rivet-dev/agentos

AgentOS is a secure, virtualized execution runtime that isolates JavaScript, Python, and WebAssembly workloads within sandboxed virtual machines. It provides a comprehensive POSIX-compatible environment by compiling core utilities and shell tools to WebAssembly, enabling deterministic and reproducible code execution with strict resource limits and permission policies. The system supports persistent VM lifecycles, network and filesystem confinement, and integrates with various cloud and local sandbox providers for flexible deployment.

The native sidecar now supports executing JavaScript code, providing a runtime environment that includes Node.js-compatible modules for cryptographic operations (hashing, HMAC, PBKDF2, scrypt, symmetric/asymmetric encryption, and key generation), HTTP client capabilities (including loopback request handling and streaming), and SQLite database access (opening, querying, and managing statements). This implementation bridges these JavaScript APIs to the underlying sidecar kernel via synchronous RPC calls, enabling guest applications to perform standard web and data operations within the sandboxed execution context.

crates/native-sidecar/src/execution/javascript · high confidence

The execution runtime now supports running Python scripts and WebAssembly modules via WASI. New runner assets in \crates/execution/assets/runners\ provide the \python-runner.mjs\ (leveraging Pyodide for Python execution) and \wasm-runner.mjs\/\wasi-module.js\ (implementing the WASI syscall interface to bridge guest WebAssembly code to the host environment). This enables users to execute Python code and WASM binaries directly within the agent environment.

crates/execution/assets/runners · high confidence

This change enables the \fd-find\, \grep\, \ripgrep\, and \findutils\ packages to run on the WASI target by applying patches that replace platform-specific logic (such as file metadata access and threading models) with WASI-compatible implementations. It also introduces native Rust wrapper binaries for \egrep\ and \fgrep\ that delegate to the underlying \grep\ implementation, ensuring these aliases are available in the toolchain.

(repo-wide) · high confidence

A new example file at secure-exec/examples/code-mode/src/index.ts has been added to demonstrate the secure-exec library's code-mode capabilities. This example illustrates how to define host functions (such as listing orders and processing refunds) with Zod schemas, generate a JavaScript program from an AI model, and execute it safely within a sandboxed environment using the evaluate function with specific timeouts and input constraints.

secure-exec/examples/code-mode · high confidence

New build artifacts have been introduced to support cross-compilation of the \agentos-native-sidecar\ binary for macOS (Darwin) and Linux (GNU) targets. The \darwin.Dockerfile\ leverages \osxcross\ to build for \aarch64\ and \x86\_64\ Apple platforms, while \linux-gnu.Dockerfile\ uses Ubuntu 24.04 with LLVM 22 to produce \x86\_64-unknown-linux-gnu\ binaries. Both configurations integrate \sccache\ for build acceleration and utilize BuildKit cache mounts for Rust and pnpm artifacts, ensuring reproducible and efficient compilation of the native sidecar component.

docker/build · high confidence

The secure-exec/examples/host-functions package now includes an index.ts example that demonstrates how to use the evaluate function with host functions. The example shows defining an input schema using Zod, passing host functions that run in the host process with credentials, and executing guest code within a VM. This provides a concrete reference for integrating secure execution with typed inputs and host-side function execution.

secure-exec/examples/host-functions · high confidence

This change introduces native Rust implementations for a suite of core utilities (including sort, awk, jq, gzip, tar, diff, file, which, and others) and built-in shell commands (sleep, test, whoami). For the core utilities, the diff shows new main entry points that delegate to specific agentos crates, with sort, awk, and jq now explicitly handling stdout flush errors to ensure correct exit codes. The built-in commands are implemented in the toolchain's builtins library, providing WASM-compatible versions of sleep (using host callbacks), test (evaluating conditional expressions), and whoami (reading environment variables), alongside shims for other commands like which. Additionally, tests were added to verify sort's external spill behavior without signal handlers and which's executable mode detection.

(repo-wide) · high confidence

A new example server at secure-exec/examples/dev-server demonstrates how to use the createVm API to run a Node.js HTTP server inside a virtual machine. The example shows spawning a process that listens on an internal VM port, waiting for it to become ready, and sending HTTP requests via vm.network.httpRequest without exposing the port on the host network, followed by proper process termination and VM disposal.

secure-exec/examples/dev-server · high confidence

Added example applications demonstrating the secure-exec library's capabilities, including TypeScript type checking, execution limits (timeouts and memory), permission scoping (network access), and plugin isolation.

(repo-wide) · high confidence

This change introduces a collection of TypeScript example projects under \secure-exec/examples\ (including quickstart, ai-agent, benchmark, mounts, and others) to demonstrate the new function-style secure execution API. The quickstart examples specifically illustrate core capabilities such as the \evaluate\ and \execute\ functions, input handling, output capturing, and error management, while other examples cover advanced features like host data mounting and module execution.

secure-exec/examples, secure-exec/examples/quickstart · high confidence

The examples/js-networking directory now includes a TypeScript source file that demonstrates how guest code interacts with network permissions. It illustrates that with network 'allow', guests can communicate via loopback within the VM, and with network 'deny', external egress is blocked while VM-local operations remain functional. It also shows that accessing host loopback services requires explicitly exempting the specific host port via loopbackExemptPorts, even when general network access is permitted.

examples/js-networking · high confidence

The \toolchain/crates/libs/shims\ library now provides custom Rust implementations for several standard POSIX utilities (\env\, \grep\ aliases, \nice\, \nohup\, \stdbuf\, \timeout\, \which\, and \xargs\) to ensure compatibility within the WASM sandbox. Because the WASI environment lacks native support for process priority, signal handling, and external buffering control, the shims for \nice\, \nohup\, and \stdbuf\ transparently pass through to the child command while ignoring unsupported flags. The \timeout\ shim implements a non-blocking wait loop using \wasi\_ext::host\_sleep\_ms\ to prevent busy-waiting, and the \env\ shim manages environment variable isolation for spawned processes. Additionally, the \which\ shim includes a WASI-specific file mode checker to resolve executable paths, and \grep\_alias\ ensures legacy \egrep\/\fgrep\ commands continue to function by delegating to \grep\ with appropriate flags.

toolchain/crates/libs/shims · high confidence

The curl native overlay now includes the core curl setup and SSL configuration headers and source files, establishing the foundation for in-guest TLS using mbedTLS. This change introduces the necessary build configuration and SSL backend abstraction layer required for secure connections within the runtime environment.

software/curl/native/c/overlay · medium confidence

Wget now supports real HTTPS connections on the wasm32-wasip1 target by implementing a new in-guest TLS backend using mbedTLS. This change introduces \wasi\_ssl.c\, which implements the standard SSL interface functions (\ssl\_init\, \ssl\_cleanup\, \ssl\_connect\_wget\, \ssl\_check\_certificate\) to perform TLS handshakes and X.509 certificate verification entirely within the guest environment. Users can now fetch resources over HTTPS with trust configuration mirroring Linux Wget, including support for default CA bundles, custom CA certificates, CRLs, and hostname verification.

