eve 0.7.3 → 0.8.0

package/dist/src/shared/sandbox-backend.d.ts

@@ -88,6 +88,10 @@ export interface SandboxBackendCreateInput {
 export interface SandboxBackendPrewarmInput<BO = Record<string, never>> {
     readonly templateKey: string;
     readonly bootstrap?: (input: SandboxBootstrapContext<BO>) => void | Promise<void>;
+    /**
+     * Optional progress logger for backend-specific prewarm phases.
+     */
+    readonly log?: (message: string) => void;
     readonly runtimeContext: SandboxBackendRuntimeContext;
     readonly seedFiles: ReadonlyArray<SandboxSeedFile>;
 }
@@ -110,8 +114,10 @@ export interface SandboxBackendPrewarmResult {
  *
  * A `SandboxBackend` is a value an author attaches to a
  * {@link SandboxDefinition} to choose which underlying runtime hosts the
- * sandbox. Eve ships two built-in backends (`vercelBackend()` and
- * `localBackend()`), but the interface is public so authors can write
+ * sandbox. Eve ships built-in backends (`dockerBackend()`,
+ * `justBashBackend()`, `microsandboxBackend()`,
+ * `vercelSandboxBackend()`, and the availability-aware
+ * `defaultBackend()`), but the interface is public so authors can write
  * their own.
  *
  * A backend implements the full two-phase lifecycle:

package/dist/src/shared/sandbox-definition.d.ts

@@ -69,13 +69,14 @@ interface SandboxDefinitionBase<BO = Record<string, never>, SO = Record<string,
      *
      * ```ts
      * defineSandbox({
-     *   backend: () => vercelBackend({ env: { TOKEN: process.env.TOKEN ?? "" } }),
+     *   backend: () => vercelSandboxBackend({ env: { TOKEN: process.env.TOKEN ?? "" } }),
      * });
      * ```
      *
      * When this field is omitted, Eve substitutes `defaultBackend()` at
-     * runtime, which delegates to `vercelBackend()` on hosted Vercel
-     * (where `process.env.VERCEL` is set) and to `localBackend()`
+     * runtime, which picks the best available backend: `vercelSandboxBackend()`
+     * on hosted Vercel (where `process.env.VERCEL` is set), then Docker,
+     * microsandbox, or just-bash
      * everywhere else. Set `backend` explicitly to pin the sandbox to a
      * specific backend regardless of environment.
      */

package/dist/src/shared/sandbox-network-policy.d.ts

@@ -17,7 +17,9 @@ import type { NetworkPolicy } from "#compiled/@vercel/sandbox/index.js";
  * });
  * ```
  *
- * The local backend rejects `setNetworkPolicy`: just-bash cannot update its
- * network policy at run time and runs no binaries to govern.
+ * The Docker backend honors only the coarse `"allow-all"` and
+ * `"deny-all"` policies; the just-bash backend rejects `setNetworkPolicy`
+ * entirely (its network policy is fixed at sandbox creation and it runs
+ * no binaries to govern).
  */
 export type SandboxNetworkPolicy = NetworkPolicy;

package/dist/src/shared/sandbox-session.d.ts

@@ -107,8 +107,9 @@ export interface SandboxSession extends Pick<AiSdkSandbox, "run" | "spawn" | "re
      *
      * When the policy is known at session start, prefer configuring it up
      * front in the sandbox backend factory or `onSession`'s `use()`. The
-     * local backend rejects this call: just-bash cannot update its network
-     * policy at run time and runs no binaries to govern.
+     * Docker backend honors only `"allow-all"` and `"deny-all"`;
+     * the just-bash backend rejects this call entirely (its network policy
+     * is fixed at sandbox creation and it runs no binaries to govern).
      */
     setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
     /**

package/dist/src/svelte/index.js

@@ -1,3 +1,3 @@
-import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-DoR8C4i6.js";
+import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-Dlut2Qzt.js";
 
 export { defaultMessageReducer, useEveAgent };

package/dist/src/svelte/use-eve-agent.js

@@ -1,3 +1,3 @@
-import { t as useEveAgent } from "../chunks/use-eve-agent-DoR8C4i6.js";
+import { t as useEveAgent } from "../chunks/use-eve-agent-Dlut2Qzt.js";
 
 export { useEveAgent };

package/dist/src/vue/index.js

@@ -1,3 +1,3 @@
-import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-DErQj5hs.js";
+import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-BSXZSn-R.js";
 
 export { defaultMessageReducer, useEveAgent };

package/dist/src/vue/use-eve-agent.js

@@ -1,3 +1,3 @@
-import { t as useEveAgent } from "../chunks/use-eve-agent-DErQj5hs.js";
+import { t as useEveAgent } from "../chunks/use-eve-agent-BSXZSn-R.js";
 
 export { useEveAgent };

package/{dist/docs/public → docs}/getting-started.mdx

@@ -26,7 +26,17 @@ You also need a model credential. Set the provider or gateway key your model str
 
 The quick start uses `eve init` for a guided scaffold. The target can also be an existing project directory (`eve init .`): the project must have a `package.json`, the `agent/` files must not exist yet, and the missing `eve`, `ai`, and `zod` dependencies are added without touching anything else the project owns. Either way the final handoff runs the `eve dev` binary through the project's package manager, never the project's own `dev` script.
 
-To wire Eve into an existing app yourself instead, add only the dependency and author the two files the runtime needs:
+To wire Eve into an existing app yourself instead, make sure the app declares a compatible Node runtime in `package.json`:
+
+```json
+{
+  "engines": {
+    "node": ">=24"
+  }
+}
+```
+
+Then add only the dependency and author the two files the runtime needs:
 
