@rivet-dev/agentos-core 0.2.7 → 0.2.8-rc.1

package/dist/agent-os.d.ts

@@ -499,10 +499,16 @@ export declare class AgentOs {
     stat(path: string): Promise<VirtualStat>;
     exists(path: string): Promise<boolean>;
     snapshotRootFilesystem(): Promise<RootSnapshotExport>;
+    /**
+     * Mount a filesystem into the running VM. Resolves once the mount has been
+     * delivered to the native sidecar, so guest code can use it immediately
+     * after the returned promise settles; a delivery failure rejects instead of
+     * leaving the mount silently host-only.
+     */
     mountFs(path: string, driver: VirtualFileSystem, options?: {
         readOnly?: boolean;
-    }): void;
-    unmountFs(path: string): void;
+    }): Promise<void>;
+    unmountFs(path: string): Promise<void>;
     move(from: string, to: string): Promise<void>;
     delete(path: string, options?: {
         recursive?: boolean;

package/dist/agent-os.js

@@ -43,7 +43,7 @@ import { resolveDefaultSoftware } from "./default-software.js";
 import { allowAll } from "./runtime-compat.js";
 import { AcpRuntimeKind, decodeAcpCallback, decodeAcpEvent, decodeAcpResponse, encodeAcpCallbackResponse, encodeAcpRequest, } from "./sidecar/agentos-protocol.js";
 import { serializePermissionsForSidecar } from "./sidecar/permissions.js";
-import { createAgentOsSidecarClient, NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarKernelProxy, SidecarProcess, serializeRootFilesystemForSidecar, } from "./sidecar/rpc-client.js";
+import { createAgentOsSidecarClient, NativeSidecarKernelProxy, SidecarProcess, serializeRootFilesystemForSidecar, } from "./sidecar/rpc-client.js";
 function defaultAgentStderrHandler(event) {
     process.stderr.write(event.chunk);
 }
@@ -1600,6 +1600,12 @@ export class AgentOs {
                     permissions: sidecarPermissions,
                     commandPermissions: {},
                     loopbackExemptPorts: options?.loopbackExemptPorts,
+                    // Retained for runtime mount reconfigures: `configure_vm` is
+                    // replace-on-write for the whole payload, so post-boot mountFs
+                    // must resend the boot packages and tool shims.
+                    packages: sidecarPackages,
+                    packagesMountAt: OPT_AGENTOS_ROOT,
+                    toolShimCommands: toolBootstrapCommands,
                     commandGuestPaths,
                     onDispose: cleanup,
                     // The native process is owned by the AgentOsSidecar handle and
@@ -1920,13 +1926,19 @@ export class AgentOs {
         }
         return createSnapshotExport(await snapshotVirtualFilesystem(this._rootFilesystem));
     }
-    mountFs(path, driver, options) {
+    /**
+     * Mount a filesystem into the running VM. Resolves once the mount has been
+     * delivered to the native sidecar, so guest code can use it immediately
+     * after the returned promise settles; a delivery failure rejects instead of
+     * leaving the mount silently host-only.
+     */
+    async mountFs(path, driver, options) {
         this._assertSafeAbsolutePath(path);
-        this.#kernel.mountFs(path, driver, { readOnly: options?.readOnly });
+        await this.#kernel.mountFs(path, driver, { readOnly: options?.readOnly });
     }
-    unmountFs(path) {
+    async unmountFs(path) {
         this._assertSafeAbsolutePath(path);
-        this.#kernel.unmountFs(path);
+        await this.#kernel.unmountFs(path);
     }
     async move(from, to) {
         this._assertWritableAbsolutePath(from);
@@ -2174,6 +2186,10 @@ export class AgentOs {
                 command.name,
                 command.guestPath,
             ])));
+            // Retain the linked package for runtime mount reconfigures:
+            // `configure_vm` is replace-on-write, so a later `mountFs` that
+            // resent only the boot packages would unproject this one.
+            this.#kernel.registerLinkedPackage({ path: ref.path });
         }
         // The client parses no manifests: an `agent` block in the linked package is
         // picked up by the sidecar (it owns the projected `/opt/agentos` and answers
@@ -3621,7 +3637,6 @@ function ensureSharedSidecarNativeProcess(sidecar) {
                 cwd: REPO_ROOT,
                 command: ensureNativeSidecarBinary(),
                 args: [],
-                frameTimeoutMs: NATIVE_SIDECAR_FRAME_TIMEOUT_MS,
             });
             // Track the child immediately — BEFORE the handshake await — so a
             // failed `authenticateAndOpenSession()` can still reap it (otherwise