software/wget/native/c/overlay · high confidence

The build tools now include a new set of polyfills in \packages/build-tools/bridge-src/polyfills\ to ensure consistent behavior of Web APIs across different JavaScript runtimes. This change introduces fallback implementations for \AbortController\ and \AbortSignal\ (including static methods like \timeout\ and \any\), \Blob\ and \File\ with specific size/part limits, and DOM event handling (\Event\, \CustomEvent\, \EventTarget\). It also adds polyfills for text encoding (\TextEncoder\, \TextDecoder\) using upstream libraries, and URL handling (\URL\, \URLSearchParams\) with a managed \blob:\ URL store. These modules are exported via \index.ts\ to define global counterparts where native support is missing or incomplete, ensuring that code relying on these standard Web APIs functions correctly within the execution environment.

packages/build-tools/bridge-src/polyfills · high confidence

A new build script, \copy-wasm-commands.mjs\, has been added to the \packages/runtime-core/scripts\ directory to handle the packaging of WebAssembly command binaries. This script copies compiled WASM binaries from the toolchain build output into the \@rivet-dev/agentos-runtime-core\ package directory, ensuring they are included in the published npm tarball. It specifically resolves symlinks to prevent npm from dropping them and validates that all required command artifacts (derived from software package manifests) are present in the final distribution.

packages/runtime-core/scripts · high confidence

The runtime-core package now includes a comprehensive suite of generated TypeScript type definitions (via ts-rs) that expose the internal VM configuration schema to the TypeScript layer. This adds strict typing for \CreateVmConfig\ and its sub-components, including \JsRuntimeConfig\ (with platform and module resolution options), \PermissionsPolicy\ (covering filesystem, network, and host function scopes), and granular \\*LimitsConfig\ types for resources such as CPU, memory, I/O, and execution timeouts. These types ensure that VM creation and runtime options are validated against the Rust-side schema at compile time.

packages/runtime-core/src/generated · high confidence

The \packages/manifest\ package now defines the structure for AgentOS packages via a new JSON schema (\agentos-package.schema.json\) and corresponding TypeScript interfaces. This introduces a standardized \agentos-package.json\ manifest format that declares a package's \name\, optional \version\, and a \provides\ descriptor for VM environment defaults and read-only file mounts. The package also exports types for \SoftwarePackageRef\ (pointing to \.aospkg\ files) and \PackageDescriptor\, establishing the foundational contract for how packages declare their capabilities to the runtime.

packages/manifest · high confidence

Added a new benchmarking package for the agentOS runtime that measures cold-start latency, warm execution speed, and memory overhead. The suite includes scripts and utilities to run cold-start scenarios (fresh-sidecar, shared-sidecar, resident-runner) and memory usage tests, along with a comprehensive latency matrix covering filesystem, networking, and module loading operations. It also provides a PR gate mechanism to detect performance regressions against a committed baseline.

packages/runtime-benchmarks · high confidence

A new \scripts/pipboy\ CLI tool is added to provide CI insights for pull requests. It introduces commands to pack workspace packages, measure install footprint (size and entrypoints), check hygiene (advisories, licenses, sources, bans, unused dependencies), and analyze native binary changes. The tool compares PR changes against baselines from main, reporting failures when budgets are exceeded or new blocking hygiene issues are introduced, and posts these results as comments on the PR.

scripts/pipboy · high confidence

Added a new Rust client SDK (\agentos-client\) that provides a 1:1 port of the TypeScript Agent OS client, enabling Rust applications to interact with the native sidecar. This SDK exposes the full Agent OS API surface—including VM lifecycle management, process and shell execution, file system operations, cron scheduling, and language execution (JavaScript/TypeScript/Python)—along with a structured error taxonomy and configuration model that mirrors the TypeScript implementation.

crates/client/src · high confidence

The software directory now provides a structured catalog for building and distributing immutable \.aospkg\ packages for agentOS VMs. This includes a new build workflow using \pnpm\ and \just\, a registry metadata system defined in \agentos-package.json\, and a set of default core packages such as coreutils, diffutils, curl, and POSIX ACL tools. Users can now install software by name from a registry, and the system supports local testing via embedded core paths or hosted actor URLs with digest verification.

software · high confidence

The runtime-benchmarks package now includes a CI gate that enforces performance stability by comparing current benchmark results against a stored baseline. New scripts in \src/\ handle this workflow: \quick-gate.ts\ runs a selected set of latency operations and fails the build if any exceed a configurable threshold (default 2x) relative to the baseline, while \compare-baseline.ts\ provides the logic to calculate these ratios and handle edge cases like missing data or tiny-latency floors. Additionally, \check-native-ops.ts\ ensures that the JavaScript operation definitions remain in sync with the native \agentos-native-baseline\ binary, preventing drift between the two implementations.

packages/runtime-benchmarks/src · high confidence

This change adds the \crates/bridge\ library, which defines the shared interface contracts between the agentOS kernel and execution planes. It introduces a \FilesystemBridge\ trait for standard file operations (read, write, stat, etc.) and structured permission request types for filesystem, network, and command access. Additionally, it implements a centralized \QueueRegistry\ and \TrackedLimit\ system to monitor bounded queues and resource usage (such as V8 heap, WASM memory, and VM file descriptors), emitting structured \LimitWarning\ events when usage approaches capacity thresholds.

crates/bridge/src · high confidence

The \crates/v8-runtime/src\ module now provides a new embedded V8 runtime implementation that manages V8 isolates and sessions via a custom binary IPC wire format (\ipc\_binary.rs\) instead of the previous MessagePack framing. This runtime supports an optional CBOR serialization codec (activated via the \AGENTOS\_V8\_CODEC=cbor\ environment variable) to improve compatibility with non-standard V8 environments like Bun. The implementation includes a snapshot cache for pre-warming workers, dedicated session threads for execution, and specific memory management features such as capping ArrayBuffer memory per isolate and returning freed native heap pages to the OS on Linux.

crates/v8-runtime/src · high confidence

Added a new \sidecar-client\ crate that provides the foundational stdio transport for communicating with the native AgentOS sidecar. This client manages the sidecar process lifecycle, implements a framed BARE protocol codec for wire payloads, and includes a silence watchdog to detect when the sidecar exits or becomes unresponsive. It exposes raw transport primitives and generated wire types, serving as the base layer for higher-level product clients to build upon.

crates/sidecar-client · high confidence

This release adds native Rust implementations for the \file\, \jq\, and \yq\ command-line utilities, providing file type detection, JSON processing, and multi-format (YAML/XML/TOML/JSON) data transformation capabilities. Additionally, a patch for the \path-dedot\ crate is applied to ensure successful compilation on the WASM target by routing all \target\_family = "wasm"\ builds to the Unix path implementation.

