rivet-dev · NathanFlurry · Jul 10, 2026
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
@@ -1,5 +1,9 @@
 name: bench
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     branches: [main]
@@ -16,7 +20,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
       - uses: dtolnay/rust-toolchain@stable
@@ -38,3 +42,20 @@ jobs:
           AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
           NATIVE_BASELINE_BIN: ${{ github.workspace }}/target/release/agentos-native-baseline
           NATIVE_BASELINE_WASM: ${{ github.workspace }}/target/wasm32-wasip1/release/agentos-native-baseline.wasm
+      - name: Measure Node stdlib legacy/real delta
+        if: github.event_name == 'pull_request'
+        run: |
+          pnpm --silent --dir packages/runtime-benchmarks bench:node-stdlib-ab > node-stdlib-ab.json
+          pnpm --silent --dir packages/runtime-benchmarks bench:node-stdlib-delta node-stdlib-ab.json > node-stdlib-delta.md
+          cat node-stdlib-delta.md >> "$GITHUB_STEP_SUMMARY"
+        env:
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+          NATIVE_BASELINE_BIN: ${{ github.workspace }}/target/release/agentos-native-baseline
+          NATIVE_BASELINE_WASM: ${{ github.workspace }}/target/wasm32-wasip1/release/agentos-native-baseline.wasm
+          BENCH_NODE_STDLIB_ITERATIONS: 5
+          BENCH_NODE_STDLIB_WARMUP: 1
+      - uses: marocchino/sticky-pull-request-comment@v2
+        if: github.event_name == 'pull_request'
+        with:
+          header: node-stdlib-benchmark-delta
+          path: node-stdlib-delta.md
diff --git a/.github/workflows/ci-nightly.yml b/.github/workflows/ci-nightly.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
@@ -25,16 +25,36 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: make -C toolchain commands
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
-      - run: cargo check --workspace
-      - run: cargo clippy --workspace --all-targets -- -D warnings
+      - run: cargo check --workspace --exclude agentos-native-sidecar-browser --exclude agentos-sidecar-browser
+      - run: cargo clippy --workspace --exclude agentos-native-sidecar-browser --exclude agentos-sidecar-browser --all-targets -- -D warnings
       - run: pnpm check-types
       - run: pnpm test
         env:
           AGENTOS_E2E_NETWORK: '1'
-      - run: cargo test --workspace -- --test-threads=1
+      - run: cargo test --workspace --exclude agentos-native-sidecar-browser --exclude agentos-sidecar-browser -- --test-threads=1
       - run: cargo build --release -p agentos-native-sidecar
       - run: cargo build --release -p agentos-native-baseline
       - run: cargo build --release --target wasm32-wasip1 -p agentos-native-baseline
+      - name: Node 24 suite smoke (legacy)
+        run: pnpm --silent --dir test-harness node-suite -- --slice smoke --timeout 2000 --batch-size 50 --ledger node-suite/ledger-smoke.json --write node-suite-smoke-legacy.json
+        env:
+          AGENTOS_JS_STDLIB: legacy
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+      - name: Node 24 suite smoke (real stdlib)
+        run: pnpm --silent --dir test-harness node-suite -- --slice smoke --timeout 2000 --batch-size 50 --ledger node-suite/ledger-smoke.json --write node-suite-smoke-real.json
+        env:
+          AGENTOS_JS_STDLIB: real
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+      - name: Node 24 full suite (legacy)
+        run: pnpm --silent --dir test-harness node-suite -- --slice full --timeout 2000 --batch-size 50 --ledger node-suite/ledger.json --write node-suite-full-legacy.json
+        env:
+          AGENTOS_JS_STDLIB: legacy
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+      - name: Node 24 full suite (real stdlib)
+        run: pnpm --silent --dir test-harness node-suite -- --slice full --timeout 2000 --batch-size 50 --ledger node-suite/ledger.json --write node-suite-full-real.json
+        env:
+          AGENTOS_JS_STDLIB: real
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
       - run: pnpm --dir packages/runtime-benchmarks bench:matrix
         env:
           AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
@@ -46,3 +66,9 @@ jobs:
           name: nightly-benchmark-results
           path: packages/runtime-benchmarks/results
           if-no-files-found: warn
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: node-suite-smoke-results
+          path: node-suite-*.json
+          if-no-files-found: warn
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
       - uses: dtolnay/rust-toolchain@stable
@@ -30,9 +30,9 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: |
           if grep -qE '^[[:space:]]*-[[:space:]]*website[[:space:]]*$' pnpm-workspace.yaml; then
-            npx turbo build --filter='!@agentos/website'
+            npx turbo build --filter='!@agentos/website' --filter='!@rivet-dev/agentos-runtime-browser' --filter='!@rivet-dev/agentos-browser' --filter='!@rivet-dev/agentos-playground'
           else
-            npx turbo build
+            npx turbo build --filter='!@rivet-dev/agentos-runtime-browser' --filter='!@rivet-dev/agentos-browser' --filter='!@rivet-dev/agentos-playground'
           fi
       - run: pnpm --dir scripts/publish run check-types
       - run: pnpm --dir scripts/publish test
@@ -56,7 +56,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
       - uses: dtolnay/rust-toolchain@nightly
@@ -67,14 +67,26 @@ jobs:
           workspaces: toolchain -> toolchain/target
           cache-workspace-crates: true
           key: wasm-commands-${{ hashFiles('toolchain/Cargo.lock') }}
+      - uses: actions/cache@v4
+        with:
+          path: |
+            toolchain/c/vendor/wasi-sdk
+            toolchain/c/sysroot
+          key: c-sysroot-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('toolchain/std-patches/wasi-libc/**', 'toolchain/std-patches/wasi-libc-overrides/**', 'toolchain/c/patches/llvm-project/**', 'toolchain/scripts/patch-wasi-libc.sh', 'toolchain/c/scripts/build-llvm-runtimes.sh', 'toolchain/c/Makefile') }}
       - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-runtime-core...'
       - run: make -C toolchain commands
+      - run: make -C toolchain/c openssl-smoke
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
       - uses: actions/upload-artifact@v4
         with:
           name: wasm-commands
           path: packages/runtime-core/commands
           if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: node-openssl-smoke
+          path: toolchain/c/build/openssl_handshake_smoke
+          if-no-files-found: error
 
