@rivet-dev/agentos-runtime-core 0.0.0-codex-actor-plugin-contract-coverage.115ca8a → 0.0.0-fix-main-wasm-ownership.150c49a

package/dist/test-runtime.js

@@ -5,7 +5,7 @@ import * as path from "node:path";
 import * as posixPath from "node:path/posix";
 import { fileURLToPath } from "node:url";
 import "./native-client.js";
-import { NATIVE_SIDECAR_FRAME_TIMEOUT_MS, NativeSidecarKernelProxy, SidecarProcess, serializeMountConfigForSidecar, } from "./kernel-proxy.js";
+import { NativeSidecarKernelProxy, SidecarProcess, serializeMountConfigForSidecar, } from "./kernel-proxy.js";
 import { resolvePublishedSidecarBinary } from "./binary.js";
 import { findCargoBinary, resolveCargoBinary } from "./cargo.js";
 export const AF_INET = 2;
@@ -33,6 +33,8 @@ const KERNEL_POSIX_BOOTSTRAP_DIRS = [
     "/srv",
     "/sys",
     "/opt",
+    "/opt/agentos",
+    "/opt/agentos/bin",
     "/mnt",
     "/media",
     "/home",
@@ -66,9 +68,21 @@ const SIDECAR_BUILD_INPUTS = [
     path.join(REPO_ROOT, "Cargo.toml"),
     path.join(REPO_ROOT, "Cargo.lock"),
     path.join(REPO_ROOT, "crates/bridge"),
+    path.join(REPO_ROOT, "crates/build-support"),
     path.join(REPO_ROOT, "crates/execution"),
     path.join(REPO_ROOT, "crates/kernel"),
-    path.join(REPO_ROOT, "crates/sidecar"),
+    path.join(REPO_ROOT, "crates/native-sidecar"),
+    path.join(REPO_ROOT, "crates/native-sidecar-core"),
+    path.join(REPO_ROOT, "crates/sidecar-protocol"),
+    path.join(REPO_ROOT, "crates/v8-runtime"),
+    path.join(REPO_ROOT, "crates/vfs"),
+    path.join(REPO_ROOT, "crates/vm-config"),
+    path.join(REPO_ROOT, "packages/build-tools/bridge-src"),
+    path.join(REPO_ROOT, "packages/build-tools/package.json"),
+    path.join(REPO_ROOT, "packages/build-tools/scripts/build-v8-bridge.mjs"),
+    path.join(REPO_ROOT, "packages/core/fixtures/base-filesystem.json"),
+    path.join(REPO_ROOT, "packages/runtime-core/fixtures/base-filesystem.json"),
+    path.join(REPO_ROOT, "pnpm-lock.yaml"),
 ];
 let ensuredSidecarBinary = null;
 export class KernelError extends Error {
@@ -325,8 +339,10 @@ export class InMemoryFileSystem {
             typeBits === 0 ? (entry.mode & 0o170000) | (mode & 0o7777) : mode;
         entry.ctimeMs = Date.now();
     }
-    async chown(targetPath, uid, gid) {
-        const entry = this.resolveEntry(targetPath);
+    async chown(targetPath, uid, gid, options) {
+        const entry = options?.followSymlinks === false
+            ? this.entries.get(normalizePath(targetPath))
+            : this.resolveEntry(targetPath);
         if (!entry)
             throw errnoError("ENOENT", `chown '${targetPath}'`);
         entry.uid = uid;
@@ -548,8 +564,14 @@ export class NodeFileSystem {
     async chmod(targetPath, mode) {
         await fs.chmod(this.normalizeTarget(targetPath), mode);
     }
-    async chown(targetPath, uid, gid) {
-        await fs.chown(this.normalizeTarget(targetPath), uid, gid);
+    async chown(targetPath, uid, gid, options) {
+        const normalized = this.normalizeTarget(targetPath);
