boolean;
+    stderrTruncated?: boolean;
+}
+type ExecutionResultOutcome<TIdentity> = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+} & TIdentity) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+} & TIdentity);
+export type CodeExecutionResult = ExecutionResultOutcome<Record<never, never>>;
+export type CodeEvaluationResult<T = JsonValue> = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+    value: T;
+}) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+    value?: never;
+});
+export interface TypeScriptDiagnostic {
+    code: number;
+    category: "error" | "warning" | "suggestion" | "message";
+    message: string;
+    filePath?: string;
+    line?: number;
+    column?: number;
+}
+export type TypeScriptCheckResult = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+    hasErrors: boolean;
+    diagnostics: TypeScriptDiagnostic[];
+}) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+    hasErrors?: never;
+    diagnostics: TypeScriptDiagnostic[];
+});
+export interface ProcessOutputEvent<TChunk = Uint8Array> {
+    pid: number;
+    sequence: number;
+    channel: "stdout" | "stderr" | "pty";
+    chunk: TChunk;
+    timestampMs: number;
+}
+export interface OutputReplay<TChunk = Uint8Array> {
+    pid: number;
+    events: ProcessOutputEvent<TChunk>[];
+    nextCursor: string;
+    hasMore: boolean;
+    truncated: boolean;
+}
+export {};

package/dist/language-execution.js

@@ -0,0 +1 @@
+export {};

package/dist/options-schema.d.ts

@@ -138,7 +138,7 @@ export declare const agentOsLimitsSchema: z.ZodObject<{
         defaultBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
         maxBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
         maxRegisteredCollections: z.ZodOptional<z.ZodNumber>;
-        maxRegisteredCollectionsPerVm: z.ZodOptional<z.ZodNumber>;
+        maxRegisteredBindingsPerVm: z.ZodOptional<z.ZodNumber>;
         maxBindingsPerCollection: z.ZodOptional<z.ZodNumber>;
         maxBindingSchemaBytes: z.ZodOptional<z.ZodNumber>;
         maxExamplesPerBinding: z.ZodOptional<z.ZodNumber>;
@@ -196,6 +196,11 @@ export declare const agentOsLimitsSchema: z.ZodObject<{
         runnerHeapLimitMb: z.ZodOptional<z.ZodNumber>;
         runnerCpuTimeLimitMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
+    execution: z.ZodOptional<z.ZodObject<{
+        completedTtlMs: z.ZodOptional<z.ZodNumber>;
+        maxCompletedExecutions: z.ZodOptional<z.ZodNumber>;
+        liveExecutionWarningThreshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
     process: z.ZodOptional<z.ZodObject<{
         maxSpawnFileActions: z.ZodOptional<z.ZodNumber>;
         maxSpawnFileActionBytes: z.ZodOptional<z.ZodNumber>;
@@ -488,7 +493,7 @@ export declare const agentOsOptionFieldSchemas: {
             defaultBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
             maxBindingTimeoutMs: z.ZodOptional<z.ZodNumber>;
             maxRegisteredCollections: z.ZodOptional<z.ZodNumber>;
-            maxRegisteredCollectionsPerVm: z.ZodOptional<z.ZodNumber>;
+            maxRegisteredBindingsPerVm: z.ZodOptional<z.ZodNumber>;
             maxBindingsPerCollection: z.ZodOptional<z.ZodNumber>;
             maxBindingSchemaBytes: z.ZodOptional<z.ZodNumber>;
             maxExamplesPerBinding: z.ZodOptional<z.ZodNumber>;
@@ -546,6 +551,11 @@ export declare const agentOsOptionFieldSchemas: {
             runnerHeapLimitMb: z.ZodOptional<z.ZodNumber>;
             runnerCpuTimeLimitMs: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
+        execution: z.ZodOptional<z.ZodObject<{
+            completedTtlMs: z.ZodOptional<z.ZodNumber>;
+            maxCompletedExecutions: z.ZodOptional<z.ZodNumber>;
+            liveExecutionWarningThreshold: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
         process: z.ZodOptional<z.ZodObject<{
             maxSpawnFileActions: z.ZodOptional<z.ZodNumber>;
             maxSpawnFileActionBytes: z.ZodOptional<z.ZodNumber>;