(repo-wide) · high confidence

Adds a new \native-sidecar-browser\ crate that provides the core scaffolding for running AgentOS workloads in a browser environment. This includes the \BrowserSidecar\ service implementation for managing VM lifecycles and guest executions, a \BrowserJsBridge\ for marshalling kernel and host operations to JavaScript, and a \BrowserWireDispatcher\ to handle protocol-level request routing and event polling. This change establishes the foundational runtime layer for the browser target, distinct from the existing native sidecar.

crates/native-sidecar-browser/src · high confidence

This change adds a comprehensive set of new modules to the runtime-core package to support the new AgentOS runtime architecture. It introduces a robust frame-based RPC transport layer (frame-rpc, frame-stream, framing) for communicating with the native sidecar, including support for split lanes and silence watchdogs. It also adds a new host function system (host-functions, host-functions-zod) allowing guest code to invoke host capabilities via Zod-validated schemas, alongside utilities for resolving sidecar binaries, managing event buffers, and handling protocol descriptors.

packages/runtime-core/src · high confidence

A new benchmarking suite in \scripts/benchmarks\ now measures the agentOS sandbox runtime's performance. It includes a cold-start latency benchmark (\coldstart.bench.ts\) that times VM creation through the first workload, and a memory overhead benchmark (\memory.bench.ts\) that calculates the marginal RSS and heap cost per VM using a staircase approach. Both benchmarks share a single sidecar process and use a cold-run snapshot to isolate incremental costs from bootstrap noise. A shell script (\run-benchmarks.sh\) orchestrates the builds and execution, writing structured JSON results to \scripts/benchmarks/results/\.

scripts/benchmarks · high confidence

The \agentos-sandbox\ package now exposes a unified provider API that allows users to start isolated sandboxes for each AgentOS VM using various backends, including Docker, Cloudflare, ComputeSDK, Daytona, E2B, Local, Modal, Vercel, and Fly.io Sprites. This is achieved through a new \sandboxAgentProvider\ adapter that wraps the \sandbox-agent\ library, standardizing the lifecycle management (start/dispose) of sandbox clients. The package also re-exports host functions (\createSandboxHostFunctions\) and filesystem mounting utilities (\createSandboxFs\) from \@rivet-dev/agentos-core\, enabling direct execution of commands and file operations within the sandbox environment. Integration tests verify that VMs can read/write files via sandbox mounts and execute host functions directly.

packages/agentos-sandbox · high confidence

The build-tools bridge now ships a comprehensive set of polyfills for Node.js built-in modules (including buffer, child\_process, console, crypto, dgram, dns, events, fetch, and others) to provide runtime compatibility within the sandboxed environment. These modules implement sandboxed behavior, such as bounded HTTP body sizes and FormData entry limits in fetch, specific error codes for released context handles, and deferred file descriptor closing for child processes, ensuring guest code behaves consistently with Node.js standards while respecting sandbox constraints.

packages/build-tools/bridge-src/builtins · high confidence

The \secure-exec\ package now provides a new API for running JavaScript and TypeScript code in isolated VMs. It exposes \createVm\ for persistent execution contexts with retained state, one-shot convenience functions (\execute\, \evaluate\, \executeFile\) for both languages, and a \Context\ interface to manage variable scope across calls. The runtime handles sidecar lifecycle via \init\ and \shutdown\, applies strict security policies by default, and supports host functions, mounts, and permissions.

secure-exec/src · high confidence

The build-tools bridge now includes a new V8 bridge entry point that establishes a hardened execution environment. This change adds a global-exposure registry that explicitly whitelists and classifies Node.js process and filesystem APIs (such as \process.getuid\, \\_fsAccess\) as 'hardened' to prevent sandbox code from replacing critical bootstrap configuration. It also implements a prelude that patches the global \Buffer\ to support \base64url\ encoding and provides a native \structuredClone\ implementation capable of handling typed arrays, \ArrayBuffer\, \Map\, \Set\, and other complex objects. Additionally, a new transport module handles synchronous dispatch between the sandbox and host, including specific encoding for \undefined\ values and error propagation.

packages/build-tools/bridge-src · high confidence

This change adds four new packages to the repository. The \@rivet-dev/agentos-core\ package provides the embedded TypeScript API for VM lifecycle, filesystem, processes, terminals, language execution, networking, software, cron commands, permissions, limits, and trusted host bindings, explicitly excluding agents, durable sessions, and ACP. The \@rivet-dev/agentos-node-pty\ package implements the \@lydell/node-pty\ JavaScript API on top of agentOS kernel PTYs, intended for packages running inside an agentOS VM without loading a native Node addon. The \@rivet-dev/agentos-runtime-sidecar\ package acts as a platform-specific resolver for the prebuilt \agentos-native-sidecar\ binary, handling resolution priority via environment variables, local binaries, or platform-specific optional dependencies for linux (glibc/musl), darwin, and windows. Finally, the \@rivet-dev/agentos-internal-typescript\ package provides an internal TypeScript compiler tool that can run type-checking and compilation either via a driver-based approach or directly within an existing AgentOS VM context.

packages/core · high confidence

The runtime now enforces strict resource limits and fair scheduling for VMs and their capabilities. A new hierarchical accounting system tracks usage across 29 resource classes (such as sockets, connections, and HTTP/2 streams) with parent-child scope inheritance, rejecting operations that exceed configured ceilings. A generation-aware capability registry manages the lifecycle of native and kernel-backed resources (TCP, UDP, TLS, HTTP/2), ensuring IDs are not recycled within a session and validating transitions. Additionally, a deterministic hierarchical deficit round-robin scheduler allocates operation and byte budgets to VMs and individual capabilities, preventing any single entity from monopolizing runtime resources.

crates/runtime · high confidence

This change adds the \native-sidecar-core\ crate, establishing the foundational runtime for AgentOS VMs. It embeds a Mozilla CA root certificate bundle (pinned via \webpki-root-certs\) to ensure secure TLS connections within guest environments. The crate implements a unified synchronous dispatcher for guest kernel calls, handling filesystem operations (\read\, \write\, \stat\, etc.), networking (\connect\, \listen\, \poll\, \dns.lookup\), and pseudo-terminals (\pty.\*\). It also introduces a host function registry system with strict validation for collections, aliases, and schema limits, alongside protocol frame handling for authentication and session management.

crates/native-sidecar-core · high confidence

The \crates/vm-config\ crate now provides the canonical Rust-side configuration for creating virtual machines, introducing a \VmDefaultsProfile\ enum that allows users to select between a default 'Secure' profile and an 'AgentOs' profile. This change adds support for configuring JavaScript runtime options (including allowed Node.js builtins), bootstrap commands, and specific network policies like loopback-exempt ports. The configuration schema is validated and normalized to enforce limits on builtins and ports, and the types are exported to TypeScript to ensure parity with the frontend runtime options.

crates/vm-config · high confidence

The shell package now provides a native interactive shell that mimics the \docker run\ experience, launching a real Bash process via a PTY rather than a synthetic prompt. It supports Docker-like flags including \-i/--interactive\, \-t/--tty\, \-e/--env\, \--env-file\, \-v/--volume\, and \-w/--workdir\. The shell loads a suite of standard command packages (such as coreutils, vim, jq, and git) from the registry, handling both published \.aospkg\ files and local workspace fallbacks to ensure commands are available even if the native WASM build hasn't run locally.

