@moinulmoin/eden 0.7.0 → 0.7.2

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.7.0
+npm install --global @moinulmoin/eden@0.7.2
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.7.0
+pnpm add --global @moinulmoin/eden@0.7.2
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.7.0
+bun add --global @moinulmoin/eden@0.7.2
 ```
 
 Then confirm the CLI is available:
@@ -102,6 +102,10 @@ eden preflight \
   --name my-eve-preview
 ```
 
+Ship a change by running the same deploy again. Eden updates the target it
+owns in place: same Worker and URL, the new code, and every conversation's
+sandbox files carried into the new Container.
+
 Remove exactly that deployment when finished:
 
 ```sh
@@ -117,7 +121,7 @@ deletes by prefix or broad account search.
 | Command | Purpose |
 | --- | --- |
 | `eden preflight` | Build and inspect an Eve candidate without remote mutation |
-| `eden deploy` | Deploy an existing Eve project to one exact target |
+| `eden deploy` | Deploy an existing Eve project to one exact target, or update one Eden owns in place |
 | `eden destroy` | Remove one exact Eden-owned Eve deployment |
 
 Run `eden <command> --help` for command-specific options.
@@ -125,7 +129,11 @@ Run `eden <command> --help` for command-specific options.
 ## What Eden does not do
 
 - Deploy does not replace the Eve project's providers, databases, Workflow
-  World, authentication, schedules, channels, or sandbox.
+  World, authentication, schedules, or channels.
+- The agent's sandbox is `just-bash`, a simulated shell, not a real Linux VM
+  like Vercel Sandbox. Files, `grep`/`sed`/`jq`/`sqlite3`, and `curl` work;
+  `python`, `git`, and `npm` do not. A custom `agent/sandbox.ts` or
+  `agent/sandbox/Dockerfile` is not supported yet.
 - Container files survive sleep via snapshots, and image updates now carry
   Eve's sandbox sessions — every conversation's files — across the image
   change through the Durable Object's storage (capped at 1 GiB compressed).

package/dist/eve-control-plane.js

@@ -227,7 +227,7 @@ async function collectEveWorldWarnings(candidate, runtimeConfig) {
             world === "@workflow/world-local") {
             warnings.push({
                 id: "EVE_WORLD_LOCAL",
-                message: "This project uses Eve's default local Workflow World; workflow state lives on the container disk and is lost when the container sleeps.",
+                message: "This project uses Eve's default local Workflow World; workflow state lives on the container disk, survives sleep, and resets when you update the agent.",
                 remediation: "Configure a durable Workflow World such as @workflow/world-postgres; see docs/deploy.md#durable-state-postgres-world.",
             });
         }
@@ -1010,7 +1010,11 @@ async function writeEveDeploymentArtifacts(candidate, hostConfig, workerSource)
     });
     return { workerSourcePath, wranglerConfigPath };
 }
-function runWranglerWithInput(args, cwd, input) {
+/** Deadline for bounded Wrangler reads, secret writes, pushes, and deletions. */
+const WRANGLER_OPERATION_TIMEOUT_MS = 120_000;
+/** Deadline for `wrangler deploy`, whose Container image preparation alone can approach two minutes. */
+const WRANGLER_PUBLICATION_TIMEOUT_MS = 600_000;
+function runWranglerWithInput(args, cwd, input, timeoutMs = WRANGLER_OPERATION_TIMEOUT_MS) {
     return new Promise((resolveResult) => {
         const child = spawn(process.execPath, [wranglerEntrypoint, ...args], {
             cwd,
@@ -1037,7 +1041,7 @@ function runWranglerWithInput(args, cwd, input) {
                 stdout,
                 stderr: "The bounded Wrangler operation timed out.",
             });
-        }, 120_000);
+        }, timeoutMs);
         child.stdout.on("data", (chunk) => {
             stdout += chunk.toString();
         });
@@ -1156,7 +1160,7 @@ function defaultPublicationRunner() {
             "--env",
             request.identity.environment,
             "--strict",
-        ], dirname(request.wranglerConfigPath));
+        ], dirname(request.wranglerConfigPath), undefined, WRANGLER_PUBLICATION_TIMEOUT_MS);
         if (result.exitCode !== 0) {
             return {
                 status: "indeterminate",

package/dist/eve-packaging.d.ts

@@ -277,13 +277,15 @@ export declare class EvePackagingError extends Error {
  * rewrites one file in the installed Eve copy so an existing session reopens
  * against the current template instead of throwing; user files under
  * `/workspace` always win over the template. The patch applies only when the
- * target file's sha256 equals `EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256`, and it
- * is removed entirely once upstream ships the fix.
