fix: restore clippy and rustfmt on main, restructure secure-exec docs

crates/client/src/agent_os.rs

@@ -26,9 +26,9 @@ use agentos_vm_config as vm_config;
 
 use crate::config::{
     resolve_host_functions, AgentOsConfig, AgentOsLimits, MountConfig, ResolvedHostFunction,
-    ResolvedHostFunctions, RootFilesystemConfig,
-    RootFilesystemKind, RootFilesystemMode as ConfigRootFilesystemMode, RootLowerInput,
-    SidecarJsBridgeCall, SidecarJsBridgeCallback, TimerScheduleDriver,
+    ResolvedHostFunctions, RootFilesystemConfig, RootFilesystemKind,
+    RootFilesystemMode as ConfigRootFilesystemMode, RootLowerInput, SidecarJsBridgeCall,
+    SidecarJsBridgeCallback, TimerScheduleDriver,
 };
 use crate::cron::CronManager;
 use crate::error::ClientError;

crates/client/src/config.rs

@@ -307,9 +307,9 @@ fn is_command_name(name: &str) -> bool {
         && !name.starts_with('-')
         && !name.ends_with('-')
         && !name.contains("--")
-        && name
-            .chars()
-            .all(|character| character.is_ascii_lowercase() || character.is_ascii_digit() || character == '-')
+        && name.chars().all(|character| {
+            character.is_ascii_lowercase() || character.is_ascii_digit() || character == '-'
+        })
 }
 
 fn to_command_name(kind: &str, key: &str) -> Result<String, String> {

crates/client/src/lib.rs

@@ -67,13 +67,13 @@ pub use stream::{ByteStream, Subscription};
 pub use config::{
     node_modules_mount, AcpLimits, AgentOsConfig, AgentOsConfigBuilder, AgentOsLimits,
     AgentOsSidecarConfig, FsPermissionRule, FsPermissions, HostFunction, HostFunctionCallback,
-    HostFunctionCollection, HostFunctionCollections, HostFunctionLimits, HttpLimits, JsRuntimeLimits, MountConfig, MountPlugin,
-    OverlayMountConfig, PackageRef, PatternPermissionRule, PatternPermissions, PermissionMode,
-    Permissions, PluginLimits, PythonLimits, ResourceLimits, RootFilesystemConfig,
-    RootFilesystemKind, RootFilesystemMode, RootLowerInput, RulePermissions, ScheduleCallback,
-    ScheduleDriver, ScheduleEntry, ScheduleHandle, SidecarJsBridgeCall, SidecarJsBridgeCallback,
-    SoftwareInput, SoftwareKind, TimerScheduleDriver, VmGroupConfig, VmUserAccountConfig,
-    VmUserConfig, WasmLimits,
+    HostFunctionCollection, HostFunctionCollections, HostFunctionLimits, HttpLimits,
+    JsRuntimeLimits, MountConfig, MountPlugin, OverlayMountConfig, PackageRef,
+    PatternPermissionRule, PatternPermissions, PermissionMode, Permissions, PluginLimits,
+    PythonLimits, ResourceLimits, RootFilesystemConfig, RootFilesystemKind, RootFilesystemMode,
+    RootLowerInput, RulePermissions, ScheduleCallback, ScheduleDriver, ScheduleEntry,
+    ScheduleHandle, SidecarJsBridgeCall, SidecarJsBridgeCallback, SoftwareInput, SoftwareKind,
+    TimerScheduleDriver, VmGroupConfig, VmUserAccountConfig, VmUserConfig, WasmLimits,
 };
 
 pub use process::{

crates/client/tests/os_instructions_e2e.rs

@@ -13,8 +13,9 @@ use std::path::Path;
 use std::sync::Arc;
 
 use agentos_client::config::{
-    node_modules_mount, AgentOsConfig, AgentOsSidecarConfig, FsPermissions, HostFunction, HostFunctionCollection,
-    HostFunctionCollections, PackageRef, PatternPermissions, PermissionMode, Permissions,
+    node_modules_mount, AgentOsConfig, AgentOsSidecarConfig, FsPermissions, HostFunction,
+    HostFunctionCollection, HostFunctionCollections, PackageRef, PatternPermissions,
+    PermissionMode, Permissions,
 };
 use agentos_client::{AgentOs, OpenSessionInput};
 use agentos_vm_config::VmSqliteDescriptor;