packages/shell · high confidence

The \crates/execution\ module now provides a native execution plane for running JavaScript (via V8) and Python (via Pyodide) workloads. This includes the core execution engines, a Node.js module import cache, and a CLI benchmark tool (\node-import-bench\) for measuring import and execution performance. The implementation exposes structured APIs for context creation, execution limits, and result reporting, replacing the previous JavaScript execution path with a Rust-native implementation.

crates/execution/src · high confidence

This release adds native WebAssembly System Interface (WASI) support to the coreutils suite and the brush shell. The \mv\ command now includes a native Rust implementation with a comprehensive test suite covering cross-device moves, symlink handling, and inode preservation. The \du\ command is implemented in Rust with support for human-readable output and depth limiting. The \awk\ command is provided via the \awk-rs\ crate, and \sed\ is patched to remove non-WASI dependencies (like \terminal\_size\ and \assert\_fs\) and handle in-place edits correctly. The \brush\ shell is patched to use \reedline\ for interactive input on WASI and to correctly observe the exit status of previous commands. Additionally, \cp\ is patched to use \std::fs::soft\_link\ for symlinks and a buffered copy stream for file transfers, while \ls\ is patched to display file modes, owners, and groups by calling host filesystem and user/group lookup functions via WASI imports.

(repo-wide) · high confidence

The system now includes a comprehensive set of native coreutils (such as cat, ls, chmod, and sh) implemented in Rust, which are compiled to WASM binaries to provide a rich command-line environment within the runtime. To support this, a new vm-test-harness package has been added, providing utilities to detect these WASM binaries, conditionally skip tests when prerequisites are missing, and create integration kernels that mount both the new WASM runtimes and Node.js runtimes. Additionally, a TerminalHarness class has been introduced to allow tests to interact with and assert against deterministic terminal screen states.

(repo-wide) · high confidence

A new \agentos-native-baseline\ crate has been introduced to serve as a native floor for differential performance benchmarking. It implements a suite of system operations—including file I/O, network connections, process spawning, and CPU loops—in pure Rust to provide a baseline against which the overhead of the JavaScript and Python guest execution layers can be measured.

crates/execution · high confidence

The native-sidecar now includes a comprehensive network bridge module that exposes TCP, UDP, Unix domain sockets, TLS, HTTP/2, and DNS resolution capabilities to guest execution environments. This addition provides the underlying transport and protocol handling required for guest processes to perform network I/O, including secure loopback TLS connections, HTTP/2 client and server streams, and structured DNS audit events.

crates/native-sidecar/src/execution/network · high confidence

The repository now includes a suite of new Node.js scripts in the \scripts/\ directory that enforce stricter quality gates during CI. \check-agentos-client-protocol-compat.mjs\ scans Rust client code to ensure the legacy \agentos\_client::protocol\ surface is not used and that the sidecar correctly imports \agentos\_sidecar\_client::wire\. \check-layout.mjs\ validates the repository structure, ensuring test files are in allowed directories, \software/\ packages have required metadata, and native crates belong to the toolchain workspace. \verify-fixed-versions.mjs\ acts as a gate to ensure all product \package.json\ files and the Rust workspace \Cargo.toml\ remain pinned to version \0.0.1\. Additional scripts include \check-rust-package-metadata.mjs\ to verify \agentos-client\ package properties, \check-rustfmt.mjs\ to format-check non-browser Rust packages, \verify-check-types.mjs\ to ensure all packages define a type-checking script, \gen-registry.mjs\ to build the software catalog, and \ci.sh\ to orchestrate these checks.

scripts · high confidence

Added a comprehensive set of example scripts demonstrating the JavaScript and Python execution capabilities within the AgentOS virtualized runtime. The JavaScript examples cover core features such as executing code, managing a virtual filesystem, mounting host directories and npm packages, handling permissions, and TypeScript type-checking. The Python examples illustrate basic execution, managing execution contexts, passing inputs, installing packages, and controlling spawned processes with network and filesystem access.

(repo-wide) · high confidence

The \examples/js-sdk-overview\ directory now includes a set of TypeScript source files (\contexts.ts\, \index.ts\, \inputs.ts\, \limits.ts\, \npm.ts\, \platform.ts\) that demonstrate how to use the \runtime.javascript\ API in the \@rivet-dev/agentos-core\ SDK. These examples show users how to execute and evaluate JavaScript code within isolated contexts, handle inputs and outputs, enforce execution timeouts, manage npm packages, and access platform features like the filesystem, child processes, and network requests.

examples/js-sdk-overview · high confidence

Added a new set of scripts and configuration files in \scripts/ralph\ to support an autonomous coding agent workflow. This includes a \ralph.sh\ loop that iterates through user stories defined in \prd.json\ using tools like Codex, Claude, or Amp, and a \ralph-docker.sh\ wrapper to run the agent inside a Docker container with resource limits. A new \ralph-docker-per-iter.sh\ script provides an alternative mode where each iteration runs in a fresh container to prevent memory leaks. The setup also includes \CLAUDE.md\ and \CODEX.md\ instruction files for the agents, a \Dockerfile\ for the runner environment, and an \AGENTS.md\ symlink.

scripts/ralph · high confidence

The \packages/agentos-toolchain/src\ directory now provides the TypeScript implementation for the agentOS package toolchain, introducing a new \.aospkg\ container format (version 2) that bundles a package's mount tar with a binary-encoded (vBARE) manifest and index. This toolchain enables developers to build, stage, and pack packages into self-contained runtime artifacts: the \build\ command assembles a clean runtime directory (bin/, share/, manifest) and produces a \.aospkg\; the \pack\ command creates JavaScript package closures with optional native addon pruning; and the \stage\ command populates command binaries into a package's \bin/\ directory based on manifest declarations. The CLI exposes these capabilities via \agentos-toolchain build\, \pack\, \stage\, and \pack-aospkg\ commands, while the underlying \aospkg.ts\ module handles the low-level serialization of the package format, ensuring deterministic packing and efficient VM startup by serving file contents as byte ranges from the mount tar.

packages/agentos-toolchain/src · high confidence

The \crates/vfs-store\ crate introduces concrete backend adapters for agentos deployments, providing \SqliteMetadataStore\ for local metadata persistence and \S3BlockStore\/\S3ObjectBackend\ for cloud storage. The SQLite store now supports special inode kinds (character devices, block devices, and fifos) via an updated schema (version 3) and includes migration logic to handle upgrades. The S3 adapters enable block and object storage operations with configurable prefixes, while a callback-based metadata store allows integration with external sidecar services.

crates/vfs-store · high confidence

Added example scripts demonstrating the new \createVm\ API and its lifecycle. The \vm\ example shows how to instantiate a persistent VM, manage files via the host filesystem, and execute TypeScript code with type-checking. The \benchmark\ example provides a performance comparison of Secure Exec against QuickJS and Vercel Run, illustrating both one-shot evaluation and reuse of an existing VM instance.

