@rivet-dev/agentos-core 0.2.20 → 0.2.21

package/dist/sandbox.js

@@ -1,8 +1,5 @@
 import { z } from "zod";
 const sandboxDisposeHooks = Symbol("agentos.sandboxDisposeHooks");
-function binding(def) {
-    return def;
-}
 function normalizeHeaders(headers) {
     if (!headers) {
         return undefined;
@@ -47,137 +44,149 @@ export function createSandboxFs(input) {
         },
     };
 }
-export function createSandboxBindings(input) {
+/**
+ * Identity helper so each `execute` below infers its input from its own
+ * `inputSchema`. Callers writing an object literal get that from
+ * `AgentOs.create()`; code that builds a collection programmatically has no
+ * contextual type to infer from, so it needs this.
+ */
+function hostFunction(definition) {
+    return definition;
+}
+export function createSandboxHostFunctions(input) {
     const options = input;
     const { client } = options;
     return {
-        name: "sandbox",
-        description: "Execute commands and manage processes in a remote sandbox environment.",
-        bindings: {
-            "run-command": binding({
-                description: "Run a command synchronously in the sandbox and return its stdout, stderr, and exit code.",
-                inputSchema: z.object({
-                    command: z
-                        .string()
-                        .describe("The command to execute (e.g. 'ls', 'python3')."),
-                    args: z.array(z.string()).optional(),
-                    cwd: z.string().optional(),
-                    env: z.record(z.string(), z.string()).optional(),
-                    timeoutMs: z.number().optional(),
-                }),
-                timeout: 120_000,
-                execute: async (input) => {
-                    const result = await client.runProcess(input);
-                    return {
-                        stdout: result.stdout,
-                        stderr: result.stderr,
-                        exitCode: result.exitCode,
-                        timedOut: result.timedOut,
-                        durationMs: result.durationMs,
-                    };
-                },
-            }),
-            "create-process": binding({
-                description: "Start a long-running background process in the sandbox. Returns a process ID for later management.",
-                inputSchema: z.object({
-                    command: z.string(),
-                    args: z.array(z.string()).optional(),
-                    cwd: z.string().optional(),
-                    env: z.record(z.string(), z.string()).optional(),
-                }),
-                execute: async (input) => {
-                    const proc = await client.createProcess(input);
-                    return {
-                        id: proc.id,
-                        command: proc.command,
-                        args: proc.args,
-                        status: proc.status,
-                        pid: proc.pid,
-                    };
-                },
-            }),
-            "list-processes": binding({
-                description: "List all processes running in the sandbox.",
-                inputSchema: z.object({}),
-                execute: async () => {
-                    const result = await client.listProcesses();
-                    return {
-                        processes: result.processes.map((p) => ({
-                            id: p.id,
-                            command: p.command,
-                            args: p.args,
-                            status: p.status,
-                            exitCode: p.exitCode,
-                            pid: p.pid,
-                        })),
-                    };
-                },
-            }),
-            "stop-process": binding({
-                description: "Gracefully stop a running process in the sandbox.",
-                inputSchema: z.object({ id: z.string() }),
-                execute: async (input) => {
-                    const proc = await client.stopProcess(input.id);
-                    return {
-                        id: proc.id,
-                        status: proc.status,
-                        exitCode: proc.exitCode,
-                    };
-                },
-            }),
-            "kill-process": binding({
-                description: "Forcefully kill a running process in the sandbox.",
-                inputSchema: z.object({ id: z.string() }),
-                execute: async (input) => {
-                    const proc = await client.killProcess(input.id);
-                    return {
-                        id: proc.id,
-                        status: proc.status,
-                        exitCode: proc.exitCode,
-                    };
-                },
-            }),
-            "get-process-logs": binding({
-                description: "Get stdout/stderr logs from a sandbox process.",
-                inputSchema: z.object({
-                    id: z.string(),
-                    stream: z.enum(["stdout", "stderr", "combined"]).optional(),
-                    tail: z.number().optional(),
-                }),
-                execute: async (input) => {
-                    const result = await client.getProcessLogs(input.id, {
-                        stream: input.stream,
-                        tail: input.tail,
-                    });
-                    return {
-                        logs: result.entries.map((e) => {
-                            const data = e.encoding === "base64"
-                                ? Buffer.from(e.data, "base64").toString("utf-8")
-                                : e.data;
-                            return {
-                                data,
-                                stream: e.stream,
-                                timestampMs: e.timestampMs,
-                            };
-                        }),
-                    };
-                },
-            }),
-            "send-input": binding({
-                description: "Send text input to an interactive sandbox process via stdin.",
-                inputSchema: z.object({
-                    id: z.string(),
-                    data: z.string(),
-                }),
-                execute: async (input) => {
-                    await client.sendProcessInput(input.id, {
-                        data: Buffer.from(input.data, "utf-8").toString("base64"),
-                        encoding: "base64",
-                    });
-                    return { sent: true };
-                },
-            }),
-        },
+        runCommand: hostFunction({
+            inputSchema: z
