feat: macOS port (merge #111) + /workspace + /home/agentos + binding facade + 4-target publish

Also fix publish vfs-bump bug (FALLING_OUT.md §4a): bumpCargoVersions only
matched agent-os-*/secure-exec-* path deps, silently skipping the unprefixed
`vfs` workspace crate -> dependent stayed pinned to ^0.3.0-rc.1 while the crate
moved to the preview version, failing cargo resolution in the publish build.
Regex now bumps every internal `path = "...", version = "..."` dep.

Also gate publish-crates to release-only (FALLING_OUT.md §4b): on previews the
crates dry-run compiled/packaged and any error reddened the whole run even though
npm published fine. build-sidecar already compiles every crate per target.

Author: NathanFlurry

.github/workflows/publish.yaml

@@ -20,7 +20,7 @@ concurrency:
 env:
   R2_BUCKET: rivet-releases
   R2_ENDPOINT: https://2a94c6a0ced8d35ea63cddc86c2681e7.r2.cloudflarestorage.com
-  SIDECAR_PLATFORMS: "linux-x64-gnu"
+  SIDECAR_PLATFORMS: "linux-x64-gnu linux-arm64-gnu darwin-x64 darwin-arm64"
 
 jobs:
   context:
@@ -36,10 +36,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - uses: pnpm/action-setup@v4
+      - run: corepack enable
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: "22"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
       - name: Install publish scripts
@@ -53,23 +53,51 @@ jobs:
     name: "Build sidecar (${{ matrix.platform }})"
     strategy:
       fail-fast: false
+      # The target set is dictated by the embedded V8 (rusty_v8): the build links
+      # a prebuilt `librusty_v8` static lib, and rusty_v8 publishes prebuilts for
+      # EXACTLY these four triples (linux-gnu + darwin, x64/arm64). musl has no
+      # prebuilt (would force a 30+ min V8 source build). Keep this list in
+      # lockstep with the rusty_v8 release assets when bumping the v8 crate.
       matrix:
         include:
           - platform: linux-x64-gnu
             runner: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
+            binary: secure-exec-sidecar
+          - platform: linux-arm64-gnu
+            runner: ubuntu-22.04-arm
+            target: aarch64-unknown-linux-gnu
+            binary: secure-exec-sidecar
+          - platform: darwin-x64
+            runner: macos-13
+            target: x86_64-apple-darwin
+            binary: secure-exec-sidecar
+          - platform: darwin-arm64
+            runner: macos-14
+            target: aarch64-apple-darwin
+            binary: secure-exec-sidecar
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - run: corepack enable
+        shell: bash
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: "22"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
       - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
+      - name: Add Rust target to the pinned toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          # The repo pins a toolchain via rust-toolchain.toml; cross targets
+          # must be added to *that* toolchain (not just `stable`), or cargo
+          # fails with "can't find crate for `core`" for the cross target.
+          channel=$(awk -F'"' '/channel/ {print $2; exit}' rust-toolchain.toml)
+          echo "Pinned toolchain channel: ${channel}"
+          rustup toolchain install "${channel}" --profile minimal
+          rustup target add --toolchain "${channel}" "${{ matrix.target }}"
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: . -> target
@@ -80,21 +108,35 @@ jobs:
           key: ${{ runner.os }}-${{ matrix.target }}-rusty-v8-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-${{ matrix.target }}-rusty-v8-
-      - run: pnpm install --frozen-lockfile
+      # The v8-runtime build script generates the V8 bridge assets from
+      # packages/build-tools/node_modules, so the workspace must be installed
+      # before cargo build. Exclude the `website` package: it is a leaf nothing
+      # depends on, and pnpm 10.x intermittently loses a symlink-ordering race
+      # creating website/node_modules (ENOENT before linking pixelmatch).
+      - name: Install workspace dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile --filter='!@secure-exec/website'
       - name: Build sidecar binary
         id: build
+        shell: bash
+        env:
+          MATRIX_TARGET: ${{ matrix.target }}
+          MATRIX_PLATFORM: ${{ matrix.platform }}
+          MATRIX_BINARY: ${{ matrix.binary }}
+          TRIGGER: ${{ needs.context.outputs.trigger }}
         run: |
           set -euo pipefail
-          out="target/sidecar-artifacts/${{ matrix.platform }}"
+
+          out="target/sidecar-artifacts/${MATRIX_PLATFORM}"
           mkdir -p "$out"
-          if [ "${{ needs.context.outputs.trigger }}" = "release" ]; then
-            cargo build --release -p secure-exec-sidecar --target ${{ matrix.target }}
+          if [ "$TRIGGER" = "release" ]; then
+            cargo build --release -p secure-exec-sidecar --target "$MATRIX_TARGET"
             profile="release"
           else
-            cargo build -p secure-exec-sidecar --target ${{ matrix.target }}
+            cargo build -p secure-exec-sidecar --target "$MATRIX_TARGET"
             profile="debug"
           fi
-          cp "target/${{ matrix.target }}/${profile}/secure-exec-sidecar" "$out/secure-exec-sidecar"
+          cp "target/${MATRIX_TARGET}/${profile}/${MATRIX_BINARY}" "$out/${MATRIX_BINARY}"