+        if (options?.followSymlinks === false) {
+            await fs.lchown(normalized, uid, gid);
+        }
+        else {
+            await fs.chown(normalized, uid, gid);
+        }
     }
     async utimes(targetPath, atime, mtime) {
         await fs.utimes(this.normalizeTarget(targetPath), atime / 1000, mtime / 1000);
@@ -569,7 +591,7 @@ export class NodeFileSystem {
         }
     }
     async pwrite(targetPath, offset, data) {
-        const handle = await fs.open(this.normalizeTarget(targetPath), "r+");
+        const handle = await fs.open(this.normalizeTarget(targetPath), fsSync.constants.O_WRONLY);
         try {
             await handle.write(data, 0, data.length, offset);
         }
@@ -857,7 +879,6 @@ export const WASMVM_COMMANDS = Object.freeze([
     "unzip",
     "sqlite3",
     "curl",
-    "wget",
     "git",
     "git-remote-http",
     "git-remote-https",
@@ -1021,7 +1042,6 @@ export const DEFAULT_FIRST_PARTY_TIERS = Object.freeze({
     tac: "read-only",
     tsort: "read-only",
     curl: "full",
-    wget: "full",
     sqlite3: "read-write",
 });
 class NativeRuntimeDescriptor {
@@ -1148,8 +1168,8 @@ class WasmVmRuntimeDescriptor {
     recordModuleExecution(command) {
         const normalized = normalizeCommandLookup(command);
         if (this._commandPaths.has(normalized) ||
-            (!this.commandDirs || this.commandDirs.length === 0) &&
-                this.commands.includes(normalized)) {
+            ((!this.commandDirs || this.commandDirs.length === 0) &&
+                this.commands.includes(normalized))) {
             this._moduleCache.set(normalized, true);
         }
     }
@@ -1201,7 +1221,6 @@ function ensureNativeSidecarBinary() {
     // A published install has no in-repo Cargo workspace to build from: resolve
     // the prebuilt platform binary (or an explicit sidecar override).
     if (process.env.AGENTOS_SIDECAR_BIN ||
-        process.env.AGENTOS_SIDECAR_BIN ||
         !fsSync.existsSync(path.join(REPO_ROOT, "Cargo.toml"))) {
         return resolvePublishedSidecarBinary();
     }
@@ -1243,7 +1262,7 @@ function createBootstrapEntries(commandNames) {
         ...KERNEL_POSIX_BOOTSTRAP_DIRS.map((entryPath) => ({
             path: entryPath,
             kind: "directory",
-            mode: 0o755,
+            mode: entryPath === "/tmp" || entryPath === "/var/tmp" ? 0o1777 : 0o755,
             uid: 0,
             gid: 0,
         })),
@@ -1412,9 +1431,16 @@ function collectGuestCommandPaths(commandDirs, startIndex = 0) {
 async function ensureCommandStubs(proxy, commands) {
     const rootView = proxy.createRootView();
     for (const command of commands) {
-        const stubPath = `/bin/${command}`;
-        await rootView.writeFile(stubPath, KERNEL_COMMAND_STUB);
-        await rootView.chmod(stubPath, 0o755);
+        // `/bin` supports PATH-based test commands. `/opt/agentos/bin` mirrors
+        // the package projection used by production VMs and is required by
+        // upstream tools that exec private helpers via an absolute libexec path.
