VM kernel does not route outbound HTTPS from spawned subprocesses

[abraderAI]

Summary

Spawned subprocesses inside the AgentOS VM kernel cannot make outbound HTTPS requests. The VM network policy (allowOutbound: true + allowedHosts) works for the main Node.js process but does not route traffic from child processes spawned via this.spawn() in createSession.

Environment

• Platform: Fly.io, 1GB VM, Node 22
• SDK: @rivet-dev/agent-os-core@0.1.1
• Agent: pi (adapter: pi-acp@0.0.26, agent: @mariozechner/pi-coding-agent@0.73.0)

Reproduction

Network config:

network: {
  allowOutbound: true,
  allowedHosts: ["api.groq.com", "api.x.ai", "api.openai.com"],
}

Steps:

1. createSession("pi", { env: { GROQ_API_KEY: "..." } }) is called
2. SDK resolves pi-acp adapter, spawns subprocess via this.spawn()
3. ACP initialize succeeds
4. ACP session/new sent — Pi calls getAvailableModels() → HTTPS to api.groq.com
5. Request never completes — hangs until 120s ACP timeout
6. Error: ACP request session/new (id=2) timed out after 120000ms

Root cause analysis

Systematically ruled out:

1. Not auth: Pi hasAnyPiAuthConfigured() passes. Hang is after auth, during HTTPS.
2. Not provider-specific: Tested xAI, Groq, OpenAI — all timeout at 120s.
3. Not OOM: 1GB VM, no OOM kills.
4. Not adapter-specific: OpenCode crashes differently; Pi gets further (completes initialize).
5. ACP protocol works: initialize handshake succeeds over stdin/stdout pipes.
6. Host-side HTTP works: Host tools calling Go API via fetch work fine.

Conclusion: The VM kernel network adapter (createNodeHostNetworkAdapter()) does not intercept/route outbound HTTPS from spawned subprocesses. Only the main process has network access.

Relevant code paths

• agent-os.js:1096-1133 — spawns adapter via this.spawn("node", [binPath, ...launchArgs])
• agent-os.js:279-368 — AgentOs.create sets up createNodeHostNetworkAdapter()

Workaround

Using a synthetic session ID without calling createSession. VM is available for host tools and VFS only — but no real ACP agent sessions work.

Impact

Blocks all ACP coding agent sessions in production. No coding agent (Pi, OpenCode, Claude Code) can reach its LLM API from inside the sandbox.