 ```bash
 npm install eve@latest
@@ -157,8 +167,8 @@ See [Sessions, runs & streaming](./concepts/sessions-runs-and-streaming) for the
 
 If a coding agent (Claude Code, Cursor, and the like) is doing the setup, hand it this prompt:
 
-<CopyPrompt text="Set up an Eve agent for the user. Eve is a filesystem-first TypeScript framework for durable agents, published as the npm package eve. Read its docs: once eve is installed they are bundled in the package at node_modules/eve/dist/docs/public; before eve is installed, read the published Introduction and Getting Started pages. If the project has no Eve app, scaffold one with `npx eve@latest init <name>`; add `--channel-web-nextjs` only when the user wants Web Chat. The init command installs dependencies, initializes Git, and starts the dev server, so run it in a controllable process and stop it before editing. To add Eve to an existing app, run `npm install eve@latest`. Make sure agent/agent.ts and agent/instructions.md exist, then add a first typed tool at agent/tools/get_weather.ts using defineTool from eve/tools with a Zod inputSchema and an inline execute. Start the dev server again, then exercise the HTTP API: create a session with POST /eve/v1/session, attach to GET /eve/v1/session/:id/stream, and send a follow-up with the returned continuationToken. Verify with the project's typecheck, adapt model and provider choices to the project, and do not commit unless the user asks.">
-  Set up an Eve agent: read the Eve docs (bundled at node_modules/eve/dist/docs/public once eve is
+<CopyPrompt text="Set up an Eve agent for the user. Eve is a filesystem-first TypeScript framework for durable agents, published as the npm package eve. Read its docs: once eve is installed they are bundled in the package at node_modules/eve/docs; before eve is installed, read the published Introduction and Getting Started pages. If the project has no Eve app, scaffold one with `npx eve@latest init <name>`; add `--channel-web-nextjs` only when the user wants Web Chat. The init command installs dependencies, initializes Git, and starts the dev server, so run it in a controllable process and stop it before editing. To add Eve to an existing app, run `npm install eve@latest`. Make sure agent/agent.ts and agent/instructions.md exist, then add a first typed tool at agent/tools/get_weather.ts using defineTool from eve/tools with a Zod inputSchema and an inline execute. Start the dev server again, then exercise the HTTP API: create a session with POST /eve/v1/session, attach to GET /eve/v1/session/:id/stream, and send a follow-up with the returned continuationToken. Verify with the project's typecheck, adapt model and provider choices to the project, and do not commit unless the user asks.">
+  Set up an Eve agent: read the Eve docs (bundled at node_modules/eve/docs once eve is
   installed), scaffold with `npx eve@latest init <name>` (or `npm install eve@latest` in an existing app), add
   a typed tool at agent/tools/get_weather.ts, run it with `npm run dev`, then create a session, stream
   it, and send a follow-up.
@@ -166,7 +176,7 @@ If a coding agent (Claude Code, Cursor, and the like) is doing the setup, hand i
 
 Once `eve` is a dependency, the full docs are bundled in the package, so the agent can read them locally without fetching anything:
 
-- Docs: `node_modules/eve/dist/docs/public/`
+- Docs: `node_modules/eve/docs/`
 
 `eve init <name>` creates the base agent; `eve init .` adds one to an existing project. Add `--channel-web-nextjs` for Web Chat, or run
 `eve channels add slack` later from an interactive terminal.

package/{dist/docs/public → docs}/guides/deployment.md

@@ -29,10 +29,10 @@ Route-auth secrets never get serialized into the compiled discovery or module-ma
 On Vercel, the [sandbox](../sandbox) runs on hosted [Vercel Sandbox](https://vercel.com/docs/sandbox) infrastructure. Attach the backend on the sandbox definition:
 
 ```ts title="agent/sandbox/sandbox.ts"
-import { defineSandbox, vercelBackend } from "eve/sandbox";
+import { defineSandbox, vercelSandboxBackend } from "eve/sandbox";
 
 export default defineSandbox({
-  backend: vercelBackend(),
+  backend: vercelSandboxBackend(),
 });
 ```
 