+        for (const stubPath of [
+            `/bin/${command}`,
+            `/opt/agentos/bin/${command}`,
+        ]) {
+            await rootView.writeFile(stubPath, KERNEL_COMMAND_STUB);
+            await rootView.chmod(stubPath, 0o755);
+        }
     }
 }
 class DeferredFileSystem {
@@ -1483,8 +1509,8 @@ class DeferredFileSystem {
     chmod(path, mode) {
         return this.filesystem().chmod(path, mode);
     }
-    chown(path, uid, gid) {
-        return this.filesystem().chown(path, uid, gid);
+    chown(path, uid, gid, options) {
+        return this.filesystem().chown(path, uid, gid, options);
     }
     utimes(path, atime, mtime) {
         return this.filesystem().utimes(path, atime, mtime);
@@ -1524,7 +1550,10 @@ const VIRTUAL_FILESYSTEM_METHOD_NAMES = [
     "pread",
     "pwrite",
 ];
-const LIVE_FILESYSTEM_SYNC_CHUNK_SIZE = 512 * 1024;
+const DEFAULT_LIVE_FILESYSTEM_SYNC_MAX_BYTES = 64 * 1024 * 1024;
+class LiveFilesystemSyncLimitError extends Error {
+    code = "ERR_AGENTOS_LIVE_FILESYSTEM_SYNC_LIMIT";
+}
 function topLevelSyncRoot(targetPath) {
     const normalized = normalizePath(targetPath);
     const [first] = normalized.split("/").filter(Boolean);
@@ -1552,48 +1581,75 @@ async function ensureBoundParentDirectory(methods, targetPath) {
     if (parent === targetPath) {
         return;
     }
-    await callBoundFilesystemMethod(methods, "mkdir", parent, { recursive: true });
+    await callBoundFilesystemMethod(methods, "mkdir", parent, {
+        recursive: true,
+    });
 }
-async function syncLiveFilesystemToBoundMethods(live, methods, paths) {
+async function syncLiveFilesystemToBoundMethods(live, methods, paths, maxBytes) {
+    const snapshot = [];
+    const usage = { bytes: 0 };
     for (const targetPath of [...new Set(paths.map(normalizePath))].sort((left, right) => left.localeCompare(right))) {
         if (!(await live.exists(targetPath).catch(() => false))) {
             continue;
         }
-        await syncLiveFilesystemPathToBoundMethods(live, methods, targetPath);
+        await snapshotLiveFilesystemPath(live, targetPath, snapshot, usage, maxBytes);
+    }
+    if (usage.bytes >= maxBytes * 0.8) {
+        process.emitWarning(`live filesystem sync retained ${usage.bytes} of ${maxBytes} bytes; ` +
+            "raise createKernel({ maxFilesystemBytes }) before increasing VM filesystem limits", { code: "AGENTOS_LIVE_FILESYSTEM_SYNC_NEAR_LIMIT" });
+    }
+    for (const entry of snapshot) {
+        await applyLiveFilesystemSnapshotEntry(methods, entry);
     }
 }
-async function syncLiveFilesystemPathToBoundMethods(live, methods, targetPath) {
-    const stat = targetPath === "/" ? await live.stat(targetPath) : await live.lstat(targetPath);
+async function snapshotLiveFilesystemPath(live, targetPath, snapshot, usage, maxBytes, knownEntry) {
+    const stat = knownEntry ??
+        (targetPath === "/" ? await live.stat(targetPath) : await live.lstat(targetPath));
     if (stat.isSymbolicLink) {
-        await ensureBoundParentDirectory(methods, targetPath);
-        await callBoundFilesystemMethod(methods, "removeFile", targetPath).catch(() => { });
-        await callBoundFilesystemMethod(methods, "symlink", await live.readlink(targetPath), targetPath);
+        snapshot.push({ kind: "symlink", path: targetPath, target: await live.readlink(targetPath) });
         return;
     }
     if (stat.isDirectory) {
-        await callBoundFilesystemMethod(methods, "mkdir", targetPath, {
-            recursive: true,
-        });
+        snapshot.push({ kind: "directory", path: targetPath });
         const children = (await live.readDirWithTypes(targetPath))
-            .map((entry) => entry.name)
-            .filter((name) => name !== "." && name !== "..")
-            .sort((left, right) => left.localeCompare(right));
+            .filter((entry) => entry.name !== "." && entry.name !== "..")
