@open-everywhere/adapters 0.1.5 → 0.3.0

package/NOTICE

@@ -12,28 +12,28 @@ Apache License, Version 2.0.
 
 Modifications to eve
 
-The @open-everywhere/core package distributes patches/eve+0.54.3.patch. That
-patch file is a modification of eve 0.54.3. Vercel licenses eve 0.54.3 under the
-Apache License, Version 2.0. The copyright notice of eve 0.54.3 reads
+The @open-everywhere/core package distributes patches/eve+0.71.0.patch. That
+patch file is a modification of eve 0.71.0. Vercel licenses eve 0.71.0 under the
+Apache License, Version 2.0. The copyright notice of eve 0.71.0 reads
 "Copyright 2026 Vercel, Inc. and contributors". The Open Everywhere authors made
 the changes in the patch file.
 
-The patch modifies six files of eve 0.54.3:
+The patch modifies four files of eve 0.71.0:
 
-  dist/src/context/dynamic-tool-lifecycle.js
   dist/src/execution/web-fetch/request.js
   dist/src/harness/tool-loop.js
   dist/src/internal/authored-package-boundary.js
   dist/src/protocol/message.d.ts
-  dist/src/tasks/session-index.js
 
 Open Everywhere does not ship the eve package. eve is a peer dependency, so the
-consumer installs eve 0.54.3 from the registry. The patch file carries the
+consumer installs eve 0.71.0 from the registry. The patch file carries the
 modified portions of eve. The oe-eve-patch command, which
 @open-everywhere/core ships, applies them to the eve that the consumer
-installed. The command writes no file outside the consumer's own project.
+installed. The command patches no file outside the consumer's own project. To
+restore an eve that holds an older Open Everywhere patch, it also writes to npm's
+cache and to a temporary directory.
 
-The attribution notice of eve 0.54.3 follows, as section 4(d) of the Apache
+The attribution notice of eve 0.71.0 follows, as section 4(d) of the Apache
 License, Version 2.0 requires. The notices for eve's bundled code-mode runtime
 are not reproduced, because the patch modifies no part of that runtime.
 

package/README.md

@@ -17,10 +17,18 @@ It implements core's host seams against concrete services:
 Core defines these seams and ships no host of its own, so a different host is a different adapters
 package rather than a fork of the runtime.
 
+## Boot wiring
+
+`registerDefaultAdapters()` (`@open-everywhere/adapters/agent/register-defaults.js`) wires every
+default adapter, the app's selected provider bundles and the operational store, with the store
+selection rules and the floors. An app's `agent/lib/register-adapters.ts` calls it once and adds
+its own adapters in the `customAdapters` hook. See
+[the app's adapter wiring](https://github.com/open-everywhere/open-everywhere/blob/main/docs/extending/adapter-model.md#the-apps-adapter-wiring).
+
 ## Install
 
 ```sh
-npm i @open-everywhere/core @open-everywhere/adapters eve@0.54.3
+npm i @open-everywhere/core @open-everywhere/adapters eve@0.71.0
 npx oe-eve-patch
 ```
 

package/agent/browser/sandbox.ts

@@ -1,16 +1,32 @@
 // The agent-browser sandbox pre-bake — Vercel-only, and mandatory: a session sits behind the deny-all egress
-// firewall, so no mid-turn install can work. eve freezes `revalidationKey` at BUILD, so arm it there too.
+// firewall, so no mid-turn install can work, so the install has to happen at BUILD.
+//
+// 🔴 eve 0.69.0 REMOVED `revalidationKey` (OPE-2247), so the key below reaches nothing. The sandbox
+// definition used to pass it to eve, which froze it into the template identity; 0.69.0 keys a template
+// by `sha256(stableSerialize(environment options))` instead, and the app now passes the bake as the
+// environment's `prepare` (`agent/sandbox/sandbox.ts`). `stableSerialize` renders a function as its
+// SOURCE TEXT, so arming or disarming the bake re-keys the template and editing the prepare body
+// re-keys it, but a change to the agent-browser PIN alone does not — the pin lives inside the vendor
+// installer, behind a closure the hash cannot see. The key is kept, unused, because it is still the
+// honest answer to "what would re-key this bake" and the re-derivation needs it; see the 🔴 note in
+// `agent/sandbox/sandbox.ts`, which carries the whole account and the follow-up.
 