   rust:
     name: Rust
@@ -85,7 +97,7 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -100,25 +112,37 @@ jobs:
           rm -rf website/vendor/theme && mkdir -p website/vendor
           cp -r /tmp/docs-theme/packages/theme website/vendor/theme
       - run: pnpm install --frozen-lockfile
-      - name: Install Playwright Chromium
-        run: pnpm --dir packages/browser exec playwright install --with-deps chromium
       - uses: actions/download-artifact@v4
         with:
           name: wasm-commands
           path: packages/runtime-core/commands
+      - uses: actions/download-artifact@v4
+        with:
+          name: node-openssl-smoke
+          path: toolchain/c/build
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
       - run: |
           if grep -qE '^[[:space:]]*-[[:space:]]*website[[:space:]]*$' pnpm-workspace.yaml; then
-            npx turbo build --filter='!@agentos/website'
+            npx turbo build --filter='!@agentos/website' --filter='!@rivet-dev/agentos-runtime-browser' --filter='!@rivet-dev/agentos-browser' --filter='!@rivet-dev/agentos-playground'
           else
-            npx turbo build
+            npx turbo build --filter='!@rivet-dev/agentos-runtime-browser' --filter='!@rivet-dev/agentos-browser' --filter='!@rivet-dev/agentos-playground'
           fi
-      - run: cargo clippy --workspace --all-targets -- -D warnings
+      - run: cargo clippy --workspace --exclude agentos-native-sidecar-browser --exclude agentos-sidecar-browser --all-targets -- -D warnings
       - run: cargo test -p agentos-protocol -- --test-threads=1
       - run: cargo test -p agentos-sidecar -- --test-threads=1
       - run: cargo test -p agentos-client -- --test-threads=1
         env:
           AGENT_OS_CLIENT_ALLOW_E2E_SKIPS: '1'
+      - name: Node 24 suite sanity (legacy)
+        run: pnpm --silent --dir test-harness node-suite -- --slice sanity --batch-size 50 --ledger node-suite/ledger-sanity.json
+        env:
+          AGENTOS_JS_STDLIB: legacy
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/debug/agentos-native-sidecar
+      - name: Node 24 suite sanity (real stdlib)
+        run: pnpm --silent --dir test-harness node-suite -- --slice sanity --batch-size 50 --ledger node-suite/ledger-sanity.json
+        env:
+          AGENTOS_JS_STDLIB: real
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/debug/agentos-native-sidecar
       - name: Reclaim Cargo target space before package tests
         run: |
           df -h .

