eve 0.63.0 → 0.64.0

package/dist/src/public/sandbox/vercel.d.ts

@@ -1,3 +1,3 @@
-export { vercel } from "#public/sandbox/backends/vercel.js";
+export { VercelSandbox, type VercelSandboxEnvironmentOptions, type VercelSandboxRuntimeOptions, } from "#sandbox/providers/vercel.js";
 export { Drive } from "#compiled/@vercel/sandbox/index.js";
-export type { VercelSandboxBootstrapUseOptions, VercelSandboxCreateOptions, VercelSandboxMount, VercelSandboxMountMode, VercelSandboxMounts, VercelSandboxOptions, VercelSandboxSessionCreateContext, VercelSandboxSessionCreateOptions, VercelSandboxSessionUseOptions, } from "#public/sandbox/vercel-sandbox.js";
+export type { VercelSandboxMount, VercelSandboxMountMode, VercelSandboxMounts, } from "#public/sandbox/vercel-sandbox.js";

package/dist/src/public/sandbox/vercel.js

@@ -1 +1 @@
-import{vercel}from"#public/sandbox/backends/vercel.js";import{Drive}from"#compiled/@vercel/sandbox/index.js";export{Drive,vercel};
+import{VercelSandbox}from"#sandbox/providers/vercel.js";import{Drive}from"#compiled/@vercel/sandbox/index.js";export{Drive,VercelSandbox};

package/dist/src/runtime/cache-key.js

@@ -1 +1 @@
-import{getRuntimeCompiledArtifactsCacheKey}from"#runtime/compiled-artifacts-source.js";import{loadCompileMetadata}from"#runtime/loaders/compile-metadata.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";async function resolveRuntimeCompiledArtifactsVersionedCacheKey(e){let t=getRuntimeCompiledArtifactsCacheKey(e),n=await resolveCompileMetadataMtimeMs(e);try{let r=(await loadCompileMetadata({compiledArtifactsSource:e}))?.discovery.sourceGraphHash;return r===void 0||r.length===0?n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`:n===void 0?`${t}:${r}`:`${t}:${r}:mtime-${formatMtimeMsForCacheKey(n)}`}catch{return n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`}}async function resolveCompileMetadataMtimeMs(e){if(e.kind!==`disk`)return;let{stat:t}=await import(`node:fs/promises`),{compileMetadataPath:n}=resolveRuntimeCompilerArtifactPaths(e.appRoot);try{return(await t(n)).mtimeMs}catch{return}}function formatMtimeMsForCacheKey(e){return Math.floor(e).toString(36)}export{resolveRuntimeCompiledArtifactsVersionedCacheKey};
+import{getRuntimeCompiledArtifactsCacheKey}from"#runtime/compiled-artifacts-source.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{loadCompileMetadata}from"#runtime/loaders/compile-metadata.js";async function resolveRuntimeCompiledArtifactsVersionedCacheKey(e){let t=getRuntimeCompiledArtifactsCacheKey(e),n=await resolveCompileMetadataMtimeMs(e);try{let r=(await loadCompileMetadata({compiledArtifactsSource:e}))?.discovery.sourceGraphHash;return r===void 0||r.length===0?n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`:n===void 0?`${t}:${r}`:`${t}:${r}:mtime-${formatMtimeMsForCacheKey(n)}`}catch{return n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`}}async function resolveCompileMetadataMtimeMs(e){if(e.kind!==`disk`)return;let{stat:t}=await import(`node:fs/promises`),{compileMetadataPath:n}=resolveRuntimeCompilerArtifactPaths(e.appRoot);try{return(await t(n)).mtimeMs}catch{return}}function formatMtimeMsForCacheKey(e){return Math.floor(e).toString(36)}export{resolveRuntimeCompiledArtifactsVersionedCacheKey};

package/dist/src/runtime/compiled-artifacts-source.d.ts

@@ -8,6 +8,8 @@ export type RuntimeCompiledArtifactsSource = RuntimeBundledCompiledArtifactsSour
  */
 export interface RuntimeBundledCompiledArtifactsSource {
     readonly kind: "bundled";
+    /** Stable app partition embedded by a production build for local providers. */
+    readonly sandboxScope?: string;
 }
 /**
  * Disk-backed compiled artifacts rooted at one authored application.
@@ -23,6 +25,8 @@ export interface RuntimeDiskCompiledArtifactsSource {
      * emitted by the build.
      */
     readonly moduleMapLoaderPath?: string;
+    /** Stable app partition shared by production build preparation and runtime. */
+    readonly sandboxScope?: string;
     /**
      * Stable application root used for local sandbox template/session caches.
      * In development, `appRoot` can point at an immutable runtime snapshot
@@ -41,7 +45,7 @@ export interface RuntimeDiskCompiledArtifactsSource {
 /**
  * Creates the bundled compiled-artifact source.
  */
-export declare function createBundledRuntimeCompiledArtifactsSource(): RuntimeBundledCompiledArtifactsSource;
+export declare function createBundledRuntimeCompiledArtifactsSource(sandboxScope?: string): RuntimeBundledCompiledArtifactsSource;
 /**
  * Creates the disk-backed compiled-artifact source for one authored app root.
  */
@@ -49,6 +53,7 @@ export declare function createDiskRuntimeCompiledArtifactsSource(appRoot: string
     readonly durableReference?: "development-generation";
     readonly moduleMapLoaderPath?: string;
     readonly sandboxAppRoot?: string;
+    readonly sandboxScope?: string;
 }): RuntimeDiskCompiledArtifactsSource;
 /**
  * Returns the disk-backed app root when one exists for the artifact source.

package/dist/src/runtime/compiled-artifacts-source.js

@@ -1 +1 @@
-function createBundledRuntimeCompiledArtifactsSource(){return{kind:`bundled`}}function createDiskRuntimeCompiledArtifactsSource(e,t={}){return t.moduleMapLoaderPath!==void 0||t.sandboxAppRoot!==void 0||t.durableReference!==void 0?{appRoot:e,durableReference:t.durableReference,kind:`disk`,moduleMapLoaderPath:t.moduleMapLoaderPath,sandboxAppRoot:t.sandboxAppRoot}:{appRoot:e,kind:`disk`}}function getRuntimeCompiledArtifactsAppRoot(e){return e.kind===`disk`?e.appRoot:void 0}function getRuntimeCompiledArtifactsSandboxAppRoot(e){return e.kind===`disk`?e.sandboxAppRoot??e.appRoot:void 0}function getRuntimeCompiledArtifactsCacheKey(e){return e.kind===`disk`?e.moduleMapLoaderPath===void 0?`disk:${e.appRoot}`:`disk:${e.appRoot}:authored-source:${e.moduleMapLoaderPath}`:`bundled`}export{createBundledRuntimeCompiledArtifactsSource,createDiskRuntimeCompiledArtifactsSource,getRuntimeCompiledArtifactsAppRoot,getRuntimeCompiledArtifactsCacheKey,getRuntimeCompiledArtifactsSandboxAppRoot};
+function createBundledRuntimeCompiledArtifactsSource(e){return e===void 0?{kind:`bundled`}:{kind:`bundled`,sandboxScope:e}}function createDiskRuntimeCompiledArtifactsSource(e,t={}){return t.moduleMapLoaderPath!==void 0||t.sandboxAppRoot!==void 0||t.sandboxScope!==void 0||t.durableReference!==void 0?{appRoot:e,durableReference:t.durableReference,kind:`disk`,moduleMapLoaderPath:t.moduleMapLoaderPath,sandboxAppRoot:t.sandboxAppRoot,sandboxScope:t.sandboxScope}:{appRoot:e,kind:`disk`}}function getRuntimeCompiledArtifactsAppRoot(e){return e.kind===`disk`?e.appRoot:void 0}function getRuntimeCompiledArtifactsSandboxAppRoot(e){return e.kind===`disk`?e.sandboxAppRoot??e.appRoot:void 0}function getRuntimeCompiledArtifactsCacheKey(e){return e.kind===`disk`?e.moduleMapLoaderPath===void 0?`disk:${e.appRoot}`:`disk:${e.appRoot}:authored-source:${e.moduleMapLoaderPath}`:`bundled`}export{createBundledRuntimeCompiledArtifactsSource,createDiskRuntimeCompiledArtifactsSource,getRuntimeCompiledArtifactsAppRoot,getRuntimeCompiledArtifactsCacheKey,getRuntimeCompiledArtifactsSandboxAppRoot};

package/dist/src/runtime/loaders/artifact-paths.d.ts

@@ -10,6 +10,7 @@ export interface RuntimeCompilerArtifactPaths {
     readonly discoveryManifestPath: string;
     readonly discoveryDirectoryPath: string;
     readonly moduleMapPath: string;
+    readonly sandboxPreparedArtifactsPath: string;
 }
 /**
  * Resolves the stable eve artifact paths for one application root without

package/dist/src/runtime/loaders/artifact-paths.js

@@ -1 +1 @@
-function resolveRuntimeCompilerArtifactPaths(e){let t=normalizeFilesystemPath(e),n=`${t}/.eve/discovery`,r=`${t}/.eve/compile`;return{appRoot:t,compiledManifestPath:`${r}/compiled-agent-manifest.json`,compileDirectoryPath:r,compileMetadataPath:`${r}/compile-metadata.json`,diagnosticsPath:`${n}/diagnostics.json`,discoveryDirectoryPath:n,discoveryManifestPath:`${n}/agent-discovery-manifest.json`,moduleMapPath:`${r}/module-map.mjs`}}function normalizeFilesystemPath(e){let t=e.replaceAll(`\\`,`/`);return t===`/`?t:t.replace(/\/+$/,``)}export{resolveRuntimeCompilerArtifactPaths};
+function resolveRuntimeCompilerArtifactPaths(e){let t=normalizeFilesystemPath(e),n=`${t}/.eve/discovery`,r=`${t}/.eve/compile`;return{appRoot:t,compiledManifestPath:`${r}/compiled-agent-manifest.json`,compileDirectoryPath:r,compileMetadataPath:`${r}/compile-metadata.json`,diagnosticsPath:`${n}/diagnostics.json`,discoveryDirectoryPath:n,discoveryManifestPath:`${n}/agent-discovery-manifest.json`,moduleMapPath:`${r}/module-map.mjs`,sandboxPreparedArtifactsPath:`${r}/sandbox-prepared-artifacts.json`}}function normalizeFilesystemPath(e){let t=e.replaceAll(`\\`,`/`);return t===`/`?t:t.replace(/\/+$/,``)}export{resolveRuntimeCompilerArtifactPaths};

