@moinulmoin/eden 0.5.0 → 0.7.0

package/dist/eve-packaging.d.ts

@@ -1,5 +1,5 @@
-import type { EveRuntimeInputIdentity } from "./eve-runtime-config.js";
-export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED" | "PACKAGE_VERIFICATION_FAILED";
+import { type EveRuntimeInputIdentity } from "./eve-runtime-config.js";
+export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED";
 export interface EveRuntimeConfigExclusion {
     /**
      * This path is opaque. The packaging worker only uses its lexical identity
@@ -101,6 +101,23 @@ export interface EveProjectOutput {
     readonly outputDigest: string;
     readonly fileCount: number;
 }
+/** Snapshot-relative root of Eve's prepared sandbox templates. */
+export declare const EVE_SANDBOX_CACHE_ROOT: ".eve/sandbox-cache";
+/**
+ * Evidence for the sandbox templates `eve build` prepared inside the isolated
+ * builder. Runtime sandboxes resolve their template at
+ * `<appRoot>/.eve/sandbox-cache/<provider>/templates/<key>`, so this tree must
+ * ship inside the runtime image or every `bash`/`read_file`/`write_file` call
+ * fails with "Sandbox template ... is not provisioned". `null` when this Eve
+ * build prepared no sandbox template.
+ */
+export interface EveSandboxCacheOutput {
+    readonly present: true;
+    readonly root: typeof EVE_SANDBOX_CACHE_ROOT;
+    readonly outputDigest: string;
+    readonly fileCount: number;
+    readonly totalBytes: number;
+}
 export interface EveProjectBuildCandidate {
     readonly generationId: string;
     readonly generationRoot: string;
@@ -122,6 +139,7 @@ export interface EveProjectBuildCandidate {
     readonly sourceDigest: string;
     readonly snapshotDigest: string;
     readonly generatedOutput: EveProjectOutput;
+    readonly sandboxCache: EveSandboxCacheOutput | null;
     readonly runtimeConfigInputIdentity?: string;
     readonly runtimeVariableNames: readonly string[];
 }
@@ -175,15 +193,6 @@ export interface EveProjectImage {
     };
     readonly generatedOutput: EveProjectOutput | null;
 }
-export interface EveProjectRuntime {
-    readonly listenHost: "0.0.0.0";
-    readonly listenPort: 8080;
-    readonly healthMethod: "GET";
-    readonly healthPath: "/eve/v1/health";
-    readonly healthStatus: "not-run";
-    readonly healthVerified: false;
-    readonly durableLocalFilesystemClaim: false;
-}
 export interface EveProjectSecretsEvidence {
     readonly runtimeVariableNames: readonly string[];
     readonly valuesRecorded: false;
@@ -228,9 +237,15 @@ export interface EveProjectPackagingResult {
     readonly snapshot: EveProjectSnapshot | null;
     readonly toolchain: EveProjectToolchain | null;
     readonly image: EveProjectImage | null;
-    readonly runtime: EveProjectRuntime | null;
     readonly secrets: EveProjectSecretsEvidence;
     readonly checks: readonly EvePackagingCheck[];
+    /**
+     * Outcome of the builder's temporary eve#4440 sandbox-resume patch:
+     * `applied` when the shipped just-bash binding carries it, `skipped` when
+     * the binding is a version Eden does not know, `absent` when this Eve
+     * build has no just-bash binding or packaging never reached the image.
+     */
+    readonly sandboxResumePatch: EveSandboxResumePatchStatus;
     readonly candidateImageId: string | null;
     readonly candidateImageRetainedLocally: boolean;
     readonly writtenPaths: readonly string[];
@@ -252,6 +267,57 @@ export declare class EvePackagingError extends Error {
         readonly remediation: string;
     });
 }
+/**
+ * Eden's temporary fix for upstream https://github.com/vercel/eve/issues/4440
+ * (repro: https://github.com/moinulmoin/eve-justbash-resume-repro).
+ * Eve's just-bash provider permanently refuses to resume a conversation once
+ * the sandbox template changes (skills, `agent/sandbox/workspace/`, or the
+ * sandbox definition) and never falls back, so one `eden deploy` update would
+ * break every existing conversation's sandbox forever. The isolated builder
+ * rewrites one file in the installed Eve copy so an existing session reopens
+ * against the current template instead of throwing; user files under
+ * `/workspace` always win over the template. The patch applies only when the
+ * target file's sha256 equals `EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256`, and it
+ * is removed entirely once upstream ships the fix.