secure-exec/examples/benchmark, secure-exec/examples/vm · high confidence

The runtime-benchmarks package now includes a comprehensive suite of benchmark families to measure the performance overhead of the guest VM environment. This change introduces new benchmark definitions for control operations (CPU loops, memory allocation), DNS resolution, POSIX ecosystem commands (ls, grep, tar, etc.), file system operations (read/write, stat, streams), module loading (CommonJS/ESM, npm packages), network I/O (HTTP, TCP, TLS), process spawning, and timer cadence. It also adds specific regression guards for known performance anti-patterns (such as stdio buffer cloning and Unix socket accept latency) and a permissions family to measure the overhead of restrictive security policies. These benchmarks allow users to quantify the performance tax of running workloads inside the VM compared to native Node.js.

packages/runtime-benchmarks/src/families · high confidence

The \packages/runtime-benchmarks/src/lib\ directory now contains the core implementation for a multi-layer performance benchmarking suite. This adds the ability to measure and compare execution latency and memory usage across three distinct layers: a native baseline, a Node.js runtime, and a guest virtualized environment. The new code introduces structured measurement utilities (\perf-utils.ts\), memory sampling logic that tracks Resident Set Size (RSS) via \/proc\ on Linux (\memory.ts\), and a native execution layer that invokes a compiled \agentos-native-baseline\ binary to establish performance baselines (\native.ts\). It also provides a benchmarking Virtual Machine abstraction (\vm.ts\) that wraps the \@rivet-dev/agentos-runtime-core\ to execute operations in the guest environment, and a reporting module (\report.ts\) that analyzes these results to identify emulation overhead and permission policy taxes.

packages/runtime-benchmarks/src/lib · high confidence

The playground now includes a dedicated Node.js development server that serves static assets with Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy headers required for SharedArrayBuffer support, while enforcing strict path validation to prevent symlink-based directory traversal. The frontend features a new runtime harness that manages browser-based execution environments via web workers, providing APIs to create, execute, and dispose of isolated runtimes with captured standard I/O. Build scripts bundle the Monaco editor, TypeScript, and the runtime harness, symlinking vendor assets from node\_modules to ensure local serving without CDN dependencies.

packages/playground · high confidence

The \packages/runtime-browser/scripts\ directory now includes a complete set of automation scripts to build, verify, and run the converged browser runtime. \build-dist-wasm.mjs\ and \build-sidecar-wasm.mjs\ compile the Rust \sidecar-browser\ crate into WebAssembly packages for production distribution and local testing, respectively. \build-browser-test-assets.mjs\ bundles the worker and harness entry points using esbuild. To ensure correctness, \check-bridge-contract.mjs\, \check-signal-table.mjs\, and \check-wasi-surface.mjs\ act as convergence guards, verifying that the browser's TypeScript implementations (signal handling, WASI polyfills, and bridge contracts) remain in sync with the native Rust core. \generate-wasi-polyfill.mjs\ automates the creation of the browser WASI polyfill from the shared native runner, and \run-browser-tests.mjs\ / \serve-browser-tests.mjs\ provide a self-contained environment for executing Playwright-based browser tests, including automatic resolution of Linux system libraries.

packages/runtime-browser/scripts · high confidence

The build-tools package now includes a suite of new scripts to automate the generation of browser polyfills, the base filesystem image, and protocol definitions. The \build-browser-\*-polyfill.mjs\ scripts (for buffer, path, util, and node modules) bundle upstream Node.js standard library modules into browser-compatible code using esbuild and node-stdlib-browser, ensuring the runtime exposes faithful Node APIs in the browser. \build-base-filesystem.mjs\ captures a stock Alpine container and applies AgentOS-specific transforms to produce the embedded base filesystem JSON. Additionally, \compile-package-format.mjs\ and \compile-sidecar-protocol.mjs\ generate TypeScript types from Bare schema definitions, while \build-v8-bridge.mjs\ bundles the V8 bridge with extensive module aliasing. Tests have been added to verify the correctness of the generated polyfills and TTY configuration.

packages/build-tools/scripts · high confidence

The \vfs\ crate now includes a new filesystem engine architecture featuring \ChunkedFs\ and \ObjectFs\ implementations, along with in-memory backends for testing. \ChunkedFs\ introduces a decoupled metadata and block store design with content-addressed storage, adaptive chunk sizing, and snapshot capabilities, while \ObjectFs\ provides a simple object-store-backed filesystem. The crate also introduces the \.aospkg\ package format (v2) with a new schema, packer, and mount index system, allowing packages to be loaded and projected into the guest filesystem. A \MountedEngineFileSystem\ adapter bridges these async engines to the synchronous POSIX VFS interface used by the runtime.

crates/vfs · high confidence

The core package now uses a self-contained \agentos-package.json\ manifest model (with \/opt/agentos\ path constants) to define package metadata and provides, replacing the previous host-projected approach. A new build script (\stage-default-software.mjs\) and runtime resolver (\default-software.ts\) bundle a static list of default \.aospkg\ artifacts directly into the published package, ensuring resolution is deterministic and independent of npm or \node\_modules\. Additionally, a comprehensive set of TypeScript types generated from Rust (\ts-rs\) has been introduced for \CreateVmConfig\, encompassing detailed schemas for VM limits (CPU, memory, HTTP, JS/Python/Wasm), permissions (FS, network, process), and filesystem configuration, providing a strict, typed interface for VM creation.

packages/core/src · high confidence

This change introduces a suite of new command-line utilities to the system, including bc (arbitrary-precision arithmetic), chown/chgrp (file ownership), cmp (file comparison), df (disk space), findmnt (mount points), getent (database lookups), hostname, id (user identity), mount (remounting), runas, and su (switch user). It also adds package manifest definitions for the acl, attr, and xfsprogs software packages, and applies patches to the awk-rs toolchain crate to support special variable assignments and unsigned printf formatting.

(repo-wide) · high confidence

Added a comprehensive set of TypeScript examples in the \examples/embedded/\ directory that demonstrate how to boot and control an agentOS VM directly from a trusted Node.js application using \@rivet-dev/agentos-core\. These examples cover the full embedded runtime surface, including filesystem operations, process management, language execution (JavaScript, Python, Bash), networking, cron jobs, and persistent state via SQLite. They also illustrate advanced capabilities such as configuring resource limits, mounting host directories and S3 buckets, setting network permissions, and exposing trusted host functions to guest programs. Additionally, new quickstart examples were added for bash, cron, filesystem, git, hello-world, host functions, network, nodejs, and processes to help users get started with the API.

examples · high confidence

Added two new example applications demonstrating core agentOS runtime capabilities. The \js-ai-agent-code-exec\ example shows how to safely evaluate untrusted JavaScript expressions within an isolated VM environment, including handling timeouts and capturing output. The \js-networking-wasm\ example demonstrates how to configure network permissions and execute shell commands (specifically via a WASM-backed process) to interact with the underlying system.

examples/js-ai-agent-code-exec, examples/js-networking-wasm · high confidence

Added a suite of focused benchmarks in the \packages/runtime-benchmarks/src/focused\ directory to isolate and measure specific runtime performance characteristics. This includes \concurrency-common.ts\ and associated benchmarks for measuring concurrency scaling across multiple VMs and concurrent processes, \fs-sync-ops.bench.ts\ for synchronous filesystem operation latency, \readdir.bench.ts\ and \mount-readdir.bench.ts\ for directory listing performance under various mount configurations, \net-tcp-event-floor.bench.ts\ for TCP event loop overhead, \dns-lookup-floor.bench.ts\ for DNS resolution latency, \process-spawn.bench.ts\ for process creation costs, and \interference.bench.ts\ for measuring performance impact of concurrent busy workloads.