-import { agentBrowserRevalidationKey, installAgentBrowser } from "@agent-browser/eve/sandbox";
+import { agentBrowserRevalidationKey, installAgentBrowser, type EveSandboxSession } from "@agent-browser/eve/sandbox";
 import { agentBrowserEnabled, loadAgentBrowserConfig } from "./config.js";
 
-/** Minimal structural sandbox the installer needs (matches @agent-browser/eve's EveSandboxSession). */
+/** Minimal structural sandbox the installer needs. `id` is OPTIONAL deliberately: eve 0.69.0's
+ *  `prepare` hands over a `SandboxSession`, which carries no `id` at all, and `installAgentBrowser`
+ *  reads only `run` — `sandbox.id` appears once in the vendor bundle, inside `runAgentBrowser` (the
+ *  TOOL path). Keeping it required would make the caller's cast load-bearing and hide the day a real
+ *  `id` dependency comes back. @agent-browser/eve's own `EveSandboxSession` still requires it, so the
+ *  one cast at the `installAgentBrowser` boundary stays and is commented there. */
 export interface BakeableSandbox {
-  readonly id: string;
+  readonly id?: string;
   run(options: { readonly command: string }): PromiseLike<{ readonly exitCode?: number; readonly stderr?: string; readonly stdout?: string }>;
 }
 
 export interface AgentBrowserSandboxHooks {
+  /** 🔴 DEAD SINCE eve 0.69.0 (OPE-2247) — nothing reads it. See this file's header. */
   readonly revalidationKey: () => string;
   readonly bootstrap: (input: { use: () => Promise<BakeableSandbox> }) => Promise<void>;
 }
@@ -20,7 +36,13 @@ export interface AgentBrowserSandboxHooks {
  * vendor installer: system deps → `npm install -g agent-browser@<pinned>` → `agent-browser install`).
  */
 export function agentBrowserSandboxHooks(
-  install: (sandbox: BakeableSandbox) => Promise<unknown> = (sandbox) => installAgentBrowser(sandbox),
+  // 🔴 THE ONE CAST, AND IT IS HERE ON PURPOSE. The vendor's `EveSandboxSession` requires an `id`;
+  // `installAgentBrowser` never reads one (verified in the vendor bytes: `sandbox.id` appears once, in
+  // `runAgentBrowser`, which is the TOOL path), and eve 0.69.0's `prepare` has no `id` to give. So the
+  // widening sits at THIS boundary, where the mismatch actually is, rather than at the caller — which
+  // is what makes `BakeableSandbox.id` optional honest instead of a hole: the day the installer does
+  // read an `id`, this line is the one that has to be argued with.
+  install: (sandbox: BakeableSandbox) => Promise<unknown> = (sandbox) => installAgentBrowser(sandbox as EveSandboxSession),
 ): AgentBrowserSandboxHooks | Record<string, never> {
   if (!agentBrowserEnabled()) return {};
   // 🔴 ONE ROAD, NOT TWO (OPE-1793). The platform refusal lives in the config loader, which every

package/agent/instrumentation.ts

@@ -1,42 +1,101 @@
-// OpenTelemetry tracing through eve's instrumentation seam; the vendor SDK is why this lives in adapters.
-// A provider registers only when a collector is configured, and NO model input or output reaches a span.
-// eve's `defineInstrumentation` accepts `recordInputs` and `recordOutputs`; it normalises each as
-// `=== true`, so an absent field reads FALSE. This adapter sets neither, so enabling model content
-// takes action — suppressing it does not. A fork that sets them true still meets eve's audience
-// ceiling (`applyAudienceCeiling`, eve `shared/instrumentation-content.js`), which forces both off
-// for every channel whose audience is not `public` (an `unknown` audience records only inside eve's
-// own dev environment).
-
-import { defineInstrumentation } from "eve/instrumentation";
-import { registerOTel } from "@vercel/otel";
+// OpenTelemetry through eve's own pipeline; the vendor SDK (`@vercel/otel` exporters) is why this lives in adapters.
+//
+// eve 0.71 owns the OpenTelemetry lifecycle: it registers ONE tracer provider for the process, from
+// the providers in `agent/instrumentation/`. On Vercel preview and production it also seeds its Agent
+// Runs destination. A second `registerOTel` call kills the boot ("another runtime already owns the
+// global tracer provider", OPE-2262), so this module never registers anything itself. It declares:
+//
+//   - `default` (the app's `otel` slot): the process-wide trace policy, plus the boot `setup`.
+//     The policy emits every trace with NO model input and NO model output, for every audience in
+//     every environment. Without it, eve records content for public conversations and in
+//     development. A destination cannot restore what this ceiling removes.
+//   - `otlpDestination` (the app's `otlp` slot): the consumer's OTLP collector, from the standard
+//     `OTEL_EXPORTER_OTLP_*` variables, as an eve destination. With no endpoint it is disabled.
+//
+// `scripts/instrumentation-hosted-boot-test.ts` boots both slots through eve's registration path
+// with the env Vercel creates.
+
+import { disableInstrumentation } from "eve/instrumentation";
+import { otel, otelIntegration, type OtelDeclaration, type SpanExporter } from "eve/instrumentation/otel";
+import { OTLPHttpJsonTraceExporter, OTLPHttpProtoTraceExporter } from "@vercel/otel";
 import { installLogShipping, initTelemetry } from "@open-everywhere/core/agent/adapter-api.js";
 
