eve 0.8.6 → 0.9.1

package/docs/guides/deployment.md

@@ -29,10 +29,11 @@ Route-auth secrets never get serialized into the compiled discovery or module-ma
 On Vercel, the [sandbox](../sandbox) runs on hosted [Vercel Sandbox](https://vercel.com/docs/sandbox) infrastructure. Attach the backend on the sandbox definition:
 
 ```ts title="agent/sandbox/sandbox.ts"
-import { defineSandbox, vercelSandboxBackend } from "eve/sandbox";
+import { defineSandbox } from "eve/sandbox";
+import { vercel } from "eve/sandbox/vercel";
 
 export default defineSandbox({
-  backend: vercelSandboxBackend(),
+  backend: vercel(),
 });
 ```
 
@@ -110,7 +111,7 @@ Agent Runs is separate from the OpenTelemetry exporters configured in [`instrume
 
 - [ ] `eve build` succeeds and writes `.vercel/output`.
 - [ ] Provider keys and route-auth secrets are set in Vercel env vars.
-- [ ] The sandbox backend matches the environment (`vercelSandboxBackend()` or `defaultBackend()`).
+- [ ] The sandbox backend matches the environment (`vercel()` or `defaultBackend()`).
 - [ ] Build-time prewarm reused or built templates without failing.
 - [ ] `placeholderAuth()` is replaced with your real policy.
 

package/docs/reference/cli.md

@@ -90,6 +90,8 @@ Pass a bare URL as the only argument and the UI connects to that server instead
 | `--context-size <tokens>`           | Model context window size, shown as a usage percentage                                    |
 | `--logs <mode>`                     | Server/agent logs to show: `all` \| `stderr` \| `sandbox` \| `none`                       |
 
+Local dev writes the active server process ID to `.eve/dev-process.pid`. If another `eve dev` starts for the same agent while that process is still running, Eve exits with a message that includes the command to stop the existing server.
+
 Local dev keeps immutable runtime source snapshots under `.eve/dev-runtime/snapshots/` so in-flight sessions keep a consistent code revision while new prompts pick up rebuilds. `eve dev` prunes stale runtime snapshots and old local sandbox templates in the background on startup; stopping `eve dev` and deleting `.eve/dev-runtime/snapshots/` or `.eve/sandbox-cache/local/templates/` is safe when you want a manual cleanup.
 
 ## `eve link`

package/docs/sandbox.mdx

@@ -90,10 +90,11 @@ To add setup, seed files, or pick a backend, author `defineSandbox`. There are t
 - `agent/sandbox/sandbox.ts`: folder layout. Use it when you also seed `agent/sandbox/workspace/**`. If both exist, the folder layout wins.
 
 ```ts title="agent/sandbox/sandbox.ts"
-import { defineSandbox, vercelSandboxBackend } from "eve/sandbox";
+import { defineSandbox } from "eve/sandbox";
+import { vercel } from "eve/sandbox/vercel";
 
 export default defineSandbox({
-  backend: vercelSandboxBackend({ runtime: "node24", resources: { vcpus: 2 } }),
+  backend: vercel({ runtime: "node24", resources: { vcpus: 2 } }),
   revalidationKey: () => "repo-bootstrap-v1",
   async bootstrap({ use }) {
     const sandbox = await use();
@@ -105,21 +106,21 @@ export default defineSandbox({
 });
 ```
 
-`defineSandbox` lives on `eve/sandbox`. Omit `backend` and the runtime falls back to `defaultBackend()` (see [Backends](#backends)).
+`defineSandbox` and `defaultBackend` live on `eve/sandbox`. Omit `backend` and the runtime falls back to `defaultBackend()` (see [Backends](#backends)).
 