+            .sort((left, right) => left.name.localeCompare(right.name));
         for (const child of children) {
-            await syncLiveFilesystemPathToBoundMethods(live, methods, targetPath === "/" ? posixPath.join("/", child) : posixPath.join(targetPath, child));
+            await snapshotLiveFilesystemPath(live, targetPath === "/"
+                ? posixPath.join("/", child.name)
+                : posixPath.join(targetPath, child.name), snapshot, usage, maxBytes, child);
         }
         return;
     }
-    await ensureBoundParentDirectory(methods, targetPath);
-    await callBoundFilesystemMethod(methods, "writeFile", targetPath, new Uint8Array(0));
-    for (let offset = 0; offset < stat.size; offset += LIVE_FILESYSTEM_SYNC_CHUNK_SIZE) {
-        const chunk = await live.pread(targetPath, offset, Math.min(LIVE_FILESYSTEM_SYNC_CHUNK_SIZE, stat.size - offset));
-        if (chunk.length === 0) {
-            break;
-        }
-        await callBoundFilesystemMethod(methods, "pwrite", targetPath, offset, chunk);
+    const fileSize = "size" in stat && typeof stat.size === "number"
+        ? stat.size
+        : (await live.lstat(targetPath)).size;
+    if (fileSize > maxBytes - usage.bytes) {
+        throw new LiveFilesystemSyncLimitError(`live filesystem sync for ${targetPath} exceeds ${maxBytes} bytes ` +
+            "(createKernel maxFilesystemBytes); raise createKernel({ maxFilesystemBytes })");
+    }
+    const content = await live.readFile(targetPath);
+    if (content.byteLength > maxBytes - usage.bytes) {
+        throw new LiveFilesystemSyncLimitError(`live filesystem sync for ${targetPath} exceeds ${maxBytes} bytes ` +
+            "(createKernel maxFilesystemBytes); raise createKernel({ maxFilesystemBytes })");
+    }
+    usage.bytes += content.byteLength;
+    snapshot.push({ kind: "file", path: targetPath, content });
+}
+async function applyLiveFilesystemSnapshotEntry(methods, entry) {
+    if (entry.kind === "directory") {
+        await callBoundFilesystemMethod(methods, "mkdir", entry.path, { recursive: true });
+        return;
     }
+    await ensureBoundParentDirectory(methods, entry.path);
+    if (entry.kind === "symlink") {
+        await callBoundFilesystemMethod(methods, "removeFile", entry.path).catch(() => { });
+        await callBoundFilesystemMethod(methods, "symlink", entry.target, entry.path);
+        return;
+    }
+    await callBoundFilesystemMethod(methods, "writeFile", entry.path, entry.content);
 }
-function bindLiveFilesystem(target, getFilesystem) {
+function bindLiveFilesystem(target, getFilesystem, maxBytes) {
     const fallback = {};
     for (const method of VIRTUAL_FILESYSTEM_METHOD_NAMES) {
         const candidate = target[method];
@@ -1619,7 +1675,7 @@ function bindLiveFilesystem(target, getFilesystem) {
             if (!filesystem) {
                 return;
             }
-            await syncLiveFilesystemToBoundMethods(filesystem, fallback, paths);
+            await syncLiveFilesystemToBoundMethods(filesystem, fallback, paths, maxBytes);
         },
         restore() {
             for (const [method, delegate] of Object.entries(fallback)) {
@@ -1653,9 +1709,9 @@ class NativeKernel {
     loopbackExemptPorts;
     // Bindings registered with the VM, keyed by the callback key the sidecar
     // sends back on a host_callback request (the binding name). Installed lazily
-    // on the first registerHostTools call.
-    hostToolHandlers = new Map();
-    hostToolRequestHandlerInstalled = false;
+    // on the first registerBindings call.
+    bindingHandlers = new Map();
+    bindingRequestHandlerInstalled = false;
     constructor(options) {
         this.options = options;
         this.env = { ...(options.env ?? {}) };
@@ -1685,7 +1741,7 @@ class NativeKernel {
             });
         }
         this.vfs = new DeferredFileSystem(() => this.rootFilesystem);
-        this.liveFilesystemBinding = bindLiveFilesystem(this.options.filesystem, () => this.rootFilesystem);
+        this.liveFilesystemBinding = bindLiveFilesystem(this.options.filesystem, () => this.rootFilesystem, options.maxFilesystemBytes ?? DEFAULT_LIVE_FILESYSTEM_SYNC_MAX_BYTES);
     }
     get zombieTimerCount() {
         return this.proxy?.zombieTimerCount ?? 0;
@@ -1880,7 +1936,7 @@ class NativeKernel {
         await this.ensureReady();
         return this.proxy.vmFetch(request);
     }
-    async registerHostTools(tools) {
+    async registerBindings(bindings) {
         await this.ensureReady();
         if (!this.client || !this.session || !this.vm) {
             throw new Error("kernel is not ready");
@@ -1888,12 +1944,12 @@ class NativeKernel {
         // Install the dispatcher once. It routes every host_callback request the
         // sidecar emits to the matching registered handler and replies with a
         // host_callback_result frame.