+/** Metadata only: emit the span, record neither content direction. */
+const METADATA_ONLY = { emit: true, recordInputs: false, recordOutputs: false } as const;
+
 /**
- * A collector is configured when a standard OTLP endpoint env var is set, or when running on Vercel, where
- * `registerOTel` auto-wires the built-in collector. Neither holds locally or in CI.
+ * Boot side effects. eve awaits every provider's `setup` before it loads the server entry.
+ * `OtelDeclaration` is an eve `InstrumentationProvider`, so it carries `setup` like any other.
  */
-function collectorConfigured(): boolean {
-  return Boolean(
-    process.env.OTEL_EXPORTER_OTLP_ENDPOINT ||
-      process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||
-      process.env.VERCEL,
-  );
+function setup(): void {
+  // Structured log shipping (vendor-neutral HTTP ingest; core seam). Its own env gate
+  // (OE_LOG_SHIP_URL); console is untouched when that is unset.
+  installLogShipping();
+  // Anonymous usage telemetry (default ON; core seam, own env gate — OE_TELEMETRY/DO_NOT_TRACK).
+  // Prints the boot disclosure line before anything is transmitted. Fire-and-forget: boot never waits.
+  void initTelemetry();
 }
 
-export default defineInstrumentation({
-  setup({ agentName }) {
-    // Structured log shipping (vendor-neutral HTTP ingest; core seam). Independent of
-    // the OTel collector check below: it has its own env gate (OE_LOG_SHIP_URL) and is
-    // a full no-op — console untouched — when that is unset.
-    installLogShipping();
-    // Anonymous usage telemetry (default ON; core seam, own env gate — OE_TELEMETRY/
-    // DO_NOT_TRACK). Prints the boot disclosure line before anything is transmitted;
-    // fire-and-forget (this callback is synchronous, must never block boot).
-    initTelemetry();
-    if (!collectorConfigured()) return;
-    // serviceName = the agent name from `defineAgent`, per Eve's guidance. Exporter
-    // wiring (endpoint, headers, protocol) comes from the standard `OTEL_EXPORTER_OTLP_*`
-    // env vars that `@vercel/otel` reads.
-    registerOTel({ serviceName: agentName });
-  },
-});
+const declaration: OtelDeclaration = { ...otel({ tracePolicy: () => METADATA_ONLY }), setup };
+export default declaration;
+
+/** The OTLP traces protocols `@vercel/otel` exports over HTTP. */
+type OtlpProtocol = "http/protobuf" | "http/json";
+
+/** The OTLP target the standard env vars name, or `undefined` when no endpoint is set. */
+export interface OtlpTarget {
+  readonly url: string;
+  readonly protocol: OtlpProtocol;
+  readonly headers: Readonly<Record<string, string>>;
+}
+
+/**
+ * Parse an `OTEL_EXPORTER_OTLP_*HEADERS` value: comma-separated `key=value` pairs, each value
+ * percent-encoded (OpenTelemetry SDK environment specification). A pair without `=` is skipped.
+ */
+export function parseOtlpHeaders(raw: string | undefined): Record<string, string> {
+  const headers: Record<string, string> = {};
+  for (const pair of (raw ?? "").split(",")) {
+    const at = pair.indexOf("=");
+    if (at <= 0) continue;
+    const key = pair.slice(0, at).trim();
+    const value = pair.slice(at + 1).trim();
+    if (key === "") continue;
+    try {
+      headers[key] = decodeURIComponent(value);
+    } catch {
+      headers[key] = value;
+    }
+  }
+  return headers;
+}
+
+/**
+ * Resolve the OTLP traces target with the standard precedence: the traces-specific variable over the
+ * general one, and the general endpoint gets `/v1/traces` appended. Only the HTTP protocols exist
+ * here; `grpc` or an unknown value falls back to `http/protobuf` with a warning.
+ */
+export function resolveOtlpTarget(env: NodeJS.ProcessEnv = process.env): OtlpTarget | undefined {
+  const tracesEndpoint = env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+  const endpoint = env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  const url = tracesEndpoint ? tracesEndpoint : endpoint ? `${endpoint.replace(/\/+$/, "")}/v1/traces` : undefined;
+  if (url === undefined) return undefined;
+  const requested = (env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL ?? env.OTEL_EXPORTER_OTLP_PROTOCOL ?? "http/protobuf").trim();
+  let protocol: OtlpProtocol = "http/protobuf";
+  if (requested === "http/json") protocol = "http/json";
+  else if (requested !== "http/protobuf") {
+    console.warn(`[open-everywhere:instrumentation] OTLP traces protocol "${requested}" is not supported — exporting with http/protobuf`);
+  }
+  const headers = { ...parseOtlpHeaders(env.OTEL_EXPORTER_OTLP_HEADERS), ...parseOtlpHeaders(env.OTEL_EXPORTER_OTLP_TRACES_HEADERS) };
+  return { url, protocol, headers };
+}
+
+function otlpExporter(target: OtlpTarget): SpanExporter {
+  const config = { url: target.url, headers: { ...target.headers } };
+  return target.protocol === "http/json" ? new OTLPHttpJsonTraceExporter(config) : new OTLPHttpProtoTraceExporter(config);
+}
+
+const OTLP_TARGET = resolveOtlpTarget();
+
+/** The consumer's OTLP collector as an eve destination, or disabled when no endpoint is set. */
+export const otlpDestination = OTLP_TARGET === undefined ? disableInstrumentation() : otelIntegration({ traceExporter: otlpExporter(OTLP_TARGET) });

