@moinulmoin/eden 0.7.4 → 0.9.0

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.7.4
+npm install --global @moinulmoin/eden@0.9.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.7.4
+pnpm add --global @moinulmoin/eden@0.9.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.7.4
+bun add --global @moinulmoin/eden@0.9.0
 ```
 
 Then confirm the CLI is available:

package/dist/eve-control-plane.js

@@ -8,7 +8,7 @@ import { execFile, spawn, } from "node:child_process";
 import { fileURLToPath, } from "node:url";
 import { promisify, } from "node:util";
 import { EveCliError, EVE_NAME_PATTERN, } from "./eve.js";
-import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
+import { buildEveProjectSnapshot, checkEveSandboxProvider, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
 import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
 import { createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
@@ -65,6 +65,7 @@ function mapPackagingCheck(value) {
             case "DOCKER_PLATFORM_BLOCKED":
                 return "VAL-BUILD-005";
             case "EVE_SANDBOX_RESUME_PATCH":
+            case "EVE_SANDBOX_PROVIDER":
                 return value.id;
             default:
                 return `EVE-${value.id}`;
@@ -214,10 +215,82 @@ function pooledPostgresReason(connectionString) {
     return undefined;
 }
 /**
- * Non-blocking World warnings. The container wipes its disk on sleep, so the
- * default local World loses pending approvals and sessions; and a pooled
- * Postgres URL breaks the World streamer, which relies on LISTEN/NOTIFY.
+ * Recognizes the generated channel, not arbitrary user authentication policies.
+ * The calls below match the Eve 0.82 initializer's agent/channels/eve.ts.
  */
+async function collectEveSetupWarnings(projectRoot) {
+    const warnings = [];
+    const source = async (path) => {
+        try {
+            return await readFile(join(projectRoot, path), "utf8");
+        }
+        catch {
+            return "";
+        }
+    };
+    const channel = (await source("agent/channels/eve.ts"))
+        .replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/gu, "")
+        .replace(/\s+/gu, "");
+    if (/exportdefaulteveChannel\(\{auth:\[vercelOidc\(\),localDev\(\),placeholderAuth\(\),?\],?\}\);?$/u
+        .test(channel)) {
+        warnings.push({
+            id: "EVE_AUTH_SCAFFOLD",
+            message: "Eve's generated channel auth does not grant Cloudflare callers access.",
+            remediation: "Replace agent/channels/eve.ts auth with your app's authenticator; put credentials in --env-file.",
+        });
+    }
+    try {
+        const manifest = JSON.parse(await source("package.json"));
+        const agent = await source("agent/agent.ts");
+        if (/export\s+default\s+defineAgent\s*\(\s*\{\s*model\s*:\s*["'][^"']+["']\s*,\s*reasoning\s*:\s*["'][^"']+["']\s*,?\s*\}\s*\)/u.test(agent)) {
+            warnings.push({
+                id: "EVE_WORLD_LOCAL",
+                message: "Local World stores memory on container disk; updates or a lost sleep snapshot reset sessions and approvals.",
+                remediation: "Configure @workflow/world-postgres; see docs/deploy.md#durable-state-postgres-world.",
+            });
+        }
+        if (manifest.dependencies?.["just-bash"] === undefined &&
+            agent.length > 0 &&
+            !/\bsandbox\s*:/u.test(agent)) {
+            const command = manifest.packageManager?.startsWith("pnpm@")
+                ? "pnpm add just-bash"
+                : "npm install just-bash";
+            warnings.push({
+                id: "EVE_JUST_BASH_MISSING",
+                message: "Eve's default sandbox needs the just-bash production dependency in Eden's builder.",
+                remediation: `Run ${command}, commit the updated manifest and lockfile, then retry.`,
+            });
+        }
+        if (!manifest.packageManager?.startsWith("pnpm@")) {
+            const lockText = await source("package-lock.json");
+            // Same trust level as the manifest above: npm wrote it; packaging validates it.
+            const lock = JSON.parse(lockText === "" ? "{}" : lockText);
+            const entries = lock.packages ?? {};
+            const skipped = new Set();
+            for (const [path, entry] of Object.entries(entries)) {
+                const at = path.lastIndexOf("node_modules/");
+                if (at !== -1 &&
+                    entry.hasInstallScript === true &&
+                    entry.dev !== true &&
+                    entry.optional !== true &&
+                    entry.devOptional !== true) {
+                    skipped.add(path.slice(at + "node_modules/".length));
+                }
+            }
+            if (skipped.size > 0) {
+                warnings.push({
+                    id: "EVE_NPM_INSTALL_SCRIPTS_SKIPPED",
+                    message: `Eden's npm install skips dependency install scripts; these production dependencies have one and may fail at runtime: ${[...skipped].sort().join(", ")}.`,
+                    remediation: "Use packages that need no install script, or switch to exact-pinned pnpm and list them under allowBuilds in pnpm-workspace.yaml.",
+                });
+            }
+        }
+    }
+    catch {
+        // Packaging reports invalid manifests; setup hints must not mask that result.
+    }
+    return warnings;
+}
 async function collectEveWorldWarnings(candidate, runtimeConfig) {
     const warnings = [];
     if (candidate !== undefined) {
@@ -227,7 +300,7 @@ async function collectEveWorldWarnings(candidate, runtimeConfig) {
             world === "@workflow/world-local") {
             warnings.push({
                 id: "EVE_WORLD_LOCAL",
-                message: "This project uses Eve's default local Workflow World; workflow state lives on the container disk, survives sleep, and resets when you update the agent.",
+                message: "Local World stores memory on container disk; updates or a lost sleep snapshot reset sessions and approvals.",
                 remediation: "Configure a durable Workflow World such as @workflow/world-postgres; see docs/deploy.md#durable-state-postgres-world.",
             });
         }
@@ -1981,6 +2054,23 @@ async function collectEvePreflight(request, options) {
             runtimeConfig,
         };
     }
+    const sandboxProvider = await checkEveSandboxProvider(request.projectRoot);
+    if (sandboxProvider !== undefined) {
+        checks.push(check(sandboxProvider.code, "failed", sandboxProvider.message, sandboxProvider.remediation));
+        return {
+            result: {
+                command: request.command === "deploy" ? "eve deploy" : "eve preflight",
+                ok: false,
+                environment: request.environment,
+                name: request.name,
+                checks,
+                warnings,
+                candidate: null,
+            },
+            runtimeConfig,
+        };
+    }
+    warnings.push(...await collectEveSetupWarnings(request.projectRoot));
     eveProgress(options, "packaging project — snapshot, frozen install, eve build");
     const nodeImage = options.nodeImage ?? DEFAULT_EVE_NODE_IMAGE;
     const artifactRoot = options.artifactRoot ??