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
@@ -69,8 +69,15 @@ jobs:
           workspaces: toolchain -> toolchain/target
           cache-workspace-crates: true
           key: wasm-commands-${{ hashFiles('toolchain/Cargo.lock') }}
+      - uses: actions/cache@v4
+        with:
+          path: |
+            toolchain/c/vendor/wasi-sdk
+            toolchain/c/sysroot
+          key: c-sysroot-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('toolchain/std-patches/wasi-libc/**', 'toolchain/std-patches/wasi-libc-overrides/**', 'toolchain/c/patches/llvm-project/**', 'toolchain/scripts/patch-wasi-libc.sh', 'toolchain/c/scripts/build-llvm-runtimes.sh', 'toolchain/c/Makefile') }}
       - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-runtime-core...'
       - run: make -C toolchain commands
+      - run: make -C toolchain/c openssl-smoke
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
       - uses: actions/upload-artifact@v4
         with:
@@ -243,10 +250,50 @@ jobs:
           path: target/plugin-artifacts/${{ matrix.platform }}
           if-no-files-found: error
 
+  node-suite-full:
+    needs: [wasm-commands, build-sidecar]
+    name: Node 24 full suite
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@v4
+        with:
+          name: wasm-commands
+          path: packages/runtime-core/commands
+      - uses: actions/download-artifact@v4
+        with:
+          name: sidecar-linux-x64-gnu
+          path: target/node-suite-sidecar
+      - run: chmod +x target/node-suite-sidecar/agentos-native-sidecar
+      - name: Node 24 full suite (legacy)
+        run: pnpm --silent --dir test-harness node-suite -- --slice full --timeout 2000 --batch-size 50 --ledger node-suite/ledger.json --write node-suite-full-legacy.json
+        env:
+          AGENTOS_JS_STDLIB: legacy
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/node-suite-sidecar/agentos-native-sidecar
+      - name: Node 24 full suite (real stdlib)
+        run: pnpm --silent --dir test-harness node-suite -- --slice full --timeout 2000 --batch-size 50 --ledger node-suite/ledger.json --write node-suite-full-real.json
+        env:
+          AGENTOS_JS_STDLIB: real
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/node-suite-sidecar/agentos-native-sidecar
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: node-suite-full-results
+          path: node-suite-full-*.json
+          if-no-files-found: warn
+
   publish-npm:
-    needs: [context, wasm-commands, build-sidecar, build-sidecar-darwin]
+    needs: [context, wasm-commands, build-sidecar, build-sidecar-darwin, node-suite-full]
     name: Publish npm
-    if: ${{ !cancelled() && needs.wasm-commands.result == 'success' && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' }}
+    if: ${{ !cancelled() && needs.wasm-commands.result == 'success' && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' && needs.node-suite-full.result == 'success' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -313,6 +360,8 @@ jobs:
         run: |
           npx turbo build \
             --filter='!@rivet-dev/agentos-plugin' \
+            --filter='!@rivet-dev/agentos-runtime-browser' \
+            --filter='!@rivet-dev/agentos-browser' \
             --filter='!@rivet-dev/agentos-playground' \
             --filter='!./examples/*' \
             --filter='!./examples/quickstart/*'
@@ -331,9 +380,9 @@ jobs:
             ${{ needs.context.outputs.trigger == 'release' && '--release-mode' || '' }}
 
   release-assets:
-    needs: [context, build-sidecar, build-sidecar-darwin]
+    needs: [context, build-sidecar, build-sidecar-darwin, node-suite-full]
     name: Release assets
-    if: ${{ !cancelled() && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' }}
+    if: ${{ !cancelled() && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' && needs.node-suite-full.result == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -16,6 +16,7 @@ members = [
     "crates/native-sidecar",
     "crates/native-sidecar-browser",
     "crates/native-sidecar-core",
+    "crates/node-stdlib",
     "crates/sidecar-client",
     "crates/sidecar-protocol",
     "crates/v8-runtime",
@@ -41,6 +42,7 @@ agentos-native-baseline = { path = "crates/native-baseline", version = "0.0.1" }
 agentos-native-sidecar = { path = "crates/native-sidecar", version = "0.0.1" }
 agentos-native-sidecar-browser = { path = "crates/native-sidecar-browser", version = "0.0.1" }
 agentos-native-sidecar-core = { path = "crates/native-sidecar-core", version = "0.0.1" }
+agentos-node-stdlib = { path = "crates/node-stdlib", version = "0.0.1" }
 agentos-protocol = { path = "crates/agentos-protocol", version = "0.0.1" }
 agentos-sidecar-client = { path = "crates/sidecar-client", version = "0.0.1" }
 agentos-sidecar-core = { path = "crates/agentos-sidecar-core", version = "0.0.1" }

