eve 0.82.0 → 0.83.1

package/dist/src/setup/integrations/discord/daemon.js

@@ -0,0 +1,21 @@
+import{readFile}from"node:fs/promises";import{isErrnoCode,isObject}from"#shared/guards.js";import{formatEveDependencySpecifier,resolveEvePackageContract}from"#setup/scaffold/create/project.js";import{DEFAULT_CONNECT_PACKAGE_VERSION}from"#setup/scaffold/version-tokens.js";const DISCORD_DAEMON_NAME=`discord-gateway`,DISCORD_DAEMON_ROOT=`daemon`;function discordDaemon(e){return{root:DISCORD_DAEMON_ROOT,entrypoint:`Dockerfile`,instances:{[e]:1}}}const DEFAULT_REGION=`iad1`;function discordDaemonFiles(e,t={messageContent:!1}){let n={private:!0,type:`module`,dependencies:{"@vercel/connect":DEFAULT_CONNECT_PACKAGE_VERSION,eve:formatEveDependencySpecifier(resolveEvePackageContract().version)}};return{".dockerignore":`node_modules
+`,Dockerfile:`FROM node:24-slim
+WORKDIR /app
+ENV NODE_ENV=production
+COPY package*.json ./
+RUN npm install --omit=dev --no-audit --no-fund
+COPY main.ts ./
+USER node
+CMD ["node", "main.ts"]
+`,"main.ts":`import { connectDiscordCredentials } from "@vercel/connect/eve";
+import { experimental_runDiscordGatewayRelay } from "eve/channels/discord/gateway";
+
+await experimental_runDiscordGatewayRelay({
+  credentials: connectDiscordCredentials(${JSON.stringify(e)}),
+  // Lets thread follow-ups that don't mention the bot arrive with their text. Needs
+  // Message Content Intent under Bot in the Discord Developer Portal, or Discord refuses the relay.
+  messageContent: ${String(t.messageContent)},
+  // Defaults to the project's production URL; set EVE_URL to relay to \`eve dev\`.
+  url: process.env.EVE_URL,
+});
+`,"package.json":`${JSON.stringify(n,null,2)}\n`}}function discordDaemonEntry(){return`daemons: ${JSON.stringify({[DISCORD_DAEMON_NAME]:discordDaemon(DEFAULT_REGION)})}`}function withDiscordDaemon(e){let t={$schema:`https://openapi.vercel.sh/vercel.json`};if(e!==void 0){let n;try{n=JSON.parse(e)}catch{throw Error(`vercel.json contains invalid JSON; fix it, then run the setup again.`)}if(!isObject(n))throw Error(`vercel.json must contain a JSON object.`);t=n}if(t.daemons!==void 0&&!isObject(t.daemons))throw Error("vercel.json has a `daemons` value that isn't an object; fix it, then run the setup again.");let n=isObject(t.daemons)?t.daemons:{};if(n[`discord-gateway`]!==void 0)return;let r=discordDaemon(Array.isArray(t.regions)&&typeof t.regions[0]==`string`?t.regions[0]:DEFAULT_REGION);return`${JSON.stringify({...t,daemons:{...n,[DISCORD_DAEMON_NAME]:r}},null,2)}\n`}async function readTextFile(e){try{return await readFile(e,`utf8`)}catch(e){if(isErrnoCode(e,`ENOENT`))return;throw e}}export{DISCORD_DAEMON_NAME,DISCORD_DAEMON_ROOT,discordDaemonEntry,discordDaemonFiles,readTextFile,withDiscordDaemon};

package/dist/src/setup/integrations/discord/setup.d.ts

@@ -2,30 +2,50 @@ import type { VercelProjectReference } from "#setup/project-resolution.js";
 import { deriveSlackConnectorSlug } from "#setup/scaffold/index.js";
 import { writeTextFile } from "#setup/scaffold/files.js";
 import { type SetupApplyContext, type SetupPrepareContext } from "../types.js";
-import { configureDiscordInteractionsEndpoint, registerDiscordCommand, resolveDiscordApplication } from "./api.js";
+import { configureDiscordInteractionsEndpoint, enableDiscordMessageContentIntent, registerDiscordCommand, resolveDiscordApplication } from "./api.js";
 import { provisionDiscordConnector } from "./connect.js";
+import { readTextFile } from "./daemon.js";
 export interface DiscordSetupDeps {
     configureEndpoint: typeof configureDiscordInteractionsEndpoint;
     deriveConnectorSlug: typeof deriveSlackConnectorSlug;
+    enableMessageContent: typeof enableDiscordMessageContentIntent;
     provisionConnector: typeof provisionDiscordConnector;
+    readTextFile: typeof readTextFile;
     registerCommand: typeof registerDiscordCommand;
     resolveApplication: typeof resolveDiscordApplication;
     writeTextFile: typeof writeTextFile;
 }
 interface DiscordSetupPlan {
     botToken: string;
-    commandName: string;
-    commandDescription: string;
+    /** The slash command to register; absent when the agent answers messages instead. */
+    command?: {
+        readonly name: string;
+        readonly description: string;
+    };
+    /** How to register the Gateway relay; absent for slash commands only. */
+    gateway?: DiscordGatewayPlan;
     project: VercelProjectReference;
     slug: string;
 }
+/** The project's Vercel config, checked before anything is written. */
+type DiscordGatewayPlan = 
+/** `vercel.json` with the daemon added, or `undefined` when it's already there. */
+{
+    readonly vercelJson: string | undefined;
+}
+/** The project configures Vercel in `vercel.ts`, which setup doesn't edit. */
+ | {
+    readonly vercelTs: {
+        readonly registered: boolean;
+    };
+};
 export declare function prepareDiscordSetup(context: SetupPrepareContext, deps?: DiscordSetupDeps): Promise<DiscordSetupPlan>;
 export declare function applyDiscordSetup(plan: DiscordSetupPlan, context: SetupApplyContext, deps?: DiscordSetupDeps): Promise<{
     deploymentRequired: true;
     facts: {
         label: string;
         value: string;
-        kind: "url";
+        kind?: "url";
     }[];
 }>;
 export declare const DISCORD_SETUP: import("../types.js").SetupIntegration;

package/dist/src/setup/integrations/discord/setup.js

@@ -1,9 +1,10 @@
-import{configureDiscordInteractionsEndpoint,registerDiscordCommand,resolveDiscordApplication}from"./api.js";import{provisionDiscordConnector}from"./connect.js";import{defineSetupIntegration}from"../types.js";import{join}from"node:path";import{deriveSlackConnectorSlug}from"#setup/scaffold/index.js";import{writeTextFile}from"#setup/scaffold/files.js";import{text}from"#setup/ask.js";const defaultDeps={configureEndpoint:configureDiscordInteractionsEndpoint,deriveConnectorSlug:deriveSlackConnectorSlug,provisionConnector:provisionDiscordConnector,registerCommand:registerDiscordCommand,resolveApplication:resolveDiscordApplication,writeTextFile};function validateCommandName(e){let t=e.trim();return t?t.length>32?`Command name must be 32 characters or fewer.`:/^[a-z0-9_-]+$/.test(t)?null:`Use lowercase letters, numbers, hyphens, or underscores.`:`Command name is required.`}function connectTemplate(e){return`import { connectDiscordCredentials } from "@vercel/connect/eve";
+import{configureDiscordInteractionsEndpoint,enableDiscordMessageContentIntent,registerDiscordCommand,resolveDiscordApplication}from"./api.js";import{provisionDiscordConnector}from"./connect.js";import{DISCORD_DAEMON_NAME,DISCORD_DAEMON_ROOT,discordDaemonEntry,discordDaemonFiles,readTextFile,withDiscordDaemon}from"./daemon.js";import{defineSetupIntegration}from"../types.js";import{join,relative}from"node:path";import{deriveSlackConnectorSlug}from"#setup/scaffold/index.js";import{WriteFileExistsError,writeTextFile}from"#setup/scaffold/files.js";import{select,text}from"#setup/ask.js";const defaultDeps={configureEndpoint:configureDiscordInteractionsEndpoint,deriveConnectorSlug:deriveSlackConnectorSlug,enableMessageContent:enableDiscordMessageContentIntent,provisionConnector:provisionDiscordConnector,readTextFile,registerCommand:registerDiscordCommand,resolveApplication:resolveDiscordApplication,writeTextFile};function validateCommandName(e){let t=e.trim();return t?t.length>32?`Command name must be 32 characters or fewer.`:/^[a-z0-9_-]+$/.test(t)?null:`Use lowercase letters, numbers, hyphens, or underscores.`:`Command name is required.`}function connectTemplate(e,t){return`import { connectDiscordCredentials } from "@vercel/connect/eve";
 import { discordChannel } from "eve/channels/discord";
 