package/agent/model/approval-judge.ts

@@ -50,7 +50,7 @@ function gatewayApprovalJudgeCompletion(defaults: GatewayRoutedDefaults): Approv
 
 /**
  * Build and register the gateway judge transport at boot. Without it the judge answers `defer` everywhere;
- * registration IS the transport opt-in, and arming is separate (approvals.judgeMode, default off).
+ * registration IS the transport opt-in, and arming is separate (approvals.judgeMode, shipped enforce).
  */
 export function registerGatewayApprovalJudge(defaults: GatewayRoutedDefaults): void {
   registerApprovalJudgeCompletion(gatewayApprovalJudgeCompletion(defaults));

package/agent/oe-oauth/config.ts

@@ -32,7 +32,7 @@ export interface OeOauthDiscoveryProviderConfig extends OeOauthProviderConfigBas
   readonly mode: typeof OE_OAUTH_MODE_DISCOVERY;
   /** The hosted-MCP server URL — discovery base + RFC 8707 resource indicator. */
   readonly resource: string;
-  /** The `client_name` sent at Dynamic Client Registration (default "Open Everywhere"). */
+  /** The `client_name` sent at Dynamic Client Registration (default: the deployment's configured name, `agentDisplayName()`). */
   readonly clientName?: string;
 }
 

package/agent/oe-oauth/token-vault.ts

@@ -2,7 +2,7 @@
 // encrypted KV. Refresh is single-flight in-process AND cross-process, because the provider ROTATES tokens.
 
 import type { EncryptedKvVault } from "@open-everywhere/core/agent/adapter-api.js";
-import { encryptedKvVault, getSecretVia, OE_OAUTH_CALLBACK_PATH } from "@open-everywhere/core/agent/adapter-api.js";
+import { agentDisplayName, encryptedKvVault, getSecretVia, OE_OAUTH_CALLBACK_PATH } from "@open-everywhere/core/agent/adapter-api.js";
 import { isStaticConfidential, OE_OAUTH_MODE_STATIC, type OeOauthProviderConfig, type OeOauthStaticProviderConfig } from "./config.js";
 import {
   discoverEndpoints,
@@ -250,7 +250,8 @@ export function makeOeOauthTokenVault(providers: ReadonlyMap<string, OeOauthProv
       const endpoints = await discoverEndpoints(cfg.resource, doFetch);
       const { clientId } = await registerClient(
         endpoints.registrationEndpoint,
-        { clientName: cfg.clientName ?? "Open Everywhere", redirectUri, ...(cfg.scopes ? { scopes: cfg.scopes } : {}) },
+        // The OAuth consent screen names the client: the deployment's configured name (OPE-2334).
+        { clientName: cfg.clientName ?? agentDisplayName(), redirectUri, ...(cfg.scopes ? { scopes: cfg.scopes } : {}) },
         doFetch,
       );
       const record: DcrClientRecord = {