-        if (!this.hostToolRequestHandlerInstalled) {
-            this.client.setSidecarRequestHandler((request) => this.dispatchHostToolRequest(request));
-            this.hostToolRequestHandlerInstalled = true;
+        if (!this.bindingRequestHandlerInstalled) {
+            this.client.setSidecarRequestHandler((request) => this.dispatchBindingRequest(request));
+            this.bindingRequestHandlerInstalled = true;
         }
-        for (const [name, binding] of Object.entries(tools)) {
-            this.hostToolHandlers.set(name, binding.handler);
+        for (const [name, binding] of Object.entries(bindings)) {
+            this.bindingHandlers.set(name, binding.handler);
             const definition = {
                 description: binding.description,
                 inputSchema: binding.inputSchema,
@@ -1909,9 +1965,9 @@ class NativeKernel {
                     }
                     : {}),
             };
-            // Register each binding as its own single-callback toolkit so the guest
+            // Register each binding as its own single-callback binding collection so the guest
             // can invoke it directly by name (or by any caller-provided alias). The
-            // sidecar exposes the toolkit name as a guest command; the single
+            // sidecar exposes the binding collection name as a guest command; the single
             // callback carries the binding's schema and gates the `binding`
             // permission.
             await this.client.registerHostCallbacks(this.session, this.vm, {
@@ -1926,21 +1982,21 @@ class NativeKernel {
             }
         }
     }
-    async dispatchHostToolRequest(request) {
+    async dispatchBindingRequest(request) {
         const { payload } = request;
         if (payload.type !== "host_callback") {
             throw new Error(`unsupported sidecar request for bindings: ${payload.type}`);
         }
-        // Callback keys arrive as `${toolkit}:${tool}` for toolkit invocations and
-        // as the bare command name otherwise. The toolkit name and tool name are
-        // the same here, so the registered tool name is the segment after the last
+        // Callback keys arrive as `${collection}:${binding}` for collection invocations
+        // and as the bare command name otherwise. The collection and binding name are
+        // the same here, so the registered binding name is the segment after the last
         // colon (or the whole key when no colon is present).
         const callbackKey = payload.callback_key;
-        const toolName = callbackKey.includes(":")
+        const bindingName = callbackKey.includes(":")
             ? callbackKey.slice(callbackKey.lastIndexOf(":") + 1)
             : callbackKey;
-        const handler = this.hostToolHandlers.get(toolName) ??
-            this.hostToolHandlers.get(callbackKey);
+        const handler = this.bindingHandlers.get(bindingName) ??
+            this.bindingHandlers.get(callbackKey);
         if (!handler) {
             return {
                 type: "host_callback_result",
@@ -1996,6 +2052,10 @@ class NativeKernel {
         await this.ensureReady();
         return this.proxy.rename(oldPath, newPath);
     }
+    async pwrite(targetPath, offset, data) {
+        await this.ensureReady();
+        return this.proxy.vfs.pwrite(targetPath, offset, data);
+    }
     tryResolveMountedCommand(command) {
         const normalized = normalizeCommandLookup(command);
         for (const driver of this.mountedRuntimeDrivers) {
@@ -2062,15 +2122,19 @@ class NativeKernel {
                 cwd: REPO_ROOT,
                 command: ensureNativeSidecarBinary(),
                 args: [],
-                frameTimeoutMs: NATIVE_SIDECAR_FRAME_TIMEOUT_MS,
+                gracefulExitMs: 100,
+                forceExitMs: 100,
             }));
         const session = await this.measureBoot("session_open", () => client.authenticateAndOpenSession());
         const vm = await this.measureBoot("vm_create", () => client.createVm(session, {
             runtime: "java_script",
             config: {
                 env: createVmEnv,
+                ...(this.options.user ? { user: this.options.user } : {}),
                 rootFilesystem,
-                ...(bootstrapPermissions ? { permissions: bootstrapPermissions } : {}),
+                ...(bootstrapPermissions
+                    ? { permissions: bootstrapPermissions }
+                    : {}),
                 loopbackExemptPorts: this.loopbackExemptPorts,
                 ...(this.options.jsRuntime
                     ? { jsRuntime: this.options.jsRuntime }

package/dist/vm-config.d.ts

@@ -1,5 +1,8 @@
 export type { AcpLimitsConfig } from "./generated/AcpLimitsConfig.js";
 export type { CreateVmConfig } from "./generated/CreateVmConfig.js";
+export type { VmUserConfig } from "./generated/VmUserConfig.js";
+export type { VmUserAccountConfig } from "./generated/VmUserAccountConfig.js";
+export type { VmGroupConfig } from "./generated/VmGroupConfig.js";
 export type { FsPermissionRule } from "./generated/FsPermissionRule.js";
 export type { FsPermissionRuleSet } from "./generated/FsPermissionRuleSet.js";
 export type { FsPermissionScope } from "./generated/FsPermissionScope.js";
@@ -16,6 +19,7 @@ export type { PatternPermissionScope } from "./generated/PatternPermissionScope.