package/dist/options-schema.js

@@ -128,7 +128,7 @@ export const agentOsLimitsSchema = z
         defaultBindingTimeoutMs: nonNegativeInteger.optional(),
         maxBindingTimeoutMs: nonNegativeInteger.optional(),
         maxRegisteredCollections: positiveInteger.optional(),
-        maxRegisteredCollectionsPerVm: positiveInteger.optional(),
+        maxRegisteredBindingsPerVm: positiveInteger.optional(),
         maxBindingsPerCollection: positiveInteger.optional(),
         maxBindingSchemaBytes: positiveInteger.optional(),
         maxExamplesPerBinding: nonNegativeInteger.optional(),
@@ -204,6 +204,14 @@ export const agentOsLimitsSchema = z
     })
         .strict()
         .optional(),
+    execution: z
+        .object({
+        completedTtlMs: positiveInteger.optional(),
+        maxCompletedExecutions: positiveInteger.optional(),
+        liveExecutionWarningThreshold: positiveInteger.optional(),
+    })
+        .strict()
+        .optional(),
     process: z
         .object({
         maxSpawnFileActions: positiveInteger.optional(),

package/dist/packages.d.ts

@@ -1,7 +1,7 @@
 import type { SoftwarePackageRef } from "./agentos-package.js";
 /**
  * Input type for the `software` option. Software is a self-contained package
- * directory that the secure-exec sidecar materializes into the `/opt/agentos`
+ * directory that the agentos sidecar materializes into the `/opt/agentos`
  * projection. Accepts a package-dir ref or an array of refs for meta-packages.
  */
 export type SoftwareEntry = SoftwarePackageRef;

package/dist/runtime-compat.js

@@ -1363,7 +1363,7 @@ class NativeKernel {
             throw new Error("kernel is not ready");
         }
         const sidecarMounts = commandDirs.map((commandDir, index) => serializeMountConfigForSidecar({
-            path: `/__secure_exec/commands/${index}`,
+            path: `/__agentos/commands/${index}`,
             readOnly: true,
             plugin: {
                 id: "host_dir",

package/dist/sidecar/agentos-protocol.d.ts

@@ -236,13 +236,15 @@ export declare function writeAcpCloseSessionRequest(bc: bare.ByteCursor, x: AcpC
  * Resume a session that exists in durable storage but is not live in the current
  * VM (e.g. after a Rivet actor slept and woke with a fresh VM). The sidecar runs
  * the stateless resume state machine (native session/load when the agent supports
- * it, else a fresh session/new + transcript continuation preamble). `cwd`/`env`
- * describe the fresh adapter launch used by the fallback tier. `transcriptPath`,
- * when present, is a guest-readable path the fallback preamble points the agent at.
+ * it, else a fresh session/new + transcript continuation preamble). `runtime`,
+ * `cwd`, and `env` describe the fresh adapter launch used by the fallback tier.
+ * `transcriptPath`, when present, is a guest-readable path the fallback preamble
+ * points the agent at.
  */
 export type AcpResumeSessionRequest = {
     readonly sessionId: string;
     readonly agentType: string;
+    readonly runtime: AcpRuntimeKind;
     readonly transcriptPath: string | null;
     readonly cwd: string;
     readonly additionalDirectories: readonly string[];

package/dist/sidecar/agentos-protocol.js

@@ -373,6 +373,7 @@ export function readAcpResumeSessionRequest(bc) {
     return {
         sessionId: bare.readString(bc),
         agentType: bare.readString(bc),
+        runtime: readAcpRuntimeKind(bc),
         transcriptPath: read2(bc),
         cwd: bare.readString(bc),
         additionalDirectories: read0(bc),
@@ -383,6 +384,7 @@ export function readAcpResumeSessionRequest(bc) {
 export function writeAcpResumeSessionRequest(bc, x) {
     bare.writeString(bc, x.sessionId);
     bare.writeString(bc, x.agentType);
+    writeAcpRuntimeKind(bc, x.runtime);
     write2(bc, x.transcriptPath);
     bare.writeString(bc, x.cwd);
     write0(bc, x.additionalDirectories);