package/agent/register-defaults.ts

@@ -0,0 +1,276 @@
+// THE DEFAULT ADAPTER WIRING (OPE-2301) — `registerDefaultAdapters()`, the boot call every app makes
+// from its `agent/lib/register-adapters.ts`.
+//
+// 🔴 WHY THIS IS PRODUCT CODE AND NOT A TEMPLATE FILE. The wiring used to live in each app, as a
+// copy of the template's `agent/lib/register-adapters.ts`. `npx @open-everywhere/create` copies the
+// template once, and an upgrade touches only `package.json`, so every upgrade had to hand-merge the
+// copy. It drifted twice: a 0.1.2 copy registered no Postgres client on a bare `DATABASE_URL`
+// (OPE-2230), and the test-bed's copy broke the 0.1.5 build with a boot refusal. The selection rules
+// and the floors below are product logic, not consumer config. Here they ship with the package, and
+// an upgrade picks them up. The app's file is one call plus an optional `customAdapters` hook.
+//
+// 🔴 STATIC IMPORTS ON PURPOSE. Eve bundles each authored module and its import graph into ONE
+// rolldown chunk. A literal dynamic `import("…")` of an internal module code-splits into a second
+// chunk and trips Eve's "expected one authored module" invariant. Laziness is kept where it matters:
+// `registerNeon()` builds the `@neondatabase/serverless` driver through an inner variable-specifier
+// import, and only when it is CALLED (the Neon gate below).
+//
+// 🔴 THE APP'S INPUTS ARE ARGUMENTS. The selection table (`providers.generated.ts`, `oe build`
+// output) and the memory config are app files, so the app passes them in. This module names no
+// provider bundle: it drives the table it receives.
+
+import { registerOeOauth } from "./oe-oauth/register.js";
+import { oeOauthEnabled, loadOeOauthConfig } from "./oe-oauth/config.js";
+import { registerAgentBrowser } from "./browser/register.js";
+import { agentBrowserEnabled, loadAgentBrowserConfig } from "./browser/config.js";
+import { registerAwsAccess } from "./aws/register.js";
+import { awsAccessEnabled } from "./aws/config.js";
+import { registerDirectoryAdapter } from "./directory/register.js";
+import { registerGatewayRouteProbe } from "./model/gateway-probe.js";
+import { registerNeon } from "./postgres/neon.js";
+import { vercelBlobPutter } from "./blob/hosting.js";
+import {
+  registerDbCredentialBroker,
+  CREDENTIAL_KEY_ENV,
+  registerGitHubConfigPrProvider,
+  setBlobPutter,
+  registerAuditDropCounter,
+  emitTelemetry,
+  getOperationalStore,
+  bootVerifyAuditChainTail,
+  bootBackfillLinkTenants,
+  runBootNotices,
+  registerBootNotice,
+  announceJudgeWithoutRules,
+  registerOperationalPgliteLazy,
+  resolveOperationalSelection,
+  resolveMemoryProviderId,
+  onVercel,
+  declareProviderSelection,
+  assertConnectorMemoryGrants,
+  applySubtreeSurfaceClaims,
+  reconcileSurfaceCommands,
+  type Domain,
+  type DomainMemoryGrants,
+  type MemorySilo,
+  type OperationalFloor,
+} from "@open-everywhere/core/agent/adapter-api.js";
+
+/** One row of the app's generated selection table (`agent/lib/providers.generated.ts`). */
+export interface SelectedProviderBundle {
+  readonly id: string;
+  readonly register: () => void;
+}
+
+export interface DefaultAdapterOptions {
+  /** The app's `SELECTED_PROVIDERS` table. Its ids are the declared selection. */
+  readonly providers: readonly SelectedProviderBundle[];
+  /**
+   * The app's memory config, for the prefetch invariant. Each one is CALLED at the check, after the
+   * provider bundles register, so pass the loaders, not their results.
+   */
+  readonly memory: {
+    readonly domains: () => readonly Domain[];
+    readonly silos: () => readonly MemorySilo[];
+    readonly grants: (domain: Domain) => DomainMemoryGrants | null;
+  };
+  /**
+   * THE HOOK FOR CUSTOM ADAPTERS. It runs once, after every default adapter and every selected
+   * provider bundle registers, and before the boot checks that read those registries (the memory
+   * grants, the subtree claims), the store wiring and the slash-command reconcile. So a custom
+   * registration here replaces a default one, and the same boot checks see it.
+   * The store selection is NOT a hook point: the Neon gate and the PGlite floor are product rules.
+   */
+  readonly customAdapters?: () => void | Promise<void>;
+}
+
+/** What the store wiring decided for one env. */
+export interface StoreWiring {
+  readonly operational: { readonly id: string; readonly floor: OperationalFloor };
+  /** Did the Neon gate open (a Postgres backing is selected AND `DATABASE_URL` is set)? */
+  readonly neon: boolean;
+  /** Is the embedded PGlite floor armed? */
+  readonly pgliteFloor: boolean;
+}
+
+/** What one `registerDefaultAdapters()` call wired. */
+export interface DefaultAdapterWiring {
+  readonly providers: readonly string[];
+  readonly oeOauth: boolean;
+  readonly dbCredentialBroker: boolean;
+  readonly agentBrowser: boolean;
+  readonly awsAccess: boolean;
+  readonly customAdapters: boolean;