packages/runtime-benchmarks/src/focused · high confidence

A new local CLI tool, \cut-release\, has been added to the \scripts/publish/src/local\ directory to allow developers to manually orchestrate releases. This tool resolves the target version, validates the git working tree, and optionally runs a local type-check fail-fast before triggering the \publish.yaml\ GitHub Actions workflow. A key addition is the \--profile\ flag, which allows users to override the native binary build profile (defaulting to \release\ but supporting \debug\), enabling more flexible local testing and release preparation.

scripts/publish/src/local · high confidence

The \scripts/publish/src/lib\ area now contains a complete, modularized publish toolchain that replaces the previous ad-hoc scripts. A new CLI entrypoint (\ci/bin.ts\) exposes subcommands for resolving the publish context, bumping versions across \package.json\ and \Cargo.toml\, publishing to npm and crates.io, and staging software artifacts. The library provides dedicated modules for handling npm publishing with parallelism and retries (\npm.ts\), Rust crate discovery and ordering (\rust-crates.ts\), package discovery and metadata injection (\packages.ts\), and R2 artifact uploads (\r2.ts\). This change introduces a structured, testable foundation for the release process, including specific logic for handling sidecar platform packages and registry software artifacts.

scripts/publish/src/lib · high confidence

The native sidecar now registers a suite of new virtual filesystem plugins that expand how guest environments access storage. The \chunked\_local\ and \chunked\_sqlite\ plugins enable efficient, chunk-based storage backed by local files and SQLite metadata, while \chunked\_s3\ brings the same chunked engine to S3-compatible object stores with configurable metadata backends. A new \google\_drive\ plugin exposes Google Drive folders as a virtual filesystem, and \js\_bridge\ allows guest code to perform filesystem operations by routing requests through the sidecar's JavaScript bridge. Additionally, the \agentos\_packages\ plugin provides a specialized mount type for projecting uncompressed package tars into the guest without host-to-guest path translation, and the \host\_dir\ plugin has been updated with a universal, cross-platform (Linux, macOS, gVisor) path-confinement resolver to prevent directory escape attacks.

crates/native-sidecar/src/plugins · high confidence

The \kill\ utility now supports WASI targets by replacing the \nix\ signal library with \wasi-ext\ for process signaling, ensuring correct behavior on WebAssembly platforms. Additionally, a new test program (\fd-mapping-contract\) was introduced to verify file descriptor mapping contracts, validating sequential mappings, swap cycles, and duplicate target rejection across both WASI and Unix environments.

_software/coreutils/native/crates/cmd-kill, toolchain/std-patches/crates/uu\kill, toolchain/test-programs/fd-mapping-contract · high confidence

The native sidecar now exposes a unified RPC interface for Python guest processes to perform network and system operations. Python code running inside the VM can now make HTTP requests, establish TCP/UDP socket connections, and spawn child subprocesses. These capabilities are implemented in the new \crates/native-sidecar/src/execution/python\ module, which handles the translation of Python VFS RPC requests into host-side actions, including DNS resolution, network access validation, and process lifecycle management.

crates/native-sidecar/src/execution/python · high confidence

Added example implementations in the secure-exec package demonstrating how to use persistent execution contexts with state retention and parallelism, mount host directories and node\_modules into the VM for file and package access, and install npm packages within a VM environment.

secure-exec/examples/contexts, secure-exec/examples/mounts, secure-exec/examples/npm · high confidence

The \crates/execution/assets/pyodide\ directory now contains the Pyodide WebAssembly runtime (v0.28.0.dev0, Python 3.13.2) and a comprehensive set of pre-built offline wheels (including numpy, pandas, matplotlib, and scikit-learn). This bundle allows the agentos Python sidecar to execute code without requiring external network access for package installation, as the sidecar seeds these wheels directly into the Pyodide package cache. Dynamic installs are still supported via the agentos kernel's network policy, but the bundled packages ensure fast, offline-capable startup for common data science libraries.

crates/execution/assets/pyodide · high confidence

The toolchain now cross-compiles C and Rust commands for the wasm32-wasip1 target using a custom sysroot and wasi-sdk 25. It integrates mbedTLS 3.6.2 to provide real in-guest TLS for curl, wget, and Git over HTTPS, including a CA bundle and a WASI-compatible entropy shim. Git is patched to use posix\_spawn instead of fork for child processes and to stream sideband traffic through a spawned helper, enabling safe fetch/push over HTTPS without blocking. The build system vendors dependencies, applies crate-level patches, and links a custom libc to ensure correct signal handling and WASI compatibility.

toolchain · high confidence

This change removes several packages from the repository: the \agent-opencode\ and \agent-pi\ agent definitions, the \google-drive\ and \s3\ cloud storage block stores (along with their tests), the \sandbox\ package (including its filesystem, toolkit, and tests), and the \sandbox\ benchmarks and documentation. Users will no longer have access to these specific agent integrations, cloud storage backends, or sandbox-related tools and utilities.

(repo-wide) · high confidence

The process execution, networking, and runtime event handling code has been extracted from the main service file into a new \crates/native-sidecar/src/execution\ module. This refactoring introduces dedicated modules for child process management, request coordination, runtime launching, process state, event handling, signal processing, and standard I/O, improving code organization and maintainability without changing external behavior.

crates/native-sidecar/src/execution · high confidence

The native sidecar source code has been reorganized by extracting core responsibilities into dedicated modules: \bootstrap.rs\ handles root filesystem snapshotting and command discovery, \bridge.rs\ manages host filesystem and permission plumbing, \crypto\_cipher.rs\ provides a pure-Rust AES implementation for guest Node.js crypto APIs, \extension.rs\ and \extension\_services.rs\ define the extension host interface and its concurrent service implementation, \filesystem.rs\ contains guest VFS dispatch logic, \host\_functions.rs\ implements host callback registration, \json\_rpc.rs\ adds JSON-RPC protocol support, and \language\_execution.rs\ manages first-class JavaScript and Python execution lifecycles. This restructuring isolates these subsystems from the main service file to improve modularity and maintainability.

crates/native-sidecar/src · high confidence

The dd utility now supports the WASI (WebAssembly System Interface) target. This patch introduces conditional compilation to handle platform-specific differences, such as using io::Stdout instead of file handles on WASI, disabling the progress update thread in WASI environments, and providing WASI-specific implementations for checking if stdout is redirected to a seekable file. Users can now run dd in WASI-compatible runtimes.

_toolchain/std-patches/crates/uu\dd · high confidence

The development environment now includes automated scripts to ensure consistent frontend tooling. The setup script installs Node.js 24 and pnpm 10.13.1, vendors the docs theme and icon bundle from the rivet-dev/docs-theme repository, and installs frontend dependencies. The resume script provides a quick verification that the frontend orb is ready.

