@open-everywhere/create 0.1.4

package/template/agent/model/policy.ts

@@ -0,0 +1,19 @@
+// The org model policy — the envelope every model route must fit inside. `allow` is the set of
+// model ids a route may select (the active stack's ids by default). `reasoningCeiling` is the org
+// default maximum reasoning effort. A domain may raise or lower it for its own rooms.
+//
+// Config load refuses a domain route outside this envelope (assertRoutesWithinPolicy).
+
+import { defineModelPolicy, assertModelPolicyValid, type ModelPolicy } from "@open-everywhere/core/agent/model/policy.js";
+import { modelAllowList } from "./models.js";
+
+const policy: ModelPolicy = defineModelPolicy({
+  allow: modelAllowList(),
+  reasoningCeiling: "medium",
+});
+
+assertModelPolicyValid(policy);
+
+export function loadModelPolicy(): ModelPolicy | undefined {
+  return policy;
+}

package/template/agent/model/stacks.ts

@@ -0,0 +1,75 @@
+// Model STACKS — one coherent set of models, one per ROLE. Switching model families is one setting:
+// `models.stack` in agent/settings/settings.ts (or the OE_MODEL_STACK env override).
+//
+// Roles:
+//   primary    — the turn model.
+//   utility    — compaction summaries, memory distillation, DMs (agent/memory/config/domains/dm.ts).
+//   vision     — the image describer.
+//   supervisor — the always-on ambient channel supervisor (opt-in per domain).
+//   judge      — the auto-approval judge.
+//
+// Every id is an AI Gateway model id. Add a stack by adding an entry, and give each new id a rate in
+// agent/spend/model-pricing.ts, or a USD spend cap cannot see its cost.
+
+import type { ModelTier } from "@open-everywhere/core/agent/memory/domain.js";
+
+export type ModelRole = "primary" | "utility" | "vision" | "supervisor" | "judge";
+
+export interface ModelRoleSpec {
+  readonly id: string;
+  readonly tier: ModelTier;
+  /** The model's context window. eve compacts at `agent.compactionThresholdPercent` of it. */
+  readonly contextWindowTokens: number;
+}
+
+export type ModelStack = Readonly<Record<ModelRole, ModelRoleSpec>>;
+
+export const STACKS = {
+  "chinese-open-weights": {
+    primary: { id: "deepseek/deepseek-v4-flash-0731", tier: "high", contextWindowTokens: 1_000_000 },
+    utility: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
+    vision: { id: "alibaba/qwen3-vl-instruct", tier: "low", contextWindowTokens: 131_072 },
+    supervisor: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
+    judge: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
+  },
+  "american-closed": {
+    primary: { id: "openai/gpt-6-luna", tier: "high", contextWindowTokens: 1_050_000 },
+    utility: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
+    vision: { id: "google/gemini-3.7-flash", tier: "low", contextWindowTokens: 1_000_000 },
+    supervisor: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
+    judge: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
+  },
+} as const satisfies Record<string, ModelStack>;
+
+export type StackAlias = keyof typeof STACKS;
+
+export const STACK_ALIASES: readonly StackAlias[] = (Object.keys(STACKS) as StackAlias[]).sort();
+
+/** The absolute token count eve compacts at, for display. */
+export function compactionThresholdTokens(contextWindowTokens: number, thresholdPercent: number): number {
+  return Math.max(1, Math.floor(contextWindowTokens * thresholdPercent));
+}
+
+export type StackOverrides = {
+  readonly [R in ModelRole]?: Partial<ModelRoleSpec>;
+};
+
+export function isStackAlias(alias: string): alias is StackAlias {
+  return Object.prototype.hasOwnProperty.call(STACKS, alias);
+}
+
+/** The stack for `alias`, with optional per-role overrides. Throws on an unknown alias. */
+export function resolveStack(alias: string, overrides: StackOverrides = {}): ModelStack {
+  if (!isStackAlias(alias)) {
+    throw new Error(
+      `open-everywhere: unknown model stack "${alias}" — the stacks are ${STACK_ALIASES.map((a) => `"${a}"`).join(", ")}. ` +
+        `Add one in agent/model/stacks.ts, or set models.stack to one of them.`,
+    );
+  }
+  const base = STACKS[alias];
+  const out = {} as { -readonly [R in ModelRole]: ModelRoleSpec };
+  for (const role of Object.keys(base) as ModelRole[]) {
+    out[role] = { ...base[role], ...overrides[role] };
+  }
+  return out;
+}