@@ -110,7 +110,7 @@ Agent Runs is separate from the OpenTelemetry exporters configured in [`instrume
 
 - [ ] `eve build` succeeds and writes `.vercel/output`.
 - [ ] Provider keys and route-auth secrets are set in Vercel env vars.
-- [ ] The sandbox backend matches the environment (`vercelBackend()` or `defaultBackend()`).
+- [ ] The sandbox backend matches the environment (`vercelSandboxBackend()` or `defaultBackend()`).
 - [ ] Build-time prewarm reused or built templates without failing.
 - [ ] `placeholderAuth()` is replaced with your real policy.
 

package/{dist/docs/public → docs}/guides/dev-tui.md

@@ -18,9 +18,9 @@ On startup the TUI prints a brand line with your agent's name, plus a rotating t
 
 If agent discovery reported problems, an error/warning count renders between the two lines. Instructions, tools, skills, and subagents are one `eve info` away, and `/help` lists every command.
 
-From there the conversation streams straight into your terminal's normal scrollback — your prompts, the agent's replies, reasoning, tool calls, nested subagents, connection-authorization prompts, and any captured `stdout`/`stderr` — so you keep native scrolling, copy/paste, and a transcript that persists after you exit. Each turn is rendered without boxes: a colored gutter glyph marks who's speaking, tool calls collapse to a one-line summary (`✓ get_weather  city="SF" → 73°F`), and a subagent's work is indented beneath its `◆` header. A sticky footer keeps you oriented. The input prompt shows a dim `Type to chat · / for commands` placeholder while empty, and beneath it a persistent status line shows the model, the session's token flow (`⁕ ↑ 394.4K ↓ 4.3K`), the linked Vercel project and team (`▲ my-agent (acme)`), and a yellow `deploy pending` marker once a channel added this session still needs `/deploy`. The Vercel segment stays hidden until the directory is linked. Press `Enter` to send; `Ctrl+C` interrupts a running turn or quits at the prompt. Slash commands: `/new` starts a fresh session and `/exit` quits.
+From there the conversation streams straight into your terminal's normal scrollback — your prompts, the agent's replies, reasoning, tool calls, nested subagents, connection-authorization prompts, and any captured `stdout`/`stderr` — so you keep native scrolling, copy/paste, and a transcript that persists after you exit. Each turn is rendered without boxes: a colored gutter glyph marks who's speaking, tool calls collapse to a one-line summary (`✓ get_weather  city="SF" → 73°F`), and a subagent's work is indented beneath its `◆` header. A sticky footer keeps you oriented. When input is ready, the prompt shows a dim `Type to chat · / for commands` placeholder while empty; while a turn or setup action owns the terminal, only its live status is shown. Beneath the prompt or status, a persistent line shows the model, the session's token flow (`⁕ ↑ 394.4K ↓ 4.3K`), the linked Vercel project and team (`▲ my-agent (acme)`), and a yellow `/deploy pending` marker once a channel added this session still needs `/deploy`. The Vercel segment stays hidden until the directory is linked. Press `Enter` to send; `Ctrl+C` interrupts a running turn or quits at the prompt. Slash commands: `/new` starts a fresh session and `/exit` quits.
 