 export default discordChannel({
-  credentials: connectDiscordCredentials(${JSON.stringify(e)}),
+  credentials: connectDiscordCredentials(${JSON.stringify(e)}),${t?`
+  gateway: {},`:``}
 });
-`}async function prepareDiscordSetup(e,t=defaultDeps){e.presenter.log.info(`Create a Discord application or open an existing one, then go to Bot → Reset Token and copy the new bot token.
+`}async function prepareDiscordSetup(e,t=defaultDeps){let n=await e.asker.ask(select({key:`discord-messages`,message:`How should people reach the agent in Discord?`,options:[{id:`gateway`,value:`gateway`,label:`DMs, mentions, and threads`,hint:`Adds an experimental Discord Gateway relay that runs as a Vercel Daemon`},{id:`commands`,value:`commands`,label:`A slash command`,hint:`No long-running process`}],recommended:`commands`,required:!0}));e.presenter.log.info(`Create a Discord application or open an existing one, then go to Bot → Reset Token and copy the new bot token.
 Create: https://discord.com/developers/applications?new_application=true
-Existing applications: https://discord.com/developers/applications`);let n=(await e.asker.ask(text({key:`discord-bot-token`,message:`Discord bot token`,required:!0,sensitive:!0,environment:`DISCORD_BOT_TOKEN`}))).trim(),r=await e.asker.ask(text({key:`discord-command-name`,message:`Discord command name`,detected:`ask`,required:!0,validate:validateCommandName})),i=await e.asker.ask(text({key:`discord-command-description`,message:`Discord command description`,detected:`Ask the eve agent`,required:!0,validate:e=>e.trim().length===0?`Command description is required.`:e.trim().length>100?`Command description must be 100 characters or fewer.`:null})),a=await e.resolveVercelProject(`Discord`);return{botToken:n,commandName:r.trim(),commandDescription:i.trim(),project:a,slug:await t.deriveConnectorSlug(e.appRoot)}}async function applyDiscordSetup(e,t,n=defaultDeps){let r=await n.resolveApplication(e.botToken),i=await n.provisionConnector({botToken:e.botToken,log:t.presenter.log,project:e.project,projectRoot:t.projectRoot,slug:e.slug,signal:t.signal});await n.registerCommand(r.id,e.botToken,{name:e.commandName,description:e.commandDescription}),await n.configureEndpoint(e.botToken,i.id),await n.writeTextFile(join(t.appRoot,`agent/channels/discord.ts`),connectTemplate(i.uid),{force:t.force});let a=`https://discord.com/oauth2/authorize?client_id=${encodeURIComponent(r.id)}&scope=bot%20applications.commands&permissions=3072`;return t.presenter.nextSteps([`Install the Discord application, then try /${e.commandName}: ${a}`]),{deploymentRequired:!0,facts:[{label:`Discord application dashboard`,value:`https://discord.com/developers/applications/${r.id}/information`,kind:`url`}]}}const DISCORD_SETUP=defineSetupIntegration({kind:`discord`,label:`Discord`,hint:`Slash commands and interactions`,prepare:prepareDiscordSetup,apply:applyDiscordSetup});export{DISCORD_SETUP,applyDiscordSetup,prepareDiscordSetup};
+Existing applications: https://discord.com/developers/applications`);let r=(await e.asker.ask(text({key:`discord-bot-token`,message:`Discord bot token`,required:!0,sensitive:!0,environment:`DISCORD_BOT_TOKEN`}))).trim(),i=n===`commands`?await askCommand(e):void 0,a=await preflightFiles(e,n===`gateway`,t),o={botToken:r,project:await e.resolveVercelProject(`Discord`),slug:await t.deriveConnectorSlug(e.appRoot)};return i!==void 0&&(o.command=i),a!==void 0&&(o.gateway=a),o}async function askCommand(e){let t=await e.asker.ask(text({key:`discord-command-name`,message:`Discord command name`,detected:`ask`,required:!0,validate:validateCommandName})),n=await e.asker.ask(text({key:`discord-command-description`,message:`Discord command description`,detected:`Ask the eve agent`,required:!0,validate:e=>e.trim().length===0?`Command description is required.`:e.trim().length>100?`Command description must be 100 characters or fewer.`:null}));return{name:t.trim(),description:n.trim()}}async function preflightFiles(e,t,n){let r=[join(e.appRoot,`agent/channels/discord.ts`),...t?Object.keys(discordDaemonFiles(``)).map(t=>join(e.projectRoot,DISCORD_DAEMON_ROOT,t)):[]];if(!e.force){for(let e of r)if(await n.readTextFile(e)!==void 0)throw new WriteFileExistsError(e)}if(!t)return;let i=await n.readTextFile(join(e.projectRoot,`vercel.ts`));return i===void 0?{vercelJson:withDiscordDaemon(await n.readTextFile(join(e.projectRoot,`vercel.json`)))}:{vercelTs:{registered:i.includes(DISCORD_DAEMON_NAME)}}}async function applyDiscordSetup(e,t,n=defaultDeps){let r=await n.resolveApplication(e.botToken),i=await n.provisionConnector({botToken:e.botToken,log:t.presenter.log,project:e.project,projectRoot:t.projectRoot,slug:e.slug,signal:t.signal});e.command!==void 0&&await n.registerCommand(r.id,e.botToken,e.command),await n.configureEndpoint(e.botToken,i.id);let{gateway:a}=e;await n.writeTextFile(join(t.appRoot,`agent/channels/discord.ts`),connectTemplate(i.uid,a!==void 0),{force:t.force});let o=[];if(a!==void 0){let r=await n.enableMessageContent(e.botToken).catch(()=>!1);r||o.push({label:`Enable Message Content`,value:`Discord didn't let setup turn on Message Content Intent, so thread follow-ups must mention the bot. Turn it on under Bot in the Discord Developer Portal, then set messageContent: true in ${DISCORD_DAEMON_ROOT}/main.ts.`});for(let[e,a]of Object.entries(discordDaemonFiles(i.uid,{messageContent:r})))await n.writeTextFile(join(t.projectRoot,DISCORD_DAEMON_ROOT,e),a,{force:t.force});`vercelJson`in a&&a.vercelJson!==void 0&&await n.writeTextFile(join(t.projectRoot,`vercel.json`),a.vercelJson,{force:!0}),`vercelTs`in a&&!a.vercelTs.registered&&o.push({label:`Add to the config ${relative(t.appRoot,join(t.projectRoot,`vercel.ts`))||`vercel.ts`} exports`,value:discordDaemonEntry()})}let s=`https://discord.com/oauth2/authorize?client_id=${encodeURIComponent(r.id)}&scope=bot%20applications.commands&permissions=${a===void 0?`3072`:`309237713920`}`;return t.presenter.nextSteps([e.command===void 0?`Install the bot from its install URL, then DM it or mention it in a channel.`:`Install the bot from its install URL, then try /${e.command.name}.`,...a===void 0?[]:[`Deploy to start the experimental Gateway relay in ${DISCORD_DAEMON_ROOT}/. Run one instance per bot.`]]),{deploymentRequired:!0,facts:[{label:`Discord bot install URL`,value:s,kind:`url`},{label:`Discord application dashboard`,value:`https://discord.com/developers/applications/${r.id}/information`,kind:`url`},...o]}}const DISCORD_SETUP=defineSetupIntegration({kind:`discord`,label:`Discord`,hint:`Messages, DMs, and slash commands`,prepare:prepareDiscordSetup,apply:applyDiscordSetup});export{DISCORD_SETUP,applyDiscordSetup,prepareDiscordSetup};

