@moinulmoin/eden 0.8.0 → 0.9.0

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.8.0
+npm install --global @moinulmoin/eden@0.9.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.8.0
+pnpm add --global @moinulmoin/eden@0.9.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.8.0
+bun add --global @moinulmoin/eden@0.9.0
 ```
 
 Then confirm the CLI is available:

package/dist/eve-control-plane.js

@@ -8,7 +8,7 @@ import { execFile, spawn, } from "node:child_process";
 import { fileURLToPath, } from "node:url";
 import { promisify, } from "node:util";
 import { EveCliError, EVE_NAME_PATTERN, } from "./eve.js";
-import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
+import { buildEveProjectSnapshot, checkEveSandboxProvider, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
 import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
 import { createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
@@ -65,6 +65,7 @@ function mapPackagingCheck(value) {
             case "DOCKER_PLATFORM_BLOCKED":
                 return "VAL-BUILD-005";
             case "EVE_SANDBOX_RESUME_PATCH":
+            case "EVE_SANDBOX_PROVIDER":
                 return value.id;
             default:
                 return `EVE-${value.id}`;
@@ -2053,6 +2054,22 @@ async function collectEvePreflight(request, options) {
             runtimeConfig,
         };
     }
+    const sandboxProvider = await checkEveSandboxProvider(request.projectRoot);
+    if (sandboxProvider !== undefined) {
+        checks.push(check(sandboxProvider.code, "failed", sandboxProvider.message, sandboxProvider.remediation));
+        return {
+            result: {
+                command: request.command === "deploy" ? "eve deploy" : "eve preflight",
+                ok: false,
+                environment: request.environment,
+                name: request.name,
+                checks,
+                warnings,
+                candidate: null,
+            },
+            runtimeConfig,
+        };
+    }
     warnings.push(...await collectEveSetupWarnings(request.projectRoot));
     eveProgress(options, "packaging project — snapshot, frozen install, eve build");
     const nodeImage = options.nodeImage ?? DEFAULT_EVE_NODE_IMAGE;

package/dist/eve-packaging.d.ts

@@ -1,5 +1,5 @@
 import { type EveRuntimeInputIdentity } from "./eve-runtime-config.js";
-export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED";
+export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "EVE_SANDBOX_PROVIDER" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED";
 export interface EveRuntimeConfigExclusion {
     /**
      * This path is opaque. The packaging worker only uses its lexical identity
@@ -228,9 +228,10 @@ export interface EveProjectPackagingResult {
     readonly checks: readonly EvePackagingCheck[];
     /**
      * Outcome of the builder's temporary eve#4440 sandbox-resume patch:
-     * `applied` when the shipped just-bash binding carries it, `skipped` when
-     * the binding is a version Eden does not know, `absent` when this Eve
-     * build has no just-bash binding or packaging never reached the image.
+     * `applied` when the shipped just-bash binding carries it, `fixed` when the
+     * installed Eve already includes the upstream fix, `skipped` when the
+     * binding is a version Eden does not know, `absent` when this Eve build has
+     * no just-bash binding or packaging never reached the image.
      */
     readonly sandboxResumePatch: EveSandboxResumePatchStatus;
     readonly candidateImageId: string | null;
@@ -272,6 +273,25 @@ export declare const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f
 export declare const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export declare const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
+/**
+ * First Eve release whose just-bash provider keeps a session's files across
+ * template changes (vercel/eve#5132), so the patch is not needed from here on.
+ */
+export declare const EVE_SANDBOX_RESUME_FIXED_VERSION = "0.83.0";
+/**
+ * True when an installed Eve version already ships the eve#4440 fix. A
+ * prerelease of the fixed version sorts before it (semver), so it may predate
+ * the fix and keeps the patch.