 ## Backends
 
-The backend decides where the sandbox runs. Eve ships four pinned factories plus an availability-aware default from `eve/sandbox`:
+The backend decides where the sandbox runs. Eve ships four pinned factories from nested `eve/sandbox/*` imports plus an availability-aware default from `eve/sandbox`:
 
-| Backend                  | Runs the sandbox                                                                               |
-| ------------------------ | ---------------------------------------------------------------------------------------------- |
-| `vercelSandboxBackend()` | on [Vercel Sandbox](https://vercel.com/docs/sandbox).                                          |
-| `dockerBackend()`        | locally in a Docker container, driven through the `docker` CLI.                                |
-| `microsandboxBackend()`  | locally in a lightweight [microsandbox](https://www.npmjs.com/package/microsandbox) VM.        |
-| `justBashBackend()`      | locally in the pure-JS `just-bash` interpreter — no daemon or VM, but no real binaries either. |
-| `defaultBackend()`       | picks the best available: Vercel Sandbox on hosted Vercel → Docker → microsandbox → just-bash. |
+| Backend            | Runs the sandbox                                                                               |
+| ------------------ | ---------------------------------------------------------------------------------------------- |
+| `vercel()`         | on [Vercel Sandbox](https://vercel.com/docs/sandbox).                                          |
+| `docker()`         | locally in a Docker container, driven through the `docker` CLI.                                |
+| `microsandbox()`   | locally in a lightweight [microsandbox](https://www.npmjs.com/package/microsandbox) VM.        |
+| `justbash()`       | locally in the pure-JS `just-bash` interpreter — no daemon or VM, but no real binaries either. |
+| `defaultBackend()` | picks the best available: Vercel Sandbox on hosted Vercel → Docker → microsandbox → just-bash. |
 
-Configuring a pinned factory uses that backend unconditionally — `dockerBackend()` always requires a reachable Docker daemon, `vercelSandboxBackend()` always creates hosted sandboxes (including from local dev, with Vercel credentials).
+Configuring a pinned factory uses that backend unconditionally — `docker()` always requires a reachable Docker daemon, `vercel()` always creates hosted sandboxes (including from local dev, with Vercel credentials).
 
 With `backend` omitted, Eve uses `defaultBackend()`, which resolves on first use in priority order:
 
@@ -144,15 +145,15 @@ export default defineSandbox({
 
 ### Docker
 
-`dockerBackend()` drives the Docker CLI directly. The default base image is `ghcr.io/vercel/eve:latest`, Eve's published sandbox runtime image; Eve creates `/workspace` and verifies Bash during framework setup before authored bootstrap code runs. Configure it through `dockerBackend({ image, env, pullPolicy, networkPolicy })`; install authored runtime tools in sandbox bootstrap or provide them through a custom image. Templates are committed as local Docker images and reused across sessions when the sandbox source, seed files, `revalidationKey`, and Docker backend options still match; sessions run as long-lived containers whose filesystems persist `/workspace` changes across turns for the same durable session. `eve dev` prunes stale template images in the background.
+`docker()` drives the Docker CLI directly. The default base image is `ghcr.io/vercel/eve:latest`, Eve's published sandbox runtime image; Eve creates `/workspace` and verifies Bash during framework setup before authored bootstrap code runs. Configure it through `docker({ image, env, pullPolicy, networkPolicy })`; install authored runtime tools in sandbox bootstrap or provide them through a custom image. Templates are committed as local Docker images and reused across sessions when the sandbox source, seed files, `revalidationKey`, and Docker backend options still match; sessions run as long-lived containers whose filesystems persist `/workspace` changes across turns for the same durable session. `eve dev` prunes stale template images in the background.
 