           echo "dir=$out" >> "$GITHUB_OUTPUT"
       - uses: actions/upload-artifact@v4
         with:
@@ -114,14 +156,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - run: corepack enable
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: "22"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
           registry-url: https://registry.npmjs.org
-      - run: pnpm install --frozen-lockfile
+      # Install the full workspace except the `website` package. website is a
+      # leaf (nothing depends on it, and it is not published here), and pnpm 10.x
+      # intermittently loses a symlink-ordering race creating website/node_modules
+      # (ENOENT before linking pixelmatch). Excluding it deterministically avoids
+      # the flake. `--frozen-lockfile` still validates the full lockfile.
+      - name: Install workspace dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile --filter='!@secure-exec/website'
       - uses: actions/download-artifact@v4
         with:
           pattern: sidecar-*
@@ -130,7 +179,8 @@ jobs:
         run: |
           set -euo pipefail
           for p in $SIDECAR_PLATFORMS; do
-            bin="artifacts/sidecar-${p}/secure-exec-sidecar"
+            binname="secure-exec-sidecar"
+            bin="artifacts/sidecar-${p}/${binname}"
             dest="packages/sidecar/npm/${p}"
             if [ ! -f "$bin" ]; then
               echo "::error::missing secure-exec-sidecar binary artifact for ${p}"
@@ -140,8 +190,8 @@ jobs:
               echo "::error::missing platform package dir $dest"
               exit 1
             fi
-            cp "$bin" "${dest}/secure-exec-sidecar"
-            chmod +x "${dest}/secure-exec-sidecar"
+            cp "$bin" "${dest}/${binname}"
+            chmod +x "${dest}/${binname}"
             echo "Placed binary for ${p}"
           done
       - name: Bump package versions for build
@@ -152,7 +202,8 @@ jobs:
       - name: Build TypeScript packages
         run: |
           npx turbo build \
-            --filter='!./examples/*'
+            --filter='!./examples/*' \
+            --filter='!@secure-exec/website'
       - name: Finalize package versions for publish
         run: |
           pnpm --filter=publish exec tsx src/ci/bin.ts bump-versions \
@@ -178,10 +229,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v4
+      - run: corepack enable
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: "22"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
       - run: pnpm install --frozen-lockfile --filter=publish
@@ -196,13 +247,18 @@ jobs:
           set -euo pipefail
           declare -A PLATFORM_TARGET=(
             [linux-x64-gnu]=x86_64-unknown-linux-gnu
+            [linux-arm64-gnu]=aarch64-unknown-linux-gnu
+            [darwin-x64]=x86_64-apple-darwin
+            [darwin-arm64]=aarch64-apple-darwin
           )
           mkdir -p release-assets
           for p in $SIDECAR_PLATFORMS; do
-            bin="artifacts/sidecar-${p}/secure-exec-sidecar"
+            binname="secure-exec-sidecar"
+            suffix=""
+            bin="artifacts/sidecar-${p}/${binname}"
             if [ -f "$bin" ]; then
               target="${PLATFORM_TARGET[$p]}"
-              cp "$bin" "release-assets/secure-exec-sidecar-${target}"
+              cp "$bin" "release-assets/secure-exec-sidecar-${target}${suffix}"
             else
               echo "::warning::missing secure-exec-sidecar binary for ${p}"
             fi
@@ -274,14 +330,18 @@ jobs:
   publish-crates:
     needs: [context, build-sidecar, release-assets]
     name: "Publish crates.io"
-    if: ${{ !cancelled() && needs.build-sidecar.result == 'success' && (needs.release-assets.result == 'success' || needs.release-assets.result == 'skipped') }}
+    # Release-only: on previews the crates publish is a dry-run that still does a
+    # full compile/package, and any error there reddened the WHOLE run even though
+    # the npm deliverable published fine (FALLING_OUT.md §4b). The 4 build-sidecar
+    # legs already compile every crate, so the preview dry-run added only noise.
+    if: ${{ !cancelled() && needs.build-sidecar.result == 'success' && needs.release-assets.result == 'success' && needs.context.outputs.trigger == 'release' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - run: corepack enable
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: "22"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
       - uses: dtolnay/rust-toolchain@stable
@@ -294,7 +354,14 @@ jobs:
           key: ${{ runner.os }}-x86_64-unknown-linux-gnu-rusty-v8-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-x86_64-unknown-linux-gnu-rusty-v8-
-      - run: pnpm install --frozen-lockfile
+      # Install the full workspace except the `website` package. website is a
+      # leaf (nothing depends on it, and it is not published here), and pnpm 10.x
+      # intermittently loses a symlink-ordering race creating website/node_modules
+      # (ENOENT before linking pixelmatch). Excluding it deterministically avoids
+      # the flake. `--frozen-lockfile` still validates the full lockfile.
+      - name: Install workspace dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile --filter='!@secure-exec/website'
       - name: Bump Cargo versions
         run: |
           pnpm --filter=publish exec tsx src/ci/bin.ts bump-versions \