+ */
+export declare function eveIncludesSandboxResumeFix(version: unknown): boolean;
+/**
+ * Early, source-level rejection of sandbox setups that cannot work in Eden's
+ * isolated builder: a native provider named in the sandbox module, or, on Eve
+ * 0.83.0 and later, DefaultSandbox (no module, or one that names it without
+ * JustBash). Anything it cannot recognize is left to
+ * checkPreparedJustBashTemplate, which inspects what `eve build` produced.
+ */
+export declare function checkEveSandboxProvider(projectRoot: string, resolvedVersion?: string): Promise<EvePackagingError | undefined>;
 /** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
 export declare const EVE_JUST_BASH_RESUME_ORIGINAL = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root \"${a.rootPath}\" no longer exists.`);return await openHandle(e,a.rootPath,t)}";
 /**
@@ -305,7 +325,7 @@ export declare const EVE_SANDBOX_RESUME_PATCH_HELPERS = "async function edenRefr
  */
 export declare const EVE_SANDBOX_RESUME_PATCH_SCRIPT: string;
 /** Outcome of the builder's sandbox-resume patch for the packaged image. */
-export type EveSandboxResumePatchStatus = "applied" | "skipped" | "absent";
+export type EveSandboxResumePatchStatus = "applied" | "fixed" | "skipped" | "absent";
 export declare function sha256(value: string | Buffer): string;
 export declare function jsonBytes(value: unknown): Buffer;
 export declare function isWithin(root: string, candidate: string): boolean;

package/dist/eve-packaging.js

@@ -48,6 +48,150 @@ export const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f67a6028f
 export const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
+/**
+ * First Eve release whose just-bash provider keeps a session's files across
+ * template changes (vercel/eve#5132), so the patch is not needed from here on.
+ */
+export const EVE_SANDBOX_RESUME_FIXED_VERSION = "0.83.0";
+/** `major.minor.patch` of a version string; prerelease and build suffixes are dropped. */
+function parseEveRelease(version) {
+    const match = typeof version === "string"
+        ? /^(\d+)\.(\d+)\.(\d+)/u.exec(version)
+        : null;
+    return match === null
+        ? null
+        : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+/**
+ * True when an installed Eve version already ships the eve#4440 fix. A
+ * prerelease of the fixed version sorts before it (semver), so it may predate
+ * the fix and keeps the patch.
+ */
+export function eveIncludesSandboxResumeFix(version) {
+    const installed = parseEveRelease(version);
+    const fixed = parseEveRelease(EVE_SANDBOX_RESUME_FIXED_VERSION);
+    if (installed === null || fixed === null)
+        return false;
+    for (let index = 0; index < 3; index += 1) {
+        if (installed[index] !== fixed[index]) {
+            return (installed[index] ?? 0) > (fixed[index] ?? 0);
+        }
+    }
+    return typeof version === "string" && !/^\d+\.\d+\.\d+-/u.test(version);
+}
+/** Eve 0.83.0 and later no longer fall back to just-bash in production builds. */
+function eveRequiresExplicitJustBash(version) {
+    const release = parseEveRelease(version);
+    return release !== null && (release[0] > 0 || release[1] >= 83);
+}
+/**
+ * Eve reads its sandbox module from either path, with any source extension.
+ * When `agent/sandbox/` exists only the nested module counts: Eve 0.83–0.86
+ * silently ignores `agent/sandbox.ts` and 0.87+ fails the build.
+ */
+const EVE_SANDBOX_MODULE_PATHS = ["agent/sandbox", "agent/sandbox/sandbox"].flatMap((base) => ["ts", "mts", "cts", "tsx", "js", "mjs", "cjs", "jsx"].map((extension) => `${base}.${extension}`));
+function justBashRemediation(command, path) {
+    return `Run ${command} (production dependency), then create or replace ${path} with:\nimport { defineSandbox } from 'eve/sandbox';\nimport { JustBashSandbox } from 'eve/sandbox/just-bash';\nexport const environment = JustBashSandbox.environment();\nexport default defineSandbox(() => environment.open());\nCommit the module, package.json, and updated lockfile, then retry eden preflight. See docs/deploy.md. Do not set EVE_DEV.`;
+}
+/**
+ * Early, source-level rejection of sandbox setups that cannot work in Eden's
+ * isolated builder: a native provider named in the sandbox module, or, on Eve
+ * 0.83.0 and later, DefaultSandbox (no module, or one that names it without
+ * JustBash). Anything it cannot recognize is left to
+ * checkPreparedJustBashTemplate, which inspects what `eve build` produced.