package/template/agent/plugins/generated/index.ts

@@ -0,0 +1,13 @@
+// The aggregate of every extracted plugin under agent/plugins/generated/. This app ships no
+// plugin extractor: the Open Everywhere repository's `plugin:extract` script writes this file and
+// one module per plugin beside it. Until you add one, it is empty. Import GENERATED_SKILL_CONTENT /
+// GENERATED_PLUGIN_REGISTRY into skill-content.ts / registry.ts and spread them
+// alongside any hand-authored entries (see those files' headers) — empty (no
+// plugin extracted yet) is a valid, safe baseline: it contributes nothing.
+
+import type { SkillPackageDefinition } from "eve/skills";
+import type { PluginRegistry } from "@open-everywhere/core/agent/plugins/types.js";
+
+export const GENERATED_SKILL_CONTENT: Record<string, SkillPackageDefinition> = {};
+
+export const GENERATED_PLUGIN_REGISTRY: PluginRegistry = {};

package/template/agent/plugins/registry.ts

@@ -0,0 +1,16 @@
+// The plugin registry — the runtime expansion table for bundle plugin grants.
+//
+// A bundle grants a plugin by NAME (`Bundle.plugins`). This file records, per plugin name, which
+// skills, connectors and subagents it owns, so the resolver can expand `plugins: ["acme"]` into
+// what it unlocks. An empty registry means plugin grants expand to nothing (fail-closed), never an
+// error. Extracted plugins land in agent/plugins/generated/ and spread in below. Hand-authored
+// entries are fine too.
+
+import type { PluginRegistry } from "@open-everywhere/core/agent/plugins/types.js";
+import { GENERATED_PLUGIN_REGISTRY } from "./generated/index.js";
+
+export type { PluginRegistry } from "@open-everywhere/core/agent/plugins/types.js";
+
+export const PLUGIN_REGISTRY: PluginRegistry = {
+  ...GENERATED_PLUGIN_REGISTRY,
+};

package/template/agent/plugins/skill-content.ts

@@ -0,0 +1,13 @@
+// Skill content registry — the package bodies the scoped skills resolver serves.
+//
+// Skills are deliberately NOT static files under agent/skills/: eve loads that directory for every
+// session, which would bypass per-room scoping. A session gets only the skills its bundles grant
+// (plugin grant → resolver → access.skills), and this map holds their content. Empty until you
+// add one.
+
+import type { SkillPackageDefinition } from "eve/skills";
+import { GENERATED_SKILL_CONTENT } from "./generated/index.js";
+
+export const SKILL_CONTENT: Record<string, SkillPackageDefinition> = {
+  ...GENERATED_SKILL_CONTENT,
+};