 ### microsandbox
 
-`microsandboxBackend()` runs each sandbox in a lightweight local VM with snapshot-backed templates, a `vercel-sandbox` user, and a firewall capable of domain-level network policies and credential brokering — the closest local match to hosted Vercel Sandbox. The default base image is `ghcr.io/vercel/eve:latest`, Eve's published sandbox runtime image; Eve verifies Bash, creates `/workspace`, and creates the sandbox user during framework setup before authored bootstrap code runs. Install authored runtime tools in sandbox bootstrap or provide them through a custom image. Supported hosts: macOS on Apple Silicon, or Linux (glibc) with KVM. The `microsandbox` npm package and its VM runtime are not bundled with Eve: `eve dev` installs both automatically when missing (disable with `setup: { autoInstall: false }`); production processes fail with actionable install errors instead.
+`microsandbox()` runs each sandbox in a lightweight local VM with snapshot-backed templates, a `vercel-sandbox` user, and a firewall capable of domain-level network policies and credential brokering — the closest local match to hosted Vercel Sandbox. The default base image is `ghcr.io/vercel/eve:latest`, Eve's published sandbox runtime image; Eve verifies Bash, creates `/workspace`, and creates the sandbox user during framework setup before authored bootstrap code runs. Install authored runtime tools in sandbox bootstrap or provide them through a custom image. Supported hosts: macOS on Apple Silicon, or Linux (glibc) with KVM. The `microsandbox` npm package and its VM runtime are not bundled with Eve: `eve dev` installs both automatically when missing (disable with `setup: { autoInstall: false }`); production processes fail with actionable install errors instead.
 
 ### just-bash
 
-`justBashBackend()` needs no daemon or VM, but commands run in a simulated bash with a virtual filesystem under `.eve/sandbox-cache/` — no real binaries (`git`, `node`, package managers) and no network isolation. The `just-bash` package is an optional peer dependency: `eve dev` installs it into your application automatically when missing (disable with `autoInstall: false`); production processes fail with an actionable install error instead.
+`justbash()` needs no daemon or VM, but commands run in a simulated bash with a virtual filesystem under `.eve/sandbox-cache/` — no real binaries (`git`, `node`, package managers) and no network isolation. The `just-bash` package is an optional peer dependency: `eve dev` installs it into your application automatically when missing (disable with `autoInstall: false`); production processes fail with an actionable install error instead.
 
 You can write your own backend too: a `SandboxBackend` is just an object with a `name`, a `create`, and an optional `prewarm`. See the `SandboxBackend*` types on `eve/sandbox`.
 
@@ -164,10 +165,11 @@ There are two hooks, scoped differently:
 - **`onSession({ use, ctx })`** is durable-session-scoped and runs once per session. This is where per-session setup goes: network policy, resources, timeout, per-user credentials, one-time markers. Because it runs inside the active runtime context, it can read `ctx.session` and derive the current principal without baking credentials into the template. Call `use(opts?)` to get a `SandboxSession`; `opts` flow to the backend's update path after create.
 
 ```ts
-import { defineSandbox, vercelSandboxBackend } from "eve/sandbox";
+import { defineSandbox } from "eve/sandbox";
+import { vercel } from "eve/sandbox/vercel";
 
 export default defineSandbox({
-  backend: vercelSandboxBackend(),
+  backend: vercel(),
   async onSession({ use, ctx }) {
     const sandbox = await use({ networkPolicy: "deny-all" });
     const user = ctx.session.auth.current;
@@ -193,9 +195,9 @@ networkPolicy: {
 };
 ```
 
-Set it on the factory (`vercelSandboxBackend({ networkPolicy: "deny-all" })`) and it applies before authored `bootstrap` code runs; framework-owned base setup may briefly keep egress open to install required packages. Set it in `onSession`'s `use()` to override per-session. The common pattern combines both: leave the factory open so `bootstrap` can `git clone`, then lock down in `onSession`. And to change the policy mid-turn, call `sandbox.setNetworkPolicy(...)` on the live handle.
+Set it on the factory (`vercel({ networkPolicy: "deny-all" })`) and it applies before authored `bootstrap` code runs; framework-owned base setup may briefly keep egress open to install required packages. Set it in `onSession`'s `use()` to override per-session. The common pattern combines both: leave the factory open so `bootstrap` can `git clone`, then lock down in `onSession`. And to change the policy mid-turn, call `sandbox.setNetworkPolicy(...)` on the live handle.
 
