diff --git a/CLAUDE.md b/CLAUDE.md
index ec3f96b725..fc252dd1f6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -151,11 +151,35 @@ gawk, real curl/sqlite/duckdb/vim, …) compiled to `wasm32-wasip1` against a
 custom host-syscall imports. Treat that target as **native POSIX**;
 `wasm32-wasip1` is an implementation detail, not a feature ceiling.
 
+### `wasm32-wasip1` capability rule
+
+- **Never use `target_os = "wasi"` as evidence that a POSIX capability is
+  absent.** In agentOS it does not imply missing symlinks, executable modes,
+  TCP/UDP/Unix sockets, processes, signals, polling, or other Linux behavior.
+- When an upstream Rust crate hides a supported API behind `cfg(unix)`, expose
+  the same behavior through the corresponding `std::os::wasi` or libc API. A
+  crate or Codex patch may adapt target-specific API names and cfg routing; it
+  must not replace working behavior with `Unsupported`, a no-op, a dummy
+  capability report, or a Windows fallback.
+- Fix a genuinely missing POSIX operation in this order: Rust std, agentOS
+  libc/sysroot, then the host import and kernel implementation. Do not make an
+  application compile by disabling the operation one layer above the gap.
+- A WASI stub is allowed only for a genuinely host-native architectural
+  boundary, not for a missing syscall. Its source must state which trusted
+  agentOS component owns the behavior and why the guest implementation must not
+  run. For example, guest HTTP uses the sidecar-brokered HTTP transport because
+  the sidecar owns network policy; that does not mean guest TCP sockets are
+  unsupported.
+- Before accepting a new WASI patch or stub, audit every error path and cfg for
+  capability loss. Compilation alone is not validation: add or run a guest
+  behavior test for each POSIX surface the patch exposes.
+
 - **We do not depend on stock WASI / wasi-libc.** The sysroot is ours. A missing
   libc/POSIX API (`getrlimit`/`RLIMIT_NOFILE`, `getgroups`, spawn, fd dup, …) is
-  never a blocker — implement it (real, or a sane stub) in the patched
+  never a blocker — implement the real operation in the patched
   std/libc/host-import layer. "WASI doesn't have X" is not a reason to stop; X is
-  ours to add.
+  ours to add. Do not substitute a success-returning stub, hard-coded value, or
+  target-level omission for a syscall agentOS can implement.
 - **Fix portability one layer down, in the sysroot** — a new std/libc patch or a
   new host import — not with `cfg(target_*)` branches or shims in the tool's own
   source. A WASM-specific branch in application code usually means the fix
diff --git a/crates/execution/assets/runners/wasm-runner.mjs b/crates/execution/assets/runners/wasm-runner.mjs
index 919e3ba3c7..404605c450 100644
--- a/crates/execution/assets/runners/wasm-runner.mjs
+++ b/crates/execution/assets/runners/wasm-runner.mjs
@@ -8647,7 +8647,26 @@ const hostProcessImport = {
           }
         },
         pty_open(retMasterFdPtr, retSlaveFdPtr) {
-          return WASI_ERRNO_FAULT;
+          let masterFd = null;
+          let slaveFd = null;
+          try {
+            if (!hasRunnerOpenFdCapacity(2)) return WASI_ERRNO_MFILE;
+            const result = callSyncRpc('process.pty_open');
+            masterFd = registerKernelDelegateFd(result?.masterFd);
+            slaveFd = registerKernelDelegateFd(result?.slaveFd);
+            if (masterFd == null || slaveFd == null) return WASI_ERRNO_FAULT;
+            if (writeGuestUint32(retMasterFdPtr, masterFd) !== WASI_ERRNO_SUCCESS
+              || writeGuestUint32(retSlaveFdPtr, slaveFd) !== WASI_ERRNO_SUCCESS) {
+              wasiImport.fd_close(masterFd);
+              wasiImport.fd_close(slaveFd);
+              return WASI_ERRNO_FAULT;
+            }
+            return WASI_ERRNO_SUCCESS;
+          } catch (error) {
+            if (masterFd != null) wasiImport.fd_close(masterFd);
+            if (slaveFd != null) wasiImport.fd_close(slaveFd);
+            return mapHostProcessError(error);
+          }
         },
         proc_sigaction(signal, action, maskLo, maskHi, flags) {
           if (permissionTier !== 'full') {
@@ -12372,6 +12391,16 @@ const hostTtyImport = {
     view.setUint16(rowsPtr >>> 0, size.rows & 0xffff, true);
     return 0;
   },
+  // Resize any kernel PTY descriptor and let the kernel deliver SIGWINCH to
+  // its foreground process group.
+  set_size(fd, cols, rows) {
+    try {
+      callSyncRpc('process.pty_resize', [fd >>> 0, cols >>> 0, rows >>> 0]);
+      return 0;
+    } catch (error) {
+      return mapHostProcessError(error);
+    }
+  },
   // Toggle terminal raw mode on the guest's PTY. crossterm/pty_probe/vim call this
   // instead of tcsetattr; route it to the kernel so the guest gets raw keystrokes.
   set_raw_mode(enabled) {
diff --git a/crates/execution/src/wasm.rs b/crates/execution/src/wasm.rs
index e295592c9b..daa9a282e2 100644
--- a/crates/execution/src/wasm.rs
+++ b/crates/execution/src/wasm.rs
@@ -3475,6 +3475,8 @@ if (typeof globalThis !== "undefined") {{
         case "process.waitpid_transition":
         case "process.itimer_real":
         case "process.fd_pipe":
+        case "process.pty_open":
+        case "process.pty_resize":
         case "process.fd_open":
         case "process.path_open_at":
         case "process.path_mkdir_at":
diff --git a/crates/native-sidecar/src/execution/javascript/rpc.rs b/crates/native-sidecar/src/execution/javascript/rpc.rs
index bbe575c27e..06d3459e15 100644
--- a/crates/native-sidecar/src/execution/javascript/rpc.rs
+++ b/crates/native-sidecar/src/execution/javascript/rpc.rs
@@ -56,6 +56,8 @@ const ALLOWED_WASM_PROCESS_SYNC_RPCS: &[&str] = &[
     "process.waitpid_transition",
     "process.itimer_real",
     "process.fd_pipe",
+    "process.pty_open",
+    "process.pty_resize",
     "process.fd_open",
     "process.path_open_at",
     "process.path_mkdir_at",
@@ -968,6 +970,31 @@ where
             .open_pipe(EXECUTION_DRIVER_NAME, process.kernel_pid)
             .map(|(read_fd, write_fd)| json!({ "readFd": read_fd, "writeFd": write_fd }))
             .map_err(kernel_error),
+        "process.pty_open" => kernel
+            .open_pty(EXECUTION_DRIVER_NAME, process.kernel_pid)
+            .map(|(master_fd, slave_fd, path)| {
+                json!({ "masterFd": master_fd, "slaveFd": slave_fd, "path": path })
+            })
+            .map_err(kernel_error),
+        "process.pty_resize" => {
+            let fd = javascript_sync_rpc_arg_u32(&request.args, 0, "PTY fd")?;
+            let cols = u16::try_from(javascript_sync_rpc_arg_u32(
+                &request.args,
+                1,
+                "PTY columns",
+            )?)
+            .map_err(|_| SidecarError::InvalidState(String::from("EINVAL: PTY columns exceed u16")))?;
+            let rows = u16::try_from(javascript_sync_rpc_arg_u32(
+                &request.args,
+                2,
+                "PTY rows",
+            )?)
+            .map_err(|_| SidecarError::InvalidState(String::from("EINVAL: PTY rows exceed u16")))?;
+            kernel
+                .pty_resize(EXECUTION_DRIVER_NAME, process.kernel_pid, fd, cols, rows)
+                .map(|_| Value::Null)
+                .map_err(kernel_error)
+        }
         "process.fd_open" => {
             let path = javascript_sync_rpc_arg_str(&request.args, 0, "fd_open path")?;
             let flags = javascript_sync_rpc_arg_u32(&request.args, 1, "fd_open flags")?;
diff --git a/examples/codex/client.ts b/examples/codex/client.ts
index 1a827c5541..9d3056d9ee 100644
--- a/examples/codex/client.ts
+++ b/examples/codex/client.ts
@@ -59,7 +59,9 @@ Write commit messages in the imperative mood and keep the subject under 50 chara
 async function withMcp() {
 	// Pre-install the MCP server so `npx` is silent — first-run install output
 	// would otherwise corrupt the MCP stdio handshake ("Connection closed").
-	await agent.process.exec("npm install -g @modelcontextprotocol/server-filesystem");
+	await agent.process.exec(
+		"npm install -g @modelcontextprotocol/server-filesystem",
+	);
 
 	const config = `[mcp_servers.filesystem]
 command = "npx"
@@ -79,6 +81,62 @@ http_headers = { Authorization = "Bearer my-token" }
 }
 // docs:end mcp
 
+// docs:start agent-plugins
+// ── Agent Plugins ─────────────────────────────────────────────────
+//
+// Install a portable Agent Plugin into Codex's cache before opening the
+// session. Other compatible clients use their own installation locations.
+async function withAgentPlugin() {
+	const pluginRoot =
+		"/home/agentos/.codex/plugins/cache/local/release-workflow/1.0.0";
+	await agent.filesystem.mkdir(`${pluginRoot}/.codex-plugin`);
+	await agent.filesystem.mkdir(`${pluginRoot}/skills/release-notes`);
+
+	await agent.filesystem.writeFile(
+		`${pluginRoot}/.codex-plugin/plugin.json`,
+		JSON.stringify({
+			$schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+			name: "release-workflow",
+			version: "1.0.0",
+			description: "Project release workflow",
+		}),
+	);
+	await agent.filesystem.writeFile(
+		`${pluginRoot}/skills/release-notes/SKILL.md`,
+		`---
+name: release-notes
+description: Write release notes for this project.
+---
+
+Summarize user-visible changes under Added, Changed, and Fixed.
+`,
+	);
+
+	await agent.filesystem.writeFile(
+		"/home/agentos/.codex/config.toml",
+		`[features]
+plugins = true
+
+[plugins."release-workflow@local"]
+enabled = true
+`,
+	);
+
+	await agent.sessions.open({
+		agent: "codex",
+		env: { OPENAI_API_KEY: process.env.OPENAI_API_KEY! },
+	});
+	await agent.sessions.prompt({
+		content: [
+			{
+				type: "text",
+				text: "Use $release-workflow:release-notes for the current changes.",
+			},
+		],
+	});
+}
+// docs:end agent-plugins
+
 // ── Skills + MCP together ─────────────────────────────────────────
 async function withSkillAndMcp() {
 	const skill = `---
@@ -97,7 +155,9 @@ Write commit messages in the imperative mood and keep the subject under 50 chara
 
 	// Pre-install the MCP server so `npx` is silent — first-run install output
 	// would otherwise corrupt the MCP stdio handshake ("Connection closed").
-	await agent.process.exec("npm install -g @modelcontextprotocol/server-filesystem");
+	await agent.process.exec(
+		"npm install -g @modelcontextprotocol/server-filesystem",
+	);
 
 	const config = `[mcp_servers.filesystem]
 command = "npx"
@@ -122,4 +182,4 @@ args = ["-y", "@modelcontextprotocol/server-filesystem", "/home/agentos"]
 	console.log(result.message?.content ?? []);
 }
 
-export { quickStart, withSkill, withMcp, withSkillAndMcp };
+export { quickStart, withAgentPlugin, withMcp, withSkill, withSkillAndMcp };
diff --git a/packages/core/tests/codex-fullturn.nightly.test.ts b/packages/core/tests/codex-fullturn.nightly.test.ts
index 7685387d11..185b3f8da3 100644
--- a/packages/core/tests/codex-fullturn.nightly.test.ts
+++ b/packages/core/tests/codex-fullturn.nightly.test.ts
@@ -10,7 +10,11 @@ import {
 } from "./helpers/openai-responses-mock.js";
 import { REGISTRY_SOFTWARE } from "./helpers/registry-commands.js";
 
-const codexConfig = `[features]
+const codexConfig = (
+	openAiBaseUrl: string,
+) => `openai_base_url = "${openAiBaseUrl}"
+
+[features]
 # Shell snapshots spawn a pre-turn shell subprocess. The real turn coverage
 # below does not need that optional context, and disabling it keeps the WASI VM
 # focused on the codex-core model/tool path under test.
@@ -34,6 +38,7 @@ async function runSessionTurn(
 	fixtures: ResponsesFixture[],
 	start: Record<string, unknown>,
 	stdinTail = "",
+	prepare?: (vm: AgentOs, openAiBaseUrl: string) => Promise<void>,
 ) {
 	const mock = await startResponsesMock(fixtures);
 	const vm = await AgentOs.create({
@@ -53,8 +58,9 @@ async function runSessionTurn(
 		await vm.execArgv("mkdir", ["-p", "/home/agentos/.codex"]);
 		await vm.writeFile(
 			"/home/agentos/.codex/config.toml",
-			new TextEncoder().encode(codexConfig),
+			new TextEncoder().encode(codexConfig(`${mock.url}/v1`)),
 		);
+		await prepare?.(vm, `${mock.url}/v1`);
 		const r = await vm.execArgv("codex-exec", ["--session-turn"], {
 			timeout: 45000,
 			stdin,
@@ -95,6 +101,62 @@ const finalText = (text: string): ResponsesFixture => ({
 describe.skipIf(!hasCodexExecArtifact)(
 	"codex full turn (real codex agent in the VM, mock OpenAI Responses)",
 	() => {
+		test("loads a portable Agent Plugin skill into the model context", async () => {
+			const pluginRoot =
+				"/home/agentos/.codex/plugins/cache/local/release-workflow/1.0.0";
+			const { stdout, stderr, exitCode, requests } = await runSessionTurn(
+				[finalText("used the release notes skill")],
+				{ prompt: "Use $release-workflow:release-notes for these changes." },
+				"",
+				async (vm, openAiBaseUrl) => {
+					await vm.execArgv("mkdir", ["-p", `${pluginRoot}/.codex-plugin`]);
+					await vm.execArgv("mkdir", [
+						"-p",
+						`${pluginRoot}/skills/release-notes`,
+					]);
+					await vm.writeFile(
+						`${pluginRoot}/.codex-plugin/plugin.json`,
+						new TextEncoder().encode(
+							JSON.stringify({
+								$schema:
+									"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+								name: "release-workflow",
+								version: "1.0.0",
+								description: "Project release workflow",
+							}),
+						),
+					);
+					await vm.writeFile(
+						`${pluginRoot}/skills/release-notes/SKILL.md`,
+						new TextEncoder().encode(`---
+name: release-notes
+description: Write release notes for this project.
+---
+
+Summarize user-visible changes under Added, Changed, and Fixed.
+`),
+					);
+					await vm.writeFile(
+						"/home/agentos/.codex/config.toml",
+						new TextEncoder().encode(`${codexConfig(openAiBaseUrl)}
+plugins = true
+
+[plugins."release-workflow@local"]
+enabled = true
+`),
+					);
+				},
+			);
+			expect(
+				requests.length,
+				`codex-exec did not call mock Responses; exitCode=${exitCode}; stderr=${stderr}; stdout=${stdout}`,
+			).toBeGreaterThan(0);
+			const requestBody = JSON.stringify(requests[0]);
+			expect(requestBody).toContain("release-workflow:release-notes");
+			expect(requestBody).toContain("Write release notes for this project.");
+			expect(stdout).toContain('"type":"done"');
+		}, 70000);
+
 		test("codex-exec --session-turn completes a model turn end-to-end", async () => {
 			const { stdout, stderr, exitCode, requests } = await runSessionTurn(
 				[finalText("hello from codex")],
diff --git a/toolchain/codex-ref b/toolchain/codex-ref
index c50b0698e8..d6bf40e604 100644
--- a/toolchain/codex-ref
+++ b/toolchain/codex-ref
@@ -1 +1 @@
-rivet-dev/codex@8f4655a9dbfc7db91768c78ccaea7357ba47127e
+rivet-dev/codex@aed385c00e5156596d57edb8e4a5f02ec6b8172f
diff --git a/toolchain/scripts/clone-and-build-codex-wasi.sh b/toolchain/scripts/clone-and-build-codex-wasi.sh
index dce357e58b..ea36e32cee 100755
--- a/toolchain/scripts/clone-and-build-codex-wasi.sh
+++ b/toolchain/scripts/clone-and-build-codex-wasi.sh
@@ -9,9 +9,10 @@
 #
 #   1. Read the pin from toolchain/codex-ref ("<owner>/<repo>@<sha>").
 #   2. Shallow-clone the fork at that exact SHA into a gitignored scratch dir.
-#   3. Rewrite the clone's [patch.crates-io] to point at the toolchain's reproducible
-#      stubs (toolchain/stubs/{reqwest-shim,portable-pty-wasi,ctrlc}); drop tokio's
-#      machine-path patch so tokio 1.52.3 comes through the vendored+patched tree.
+#   3. Rewrite the clone's existing local development overrides to the
+#      reproducible agentOS adapters, while keeping real AWS authentication and
+#      the Codex network-policy crate. Drop tokio's machine-path patch so the
+#      locked Tokio release comes through the vendored+patched tree.
 #   4. Strip the hardcoded `-L .../self-contained` from the clone's .cargo/config.toml
 #      (that absolute rustup path is machine-specific; it is recomputed and passed via
 #      RUSTFLAGS at build time instead).
@@ -116,24 +117,28 @@ grep -q 'Config::load_default_with_cli_overrides' \
 }
 printf '%s\n' "$EXPECTED_STAMP" > "$STAMP"
 
-# --- 3. rewrite [patch.crates-io] -> reproducible toolchain stubs ------------
-echo "== rewriting [patch.crates-io] -> toolchain/stubs/* =="
+# --- 3. rewrite local fork overrides to reproducible agentOS adapters --------
+echo "== rewriting local Codex overrides -> reproducible agentOS adapters =="
 python3 - "$WORKSPACE/Cargo.toml" "$STUBS" <<'PY'
 import re, sys
 cargo, stubs = sys.argv[1], sys.argv[2]
 lines = open(cargo).read().split('\n')
-# Crates whose patch we own: reqwest/portable-pty/ctrlc get repointed at the
-# reproducible toolchain stubs; tokio's patch is dropped so tokio 1.52.3 resolves
-# through the vendored+patched sources (std-patches/crates/tokio/0001).
+# Remove the fork developer's machine-local paths. reqwest is the trusted
+# sidecar HTTP boundary. portable-pty is a thin adapter over agentOS's real
+# POSIX PTY/process host imports. The stale ctrlc path override is removed;
+# this build does not depend on ctrlc. Tokio resolves through vendored+patched
+# sources.
 OWNED = ('portable-pty', 'reqwest', 'ctrlc', 'tokio')
 owned_re = re.compile(r'^\s*#?\s*(?:%s)\s*=' % '|'.join(map(re.escape, OWNED)))
 inject = [
-    '# [patch.crates-io] injected by clone-and-build-codex-wasi.sh (reproducible stubs)',
+    '# [patch.crates-io] injected by clone-and-build-codex-wasi.sh',
     'portable-pty = {{ path = "{}/portable-pty-wasi" }}'.format(stubs),
     'reqwest = {{ path = "{}/reqwest-shim" }}'.format(stubs),
-    'ctrlc = {{ path = "{}/ctrlc" }}'.format(stubs),
-    '# tokio: vendored+patched tokio 1.52.3 (std-patches/crates/tokio), not a path patch',
+    '# tokio: vendored and patched from the pinned lockfile, not a path patch',
 ]
+injected_comment_re = re.compile(
+    r'^# (?:\[patch\.crates-io\] injected by clone-and-build-codex-wasi\.sh|tokio: vendored)'
+)
 in_patch = False
 injected = False
 out = []
@@ -147,11 +152,22 @@ for ln in lines:
         continue
     if in_patch and owned_re.match(ln):  # drop any prior line for an owned crate
         continue
+    if in_patch and injected_comment_re.match(ln):
+        continue
     out.append(ln)
 if not injected:                         # no [patch.crates-io] in the fork: add one
     out += ['', '[patch.crates-io]'] + inject
 open(cargo, 'w').write('\n'.join(out))
 PY
+grep -Fq 'codex-network-proxy = { path = "network-proxy" }' "$WORKSPACE/Cargo.toml" || {
+	echo "ERROR: Codex must use its pinned network-proxy policy/config crate" >&2
+	exit 1
+}
+grep -Fq "proxy execution and network policy are owned by the trusted agentOS sidecar" \
+	"$WORKSPACE/network-proxy/src/proxy.rs" || {
+	echo "ERROR: Codex's agentOS proxy boundary must fail explicitly" >&2
+	exit 1
+}
 echo "   --- resulting [patch.crates-io] head ---"
 sed -n '/^\[patch.crates-io\]/,/^\[/p' "$WORKSPACE/Cargo.toml" | sed 's/^/   /'
 
@@ -202,19 +218,46 @@ echo "== applying toolchain/std-patches/crates/* to vendored sources =="
 VENDOR_DIR="$WORKSPACE/vendor" "$SCRIPT_DIR/patch-vendor.sh" || \
 	echo "   (patch-vendor reported failures; verifying codex-critical patches below)"
 