+                .object({
+                command: z
+                    .string()
+                    .describe("The command to execute (e.g. 'ls', 'python3')."),
+                args: z.array(z.string()).optional(),
+                cwd: z.string().optional(),
+                env: z.record(z.string(), z.string()).optional(),
+                timeoutMs: z.number().optional(),
+            })
+                .describe("Run a command synchronously in the sandbox and return its stdout, stderr, and exit code."),
+            timeout: 120_000,
+            execute: async (input) => {
+                const result = await client.runProcess(input);
+                return {
+                    stdout: result.stdout,
+                    stderr: result.stderr,
+                    exitCode: result.exitCode,
+                    timedOut: result.timedOut,
+                    durationMs: result.durationMs,
+                };
+            },
+        }),
+        createProcess: hostFunction({
+            inputSchema: z
+                .object({
+                command: z.string(),
+                args: z.array(z.string()).optional(),
+                cwd: z.string().optional(),
+                env: z.record(z.string(), z.string()).optional(),
+            })
+                .describe("Start a long-running background process in the sandbox. Returns a process ID for later management."),
+            execute: async (input) => {
+                const proc = await client.createProcess(input);
+                return {
+                    id: proc.id,
+                    command: proc.command,
+                    args: proc.args,
+                    status: proc.status,
+                    pid: proc.pid,
+                };
+            },
+        }),
+        listProcesses: hostFunction({
+            inputSchema: z
+                .object({})
+                .describe("List all processes running in the sandbox."),
+            execute: async () => {
+                const result = await client.listProcesses();
+                return {
+                    processes: result.processes.map((p) => ({
+                        id: p.id,
+                        command: p.command,
+                        args: p.args,
+                        status: p.status,
+                        exitCode: p.exitCode,
+                        pid: p.pid,
+                    })),
+                };
+            },
+        }),
+        stopProcess: hostFunction({
+            inputSchema: z
+                .object({ id: z.string() })
+                .describe("Gracefully stop a running process in the sandbox."),
+            execute: async (input) => {
+                const proc = await client.stopProcess(input.id);
+                return {
+                    id: proc.id,
+                    status: proc.status,
+                    exitCode: proc.exitCode,
+                };
+            },
+        }),
+        killProcess: hostFunction({
+            inputSchema: z
+                .object({ id: z.string() })
+                .describe("Forcefully kill a running process in the sandbox."),
+            execute: async (input) => {
+                const proc = await client.killProcess(input.id);
+                return {
+                    id: proc.id,
+                    status: proc.status,
+                    exitCode: proc.exitCode,
+                };
+            },
+        }),
+        getProcessLogs: hostFunction({
+            inputSchema: z
+                .object({
+                id: z.string(),
+                stream: z.enum(["stdout", "stderr", "combined"]).optional(),
+                tail: z.number().optional(),
+            })
+                .describe("Get stdout/stderr logs from a sandbox process."),
+            execute: async (input) => {
+                const result = await client.getProcessLogs(input.id, {
+                    stream: input.stream,
+                    tail: input.tail,
+                });
+                return {
+                    logs: result.entries.map((e) => {
+                        const data = e.encoding === "base64"
+                            ? Buffer.from(e.data, "base64").toString("utf-8")
+                            : e.data;
+                        return {
+                            data,
+                            stream: e.stream,
+                            timestampMs: e.timestampMs,
+                        };
+                    }),
+                };
+            },
+        }),
+        sendInput: hostFunction({
+            inputSchema: z
+                .object({
+                id: z.string(),
+                data: z.string(),
+            })
+                .describe("Send text input to an interactive sandbox process via stdin."),
+            execute: async (input) => {
+                await client.sendProcessInput(input.id, {
+                    data: Buffer.from(input.data, "utf-8").toString("base64"),
+                    encoding: "base64",
+                });
+                return { sent: true };
+            },
+        }),
     };
 }
 function isProviderOptions(input) {
@@ -187,13 +196,13 @@ function isClientOptions(input) {
     return "client" in input;
 }
 function assertNoLegacySandboxOptions(input) {
-    const legacyKeys = ["mount", "bindings", "path", "basePath"];
+    const legacyKeys = ["mount", "hostFunctions", "path", "basePath"];
     for (const key of legacyKeys) {
         if (key in input) {
             const replacement = key === "path" || key === "basePath" ? "sandboxRoot" : undefined;
             throw new Error(replacement
                 ? `sandbox.${key} has been removed; use sandbox.${replacement} instead.`
-                : `sandbox.${key} has been removed; sandbox mounts and bindings are always enabled.`);
+                : `sandbox.${key} has been removed; sandbox mounts and host functions are always enabled.`);
         }
     }
 }
@@ -257,14 +266,14 @@ export async function resolveSandboxOptions(options) {
                 readOnly: sandboxOptions.readOnly,
             },
         ];
-        const bindings = [
-            ...(expanded.bindings ?? []),
-            createSandboxBindings(sandboxOptions),
-        ];
+        const hostFunctions = {
+            ...expanded.hostFunctions,
+            sandbox: createSandboxHostFunctions(sandboxOptions),
+        };
         return attachSandboxDisposeHooks({
             ...expanded,
             mounts,
-            bindings,
+            hostFunctions,
         }, normalizedSandbox.dispose ? [normalizedSandbox.dispose] : []);
     }
     catch (error) {

