feat(execution): add JavaScript and Python execution

.claude/skills/publish-registry/SKILL.md

@@ -29,7 +29,7 @@ just registry-publish-all [tag]
 
 ## Rules
 
-- Do not publish registry packages from secure-exec.
+- Do not publish registry packages from agentos.
 - Do not move `latest` unless the user explicitly asks for a release.
 - Prefer AgentOS workspace builds while iterating; published pins are for
   consumers and release validation.

.claude/skills/release-preview/SKILL.md

@@ -9,8 +9,8 @@ AgentOS previews are branch snapshots from this repository. The workflow builds
 debug artifacts and publishes npm packages under a sanitized branch dist-tag.
 No crates.io release, git tag, or GitHub release is created.
 
-secure-exec is a generated mirror. Do not bump a secure-exec ref or cut a
-secure-exec preview by hand.
+agentos is a generated mirror. Do not bump a agentos ref or cut a
+agentos preview by hand.
 
 ## Procedure
 
@@ -32,6 +32,6 @@ npm install @rivet-dev/agentos-core@<sanitized-branch>
 ## Rules
 
 - Release-preview is for previews only; releases use the `release` skill.
-- All code changes belong in AgentOS. The secure-exec mirror is regenerated
+- All code changes belong in AgentOS. The agentos mirror is regenerated
   from AgentOS and follows the published AgentOS version.
 - On failure: `gh run view <run> --log-failed`, fix, re-dispatch, re-watch.

.claude/skills/release/SKILL.md

@@ -10,8 +10,8 @@ The publish flow lives in `scripts/publish` and is driven by
 
 AgentOS is the source of truth. It publishes npm packages, crates, runtime
 sidecars, Pyodide/R2 assets, and `@agentos-software/*` registry packages from
-this repository. secure-exec releases are generated compatibility shims that
-follow the AgentOS version; never release secure-exec first.
+this repository. agentos releases are generated compatibility shims that
+follow the AgentOS version; never release agentos first.
 
 ## Procedure
 
@@ -37,6 +37,6 @@ gh run watch -R rivet-dev/agentos "$run" --exit-status
 - `scripts/publish/src/local/cut-release.ts` is a pure trigger; version changes
   happen in the ephemeral CI checkout.
 - `workspace:*` deps are rewritten to literal versions by the publish bump pass.
-- Generated secure-exec shims are dispatched after AgentOS publishes and must
+- Generated agentos shims are dispatched after AgentOS publishes and must
   use the same version.
 - If anything fails, stop and report — do not retry automatically.

.gitattributes

@@ -2,7 +2,7 @@
 #
 # The Rust kernel is the substance of this repo; the rest is the TypeScript
 # client/protocol/registry plus a large test suite (the kernel itself lives in
-# the secure-exec repo). We count Rust in full, plus the core client surface
+# the agentos repo). We count Rust in full, plus the core client surface
 # (the AgentOS client entrypoint + its sidecar wire layer) and the core JS
 # binary-resolver shim, and exclude everything else (tests, demos, tooling,
 # generated bundles, the website, and the remaining client/registry code).

.github/workflows/ci-nightly.yml

@@ -40,7 +40,6 @@ jobs:
             sudo apt-get install --yes cmake
           fi
       - run: pnpm install --frozen-lockfile
-      - run: node --test scripts/generate-secure-exec-mirror.test.mjs
       - run: make -C toolchain commands
       - run: make -C toolchain cmd/duckdb
       - run: make -C toolchain codex

.github/workflows/ci.yml

@@ -72,7 +72,6 @@ jobs:
       - run: node scripts/verify-fixed-versions.mjs
       - run: node --test scripts/check-layout.test.mjs
       - run: pnpm check-layout
-      - run: node --test scripts/generate-secure-exec-mirror.test.mjs
       - run: node --test scripts/check-rustfmt.test.mjs
       - run: node scripts/check-rustfmt.mjs
       - run: pnpm check-types
@@ -82,7 +81,6 @@ jobs:
             --filter '@rivet-dev/agentos-build-tools' \
             --filter '@rivet-dev/agentos-toolchain' \
             --filter '@rivet-dev/agentos-runtime-sidecar' \
-            --filter 'secure-exec' \
             test
       - run: pnpm lint
         continue-on-error: true

.pnpmfile.cjs

@@ -0,0 +1,15 @@
+const PINNED_RIVETKIT_VERSION = "0.0.0-sqlite-uds.4e59a38";
+
+module.exports = {
+	hooks: {
+		readPackage(pkg) {
+			if (pkg.name === "rivetkit" && pkg.version === PINNED_RIVETKIT_VERSION) {
+				// This preview bundles its ./agent-os implementation but still declares
+				// the retired external runtime. Keeping the declaration would restore the
+				// sunset package graph even though no bundled RivetKit module imports it.
+				delete pkg.dependencies?.["@rivet-dev/agent-os-core"];
+			}
+			return pkg;
+		},
+	},
+};

CLAUDE.md

@@ -1,8 +1,8 @@
 # agentOS
 
 AgentOS owns the runtime, kernel, VFS, language execution, registry packages,
-ACP/session layer, AgentOS client APIs, docs, and publish machinery. The
-`secure-exec` repository is now a generated compatibility mirror only.
+ACP/session layer, AgentOS client APIs, docs, and publish machinery. Agent OS
+Exec is the JavaScript, TypeScript, and Python execution surface of AgentOS.
 
 ## Boundaries
 
@@ -16,9 +16,8 @@ ACP/session layer, AgentOS client APIs, docs, and publish machinery. The
   or public API that already uses the word.
 - The protocol has no backward compatibility guarantee. Client, sidecar, and
   protocol crates ship in same-version lockstep; update both sides together.
-- Generic runtime work belongs here, not in `../secure-exec`. Regenerate that
-  mirror with `node scripts/generate-secure-exec-mirror.mjs` after changing a
-  shimmed public surface.
+- Generic runtime and language-execution work belongs here. Do not add a
+  compatibility mirror or a second package namespace for AgentOS language execution.
 - Keep root `package.json` scripts limited to Turbo orchestration; repo-specific
   commands belong in `justfile` recipes or scoped package scripts.
 - AgentOS targets native Linux/container execution. Browser support is not
@@ -218,9 +217,10 @@ custom host-syscall imports. Treat that target as **native POSIX**;
 
 - `scripts/publish` is the source of truth for npm/crates discovery, version
   rewriting, npm publish, crates publish, release assets, and R2 upload.
-- Publishable npm packages and Rust crates are AgentOS-owned. Compatibility
-  `@secure-exec/*`, `secure-exec`, and `secure-exec-*` artifacts are emitted
-  from the generated mirror.
+- Publishable npm packages and Rust crates are AgentOS-owned. AgentOS language execution is
+  published through `@rivet-dev/agentos-javascript` and
+  `@rivet-dev/agentos-python`; `@rivet-dev/agentos` owns the actor API. Do not
+  publish compatibility artifacts or language subpaths from the actor package.
 - The release workflow must build and stage the native sidecar binaries,
   runtime-sidecar binaries, registry WASM commands, and pyodide assets before
   publish.