+# `cargo vendor --sync` can retain a second libc release for build-std. The
+# generic patcher selects the unversioned application copy, so apply the same
+# agentOS ABI declarations to every versioned libc source Cargo may compile.
+for libc_dir in "$WORKSPACE/vendor"/libc-*; do
+	[ -d "$libc_dir" ] || continue
+	libc_patch="$TOOLCHAIN_DIR/std-patches/crates/libc/0001-wasip1-socket-bindings.patch"
+	if patch --dry-run -p1 -d "$libc_dir" < "$libc_patch" >/dev/null 2>&1; then
+		patch -p1 -d "$libc_dir" < "$libc_patch" >/dev/null
+	elif ! patch --dry-run -R -p1 -d "$libc_dir" < "$libc_patch" >/dev/null 2>&1; then
+		echo "ERROR: agentOS libc socket bindings do not apply to $libc_dir" >&2
+		exit 1
+	fi
+	python3 - "$libc_dir/.cargo-checksum.json" <<'PY'
+import json, sys
+path = sys.argv[1]
+with open(path) as source:
+    checksum = json.load(source)
+checksum["files"] = {}
+with open(path, "w") as output:
+    json.dump(checksum, output)
+PY
+done
+
 echo "== verifying codex-critical crate patches applied =="
 assert_patched() {  # <file> <needle> <label>
-	if grep -q -- "$2" "$1" 2>/dev/null; then
+	if grep -Fq -- "$2" "$1" 2>/dev/null; then
 		echo "   OK: $3"
 	else
 		echo "ERROR: required patch missing: $3 ($1)" >&2
 		exit 1
 	fi
 }
-assert_patched "$WORKSPACE/vendor/path-dedot/src/lib.rs" \
-	'cfg(any(unix, target_family = "wasm"))' 'path-dedot wasi unix-paths'
+if [ -f "$WORKSPACE/vendor/path-dedot/src/lib.rs" ]; then
+	assert_patched "$WORKSPACE/vendor/path-dedot/src/lib.rs" \
+		'cfg(any(unix, target_family = "wasm"))' 'path-dedot wasi unix-paths'
+else
+	echo "   SKIP: path-dedot is not in the pinned Codex dependency graph"
+fi
 assert_patched "$WORKSPACE/vendor/rustls-native-certs/src/lib.rs" \
-	'target_os = "wasi"' 'rustls-native-certs wasi empty-certs'
+	'/etc/ssl/certs/ca-certificates.crt' 'rustls-native-certs loads the agentOS VM trust store'
 assert_patched "$WORKSPACE/vendor/tokio/src/process/mod.rs" \
 	'path = "wasi.rs"' 'tokio wasi-process routing'
 [ -f "$WORKSPACE/vendor/tokio/src/process/wasi.rs" ] || {
@@ -224,6 +267,26 @@ assert_patched "$WORKSPACE/vendor/tokio/src/fs/mod.rs" \
 	'cfg(not(target_os = "wasi"))' 'tokio wasi filesystem operations run inline'
 assert_patched "$WORKSPACE/vendor/tokio/src/runtime/blocking/pool.rs" \
 	'let result = func();' 'tokio wasi spawn_blocking runs inline'
+assert_patched "$WORKSPACE/vendor/gix-fs/src/capabilities.rs" \
+	'executable_bit: true' 'gix-fs probes real executable modes'
+assert_patched "$WORKSPACE/vendor/gix-fs/src/symlink.rs" \
+	'std::os::wasi::fs::symlink_path' 'gix-fs creates real symlinks'
+assert_patched "$WORKSPACE/vendor/mio/src/sys/wasip1/mod.rs" \
+	'libc::socket' 'mio uses agentOS POSIX sockets'
+assert_patched "$WORKSPACE/vendor/mio/src/net/mod.rs" \
+	'cfg(any(unix, target_os = "wasi"))' 'mio exposes agentOS Unix-domain sockets'
+assert_patched "$WORKSPACE/vendor/mio/src/sys/wasip1/mod.rs" \
+	'pub(crate) mod uds;' 'mio routes Unix-domain sockets to agentOS libc'
+assert_patched "$WORKSPACE/vendor/socket2/src/lib.rs" \
+	'pub const UNIX: Domain = Domain(sys::AF_UNIX);' 'socket2 exposes AF_UNIX on agentOS'
+assert_patched "$WORKSPACE/vendor/tokio/src/macros/cfg.rs" \
+	'($($item:item)*) => { $($item)* }' 'tokio exposes evented networking'
+assert_patched "$WORKSPACE/vendor/tokio/src/net/unix/mod.rs" \
+	'pub mod pipe;' 'tokio exposes agentOS Unix sockets and pipes'
+assert_patched "$WORKSPACE/vendor/tokio/src/runtime/io/registration.rs" \
+	'pub(crate) fn poll_read_io<R>' 'tokio exposes readiness-driven socket reads'
+assert_patched "$WORKSPACE/vendor/tokio/Cargo.toml" \
+	'cfg(any(not(target_family = "wasm"), target_os = "wasi"))' 'tokio links socket2 on agentOS'
 
 if [ "$STOP_AFTER" = "vendor" ]; then
 	echo ""
@@ -231,12 +294,13 @@ if [ "$STOP_AFTER" = "vendor" ]; then
 	SELF_CONTAINED="$(rustc "+$TOOLCHAIN" --print sysroot)/lib/rustlib/wasm32-wasip1/lib/self-contained"
 	export CC_wasm32_wasip1="$WASI_SDK_DIR/bin/clang"
 	export AR_wasm32_wasip1="$WASI_SDK_DIR/bin/llvm-ar"
-	export CFLAGS_wasm32_wasip1="--sysroot=$WASI_SDK_DIR/share/wasi-sysroot -D_WASI_EMULATED_SIGNAL -D_WASI_EMULATED_PTHREAD -D_WASI_EMULATED_MMAN -D_WASI_EMULATED_PROCESS_CLOCKS"
-	# Compile-check the crates whose wasi patches this script injects (path-dedot,
-	# rustls-native-certs, tokio) plus their reverse-deps, without the full link.
+	export CFLAGS_wasm32_wasip1="--sysroot=$TOOLCHAIN_DIR/c/sysroot -D_WASI_EMULATED_SIGNAL -D_WASI_EMULATED_PTHREAD -D_WASI_EMULATED_MMAN -D_WASI_EMULATED_PROCESS_CLOCKS"
+	# Compile-check the crates whose WASI patches this script injects plus their
+	# reverse-dependencies, without the full link. path-dedot is no longer in the
+	# pinned Codex dependency graph.
 	RUSTFLAGS="-C link-arg=-L$SELF_CONTAINED --cfg tokio_unstable" \
 		cargo "+$TOOLCHAIN" build --target wasm32-wasip1 -Z build-std \
-		-p path-dedot -p rustls-native-certs -p tokio
+		-p rustls-native-certs -p tokio -p tonic
 	echo "== vendor/patch frontier OK =="
 	exit 0
 fi
@@ -257,6 +321,7 @@ INSTALL=0 \
 TOOLCHAIN="$TOOLCHAIN" \
 KEEP_SYSROOT="${KEEP_SYSROOT:-0}" \
 WASI_SDK_DIR="$WASI_SDK_DIR" \
+AGENTOS_C_SYSROOT="$TOOLCHAIN_DIR/c/sysroot" \
 RUSTFLAGS="-C link-self-contained=no -C link-arg=$AGENTOS_WASI_LIBDIR/crt1-command.o -C link-arg=$AGENTOS_WASI_LIBDIR/libc.a -C link-arg=$AGENTOS_WASI_LIBDIR/libwasi-emulated-pthread.a -C link-arg=-L$AGENTOS_WASI_LIBDIR -C metadata=agentos-libc-$LIBC_DIGEST --cfg tokio_unstable" \
 	"$BUILD_SCRIPT"
 
diff --git a/toolchain/std-patches/0011-wasi-file-permissions-mode.patch b/toolchain/std-patches/0011-wasi-file-permissions-mode.patch
index f4fd55bce2..bf560fe240 100644
--- a/toolchain/std-patches/0011-wasi-file-permissions-mode.patch
+++ b/toolchain/std-patches/0011-wasi-file-permissions-mode.patch
@@ -1,6 +1,9 @@
+Expose the real POSIX mode APIs backed by agentOS's owned filesystem metadata
+and chmod/open-mode host imports.
+
 --- a/library/std/src/sys/fs/unix.rs
 +++ b/library/std/src/sys/fs/unix.rs
-@@ -778,7 +778,6 @@ impl FilePermissions {
+@@ -781,7 +781,6 @@
              self.mode |= 0o222;
          }
      }
@@ -8,3 +11,66 @@
      pub fn mode(&self) -> u32 {
          self.mode as u32
      }
+@@ -1281,7 +1280,6 @@
+     pub fn custom_flags(&mut self, flags: i32) {
+         self.custom_flags = flags;
+     }
+-    #[cfg(not(target_os = "wasi"))]
+     pub fn mode(&mut self, mode: u32) {
+         self.mode = mode as mode_t;
+     }
+--- a/library/std/src/os/wasi/fs.rs
++++ b/library/std/src/os/wasi/fs.rs
+@@ -15,7 +15,7 @@
+ use crate::path::Path;
+ #[cfg(target_env = "p1")]
+ use crate::sys::err2io;
+-use crate::sys::{AsInner, AsInnerMut};
++use crate::sys::{AsInner, AsInnerMut, FromInner};
+ 
+ /// WASI-specific extensions to [`File`].
+ pub trait FileExt {
+@@ -305,11 +305,18 @@
+ 
+ /// WASI-specific extensions to [`OpenOptions`].
+ pub trait OpenOptionsExt {
++    /// Sets the POSIX mode used when a new file is created.
++    fn mode(&mut self, mode: u32) -> &mut Self;
+     /// Pass custom flags to the `flags` argument of `open`.
+     fn custom_flags(&mut self, flags: i32) -> &mut Self;
+ }
+ 
+ impl OpenOptionsExt for OpenOptions {
++    fn mode(&mut self, mode: u32) -> &mut OpenOptions {
++        self.as_inner_mut().mode(mode);
++        self
++    }
++
+     fn custom_flags(&mut self, flags: i32) -> &mut OpenOptions {
+         self.as_inner_mut().custom_flags(flags);
+         self
+@@ -320,12 +327,24 @@
+ pub trait PermissionsExt {
+     /// Returns the underlying POSIX mode bits.
+     fn mode(&self) -> u32;
++    /// Replaces the underlying POSIX mode bits.
++    fn set_mode(&mut self, mode: u32);
++    /// Creates permissions from POSIX mode bits.
++    fn from_mode(mode: u32) -> Self;
+ }
+ 
+ impl PermissionsExt for fs::Permissions {
+     fn mode(&self) -> u32 {
+         self.as_inner().mode()
+     }
++
++    fn set_mode(&mut self, mode: u32) {
++        *self = fs::Permissions::from_inner(crate::sys::FromInner::from_inner(mode));
++    }
++
++    fn from_mode(mode: u32) -> fs::Permissions {
++        fs::Permissions::from_inner(crate::sys::FromInner::from_inner(mode))
++    }
+ }
+ 
+ /// WASI-specific extensions to [`fs::Metadata`].
diff --git a/toolchain/std-patches/0015a-wasi-posix-sockets.patch b/toolchain/std-patches/0015a-wasi-posix-sockets.patch
new file mode 100644
index 0000000000..8e7da7a12d
--- /dev/null
+++ b/toolchain/std-patches/0015a-wasi-posix-sockets.patch
@@ -0,0 +1,120 @@
+Route wasm32-wasip1 through Rust std's libc-backed socket implementation.
+agentOS supplies the POSIX socket, DNS, option, and poll functions through its
+owned libc and host_net imports, so the stock WASIp1 Unsupported implementation
+is the wrong backend for this sysroot.
+
+--- a/library/std/src/os/mod.rs
++++ b/library/std/src/os/mod.rs
+@@ -85,6 +85,16 @@ pub mod darwin;
+ pub mod unix;
+ 
++// agentOS exposes the supported Unix API names over its WASI/POSIX surface.
++#[cfg(target_os = "wasi")]
++#[stable(feature = "rust1", since = "1.0.0")]
++pub mod unix {
++    #[stable(feature = "rust1", since = "1.0.0")]
++    pub use crate::os::wasi::{ffi, fs, io, net};
++}
++
+ // linux
+ #[cfg(not(all(
+     doc,
+--- a/library/std/src/os/wasi/net/mod.rs
++++ b/library/std/src/os/wasi/net/mod.rs
+@@ -1,6 +1,24 @@
+ //! WASI-specific networking functionality
+ 
+ #![unstable(feature = "wasi_ext", issue = "71213")]
+ 
++#[path = "../../unix/net/addr.rs"]
++mod addr;
++#[path = "../../unix/net/datagram.rs"]
++mod datagram;
++#[path = "../../unix/net/listener.rs"]
++mod listener;
++#[path = "../../unix/net/stream.rs"]
++mod stream;
++
++#[stable(feature = "unix_socket", since = "1.10.0")]
++pub use self::addr::*;
++#[stable(feature = "unix_socket", since = "1.10.0")]
++pub use self::datagram::*;
++#[stable(feature = "unix_socket", since = "1.10.0")]
++pub use self::listener::*;
++#[stable(feature = "unix_socket", since = "1.10.0")]
++pub use self::stream::*;
++
+ use crate::os::fd::AsRawFd;
+ use crate::sys::err2io;
+ use crate::{io, net};
+--- a/library/std/src/os/unix/net/addr.rs
++++ b/library/std/src/os/unix/net/addr.rs
+@@ -9,7 +9,7 @@ use crate::sealed::Sealed;
+ use crate::sys::cvt;
+ use crate::{fmt, io, mem, ptr};
+ 
+-#[cfg(not(unix))]
++#[cfg(not(any(unix, target_os = "wasi")))]
+ #[allow(non_camel_case_types)]
+ mod libc {
+--- a/library/std/src/sys/net/connection/mod.rs
++++ b/library/std/src/sys/net/connection/mod.rs
+@@ -3,8 +3,8 @@ cfg_select! {
+     any(
+         all(target_family = "unix", not(target_os = "l4re")),
+         target_os = "windows",
+         target_os = "hermit",
+-        all(target_os = "wasi", any(target_env = "p2", target_env = "p3")),
++        target_os = "wasi",
+         target_os = "solid_asp3",
+     ) => {
+         mod socket;
+@@ -13,10 +13,6 @@ cfg_select! {
+         mod sgx;
+         pub use sgx::*;
+     }
+-    all(target_os = "wasi", target_env = "p1") => {
+-        mod wasip1;
+-        pub use wasip1::*;
+-    }
+     target_os = "motor" => {
+         mod motor;
+         pub use motor::*;
+--- a/library/std/src/sys/net/connection/socket/unix.rs
++++ b/library/std/src/sys/net/connection/socket/unix.rs
+@@ -7,7 +7,10 @@
+ use crate::os::fd::{AsFd, AsRawFd, BorrowedFd, FromRawFd, IntoRawFd, RawFd};
+ use crate::sys::fd::FileDesc;
+ use crate::sys::net::{getsockopt, setsockopt};
+-use crate::sys::pal::IsMinusOne;
++#[cfg(not(target_os = "wasi"))]
++use crate::sys::pal::IsMinusOne;
++#[cfg(target_os = "wasi")]
++use crate::sys::os::IsMinusOne;
+ use crate::sys::{AsInner, FromInner, IntoInner};
+ use crate::time::{Duration, Instant};
+ use crate::{cmp, mem};
+@@ -111,7 +114,6 @@ impl Socket {
+         }
+     }
+ 
+-    #[cfg(not(any(target_os = "vxworks", target_os = "wasi")))]
+     pub fn new_pair(fam: c_int, ty: c_int) -> io::Result<(Socket, Socket)> {
+         unsafe {
+             let mut fds = [0, 0];
+@@ -275,7 +275,6 @@ impl Socket {
+         }
+     }
+ 
+-    #[cfg(not(target_os = "wasi"))]
+     pub fn send_with_flags(&self, buf: &[u8], flags: c_int) -> io::Result<usize> {
+         let len = cmp::min(buf.len(), <wrlen_t>::MAX as usize) as wrlen_t;
+         let ret = cvt(unsafe {
+@@ -363,7 +362,6 @@ impl Socket {
+         self.0.read_vectored(bufs)
+     }
+ 
+-    #[cfg(not(target_os = "wasi"))]
+     pub fn write(&self, buf: &[u8]) -> io::Result<usize> {
+         self.0.write(buf)
+     }
diff --git a/toolchain/std-patches/0016-wasi-file-locking.patch b/toolchain/std-patches/0016-wasi-file-locking.patch
new file mode 100644
index 0000000000..ab0811c10c
--- /dev/null
+++ b/toolchain/std-patches/0016-wasi-file-locking.patch
@@ -0,0 +1,149 @@
+--- a/library/std/src/sys/fs/unix.rs
++++ b/library/std/src/sys/fs/unix.rs
+@@ -99,6 +99,34 @@ mod host_fs {
+     }
+ }
+ 
++#[cfg(target_os = "wasi")]
++mod host_process {
++    #[link(wasm_import_module = "host_process")]
++    unsafe extern "C" {
++        pub fn fd_flock(fd: u32, operation: u32) -> u32;
++    }
++}
++
++#[cfg(target_os = "wasi")]
++fn agentos_flock(fd: c_int, operation: u32) -> io::Result<()> {
++    // SAFETY: fd_flock accepts a guest fd plus the standard LOCK_* bitmask.
++    let errno = unsafe { host_process::fd_flock(fd as u32, operation) };
++    if errno == 0 {
++        Ok(())
++    } else {
++        Err(io::Error::from_raw_os_error(errno as i32))
++    }
++}
++
++#[cfg(target_os = "wasi")]
++const LOCK_SH: u32 = 1;
++#[cfg(target_os = "wasi")]
++const LOCK_EX: u32 = 2;
++#[cfg(target_os = "wasi")]
++const LOCK_NB: u32 = 4;
++#[cfg(target_os = "wasi")]
++const LOCK_UN: u32 = 8;
++
+ #[cfg(target_os = "wasi")]
+ const AGENTOS_HIDDEN_PREOPEN_FD: u32 = 0x40000003;
+ #[cfg(target_os = "wasi")]
+@@ -1480,6 +1502,11 @@ impl File {
+         return Ok(());
+     }
+ 
++    #[cfg(target_os = "wasi")]
++    pub fn lock(&self) -> io::Result<()> {
++        agentos_flock(self.as_raw_fd(), LOCK_EX)
++    }
++
+     #[cfg(target_os = "solaris")]
+     pub fn lock(&self) -> io::Result<()> {
+         let mut flock: libc::flock = unsafe { mem::zeroed() };
+@@ -1500,6 +1527,7 @@ impl File {
+         target_os = "illumos",
+         target_os = "aix",
+         target_vendor = "apple",
++        target_os = "wasi",
+     )))]
+     pub fn lock(&self) -> io::Result<()> {
+         Err(io::const_error!(io::ErrorKind::Unsupported, "lock() not supported"))
+@@ -1522,6 +1550,11 @@ impl File {
+         return Ok(());
+     }
+ 
++    #[cfg(target_os = "wasi")]
++    pub fn lock_shared(&self) -> io::Result<()> {
++        agentos_flock(self.as_raw_fd(), LOCK_SH)
++    }
++
+     #[cfg(target_os = "solaris")]
+     pub fn lock_shared(&self) -> io::Result<()> {
+         let mut flock: libc::flock = unsafe { mem::zeroed() };
+@@ -1542,6 +1575,7 @@ impl File {
+         target_os = "illumos",
+         target_os = "aix",
+         target_vendor = "apple",
++        target_os = "wasi",
+     )))]
+     pub fn lock_shared(&self) -> io::Result<()> {
+         Err(io::const_error!(io::ErrorKind::Unsupported, "lock_shared() not supported"))
+@@ -1567,6 +1601,17 @@ impl File {
+         }
+     }
+ 
++    #[cfg(target_os = "wasi")]
++    pub fn try_lock(&self) -> Result<(), TryLockError> {
++        match agentos_flock(self.as_raw_fd(), LOCK_EX | LOCK_NB) {
++            Ok(()) => Ok(()),
++            Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
++                Err(TryLockError::WouldBlock)
++            }
++            Err(error) => Err(TryLockError::Error(error)),
++        }
++    }
++
+     #[cfg(target_os = "solaris")]
+     pub fn try_lock(&self) -> Result<(), TryLockError> {
+         let mut flock: libc::flock = unsafe { mem::zeroed() };
+@@ -1597,6 +1645,7 @@ impl File {
+         target_os = "illumos",
+         target_os = "aix",
+         target_vendor = "apple",
++        target_os = "wasi",
+     )))]
+     pub fn try_lock(&self) -> Result<(), TryLockError> {
+         Err(TryLockError::Error(io::const_error!(
+@@ -1628,6 +1677,17 @@ impl File {
+         }
+     }
+ 
++    #[cfg(target_os = "wasi")]
++    pub fn try_lock_shared(&self) -> Result<(), TryLockError> {
++        match agentos_flock(self.as_raw_fd(), LOCK_SH | LOCK_NB) {
++            Ok(()) => Ok(()),
++            Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
++                Err(TryLockError::WouldBlock)
++            }
++            Err(error) => Err(TryLockError::Error(error)),
++        }
++    }
++
+     #[cfg(target_os = "solaris")]
+     pub fn try_lock_shared(&self) -> Result<(), TryLockError> {
+         let mut flock: libc::flock = unsafe { mem::zeroed() };
+@@ -1658,6 +1721,7 @@ impl File {
+         target_os = "illumos",
+         target_os = "aix",
+         target_vendor = "apple",
++        target_os = "wasi",
+     )))]
+     pub fn try_lock_shared(&self) -> Result<(), TryLockError> {
+         Err(TryLockError::Error(io::const_error!(
+@@ -1683,6 +1747,11 @@ impl File {
+         return Ok(());
+     }
+ 
++    #[cfg(target_os = "wasi")]
++    pub fn unlock(&self) -> io::Result<()> {
++        agentos_flock(self.as_raw_fd(), LOCK_UN)
++    }
++
+     #[cfg(target_os = "solaris")]
+     pub fn unlock(&self) -> io::Result<()> {
+         let mut flock: libc::flock = unsafe { mem::zeroed() };
+@@ -1703,6 +1772,7 @@ impl File {
+         target_os = "illumos",
+         target_os = "aix",
+         target_vendor = "apple",
++        target_os = "wasi",
+     )))]
+     pub fn unlock(&self) -> io::Result<()> {
+         Err(io::const_error!(io::ErrorKind::Unsupported, "unlock() not supported"))
diff --git a/toolchain/std-patches/codex-source/README.md b/toolchain/std-patches/codex-source/README.md
index d6e568d7ab..bdb9d73586 100644
--- a/toolchain/std-patches/codex-source/README.md
+++ b/toolchain/std-patches/codex-source/README.md
@@ -1,271 +1,37 @@
-# Required codex SOURCE patches for wasm32-wasip1
-
-These are minimal, upstreamable additions to codex's own source where it has a
-hard `compile_error!`/missing-platform arm that NO toolchain patch can bypass
-(first-party compile-time gates). Each adds REAL wasi support (wasi has the API),
-not a hack. Applied to the vendored codex source during the agentos build.
-
-1. utils/git/src/platform.rs — add `#[cfg(target_os = "wasi")] create_symlink`
-   using `std::os::wasi::fs::symlink_path`, and widen the fallback
-   `compile_error!` cfg to `not(any(unix, windows, target_os = "wasi"))`.
-   wasi supports symlinks via the VM's `path_symlink` host call.
-
-2. rmcp-client/src/program_resolver.rs:26 — widen `#[cfg(unix)]` on `resolve()` to
-   `any(unix, target_os = "wasi")` (the unix impl returns the program unchanged,
-   correct for wasi).
-3. rmcp-client/src/utils.rs:91 — widen `#[cfg(unix)]` on `DEFAULT_ENV_VARS` to
-   `any(unix, target_os = "wasi")`.
-
-4. core/Cargo.toml — add `[target.'cfg(target_os = "wasi")'.dependencies] codex-utils-pty`
-   (it compiles via the portable-pty wasi backend). codex-network-proxy stays excluded
-   (real crate pulls the rama proxy-server stack + tokio "full"); satisfied by stub.
-
-## codex-core OWN-code remaining (69 errors, characterized — this session got dep graph to 0)
-The codex authors gated codex-network-proxy + codex-utils-pty OFF wasi as DEPS but did
-NOT gate the SOURCE usage — an incomplete author wasi port. Breakdown:
-- ~50: codex-core uses codex-network-proxy's FULL API (NetworkProxyConfig, NetworkDecision,
-  NetworkPolicyDecider/BlockedRequestObserver traits, NetworkProxyHandle, ConfigReloader,
-  build_config_state, host_and_port_from_network_addr, normalize_host,
-  validate_policy_against_constraints, NetworkProxyConstraints/Error, NetworkProtocol,
-  NetworkProxyState, NetworkProxyAuditMetadata, NetworkPolicyRequest, …). The real crate
-  can't compile on wasi (rama proxy stack); EXPAND the agentos codex-network-proxy
-  stub to this full API (no-op/inert — the VM kernel brokers network policy host-side).
-- ~6: codex_otel SessionTelemetry methods the stub lacks → expand codex-otel stub.
-- tokio::signal (no signals on wasi) → gate/stub codex-core's signal usage.
-- ~4 platform fns (ensure_owner_only_permissions, synthetic_exit_status,
-  system_config_toml_file, system_requirements_toml_file) → add wasi arms.
-- ~5 type mismatches (E0308) → case-by-case.
-Then codex-exec compiles → un-stub --session-turn (real codex-core + EE protocol) → matrix.
-
-## network-proxy / otel: MUST be in-place wasi-gating of the REAL codex crates
-Attempted an external stub crate (stubs/codex-network-proxy-wasi) — does NOT work:
-codex workspace crates (codex-utils-absolute-path, etc.) use `workspace = true`, which
-can't resolve from a path crate OUTSIDE codex's workspace. So the network-proxy/otel
-stubbing must be done IN-PLACE in codex-rs/{network-proxy,otel} (workspace members):
-- network-proxy/Cargo.toml: move `rama-*` + `tokio "full"` + rustls-provider to
-  `[target.'cfg(not(target_os="wasi"))'.dependencies]`; reduce wasi tokio features.
-- network-proxy/src: gate the 6 rama files (certs,http_proxy,mitm,responses,socks5,
-  upstream) to `#[cfg(not(wasi))]` and add `#[cfg(wasi)]` stub versions. The 6 stub
-  bodies are already written in stubs/codex-network-proxy-wasi/src/{http_proxy,socks5,
-  mitm,certs,responses,upstream}.rs (run_http_proxy/run_socks5 → Ok(()); MitmState → unit).
-  Only 5 symbols are referenced by pure code: http_proxy::run_http_proxy{,_with_std_listener},
-  socks5::run_socks5{,_with_std_listener}, mitm::MitmState. lib.rs mod decls stay (pure
-  modules config/network_policy/policy/proxy/reasons/runtime/state compile as-is).
-- core/Cargo.toml: add codex-network-proxy to `[target.'cfg(target_os="wasi")'.dependencies]`.
-- otel: same pattern — gate opentelemetry-otlp (grpc/tonic/reqwest exporter) off wasi,
-  stub the exporter init; keep the SessionTelemetry API (codex-core uses ~6 methods).
-This is completing the codex authors' OWN incomplete wasi port (they gated the DEPS off
-wasi but not the source). It is codex SOURCE modification, unavoidable (workspace constraint).
-
-## DONE this iteration: network-proxy in-place wasi-gating WORKS (codex-core 69→49)
-Applied to REAL codex-rs/network-proxy (workspace member, so workspace=true resolves):
-- network-proxy/Cargo.toml: rama-* + rustls-provider + tokio "full" → moved to
-  [target.'cfg(not(target_os="wasi"))'.dependencies]; base tokio reduced to
-  ["macros","rt","sync","time","io-util"].
-- network-proxy/src/lib.rs: the 6 rama modules (certs/http_proxy/mitm/responses/
-  socks5/upstream) cfg-selected: #[cfg(not(wasi))] real vs #[cfg(wasi)] #[path="*_wasi.rs"].
-- network-proxy/src/{certs,http_proxy,mitm,responses,socks5,upstream}_wasi.rs: stub bodies
-  (run_http_proxy/run_socks5 → Ok(()); MitmState → unit). VERIFIED: codex_network_proxy
-  refs now resolve (0 unresolved). Restored workspace redirect to path="network-proxy"
-  + re-added as member + codex-core wasi dep.
-
-## NEXT: otel in-place gating (same pattern; ~6 SessionTelemetry method errors remain)
-otel's opentelemetry-otlp exporter is spread across provider.rs(63)/client.rs(40)/
-otlp.rs(11)/config.rs(24). Gate those off wasi (cfg-select stub modules), keep
-events/session_telemetry.rs (the SessionTelemetry API codex-core calls:
-record_api_request, record_websocket_request, record_auth_recovery, log_sse_event,
-tool_decision, tool_result_with_tags, on_request — these use codex-protocol types, so
-MUST stay in-crate, not an external stub). Then: tokio::signal gate, ~4 platform fns
-(synthetic_exit_status, system_*_toml_file, ensure_owner_only_permissions), ~5 E0308.
-Then codex-exec → session-turn engine → matrix.
-
-## ✅ MILESTONE: codex-core AND codex-exec COMPILE for wasm32-wasip1
-All in-crate wasi-gating done (committed to the rivet codex fork, branch
-wasi-port-codex-core, commit 0c3f4eb73, 25 files): network-proxy + otel in-place
-gating, core platform fns (tokio::signal/synthetic_exit_status/toml/permissions),
-git symlink, rmcp-client resolver. Plus std ExitStatusExt patch (std-patches/
-0008-wasi-exit-status-ext.md). `cargo build -p codex-core -p codex-exec
---target wasm32-wasip1 -Z build-std` → Finished, EXIT 0.
-
-REMAINING to e2e: (1) the agentos command crate crates/commands/codex-exec
-un-stub --session-turn to delegate to the real codex-core/codex-exec engine and emit
-the EE newline-JSON protocol (start/text_delta/tool_call_update/permission_request/
-done) — the real functional integration; (2) build via `make -C toolchain wasm`
-(vendoring the codex fork + these patches); (3) wire the EE codex descriptor into the
-agent-os matrix + un-skip the codex session test.
-
-## FINAL PIECE: session-turn engine (replace codex-exec wasi_stub_main)
-codex-exec/src/lib.rs `wasi_stub_main()` is a placeholder ("WASI runtime support is
-under development"). codex-core compiles now, so replace it with the real engine
-(mirror lib_native.rs::run_exec_session, ~200-300 lines, in codex's workspace so it has
-codex-core access). The built codex-exec.wasm IS the agentos `codex-exec` command.
-
-PROTOCOL (newline-JSON, the EE adapter @rivet-ee/agent-os-codex-agent drives it):
-- stdin: first line {type:"start", cwd, mode, model, thought_level,
-  developer_instructions, history, prompt}; then {type:"permission_response", id, decision}.
-- stdout events to EMIT (one JSON/line):
-  - {type:"start"} on boot
-  - {type:"text_delta", delta}          ← EventMsg::AgentMessageDelta
-  - {type:"tool_call_update", tool_call_id, status, content}
-                                         ← EventMsg::ExecCommandBegin / ExecCommandEnd
-  - {type:"permission_request", tool_call_id, command}
-                                         ← EventMsg::ExecApprovalRequest /
-                                            ApplyPatchApprovalRequest; then read
-                                            permission_response from stdin → submit Op approval
-  - {type:"done"}                        ← EventMsg::TurnComplete
-  - {type:"error", message}             ← EventMsg::Error
-
-ENGINE (codex-core API, verified):
-1. parse start JSON → build codex_core Config (cwd/model/instructions; sandbox+network
-   proxy already gated off on wasi; approval policy = OnRequest so approvals surface).
-2. ConversationManager::new_conversation(config) → Codex (or new_conversation_with_auth).
-3. tokio current_thread runtime (rt feature works on wasi). seed history, then
-   submit(Op::UserInput{ items:[InputItem::Text{prompt}] }).
-4. loop next_event() → match EventMsg → emit per table above; on approval requests,
-   block reading stdin for permission_response → submit(Op::ExecApproval/PatchApproval).
-5. TurnComplete → emit done, exit 0.
-Then: `make -C toolchain wasm` (vendor the codex fork wasi-port-codex-core branch +
-all patches) → copies codex/codex-exec into software/codex/wasm → wire EE descriptor into
-the agent-os matrix (software/codex already exists) → un-skip the codex session test.
-
-### session-turn engine — Config is loadable (tractable)
-core/src/config/mod.rs has `Config::load_with_cli_overrides(cli_overrides, harness)`
-(811) — build Config from {model, cwd, approval_policy=OnRequest, ...} overrides rather
-than manual field construction. Op/InputItem: protocol.rs Op::UserInput{ items:
-Vec<UserInput> } (235). The Codex client (core/src/codex.rs submit/next_event) is created
-via the conversation/thread entry (codex_thread.rs / conversation flow) — confirm the
-exact constructor (ConversationManager or Codex::spawn) when implementing. Engine ≈
-200-300 lines in codex-exec wasi_stub_main; tokio current_thread runtime (works on wasi).
-
-## ✅ DONE: session-turn engine compiles (the final FUNCTIONAL piece)
-codex-exec/src/session_turn_wasi.rs (fork commit b86a5dfc0) drives the REAL codex-core
-agent and emits the EE protocol. `cargo build -p codex-exec --target wasm32-wasip1
--Z build-std` → EXIT 0. So codex-core + codex-exec + the session-turn engine ALL compile.
-
-## Remaining = build pipeline + ACP wiring + test run (integration, not functional)
-1. Produce optimized wasm artifacts from the fork (branch wasi-port-codex-core):
-   `cargo build -p codex-exec -p codex --release --target wasm32-wasip1 -Z build-std`
-   (+ wasm-opt) → copy to software/codex/wasm/{codex-exec,codex}. NOTE: the
-   agentos `make wasm` currently builds the STUB crates/commands/{codex,codex-exec};
-   to ship the real engine, either build from the fork directly (above) or vendor the
-   fork into toolchain and point cmd-codex-exec at the real codex-exec.
-2. ACP adapter: the codex ACP bridge (spawns `codex-exec --session-turn`, newline-JSON↔ACP)
-   lives in EE (@rivet-ee/agent-os-codex-agent, agent-os-ee/packages/codex/src/adapter.ts).
-   The open-source software/codex only re-exports the wasm software package. To test
-   codex e2e in the agent-os matrix, either bring that adapter into agent-os or run the
-   EE codex-session.test.ts (describe.skipIf gated on wasm presence — un-skips once the
-   wasm artifacts above exist).
-3. e2e: with codex-exec.wasm present, the EE adapter spawns it in the VM (wasi-spawn/http
-   host bridges), the engine talks to the (mock) model via wasi-http, streams text_delta/
-   tool_call_update, emits done. Run codex-session.test.ts to verify.
-
-## ✅ ARTIFACT BUILT + SPAWNS IN VM; last blocker = 1 host import
-Built the real codex-exec from the fork (release, wasm-opt'd to 28MB) and placed it in
-software/codex/wasm/{codex-exec,codex}. Smoke test (vm.exec("... | codex-exec
---session-turn")) shows it SPAWNS and attempts WebAssembly instantiation in the VM —
-44 imports, of which 43 (wasi_snapshot_preview1×30, host_net×6, host_process×5,
-host_fs×2) are provided by the agentos runtime. The ONLY unprovided one was
-`env.sqlite3_load_extension` (sqlx's sqlite). Fixed by defining a #[no_mangle] no-op
-stub in the engine (fork commit). Rebuild + re-place → instantiation should succeed.
-Then the smoke test ({"type":"start"} before the model call) and the full EE
-codex-session.test.ts (with the responses mock) verify the e2e turn.
-
-## ✅✅ VERIFIED: codex-exec RUNS IN THE VM and emits the EE protocol
-Smoke test (packages/core/tests/codex-smoke.test.ts) PASSES:
-  vm.exec("printf '<start json>' | codex-exec --session-turn")  →  stdout: {"type":"start"}
-The real codex agent (codex-rs → wasip1, session-turn engine driving codex-core) BOOTS
-in the agentos VM, instantiates all 44 imports (after adding host
-path_filestat_set_times), runs the engine, and emits the EE protocol's start event.
-(exit 1 only because the smoke test provides no model mock/auth, so the turn errors
-AFTER start — proving the boot + protocol path works.)
-
-FULL turn (text_delta→done): run the EE codex-session.test.ts with startResponsesMock
-(OpenAI Responses mock) + OPENAI_API_KEY/base_url pointed at it. That exercises a
-complete agent turn. The boot+protocol path is now VERIFIED end-to-end in the VM.
-
-## ✅✅✅ codex runs the FULL session event loop in the VM
-DBG markers (engine) confirm the real codex agent runs the entire lifecycle in the VM:
-load config → AuthManager::shared → ThreadManager::new → start_thread → submit
-Op::UserInput → LIVE next_event loop (received a Warning event, processing). 8 runtime
-blockers fixed and committed (host imports, agentos host wasi shim
-path_filestat_set_times, tokio fs-asyncify + spawn_blocking inline on wasi, std
-split_paths, now_local→UTC). FINAL GAP: the model HTTP POST to the OpenAI Responses
-mock does not reach it (mock requests=0, then hang). codex honors OPENAI_BASE_URL
-(deprecated warning), so base_url=mock; the codex-exec wasi-http/host_net connect to the
-HOST loopback mock blocks. Resolve: confirm host_net egress to the test's 127.0.0.1:PORT
-is permitted for wasi commands (loopbackExemptPorts is for the kernel adapter; host_net
-may need its own allow), and that the Responses path matches (/v1/responses). Then the
-turn streams text_delta→done. The agent itself runs e2e in the VM today.
-
-## CORRECTED final diagnosis (via sidecar instrumentation): NOT a network issue
-Added file-logging to the sidecar net.connect handler ENTRY + require_network_access +
-resolve_tcp_connect_addr, ran the full-turn test. RESULT: the log stays EMPTY — codex's
-connect NEVER reaches the sidecar. So codex is NOT making the model HTTP call; it HANGS
-in its OWN agent loop after the first event (a config Warning), before any network call.
-Root cause: codex's agent loop uses tokio concurrency that assumes OS threads
-(spawn_blocking on a dedicated blocking pool, background tasks). wasm32-wasip1 is
-single-threaded (no OS threads); the spawn_blocking-as-current-thread-task workaround
-(0003) can DEADLOCK — a blocking task occupies the only thread while waiting on another
-task that can't run. This is an architectural mismatch (codex's threading model vs
-single-thread wasi), the genuinely hard core of running codex on wasi. Resolving it needs
-codex-internal tracing to find the exact blocking construct and make it cooperative, or a
-different runtime strategy. (Sidecar instrumentation reverted; agentos is clean.)
-STATUS: codex compiles + runs the full session lifecycle in the VM (boot → EE protocol →
-config → auth → ThreadManager → start_thread → submit → live event loop) but hangs in the
-agent loop before the model call on the single-threaded runtime.
-
-## ✅✅✅ RESOLVED: codex completes a full model turn end-to-end on wasm32-wasip1
-
-The "agent loop hangs" diagnosis above was *close but mislabeled* — it is NOT a tokio
-concurrency/threading-model mismatch. The current-thread runtime drives codex's spawned
-submission_loop correctly. The real root cause, found by instrumenting tokio's
-current-thread scheduler (Handle::spawn / schedule / the block_on for-loop / per-task
-spawn-location), was a **single blocking task that pins the only executor thread**:
-
-- `codex-core` spawns a shell-snapshot task (`core/src/shell_snapshot.rs`) during session
-  init that launches a **shell subprocess** to capture the environment and blocks on its
-  exit. On wasm32-wasip1 the VM's child-process bridge cannot deliver that wait on the
-  single-threaded runtime (the "could not retrieve pid for child process" warnings), so the
-  task blocks the executor thread **forever**. The scheduler then never drains the rest of
-  the local run queue — including the submission_loop — so the agent turn never advances and
-  no model HTTP call is ever made. (Hence the sidecar net.connect handler stayed empty.)
-
-Fixes (all in the codex fork, branch `wasi-port-codex-core`, all `#[cfg(target_os="wasi")]`):
-1. `core/src/shell_snapshot.rs` — skip the snapshot on wasi (send `None`, return). A shell
-   environment snapshot is meaningless in the VM and the subprocess wait deadlocks the runtime.
-2. `core/src/state_db.rs` — `init` / `get_state_db` / `open_if_present` return `None` on wasi.
-   sqlx-sqlite's blocking worker can't run on the thread-less runtime (open fails ENOTSUP,
-   os error 58); skipping it also avoids perturbing session init.
-3. `exec/src/session_turn_wasi.rs` — runtime is `new_current_thread().enable_time()` (no I/O
-   reactor needed; network I/O is host-brokered/synchronous) and a plain
-   `block_on(session_turn())`. The earlier yield-pump / `global_queue_interval(1)`
-   experiments were chasing the wrong theory and are NOT needed once the blocking task is gone.
-
-Test (`packages/core/tests/codex-fullturn.test.ts`): codex-exec --session-turn runs the real
-codex-core agent in the VM, calls the mock OpenAI Responses API over wasi-http, streams the
-SSE response, and emits `{"type":"start"}` … `{"type":"done"}` on a clean protocol channel
-(stdout carries ONLY the EE protocol JSON). The mock (`tests/helpers/openai-responses-mock.ts`)
-emits a faithful Responses SSE stream (`response.created` → `response.output_text.delta` →
-`response.output_item.done` → `response.completed`); `OPENAI_BASE_URL` includes `/v1` to match
-codex's URL convention (`{base}/responses`).
-
-Build (reproducible): the wasi build uses `-Z build-std` with a patched rust-src sysroot.
-Because `-Z build-std` injects `panic_unwind` via `--extern` while the wasm target needs
-`panic_abort` resolved from the sysroot, the build:
-  - stashes the prebuilt `wasm32-wasip1` `*.rlib`/`*.rmeta` out of the toolchain lib dir
-    (keeping `self-contained/` crt) so build-std's own `libcore` is the only one (avoids the
-    `E0152 duplicate lang item core` at the bin link), and
-  - copies build-std's freshly-built `libpanic_abort-*.rlib` into that sysroot lib dir (so the
-    bin's `-Cpanic=abort` resolves a `panic_abort` that is ABI-matched to build-std's core),
-  - builds with `--config 'profile.release.panic="abort"'`.
-See `/tmp/relink-codex.sh` for the exact invocation. (This sysroot massaging should be folded
-into the agentos wasm toolchain so it is not a manual step.)
-
-KNOWN REMAINING (non-blocking; turn works e2e):
-- Rollout recorder logs `failed to queue rollout items: channel closed` (the writer task exits
-  early on wasi — likely the git-info subprocess in `write_session_meta`, same blocking-child
-  class as shell_snapshot). Non-fatal: the turn completes; agent-os resume uses adapter-passed
-  history, not codex's on-disk rollout. Gating git-info on wasi would silence it.
-- The session-turn engine reads `prompt` but not `history`; multi-turn resume via the EE ACP
-  adapter needs history replay wired in.
-- ACP-level integration into the unified agent-matrix lives in the EE codex adapter.
+# Codex patches for agentOS
+
+Codex targets agentOS's Linux-in-WASM environment. Although Rust identifies the
+target as `wasm32-wasip1` / `target_os = "wasi"`, agentOS supplies an owned POSIX
+sysroot, libc, Rust standard library, and host imports. The target therefore has
+real executable modes, symlinks, sockets, processes, PTYs, and signals.
+
+Patches in `../codex/` may expose those existing capabilities through API names
+that upstream crates normally guard with `cfg(unix)`. A missing declaration or
+operation must be fixed in this order:
+
+1. the agentOS Rust standard library;
+2. the agentOS libc and C sysroot;
+3. the kernel/sidecar host import;
+4. a narrow Codex or dependency cfg patch that selects the real implementation.
+
+Do not replace POSIX behavior with `Unsupported`, a hard-coded capability value,
+an empty result, or a success-returning no-op merely because the target is named
+WASI. The `portable-pty` compatibility crate is backed by agentOS's real PTY,
+process, descriptor, terminal-size, wait, and signal host interfaces. The build
+removes the fork's stale `ctrlc` override (the session-turn dependency graph does
+not use it) and uses the real AWS authentication crate.
+
+The one dependency-level adapter is `toolchain/stubs/reqwest-shim`. It is not a
+socket substitute: guest TCP and Unix sockets remain real. It routes outbound
+HTTP through the trusted sidecar because enforcement of HTTP policy, credentials,
+and TLS identity belongs outside the untrusted VM. Unsupported per-client policy
+or TLS overrides return explicit typed errors.
+
+Codex's managed proxy listener, MITM, and credential-injection service are the
+other host-native boundary. The fork retains its real policy/configuration types,
+but attempting to launch that trusted service inside the untrusted guest fails
+explicitly and directs ownership to the sidecar. This is not evidence that agentOS
+lacks listeners, Unix sockets, or networking.
+
+Every new patch must include a behavioral test where practical. Compile success
+alone is not proof that the POSIX behavior survived.
diff --git a/toolchain/std-patches/codex-source/build-codex-wasip1.sh b/toolchain/std-patches/codex-source/build-codex-wasip1.sh
index a432314194..4d138c309f 100755
--- a/toolchain/std-patches/codex-source/build-codex-wasip1.sh
+++ b/toolchain/std-patches/codex-source/build-codex-wasip1.sh
@@ -19,7 +19,7 @@ CARGO_CACHE="$(ls -d $HOME/.cargo/registry/src/index.crates.io-*/ | head -1)"
 echo "== 1. C toolchain (wasi-sdk clang) for libz-sys/ring/etc. =="
 export CC_wasm32_wasip1="$WSDK/bin/clang"
 export AR_wasm32_wasip1="$WSDK/bin/llvm-ar"
-export CFLAGS_wasm32_wasip1="--sysroot=$WSDK/share/wasi-sysroot -D_WASI_EMULATED_SIGNAL -D_WASI_EMULATED_PTHREAD -D_WASI_EMULATED_MMAN -D_WASI_EMULATED_PROCESS_CLOCKS"
+export CFLAGS_wasm32_wasip1="--sysroot=$SECEXEC/toolchain/c/sysroot -D_WASI_EMULATED_SIGNAL -D_WASI_EMULATED_PTHREAD -D_WASI_EMULATED_MMAN -D_WASI_EMULATED_PROCESS_CLOCKS"
 