package/dist/sidecar/permissions.d.ts

@@ -1,3 +1,7 @@
 import type { PermissionsPolicy } from "@rivet-dev/agentos-runtime-core/vm-config";
 import type { Permissions } from "../runtime-compat.js";
-export declare function serializePermissionsForSidecar(permissions?: Permissions): PermissionsPolicy;
+/**
+ * Serialize only the scopes the caller set. The sidecar owns the defaults, so
+ * an omitted scope, or an omitted policy, takes the sidecar's default.
+ */
+export declare function serializePermissionsForSidecar(permissions?: Permissions): PermissionsPolicy | undefined;

package/dist/sidecar/permissions.js

@@ -20,16 +20,13 @@ function serializePatternScope(scope) {
         })),
     };
 }
+/**
+ * Serialize only the scopes the caller set. The sidecar owns the defaults, so
+ * an omitted scope, or an omitted policy, takes the sidecar's default.
+ */
 export function serializePermissionsForSidecar(permissions) {
     if (!permissions) {
-        return {
-            fs: "deny",
-            network: "deny",
-            childProcess: "deny",
-            process: "deny",
-            env: "deny",
-            binding: "deny",
-        };
+        return undefined;
     }
     return {
         fs: typeof permissions.fs === "string" || !permissions.fs
@@ -47,8 +44,8 @@ export function serializePermissionsForSidecar(permissions) {
         env: typeof permissions.env === "string" || !permissions.env
             ? permissions.env
             : serializePatternScope(permissions.env),
-        binding: typeof permissions.binding === "string" || !permissions.binding
-            ? permissions.binding
-            : serializePatternScope(permissions.binding),
+        hostFunction: typeof permissions.hostFunction === "string" || !permissions.hostFunction
+            ? permissions.hostFunction
+            : serializePatternScope(permissions.hostFunction),
     };
 }

package/dist/sidecar/rpc-client.d.ts

@@ -40,11 +40,11 @@ interface NativeSidecarKernelProxyOptions {
      * `configure_vm` rebuilds the whole VM configuration from each payload, so
      * every runtime mount reconfigure must resend these or a post-boot
      * `mountFs()` silently drops the `/opt/agentos` package projections and
-     * binding shim commands applied at boot.
+     * host-function shim commands applied at boot.
      */
     packages?: Parameters<SidecarProcess["configureVm"]>[2]["packages"];
     packagesMountAt?: string;
-    bindingShimCommands?: string[];
+    hostFunctionShimCommands?: string[];
     commandGuestPaths: ReadonlyMap<string, string>;
     onWasmCommandResolved?: (command: string) => void;
     onDispose?: () => Promise<void>;
@@ -76,7 +76,7 @@ export declare class NativeSidecarKernelProxy {
     private readonly loopbackExemptPorts;
     private packages;
     private readonly packagesMountAt;
-    private readonly bindingShimCommands;
+    private readonly hostFunctionShimCommands;
     private readonly commandDrivers;
     private readonly onWasmCommandResolved;
     private readonly onDispose;