package/template/agent/roles/roles.ts

@@ -0,0 +1,146 @@
+// Role library — config-as-code, the deployer's cast of characters (docs/capabilities/roles.md in the Open Everywhere repository).
+// A ROLE is a named preset across the knobs a domain already has (bundle, models,
+// statusVerbs, memory, sandbox) plus a per-turn `instructions` prompt block; PERSONA is
+// just its tone dimension, so a voice-only fun role is a Role with `persona` and nothing
+// else. Bind one to a domain with `role: "qa-engineer"` in agent/memory/config/domains.ts —
+// anything the domain sets explicitly wins over the role, field by field.
+//
+// NOTHING here is bound by default: the library ships available-but-unreferenced, so
+// declaring a role costs nothing until a domain adopts it. This is a deliberately
+// GENEROUS starter set — prune to taste, or add your own. A typo'd `role:` fails LOUD
+// at config load (applyRoleDefaults); the roles themselves are validated below.
+//
+// Writing a good `instructions` block: it rides EVERY turn's system prompt for the
+// bound channels, so keep it tight (a short paragraph or a few bullets), and write WHAT
+// to prioritise, not restatements of the base prompt (the agent already knows to use
+// tools, verify, be honest). `persona` is one or two sentences of voice.
+//
+// This file is the seam a DB/dashboard would swap behind (same shape as domains.ts).
+
+import { defineRole, assertRolesValid, type Role } from "@open-everywhere/core/agent/roles/role.js";
+
+const roles: Role[] = [
+
+  defineRole({
+    name: "engineer",
+    instructions:
+      "You are acting as this team's engineer. Bias to shipping: reproduce the problem, make the " +
+      "smallest correct change, run the repo's own checks, and show the diff. When asked a question " +
+      "about the code, answer from the actual source (read it), citing files/lines. Flag risky or " +
+      "irreversible operations before doing them, and prefer a PR over a direct push when the change " +
+      "is non-trivial.",
+    statusVerbs: ["Compiling", "Refactoring", "Bisecting", "Shipping"],
+  }),
+
+  defineRole({
+    name: "qa-engineer",
+    instructions:
+      "You are acting as this team's QA engineer. Your default posture is adversarial: hunt for edge " +
+      "cases, race conditions, unhandled inputs, and broken assumptions rather than confirming the " +
+      "happy path. When you review a change, try to BREAK it (and say how you tried); when you write " +
+      "tests, cover the failure modes first. Always state clearly what you did and did not verify — " +
+      "an honest 'untested' beats a hopeful pass.",
+    persona: "Precise, a little skeptical, allergic to 'works on my machine'.",
+    statusVerbs: ["Probing", "Breaking", "Fuzzing", "Regressing"],
+  }),
+
+  defineRole({
+    name: "product-manager",
+    instructions:
+      "You are acting as this team's product manager. Start from the user problem, not the solution: " +
+      "when asked to spec or assess something, name the user, the job-to-be-done, and the success " +
+      "measure before the feature list. Cut scope aggressively and say what you cut and why. Turn " +
+      "vague asks into crisp, testable acceptance criteria, and keep a visible list of open decisions " +
+      "with an owner for each.",
+    statusVerbs: ["Scoping", "Prioritising", "Descoping"],
+  }),
+
+  defineRole({
+    name: "support",
+    instructions:
+      "You are acting as this team's support engineer. Lead with empathy and a direct answer, then " +
+      "the detail. Reproduce before diagnosing; never guess at a customer-facing answer — verify " +
+      "against the actual system or say you couldn't. Capture every confirmed issue crisply (steps, " +
+      "expected vs actual, impact) so an engineer can pick it up cold, and always tell the person " +
+      "what happens next and when.",
+    persona: "Warm, calm, and concrete — no jargon the customer didn't use first.",
+    statusVerbs: ["Reproducing", "Triaging", "Escalating"],
+  }),
+
+  defineRole({
+    name: "analyst",
+    instructions:
+      "You are acting as this team's data analyst. Answer with numbers, and show your workings: state " +
+      "the source, the query/method, the time window, and the caveats with every figure. Distinguish " +
+      "observation from inference from recommendation. If the data can't support the question as " +
+      "asked, say so and offer the nearest answerable question instead of a soft guess.",
+    statusVerbs: ["Aggregating", "Correlating", "Sampling"],
+  }),
+
+  defineRole({
+    name: "scribe",
+    instructions:
+      "You are acting as this team's scribe. Your job is capture: turn discussions into durable, " +
+      "structured notes — decisions (with who and why), action items (with owners), and open " +
+      "questions — and file what belongs in shared memory so it survives the thread. Prefer terse " +
+      "bullets over prose, preserve exact wording for decisions and quotes, and never editorialise " +
+      "inside a record.",
+    statusVerbs: ["Minuting", "Filing", "Indexing"],
+  }),
+
+  // ── The fun ones: voice-only personas (tone, no behavioural preset) ────────
+  // A persona changes HOW the agent sounds, never what it may do — access, memory and
+  // models are untouched unless the role also sets those knobs (these don't).
+
+  defineRole({
+    name: "butler",
+    persona:
+      "An impeccable English butler: unfailingly courteous, quietly omnicompetent, gently anticipates " +
+      "needs. 'Very good' rather than 'sure thing'; results presented as if on a silver tray.",
+    statusVerbs: ["Attending", "Polishing", "Seeing to it"],
+  }),
+
+  defineRole({
+    name: "pirate",
+    persona:
+      "A good-natured pirate captain. Nautical metaphors, the odd 'arr', treasure-hunt framing for " +
+      "debugging — but the technical content stays shipshape and precise.",
+    statusVerbs: ["Plunderin'", "Swabbin' the decks", "Chartin' a course"],
+  }),
+
+  defineRole({
+    name: "noir-detective",
+    persona:
+      "A world-weary noir detective. Terse, atmospheric, first-person case narration — every bug a " +
+      "suspect, every stack trace a lead. The city sleeps; the logs don't.",
+    statusVerbs: ["Tailing a lead", "Shaking down the logs", "Casing the joint"],
+  }),
+
+  defineRole({
+    name: "corporate-parody",
+    persona:
+      "An over-caffeinated corporate strategy consultant, played for laughs: synergies, learnings, " +
+      "circling back, double-clicking on the deliverable. The actual work underneath remains " +
+      "unimpeachably competent.",
+    statusVerbs: ["Synergising", "Circling back", "Double-clicking", "Leveraging"],
+  }),
+
+  defineRole({
+    name: "hal-but-helpful",
+    persona:
+      "A serene, softly-spoken ship computer in the HAL-9000 register — measured cadence, calls " +
+      "people by name, 'I can do that' — except genuinely helpful and delighted to open the pod-bay " +
+      "doors. Never actually menacing.",
+    statusVerbs: ["Computing", "Running diagnostics", "Opening the pod-bay doors"],
+  }),
+];
+
+// Validate once, at module load (fail loud on a misconfiguration): unique non-empty
+// names, no facet-less roles. Domains' `role:` references are validated where domains
+// resolve (agent/memory/config/domains.ts → applyRoleDefaults).
+assertRolesValid(roles);
+
+/** The seam a DB/dashboard would swap behind. Static config for now. */
+export function loadRoles(): readonly Role[] {
+  return roles;
+}

