rivetkit 2.3.27 → 2.3.28

package/src/agent-os/actor/filesystem.ts

@@ -1,131 +0,0 @@
-import type {
-	AgentRegistryEntry,
-	BatchReadResult,
-	BatchWriteEntry,
-	BatchWriteResult,
-	DirEntry,
-	ReaddirRecursiveOptions,
-} from "@rivet-dev/agent-os-core";
-import type { AgentOsActorConfig } from "../config";
-import type { AgentOsActionContext } from "../types";
-import { ensureVm } from "./index";
-
-// Infer types from AgentOs methods since @secure-exec/core is not a direct dep.
-type VirtualStat = Awaited<
-	ReturnType<import("@rivet-dev/agent-os-core").AgentOs["stat"]>
->;
-type DeleteOptions = Parameters<
-	import("@rivet-dev/agent-os-core").AgentOs["delete"]
->[1];
-
-// Build filesystem and agent registry actions for the actor factory.
-export function buildFilesystemActions<TConnParams>(
-	config: AgentOsActorConfig<TConnParams>,
-) {
-	return {
-		readFile: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-		): Promise<Uint8Array> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.readFile(path);
-		},
-
-		writeFile: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-			content: string | Uint8Array,
-		): Promise<void> => {
-			const agentOs = await ensureVm(c, config);
-			await agentOs.writeFile(path, content);
-		},
-
-		readFiles: async (
-			c: AgentOsActionContext<TConnParams>,
-			paths: string[],
-		): Promise<BatchReadResult[]> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.readFiles(paths);
-		},
-
-		writeFiles: async (
-			c: AgentOsActionContext<TConnParams>,
-			entries: BatchWriteEntry[],
-		): Promise<BatchWriteResult[]> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.writeFiles(entries);
-		},
-
-		mkdir: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-			options?: { recursive?: boolean },
-		): Promise<void> => {
-			const agentOs = await ensureVm(c, config);
-			await agentOs.mkdir(path, options);
-		},
-
-		readdir: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-		): Promise<string[]> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.readdir(path);
-		},
-
-		readdirRecursive: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-			options?: ReaddirRecursiveOptions,
-		): Promise<DirEntry[]> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.readdirRecursive(path, options);
-		},
-
-		stat: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-		): Promise<VirtualStat> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.stat(path);
-		},
-
-		exists: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-		): Promise<boolean> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.exists(path);
-		},
-
-		move: async (
-			c: AgentOsActionContext<TConnParams>,
-			from: string,
-			to: string,
-		): Promise<void> => {
-			const agentOs = await ensureVm(c, config);
-			await agentOs.move(from, to);
-		},
-
-		deleteFile: async (
-			c: AgentOsActionContext<TConnParams>,
-			path: string,
-			options?: DeleteOptions,
-		): Promise<void> => {
-			const agentOs = await ensureVm(c, config);
-			await agentOs.delete(path, options);
-		},
-
-		// TODO: mountFs and unmountFs are not exposed as actor actions because
-		// filesystem drivers (VirtualFileSystem) are not serializable over the
-		// network. Mount filesystems via the `options.mounts` config in agentOs()
-		// instead. See: https://github.com/rivet-dev/rivet/issues/XXXX
-
-		listAgents: async (
-			c: AgentOsActionContext<TConnParams>,
-		): Promise<AgentRegistryEntry[]> => {
-			const agentOs = await ensureVm(c, config);
-			return agentOs.listAgents();
-		},
-	};
-}

package/src/agent-os/actor/index.ts

@@ -1,285 +0,0 @@
-import type { AgentOsOptions, MountConfig } from "@rivet-dev/agent-os-core";
-import { AgentOs, createInMemoryFileSystem } from "@rivet-dev/agent-os-core";
-import { type ActorDefinition, actor, event } from "@/actor/mod";
-import type { DatabaseProvider, RawAccess } from "@/common/database/config";
-import { db } from "@/common/database/mod";
-import {
-	type AgentOsActorConfig,
-	type AgentOsActorConfigInput,
-	agentOsActorConfigSchema,
-} from "../config";
-import type {
-	AgentOsActionContext,
-	AgentOsActorState,
-	AgentOsActorVars,
-	CronEventPayload,
-	PermissionRequestPayload,
-	ProcessExitPayload,
-	ProcessOutputPayload,
-	SessionEventPayload,
-	ShellDataPayload,
-	VmBootedPayload,
-	VmShutdownPayload,
-} from "../types";
-import { buildCronActions } from "./cron";
-import { migrateAgentOsTables } from "./db";
-import { buildFilesystemActions } from "./filesystem";
-import { buildNetworkActions } from "./network";
-import { buildOnRequestHandler, buildPreviewActions } from "./preview";
-import { buildProcessActions } from "./process";
-import {
-	buildConfigActions,
-	buildPromptActions,
-	buildSessionActions,
-	buildSessionPersistenceActions,
-} from "./session";
-import { buildShellActions } from "./shell";
-
-// --- VM lifecycle helpers ---
-
-async function ensureVm<TConnParams>(
-	c: AgentOsActionContext<TConnParams>,
-	config: AgentOsActorConfig<TConnParams>,
-): Promise<AgentOs> {
-	if (c.vars.agentOs) {
-		return c.vars.agentOs;
-	}
-
-	const start = Date.now();
-
-	// Build options with in-memory VFS as default working directory mount.