 echo "== 2. crate-cache patches (become std-patches/crates/* artifacts when vendored) =="
 # path-dedot + path-absolutize: route target_family=wasm to the unix-paths impl.
@@ -28,14 +28,14 @@ for c in path-dedot-3.1.1 path-absolutize-3.1.1; do
     [ -f "$f" ] && sed -i 's/all(target_family = "wasm", feature = "use_unix_paths_on_wasm")/target_family = "wasm"/g' "$f"
   done
 done
-# rustls-native-certs: add a wasi arm returning empty certs (TLS is host-brokered).
+# rustls-native-certs: load agentOS's real VM trust store from its Linux path.
 RNC="${CARGO_CACHE}rustls-native-certs-0.8.3/src/lib.rs"
 if [ -f "$RNC" ] && ! grep -q 'target_os = "wasi"' "$RNC"; then
   python3 - "$RNC" <<'PY'
 import sys
 p=sys.argv[1]; s=open(p).read()
 a='#[cfg(target_os = "macos")]\nuse macos as platform;\n'
-s=s.replace(a, a+'\n#[cfg(target_os = "wasi")]\nmod platform {\n    use super::CertificateResult;\n    pub fn load_native_certs() -> CertificateResult { CertificateResult::default() }\n}\n',1)
+s=s.replace(a, a+'\n#[cfg(target_os = "wasi")]\nmod platform {\n    use super::{CertPaths, CertificateResult};\n    use std::path::PathBuf;\n    pub fn load_native_certs() -> CertificateResult {\n        CertPaths {\n            file: Some(PathBuf::from("/etc/ssl/certs/ca-certificates.crt")),\n            dirs: Vec::new(),\n        }.load()\n    }\n}\n',1)
 open(p,"w").write(s)
 PY
 fi
@@ -43,41 +43,10 @@ fi
 # (`pub use unsupported;` name collision; read/write/rw guards `use std::os::unix`).
 # Needs a wasi sys arm (advisory locks are no-ops in the single-process VM).
 