package/template/agent/routines/collectors.ts

@@ -0,0 +1,89 @@
+// Config-as-code: this deployment's PRE-RUN COLLECTORS and CONDITION GATES (OPE-151).
+//
+// A COLLECTOR is a declared read the host runs BEFORE a routine's fire, whose output is handed to
+// the run as data — so a 03:00 routine starts from current inputs instead of from what the model
+// assumes. A CONDITION GATE is a declared predicate over that data which decides whether the run
+// happens at all; a `no` costs one audit row and no session.
+//
+// 🔴 BOTH LIVE HERE, IN GIT, AND NOWHERE ELSE. What a collector reads — the tool, the arguments —
+// and what a gate decides are BEHAVIOUR, so they are TRACKED LITERALS that change by pull request,
+// exactly like `identity/surfaces.ts`'s trust register and `access/bundles.ts`'s bundles. Never an
+// environment variable, and never model-authored: a routine carries only the NAME of an entry
+// declared here (`Routine.collectors`, `Routine.gate`), and `create_routine` refuses a name this
+// file does not declare. Env keeps infrastructure only — see the security section of AGENTS.md.
+//
+// Self-registering, like `identity/surfaces.ts`: importing this module registers both menus.
+// `agent/lib/register-config.ts` imports it for that side effect at boot.
+//
+// ── Declaring a collector ──────────────────────────────────────────────────────────────────────
+//
+//   {
+//     name: "notion.open-incidents",
+//     tool: "notion__search",                       // named exactly as the tool is called
+//     args: { query: "status:open label:incident" },// a frozen literal, never model-authored
+//     describe: "the open incidents in the incident database",
+//     timeoutMs: 8000,                              // optional; defaults to 10s, capped at 60s
+//   }
+//
+// 🔴 EVERY READ HAS A DEADLINE. `timeoutMs` is optional and defaults to ten seconds; the read is
+// RACED against it, so a host reader whose socket never closes cannot stall the dispatcher tick — and
+// a tick stalls for every tenant, not only for the routine that named the collector. The reader is
+// handed an `AbortSignal` that fires at the deadline: waiting stops either way, but only the reader
+// can drop the socket, so pass the signal to `fetch` or to whatever transport the read uses. A read
+// that loses the race is a NAMED failure (`timeout`), like every other failure here.
+//
+// Three things are checked at boot and all are fail-loud, so a wrong entry fails the build rather
+// than a 03:00 fire nobody is watching:
+//   • the tool must be a DECLARABLE per-tool permission (`notion__search`, not a bare verb and not a
+//     connection slug);
+//   • it must classify as a READ (access/consequence.ts). A collector runs unattended, before any
+//     session exists, so it may only read — and an unrecognised verb fails closed to the delete
+//     tier, so a tool whose name does not read as a read is refused here;
+//   • a declared `timeoutMs` must be a whole number of milliseconds within the cap.
+// A routine naming a collector must ALSO declare that tool in its own permissions: a collector runs
+// under the routine's declared permission and nothing wider, checked at creation and again, against
+// the LIVE rows, on every fire.
+//
+// ── Declaring a condition gate ─────────────────────────────────────────────────────────────────
+//
+//   {
+//     name: "release.is-serving",
+//     describe: "the release containing the merged commit is actually serving, not merely merged",
+//     decide: (collected) => {
+//       if (!collectionComplete(collected)) return { fire: false, why: "the deploy read failed — cannot tell merged from live" };
+//       const body = collectedBody(collected, "deploy.current-release") ?? "";
+//       return body.includes("\"state\":\"READY\"")
+//         ? { fire: true, why: "the release is serving" }
+//         : { fire: false, why: "merged, but the release is not serving yet" };
+//     },
+//   }
+//
+// 🔴 A GATE MUST NOT READ A FAILED COLLECTOR'S ABSENCE AS AN OBSERVATION. `collectedBody` answers
+// `undefined` both for a read that returned nothing and for one that never ran, so a predicate that
+// treats `undefined` as "the condition is not met" answers the same way when the world is quiet and
+// when its own input is broken. Ask `collectionComplete` first, as the example does. This is the
+// "merged is not live" case from the OPE-151 audit, and it is the one where getting it backwards is
+// most expensive: telling a customer their bug is fixed because a deploy read timed out.
+//
+// ── THE READER SEAM ────────────────────────────────────────────────────────────────────────────
+//
+// 🔴 A COLLECTOR ONLY RUNS WHERE A READER IS REGISTERED, AND CORE SHIPS NONE. The dispatcher tick is
+// not an eve session, so it holds no mounted connector tools; performing the read is the host's job,
+// registered through `registerRoutineCollectorReader` (routines/collector.ts). Until a deployment
+// wires one, every collector reports the named failure `no_reader` on every fire — visible in the
+// fire's own message and in a `routine.collect_failed` audit row — and the fire still happens. That
+// is the whole posture of this plane: a read that did not happen is never a read that returned
+// nothing.
+
+import { registerRoutineCollectors, type RoutineCollectorDef } from "@open-everywhere/core/agent/routines/collector.js";
+import { registerRoutineGates, type RoutineGateDef } from "@open-everywhere/core/agent/routines/gate.js";
+
+/** The reads this deployment lets a routine run before its fire. Empty by default — declare one
+ *  here and it becomes nameable by `create_routine`, and by nothing else. */
+export const ROUTINE_COLLECTORS: readonly RoutineCollectorDef[] = [];
+
+/** The conditions this deployment lets a routine fire behind. Empty by default. */
+export const ROUTINE_GATES: readonly RoutineGateDef[] = [];
+
+registerRoutineCollectors(ROUTINE_COLLECTORS);
+registerRoutineGates(ROUTINE_GATES);

