@rivet-dev/agentos-core 0.2.8-rc.4 → 0.2.9

package/dist/agent-os.d.ts

@@ -3,6 +3,7 @@ import type { VmUserConfig } from "@rivet-dev/agentos-runtime-core/vm-config";
 import type { CancelPromptResult, HistoryPage, ListSessionsInput, OpenSessionInput, PermissionResponse, PermissionResponseResult, PromptInput, PromptResult as DurablePromptResult, ReadHistoryInput, SessionCapabilities, SessionAgentInfo, SessionConfig, SessionInfo as DurableSessionInfo, SessionPage, SessionStreamEntry, SessionTarget, SetSessionConfigOptionInput } from "./session-api.js";
 import { type Bindings } from "./bindings.js";
 import type { ConnectTerminalOptions, Kernel, KernelExecOptions, KernelExecResult, ProcessInfo as KernelProcessInfo, KernelSpawnOptions, OpenShellOptions, Permissions, VirtualFileSystem, VirtualStat } from "./runtime-compat.js";
+import { type AgentOsSandboxInput } from "./sandbox.js";
 export type { MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountPluginDescriptor, } from "@rivet-dev/agentos-runtime-core/descriptors";
 export type { ConnectTerminalOptions } from "./runtime-compat.js";
 export type * from "./session-api.js";
@@ -393,6 +394,8 @@ export interface AgentOsOptions {
     rootFilesystem?: RootFilesystemConfig;
     /** Filesystems to mount at boot time. */
     mounts?: MountConfig[];
+    /** External sandbox mounted into this VM with process bindings. */
+    sandbox?: AgentOsSandboxInput;
     /** Custom schedule driver for cron jobs. Defaults to TimerScheduleDriver. */
     scheduleDriver?: ScheduleDriver;
     /** Host-side bindings available to agents inside the VM. */
@@ -475,6 +478,7 @@ export declare class AgentOs {
     private readonly _agentStderrHandler?;
     private readonly _agentExitHandler?;
     private readonly _limitWarningHandler?;
+    private readonly _disposeHooks;
     private constructor();
     static createSidecar(options?: AgentOsCreateSidecarOptions): Promise<AgentOsSidecar>;
     static getSharedSidecar(options?: AgentOsSharedSidecarOptions): Promise<AgentOsSidecar>;

package/dist/agent-os.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { validateBindings } from "./bindings.js";
 import { zodToJsonSchema } from "./bindings-zod.js";
 import { parseAgentOsOptions } from "./options-schema.js";
+import { getSandboxDisposeHooks, resolveSandboxOptions, } from "./sandbox.js";
 import { resolvePublishedSidecarBinary } from "./sidecar/binary.js";
 import { findCargoBinary, resolveCargoBinary } from "./sidecar/cargo.js";
 const ACP_PROTOCOL_VERSION = 1;
@@ -1457,6 +1458,7 @@ export class AgentOs {
     _agentStderrHandler;
     _agentExitHandler;
     _limitWarningHandler;
+    _disposeHooks = [];
     constructor(kernel, sidecar, softwareRoots, hostMounts, env, rootFilesystem, sidecarClient, sidecarSession, sidecarVm, agentStderrHandler, agentExitHandler, limitWarningHandler) {
         this.#kernel = kernel;
         this.sidecar = sidecar;
@@ -1522,13 +1524,15 @@ export class AgentOs {
         // sidecar owns agent resolution, agent enumeration, and agent snapshot
         // bundle loading from the projected package dirs.
         const localMounts = await resolveCompatLocalMounts(options?.mounts);
-        const bindings = options?.bindings;
-        if (bindings && bindings.length > 0) {
-            validateBindings(bindings);
+        if (options?.bindings && options.bindings.length > 0) {
+            validateBindings(options.bindings);
         }
-        // Resolve the sidecar handle up front so every VM created here leases the
-        // one shared native sidecar process owned by that handle.
+        // Resolve the sidecar handle before starting an external sandbox so option
+        // validation failures cannot leak provider resources.
         const sidecar = resolveAgentOsSidecar(options?.sidecar);
+        options = await resolveSandboxOptions(options);
+        const sandboxDisposeHooks = getSandboxDisposeHooks(options);
+        const bindings = options.bindings;
         const createVmAdmin = async () => {
             // The `/opt/agentos` projection is built by the sidecar from the
             // forwarded `packages` (it owns the staging dir + read-only mount, and
@@ -1736,12 +1740,24 @@ export class AgentOs {
             vm._bindings = vmAdmin.bindings;
             vm._bindingReference = vmAdmin.bindingReference;
             vm._permissions = vmAdmin.permissions;
+            vm._disposeHooks.push(...sandboxDisposeHooks);
             vm._installSidecarRequestHandler();
             vm._cronManager = new CronManager(vm, options?.scheduleDriver ?? new TimerScheduleDriver());
             return vm;
         }
         catch (error) {
-            await sidecarLease?.dispose().catch(() => { });
+            const cleanupErrors = [];
+            try {
+                await sidecarLease?.dispose();
+            }
+            catch (disposeError) {
+                cleanupErrors.push(disposeError);
+            }
+            const sandboxCleanupResults = await Promise.allSettled(sandboxDisposeHooks.map((hook) => hook()));
+            cleanupErrors.push(...sandboxCleanupResults.flatMap((result) => result.status === "rejected" ? [result.reason] : []));
+            if (cleanupErrors.length > 0) {
+                throw new AggregateError([error, ...cleanupErrors], "AgentOS VM creation and cleanup failed");
+            }
             throw error;
         }
     }
@@ -3100,10 +3116,24 @@ export class AgentOs {
         this._disposeSidecarEventListener();
         const sidecarLease = this._sidecarLease;
         this._sidecarLease = null;
-        if (sidecarLease) {
-            return sidecarLease.dispose();
+        const disposeVm = sidecarLease
+            ? sidecarLease.dispose()
+            : this.#kernel.dispose();
+        const hooks = this._disposeHooks.splice(0);
+        const errors = [];
+        try {
+            await disposeVm;
+        }
+        catch (error) {
+            errors.push(error);
+        }
+        const hookResults = await Promise.allSettled(hooks.map((hook) => hook()));
+        errors.push(...hookResults.flatMap((result) => result.status === "rejected" ? [result.reason] : []));
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1) {
+            throw new AggregateError(errors, "AgentOS VM disposal failed");
         }
-        return this.#kernel.dispose();
     }
 }
 const agentOsRuntimeAdmins = new WeakMap();