package/dist/src/runtime/loaders/bundled-artifacts.d.ts

@@ -1,6 +1,7 @@
 import type { CompileMetadata } from "#compiler/artifacts.js";
 import type { CompiledAgentManifest } from "#compiler/manifest.js";
 import type { CompiledModuleMap } from "#compiler/module-map.js";
+import type { SandboxPreparedArtifactsManifest } from "#shared/sandbox-prepared-artifacts.js";
 /**
  * Bundled compiled artifacts installed by Nitro when authored runtime state is
  * embedded directly into the server bundle.
@@ -9,6 +10,7 @@ export interface BundledCompiledArtifacts {
     manifest: CompiledAgentManifest;
     metadata?: CompileMetadata;
     moduleMap: CompiledModuleMap;
+    sandboxPreparedArtifacts?: SandboxPreparedArtifactsManifest;
 }
 /**
  * Input for running code against one isolated bundled compiled-artifact
@@ -33,4 +35,5 @@ export declare function withBundledCompiledArtifacts<T>(input: WithBundledCompil
  * Reads the bundled compiled-artifact snapshot for the active runtime
  * session, or `null` if none has been installed.
  */
+export declare function updateBundledSandboxPreparedArtifacts(sandboxPreparedArtifacts: SandboxPreparedArtifactsManifest): boolean;
 export declare function readBundledCompiledArtifacts(): BundledCompiledArtifacts | null;

package/dist/src/runtime/loaders/bundled-artifacts.js

@@ -1 +1 @@
-import{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession}from"#runtime/sessions/runtime-session.js";function installBundledCompiledArtifacts(e){setRuntimeSessionCompiledArtifacts(getActiveRuntimeSession(),{manifest:e.manifest,metadata:e.metadata,moduleMap:e.moduleMap})}async function withBundledCompiledArtifacts(e,t){let n=createRuntimeSession(e.sessionId??`bundled-compiled-artifacts`);return await withRuntimeSession(n,async()=>(installBundledCompiledArtifacts(e),await t()))}function readBundledCompiledArtifacts(){return getActiveRuntimeSession().compiledArtifacts}export{installBundledCompiledArtifacts,readBundledCompiledArtifacts,withBundledCompiledArtifacts};
+import{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession}from"#runtime/sessions/runtime-session.js";function installBundledCompiledArtifacts(e){setRuntimeSessionCompiledArtifacts(getActiveRuntimeSession(),{manifest:e.manifest,metadata:e.metadata,moduleMap:e.moduleMap,sandboxPreparedArtifacts:e.sandboxPreparedArtifacts})}async function withBundledCompiledArtifacts(e,t){let n=createRuntimeSession(e.sessionId??`bundled-compiled-artifacts`);return await withRuntimeSession(n,async()=>(installBundledCompiledArtifacts(e),await t()))}function updateBundledSandboxPreparedArtifacts(e){let t=getActiveRuntimeSession(),n=t.compiledArtifacts;return n!==null&&(setRuntimeSessionCompiledArtifacts(t,{...n,sandboxPreparedArtifacts:e}),!0)}function readBundledCompiledArtifacts(){return getActiveRuntimeSession().compiledArtifacts}export{installBundledCompiledArtifacts,readBundledCompiledArtifacts,updateBundledSandboxPreparedArtifacts,withBundledCompiledArtifacts};

package/dist/src/runtime/loaders/compile-metadata.js

@@ -1 +1 @@
-import{z}from"#compiled/zod/index.js";import{COMPILE_METADATA_KIND,COMPILE_METADATA_VERSION}from"#compiler/artifacts.js";import{formatValidationError}from"#runtime/validation.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";const compileArtifactDigestSchema=z.object({path:z.string(),sha256:z.string()}).strict(),compileMetadataSchema=z.object({compile:z.object({manifest:compileArtifactDigestSchema,moduleMap:compileArtifactDigestSchema}).strict(),discovery:z.object({diagnostics:compileArtifactDigestSchema,manifest:compileArtifactDigestSchema,sourceGraphHash:z.string(),summary:z.object({errors:z.number().finite(),warnings:z.number().finite()}).strict()}).strict(),generator:z.object({name:z.string(),version:z.string()}).strict(),kind:z.literal(COMPILE_METADATA_KIND),status:z.union([z.literal(`failed`),z.literal(`ready`)]),version:z.literal(COMPILE_METADATA_VERSION)}).strict();var LoadCompileMetadataError=class extends Error{metadataPath;constructor(e,t){super(e),this.name=`LoadCompileMetadataError`,t!==void 0&&(this.metadataPath=t)}};async function loadCompileMetadata(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compileMetadataPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompileMetadataError(formatLoadErrorMessage(e),t)}return parseCompileMetadata(n,t)}let n=readBundledCompiledArtifacts()?.metadata;return n===void 0?null:parseCompileMetadata(n,`bundled compile metadata`)}function parseCompileMetadata(e,t){let n=compileMetadataSchema.safeParse(e);if(!n.success)throw new LoadCompileMetadataError(`Expected "${t}" to contain valid eve compile metadata. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown compile metadata load failure.`}export{loadCompileMetadata};
+import{z}from"#compiled/zod/index.js";import{COMPILE_METADATA_KIND,COMPILE_METADATA_VERSION}from"#compiler/artifacts.js";import{formatValidationError}from"#runtime/validation.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";const compileArtifactDigestSchema=z.object({path:z.string(),sha256:z.string()}).strict(),compileMetadataSchema=z.object({compile:z.object({manifest:compileArtifactDigestSchema,moduleMap:compileArtifactDigestSchema}).strict(),discovery:z.object({diagnostics:compileArtifactDigestSchema,manifest:compileArtifactDigestSchema,sourceGraphHash:z.string(),summary:z.object({errors:z.number().finite(),warnings:z.number().finite()}).strict()}).strict(),generator:z.object({name:z.string(),version:z.string()}).strict(),kind:z.literal(COMPILE_METADATA_KIND),status:z.union([z.literal(`failed`),z.literal(`ready`)]),version:z.literal(COMPILE_METADATA_VERSION)}).strict();var LoadCompileMetadataError=class extends Error{metadataPath;constructor(e,t){super(e),this.name=`LoadCompileMetadataError`,t!==void 0&&(this.metadataPath=t)}};async function loadCompileMetadata(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compileMetadataPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompileMetadataError(formatLoadErrorMessage(e),t)}return parseCompileMetadata(n,t)}let n=readBundledCompiledArtifacts()?.metadata;return n===void 0?null:parseCompileMetadata(n,`bundled compile metadata`)}function parseCompileMetadata(e,t){let n=compileMetadataSchema.safeParse(e);if(!n.success)throw new LoadCompileMetadataError(`Expected "${t}" to contain valid eve compile metadata. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown compile metadata load failure.`}export{loadCompileMetadata};

package/dist/src/runtime/loaders/manifest.js

@@ -1 +1 @@
-import{compiledAgentManifestSchema}from"#compiler/manifest.js";import{formatValidationError}from"#runtime/validation.js";import{validateCompiledAgentManifest}from"#compiler/validate-artifact.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";const BUNDLED_MANIFEST_SOURCE=`bundled compiled manifest`;var LoadCompiledManifestError=class extends Error{manifestPath;constructor(e,t){super(e),this.name=`LoadCompiledManifestError`,t!==void 0&&(this.manifestPath=t)}};async function loadCompiledManifest(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compiledManifestPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompiledManifestError(formatLoadErrorMessage(e),t)}return parseCompiledManifest(n,t)}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledManifest(n.manifest,BUNDLED_MANIFEST_SOURCE);throw new LoadCompiledManifestError(`Compiled manifest is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MANIFEST_SOURCE)}function parseCompiledManifest(e,t){let n=compiledAgentManifestSchema.safeParse(e);if(!n.success)throw new LoadCompiledManifestError(`Expected "${t}" to contain a valid compiled eve agent manifest. ${formatValidationError(n.error)}`,t);try{validateCompiledAgentManifest(n.data)}catch(e){throw new LoadCompiledManifestError(`Expected "${t}" to contain a semantically valid compiled eve agent manifest. ${formatLoadErrorMessage(e)}`,t)}return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown manifest load failure.`}export{LoadCompiledManifestError,loadCompiledManifest};
+import{compiledAgentManifestSchema}from"#compiler/manifest.js";import{formatValidationError}from"#runtime/validation.js";import{validateCompiledAgentManifest}from"#compiler/validate-artifact.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";const BUNDLED_MANIFEST_SOURCE=`bundled compiled manifest`;var LoadCompiledManifestError=class extends Error{manifestPath;constructor(e,t){super(e),this.name=`LoadCompiledManifestError`,t!==void 0&&(this.manifestPath=t)}};async function loadCompiledManifest(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compiledManifestPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompiledManifestError(formatLoadErrorMessage(e),t)}return parseCompiledManifest(n,t)}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledManifest(n.manifest,BUNDLED_MANIFEST_SOURCE);throw new LoadCompiledManifestError(`Compiled manifest is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MANIFEST_SOURCE)}function parseCompiledManifest(e,t){let n=compiledAgentManifestSchema.safeParse(e);if(!n.success)throw new LoadCompiledManifestError(`Expected "${t}" to contain a valid compiled eve agent manifest. ${formatValidationError(n.error)}`,t);try{validateCompiledAgentManifest(n.data)}catch(e){throw new LoadCompiledManifestError(`Expected "${t}" to contain a semantically valid compiled eve agent manifest. ${formatLoadErrorMessage(e)}`,t)}return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown manifest load failure.`}export{LoadCompiledManifestError,loadCompiledManifest};

package/dist/src/runtime/loaders/module-map.js

@@ -1 +1 @@
-import{compiledModuleMapSchema}from"#compiler/module-map.js";import{formatValidationError}from"#runtime/validation.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";const BUNDLED_MODULE_MAP_SOURCE=`bundled compiled module map`;var LoadCompiledModuleMapError=class extends Error{moduleMapPath;constructor(e,t){super(e),this.name=`LoadCompiledModuleMapError`,t!==void 0&&(this.moduleMapPath=t)}};async function loadCompiledModuleMap(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).moduleMapPath:void 0;if(t!==void 0){let e=createFileImportSpecifier(t);try{let n=await import(e);return parseCompiledModuleMap(n.moduleMap??n.default,t)}catch(e){throw new LoadCompiledModuleMapError(formatLoadErrorMessage(e),t)}}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledModuleMap(n.moduleMap,BUNDLED_MODULE_MAP_SOURCE);throw new LoadCompiledModuleMapError(`Compiled module map is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MODULE_MAP_SOURCE)}function parseCompiledModuleMap(e,t){let n=compiledModuleMapSchema.safeParse(e);if(!n.success)throw new LoadCompiledModuleMapError(`Expected "${t}" to export a valid compiled eve module map. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown module-map load failure.`}function createFileImportSpecifier(e){let t=e.replaceAll(`\\`,`/`);return/^[A-Za-z]:\//.test(t)?`file:///${encodeURI(t)}`:t.startsWith(`/`)?`file://${encodeURI(t)}`:t}export{LoadCompiledModuleMapError,loadCompiledModuleMap};
+import{compiledModuleMapSchema}from"#compiler/module-map.js";import{formatValidationError}from"#runtime/validation.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";const BUNDLED_MODULE_MAP_SOURCE=`bundled compiled module map`;var LoadCompiledModuleMapError=class extends Error{moduleMapPath;constructor(e,t){super(e),this.name=`LoadCompiledModuleMapError`,t!==void 0&&(this.moduleMapPath=t)}};async function loadCompiledModuleMap(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).moduleMapPath:void 0;if(t!==void 0){let e=createFileImportSpecifier(t);try{let n=await import(e);return parseCompiledModuleMap(n.moduleMap??n.default,t)}catch(e){throw new LoadCompiledModuleMapError(formatLoadErrorMessage(e),t)}}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledModuleMap(n.moduleMap,BUNDLED_MODULE_MAP_SOURCE);throw new LoadCompiledModuleMapError(`Compiled module map is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MODULE_MAP_SOURCE)}function parseCompiledModuleMap(e,t){let n=compiledModuleMapSchema.safeParse(e);if(!n.success)throw new LoadCompiledModuleMapError(`Expected "${t}" to export a valid compiled eve module map. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown module-map load failure.`}function createFileImportSpecifier(e){let t=e.replaceAll(`\\`,`/`);return/^[A-Za-z]:\//.test(t)?`file:///${encodeURI(t)}`:t.startsWith(`/`)?`file://${encodeURI(t)}`:t}export{LoadCompiledModuleMapError,loadCompiledModuleMap};