package/dist/src/setup/integrations/self-modification/setup.js

@@ -1 +1 @@
-import{defineSetupIntegration}from"../types.js";import{describeIntegrationSetupEnvironment}from"../shared/environment.js";import{installScaffoldDependencies}from"../shared/scaffold.js";import{relative}from"node:path";import{ensurePackageDependencies}from"#setup/scaffold/index.js";import{confirm,select,text}from"#setup/ask.js";import{DEPLOYED_SELF_MODIFICATION_CONFIG_PATH,SELF_MODIFICATION_CONFIG_PATH,classifySelfModificationConfig,connectorName,defaultSelfModificationSetupOperations,directoryError,gitRefError,renderSelfModificationConfig,repositoryPartError}from"#self-modification/setup.js";import{detectLegacySelfModificationScaffold,removeLegacySelfModificationScaffold}from"#self-modification/migration.js";import{DEFAULT_CONNECT_PACKAGE_VERSION,DEFAULT_MICROSANDBOX_PACKAGE_VERSION}from"#setup/scaffold/version-tokens.js";const defaultApplyDependencies={ensurePackageDependencies,installScaffoldDependencies},SELF_MODIFICATION_PRODUCTION_DEPENDENCIES={"@vercel/connect":DEFAULT_CONNECT_PACKAGE_VERSION,microsandbox:DEFAULT_MICROSANDBOX_PACKAGE_VERSION};function validationResult(e){return e??null}async function prepareLegacyScaffoldCleanup(e){let t=await detectLegacySelfModificationScaffold(e.appRoot);return t===void 0?void 0:await e.asker.ask(confirm({key:`self-modification-cleanup`,message:`A legacy self-modification scaffold was found at ${relative(e.appRoot,t.root)}. This scaffold format is no longer supported. Do you want to remove it?`,recommended:!0,required:!0}))?t:void 0}function withLegacyScaffold(e,t){return t===void 0?e:{...e,legacyScaffold:t}}async function prepareSelfModificationSetup(e,t=defaultSelfModificationSetupOperations(e.appRoot,void 0,e.projectRoot)){let n=await prepareLegacyScaffoldCleanup(e),r=await t.readConfig();if(classifySelfModificationConfig(r)===`authored`)return e.presenter.note(`The existing ${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH} contains authored configuration and was not overwritten.`,`Manual update required`,{tone:`warning`}),withLegacyScaffold({kind:`authored`},n);if(await e.asker.ask(select({key:`self-modification-mode`,message:`How should self-modification be enabled?`,options:[{id:`deployed`,value:`deployed`,label:`Enable for deployed`,hint:`Let deployed agents propose source changes through draft pull requests`},{id:`local`,value:`local`,label:`Keep local`,hint:`Only enable source editing during local development`}],recommended:`local`,required:!0}))===`local`)return withLegacyScaffold({kind:`local`},n);let[i,a,o]=await Promise.all([e.resolveVercelProject(`self-modification`),t.detectGitRepository(),t.detectChannelNames()]),s=await e.asker.ask(text({key:`self-modification-repository-owner`,message:`GitHub repository owner`,detected:a.owner,required:!0,validate:e=>validationResult(repositoryPartError(e))})),c=await e.asker.ask(text({key:`self-modification-repository-name`,message:`GitHub repository name`,detected:a.repo,required:!0,validate:e=>validationResult(repositoryPartError(e))})),l=await e.asker.ask(text({key:`self-modification-repository-directory`,message:`Application directory relative to the repository root`,detected:a.directory??`.`,required:!0,validate:e=>validationResult(directoryError(e))})),u=await e.asker.ask(text({key:`self-modification-target-branch`,message:`Target branch`,detected:a.branch??`main`,required:!0,validate:e=>validationResult(gitRefError(e))})),d=connectorName(s,c),f={branch:u,channelNames:o,connector:`github/${d}`,directory:l,repository:`github.com/${s}/${c}`,vercelBackend:!0};return e.presenter.note(renderSelfModificationConfig(f),`Generated ${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH}`),e.presenter.note(`Vercel Connect will issue short-lived GitHub App credentials restricted to this repository. Install the managed GitHub App and select only this repository. Review, merge, and deployment remain separate operator boundaries.`,`Security summary`),withLegacyScaffold(await e.asker.ask(confirm({key:`self-modification-confirm`,message:`Create or attach this GitHub connector and write this configuration?`,recommended:!1,required:!0}))?{kind:`deployed`,connectorName:d,project:i,values:f}:{kind:`local`},n)}async function applySelfModificationSetup(e,t,n=defaultSelfModificationSetupOperations(t.appRoot,void 0,t.projectRoot),r=defaultApplyDependencies){if(e.legacyScaffold!==void 0&&(await removeLegacySelfModificationScaffold(t.appRoot,e.legacyScaffold),t.presenter.log.success(`Removed the retired self-modification scaffold.`)),e.kind===`authored`)return{facts:[{label:`Self-modification`,value:`manual configuration update required`}]};if(e.kind===`local`)return{facts:[]};let i=await n.findOrCreateConnector(e.connectorName,e.project);await n.attachConnector(i,e.project);let a=await r.ensurePackageDependencies({dependencies:SELF_MODIFICATION_PRODUCTION_DEPENDENCIES,projectRoot:t.appRoot});return await r.installScaffoldDependencies({changed:a.length>0,log:t.presenter.log,projectPath:t.appRoot,signal:t.signal}),await n.writeConfig(renderSelfModificationConfig({...e.values,connector:i})),t.presenter.log.success(`Updated ${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH}.`),t.presenter.nextSteps([`Install the managed GitHub App for the configured repository, then deploy or redeploy.`,e.values.vercelBackend?`After deployment, try self-modification by running \`eve dev <deployment-url>\` from this linked project. The generated policy admits its Vercel OIDC identity over HTTP; configured channels remain denied until you update \`${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH}\`.`:`Before deployment, configure \`authorize\` in \`${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH}\` to admit a trusted principal for your deployment's channel. After deployment, use that channel to try self-modification.`]),{deploymentRequired:!0,facts:[{label:`Repository`,value:e.values.repository},{label:`Application directory`,value:e.values.directory},{label:`Target branch`,value:e.values.branch},{label:`Credential`,value:i}]}}async function prepareLocalSelfModificationSetup(e,t=defaultSelfModificationSetupOperations(e.appRoot,void 0,e.projectRoot)){let n=await prepareLegacyScaffoldCleanup(e),r=await t.readLocalConfig();return classifySelfModificationConfig(r)===`authored`?(e.presenter.note(`The existing ${SELF_MODIFICATION_CONFIG_PATH} contains authored configuration and was not overwritten.`,`Manual update required`,{tone:`warning`}),withLegacyScaffold({kind:`authored`},n)):withLegacyScaffold({kind:`local`},n)}function describeEnvironment(e){if(e.vercel.kind===`available`)return describeIntegrationSetupEnvironment(e);switch(e.vercel.reason){case`logged-out`:return`No authenticated Vercel account found. Local editing remains available; deployed proposals require Vercel Connect.`;case`cli-missing`:return`Vercel CLI not found. Local editing remains available; deployed proposals require Vercel Connect.`;case`unavailable`:return`Could not verify the Vercel account. Local editing remains available; deployed proposals require Vercel Connect.`}}const SELF_MODIFICATION_SETUP=defineSetupIntegration({kind:`self-modification`,label:`Self-modification`,hint:`Local source editing is enabled`,describeEnvironment,prepare:prepareLocalSelfModificationSetup,apply:applySelfModificationSetup}),SELF_MODIFICATION_PRODUCTION_SETUP=defineSetupIntegration({kind:`self-modification-production`,label:`Self-modification production`,hint:`Configure deployed draft pull requests`,describeEnvironment,prepare:prepareSelfModificationSetup,apply:applySelfModificationSetup});export{SELF_MODIFICATION_PRODUCTION_SETUP,SELF_MODIFICATION_SETUP,applySelfModificationSetup,prepareLocalSelfModificationSetup,prepareSelfModificationSetup};
+import{defineSetupIntegration}from"../types.js";import{describeIntegrationSetupEnvironment}from"../shared/environment.js";import{installScaffoldDependencies}from"../shared/scaffold.js";import{relative}from"node:path";import{ensurePackageDependencies}from"#setup/scaffold/index.js";import{confirm,select,text}from"#setup/ask.js";import{DEFAULT_CONNECT_PACKAGE_VERSION}from"#setup/scaffold/version-tokens.js";import{DEPLOYED_SELF_MODIFICATION_CONFIG_PATH,SELF_MODIFICATION_CONFIG_PATH,classifySelfModificationConfig,connectorName,defaultSelfModificationSetupOperations,directoryError,gitRefError,renderSelfModificationConfig,repositoryPartError}from"#self-modification/setup.js";import{detectLegacySelfModificationScaffold,removeLegacySelfModificationScaffold}from"#self-modification/migration.js";const defaultApplyDependencies={ensurePackageDependencies,installScaffoldDependencies},SELF_MODIFICATION_PRODUCTION_DEPENDENCIES={"@vercel/connect":DEFAULT_CONNECT_PACKAGE_VERSION};function validationResult(e){return e??null}async function prepareLegacyScaffoldCleanup(e){let t=await detectLegacySelfModificationScaffold(e.appRoot);return t===void 0?void 0:await e.asker.ask(confirm({key:`self-modification-cleanup`,message:`A legacy self-modification scaffold was found at ${relative(e.appRoot,t.root)}. This scaffold format is no longer supported. Do you want to remove it?`,recommended:!0,required:!0}))?t:void 0}function withLegacyScaffold(e,t){return t===void 0?e:{...e,legacyScaffold:t}}async function prepareSelfModificationSetup(e,t=defaultSelfModificationSetupOperations(e.appRoot,void 0,e.projectRoot)){let n=await prepareLegacyScaffoldCleanup(e),r=await t.readConfig();if(classifySelfModificationConfig(r)===`authored`)return e.presenter.note(`The existing ${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH} contains authored configuration and was not overwritten.`,`Manual update required`,{tone:`warning`}),withLegacyScaffold({kind:`authored`},n);if(await e.asker.ask(select({key:`self-modification-mode`,message:`How should self-modification be enabled?`,options:[{id:`deployed`,value:`deployed`,label:`Enable for deployed`,hint:`Let deployed agents propose source changes through draft pull requests`},{id:`local`,value:`local`,label:`Keep local`,hint:`Only enable source editing during local development`}],recommended:`local`,required:!0}))===`local`)return withLegacyScaffold({kind:`local`},n);let[i,a,o]=await Promise.all([e.resolveVercelProject(`self-modification`),t.detectGitRepository(),t.detectChannelNames()]),s=await e.asker.ask(text({key:`self-modification-repository-owner`,message:`GitHub repository owner`,detected:a.owner,required:!0,validate:e=>validationResult(repositoryPartError(e))})),c=await e.asker.ask(text({key:`self-modification-repository-name`,message:`GitHub repository name`,detected:a.repo,required:!0,validate:e=>validationResult(repositoryPartError(e))})),l=await e.asker.ask(text({key:`self-modification-repository-directory`,message:`Application directory relative to the repository root`,detected:a.directory??`.`,required:!0,validate:e=>validationResult(directoryError(e))})),u=await e.asker.ask(text({key:`self-modification-target-branch`,message:`Target branch`,detected:a.branch??`main`,required:!0,validate:e=>validationResult(gitRefError(e))})),d=connectorName(s,c),f={branch:u,channelNames:o,connector:`github/${d}`,directory:l,repository:`github.com/${s}/${c}`};return e.presenter.note(renderSelfModificationConfig(f),`Generated ${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH}`),e.presenter.note(`Vercel Connect will issue short-lived GitHub App credentials restricted to this repository. Install the managed GitHub App and select only this repository. Review, merge, and deployment remain separate operator boundaries.`,`Security summary`),withLegacyScaffold(await e.asker.ask(confirm({key:`self-modification-confirm`,message:`Create or attach this GitHub connector and write this configuration?`,recommended:!1,required:!0}))?{kind:`deployed`,connectorName:d,project:i,values:f}:{kind:`local`},n)}async function applySelfModificationSetup(e,t,n=defaultSelfModificationSetupOperations(t.appRoot,void 0,t.projectRoot),r=defaultApplyDependencies){if(e.legacyScaffold!==void 0&&(await removeLegacySelfModificationScaffold(t.appRoot,e.legacyScaffold),t.presenter.log.success(`Removed the retired self-modification scaffold.`)),e.kind===`authored`)return{facts:[{label:`Self-modification`,value:`manual configuration update required`}]};if(e.kind===`local`)return{facts:[]};let i=await n.findOrCreateConnector(e.connectorName,e.project);await n.attachConnector(i,e.project);let a=await r.ensurePackageDependencies({dependencies:SELF_MODIFICATION_PRODUCTION_DEPENDENCIES,projectRoot:t.appRoot});return await r.installScaffoldDependencies({changed:a.length>0,log:t.presenter.log,projectPath:t.appRoot,signal:t.signal}),await n.writeConfig(renderSelfModificationConfig({...e.values,connector:i})),t.presenter.log.success(`Updated ${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH}.`),t.presenter.nextSteps([`Install the managed GitHub App for the configured repository, then deploy or redeploy.`,`After deployment, try self-modification by running \`eve dev <deployment-url>\` from this linked project. The generated policy admits its Vercel OIDC identity over HTTP; configured channels remain denied until you update \`${DEPLOYED_SELF_MODIFICATION_CONFIG_PATH}\`.`]),{deploymentRequired:!0,facts:[{label:`Repository`,value:e.values.repository},{label:`Application directory`,value:e.values.directory},{label:`Target branch`,value:e.values.branch},{label:`Credential`,value:i}]}}async function prepareLocalSelfModificationSetup(e,t=defaultSelfModificationSetupOperations(e.appRoot,void 0,e.projectRoot)){let n=await prepareLegacyScaffoldCleanup(e),r=await t.readLocalConfig();return classifySelfModificationConfig(r)===`authored`?(e.presenter.note(`The existing ${SELF_MODIFICATION_CONFIG_PATH} contains authored configuration and was not overwritten.`,`Manual update required`,{tone:`warning`}),withLegacyScaffold({kind:`authored`},n)):withLegacyScaffold({kind:`local`},n)}function describeEnvironment(e){if(e.vercel.kind===`available`)return describeIntegrationSetupEnvironment(e);switch(e.vercel.reason){case`logged-out`:return`No authenticated Vercel account found. Local editing remains available; deployed proposals require Vercel Connect.`;case`cli-missing`:return`Vercel CLI not found. Local editing remains available; deployed proposals require Vercel Connect.`;case`unavailable`:return`Could not verify the Vercel account. Local editing remains available; deployed proposals require Vercel Connect.`}}const SELF_MODIFICATION_SETUP=defineSetupIntegration({kind:`self-modification`,label:`Self-modification`,hint:`Local source editing is enabled`,describeEnvironment,prepare:prepareLocalSelfModificationSetup,apply:applySelfModificationSetup}),SELF_MODIFICATION_PRODUCTION_SETUP=defineSetupIntegration({kind:`self-modification-production`,label:`Self-modification production`,hint:`Configure deployed draft pull requests`,describeEnvironment,prepare:prepareSelfModificationSetup,apply:applySelfModificationSetup});export{SELF_MODIFICATION_PRODUCTION_SETUP,SELF_MODIFICATION_SETUP,applySelfModificationSetup,prepareLocalSelfModificationSetup,prepareSelfModificationSetup};