-When `eve dev` runs the server locally, three more slash commands manage the project without leaving the session. Bare `/model` opens a two-row configure menu that loops until Esc. "Change model" runs the same searchable model picker setup uses (the AI Gateway catalog, pre-selected on the model the runtime is serving); a model change is written into your agent's authored source, and the command reports success only after Eve confirms the new id (`/model <provider/model-id>` applies one directly, skipping the menu). The provider row opens the provider questions: which model provider to use (picking something other than AI Gateway shows wiring instructions for your own provider and stops there, leaving any existing setup untouched) and how to connect to AI Gateway — paste your own `AI_GATEWAY_API_KEY`, saved straight to `.env.local`, or connect via a project, which walks the same Vercel team/project pickers as setup (picking again re-links) and pulls the project's environment so an AI Gateway credential lands in `.env.local`; the dev server reloads env files automatically, no restart needed. The row demands attention (a bold yellow "Configure provider" with "Required to enable the agent") until a link or gateway credential is detected, then names the connection (e.g. "AI Gateway (Linked to my-project in my-team)") after, and each action's latest outcome stays visible beneath the menu (e.g. "✓ Model changed to openai/gpt-5.5"). `/channels` shows the agent's channel list — already-registered channels render as locked rows — and adds the one you pick, including the Slack Connect provisioning, then installs the dependencies the scaffold added so the dev server can load the new channels right away; after each addition the list repaints with the new channel locked, until Done (or Esc) leaves the flow. `/deploy` ships the agent to Vercel production, linking first when the directory is unlinked. Each command echoes as an invocation line, asks through a bordered panel that takes the input area's place — one question at a time, clearly separate from the chat transcript — and finishes with a one-line `⎿` result; loading states stay on the ephemeral status line instead of piling into the transcript. These commands are not available when connected to a remote server with `--url`, and when a turn fails because AI Gateway authentication is missing or stale, the error points you at `/model` directly. The TUI also checks at startup: a missing model-provider setup surfaces as an attention line — `⚠ 1 setup issue: model provider not linked · /model` — so the fix is visible before the first message fails, and each command's outcome hangs under it with the `⎿` connector.
+When `eve dev` runs the server locally, three more slash commands manage the project without leaving the session. Bare `/model` opens a configure menu that loops until Done (or Esc). "Change model" runs the same searchable model picker setup uses (the AI Gateway catalog, pre-selected on the model the runtime is serving); a model change is written into your agent's authored source, and the command reports success only after Eve confirms the new id (`/model <provider/model-id>` applies one directly, skipping the menu). The provider row opens the provider questions: which model provider to use (picking something other than AI Gateway shows wiring instructions for your own provider and stops there, leaving any existing setup untouched) and how to connect to AI Gateway — paste your own `AI_GATEWAY_API_KEY`, saved straight to `.env.local`, or connect via a project, which asks for a Vercel team and then opens that team's existing-project list (picking again re-links) before pulling the project's environment so an AI Gateway credential lands in `.env.local`; the dev server reloads env files automatically, no restart needed. The row demands attention (a bold yellow "Configure provider" with "Required to enable the agent") until a link or gateway credential is detected, then names the connection (e.g. "AI Gateway (Linked to my-project in my-team)") after, and each action's latest outcome stays visible beneath the menu (e.g. "✓ Model changed to openai/gpt-5.5"). `/channels` shows the agent's channel list — already-registered channels render as checked, focusable rows with an "Already installed" hint — and adds the one you pick, including the Slack Connect provisioning, then installs the dependencies the scaffold added so the dev server can load the new channels right away; after each addition the list repaints with the channel checked, until Done (or Esc) leaves the flow. `/deploy` ships the agent to Vercel production, linking first when the directory is unlinked. Each command echoes as an invocation line, asks through a bordered panel that takes the input area's place — one question at a time, clearly separate from the chat transcript — and finishes with a one-line `⎿` result; loading states stay on the ephemeral status line instead of piling into the transcript. These commands are not available when connected to a remote server with `--url`, and when a turn fails because AI Gateway authentication is missing or stale, the error points you at `/model` directly. The TUI also checks at startup: a missing model-provider setup surfaces as an attention line — `⚠ 1 setup issue: model provider not linked · /model` — so the fix is visible before the first message fails, and each command's outcome hangs under it with the `⎿` connector.
 
 The prompt input behaves like a shell line editor: `↑`/`↓` cycle through the messages you've sent this session, `←`/`→`, Home/End, and `Ctrl+A`/`Ctrl+E` move the caret, and `Ctrl+U`/`Ctrl+K`/`Ctrl+W` kill the line, the rest of the line, or the previous word. If a turn fails terminally — the server session dies or the connection drops — the TUI starts a fresh session and notes it inline so you can keep going (server-side context resets with the old session). Errors render compactly, with docs links highlighted, and a code bug escaping your agent's own code shows its stack trace dim beneath the error headline. Captured server `stdout`/`stderr` renders as dim, indented log runs behind a `│` rule — consecutive lines from the same source share one label. Dev-server rebuilds condense further, into one status row that updates in place: `tui/setup-panel.ts changed · rebuilding…`, then `· rebuilt`. Only the latest rebuild shows, and paths shrink to their last two components. The TUI hides logs by default. `/loglevel <all|stderr|none>` switches what the transcript shows, and because logs stay buffered either way, the switch is retroactive: `/loglevel all` brings back everything captured so far, in its original order. Bare `/loglevel` reports the current mode; the `--logs` flag sets the starting one.
 