+ * target file's sha256 matches a known binding and selects that binding's
+ * replacement; it is removed entirely once upstream ships the fix.
  */
 export declare const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f67a6028f1675bf7c04b22454b4ebfb4cd9d19e5bf5aaf8";
+/** Eve 0.79.1 stores a template key instead of an absolute template path. */
+export declare const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export declare const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
-/** The exact `resume()` implementation in eve 0.68.0, 0.71.2, and 0.72.1. */
+/** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
 export declare const EVE_JUST_BASH_RESUME_ORIGINAL = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root \"${a.rootPath}\" no longer exists.`);return await openHandle(e,a.rootPath,t)}";
 /**
  * The replacement `resume()`: a session whose template generation moved is
@@ -293,6 +295,11 @@ export declare const EVE_JUST_BASH_RESUME_ORIGINAL = "async resume(e,n,r){let i=
  * current template instead of failing every later sandbox call.
  */
 export declare const EVE_SANDBOX_RESUME_PATCHED = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if((a.generation!==o||a.rootPath!==s)&&dirname(a.rootPath)!==dirname(s))throw Error(`just-bash session state is incompatible with this environment.`);await ensureSessionRoot(i,a.rootPath);if(a.generation!==o)await edenRefreshJustBashSessionSkills(i.templateRootPath,a.rootPath);return await openHandle(e,a.rootPath,t)}";
+/**
+ * Eve 0.79.1 resolves the current template key under the runtime cache.
+ * Its ensureSessionRoot accepts that path, not the prepared artifact.
+ */
+export declare const EVE_SANDBOX_RESUME_PATCHED_LATEST = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if((a.generation!==o||a.rootPath!==s)&&dirname(a.rootPath)!==dirname(s))throw Error(`just-bash session state is incompatible with this environment.`);let c=resolveTemplateRootPath(e.storagePath,i.templateKey);await ensureSessionRoot(c,a.rootPath);if(a.generation!==o)await edenRefreshJustBashSessionSkills(c,a.rootPath);return await openHandle(e,a.rootPath,t)}";
 /**
  * Helpers appended to the patched binding. They use only identifiers the
  * module already imports (`readdir`, `rm`, `join`, `pathExists`,
@@ -305,7 +312,7 @@ export declare const EVE_SANDBOX_RESUME_PATCH_HELPERS = "async function edenRefr
 /**
  * The CommonJS patcher the isolated builder runs between the frozen install
  * and `eve build` (and again for the production reinstall). It never touches
- * project files, applies only against the known sha256, verifies the
+ * project files, applies only against known sha256 hashes, verifies the
  * replacement matched exactly once, validates the result with `node --check`,
  * and breaks hardlinks by writing a temp file and renaming it into place.
  */

package/dist/eve-packaging.js

@@ -40,15 +40,17 @@ const IGNORED_BUILDS_GUARD = `node -e 'const m=JSON.parse(require("fs").readFile
  * rewrites one file in the installed Eve copy so an existing session reopens
  * against the current template instead of throwing; user files under
  * `/workspace` always win over the template. The patch applies only when the
- * target file's sha256 equals `EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256`, and it
- * is removed entirely once upstream ships the fix.
+ * target file's sha256 matches a known binding and selects that binding's
+ * replacement; it is removed entirely once upstream ships the fix.
  */
 export const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f67a6028f1675bf7c04b22454b4ebfb4cd9d19e5bf5aaf8";
+/** Eve 0.79.1 stores a template key instead of an absolute template path. */
+export const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
 /** Path of the just-bash binding inside the resolved Eve package root. */
 const EVE_JUST_BASH_BINDING_PATH = "dist/src/execution/sandbox/bindings/just-bash.js";
-/** The exact `resume()` implementation in eve 0.68.0, 0.71.2, and 0.72.1. */
+/** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
 export const EVE_JUST_BASH_RESUME_ORIGINAL = `async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(\`just-bash session state is incompatible with this environment.\`);if(!await pathExists(a.rootPath))throw Error(\`just-bash session root "\${a.rootPath}" no longer exists.\`);return await openHandle(e,a.rootPath,t)}`;
 /**
  * The replacement `resume()`: a session whose template generation moved is
@@ -58,6 +60,11 @@ export const EVE_JUST_BASH_RESUME_ORIGINAL = `async resume(e,n,r){let i=requireP
  * current template instead of failing every later sandbox call.