+ */
+export async function checkEveSandboxProvider(projectRoot, resolvedVersion) {
+    const source = async (path) => readFile(join(projectRoot, path), "utf8").catch(() => "");
+    const json = async (path) => {
+        try {
+            const value = JSON.parse(await source(path));
+            return value !== null && typeof value === "object" && !Array.isArray(value)
+                ? value
+                : {};
+        }
+        catch {
+            return {};
+        }
+    };
+    const manifest = await json("package.json");
+    const dependencies = manifest.dependencies;
+    const lock = await json("package-lock.json");
+    const packages = lock.packages;
+    const pnpmLock = await source("pnpm-lock.yaml");
+    const pnpmVersion = /^\s{6}eve:\s*\r?\n\s{8}specifier:[^\n]*\r?\n\s{8}version:\s*['"]?(\d+\.\d+\.\d+(?:-[^('"\s]+)?)/mu
+        .exec(pnpmLock)?.[1];
+    const installed = await json("node_modules/eve/package.json");
+    const declared = typeof dependencies?.eve === "string"
+        ? /^[~^]?(\d+\.\d+\.\d+)/u.exec(dependencies.eve)?.[1]
+        : undefined;
+    const version = resolvedVersion ?? packages?.["node_modules/eve"]?.version ??
+        pnpmVersion ?? installed.version ?? declared;
+    const requiresExplicit = eveRequiresExplicitJustBash(version);
+    const sandboxDirectory = (await lstat(join(projectRoot, "agent/sandbox")).catch(() => undefined))
+        ?.isDirectory() === true;
+    let path;
+    for (const candidate of EVE_SANDBOX_MODULE_PATHS) {
+        if ((await lstat(join(projectRoot, candidate)).catch(() => undefined))?.isFile() === true) {
+            path = candidate;
+            break;
+        }
+    }
+    const module = path === undefined
+        ? ""
+        : (await source(path)).replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/gu, "");
+    const otherProvider = /\b(DefaultSandbox|DockerSandbox|VercelSandbox|VmSandbox|VMSandbox)\b/u
+        .exec(module)?.[1];
+    const justBash = /import\s*\{[^}]*?\bJustBashSandbox(?:\s+as\s+(\w+))?\s*(?:,|\})[^;]*?from\s*["']eve\/sandbox\/just-bash["']/u
+        .exec(module);
+    const binding = justBash?.[1] ?? "JustBashSandbox";
+    const explicit = justBash !== null &&
+        new RegExp(`\\b${binding}\\s*\\.\\s*environment\\s*\\(`, "u").test(module);
+    const native = otherProvider !== undefined && otherProvider !== "DefaultSandbox";
+    const usesDefault = path === undefined || (otherProvider === "DefaultSandbox" && !explicit);
+    const shadowed = requiresExplicit && sandboxDirectory && path?.startsWith("agent/sandbox.") === true;
+    if (!native && !shadowed && !(requiresExplicit && usesDefault))
+        return undefined;
+    const target = shadowed || (path === undefined && sandboxDirectory)
+        ? "agent/sandbox/sandbox.ts"
+        : path ?? "agent/sandbox.ts";
+    const command = typeof manifest.packageManager === "string" &&
+        manifest.packageManager.startsWith("pnpm@")
+        ? "pnpm add just-bash"
+        : "npm install just-bash";
+    return new EvePackagingError({
+        code: "EVE_SANDBOX_PROVIDER",
+        subject: target,
+        reason: shadowed
+            ? `${String(path)} sits beside the agent/sandbox/ directory, where Eve ${String(version)} reads only agent/sandbox/sandbox.ts: Eve 0.83–0.86 ignores ${String(path)} and falls back to DefaultSandbox, and 0.87 and later fail the build.`
+            : native
+                ? `${target} selects ${otherProvider}, which Eden does not support; use explicit JustBash instead.`
+                : path === undefined
+                    ? `Eve ${String(version)} has no sandbox module, so it uses DefaultSandbox, which has no provider in Eden's isolated builder: production builds no longer fall back to just-bash.`
+                    : `${target} selects DefaultSandbox, which has no provider in Eden's isolated builder on Eve ${String(version)}: production builds no longer fall back to just-bash.`,
+        remediation: shadowed
+            ? `Move ${String(path)} to agent/sandbox/sandbox.ts (delete it instead if agent/sandbox/sandbox.ts already exists), then retry eden preflight.`
+            : justBashRemediation(command, target),
+    });
+}
+/**
+ * Ground truth after `eve build`: on Eve 0.83.0 and later an agent whose
+ * sandbox resolved to no provider prepares no template and would fail to open
+ * its sandbox on Cloudflare, however its sandbox module is written.