+  readonly store: StoreWiring;
+}
+
+/**
+ * The store decision, pure. 🔴 THE SELECTION IS THE RUNTIME'S OWN RULE, NOT A SECOND ENV TEST
+ * (OPE-2230). Both selectors default to postgres when `DATABASE_URL` is present. A hand-written
+ * `OE_MEMORY_PROVIDER === "postgres"` test refuses to build the driver for exactly the deployment
+ * the default exists for: the Neon Marketplace integration sets `DATABASE_URL` and nothing else.
+ *
+ * The PGlite floor (OPE-113) arms when the operational selection resolves to it (no provider named,
+ * no `DATABASE_URL`). It stays off on Vercel, where the floor is per-instance and ephemeral, unless
+ * `OE_ALLOW_EPHEMERAL_OPERATIONAL=1` names the single-instance escape. The Neon gate never opens on
+ * the floor's branch, so the two never both register.
+ */
+export function decideStoreWiring(env: NodeJS.ProcessEnv, vercel: boolean): StoreWiring {
+  const operational = resolveOperationalSelection(env);
+  const postgresSelected =
+    resolveMemoryProviderId(env) === "postgres" || (operational.id === "postgres" && operational.floor === "none");
+  return {
+    operational,
+    neon: postgresSelected && Boolean(env.DATABASE_URL),
+    pgliteFloor: operational.floor === "pglite" && (!vercel || env.OE_ALLOW_EPHEMERAL_OPERATIONAL === "1"),
+  };
+}
+
+let WIRED: DefaultAdapterWiring | undefined;
+let STARTED: Promise<DefaultAdapterWiring> | undefined;
+
+/** What `registerDefaultAdapters()` wired in this process, or `undefined` before it runs. */
+export function defaultAdapterWiring(): DefaultAdapterWiring | undefined {
+  return WIRED;
+}
+
+/**
+ * Wire every default adapter, the selected provider bundles and the operational store. Call it from
+ * the app's `agent/lib/register-adapters.ts`, with `await` at module top level.
+ * The wiring runs ONCE per process. A second run would declare the provider selection again (which
+ * clears the gate's admitted and refused records), and run every bundle's register(), the boot
+ * checks and the slash-command reconcile a second time.
+ * 🔴 A SECOND CALL RETURNS THE FIRST CALL'S RESULT; IT DOES NOT THROW. eve 0.71's authored-module
+ * loader (`internal/authored-module-loader.js`) bundles and evaluates `agent/agent.ts` more than once
+ * in one `eve build` process, and each evaluation runs `register-adapters.ts` again. This module and
+ * core stay external, so the second evaluation shares the registries the first one filled. A throw
+ * here failed that evaluation and the build (OPE-2346).
+ */
+export function registerDefaultAdapters(options: DefaultAdapterOptions): Promise<DefaultAdapterWiring> {
+  STARTED ??= wireDefaultAdapters(options);
+  return STARTED;
+}
+
+async function wireDefaultAdapters(options: DefaultAdapterOptions): Promise<DefaultAdapterWiring> {
+
+  // PROVIDER SELECTION — declared FIRST, before any bundle registers (OPE-116 stage 5). Core takes the
+  // ids as opaque strings, and every platform-keyed registration seam then refuses anything outside
+  // them. A row that lands ahead of the declaration cannot be retracted (core warns if one does).
+  const providers = declareProviderSelection(options.providers.map((p) => p.id));
+
+  // Connector-plane user-auth flow (OPE-88): own-rolled OAuth, registered only when the master flag
+  // OE_OAUTH_ENABLED is armed AND a provider config block is present. Otherwise no flow registers and
+  // core's OAuth mint paths fail closed. There is no vendor fallback.
+  const oeOauthCfg = oeOauthEnabled() ? loadOeOauthConfig() : undefined;
+  if (oeOauthCfg) registerOeOauth({ providers: oeOauthCfg });
+
+  // The "db" credential broker (task #113): registered iff its AES key exists. Without the key the
+  // broker fails closed on store and read, so registering it would falsely offer the "Set API key"
+  // chat intake, which keys off the broker being REGISTERED.
+  const dbCredentialBroker = Boolean(process.env[CREDENTIAL_KEY_ENV]);
+  if (dbCredentialBroker) registerDbCredentialBroker();
+
+  // The agent-browser toolkit (OPE-43). The platform gate is inside loadAgentBrowserConfig
+  // (OPE-1793): off Vercel the config is `undefined` and nothing registers.
+  // registerAgentBrowser can still refuse (returns false, loud) when the vendor binding did not take.
+  const browserCfg = agentBrowserEnabled() ? loadAgentBrowserConfig() : undefined;
+  const agentBrowser = browserCfg ? registerAgentBrowser(browserCfg) : false;
+
+  // The AWS-access layer: only when OE_AWS_ENABLED is armed. Flag-off ⇒ core's AWS mint and exec
+  // paths fail closed.
+  const awsAccess = awsAccessEnabled();
+  if (awsAccess) registerAwsAccess();
+
+  // The identity-DIRECTORY plane: a no-op unless OE_DIRECTORY_PROVIDER names an adapter, and LOUD
+  // when it names one whose config is incomplete.
+  registerDirectoryAdapter();
+
+  // The GitHub config-repo PR mechanism, the default ConfigPrProvider (OPE-86). Unconditional and