.agents · high confidence

The build process now automatically generates the V8 bridge JavaScript bundles and the sidecar protocol schema files during compilation. For the V8 bridge, the build script detects whether it is running in a monorepo environment (using Node.js and pnpm to run build scripts) or a published crate (using vendored prebuilt assets), ensuring the correct \v8-bridge.js\ and \v8-bridge-zlib.js\ files are placed in the output directory. Simultaneously, the sidecar protocol build script now compiles the \agentos\_sidecar\_v1.bare\ schema into Rust code using the \vbare\_compiler\, ensuring that protocol definitions are kept in sync with the source schema files.

crates/build-support · high confidence

The browser runtime now uses a new 'converged' execution path that routes guest filesystem, network, UDP, and PTY syscalls to the WASM sidecar kernel instead of the legacy in-process TypeScript kernel. This change introduces a set of bridge modules (fs, net, dgram, pty) and a sync-bridge handler that translates guest operations into wire protocol requests, ensuring the WASM kernel is the single enforcement point for permissions and behavior. The legacy TypeScript executor is retained as a fallback for operations not yet covered by the converged path, and the package now includes Playwright configuration and documentation for this new browser driver architecture.

packages/runtime-browser/src · high confidence

This change adds and updates internal documentation to reflect significant platform shifts. It introduces the Execution API Redesign, which replaces the conflated \executionId\/\detached\ model with distinct \Context\ (for retained state), \Process\ (for background tasks), and one-shot runs, while flattening the TypeScript namespace to \vm.typescript\. It documents a new layered filesystem model for VMs, featuring a read-only base overlay, writable layers, and configurable mounts. Additionally, it records native runtime fixes that restore interactive shell correctness by fixing PTY output ordering, signal handling (SIGWINCH), and shebang script resolution, and specifies the move to in-guest mbedTLS for full curl/wget/git networking parity.

docs-internal · high confidence

The execution environment now includes a comprehensive set of JavaScript shims in the \undici-shims\ directory to improve compatibility with Node.js APIs. These changes add stubs and wrappers for core modules including \async\_hooks\, \crypto\, \diagnostics\_channel\, \dns\, \http\, \http2\, \https\, \net\, \perf\_hooks\, \process\, \randombytes\, \stream\, \tls\, \url\, \util-types\, \websocket\, \worker\_threads\, and \zlib\. Notably, the \stream\ shim now implements a custom \finished\ function that correctly handles Web Streams to prevent the guest event loop from being held open by unread fetch bodies, and the \process\ shim delegates \nextTick\ to the runtime to avoid timer delays in stream operations.

crates/execution/assets/undici-shims · high confidence

The native sidecar now enforces a single, universal resolve-beneath walk for all host-mount confinement operations, replacing previous platform-specific or split implementations. This change ensures that file operations within mounted directories are strictly confined to the allowed base paths, preventing path traversal escapes. The implementation uses plain \openat(2)\ with \O\_NOFOLLOW\ to descend component-by-component, maintaining its own ancestor-fd stack for \..\ resolution and manually expanding symlinks, which avoids reliance on \openat2(RESOLVE\_BENEATH)\ (unsupported in gVisor/runsc) and reduces the attack surface by eliminating separate macOS fallbacks. This applies to all host directory operations, ensuring consistent security behavior across different environments and user privileges.

crates/native-sidecar · high confidence

The kernel crate now provides a new Rust implementation of core virtual-machine subsystems, including a command registry, device layer, DNS resolver, file descriptor table, process table, pipe and PTY managers, poll notifier, socket table, and network/permission policies. This replaces the previous JavaScript/TypeScript kernel layer, giving users a unified, safer, and more performant execution environment with Linux-compatible process scheduling, file semantics, and permission enforcement.

crates/kernel/src · high confidence

The \sidecar-protocol\ crate now exposes a new wire protocol surface generated from a BARE schema, replacing the previous hand-written protocol types. This change introduces a compatibility layer (\protocol.rs\) that maps between the new generated wire frames and the existing internal protocol structures, ensuring that callers can migrate to the generated types without immediate site-by-site rewiring. The crate also provides helper implementations for common types (such as \PermissionsPolicy\ and \CreateVmRequest\) to maintain ergonomic usage during the transition.

crates/sidecar-protocol/src · high confidence

The sidecar wire protocol now defines a canonical BARE schema (agentos\_sidecar\_v1.bare) alongside a migration plan. This schema formalizes the structure of requests, responses, and events, introducing specific types for runtime configuration (including JavaScript and Python support), filesystem permissions, and session ownership. The migration strategy ensures backward compatibility by maintaining the existing 4-byte big-endian framing while adding a dual-stack decoder that can distinguish between the legacy JSON payload and the new BARE payload, allowing a gradual rollout to the TypeScript client.

crates/sidecar-protocol/protocol · high confidence

The native sidecar now implements the CallbackMetadataClient interface, allowing it to handle secure metadata callbacks via the agentos core (crates/native-sidecar/src/metadata/mod.rs). Additionally, the agentos-toolchain bin shim (packages/agentos-toolchain/bin/agentos-toolchain.mjs) has been updated to reliably import the CLI entry point, fixing issues where fresh checkouts failed to find the command. The build toolchain also includes vendored esbuild runtime and buffer utilities to support CommonJS/ESM interop during bundling.

(repo-wide) · high confidence

The publish workflow now includes a verification step that checks the actual npm tarballs for common software packages before release. This ensures that the published packages contain all declared command binaries, preventing issues where a local build might succeed but the released package is missing required components.

scripts/publish · high confidence

The quickstart examples in \examples/quickstart/src/\ have been updated to reflect the new ID-based session API. The previous examples, which demonstrated session creation and interaction via the older \os.createSession\ and \vm.prompt\ patterns, have been removed. This change aligns the example code with the current API surface, ensuring users follow the correct, modern patterns for managing agent sessions and interactions.

examples/quickstart · high confidence

This change introduces foundational repository governance and build infrastructure. It adds a \.dockerignore\ to restrict the Docker build context to the website and SDK source, and a \.gitattributes\ file to configure GitHub Linguist to report approximately 70% Rust coverage by selectively counting core client and sidecar files. A new \justfile\ provides recipes for release, toolchain pre-flight, and local development of the docs site. The \CLAUDE.md\ and \README.md\ are rewritten to reflect the new \agentOS\ product identity, updated npm namespaces (\@rivet-dev/agentos-\*\), and a library-based usage model. Build tooling is updated with \biome.json\ schema and scope changes, \pnpm-workspace.yaml\ reorganization, and \turbo.json\ enhancements including new \test:nightly\ tasks and global environment handling.