package/dist/src/setup/scaffold/create/project.js

@@ -1,4 +1,4 @@
-import{pinnedNodeEngineMajor}from"../../node-engine.js";import{parseChatGptModelSelection}from"../../../shared/chatgpt-model.js";import{SUPPORTED_AUTHORED_MODULE_FILE_EXTENSIONS}from"../update/module-files.js";import{pathExists,writeTextFile}from"../files.js";import{blockingCreateInPlaceEntries}from"../create-in-place.js";import{DEFAULT_CONNECT_PACKAGE_VERSION,resolveVersionToken}from"../version-tokens.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{WEB_CHANNEL_TEMPLATES}from"./web-template.js";import{AGENT_INSTRUCTIONS_TEMPLATE}from"./instructions-template.js";import{SCAFFOLDED_AGENT_PATHS}from"./agent-paths.js";import{mkdir,readdir,stat}from"node:fs/promises";import{basename,join,resolve}from"node:path";const CURRENT_DIRECTORY_PROJECT_NAME=`.`,DEFAULT_AI_PACKAGE_VERSION=`^7.0.137`,DEFAULT_ZOD_PACKAGE_VERSION=`4.5.4`,DEFAULT_EVE_PACKAGE_CONTRACT={version:`0.82.0`,nodeEngine:`>=24`};function resolveEvePackageContract(e=DEFAULT_EVE_PACKAGE_CONTRACT){return{version:resolveVersionToken(`evePackage.version`,e.version),nodeEngine:resolveVersionToken(`evePackage.nodeEngine`,e.nodeEngine)}}function modelProviderSlug(e){let t=(e.split(`/`)[0]??``).replaceAll(/[^A-Za-z0-9._-]/gu,``);return t.length>0?t:`anthropic`}function byokProviderEnvVar(e){let t=modelProviderSlug(e).toUpperCase().replaceAll(/[^A-Z0-9]/gu,`_`);return`${/^[0-9]/.test(t)?`_`:``}${t}_API_KEY`}function agentTemplateFiles(e,t){return{[SCAFFOLDED_AGENT_PATHS.config]:renderAgentTemplate(e,t),[SCAFFOLDED_AGENT_PATHS.channel]:WEB_CHANNEL_TEMPLATES.default,[SCAFFOLDED_AGENT_PATHS.instructions]:AGENT_INSTRUCTIONS_TEMPLATE}}function renderAgentTemplate(e,t){let n=parseChatGptModelSelection(e);return n===void 0?BASE_AGENT_TEMPLATE.replaceAll(`__EVE_INIT_MODEL__`,e).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t)):`import { defineAgent } from "eve";\nimport { chatgpt } from "eve/models/openai";\n\nexport default defineAgent({\n  model: chatgpt(${JSON.stringify(n)}),\n${reasoningTemplateLine(t)}});\n`}function reasoningTemplateLine(e){return e===void 0||e===`provider-default`?``:`  reasoning: "${e}",\n`}function renderTemplate(e,t){return e===BASE_AGENT_TEMPLATE&&parseChatGptModelSelection(t.model)!==void 0?renderAgentTemplate(t.model,t.reasoning):e.replaceAll(`__EVE_INIT_APP_NAME__`,t.appName).replaceAll(`__EVE_INIT_MODEL__`,t.model).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t.reasoning)).replaceAll(`__EVE_INIT_BYOK_PROVIDER__`,modelProviderSlug(t.model)).replaceAll(`__EVE_INIT_BYOK_ENV_VAR__`,byokProviderEnvVar(t.model)).replaceAll(`__EVE_INIT_PACKAGE_VERSION__`,formatEveDependencySpecifier(t.eveVersion)).replaceAll(`__EVE_INIT_AI_SDK_VERSION__`,t.aiPackageVersion).replaceAll(`__EVE_INIT_CONNECT_VERSION__`,t.connectPackageVersion).replaceAll(`__EVE_INIT_ZOD_VERSION__`,t.zodPackageVersion).replaceAll(`__EVE_INIT_TYPESCRIPT_VERSION__`,t.typescriptPackageVersion).replaceAll(`__EVE_INIT_TYPES_NODE_VERSION__`,t.nodeTypesVersion).replaceAll(`__EVE_INIT_NODE_ENGINE__`,t.nodeEngine)}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}const BASE_AGENT_TEMPLATE=`import { defineAgent } from "eve";
+import{pinnedNodeEngineMajor}from"../../node-engine.js";import{parseChatGptModelSelection}from"../../../shared/chatgpt-model.js";import{SUPPORTED_AUTHORED_MODULE_FILE_EXTENSIONS}from"../update/module-files.js";import{pathExists,writeTextFile}from"../files.js";import{blockingCreateInPlaceEntries}from"../create-in-place.js";import{DEFAULT_CONNECT_PACKAGE_VERSION,resolveVersionToken}from"../version-tokens.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{WEB_CHANNEL_TEMPLATES}from"./web-template.js";import{AGENT_INSTRUCTIONS_TEMPLATE}from"./instructions-template.js";import{SCAFFOLDED_AGENT_PATHS}from"./agent-paths.js";import{mkdir,readdir,stat}from"node:fs/promises";import{basename,join,resolve}from"node:path";const CURRENT_DIRECTORY_PROJECT_NAME=`.`,DEFAULT_AI_PACKAGE_VERSION=`^7.0.137`,DEFAULT_ZOD_PACKAGE_VERSION=`4.5.4`,DEFAULT_EVE_PACKAGE_CONTRACT={version:`0.83.1`,nodeEngine:`>=24`};function resolveEvePackageContract(e=DEFAULT_EVE_PACKAGE_CONTRACT){return{version:resolveVersionToken(`evePackage.version`,e.version),nodeEngine:resolveVersionToken(`evePackage.nodeEngine`,e.nodeEngine)}}function modelProviderSlug(e){let t=(e.split(`/`)[0]??``).replaceAll(/[^A-Za-z0-9._-]/gu,``);return t.length>0?t:`anthropic`}function byokProviderEnvVar(e){let t=modelProviderSlug(e).toUpperCase().replaceAll(/[^A-Z0-9]/gu,`_`);return`${/^[0-9]/.test(t)?`_`:``}${t}_API_KEY`}function agentTemplateFiles(e,t){return{[SCAFFOLDED_AGENT_PATHS.config]:renderAgentTemplate(e,t),[SCAFFOLDED_AGENT_PATHS.channel]:WEB_CHANNEL_TEMPLATES.default,[SCAFFOLDED_AGENT_PATHS.instructions]:AGENT_INSTRUCTIONS_TEMPLATE}}function renderAgentTemplate(e,t){let n=parseChatGptModelSelection(e);return n===void 0?BASE_AGENT_TEMPLATE.replaceAll(`__EVE_INIT_MODEL__`,e).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t)):`import { defineAgent } from "eve";\nimport { chatgpt } from "eve/models/openai";\n\nexport default defineAgent({\n  model: chatgpt(${JSON.stringify(n)}),\n${reasoningTemplateLine(t)}});\n`}function reasoningTemplateLine(e){return e===void 0||e===`provider-default`?``:`  reasoning: "${e}",\n`}function renderTemplate(e,t){return e===BASE_AGENT_TEMPLATE&&parseChatGptModelSelection(t.model)!==void 0?renderAgentTemplate(t.model,t.reasoning):e.replaceAll(`__EVE_INIT_APP_NAME__`,t.appName).replaceAll(`__EVE_INIT_MODEL__`,t.model).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t.reasoning)).replaceAll(`__EVE_INIT_BYOK_PROVIDER__`,modelProviderSlug(t.model)).replaceAll(`__EVE_INIT_BYOK_ENV_VAR__`,byokProviderEnvVar(t.model)).replaceAll(`__EVE_INIT_PACKAGE_VERSION__`,formatEveDependencySpecifier(t.eveVersion)).replaceAll(`__EVE_INIT_AI_SDK_VERSION__`,t.aiPackageVersion).replaceAll(`__EVE_INIT_CONNECT_VERSION__`,t.connectPackageVersion).replaceAll(`__EVE_INIT_ZOD_VERSION__`,t.zodPackageVersion).replaceAll(`__EVE_INIT_TYPESCRIPT_VERSION__`,t.typescriptPackageVersion).replaceAll(`__EVE_INIT_TYPES_NODE_VERSION__`,t.nodeTypesVersion).replaceAll(`__EVE_INIT_NODE_ENGINE__`,t.nodeEngine)}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}const BASE_AGENT_TEMPLATE=`import { defineAgent } from "eve";
 
 export default defineAgent({
   model: "__EVE_INIT_MODEL__",

package/dist/src/setup/scaffold/update/web-options.js

@@ -1 +1 @@
-import{DEFAULT_EVE_PACKAGE_CONTRACT}from"../create/project.js";function resolveWebPackageVersions(e,t){return{evePackage:e?.evePackage??DEFAULT_EVE_PACKAGE_CONTRACT,aiPackageVersion:e?.aiPackageVersion??`^7.0.137`,betterAuthPackageVersion:e?.betterAuthPackageVersion??`1.6.26`,nextPackageVersion:e?.nextPackageVersion??(t===`sign-in-with-vercel`?`16.3.0`:`16.3.4`),reactPackageVersion:e?.reactPackageVersion??`19.2.6`,reactDomPackageVersion:e?.reactDomPackageVersion??`19.2.6`,streamdownPackageVersion:e?.streamdownPackageVersion??`2.5.0`,zodPackageVersion:e?.zodPackageVersion??`4.5.4`,typesReactPackageVersion:e?.typesReactPackageVersion??`19.2.15`,typesReactDomPackageVersion:e?.typesReactDomPackageVersion??`19.2.3`}}export{resolveWebPackageVersions};
+import{DEFAULT_EVE_PACKAGE_CONTRACT}from"../create/project.js";function resolveWebPackageVersions(e,t){return{evePackage:e?.evePackage??DEFAULT_EVE_PACKAGE_CONTRACT,aiPackageVersion:e?.aiPackageVersion??`^7.0.137`,betterAuthPackageVersion:e?.betterAuthPackageVersion??`1.6.26`,nextPackageVersion:e?.nextPackageVersion??(t===`sign-in-with-vercel`?`16.3.0`:`16.3.8`),reactPackageVersion:e?.reactPackageVersion??`19.2.6`,reactDomPackageVersion:e?.reactDomPackageVersion??`19.2.6`,streamdownPackageVersion:e?.streamdownPackageVersion??`2.5.0`,zodPackageVersion:e?.zodPackageVersion??`4.5.4`,typesReactPackageVersion:e?.typesReactPackageVersion??`19.2.15`,typesReactDomPackageVersion:e?.typesReactDomPackageVersion??`19.2.3`}}export{resolveWebPackageVersions};

package/dist/src/setup/scaffold/version-tokens.d.ts

@@ -1,5 +1,4 @@
 export declare const DEFAULT_CONNECT_PACKAGE_VERSION = "2.5.2";
-export declare const DEFAULT_MICROSANDBOX_PACKAGE_VERSION = "0.5.5";
 /**
  * Returns a scaffold version value, resolving a build-stamp token at the point
  * of need when the running code is unstamped. The published package is stamped