package/{dist/docs/public → docs}/reference/cli.md

@@ -81,6 +81,7 @@ Pass a bare URL as the only argument and the UI connects to that server instead
 | `-u, --url <url>`                   | Connect to an existing server URL instead of starting one                                 |
 | `--no-ui`                           | Start the server without an interactive UI                                                |
 | `--name <name>`                     | Title shown in the terminal UI (defaults to the app folder name)                          |
+| `--input <text>`                    | Pre-fill the prompt input after launching the UI (editable; not auto-submitted)           |
 | `--tools <mode>`                    | Tool-call rendering: `full` \| `collapsed` \| `auto-collapsed` \| `hidden`                |
 | `--reasoning <mode>`                | Reasoning rendering: `full` \| `collapsed` \| `auto-collapsed` \| `hidden`                |
 | `--subagents <mode>`                | Subagent-section rendering: `full` \| `collapsed` \| `auto-collapsed` \| `hidden`         |
@@ -97,7 +98,7 @@ Local dev keeps immutable runtime source snapshots under `.eve/dev-runtime/snaps
 eve link
 ```
 
-Links the current directory to a Vercel project through interactive team/project pickers, then pulls the project's environment so an AI Gateway credential (`VERCEL_OIDC_TOKEN` or `AI_GATEWAY_API_KEY`) lands in `.env.local`, and verifies one actually did. Running it again re-links: the pickers always run, and the new choice wins. Interactive only — in CI, use `vercel link --project <name> --yes` instead. A running `eve dev` reloads env files automatically, so no restart is needed after the pull.
+Links the current directory to an existing Vercel project by selecting a team and then a project, then pulls the project's environment so an AI Gateway credential (`VERCEL_OIDC_TOKEN` or `AI_GATEWAY_API_KEY`) lands in `.env.local`, and verifies one actually did. Running it again re-links: the pickers always run, and the new choice wins. Interactive only — in CI, use `vercel link --project <name> --yes` instead. A running `eve dev` reloads env files automatically, so no restart is needed after the pull.
 
 ## `eve deploy`
 

package/{dist/docs/public → docs}/sandbox.mdx

@@ -51,7 +51,7 @@ The handle does more than `run` and `writeTextFile`. In every method, relative p
 | `readFile` / `writeFile`                 | stream a file in/out as bytes                                                                   |
 | `removePath({ path, force, recursive })` | delete one file or directory; `force` ignores missing paths, `recursive` removes non-empty dirs |
 | `resolvePath(path)`                      | anchor a relative path to its absolute `/workspace/...` form                                    |
-| `setNetworkPolicy(policy)`               | change egress policy mid-turn (Vercel backend only; see [Network policy](#network-policy))      |
+| `setNetworkPolicy(policy)`               | change egress policy mid-turn (backend-dependent; see [Network policy](#network-policy))        |
 
 Since `run` blocks until the command exits, reach for `spawn` when the process should keep running while the agent does other work:
 
@@ -90,10 +90,10 @@ To add setup, seed files, or pick a backend, author `defineSandbox`. There are t
 - `agent/sandbox/sandbox.ts`: folder layout. Use it when you also seed `agent/sandbox/workspace/**`. If both exist, the folder layout wins.
 
 ```ts title="agent/sandbox/sandbox.ts"
-import { defineSandbox, vercelBackend } from "eve/sandbox";
+import { defineSandbox, vercelSandboxBackend } from "eve/sandbox";
 
 export default defineSandbox({
-  backend: vercelBackend({ runtime: "node24", resources: { vcpus: 2 } }),
+  backend: vercelSandboxBackend({ runtime: "node24", resources: { vcpus: 2 } }),
   revalidationKey: () => "repo-bootstrap-v1",
   async bootstrap({ use }) {
     const sandbox = await use();
@@ -109,15 +109,26 @@ export default defineSandbox({
 
 ## Backends
 
-The backend decides where the sandbox runs. Eve ships three factories from `eve/sandbox`:
+The backend decides where the sandbox runs. Eve ships four pinned factories plus an availability-aware default from `eve/sandbox`:
 
-| Backend            | Runs the sandbox                                                                                 |
-| ------------------ | ------------------------------------------------------------------------------------------------ |
-| `vercelBackend()`  | on [Vercel Sandbox](https://vercel.com/docs/sandbox).                                            |
-| `localBackend()`   | locally via `just-bash`. The default for `eve dev`.                                              |
-| `defaultBackend()` | `vercelBackend()` on hosted Vercel (`process.env.VERCEL` set), `localBackend()` everywhere else. |
+| Backend                  | Runs the sandbox                                                                               |
+| ------------------------ | ---------------------------------------------------------------------------------------------- |
+| `vercelSandboxBackend()` | on [Vercel Sandbox](https://vercel.com/docs/sandbox).                                          |
+| `dockerBackend()`        | locally in a Docker container, driven through the `docker` CLI.                                |
+| `microsandboxBackend()`  | locally in a lightweight [microsandbox](https://www.npmjs.com/package/microsandbox) VM.        |
+| `justBashBackend()`      | locally in the pure-JS `just-bash` interpreter — no daemon or VM, but no real binaries either. |
+| `defaultBackend()`       | picks the best available: Vercel Sandbox on hosted Vercel → Docker → microsandbox → just-bash. |
 