package/dist/sidecar/rpc-client.js

@@ -361,16 +361,16 @@ export class NativeSidecarKernelProxy {
         const parsedCommand = parseSimpleExecCommand(command);
         const runAndCapture = async (proc, stdinOverride, readExitCode) => {
             if (stdinOverride !== undefined) {
-                proc.writeStdin(stdinOverride);
+                await proc.writeStdin(stdinOverride);
             }
             else if (options?.stdin !== undefined) {
-                proc.writeStdin(options.stdin);
+                await proc.writeStdin(options.stdin);
             }
             // `kernel.exec()` is a non-interactive run-to-completion API: when the
             // caller does not opt into a streaming stdin handle, the guest process
             // should observe EOF after any provided input so commands like
             // `node -e ...` do not linger behind an inherited open stdin pipe.
-            proc.closeStdin();
+            await proc.closeStdin();
             const waitPromise = proc.wait();
             const shellExitCode = typeof options?.timeout === "number"
                 ? await new Promise((resolve) => {
@@ -438,9 +438,9 @@ export class NativeSidecarKernelProxy {
         const effectiveCwd = options?.cwd ?? this.defaultExecCwd ?? this.cwd;
         const runAndCapture = async (proc) => {
             if (options?.stdin !== undefined) {
-                proc.writeStdin(options.stdin);
+                await proc.writeStdin(options.stdin);
             }
-            proc.closeStdin();
+            await proc.closeStdin();
             const waitPromise = proc.wait();
             const exitCode = typeof options?.timeout === "number"
                 ? await new Promise((resolve) => {
@@ -524,9 +524,9 @@ export class NativeSidecarKernelProxy {
             rejectWait,
             onStdout: new Set(options?.onStdout ? [options.onStdout] : []),
             onStderr: new Set(options?.onStderr ? [options.onStderr] : []),
-            pendingStdin: [],
+            pendingStdin: options?.stdin === undefined ? [] : [options.stdin],
             stdinFlushPromise: null,
-            pendingCloseStdin: false,
+            pendingCloseStdin: !options?.streamStdin,
             pendingKillSignal: null,
             waitWithFallbackPromise: null,
             hostExitObservedAt: null,
@@ -1001,7 +1001,9 @@ export class NativeSidecarKernelProxy {
             });
         const restoreRawMode = stdin.isTTY && typeof stdin.setRawMode === "function";
         const onStdinData = (data) => {
-            shell.write(data);
+            void shell.write(data).catch((error) => {
+                console.error("[agentos] failed to forward terminal stdin:", error);
+            });
         };
         const onResize = () => {
             shell.resize(stdout.columns, stdout.rows);