Cargo.lock

@@ -52,7 +52,7 @@ npm install secure-exec
 
 **2. Create a runtime**
 
-`NodeRuntime.create()` boots a fully virtualized VM behind the native sidecar. Guest code runs inside the kernel isolation boundary with no host escapes. All options are optional: `cwd` defaults to `/home/user`, and permissions default to a secure policy that denies network access (see step 4).
+`NodeRuntime.create()` boots a fully virtualized VM behind the native sidecar. Guest code runs inside the kernel isolation boundary with no host escapes. All options are optional: `cwd` defaults to `/workspace`, and permissions default to a secure policy that denies network access (see step 4).
 
 ```ts
 import { NodeRuntime } from "secure-exec";

README.md

@@ -5631,13 +5631,13 @@ mod tests {
     fn translate_wasm_guest_path_uses_sandbox_root_for_absolute_paths() {
         let temp = tempdir().expect("create temp dir");
         let sandbox_root = temp.path().join("shadow-root");
-        let cwd = sandbox_root.join("home/user");
+        let cwd = sandbox_root.join("workspace");
         fs::create_dir_all(cwd.join("project")).expect("create host cwd");
 
         let internal_sync_rpc = WasmInternalSyncRpc {
             module_guest_paths: Vec::new(),
             module_host_path: sandbox_root.join("module.wasm"),
-            guest_cwd: String::from("/home/user"),
+            guest_cwd: String::from("/workspace"),
             host_cwd: cwd.clone(),
             sandbox_root: Some(sandbox_root.clone()),
             guest_path_mappings: Vec::new(),
@@ -5660,13 +5660,13 @@ mod tests {
     fn translate_wasm_host_symlink_target_returns_guest_path_for_mapped_targets() {
         let temp = tempdir().expect("create temp dir");
         let sandbox_root = temp.path().join("shadow-root");
-        let cwd = sandbox_root.join("home/user");
+        let cwd = sandbox_root.join("workspace");
         fs::create_dir_all(cwd.join("project")).expect("create host cwd");
 
         let internal_sync_rpc = WasmInternalSyncRpc {
             module_guest_paths: Vec::new(),
             module_host_path: sandbox_root.join("module.wasm"),
-            guest_cwd: String::from("/home/user"),
+            guest_cwd: String::from("/workspace"),
             host_cwd: cwd.clone(),
             sandbox_root: Some(sandbox_root.clone()),
             guest_path_mappings: vec![super::WasmGuestPathMapping {
@@ -5983,13 +5983,13 @@ mod tests {
     fn wasm_guest_path_mappings_mount_root_to_sandbox_root() {
         let temp = tempdir().expect("create temp dir");
         let sandbox_root = temp.path().join("shadow-root");
-        let host_cwd = sandbox_root.join("home/user");
+        let host_cwd = sandbox_root.join("workspace");
         fs::create_dir_all(&host_cwd).expect("create host cwd");
 
         let mappings = super::wasm_guest_path_mappings(&request_with_env(
             &host_cwd,
             BTreeMap::from([
-                (String::from("PWD"), String::from("/home/user")),
+                (String::from("PWD"), String::from("/workspace")),
                 (
                     String::from(WASM_SANDBOX_ROOT_ENV),