-With `backend` omitted, Eve uses `defaultBackend()`: `eve dev` on your laptop boots the local backend, and a production build on Vercel uses Vercel Sandbox, no code change in between. `defaultBackend()` also accepts a keyed bag so each inner backend gets its own typed create options:
+Configuring a pinned factory uses that backend unconditionally — `dockerBackend()` always requires a reachable Docker daemon, `vercelSandboxBackend()` always creates hosted sandboxes (including from local dev, with Vercel credentials).
+
+With `backend` omitted, Eve uses `defaultBackend()`, which resolves on first use in priority order:
+
+1. **Vercel Sandbox** when deploying on Vercel (`process.env.VERCEL` is set) — local container/VM runtimes can't run there.
+2. **Docker** when a daemon is reachable through a Docker-compatible `docker` CLI (Docker Desktop, OrbStack, Colima, Podman via its docker-compatible CLI; override the binary with `EVE_DOCKER_PATH`).
+3. **microsandbox** when the host supports it: macOS on Apple Silicon, or glibc Linux with KVM enabled.
+4. **just-bash** as the dependency-free fallback.
+
+`defaultBackend()` also accepts a keyed bag so each inner backend gets its own typed create options:
 
 ```ts
 import { defaultBackend, defineSandbox } from "eve/sandbox";
@@ -125,12 +136,23 @@ import { defaultBackend, defineSandbox } from "eve/sandbox";
 export default defineSandbox({
   backend: defaultBackend({
     vercel: { networkPolicy: "deny-all", resources: { vcpus: 4 } },
-    local: {},
+    docker: { image: "ubuntu:26.04" },
+    microsandbox: { memoryMiB: 2048 },
   }),
 });
 ```
 
-In local development, `localBackend()` stores template and session files as normal directories under `.eve/sandbox-cache/local/`. Template directories are reused across sessions when the sandbox source, seed files, and `revalidationKey` still match; `eve dev` prunes stale local templates in the background. Session directories persist `/workspace` changes across turns for the same durable session.
+### Docker
+
+`dockerBackend()` drives the Docker CLI directly. The default base image is `ubuntu:26.04`, the official Ubuntu 26.04 image from Docker Hub; Eve installs Node 24, npm, Bash, and baseline tools during framework setup before authored bootstrap code runs. Configure it through `dockerBackend({ image, env, pullPolicy, networkPolicy })`; custom images must provide Bash, Node 24, and npm, or a package manager and setup network access that can install them. Templates are committed as local Docker images and reused across sessions when the sandbox source, seed files, `revalidationKey`, and Docker backend options still match; sessions run as long-lived containers whose filesystems persist `/workspace` changes across turns for the same durable session. `eve dev` prunes stale template images in the background.
+
+### microsandbox
+
+`microsandboxBackend()` runs each sandbox in a lightweight local VM with snapshot-backed templates, a `vercel-sandbox` user, and a firewall capable of domain-level network policies and credential brokering — the closest local match to hosted Vercel Sandbox. Supported hosts: macOS on Apple Silicon, or Linux (glibc) with KVM. The `microsandbox` npm package and its VM runtime are not bundled with Eve: `eve dev` installs both automatically when missing (disable with `setup: { autoInstall: false }`); production processes fail with actionable install errors instead.
+
+### just-bash
+
+`justBashBackend()` needs no daemon or VM, but commands run in a simulated bash with a virtual filesystem under `.eve/sandbox-cache/` — no real binaries (`git`, `node`, package managers) and no network isolation. The `just-bash` package is an optional peer dependency: `eve dev` installs it into your application automatically when missing (disable with `autoInstall: false`); production processes fail with an actionable install error instead.
 
 You can write your own backend too: a `SandboxBackend` is just an object with a `name`, a `create`, and an optional `prewarm`. See the `SandboxBackend*` types on `eve/sandbox`.
 
@@ -142,10 +164,10 @@ There are two hooks, scoped differently:
 - **`onSession({ use, ctx })`** is durable-session-scoped and runs once per session. This is where per-session setup goes: network policy, resources, timeout, per-user credentials, one-time markers. Because it runs inside the active runtime context, it can read `ctx.session` and derive the current principal without baking credentials into the template. Call `use(opts?)` to get a `SandboxSession`; `opts` flow to the backend's update path after create.
 
 ```ts
-import { defineSandbox, vercelBackend } from "eve/sandbox";
+import { defineSandbox, vercelSandboxBackend } from "eve/sandbox";
 
 export default defineSandbox({
-  backend: vercelBackend(),
+  backend: vercelSandboxBackend(),
   async onSession({ use, ctx }) {
     const sandbox = await use({ networkPolicy: "deny-all" });
     const user = ctx.session.auth.current;
@@ -171,7 +193,9 @@ networkPolicy: {
 };
 ```
 