-echo "== 3. codex workspace patches (Cargo.toml) — build config, not agent logic =="
-# Applied by hand in this session (see git diff of codex-rs/Cargo.toml):
-#  - [patch.crates-io]: reqwest = stubs/reqwest-shim, tokio = /tmp/tokio-dev (1.52.3),
-#                       ctrlc = stubs/ctrlc
-#  - codex-network-proxy / codex-otel workspace deps repointed to stubs/*
-#  - removed "network-proxy","otel" from [workspace].members (collision)
-#  - zip = { default-features=false, features=["deflate","time"] }  (drops xz/lzma)
-#  - cargo update -p tokio --precise 1.52.3  (unify onto the patched tokio)
-
-echo "== 4. codex SOURCE patch (unavoidable compile_error) =="
-#  - utils/git/src/platform.rs: add #[cfg(target_os="wasi")] create_symlink stub +
-#    widen the fallback compile_error cfg. (see std-patches/codex-source/README.md)
-
-echo "== 5. build =="
+echo "== 3. build =="
+# This diagnostic helper assumes clone-and-build-codex-wasi.sh has already
+# applied the checked-in source, sysroot, libc, and dependency patches. It does
+# not describe or authorize compile-only WASI fallbacks; see README.md.
 cd "$CODEX"
 RUSTFLAGS="--cfg tokio_unstable" cargo +$TOOLCHAIN build -p codex-core \
-  --target wasm32-wasip1 -Z build-std=std,panic_abort "$@"
-fd-lock-4.0.4: sys/mod.rs unsupported branch (pub use unsupported::* + AsOpenFile=std::os::fd::AsFd); unsupported guards std::os::unix::io -> std::os::fd. Advisory locks are no-ops in single-process VM.
-
-# == portable-pty subtree (codex-utils-pty → portable-pty → filedescriptor) ==
-# PTY is NOT on the headless session-turn path (compile-only). Applied:
-#  - portable-pty-0.9.0: add src/wasi.rs (WasiPtySystem/Master/Slave/Child stubs
-#    impl'ing PtySystem/MasterPty/SlavePty/Child/ChildKiller); lib.rs gate
-#    `pub mod serial` to not(wasi) + add `#[cfg(target_os="wasi")] pub mod wasi` +
-#    `#[cfg(target_os="wasi")] pub type NativePtySystem = wasi::WasiPtySystem`;
-#    Cargo.toml: make serial2 a `cfg(not(target_os="wasi"))` target dep.
-#  - reqwest shim expanded: Client::{put,patch,delete,head,execute}, Request type +
-#    TryFrom<http::Request<Vec<u8>>>, RequestBuilder::{bearer_auth,basic_auth,query,
-#    form}, IntoUrl for &String/url::Url, all reqwest 0.12 features as no-op flags,
-#    deps url/base64/serde_urlencoded. reqwest unified to 0.12.28 (kills the
-#    wasm-bindgen-futures browser-backend leak from fragmented 0.12.27).
-#  - tokio /tmp/tokio-dev stream.rs: add #[cfg(target_os="wasi")] TcpStream::connect
-#    stub (compile-only; tungstenite references it, runtime uses HTTP fallback).
-# TODO(final dep wall): filedescriptor-0.8.3 has no wasi arm (RawFileDescriptor/
-#   SocketDescriptor/HandleType undefined on wasi). Either add a filedescriptor wasi
-#   module (RawFileDescriptor=std::os::fd::RawFd + minimal FileDescriptor/OwnedHandle)
-#   OR replace portable-pty wholesale with a [patch.crates-io] stub (the src/wasi.rs
-#   impls already written are the basis). After that, codex-core's OWN code compiles.
+	--target wasm32-wasip1 -Z build-std=std,panic_abort "$@"
diff --git a/toolchain/std-patches/codex/0004-wasi-apply-patch-child.patch b/toolchain/std-patches/codex/0004-wasi-apply-patch-child.patch
deleted file mode 100644
index 8e75add85a..0000000000
--- a/toolchain/std-patches/codex/0004-wasi-apply-patch-child.patch
+++ /dev/null
@@ -1,44 +0,0 @@
---- a/exec/Cargo.toml
-+++ b/exec/Cargo.toml
-@@ -20,6 +20,7 @@ anyhow = { workspace = true }
- # All codex deps are gated out on WASI — the WASI target provides stubs
- # wasm32-wasip1: codex-core compiles here now, so the session-turn engine drives it.
- [target.'cfg(target_os = "wasi")'.dependencies]
-+codex-apply-patch = { workspace = true }
- codex-core = { workspace = true }
- codex-protocol = { workspace = true }
- serde_json = { workspace = true }
---- a/core/src/tools/runtimes/apply_patch.rs
-+++ b/core/src/tools/runtimes/apply_patch.rs
-@@ -71,6 +71,9 @@ impl ApplyPatchRuntime {
-         req: &ApplyPatchRequest,
-         _codex_home: &std::path::Path,
-     ) -> Result<CommandSpec, ToolError> {
-+        #[cfg(target_os = "wasi")]
-+        let exe = PathBuf::from("/opt/agentos/bin/codex-exec");
-+        #[cfg(not(target_os = "wasi"))]
-         let exe = if let Some(path) = &req.codex_exe {
-             path.clone()
-         } else {
---- a/exec/src/lib.rs
-+++ b/exec/src/lib.rs
-@@ -15,8 +15,18 @@ pub fn wasi_stub_main() -> anyhow::Result<()> {
-     let args: Vec<String> = std::env::args().collect();
-     if args.get(1).map(String::as_str) == Some("--session-turn") {
-         session_turn_wasi::run()
-+    } else if args.get(1).map(String::as_str)
-+        == Some(codex_apply_patch::CODEX_CORE_APPLY_PATCH_ARG1)
-+    {
-+        let patch = args.get(2).map(String::as_str).unwrap_or_default();
-+        let mut stdout = std::io::stdout();
-+        let mut stderr = std::io::stderr();
-+        codex_apply_patch::apply_patch(patch, &mut stdout, &mut stderr)
-+            .map_err(anyhow::Error::from)
-     } else {
--        eprintln!("codex-exec: only --session-turn is supported on wasm32-wasip1");
-+        eprintln!(
-+            "codex-exec: only --session-turn and --codex-run-as-apply-patch are supported on wasm32-wasip1"
-+        );
-         Ok(())
-     }
- }
diff --git a/toolchain/std-patches/codex/0008-wasi-disable-unified-exec.patch b/toolchain/std-patches/codex/0008-wasi-disable-unified-exec.patch
deleted file mode 100644
index 47c2355dcf..0000000000
--- a/toolchain/std-patches/codex/0008-wasi-disable-unified-exec.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- a/exec/src/session_turn_wasi.rs
-+++ b/exec/src/session_turn_wasi.rs
-@@ -124,6 +124,14 @@ async fn session_turn() -> anyhow::Result<()> {
-             "sandbox_mode".to_string(),
-             toml::Value::String("workspace-write".to_string()),
-         ),
-+        // Unified exec requires process-management primitives that the AgentOS
-+        // WASI bridge does not expose. Keep Codex on its standard shell tool,
-+        // whose child process path is supported by the bridge. This must change
-+        // the canonical feature map because tool selection reads config.features.
-+        (
-+            "features.unified_exec".to_string(),
-+            toml::Value::Boolean(false),
-+        ),
-     ];
-     // This harness supplies its model, approval policy, filesystem, network, and
-     // credential environment explicitly. Loading arbitrary host CLI settings can
diff --git a/toolchain/std-patches/codex/0010-reasoning-effort-max-ultra.patch b/toolchain/std-patches/codex/0010-reasoning-effort-max-ultra.patch
deleted file mode 100644
index 4bfac11701..0000000000
--- a/toolchain/std-patches/codex/0010-reasoning-effort-max-ultra.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/protocol/src/openai_models.rs
-+++ b/protocol/src/openai_models.rs
-@@ -50,6 +50,8 @@ pub enum ReasoningEffort {
-     Medium,
-     High,
-     XHigh,
-+    Max,
-+    Ultra,
- }
- 
- impl FromStr for ReasoningEffort {
-@@ -501,6 +503,8 @@ fn effort_rank(effort: ReasoningEffort) -> i32 {
-         ReasoningEffort::Medium => 3,
-         ReasoningEffort::High => 4,
-         ReasoningEffort::XHigh => 5,
-+        ReasoningEffort::Max => 6,
-+        ReasoningEffort::Ultra => 7,
-     }
- }
- 
diff --git a/toolchain/std-patches/codex/0012-session-turn-current-api.patch b/toolchain/std-patches/codex/0012-session-turn-current-api.patch
new file mode 100644
index 0000000000..902c2ba28e
--- /dev/null
+++ b/toolchain/std-patches/codex/0012-session-turn-current-api.patch
@@ -0,0 +1,198 @@
+diff --git a/exec/Cargo.toml b/exec/Cargo.toml
+--- a/exec/Cargo.toml
++++ b/exec/Cargo.toml
+@@ -31,6 +31,10 @@ anyhow = { workspace = true }
+ # wasm32-wasip1: codex-core compiles here now, so the session-turn engine drives it.
+ [target.'cfg(target_os = "wasi")'.dependencies]
+ codex-core = { workspace = true }
++codex-exec-server = { workspace = true }
++codex-extension-api = { workspace = true }
++codex-home = { workspace = true }
++codex-login = { workspace = true }
+ codex-protocol = { workspace = true }
+ serde_json = { workspace = true }
+ toml = { workspace = true }
+diff --git a/exec/src/session_turn_wasi.rs b/exec/src/session_turn_wasi.rs
+--- a/exec/src/session_turn_wasi.rs
++++ b/exec/src/session_turn_wasi.rs
+@@ -11,11 +11,22 @@
+ //!           {type:"error",message}
+ 
+ use std::io::Write;
++use std::sync::Arc;
+ 
+ use anyhow::Context as _;
+-use codex_core::AuthManager;
++use codex_core::CodexAppsToolsCache;
++use codex_core::StartThreadOptions;
+ use codex_core::ThreadManager;
++use codex_core::build_models_manager;
+ use codex_core::config::Config;
++use codex_core::local_agent_graph_store_from_state_db;
++use codex_core::resolve_installation_id;
++use codex_core::thread_store_from_config;
++use codex_exec_server::EnvironmentManager;
++use codex_exec_server::ExecServerRuntimePaths;
++use codex_extension_api::empty_extension_registry;
++use codex_home::CodexHomeUserInstructionsProvider;
++use codex_login::AuthManager;
+ use codex_protocol::items::AgentMessageContent;
+ use codex_protocol::items::TurnItem;
+ use codex_protocol::models::ContentItem;
+@@ -63,8 +75,8 @@ fn history_from_start(start: &Value) -> Vec<RolloutItem> {
+             id: None,
+             role,
+             content,
+-            end_turn: None,
+             phase: None,
++            internal_chat_message_metadata_passthrough: None,
+         }));
+     }
+     items
+@@ -93,13 +105,10 @@ pub fn run() -> anyhow::Result<()> {
+         )
+         .try_init();
+-    // wasm32-wasip1 is single-threaded with no tokio::net reactor. codex-core drives the agent turn
+-    // on an internally `tokio::spawn`ed submission loop, so the runtime must cooperatively schedule
+-    // background tasks while our event loop awaits. The current-thread runtime does this correctly as
+-    // long as no task blocks the single executor thread (see the shell-snapshot wasi gate). Only the
+-    // time driver is needed; there is no I/O reactor on wasi (network I/O is host-brokered and
+-    // synchronous from the guest's perspective).
++    // agentOS supplies the POSIX network/process surface used by Tokio. Keep the
++    // current-thread executor for the single guest thread, but enable every
++    // available runtime driver instead of treating wasm32-wasip1 as stock WASI.
+     let rt = tokio::runtime::Builder::new_current_thread()
+-        .enable_time()
++        .enable_all()
+         .build()?;
+     rt.block_on(session_turn())
+ }
+@@ -143,51 +152,56 @@ async fn session_turn() -> anyhow::Result<()> {
+     // start from this revision's defaults.
+     let mut config = Config::load_default_with_cli_overrides(overrides)
++        .await
+         .context("load config")?;
+-    config.cwd = std::path::PathBuf::from(cwd);
+-    // wasm32-wasip1 has no tokio::net readiness reactor, so the WebSocket transport
+-    // (tokio-tungstenite → tokio::net::TcpStream) can't connect. Force the HTTP
+-    // Responses transport (host-brokered via wasi-http) by disabling websockets on
+-    // every provider; codex's HTTP path is the supported transport in the VM.
+-    for provider in config.model_providers.values_mut() {
+-        provider.supports_websockets = false;
+-    }
+-
+-    let auth_manager = AuthManager::shared(
+-        config.codex_home.clone(),
+-        /*enable_codex_api_key_env*/ true,
+-        config.cli_auth_credentials_store_mode,
+-    );
+-
+-    let auth_for_resume = AuthManager::shared(
+-        config.codex_home.clone(),
+-        /*enable_codex_api_key_env*/ true,
+-        config.cli_auth_credentials_store_mode,
+-    );
++    config.cwd = std::path::PathBuf::from(cwd)
++        .try_into()
++        .context("cwd must be absolute")?;
++
++    let auth_manager =
++        AuthManager::shared_from_config(&config, /*enable_codex_api_key_env*/ true).await;
++    let runtime_paths = ExecServerRuntimePaths::from_optional_paths(
++        config.codex_self_exe.clone(),
++        config.codex_linux_sandbox_exe.clone(),
++    )?;
++    let environment_manager = Arc::new(
++        EnvironmentManager::from_codex_home(
++            config.codex_home.clone(),
++            Some(runtime_paths),
++            config.http_client_factory(),
++        )
++        .await?,
++    );
++    let thread_store = thread_store_from_config(&config, None);
++    let installation_id = resolve_installation_id(&config.codex_home).await?;
+     let manager = ThreadManager::new(
+         &config,
+-        auth_manager,
++        Arc::clone(&auth_manager),
++        build_models_manager(&config, auth_manager),
++        CodexAppsToolsCache::default(),
+         SessionSource::Exec,
+-        Default::default(),
++        environment_manager,
++        empty_extension_registry(),
++        Arc::new(CodexHomeUserInstructionsProvider::new(
++            config.codex_home.clone(),
++        )),
++        /*analytics_events_client*/ None,
++        Arc::clone(&thread_store),
++        local_agent_graph_store_from_state_db(None),
++        installation_id,
++        /*attestation_provider*/ None,
++        /*external_time_provider*/ None,
+     );
+-    // Replay prior turns when the adapter sends `history`; otherwise start a fresh thread.
++    // Replay prior turns when the adapter sends `history`; otherwise start a
++    // fresh thread through the same current Codex thread-manager API.
+     let history = history_from_start(&start);
+-    let new_thread = if history.is_empty() {
+-        manager
+-            .start_thread(config.clone())
+-            .await
+-            .context("start thread")?
+-    } else {
+-        manager
+-            .resume_thread_with_history(
+-                config.clone(),
+-                InitialHistory::Forked(history),
+-                auth_for_resume,
+-                /*persist_extended_history*/ false,
+-                /*parent_trace*/ None,
+-            )
+-            .await
+-            .context("resume thread with history")?
+-    };
++    let mut options = StartThreadOptions::new(config.clone());
++    if !history.is_empty() {
++        options.initial_history = InitialHistory::Forked(history);
++    }
++    let new_thread = manager
++        .start_thread(options)
++        .await
++        .context("start thread")?;
+     let thread = new_thread.thread;
+ 
+     thread
+@@ -197,6 +216,9 @@ async fn session_turn() -> anyhow::Result<()> {
+                 text_elements: Vec::new(),
+             }],
+             final_output_json_schema: None,
++            responsesapi_client_metadata: None,
++            additional_context: Default::default(),
++            thread_settings: Default::default(),
+         })
+         .await
+         .context("submit prompt")?;
+@@ -355,7 +377,9 @@ async fn session_turn() -> anyhow::Result<()> {
+                     Some("allow") | Some("approve") | Some("allow_always") => {
+                         ReviewDecision::Approved
+                     }
+-                    _ => ReviewDecision::Denied,
++                    _ => ReviewDecision::Denied {
++                        rejection: "denied by user".to_string(),
++                    },
+                 };
+                 let _ = thread
+                     .submit(Op::ExecApproval {
+@@ -382,7 +406,9 @@ async fn session_turn() -> anyhow::Result<()> {
+                     Some("allow") | Some("approve") | Some("allow_always") => {
+                         ReviewDecision::Approved
+                     }
+-                    _ => ReviewDecision::Denied,
++                    _ => ReviewDecision::Denied {
++                        rejection: "denied by user".to_string(),
++                    },
+                 };
+                 let _ = thread
+                     .submit(Op::PatchApproval {
diff --git a/toolchain/std-patches/codex/0013-wasi-use-agentos-c-sysroot.patch b/toolchain/std-patches/codex/0013-wasi-use-agentos-c-sysroot.patch
new file mode 100644
index 0000000000..3471a9eceb
--- /dev/null
+++ b/toolchain/std-patches/codex/0013-wasi-use-agentos-c-sysroot.patch
@@ -0,0 +1,9 @@
+--- a/scripts/build-wasi-codex-exec.sh
++++ b/scripts/build-wasi-codex-exec.sh
+@@ -51,4 +51,5 @@ export CC_wasm32_wasip1="$WSDK/bin/clang"
+ export AR_wasm32_wasip1="$WSDK/bin/llvm-ar"
+-export CFLAGS_wasm32_wasip1="--sysroot=$WSDK/share/wasi-sysroot -D_WASI_EMULATED_SIGNAL -D_WASI_EMULATED_PTHREAD -D_WASI_EMULATED_MMAN -D_WASI_EMULATED_PROCESS_CLOCKS"
++C_SYSROOT="${AGENTOS_C_SYSROOT:-$WSDK/share/wasi-sysroot}"
++export CFLAGS_wasm32_wasip1="--sysroot=$C_SYSROOT -D_WASI_EMULATED_SIGNAL -D_WASI_EMULATED_PTHREAD -D_WASI_EMULATED_MMAN -D_WASI_EMULATED_PROCESS_CLOCKS"
+ 
+ restore_sysroot() {
diff --git a/toolchain/std-patches/codex/0014-wasi-exec-recursion-limit.patch b/toolchain/std-patches/codex/0014-wasi-exec-recursion-limit.patch
new file mode 100644
index 0000000000..757da7e2cd
--- /dev/null
+++ b/toolchain/std-patches/codex/0014-wasi-exec-recursion-limit.patch
@@ -0,0 +1,11 @@
+diff --git a/exec/src/lib.rs b/exec/src/lib.rs
+--- a/exec/src/lib.rs
++++ b/exec/src/lib.rs
+@@ -3,6 +3,7 @@
+ // - In --json mode, stdout must be valid JSONL, one event per line.
+ // For both modes, any other output must be written to stderr.
+ #![cfg_attr(not(target_os = "wasi"), deny(clippy::print_stdout))]
++#![cfg_attr(target_os = "wasi", recursion_limit = "256")]
+ 
+ #[cfg(target_os = "wasi")]
+ mod session_turn_wasi;
diff --git a/toolchain/std-patches/codex/0015-strip-debug-before-wasm-opt.patch b/toolchain/std-patches/codex/0015-strip-debug-before-wasm-opt.patch
new file mode 100644
index 0000000000..5606df447f
--- /dev/null
+++ b/toolchain/std-patches/codex/0015-strip-debug-before-wasm-opt.patch
@@ -0,0 +1,18 @@
+diff --git a/scripts/build-wasi-codex-exec.sh b/scripts/build-wasi-codex-exec.sh
+--- a/scripts/build-wasi-codex-exec.sh
++++ b/scripts/build-wasi-codex-exec.sh
+@@ -107,7 +107,13 @@ echo "== built: $(stat -c%s "$RAW") bytes =="
+ 
+ OUT="$REPO_DIR/target/wasm32-wasip1/release/codex-exec.opt.wasm"
+ if command -v wasm-opt >/dev/null 2>&1; then
+-	wasm-opt --all-features -O2 "$RAW" -o "$OUT"
++	# Binaryen 128 cannot parse the DWARF line opcodes emitted by this nightly.
++	# Strip debug sections with the matching wasi-sdk LLVM tool before optimizing;
++	# this does not change guest behavior or agentOS capabilities.
++	STRIPPED="${RAW%.wasm}.stripped.wasm"
++	"$WASI_SDK_DIR/bin/llvm-strip" --strip-debug -o "$STRIPPED" "$RAW"
++	wasm-opt --all-features -O2 "$STRIPPED" -o "$OUT"
++	rm -f "$STRIPPED"
+ else
+ 	echo "wasm-opt not found — shipping unoptimized"; cp "$RAW" "$OUT"
+ fi
diff --git a/toolchain/std-patches/codex/0016-wasi-configure-codex-executable-path.patch b/toolchain/std-patches/codex/0016-wasi-configure-codex-executable-path.patch
new file mode 100644
index 0000000000..a937ed162f
--- /dev/null
+++ b/toolchain/std-patches/codex/0016-wasi-configure-codex-executable-path.patch
@@ -0,0 +1,15 @@
+diff --git a/exec/src/session_turn_wasi.rs b/exec/src/session_turn_wasi.rs
+--- a/exec/src/session_turn_wasi.rs
++++ b/exec/src/session_turn_wasi.rs
+@@ -158,6 +158,11 @@ async fn session_turn() -> anyhow::Result<()> {
+     config.cwd = std::path::PathBuf::from(cwd)
+         .try_into()
+         .context("cwd must be absolute")?;
++    // The native CLI derives this from argv0 dispatch. The agentOS WASM entrypoint
++    // bypasses that CLI, so identify the same executable by its stable projected
++    // package path before constructing upstream's exec-server runtime paths.
++    config.codex_self_exe =
++        Some(std::path::PathBuf::from("/opt/agentos/bin/codex-exec"));
+ 
+     let auth_manager =
+         AuthManager::shared_from_config(&config, /*enable_codex_api_key_env*/ true).await;
diff --git a/toolchain/std-patches/codex/0017-wasi-load-guest-config.patch b/toolchain/std-patches/codex/0017-wasi-load-guest-config.patch
new file mode 100644
index 0000000000..abd59c34d3
--- /dev/null
+++ b/toolchain/std-patches/codex/0017-wasi-load-guest-config.patch
@@ -0,0 +1,18 @@
+--- a/exec/src/session_turn_wasi.rs
++++ b/exec/src/session_turn_wasi.rs
+@@ -147,10 +147,9 @@ async fn session_turn() -> anyhow::Result<()> {
+         ),
+     ];
+-    // This harness supplies its model, approval policy, filesystem, network, and
+-    // credential environment explicitly. Loading arbitrary host CLI settings can
+-    // make the pinned runtime reject values written by a newer Codex release (for
+-    // example service_tier = "default"). Keep CODEX_HOME for auth storage, but
+-    // start from this revision's defaults.
+-    let mut config = Config::load_default_with_cli_overrides(overrides)
++    // Load the guest's normal Codex configuration so portable Agent Plugins,
++    // model providers, and other client-supported settings work in agentOS.
++    // The explicit harness overrides above still own the session's model,
++    // approval, filesystem, and shell-snapshot behavior.
++    let mut config = Config::load_with_cli_overrides(overrides)
+         .await
+         .context("load config")?;
diff --git a/toolchain/std-patches/crates/gethostname/0001-wasip1-hostname.patch b/toolchain/std-patches/crates/gethostname/0001-wasip1-hostname.patch
new file mode 100644
index 0000000000..fc63451158
--- /dev/null
+++ b/toolchain/std-patches/crates/gethostname/0001-wasip1-hostname.patch
@@ -0,0 +1,39 @@
+Use the gethostname(2) implementation supplied by the agentOS libc rather than
+inventing a WASI-specific hostname fallback.
+
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -52,6 +52,24 @@
+         use std::os::unix::ffi::OsStringExt;
+         OsString::from_vec(rustix::system::uname().nodename().to_bytes().to_vec())
+     }
++    #[cfg(target_os = "wasi")]
++    {
++        use std::os::wasi::ffi::OsStringExt;
++
++        let mut buffer = vec![0_u8; 256];
++        let result = unsafe {
++            libc::gethostname(buffer.as_mut_ptr().cast::<libc::c_char>(), buffer.len())
++        };
++        if result != 0 {
++            panic!("gethostname failed: {}", std::io::Error::last_os_error());
++        }
++        let end = buffer
++            .iter()
++            .position(|byte| *byte == 0)
++            .unwrap_or(buffer.len());
++        buffer.truncate(end);
++        OsString::from_vec(buffer)
++    }
+     #[cfg(windows)]
+     {
+         get_computer_physical_dns_hostname()
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -76,3 +76,6 @@
+ 
+ [target."cfg(windows)".dependencies.windows-link]
+ version = "0.2.1"
++
++[target.'cfg(target_os = "wasi")'.dependencies]
++libc = "0.2"
diff --git a/toolchain/std-patches/crates/gix-fs/0001-agentos-posix-capabilities.patch b/toolchain/std-patches/crates/gix-fs/0001-agentos-posix-capabilities.patch
new file mode 100644
index 0000000000..e1cd07854d
--- /dev/null
+++ b/toolchain/std-patches/crates/gix-fs/0001-agentos-posix-capabilities.patch
@@ -0,0 +1,77 @@
+Expose the POSIX filesystem behavior agentOS already provides through Rust's
+WASI-specific std APIs. Do not use target_os="wasi" as a capability fallback:
+the VM supports executable modes and symlinks and gix must probe both normally.
+
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -1,4 +1,5 @@
+ //! A crate with file-system specific utilities.
++#![cfg_attr(target_os = "wasi", feature(wasi_ext))]
+ #![deny(rust_2018_idioms, missing_docs)]
+ #![forbid(unsafe_code)]
+ 
+--- a/src/capabilities.rs
++++ b/src/capabilities.rs
+@@ -27,6 +27,18 @@
+     }
+ }
+ 
++#[cfg(target_os = "wasi")]
++impl Default for Capabilities {
++    fn default() -> Self {
++        Capabilities {
++            precompose_unicode: false,
++            ignore_case: false,
++            executable_bit: true,
++            symlink: true,
++        }
++    }
++}
++