package/dist/runtime-compat.d.ts

@@ -16,6 +16,7 @@ export interface VirtualDirEntry {
 export interface VirtualStat {
     mode: number;
     size: number;
+    sizeExact?: bigint;
     blocks: number;
     dev: number;
     rdev: number;
@@ -26,7 +27,9 @@ export interface VirtualStat {
     ctimeMs: number;
     birthtimeMs: number;
     ino: number;
+    inoExact?: bigint;
     nlink: number;
+    nlinkExact?: bigint;
     uid: number;
     gid: number;
 }
@@ -281,8 +284,8 @@ export interface Kernel extends KernelInterface {
     connectTerminal(options?: ConnectTerminalOptions): Promise<number>;
     mountFs(path: string, fs: VirtualFileSystem, options?: {
         readOnly?: boolean;
-    }): void;
-    unmountFs(path: string): void;
+    }): void | Promise<void>;
+    unmountFs(path: string): void | Promise<void>;
     readFile(path: string): Promise<Uint8Array>;
     writeFile(path: string, content: string | Uint8Array): Promise<void>;
     mkdir(path: string): Promise<void>;

package/dist/runtime-compat.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { resolvePublishedSidecarBinary } from "./sidecar/binary.js";
 import { findCargoBinary, resolveCargoBinary } from "./sidecar/cargo.js";
 import { serializePermissionsForSidecar } from "./sidecar/permissions.js";
-import { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarKernelProxy, SidecarProcess, serializeMountConfigForSidecar, } from "./sidecar/rpc-client.js";
+import { NativeSidecarKernelProxy, SidecarProcess, serializeMountConfigForSidecar, } from "./sidecar/rpc-client.js";
 export const AF_INET = 2;
 export const AF_UNIX = 1;
 export const SOCK_STREAM = 1;
@@ -1804,9 +1804,10 @@ class NativeKernel {
         this.pendingLocalMounts.unshift(localMount);
         this.pendingLocalMounts.sort((left, right) => right.path.length - left.path.length);
         if (!this.proxy) {
+            // Pre-boot mounts apply during kernel initialization.
             return;
         }
-        this.proxy.mountFs(mountPath, filesystem, {
+        return this.proxy.mountFs(mountPath, filesystem, {
             readOnly: localMount.readOnly,
             sidecarMount: localMount.sidecarMount,
         });
@@ -1817,7 +1818,7 @@ class NativeKernel {
         if (pendingIndex >= 0) {
             this.pendingLocalMounts.splice(pendingIndex, 1);
         }
-        this.proxy?.unmountFs(mountPath);
+        return this.proxy?.unmountFs(mountPath);
     }
     async readFile(targetPath) {
         await this.ensureReady();
@@ -1917,7 +1918,6 @@ class NativeKernel {
             cwd: REPO_ROOT,
             command: ensureNativeSidecarBinary(),
             args: [],
-            frameTimeoutMs: NATIVE_SIDECAR_FRAME_TIMEOUT_MS,
         });
         const session = await client.authenticateAndOpenSession();
         const createVmConfig = {