crates/native-sidecar-core/src/permissions.rs

@@ -114,10 +114,7 @@ pub fn resolve_permissions_policy(
         child_process: requested.child_process.clone().or(defaults.child_process),
         process: requested.process.clone().or(defaults.process),
         env: requested.env.clone().or(defaults.env),
-        host_function: requested
-            .host_function
-            .clone()
-            .or(defaults.host_function),
+        host_function: requested.host_function.clone().or(defaults.host_function),
     }
 }
 

crates/native-sidecar/src/execution/mod.rs

@@ -137,14 +137,14 @@ use crate::state::{
     GuestUnixListenerRoute, HostFunctionExecution, HostNetTransferDescription,
     HostNetTransferDescriptionRegistry, Http2BridgeEvent, Http2ResponseSender,
     Http2RuntimeSnapshot, Http2SessionCommand, Http2SessionSnapshot, Http2SocketSnapshot,
-    JavascriptHttp2LoopbackTarget,
-    JavascriptHttpLoopbackTarget, JavascriptSocketFamily, JavascriptSocketPathContext,
-    JavascriptTcpListenerEvent, JavascriptTcpSocketEvent, JavascriptTlsBridgeOptions,
-    JavascriptTlsClientHello, JavascriptTlsDataValue, JavascriptTlsMaterial, JavascriptUdpFamily,
-    JavascriptUdpSocketEvent, JavascriptUnixListenerEvent, KernelSocketReadinessEvent,
-    KernelSocketReadinessRegistry, KernelSocketReadinessTarget, ListenerConnectionRetirement,
-    NativeCapabilityKey, NativePlainSocketCommand, NativeTlsCommand, NativeUdpCommand,
-    NativeUdpSendPayload, NativeUdpSocketOption, NetworkResourceCounts, PendingChildProcessSync,
+    JavascriptHttp2LoopbackTarget, JavascriptHttpLoopbackTarget, JavascriptSocketFamily,
+    JavascriptSocketPathContext, JavascriptTcpListenerEvent, JavascriptTcpSocketEvent,
+    JavascriptTlsBridgeOptions, JavascriptTlsClientHello, JavascriptTlsDataValue,
+    JavascriptTlsMaterial, JavascriptUdpFamily, JavascriptUdpSocketEvent,
+    JavascriptUnixListenerEvent, KernelSocketReadinessEvent, KernelSocketReadinessRegistry,
+    KernelSocketReadinessTarget, ListenerConnectionRetirement, NativeCapabilityKey,
+    NativePlainSocketCommand, NativeTlsCommand, NativeUdpCommand, NativeUdpSendPayload,
+    NativeUdpSocketOption, NetworkResourceCounts, PendingChildProcessSync,
     PendingChildProcessSyncCompletion, PendingHttpRequest, PendingJavascriptNetConnect,
     PendingJavascriptNetConnectState, PendingKernelStdin, PendingPythonTcpConnect,
     PendingTcpSocket, PendingUnixConnectionGuard, PendingUnixSocket, PlainSocketWritePayload,

crates/native-sidecar/src/execution/network/unix.rs

@@ -1114,6 +1114,7 @@ pub(in crate::execution) fn defer_vm_local_unix_connect(
 // ActiveUnixListener moved to crate::state
 
 impl ActiveUnixListener {
+    #[allow(clippy::too_many_arguments)]
     fn from_virtual(
         guest_path: String,
         abstract_path_hex: Option<String>,

crates/native-sidecar/src/language_execution.rs

@@ -3088,7 +3088,10 @@ mod inline_host_functions_prefix_tests {
     fn converts_kebab_case_names_to_identifiers() {
         assert_eq!(host_function_identifier("orders"), "orders");
         assert_eq!(host_function_identifier("order-store"), "orderStore");
-        assert_eq!(host_function_identifier("list-open-orders"), "listOpenOrders");
+        assert_eq!(
+            host_function_identifier("list-open-orders"),
+            "listOpenOrders"
+        );
     }
 
     #[test]

docs/content/docs/architecture.mdx

@@ -73,7 +73,7 @@ The client speaks to the agentOS server over the wire. The server runs the **sid
 ### The VM
 
 - **A fully virtualized Linux environment.** Each VM has its own filesystem, process table, and network policy. Two VMs share nothing.
-- **The unit of isolation.** Put one tenant or one task per VM to control the blast radius. A crash or runaway in one VM never affects another.
+- **The unit of isolation.** A crash or runaway in one VM never affects another.
 - **Where guest code lives.** The agent, the shell, npm packages, and any generated code all run inside the VM, behind the kernel's boundary.
 