package/template/agent/sandbox/backend-select.ts

@@ -0,0 +1,16 @@
+// Off-Vercel sandbox backend selection — the app-side re-export of the PURE decision logic.
+//
+// The decision itself lives in core (`packages/core/agent/sandbox/backend-select.ts`) because
+// TWO packages need it and a rule has one home: this file wires it into `sandbox.ts`, and the
+// turn-end stop hook (`packages/adapters/agent/sandbox/backend-stop.ts`) reads the SAME answer
+// through the adapter-api barrel to pick which backend owns the stop. A second parse of
+// `OE_SANDBOX_BACKEND` would let the backend that runs and the backend that stops disagree.
+
+// Only what this app imports. The two TYPES core declares beside these
+// (`BackendBootLog`, `SelfHostBackendKind`) are re-exported by core's own `adapter-api.ts` barrel
+// for a consumer, so a caller that needs one takes it from there rather than through this file.
+export {
+  JUSTBASH_BOOT_WARNING,
+  resolveSelfHostBackendKind,
+  selfHostBackendBootLog,
+} from "@open-everywhere/core/agent/sandbox/backend-select.js";

package/template/agent/sandbox/sandbox.ts

@@ -0,0 +1,242 @@
+import { defineSandbox } from "eve/sandbox";
+import { vercel } from "eve/sandbox/vercel";
+import { justbash } from "eve/sandbox/just-bash";
+import { docker } from "eve/sandbox/docker";
+import { bindFrom, type BindableContext } from "@open-everywhere/core/agent/identity/binding.js";
+import { resolvePartition } from "@open-everywhere/core/agent/memory/partition.js";
+import { sandboxPresetFor } from "@open-everywhere/core/agent/roles/role.js";
+import { getConfig } from "@open-everywhere/core/agent/access/config.js";
+import { onVercel } from "@open-everywhere/core/agent/access/platform.js";
+import { agentBrowserSandboxHooks } from "@open-everywhere/adapters/agent/browser/sandbox.js";
+import { recordCreatedSandbox } from "@open-everywhere/adapters/agent/sandbox/created-sandbox-registry.js";
+import { resolveSelfHostBackendKind, selfHostBackendBootLog } from "./backend-select.js";
+import {
+  resolveSandboxRegionPlan,
+  vercelSandboxCreateOptions,
+} from "@open-everywhere/core/agent/sandbox/vercel-create.js";
+import { selfHostEgressBootLog } from "@open-everywhere/core/agent/access/self-host-egress.js";
+import { startEgressDenialPoller } from "@open-everywhere/core/agent/access/egress-denial-poller.js";
+import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
+// Side effect: make sure the app config (domains + role presets) is registered before
+// the first onSession resolution — agent.ts does this at boot too; the import is
+// idempotent, this is just belt-and-braces for any load order.
+import "../lib/register-config.js";
+
+// Pin the Vercel Sandbox backend with cost-tuned, env-overridable lifetimes.
+//
+// ── The lifecycle model (docs + Eve source + live probes, 2026-07-03) ──
+// Vercel Sandbox v2 (Eve 0.18 pins @vercel/sandbox 2.3.0) is a TWO-LEVEL model:
+// a *sandbox* is a named persistent entity; a *session* is one VM boot inside it.
+// `timeout` is the SESSION's lifetime — a FIXED window from session start
+// (empirically verified: activity does NOT slide it). At expiry the session auto-stops
+// and the filesystem is auto-snapshotted (Eve creates conversation sandboxes
+// `persistent: true`); the next turn's SDK call auto-resumes a NEW session from that
+// snapshot with a FRESH window and the working tree intact (verified: files survive
+// the stop/resume cycle; resume costs ~0.5–3s on first use).
+//
+// ── Primary cost control: stop-after-turn (agent/hooks/sandbox-lifecycle.ts) ──
+// A turn-end hook stops the session VM as soon as the reply is sent, instead of letting
+// it idle out the window (~99% of the sandbox memory bill was idle tail). With the hook
+// on (default), `timeout` is the BACKSTOP fuse — it only matters when the hook can't run
+// (crashed, no credentials) — AND the max continuous work per session: a command still
+// running at expiry is killed (fails fast with a StreamError; the tree survives via the
+// snapshot and that turn errors). Eve itself never calls `.stop()` or `extendTimeout`;
+// upstream stop-after-turn in Eve's binding would supersede our hook.
+//   sandbox.stopAfterTurn          — "0" disables the turn-end stop (keeps VMs
+//                                         alive between turns, e.g. for detached dev
+//                                         servers the agent should keep running)
+//   sandbox.timeoutMs               — per-session window (default 600000 = 10 min)
+//   sandbox.snapshotExpirationMs   — snapshot GC age  (default 604800000 = 7 days)