+ #[cfg(all(unix, not(target_os = "macos")))]
+ impl Default for Capabilities {
+     fn default() -> Self {
+@@ -69,9 +81,12 @@
+         }
+     }
+ 
+-    #[cfg(unix)]
++    #[cfg(any(unix, target_os = "wasi"))]
+     fn probe_file_mode(root: &Path) -> std::io::Result<bool> {
++        #[cfg(unix)]
+         use std::os::unix::fs::{MetadataExt, OpenOptionsExt, PermissionsExt};
++        #[cfg(target_os = "wasi")]
++        use std::os::wasi::fs::{MetadataExt, OpenOptionsExt, PermissionsExt};
+ 
+         // First check that we can create an executable file, then check that we
+         // can change the executable bit.
+@@ -101,7 +116,7 @@
+         res
+     }
+ 
+-    #[cfg(not(unix))]
++    #[cfg(not(any(unix, target_os = "wasi")))]
+     fn probe_file_mode(_root: &Path) -> std::io::Result<bool> {
+         Ok(false)
+     }
+--- a/src/symlink.rs
++++ b/src/symlink.rs
+@@ -3,11 +3,17 @@
+ /// Create a new symlink at `link` which points to `original`.
+ ///
+ /// Note that `original` doesn't have to exist.
+-#[cfg(not(windows))]
++#[cfg(unix)]
+ pub fn create(original: &Path, link: &Path) -> io::Result<()> {
+     std::os::unix::fs::symlink(original, link)
+ }
+ 
++/// Create a symlink through agentOS's WASI/POSIX std surface.
++#[cfg(target_os = "wasi")]
++pub fn create(original: &Path, link: &Path) -> io::Result<()> {
++    std::os::wasi::fs::symlink_path(original, link)
++}
++
+ /// Remove a symlink.
+ ///
+ /// Note that on only on windows this is special.
diff --git a/toolchain/std-patches/crates/libc/0001-wasip1-socket-bindings.patch b/toolchain/std-patches/crates/libc/0001-wasip1-socket-bindings.patch
new file mode 100644
index 0000000000..36b4174359
--- /dev/null
+++ b/toolchain/std-patches/crates/libc/0001-wasip1-socket-bindings.patch
@@ -0,0 +1,217 @@
+Expose the agentOS libc socket ABI to Rust crates on wasm32-wasip1. These are
+bindings to the real POSIX implementation in the owned sysroot and host_net
+imports, not stock-WASI capability shims.
+
+--- a/src/wasi/mod.rs
++++ b/src/wasi/mod.rs
+@@ -37,6 +37,10 @@
+ pub type pthread_once_t = c_int;
+ pub type pthread_key_t = c_uint;
+ pub type pthread_spinlock_t = c_int;
++pub type sa_family_t = c_ushort;
++pub type socklen_t = c_uint;
++pub type in_port_t = u16;
++pub type in_addr_t = u32;
+ 
+ s_no_extra_traits! {
+     #[repr(align(16))]
+@@ -149,6 +153,76 @@
+         pub revents: c_short,
+     }
+ 
++    #[repr(C, align(4))]
++    pub struct in_addr {
++        pub s_addr: in_addr_t,
++    }
++
++    #[repr(C, align(4))]
++    pub struct in6_addr {
++        pub s6_addr: [u8; 16],
++    }
++
++    #[repr(C, align(16))]
++    pub struct sockaddr {
++        pub sa_family: sa_family_t,
++        pub sa_data: [c_char; 0],
++    }
++
++    #[repr(C, align(16))]
++    pub struct sockaddr_in {
++        pub sin_family: sa_family_t,
++        pub sin_port: in_port_t,
++        pub sin_addr: in_addr,
++    }
++
++    #[repr(C, align(16))]
++    pub struct sockaddr_in6 {
++        pub sin6_family: sa_family_t,
++        pub sin6_port: in_port_t,
++        pub sin6_flowinfo: c_uint,
++        pub sin6_addr: in6_addr,
++        pub sin6_scope_id: c_uint,
++    }
++
++    #[repr(C, align(16))]
++    pub struct sockaddr_storage {
++        pub ss_family: sa_family_t,
++        pub __ss_data: [c_char; 126],
++    }
++
++    #[repr(C, align(16))]
++    pub struct sockaddr_un {
++        pub sun_family: sa_family_t,
++        pub sun_path: [c_char; 108],
++    }
++
++    pub struct linger {
++        pub l_onoff: c_int,
++        pub l_linger: c_int,
++    }
++
++    pub struct ip_mreq {
++        pub imr_multiaddr: in_addr,
++        pub imr_interface: in_addr,
++    }
++
++    pub struct ipv6_mreq {
++        pub ipv6mr_multiaddr: in6_addr,
++        pub ipv6mr_interface: c_uint,
++    }
++
++    pub struct addrinfo {
++        pub ai_flags: c_int,
++        pub ai_family: c_int,
++        pub ai_socktype: c_int,
++        pub ai_protocol: c_int,
++        pub ai_addrlen: socklen_t,
++        pub ai_addr: *mut sockaddr,
++        pub ai_canonname: *mut c_char,
++        pub ai_next: *mut addrinfo,
++    }
++
+     pub struct rusage {
+         pub ru_utime: timeval,
+         pub ru_stime: timeval,
+@@ -233,6 +307,53 @@
+ pub const STDIN_FILENO: c_int = 0;
+ pub const STDOUT_FILENO: c_int = 1;
+ pub const STDERR_FILENO: c_int = 2;
++pub const AF_UNSPEC: c_int = 0;
++pub const AF_INET: c_int = 1;
++pub const AF_INET6: c_int = 2;
++pub const AF_UNIX: c_int = 3;
++pub const AF_LOCAL: c_int = AF_UNIX;
++pub const SOCK_DGRAM: c_int = 5;
++pub const SOCK_STREAM: c_int = 6;
++pub const SOCK_NONBLOCK: c_int = 0x0000_4000;
++pub const SOCK_CLOEXEC: c_int = 0x0000_2000;
++pub const IPPROTO_IP: c_int = 0;
++pub const IPPROTO_TCP: c_int = 6;
++pub const IPPROTO_UDP: c_int = 17;
++pub const IPPROTO_IPV6: c_int = 41;
++pub const SOL_SOCKET: c_int = 0x7fff_ffff;
++pub const SO_REUSEADDR: c_int = 2;
++pub const SO_TYPE: c_int = 3;
++pub const SO_ERROR: c_int = 4;
++pub const SO_BROADCAST: c_int = 6;
++pub const SO_SNDBUF: c_int = 7;
++pub const SO_RCVBUF: c_int = 8;
++pub const SO_KEEPALIVE: c_int = 9;
++pub const SO_LINGER: c_int = 13;
++pub const SO_RCVTIMEO: c_int = 66;
++pub const SO_SNDTIMEO: c_int = 67;
++pub const IP_TTL: c_int = 2;
++pub const IP_MULTICAST_TTL: c_int = 33;
++pub const IP_MULTICAST_LOOP: c_int = 34;
++pub const IP_ADD_MEMBERSHIP: c_int = 35;
++pub const IP_DROP_MEMBERSHIP: c_int = 36;
++pub const IPV6_UNICAST_HOPS: c_int = 16;
++pub const IPV6_MULTICAST_LOOP: c_int = 19;
++pub const IPV6_JOIN_GROUP: c_int = 20;
++pub const IPV6_LEAVE_GROUP: c_int = 21;
++pub const IPV6_ADD_MEMBERSHIP: c_int = 20;
++pub const IPV6_DROP_MEMBERSHIP: c_int = 21;
++pub const IPV6_V6ONLY: c_int = 26;
++pub const TCP_NODELAY: c_int = 1;
++pub const TCP_KEEPIDLE: c_int = 4;
++pub const TCP_KEEPINTVL: c_int = 5;
++pub const TCP_KEEPCNT: c_int = 6;
++pub const MSG_PEEK: c_int = 2;
++pub const MSG_NOSIGNAL: c_int = 0x4000;
++pub const SOMAXCONN: c_int = 128;
++pub const SHUT_RD: c_int = 1;
++pub const SHUT_WR: c_int = 2;
++pub const SHUT_RDWR: c_int = SHUT_RD | SHUT_WR;
++pub const EAI_SYSTEM: c_int = -11;
+ pub const SEEK_SET: c_int = 0;
+ pub const SEEK_CUR: c_int = 1;
+ pub const SEEK_END: c_int = 2;
+@@ -656,6 +777,59 @@
+     pub fn putchar_unlocked(c: c_int) -> c_int;
+ 
+     pub fn shutdown(socket: c_int, how: c_int) -> c_int;
++    pub fn gethostname(name: *mut c_char, len: size_t) -> c_int;
++    pub fn socket(domain: c_int, ty: c_int, protocol: c_int) -> c_int;
++    pub fn socketpair(domain: c_int, ty: c_int, protocol: c_int, sockets: *mut c_int) -> c_int;
++    pub fn bind(socket: c_int, address: *const sockaddr, address_len: socklen_t) -> c_int;
++    pub fn connect(socket: c_int, address: *const sockaddr, address_len: socklen_t) -> c_int;
++    pub fn listen(socket: c_int, backlog: c_int) -> c_int;
++    pub fn accept(socket: c_int, address: *mut sockaddr, address_len: *mut socklen_t) -> c_int;
++    pub fn accept4(
++        socket: c_int,
++        address: *mut sockaddr,
++        address_len: *mut socklen_t,
++        flags: c_int,
++    ) -> c_int;
++    pub fn getsockname(socket: c_int, address: *mut sockaddr, address_len: *mut socklen_t) -> c_int;
++    pub fn getpeername(socket: c_int, address: *mut sockaddr, address_len: *mut socklen_t) -> c_int;
++    pub fn sendto(
++        socket: c_int,
++        buf: *const c_void,
++        len: size_t,
++        flags: c_int,
++        address: *const sockaddr,
++        address_len: socklen_t,
++    ) -> ssize_t;
++    pub fn recvfrom(
++        socket: c_int,
++        buf: *mut c_void,
++        len: size_t,
++        flags: c_int,
++        address: *mut sockaddr,
++        address_len: *mut socklen_t,
++    ) -> ssize_t;
++    pub fn getsockopt(
++        socket: c_int,
++        level: c_int,
++        name: c_int,
++        value: *mut c_void,
++        value_len: *mut socklen_t,
++    ) -> c_int;
++    pub fn setsockopt(
++        socket: c_int,
++        level: c_int,
++        name: c_int,
++        value: *const c_void,
++        value_len: socklen_t,
++    ) -> c_int;
++    pub fn getaddrinfo(
++        node: *const c_char,
++        service: *const c_char,
++        hints: *const addrinfo,
++        result: *mut *mut addrinfo,
++    ) -> c_int;
++    pub fn freeaddrinfo(result: *mut addrinfo);
++    pub fn gai_strerror(error: c_int) -> *const c_char;
+     pub fn fstat(fildes: c_int, buf: *mut stat) -> c_int;
+     pub fn mkdir(path: *const c_char, mode: mode_t) -> c_int;
+     pub fn stat(path: *const c_char, buf: *mut stat) -> c_int;
+@@ -667,6 +841,8 @@
+     pub fn open(path: *const c_char, oflag: c_int, ...) -> c_int;
+     pub fn creat(path: *const c_char, mode: mode_t) -> c_int;
+     pub fn fcntl(fd: c_int, cmd: c_int, ...) -> c_int;
++    pub fn pipe(fds: *mut c_int) -> c_int;
++    pub fn pipe2(fds: *mut c_int, flags: c_int) -> c_int;
+     pub fn opendir(dirname: *const c_char) -> *mut crate::DIR;
+     pub fn fdopendir(fd: c_int) -> *mut crate::DIR;
+     pub fn readdir(dirp: *mut crate::DIR) -> *mut crate::dirent;
diff --git a/toolchain/std-patches/crates/mio/0001-agentos-wasip1-posix-net.patch b/toolchain/std-patches/crates/mio/0001-agentos-wasip1-posix-net.patch
new file mode 100644
index 0000000000..9f1fe59a2a
--- /dev/null
+++ b/toolchain/std-patches/crates/mio/0001-agentos-wasip1-posix-net.patch
@@ -0,0 +1,199 @@
+Expose agentOS's POSIX TCP and UDP APIs through Mio's WASIp1 backend. The
+backend keeps Mio's poll_oneoff readiness integration, while socket creation and
+address operations call the real libc functions supplied by the agentOS sysroot.
+
+--- a/src/net/mod.rs
++++ b/src/net/mod.rs
+@@ -28,9 +28,7 @@
+ mod tcp;
+ pub use self::tcp::{TcpListener, TcpStream};
+ 
+-#[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+ mod udp;
+-#[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+ pub use self::udp::UdpSocket;
+ 
+ #[cfg(unix)]
+--- a/src/net/tcp/stream.rs
++++ b/src/net/tcp/stream.rs
+@@ -13,7 +13,6 @@
+ };
+ 
+ use crate::io_source::IoSource;
+-#[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+ use crate::sys::tcp::{connect, new_for_addr};
+ use crate::{event, Interest, Registry, Token};
+ 
+@@ -87,7 +86,6 @@
+     /// entries in the routing cache.
+     ///
+     /// [write interest]: Interest::WRITABLE
+-    #[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+     pub fn connect(addr: SocketAddr) -> io::Result<TcpStream> {
+         let socket = new_for_addr(addr)?;
+         #[cfg(any(unix, target_os = "hermit", target_os = "wasi"))]
+--- a/src/net/tcp/listener.rs
++++ b/src/net/tcp/listener.rs
+@@ -13,13 +13,7 @@
+ 
+ use crate::io_source::IoSource;
+ use crate::net::TcpStream;
+-#[cfg(any(
+-    unix,
+-    target_os = "hermit",
+-    all(target_os = "wasi", not(target_env = "p1"))
+-))]
+ use crate::sys::tcp::set_reuseaddr;
+-#[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+ use crate::sys::tcp::{bind, listen, new_for_addr};
+ use crate::{event, sys, Interest, Registry, Token};
+ 
+@@ -63,7 +57,6 @@
+     /// 2. Set the `SO_REUSEADDR` option on the socket on Unix.
+     /// 3. Bind the socket to the specified address.
+     /// 4. Calls `listen` on the socket to prepare it to receive new connections.
+-    #[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+     pub fn bind(addr: SocketAddr) -> io::Result<TcpListener> {
+         let socket = new_for_addr(addr)?;
+         #[cfg(any(unix, target_os = "hermit", target_os = "wasi"))]
+--- a/src/sys/wasip1/mod.rs
++++ b/src/sys/wasip1/mod.rs
+@@ -26,7 +26,99 @@
+ cfg_net! {
+     pub(crate) mod tcp {
+         use std::io;
++        use std::mem::size_of;
+         use std::net::{self, SocketAddr};
++        use std::os::fd::{AsRawFd, FromRawFd};
++
++        #[repr(C)]
++        union SocketAddrCRepr {
++            v4: libc::sockaddr_in,
++            v6: libc::sockaddr_in6,
++        }
++
++        impl SocketAddrCRepr {
++            fn as_ptr(&self) -> *const libc::sockaddr {
++                self as *const _ as *const libc::sockaddr
++            }
++        }
++
++        fn socket_addr(addr: &SocketAddr) -> (SocketAddrCRepr, libc::socklen_t) {
++            match addr {
++                SocketAddr::V4(addr) => (
++                    SocketAddrCRepr {
++                        v4: libc::sockaddr_in {
++                            sin_family: libc::AF_INET as libc::sa_family_t,
++                            sin_port: addr.port().to_be(),
++                            sin_addr: libc::in_addr {
++                                s_addr: u32::from_ne_bytes(addr.ip().octets()),
++                            },
++                        },
++                    },
++                    size_of::<libc::sockaddr_in>() as libc::socklen_t,
++                ),
++                SocketAddr::V6(addr) => (
++                    SocketAddrCRepr {
++                        v6: libc::sockaddr_in6 {
++                            sin6_family: libc::AF_INET6 as libc::sa_family_t,
++                            sin6_port: addr.port().to_be(),
++                            sin6_flowinfo: addr.flowinfo(),
++                            sin6_addr: libc::in6_addr {
++                                s6_addr: addr.ip().octets(),
++                            },
++                            sin6_scope_id: addr.scope_id(),
++                        },
++                    },
++                    size_of::<libc::sockaddr_in6>() as libc::socklen_t,
++                ),
++            }
++        }
++
++        fn cvt(result: libc::c_int) -> io::Result<libc::c_int> {
++            if result < 0 {
++                Err(io::Error::last_os_error())
++            } else {
++                Ok(result)
++            }
++        }
++
++        pub(crate) fn new_for_addr(addr: SocketAddr) -> io::Result<libc::c_int> {
++            let domain = if addr.is_ipv4() { libc::AF_INET } else { libc::AF_INET6 };
++            cvt(unsafe { libc::socket(domain, libc::SOCK_STREAM | libc::SOCK_NONBLOCK, 0) })
++        }
++
++        pub(crate) fn connect(stream: &net::TcpStream, addr: SocketAddr) -> io::Result<()> {
++            let (raw_addr, raw_addr_len) = socket_addr(&addr);
++            let result = unsafe { libc::connect(stream.as_raw_fd(), raw_addr.as_ptr(), raw_addr_len) };
++            match cvt(result) {
++                Err(error) if error.raw_os_error() == Some(libc::EINPROGRESS) => Ok(()),
++                result => result.map(|_| ()),
++            }
++        }
++
++        pub(crate) fn bind(listener: &net::TcpListener, addr: SocketAddr) -> io::Result<()> {
++            let (raw_addr, raw_addr_len) = socket_addr(&addr);
++            cvt(unsafe { libc::bind(listener.as_raw_fd(), raw_addr.as_ptr(), raw_addr_len) })?;
++            Ok(())
++        }
++
++        pub(crate) fn listen(listener: &net::TcpListener, backlog: libc::c_int) -> io::Result<()> {
++            cvt(unsafe { libc::listen(listener.as_raw_fd(), backlog) })?;
++            Ok(())
++        }
++
++        pub(crate) fn set_reuseaddr(listener: &net::TcpListener, reuse: bool) -> io::Result<()> {
++            let value = libc::c_int::from(reuse);
++            cvt(unsafe {
++                libc::setsockopt(
++                    listener.as_raw_fd(),
++                    libc::SOL_SOCKET,
++                    libc::SO_REUSEADDR,
++                    (&raw const value).cast(),
++                    size_of::<libc::c_int>() as libc::socklen_t,
++                )
++            })?;
++            Ok(())
++        }
+ 
+         pub(crate) fn accept(listener: &net::TcpListener) -> io::Result<(net::TcpStream, SocketAddr)> {
+             let (stream, addr) = listener.accept()?;
+@@ -34,6 +126,38 @@
+             Ok((stream, addr))
+         }
+     }
++
++    pub(crate) mod udp {
++        use std::io;
++        use std::mem::size_of;
++        use std::net::{self, SocketAddr};
++        use std::os::fd::AsRawFd;
++
++        pub(crate) fn bind(addr: SocketAddr) -> io::Result<net::UdpSocket> {
++            let socket = net::UdpSocket::bind(addr)?;
++            socket.set_nonblocking(true)?;
++            Ok(socket)
++        }
++
++        pub(crate) fn only_v6(socket: &net::UdpSocket) -> io::Result<bool> {
++            let mut value: libc::c_int = 0;
++            let mut length = size_of::<libc::c_int>() as libc::socklen_t;
++            let result = unsafe {
++                libc::getsockopt(
++                    socket.as_raw_fd(),
++                    libc::IPPROTO_IPV6,
++                    libc::IPV6_V6ONLY,
++                    (&raw mut value).cast(),
++                    &mut length,
++                )
++            };
++            if result < 0 {
++                Err(io::Error::last_os_error())
++            } else {
++                Ok(value != 0)
++            }
++        }
++    }
+ }
+ 
+ /// Unique id for use as `SelectorId`.
diff --git a/toolchain/std-patches/crates/mio/0002-agentos-wasip1-posix-unix-sockets.patch b/toolchain/std-patches/crates/mio/0002-agentos-wasip1-posix-unix-sockets.patch
new file mode 100644
index 0000000000..ef7531db5d
--- /dev/null
+++ b/toolchain/std-patches/crates/mio/0002-agentos-wasip1-posix-unix-sockets.patch
@@ -0,0 +1,179 @@
+Expose agentOS Unix-domain sockets, pipes, and raw descriptors through Mio's
+existing APIs. The WASIp1 selector remains in use; these modules call the real
+agentOS libc implementations and register their descriptors with poll_oneoff.
+
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -6,6 +6,7 @@
+     dead_code
+ )]
+ #![cfg_attr(docsrs, feature(doc_cfg))]
++#![cfg_attr(target_os = "wasi", feature(wasi_ext))]
+ // Disallow warnings when running tests.
+ #![cfg_attr(test, deny(warnings))]
+ // Disallow warnings in examples.
+@@ -72,8 +73,8 @@
+ #[cfg(not(target_os = "wasi"))]
+ pub use waker::Waker;
+ 
+-#[cfg(all(unix, feature = "os-ext"))]
+-#[cfg_attr(docsrs, doc(cfg(all(unix, feature = "os-ext"))))]
++#[cfg(all(any(unix, target_os = "wasi"), feature = "os-ext"))]
++#[cfg_attr(docsrs, doc(cfg(all(any(unix, target_os = "wasi"), feature = "os-ext"))))]
+ pub mod unix {
+     //! Unix only extensions.
+ 
+--- a/src/net/mod.rs
++++ b/src/net/mod.rs
+@@ -31,7 +31,7 @@
+ mod udp;
+ pub use self::udp::UdpSocket;
+ 
+-#[cfg(unix)]
++#[cfg(any(unix, target_os = "wasi"))]
+ mod uds;
+-#[cfg(unix)]
++#[cfg(any(unix, target_os = "wasi"))]
+ pub use self::uds::{UnixDatagram, UnixListener, UnixStream};
+--- a/src/sys/mod.rs
++++ b/src/sys/mod.rs
+@@ -70,7 +70,7 @@
+ #[cfg(all(target_os = "wasi", target_env = "p1"))]
+ cfg_os_poll! {
+     mod wasip1;
+-    pub(crate) use self::wasip1::*;
++    pub use self::wasip1::*;
+ }
+ 
+ cfg_not_os_poll! {
+--- a/src/sys/wasip1/mod.rs
++++ b/src/sys/wasip1/mod.rs
+@@ -20,10 +20,26 @@
+ use std::sync::{Arc, Mutex};
+ use std::time::Duration;
+ 
++macro_rules! syscall {
++    ($fn: ident ( $($arg: expr),* $(,)* ) ) => {{
++        let res = unsafe { libc::$fn($($arg, )*) };
++        if res < 0 {
++            Err(std::io::Error::last_os_error())
++        } else {
++            Ok(res)
++        }
++    }};
++}
++
+ #[cfg(feature = "net")]
+ use crate::{Interest, Token};
+ 
+ cfg_net! {
++    #[path = "../unix/net.rs"]
++    pub(crate) mod posix_net;
++    #[path = "../unix/uds/mod.rs"]
++    pub(crate) mod uds;
++
+     pub(crate) mod tcp {
+         use std::io;
+         use std::mem::size_of;
+@@ -160,6 +176,16 @@
+     }
+ }
+ 
++#[cfg(feature = "os-ext")]
++#[path = "../unix/pipe.rs"]
++pub(crate) mod pipe;
++
++#[cfg(feature = "os-ext")]
++#[path = "../unix/sourcefd.rs"]
++mod sourcefd;
++#[cfg(feature = "os-ext")]
++pub use sourcefd::SourceFd;
++
+ /// Unique id for use as `SelectorId`.
+ #[cfg(all(debug_assertions, feature = "net"))]
+ static NEXT_ID: AtomicUsize = AtomicUsize::new(1);
+--- a/src/sys/unix/pipe.rs
++++ b/src/sys/unix/pipe.rs
+@@ -22,6 +22,7 @@
+         target_os = "solaris",
+         target_os = "vita",
+         target_os = "cygwin",
++        target_os = "wasi",
+     ))]
+     unsafe {
+         if libc::pipe2(fds.as_mut_ptr(), libc::O_CLOEXEC | libc::O_NONBLOCK) != 0 {
+--- a/src/sys/unix/sourcefd.rs
++++ b/src/sys/unix/sourcefd.rs
+@@ -109,7 +109,7 @@
+         token: Token,
+         interests: Interest,
+     ) -> io::Result<()> {
+-        registry.selector().register(*self.0, token, interests)
++        registry.selector().register(*self.0 as _, token, interests)
+     }
+ 
+     fn reregister(
+@@ -118,10 +118,10 @@
+         token: Token,
+         interests: Interest,
+     ) -> io::Result<()> {
+-        registry.selector().reregister(*self.0, token, interests)
++        registry.selector().reregister(*self.0 as _, token, interests)
+     }
+ 
+     fn deregister(&mut self, registry: &Registry) -> io::Result<()> {
+-        registry.selector().deregister(*self.0)
++        registry.selector().deregister(*self.0 as _)
+     }
+ }
+--- a/src/sys/unix/uds/datagram.rs
++++ b/src/sys/unix/uds/datagram.rs
+@@ -2,8 +2,14 @@
+ use std::os::fd::{AsRawFd, FromRawFd};
+ use std::os::unix::net::{self, SocketAddr};
+ 
++#[cfg(not(target_os = "wasi"))]
+ use crate::sys::unix::net::new_socket;
++#[cfg(target_os = "wasi")]
++use crate::sys::posix_net::new_socket;
++#[cfg(not(target_os = "wasi"))]
+ use crate::sys::unix::uds::unix_addr;
++#[cfg(target_os = "wasi")]
++use crate::sys::uds::unix_addr;
+ 
+ pub(crate) fn bind_addr(address: &SocketAddr) -> io::Result<net::UnixDatagram> {
+     let socket = unbound()?;
+--- a/src/sys/unix/uds/listener.rs
++++ b/src/sys/unix/uds/listener.rs
+@@ -6,8 +6,14 @@
+ use std::{io, mem};
+ 
+ use crate::net::UnixStream;
++#[cfg(not(target_os = "wasi"))]
+ use crate::sys::unix::net::new_socket;
++#[cfg(target_os = "wasi")]
++use crate::sys::posix_net::new_socket;
++#[cfg(not(target_os = "wasi"))]
+ use crate::sys::unix::uds::{path_offset, unix_addr};
++#[cfg(target_os = "wasi")]
++use crate::sys::uds::{path_offset, unix_addr};
+ 
+ pub(crate) fn bind_addr(address: &SocketAddr) -> io::Result<net::UnixListener> {
+     let fd = new_socket(libc::AF_UNIX, libc::SOCK_STREAM)?;
+--- a/src/sys/unix/uds/stream.rs
++++ b/src/sys/unix/uds/stream.rs
+@@ -2,8 +2,14 @@
+ use std::os::fd::FromRawFd;
+ use std::os::unix::net::{self, SocketAddr};
+ 
++#[cfg(not(target_os = "wasi"))]
+ use crate::sys::unix::net::new_socket;
++#[cfg(target_os = "wasi")]
++use crate::sys::posix_net::new_socket;
++#[cfg(not(target_os = "wasi"))]
+ use crate::sys::unix::uds::unix_addr;
++#[cfg(target_os = "wasi")]
++use crate::sys::uds::unix_addr;
+ 
+ pub(crate) fn connect_addr(address: &SocketAddr) -> io::Result<net::UnixStream> {
+     let fd = new_socket(libc::AF_UNIX, libc::SOCK_STREAM)?;
diff --git a/toolchain/std-patches/crates/oauth2/0001-wasip1-send-reqwest-future.patch b/toolchain/std-patches/crates/oauth2/0001-wasip1-send-reqwest-future.patch
index ccc22b1cc5..eaaed2c504 100644
--- a/toolchain/std-patches/crates/oauth2/0001-wasip1-send-reqwest-future.patch
+++ b/toolchain/std-patches/crates/oauth2/0001-wasip1-send-reqwest-future.patch
@@ -1,18 +1,20 @@
 # oauth2 5.0.0 treats every wasm32 target as browser WebAssembly and erases
 # Send/Sync from the reqwest client future. wasm32-wasip1 is a server-style,
 # cooperatively scheduled runtime and rmcp requires its HTTP transport futures
-# to remain Send. Keep the browser exception for target_os="unknown", while
-# using the native Send + Sync contract for WASI.
+# to remain Send. The shim's streaming request body is intentionally not Sync,
+# so keep the browser exception for target_os="unknown" and use Send on WASI.
 --- a/src/reqwest_client.rs
 +++ b/src/reqwest_client.rs
-@@ -6,9 +6,9 @@ impl<'c> AsyncHttpClient<'c> for reqwest::Client {
+@@ -6,9 +6,12 @@ impl<'c> AsyncHttpClient<'c> for reqwest::Client {
      type Error = HttpClientError<reqwest::Error>;
  