+ */
+export declare const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f67a6028f1675bf7c04b22454b4ebfb4cd9d19e5bf5aaf8";
+/** Marker the patched binding always contains; proves the patch shipped. */
+export declare const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
+/** The exact `resume()` implementation in eve 0.68.0, 0.71.2, and 0.72.1. */
+export declare const EVE_JUST_BASH_RESUME_ORIGINAL = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root \"${a.rootPath}\" no longer exists.`);return await openHandle(e,a.rootPath,t)}";
+/**
+ * The replacement `resume()`: a session whose template generation moved is
+ * contained to the same sessions directory and reopened with its authored
+ * skills refreshed from the current template. A session folder that is gone
+ * (for example a deploy that could not carry it) is recreated from the
+ * current template instead of failing every later sandbox call.
+ */
+export declare const EVE_SANDBOX_RESUME_PATCHED = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if((a.generation!==o||a.rootPath!==s)&&dirname(a.rootPath)!==dirname(s))throw Error(`just-bash session state is incompatible with this environment.`);await ensureSessionRoot(i,a.rootPath);if(a.generation!==o)await edenRefreshJustBashSessionSkills(i.templateRootPath,a.rootPath);return await openHandle(e,a.rootPath,t)}";
+/**
+ * Helpers appended to the patched binding. They use only identifiers the
+ * module already imports (`readdir`, `rm`, `join`, `pathExists`,
+ * `copyDirectoryAtomically`). Skills live at `$HOME/.agents/skills` inside a
+ * just-bash root, so the session keeps the same path relative to its `fs`
+ * directory as the template; the template's `fs` is scanned because `$HOME`
+ * is only known inside the sandbox.
+ */
+export declare const EVE_SANDBOX_RESUME_PATCH_HELPERS = "async function edenRefreshJustBashSessionSkills(e,t){let n=await edenFindTemplateSkillsRelativePath(join(e,\"fs\"));if(n===void 0)return;let r=join(t,\"fs\",n);await rm(r,{force:!0,recursive:!0}),await copyDirectoryAtomically(join(e,\"fs\",n),r)}\nasync function edenFindTemplateSkillsRelativePath(e){let t=[[\"\",0]];for(;t.length>0;){let n=t.shift(),r=n[0],i=n[1];if(i>3)continue;let a=[];try{a=await readdir(join(e,r),{withFileTypes:!0})}catch{a=[]}for(let o of a){if(!o.isDirectory())continue;let s=r===\"\"?o.name:r+\"/\"+o.name;if(o.name===\".agents\")return await pathExists(join(e,s,\"skills\"))?s+\"/skills\":void 0;t.push([s,i+1])}}return void 0}\n";
+/**
+ * The CommonJS patcher the isolated builder runs between the frozen install
+ * and `eve build` (and again for the production reinstall). It never touches
+ * project files, applies only against the known sha256, verifies the
+ * replacement matched exactly once, validates the result with `node --check`,
+ * and breaks hardlinks by writing a temp file and renaming it into place.
+ */
+export declare const EVE_SANDBOX_RESUME_PATCH_SCRIPT: string;
+/** Outcome of the builder's sandbox-resume patch for the packaged image. */
+export type EveSandboxResumePatchStatus = "applied" | "skipped" | "absent";
+export declare function sha256(value: string | Buffer): string;
+export declare function jsonBytes(value: unknown): Buffer;
+export declare function isWithin(root: string, candidate: string): boolean;
+export declare function safeRelativePath(root: string, candidate: string): string;
+export declare const IMAGE_ID_PATTERN: RegExp;
+export declare function imageReference(nodeImage: EveNodeImage, reason: string, remediation: string): string;
 /**
  * The authored Eve project source the runtime stage must carry so `eve start`
  * can resolve the project context (agent/, agents/ workspaces, flat layouts,
@@ -259,6 +325,7 @@ export declare class EvePackagingError extends Error {
  * capture-time exclusion still applied; generated roots are never source.
  */
 export declare function eveSnapshotSourceEntries(snapshotRoot: string): Promise<readonly string[]>;
+export declare function safeError(error: EvePackagingError): EveProjectPackagingResult["error"];
 export declare function buildEveProjectSnapshot(options: EveProjectSnapshotOptions): Promise<EveProjectPackagingResult>;
 export declare function revalidateEveProjectCandidateInputs(candidate: EveProjectBuildCandidate, runtimeConfig?: EveRuntimeConfigExclusion): Promise<void>;
 export declare function createDockerEveProjectBuilder(options: {