package/dist/types.d.ts

@@ -1,4 +1,5 @@
-export type { AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentExitEvent, AgentExitHandler, AgentRestartOutcome, AgentStderrEvent, AgentStderrHandler, AgentRegistryEntry, BatchReadResult, BatchWriteEntry, BatchWriteResult, DirEntry, DynamicMountDescriptor, ExportRootFilesystemOptions, HttpRequest, HttpResponse, LimitWarning, LimitWarningHandler, MountConfig, MountInfo, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountConfig, NativeMountPluginDescriptor, NativeRootFilesystemConfig, OverlayMountConfig, OverlayRootFilesystemConfig, PlainMountConfig, ProcessTreeNode, ProcessExit, ProcessOutput, ReaddirEntry, ReaddirRecursiveOptions, RootFilesystemConfig, RootLowerInput, SpawnedProcessInfo, SpawnOptions, ShellData, ShellExit, ShellOptions, } from "./agent-os.js";
+export type { AgentExitEvent, AgentExitHandler, AgentOsCreateSidecarOptions, AgentOsLimits, AgentOsOptions, AgentOsSharedSidecarOptions, AgentOsSidecarConfig, AgentOsSidecarDescription, AgentRegistryEntry, AgentRestartOutcome, AgentStderrEvent, AgentStderrHandler, BatchReadResult, BatchWriteEntry, BatchWriteResult, DirEntry, DynamicMountDescriptor, ExportRootFilesystemOptions, HttpRequest, HttpResponse, LimitWarning, LimitWarningHandler, MountConfig, MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, MountInfo, NativeMountConfig, NativeMountPluginDescriptor, NativeRootFilesystemConfig, OverlayMountConfig, OverlayRootFilesystemConfig, PlainMountConfig, ProcessOutput, ProcessTreeNode, ReaddirEntry, ReaddirRecursiveOptions, RootFilesystemConfig, RootLowerInput, ShellData, ShellExit, ShellOptions, } from "./agent-os.js";
+export type { CodeEvaluationResult, CodeExecutionResult, ContextDescriptor, ContextState, ExecutionErrorData, ExecutionSignal, InlineExecutionOptions, JavaScriptEvaluationOptions, JavaScriptExecutionOptions, LanguageExecutionOptions, LanguageSpawnOptions, NpmPackageInstallOptions, NpmProjectInstallOptions, OutputCapture, OutputReplay, ProcessDescriptor, ProcessExit, ProcessOutputEvent, PythonInstallOptions, SpawnOptions, TypeScriptCheckOptions, TypeScriptCheckResult, TypeScriptDiagnostic, TypeScriptEvaluationOptions, TypeScriptExecutionOptions, TypeScriptFileExecutionOptions, } from "./language-execution.js";
 export type * from "./session-api.js";
 /**
  * An agent type id — the `name` of an `/opt/agentos` agent package manifest
@@ -7,11 +8,11 @@ export type * from "./session-api.js";
  * passes only the name, so any manifest `name` is a valid agent type.
  */
 export type AgentType = string;
+export type { AgentBlock, PackageDescriptor, PackageRef, SoftwarePackageRef, } from "./agentos-package.js";
+export type { Binding, BindingExample, Bindings } from "./bindings.js";
 export type { CronAction, CronActionInfo, CronEvent, CronEventHandler, CronJob, CronJobInfo, CronJobOptions, ScheduleDriver, ScheduleEntry, ScheduleHandle, } from "./cron/index.js";
 export type { HostDirBackendOptions, HostDirMountPluginConfig, NodeModulesMountConfig, } from "./host-dir-mount.js";
-export type { Binding, BindingExample, Bindings } from "./bindings.js";
 export type { FilesystemSnapshotExport, LayerHandle, LayerStore, OverlayFilesystemMode, RootSnapshotExport, SnapshotImportSource, SnapshotLayerHandle, WritableLayerHandle, } from "./layers.js";
 export type { SoftwareInput, SoftwareRoot } from "./packages.js";
-export type { AgentBlock, PackageDescriptor, PackageRef, SoftwarePackageRef, } from "./agentos-package.js";
 export type { ChildProcessPermissions, ConnectTerminalOptions, EnvPermissions, ExecOptions, ExecResult, FsPermissionRule, FsPermissions, KernelExecOptions, KernelExecResult, KernelSpawnOptions, NetworkAccessRequest, NetworkPermissions, OpenShellOptions, PatternPermissionRule, PermissionDecision, PermissionMode, Permissions, ProcessInfo, RulePermissions, StdioChannel, TimingMitigation, VirtualDirEntry, VirtualFileSystem, VirtualStat, } from "./runtime.js";
 export type { AgentOsSandboxClient, AgentOsSandboxClientOptions, AgentOsSandboxCommonOptions, AgentOsSandboxInput, AgentOsSandboxOptions, AgentOsSandboxProcessInfo, AgentOsSandboxProcessLogs, AgentOsSandboxProcessResult, AgentOsSandboxProvider, AgentOsSandboxProviderOptions, SandboxMountPluginConfig, } from "./sandbox.js";