package/dist/src/setup/scaffold/version-tokens.js

@@ -1 +1 @@
-import{existsSync,readFileSync,realpathSync}from"node:fs";import{dirname,join}from"node:path";import{fileURLToPath}from"node:url";function versionToken(e){return`__${e}_VERSION__`}function bareToken(e){return`__${e}__`}const NODE_ENGINE_TOKEN=bareToken(`NODE_ENGINE`),DEFAULT_CONNECT_PACKAGE_VERSION=`2.5.2`,DEFAULT_MICROSANDBOX_PACKAGE_VERSION=`0.5.5`,TOKEN_SOURCES={[versionToken(`EVE_PACKAGE`)]:{kind:`eve-version`},[versionToken(`EVE_PACKAGE_DEPENDENCY`)]:{kind:`eve-version`},[NODE_ENGINE_TOKEN]:{kind:`eve-node-engine`},[versionToken(`AI_SDK`)]:{kind:`catalog`,packageName:`ai`},[versionToken(`NEXT`)]:{kind:`catalog`,packageName:`next`},[versionToken(`REACT`)]:{kind:`catalog`,packageName:`react`},[versionToken(`REACT_DOM`)]:{kind:`catalog`,packageName:`react-dom`},[versionToken(`STREAMDOWN`)]:{kind:`catalog`,packageName:`streamdown`},[versionToken(`ZOD`)]:{kind:`catalog`,packageName:`zod`},[versionToken(`TYPESCRIPT`)]:{kind:`catalog`,packageName:`typescript`},[versionToken(`TYPES_REACT`)]:{kind:`catalog`,packageName:`@types/react`},[versionToken(`TYPES_REACT_DOM`)]:{kind:`catalog`,packageName:`@types/react-dom`}},resolvedTokens=new Map;function findEvePackageRoot(){let e=dirname(realpathSync(fileURLToPath(import.meta.url)));for(;;){let t=join(e,`package.json`);if(existsSync(t)&&JSON.parse(readFileSync(t,`utf8`)).name===`eve`)return e;let n=dirname(e);if(n===e)return;e=n}}function findWorkspaceManifest(e){let t=e;for(;;){let e=join(t,`pnpm-workspace.yaml`);if(existsSync(e))return e;let n=dirname(t);if(n===t)return;t=n}}function readCatalogVersion(e,t){let n=readFileSync(e,`utf8`).split(/\r?\n/),r=!1;for(let e of n){if(/^catalog:\s*$/.test(e)){r=!0;continue}if(!r)continue;if(/^\S/.test(e))break;let n=e.match(/^\s+(?:"([^"]+)"|([\w@/.-]+)):\s*"([^"]+)"/);if(n&&(n[1]??n[2])===t)return n[3]}}function resolveTokenFromDevTree(e){let t=TOKEN_SOURCES[e];if(t!==void 0)try{let e=findEvePackageRoot();if(e===void 0||!existsSync(join(e,`scripts/stamp-version-tokens.mjs`)))return;if(t.kind===`eve-version`){let t=JSON.parse(readFileSync(join(e,`package.json`),`utf8`));return typeof t.version==`string`?t.version:void 0}if(t.kind===`eve-node-engine`){let t=JSON.parse(readFileSync(join(e,`package.json`),`utf8`)).engines?.node;return typeof t==`string`?t:void 0}let n=findWorkspaceManifest(e);return n===void 0?void 0:readCatalogVersion(n,t.packageName)}catch{return}}function resolveVersionToken(e,t){if(!t.startsWith(`__`))return t;let n=resolvedTokens.get(t);if(n!==void 0)return n;let r=resolveTokenFromDevTree(t);if(r===void 0)throw Error(`Scaffold received unstamped version token (${e}=${t}). Build eve before using its dist entrypoint.`);return resolvedTokens.set(t,r),r}export{DEFAULT_CONNECT_PACKAGE_VERSION,DEFAULT_MICROSANDBOX_PACKAGE_VERSION,resolveVersionToken};
+import{existsSync,readFileSync,realpathSync}from"node:fs";import{dirname,join}from"node:path";import{fileURLToPath}from"node:url";function versionToken(e){return`__${e}_VERSION__`}function bareToken(e){return`__${e}__`}const NODE_ENGINE_TOKEN=bareToken(`NODE_ENGINE`),DEFAULT_CONNECT_PACKAGE_VERSION=`2.5.2`,TOKEN_SOURCES={[versionToken(`EVE_PACKAGE`)]:{kind:`eve-version`},[versionToken(`EVE_PACKAGE_DEPENDENCY`)]:{kind:`eve-version`},[NODE_ENGINE_TOKEN]:{kind:`eve-node-engine`},[versionToken(`AI_SDK`)]:{kind:`catalog`,packageName:`ai`},[versionToken(`NEXT`)]:{kind:`catalog`,packageName:`next`},[versionToken(`REACT`)]:{kind:`catalog`,packageName:`react`},[versionToken(`REACT_DOM`)]:{kind:`catalog`,packageName:`react-dom`},[versionToken(`STREAMDOWN`)]:{kind:`catalog`,packageName:`streamdown`},[versionToken(`ZOD`)]:{kind:`catalog`,packageName:`zod`},[versionToken(`TYPESCRIPT`)]:{kind:`catalog`,packageName:`typescript`},[versionToken(`TYPES_REACT`)]:{kind:`catalog`,packageName:`@types/react`},[versionToken(`TYPES_REACT_DOM`)]:{kind:`catalog`,packageName:`@types/react-dom`}},resolvedTokens=new Map;function findEvePackageRoot(){let e=dirname(realpathSync(fileURLToPath(import.meta.url)));for(;;){let t=join(e,`package.json`);if(existsSync(t)&&JSON.parse(readFileSync(t,`utf8`)).name===`eve`)return e;let n=dirname(e);if(n===e)return;e=n}}function findWorkspaceManifest(e){let t=e;for(;;){let e=join(t,`pnpm-workspace.yaml`);if(existsSync(e))return e;let n=dirname(t);if(n===t)return;t=n}}function readCatalogVersion(e,t){let n=readFileSync(e,`utf8`).split(/\r?\n/),r=!1;for(let e of n){if(/^catalog:\s*$/.test(e)){r=!0;continue}if(!r)continue;if(/^\S/.test(e))break;let n=e.match(/^\s+(?:"([^"]+)"|([\w@/.-]+)):\s*"([^"]+)"/);if(n&&(n[1]??n[2])===t)return n[3]}}function resolveTokenFromDevTree(e){let t=TOKEN_SOURCES[e];if(t!==void 0)try{let e=findEvePackageRoot();if(e===void 0||!existsSync(join(e,`scripts/stamp-version-tokens.mjs`)))return;if(t.kind===`eve-version`){let t=JSON.parse(readFileSync(join(e,`package.json`),`utf8`));return typeof t.version==`string`?t.version:void 0}if(t.kind===`eve-node-engine`){let t=JSON.parse(readFileSync(join(e,`package.json`),`utf8`)).engines?.node;return typeof t==`string`?t:void 0}let n=findWorkspaceManifest(e);return n===void 0?void 0:readCatalogVersion(n,t.packageName)}catch{return}}function resolveVersionToken(e,t){if(!t.startsWith(`__`))return t;let n=resolvedTokens.get(t);if(n!==void 0)return n;let r=resolveTokenFromDevTree(t);if(r===void 0)throw Error(`Scaffold received unstamped version token (${e}=${t}). Build eve before using its dist entrypoint.`);return resolvedTokens.set(t,r),r}export{DEFAULT_CONNECT_PACKAGE_VERSION,resolveVersionToken};

package/dist/src/shared/agent-definition.d.ts

@@ -70,6 +70,8 @@ export type InternalAgentModelDefinition = {
     contextWindowTokens?: number;
     maxOutputTokens?: number;
     source?: ModuleSourceRef;
+    /** Field of the `source` agent config export that holds this model; absent means `model`. */
+    sourceField?: "compaction.model";
     providerOptions?: Record<string, JsonObject>;
     promptCache?: AgentPromptCacheDefinition;
 };

package/dist/src/shared/built-server-start-failure.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Detects a built eve server that reported a failed start in `output`.
+ *
+ * srvx only logs a failed bind and sets `process.exitCode`, so the process can
+ * stay alive without serving anything. Callers must treat this output as fatal
+ * and stop the process themselves.
+ */
+export declare function readBuiltServerStartFailure(output: string, listen: {
+    readonly host: string;
+    readonly port: number | string;
+    readonly retryHint: string;
+}): Error | undefined;

package/dist/src/shared/built-server-start-failure.js

@@ -0,0 +1,3 @@
+function readBuiltServerStartFailure(e,t){let n=e.indexOf(`[srvx] Failed to start server:`),r=n===-1?-1:e.indexOf(`
+`,n);if(r===-1)return;let i=e.slice(n);return e.slice(n,r).includes(`EADDRINUSE`)?Error(`Port ${String(t.port)} on ${t.host} is already in use. Another process is listening there; stop it or ${t.retryHint}.`):Error([`Built eve server failed to start on ${t.host}:${String(t.port)}.`,i].join(`
+`))}export{readBuiltServerStartFailure};

package/dist/src/shared/framework-eve-server.d.ts

@@ -26,6 +26,8 @@ export declare function startEveProductionServer(input: {
     readonly appRoot: string;
     readonly host: EveFrameworkHost;
     readonly origin: string;
+    /** How to pick another port, completing "stop it or ..." when the port is taken. */
+    readonly portRetryHint: string;
 }): Promise<EveProcessHandle>;
 /**
  * Resolve a shared eve dev server for `appRoot`, reusing a healthy registered