package/dist/sidecar/rpc-client.js

@@ -221,7 +221,7 @@ export class NativeSidecarKernelProxy {
     // later mount reconfigures resend linked packages too, not just boot ones.
     packages;
     packagesMountAt;
-    bindingShimCommands;
+    hostFunctionShimCommands;
     commandDrivers;
     onWasmCommandResolved;
     onDispose;
@@ -260,7 +260,7 @@ export class NativeSidecarKernelProxy {
         this.loopbackExemptPorts = options.loopbackExemptPorts;
         this.packages = options.packages ? [...options.packages] : [];
         this.packagesMountAt = options.packagesMountAt;
-        this.bindingShimCommands = options.bindingShimCommands;
+        this.hostFunctionShimCommands = options.hostFunctionShimCommands;
         this.commandDrivers = buildCommandMap(options.commandGuestPaths);
         this.onWasmCommandResolved = options.onWasmCommandResolved;
         this.onDispose = options.onDispose;
@@ -1212,8 +1212,8 @@ export class NativeSidecarKernelProxy {
                 return;
             }
             // Rust `configure_vm` rebuilds the whole VM configuration from this
-            // payload, so resend the boot packages / binding shim commands too —
-            // omitting them here strips the `/opt/agentos` projections and binding
+            // payload, so resend the boot packages and host-function shim commands too.
+            // Omitting them here strips the `/opt/agentos` projections and host-function
             // shims from the VM as a side effect of a runtime mount change.
             await this.client.configureVm(this.session, this.vm, {
                 mounts: this.desiredSidecarMounts(),
@@ -1222,7 +1222,7 @@ export class NativeSidecarKernelProxy {
                 loopbackExemptPorts: this.loopbackExemptPorts,
                 packages: this.packages,
                 packagesMountAt: this.packagesMountAt,
-                bindingShimCommands: this.bindingShimCommands,
+                hostFunctionShimCommands: this.hostFunctionShimCommands,
             });
         };
         const previous = this.mountReconfigurePromise ?? Promise.resolve();
@@ -1370,7 +1370,7 @@ export class NativeSidecarKernelProxy {
         this.updateTrackedProcessSnapshot(entry);
         void this.refreshProcessSnapshot().catch(() => { });
         // Signal metadata is advisory and must not hold process startup behind a
-        // second sidecar RPC. Very short binding commands can finish while the
+        // second sidecar RPC. Very short hostFunction commands can finish while the
         // original execute response is still in flight; synchronously refreshing
         // here creates a circular wait with their output/exit delivery.
         this.scheduleSignalStateRefresh(entry);