@@ -2087,6 +2177,10 @@ async function collectEvePreflight(request, options) {
     if (workflowWorld === "@moinulmoin/eden-world-cloudflare") {
         checks.push(check("EVE-WORLD", "passed", "world: Cloudflare Durable Object"));
     }
+    // Compiled configuration supersedes the early generated-source hint.
+    const localHint = warnings.findIndex((warning) => warning.id === "EVE_WORLD_LOCAL");
+    if (localHint !== -1)
+        warnings.splice(localHint, 1);
     warnings.push(...(await collectEveWorldWarnings(candidate, undefined)));
     const schedules = await readCompiledSchedules(candidate);
     const expressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) !== undefined);

package/dist/eve-packaging.d.ts

@@ -1,5 +1,5 @@
 import { type EveRuntimeInputIdentity } from "./eve-runtime-config.js";
-export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED";
+export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "EVE_SANDBOX_PROVIDER" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED";
 export interface EveRuntimeConfigExclusion {
     /**
      * This path is opaque. The packaging worker only uses its lexical identity
@@ -19,18 +19,15 @@ export interface EveNodeImage {
     readonly reference: string;
     readonly digest: string;
 }
+export type EvePackageManager = "pnpm" | "npm";
+export type EveInstallCommand = readonly ["corepack", "pnpm", "install", "--frozen-lockfile"] | readonly ["npm", "ci", "--ignore-scripts", "--no-audit", "--no-fund"];
 export interface EveProjectBuilderRequest {
     readonly generationRoot: string;
     readonly snapshotRoot: string;
     readonly inputManifestPath: string;
     readonly dockerfilePath: string | undefined;
     readonly packageManagerVersion: string;
-    readonly installCommand: readonly [
-        "corepack",
-        "pnpm",
-        "install",
-        "--frozen-lockfile"
-    ];
+    readonly installCommand: EveInstallCommand;
     readonly buildCommand: readonly ["./node_modules/.bin/eve", "build"];
     readonly platform: "linux/amd64";
     readonly sourceDigest: string;
@@ -75,7 +72,7 @@ export interface EveProjectInputManifest {
     readonly requestedRoot: string;
     readonly canonicalRoot: string;
     readonly projectId: string;
-    readonly packageManager: "pnpm";
+    readonly packageManager: EvePackageManager;
     readonly packageManagerVersion: string;
     readonly packageJsonSha256: string;
     readonly lockfileSha256: string;
@@ -123,14 +120,9 @@ export interface EveProjectBuildCandidate {
     readonly generationRoot: string;
     readonly snapshotRoot: string;
     readonly inputManifestPath: string;
-    readonly packageManager: "pnpm";
+    readonly packageManager: EvePackageManager;
     readonly packageManagerVersion: string;
-    readonly installCommand: readonly [
-        "corepack",
-        "pnpm",
-        "install",
-        "--frozen-lockfile"
-    ];
+    readonly installCommand: EveInstallCommand;
     readonly buildCommand: readonly ["./node_modules/.bin/eve", "build"];
     readonly eveExecutable: "node_modules/.bin/eve";
     readonly eveVersion: string;
@@ -145,14 +137,9 @@ export interface EveProjectBuildCandidate {
 }
 export interface EveProjectToolchain {
     readonly nodeVersion: "24.17.0";
-    readonly packageManager: "pnpm";
+    readonly packageManager: EvePackageManager;
     readonly packageManagerVersion: string;
-    readonly installCommand: readonly [
-        "corepack",
-        "pnpm",
-        "install",
-        "--frozen-lockfile"
-    ];
+    readonly installCommand: EveInstallCommand;
     readonly buildCommand: readonly ["./node_modules/.bin/eve", "build"];
     readonly startCommand: readonly [
         "./node_modules/.bin/eve",
@@ -227,7 +214,7 @@ export interface EveProjectPackagingResult {
             readonly sha256: string;
         };
         readonly lockfile: {
-            readonly path: "pnpm-lock.yaml";
+            readonly path: "pnpm-lock.yaml" | "package-lock.json";
             readonly sha256: string;
         };
         readonly sourceDigest: string;
@@ -241,9 +228,10 @@ export interface EveProjectPackagingResult {
     readonly checks: readonly EvePackagingCheck[];
     /**
      * Outcome of the builder's temporary eve#4440 sandbox-resume patch:
-     * `applied` when the shipped just-bash binding carries it, `skipped` when
-     * the binding is a version Eden does not know, `absent` when this Eve
-     * build has no just-bash binding or packaging never reached the image.
+     * `applied` when the shipped just-bash binding carries it, `fixed` when the
+     * installed Eve already includes the upstream fix, `skipped` when the
+     * binding is a version Eden does not know, `absent` when this Eve build has
+     * no just-bash binding or packaging never reached the image.
      */
     readonly sandboxResumePatch: EveSandboxResumePatchStatus;
     readonly candidateImageId: string | null;
@@ -285,6 +273,25 @@ export declare const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f
 export declare const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export declare const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
+/**
+ * First Eve release whose just-bash provider keeps a session's files across
+ * template changes (vercel/eve#5132), so the patch is not needed from here on.
+ */
+export declare const EVE_SANDBOX_RESUME_FIXED_VERSION = "0.83.0";
+/**
+ * True when an installed Eve version already ships the eve#4440 fix. A
+ * prerelease of the fixed version sorts before it (semver), so it may predate
+ * the fix and keeps the patch.