 export type { PermissionMode } from "./generated/PermissionMode.js";
 export type { PermissionsPolicy } from "./generated/PermissionsPolicy.js";
 export type { PluginLimitsConfig } from "./generated/PluginLimitsConfig.js";
+export type { ProcessLimitsConfig } from "./generated/ProcessLimitsConfig.js";
 export type { PythonLimitsConfig } from "./generated/PythonLimitsConfig.js";
 export type { ResourceLimitsConfig } from "./generated/ResourceLimitsConfig.js";
 export type { RootFilesystemConfig } from "./generated/RootFilesystemConfig.js";
@@ -24,7 +28,7 @@ export type { RootFilesystemEntryEncoding } from "./generated/RootFilesystemEntr
 export type { RootFilesystemEntryKind } from "./generated/RootFilesystemEntryKind.js";
 export type { RootFilesystemLowerDescriptor } from "./generated/RootFilesystemLowerDescriptor.js";
 export type { RootFilesystemMode } from "./generated/RootFilesystemMode.js";
-export type { ToolLimitsConfig } from "./generated/ToolLimitsConfig.js";
+export type { BindingLimitsConfig } from "./generated/BindingLimitsConfig.js";
 export type { VmDnsConfig } from "./generated/VmDnsConfig.js";
 export type { VmLimitsConfig } from "./generated/VmLimitsConfig.js";
 export type { VmListenPolicyConfig } from "./generated/VmListenPolicyConfig.js";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rivet-dev/agentos-runtime-core",
-	"version": "0.0.0-codex-actor-plugin-contract-coverage.115ca8a",
+	"version": "0.0.0-fix-main-wasm-ownership.150c49a",
 	"type": "module",
 	"license": "Apache-2.0",
 	"main": "./dist/index.js",
@@ -189,10 +189,12 @@
 		"check-types": "pnpm run build:protocol && pnpm run build:vm-config && tsc --noEmit",
 		"build": "pnpm run build:protocol && pnpm run build:vm-config && tsc && pnpm run copy-commands",
 		"prepack": "node scripts/copy-wasm-commands.mjs --require",
-		"test": "vitest run"
+		"pretest": "cargo build -q -p agentos-native-sidecar",
+		"test": "vitest run",
+		"test:ecosystem": "AGENTOS_ECOSYSTEM_E2E=1 vitest run tests/integration/e2e-project-matrix.test.ts -t 'required Node ecosystem reactor matrix' --reporter=verbose"
 	},
 	"dependencies": {
-		"@rivet-dev/agentos-runtime-sidecar": "0.0.0-codex-actor-plugin-contract-coverage.115ca8a",
+		"@rivet-dev/agentos-runtime-sidecar": "0.0.0-fix-main-wasm-ownership.150c49a",
 		"@rivetkit/bare-ts": "^0.6.2",
 		"zod": "^4.1.11"
 	},

package/dist/generated/ToolLimitsConfig.d.ts

@@ -1,10 +0,0 @@
-export type ToolLimitsConfig = {
-    defaultToolTimeoutMs?: number;
-    maxToolTimeoutMs?: number;
-    maxRegisteredToolkits?: number;
-    maxRegisteredToolsPerVm?: number;
-    maxToolsPerToolkit?: number;
-    maxToolSchemaBytes?: number;
-    maxToolExamplesPerTool?: number;
-    maxToolExampleInputBytes?: number;
-};