package/dist/runtime.d.ts

@@ -10,6 +10,7 @@ export interface VirtualDirEntry {
 export interface VirtualStat {
     mode: number;
     size: number;
+    sizeExact?: bigint;
     blocks: number;
     dev: number;
     rdev: number;
@@ -20,7 +21,9 @@ export interface VirtualStat {
     ctimeMs: number;
     birthtimeMs: number;
     ino: number;
+    inoExact?: bigint;
     nlink: number;
+    nlinkExact?: bigint;
     uid: number;
     gid: number;
 }
@@ -275,8 +278,8 @@ export interface Kernel extends KernelInterface {
     connectTerminal(options?: ConnectTerminalOptions): Promise<number>;
     mountFs(path: string, fs: VirtualFileSystem, options?: {
         readOnly?: boolean;
-    }): void;
-    unmountFs(path: string): void;
+    }): void | Promise<void>;
+    unmountFs(path: string): void | Promise<void>;
     readFile(path: string): Promise<Uint8Array>;
     writeFile(path: string, content: string | Uint8Array): Promise<void>;
     mkdir(path: string): Promise<void>;

package/dist/sidecar/native-process-client.d.ts

@@ -1,6 +1,6 @@
 import "@rivet-dev/agentos-runtime-core/native-client";
 import { SidecarProcess } from "@rivet-dev/agentos-runtime-core/sidecar-client";
-export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "@rivet-dev/agentos-runtime-core/sidecar-client";
+export { SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "@rivet-dev/agentos-runtime-core/sidecar-client";
 export declare const NativeSidecarProcessClient: typeof SidecarProcess;
 export type { AuthenticatedSession, CreatedVm, ExtEnvelope, GuestFilesystemStat, RootFilesystemEntry, RootFilesystemLowerDescriptor, SidecarEventSelector, SidecarFsPermissionRule, SidecarLinkPackageResult, SidecarMountDescriptor, SidecarMountPluginDescriptor, SidecarPatternPermissionRule, SidecarPermissionMode, SidecarPermissionScope, SidecarPermissionsPolicy, SidecarProcessSnapshotEntry, SidecarProjectedAgent, SidecarProjectedModuleDescriptor, SidecarRegisteredHostCallbackDefinition, SidecarRegisteredHostCallbackExample, SidecarRequestFrame, SidecarRequestHandler, SidecarRequestPayload, SidecarResponseFrame, SidecarResponsePayload, SidecarRulePermissions, SidecarSessionState, SidecarSignalHandlerRegistration, SidecarSignalState, SidecarSocketStateEntry, SidecarSoftwareDescriptor, SidecarSpawnOptions, SidecarSpawnOptions as NativeSidecarSpawnOptions, SidecarZombieTimerCount, } from "@rivet-dev/agentos-runtime-core/sidecar-client";
 export type { SidecarVmConfiguredResponse as SidecarConfigureVmResult, } from "@rivet-dev/agentos-runtime-core/sidecar-client";

package/dist/sidecar/native-process-client.js

@@ -4,5 +4,5 @@
 // SidecarProcess.spawn works in this native runtime.
 import "@rivet-dev/agentos-runtime-core/native-client";
 import { SidecarProcess } from "@rivet-dev/agentos-runtime-core/sidecar-client";
-export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "@rivet-dev/agentos-runtime-core/sidecar-client";
+export { SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "@rivet-dev/agentos-runtime-core/sidecar-client";
 export const NativeSidecarProcessClient = SidecarProcess;