  */
 export const EVE_SANDBOX_RESUME_PATCHED = `async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if((a.generation!==o||a.rootPath!==s)&&dirname(a.rootPath)!==dirname(s))throw Error(\`just-bash session state is incompatible with this environment.\`);await ensureSessionRoot(i,a.rootPath);if(a.generation!==o)await edenRefreshJustBashSessionSkills(i.templateRootPath,a.rootPath);return await openHandle(e,a.rootPath,t)}`;
+/**
+ * Eve 0.79.1 resolves the current template key under the runtime cache.
+ * Its ensureSessionRoot accepts that path, not the prepared artifact.
+ */
+export const EVE_SANDBOX_RESUME_PATCHED_LATEST = `async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if((a.generation!==o||a.rootPath!==s)&&dirname(a.rootPath)!==dirname(s))throw Error(\`just-bash session state is incompatible with this environment.\`);let c=resolveTemplateRootPath(e.storagePath,i.templateKey);await ensureSessionRoot(c,a.rootPath);if(a.generation!==o)await edenRefreshJustBashSessionSkills(c,a.rootPath);return await openHandle(e,a.rootPath,t)}`;
 /**
  * Helpers appended to the patched binding. They use only identifiers the
  * module already imports (`readdir`, `rm`, `join`, `pathExists`,
@@ -72,7 +79,7 @@ async function edenFindTemplateSkillsRelativePath(e){let t=[["",0]];for(;t.lengt
 /**
  * The CommonJS patcher the isolated builder runs between the frozen install
  * and `eve build` (and again for the production reinstall). It never touches
- * project files, applies only against the known sha256, verifies the
+ * project files, applies only against known sha256 hashes, verifies the
  * replacement matched exactly once, validates the result with `node --check`,
  * and breaks hardlinks by writing a temp file and renaming it into place.
  */
@@ -81,17 +88,24 @@ export const EVE_SANDBOX_RESUME_PATCH_SCRIPT = `// Eden temporary fix for https:
 // sandbox template changes (skills, agent/sandbox/workspace/, sandbox
 // definition) and never falls back. This rewrites one file in the installed
 // Eve copy so an existing session reopens against the current template. It
-// runs only against the sha256 Eden knows and is removed once upstream
-// ships the fix.
+// runs only against sha256 hashes Eden knows, with a replacement specific to
+// each binding, and is removed once upstream ships the fix.
 const fs = require("node:fs");
 const path = require("node:path");
 const crypto = require("node:crypto");
 const { spawnSync } = require("node:child_process");
-const KNOWN_SHA256 = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256)};
+const KNOWN_PATCHES = ${JSON.stringify({
+    [EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256]: {
+        original: EVE_JUST_BASH_RESUME_ORIGINAL,
+        replacement: EVE_SANDBOX_RESUME_PATCHED,
+    },
+    [EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256]: {
+        original: EVE_JUST_BASH_RESUME_ORIGINAL,
+        replacement: EVE_SANDBOX_RESUME_PATCHED_LATEST,
+    },
+})};
 const SIGNATURE = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_SIGNATURE)};
 const BINDING_PATH = ${JSON.stringify(EVE_JUST_BASH_BINDING_PATH)};
-const ORIGINAL = ${JSON.stringify(EVE_JUST_BASH_RESUME_ORIGINAL)};
-const PATCHED_RESUME = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCHED)};
 const HELPERS = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_HELPERS)};
 function finish(outcome, detail) {
   console.log("eden-eve-sandbox-resume-patch: " + outcome + " (" + detail + ")");
@@ -116,10 +130,12 @@ if (source.includes(SIGNATURE)) {
   process.exit(0);
 }
 const digest = crypto.createHash("sha256").update(source).digest("hex");
-if (digest !== KNOWN_SHA256) {
+const patch = KNOWN_PATCHES[digest];
+if (patch === undefined) {
   finish("skipped", "sha256 " + digest + " is not a version Eden knows (eve#4440)");
   process.exit(0);
 }
+const { original: ORIGINAL, replacement: PATCHED_RESUME } = patch;
 const first = source.indexOf(ORIGINAL);
 if (first === -1 || source.indexOf(ORIGINAL, first + 1) !== -1) {
   console.error("eden-eve-sandbox-resume-patch: the known resume implementation did not match exactly once; refusing to patch");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.7.0",
+    "@moinulmoin/eden-runtime-cloudflare": "0.7.2",
     "wrangler": "4.147.0"
   },
   "devDependencies": {