diff --git a/biome.json b/biome.json
@@ -4,6 +4,9 @@
 		"includes": [
 			"packages/**/*.ts",
 			"examples/**/*.ts",
+			"!packages/runtime-browser/**",
+			"!packages/browser/**",
+			"!packages/playground/**",
 			"!packages/core/src/sidecar/generated-protocol.ts",
 			"!_secure-exec-sibling",
 			"!/**/node_modules"

diff --git a/crates/agentos-sidecar-browser/Cargo.toml b/crates/agentos-sidecar-browser/Cargo.toml
@@ -5,6 +5,7 @@ edition.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Browser Agent OS sidecar wrapper"
+publish = false
 
 # cdylib for the wasm32 browser build (wasm-pack); rlib so native tests + the
 # workspace can still link it as a library.

diff --git a/crates/native-sidecar-browser/Cargo.toml b/crates/native-sidecar-browser/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 description = "Browser-side Secure Exec sidecar scaffold"
+publish = false
 
 [lib]
 crate-type = ["cdylib", "rlib"]

diff --git a/crates/native-sidecar/src/execution.rs b/crates/native-sidecar/src/execution.rs
@@ -42,10 +42,9 @@ use crate::state::{
     JavascriptUnixListenerEvent, KernelSocketReadinessEvent, KernelSocketReadinessRegistry,
     KernelSocketReadinessTarget, LoopbackTlsPendingWriteHandle, LoopbackTlsPendingWriteState,
     NetworkResourceCounts, PendingKernelStdin, PendingTcpSocket, PendingUnixSocket, ProcNetEntry,
-    ProcessEventEnvelope,
-    PythonHostSocket, ResolvedChildProcessExecution, ResolvedTcpConnectAddr, SharedBridge,
-    SharedSidecarRequestClient, SidecarKernel, SocketQueryKind, ToolExecution, VmDnsConfig,
-    VmListenPolicy, VmState, DEFAULT_JAVASCRIPT_NET_BACKLOG, EXECUTION_DRIVER_NAME,
+    ProcessEventEnvelope, PythonHostSocket, ResolvedChildProcessExecution, ResolvedTcpConnectAddr,
+    SharedBridge, SharedSidecarRequestClient, SidecarKernel, SocketQueryKind, ToolExecution,
+    VmDnsConfig, VmListenPolicy, VmState, DEFAULT_JAVASCRIPT_NET_BACKLOG, EXECUTION_DRIVER_NAME,
     EXECUTION_SANDBOX_ROOT_ENV, JAVASCRIPT_COMMAND, LOOPBACK_EXEMPT_PORTS_ENV,
     MAPPED_HOST_FD_START, PYTHON_COMMAND, TOOL_DRIVER_NAME,
     VM_LISTEN_ALLOW_PRIVILEGED_METADATA_KEY, WASM_COMMAND, WASM_STDIO_SYNC_RPC_ENV,
@@ -10006,9 +10005,7 @@ fn propagate_shadow_deletions_to_kernel(vm: &mut VmState, current: &BTreeSet<Str
         .cloned()
         .collect();
     for path in stale {
-        if path == "/"
-            || should_skip_shadow_sync_path(vm, &path)
-            || is_shadow_bootstrap_dir(&path)
+        if path == "/" || should_skip_shadow_sync_path(vm, &path) || is_shadow_bootstrap_dir(&path)
         {
             continue;
         }
@@ -19727,8 +19724,10 @@ pub(crate) fn flush_pending_kernel_stdin(
         let slice = &front[offset..];
         match kernel.fd_write(EXECUTION_DRIVER_NAME, process.kernel_pid, writer_fd, slice) {
             Ok(written) if written >= slice.len() => {
-                process.pending_kernel_stdin.total =
-                    process.pending_kernel_stdin.total.saturating_sub(slice.len());
+                process.pending_kernel_stdin.total = process
+                    .pending_kernel_stdin
+                    .total
+                    .saturating_sub(slice.len());
                 process.pending_kernel_stdin.front_offset = 0;
             }
             Ok(written) => {