package/dist/sidecar/rpc-client.d.ts

@@ -35,6 +35,16 @@ interface NativeSidecarKernelProxyOptions {
     permissions?: SidecarPermissionsPolicy;
     commandPermissions?: Parameters<SidecarProcess["configureVm"]>[2]["commandPermissions"];
     loopbackExemptPorts?: number[];
+    /**
+     * The boot `configureVm` payload pieces beyond mounts/permissions. Rust
+     * `configure_vm` rebuilds the whole VM configuration from each payload, so
+     * every runtime mount reconfigure must resend these or a post-boot
+     * `mountFs()` silently drops the `/opt/agentos` package projections and
+     * tool shim commands applied at boot.
+     */
+    packages?: Parameters<SidecarProcess["configureVm"]>[2]["packages"];
+    packagesMountAt?: string;
+    toolShimCommands?: string[];
     commandGuestPaths: ReadonlyMap<string, string>;
     onWasmCommandResolved?: (command: string) => void;
     onDispose?: () => Promise<void>;
@@ -63,6 +73,9 @@ export declare class NativeSidecarKernelProxy {
     private readonly permissions;
     private readonly commandPermissions;
     private readonly loopbackExemptPorts;
+    private packages;
+    private readonly packagesMountAt;
+    private readonly toolShimCommands;
     private readonly commandDrivers;
     private readonly onWasmCommandResolved;
     private readonly onDispose;
@@ -88,6 +101,15 @@ export declare class NativeSidecarKernelProxy {
     createRootView(): VirtualFileSystem;
     get zombieTimerCount(): number;
     registerCommandGuestPaths(commandGuestPaths: ReadonlyMap<string, string>): void;
+    /**
+     * Record a runtime-linked package (`linkSoftware`) so mount reconfigures
+     * resend it. Rust `configure_vm` rebuilds the whole VM configuration from
+     * each payload, so a linked package omitted here would be silently
+     * unprojected from `/opt/agentos` by the next `mountFs`/`unmountFs`.
+     */
+    registerLinkedPackage(descriptor: {
+        path: string;
+    }): void;
     dispose(): Promise<void>;
     /** Test-only snapshot of the per-VM tracking collection sizes. */
     __trackingSizesForTest(): {
@@ -137,8 +159,8 @@ export declare class NativeSidecarKernelProxy {
     mountFs(path: string, driver: VirtualFileSystem, options?: {
         readOnly?: boolean;
         sidecarMount?: SidecarMountDescriptor;
-    }): void;
-    unmountFs(path: string): void;
+    }): Promise<void>;
+    unmountFs(path: string): Promise<void>;
     private desiredSidecarMounts;
     private reconfigureSidecarMounts;
     private waitForMountReconfigure;
@@ -184,7 +206,7 @@ export declare class NativeSidecarKernelProxy {
     private updateTrackedProcessSnapshot;
 }
 export type { AuthenticatedSession, CreatedVm, GuestFilesystemStat, RootFilesystemEntry, SidecarConfigureVmResult, SidecarEventSelector, SidecarLinkPackageResult, SidecarPermissionsPolicy, SidecarProjectedAgent, SidecarRegisteredHostCallbackDefinition, SidecarRequestFrame, SidecarResponsePayload, SidecarSessionState, SidecarSignalHandlerRegistration, SidecarSocketStateEntry, SidecarSpawnOptions, } from "./native-process-client.js";
-export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarProcessClient, SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "./native-process-client.js";
+export { NativeSidecarProcessClient, SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "./native-process-client.js";
 export type AgentOsSidecarPlacement = {
     kind: "shared";
     pool?: string;