-Set it on the factory (`vercelBackend({ networkPolicy: "deny-all" })`) and it applies from creation, including during `bootstrap`. Set it in `onSession`'s `use()` to override per-session. The common pattern combines both: leave the factory open so `bootstrap` can `git clone`, then lock down in `onSession`. And to change the policy mid-turn, call `sandbox.setNetworkPolicy(...)` on the live handle. That one is Vercel-only; the local backend rejects it.
+Set it on the factory (`vercelSandboxBackend({ networkPolicy: "deny-all" })`) and it applies from creation, including during `bootstrap`. Set it in `onSession`'s `use()` to override per-session. The common pattern combines both: leave the factory open so `bootstrap` can `git clone`, then lock down in `onSession`. And to change the policy mid-turn, call `sandbox.setNetworkPolicy(...)` on the live handle.
+
+Domain-level allow-lists and credential brokering are supported by `vercelSandboxBackend()` and `microsandboxBackend()`. The Docker backend honors only `"allow-all"` and `"deny-all"` (at creation and via `setNetworkPolicy`); the just-bash backend rejects `setNetworkPolicy` entirely.
 
 ## Credential brokering
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [
@@ -36,6 +36,7 @@
   "files": [
     "bin",
     "dist",
+    "docs",
     "CHANGELOG.md",
     "NOTICE",
     "README.md"
@@ -279,6 +280,7 @@
     "jose": "6.2.3",
     "jsonc-parser": "3.3.1",
     "just-bash": "3.0.1",
+    "microsandbox": "0.5.5",
     "next": "16.2.6",
     "picocolors": "1.1.1",
     "react": "19.2.6",
@@ -296,6 +298,8 @@
     "@sveltejs/kit": "^2.0.0",
     "ai": "7.0.0-canary.171",
     "braintrust": "^3.0.0",
+    "just-bash": "^3.0.0",
+    "microsandbox": "^0.5.0",
     "next": "^16.0.0",
     "nuxt": "^4.0.0",
     "react": "^19.0.0",
@@ -313,6 +317,12 @@
     "braintrust": {
       "optional": true
     },
+    "just-bash": {
+      "optional": true
+    },
+    "microsandbox": {
+      "optional": true
+    },
     "next": {
       "optional": true
     },