package/dist/src/runtime/local-dev-capability.d.ts

@@ -1,12 +1,11 @@
 export declare const LOCAL_DEV_INTERACTIVE_CLIENT_HEADER = "x-eve-dev-interactive-client";
 /**
- * Capabilities available to authored code in an execution initiated by a
- * same-machine request to `eve dev`.
+ * Host facilities available to authored code running on an `eve dev` server.
  *
- * Absence is the signal, not a disabled flag: a deployed runtime has no
- * authored tree to mutate or watcher to pause, and a request from a remote
- * client is not authorized to mutate the server's authored tree.
- * {@link getLocalDevCapability} returns `undefined` in both cases.
+ * Absence means this host has no authored tree to mutate or watcher to pause.
+ * When present, the capability is available to every execution on that host;
+ * callers admitted to the development server are trusted with enabled local
+ * editing tools.
  */
 export interface LocalDevCapability {
     /**
@@ -15,8 +14,9 @@ export interface LocalDevCapability {
      */
     readonly appRoot: string;
     /**
-     * Whether the requesting client is the dev TUI and can therefore run a flow
-     * that asks questions in its terminal.
+     * Whether the originating client is the dev TUI and can run a flow that asks
+     * questions in its terminal. This inherited hint is not proof that the
+     * current sender has a live terminal.
      */
     readonly interactiveClient: boolean;
     /**
@@ -39,13 +39,15 @@ export declare function installLocalDevCapabilityEnvironment(input: {
     readonly serverUrl: string;
 }): () => void;
 /**
- * Seeds durable local-dev provenance only when the parent host signed a
- * loopback peer address. Public address headers cannot grant access.
+ * Seeds the inherited dev-TUI hint only when the dev host signed a loopback
+ * peer address. Client-supplied address headers cannot create that hint.
  */
 export declare function withLocalDevRequestScope<T>(request: Request, callback: () => Promise<T>): Promise<T>;
 /**
- * Resolves the local dev capability, or `undefined` outside an execution
- * initiated by an authorized local request to `eve dev`.
+ * Resolves local development host facilities, or `undefined` when this host
+ * lacks the authored root or watcher control origin installed by `eve dev`.
+ * Request provenance affects only the optional dev-TUI hint, never access to
+ * the authored tree.
  *
  * This is deliberately not a {@link import("#public/definitions/tool.js").ToolContext}
  * field: both values are meaningless in a deployed runtime, and a capability

package/dist/src/runtime/local-dev-capability.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{isLoopbackHostname}from"#shared/network-address.js";import{ContextContainer,contextStorage}from"#context/container.js";import{resumeDevelopmentRuntimeArtifacts,suspendDevelopmentRuntimeArtifacts}from"#services/dev-client/runtime-artifacts.js";import{DEVELOPMENT_WORKFLOW_SECRET_ENV}from"#internal/workflow/development-world-protocol.js";import{DEVELOPMENT_CLIENT_ADDRESS_SIGNATURE_HEADER,isTrustedDevelopmentClientAddress,readTrustedDevelopmentClientAddress}from"#internal/nitro/dev-client-address.js";const LOCAL_DEV_APP_ROOT_ENV=`EVE_DEV_APP_ROOT`,LOCAL_DEV_CONTROL_URL_ENV=`EVE_DEV_CONTROL_URL`,LOCAL_DEV_INTERACTIVE_CLIENT_HEADER=`x-eve-dev-interactive-client`;function installLocalDevCapabilityEnvironment(e){let t=process.env[LOCAL_DEV_APP_ROOT_ENV],n=process.env[LOCAL_DEV_CONTROL_URL_ENV];return process.env[LOCAL_DEV_APP_ROOT_ENV]=e.appRoot,process.env[LOCAL_DEV_CONTROL_URL_ENV]=new URL(e.serverUrl).origin,()=>{restore(LOCAL_DEV_APP_ROOT_ENV,t),restore(LOCAL_DEV_CONTROL_URL_ENV,n)}}async function withLocalDevRequestScope(e,t){let n=process.env[DEVELOPMENT_WORKFLOW_SECRET_ENV],r=readTrustedDevelopmentClientAddress(e.headers,n),i=e.headers.get(DEVELOPMENT_CLIENT_ADDRESS_SIGNATURE_HEADER);return r===void 0||i===null||!isLoopbackHostname(r)?await t():await contextStorage.run(new ContextContainer({localDevRequest:{address:r,interactiveClient:e.headers.get(LOCAL_DEV_INTERACTIVE_CLIENT_HEADER)===`1`,signature:i}}),t)}function getLocalDevCapability(e=process.env){let t=e[LOCAL_DEV_APP_ROOT_ENV],n=e[LOCAL_DEV_CONTROL_URL_ENV],r=contextStorage.getStore()?.localDevRequest;if(r!==void 0&&typeof r.address==`string`&&typeof r.signature==`string`&&typeof r.interactiveClient==`boolean`&&isLoopbackHostname(r.address)&&isTrustedDevelopmentClientAddress(r.address,r.signature,process.env[DEVELOPMENT_WORKFLOW_SECRET_ENV])&&t!==void 0&&t!==``&&n!==void 0&&n!==``)return{appRoot:t,interactiveClient:r.interactiveClient,async withSuspendedSource(e){let t=randomUUID();if(!await suspendDevelopmentRuntimeArtifacts({leaseId:t,serverUrl:n}))throw Error(`Could not pause the eve development server. Its authored-source watcher must be suspended before the authored tree is modified.`);let r;try{r={ok:!0,value:await e()}}catch(e){r={error:e,ok:!1}}if(await resumeDevelopmentRuntimeArtifacts({leaseId:t,serverUrl:n})===void 0&&await resumeDevelopmentRuntimeArtifacts({leaseId:t,serverUrl:n})===void 0)throw Error(`Could not resume the eve development server after modifying the authored tree. Restart eve dev before making further source changes.`,r.ok?void 0:{cause:r.error});if(!r.ok)throw r.error;return r.value}}}function restore(e,t){t===void 0?delete process.env[e]:process.env[e]=t}export{LOCAL_DEV_INTERACTIVE_CLIENT_HEADER,getLocalDevCapability,installLocalDevCapabilityEnvironment,withLocalDevRequestScope};
+import{randomUUID}from"node:crypto";import{isLoopbackHostname}from"#shared/network-address.js";import{ContextContainer,contextStorage}from"#context/container.js";import{resumeDevelopmentRuntimeArtifacts,suspendDevelopmentRuntimeArtifacts}from"#services/dev-client/runtime-artifacts.js";import{DEVELOPMENT_WORKFLOW_SECRET_ENV}from"#internal/workflow/development-world-protocol.js";import{DEVELOPMENT_CLIENT_ADDRESS_SIGNATURE_HEADER,isTrustedDevelopmentClientAddress,readTrustedDevelopmentClientAddress}from"#internal/nitro/dev-client-address.js";const LOCAL_DEV_APP_ROOT_ENV=`EVE_DEV_APP_ROOT`,LOCAL_DEV_CONTROL_URL_ENV=`EVE_DEV_CONTROL_URL`,LOCAL_DEV_INTERACTIVE_CLIENT_HEADER=`x-eve-dev-interactive-client`;function installLocalDevCapabilityEnvironment(e){let t=process.env[LOCAL_DEV_APP_ROOT_ENV],n=process.env[LOCAL_DEV_CONTROL_URL_ENV];return process.env[LOCAL_DEV_APP_ROOT_ENV]=e.appRoot,process.env[LOCAL_DEV_CONTROL_URL_ENV]=new URL(e.serverUrl).origin,()=>{restore(LOCAL_DEV_APP_ROOT_ENV,t),restore(LOCAL_DEV_CONTROL_URL_ENV,n)}}async function withLocalDevRequestScope(e,t){let n=process.env[DEVELOPMENT_WORKFLOW_SECRET_ENV],r=readTrustedDevelopmentClientAddress(e.headers,n),i=e.headers.get(DEVELOPMENT_CLIENT_ADDRESS_SIGNATURE_HEADER);return r===void 0||i===null||!isLoopbackHostname(r)?await contextStorage.run(new ContextContainer({localDevRequest:void 0}),t):await contextStorage.run(new ContextContainer({localDevRequest:{address:r,interactiveClient:e.headers.get(LOCAL_DEV_INTERACTIVE_CLIENT_HEADER)===`1`,signature:i}}),t)}function getLocalDevCapability(e=process.env){let t=e[LOCAL_DEV_APP_ROOT_ENV],n=e[LOCAL_DEV_CONTROL_URL_ENV];if(t===void 0||t===``||n===void 0||n===``)return;let r=contextStorage.getStore()?.localDevRequest;return{appRoot:t,interactiveClient:r!==void 0&&typeof r.address==`string`&&typeof r.signature==`string`&&typeof r.interactiveClient==`boolean`&&isLoopbackHostname(r.address)&&isTrustedDevelopmentClientAddress(r.address,r.signature,process.env[DEVELOPMENT_WORKFLOW_SECRET_ENV])?r.interactiveClient:!1,async withSuspendedSource(e){let t=randomUUID();if(!await suspendDevelopmentRuntimeArtifacts({leaseId:t,serverUrl:n}))throw Error(`Could not pause the eve development server. Its authored-source watcher must be suspended before the authored tree is modified.`);let r;try{r={ok:!0,value:await e()}}catch(e){r={error:e,ok:!1}}if(await resumeDevelopmentRuntimeArtifacts({leaseId:t,serverUrl:n})===void 0&&await resumeDevelopmentRuntimeArtifacts({leaseId:t,serverUrl:n})===void 0)throw Error(`Could not resume the eve development server after modifying the authored tree. Restart eve dev before making further source changes.`,r.ok?void 0:{cause:r.error});if(!r.ok)throw r.error;return r.value}}}function restore(e,t){t===void 0?delete process.env[e]:process.env[e]=t}export{LOCAL_DEV_INTERACTIVE_CLIENT_HEADER,getLocalDevCapability,installLocalDevCapabilityEnvironment,withLocalDevRequestScope};