package/dist/index.d.ts

@@ -8,4 +8,5 @@ export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { KernelError } from "./runtime-compat.js";
 export type { ExecOptions, ExecResult, ManagedProcess, ProcessInfo, ShellHandle, VirtualDirEntry, VirtualStat, } from "./runtime.js";
+export { createSandboxBindings, createSandboxFs, getSandboxDisposeHooks, resolveSandboxOptions, } from "./sandbox.js";
 export type * from "./types.js";

package/dist/index.js

@@ -8,3 +8,4 @@ export { createSnapshotExport, } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
 export { KernelError } from "./runtime-compat.js";
+export { createSandboxBindings, createSandboxFs, getSandboxDisposeHooks, resolveSandboxOptions, } from "./sandbox.js";

package/dist/options-schema.d.ts

@@ -338,6 +338,7 @@ export declare const agentOsOptionFieldSchemas: {
             lowers: z.ZodArray<z.ZodUnknown>;
         }, z.core.$strict>;
     }, z.core.$strict>]>>>;
+    readonly sandbox: z.ZodOptional<z.ZodCustom<unknown, unknown>>;
     readonly scheduleDriver: z.ZodOptional<z.ZodCustom<unknown, unknown>>;
     readonly bindings: z.ZodOptional<z.ZodArray<z.ZodType<Bindings, unknown, z.core.$ZodTypeInternals<Bindings, unknown>>>>;
     readonly permissions: z.ZodOptional<z.ZodObject<{

package/dist/options-schema.js

@@ -352,6 +352,10 @@ export const agentOsOptionFieldSchemas = {
         .optional(),
     rootFilesystem: rootFilesystemConfigSchema.optional(),
     mounts: z.array(mountConfigSchema).optional(),
+    sandbox: z
+        .custom((value) => value === undefined ||
+        (typeof value === "object" && value !== null && !Array.isArray(value)), { message: "Expected sandbox options object" })
+        .optional(),
     scheduleDriver: z
         .custom((value) => typeof value === "object" && value !== null, {
         message: "Expected schedule driver object",