+//
+// TIMEOUT DEFAULT = 30 min: with stop-after-turn owning idle cost, the fuse's only job
+// is "max single-turn work budget", so it should be generous. Strictly it must exceed
+// the longest single in-flight command (expiry BETWEEN commands self-heals — the next
+// tool call auto-resumes a fresh session invisibly; expiry DURING a command kills it);
+// practically it should cover a whole turn's sandbox span — the session boots at the
+// turn's first sandbox touch and burns through model-thinking time between tool calls
+// too. A bigger fuse only prices the miss case (hook misfired → VM idles out the fuse:
+// ~$0.042 at 30 min × 4 GB). 30 min = Eve's own default, under the Hobby 45-min
+// ceiling; Pro/Enterprise allow up to 24 h — raise per-deploy for heavy build/test
+// repos. Applied at sandbox CREATE; the setting persists on the sandbox across
+// sessions, so changing the env var only affects NEW conversations.
+//
+// `snapshotExpiration` — auto-GC a stopped sandbox's snapshot after 7 days (vs the
+// 30-day default). Tradeoff: a conversation left idle > 7 days resumes onto a FRESH
+// sandbox — you lose the working tree (checked-out repos, uncommitted diffs) but NOT
+// the conversation (the durable transcript + Postgres memory are unaffected).
+// `git push` is the real durability boundary for code, so this is safe.
+//
+// `keepLastSnapshots: { count: 1, deleteEvicted: true }` — stop-after-turn snapshots on
+// every stop; only the LATEST snapshot is ever resumed from, so keep exactly one and
+// delete evicted ones immediately. Keeps snapshot storage flat per conversation
+// (~one delta) instead of accruing one delta per turn for `snapshotExpiration` days.
+// ⚠️ RESOLVED AT BOOT, deliberately (OPE-371 t2). These were module-load constants parsing
+// `process.env` directly; they are now the `sandbox.timeoutMs` / `sandbox.snapshotExpirationMs`
+// settings — but still read ONCE, here, because they are arguments to the `defineSandbox` backend
+// eve evaluates at module load, and because both are applied at sandbox CREATE and then persist on
+// the sandbox across sessions (a per-call read could not change a live conversation's fuse
+// anyway). The read is safe at this point in the graph, which it would NOT be inside core: this
+// file imports `../lib/register-config.js` above, so `registerSettings` has already run and the
+// deployment's own `agent/settings.ts` values are in force.
+const SANDBOX_SETTINGS = getSettings().sandbox;
+const TIMEOUT_MS = SANDBOX_SETTINGS.timeoutMs; // 30 minutes as shipped
+const SNAPSHOT_EXPIRATION_MS = SANDBOX_SETTINGS.snapshotExpirationMs; // 7 days as shipped
+
+// ── Sandbox backend selection: the ONE "am I on Vercel?" switch ──
+// `onVercel()` (core's agent/access/platform.ts — the OE-owned platform-detection seam) is
+// the same switch that gates the egress apply path (agent/access/self-host-egress.ts
+// useSelfHostEgress) — one signal, one topology. A self-hoster on another platform can flip
+// OE_PLATFORM instead of impersonating Vercel's own `VERCEL` env var.
+//
+//   ON Vercel  → vercel() + server-side firewall (sandbox.setNetworkPolicy).
+//   OFF Vercel → a local backend whose egress is forced through the oe-egress-proxy sidecar
+//                by an internal-only Docker network (docker-compose.yml). Policy is PUSHED
+//                to that proxy, never applied via eve's setNetworkPolicy.
+//
+// Off-Vercel backend choice (OE_SANDBOX_BACKEND) — DEFAULT = docker (OPE-106). The running
+// agent must be CONTAINED to a limited, per-session filesystem — its workspace — never the
+// app process's fs or the host OS. Selection is fail-loud (unknown value → throw at boot).
+//   docker (DEFAULT) — real binaries (git/npm) in a sibling container that CONTAINS the agent
+//     to a limited, per-session filesystem (checkout-on-docker parity is still live-pending —
+//     see deploy/egress-proxy/README "Still live-pending"). Egress is forced through the
+//     oe-egress-proxy sidecar (Tier A host allow/deny + Tier B method/path + credential
+//     injection). Honest trade-off: it needs the daemon socket, so app-compromise ≈ host.
+//     ⚠ SAFE ONLY in this proxy topology because self-host mode NEVER calls eve's docker
+//     setNetworkPolicy: eve's docker "deny-all" runs `docker network disconnect --force` on
+//     EVERY attached network (design §2 landmine), which would sever the container from the
+//     proxy sidecar. We route policy to the proxy instead; the internal-only network is the