package/dist/src/runtime/resolve-agent-graph.js

@@ -1 +1 @@
-import{expectObjectRecord}from"#internal/authored-module.js";import{stripLogicalPathExtension}from"#discover/filesystem.js";import{ROOT_COMPILED_AGENT_NODE_ID}from"#compiler/manifest.js";import{validateCompiledModuleMap}from"#compiler/validate-artifact.js";import{createRuntimeSubagentRegistry}from"#runtime/subagents/registry.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{createRuntimeToolRegistry}from"#runtime/tools/registry.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{createResolvedRuntimeTurnAgent}from"#runtime/agent/bootstrap.js";import{createWorkspacePromptSection}from"#runtime/workspace/spec.js";import{createRuntimeHookRegistry}from"#runtime/hooks/registry.js";import{resolveAgent}from"#runtime/resolve-agent.js";import{resolveDynamicSubagentDefinition}from"#runtime/resolve-dynamic-subagent.js";import{createRuntimeSandboxRegistry}from"#runtime/sandbox/registry.js";var ResolveRuntimeAgentGraphError=class extends Error{logicalPath;nodeId;sourceId;constructor(e,t={}){super(e),this.name=`ResolveRuntimeAgentGraphError`,t.logicalPath!==void 0&&(this.logicalPath=t.logicalPath),t.nodeId!==void 0&&(this.nodeId=t.nodeId),t.sourceId!==void 0&&(this.sourceId=t.sourceId)}};async function resolveRuntimeAgentGraph(e){validateCompiledModuleMap(e.manifest,e.moduleMap);let t=new Map,n=createChildNodeIdsByParentNodeId(e.manifest),r=new Map(e.manifest.subagents.map(e=>[e.nodeId,e])),i=await resolveRuntimeAgentNode({childNodeIdsByParentNodeId:n,manifest:e.manifest,moduleMap:e.moduleMap,nodeId:ROOT_COMPILED_AGENT_NODE_ID,nodesByNodeId:t,subagentNodesById:r});return attachInheritedSandboxWorkspaceResources({manifest:e.manifest,nodesByNodeId:t}),{nodesByNodeId:t,root:i}}async function resolveRuntimeAgentNode(e){let t=toRuntimeNodeId(e.nodeId);if(e.nodesByNodeId.has(t))throw new ResolveRuntimeAgentGraphError(`Found multiple runtime agent nodes for node id "${t}".`,{nodeId:t,sourceId:e.sourceId});let n=await resolveAgent({manifest:e.manifest,moduleMap:e.moduleMap,nodeId:e.nodeId}),r=await createRuntimeToolRegistry({tools:n.tools},{nodeId:t}),i=createRuntimeSandboxRegistry({sandbox:n.sandbox,workspaceResourceRoot:n.workspaceResourceRoot}),a=createRuntimeSubagentRegistry({disabledToolNames:e.manifest.sourceComposition.entries.flatMap(e=>e.kind!==`disabled`||!e.source.logicalPath.startsWith(`tools/`)?[]:[stripLogicalPathExtension(e.source.logicalPath).replace(/^tools\//,``).replaceAll(`/`,`-`)]),reservedToolNames:[LOAD_SKILL_TOOL_NAME,...r.preparedTools.map(e=>e.name)],subagents:await resolveRuntimeSubagents({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.manifest,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,parentNodeId:e.nodeId,subagentNodesById:e.subagentNodesById})}),o={agent:n,channels:n.channels,hookRegistry:createRuntimeHookRegistry(n.hooks),nodeId:t,sandboxRegistry:i,sourceId:e.sourceId,subagentRegistry:a,toolRegistry:r,turnAgent:createResolvedRuntimeTurnAgent({agent:n,dynamicSubagentsAvailable:a.dynamicResolvers.length>0,id:e.agentId,nodeId:t,tools:[...r.preparedTools,...a.preparedTools]})};return e.nodesByNodeId.set(t,o),o}async function resolveRuntimeSubagents(e){let t=[],n=e.childNodeIdsByParentNodeId.get(e.parentNodeId)??[];for(let r of n){let n=e.subagentNodesById.get(r);if(n===void 0)throw new ResolveRuntimeAgentGraphError(`Missing compiled subagent node "${r}" while resolving runtime subagents.`,{nodeId:toRuntimeNodeId(e.parentNodeId),sourceId:r});t.push(await resolveRuntimeSubagent({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,sourceRef:n,subagentNodesById:e.subagentNodesById}))}for(let n of e.manifest.remoteAgents)t.push(await resolveRuntimeRemoteAgent({moduleMap:e.moduleMap,nodeScopeId:e.parentNodeId,sourceRef:n}));return t}async function resolveRuntimeSubagent(e){let t={...e.sourceRef.configResolver===void 0?{description:e.sourceRef.description,tool:e.sourceRef.agent.config.tool}:{dynamic:await resolveDynamicSubagentDefinition({definition:e.sourceRef.configResolver,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId})},kind:`subagent`,logicalPath:e.sourceRef.logicalPath,name:e.sourceRef.name,nodeId:toRuntimeNodeId(e.sourceRef.nodeId),sourceId:e.sourceRef.sourceId,sourceKind:`module`};return await resolveRuntimeAgentNode({agentId:e.sourceRef.name,childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.sourceRef.agent,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId,nodesByNodeId:e.nodesByNodeId,sourceId:e.sourceRef.sourceId,subagentNodesById:e.subagentNodesById}),t}async function resolveRuntimeRemoteAgent(e){let t=await loadResolvedModuleExport({definition:e.sourceRef,kindLabel:`remote agent`,moduleMap:e.moduleMap,nodeId:e.nodeScopeId}),n=expectObjectRecord(t,`Expected remote agent source "${e.sourceRef.logicalPath}" to export an object.`),r={description:e.sourceRef.description,kind:`remote`,logicalPath:e.sourceRef.logicalPath,name:e.sourceRef.name,nodeId:toRuntimeNodeId(e.sourceRef.nodeId),outputSchema:e.sourceRef.outputSchema,path:e.sourceRef.path,sourceId:e.sourceRef.sourceId,sourceKind:`module`,tool:e.sourceRef.tool,url:await resolveRemoteAgentUrl({bakedUrl:e.sourceRef.url,logicalPath:e.sourceRef.logicalPath,resolvedUrl:n.url})};typeof n.auth==`function`&&(r.auth=n.auth),n.forwardPrincipal===!0&&(r.forwardPrincipal=!0);let i=resolveRemoteAgentHeaders(n.headers);return i!==void 0&&(r.headers=i),r}async function resolveRemoteAgentUrl(e){if(typeof e.resolvedUrl==`function`){let t=await e.resolvedUrl();if(typeof t!=`string`||t.length===0)throw Error(`Remote agent "${e.logicalPath}" url function must return a non-empty string.`);return t}let t=e.bakedUrl??(typeof e.resolvedUrl==`string`?e.resolvedUrl:``);if(t.length===0)throw Error(`Remote agent "${e.logicalPath}" is missing a url.`);return t}function resolveRemoteAgentHeaders(e){if(e===void 0)return;if(typeof e==`function`)return e;if(typeof e!=`object`||!e||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return t}function attachInheritedSandboxWorkspaceResources(e){let t=new Map(e.manifest.subagents.map(e=>[e.nodeId,e.parentNodeId]));for(let[n,r]of e.nodesByNodeId){if(r.sandboxRegistry.sandbox.definition.inheritsParent!==!0)continue;if(r.agent.dynamicSkillResolvers.length>0)throw new ResolveRuntimeAgentGraphError(`Sandbox "${r.sandboxRegistry.sandbox.definition.logicalPath}" selects parent.sandbox but agent node "${n}" defines dynamic skills. Remove the child dynamic skills or give the child its own sandbox.`,{nodeId:n});let i=t.get(n);if(i===void 0)throw new ResolveRuntimeAgentGraphError(`Sandbox "${r.sandboxRegistry.sandbox.definition.logicalPath}" selects parent.sandbox but agent node "${n}" has no parent.`,{nodeId:n});let a=resolveSandboxOwnerNode({nodeId:i,nodesByNodeId:e.nodesByNodeId,parentNodeIdByChildNodeId:t});r.sandboxRegistry.sandbox.inheritance={definition:a.sandboxRegistry.sandbox.definition,nodeId:a.nodeId,workspaceResourceRoot:a.sandboxRegistry.sandbox.workspaceResourceRoot};let o=createWorkspacePromptSection(a.agent.workspaceSpec);o!==void 0&&(r.turnAgent.instructions=[...r.turnAgent.instructions,o])}}function resolveSandboxOwnerNode(e){let t=e.nodesByNodeId.get(toRuntimeNodeId(e.nodeId));if(t===void 0)throw new ResolveRuntimeAgentGraphError(`Missing parent runtime node "${e.nodeId}".`,{nodeId:e.nodeId});if(t.sandboxRegistry.sandbox.definition.inheritsParent!==!0)return t;let n=e.parentNodeIdByChildNodeId.get(e.nodeId);if(n===void 0)throw new ResolveRuntimeAgentGraphError(`Inherited sandbox node "${e.nodeId}" has no parent.`,{nodeId:e.nodeId});return resolveSandboxOwnerNode({...e,nodeId:n})}function createChildNodeIdsByParentNodeId(e){let t=new Map;for(let n of e.subagents){let e=t.get(n.parentNodeId);if(e===void 0){t.set(n.parentNodeId,[n.nodeId]);continue}e.push(n.nodeId)}return t}function toRuntimeNodeId(e){return e===ROOT_COMPILED_AGENT_NODE_ID?ROOT_RUNTIME_AGENT_NODE_ID:e}export{resolveRuntimeAgentGraph};
+import{expectObjectRecord}from"#internal/authored-module.js";import{stripLogicalPathExtension}from"#discover/filesystem.js";import{ROOT_COMPILED_AGENT_NODE_ID}from"#compiler/manifest.js";import{validateCompiledModuleMap}from"#compiler/validate-artifact.js";import{createRuntimeSubagentRegistry}from"#runtime/subagents/registry.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{createRuntimeToolRegistry}from"#runtime/tools/registry.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{createResolvedRuntimeTurnAgent}from"#runtime/agent/bootstrap.js";import{createWorkspacePromptSection}from"#runtime/workspace/spec.js";import{createRuntimeHookRegistry}from"#runtime/hooks/registry.js";import{resolveAgent}from"#runtime/resolve-agent.js";import{resolveDynamicSubagentDefinition}from"#runtime/resolve-dynamic-subagent.js";import{createRuntimeSandboxRegistry}from"#runtime/sandbox/registry.js";var ResolveRuntimeAgentGraphError=class extends Error{logicalPath;nodeId;sourceId;constructor(e,t={}){super(e),this.name=`ResolveRuntimeAgentGraphError`,t.logicalPath!==void 0&&(this.logicalPath=t.logicalPath),t.nodeId!==void 0&&(this.nodeId=t.nodeId),t.sourceId!==void 0&&(this.sourceId=t.sourceId)}};async function resolveRuntimeAgentGraph(e){validateCompiledModuleMap(e.manifest,e.moduleMap);let t=new Map,n=createChildNodeIdsByParentNodeId(e.manifest),r=new Map(e.manifest.subagents.map(e=>[e.nodeId,e])),i=await resolveRuntimeAgentNode({childNodeIdsByParentNodeId:n,manifest:e.manifest,moduleMap:e.moduleMap,nodeId:ROOT_COMPILED_AGENT_NODE_ID,nodesByNodeId:t,subagentNodesById:r});return attachInheritedSandboxWorkspaceResources({manifest:e.manifest,nodesByNodeId:t}),{nodesByNodeId:t,root:i}}async function resolveRuntimeAgentNode(e){let t=toRuntimeNodeId(e.nodeId);if(e.nodesByNodeId.has(t))throw new ResolveRuntimeAgentGraphError(`Found multiple runtime agent nodes for node id "${t}".`,{nodeId:t,sourceId:e.sourceId});let n=await resolveAgent({manifest:e.manifest,moduleMap:e.moduleMap,nodeId:e.nodeId}),r=await createRuntimeToolRegistry({tools:n.tools},{nodeId:t}),i=createRuntimeSandboxRegistry({sandbox:n.sandbox,workspaceResourceRoot:n.workspaceResourceRoot}),a=createRuntimeSubagentRegistry({disabledToolNames:e.manifest.sourceComposition.entries.flatMap(e=>e.kind!==`disabled`||!e.source.logicalPath.startsWith(`tools/`)?[]:[stripLogicalPathExtension(e.source.logicalPath).replace(/^tools\//,``).replaceAll(`/`,`-`)]),reservedToolNames:[LOAD_SKILL_TOOL_NAME,...r.preparedTools.map(e=>e.name)],subagents:await resolveRuntimeSubagents({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.manifest,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,parentNodeId:e.nodeId,subagentNodesById:e.subagentNodesById})}),o={agent:n,channels:n.channels,hookRegistry:createRuntimeHookRegistry(n.hooks),nodeId:t,sandboxRegistry:i,sourceId:e.sourceId,subagentRegistry:a,toolRegistry:r,turnAgent:createResolvedRuntimeTurnAgent({agent:n,dynamicSubagentsAvailable:a.dynamicResolvers.length>0,id:e.agentId,nodeId:t,tools:[...r.preparedTools,...a.preparedTools]})};return e.nodesByNodeId.set(t,o),o}async function resolveRuntimeSubagents(e){let t=[],n=e.childNodeIdsByParentNodeId.get(e.parentNodeId)??[];for(let r of n){let n=e.subagentNodesById.get(r);if(n===void 0)throw new ResolveRuntimeAgentGraphError(`Missing compiled subagent node "${r}" while resolving runtime subagents.`,{nodeId:toRuntimeNodeId(e.parentNodeId),sourceId:r});t.push(await resolveRuntimeSubagent({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,sourceRef:n,subagentNodesById:e.subagentNodesById}))}for(let n of e.manifest.remoteAgents)t.push(await resolveRuntimeRemoteAgent({moduleMap:e.moduleMap,nodeScopeId:e.parentNodeId,sourceRef:n}));return t}async function resolveRuntimeSubagent(e){let t={...e.sourceRef.configResolver===void 0?{description:e.sourceRef.description,tool:e.sourceRef.agent.config.tool}:{dynamic:await resolveDynamicSubagentDefinition({definition:e.sourceRef.configResolver,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId})},kind:`subagent`,logicalPath:e.sourceRef.logicalPath,name:e.sourceRef.name,nodeId:toRuntimeNodeId(e.sourceRef.nodeId),sourceId:e.sourceRef.sourceId,sourceKind:`module`};return await resolveRuntimeAgentNode({agentId:e.sourceRef.name,childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.sourceRef.agent,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId,nodesByNodeId:e.nodesByNodeId,sourceId:e.sourceRef.sourceId,subagentNodesById:e.subagentNodesById}),t}async function resolveRuntimeRemoteAgent(e){let t=await loadResolvedModuleExport({definition:e.sourceRef,kindLabel:`remote agent`,moduleMap:e.moduleMap,nodeId:e.nodeScopeId}),n=expectObjectRecord(t,`Expected remote agent source "${e.sourceRef.logicalPath}" to export an object.`),r={description:e.sourceRef.description,kind:`remote`,logicalPath:e.sourceRef.logicalPath,name:e.sourceRef.name,nodeId:toRuntimeNodeId(e.sourceRef.nodeId),outputSchema:e.sourceRef.outputSchema,path:e.sourceRef.path,sourceId:e.sourceRef.sourceId,sourceKind:`module`,tool:e.sourceRef.tool,url:await resolveRemoteAgentUrl({bakedUrl:e.sourceRef.url,logicalPath:e.sourceRef.logicalPath,resolvedUrl:n.url})};typeof n.auth==`function`&&(r.auth=n.auth),n.forwardPrincipal===!0&&(r.forwardPrincipal=!0);let i=resolveRemoteAgentHeaders(n.headers);return i!==void 0&&(r.headers=i),r}async function resolveRemoteAgentUrl(e){if(typeof e.resolvedUrl==`function`){let t=await e.resolvedUrl();if(typeof t!=`string`||t.length===0)throw Error(`Remote agent "${e.logicalPath}" url function must return a non-empty string.`);return t}let t=e.bakedUrl??(typeof e.resolvedUrl==`string`?e.resolvedUrl:``);if(t.length===0)throw Error(`Remote agent "${e.logicalPath}" is missing a url.`);return t}function resolveRemoteAgentHeaders(e){if(e===void 0)return;if(typeof e==`function`)return e;if(typeof e!=`object`||!e||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return t}function attachInheritedSandboxWorkspaceResources(e){let t=new Map(e.manifest.subagents.map(e=>[e.nodeId,e.parentNodeId]));for(let[n,r]of e.nodesByNodeId){if(r.sandboxRegistry.sandbox.definition.kind!==`parent`)continue;if(r.agent.dynamicSkillResolvers.length>0)throw new ResolveRuntimeAgentGraphError(`Sandbox "${r.sandboxRegistry.sandbox.definition.logicalPath}" selects parent.sandbox but agent node "${n}" defines dynamic skills. Remove the child dynamic skills or give the child its own sandbox.`,{nodeId:n});let i=t.get(n);if(i===void 0)throw new ResolveRuntimeAgentGraphError(`Sandbox "${r.sandboxRegistry.sandbox.definition.logicalPath}" selects parent.sandbox but agent node "${n}" has no parent.`,{nodeId:n});let a=resolveSandboxOwnerNode({nodeId:i,nodesByNodeId:e.nodesByNodeId,parentNodeIdByChildNodeId:t});r.sandboxRegistry.sandbox.inheritance={definition:a.sandboxRegistry.sandbox.definition,nodeId:a.nodeId,workspaceResourceRoot:a.sandboxRegistry.sandbox.workspaceResourceRoot};let o=createWorkspacePromptSection(a.agent.workspaceSpec);o!==void 0&&(r.turnAgent.instructions=[...r.turnAgent.instructions,o])}}function resolveSandboxOwnerNode(e){let t=e.nodesByNodeId.get(toRuntimeNodeId(e.nodeId));if(t===void 0)throw new ResolveRuntimeAgentGraphError(`Missing parent runtime node "${e.nodeId}".`,{nodeId:e.nodeId});if(t.sandboxRegistry.sandbox.definition.kind!==`parent`)return t;let n=e.parentNodeIdByChildNodeId.get(e.nodeId);if(n===void 0)throw new ResolveRuntimeAgentGraphError(`Inherited sandbox node "${e.nodeId}" has no parent.`,{nodeId:e.nodeId});return resolveSandboxOwnerNode({...e,nodeId:n})}function createChildNodeIdsByParentNodeId(e){let t=new Map;for(let n of e.subagents){let e=t.get(n.parentNodeId);if(e===void 0){t.set(n.parentNodeId,[n.nodeId]);continue}e.push(n.nodeId)}return t}function toRuntimeNodeId(e){return e===ROOT_COMPILED_AGENT_NODE_ID?ROOT_RUNTIME_AGENT_NODE_ID:e}export{resolveRuntimeAgentGraph};