-Domain-level allow-lists and credential brokering are supported by `vercelSandboxBackend()` and `microsandboxBackend()`. The Docker backend honors only `"allow-all"` and `"deny-all"` (at creation and via `setNetworkPolicy`); the just-bash backend rejects `setNetworkPolicy` entirely.
+Domain-level allow-lists and credential brokering are supported by `vercel()` and `microsandbox()`. The Docker backend honors only `"allow-all"` and `"deny-all"` (at creation and via `setNetworkPolicy`); the just-bash backend rejects `setNetworkPolicy` entirely.
 
 ## Credential brokering
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.8.6",
+  "version": "0.9.1",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [
@@ -131,6 +131,26 @@
       "import": "./dist/src/public/sandbox/index.js",
       "default": "./dist/src/public/sandbox/index.js"
     },
+    "./sandbox/docker": {
+      "types": "./dist/src/public/sandbox/docker.d.ts",
+      "import": "./dist/src/public/sandbox/docker.js",
+      "default": "./dist/src/public/sandbox/docker.js"
+    },
+    "./sandbox/just-bash": {
+      "types": "./dist/src/public/sandbox/just-bash.d.ts",
+      "import": "./dist/src/public/sandbox/just-bash.js",
+      "default": "./dist/src/public/sandbox/just-bash.js"
+    },
+    "./sandbox/microsandbox": {
+      "types": "./dist/src/public/sandbox/microsandbox.d.ts",
+      "import": "./dist/src/public/sandbox/microsandbox.js",
+      "default": "./dist/src/public/sandbox/microsandbox.js"
+    },
+    "./sandbox/vercel": {
+      "types": "./dist/src/public/sandbox/vercel.d.ts",
+      "import": "./dist/src/public/sandbox/vercel.js",
+      "default": "./dist/src/public/sandbox/vercel.js"
+    },
     "./evals": {
       "types": "./dist/src/evals/index.d.ts",
       "import": "./dist/src/evals/index.js",
@@ -245,7 +265,8 @@
   },
   "dependencies": {
     "nitro": "3.0.260610-beta",
-    "oxc-parser": "0.134.0"
+    "oxc-parser": "0.134.0",
+    "semver": "7.8.4"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "4.0.0-canary.65",
@@ -269,7 +290,7 @@
     "@workflow/errors": "5.0.0-beta.7",
     "@workflow/world": "5.0.0-beta.9",
     "@workflow/world-local": "5.0.0-beta.16",
-    "ai": "7.0.0-canary.171",
+    "ai": ">=7.0.0-beta.177",
     "autoevals": "0.0.132",
     "chat": "4.29.0",
     "chokidar": "5.0.0",
@@ -297,7 +318,7 @@
   "peerDependencies": {
     "@opentelemetry/api": "^1.0.0",
     "@sveltejs/kit": "^2.0.0",
-    "ai": "7.0.0-canary.171",
+    "ai": ">=7.0.0-beta.177",
     "braintrust": "^3.0.0",
     "just-bash": "^3.0.0",
     "microsandbox": "^0.5.0",
@@ -348,10 +369,11 @@
   },
   "scripts": {
     "clean": "node -e \"fs.rmSync('dist', { recursive: true, force: true })\"",
-    "build": "pnpm run build:js && node ./scripts/copy-docs.mjs && node ./scripts/stamp-version-tokens.mjs",
+    "build": "pnpm run check:bin-runtime-dependencies && pnpm run build:js && node ./scripts/copy-docs.mjs && node ./scripts/stamp-version-tokens.mjs",
     "build:compiled": "node ./scripts/vendor-compiled.mjs",
     "build:js": "pnpm run build:compiled && pnpm run clean && pnpm run build:types && node ./scripts/copy-compiled-assets.mjs && node ./scripts/build-rolldown.mjs",
     "build:types": "pnpm run build:compiled && tsgo -p tsconfig.build.json",
+    "check:bin-runtime-dependencies": "node ./scripts/check-bin-runtime-dependencies.mjs",
     "dev": "pnpm run build:compiled && tsgo -p tsconfig.dev.json --watch --preserveWatchOutput",
     "test": "pnpm run test:unit && pnpm run test:integration",
     "test:integration": "pnpm run build:js && vitest run --config vitest.integration.config.ts",