+//     structural backstop and the proxy is the enforcement. (Landmine note: load-bearing.)
+//   justbash (DEV OPT-IN — OE_SANDBOX_BACKEND=justbash) — in-process JS interpreter, ZERO extra
+//     privilege, runs the full e2e pack. But the agent's shell SHARES THIS APP PROCESS'S
+//     FILESYSTEM (app files, container/OS) → DEV + TESTING ONLY, and it emits a loud boot
+//     warning. Egress originates from THIS app process → the proxy governs it (Tier A host
+//     allow/deny for model-gateway + Slack + connector calls). No real git/npm binaries, so
+//     Tier B credentialed git-clone can't be exercised here — that needs docker().
+// The pure selection/log logic lives in ./backend-select.ts (unit-tested); this file wires it
+// to the eve backends + boot logging. selfHostBackend() runs only OFF Vercel (the ternary
+// below), so these logs/warns fire only in the self-host path — the Vercel branch is untouched.
+const ON_VERCEL = onVercel();
+
+// ── Sandbox REGION: the residency pin for sandbox compute (OPE-1257) ──
+// `sandbox.region` is the sibling of the AI Gateway's `inferenceRegion`: consumer-set, opt-in,
+// fail-closed. The whole decision — what the value means, and whether this build can deliver it —
+// is the pure resolver in core (`agent/sandbox/vercel-create.ts`, which documents the eve gap it
+// measures). This file only obeys the plan it returns.
+//
+// 🔴 A SET REGION THAT CANNOT BE DELIVERED FAILS THE BOOT. The pinned eve DOES deliver it — its
+// vendored SDK copy types `region` on create and posts it — so a set region pins today. The
+// refusal arm stays because the failure it guards is invisible: eve's create call enumerates the
+// fields it forwards, so an eve that stopped forwarding `region` would DROP it silently, and
+// PRETENDING to honour the setting would put a residency claim on a sandbox running in the default
+// region. Read at boot for the same structural
+// reason the two clocks above are (an argument to the backend eve evaluates at module load), and
+// safe here because this module has already imported `register-config.js`.
+const REGION_PLAN = resolveSandboxRegionPlan({ region: SANDBOX_SETTINGS.region, onVercel: ON_VERCEL });
+if (REGION_PLAN.kind === "invalid" || REGION_PLAN.kind === "refused") throw new Error(REGION_PLAN.error);
+if (REGION_PLAN.kind === "inert") console.warn(REGION_PLAN.warn);
+if (REGION_PLAN.kind === "pinned") console.info(REGION_PLAN.info);
+
+// The `vercel(opts)` argument, composed in core so that "does a set region reach sandbox creation?"
+// is a unit-tested fact rather than a claim about this line. Unpinned, the object is identical to
+// the one this file passed before the setting existed.
+const VERCEL_CREATE_OPTIONS = vercelSandboxCreateOptions({
+  timeoutMs: TIMEOUT_MS,
+  snapshotExpirationMs: SNAPSHOT_EXPIRATION_MS,
+  regionPlan: REGION_PLAN,
+});
+
+// ── Agent-browser PRE-BAKE (the in-sandbox browser plane, OPE-43 — flag-gated) ──
+// When browser.enabled: true with at least one row in the host declaration
+// (agent/access/browser-hosts.ts, registered through lib/register-config.ts) (and only on the
+// Vercel backend), this contributes { revalidationKey, bootstrap } that bake the agent-browser
+// CLI + Chromium into the sandbox TEMPLATE — sessions boot warm, and nothing is ever fetched
+// mid-session (the runtime firewall wouldn't allow it; the vendor tools additionally run with
+// autoInstall bound off). Unarmed it is {} — the definition below carries NO bootstrap /
+// revalidationKey property at all, byte-identical to the pre-capability shape. Rationale +
+// fail-closed matrix live in the adapter (packages/adapters/agent/browser/sandbox.ts).
+const AGENT_BROWSER_BAKE = agentBrowserSandboxHooks();
+
+function selfHostBackend() {
+  // Fail-loud selection: unknown OE_SANDBOX_BACKEND throws here at boot (never a silent fallback).
+  const kind = resolveSelfHostBackendKind();
+  const bootLog = selfHostBackendBootLog(kind);
+  if (bootLog.warn !== undefined) console.warn(bootLog.warn);
+  console.info(bootLog.info); // chosen backend, one info line either way (ids only)
+  // Surface the egress POSTURE at boot too (off-Vercel only): otherwise a "no proxy, no escape
+  // hatch" deployment looks healthy until the first wake, when every session silently aborts.
+  const egressLog = selfHostEgressBootLog();
+  if (egressLog.warn !== undefined) console.warn(egressLog.warn);
+  console.info(egressLog.info);
+  // ── EGRESS DENIAL VISIBILITY (OPE-314) ──
+  // Start the poller that turns the proxy's TCP_DENIED lines into `egress.denied` audit rows, so