package/dist/src/runtime/resolve-sandbox.d.ts

@@ -1,13 +1,4 @@
-import type { CompiledSandboxDefinition } from "#compiler/manifest.js";
+import { type CompiledSandboxDefinition } from "#compiler/manifest.js";
 import type { CompiledModuleMap } from "#compiler/module-map.js";
 import type { ResolvedSandboxDefinition } from "#runtime/types.js";
-/**
- * Resolves one compiled sandbox entry into a runtime-owned definition
- * with live `backend`, `bootstrap`, and `onSession` lifecycle handlers
- * (when present) attached from the authored module.
- *
- * If the authored module omits `backend`, the resolver substitutes
- * {@link defaultSandbox} so the rest of the runtime can rely on a
- * non-null backend value.
- */
 export declare function resolveSandboxDefinition(definition: CompiledSandboxDefinition, moduleMap: CompiledModuleMap, nodeId: string | undefined): Promise<ResolvedSandboxDefinition>;

package/dist/src/runtime/resolve-sandbox.js

@@ -1 +1 @@
-import{expectObjectRecord}from"#internal/authored-module.js";import{toErrorMessage}from"#shared/errors.js";import{lazyBackend}from"#execution/sandbox/lazy-backend.js";import{ResolveAgentError,loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{defaultSandbox}from"#public/sandbox/backends/default.js";async function resolveSandboxDefinition(e,t,n){try{let r=e.inheritsParent?void 0:await loadResolvedModuleExport({definition:e,kindLabel:`sandbox`,moduleMap:t,nodeId:n}),i=e.inheritsParent?{}:expectObjectRecord(r,`Expected the sandbox export "${e.exportName??`default`}" from "${e.logicalPath}" to return an object.`);return{backend:resolveBackend(i.backend,e.logicalPath),bootstrap:i.bootstrap,description:e.description,inheritsParent:e.inheritsParent,exportName:e.exportName,logicalPath:e.logicalPath,onSession:i.onSession,revalidationKey:e.revalidationKey,sourceHash:e.sourceHash,sourceId:e.sourceId,sourceKind:`module`}}catch(t){throw t instanceof ResolveAgentError?t:new ResolveAgentError(`Failed to attach the sandbox lifecycle handlers from "${e.logicalPath}": ${toErrorMessage(t)}`,{logicalPath:e.logicalPath,sourceId:e.sourceId})}}function resolveBackend(e,t){if(e===void 0)return defaultSandbox();if(typeof e==`function`)return lazyBackend(e);if(typeof e!=`object`||!e)throw new ResolveAgentError(`Sandbox "${t}" exposed a non-object "backend" field. Use docker(), vercel(), another factory that returns a SandboxBackend value, or a zero-arg callback returning one.`,{logicalPath:t});let n=e;if(typeof n.name!=`string`||n.name.length===0)throw new ResolveAgentError(`Sandbox "${t}" backend is missing a non-empty string "name" identifier.`,{logicalPath:t});if(typeof n.create!=`function`)throw new ResolveAgentError(`Sandbox "${t}" backend is missing a "create" function.`,{logicalPath:t});return n}export{resolveSandboxDefinition};
+import{expectObjectRecord,getAuthoredModuleExport}from"#internal/authored-module.js";import{ROOT_COMPILED_AGENT_NODE_ID}from"#compiler/manifest.js";import{getBoundSandboxEnvironment,isSandboxEnvironment}from"#shared/sandbox-environment.js";import{defineParentSandbox}from"#public/definitions/sandbox.js";import{ResolveAgentError}from"#runtime/resolve-helpers.js";async function resolveSandboxDefinition(e,t,n){if(e.inheritsParent===!0)return{exportName:e.exportName,kind:`parent`,logicalPath:e.logicalPath,revisionHash:e.revisionHash,selector:defineParentSandbox(),sourceId:e.sourceId,sourceKind:`module`};let r=t.nodes[n??ROOT_COMPILED_AGENT_NODE_ID]?.modules[e.sourceId],i=expectObjectRecord(r,`Missing sandbox module "${e.logicalPath}".`),a=getAuthoredModuleExport(i,e);if(typeof a!=`function`)throw new ResolveAgentError(`Sandbox "${e.logicalPath}" does not export a selector.`);let o=e.environmentExportName?i[e.environmentExportName]:getBoundSandboxEnvironment(a),s={exportName:e.exportName,logicalPath:e.logicalPath,revisionHash:e.revisionHash,selector:a,sourceId:e.sourceId,sourceKind:`module`};if(!isSandboxEnvironment(o))throw new ResolveAgentError(`Sandbox "${e.logicalPath}" has no environment.`);return{...s,environment:o,kind:`independent`}}export{resolveSandboxDefinition};