+  // harmless when unused. A self-host swaps in its own provider from `customAdapters`.
+  registerGitHubConfigPrProvider();
+
+  // THE PROVIDER BUNDLES: one boot call per SELECTED bundle, straight from the generated table.
+  for (const provider of options.providers) {
+    provider.register();
+  }
+
+  // The deployment-status surface's model probe (OPE-2230). It registers a function, and nothing
+  // calls it until somebody reads `GET /eve/v1/oe/status`.
+  registerGatewayRouteProbe();
+
+  // The audit drop counter (audit-wedge WS-5). audit.ts cannot import telemetry.ts (a module-init
+  // cycle, and the one-chunk invariant), so this boot module injects the emitter.
+  registerAuditDropCounter((action, platform) => emitTelemetry("oe.audit.dropped", { "oe.action": action, "oe.platform": platform }));
+
+  // The Vercel Blob putter for the HTML-artifact hosting seam. Harmless when unused: the hosting
+  // path runs only for an org that opted in, and the putter fails loud without its OIDC env.
+  setBlobPutter(vercelBlobPutter);
+
+  // THE APP'S HOOK, after every default registration and before every check that reads them.
+  const customAdapters = options.customAdapters !== undefined;
+  if (options.customAdapters) await options.customAdapters();
+
+  // THE PREFETCH INVARIANT (OPE-390), fail-LOUD. It runs after the bundles register, because a
+  // connector-owned memory capability is DECLARED by its bundle's register(). It refuses a domain
+  // whose memory names a connector-owned silo the domain holds no connector grant for.
+  assertConnectorMemoryGrants(options.memory.domains(), options.memory.silos(), options.memory.grants);
+
+  // THE SUBTREE CLAIM (OPE-539), for the same boot-order reason: the platform that honours
+  // `subtree: true` declares so from its own bundle's register().
+  applySubtreeSurfaceClaims();
+
+  // The judge-without-rules line (OPE-2400): `approvals.judgeMode: "enforce"` with no bound
+  // pre-approval rule behaves like `off`, so say so once. A boot notice, so it logs once per process,
+  // in the process that serves, and a failure costs one log line, never the boot.
+  registerBootNotice("approval-judge-no-rules", announceJudgeWithoutRules);
+
+  const store = decideStoreWiring(process.env, onVercel());
+
+  // Neon (hosted Postgres) is LIVE-ONLY: registerNeon() builds the driver only when called here.
+  if (store.neon) await registerNeon();
+
+  // The embedded PGlite floor, armed LAZILY (OPE-391). The store registers now, but the lock, the
+  // WASM boot and the schema init happen on the first QUERY. `eve start` evaluates the app module
+  // in the CLI parent and again in the server child, and an eager arm made the parent the lock
+  // holder. The boot store checks ride along as the first-open callback, so they run once, in the
+  // process that uses the store.
+  if (store.pgliteFloor) registerOperationalPgliteLazy(undefined, runBootStoreChecks);
+  else await runBootStoreChecks();
+
+  // SLASH COMMANDS REGISTER FROM THE DEPLOYMENT ITSELF (OPE-1687). The app declares WHICH ROOMS
+  // (`declareSurfaceCommandScope`); each selected bundle declared HOW in the loop above. AWAITED, and
+  // it never throws: a lambda can freeze the moment it answers, and a floating promise would be
+  // cancelled on the cold start that had the work to do. The reconciler owns the latency bound (a
+  // short timeout per vendor call, no 429 backoff, one budget). `eve start` evaluates the app module
+  // twice, so a local start reconciles twice. A reconcile WRITES when the process holds the surface's
+  // credentials and the declared rooms differ from this checkout.
+  await reconcileSurfaceCommands();
+
+  WIRED = { providers, oeOauth: oeOauthCfg !== undefined, dbCredentialBroker, agentBrowser, awsAccess, customAdapters, store };
+  return WIRED;
+}
+
+// The boot-time store checks, in one place so they run either eagerly (hosted and sqlite paths, where
+// the store is live the moment it registers) or on the PGlite floor's FIRST OPEN. Availability over
+// integrity: none of them throws.
+//  1. The audit hash-chain tail-check (OPE-52): one loud warn on any break.
+//  2. The identity-link tenant backfill (OPE-309): fills blank `tenant` columns only.
+//  3. The registered boot notices (OPE-2231): a selected bundle registers a notice from its own
+//     register() call, and this drains the registry. The drain catches each notice separately.
+async function runBootStoreChecks(): Promise<void> {
+  try {
+    await bootVerifyAuditChainTail(getOperationalStore());
+  } catch {
+    /* store not resolvable — its first real use raises the reason loudly; skip the check */
+  }
+  try {
+    await bootBackfillLinkTenants();
+  } catch {
+    /* store not resolvable — see above; bootBackfillLinkTenants swallows everything else */
+  }
+  try {
+    await runBootNotices();
+  } catch {
+    /* unreachable — runBootNotices catches per notice; see core boot/notices.ts */
+  }
+}

