Software
Install immutable .aospkg command packages when a VM is created or while it is running.
agentOS software ships as immutable .aospkg packages containing real compiled
tools. Installed packages are projected read-only under
/opt/agentos/pkgs/<name>/<version>, and their commands are linked under
/opt/agentos/bin. Every VM includes a default bundle with sh, coreutils, and
the standard CLI tools programs rely on.
Browse the available packages in the registry.
Registry packages
Registry packages are published with each release under
https://releases.rivet.dev/agent-os/<version>/software/, or latest for the
newest release. Its manifest.json lists each package’s name, digest, size,
and path relative to the manifest. Registry software is not installed from npm;
see Publishing Software.
Install while running
Install a package into a running VM from an HTTPS URL, with an optional exact
sha256:<64 lowercase hex> digest. The library also accepts a trusted local
path.
import { createAgentOsClient } from "@rivet-dev/agentos";
const client = createAgentOsClient({ endpoint: "https://api.rivet.dev" });
const vm = client.agentOS.getOrCreate(["my-vm"]);
// Registry software is published as digest-addressed .aospkg files next to a
// manifest. Use a release version, or `latest`.
const base = "https://releases.rivet.dev/agent-os/latest/software/";
const { artifacts } = await (await fetch(`${base}manifest.json`)).json();
const ripgrep = artifacts.find((artifact: { name: string }) => artifact.name === "ripgrep");
const installed = await vm.v1.software.install({
source: { url: new URL(ripgrep.path, base).href, digest: ripgrep.digest },
});
if (installed.config.state === "restart_required") {
await vm.v1.vm.restart({});
}
for (const software of await vm.v1.software.list({})) {
console.log(software.packageId, software.commands);
}
const { packageId } = installed.source;
if (packageId) await vm.v1.software.uninstall({ packageId });
import { AgentOs } from "@rivet-dev/agentos-core";
// Registry software is published as digest-addressed .aospkg files next to a
// manifest. Use a release version, or `latest`.
const base = "https://releases.rivet.dev/agent-os/latest/software/";
const manifest = (await (await fetch(`${base}manifest.json`)).json()) as {
artifacts: { name: string; digest: string; path: string }[];
};
const ripgrep = manifest.artifacts.find((artifact) => artifact.name === "ripgrep");
if (!ripgrep) throw new Error("ripgrep is not in the manifest");
const vm = await AgentOs.create();
try {
// Install a package while the VM is running. The bytes are verified against
// the digest before the package is projected into /opt/agentos.
const installed = await vm.software.install({
type: "url",
url: new URL(ripgrep.path, base).href,
expectedDigest: ripgrep.digest,
});
console.log(installed.packageName, installed.version, installed.commands);
const result = await vm.process.execFile("rg", ["--version"], {
output: { capture: "all" },
});
console.log(result.stdout);
// Packages installed through this API, and every command the VM provides.
console.log(vm.software.installed());
console.log(await vm.software.list());
await vm.software.uninstall(installed.packageId);
} finally {
await vm.dispose();
}
On hosted VMs, software is part of the VM’s durable configuration, so install
and uninstall use the same revision checks as v1.config.patch. A change
applies live when the VM is ready and its desired configuration is fully
applied; otherwise it reports restart_required, and v1.vm.restart applies
it. Both mutations return { source, software, config }. v1.software.list
reads the live installed set, and the desired package sources live in
v1.config.get.
In the library, software.install(source) returns the installed package’s
packageId, digest, sizeBytes, packageName, version, and commands.
software.installed() lists packages installed through software.install, and
software.list() reports every package that provides commands in the VM. Only
one software or mount mutation runs at a time per VM; a concurrent call fails
with invalid_state instead of queueing.
Install when the VM is created
import { createAgentOsClient } from "@rivet-dev/agentos";
const client = createAgentOsClient({ endpoint: "https://api.rivet.dev" });
const vm = client.agentOS.getOrCreate(["my-vm"], {
createWithInput: {
config: {
software: [
{
url: "https://releases.rivet.dev/agent-os/latest/software/packages/git/<sha256>.aospkg",
},
],
},
},
});
import git from "@agentos-software/git";
import { AgentOs } from "@rivet-dev/agentos-core";
const vm = await AgentOs.create({ software: [git] });
try {
const result = await vm.process.exec("git --version", {
output: { capture: "all" },
});
console.log(result.stdout);
} finally {
await vm.dispose();
}
Hosted VMs take package URLs in their software config. The library takes
{ packagePath } references to packed .aospkg files, which is what the
@agentos-software/* packages in the agentOS repository export, and
defaultSoftware: false for a bare VM with only the software you list.
Verification and caching
Each URL source is downloaded under strict size, time, and redirect limits, verified against the expected digest when one is given, and validated before it is projected. The verified content digest is the package identity.
Packages are cached by content digest, so VMs that share a worker or sidecar reuse one verified copy, and repeat installs of the same bytes skip the download. Hosted workers also warm popular packages at startup; see Software Installation and Preloading.
Embedded API
The embedding process is trusted, so software.install accepts local package
paths as well as URLs. Read more in the
embedded API quickstart.