 -    #[cfg(target_arch = "wasm32")]
 +    #[cfg(all(target_arch = "wasm32", not(target_os = "wasi")))]
      type Future = Pin<Box<dyn Future<Output = Result<HttpResponse, Self::Error>> + 'c>>;
--    #[cfg(not(target_arch = "wasm32"))]
-+    #[cfg(any(not(target_arch = "wasm32"), target_os = "wasi"))]
++    #[cfg(all(target_arch = "wasm32", target_os = "wasi"))]
++    type Future =
++        Pin<Box<dyn Future<Output = Result<HttpResponse, Self::Error>> + Send + 'c>>;
+     #[cfg(not(target_arch = "wasm32"))]
      type Future =
          Pin<Box<dyn Future<Output = Result<HttpResponse, Self::Error>> + Send + Sync + 'c>>;
  
diff --git a/toolchain/std-patches/crates/rustls-native-certs/0001-agentos-vm-trust-store.patch b/toolchain/std-patches/crates/rustls-native-certs/0001-agentos-vm-trust-store.patch
new file mode 100644
index 0000000000..b4c58d1ef8
--- /dev/null
+++ b/toolchain/std-patches/crates/rustls-native-certs/0001-agentos-vm-trust-store.patch
@@ -0,0 +1,31 @@
+# rustls-native-certs 0.8.3 selects a per-OS `platform` module (unix/windows/macos)
+# for `load_native_certs()` and has no wasm/wasi arm. agentOS provisions the VM's
+# trust store at the conventional Linux path below, so load that real VFS file.
+# This is a target-specific API alias for existing agentOS POSIX behavior, not a
+# stock-WASI capability fallback.
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -43,6 +43,23 @@
+ #[cfg(target_os = "macos")]
+ use macos as platform;
+ 
++// agentOS provisions its VM trust store at this conventional Linux path.
++// wasm32-wasip1 needs only the target-specific rustls-native-certs adapter;
++// file access and certificate validation remain real guest behavior.
++#[cfg(target_os = "wasi")]
++mod platform {
++    use super::{CertPaths, CertificateResult};
++    use std::path::PathBuf;
++
++    pub fn load_native_certs() -> CertificateResult {
++        CertPaths {
++            file: Some(PathBuf::from("/etc/ssl/certs/ca-certificates.crt")),
++            dirs: Vec::new(),
++        }
++        .load()
++    }
++}
++
+ /// Load root certificates found in the platform's native certificate store.
+ ///
+ /// ## Environment Variables
diff --git a/toolchain/std-patches/crates/rustls-native-certs/0001-wasi-empty-certs.patch b/toolchain/std-patches/crates/rustls-native-certs/0001-wasi-empty-certs.patch
deleted file mode 100644
index 388b164735..0000000000
--- a/toolchain/std-patches/crates/rustls-native-certs/0001-wasi-empty-certs.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-# rustls-native-certs 0.8.3 selects a per-OS `platform` module (unix/windows/macos)
-# for `load_native_certs()` and has NO wasm/wasi arm -> on wasm32-wasip1 the
-# `platform` module is undefined and the crate fails to compile (unresolved import
-# in the top-level `load_native_certs`). wasm32-wasip1 has no native OS cert store;
-# TLS is brokered host-side by the agentos VM (host CAs), so the in-guest rustls
-# never validates certificates. Add a `target_os = "wasi"` platform arm that returns
-# an empty CertificateResult so the crate compiles (compile/link-only for codex; the
-# guest never performs cert validation). Pipeline-only codex WASI port.
---- a/src/lib.rs
-+++ b/src/lib.rs
-@@ -43,6 +43,17 @@
- #[cfg(target_os = "macos")]
- use macos as platform;
-
-+// wasm32-wasip1: no native OS cert store. TLS is brokered host-side by the
-+// agentos VM (host CAs), so the in-guest rustls never validates certificates.
-+// Provide an empty native-cert loader so the crate compiles.
-+#[cfg(target_os = "wasi")]
-+mod platform {
-+    use super::CertificateResult;
-+    pub fn load_native_certs() -> CertificateResult {
-+        CertificateResult::default()
-+    }
-+}
-+
- /// Load root certificates found in the platform's native certificate store.
- ///
- /// ## Environment Variables
diff --git a/toolchain/std-patches/crates/socket2/0001-wasip1.patch b/toolchain/std-patches/crates/socket2/0001-wasip1.patch
index d518cd635b..aa92d3c491 100644
--- a/toolchain/std-patches/crates/socket2/0001-wasip1.patch
+++ b/toolchain/std-patches/crates/socket2/0001-wasip1.patch
@@ -1,10 +1,18 @@
-# socket2 0.6.x excludes wasm32-wasip1 (`not(target_env = "p1")`) → "doesn't support
-# the compile target". Include p1 so it routes to sys/unix.rs (the patched wasi-libc
-# host_net provides the socket fns; codex's HTTP uses wasi-http, so socket2 only needs
-# to COMPILE as a transitive dep of tokio::net/mio/reqwest). Pipeline-only codex port.
 --- a/src/lib.rs
 +++ b/src/lib.rs
-@@
+@@ -109,7 +109,7 @@
+     ($from: ty, $for: ty) => {
+         impl From<$from> for $for {
+             fn from(socket: $from) -> $for {
+-                #[cfg(any(unix, all(target_os = "wasi", not(target_env = "p1"))))]
++                #[cfg(any(unix, target_os = "wasi"))]
+                 unsafe {
+                     <$for>::from_raw_fd(socket.into_raw_fd())
+                 }
+@@ -176,14 +176,11 @@
+ mod socket;
+ mod sockref;
+ 
 -#[cfg_attr(
 -    any(unix, all(target_os = "wasi", not(target_env = "p1"))),
 -    path = "sys/unix.rs"
@@ -16,5 +24,157 @@
 -#[cfg(not(any(windows, unix, all(target_os = "wasi", not(target_env = "p1")))))]
 +#[cfg(not(any(windows, unix, target_os = "wasi")))]
  compile_error!("Socket2 doesn't support the compile target");
-# NOTE: verify sys/unix.rs compiles on wasip1 (some fns may need stubbing if wasi-libc
-# lacks them); if so, add a sys/wasi.rs stub instead. socket2 is compile-only for codex.
+ 
+ use sys::c_int;
+@@ -528,7 +525,7 @@
+         target_os = "watchos",
+         target_os = "windows",
+         target_os = "cygwin",
+-        all(target_os = "wasi", not(target_env = "p1")),
++        target_os = "wasi",
+     ))]
+     pub const fn with_interval(self, interval: Duration) -> Self {
+         Self {
+@@ -558,7 +555,7 @@
+             target_os = "watchos",
+             target_os = "cygwin",
+             target_os = "windows",
+-            all(target_os = "wasi", not(target_env = "p1")),
++            target_os = "wasi",
+         )
+     ))]
+     pub const fn with_retries(self, retries: u32) -> Self {
+--- a/src/socket.rs
++++ b/src/socket.rs
+@@ -14,7 +14,7 @@
+ #[cfg(not(target_os = "nto"))]
+ use std::net::Ipv6Addr;
+ use std::net::{self, Ipv4Addr, Shutdown};
+-#[cfg(any(unix, all(target_os = "wasi", not(target_env = "p1"))))]
++#[cfg(any(unix, target_os = "wasi"))]
+ use std::os::fd::{FromRawFd, IntoRawFd};
+ #[cfg(windows)]
+ use std::os::windows::io::{FromRawSocket, IntoRawSocket};
+@@ -220,7 +220,7 @@
+         match res {
+             Ok(()) => return Ok(()),
+             Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => {}
+-            #[cfg(any(unix, all(target_os = "wasi", not(target_env = "p1"))))]
++            #[cfg(any(unix, target_os = "wasi"))]
+             Err(ref e) if e.raw_os_error() == Some(libc::EINPROGRESS) => {}
+             Err(e) => return Err(e),
+         }
+@@ -367,7 +367,7 @@
+     /// On Windows it is not possible retrieve the nonblocking mode status.
+     #[cfg(all(
+         feature = "all",
+-        any(unix, all(target_os = "wasi", not(target_env = "p1")))
++        any(unix, target_os = "wasi")
+     ))]
+     pub fn nonblocking(&self) -> io::Result<bool> {
+         sys::nonblocking(self.as_raw())
+@@ -2241,7 +2241,7 @@
+             target_os = "tvos",
+             target_os = "watchos",
+             target_os = "cygwin",
+-            all(target_os = "wasi", not(target_env = "p1")),
++            target_os = "wasi",
+         )
+     ))]
+     pub fn tcp_keepalive_interval(&self) -> io::Result<Duration> {
+@@ -2273,7 +2273,7 @@
+             target_os = "watchos",
+             target_os = "cygwin",
+             target_os = "windows",
+-            all(target_os = "wasi", not(target_env = "p1")),
++            target_os = "wasi",
+         )
+     ))]
+     pub fn tcp_keepalive_retries(&self) -> io::Result<u32> {
+--- a/src/sockaddr.rs
++++ b/src/sockaddr.rs
+@@ -298,7 +298,7 @@
+                 ip,
+                 port,
+                 addr.sin6_flowinfo,
+-                #[cfg(any(unix, all(target_os = "wasi", not(target_env = "p1"))))]
++                #[cfg(any(unix, target_os = "wasi"))]
+                 addr.sin6_scope_id,
+                 #[cfg(windows)]
+                 unsafe {
+@@ -393,7 +393,7 @@
+             storage.sin6_port = addr.port().to_be();
+             storage.sin6_addr = crate::sys::to_in6_addr(addr.ip());
+             storage.sin6_flowinfo = addr.flowinfo();
+-            #[cfg(any(unix, all(target_os = "wasi", not(target_env = "p1"))))]
++            #[cfg(any(unix, target_os = "wasi"))]
+             {
+                 storage.sin6_scope_id = addr.scope_id();
+             }
+--- a/src/sockref.rs
++++ b/src/sockref.rs
+@@ -2,7 +2,7 @@
+ use std::marker::PhantomData;
+ use std::mem::ManuallyDrop;
+ use std::ops::Deref;
+-#[cfg(any(unix, all(target_os = "wasi", not(target_env = "p1"))))]
++#[cfg(any(unix, target_os = "wasi"))]
+ use std::os::fd::{AsFd, AsRawFd, FromRawFd};
+ #[cfg(windows)]
+ use std::os::windows::io::{AsRawSocket, AsSocket, FromRawSocket};
+@@ -77,7 +77,7 @@
+ }
+ 
+ /// On Windows, a corresponding `From<&impl AsSocket>` implementation exists.
+-#[cfg(any(unix, all(target_os = "wasi", not(target_env = "p1"))))]
++#[cfg(any(unix, target_os = "wasi"))]
+ impl<'s, S> From<&'s S> for SockRef<'s>
+ where
+     S: AsFd,
+--- a/src/sys/unix.rs
++++ b/src/sys/unix.rs
+@@ -267,7 +267,7 @@
+     target_os = "solaris",
+     target_os = "tvos",
+     target_os = "watchos",
+-    all(target_os = "wasi", not(target_env = "p1")),
++    target_os = "wasi",
+ ))]
+ pub(crate) use libc::{
+     IPV6_JOIN_GROUP as IPV6_ADD_MEMBERSHIP, IPV6_LEAVE_GROUP as IPV6_DROP_MEMBERSHIP,
+@@ -290,7 +290,7 @@
+         target_os = "tvos",
+         target_os = "watchos",
+         target_os = "cygwin",
+-        all(target_os = "wasi", not(target_env = "p1")),
++        target_os = "wasi",
+     )
+ ))]
+ pub(crate) use libc::{TCP_KEEPCNT, TCP_KEEPINTVL};
+@@ -451,7 +451,7 @@
+             target_os = "netbsd",
+             target_os = "openbsd",
+             target_os = "cygwin",
+-            all(target_os = "wasi", not(target_env = "p1")),
++            target_os = "wasi",
+         )
+     ))]
+     pub const fn nonblocking(self) -> Type {
+@@ -1001,7 +1001,7 @@
+ 
+ #[cfg(all(
+     feature = "all",
+-    any(unix, all(target_os = "wasi", not(target_env = "p1"))),
++    any(unix, target_os = "wasi"),
+     not(target_os = "vita")
+ ))]
+ pub(crate) fn nonblocking(fd: RawSocket) -> io::Result<bool> {
+@@ -1262,7 +1262,7 @@
+         target_os = "tvos",
+         target_os = "watchos",
+         target_os = "cygwin",
+-        all(target_os = "wasi", not(target_env = "p1")),
++        target_os = "wasi",
+     ))]
+     {
+         if let Some(interval) = keepalive.interval {
diff --git a/toolchain/std-patches/crates/socket2/0002-agentos-wasip1-unix-sockets.patch b/toolchain/std-patches/crates/socket2/0002-agentos-wasip1-unix-sockets.patch
new file mode 100644
index 0000000000..c74e65c77d
--- /dev/null
+++ b/toolchain/std-patches/crates/socket2/0002-agentos-wasip1-unix-sockets.patch
@@ -0,0 +1,118 @@
+Expose socket2's Unix-domain address constructors through agentOS's real
+AF_UNIX and sockaddr_un libc ABI. This removes API-name gates only; no socket
+behavior is emulated in the crate.
+
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -55,6 +55,7 @@
+ #![deny(missing_docs, missing_debug_implementations, rust_2018_idioms)]
+ // Automatically generate required OS/features for docs.rs.
+ #![cfg_attr(docsrs, feature(doc_cfg))]
++#![cfg_attr(target_os = "wasi", feature(wasi_ext))]
+ // Disallow warnings when running tests.
+ #![cfg_attr(test, deny(warnings))]
+ // Disallow warnings in examples.
+@@ -222,7 +223,6 @@
+     pub const IPV6: Domain = Domain(sys::AF_INET6);
+ 
+     /// Domain for Unix socket communication, corresponding to `AF_UNIX`.
+-    #[cfg(not(target_os = "wasi"))]
+     pub const UNIX: Domain = Domain(sys::AF_UNIX);
+ 
+     /// Returns the correct domain for `address`.
+--- a/src/sockaddr.rs
++++ b/src/sockaddr.rs
+@@ -1,14 +1,12 @@
+ use std::hash::Hash;
+ use std::mem::{self, size_of};
+ use std::net::{SocketAddr, SocketAddrV4, SocketAddrV6};
+-#[cfg(not(target_os = "wasi"))]
+ use std::path::Path;
+ use std::{fmt, io, ptr};
+ 
+ #[cfg(windows)]
+ use windows_sys::Win32::Networking::WinSock::SOCKADDR_IN6_0;
+ 
+-#[cfg(not(target_os = "wasi"))]
+ use crate::sys::AF_UNIX;
+ use crate::sys::{c_int, sockaddr_in, sockaddr_in6, sockaddr_storage, AF_INET, AF_INET6};
+ use crate::Domain;
+@@ -215,7 +213,6 @@
+     /// Constructs a `SockAddr` with the family `AF_UNIX` and the provided path.
+     ///
+     /// Returns an error if the path is longer than `SUN_LEN`.
+-    #[cfg(not(target_os = "wasi"))]
+     pub fn unix<P>(path: P) -> io::Result<SockAddr>
+     where
+         P: AsRef<Path>,
+@@ -273,7 +270,6 @@
+ 
+     /// Returns true if this address is of a unix socket (for local interprocess communication),
+     /// i.e. it is from the `AF_UNIX` family, false otherwise.
+-    #[cfg(not(target_os = "wasi"))]
+     pub fn is_unix(&self) -> bool {
+         self.storage.ss_family == AF_UNIX as sa_family_t
+     }
+--- a/src/sys/unix.rs
++++ b/src/sys/unix.rs
+@@ -7,7 +7,6 @@
+ // except according to those terms.
+ 
+ use std::cmp::min;
+-#[cfg(not(target_os = "wasi"))]
+ use std::ffi::OsStr;
+ #[cfg(not(any(target_os = "redox", target_os = "wasi")))]
+ use std::io::IoSlice;
+@@ -46,11 +45,9 @@
+ ))]
+ use std::num::NonZeroUsize;
+ use std::os::fd::{AsFd, AsRawFd, BorrowedFd, FromRawFd, IntoRawFd, OwnedFd, RawFd};
+-#[cfg(not(target_os = "wasi"))]
+ use std::os::unix::ffi::OsStrExt;
+ #[cfg(all(feature = "all", unix))]
+ use std::os::unix::net::{UnixDatagram, UnixListener, UnixStream};
+-#[cfg(not(target_os = "wasi"))]
+ use std::path::Path;
+ use std::ptr;
+ use std::time::{Duration, Instant};
+@@ -67,7 +64,6 @@
+ use libc::ssize_t;
+ use libc::{in6_addr, in_addr};
+ 
+-#[cfg(not(target_os = "wasi"))]
+ use crate::SockAddrStorage;
+ use crate::{Domain, Protocol, SockAddr, TcpKeepalive, Type};
+ #[cfg(not(any(target_os = "redox", target_os = "wasi")))]
+@@ -76,7 +72,6 @@
+ pub(crate) use std::ffi::c_int;
+ 
+ // Used in `Domain`.
+-#[cfg(not(target_os = "wasi"))]
+ pub(crate) use libc::AF_UNIX;
+ pub(crate) use libc::{AF_INET, AF_INET6};
+ // Used in `Type`.
+@@ -673,14 +668,12 @@
+ }
+ 
+ /// Returns the offset of the `sun_path` member of the passed unix socket address.
+-#[cfg(not(target_os = "wasi"))]
+ pub(crate) fn offset_of_path(storage: &libc::sockaddr_un) -> usize {
+     let base = storage as *const _ as usize;
+     let path = ptr::addr_of!(storage.sun_path) as usize;
+     path - base
+ }
+ 
+-#[cfg(not(target_os = "wasi"))]
+ #[allow(unsafe_op_in_unsafe_fn)]
+ pub(crate) fn unix_sockaddr(path: &Path) -> io::Result<SockAddr> {
+     let mut storage = SockAddrStorage::zeroed();
+@@ -800,8 +793,7 @@
+     }
+ }
+ 
+-/// Unix only API (not available on WASI).
+-#[cfg(not(target_os = "wasi"))]
++/// Unix only API.
+ impl SockAddr {
+     /// Returns true if this address is an unnamed address from the `AF_UNIX` family (for local
+     /// interprocess communication), false otherwise.
diff --git a/toolchain/std-patches/crates/tokio/0002-agentos-wasip1-posix-net.patch b/toolchain/std-patches/crates/tokio/0002-agentos-wasip1-posix-net.patch
new file mode 100644
index 0000000000..75ce814d99
--- /dev/null
+++ b/toolchain/std-patches/crates/tokio/0002-agentos-wasip1-posix-net.patch
@@ -0,0 +1,49 @@
+Expose Tokio's normal evented networking surface on agentOS. Mio remains on its
+WASIp1 poll_oneoff backend, while its socket constructors use the real agentOS
+libc/host_net implementation; therefore the stock-WASI API exclusion is not a
+valid capability test here.
+
+--- a/src/macros/cfg.rs
++++ b/src/macros/cfg.rs
+@@ -374,7 +374,7 @@ macro_rules! cfg_net_unix {
+     ($($item:item)*) => {
+         $(
+-            #[cfg(all(unix, feature = "net"))]
+-            #[cfg_attr(docsrs, doc(cfg(all(unix, feature = "net"))))]
++            #[cfg(all(any(unix, target_os = "wasi"), feature = "net"))]
++            #[cfg_attr(docsrs, doc(cfg(all(any(unix, target_os = "wasi"), feature = "net"))))]
+             $item
+         )*
+     }
+@@ -704,12 +704,7 @@
+ }
+ 
+ macro_rules! cfg_not_wasip1 {
+-    ($($item:item)*) => {
+-        $(
+-            #[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+-            $item
+-        )*
+-    }
++    ($($item:item)*) => { $($item)* }
+ }
+ 
+ macro_rules! cfg_is_wasm_not_wasi {
+--- a/src/runtime/io/registration.rs
++++ b/src/runtime/io/registration.rs
+@@ -119,7 +119,6 @@ impl Registration {
+ 
+     // Uses the poll path, requiring the caller to ensure mutual exclusion for
+     // correctness. Only the last task to call this function is notified.
+-    #[cfg(not(all(target_os = "wasi", target_env = "p1")))]
+     pub(crate) fn poll_read_io<R>(
+         &self,
+         cx: &mut Context<'_>,
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -913,4 +913,4 @@
+-[target.'cfg(any(not(target_family = "wasm"), all(target_os = "wasi", not(target_env = "p1"))))'.dependencies.socket2]
++[target.'cfg(any(not(target_family = "wasm"), target_os = "wasi"))'.dependencies.socket2]
+ version = "0.6.3"
+ features = ["all"]
+ optional = true
diff --git a/toolchain/std-patches/crates/tokio/0002-wasi-net-stubs.patch b/toolchain/std-patches/crates/tokio/0002-wasi-net-stubs.patch
deleted file mode 100644
index 6ad28735a4..0000000000
--- a/toolchain/std-patches/crates/tokio/0002-wasi-net-stubs.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-# tokio 1.52.3 gates outbound/listener socket constructors (`TcpStream::connect`,
-# `TcpListener::bind`) behind the readiness reactor, which wasm32-wasip1 lacks.
-# tokio-tungstenite (rmcp's websocket transport) and codex-exec-server reference
-# these at COMPILE time even though codex never takes those paths in the VM (it
-# forces the HTTP transport; networking is host-brokered). Without these arms the
-# wasm build fails E0599 "no function `connect`/`bind`". Add compile-only wasi stubs
-# that error at runtime. Companion of 0001-tokio-wasi-process.patch; both reproduce
-# the fork's vendored tokio-wasi. Pipeline-only codex WASI port.
---- a/src/net/tcp/stream.rs	2006-07-23 18:21:28.000000000 -0700
-+++ b/src/net/tcp/stream.rs	2026-06-23 06:09:30.466512017 -0700
-@@ -1581,3 +1581,18 @@
-         }
-     }
- }
-+
-+// wasm32-wasip1: `connect` lives in `cfg_not_wasip1!` because there is no readiness
-+// reactor for outbound sockets. tokio-tungstenite references `TcpStream::connect` at
-+// compile time; codex never takes the websocket connect path in the VM (it forces the
-+// HTTP fallback), so a compile-only stub that errors at runtime is sufficient.
-+#[cfg(target_os = "wasi")]
-+impl TcpStream {
-+    pub async fn connect<A: crate::net::ToSocketAddrs>(_addr: A) -> std::io::Result<TcpStream> {
-+        Err(std::io::Error::new(
-+            std::io::ErrorKind::Unsupported,
-+            "tokio::net::TcpStream::connect is unsupported on wasm32-wasip1 \
-+             (host-brokered networking; use the HTTP transport)",
-+        ))
-+    }
-+}
---- a/src/net/tcp/listener.rs	2006-07-23 18:21:28.000000000 -0700
-+++ b/src/net/tcp/listener.rs	2026-06-23 06:31:35.275303405 -0700
-@@ -458,3 +458,15 @@
-         }
-     }
- }
-+
-+// wasm32-wasip1: outbound/listener sockets have no readiness reactor; codex-exec-server
-+// references TcpListener::bind at compile time but is not on the VM session-turn path.
-+#[cfg(target_os = "wasi")]
-+impl TcpListener {
-+    pub async fn bind<A: crate::net::ToSocketAddrs>(_addr: A) -> std::io::Result<TcpListener> {
-+        Err(std::io::Error::new(
-+            std::io::ErrorKind::Unsupported,
-+            "tokio::net::TcpListener::bind is unsupported on wasm32-wasip1",
-+        ))
-+    }
-+}
diff --git a/toolchain/std-patches/crates/tokio/0003-agentos-wasip1-unix-sockets.patch b/toolchain/std-patches/crates/tokio/0003-agentos-wasip1-unix-sockets.patch
new file mode 100644
index 0000000000..a6b442a85d
--- /dev/null
+++ b/toolchain/std-patches/crates/tokio/0003-agentos-wasip1-unix-sockets.patch
@@ -0,0 +1,39 @@
+Expose Tokio's Unix-domain socket API through agentOS's real Unix socket
+implementation. SO_PEERCRED is a Linux-specific extension rather than POSIX,
+so its target-specific API name remains absent until agentOS adds that option.
+
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -19,6 +19,7 @@
+ // Do not show "Available on non-loom only" label
+ #![cfg_attr(docsrs, doc(auto_cfg(hide(loom))))]
+ #![cfg_attr(docsrs, feature(doc_cfg))]
++#![cfg_attr(target_os = "wasi", feature(wasi_ext))]
+ #![cfg_attr(docsrs, allow(unused_attributes))]
+ #![cfg_attr(loom, allow(dead_code, unreachable_pub))]
+ #![cfg_attr(windows, allow(rustdoc::broken_intra_doc_links))]
+--- a/src/net/unix/mod.rs
++++ b/src/net/unix/mod.rs
+@@ -21,7 +21,9 @@
+ pub(crate) mod stream;
+ pub(crate) use stream::UnixStream;
+ 
++#[cfg(not(target_os = "wasi"))]
+ mod ucred;
++#[cfg(not(target_os = "wasi"))]
+ pub use ucred::UCred;
+ 
+ pub mod pipe;
+--- a/src/net/unix/stream.rs
++++ b/src/net/unix/stream.rs
+@@ -4,1 +4,2 @@
++#[cfg(not(target_os = "wasi"))]
+ use crate::net::unix::ucred::{self, UCred};
+@@ -964,6 +965,7 @@
+     }
+ 
+     /// Returns effective credentials of the process which called `connect` or `pair`.
++    #[cfg(not(target_os = "wasi"))]
+     pub fn peer_cred(&self) -> io::Result<UCred> {
+         ucred::get_peer_cred(self)
+     }
diff --git a/toolchain/std-patches/wasi-libc/0011-sigaction.patch b/toolchain/std-patches/wasi-libc/0011-sigaction.patch
index e57024b23d..09eba9c516 100644
--- a/toolchain/std-patches/wasi-libc/0011-sigaction.patch
+++ b/toolchain/std-patches/wasi-libc/0011-sigaction.patch
@@ -242,20 +242,30 @@ index 9bf8833..6830b5b 100644
  #ifdef __cplusplus
  extern "C" {
  #endif
-@@ -16,10 +16,12 @@ extern "C" {
-  || defined(_BSD_SOURCE)
+@@ -13,15 +13,17 @@ extern "C" {
  