                     sandbox_root.to_string_lossy().into_owned(),
@@ -6001,7 +6001,7 @@ mod tests {
             .iter()
             .any(|mapping| { mapping.guest_path == "/" && mapping.host_path == sandbox_root }));
         assert!(mappings.iter().any(|mapping| {
-            mapping.guest_path == "/home/user" && mapping.host_path == host_cwd
+            mapping.guest_path == "/workspace" && mapping.host_path == host_cwd
         }));
     }
 

crates/execution/src/wasm.rs

@@ -127,7 +127,7 @@ impl KernelVmConfig {
         Self {
             vm_id: vm_id.into(),
             env: BTreeMap::new(),
-            cwd: String::from("/home/user"),
+            cwd: String::from("/workspace"),
             user: UserConfig::default(),
             permissions: Permissions::default(),
             dns: DnsConfig::default(),

crates/kernel/src/kernel.rs

@@ -63,7 +63,7 @@ impl UserManager {
     pub fn from_config(config: UserConfig) -> Self {
         let uid = config.uid.unwrap_or(1000);
         let gid = config.gid.unwrap_or(1000);
-        let username = config.username.unwrap_or_else(|| String::from("user"));
+        let username = config.username.unwrap_or_else(|| String::from("agentos"));
         let supplementary_gids = normalize_supplementary_gids(gid, config.supplementary_gids);
 
         Self {
@@ -72,7 +72,7 @@ impl UserManager {
             euid: config.euid.unwrap_or(uid),
             egid: config.egid.unwrap_or(gid),
             username: username.clone(),
-            homedir: config.homedir.unwrap_or_else(|| String::from("/home/user")),
+            homedir: config.homedir.unwrap_or_else(|| String::from("/home/agentos")),
             shell: config.shell.unwrap_or_else(|| String::from("/bin/sh")),
             gecos: config.gecos.unwrap_or_default(),
             group_name: config.group_name.unwrap_or(username),

crates/kernel/src/user.rs

@@ -307,13 +307,13 @@ fn filter_env_only_keeps_allowed_keys() {
     };
 
     let env = BTreeMap::from([
-        (String::from("HOME"), String::from("/home/user")),
+        (String::from("HOME"), String::from("/home/agentos")),
         (String::from("PATH"), String::from("/usr/bin")),
         (String::from("SECRET_KEY"), String::from("hidden")),
     ]);
 
     let filtered = filter_env("vm-permissions", &env, &permissions);
-    assert_eq!(filtered.get("HOME"), Some(&String::from("/home/user")));
+    assert_eq!(filtered.get("HOME"), Some(&String::from("/home/agentos")));
     assert_eq!(filtered.get("PATH"), Some(&String::from("/usr/bin")));
     assert!(!filtered.contains_key("SECRET_KEY"));
 }
@@ -408,7 +408,7 @@ fn kernel_vm_config_defaults_to_deny_all_permissions() {
 }
 
 #[test]
-fn kernel_default_spawn_cwd_matches_home_user() {
+fn kernel_default_spawn_cwd_matches_workspace() {
     let captured_cwd = Arc::new(Mutex::new(None));
     let captured_cwd_for_permission = Arc::clone(&captured_cwd);
 
@@ -437,7 +437,7 @@ fn kernel_default_spawn_cwd_matches_home_user() {
             .lock()
             .expect("captured cwd lock poisoned")
             .as_deref(),
-        Some("/home/user")
+        Some("/workspace")
     );
 
     process.finish(0);