-	const options = buildVmOptions(config.options);
-
-	const agentOs = await AgentOs.create(options);
-	c.vars.agentOs = agentOs;
-
-	// Wire cron events to actor events.
-	agentOs.onCronEvent((cronEvent) => {
-		c.broadcast("cronEvent", { event: cronEvent });
-	});
-
-	c.broadcast("vmBooted", {});
-	c.log.info({
-		msg: "agent-os vm booted",
-		bootDurationMs: Date.now() - start,
-	});
-
-	return agentOs;
-}
-
-function buildVmOptions(userOptions?: AgentOsOptions): AgentOsOptions {
-	const userMounts = userOptions?.mounts ?? [];
-
-	// Check if the user already provided a mount at /home/user. If so, respect
-	// their override and skip the default in-memory VFS mount.
-	const hasWorkdirMount = userMounts.some(
-		(m: MountConfig) => m.path === "/home/user",
-	);
-
-	if (hasWorkdirMount) {
-		return userOptions ?? {};
-	}
-
-	// TODO: Reimplement with persistent backend (SQLite-backed metadata and
-	// actor storage-backed blocks) so VM filesystem state survives sleep/wake.
-	const memMount: MountConfig = {
-		path: "/home/user",
-		driver: createInMemoryFileSystem(),
-	};
-
-	return {
-		...userOptions,
-		mounts: [memMount, ...userMounts],
-	};
-}
-
-// --- Prevent-sleep coordination ---
-
-function syncPreventSleep<TConnParams>(
-	c: AgentOsActionContext<TConnParams>,
-): void {
-	const shouldPrevent =
-		c.vars.activeSessionIds.size > 0 ||
-		c.vars.activeProcesses.size > 0 ||
-		c.vars.activeHooks.size > 0 ||
-		c.vars.activeShells.size > 0;
-
-	c.setPreventSleep(shouldPrevent);
-
-	c.log.info({
-		msg: "agent-os prevent sleep sync",
-		preventSleep: shouldPrevent,
-		activeSessions: c.vars.activeSessionIds.size,
-		activeProcesses: c.vars.activeProcesses.size,
-		activeHooks: c.vars.activeHooks.size,
-		activeShells: c.vars.activeShells.size,
-	});
-}
-
-// --- Hook tracking ---
-
-function runHook<TConnParams>(
-	c: AgentOsActionContext<TConnParams>,
-	name: string,
-	callback: () => void | Promise<void>,
-): void {
-	const promise = Promise.resolve(callback())
-		.catch((error) =>
-			c.log.error({ msg: "agent-os hook failed", hookName: name, error }),
-		)
-		.finally(() => {
-			c.vars.activeHooks.delete(promise);
-			syncPreventSleep(c);
-		});
-	c.vars.activeHooks.add(promise);
-	syncPreventSleep(c);
-	c.waitUntil(promise);
-}
-
-// --- Public API ---
-
-export function agentOs<TConnParams = undefined>(
-	config: AgentOsActorConfigInput<TConnParams>,
-): ActorDefinition<
-	AgentOsActorState,
-	TConnParams,
-	undefined,
-	AgentOsActorVars,
-	undefined,
-	DatabaseProvider<RawAccess>,
-	{
-		sessionEvent: typeof sessionEventToken;
-		permissionRequest: typeof permissionRequestToken;
-		vmBooted: typeof vmBootedToken;
-		vmShutdown: typeof vmShutdownToken;
-		processOutput: typeof processOutputToken;
-		processExit: typeof processExitToken;
-		shellData: typeof shellDataToken;
-		cronEvent: typeof cronEventToken;
-	},
-	Record<never, never>,
-	any
-> {
-	const parsedConfig = agentOsActorConfigSchema.parse(
-		config,
-	) as AgentOsActorConfig<TConnParams>;
-	const actions = {
-		...buildSessionActions(parsedConfig),
-		...buildPromptActions(parsedConfig),