- #ifndef __wasilibc_unmodified_upstream
--// Ensure pid_t is available for kill() declaration below.
--// The upstream __NEED_pid_t is inside the ifdef'd-out block.
- #define __NEED_pid_t
+ #include <features.h>
+ 
++#ifndef __wasilibc_unmodified_upstream
++#define __NEED_pid_t
 +#define __NEED_sigset_t
- #include <bits/alltypes.h>
++#include <bits/alltypes.h>
 +#define SIG_BLOCK     0
 +#define SIG_UNBLOCK   1
 +#define SIG_SETMASK   2
- #endif
++#endif
++
+ #if defined(_POSIX_SOURCE) || defined(_POSIX_C_SOURCE) \
+  || defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) \
+  || defined(_BSD_SOURCE)
  
+-#ifndef __wasilibc_unmodified_upstream
+-// Ensure pid_t is available for kill() declaration below.
+-// The upstream __NEED_pid_t is inside the ifdef'd-out block.
+-#define __NEED_pid_t
+-#include <bits/alltypes.h>
+-#endif
+-
  #ifdef __wasilibc_unmodified_upstream /* WASI has no ucontext/sigaction */
 @@ -60,6 +62,36 @@ typedef struct sigaltstack stack_t;
  
diff --git a/toolchain/std-patches/wasi-libc/0018-posix-spawn-and-terminal-headers.patch b/toolchain/std-patches/wasi-libc/0018-posix-spawn-and-terminal-headers.patch
index a792103b40..979a6ee414 100644
--- a/toolchain/std-patches/wasi-libc/0018-posix-spawn-and-terminal-headers.patch
+++ b/toolchain/std-patches/wasi-libc/0018-posix-spawn-and-terminal-headers.patch
@@ -38,6 +38,8 @@ index 0000000..3b70693
 +
 +WASM_IMPORT("host_tty", "get_size")
 +uint32_t __host_tty_get_size(uint32_t fd, unsigned short *cols, unsigned short *rows);
++WASM_IMPORT("host_tty", "set_size")
++uint32_t __host_tty_set_size(uint32_t fd, unsigned short cols, unsigned short rows);
 +
 +WASM_IMPORT("host_tty", "set_raw_mode")
 +uint32_t __host_tty_set_raw_mode(uint32_t enabled);
@@ -161,10 +163,16 @@ index 0000000..3b70693
 +}
 +
 +int tcsetwinsize(int fd, const struct winsize *ws) {
-+    (void)fd;
-+    (void)ws;
-+    errno = ENOSYS;
-+    return -1;
++    if (ws == NULL) {
++        errno = EFAULT;
++        return -1;
++    }
++    uint32_t rc = __host_tty_set_size((uint32_t)fd, ws->ws_col, ws->ws_row);
++    if (rc != 0) {
++        errno = (int)rc;
++        return -1;
++    }
++    return 0;
 +}
 +
 +void cfmakeraw(struct termios *t) {
diff --git a/toolchain/std-patches/wasi-libc/0047-extensions-feature-alias.patch b/toolchain/std-patches/wasi-libc/0047-extensions-feature-alias.patch
new file mode 100644
index 0000000000..5bd2df5944
--- /dev/null
+++ b/toolchain/std-patches/wasi-libc/0047-extensions-feature-alias.patch
@@ -0,0 +1,16 @@
+Expose the owned POSIX surface to C projects that request the conventional
+__EXTENSIONS__ feature set. AWS-LC uses this spelling with strict C11; treating
+it like musl's _ALL_SOURCE selects declarations for real agentOS operations
+rather than requiring an application-specific source patch.
+
+--- a/libc-top-half/musl/include/features.h
++++ b/libc-top-half/musl/include/features.h
+@@ -1,7 +1,7 @@
+ #ifndef _FEATURES_H
+ #define _FEATURES_H
+ 
+-#if defined(_ALL_SOURCE) && !defined(_GNU_SOURCE)
++#if (defined(_ALL_SOURCE) || defined(__EXTENSIONS__)) && !defined(_GNU_SOURCE)
+ #define _GNU_SOURCE 1
+ #endif
+ 
diff --git a/toolchain/stubs/portable-pty-wasi/Cargo.toml b/toolchain/stubs/portable-pty-wasi/Cargo.toml
index 20280e983b..134a07ada9 100644
--- a/toolchain/stubs/portable-pty-wasi/Cargo.toml
+++ b/toolchain/stubs/portable-pty-wasi/Cargo.toml
@@ -20,7 +20,7 @@ autobins = false
 autoexamples = false
 autotests = false
 autobenches = false
-description = "Cross platform pty interface"
+description = "portable-pty API backed by agentOS POSIX PTY and process host imports"
 documentation = "https://docs.rs/portable-pty"
 readme = false
 license = "MIT"
@@ -50,6 +50,9 @@ path = "examples/whoami_async.rs"
 [dependencies.anyhow]
 version = "1.0"
 
+[dependencies.wasi-ext]
+path = "../../crates/wasi-ext"
+
 [dependencies.downcast-rs]
 version = "1.0"
 
diff --git a/toolchain/stubs/portable-pty-wasi/src/cmdbuilder.rs b/toolchain/stubs/portable-pty-wasi/src/cmdbuilder.rs
index b4ce50a853..76b864ed33 100644
--- a/toolchain/stubs/portable-pty-wasi/src/cmdbuilder.rs
+++ b/toolchain/stubs/portable-pty-wasi/src/cmdbuilder.rs
@@ -8,6 +8,7 @@ use std::ffi::{OsStr, OsString};
 use std::os::windows::ffi::OsStrExt;
 #[cfg(unix)]
 use std::path::Component;
+#[cfg(unix)]
 use std::path::Path;
 
 /// Used to deal with Windows having case-insensitive environment variables.
@@ -72,6 +73,7 @@ fn get_shell() -> String {
 }
 
 fn get_base_env() -> BTreeMap<OsString, EnvEntry> {
+    #[allow(unused_mut)]
     let mut env: BTreeMap<OsString, EnvEntry> = std::env::vars_os()
         .map(|(key, value)| {
             (
@@ -389,6 +391,18 @@ impl CommandBuilder {
         )
     }
 
+    /// Iterate over the complete environment without discarding non-UTF-8
+    /// values. The agentOS process ABI accepts byte strings, just like POSIX.
+    pub(crate) fn iter_full_env(&self) -> impl Iterator<Item = (&OsStr, &OsStr)> {
+        self.envs.values().map(
+            |EnvEntry {
+                 preferred_key,
+                 value,
+                 ..
+             }| (preferred_key.as_os_str(), value.as_os_str()),
+        )
+    }
+
     /// Return the configured command and arguments as a single string,
     /// quoted per the unix shell conventions.
     pub fn as_unix_command_line(&self) -> anyhow::Result<String> {
diff --git a/toolchain/stubs/portable-pty-wasi/src/lib.rs b/toolchain/stubs/portable-pty-wasi/src/lib.rs
index 24e32aa498..568f3d088c 100644
--- a/toolchain/stubs/portable-pty-wasi/src/lib.rs
+++ b/toolchain/stubs/portable-pty-wasi/src/lib.rs
@@ -340,6 +340,25 @@ impl ChildKiller for ProcessSignaller {
     }
 }
 
+#[cfg(target_os = "wasi")]
+impl ChildKiller for ProcessSignaller {
+    fn kill(&mut self) -> IoResult<()> {
+        if let Some(pid) = self.pid {
+            wasi_ext::kill(pid, 1).map_err(|errno| {
+                std::io::Error::new(
+                    std::io::ErrorKind::Other,
+                    format!("SIGHUP delivery failed with WASI errno {errno}"),
+                )
+            })?;
+        }
+        Ok(())
+    }
+
+    fn clone_killer(&self) -> Box<dyn ChildKiller + Send + Sync> {
+        Box::new(Self { pid: self.pid })
+    }
+}
+
 impl ChildKiller for std::process::Child {
     fn kill(&mut self) -> IoResult<()> {
         #[cfg(unix)]
@@ -401,7 +420,9 @@ impl ChildKiller for std::process::Child {
 
     #[cfg(target_os = "wasi")]
     fn clone_killer(&self) -> Box<dyn ChildKiller + Send + Sync> {
-        Box::new(crate::wasi::WasiChild)
+        Box::new(ProcessSignaller {
+            pid: self.process_id(),
+        })
     }
 }
 
diff --git a/toolchain/stubs/portable-pty-wasi/src/wasi.rs b/toolchain/stubs/portable-pty-wasi/src/wasi.rs
index f44cf80651..2e47847138 100644
--- a/toolchain/stubs/portable-pty-wasi/src/wasi.rs
+++ b/toolchain/stubs/portable-pty-wasi/src/wasi.rs
@@ -1,75 +1,291 @@
-//! wasm32-wasip1 backend stub for portable-pty.
+//! agentOS POSIX backend for `portable-pty`.
 //!
-//! The agentos VM brokers process execution via wasi-spawn/wasi-pty; a full
-//! PTY bridge is future work. This backend lets portable-pty (and thus
-//! codex-utils-pty / codex-core) COMPILE for wasip1. PTY operations return an
-//! Unsupported error at runtime (codex's exec falls back to non-PTY execution).
+//! Rust names the guest target `wasm32-wasip1`, but agentOS provides real PTY,
+//! process, descriptor, terminal-size, wait, and signal operations. This module
+//! only exposes those existing operations through the `portable-pty` traits.
+
+use std::ffi::OsStr;
+use std::fs::File;
 use std::io::{Read, Result as IoResult, Write};
+use std::os::fd::FromRawFd;
+use std::sync::Arc;
 
-use anyhow::{bail, Error};
+use anyhow::{anyhow, bail, Context, Error};
 
 use crate::{Child, ChildKiller, ExitStatus, MasterPty, PtyPair, PtySize, PtySystem, SlavePty};
 
+const MAX_ITEMS: usize = 4_096;
+const MAX_SERIALIZED_BYTES: usize = 1024 * 1024;
+const WNOHANG: u32 = 1;
+const SIGHUP: u32 = 1;
+
+#[link(wasm_import_module = "host_tty")]
+extern "C" {
+    #[link_name = "get_size"]
+    fn host_tty_get_size(fd: u32, cols: *mut u16, rows: *mut u16) -> u32;
+    #[link_name = "set_size"]
+    fn host_tty_set_size(fd: u32, cols: u16, rows: u16) -> u32;
+}
+
+fn errno_error(operation: &str, errno: wasi_ext::Errno) -> std::io::Error {
+    std::io::Error::new(
+        std::io::ErrorKind::Other,
+        format!("{operation} failed with WASI errno {errno}"),
+    )
+}
+
+fn close_fd(fd: u32) {
+    // SAFETY: each caller transfers one owned descriptor into this File.
+    drop(unsafe { File::from_raw_fd(fd as i32) });
+}
+
+fn dup_file(fd: u32) -> IoResult<File> {
+    let duplicate = wasi_ext::dup(fd).map_err(|errno| errno_error("dup", errno))?;
+    // SAFETY: dup returned a new owned descriptor.
+    Ok(unsafe { File::from_raw_fd(duplicate as i32) })
+}
+
+fn set_size(fd: u32, size: PtySize) -> IoResult<()> {
+    // SAFETY: host_tty is the agentOS kernel PTY bridge and accepts scalar values.
+    let errno = unsafe { host_tty_set_size(fd, size.cols, size.rows) };
+    if errno == 0 {
+        Ok(())
+    } else {
+        Err(errno_error("set PTY size", errno))
+    }
+}
+
+fn get_size(fd: u32) -> IoResult<PtySize> {
+    let mut cols = 0;
+    let mut rows = 0;
+    // SAFETY: cols and rows are valid writable u16 pointers for the duration of the call.
+    let errno = unsafe { host_tty_get_size(fd, &mut cols, &mut rows) };
+    if errno != 0 {
+        return Err(errno_error("get PTY size", errno));
+    }
+    Ok(PtySize {
+        rows,
+        cols,
+        pixel_width: 0,
+        pixel_height: 0,
+    })
+}
+
+fn push_item(buffer: &mut Vec<u8>, item: &[u8], label: &str) -> anyhow::Result<()> {
+    if item.contains(&0) {
+        bail!("{label} contains NUL");
+    }
+    let separator = usize::from(!buffer.is_empty());
+    let next_len = buffer
+        .len()
+        .checked_add(separator)
+        .and_then(|length| length.checked_add(item.len()))
+        .ok_or_else(|| anyhow!("serialized {label} length overflowed"))?;
+    if next_len > MAX_SERIALIZED_BYTES {
+        bail!("serialized process data exceeds {MAX_SERIALIZED_BYTES} bytes");
+    }
+    if separator != 0 {
+        buffer.push(0);
+    }
+    buffer.extend_from_slice(item);
+    Ok(())
+}
+
+fn os_bytes(value: &OsStr) -> &[u8] {
+    value.as_encoded_bytes()
+}
+
 #[derive(Default)]
 pub struct WasiPtySystem;
 
 impl PtySystem for WasiPtySystem {
-    fn openpty(&self, _size: PtySize) -> anyhow::Result<PtyPair> {
+    fn openpty(&self, size: PtySize) -> anyhow::Result<PtyPair> {
+        let (master_fd, slave_fd) =
+            wasi_ext::openpty().map_err(|errno| errno_error("openpty", errno))?;
+        if let Err(error) = set_size(master_fd, size) {
+            close_fd(slave_fd);
+            close_fd(master_fd);
+            return Err(error.into());
+        }
         Ok(PtyPair {
-            slave: Box::new(WasiSlave),
-            master: Box::new(WasiMaster),
+            slave: Box::new(WasiSlave { fd: slave_fd }),
+            master: Box::new(WasiMaster { fd: master_fd }),
         })
     }
 }
 
-struct WasiMaster;
+struct WasiMaster {
+    fd: u32,
+}
+
+impl Drop for WasiMaster {
+    fn drop(&mut self) {
+        close_fd(self.fd);
+    }
+}
 
 impl MasterPty for WasiMaster {
-    fn resize(&self, _size: PtySize) -> Result<(), Error> {
-        Ok(())
+    fn resize(&self, size: PtySize) -> Result<(), Error> {
+        set_size(self.fd, size).context("failed to resize agentOS PTY")
     }
+
     fn get_size(&self) -> Result<PtySize, Error> {
-        Ok(PtySize::default())
+        get_size(self.fd).context("failed to read agentOS PTY size")
     }
+
     fn try_clone_reader(&self) -> Result<Box<dyn Read + Send>, Error> {
-        bail!("PTY reader unsupported on wasm32-wasip1")
+        Ok(Box::new(dup_file(self.fd)?))
     }
+
     fn take_writer(&self) -> Result<Box<dyn Write + Send>, Error> {
-        bail!("PTY writer unsupported on wasm32-wasip1")
+        Ok(Box::new(dup_file(self.fd)?))
     }
 }
 
-struct WasiSlave;
+struct WasiSlave {
+    fd: u32,
+}
+
+impl Drop for WasiSlave {
+    fn drop(&mut self) {
+        close_fd(self.fd);
+    }
+}
 
 impl SlavePty for WasiSlave {
     fn spawn_command(
         &self,
-        _cmd: crate::CommandBuilder,
+        command: crate::CommandBuilder,
     ) -> Result<Box<dyn Child + Send + Sync>, Error> {
-        bail!("PTY spawn unsupported on wasm32-wasip1 (use non-PTY exec)")
+        let default_shell = OsStr::new("/bin/sh");
+        let argv: Vec<&OsStr> = if command.is_default_prog() {
+            vec![default_shell]
+        } else {
+            command
+                .get_argv()
+                .iter()
+                .map(|value| value.as_os_str())
+                .collect()
+        };
+        if argv.is_empty() || argv.len() > MAX_ITEMS {
+            bail!("process argument count must be between 1 and {MAX_ITEMS}");
+        }
+
+        let mut argv_bytes = Vec::new();
+        for argument in &argv {
+            push_item(&mut argv_bytes, os_bytes(argument), "argument")?;
+        }
+
+        let environment: Vec<_> = command.iter_full_env().collect();
+        if environment.len() > MAX_ITEMS {
+            bail!("process environment count exceeds {MAX_ITEMS}");
+        }
+        let mut env_bytes = Vec::new();
+        for (key, value) in environment {
+            if os_bytes(key).is_empty() || os_bytes(key).contains(&b'=') {
+                bail!("invalid process environment key");
+            }
+            let mut entry = Vec::with_capacity(os_bytes(key).len() + os_bytes(value).len() + 1);
+            entry.extend_from_slice(os_bytes(key));
+            entry.push(b'=');
+            entry.extend_from_slice(os_bytes(value));
+            push_item(&mut env_bytes, &entry, "environment entry")?;
+        }
+
+        let cwd = match command.get_cwd() {
+            Some(cwd) => os_bytes(cwd.as_os_str()).to_vec(),
+            None => std::env::current_dir()
+                .context("failed to resolve process working directory")?
+                .as_os_str()
+                .as_encoded_bytes()
+                .to_vec(),
+        };
+        if cwd.contains(&0) {
+            bail!("process working directory contains NUL");
+        }
+
+        let pid = wasi_ext::spawn(
+            os_bytes(argv[0]),
+            &argv_bytes,
+            &env_bytes,
+            self.fd,
+            self.fd,
+            self.fd,
+            &cwd,
+        )
+        .map_err(|errno| errno_error("PTY process spawn", errno))?;
+
+        Ok(Box::new(WasiChild {
+            state: Arc::new(WasiChildState { pid }),
+            reaped: false,
+        }))
     }
 }
 
 #[derive(Debug)]
-pub struct WasiChild;
+struct WasiChildState {
+    pid: u32,
+}
+
+#[derive(Debug)]
+struct WasiChild {
+    state: Arc<WasiChildState>,
+    reaped: bool,
+}
+
+impl WasiChild {
+    fn status(&mut self, options: u32) -> IoResult<Option<ExitStatus>> {
+        if self.reaped {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "PTY child has already been reaped",
+            ));
+        }
+        let status = wasi_ext::waitpid(self.state.pid, options)
+            .map_err(|errno| errno_error("waitpid", errno))?;
+        if status.pid == 0 {
+            return Ok(None);
+        }
+        self.reaped = true;
+        if status.signal == 0 {
+            Ok(Some(ExitStatus::with_exit_code(status.exit_code)))
+        } else {
+            Ok(Some(ExitStatus::with_signal(&format!(
+                "signal {}",
+                status.signal
+            ))))
+        }
+    }
+}
 
 impl Child for WasiChild {
     fn try_wait(&mut self) -> IoResult<Option<ExitStatus>> {
-        Ok(None)
+        self.status(WNOHANG)
     }
+
     fn wait(&mut self) -> IoResult<ExitStatus> {
-        Ok(ExitStatus::with_exit_code(1))
+        self.status(0)?.ok_or_else(|| {
+            std::io::Error::new(
+                std::io::ErrorKind::WouldBlock,
+                "blocking wait returned before the PTY child exited",
+            )
+        })
     }
+
     fn process_id(&self) -> Option<u32> {
-        None
+        Some(self.state.pid)
     }
 }
 
 impl ChildKiller for WasiChild {
     fn kill(&mut self) -> IoResult<()> {
-        Ok(())
+        wasi_ext::kill(self.state.pid, SIGHUP).map_err(|errno| errno_error("kill", errno))
     }
+
     fn clone_killer(&self) -> Box<dyn ChildKiller + Send + Sync> {
-        Box::new(WasiChild)
+        Box::new(Self {
+            state: Arc::clone(&self.state),
+            reaped: false,
+        })
     }
 }
diff --git a/toolchain/stubs/reqwest-shim/Cargo.toml b/toolchain/stubs/reqwest-shim/Cargo.toml
index f9d7879ab9..e46a92dd62 100644
--- a/toolchain/stubs/reqwest-shim/Cargo.toml
+++ b/toolchain/stubs/reqwest-shim/Cargo.toml
@@ -26,6 +26,7 @@ serde = "1"
 serde_json = "1"
 serde_urlencoded = "0.7"
 futures-core = "0.3"
+futures-util = "0.3"
 url = "2"
 base64 = "0.22"
 
diff --git a/toolchain/stubs/reqwest-shim/src/lib.rs b/toolchain/stubs/reqwest-shim/src/lib.rs
index 06fdaf0f45..407830f2cc 100644
--- a/toolchain/stubs/reqwest-shim/src/lib.rs
+++ b/toolchain/stubs/reqwest-shim/src/lib.rs
@@ -1,16 +1,12 @@
 //! `reqwest` 0.12 API shim for wasm32-wasip1, backed by agentos `wasi-http`
 //! (host_net TCP/TLS). Drop-in target for `[patch.crates-io] reqwest`.
 //!
-//! STATUS: scaffold. The buffered request/response path is implemented against
-//! `wasi_http::HttpClient::send`. The streaming path (`Response::bytes_stream`)
-//! currently yields the fully-buffered body as a single chunk — see the TODO on
-//! `bytes_stream`. True incremental streaming needs a RAW chunk reader added to
-//! `wasi-http` (its `SseReader` SSE-parses, but codex's `transport.rs` does its
-//! own SSE parsing over `bytes_stream`, so the shim must surface raw bytes).
-//!
-//! Not yet wired into `[patch.crates-io]` — doing so before it compiles against
-//! codex-exec's whole subtree would break every command's `make wasm` build.
+//! This is the guest half of agentOS's brokered HTTP boundary: the trusted
+//! sidecar owns network policy and TLS, while request construction, cookies, and
+//! streaming response bodies retain reqwest-compatible guest semantics. This
+//! boundary does not replace or restrict agentOS's real guest POSIX sockets.
 