+ */
+async function checkPreparedJustBashTemplate(snapshotRoot, version) {
+    if (!eveRequiresExplicitJustBash(version))
+        return undefined;
+    const templatesPath = `${EVE_SANDBOX_CACHE_ROOT}/just-bash/templates`;
+    const templates = await readdir(join(snapshotRoot, templatesPath)).catch(() => []);
+    if (templates.length > 0)
+        return undefined;
+    return new EvePackagingError({
+        code: "EVE_SANDBOX_PROVIDER",
+        subject: templatesPath,
+        reason: `Eve ${version} built no just-bash sandbox template, so the agent's sandbox would fail to open on Cloudflare; its sandbox module does not resolve to JustBash.`,
+        remediation: justBashRemediation("npm install just-bash (or pnpm add just-bash)", "agent/sandbox.ts (agent/sandbox/sandbox.ts when agent/sandbox/ exists)"),
+    });
+}
 /** Path of the just-bash binding inside the resolved Eve package root. */
 const EVE_JUST_BASH_BINDING_PATH = "dist/src/execution/sandbox/bindings/just-bash.js";
 /** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
@@ -107,9 +251,23 @@ const KNOWN_PATCHES = ${JSON.stringify({
 const SIGNATURE = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_SIGNATURE)};
 const BINDING_PATH = ${JSON.stringify(EVE_JUST_BASH_BINDING_PATH)};
 const HELPERS = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_HELPERS)};
+const FIXED_VERSION = ${JSON.stringify(EVE_SANDBOX_RESUME_FIXED_VERSION)};
 function finish(outcome, detail) {
   console.log("eden-eve-sandbox-resume-patch: " + outcome + " (" + detail + ")");
 }
+function parseRelease(version) {
+  const match = typeof version === "string" ? /^(\\d+)\\.(\\d+)\\.(\\d+)/.exec(version) : null;
+  return match === null ? null : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function includesFix(version) {
+  const installed = parseRelease(version);
+  const fixed = parseRelease(FIXED_VERSION);
+  if (installed === null || fixed === null) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (installed[index] !== fixed[index]) return installed[index] > fixed[index];
+  }
+  return !/^\\d+\\.\\d+\\.\\d+-/.test(version);
+}
 let packageJsonPath;
 try {
   packageJsonPath = fs.realpathSync("node_modules/eve/package.json");
@@ -125,6 +283,16 @@ try {
   finish("absent", "this eve build has no just-bash binding");
   process.exit(0);
 }
+let eveVersion;
+try {
+  eveVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")).version;
+} catch {
+  eveVersion = undefined;
+}
+if (!source.includes(SIGNATURE) && includesFix(eveVersion)) {
+  finish("fixed", "eve " + eveVersion + " includes the upstream fix for eve#4440");
+  process.exit(0);
+}
 if (source.includes(SIGNATURE)) {
   finish("applied", "already patched");
   process.exit(0);
@@ -1475,6 +1643,14 @@ async function scanGeneratedSandboxCache(snapshotRoot) {
             const relativePath = relativeDirectory.length === 0
                 ? entry.name
                 : `${relativeDirectory}/${entry.name}`;
+            if (relativeDirectory === "" && entry.name !== "just-bash") {
+                throw new EvePackagingError({
+                    code: "EVE_SANDBOX_PROVIDER",
+                    subject: `${EVE_SANDBOX_CACHE_ROOT}/${entry.name}`,
+                    reason: `The Eve build prepared a ${entry.name} sandbox template; Eden supports only just-bash templates.`,
+                    remediation: "Replace the sandbox module with the explicit JustBash environment in docs/deploy.md, run npm install just-bash (or pnpm add just-bash), commit the module and lockfile, then retry eden preflight without EVE_DEV.",