package/agent/sandbox/vercel-lifecycle.ts

@@ -1,8 +1,18 @@
 // Stop-after-turn sandbox lifecycle — this file owns the DECISION, backend-stop.ts the mechanics. It exists
 // because a session VM is billed for its whole idle tail; every failure is fail-soft to the `timeout` fuse.
+//
+// 🔴 ON A WORK SESSION THE RULE IS "STOP WHEN IDLE", NOT "STOP AFTER THE TURN" (OPE-2341, placement §2.9).
+// In the three-tier shape the WORK SESSION (W) owns the conversation's sandbox, and every job of the
+// conversation runs in it. A W turn can end while W still owes a job: a job forwarded and not yet
+// started, or a task whose settlement has not run yet. The session-local live set does not see the
+// first, so the old rule stopped the VM under a job that was about to run in it. So on W the stop also
+// needs W's DURABLE ledger to owe nothing (core channels/work-generation.ts `workSessionSandboxState`).
+// The rule for every other session is unchanged: a seat has no sandbox of its own, and a two-tier seat
+// keeps the stop after its turn. `timeoutMs` stays the fuse, so on W it is the longest a JOB may hold
+// the VM, not the longest turn.
 
 import { defineHook, type HookContext } from "eve/hooks";
-import { bindFrom, domainKeyOf, resolvePartition, appendUsageEvent, usageForSession, recordSpend, periodOf, estimateSandboxCostUsd, routineIdOf, turnSurfaceMode, getSettings, isSubagentChildContext, liveTaskIds, subagentParentSessionId, type BindableContext } from "@open-everywhere/core/agent/adapter-api.js";
+import { bindFrom, domainKeyOf, resolvePartition, appendUsageEvent, usageForSession, recordSpend, periodOf, estimateSandboxCostUsd, routineIdOf, turnSurfaceMode, getSettings, isSubagentChildContext, liveTaskIds, subagentParentSessionId, workSessionSandboxState, type BindableContext } from "@open-everywhere/core/agent/adapter-api.js";
 import { resolveSandboxStopper, shouldStop, type SandboxListing, type SandboxStopper } from "./backend-stop.js";
 
 // Re-exported so the one "is this sandbox up?" predicate and the one listing shape stay
@@ -122,6 +132,17 @@ async function onTurnEnd(ctx: HookContext, outcome: string): Promise<void> {
       );
       return;
     }
+    // 🔴 OPE-2341 — A WORK SESSION STOPS ITS SANDBOX ONLY WHEN IDLE (see the file header). Fail-closed:
+    // an unreadable ledger reads as busy, and the VM then idles to its fuse instead of dying under a job.
+    const work = await workSessionSandboxState(ctx as unknown as BindableContext);
+    if (work.work && !work.idle) {
+      log(
+        `turn.${outcome}: SKIPPED the stop — this work session is not idle` +
+          (work.owed.length > 0 ? `: it still owes ${work.owed.length} job(s) or task(s) [${work.owed.join(", ")}]` : ": its ledger could not be read") +
+          "; the turn end that finds it idle sweeps it",
+      );
+      return;
+    }
     const stopped = await stopSessionSandboxes(ctx.session.id, stopper);
     if (stopped.length > 0) {
       log(`turn.${outcome}: stopped ${stopped.map((s) => s.name).join(", ")} (auto-snapshot; next turn auto-resumes)`);

package/dist/agent/browser/sandbox.d.ts

@@ -1,6 +1,11 @@
-/** Minimal structural sandbox the installer needs (matches @agent-browser/eve's EveSandboxSession). */
+/** Minimal structural sandbox the installer needs. `id` is OPTIONAL deliberately: eve 0.69.0's
+ *  `prepare` hands over a `SandboxSession`, which carries no `id` at all, and `installAgentBrowser`
+ *  reads only `run` — `sandbox.id` appears once in the vendor bundle, inside `runAgentBrowser` (the
+ *  TOOL path). Keeping it required would make the caller's cast load-bearing and hide the day a real
+ *  `id` dependency comes back. @agent-browser/eve's own `EveSandboxSession` still requires it, so the
+ *  one cast at the `installAgentBrowser` boundary stays and is commented there. */
 export interface BakeableSandbox {
-    readonly id: string;
+    readonly id?: string;
     run(options: {
         readonly command: string;
     }): PromiseLike<{
@@ -10,6 +15,7 @@ export interface BakeableSandbox {
     }>;
 }
 export interface AgentBrowserSandboxHooks {
+    /** 🔴 DEAD SINCE eve 0.69.0 (OPE-2247) — nothing reads it. See this file's header. */
     readonly revalidationKey: () => string;
     readonly bootstrap: (input: {
         use: () => Promise<BakeableSandbox>;

package/dist/agent/browser/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../agent/browser/sandbox.ts"],"names":[],"mappings":"AAMA,uGAAuG;AACvG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7I;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,MAAM,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAA6C,GAClG,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAelD"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../agent/browser/sandbox.ts"],"names":[],"mappings":"AAgBA;;;;;mFAKmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7I;AAED,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,QAAQ,CAAC,eAAe,EAAE,MAAM,MAAM,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAOtC,OAAO,GAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAkE,GACvH,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAelD"}