 ## Anatomy of a Linux VM

docs/content/docs/models-and-credentials.mdx

@@ -6,7 +6,7 @@ skill: true
 
 - Choose the model through your **agent adapter**.
 - Pass provider credentials from trusted server code.
-- Credentials are injected at session creation and can be isolated per tenant.
+- Credentials are injected at session creation.
 - The VM does **not** inherit the host `process.env` — keys must be passed
   explicitly.
 
@@ -18,7 +18,6 @@ Pass LLM provider keys via the `env` option on `openSession`.
 
 ## Per-tenant credentials
 
-- Key `getOrCreate` on the tenant id → isolated VM per tenant.
 - Look up the tenant's key on the server, inject via session `env`.
 - Keys stay on the server and never reach the client, and one tenant's key
   never reaches another.

docs/content/docs/performance.mdx

@@ -85,8 +85,7 @@ Pi session with MCP servers and mounted filesystems.
 - agentOS runs on hardware you provision, not per-VM-second billing.
 - Estimate: instance cost per second ÷ concurrent VMs it holds with realistic
   memory + utilization headroom.
-- A VM per task/tenant → strongest isolation; safely reusing a VM for trusted
-  sequential work amortizes boot + filesystem setup.
+- Reusing a VM for sequential work amortizes boot and filesystem setup.
 - Small short executions benefit most from dense packing; heavy long-lived work
   depends more on hardware choice and avoiding per-sandbox minimums.
 

examples/llm-credentials/README.md

@@ -9,7 +9,7 @@ A VM never inherits the host `process.env`, so LLM provider keys must be handed
 
 ## How it works
 
-The server declares the agent software but holds no credentials. The client passes keys through the `env` option on `openSession`, which injects them into that session's adapter environment. For multi-tenant setups, give each tenant an isolated VM keyed by their id and resolve their key from your own credential store when opening the session. Keys live on the server and are never sent to the browser.
+The server declares the agent software but holds no credentials. The client passes keys through the `env` option on `openSession`, which injects them into that session's adapter environment. For multi-tenant setups, resolve each tenant's key from your own credential store when opening the session. Keys live on the server and are never sent to the browser.
 
 ## Run it
 

examples/llm-credentials/per-tenant.ts

@@ -8,8 +8,8 @@ const client = createClient<typeof registry>({
 // Stand-in for your own per-tenant credential store.
 declare function lookupTenantApiKey(tenantId: string): Promise<string>;
 
-// Give each tenant an isolated VM keyed by their tenant id, then inject that
-// tenant's API key from your database at session creation. Keys stay on the
+// Look up each tenant's API key from your database and inject it at session
+// creation. Keys stay on the
 // server and never reach the client.
 async function startTenantSession(tenantId: string) {
 	const anthropicApiKey = await lookupTenantApiKey(tenantId);

secure-exec/docs/content/docs/comparison/quickjs.mdx

@@ -72,7 +72,7 @@ event loop.
 
 It has no native binary, so it runs in browsers, Deno, Bun, and edge runtimes,
 where Secure Exec cannot. It is small and starts almost instantly. The
-WebAssembly layer contains memory-safety bugs in the engine, which keep being
+WebAssembly layer confines memory-safety bugs in the engine, which keep being
 found, so an engine bug cannot inject code into your host. Its core language
 conformance is excellent.
 

secure-exec/docs/content/docs/comparison/vercel-run.mdx

@@ -68,7 +68,7 @@ data, the interpreter is what you will notice.
 ## What Run does well
 
 Run installs as pure JavaScript with no native binary and runs on Bun. The
-WebAssembly layer contains memory-safety bugs in the engine itself. Its host
+WebAssembly layer confines memory-safety bugs in the engine itself. Its host
 functions are well designed, and interrupt and resume for approvals is built in.
 
 ## Only choose Run when

secure-exec/docs/content/docs/contexts.mdx

@@ -18,8 +18,7 @@ need a context for those.
 
 Each call is its own ES module, so top-level `const` and `let` stay scoped to
 that call. Put values on `globalThis` to share them. A context holds memory and
-does nothing between calls. See the
-[execution model](/secure-exec/docs/execution-model) for the details.
+does nothing between calls.
 
 ## TypeScript