+ */
+export declare function eveIncludesSandboxResumeFix(version: unknown): boolean;
+/**
+ * Early, source-level rejection of sandbox setups that cannot work in Eden's
+ * isolated builder: a native provider named in the sandbox module, or, on Eve
+ * 0.83.0 and later, DefaultSandbox (no module, or one that names it without
+ * JustBash). Anything it cannot recognize is left to
+ * checkPreparedJustBashTemplate, which inspects what `eve build` produced.
+ */
+export declare function checkEveSandboxProvider(projectRoot: string, resolvedVersion?: string): Promise<EvePackagingError | undefined>;
 /** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
 export declare const EVE_JUST_BASH_RESUME_ORIGINAL = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root \"${a.rootPath}\" no longer exists.`);return await openHandle(e,a.rootPath,t)}";
 /**
@@ -318,7 +325,7 @@ export declare const EVE_SANDBOX_RESUME_PATCH_HELPERS = "async function edenRefr
  */
 export declare const EVE_SANDBOX_RESUME_PATCH_SCRIPT: string;
 /** Outcome of the builder's sandbox-resume patch for the packaged image. */
-export type EveSandboxResumePatchStatus = "applied" | "skipped" | "absent";
+export type EveSandboxResumePatchStatus = "applied" | "fixed" | "skipped" | "absent";
 export declare function sha256(value: string | Buffer): string;
 export declare function jsonBytes(value: unknown): Buffer;
 export declare function isWithin(root: string, candidate: string): boolean;

package/dist/eve-packaging.js

@@ -48,6 +48,150 @@ export const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f67a6028f
 export const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
+/**
+ * First Eve release whose just-bash provider keeps a session's files across
+ * template changes (vercel/eve#5132), so the patch is not needed from here on.
+ */
+export const EVE_SANDBOX_RESUME_FIXED_VERSION = "0.83.0";
+/** `major.minor.patch` of a version string; prerelease and build suffixes are dropped. */
+function parseEveRelease(version) {
+    const match = typeof version === "string"
+        ? /^(\d+)\.(\d+)\.(\d+)/u.exec(version)
+        : null;
+    return match === null
+        ? null
+        : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+/**
+ * True when an installed Eve version already ships the eve#4440 fix. A
+ * prerelease of the fixed version sorts before it (semver), so it may predate
+ * the fix and keeps the patch.
+ */
+export function eveIncludesSandboxResumeFix(version) {
+    const installed = parseEveRelease(version);
+    const fixed = parseEveRelease(EVE_SANDBOX_RESUME_FIXED_VERSION);
+    if (installed === null || fixed === null)
+        return false;
+    for (let index = 0; index < 3; index += 1) {
+        if (installed[index] !== fixed[index]) {
+            return (installed[index] ?? 0) > (fixed[index] ?? 0);
+        }
+    }
+    return typeof version === "string" && !/^\d+\.\d+\.\d+-/u.test(version);
+}
+/** Eve 0.83.0 and later no longer fall back to just-bash in production builds. */
+function eveRequiresExplicitJustBash(version) {
+    const release = parseEveRelease(version);
+    return release !== null && (release[0] > 0 || release[1] >= 83);
+}
+/**
+ * Eve reads its sandbox module from either path, with any source extension.
+ * When `agent/sandbox/` exists only the nested module counts: Eve 0.83–0.86
+ * silently ignores `agent/sandbox.ts` and 0.87+ fails the build.
+ */
+const EVE_SANDBOX_MODULE_PATHS = ["agent/sandbox", "agent/sandbox/sandbox"].flatMap((base) => ["ts", "mts", "cts", "tsx", "js", "mjs", "cjs", "jsx"].map((extension) => `${base}.${extension}`));
+function justBashRemediation(command, path) {
+    return `Run ${command} (production dependency), then create or replace ${path} with:\nimport { defineSandbox } from 'eve/sandbox';\nimport { JustBashSandbox } from 'eve/sandbox/just-bash';\nexport const environment = JustBashSandbox.environment();\nexport default defineSandbox(() => environment.open());\nCommit the module, package.json, and updated lockfile, then retry eden preflight. See docs/deploy.md. Do not set EVE_DEV.`;
+}
+/**
+ * Early, source-level rejection of sandbox setups that cannot work in Eden's
+ * isolated builder: a native provider named in the sandbox module, or, on Eve
+ * 0.83.0 and later, DefaultSandbox (no module, or one that names it without
+ * JustBash). Anything it cannot recognize is left to
+ * checkPreparedJustBashTemplate, which inspects what `eve build` produced.
+ */
+export async function checkEveSandboxProvider(projectRoot, resolvedVersion) {
+    const source = async (path) => readFile(join(projectRoot, path), "utf8").catch(() => "");
+    const json = async (path) => {
+        try {
+            const value = JSON.parse(await source(path));
+            return value !== null && typeof value === "object" && !Array.isArray(value)
+                ? value
+                : {};
+        }
+        catch {
+            return {};
+        }
+    };
+    const manifest = await json("package.json");
+    const dependencies = manifest.dependencies;
+    const lock = await json("package-lock.json");
+    const packages = lock.packages;
+    const pnpmLock = await source("pnpm-lock.yaml");
+    const pnpmVersion = /^\s{6}eve:\s*\r?\n\s{8}specifier:[^\n]*\r?\n\s{8}version:\s*['"]?(\d+\.\d+\.\d+(?:-[^('"\s]+)?)/mu
+        .exec(pnpmLock)?.[1];
+    const installed = await json("node_modules/eve/package.json");
+    const declared = typeof dependencies?.eve === "string"
+        ? /^[~^]?(\d+\.\d+\.\d+)/u.exec(dependencies.eve)?.[1]
+        : undefined;
+    const version = resolvedVersion ?? packages?.["node_modules/eve"]?.version ??