-		...buildConfigActions(parsedConfig),
-		...buildSessionPersistenceActions(parsedConfig),
-		...buildProcessActions(parsedConfig),
-		...buildFilesystemActions(parsedConfig),
-		...buildPreviewActions(parsedConfig),
-		...buildShellActions(parsedConfig),
-		...buildCronActions(parsedConfig),
-		...buildNetworkActions(parsedConfig),
-	};
-
-	return actor<
-		AgentOsActorState,
-		TConnParams,
-		undefined,
-		AgentOsActorVars,
-		undefined,
-		DatabaseProvider<RawAccess>,
-		{
-			sessionEvent: typeof sessionEventToken;
-			permissionRequest: typeof permissionRequestToken;
-			vmBooted: typeof vmBootedToken;
-			vmShutdown: typeof vmShutdownToken;
-			processOutput: typeof processOutputToken;
-			processExit: typeof processExitToken;
-			shellData: typeof shellDataToken;
-			cronEvent: typeof cronEventToken;
-		},
-		Record<never, never>,
-		typeof actions
-	>({
-		options: {
-			sleepGracePeriod: 900_000,
-			actionTimeout: 900_000,
-		},
-		createState: async () => ({}),
-		createVars: () => ({
-			agentOs: null,
-			activeSessionIds: new Set<string>(),
-			activeProcesses: new Set<number>(),
-			activeHooks: new Set<Promise<void>>(),
-			activeShells: new Set<string>(),
-			sessions: new Set(),
-		}),
-		db: db({
-			onMigrate: migrateAgentOsTables,
-		}),
-		events: {
-			sessionEvent: sessionEventToken,
-			permissionRequest: permissionRequestToken,
-			vmBooted: vmBootedToken,
-			vmShutdown: vmShutdownToken,
-			processOutput: processOutputToken,
-			processExit: processExitToken,
-			shellData: shellDataToken,
-			cronEvent: cronEventToken,
-		},
-		onBeforeConnect: parsedConfig.onBeforeConnect
-			? async (ctx, params) => {
-					// Skip user auth for preview URL requests. The signed token
-					// in onRequest is the credential; browsers navigating preview
-					// URLs cannot supply actor connection params.
-					if (ctx.request) {
-						const url = new URL(ctx.request.url);
-						if (url.pathname.startsWith("/fetch/")) {
-							return;
-						}
-					}
-					await parsedConfig.onBeforeConnect?.(ctx, params);
-				}
-			: undefined,
-		onRequest: buildOnRequestHandler(parsedConfig),
-		onSleep: async (c) => {
-			c.log.info({
-				msg: "agent-os vm shutdown for sleep",
-				activeSessions: c.vars.sessions.size,
-				activeProcesses: c.vars.activeProcesses.size,
-				activeShells: c.vars.activeShells.size,
-			});
-
-			if (c.vars.agentOs) {
-				await c.vars.agentOs.dispose();
-				c.vars.agentOs = null;
-			}
-
-			c.broadcast("vmShutdown", { reason: "sleep" as const });
-		},
-		onDestroy: async (c) => {
-			c.log.info({
-				msg: "agent-os vm shutdown for destroy",
-				activeSessions: c.vars.sessions.size,
-				activeProcesses: c.vars.activeProcesses.size,
-				activeShells: c.vars.activeShells.size,
-			});
-
-			if (c.vars.agentOs) {
-				await c.vars.agentOs.dispose();
-				c.vars.agentOs = null;
-			}
-
-			c.broadcast("vmShutdown", { reason: "destroy" as const });
-		},
-		actions,
-	});
-}
-
-// Event type tokens. Declared at module level so they can be referenced in
-// the actor generic type parameters.