package/dist/src/shared/framework-eve-server.js

@@ -1,2 +1,2 @@
-import{mkdir,open,readFile,rm,stat,writeFile}from"node:fs/promises";import{isLoopbackHostname}from"#shared/network-address.js";import{existsSync}from"node:fs";import{join}from"node:path";import{resolvePackageRoot}from"#internal/application/package.js";import{spawn}from"node:child_process";import{readDevelopmentRuntimeArtifactsRevision}from"#services/dev-client/runtime-artifacts.js";const DEFAULT_EVE_SERVER_TIMEOUT_MS=18e4,ANSI_ESCAPE_PATTERN=RegExp(`\x1B\\[[0-?]*[ -/]*[@-~]`,`g`),SERVER_URL_CANDIDATE_PATTERN=/https?:\/\/[^\s"'<>]+/g;function normalizeOrigin(e){return new URL(e).origin}function isNodeErrorWithCode(e,t){return e instanceof Error&&`code`in e&&e.code===t}function delay(e){return new Promise(t=>setTimeout(t,e))}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function resolveEveCacheDirectory(e){return join(e,`.eve`)}function resolveEveDevServerRegistryPath(e,t){return join(resolveEveCacheDirectory(e),`${t.slug}-dev-server.json`)}function resolveEveDevServerLockPath(e,t){return join(resolveEveCacheDirectory(e),`${t.slug}-dev-server.lock`)}function resolveDevServerTimeout(e,t){if(e!==void 0){if(!Number.isFinite(e)||e<=0)throw Error(`eve ${t.label} development server timeout must be a positive number.`);return e}}function normalizeDevServerRegistry(e){if(isRecord(e)&&typeof e.appRoot==`string`&&typeof e.origin==`string`&&typeof e.updatedAt==`string`&&(e.pid===null||typeof e.pid==`number`))try{return{appRoot:e.appRoot,origin:normalizeOrigin(e.origin),pid:e.pid,updatedAt:e.updatedAt}}catch{return}}async function readUsableEveDevServerRegistry(e,t){try{let n=normalizeDevServerRegistry(JSON.parse(await readFile(resolveEveDevServerRegistryPath(e,t),`utf8`)));return n===void 0||n.appRoot!==e||await readDevelopmentRuntimeArtifactsRevision({serverUrl:n.origin,timeoutMs:1e3})===void 0?void 0:n.origin}catch(e){if(isNodeErrorWithCode(e,`ENOENT`))return;throw e}}async function writeEveDevServerRegistry(e,t,n){await mkdir(resolveEveCacheDirectory(e),{recursive:!0}),await writeFile(resolveEveDevServerRegistryPath(e,t),`${JSON.stringify({appRoot:e,origin:n.origin,pid:n.process?.pid??null,updatedAt:new Date().toISOString()},null,2)}\n`)}async function removeStaleEveDevServerLock(e){try{let t=await stat(e);Date.now()-t.mtimeMs>3e4&&await rm(e,{force:!0})}catch(e){if(!isNodeErrorWithCode(e,`ENOENT`))throw e}}async function acquireEveDevServerLock(e,t,n){let r=resolveEveCacheDirectory(e),i=resolveEveDevServerLockPath(e,t),a=Date.now()+n;for(await mkdir(r,{recursive:!0});;)try{let e=await open(i,`wx`);return await e.writeFile(`${String(process.pid)}\n`),await e.close(),async()=>{await rm(i,{force:!0})}}catch(r){if(!isNodeErrorWithCode(r,`EEXIST`))throw r;if(await readUsableEveDevServerRegistry(e,t)!==void 0)return async()=>{};if(await removeStaleEveDevServerLock(i),Date.now()>a)throw Error(`Timed out after ${n}ms waiting for another ${t.label} process to start eve.`);await delay(100)}}function createEveBinaryPath(){return join(resolvePackageRoot(),`bin`,`eve.js`)}function parseLocalServerOrigin(e){let t=URL.parse(e);if(!(t===null||t.protocol!==`http:`&&t.protocol!==`https:`||!isLoopbackHostname(t.hostname)||t.port.length===0))return t.origin}function findLocalServerOrigin(e){for(let t of e.matchAll(SERVER_URL_CANDIDATE_PATTERN)){let e=parseLocalServerOrigin(t[0]);if(e!==void 0)return e}}function formatEveDevOutputLine(e,t){let n=e.replace(/\r$/,``),r=n.replace(ANSI_ESCAPE_PATTERN,``).trim();if(r.length===0||/^☰eve\b/.test(r)||r===`CONFIGURATION_FIELD_CONFLICT`||r.startsWith(`[CONFIGURATION_FIELD_CONFLICT]`))return;let i=t===void 0?`[eve:dev]`:`[eve:dev:${t}]`,a=/server listening at\s+(https?:\/\/[^\s]+)/i.exec(n);return a===null?`${i} ${n}`:`${i} server listening at ${a[1]}`}function createEveDevOutputWriter(e){let t=``,writeLine=t=>{let n=formatEveDevOutputLine(t,e.logLabel);n!==void 0&&e.stream.write(`${n}\n`)};return{flush(){t.length!==0&&(writeLine(t),t=``)},write(e){t+=e.toString(`utf8`);let n=t.split(`
-`);t=n.pop()??``;for(let e of n)writeLine(e)}}}function startServerProcess(e){let t=e.timeoutMs??18e4;return new Promise((n,r)=>{let i=spawn(e.command,e.args,{cwd:e.cwd,env:{...process.env,...e.env},stdio:[`ignore`,`pipe`,`pipe`]}),a=createEveDevOutputWriter({logLabel:e.logLabel,stream:process.stderr}),o=createEveDevOutputWriter({logLabel:e.logLabel,stream:process.stdout}),s=setTimeout(()=>{i.kill(),r(Error(`Timed out after ${t}ms waiting for eve to print its server URL.`))},t),cleanup=()=>{clearTimeout(s),i.off(`error`,handleError),i.off(`exit`,handleEarlyExit)},flushOutput=()=>{o.flush(),a.flush()},handleError=e=>{flushOutput(),cleanup(),r(e)},handleEarlyExit=(e,t)=>{flushOutput(),cleanup(),r(Error(`eve server process exited before printing its server URL (code ${String(e)}, signal ${String(t)}).`))},handleOutput=e=>{let t=findLocalServerOrigin(e.toString(`utf8`));t!==void 0&&(cleanup(),n({origin:t,process:i}))};i.once(`error`,handleError),i.once(`exit`,handleEarlyExit),i.stdout.on(`data`,e=>{o.write(e),handleOutput(e)}),i.stderr.on(`data`,e=>{a.write(e),handleOutput(e)})})}function installProcessShutdown(e){let t=e.process;if(t===void 0)return e;let close=()=>{t.killed||t.kill()};return process.once(`beforeExit`,close),process.once(`exit`,close),e}function startEveDevServer(e){return startServerProcess({args:[createEveBinaryPath(),`dev`,`--no-ui`,`--port`,`0`,...e.workspaceAgentName===void 0?[]:[`--agent`,e.workspaceAgentName]],command:process.execPath,cwd:e.appRoot,logLabel:e.logLabel,timeoutMs:e.timeoutMs}).then(installProcessShutdown)}function startEveProductionServer(e){let t=new URL(e.origin),n=t.port,r=join(e.appRoot,`.output`,`server`,`index.mjs`);if(!existsSync(r))throw Error(`eve production output is missing at ${r}. Run eve build from ${e.appRoot} before starting ${e.host.label}.`);return startServerProcess({args:[r],command:process.execPath,cwd:e.appRoot,env:{HOST:t.hostname,NITRO_HOST:t.hostname,NITRO_PORT:n,PORT:n}}).then(installProcessShutdown)}async function resolveSharedEveDevServer(e){let t=e.timeoutMs??18e4,n=await readUsableEveDevServerRegistry(e.appRoot,e.host);if(n!==void 0)return{origin:n};let r=await acquireEveDevServerLock(e.appRoot,e.host,t);try{let n=await readUsableEveDevServerRegistry(e.appRoot,e.host);if(n!==void 0)return{origin:n};let r=await startEveDevServer({appRoot:e.appRoot,logLabel:e.logLabel,timeoutMs:t,workspaceAgentName:e.workspaceAgentName});return await writeEveDevServerRegistry(e.appRoot,e.host,r),r}finally{await r()}}export{DEFAULT_EVE_SERVER_TIMEOUT_MS,resolveDevServerTimeout,resolveSharedEveDevServer,startEveProductionServer};
+import{mkdir,open,readFile,rm,stat,writeFile}from"node:fs/promises";import{isLoopbackHostname}from"#shared/network-address.js";import{existsSync}from"node:fs";import{join}from"node:path";import{resolvePackageRoot}from"#internal/application/package.js";import{spawn}from"node:child_process";import{readDevelopmentRuntimeArtifactsRevision}from"#services/dev-client/runtime-artifacts.js";import{readBuiltServerStartFailure}from"#shared/built-server-start-failure.js";const DEFAULT_EVE_SERVER_TIMEOUT_MS=18e4,ANSI_ESCAPE_PATTERN=RegExp(`\x1B\\[[0-?]*[ -/]*[@-~]`,`g`),SERVER_URL_CANDIDATE_PATTERN=/https?:\/\/[^\s"'<>]+/g;function normalizeOrigin(e){return new URL(e).origin}function isNodeErrorWithCode(e,t){return e instanceof Error&&`code`in e&&e.code===t}function delay(e){return new Promise(t=>setTimeout(t,e))}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function resolveEveCacheDirectory(e){return join(e,`.eve`)}function resolveEveDevServerRegistryPath(e,t){return join(resolveEveCacheDirectory(e),`${t.slug}-dev-server.json`)}function resolveEveDevServerLockPath(e,t){return join(resolveEveCacheDirectory(e),`${t.slug}-dev-server.lock`)}function resolveDevServerTimeout(e,t){if(e!==void 0){if(!Number.isFinite(e)||e<=0)throw Error(`eve ${t.label} development server timeout must be a positive number.`);return e}}function normalizeDevServerRegistry(e){if(isRecord(e)&&typeof e.appRoot==`string`&&typeof e.origin==`string`&&typeof e.updatedAt==`string`&&(e.pid===null||typeof e.pid==`number`))try{return{appRoot:e.appRoot,origin:normalizeOrigin(e.origin),pid:e.pid,updatedAt:e.updatedAt}}catch{return}}async function readUsableEveDevServerRegistry(e,t){try{let n=normalizeDevServerRegistry(JSON.parse(await readFile(resolveEveDevServerRegistryPath(e,t),`utf8`)));return n===void 0||n.appRoot!==e||await readDevelopmentRuntimeArtifactsRevision({serverUrl:n.origin,timeoutMs:1e3})===void 0?void 0:n.origin}catch(e){if(isNodeErrorWithCode(e,`ENOENT`))return;throw e}}async function writeEveDevServerRegistry(e,t,n){await mkdir(resolveEveCacheDirectory(e),{recursive:!0}),await writeFile(resolveEveDevServerRegistryPath(e,t),`${JSON.stringify({appRoot:e,origin:n.origin,pid:n.process?.pid??null,updatedAt:new Date().toISOString()},null,2)}\n`)}async function removeStaleEveDevServerLock(e){try{let t=await stat(e);Date.now()-t.mtimeMs>3e4&&await rm(e,{force:!0})}catch(e){if(!isNodeErrorWithCode(e,`ENOENT`))throw e}}async function acquireEveDevServerLock(e,t,n){let r=resolveEveCacheDirectory(e),i=resolveEveDevServerLockPath(e,t),a=Date.now()+n;for(await mkdir(r,{recursive:!0});;)try{let e=await open(i,`wx`);return await e.writeFile(`${String(process.pid)}\n`),await e.close(),async()=>{await rm(i,{force:!0})}}catch(r){if(!isNodeErrorWithCode(r,`EEXIST`))throw r;if(await readUsableEveDevServerRegistry(e,t)!==void 0)return async()=>{};if(await removeStaleEveDevServerLock(i),Date.now()>a)throw Error(`Timed out after ${n}ms waiting for another ${t.label} process to start eve.`);await delay(100)}}function createEveBinaryPath(){return join(resolvePackageRoot(),`bin`,`eve.js`)}function parseLocalServerOrigin(e){let t=URL.parse(e);if(!(t===null||t.protocol!==`http:`&&t.protocol!==`https:`||!isLoopbackHostname(t.hostname)||t.port.length===0))return t.origin}function findLocalServerOrigin(e){for(let t of e.matchAll(SERVER_URL_CANDIDATE_PATTERN)){let e=parseLocalServerOrigin(t[0]);if(e!==void 0)return e}}function formatEveDevOutputLine(e,t){let n=e.replace(/\r$/,``),r=n.replace(ANSI_ESCAPE_PATTERN,``).trim();if(r.length===0||/^☰eve\b/.test(r)||r===`CONFIGURATION_FIELD_CONFLICT`||r.startsWith(`[CONFIGURATION_FIELD_CONFLICT]`))return;let i=t===void 0?`[eve:dev]`:`[eve:dev:${t}]`,a=/server listening at\s+(https?:\/\/[^\s]+)/i.exec(n);return a===null?`${i} ${n}`:`${i} server listening at ${a[1]}`}function createEveDevOutputWriter(e){let t=``,writeLine=t=>{let n=formatEveDevOutputLine(t,e.logLabel);n!==void 0&&e.stream.write(`${n}\n`)};return{flush(){t.length!==0&&(writeLine(t),t=``)},write(e){t+=e.toString(`utf8`);let n=t.split(`
+`);t=n.pop()??``;for(let e of n)writeLine(e)}}}function startServerProcess(e){let t=e.timeoutMs??18e4;return new Promise((n,r)=>{let i=spawn(e.command,e.args,{cwd:e.cwd,env:{...process.env,...e.env},stdio:[`ignore`,`pipe`,`pipe`]}),a=createEveDevOutputWriter({logLabel:e.logLabel,stream:process.stderr}),o=createEveDevOutputWriter({logLabel:e.logLabel,stream:process.stdout}),s=setTimeout(()=>{i.kill(),r(Error(`Timed out after ${t}ms waiting for eve to print its server URL.`))},t),c=!1,l=``,cleanup=()=>{c=!0,l=``,clearTimeout(s),i.off(`error`,handleError),i.off(`exit`,handleEarlyExit)},flushOutput=()=>{o.flush(),a.flush()},handleError=e=>{flushOutput(),cleanup(),r(e)},handleEarlyExit=(e,t)=>{flushOutput(),cleanup(),r(Error(`eve server process exited before printing its server URL (code ${String(e)}, signal ${String(t)}).`))},handleOutput=t=>{if(c)return;let a=t.toString(`utf8`);l+=a;let o=e.listen===void 0?void 0:readBuiltServerStartFailure(l,e.listen);if(o!==void 0){flushOutput(),cleanup(),i.kill(),r(o);return}let s=findLocalServerOrigin(a);s!==void 0&&(cleanup(),n({origin:s,process:i}))};i.once(`error`,handleError),i.once(`exit`,handleEarlyExit),i.stdout.on(`data`,e=>{o.write(e),handleOutput(e)}),i.stderr.on(`data`,e=>{a.write(e),handleOutput(e)})})}function installProcessShutdown(e){let t=e.process;if(t===void 0)return e;let close=()=>{t.killed||t.kill()};return process.once(`beforeExit`,close),process.once(`exit`,close),e}function startEveDevServer(e){return startServerProcess({args:[createEveBinaryPath(),`dev`,`--no-ui`,`--port`,`0`,...e.workspaceAgentName===void 0?[]:[`--agent`,e.workspaceAgentName]],command:process.execPath,cwd:e.appRoot,logLabel:e.logLabel,timeoutMs:e.timeoutMs}).then(installProcessShutdown)}function startEveProductionServer(e){let t=new URL(e.origin),n=t.port,r=join(e.appRoot,`.output`,`server`,`index.mjs`);if(!existsSync(r))throw Error(`eve production output is missing at ${r}. Run eve build from ${e.appRoot} before starting ${e.host.label}.`);return startServerProcess({args:[r],command:process.execPath,cwd:e.appRoot,env:{HOST:t.hostname,NITRO_HOST:t.hostname,NITRO_PORT:n,PORT:n},listen:{host:t.hostname,port:n,retryHint:e.portRetryHint}}).then(installProcessShutdown)}async function resolveSharedEveDevServer(e){let t=e.timeoutMs??18e4,n=await readUsableEveDevServerRegistry(e.appRoot,e.host);if(n!==void 0)return{origin:n};let r=await acquireEveDevServerLock(e.appRoot,e.host,t);try{let n=await readUsableEveDevServerRegistry(e.appRoot,e.host);if(n!==void 0)return{origin:n};let r=await startEveDevServer({appRoot:e.appRoot,logLabel:e.logLabel,timeoutMs:t,workspaceAgentName:e.workspaceAgentName});return await writeEveDevServerRegistry(e.appRoot,e.host,r),r}finally{await r()}}export{DEFAULT_EVE_SERVER_TIMEOUT_MS,resolveDevServerTimeout,resolveSharedEveDevServer,startEveProductionServer};