package/dist/types.d.ts

@@ -9,9 +9,9 @@ export type * from "./session-api.js";
  */
 export type AgentType = string;
 export type { AgentBlock, PackageDescriptor, PackageRef, SoftwarePackageRef, } from "./agentos-package.js";
-export type { Binding, BindingExample, Bindings } from "./bindings.js";
 export type { CronAction, CronActionInfo, CronEvent, CronEventHandler, CronJob, CronJobInfo, CronJobOptions, ScheduleDriver, ScheduleEntry, ScheduleHandle, } from "./cron/index.js";
 export type { HostDirBackendOptions, HostDirMountPluginConfig, NodeModulesMountConfig, } from "./host-dir-mount.js";
+export type { HostFunction, HostFunctionCollection, HostFunctionCollections, HostFunctionExample, HostFunctionSchemas, ResolvedHostFunctions, } from "@rivet-dev/agentos-runtime-core/host-functions";
 export type { FilesystemSnapshotExport, LayerHandle, LayerStore, OverlayFilesystemMode, RootSnapshotExport, SnapshotImportSource, SnapshotLayerHandle, WritableLayerHandle, } from "./layers.js";
 export type { SoftwareInput, SoftwareRoot } from "./packages.js";
 export type { ChildProcessPermissions, ConnectTerminalOptions, EnvPermissions, ExecOptions, ExecResult, FsPermissionRule, FsPermissions, KernelExecOptions, KernelExecResult, KernelSpawnOptions, NetworkAccessRequest, NetworkPermissions, OpenShellOptions, PatternPermissionRule, PermissionDecision, PermissionMode, Permissions, ProcessInfo, RulePermissions, StdioChannel, TimingMitigation, VirtualDirEntry, VirtualFileSystem, VirtualStat, } from "./runtime.js";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rivet-dev/agentos-core",
-	"version": "0.2.20",
+	"version": "0.2.21",
 	"type": "module",
 	"license": "Apache-2.0",
 	"main": "./dist/index.js",
@@ -56,7 +56,7 @@
 		"build:agentos-protocol": "node ./scripts/compile-agentos-protocol.mjs",
 		"build:protocols": "pnpm run build:agentos-protocol",
 		"test": "vitest run --exclude '**/*.nightly.test.ts' --reporter=verbose",
-		"test:unit": "vitest run tests/agent-exit-event.test.ts tests/agentos-package.test.ts tests/agentos-protocol.test.ts tests/allowed-node-builtins.test.ts tests/bindings-zod.test.ts tests/bindings.test.ts tests/cron-manager.test.ts tests/cron-timer-driver.test.ts tests/execution-abort.test.ts tests/generated-protocol.test.ts tests/leak-agent-os-processes.test.ts tests/leak-rpc-client.test.ts tests/mount-descriptors.test.ts tests/mount-reconfigure.test.ts tests/options-schema.test.ts tests/public-api-exports.test.ts tests/root-filesystem-descriptors.test.ts tests/runtime-compat-mount.test.ts tests/session-event-ordering.test.ts tests/session-permission-surface.test.ts tests/sidecar-client.test.ts tests/sidecar-permission-descriptors.test.ts tests/wasm-permission-tiers.test.ts --fileParallelism=false",
+		"test:unit": "vitest run tests/agent-exit-event.test.ts tests/agentos-package.test.ts tests/agentos-protocol.test.ts tests/allowed-node-builtins.test.ts tests/host-functions-zod.test.ts tests/host-functions.test.ts tests/cron-manager.test.ts tests/cron-timer-driver.test.ts tests/execution-abort.test.ts tests/generated-protocol.test.ts tests/leak-agent-os-processes.test.ts tests/leak-rpc-client.test.ts tests/mount-descriptors.test.ts tests/mount-reconfigure.test.ts tests/options-schema.test.ts tests/public-api-exports.test.ts tests/root-filesystem-descriptors.test.ts tests/runtime-compat-mount.test.ts tests/session-event-ordering.test.ts tests/session-permission-surface.test.ts tests/sidecar-client.test.ts tests/sidecar-permission-descriptors.test.ts tests/wasm-permission-tiers.test.ts --fileParallelism=false",
 		"test:pr": "pnpm test:unit && vitest run tests/migration-parity.test.ts tests/acp-reactor-regression.test.ts --fileParallelism=false --reporter=verbose",
 		"test:nightly": "vitest run tests/*.nightly.test.ts --reporter=verbose --passWithNoTests"
 	},
@@ -64,14 +64,14 @@
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@agentos-software/claude-code": "0.2.7",
 		"@agentos-software/codex-cli": "0.3.4",
-		"@agentos-software/common": "0.2.20",
-		"@agentos-software/manifest": "0.2.20",
+		"@agentos-software/common": "0.2.21",
+		"@agentos-software/manifest": "0.2.21",
 		"@agentos-software/opencode": "0.2.7",
 		"@agentos-software/pi": "0.2.7",
 		"@aws-sdk/client-s3": "^3.1019.0",
-		"@rivet-dev/agentos-sidecar": "0.2.20",
+		"@rivet-dev/agentos-sidecar": "0.2.21",
 		"@rivetkit/bare-ts": "^0.6.2",
-		"@rivet-dev/agentos-runtime-core": "0.2.20",
+		"@rivet-dev/agentos-runtime-core": "0.2.21",
 		"@xterm/headless": "^6.0.0",
 		"better-sqlite3": "^12.8.0",
 		"croner": "^10.0.1",
@@ -105,7 +105,7 @@
 		"@agentos-software/vim": "0.3.3",
 		"@agentos-software/wget": "0.3.3",
 		"@agentos-software/yq": "0.3.3",
-		"@rivet-dev/agentos-test-harness": "0.2.20",
+		"@rivet-dev/agentos-test-harness": "0.2.21",
 		"@anthropic-ai/claude-agent-sdk": "^0.2.87",
 		"@anthropic-ai/claude-code": "^2.1.86",
 		"@bare-ts/tools": "0.15.0",

package/dist/bindings-zod.d.ts

@@ -1,7 +0,0 @@
-import type { ZodType } from "zod";
-export declare class BindingSchemaConversionError extends Error {
-    readonly path: string;
-    readonly zodType: string;
-    constructor(path: string, zodType: string, details?: string);
-}
-export declare function zodToJsonSchema(schema: ZodType): unknown;