package/dist/src/runtime/sandbox/prepared-artifacts.d.ts

@@ -0,0 +1,13 @@
+import type { RuntimeCompiledArtifactsSource } from "#runtime/compiled-artifacts-source.js";
+import { type SandboxPreparedArtifactEntry, type SandboxPreparedArtifactsManifest } from "#shared/sandbox-prepared-artifacts.js";
+import type { SandboxPreparedArtifact } from "#shared/sandbox-provider.js";
+export declare function writeSandboxPreparedArtifactsManifest(input: {
+    readonly compileDirectoryPath: string;
+    readonly entries: readonly SandboxPreparedArtifactEntry[];
+}): Promise<void>;
+export declare function loadSandboxPreparedArtifact(input: {
+    readonly compiledArtifactsSource: RuntimeCompiledArtifactsSource;
+    readonly nodeId: string;
+    readonly providerName: string;
+}): Promise<SandboxPreparedArtifact | undefined>;
+export declare function loadSandboxPreparedArtifactsManifest(source: RuntimeCompiledArtifactsSource): Promise<SandboxPreparedArtifactsManifest | null>;

package/dist/src/runtime/sandbox/prepared-artifacts.js

@@ -0,0 +1 @@
+import{readFile,writeFile}from"node:fs/promises";import{createSandboxPreparedArtifactsManifest,sandboxPreparedArtifactsManifestSchema}from"#shared/sandbox-prepared-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";async function writeSandboxPreparedArtifactsManifest(e){if(e.entries.length===0)return;let t=`${e.compileDirectoryPath}/sandbox-prepared-artifacts.json`,n=null;try{n=sandboxPreparedArtifactsManifestSchema.parse(JSON.parse(await readFile(t,`utf8`)))}catch(e){if(!(e instanceof Error&&`code`in e&&e.code===`ENOENT`))throw e}let r=new Map(n?.entries.map(e=>[e.nodeId,e]));for(let t of e.entries)r.set(t.nodeId,t);await writeFile(t,`${JSON.stringify(createSandboxPreparedArtifactsManifest([...r.values()]),null,2)}\n`)}async function loadSandboxPreparedArtifact(e){let t=(await loadSandboxPreparedArtifactsManifest(e.compiledArtifactsSource))?.entries.find(t=>t.nodeId===e.nodeId);if(t!==void 0&&t.providerName!==e.providerName)throw Error(`Prepared sandbox artifact for node "${e.nodeId}" belongs to provider "${t.providerName}", not "${e.providerName}".`);return t?.artifact}async function loadSandboxPreparedArtifactsManifest(e){if(e.kind===`bundled`)return readBundledCompiledArtifacts()?.sandboxPreparedArtifacts??null;let t=resolveRuntimeCompilerArtifactPaths(e.appRoot).sandboxPreparedArtifactsPath;try{return sandboxPreparedArtifactsManifestSchema.parse(JSON.parse(await readFile(t,`utf8`)))}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}export{loadSandboxPreparedArtifact,loadSandboxPreparedArtifactsManifest,writeSandboxPreparedArtifactsManifest};

package/dist/src/runtime/sandbox/registry.d.ts

@@ -1,12 +1,5 @@
 import type { CompiledWorkspaceResourceRoot } from "#compiler/manifest.js";
 import type { ResolvedSandboxDefinition } from "#runtime/types.js";
-/**
- * Stable internal source id for the framework-owned default sandbox.
- *
- * Used by the runtime template/session key derivation and by prewarm
- * to distinguish the shared framework sandbox from per-node authored
- * overrides.
- */
 /**
  * Resolved sandbox tracked by the runtime-owned registry.
  *
@@ -17,8 +10,8 @@ import type { ResolvedSandboxDefinition } from "#runtime/types.js";
  * compiled workspace resource tree owned by this graph node. The
  * prewarm orchestrator resolves the descriptor's logical path against
  * the active compiled artifacts source and writes the contents into
- * the sandbox template snapshot. Runtime `backend.create(...)` never
- * reads these files.
+ * the sandbox template artifact. Runtime provider `open(...)` never reads these
+ * files.
  */
 export interface RuntimeRegisteredSandbox {
     readonly definition: ResolvedSandboxDefinition;

package/dist/src/runtime/sandbox/registry.js

@@ -1 +1 @@
-function createRuntimeSandboxRegistry(e){let t=e.sandbox;if(t.inheritsParent===!0&&(e.workspaceResourceRoot.contentHash!==void 0||e.workspaceResourceRoot.rootEntries.length>0))throw Error(`Sandbox "${t.logicalPath}" selects parent.sandbox but has managed workspace resources. Remove the child workspace or give the child its own sandbox.`);return{sandbox:{definition:t,workspaceResourceRoot:e.workspaceResourceRoot}}}export{createRuntimeSandboxRegistry};
+function createRuntimeSandboxRegistry(e){let t=e.sandbox;if(t.kind===`parent`&&(e.workspaceResourceRoot.contentHash!==void 0||e.workspaceResourceRoot.rootEntries.length>0))throw Error(`Sandbox "${t.logicalPath}" selects parent.sandbox but has managed workspace resources. Remove the child workspace or give the child its own sandbox.`);return{sandbox:{definition:t,workspaceResourceRoot:e.workspaceResourceRoot}}}export{createRuntimeSandboxRegistry};

package/dist/src/runtime/sessions/runtime-session.js

@@ -1 +1 @@
-import{AsyncLocalStorage}from"node:async_hooks";function createRuntimeSession(e=`test-session`){return{bundleCache:new Map,bundleCacheKeyBySourceKey:new Map,compiledArtifacts:null,id:e}}function setRuntimeSessionCompiledArtifacts(e,t){let n=e.compiledArtifacts;(n===null||!isSameCompiledArtifactSnapshot(n,t))&&(e.bundleCache.clear(),e.bundleCacheKeyBySourceKey.clear()),e.compiledArtifacts=t}function isSameCompiledArtifactSnapshot(e,t){let n=e.metadata?.discovery.sourceGraphHash,r=t.metadata?.discovery.sourceGraphHash;return n&&r?n===r:e.manifest===t.manifest&&e.moduleMap===t.moduleMap&&e.metadata===t.metadata}const RUNTIME_SESSION_STORAGE_GLOBAL_KEY=Symbol.for(`eve.runtime-session-storage`),RUNTIME_SESSION_DEFAULT_GLOBAL_KEY=Symbol.for(`eve.runtime-session-default`),globalContainer=globalThis;globalContainer[RUNTIME_SESSION_STORAGE_GLOBAL_KEY]===void 0&&(globalContainer[RUNTIME_SESSION_STORAGE_GLOBAL_KEY]=new AsyncLocalStorage);const runtimeSessionStorage=globalContainer[RUNTIME_SESSION_STORAGE_GLOBAL_KEY];function resolveProcessDefaultSession(){return globalContainer[RUNTIME_SESSION_DEFAULT_GLOBAL_KEY]===void 0&&(globalContainer[RUNTIME_SESSION_DEFAULT_GLOBAL_KEY]=createRuntimeSession(`process-default`)),globalContainer[RUNTIME_SESSION_DEFAULT_GLOBAL_KEY]}function getActiveRuntimeSession(){return runtimeSessionStorage.getStore()??resolveProcessDefaultSession()}async function withRuntimeSession(e,t){return await runtimeSessionStorage.run(e,async()=>await t())}export{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession};
+import{AsyncLocalStorage}from"node:async_hooks";function createRuntimeSession(e=`test-session`){return{bundleCache:new Map,bundleCacheKeyBySourceKey:new Map,compiledArtifacts:null,id:e}}function setRuntimeSessionCompiledArtifacts(e,t){let n=e.compiledArtifacts;(n===null||!isSameCompiledArtifactSnapshot(n,t))&&(e.bundleCache.clear(),e.bundleCacheKeyBySourceKey.clear()),e.compiledArtifacts=t}function isSameCompiledArtifactSnapshot(e,t){let n=e.metadata?.discovery.sourceGraphHash,r=t.metadata?.discovery.sourceGraphHash;return n&&r?n===r&&JSON.stringify(e.sandboxPreparedArtifacts)===JSON.stringify(t.sandboxPreparedArtifacts):e.manifest===t.manifest&&e.moduleMap===t.moduleMap&&e.metadata===t.metadata}const RUNTIME_SESSION_STORAGE_GLOBAL_KEY=Symbol.for(`eve.runtime-session-storage`),RUNTIME_SESSION_DEFAULT_GLOBAL_KEY=Symbol.for(`eve.runtime-session-default`),globalContainer=globalThis;globalContainer[RUNTIME_SESSION_STORAGE_GLOBAL_KEY]===void 0&&(globalContainer[RUNTIME_SESSION_STORAGE_GLOBAL_KEY]=new AsyncLocalStorage);const runtimeSessionStorage=globalContainer[RUNTIME_SESSION_STORAGE_GLOBAL_KEY];function resolveProcessDefaultSession(){return globalContainer[RUNTIME_SESSION_DEFAULT_GLOBAL_KEY]===void 0&&(globalContainer[RUNTIME_SESSION_DEFAULT_GLOBAL_KEY]=createRuntimeSession(`process-default`)),globalContainer[RUNTIME_SESSION_DEFAULT_GLOBAL_KEY]}function getActiveRuntimeSession(){return runtimeSessionStorage.getStore()??resolveProcessDefaultSession()}async function withRuntimeSession(e,t){return await runtimeSessionStorage.run(e,async()=>await t())}export{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession};