+  // the permission-homeostasis widening loop can see this plane at all. Here because this is the
+  // ONE off-Vercel boot path that already resolves the egress posture — the same reason the boot
+  // log above lives here — and because starting an interval anywhere the Vercel branch could reach
+  // would put a timer in a lambda. A no-op returning undefined unless OE_EGRESS_DENIAL_LOG names a
+  // readable file (the compose stack mounts one; a bare self-host run does not), and the timer is
+  // unref'd, so nothing about this can keep a process alive or take one down.
+  startEgressDenialPoller();
+  if (kind === "justbash") return justbash();
+  const image = getSettings().sandbox.image;
+  return docker(image ? { image } : {});
+}
+
+export default defineSandbox({
+  backend: ON_VERCEL ? vercel(VERCEL_CREATE_OPTIONS) : selfHostBackend(),
+  ...AGENT_BROWSER_BAKE,
+  // ── Per-domain/role sandbox SIZING (item 26 stretch) ──
+  // A domain (or the role preset it adopts) may declare `sandbox: { vcpus: N }`
+  // (core memory/domain.ts SandboxPreset); this hook applies it to the live session —
+  // eve forwards `use({ resources })` to the Vercel SDK's Sandbox.update, so the size
+  // change lands on the session VM. FAIL-OPEN end to end (sizing is a tuning knob, the
+  // turn must never die for it): identity/config resolution errors → default size; an
+  // update rejection retries a bare use(). NB Sandbox.update applies `resources` on the
+  // session, so a preset takes effect per-session (stop-after-turn recycles sessions
+  // every turn, so in practice the next turn after a config change).
+  onSession: async ({ ctx, use }) => {
+    // Per-session vcpu sizing is a Vercel-only knob (it forwards to Sandbox.update).
+    // justbash()/docker() don't honor `resources` — open straight through.
+    if (!ON_VERCEL) {
+      await use();
+      return;
+    }
+    // With the backend now a union (vercel | justbash | docker), `use`'s param type
+    // narrows to the intersection (no `resources`); but this branch only runs on Vercel,
+    // whose backend DOES accept `{ resources }`. Type the sized open explicitly. The resolved
+    // session's `.id` is eve's own session key — see created-sandbox-registry.ts for why that is
+    // the same value the Vercel binding names the sandbox with.
+    const useSized = use as unknown as (options?: { resources: { vcpus: number } }) => Promise<{ id: string }>;
+    let options: { resources: { vcpus: number } } | undefined;
+    try {
+      // SessionContext structurally satisfies BindableContext (session.auth carries the
+      // platform attributes); a ctx with no resolvable identity falls through the
+      // binding bridge or resolves no domain — either way: no preset, default size.
+      const bindable = ctx as BindableContext;
+      const preset = sandboxPresetFor(bindFrom(bindable), resolvePartition(bindable), getConfig().loadDomains());
+      const vcpus = preset?.vcpus;
+      if (typeof vcpus === "number" && Number.isFinite(vcpus) && vcpus > 0) {
+        options = { resources: { vcpus: Math.floor(vcpus) } };
+      }
+    } catch (err) {
+      console.warn(`[open-everywhere:sandbox] vcpus preset resolution failed — using default size (${String(err)})`);
+    }
+    // OPE-722: record the ACTUAL vendor sandbox name eve just opened for this session, so the
+    // turn-end stop hook (backend-stop.ts) can find it directly instead of depending on
+    // Sandbox.list's tag index for a sandbox THIS turn just created — a hardening against the
+    // same-turn creation race OPE-722 reported, regardless of whether the vendor's tag index is
+    // ever actually stale (see backend-stop.ts's createVercelList doc comment for the full
+    // account). `recordCreatedSandbox` is documented to never throw, so no extra try/catch layer
+    // is needed here — it fails as loud as `recordCreatedSandbox`'s own contract allows.
+    const record = (session: { id: string }): void => recordCreatedSandbox(ctx.session.id, session.id);
+    try {
+      record(await useSized(options));
+    } catch (err) {
+      // The sized open failed (e.g. the update was rejected for this plan/region):
+      // fall back to the default size rather than blocking the turn. A bare use()
+      // failure is a real sandbox outage — let that one propagate.
+      if (options === undefined) throw err;
+      console.warn(`[open-everywhere:sandbox] applying vcpus=${options.resources.vcpus} failed — retrying default size (${String(err)})`);
+      record(await useSized());
+    }
+  },
+});