+                });
+            }
             const candidate = join(directory, entry.name);
             if (entry.isSymbolicLink()) {
                 throw new EvePackagingError({
@@ -1691,20 +1867,39 @@ function classifyNpmInstallFailure(stderr) {
         remediation: "Fix the reported npm failure; regenerate package-lock.json with the selected exact npm version if it is out of sync. Use public registry dependencies without .npmrc credentials or dependency build scripts.",
     });
 }
+/**
+ * The failing BuildKit step's own output (`#<step> <seconds> <line>`), last 20
+ * lines, so Eve's error reaches the user instead of a generic build failure.
+ */
+function failingDockerStepOutput(stderr) {
+    const step = [...stderr.matchAll(/^#(\d+) ERROR:/gmu)].at(-1)?.[1];
+    if (step === undefined)
+        return undefined;
+    const lines = [...stderr.matchAll(new RegExp(`^#${step} \\d+\\.\\d+ (.*)$`, "gmu"))]
+        .map((match) => (match[1] ?? "").trimEnd())
+        .filter((line) => line.length > 0)
+        .slice(-20);
+    if (lines.length === 0)
+        return undefined;
+    const output = lines.join("\n");
+    return output.length > 2000 ? `…${output.slice(-2000)}` : output;
+}
 function classifyEveBuildFailure(stderr) {
+    const output = failingDockerStepOutput(stderr);
+    const reported = output === undefined ? "" : `\nEve reported:\n${output}`;
     if (/\bjust-bash\b/u.test(stderr)) {
         return new EvePackagingError({
             code: "EVE_BUILD_FAILED",
             subject: "eve build",
-            reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder because Eve's default sandbox needs just-bash where no Docker daemon or /dev/kvm exists.",
+            reason: `The project-local Eve build failed inside the isolated Linux/amd64 builder because Eve's default sandbox needs just-bash where no Docker daemon or /dev/kvm exists.${reported}`,
             remediation: "Declare just-bash as a production dependency of the Eve project, regenerate its package-manager lockfile, and retry.",
         });
     }
     return new EvePackagingError({
         code: "EVE_BUILD_FAILED",
         subject: "eve build",
-        reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder.",
-        remediation: "Fix the project-local Eve build and retry without changing the authored project during packaging.",
+        reason: `The project-local Eve build failed inside the isolated Linux/amd64 builder.${reported}`,
+        remediation: "Fix the error Eve reported (run eve build locally to reproduce it) and retry.",
     });
 }
 function classifyDockerBuildFailure(error) {
@@ -1818,9 +2013,18 @@ async function detectEveSandboxResumePatch(snapshotRoot) {
     try {
         const packageJsonPath = await realpath(join(snapshotRoot, "node_modules/eve/package.json"));
         const binding = await readFile(join(dirname(packageJsonPath), EVE_JUST_BASH_BINDING_PATH), "utf8");
-        return binding.includes(EVE_SANDBOX_RESUME_PATCH_SIGNATURE)
-            ? "applied"
-            : "skipped";
+        if (binding.includes(EVE_SANDBOX_RESUME_PATCH_SIGNATURE))
+            return "applied";
+        const version = await readFile(packageJsonPath, "utf8")
+            .then((text) => {
+            const manifest = JSON.parse(text);
+            return typeof manifest === "object" && manifest !== null &&
+                "version" in manifest
+                ? manifest.version
+                : undefined;
+        })
+            .catch(() => undefined);
+        return eveIncludesSandboxResumeFix(version) ? "fixed" : "skipped";