package/dist/sidecar/rpc-client.js

@@ -214,6 +214,11 @@ export class NativeSidecarKernelProxy {
     permissions;
     commandPermissions;
     loopbackExemptPorts;
+    // Mutable: runtime `linkSoftware` appends via `registerLinkedPackage` so
+    // later mount reconfigures resend linked packages too, not just boot ones.
+    packages;
+    packagesMountAt;
+    toolShimCommands;
     commandDrivers;
     onWasmCommandResolved;
     onDispose;
@@ -250,6 +255,9 @@ export class NativeSidecarKernelProxy {
         this.permissions = options.permissions;
         this.commandPermissions = options.commandPermissions;
         this.loopbackExemptPorts = options.loopbackExemptPorts;
+        this.packages = options.packages ? [...options.packages] : [];
+        this.packagesMountAt = options.packagesMountAt;
+        this.toolShimCommands = options.toolShimCommands;
         this.commandDrivers = buildCommandMap(options.commandGuestPaths);
         this.onWasmCommandResolved = options.onWasmCommandResolved;
         this.onDispose = options.onDispose;
@@ -273,6 +281,17 @@ export class NativeSidecarKernelProxy {
             this.commandDrivers.set(name, "wasmvm");
         }
     }
+    /**
+     * Record a runtime-linked package (`linkSoftware`) so mount reconfigures
+     * resend it. Rust `configure_vm` rebuilds the whole VM configuration from
+     * each payload, so a linked package omitted here would be silently
+     * unprojected from `/opt/agentos` by the next `mountFs`/`unmountFs`.
+     */
+    registerLinkedPackage(descriptor) {
+        if (!this.packages.some((pkg) => pkg.path === descriptor.path)) {
+            this.packages.push({ path: descriptor.path });
+        }
+    }
     async dispose() {
         if (this.disposed) {
             return;
@@ -1058,7 +1077,7 @@ export class NativeSidecarKernelProxy {
         if (local) {
             return this.readdirRecursiveLocal(local.mount.fs, local.relativePath, options?.maxDepth);
         }
-        return this.client.readdirRecursive(this.session, this.vm, path, options);
+        return (await this.client.readdirRecursive(this.session, this.vm, path, options)).map((entry) => ({ ...entry, size: Number(entry.size) }));
     }
     async removeFile(path) {
         return this.dispatchWrite(path, (mount, relativePath) => mount.fs.removeFile(relativePath), () => this.client.removeFile(this.session, this.vm, path));
@@ -1126,15 +1145,24 @@ export class NativeSidecarKernelProxy {
             sidecarMount: options?.sidecarMount,
         });
         this.localMounts.sort((left, right) => right.path.length - left.path.length);
-        void this.reconfigureSidecarMounts().catch(() => { });
+        // Resolves once the sidecar has the mount; a swallowed rejection here
+        // used to turn reconfigure failures into silently missing guest mounts.
+        // The local catch only guards callers that drop the promise — awaiting
+        // callers still observe the rejection.
+        const applied = this.reconfigureSidecarMounts();
+        applied.catch(() => { });
+        return applied;
     }
     unmountFs(path) {
         const normalized = posixPath.normalize(path);
         const index = this.localMounts.findIndex((mount) => mount.path === normalized);
-        if (index >= 0) {
-            this.localMounts.splice(index, 1);
-            void this.reconfigureSidecarMounts().catch(() => { });
+        if (index < 0) {
+            return Promise.resolve();
         }
+        this.localMounts.splice(index, 1);
+        const applied = this.reconfigureSidecarMounts();
+        applied.catch(() => { });
+        return applied;
     }
     desiredSidecarMounts() {
         return [
@@ -1154,11 +1182,18 @@ export class NativeSidecarKernelProxy {
             if (this.disposed) {
                 return;
             }
+            // Rust `configure_vm` rebuilds the whole VM configuration from this
+            // payload, so resend the boot packages / tool shim commands too —
+            // omitting them here strips the `/opt/agentos` projections and tool
+            // shims from the VM as a side effect of a runtime mount change.
             await this.client.configureVm(this.session, this.vm, {