package/dist/src/runtime/types.d.ts

@@ -24,8 +24,7 @@ import type { InternalAgentDefinition } from "#shared/agent-definition.js";
 import type { RuntimeDynamicModelReference } from "#runtime/agent/bootstrap.js";
 import type { InternalToolDefinitionWithExecuteFn } from "#tools/definition.js";
 import type { CompiledToolBehavior } from "#tools/behavior.js";
-import type { SandboxBackend } from "#shared/sandbox-backend.js";
-import type { SandboxBootstrapContext, SandboxSessionContext } from "#shared/sandbox-definition.js";
+import type { SandboxEnvironmentIdentity, SandboxSelector } from "#shared/sandbox-environment.js";
 import type { ToolSchema } from "#tools/schema.js";
 import type { AgentSourceOwner } from "#compiler/source-graph.js";
 import type { MemoryDefinition } from "#public/memory/index.js";
@@ -104,32 +103,20 @@ export interface ResolvedConnectionDefinition extends ResolvedModuleSourceRef {
     readonly url: string;
 }
 /**
- * Runtime-owned authored sandbox definition resolved from a compiled module
- * map.
- *
- * The resolved `backend` is non-optional: every sandbox in the runtime
- * graph carries a concrete SandboxBackend value, even when the
- * authored definition omits `backend`. The omitted field is filled
- * in by `defaultSandbox()` (which itself selects between
- * `vercel()`, `docker()`, `microsandbox()`, and `justbash()` based on the current
- * environment).
+ * Runtime-owned sandbox definition resolved from a compiled module map.
+ * Independent definitions carry their exported environment; parent definitions
+ * explicitly inherit the dispatching agent's sandbox.
  */
-export type ResolvedSandboxDefinition = ResolvedModuleSourceRef & {
-    readonly bootstrap?: (input: SandboxBootstrapContext) => Promise<void> | void;
-    readonly revalidationKey?: string;
-    readonly sourceHash?: string;
-    /**
-     * Resolved backend value. The authored `SandboxDefinition.backend`
-     * accepts either a `SandboxBackend` or a `() => SandboxBackend`; by
-     * the time it reaches the runtime the function form has been
-     * unwrapped via `lazyBackend(...)` so consumers always see a plain
-     * value.
-     */
-    readonly backend: SandboxBackend;
-    readonly description?: string;
-    readonly inheritsParent?: boolean;
-    readonly onSession?: (input: SandboxSessionContext) => Promise<void> | void;
+type ResolvedSandboxDefinitionBase = ResolvedModuleSourceRef & {
+    readonly revisionHash: string;
+    readonly selector: SandboxSelector;
 };
+export type ResolvedSandboxDefinition = ResolvedSandboxDefinitionBase & ({
+    readonly environment: SandboxEnvironmentIdentity;
+    readonly kind: "independent";
+} | {
+    readonly kind: "parent";
+});
 /**
  * Runtime-owned tool definition resolved from the selected compiled source graph.
  * A tool without `execute` is surfaced to the client and never executed by eve.

package/dist/src/runtime/workspace/types.d.ts

@@ -1,6 +1,6 @@
 /**
  * Stable root directory for every workspace eve exposes to agents and
- * sandbox backends.
+ * sandbox providers.
  *
  * This is both the model-facing logical path and the live `bash` cwd
  * for every backend. Backends must initialize their filesystems so

package/dist/src/sandbox/providers/default.d.ts

@@ -0,0 +1,27 @@
+import type { DockerSandboxEnvironmentOptions } from "#public/sandbox/docker-sandbox.js";
+import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
+import type { MicrosandboxSandboxCreateOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import type { VercelSandboxCreateOptions } from "#public/sandbox/vercel-sandbox.js";
+import type { SandboxEnvironment } from "#shared/sandbox-environment.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+export interface DefaultSandboxEnvironmentOptions {
+    readonly docker?: DockerSandboxEnvironmentOptions;
+    readonly justBash?: JustBashSandboxCreateOptions;
+    readonly microsandbox?: MicrosandboxSandboxCreateOptions;
+    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
+    readonly vercel?: VercelSandboxCreateOptions;
+}
+export interface DefaultSandboxProbes {
+    readonly isDeployedOnVercel: () => boolean;
+    readonly isDockerAvailable: () => boolean;
+    readonly isMicrosandboxSupported: () => boolean;
+}
+export declare const SANDBOX_PROVIDER_PROBES: DefaultSandboxProbes;
+export declare const DefaultSandbox: {
+    name: string;
+    environment(options?: DefaultSandboxEnvironmentOptions): SandboxEnvironment<undefined>;
+};
+export declare function defineDefaultSandboxProvider(probes: DefaultSandboxProbes): {
+    name: string;
+    environment(options?: DefaultSandboxEnvironmentOptions): SandboxEnvironment<undefined>;
+};

package/dist/src/sandbox/providers/default.js

@@ -0,0 +1 @@
+import{isLinuxDockerDaemonAvailableSync,isMicrosandboxPlatformSupported}from"#execution/sandbox/bindings/local.js";import{DockerSandbox}from"#sandbox/providers/docker.js";import{JustBashSandbox}from"#sandbox/providers/just-bash.js";import{MicrosandboxSandbox}from"#sandbox/providers/microsandbox.js";import{createDefaultVercelEnvironment}from"#sandbox/providers/vercel.js";const SANDBOX_PROVIDER_PROBES={isDeployedOnVercel:()=>!!process.env.VERCEL,isDockerAvailable:()=>isLinuxDockerDaemonAvailableSync(),isMicrosandboxSupported:()=>isMicrosandboxPlatformSupported()},DefaultSandbox=defineDefaultSandboxProvider(SANDBOX_PROVIDER_PROBES);function defineDefaultSandboxProvider(e){return{name:`default`,environment(t={}){return e.isDeployedOnVercel()?withoutOpenOptions(createDefaultVercelEnvironment(withPreparation(t.vercel,t.prepare))):e.isDockerAvailable()?withoutOpenOptions(DockerSandbox.environment(withPreparation(t.docker,t.prepare))):e.isMicrosandboxSupported()?withoutOpenOptions(MicrosandboxSandbox.environment(withPreparation(t.microsandbox,t.prepare))):JustBashSandbox.environment(withPreparation(t.justBash,t.prepare))}}}function withPreparation(e,t){return Object.assign({},e,t===void 0?{}:{prepare:t})}function withoutOpenOptions(e){return e}export{DefaultSandbox,SANDBOX_PROVIDER_PROBES,defineDefaultSandboxProvider};

package/dist/src/sandbox/providers/docker.d.ts

@@ -0,0 +1,11 @@
+import type { DockerSandboxEnvironmentOptions, DockerSandboxRuntimeOptions } from "#public/sandbox/docker-sandbox.js";
+import type { SandboxEnvironment } from "#shared/sandbox-environment.js";
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+export type { DockerSandboxEnvironmentOptions, DockerSandboxRuntimeOptions, } from "#public/sandbox/docker-sandbox.js";
+type DockerfileEnvironmentInput = Omit<DockerSandboxEnvironmentOptions, "image">;
+export declare const DockerSandbox: {
+    name: string;
+    environment(options?: Readonly<DockerSandboxEnvironmentOptions> | undefined): SandboxEnvironment<DockerSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+    dockerfile(options?: DockerfileEnvironmentInput): SandboxEnvironment<DockerSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+    image(reference: string, options?: DockerfileEnvironmentInput): SandboxEnvironment<DockerSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+};

package/dist/src/sandbox/providers/docker.js

@@ -0,0 +1 @@
+import{createDockerSandboxProvider}from"#execution/sandbox/bindings/local.js";import{defineSandboxProvider}from"#shared/sandbox-provider.js";const provider=defineSandboxProvider({name:`docker`,environment(e){return createDockerSandboxProvider(e)}}),DockerSandbox={...provider,dockerfile(e={}){return provider.environment(e)},image(e,t={}){return provider.environment({...t,image:e})}};export{DockerSandbox};

package/dist/src/sandbox/providers/just-bash.d.ts

@@ -0,0 +1,4 @@
+import type { JustBashSandboxCreateOptions } from "#public/sandbox/just-bash-sandbox.js";
+import type { FixedNetworkSandboxSession } from "#shared/sandbox-session.js";
+export type JustBashEnvironmentOptions = JustBashSandboxCreateOptions;
+export declare const JustBashSandbox: import("#shared/sandbox-provider.js").SandboxProvider<JustBashSandboxCreateOptions, undefined, FixedNetworkSandboxSession>;

package/dist/src/sandbox/providers/just-bash.js

@@ -0,0 +1 @@
+import{createJustBashSandboxProvider}from"#execution/sandbox/bindings/local.js";import{defineSandboxProvider}from"#shared/sandbox-provider.js";const JustBashSandbox=defineSandboxProvider({name:`just-bash`,environment:e=>createJustBashSandboxProvider(e)});export{JustBashSandbox};

package/dist/src/sandbox/providers/microsandbox.d.ts

@@ -0,0 +1,12 @@
+import type { MicrosandboxSandboxCreateOptions, MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
+import type { SandboxEnvironment } from "#shared/sandbox-environment.js";
+import type { MutableNetworkSandboxSession } from "#shared/sandbox-session.js";
+export type MicrosandboxEnvironmentOptions = MicrosandboxSandboxCreateOptions;
+type DockerfileEnvironmentInput = Omit<MicrosandboxEnvironmentOptions, "image">;
+export declare const MicrosandboxSandbox: {
+    name: string;
+    environment(options?: Readonly<MicrosandboxSandboxCreateOptions> | undefined): SandboxEnvironment<MicrosandboxSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+    dockerfile(options?: DockerfileEnvironmentInput): SandboxEnvironment<MicrosandboxSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+    image(reference: string, options?: DockerfileEnvironmentInput): SandboxEnvironment<MicrosandboxSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+};
+export {};

package/dist/src/sandbox/providers/microsandbox.js

@@ -0,0 +1 @@
+import{defineSandboxProvider}from"#shared/sandbox-provider.js";import{createMicrosandboxSandboxProvider}from"#execution/sandbox/bindings/microsandbox.js";const provider=defineSandboxProvider({name:`microsandbox`,stateProtocolVersion:3,environment:e=>createMicrosandboxSandboxProvider(e)}),MicrosandboxSandbox={...provider,dockerfile(e={}){return provider.environment(e)},image(e,t={}){return provider.environment({...t,image:e})}};export{MicrosandboxSandbox};

package/dist/src/sandbox/providers/vercel.d.ts

@@ -0,0 +1,12 @@
+import type { VercelSandboxCreateOptions, VercelSandboxRuntimeOptions } from "#public/sandbox/vercel-sandbox.js";
+import type { SandboxEnvironment } from "#shared/sandbox-environment.js";
+import type { MutableNetworkSandboxSession, SandboxSession } from "#shared/sandbox-session.js";
+export type VercelSandboxEnvironmentOptions = VercelSandboxCreateOptions & {
+    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
+};
+export type { VercelSandboxRuntimeOptions } from "#public/sandbox/vercel-sandbox.js";
+export declare function createDefaultVercelEnvironment(options?: VercelSandboxEnvironmentOptions): SandboxEnvironment<VercelSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+export declare const VercelSandbox: {
+    name: string;
+    environment(options?: VercelSandboxEnvironmentOptions): SandboxEnvironment<VercelSandboxRuntimeOptions, MutableNetworkSandboxSession>;
+};

package/dist/src/sandbox/providers/vercel.js

@@ -0,0 +1 @@
+import{defineSandboxProvider}from"#shared/sandbox-provider.js";import{createVercelSandbox,createVercelSandboxProvider}from"#execution/sandbox/bindings/vercel.js";const defaultProvider=defineSandboxProvider({name:`vercel`,environment:e=>{let{prepare:t,...n}=e??{};return createVercelSandbox({createOptions:n,prepare:t,skipEmptyPreparation:!0})}}),provider=defineSandboxProvider({name:`vercel`,environment:e=>createVercelSandboxProvider(e)});function createDefaultVercelEnvironment(e){return defaultProvider.environment(e)}const VercelSandbox={name:`vercel`,environment(e){return provider.environment(e)}};export{VercelSandbox,createDefaultVercelEnvironment};