     }
     catch {
         return "absent";
@@ -2028,6 +2232,9 @@ export async function buildEveProjectSnapshot(options) {
         const afterCopyRace = await sourceRaceErrorIfChanged(roots.canonicalRoot, initialInputs, initialRuntimeInputIdentity, options.runtimeConfig, resolve(options.artifactRoot), roots.requestedRoot);
         if (afterCopyRace !== undefined)
             return blockedResult(afterCopyRace, { writtenPaths });
+        const sandboxProvider = await checkEveSandboxProvider(snapshotRoot);
+        if (sandboxProvider !== undefined)
+            throw sandboxProvider;
         const nodeImage = options.nodeImage ?? options.builder.nodeImage;
         let actualDockerfilePath;
         if (nodeImage !== undefined) {
@@ -2094,9 +2301,15 @@ export async function buildEveProjectSnapshot(options) {
             return blockedResult(cleanupError ?? dependencyError, { writtenPaths });
         }
         const eve = await resolveProjectLocalEve(snapshotRoot);
+        const sandboxProviderAfterBuild = await checkEveSandboxProvider(snapshotRoot, eve.version);
+        if (sandboxProviderAfterBuild !== undefined)
+            throw sandboxProviderAfterBuild;
         const sandboxResumePatch = await detectEveSandboxResumePatch(snapshotRoot);
         const output = await scanGeneratedOutput(snapshotRoot);
         const sandboxCache = await scanGeneratedSandboxCache(snapshotRoot);
+        const preparedTemplate = await checkPreparedJustBashTemplate(snapshotRoot, eve.version);
+        if (preparedTemplate !== undefined)
+            throw preparedTemplate;
         await assertGeneratedTreesExcludeSecrets(snapshotRoot);
         const snapshotSourceDigest = await snapshotDigest(snapshotRoot);
         const runtimeManifestPath = join(generationRoot, "runtime-manifest.json");
@@ -2277,6 +2490,15 @@ export async function buildEveProjectSnapshot(options) {
                             remediation: null,
                         }]
                     : []),
+                ...(sandboxResumePatch === "fixed"
+                    ? [{
+                            id: "EVE_SANDBOX_RESUME_PATCH",
+                            status: "pass",
+                            subject: "eve-sandbox-resume",
+                            reason: `not needed: Eve ${EVE_SANDBOX_RESUME_FIXED_VERSION} and later include the fix for eve#4440`,
+                            remediation: null,
+                        }]
+                    : []),
             ],
             sandboxResumePatch,
             candidateImageId: buildResult.imageId ?? null,

package/dist/eve-runtime-config.js

@@ -196,11 +196,18 @@ function parseEnvironmentText(text) {
     }
     return Object.freeze(values);
 }
+/**
+ * Values shorter than this are not masked: substring masking of `1`, `8`, or
+ * `eve` garbled every message and matched Eden's own random revision IDs,
+ * failing deploys. Credentials are longer; short values are still delivered
+ * only through the protected channels, just not masked if a tool echoes them.
+ */
+const MIN_REDACTED_RUNTIME_VALUE_LENGTH = 8;
 class EveRuntimeRedactionRegistry {
     handle = `eve-runtime-redaction-${randomUUID()}`;
     values = new Set();
     register(value) {
-        if (value.length > 0)
+        if (value.length >= MIN_REDACTED_RUNTIME_VALUE_LENGTH)
             this.values.add(value);
     }
     redact(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.8.0",
+    "@moinulmoin/eden-runtime-cloudflare": "0.9.0",
     "wrangler": "4.147.0"
   },
   "devDependencies": {