+        pnpmVersion ?? installed.version ?? declared;
+    const requiresExplicit = eveRequiresExplicitJustBash(version);
+    const sandboxDirectory = (await lstat(join(projectRoot, "agent/sandbox")).catch(() => undefined))
+        ?.isDirectory() === true;
+    let path;
+    for (const candidate of EVE_SANDBOX_MODULE_PATHS) {
+        if ((await lstat(join(projectRoot, candidate)).catch(() => undefined))?.isFile() === true) {
+            path = candidate;
+            break;
+        }
+    }
+    const module = path === undefined
+        ? ""
+        : (await source(path)).replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/gu, "");
+    const otherProvider = /\b(DefaultSandbox|DockerSandbox|VercelSandbox|VmSandbox|VMSandbox)\b/u
+        .exec(module)?.[1];
+    const justBash = /import\s*\{[^}]*?\bJustBashSandbox(?:\s+as\s+(\w+))?\s*(?:,|\})[^;]*?from\s*["']eve\/sandbox\/just-bash["']/u
+        .exec(module);
+    const binding = justBash?.[1] ?? "JustBashSandbox";
+    const explicit = justBash !== null &&
+        new RegExp(`\\b${binding}\\s*\\.\\s*environment\\s*\\(`, "u").test(module);
+    const native = otherProvider !== undefined && otherProvider !== "DefaultSandbox";
+    const usesDefault = path === undefined || (otherProvider === "DefaultSandbox" && !explicit);
+    const shadowed = requiresExplicit && sandboxDirectory && path?.startsWith("agent/sandbox.") === true;
+    if (!native && !shadowed && !(requiresExplicit && usesDefault))
+        return undefined;
+    const target = shadowed || (path === undefined && sandboxDirectory)
+        ? "agent/sandbox/sandbox.ts"
+        : path ?? "agent/sandbox.ts";
+    const command = typeof manifest.packageManager === "string" &&
+        manifest.packageManager.startsWith("pnpm@")
+        ? "pnpm add just-bash"
+        : "npm install just-bash";
+    return new EvePackagingError({
+        code: "EVE_SANDBOX_PROVIDER",
+        subject: target,
+        reason: shadowed
+            ? `${String(path)} sits beside the agent/sandbox/ directory, where Eve ${String(version)} reads only agent/sandbox/sandbox.ts: Eve 0.83–0.86 ignores ${String(path)} and falls back to DefaultSandbox, and 0.87 and later fail the build.`
+            : native
+                ? `${target} selects ${otherProvider}, which Eden does not support; use explicit JustBash instead.`
+                : path === undefined
+                    ? `Eve ${String(version)} has no sandbox module, so it uses DefaultSandbox, which has no provider in Eden's isolated builder: production builds no longer fall back to just-bash.`
+                    : `${target} selects DefaultSandbox, which has no provider in Eden's isolated builder on Eve ${String(version)}: production builds no longer fall back to just-bash.`,
+        remediation: shadowed
+            ? `Move ${String(path)} to agent/sandbox/sandbox.ts (delete it instead if agent/sandbox/sandbox.ts already exists), then retry eden preflight.`
+            : justBashRemediation(command, target),
+    });
+}
+/**
+ * Ground truth after `eve build`: on Eve 0.83.0 and later an agent whose
+ * sandbox resolved to no provider prepares no template and would fail to open
+ * its sandbox on Cloudflare, however its sandbox module is written.
+ */
+async function checkPreparedJustBashTemplate(snapshotRoot, version) {
+    if (!eveRequiresExplicitJustBash(version))
+        return undefined;
+    const templatesPath = `${EVE_SANDBOX_CACHE_ROOT}/just-bash/templates`;
+    const templates = await readdir(join(snapshotRoot, templatesPath)).catch(() => []);
+    if (templates.length > 0)
+        return undefined;
+    return new EvePackagingError({
+        code: "EVE_SANDBOX_PROVIDER",
+        subject: templatesPath,
+        reason: `Eve ${version} built no just-bash sandbox template, so the agent's sandbox would fail to open on Cloudflare; its sandbox module does not resolve to JustBash.`,
+        remediation: justBashRemediation("npm install just-bash (or pnpm add just-bash)", "agent/sandbox.ts (agent/sandbox/sandbox.ts when agent/sandbox/ exists)"),
+    });
+}
 /** Path of the just-bash binding inside the resolved Eve package root. */
 const EVE_JUST_BASH_BINDING_PATH = "dist/src/execution/sandbox/bindings/just-bash.js";
 /** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
@@ -107,9 +251,23 @@ const KNOWN_PATCHES = ${JSON.stringify({
 const SIGNATURE = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_SIGNATURE)};
 const BINDING_PATH = ${JSON.stringify(EVE_JUST_BASH_BINDING_PATH)};
 const HELPERS = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_HELPERS)};
+const FIXED_VERSION = ${JSON.stringify(EVE_SANDBOX_RESUME_FIXED_VERSION)};
 function finish(outcome, detail) {
   console.log("eden-eve-sandbox-resume-patch: " + outcome + " (" + detail + ")");
 }
+function parseRelease(version) {
+  const match = typeof version === "string" ? /^(\\d+)\\.(\\d+)\\.(\\d+)/.exec(version) : null;
+  return match === null ? null : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function includesFix(version) {
+  const installed = parseRelease(version);
+  const fixed = parseRelease(FIXED_VERSION);
+  if (installed === null || fixed === null) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (installed[index] !== fixed[index]) return installed[index] > fixed[index];
+  }
+  return !/^\\d+\\.\\d+\\.\\d+-/.test(version);
+}
 let packageJsonPath;
 try {
   packageJsonPath = fs.realpathSync("node_modules/eve/package.json");
@@ -125,6 +283,16 @@ try {
   finish("absent", "this eve build has no just-bash binding");
   process.exit(0);
 }
+let eveVersion;
+try {
+  eveVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")).version;
+} catch {
+  eveVersion = undefined;
+}
+if (!source.includes(SIGNATURE) && includesFix(eveVersion)) {
+  finish("fixed", "eve " + eveVersion + " includes the upstream fix for eve#4440");
+  process.exit(0);
+}
 if (source.includes(SIGNATURE)) {
   finish("applied", "already patched");
   process.exit(0);
@@ -167,6 +335,9 @@ const INSTALL_COMMAND = [
     "install",
     "--frozen-lockfile",
 ];
+const NPM_INSTALL_COMMAND = ["npm", "ci", "--ignore-scripts", "--no-audit", "--no-fund"];
+// Install this exact isolated manager without consulting project npm configuration.