package/dist/sandbox.js

@@ -241,24 +241,37 @@ export async function resolveSandboxOptions(options) {
         return rest;
     }
     const normalizedSandbox = await normalizeSandboxInput(sandbox);
-    const sandboxOptions = normalizedSandbox.options;
-    const expanded = rest;
-    const mountPath = sandboxOptions.mountPath ?? "/mnt/sandbox";
-    const mounts = [
-        ...(expanded.mounts ?? []),
-        {
-            path: mountPath,
-            plugin: createSandboxFs(sandboxOptions),
-            readOnly: sandboxOptions.readOnly,
-        },
-    ];
-    const bindings = [
-        ...(expanded.bindings ?? []),
-        createSandboxBindings(sandboxOptions),
-    ];
-    return attachSandboxDisposeHooks({
-        ...expanded,
-        mounts,
-        bindings,
-    }, normalizedSandbox.dispose ? [normalizedSandbox.dispose] : []);
+    try {
+        const sandboxOptions = normalizedSandbox.options;
+        const expanded = rest;
+        const mountPath = sandboxOptions.mountPath ?? "/mnt/sandbox";
+        const mounts = [
+            ...(expanded.mounts ?? []),
+            {
+                path: mountPath,
+                plugin: createSandboxFs(sandboxOptions),
+                readOnly: sandboxOptions.readOnly,
+            },
+        ];
+        const bindings = [
+            ...(expanded.bindings ?? []),
+            createSandboxBindings(sandboxOptions),
+        ];
+        return attachSandboxDisposeHooks({
+            ...expanded,
+            mounts,
+            bindings,
+        }, normalizedSandbox.dispose ? [normalizedSandbox.dispose] : []);
+    }
+    catch (error) {
+        if (!normalizedSandbox.dispose)
+            throw error;
+        try {
+            await normalizedSandbox.dispose();
+        }
+        catch (disposeError) {
+            throw new AggregateError([error, disposeError], "Sandbox configuration and cleanup failed");
+        }
+        throw error;
+    }
 }

package/dist/types.d.ts

@@ -14,3 +14,4 @@ export type { FilesystemSnapshotExport, LayerHandle, LayerStore, OverlayFilesyst
 export type { SoftwareInput, SoftwareRoot } from "./packages.js";
 export type { AgentBlock, PackageDescriptor, PackageRef, SoftwarePackageRef, } from "./agentos-package.js";
 export type { ChildProcessPermissions, ConnectTerminalOptions, EnvPermissions, ExecOptions, ExecResult, FsPermissionRule, FsPermissions, KernelExecOptions, KernelExecResult, KernelSpawnOptions, NetworkAccessRequest, NetworkPermissions, OpenShellOptions, PatternPermissionRule, PermissionDecision, PermissionMode, Permissions, ProcessInfo, RulePermissions, StdioChannel, TimingMitigation, VirtualDirEntry, VirtualFileSystem, VirtualStat, } from "./runtime.js";
+export type { AgentOsSandboxClient, AgentOsSandboxClientOptions, AgentOsSandboxCommonOptions, AgentOsSandboxInput, AgentOsSandboxOptions, AgentOsSandboxProcessInfo, AgentOsSandboxProcessLogs, AgentOsSandboxProcessResult, AgentOsSandboxProvider, AgentOsSandboxProviderOptions, SandboxMountPluginConfig, } from "./sandbox.js";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rivet-dev/agentos-core",
-	"version": "0.2.8-rc.4",
+	"version": "0.2.9",
 	"type": "module",
 	"license": "Apache-2.0",
 	"main": "./dist/index.js",
@@ -59,14 +59,14 @@
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@agentos-software/claude-code": "0.2.7",
 		"@agentos-software/codex-cli": "0.3.4",
-		"@agentos-software/common": "0.2.8-rc.4",
-		"@agentos-software/manifest": "0.2.8-rc.4",
+		"@agentos-software/common": "0.2.9",
+		"@agentos-software/manifest": "0.2.9",
 		"@agentos-software/opencode": "0.2.7",
 		"@agentos-software/pi": "0.2.7",
 		"@aws-sdk/client-s3": "^3.1019.0",
-		"@rivet-dev/agentos-sidecar": "0.2.8-rc.4",
+		"@rivet-dev/agentos-sidecar": "0.2.9",
 		"@rivetkit/bare-ts": "^0.6.2",
-		"@rivet-dev/agentos-runtime-core": "0.2.8-rc.4",
+		"@rivet-dev/agentos-runtime-core": "0.2.9",
 		"@xterm/headless": "^6.0.0",
 		"better-sqlite3": "^12.8.0",
 		"croner": "^10.0.1",
@@ -101,7 +101,7 @@
 		"@agentos-software/vim": "0.3.3",
 		"@agentos-software/wget": "0.3.3",
 		"@agentos-software/yq": "0.3.3",
-		"@rivet-dev/agentos-test-harness": "0.2.8-rc.4",
+		"@rivet-dev/agentos-test-harness": "0.2.9",
 		"@anthropic-ai/claude-agent-sdk": "^0.2.87",
 		"@anthropic-ai/claude-code": "^2.1.86",
 		"@bare-ts/tools": "0.15.0",