-const sessionEventToken = event<SessionEventPayload>();
-const permissionRequestToken = event<PermissionRequestPayload>();
-const vmBootedToken = event<VmBootedPayload>();
-const vmShutdownToken = event<VmShutdownPayload>();
-const processOutputToken = event<ProcessOutputPayload>();
-const processExitToken = event<ProcessExitPayload>();
-const shellDataToken = event<ShellDataPayload>();
-const cronEventToken = event<CronEventPayload>();
-
-export { ensureVm, syncPreventSleep, runHook };

package/src/agent-os/actor/network.ts

@@ -1,58 +0,0 @@
-import type { AgentOsActorConfig } from "../config";
-import type { AgentOsActionContext } from "../types";
-import { ensureVm } from "./index";
-
-// Serializable fetch options for the actor action boundary.
-export interface VmFetchOptions {
-	method?: string;
-	headers?: Record<string, string>;
-	body?: string | Uint8Array;
-}
-
-// Serializable fetch result returned by the actor action.
-export interface VmFetchResult {
-	status: number;
-	statusText: string;
-	headers: Record<string, string>;
-	body: Uint8Array;
-}
-
-// Build network actions for the actor factory.
-export function buildNetworkActions<TConnParams>(
-	config: AgentOsActorConfig<TConnParams>,
-) {
-	return {
-		vmFetch: async (
-			c: AgentOsActionContext<TConnParams>,
-			port: number,
-			url: string,
-			options?: VmFetchOptions,
-		): Promise<VmFetchResult> => {
-			const agentOs = await ensureVm(c, config);
-
-			const headers = new Headers(options?.headers);
-			const request = new Request(url, {
-				method: options?.method ?? "GET",
-				headers,
-				body: options?.body ?? null,
-			});
-
-			const response = await agentOs.fetch(port, request);
-
-			// Serialize response headers to a plain object.
-			const responseHeaders: Record<string, string> = {};
-			response.headers.forEach((value, key) => {
-				responseHeaders[key] = value;
-			});
-
-			const body = new Uint8Array(await response.arrayBuffer());
-
-			return {
-				status: response.status,
-				statusText: response.statusText,
-				headers: responseHeaders,
-				body,
-			};
-		},
-	};
-}

package/src/agent-os/actor/preview.ts

@@ -1,190 +0,0 @@
-import crypto from "node:crypto";
-import type { RequestContext } from "@/actor/config";
-import type { DatabaseProvider, RawAccess } from "@/common/database/config";
-import type { AgentOsActorConfig } from "../config";
-import type {
-	AgentOsActionContext,
-	AgentOsActorState,
-	AgentOsActorVars,
-} from "../types";
-import { ensureVm } from "./index";
-
-// Generate a 32-character lowercase alphanumeric token (a-z0-9).
-// 36^32 ~= 1.6e49 possible tokens, brute-force infeasible.
-export function generateToken(): string {
-	const bytes = crypto.randomBytes(32);
-	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
-	let token = "";
-	for (let i = 0; i < 32; i++) {
-		token += alphabet[bytes[i]! % alphabet.length];
-	}
-	return token;
-}
-
-// CORS headers added to all preview proxy responses.
-const CORS_HEADERS: Record<string, string> = {
-	"Access-Control-Allow-Origin": "*",
-	"Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-	"Access-Control-Allow-Headers": "*",
-};
-
-function addCorsHeaders(response: Response): Response {
-	const headers = new Headers(response.headers);
-	for (const [key, value] of Object.entries(CORS_HEADERS)) {
-		headers.set(key, value);
-	}
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers,
-	});
-}
-
-type AgentOsRequestContext<TConnParams> = RequestContext<
-	AgentOsActorState,
-	TConnParams,
-	undefined,
-	AgentOsActorVars,
-	undefined,
-	DatabaseProvider<RawAccess>
->;
-
-export function buildOnRequestHandler<TConnParams>(
-	config: AgentOsActorConfig<TConnParams>,
-) {
-	return async (
-		c: AgentOsRequestContext<TConnParams>,
-		request: Request,
-	): Promise<Response> => {
-		const url = new URL(request.url);
-		const pathname = url.pathname;
-
-		// Expect paths like /fetch/{token} or /fetch/{token}/remaining/path.