+const NPM_VERSION = "11.13.0";
 const BUILD_COMMAND = ["./node_modules/.bin/eve", "build"];
 const EVE_ENTRYPOINT = ".output/server/index.mjs";
 const EVE_EXCLUDED_DIRECTORY_NAMES = new Set([
@@ -201,6 +372,7 @@ const EVE_COMPETING_LOCKFILES = new Set([
     "bun.lock",
     "bun.lockb",
     "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
     "package-lock.json",
     "yarn.lock",
 ]);
@@ -548,37 +720,76 @@ function validateProjectContract(inputs) {
             remediation: "Add a non-empty package.json name and retry.",
         });
     }
-    const packageManagerVersion = parsePnpmVersion(packageValue.packageManager);
-    const lockFiles = inputs.files.filter((file) => file.relativePath === "pnpm-lock.yaml" ||
-        file.relativePath.endsWith("/pnpm-lock.yaml"));
-    if (lockFiles.length !== 1 || lockFiles[0]?.relativePath !== "pnpm-lock.yaml") {
+    const npmLock = inputs.files.find((file) => file.relativePath === "package-lock.json");
+    const packageManager = npmLock === undefined ? "pnpm" : "npm";
+    const lockfilePath = packageManager === "npm" ? "package-lock.json" : "pnpm-lock.yaml";
+    const npmPin = typeof packageValue.packageManager === "string"
+        ? /^npm@((?:[7-9]|[1-9][0-9]+)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*))$/u.exec(packageValue.packageManager)?.[1]
+        : undefined;
+    const packageManagerVersion = packageManager === "pnpm"
+        ? parsePnpmVersion(packageValue.packageManager)
+        : npmPin ?? NPM_VERSION;
+    const lockFiles = inputs.files.filter((file) => file.relativePath === lockfilePath || file.relativePath.endsWith(`/${lockfilePath}`));
+    if (lockFiles.length !== 1 || lockFiles[0]?.relativePath !== lockfilePath) {
         throw new EvePackagingError({
             code: "DEPENDENCY_AMBIGUITY",
-            subject: "pnpm-lock.yaml",
-            reason: "The selected Eve root must contain exactly one regular root pnpm-lock.yaml.",
+            subject: lockfilePath,
+            reason: "The selected Eve root must contain exactly one regular root lockfile.",
             remediation: "Remove competing or nested lockfiles and retry with the matching root lockfile.",
         });
     }
-    const competing = inputs.files.find((file) => EVE_COMPETING_LOCKFILES.has(basename(file.relativePath)));
+    const competing = inputs.files.find((file) => EVE_COMPETING_LOCKFILES.has(basename(file.relativePath)) && file.relativePath !== lockfilePath);
     if (competing !== undefined) {
         throw new EvePackagingError({
             code: "DEPENDENCY_AMBIGUITY",
             subject: competing.relativePath,
             reason: "A competing package-manager lockfile was found at the selected Eve root.",
-            remediation: "Keep only the pinned pnpm toolchain and its matching root lockfile.",
+            remediation: "Keep only one supported package manager and its matching root lockfile.",
+        });
+    }
+    if (packageManager === "npm" && packageValue.packageManager !== undefined &&
+        npmPin === undefined) {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_TOOLCHAIN",
+            subject: "package.json.packageManager",
+            reason: "npm projects may omit packageManager or declare an exact npm version (major 7 or newer).",
+            remediation: `Remove the optional packageManager field to use npm@${NPM_VERSION}, or declare an exact npm@<major>.<minor>.<patch> pin.`,
         });
     }
     const lockfile = lockFiles[0];
-    if (lockfile === undefined || !lockfileMatchesPnpm(packageManagerVersion, lockfile.bytes)) {
+    let npmLockValid = false;
+    if (packageManager === "npm" && lockfile !== undefined) {
+        try {
+            const parsed = JSON.parse(lockfile.bytes.toString("utf8"));
+            npmLockValid = (parsed.lockfileVersion === 2 || parsed.lockfileVersion === 3) &&
+                parsed.packages !== null && typeof parsed.packages === "object" &&
+                !Array.isArray(parsed.packages) && parsed.packages[""] !== undefined;
+            for (const entry of Object.values(parsed.packages ?? {})) {
+                const dependency = entry;
+                if (typeof dependency.resolved === "string" &&
+                    !dependency.resolved.startsWith("https://registry.npmjs.org/"))
+                    npmLockValid = false;
+            }
+        }
+        catch {
+            npmLockValid = false;
+        }
+    }
+    if (lockfile === undefined || (packageManager === "pnpm"
+        ? !lockfileMatchesPnpm(packageManagerVersion, lockfile.bytes)
+        : !npmLockValid)) {
         throw new EvePackagingError({
             code: "DEPENDENCY_AMBIGUITY",
-            subject: "pnpm-lock.yaml",
-            reason: "The root pnpm-lock.yaml is malformed or does not match the exact packageManager pin.",
-            remediation: "Regenerate the lockfile with the declared pnpm version, without changing it during packaging.",
+            subject: lockfilePath,
+            reason: "The root lockfile is malformed or incompatible with the selected package manager or public registry.",
+            remediation: "Regenerate the root lockfile with the selected manager and public npm registry; private registries and project .npmrc configuration are not supported.",
         });
     }
     return {
         projectId,
+        packageManager,
+        lockfilePath,
+        installCommand: packageManager === "npm" ? NPM_INSTALL_COMMAND : INSTALL_COMMAND,
         packageManagerVersion,
         packageJsonSha256: packageFile.sha256,
         lockfileSha256: lockfile.sha256,