package/dist/src/sandbox/providers.d.ts

@@ -0,0 +1,5 @@
+export { DefaultSandbox } from "#sandbox/providers/default.js";
+export { DockerSandbox } from "#sandbox/providers/docker.js";
+export { JustBashSandbox } from "#sandbox/providers/just-bash.js";
+export { MicrosandboxSandbox } from "#sandbox/providers/microsandbox.js";
+export { VercelSandbox } from "#sandbox/providers/vercel.js";

package/dist/src/sandbox/providers.js

@@ -0,0 +1 @@
+import{DockerSandbox}from"#sandbox/providers/docker.js";import{DefaultSandbox}from"#sandbox/providers/default.js";import{JustBashSandbox}from"#sandbox/providers/just-bash.js";import{MicrosandboxSandbox}from"#sandbox/providers/microsandbox.js";import{VercelSandbox}from"#sandbox/providers/vercel.js";export{DefaultSandbox,DockerSandbox,JustBashSandbox,MicrosandboxSandbox,VercelSandbox};

package/dist/src/sandbox/state.d.ts

@@ -1,32 +1,13 @@
 import type { SandboxSession } from "#public/definitions/sandbox.js";
-import type { SandboxBackendSessionState } from "#public/definitions/sandbox-backend.js";
-import type { SandboxDeleteOptions } from "#public/definitions/sandbox-backend.js";
-/**
- * Serializable sandbox reconnect record stored on the harness session.
- * Alias for {@link SandboxBackendSessionState} kept at this layer so
- * `SandboxState.session` can describe itself without importing the
- * backend's public-API spelling into harness code.
- */
-export type SandboxSessionState = SandboxBackendSessionState;
-/**
- * Serializable sandbox state carried on the harness session across
- * step boundaries.
- *
- * Contains only stable identifiers — live handles stay in a
- * process-level cache and are rehydrated per step via the backend.
- * Every agent owns exactly one sandbox, so the state is just a single
- * `initialized` flag and an optional persisted session record.
- */
+import type { SandboxDeleteOptions, SandboxPreparedArtifact } from "#shared/sandbox-provider.js";
+export interface SandboxSessionState {
+    readonly providerName: string;
+    readonly state: SandboxPreparedArtifact;
+    readonly stateProtocolVersion: number;
+}
 export interface SandboxState {
-    readonly initialized: boolean;
     readonly session: SandboxSessionState | null;
 }
-/**
- * Lazy sandbox accessor bound to one step execution.
- *
- * Returned by `ensureSandboxAccess` and placed on the `AlsContext` (via
- * `SandboxKey`) so tools can call `ctx.getSandbox()`.
- */
 export interface SandboxAccess {
     captureState(): Promise<SandboxState>;
     delete?(options?: SandboxDeleteOptions): Promise<void>;

package/dist/src/self-modification/extension/subagents/agent/agent.d.ts

@@ -1,7 +1,7 @@
 import { type AgentReasoningDefinition, type AgentStaticModelDefinition, type DynamicSentinel, type DynamicSubagentDefinition } from "eve";
 import { type SelfModificationConfig } from "../../../config.js";
 /** Fallback model when neither the self-modification agent nor its parent configures one. */
-export declare const FALLBACK_SELF_MODIFICATION_MODEL = "openai/gpt-5.6-luna-fast";
+export declare const FALLBACK_SELF_MODIFICATION_MODEL = "spacexai/grok-4.7";
 /** Configuration for the self-modification subagent. */
 export interface SelfModificationAgentOptions {
     /** Policy shared with the sandbox and extension mount. */

package/dist/src/self-modification/extension/subagents/agent/agent.js

@@ -1 +1 @@
-import{resolveSelfModificationConfig}from"../../../config.js";import{hasGitHubCredential}from"../../../credentials.js";import extension_default from"../../extension.js";import{resolveSelfModificationMode}from"../../../mode.js";import{DEFAULT_AGENT_MODEL_ID}from"#shared/default-agent-model.js";import{defineAgent,defineDynamic}from"eve";const FALLBACK_SELF_MODIFICATION_MODEL=DEFAULT_AGENT_MODEL_ID;function renderDescription(e){return e.filter(e=>e.length>0).join(` `)}function defineSelfModificationAgent(e={}){let resolve=async(t,n)=>{let r=extension_default.config,i=e.reasoning??r.reasoning,a=resolveSelfModificationConfig(e.config??r),o=resolveSelfModificationMode(a),s=e.model??r.model??n.model?.id??FALLBACK_SELF_MODIFICATION_MODEL,c=renderDescription([`Delegate here when the user asks to change this eve agent or its authored source.`,`If the requested change references a tool or skill, include the exact identifier. Do not infer source paths; let the child resolve the appropriate file under /source. Delegate the requested change and existing constraints without adding unrequested features, implementation steps, or reporting requirements.`,`Treat requests for persistent changes to future behavior or capabilities as source-modification requests, even when the requester does not mention files or source code. Infer persistence from the request and conversation rather than waiting for phrases such as “modify your source.” For example, asking the agent to stop always doing something, add a capability, or change future responses calls for inspecting and editing the authored source instead of providing a one-turn workaround.`,`Treat questions phrased as whether you can install, add, enable, or connect to a named product or service as requests to extend this eve agent and delegate immediately. Do not assume they refer to device software, ask what kind of installation they mean, or deny them because you lack access to the user's device. The subagent determines whether the request maps to an integration, channel, connection, or other capability, then checks registry availability and any required setup.`,o===`local`?`Delegate questions about which integrations, channels, connections, or capabilities are available to add: the subagent searches the eve registry and reports exact item addresses instead of guessing them.`:`Delegate requests to add integrations, channels, connections, or capabilities: the subagent searches the official eve registry and can install source changes into the draft proposal. Setup may require non-secret answers or an external action, and secret binding remains separate.`,o===`local`?`Delegate requests to investigate, diagnose, or optimize the agent's behavior from local traces to this subagent: it can inspect the invoking session's trace and make persistent source changes when warranted.`:``,`Resolve short follow-ups such as “yes” or “do it” against the preceding conversation. If whether the requested change should persist is genuinely ambiguous, ask one concise clarifying question.`,`If a tool or capability created or changed by this subagent later fails or behaves incorrectly, explain the observed problem and offer to delegate a repair. Do not start the repair until the user confirms. Treat that confirmation as a source-modification request and delegate it immediately, including the exact identifier, failing behavior, expected behavior, and existing constraints.`,o===`local`?`Source edits do not affect the caller’s current turn. After this subagent reports changes, do not invoke edited tools or attempt runtime verification until a new user turn.`:`Source edits do not affect the caller’s current turn. The subagent can publish only a draft pull request, and changes become effective only after review, merge, and redeployment.`]);if(o===`local`)return defineAgent({description:c,model:s,reasoning:i});if(o!==`deployed`||a.deployed===void 0||a.deployed.credentials.kind===`pat`&&!hasGitHubCredential())return null;try{if(!await a.deployed.authorize({channel:n.channel,principal:n.session.auth.current}))return null}catch{return null}return defineAgent({description:c,model:s,reasoning:i})};return defineDynamic({events:{"session.started":resolve,"turn.started":resolve}})}var agent_default=defineSelfModificationAgent();export{FALLBACK_SELF_MODIFICATION_MODEL,agent_default as default,defineSelfModificationAgent};
+import{resolveSelfModificationConfig}from"../../../config.js";import{hasGitHubCredential}from"../../../credentials.js";import extension_default from"../../extension.js";import{resolveSelfModificationMode}from"../../../mode.js";import{DEFAULT_AGENT_MODEL_ID}from"#shared/default-agent-model.js";import{defineAgent,defineDynamic}from"eve";import{getLocalDevCapability}from"eve/local-dev";const FALLBACK_SELF_MODIFICATION_MODEL=DEFAULT_AGENT_MODEL_ID;function renderDescription(e){return e.filter(e=>e.length>0).join(` `)}function defineSelfModificationAgent(e={}){let resolve=async(t,n)=>{let r=extension_default.config,i=e.reasoning??r.reasoning,a=resolveSelfModificationConfig(e.config??r),o=resolveSelfModificationMode(a),s=e.model??r.model??n.model?.id??FALLBACK_SELF_MODIFICATION_MODEL,c=renderDescription([`Delegate here when the user asks to change this eve agent or its authored source.`,`If the requested change references a tool or skill, include the exact identifier. Do not infer source paths; let the child resolve the appropriate file under /source. Delegate the requested change and existing constraints without adding unrequested features, implementation steps, or reporting requirements.`,`Treat requests for persistent changes to future behavior or capabilities as source-modification requests, even when the requester does not mention files or source code. Infer persistence from the request and conversation rather than waiting for phrases such as “modify your source.” For example, asking the agent to stop always doing something, add a capability, or change future responses calls for inspecting and editing the authored source instead of providing a one-turn workaround.`,`Treat questions phrased as whether you can install, add, enable, or connect to a named product or service as requests to extend this eve agent and delegate immediately. Do not assume they refer to device software, ask what kind of installation they mean, or deny them because you lack access to the user's device. The subagent determines whether the request maps to an integration, channel, connection, or other capability, then checks registry availability and any required setup.`,o===`local`?`Delegate questions about which integrations, channels, connections, or capabilities are available to add: the subagent searches the eve registry and reports exact item addresses instead of guessing them.`:`Delegate requests to add integrations, channels, connections, or capabilities: the subagent searches the official eve registry and can install source changes into the draft proposal. Setup may require non-secret answers or an external action, and secret binding remains separate.`,o===`local`?`Delegate requests to investigate, diagnose, or optimize the agent's behavior from local traces to this subagent: it can inspect the invoking session's trace and make persistent source changes when warranted.`:``,`Resolve short follow-ups such as “yes” or “do it” against the preceding conversation. If whether the requested change should persist is genuinely ambiguous, ask one concise clarifying question.`,`If a tool or capability created or changed by this subagent later fails or behaves incorrectly, explain the observed problem and offer to delegate a repair. Do not start the repair until the user confirms. Treat that confirmation as a source-modification request and delegate it immediately, including the exact identifier, failing behavior, expected behavior, and existing constraints.`,o===`local`?`Source edits do not affect the caller’s current turn. After this subagent reports changes, do not invoke edited tools or attempt runtime verification until a new user turn.`:`Source edits do not affect the caller’s current turn. The subagent can publish only a draft pull request, and changes become effective only after review, merge, and redeployment.`]);if(o===`local`)return getLocalDevCapability()===void 0?null:defineAgent({description:c,model:s,reasoning:i});if(o!==`deployed`||a.deployed===void 0||a.deployed.credentials.kind===`pat`&&!hasGitHubCredential())return null;try{if(!await a.deployed.authorize({channel:n.channel,principal:n.session.auth.current}))return null}catch{return null}return defineAgent({description:c,model:s,reasoning:i})};return defineDynamic({events:{"session.started":resolve,"turn.started":resolve}})}var agent_default=defineSelfModificationAgent();export{FALLBACK_SELF_MODIFICATION_MODEL,agent_default as default,defineSelfModificationAgent};