(repo-wide) · high confidence

The test-harness package has been reorganized to serve as a re-export layer for the underlying @rivet-dev/agentos-vm-test-harness library. This change introduces a new entry point in src/index.ts that forwards all exports from the core test harness package, alongside a dedicated tsconfig.json to manage compilation settings for this specific location.

test-harness · medium confidence

The \packages/runtime-benchmarks/results\ directory now includes fresh baseline and cold-start benchmark data. New \baseline-ci.json\ and \baseline-local.json\ files provide performance metrics for process operations (such as node exit, stdout handling, and pipe chains) across native, Node.js, and guest execution lanes on CI and local hardware. Additionally, \coldstart-final.json\ and \coldstart-final.log\ record detailed cold-start and warm-start timings for scenarios including owned-sidecar, shared-sidecar, resident-runner, and isolate-only modes, while \coldstart-resident-full-matrix\ files provide historical resident-runner benchmark data.

packages/runtime-benchmarks/results · high confidence

The V8 runtime now enforces stricter session and bridge handling to prevent hangs and resource leaks. Released context handles are explicitly failed rather than truncated, and execution results are completed only when they settle, ensuring async operations finish correctly. The event loop now properly drains V8's deferred work for async WebAssembly compilation and consults pending timer counts to avoid premature exits. Bridge waits include a per-execution abort path for timeouts and termination requests, and late bridge responses are logged with structured error codes instead of being silently dropped. Additionally, the runtime ensures that internal timers remain unref'd to survive across calls, and shared session quotas are managed via a single SessionManager to prevent race conditions.

crates/v8-runtime · high confidence

The \stat\ command now correctly reports file permissions and device numbers on WASI targets by querying the host filesystem via FFI (\host\_fs\), ensuring that format specifiers like \%a\, \%f\, \%F\, and \%R\ reflect the actual host metadata rather than incomplete WASI defaults. This change is supported by a new \wasi-ext\ crate that exposes host process, user, and network syscalls, and by \uucore\ stubs that enable \entries\ and \perms\ modules for the WASI target.

_toolchain/crates/wasi-ext, toolchain/std-patches/crates/uu\stat, toolchain/stubs/uucore · high confidence

The CI pipeline now ensures published Linux binaries remain compatible with older Linux distributions by introducing a glibc symbol floor check (preventing usage of symbols newer than GLIBC\_2.27) and running smoke tests against Debian 11 and Ubuntu 20.04 containers. To support builds on older host systems, the setup script now compiles and links shims for missing syscalls (gettid, renameat2, memfd\_create) and configures a specific sysroot with LLVM 22, resolving preview build failures caused by environment incompatibilities.

scripts/ci · high confidence

This update patches the brush-builtins crate to improve POSIX compliance and enable specific features on the WASI target. The \wait\ builtin now correctly resolves job specifications (including \$!\ and \%\ specs) and returns immediately when a trapped signal arrives, matching Linux behavior. The \exec\ builtin is now available on WASI, implementing process replacement via host syscalls and properly handling file descriptor duplication. Additionally, the \trap\ builtin now correctly manages signal dispositions on the host process for the top-level shell while preventing subshells from leaking signal changes, and the \umask\ builtin is enabled for WASI using a host import.

toolchain/std-patches/crates/brush-builtins · high confidence

Added browser conformance and integration tests for the converged WASM kernel; Added comprehensive end-to-end test suites for the Rust client; Added comprehensive test coverage for runtime-core internals; Added comprehensive test coverage for the Rust execution engine; Added comprehensive test suite for the V8 runtime; Added comprehensive tests for request concurrency in the stdio protocol loop; Added integration test fixtures for module resolution scenarios; Added integration tests for the browser sidecar bridge and wire dispatcher; Added shared e2e test helpers for AgentOS client; Added snapshot tests for PTY line discipline and protocol behavior; Added test coverage for agentOS toolchain packaging and lifecycle; Added test fixtures for PTY line discipline and shared sidecar cleanup; Added test fixtures for package manager layouts and policy limits inventory; Added test suite for secure-exec sandboxing and API; Added tests for the AgentOS bridge filesystem and permission APIs; Expanded integration test coverage for kernel runtime interactions; Expanded integration test coverage for runtime compatibility; Expanded kernel test coverage for security, API, and filesystem behavior; Expanded test coverage for AgentOS core runtime and filesystem features; Native sidecar test suite hardening and coverage expansion; Updated test helpers for registry packages and VM environment setup.

This change introduces the foundational Rust build structure for AgentOS, adding a root \Cargo.toml\ workspace that defines 15 crates (including \agentos-client\, \agentos-native-sidecar\, \agentos-v8-runtime\, and \agentos-vfs\) and a corresponding \Cargo.lock\ file to pin all transitive dependencies. It also adds a \Cargo.lock\ for the \v8-runtime\ crate and a minimal \package.json\ for undici shims, establishing the deterministic dependency graph for the native sidecar and execution planes.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• First survey — no prior run to compare against. CAI 51.

• Code Health 59
• Architecture 74
• Maturity 82
• Readiness 36
• Security 59
• Event Sourcing 100
• Accessibility 74
• Performance 69

• 300 commits — 151 feature/other, 149 fixes

• crates/native-sidecar — 59 commits
• packages/core — 33 commits
• (root) — 24 commits
• .github/workflows — 17 commits
• packages/build-tools — 16 commits
• packages/runtime-core — 13 commits
• website/src — 9 commits
• crates/client — 8 commits
• crates/execution — 8 commits
• packages/agentos — 8 commits
• website/public — 8 commits
• docs/content — 7 commits
• crates/agentos-actor-plugin — 5 commits
• crates/agentos-sidecar — 5 commits
• crates/v8-runtime — 5 commits
• examples/quickstart — 5 commits
• registry/software — 5 commits
• secure-exec/docs — 5 commits
• toolchain/std-patches — 5 commits
• scripts/publish — 4 commits

• fix: chore(clippy): apply machine-applicable Rust 1.98 lint fixes
• fix: chore(deps): bump secure-exec ref to source-built vim + audit fixes (#1600)
• fix: fix(actor-plugin): reply createSession with the bare session id (#1636)
• fix: fix(actor-plugin): revive rivetkit $Undefined envelopes in action args (#1644)
• fix: fix(agentos): accept [ as a package command name
• fix: fix(agentos): answer runtime requests from every child of a WebAssembly shell
• fix: fix(agentos): keep an evaluation running until its promise settles
• fix: fix(agentos): keep chunked_sqlite metadata pieces under the remote SQLite bind limit
• fix: fix(agentos): make Python packages import and install
• fix: fix(agentos): pin rivetkit catalog to the feat-dylib-actor-plugin preview and adapt inspector actor hook (#1634)
• fix: fix(agentos): queue concurrent WebAssembly and Python launches per VM
• fix: fix(agentos): raise the heap limit past one oversized allocation
• fix: fix(agentos): reject pending executions when the sidecar exits
• fix: fix(agentos): repair post-merge validation failures (#1774)
• fix: fix(agentos): report V8 limit terminations as typed execution errors
• fix: fix(agentos): route CompareVmConfig through the sidecar request loop
• fix: fix(agentos): run host function calls as async tasks
• fix: fix(agentos): run npm package binaries from build scripts (#1849)
• fix: fix(agentos): stop a busy JavaScript guest on an unhandled terminating signal
• fix: fix(agentos): support RivetKit 2.3.5 actor runtime socket (#1820)
• …and 280 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

rivet-dev/agentos was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.