@@ -1077,7 +1288,7 @@ export async function eveSnapshotSourceEntries(snapshotRoot) {
 }
 async function writeDockerBuildFiles(options) {
     const image = imageReference(options.nodeImage, "The Linux/amd64 builder requires an immutable Node 24 image digest.", "Supply a verified Node 24 image reference and sha256 digest.");
-    const installSources = ["package.json", "pnpm-lock.yaml"];
+    const installSources = ["package.json", options.lockfilePath];
     if ((await lstat(join(options.snapshotRoot, "pnpm-workspace.yaml"))
         .catch(() => undefined))?.isFile() === true) {
         installSources.push("pnpm-workspace.yaml");
@@ -1085,17 +1296,27 @@ async function writeDockerBuildFiles(options) {
     const runtimeSourceCopies = (await eveSnapshotSourceEntries(options.snapshotRoot))
         .map((name) => `COPY --from=builder ${JSON.stringify([`/workspace/${name}`, `/app/${name}`])}`)
         .join("\n");
+    const npm = options.packageManager === "npm";
+    const lockCheck = `test "$(sha256sum ${options.lockfilePath} | cut -d ' ' -f1)" = "${options.lockfileSha256}"`;
+    const managerSetup = npm
+        ? `npm install --global npm@${options.packageManagerVersion} --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/ && test "$(npm --version)" = "${options.packageManagerVersion}"`
+        : `corepack enable && corepack prepare pnpm@${options.packageManagerVersion} --activate && test "$(corepack pnpm --version)" = "${options.packageManagerVersion}"`;
+    const install = npm
+        ? "npm ci --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/"
+        : "corepack pnpm install --frozen-lockfile --config.node-linker=hoisted --config.strict-dep-builds=false";
+    const productionInstall = npm
+        ? `${install} --omit=dev`
+        : "corepack pnpm install --frozen-lockfile --prod --config.node-linker=hoisted --config.strict-dep-builds=false";
+    const policy = npm ? "" : ` && ${IGNORED_BUILDS_GUARD}`;
     const dockerfile = `# syntax=docker/dockerfile:1
 FROM --platform=linux/amd64 ${image} AS builder
 WORKDIR /workspace
 COPY ${JSON.stringify([...installSources, "./"])}
-RUN corepack enable \\
-  && corepack prepare pnpm@${options.packageManagerVersion} --activate \\
-  && test "$(corepack pnpm --version)" = "${options.packageManagerVersion}" \\
-  && test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}" \\
-  && corepack pnpm install --frozen-lockfile --config.node-linker=hoisted --config.strict-dep-builds=false \\
-  && ${IGNORED_BUILDS_GUARD}
-${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}RUN test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}"
+RUN ${managerSetup} \\
+  && ${lockCheck} \\
+  && ${install}${policy} \\
+  && ${lockCheck}
+${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}RUN ${lockCheck}
 COPY . ./
 RUN test -x ./node_modules/.bin/eve \\
   && ./node_modules/.bin/eve build \\
@@ -1103,10 +1324,10 @@ RUN test -x ./node_modules/.bin/eve \\
 
 FROM builder AS runtime-deps
 RUN rm -rf node_modules \\
-  && corepack pnpm install --frozen-lockfile --prod --config.node-linker=hoisted --config.strict-dep-builds=false \\
-  && ${IGNORED_BUILDS_GUARD} \\
+  && ${productionInstall}${policy} \\
+  && ${lockCheck} \\
   && for l in node_modules/.bin/*; do t=$(readlink "$l") || continue; case "$t" in /*) ln -sfn "$(realpath --relative-to=node_modules/.bin "$t")" "$l" ;; esac; done
-${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}
+${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}RUN ${lockCheck}
 
 FROM --platform=linux/amd64 ${image} AS runtime
 WORKDIR /app
@@ -1422,6 +1643,14 @@ async function scanGeneratedSandboxCache(snapshotRoot) {
             const relativePath = relativeDirectory.length === 0
                 ? entry.name
                 : `${relativeDirectory}/${entry.name}`;
+            if (relativeDirectory === "" && entry.name !== "just-bash") {
+                throw new EvePackagingError({
+                    code: "EVE_SANDBOX_PROVIDER",
+                    subject: `${EVE_SANDBOX_CACHE_ROOT}/${entry.name}`,
+                    reason: `The Eve build prepared a ${entry.name} sandbox template; Eden supports only just-bash templates.`,
+                    remediation: "Replace the sandbox module with the explicit JustBash environment in docs/deploy.md, run npm install just-bash (or pnpm add just-bash), commit the module and lockfile, then retry eden preflight without EVE_DEV.",
+                });
+            }
             const candidate = join(directory, entry.name);
             if (entry.isSymbolicLink()) {
                 throw new EvePackagingError({
@@ -1627,20 +1856,50 @@ function classifyPnpmInstallFailure(stderr) {
     }
     return undefined;
 }
+function classifyNpmInstallFailure(stderr) {
+    if (!/\bnpm (?:ci|install|error|ERR!)/u.test(stderr))
+        return undefined;
+    const code = /npm (?:error|ERR!) code ([A-Z0-9_]+)/u.exec(stderr)?.[1];
+    return new EvePackagingError({
+        code: "DEPENDENCY_AMBIGUITY",
+        subject: code === undefined ? "frozen npm install" : `npm ${code}`,
+        reason: "The isolated pinned npm install could not complete with the captured lockfile and disabled lifecycle scripts.",
+        remediation: "Fix the reported npm failure; regenerate package-lock.json with the selected exact npm version if it is out of sync. Use public registry dependencies without .npmrc credentials or dependency build scripts.",
+    });
+}
+/**
+ * The failing BuildKit step's own output (`#<step> <seconds> <line>`), last 20
+ * lines, so Eve's error reaches the user instead of a generic build failure.