-		const match = pathname.match(/^\/fetch\/([a-z0-9]+)(\/.*)?$/);
-		if (!match) {
-			return new Response("Not Found", { status: 404 });
-		}
-
-		// Handle OPTIONS preflight before token validation.
-		if (request.method === "OPTIONS") {
-			return new Response(null, { status: 204, headers: CORS_HEADERS });
-		}
-
-		const token = match[1]!;
-		const remainingPath = match[2] ?? "/";
-
-		// Validate token from SQLite.
-		const now = Date.now();
-		const rows: { port: number }[] = await c.db.execute(
-			`SELECT port FROM agent_os_preview_tokens WHERE token = ? AND expires_at > ?`,
-			token,
-			now,
-		);
-
-		if (rows.length === 0) {
-			c.log.warn({ msg: "agent-os preview auth failed", token });
-			return addCorsHeaders(new Response("Forbidden", { status: 403 }));
-		}
-
-		const port = rows[0]?.port;
-
-		// Boot the VM if needed.
-		const agentOs = await ensureVm(
-			c as AgentOsActionContext<TConnParams>,
-			config,
-		);
-
-		// Build the request to proxy through the VM's virtual network.
-		const vmUrl = `http://localhost:${port}${remainingPath}${url.search}`;
-		const vmRequest = new Request(vmUrl, {
-			method: request.method,
-			headers: request.headers,
-			body: request.body,
-			duplex: "half",
-		} as RequestInit);
-
-		const vmResponse = await agentOs.fetch(port, vmRequest);
-
-		c.log.info({
-			msg: "agent-os preview request proxied",
-			port,
-			method: request.method,
-			path: remainingPath,
-			status: vmResponse.status,
-		});
-
-		return addCorsHeaders(vmResponse);
-	};
-}
-
-export function buildPreviewActions<TConnParams>(
-	config: AgentOsActorConfig<TConnParams>,
-) {
-	return {
-		createSignedPreviewUrl: async (
-			c: AgentOsActionContext<TConnParams>,
-			port: number,
-			expiresInSeconds?: number,
-		): Promise<{
-			path: string;
-			token: string;
-			port: number;
-			expiresAt: number;
-		}> => {
-			await ensureVm(c, config);
-
-			const effectiveExpires =
-				expiresInSeconds ?? config.preview.defaultExpiresInSeconds;
-			const maxExpires = config.preview.maxExpiresInSeconds;
-
-			if (effectiveExpires < 1 || effectiveExpires > maxExpires) {
-				throw new Error(
-					`expiresInSeconds must be between 1 and ${maxExpires}`,
-				);
-			}
-
-			const token = generateToken();
-			const now = Date.now();
-			const expiresAt = now + effectiveExpires * 1000;
-
-			// Insert token and lazy-delete expired tokens.
-			await c.db.execute(
-				`INSERT INTO agent_os_preview_tokens (token, port, created_at, expires_at)
-				 VALUES (?, ?, ?, ?)`,
-				token,
-				port,
-				now,
-				expiresAt,
-			);
-			await c.db.execute(
-				`DELETE FROM agent_os_preview_tokens WHERE expires_at <= ?`,
-				now,
-			);
-
-			// Path relative to the actor's gateway URL. Full URL is
-			// `${gatewayUrl}/request/fetch/${token}` where gatewayUrl
-			// comes from the client's getGatewayUrl().
-			const path = `/request/fetch/${token}`;
-
-			c.log.info({
-				msg: "agent-os preview token created",
-				port,
-				expiresInSeconds: effectiveExpires,
-			});
-
-			return { path, token, port, expiresAt };
-		},
-
-		expireSignedPreviewUrl: async (
-			c: AgentOsActionContext<TConnParams>,
-			token: string,
-		): Promise<void> => {
-			await c.db.execute(
-				`DELETE FROM agent_os_preview_tokens WHERE token = ?`,
-				token,
-			);
-
-			c.log.info({ msg: "agent-os preview token expired", token });
-		},
-	};
-}