                 mounts: this.desiredSidecarMounts(),
                 permissions: this.permissions,
                 commandPermissions: this.commandPermissions,
                 loopbackExemptPorts: this.loopbackExemptPorts,
+                packages: this.packages,
+                packagesMountAt: this.packagesMountAt,
+                toolShimCommands: this.toolShimCommands,
             });
         };
         const previous = this.mountReconfigurePromise ?? Promise.resolve();
@@ -1957,21 +1992,27 @@ function isMissingHostProcessError(error) {
 function errnoError(code, message) {
     return Object.assign(new Error(`${code}: ${message}`), { code });
 }
+// VirtualStat is a numeric, Node-default-shaped view: u64 fields above
+// Number.MAX_SAFE_INTEGER lose precision here, same as Node's non-bigint
+// fs.stat on the host.
 function toVirtualStat(stat) {
     return {
         mode: stat.mode,
-        size: stat.size,
-        blocks: stat.blocks,
-        dev: stat.dev,
-        rdev: stat.rdev,
+        size: Number(stat.size),
+        sizeExact: stat.size,
+        blocks: Number(stat.blocks),
+        dev: Number(stat.dev),
+        rdev: Number(stat.rdev),
         isDirectory: stat.is_directory,
         isSymbolicLink: stat.is_symbolic_link,
         atimeMs: stat.atime_ms,
         mtimeMs: stat.mtime_ms,
         ctimeMs: stat.ctime_ms,
         birthtimeMs: stat.birthtime_ms,
-        ino: stat.ino,
-        nlink: stat.nlink,
+        ino: Number(stat.ino),
+        inoExact: stat.ino,
+        nlink: Number(stat.nlink),
+        nlinkExact: stat.nlink,
         uid: stat.uid,
         gid: stat.gid,
     };
@@ -2004,7 +2045,7 @@ function socketLookupKey(kind, request) {
         path: request.path ?? null,
     });
 }
-export { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarProcessClient, SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "./native-process-client.js";
+export { NativeSidecarProcessClient, SidecarEventBufferOverflow, SidecarProcess, SidecarProcessError, SidecarProcessExited, } from "./native-process-client.js";
 export class AgentOsSidecarVmHandle {
     client;
     sessionId;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rivet-dev/agentos-core",
-	"version": "0.2.7",
+	"version": "0.2.8-rc.1",
 	"type": "module",
 	"license": "Apache-2.0",
 	"main": "./dist/index.js",
@@ -53,17 +53,17 @@
 		"test": "vitest run --reporter=verbose"
 	},
 	"dependencies": {
-		"@agentos-software/claude-code": "0.2.7",
+		"@agentos-software/claude-code": "0.2.8-rc.1",
 		"@agentos-software/codex-cli": "0.3.3",
-		"@agentos-software/common": "0.2.7",
-		"@agentos-software/manifest": "0.2.7",
-		"@agentos-software/opencode": "0.2.7",
-		"@agentos-software/pi": "0.2.7",
-		"@agentos-software/pi-cli": "0.2.7",
+		"@agentos-software/common": "0.2.8-rc.1",
+		"@agentos-software/manifest": "0.2.8-rc.1",
+		"@agentos-software/opencode": "0.2.8-rc.1",
+		"@agentos-software/pi": "0.2.8-rc.1",
+		"@agentos-software/pi-cli": "0.2.8-rc.1",
 		"@aws-sdk/client-s3": "^3.1019.0",
-		"@rivet-dev/agentos-sidecar": "0.2.7",
+		"@rivet-dev/agentos-sidecar": "0.2.8-rc.1",
 		"@rivetkit/bare-ts": "^0.6.2",
-		"@rivet-dev/agentos-runtime-core": "0.2.7",
+		"@rivet-dev/agentos-runtime-core": "0.2.8-rc.1",
 		"@xterm/headless": "^6.0.0",
 		"better-sqlite3": "^12.8.0",
 		"croner": "^10.0.1",
@@ -75,8 +75,8 @@
 		"zod-to-json-schema": "^3.25.2"
 	},
 	"devDependencies": {
-		"@agentos-software/claude-code": "0.2.7",
-		"@agentos-software/codex": "0.2.7",
+		"@agentos-software/claude-code": "0.2.8-rc.1",
+		"@agentos-software/codex": "0.2.8-rc.1",
 		"@agentos-software/coreutils": "0.3.3",
 		"@agentos-software/curl": "0.3.3",
 		"@agentos-software/diffutils": "0.3.3",
@@ -90,9 +90,9 @@
 		"@agentos-software/gzip": "0.3.3",
 		"@agentos-software/http-get": "0.3.3",
 		"@agentos-software/jq": "0.3.3",
-		"@agentos-software/opencode": "0.2.7",
-		"@agentos-software/pi": "0.2.7",
-		"@agentos-software/pi-cli": "0.2.7",
+		"@agentos-software/opencode": "0.2.8-rc.1",
+		"@agentos-software/pi": "0.2.8-rc.1",
+		"@agentos-software/pi-cli": "0.2.8-rc.1",
 		"@agentos-software/ripgrep": "0.3.3",
 		"@agentos-software/sed": "0.3.3",
 		"@agentos-software/tar": "0.3.3",