+ */
+function failingDockerStepOutput(stderr) {
+    const step = [...stderr.matchAll(/^#(\d+) ERROR:/gmu)].at(-1)?.[1];
+    if (step === undefined)
+        return undefined;
+    const lines = [...stderr.matchAll(new RegExp(`^#${step} \\d+\\.\\d+ (.*)$`, "gmu"))]
+        .map((match) => (match[1] ?? "").trimEnd())
+        .filter((line) => line.length > 0)
+        .slice(-20);
+    if (lines.length === 0)
+        return undefined;
+    const output = lines.join("\n");
+    return output.length > 2000 ? `…${output.slice(-2000)}` : output;
+}
 function classifyEveBuildFailure(stderr) {
+    const output = failingDockerStepOutput(stderr);
+    const reported = output === undefined ? "" : `\nEve reported:\n${output}`;
     if (/\bjust-bash\b/u.test(stderr)) {
         return new EvePackagingError({
             code: "EVE_BUILD_FAILED",
             subject: "eve build",
-            reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder because Eve's default sandbox needs just-bash where no Docker daemon or /dev/kvm exists.",
-            remediation: "Declare just-bash as a production dependency of the Eve project, regenerate pnpm-lock.yaml, and retry.",
+            reason: `The project-local Eve build failed inside the isolated Linux/amd64 builder because Eve's default sandbox needs just-bash where no Docker daemon or /dev/kvm exists.${reported}`,
+            remediation: "Declare just-bash as a production dependency of the Eve project, regenerate its package-manager lockfile, and retry.",
         });
     }
     return new EvePackagingError({
         code: "EVE_BUILD_FAILED",
         subject: "eve build",
-        reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder.",
-        remediation: "Fix the project-local Eve build and retry without changing the authored project during packaging.",
+        reason: `The project-local Eve build failed inside the isolated Linux/amd64 builder.${reported}`,
+        remediation: "Fix the error Eve reported (run eve build locally to reproduce it) and retry.",
     });
 }
 function classifyDockerBuildFailure(error) {
@@ -1655,6 +1914,9 @@ function classifyDockerBuildFailure(error) {
         if (/\beve\b/u.test(step) && /\bbuild\b/u.test(step)) {
             return classifyEveBuildFailure(stderr);
         }
+        if (/\bnpm\b/u.test(step)) {
+            return classifyNpmInstallFailure(`npm ci\n${stderr}`);
+        }
         if (/pnpm|corepack/u.test(step)) {
             const pnpmFailure = classifyPnpmInstallFailure(stderr);
             if (pnpmFailure !== undefined)
@@ -1670,6 +1932,9 @@ function classifyDockerBuildFailure(error) {
     const pnpmFailure = classifyPnpmInstallFailure(stderr);
     if (pnpmFailure !== undefined)
         return pnpmFailure;
+    const npmFailure = classifyNpmInstallFailure(stderr);
+    if (npmFailure !== undefined)
+        return npmFailure;
     if (/\bjust-bash\b|Cannot find package/u.test(stderr)) {
         return classifyEveBuildFailure(stderr);
     }
@@ -1748,9 +2013,18 @@ async function detectEveSandboxResumePatch(snapshotRoot) {
     try {
         const packageJsonPath = await realpath(join(snapshotRoot, "node_modules/eve/package.json"));
         const binding = await readFile(join(dirname(packageJsonPath), EVE_JUST_BASH_BINDING_PATH), "utf8");
-        return binding.includes(EVE_SANDBOX_RESUME_PATCH_SIGNATURE)
-            ? "applied"
-            : "skipped";
+        if (binding.includes(EVE_SANDBOX_RESUME_PATCH_SIGNATURE))
+            return "applied";
+        const version = await readFile(packageJsonPath, "utf8")
+            .then((text) => {
+            const manifest = JSON.parse(text);
+            return typeof manifest === "object" && manifest !== null &&
+                "version" in manifest
+                ? manifest.version
+                : undefined;
+        })
+            .catch(() => undefined);
+        return eveIncludesSandboxResumeFix(version) ? "fixed" : "skipped";
     }
     catch {
         return "absent";
@@ -1915,7 +2189,7 @@ export async function buildEveProjectSnapshot(options) {
         requestedRoot: roots.requestedRoot,
         canonicalRoot: roots.canonicalRoot,
         projectId: contract.projectId,
-        packageManager: "pnpm",
+        packageManager: contract.packageManager,
         packageManagerVersion: contract.packageManagerVersion,
         packageJsonSha256: contract.packageJsonSha256,
         lockfileSha256: contract.lockfileSha256,
@@ -1958,6 +2232,9 @@ export async function buildEveProjectSnapshot(options) {
         const afterCopyRace = await sourceRaceErrorIfChanged(roots.canonicalRoot, initialInputs, initialRuntimeInputIdentity, options.runtimeConfig, resolve(options.artifactRoot), roots.requestedRoot);
         if (afterCopyRace !== undefined)
             return blockedResult(afterCopyRace, { writtenPaths });
+        const sandboxProvider = await checkEveSandboxProvider(snapshotRoot);
+        if (sandboxProvider !== undefined)
+            throw sandboxProvider;
         const nodeImage = options.nodeImage ?? options.builder.nodeImage;
         let actualDockerfilePath;
         if (nodeImage !== undefined) {
@@ -1965,6 +2242,8 @@ export async function buildEveProjectSnapshot(options) {
                 snapshotRoot,
                 dockerfilePath,
                 nodeImage,
+                packageManager: contract.packageManager,
+                lockfilePath: contract.lockfilePath,
                 packageManagerVersion: contract.packageManagerVersion,
                 lockfileSha256: contract.lockfileSha256,
             });
@@ -1977,7 +2256,7 @@ export async function buildEveProjectSnapshot(options) {
             inputManifestPath,
             dockerfilePath: actualDockerfilePath,
             packageManagerVersion: contract.packageManagerVersion,
-            installCommand: INSTALL_COMMAND,
+            installCommand: contract.installCommand,
             buildCommand: BUILD_COMMAND,
             platform: "linux/amd64",
             sourceDigest: initialInputs.sourceDigest,
@@ -2009,31 +2288,37 @@ export async function buildEveProjectSnapshot(options) {
             const cleanupError = await discardBuiltCandidate();
             return blockedResult(cleanupError ?? afterBuildRace, { writtenPaths });
         }
-        const snapshotLockfile = await readStableFile(join(snapshotRoot, "pnpm-lock.yaml"), snapshotRoot);
+        const snapshotLockfile = await readStableFile(join(snapshotRoot, contract.lockfilePath), snapshotRoot);
         if (snapshotLockfile.sha256 !== contract.lockfileSha256 ||
