Skip to content

v0.3.0

Choose a tag to compare

View all tags
@ScottRBK ScottRBK released this 28 Aug 14:22
· 24 commits to main since this release
v0.3.0
008edfa

What’s new

Composable execution hosts and isolation policies

AgentShell now separates where a CLI process runs from how that process is isolated:

  • ExecutionHost owns process launch and returns a per-run RunHandle.
  • IsolationPolicy can independently prepare a launch.
  • NativeExecutionHost with NoIsolation remains the default, preserving existing callers.
  • All seven adapters use the new execution seam for execute(), stream(), and health_check().

This provides the foundation for future execution hosts such as tmux and Herder without requiring new agent adapters.

Opt-in Linux PID namespace isolation

LinuxPidNamespaceIsolation places the CLI and its descendants inside a rootless user/PID namespace. This prevents child-namespace processes from seeing or directly signalling AgentShell’s ancestor processes.

Isolation requests fail closed when the required Linux kernel features or unshare support are unavailable. There is no silent fallback to native execution.

This is a process/signal boundary, not a general sandbox: it does not restrict filesystem access, credentials, networking, tools, resources, or every possible host-side signalling path.

Process lifecycle improvements

  • Process execution and cancellation now flow through RunHandle across every adapter.
  • Non-zero exits expose normalized returncode and signal metadata in stream events and AgentExecutionError.
  • Process guardians remain attached to the stable run handle throughout normal completion, cancellation, abandoned streams, and interpreter shutdown.

Documentation and test reliability

  • Documented Cursor’s user-scope MCP configuration behavior.
  • Cursor E2E and health checks now explicitly select auto, avoiding mutable named-model defaults that free Cursor plans cannot execute.
  • Added real-kernel and integration coverage for execution-host wiring, PID isolation, cancellation, status propagation, and fail-closed behavior.

Compatibility

There are no intentional breaking defaults in this release. Existing AgentShell(agent_type=...) callers continue to use native execution without isolation unless they explicitly select a different host or policy.

Full Changelog: v0.2.5...v0.3.0

Assets 2
Loading