package/dist/src/compiled/just-bash/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1.  Definitions.
-
-    "License" shall mean the terms and conditions for use, reproduction,
-    and distribution as defined by Sections 1 through 9 of this document.
-
-    "Licensor" shall mean the copyright owner or entity authorized by
-    the copyright owner that is granting the License.
-
-    "Legal Entity" shall mean the union of the acting entity and all
-    other entities that control, are controlled by, or are under common
-    control with that entity. For the purposes of this definition,
-    "control" means (i) the power, direct or indirect, to cause the
-    direction or management of such entity, whether by contract or
-    otherwise, or (ii) ownership of fifty percent (50%) or more of the
-    outstanding shares, or (iii) beneficial ownership of such entity.
-
-    "You" (or "Your") shall mean an individual or Legal Entity
-    exercising permissions granted by this License.
-
-    "Source" form shall mean the preferred form for making modifications,
-    including but not limited to software source code, documentation
-    source, and configuration files.
-
-    "Object" form shall mean any form resulting from mechanical
-    transformation or translation of a Source form, including but
-    not limited to compiled object code, generated documentation,
-    and conversions to other media types.
-
-    "Work" shall mean the work of authorship, whether in Source or
-    Object form, made available under the License, as indicated by a
-    copyright notice that is included in or attached to the work
-    (an example is provided in the Appendix below).
-
-    "Derivative Works" shall mean any work, whether in Source or Object
-    form, that is based on (or derived from) the Work and for which the
-    editorial revisions, annotations, elaborations, or other modifications
-    represent, as a whole, an original work of authorship. For the purposes
-    of this License, Derivative Works shall not include works that remain
-    separable from, or merely link (or bind by name) to the interfaces of,
-    the Work and Derivative Works thereof.
-
-    "Contribution" shall mean any work of authorship, including
-    the original version of the Work and any modifications or additions
-    to that Work or Derivative Works thereof, that is intentionally
-    submitted to Licensor for inclusion in the Work by the copyright owner
-    or by an individual or Legal Entity authorized to submit on behalf of
-    the copyright owner. For the purposes of this definition, "submitted"
-    means any form of electronic, verbal, or written communication sent
-    to the Licensor or its representatives, including but not limited to
-    communication on electronic mailing lists, source code control systems,
-    and issue tracking systems that are managed by, or on behalf of, the
-    Licensor for the purpose of discussing and improving the Work, but
-    excluding communication that is conspicuously marked or otherwise
-    designated in writing by the copyright owner as "Not a Contribution."
-
-    "Contributor" shall mean Licensor and any individual or Legal Entity
-    on behalf of whom a Contribution has been received by Licensor and
-    subsequently incorporated within the Work.
-
-2.  Grant of Copyright License. Subject to the terms and conditions of
-    this License, each Contributor hereby grants to You a perpetual,
-    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-    copyright license to reproduce, prepare Derivative Works of,
-    publicly display, publicly perform, sublicense, and distribute the
-    Work and such Derivative Works in Source or Object form.
-
-3.  Grant of Patent License. Subject to the terms and conditions of
-    this License, each Contributor hereby grants to You a perpetual,
-    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-    (except as stated in this section) patent license to make, have made,
-    use, offer to sell, sell, import, and otherwise transfer the Work,
-    where such license applies only to those patent claims licensable
-    by such Contributor that are necessarily infringed by their
-    Contribution(s) alone or by combination of their Contribution(s)
-    with the Work to which such Contribution(s) was submitted. If You
-    institute patent litigation against any entity (including a
-    cross-claim or counterclaim in a lawsuit) alleging that the Work
-    or a Contribution incorporated within the Work constitutes direct
-    or contributory patent infringement, then any patent licenses
-    granted to You under this License for that Work shall terminate
-    as of the date such litigation is filed.
-
-4.  Redistribution. You may reproduce and distribute copies of the
-    Work or Derivative Works thereof in any medium, with or without
-    modifications, and in Source or Object form, provided that You
-    meet the following conditions:
-
-    (a) You must give any other recipients of the Work or
-    Derivative Works a copy of this License; and
-
-    (b) You must cause any modified files to carry prominent notices
-    stating that You changed the files; and
-
-    (c) You must retain, in the Source form of any Derivative Works
-    that You distribute, all copyright, patent, trademark, and
-    attribution notices from the Source form of the Work,
-    excluding those notices that do not pertain to any part of
-    the Derivative Works; and
-
-    (d) If the Work includes a "NOTICE" text file as part of its
-    distribution, then any Derivative Works that You distribute must
-    include a readable copy of the attribution notices contained
-    within such NOTICE file, excluding those notices that do not
-    pertain to any part of the Derivative Works, in at least one
-    of the following places: within a NOTICE text file distributed
-    as part of the Derivative Works; within the Source form or
-    documentation, if provided along with the Derivative Works; or,
-    within a display generated by the Derivative Works, if and
-    wherever such third-party notices normally appear. The contents
-    of the NOTICE file are for informational purposes only and
-    do not modify the License. You may add Your own attribution
-    notices within Derivative Works that You distribute, alongside
-    or as an addendum to the NOTICE text from the Work, provided
-    that such additional attribution notices cannot be construed
-    as modifying the License.
-
-    You may add Your own copyright statement to Your modifications and
-    may provide additional or different license terms and conditions
-    for use, reproduction, or distribution of Your modifications, or
-    for any such Derivative Works as a whole, provided Your use,
-    reproduction, and distribution of the Work otherwise complies with
-    the conditions stated in this License.
-
-5.  Submission of Contributions. Unless You explicitly state otherwise,
-    any Contribution intentionally submitted for inclusion in the Work
-    by You to the Licensor shall be under the terms and conditions of
-    this License, without any additional terms or conditions.
-    Notwithstanding the above, nothing herein shall supersede or modify
-    the terms of any separate license agreement you may have executed
-    with Licensor regarding such Contributions.
-
-6.  Trademarks. This License does not grant permission to use the trade
-    names, trademarks, service marks, or product names of the Licensor,
-    except as required for reasonable and customary use in describing the
-    origin of the Work and reproducing the content of the NOTICE file.
-
-7.  Disclaimer of Warranty. Unless required by applicable law or
-    agreed to in writing, Licensor provides the Work (and each
-    Contributor provides its Contributions) on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-    implied, including, without limitation, any warranties or conditions
-    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-    PARTICULAR PURPOSE. You are solely responsible for determining the
-    appropriateness of using or redistributing the Work and assume any
-    risks associated with Your exercise of permissions under this License.
-
-8.  Limitation of Liability. In no event and under no legal theory,
-    whether in tort (including negligence), contract, or otherwise,
-    unless required by applicable law (such as deliberate and grossly
-    negligent acts) or agreed to in writing, shall any Contributor be
-    liable to You for damages, including any direct, indirect, special,
-    incidental, or consequential damages of any character arising as a
-    result of this License or out of the use or inability to use the
-    Work (including but not limited to damages for loss of goodwill,
-    work stoppage, computer failure or malfunction, or any and all
-    other commercial damages or losses), even if such Contributor
-    has been advised of the possibility of such damages.
-
-9.  Accepting Warranty or Additional Liability. While redistributing
-    the Work or Derivative Works thereof, You may choose to offer,
-    and charge a fee for, acceptance of support, warranty, indemnity,
-    or other liability obligations and/or rights consistent with this
-    License. However, in accepting such obligations, You may act only
-    on Your own behalf and on Your sole responsibility, not on behalf
-    of any other Contributor, and only if You agree to indemnify,
-    defend, and hold each Contributor harmless for any liability
-    incurred by, or claims asserted against, such Contributor by reason
-    of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-Copyright 2025 Vercel Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.