             !snapshotLockfile.bytes.equals(contract.lockfileBytes)) {
             const dependencyError = new EvePackagingError({
                 code: "DEPENDENCY_AMBIGUITY",
-                subject: "pnpm-lock.yaml",
+                subject: contract.lockfilePath,
                 reason: "The frozen install changed the captured lockfile bytes.",
-                remediation: "Use the exact declared pnpm version with pnpm install --frozen-lockfile.",
+                remediation: "Use the selected exact package manager with its frozen install command.",
             });
             const cleanupError = await discardBuiltCandidate();
             return blockedResult(cleanupError ?? dependencyError, { writtenPaths });
         }
         const eve = await resolveProjectLocalEve(snapshotRoot);
+        const sandboxProviderAfterBuild = await checkEveSandboxProvider(snapshotRoot, eve.version);
+        if (sandboxProviderAfterBuild !== undefined)
+            throw sandboxProviderAfterBuild;
         const sandboxResumePatch = await detectEveSandboxResumePatch(snapshotRoot);
         const output = await scanGeneratedOutput(snapshotRoot);
         const sandboxCache = await scanGeneratedSandboxCache(snapshotRoot);
+        const preparedTemplate = await checkPreparedJustBashTemplate(snapshotRoot, eve.version);
+        if (preparedTemplate !== undefined)
+            throw preparedTemplate;
         await assertGeneratedTreesExcludeSecrets(snapshotRoot);
         const snapshotSourceDigest = await snapshotDigest(snapshotRoot);
         const runtimeManifestPath = join(generationRoot, "runtime-manifest.json");
         await writeJson(runtimeManifestPath, {
             version: 1,
             generationId: basename(generationRoot),
-            packageManager: "pnpm",
+            packageManager: contract.packageManager,
             packageManagerVersion: contract.packageManagerVersion,
-            installCommand: INSTALL_COMMAND,
+            installCommand: contract.installCommand,
             buildCommand: BUILD_COMMAND,
             startCommand: START_COMMAND,
             sourceDigest: initialInputs.sourceDigest,
@@ -2093,7 +2378,7 @@ export async function buildEveProjectSnapshot(options) {
                 sha256: contract.packageJsonSha256,
             },
             lockfile: {
-                path: "pnpm-lock.yaml",
+                path: contract.lockfilePath,
                 sha256: contract.lockfileSha256,
             },
             sourceDigest: initialInputs.sourceDigest,
@@ -2104,9 +2389,9 @@ export async function buildEveProjectSnapshot(options) {
             generationRoot,
             snapshotRoot,
             inputManifestPath,
-            packageManager: "pnpm",
+            packageManager: contract.packageManager,
             packageManagerVersion: contract.packageManagerVersion,
-            installCommand: INSTALL_COMMAND,
+            installCommand: contract.installCommand,
             buildCommand: BUILD_COMMAND,
             eveExecutable: "node_modules/.bin/eve",
             eveVersion: eve.version,
@@ -2137,9 +2422,9 @@ export async function buildEveProjectSnapshot(options) {
             snapshot,
             toolchain: {
                 nodeVersion: "24.17.0",
-                packageManager: "pnpm",
+                packageManager: contract.packageManager,
                 packageManagerVersion: contract.packageManagerVersion,
-                installCommand: INSTALL_COMMAND,
+                installCommand: contract.installCommand,
                 buildCommand: BUILD_COMMAND,
                 startCommand: START_COMMAND,
                 eveExecutable: eve.path,
@@ -2172,7 +2457,7 @@ export async function buildEveProjectSnapshot(options) {
                     id: "VAL-BUILD-001",
                     status: "pass",
                     subject: "package-manager",
-                    reason: "The exact pnpm pin and one matching regular root lockfile were verified.",
+                    reason: "The selected package manager and one matching regular root lockfile were verified.",
                     remediation: null,
                 },
                 {
@@ -2205,6 +2490,15 @@ export async function buildEveProjectSnapshot(options) {
                             remediation: null,
                         }]
                     : []),
+                ...(sandboxResumePatch === "fixed"
+                    ? [{
+                            id: "EVE_SANDBOX_RESUME_PATCH",
+                            status: "pass",
+                            subject: "eve-sandbox-resume",
+                            reason: `not needed: Eve ${EVE_SANDBOX_RESUME_FIXED_VERSION} and later include the fix for eve#4440`,
+                            remediation: null,
+                        }]
+                    : []),
             ],
             sandboxResumePatch,
             candidateImageId: buildResult.imageId ?? null,
@@ -2287,7 +2581,7 @@ export async function revalidateEveProjectCandidateInputs(candidate, runtimeConf
     }
     const observedLatest = latest ?? fail();
     const packageFile = observedLatest.files.find((file) => file.relativePath === "package.json");
-    const lockfile = observedLatest.files.find((file) => file.relativePath === "pnpm-lock.yaml");
+    const lockfile = observedLatest.files.find((file) => file.relativePath === (candidate.packageManager === "npm" ? "package-lock.json" : "pnpm-lock.yaml"));
     if (packageFile === undefined ||
         lockfile === undefined ||
         packageFile.sha256 !== candidate.packageJsonSha256 ||

package/dist/eve-runtime-config.js

@@ -196,11 +196,18 @@ function parseEnvironmentText(text) {
     }
     return Object.freeze(values);
 }
+/**
+ * Values shorter than this are not masked: substring masking of `1`, `8`, or
+ * `eve` garbled every message and matched Eden's own random revision IDs,
+ * failing deploys. Credentials are longer; short values are still delivered
+ * only through the protected channels, just not masked if a tool echoes them.
+ */
+const MIN_REDACTED_RUNTIME_VALUE_LENGTH = 8;
 class EveRuntimeRedactionRegistry {
     handle = `eve-runtime-redaction-${randomUUID()}`;
     values = new Set();
     register(value) {
-        if (value.length > 0)
+        if (value.length >= MIN_REDACTED_RUNTIME_VALUE_LENGTH)
             this.values.add(value);
     }
     redact(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.7.4",
+  "version": "0.9.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.7.4",
+    "@moinulmoin/eden-runtime-cloudflare": "0.9.0",
     "wrangler": "4.147.0"
   },
   "devDependencies": {