package/dist/src/shared/sandbox-environment.d.ts

@@ -1,9 +1,8 @@
 import type { SessionAuth, SessionParent, SessionTurn } from "#context/keys.js";
-import type { SandboxProviderRuntime } from "#shared/sandbox-provider.js";
+import type { SandboxProviderRuntime } from "#sandbox/provider.js";
 import type { RuntimeSandboxSession, RuntimeSandboxSessionFor, SandboxSession } from "#shared/sandbox-session.js";
 declare const ENVIRONMENT: unique symbol;
 declare const PROVIDER_RUNTIME: unique symbol;
-declare const CONFIGURATION_HASH: unique symbol;
 export interface SandboxSelectorContext {
     readonly session: {
         readonly auth: SessionAuth;
@@ -15,9 +14,9 @@ export interface SandboxSelectorContext {
 export type SandboxSelector = (context: SandboxSelectorContext) => Promise<RuntimeSandboxSession> | RuntimeSandboxSession;
 export type SandboxOpenArguments<Options> = Options extends undefined ? [] : Record<never, never> extends Options ? [options?: Options] : [options: Options];
 export interface SandboxEnvironmentIdentity {
-    readonly [CONFIGURATION_HASH]: string;
     readonly [ENVIRONMENT]: true;
-    readonly [PROVIDER_RUNTIME]: SandboxProviderRuntime;
+    /** A {@link SandboxProviderRuntime}, opaque so the public type does not carry core internals. */
+    readonly [PROVIDER_RUNTIME]: unknown;
     readonly provider: string;
 }
 export interface SandboxEnvironment<Options extends object | undefined = object, Session extends SandboxSession = SandboxSession> extends SandboxEnvironmentIdentity {
@@ -25,17 +24,12 @@ export interface SandboxEnvironment<Options extends object | undefined = object,
 }
 interface ConstructorRuntime {
     open(input: {
-        readonly configurationHash: string;
         readonly environment: object;
-        readonly environmentConfigurationHash: string;
         readonly options: object | undefined;
         readonly provider: SandboxProviderRuntime;
     }): Promise<RuntimeSandboxSession>;
 }
-export declare function createSandboxEnvironment<Options extends object | undefined = object, Session extends SandboxSession = SandboxSession>(input: {
-    readonly configuration?: unknown;
-    readonly runtime: SandboxProviderRuntime;
-}): SandboxEnvironment<Options, Session>;
+export declare function createSandboxEnvironment<Options extends object | undefined = object, Session extends SandboxSession = SandboxSession>(runtime: SandboxProviderRuntime): SandboxEnvironment<Options, Session>;
 export declare function getSandboxEnvironmentRuntime(environment: SandboxEnvironmentIdentity): SandboxProviderRuntime;
 export declare function bindSandboxEnvironment(selector: SandboxSelector, environment: SandboxEnvironmentIdentity): SandboxSelector;
 export declare function getBoundSandboxEnvironment(value: unknown): SandboxEnvironmentIdentity | undefined;

package/dist/src/shared/sandbox-environment.js

@@ -1 +1 @@
-import{createHash}from"node:crypto";import{ContextContainer,contextStorage}from"#context/container.js";const ENVIRONMENT=Symbol.for(`eve.sandbox-environment`),PROVIDER_RUNTIME=Symbol.for(`eve.sandbox-provider-runtime`),CONFIGURATION_HASH=Symbol.for(`eve.sandbox-environment-configuration-hash`),SELECTOR_ENVIRONMENT=Symbol.for(`eve.sandbox-selector-environment`),RUNTIMES=Symbol.for(`eve.sandbox-constructor-runtimes`),globals=globalThis,runtimes=globals[RUNTIMES]??=new WeakMap;function createSandboxEnvironment(e){let t;return t={[CONFIGURATION_HASH]:hashConstructorOptions({environment:e.configuration,sandbox:{}}),[ENVIRONMENT]:!0,[PROVIDER_RUNTIME]:e.runtime,provider:e.runtime.providerName,async open(...n){let r=n[0],i=contextStorage.getStore(),a=i===void 0?void 0:runtimes.get(i);if(a===void 0)throw Error(`Sandbox environments can only open sandboxes inside defineSandbox().`);return await a.open({configurationHash:hashConstructorOptions({environment:e.configuration,sandbox:r}),environment:t,environmentConfigurationHash:t[CONFIGURATION_HASH],options:r,provider:e.runtime})}},t}function hashConstructorOptions(e){return createHash(`sha256`).update(stableSerialize(e)).digest(`hex`)}function stableSerialize(e,t=new WeakSet){if(e===null||typeof e==`boolean`||typeof e==`number`||typeof e==`string`)return JSON.stringify(e);if(typeof e==`function`)return`function:${e.toString()}`;if(Array.isArray(e))return`[${e.map(e=>stableSerialize(e,t)).join(`,`)}]`;if(typeof e==`object`){if(t.has(e))return`[circular]`;t.add(e);let n=e.constructor?.name??`Object`,r=`{${Object.entries(e).sort(([e],[t])=>e.localeCompare(t)).map(([e,n])=>`${JSON.stringify(e)}:${stableSerialize(n,t)}`).join(`,`)}}`;return t.delete(e),`${n}:${r}`}return typeof e}function getSandboxEnvironmentRuntime(e){return e[PROVIDER_RUNTIME]}function bindSandboxEnvironment(e,t){return Object.defineProperty(e,SELECTOR_ENVIRONMENT,{value:t}),e}function getBoundSandboxEnvironment(e){let t=typeof e==`function`?Reflect.get(e,SELECTOR_ENVIRONMENT):void 0;return isSandboxEnvironment(t)?t:void 0}function isSandboxEnvironment(e){return typeof e==`object`&&!!e&&Reflect.get(e,ENVIRONMENT)===!0&&typeof Reflect.get(e,`provider`)==`string`&&typeof Reflect.get(e,`open`)==`function`}async function runWithSandboxConstructorRuntime(e,t){let n=contextStorage.getStore(),r=n??new ContextContainer,i=runtimes.get(r);runtimes.set(r,e);try{return n===void 0?await contextStorage.run(r,t):await t()}finally{i===void 0?runtimes.delete(r):runtimes.set(r,i)}}export{bindSandboxEnvironment,createSandboxEnvironment,getBoundSandboxEnvironment,getSandboxEnvironmentRuntime,isSandboxEnvironment,runWithSandboxConstructorRuntime};
+import{ContextContainer,contextStorage}from"#context/container.js";const ENVIRONMENT=Symbol.for(`eve.sandbox-environment`),PROVIDER_RUNTIME=Symbol.for(`eve.sandbox-provider-runtime`),SELECTOR_ENVIRONMENT=Symbol.for(`eve.sandbox-selector-environment`),RUNTIMES=Symbol.for(`eve.sandbox-constructor-runtimes`),globals=globalThis,runtimes=globals[RUNTIMES]??=new WeakMap;function createSandboxEnvironment(e){let t={[ENVIRONMENT]:!0,[PROVIDER_RUNTIME]:e,provider:e.providerName,async open(...n){let r=n[0],i=contextStorage.getStore(),a=i===void 0?void 0:runtimes.get(i);if(a===void 0)throw Error("Sandbox environments can only open sandboxes inside defineSandbox(). Use `ctx.getSandbox()` to reach the session's sandbox from tools and other runtime code.");return await a.open({environment:t,options:r,provider:e})}};return t}function getSandboxEnvironmentRuntime(e){return e[PROVIDER_RUNTIME]}function bindSandboxEnvironment(e,t){return Object.defineProperty(e,SELECTOR_ENVIRONMENT,{value:t}),e}function getBoundSandboxEnvironment(e){let t=typeof e==`function`?Reflect.get(e,SELECTOR_ENVIRONMENT):void 0;return isSandboxEnvironment(t)?t:void 0}function isSandboxEnvironment(e){return typeof e==`object`&&!!e&&Reflect.get(e,ENVIRONMENT)===!0&&typeof Reflect.get(e,`provider`)==`string`&&typeof Reflect.get(e,`open`)==`function`}async function runWithSandboxConstructorRuntime(e,t){let n=contextStorage.getStore(),r=n??new ContextContainer,i=runtimes.get(r);runtimes.set(r,e);try{return n===void 0?await contextStorage.run(r,t):await t()}finally{i===void 0?runtimes.delete(r):runtimes.set(r,i)}}export{bindSandboxEnvironment,createSandboxEnvironment,getBoundSandboxEnvironment,getSandboxEnvironmentRuntime,isSandboxEnvironment,runWithSandboxConstructorRuntime};

package/dist/src/shared/sandbox-network-policy.d.ts

@@ -1,11 +1,9 @@
-import type * as Vercel from "#compiled/@vercel/sandbox/index.js";
 /**
  * Firewall network policy applied to a live sandbox session.
  *
- * eve-owned alias of the provider network-policy shape. Use it to restrict
- * egress (`"deny-all"`, an allow-list) or to broker credentials onto
- * outgoing requests. A per-domain `transform` injects headers at the
- * firewall so secrets never enter the sandbox process:
+ * Use it to restrict egress (`"deny-all"`, an allow-list) or to broker
+ * credentials onto outgoing requests. A per-domain `transform` injects
+ * headers at the firewall so secrets never enter the sandbox process:
  *
  * ```ts
  * import { environment } from "../sandbox";
@@ -19,11 +17,49 @@ import type * as Vercel from "#compiled/@vercel/sandbox/index.js";
  * });
  * ```
  *
- * The Docker provider honors only the coarse `"allow-all"` and
- * `"deny-all"` policies. just-bash environments do not expose
- * `setNetworkPolicy` because their network policy is fixed at sandbox creation.
+ * A provider rejects any part of a policy it cannot enforce instead of
+ * weakening it. The Docker provider honors only `"allow-all"` and
+ * `"deny-all"`.
  */
-export type SandboxNetworkPolicy = Vercel.NetworkPolicy;
+export type SandboxNetworkPolicy = "allow-all" | "deny-all" | {
+    /** Allowed domains, or a map from domain to the rules applied to its requests. */
+    readonly allow?: readonly string[] | Readonly<Record<string, readonly SandboxNetworkRule[]>>;
+    readonly subnets?: {
+        readonly allow?: readonly string[];
+        readonly deny?: readonly string[];
+    };
+};
+/** Exactly one of `transform` (inject headers) or `forwardURL` (proxy the request). */
+export type SandboxNetworkRule = {
+    readonly match?: SandboxNetworkMatch;
+} & ({
+    readonly transform: readonly {
+        readonly headers?: Readonly<Record<string, string>>;
+    }[];
+} | {
+    readonly forwardURL: string;
+});
+/** Which requests a {@link SandboxNetworkRule} applies to. */
+export interface SandboxNetworkMatch {
+    readonly headers?: readonly {
+        readonly key?: SandboxNetworkMatcher;
+        readonly value?: SandboxNetworkMatcher;
+    }[];
+    readonly method?: readonly string[];
+    readonly path?: SandboxNetworkMatcher;
+    readonly queryString?: readonly {
+        readonly key?: SandboxNetworkMatcher;
+        readonly value?: SandboxNetworkMatcher;
+    }[];
+}
+/** Sets exactly one of `exact`, `startsWith`, or `regex`. */
+export type SandboxNetworkMatcher = {
+    readonly exact: string;
+} | {
+    readonly startsWith: string;
+} | {
+    readonly regex: string;
+};
 /** Initial network configuration shared by network-capable sandbox providers. */
 export interface SandboxNetworkOptions {
     readonly networkPolicy?: SandboxNetworkPolicy;