+use std::sync::Arc;
 use std::time::Duration;
 
 use bytes::Bytes;
@@ -27,8 +23,70 @@ pub mod header {
 
 pub use header::HeaderMap;
 
-/// `reqwest::redirect` — redirect policy. Redirects are followed (or not) host-side
-/// by wasi-http; this surface exists so codex/rmcp's builder calls compile.
+/// `reqwest::cookie` — the small cookie-store surface used by Codex.
+pub mod cookie {
+    use std::collections::HashMap;
+    use std::sync::Mutex;
+
+    use http::HeaderValue;
+
+    use crate::Url;
+
+    pub trait CookieStore: Send + Sync {
+        fn set_cookies(&self, cookie_headers: &mut dyn Iterator<Item = &HeaderValue>, url: &Url);
+        fn cookies(&self, url: &Url) -> Option<HeaderValue>;
+    }
+
+    #[derive(Debug, Default)]
+    pub struct Jar {
+        cookies: Mutex<HashMap<String, HashMap<String, String>>>,
+    }
+
+    impl CookieStore for Jar {
+        fn set_cookies(&self, cookie_headers: &mut dyn Iterator<Item = &HeaderValue>, url: &Url) {
+            let Some(host) = url.host_str() else {
+                return;
+            };
+            let mut hosts = self
+                .cookies
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            let host_cookies = hosts.entry(host.to_string()).or_default();
+            for header in cookie_headers {
+                let Some(pair) = header
+                    .to_str()
+                    .ok()
+                    .and_then(|value| value.split(';').next())
+                else {
+                    continue;
+                };
+                let Some((name, value)) = pair.split_once('=') else {
+                    continue;
+                };
+                host_cookies.insert(name.trim().to_string(), value.trim().to_string());
+            }
+        }
+
+        fn cookies(&self, url: &Url) -> Option<HeaderValue> {
+            let host = url.host_str()?;
+            let hosts = self
+                .cookies
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            let values = hosts.get(host)?;
+            let header = values
+                .iter()
+                .map(|(name, value)| format!("{name}={value}"))
+                .collect::<Vec<_>>()
+                .join("; ");
+            HeaderValue::from_str(&header).ok()
+        }
+    }
+}
+
+/// `reqwest::redirect` — redirect policy. The agentOS broker returns the HTTP
+/// response without following redirects; `Policy::none()` therefore maps exactly
+/// to the transport behavior. Other policies remain API-shaped values only.
 pub mod redirect {
     #[derive(Clone, Debug)]
     pub struct Policy;
@@ -187,6 +245,10 @@ impl Error {
         self.url = Some(url);
         self
     }
+    pub fn without_url(mut self) -> Self {
+        self.url = None;
+        self
+    }
 }
 
 impl std::fmt::Display for Error {
@@ -204,49 +266,147 @@ impl From<wasi_http::HttpError> for Error {
 }
 
 /// `reqwest::Body`.
-pub struct Body(Vec<u8>);
+pub enum Body {
+    Buffered(Vec<u8>),
+    Stream(
+        std::pin::Pin<Box<dyn futures_core::Stream<Item = Result<Bytes, String>> + Send + 'static>>,
+    ),
+}
+
+impl std::fmt::Debug for Body {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Buffered(bytes) => formatter
+                .debug_tuple("Body")
+                .field(&format_args!("{} buffered bytes", bytes.len()))
+                .finish(),
+            Self::Stream(_) => formatter.debug_tuple("Body").field(&"stream").finish(),
+        }
+    }
+}
+
+impl Body {
+    pub fn wrap_stream<S>(stream: S) -> Self
+    where
+        S: futures_core::TryStream + Send + 'static,
+        S::Error: Into<Box<dyn std::error::Error + Send + Sync>>,
+        Bytes: From<S::Ok>,
+    {
+        use futures_util::{StreamExt, TryStreamExt};
+        Self::Stream(
+            stream
+                .map_ok(Bytes::from)
+                .map_err(|error| error.into().to_string())
+                .boxed(),
+        )
+    }
+
+    fn try_clone(&self) -> Option<Self> {
+        match self {
+            Self::Buffered(bytes) => Some(Self::Buffered(bytes.clone())),
+            Self::Stream(_) => None,
+        }
+    }
+
+    async fn into_bytes(self) -> Result<Vec<u8>, Error> {
+        match self {
+            Self::Buffered(bytes) => Ok(bytes),
+            Self::Stream(mut stream) => {
+                use futures_util::StreamExt;
+                let mut bytes = Vec::new();
+                while let Some(chunk) = stream.next().await {
+                    bytes.extend_from_slice(&chunk.map_err(Error::new)?);
+                }
+                Ok(bytes)
+            }
+        }
+    }
+}
 
 impl From<Vec<u8>> for Body {
     fn from(v: Vec<u8>) -> Self {
-        Body(v)
+        Body::Buffered(v)
     }
 }
 impl From<String> for Body {
     fn from(s: String) -> Self {
-        Body(s.into_bytes())
+        Body::Buffered(s.into_bytes())
     }
 }
 impl From<&'static str> for Body {
     fn from(s: &'static str) -> Self {
-        Body(s.as_bytes().to_vec())
+        Body::Buffered(s.as_bytes().to_vec())
+    }
+}
+impl From<Bytes> for Body {
+    fn from(bytes: Bytes) -> Self {
+        Body::Buffered(bytes.to_vec())
     }
 }
 
-/// `reqwest::Certificate` — TLS is delegated to the host runtime in wasi-http, so
-/// custom roots are accepted and ignored on this target.
+/// `reqwest::Certificate` — TLS policy for brokered HTTP is sidecar-owned.
+/// Custom per-client roots must fail explicitly instead of appearing to install.
 #[derive(Clone, Debug)]
 pub struct Certificate;
 
 impl Certificate {
     pub fn from_der(_der: &[u8]) -> Result<Self, Error> {
-        Ok(Certificate)
+        Err(Error::new(
+			"custom HTTP CA roots are unavailable inside an agentOS VM; configure the trusted sidecar or the VM CA bundle",
+		))
     }
     pub fn from_pem(_pem: &[u8]) -> Result<Self, Error> {
-        Ok(Certificate)
+        Err(Error::new(
+			"custom HTTP CA roots are unavailable inside an agentOS VM; configure the trusted sidecar or the VM CA bundle",
+		))
     }
 }
 
-/// `reqwest::Identity` — client TLS identity. TLS is host-brokered, so this is a
-/// compile-only placeholder.
+/// `reqwest::Identity` — client TLS identity for brokered HTTP is sidecar-owned.
+/// The broker does not accept guest-provided client keys.
 #[derive(Clone)]
 pub struct Identity;
 
 impl Identity {
     pub fn from_pem(_pem: &[u8]) -> Result<Self, Error> {
-        Ok(Identity)
+        Err(Error::new(
+			"per-client HTTP TLS identities are unavailable inside an agentOS VM; configure the trusted sidecar",
+		))
     }
     pub fn from_pkcs12_der(_der: &[u8], _pass: &str) -> Result<Self, Error> {
-        Ok(Identity)
+        Err(Error::new(
+			"per-client HTTP TLS identities are unavailable inside an agentOS VM; configure the trusted sidecar",
+		))
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct NoProxy;
+
+impl NoProxy {
+    pub fn from_string(value: &str) -> Option<Self> {
+        (!value.trim().is_empty()).then_some(Self)
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct Proxy {
+    scheme: String,
+    has_no_proxy: bool,
+}
+
+impl Proxy {
+    pub fn all(proxy_scheme: &str) -> Result<Self, Error> {
+        let url = parse_url(proxy_scheme)?;
+        Ok(Self {
+            scheme: url.scheme().to_string(),
+            has_no_proxy: false,
+        })
+    }
+
+    pub fn no_proxy(mut self, no_proxy: Option<NoProxy>) -> Self {
+        self.has_no_proxy = no_proxy.is_some();
+        self
     }
 }
 
@@ -255,6 +415,8 @@ impl Identity {
 pub struct ClientBuilder {
     default_headers: Option<HeaderMap>,
     timeout: Option<Duration>,
+    cookie_provider: Option<Arc<dyn cookie::CookieStore>>,
+    unsupported_transport: Option<String>,
 }
 
 impl ClientBuilder {
@@ -269,10 +431,20 @@ impl ClientBuilder {
         self.timeout = Some(timeout);
         self
     }
-    pub fn add_root_certificate(self, _cert: Certificate) -> Self {
+    pub fn add_root_certificate(mut self, _cert: Certificate) -> Self {
+        self.unsupported_transport = Some(
+			"custom HTTP CA roots are unavailable inside an agentOS VM; configure the trusted sidecar or the VM CA bundle"
+				.to_string(),
+		);
         self
     }
-    pub fn danger_accept_invalid_certs(self, _v: bool) -> Self {
+    pub fn danger_accept_invalid_certs(mut self, value: bool) -> Self {
+        if value {
+            self.unsupported_transport = Some(
+				"disabling HTTP certificate validation is unavailable inside an agentOS VM because the trusted sidecar owns TLS policy"
+					.to_string(),
+			);
+        }
         self
     }
     pub fn user_agent<V>(self, _v: V) -> Self {
@@ -296,28 +468,62 @@ impl ClientBuilder {
     pub fn no_proxy(self) -> Self {
         self
     }
+    pub fn proxy(mut self, proxy: Proxy) -> Self {
+        self.unsupported_transport = Some(format!(
+            "per-client {} proxy routing (NO_PROXY configured: {}) is unavailable in an agentOS VM; configure outbound routing on the trusted agentOS sidecar",
+            proxy.scheme, proxy.has_no_proxy
+        ));
+        self
+    }
+    pub fn cookie_provider<C>(mut self, cookie_provider: Arc<C>) -> Self
+    where
+        C: cookie::CookieStore + 'static,
+    {
+        self.cookie_provider = Some(cookie_provider);
+        self
+    }
     pub fn tcp_keepalive<D: Into<Option<Duration>>>(self, _d: D) -> Self {
         self
     }
     pub fn use_rustls_tls(self) -> Self {
         self
     }
-    pub fn identity(self, _id: Identity) -> Self {
+    pub fn identity(mut self, _id: Identity) -> Self {
+        self.unsupported_transport = Some(
+			"per-client HTTP TLS identities are unavailable inside an agentOS VM; configure the trusted sidecar"
+				.to_string(),
+		);
         self
     }
     pub fn build(self) -> Result<Client, Error> {
+        if let Some(message) = self.unsupported_transport {
+            return Err(Error::new(message));
+        }
         Ok(Client {
             default_headers: self.default_headers.unwrap_or_default(),
             _timeout: self.timeout,
+            cookie_provider: self.cookie_provider,
         })
     }
 }
 
 /// `reqwest::Client`.
-#[derive(Clone, Debug)]
+#[derive(Clone)]
 pub struct Client {
     default_headers: HeaderMap,
     _timeout: Option<Duration>,
+    cookie_provider: Option<Arc<dyn cookie::CookieStore>>,
+}
+
+impl std::fmt::Debug for Client {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("Client")
+            .field("default_headers", &self.default_headers)
+            .field("timeout", &self._timeout)
+            .field("has_cookie_provider", &self.cookie_provider.is_some())
+            .finish()
+    }
 }
 
 impl Default for Client {
@@ -325,6 +531,7 @@ impl Default for Client {
         Client {
             default_headers: HeaderMap::new(),
             _timeout: None,
+            cookie_provider: None,
         }
     }
 }
@@ -361,6 +568,8 @@ impl Client {
             url,
             headers: self.default_headers.clone(),
             body: None,
+            timeout: self._timeout,
+            cookie_provider: self.cookie_provider.clone(),
             err: None,
         }
     }
@@ -368,9 +577,11 @@ impl Client {
     pub async fn execute(&self, req: Request) -> Result<Response, Error> {
         RequestBuilder {
             method: req.method,
-            url: req.url,
+            url: req.url.to_string(),
             headers: req.headers,
             body: req.body,
+            timeout: req.timeout,
+            cookie_provider: self.cookie_provider.clone(),
             err: None,
         }
         .send()
@@ -382,34 +593,67 @@ impl Client {
 /// flows and consumed by `Client::execute`).
 pub struct Request {
     method: Method,
-    url: String,
+    url: Url,
     headers: HeaderMap,
-    body: Option<Vec<u8>>,
+    body: Option<Body>,
+    timeout: Option<Duration>,
+    version: http::Version,
 }
 
 impl Request {
     pub fn new(method: Method, url: Url) -> Self {
         Request {
             method,
-            url: url.as_str().to_string(),
+            url,
             headers: HeaderMap::new(),
             body: None,
+            timeout: None,
+            version: http::Version::HTTP_11,
         }
     }
     pub fn headers_mut(&mut self) -> &mut HeaderMap {
         &mut self.headers
     }
-    pub fn body_mut(&mut self) -> &mut Option<Vec<u8>> {
+    pub fn body_mut(&mut self) -> &mut Option<Body> {
         &mut self.body
     }
-    pub fn url(&self) -> Url {
-        parse_url(&self.url).unwrap_or_else(|_| {
-            Url::parse("http://invalid.localhost/").expect("static url parses")
-        })
+    pub fn headers(&self) -> &HeaderMap {
+        &self.headers
+    }
+    pub fn url(&self) -> &Url {
+        &self.url
+    }
+    pub fn url_mut(&mut self) -> &mut Url {
+        &mut self.url
     }
     pub fn method(&self) -> &Method {
         &self.method
     }
+    pub fn timeout(&self) -> Option<&Duration> {
+        self.timeout.as_ref()
+    }
+    pub fn timeout_mut(&mut self) -> &mut Option<Duration> {
+        &mut self.timeout
+    }
+    pub fn version(&self) -> http::Version {
+        self.version
+    }
+    pub fn version_mut(&mut self) -> &mut http::Version {
+        &mut self.version
+    }
+    pub fn try_clone(&self) -> Option<Self> {
+        Some(Self {
+            method: self.method.clone(),
+            url: self.url.clone(),
+            headers: self.headers.clone(),
+            body: match &self.body {
+                Some(body) => Some(body.try_clone()?),
+                None => None,
+            },
+            timeout: self.timeout,
+            version: self.version,
+        })
+    }
 }
 
 /// oauth2 builds an `http::Request<Vec<u8>>` and converts it into a
@@ -420,23 +664,45 @@ impl TryFrom<http::Request<Vec<u8>>> for Request {
         let (parts, body) = req.into_parts();
         Ok(Request {
             method: parts.method,
-            url: parts.uri.to_string(),
+            url: parse_url(&parts.uri.to_string())?,
             headers: parts.headers,
-            body: if body.is_empty() { None } else { Some(body) },
+            body: if body.is_empty() {
+                None
+            } else {
+                Some(Body::Buffered(body))
+            },
+            timeout: None,
+            version: parts.version,
         })
     }
 }
 
 /// `reqwest::RequestBuilder`.
-#[derive(Debug)]
 pub struct RequestBuilder {
     method: Method,
     url: String,
     headers: HeaderMap,
-    body: Option<Vec<u8>>,
+    body: Option<Body>,
+    timeout: Option<Duration>,
+    cookie_provider: Option<Arc<dyn cookie::CookieStore>>,
     err: Option<String>,
 }
 
+impl std::fmt::Debug for RequestBuilder {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RequestBuilder")
+            .field("method", &self.method)
+            .field("url", &self.url)
+            .field("headers", &self.headers)
+            .field("body", &self.body)
+            .field("timeout", &self.timeout)
+            .field("has_cookie_provider", &self.cookie_provider.is_some())
+            .field("err", &self.err)
+            .finish()
+    }
+}
+
 impl RequestBuilder {
     pub fn headers(mut self, headers: HeaderMap) -> Self {
         self.headers.extend(headers);
@@ -447,7 +713,10 @@ impl RequestBuilder {
         http::HeaderName: TryFrom<K>,
         http::HeaderValue: TryFrom<V>,
     {
-        match (http::HeaderName::try_from(key), http::HeaderValue::try_from(value)) {
+        match (
+            http::HeaderName::try_from(key),
+            http::HeaderValue::try_from(value),
+        ) {
             (Ok(k), Ok(v)) => {
                 self.headers.insert(k, v);
             }
@@ -456,7 +725,7 @@ impl RequestBuilder {
         self
     }
     pub fn body<B: Into<Body>>(mut self, body: B) -> Self {
-        self.body = Some(body.into().0);
+        self.body = Some(body.into());
         self
     }
     pub fn json<T: serde::Serialize + ?Sized>(mut self, json: &T) -> Self {
@@ -466,14 +735,17 @@ impl RequestBuilder {
                     http::header::CONTENT_TYPE,
                     http::HeaderValue::from_static("application/json"),
                 );
-                self.body = Some(v);
+                self.body = Some(Body::Buffered(v));
             }
             Err(e) => self.err = Some(e.to_string()),
         }
         self
     }
     pub fn timeout(self, _timeout: Duration) -> Self {
-        self
+        Self {
+            timeout: Some(_timeout),
+            ..self
+        }
     }
     pub fn bearer_auth<T: std::fmt::Display>(self, token: T) -> Self {
         self.header(http::header::AUTHORIZATION, format!("Bearer {token}"))
@@ -509,25 +781,42 @@ impl RequestBuilder {
                     http::header::CONTENT_TYPE,
                     http::HeaderValue::from_static("application/x-www-form-urlencoded"),
                 );
-                self.body = Some(body.into_bytes());
+                self.body = Some(Body::Buffered(body.into_bytes()));
             }
             Err(e) => self.err = Some(e.to_string()),
         }
         self
     }
-    pub fn build(self) -> Result<RequestBuilder, Error> {
-        if let Some(e) = &self.err {
-            return Err(Error::new(e.clone()));
+    pub fn build(self) -> Result<Request, Error> {
+        if let Some(e) = self.err {
+            return Err(Error::new(e));
         }
-        Ok(self)
+        Ok(Request {
+            method: self.method,
+            url: parse_url(&self.url)?,
+            headers: self.headers,
+            body: self.body,
+            timeout: self.timeout,
+            version: http::Version::HTTP_11,
+        })
     }
 
     /// Perform the request via wasi-http (blocking under the hood; resolves on
     /// first poll on the single-threaded VM).
-    pub async fn send(self) -> Result<Response, Error> {
+    pub async fn send(mut self) -> Result<Response, Error> {
         if let Some(e) = self.err {
             return Err(Error::new(e));
         }
+        let url = parse_url(&self.url)?;
+        if !self.headers.contains_key(http::header::COOKIE) {
+            if let Some(cookie) = self
+                .cookie_provider
+                .as_ref()
+                .and_then(|provider| provider.cookies(&url))
+            {
+                self.headers.insert(http::header::COOKIE, cookie);
+            }
+        }
         let method = match self.method {
             Method::GET => wasi_http::Method::Get,
             Method::POST => wasi_http::Method::Post,
@@ -544,13 +833,18 @@ impl RequestBuilder {
             }
         }
         if let Some(body) = self.body {
-            req = req.body(body);
+            req = req.body(body.into_bytes().await?);
         }
         // Always stream under the hood: headers arrive immediately and the body is
         // pulled incrementally. Buffered accessors (`json`/`text`/`bytes`) drain the
         // reader; `bytes_stream` yields raw chunks as they arrive.
         let (resp, reader) = wasi_http::HttpClient::new().send_raw_stream(&req)?;
-        Ok(Response::from_wasi(resp, reader))
+        let response = Response::from_wasi(resp, reader, url.clone());
+        if let Some(cookie_provider) = self.cookie_provider {
+            let mut set_cookie_headers = response.headers.get_all(http::header::SET_COOKIE).iter();
+            cookie_provider.set_cookies(&mut set_cookie_headers, &url);
+        }
+        Ok(response)
     }
 }
 
@@ -559,6 +853,7 @@ pub struct Response {
     status: StatusCode,
     headers: HeaderMap,
     reader: Option<wasi_http::RawBodyReader>,
+    url: Url,
 }
 
 impl std::fmt::Debug for Response {
@@ -571,7 +866,7 @@ impl std::fmt::Debug for Response {
 }
 
 impl Response {
-    fn from_wasi(resp: wasi_http::Response, reader: wasi_http::RawBodyReader) -> Self {
+    fn from_wasi(resp: wasi_http::Response, reader: wasi_http::RawBodyReader, url: Url) -> Self {
         let status = StatusCode::from_u16(resp.status).unwrap_or(StatusCode::OK);
         let mut headers = HeaderMap::new();
         for (name, value) in &resp.headers {
@@ -586,6 +881,7 @@ impl Response {
             status,
             headers,
             reader: Some(reader),
+            url,
         }
     }
 
@@ -615,6 +911,9 @@ impl Response {
     pub fn headers(&self) -> &HeaderMap {
         &self.headers
     }
+    pub fn url(&self) -> &Url {
+        &self.url
+    }
     pub fn version(&self) -> http::Version {
         http::Version::HTTP_11
     }
@@ -642,6 +941,23 @@ impl Response {
     pub async fn bytes(mut self) -> Result<Bytes, Error> {
         Ok(Bytes::from(self.drain().await?))
     }
+    pub async fn chunk(&mut self) -> Result<Option<Bytes>, Error> {
+        let Some(reader) = self.reader.as_mut() else {
+            return Ok(None);
+        };
+        loop {
+            match reader.read_chunk()? {
+                wasi_http::ChunkPoll::Ready(chunk) => {
+                    return Ok(Some(Bytes::from(chunk)));
+                }
+                wasi_http::ChunkPoll::Eof => {
+                    self.reader = None;
+                    return Ok(None);
+                }
+                wasi_http::ChunkPoll::WouldBlock => yield_now().await,
+            }
+        }
+    }
     pub async fn json<T: serde::de::DeserializeOwned>(mut self) -> Result<T, Error> {
         let body = self.drain().await?;
         serde_json::from_slice(&body).map_err(|e| Error::new(e.to_string()))
diff --git a/website/public/docs/docs/sessions.md b/website/public/docs/docs/sessions.md
index 44f4f84c86..3b31fd4474 100644
--- a/website/public/docs/docs/sessions.md
+++ b/website/public/docs/docs/sessions.md
@@ -32,11 +32,23 @@ Input fields: `agent`, `cwd`, `additionalDirectories`, `env`, `mcpServers`,
 - Configure local child-process or remote servers **before** opening the
   session.
 - Config path and transports come from the selected agent adapter (e.g. Pi
-  reads `.mcp.json` from its AgentOS home).
+  reads `.mcp.json` from its agentOS home).
 - Install local MCP server packages before opening the session so first-run
   package-manager output can't corrupt a stdio handshake.
 - See the [agent guide](/docs/agents/pi) for adapter specifics.
 
+## Agent Plugins
+
+[Agent Plugins](https://agent-plugins.org/) are portable bundles of skills and
+optional MCP servers described by a root `plugin.json`. agentOS leaves plugin
+loading to the session's agent harness: install the bundle in that client's VM
+location before opening the session. This lets the same bundle work with other
+[compatible clients](https://agent-plugins.org/compatible-clients) without an
+agentOS-specific plugin format.
+
+This example installs and enables a small Agent Plugin for Codex, then invokes
+its namespaced skill:
+
 ## Prompt
 
 - `prompt` accepts native ACP `ContentBlock[]` — not a special text format.
@@ -128,4 +140,4 @@ await agent.sessions.respondPermission({
 - `getSessionConfig` — returns the negotiated native ACP config collection + a
   revision.
 - `setSessionConfigOption` — may restore the adapter, lets ACP validate the
-  value, then replaces the cached collection.
+  value, then replaces the cached collection.
\ No newline at end of file
diff --git a/website/src/content/docs/docs/sessions.mdx b/website/src/content/docs/docs/sessions.mdx
index 9564db5240..5dabffe830 100644
--- a/website/src/content/docs/docs/sessions.mdx
+++ b/website/src/content/docs/docs/sessions.mdx
@@ -39,13 +39,27 @@ Input fields: `agent`, `cwd`, `additionalDirectories`, `env`, `mcpServers`,
 - Configure local child-process or remote servers **before** opening the
   session.
 - Config path and transports come from the selected agent adapter (e.g. Pi
-  reads `.mcp.json` from its AgentOS home).
+  reads `.mcp.json` from its agentOS home).
 - Install local MCP server packages before opening the session so first-run
   package-manager output can't corrupt a stdio handshake.
 - See the [agent guide](/docs/agents/pi) for adapter specifics.
 
 <CodeSnippet file="examples/pi/client.ts" region="mcp" />
 
+## Agent Plugins
+
+[Agent Plugins](https://agent-plugins.org/) are portable bundles of skills and
+optional MCP servers described by a root `plugin.json`. agentOS leaves plugin
+loading to the session's agent harness: install the bundle in that client's VM
+location before opening the session. This lets the same bundle work with other
+[compatible clients](https://agent-plugins.org/compatible-clients) without an
+agentOS-specific plugin format.
+
+This example installs and enables a small Agent Plugin for Codex, then invokes
+its namespaced skill:
+
+<CodeSnippet file="examples/codex/client.ts" region="agent-plugins" />
+
 ## Prompt
 
 - `prompt` accepts native ACP `ContentBlock[]` — not a special text format.