package/dist/src/shared/sandbox-provider.d.ts

@@ -1,5 +1,3 @@
-import { type SandboxEnvironment, type SandboxSelectorContext } from "#shared/sandbox-environment.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
 export interface SandboxDeleteOptions {
     readonly abortSignal?: AbortSignal;
 }
@@ -7,113 +5,12 @@ export interface SandboxProviderResourceFile {
     readonly content: string | Uint8Array;
     readonly relativePath: string;
 }
-export interface SandboxProviderResourceTree {
-    readonly files: readonly SandboxProviderResourceFile[];
-    readonly key: string;
-    readonly mountPath: string;
-    readonly targetPath: string;
-}
-export type SandboxProviderResourceSource = {
-    readonly kind: "none";
-} | {
-    readonly key: string;
-    readonly kind: "inline";
-} | {
-    readonly key: string;
-    readonly kind: "materialized";
-    readonly path: string;
-};
-export interface SandboxProviderResources {
-    readonly skills?: SandboxProviderResourceTree;
-    readonly source: SandboxProviderResourceSource;
-    readonly workspace?: SandboxProviderResourceTree;
-}
-export declare function sandboxProviderResourceIdentity(resources: SandboxProviderResources): object;
-export interface SandboxProviderTargetFile {
-    readonly content: string | Uint8Array;
-    readonly path: string;
-}
-export declare function providerResourceTargetFiles(resources: SandboxProviderResources): SandboxProviderTargetFile[];
 export type SandboxPreparedArtifact = null | boolean | number | string | readonly SandboxPreparedArtifact[] | {
     readonly [key: string]: SandboxPreparedArtifact;
 };
 export declare function isSandboxPreparedArtifact(value: unknown): value is SandboxPreparedArtifact;
-export declare function isSandboxPreparedArtifactRecord(artifact: unknown): artifact is {
-    readonly [key: string]: SandboxPreparedArtifact;
-};
 export interface SandboxProviderFiles {
     list(): Promise<readonly string[]>;
     read(path: string): Promise<Uint8Array>;
     readText(path: string): Promise<string>;
 }
-export interface SandboxProviderHost {
-    loadOptionalPackage<T>(input: {
-        readonly autoInstall: boolean;
-        readonly importModule: () => Promise<T>;
-        readonly installPackageName?: string;
-        readonly ignoredOptionalDependencies?: readonly string[];
-        readonly missingMessage: string;
-        readonly packageName: string;
-    }): Promise<T>;
-    resolveProjectPath(path: string): string;
-}
-export interface SandboxProviderPrepareContext {
-    readonly files: SandboxProviderFiles;
-    readonly host: SandboxProviderHost;
-    readonly log?: (message: string) => void;
-    readonly resources: SandboxProviderResources;
-    readonly sourceRevision: string;
-    readonly storagePath: string;
-}
-export interface SandboxProviderSessionContext {
-    readonly host: SandboxProviderHost;
-    readonly session: SandboxSelectorContext["session"];
-    readonly storagePath: string;
-}
-export interface SandboxProviderHandle<Session extends SandboxSession = SandboxSession> {
-    readonly sandbox: Session;
-    onRuntimeShutdown(): Promise<void>;
-    onSandboxDelete(options?: SandboxDeleteOptions): Promise<void>;
-    onSandboxStop(): Promise<void>;
-}
-export interface SandboxProviderImplementation<OpenOptions extends object | undefined, PreparedArtifact extends SandboxPreparedArtifact, SessionState, Session extends SandboxSession = SandboxSession> {
-    /**
-     * Permanently releases resources owned by a durable session after its terminal outcome.
-     * Implementations must be idempotent because the cleanup step may retry.
-     */
-    onSessionEnd?(context: SandboxProviderSessionContext, artifact: Readonly<PreparedArtifact>, state: Readonly<SessionState>, options: {
-        readonly reason: "completed" | "expired" | "failed";
-    }): Promise<void>;
-    prepare(context: SandboxProviderPrepareContext): Promise<PreparedArtifact>;
-    resume(context: SandboxProviderSessionContext, artifact: Readonly<PreparedArtifact>, state: Readonly<SessionState>): Promise<SandboxProviderHandle<Session>>;
-    start(context: SandboxProviderSessionContext, options: Readonly<OpenOptions> | undefined, artifact: Readonly<PreparedArtifact>): Promise<{
-        readonly handle: SandboxProviderHandle<Session>;
-        readonly state: SessionState;
-    }>;
-}
-type SandboxOptionArguments<Options extends object | undefined> = Options extends undefined ? [options?: undefined] : Record<never, never> extends Options ? [options?: Readonly<Options>] : [options: Readonly<Options>];
-export type SandboxProviderDefinition<EnvironmentOptions extends object | undefined, OpenOptions extends object | undefined, PreparedArtifact extends SandboxPreparedArtifact, SessionState, Session extends SandboxSession> = {
-    readonly name: string;
-    readonly stateProtocolVersion?: number;
-    environment(...args: SandboxOptionArguments<EnvironmentOptions>): SandboxProviderImplementation<OpenOptions, PreparedArtifact, SessionState, Session>;
-};
-export interface SandboxProvider<EnvironmentOptions extends object | undefined, OpenOptions extends object | undefined, Session extends SandboxSession> {
-    readonly name: string;
-    environment(...args: SandboxOptionArguments<EnvironmentOptions>): SandboxEnvironment<OpenOptions, Session>;
-}
-type ErasedSandboxProviderImplementation = SandboxProviderImplementation<object | undefined, SandboxPreparedArtifact, SandboxPreparedArtifact, SandboxSession>;
-export interface SandboxProviderRuntime {
-    readonly implementation: ErasedSandboxProviderImplementation;
-    readonly providerName: string;
-    readonly stateProtocolVersion: number;
-}
-export declare function defineSandboxProvider<EnvironmentOptions extends object | undefined = undefined, OpenOptions extends object | undefined = undefined, PreparedArtifact extends SandboxPreparedArtifact = SandboxPreparedArtifact, SessionState = SandboxPreparedArtifact, Session extends SandboxSession = SandboxSession>(definition: SandboxProviderDefinition<EnvironmentOptions, OpenOptions, PreparedArtifact, SessionState, Session>): SandboxProvider<EnvironmentOptions, OpenOptions, Session>;
-export declare function createSandboxProviderResources(input: {
-    readonly resourcesKey?: string;
-    readonly resourcesPath?: string;
-    readonly seedFiles?: readonly {
-        readonly content: string | Uint8Array;
-        readonly path: string;
-    }[];
-}): SandboxProviderResources;
-export {};

package/dist/src/shared/sandbox-provider.js

@@ -1 +1 @@
-import{createSandboxEnvironment}from"#shared/sandbox-environment.js";function sandboxProviderResourceIdentity(e){return{skills:e.skills?.key,workspace:e.workspace?.key}}function providerResourceTargetFiles(e){return[e.workspace,e.skills].flatMap(e=>e===void 0?[]:e.files.map(t=>({content:t.content,path:`${e.targetPath}/${t.relativePath}`})))}function isSandboxPreparedArtifact(e){return e===null||typeof e==`boolean`||typeof e==`number`||typeof e==`string`?!0:Array.isArray(e)?e.every(isSandboxPreparedArtifact):typeof e==`object`&&!!e&&Object.values(e).every(isSandboxPreparedArtifact)}function isSandboxPreparedArtifactRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function defineSandboxProvider(e){let t=e.stateProtocolVersion??1;return{name:e.name,environment(...n){return createSandboxEnvironment({configuration:n[0],runtime:{implementation:eraseSandboxProviderImplementation(e.environment(...n)),providerName:e.name,stateProtocolVersion:t}})}}}function eraseSandboxProviderImplementation(e){return e}function createSandboxProviderResources(e){if(e.resourcesKey===void 0)return{source:{kind:`none`}};let t=e.seedFiles??[],n=e.resourcesPath===void 0?{key:e.resourcesKey,kind:`inline`}:{key:e.resourcesKey,kind:`materialized`,path:e.resourcesPath};return{skills:createResourceTree({files:t.filter(e=>e.path.startsWith(`$HOME/.agents/skills/`)),key:`${e.resourcesKey}:skills`,mountPath:`/eve/resources/skills`,prefix:`$HOME/.agents/skills/`,targetPath:`$HOME/.agents/skills`}),source:n,workspace:createResourceTree({files:t.filter(e=>!e.path.startsWith(`$HOME/.agents/skills/`)),key:`${e.resourcesKey}:workspace`,mountPath:`/eve/resources/workspace`,prefix:`/workspace/`,targetPath:`/workspace`})}}function createResourceTree(e){return{files:e.files.map(t=>({content:t.content,relativePath:t.path.startsWith(e.prefix)?t.path.slice(e.prefix.length):t.path})),key:e.key,mountPath:e.mountPath,targetPath:e.targetPath}}export{createSandboxProviderResources,defineSandboxProvider,isSandboxPreparedArtifact,isSandboxPreparedArtifactRecord,providerResourceTargetFiles,sandboxProviderResourceIdentity};
+function isSandboxPreparedArtifact(e){return e===null||typeof e==`boolean`||typeof e==`number`||typeof e==`string`?!0:Array.isArray(e)?e.every(isSandboxPreparedArtifact):typeof e==`object`&&!!e&&Object.values(e).every(isSandboxPreparedArtifact)}export{isSandboxPreparedArtifact};

package/dist/src/shared/sandbox-recorded-data-error.d.ts

@@ -0,0 +1,4 @@
+/** A provider's recorded session state does not match the shape this eve version writes. */
+export declare function invalidSandboxSessionStateError(label: string): Error;
+/** A provider's prepared artifact from `eve build` does not match the shape this eve version writes. */
+export declare function invalidPreparedSandboxArtifactError(label: string): Error;

package/dist/src/shared/sandbox-recorded-data-error.js

@@ -0,0 +1 @@
+function invalidSandboxSessionStateError(e){return Error(`Invalid ${e} session state. This session's recorded sandbox state does not match the format this eve version expects, usually because the session started under a different eve version. Start a new session to get a fresh sandbox.`)}function invalidPreparedSandboxArtifactError(e){return Error(`Invalid prepared ${e} artifact. The artifact recorded by \`eve build\` does not match the format this eve version expects, usually because the build used a different eve version. Run \`eve build\` with the eve version this runtime uses, then redeploy.`)}export{invalidPreparedSandboxArtifactError,invalidSandboxSessionStateError};

package/dist/src/shared/sandbox-session-gone-error.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Thrown by a provider's `resume()` when the session's native sandbox no
+ * longer exists. eve then clears the session's sandbox state and reruns the
+ * sandbox selector, which starts a fresh sandbox, as it would after
+ * `sandbox.delete()`. Throw it only for a sandbox that is gone; other
+ * failures must surface unchanged.
+ */
+export declare class SandboxSessionGoneError extends Error {
+    constructor(message: string);
+    /** Also matches an error from another copy of this class, such as one a provider bundles. */
+    static is(error: unknown): error is SandboxSessionGoneError;
+}

package/dist/src/shared/sandbox-session-gone-error.js

@@ -0,0 +1 @@
+var SandboxSessionGoneError=class SandboxSessionGoneError extends Error{constructor(e){super(e),this.name=`SandboxSessionGoneError`}static is(e){return e instanceof SandboxSessionGoneError||e instanceof Error&&e.name===`SandboxSessionGoneError`}};export{SandboxSessionGoneError};