[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
eve (source)	^0.30.8 → ^0.91.0

---

Release Notes

vercel/eve (eve)

v0.91.0

Compare Source

Released 2026-10-30 · Compare with 0.90.0

Breaking Changes

• session.clear() now cancels a running turn and every working task before it clears history, instead of waiting for the turn to finish.
  Previously a clear sent while a turn waited on tasks didn't run until the tasks finished, and never ran if one hung. Tasks a clear stops end with task.ended outcome: "cancelled", and no task result the cleared conversation hadn't read reaches the next turn. (#​5619)

Features

• Hooks can start a session's next turn with ctx.continue() from turn.settled and * handlers.
  Other handlers don't receive it. It continues a completed turn, or a turn the same hook cancelled, and hooks that continue one turn share its next turn. It takes MessageContent with session.send()'s context and an optional auth, returns { queued } synchronously, and yields to any other turn, cancel, clear, or reset that comes first. delivery.admitted records source: { channel, hook }. (#​5555)

Bug Fixes

• The bash tool now keeps only the last 50 KiB of each output stream while a command runs, so a verbose command no longer holds its whole stdout and stderr in memory.
  Very large output no longer fails with Cannot create a string longer than 0x1fffffe8 characters. Output past the limit is noted as earlier output omitted, as it already was for commands left running.
  Thanks @​mrud for reporting this in #​5651. (#​5653)
• HTTP Basic auth now compares the username and password in constant time on every request, so response timing no longer reveals whether the username matched. (#​5521)
• Anthropic agents no longer fail with a 400 when the model calls a server tool, such as web_search or programmatic code_execution, beside a local tool.
  Anthropic runs that server tool after the local results arrive and returns its result at the start of the next response, so the next request must end on those local results. Until that result arrives, eve now holds a message that steers the turn for one model step, holds changed catalog or skill announcements, sends an empty-response retry's note as a system instruction, and keeps compaction from separating the deferred result from its call or adding a resumption message after the local results. When the result can no longer arrive, because the turn was cancelled, failed, or retried, or a new turn starts, eve answers the server call as one whose outcome is unknown, so the model reads the new message right away.
  Thanks @​jam3gw for reporting this in #​4890. (#​4891)
• A Discord display: "select" request with an option id longer than 100 characters now fails with a clear error instead of posting a select whose truncated value came back as an id the request never offered, which dropped or mismatched the user's choice. (#​5533)
• Sessions now fail controls their eve version does not support, so the control's delivery settles failed instead of never settling. (#​5622)
• A provider tool result that arrives in the response after its call, such as an Anthropic tool search the model started beside a local tool, now settles the call the earlier step introduced.
  Previously eve published that call a second time, so with the session-event checker on (eve dev, eve eval, or EVE_CHECK_SESSION_EVENTS=1) the step failed with introduced-twice, and without it the session log recorded one call introduced twice. (#​5648)
• A turn cancellation raised while the model is being resolved now cancels the turn instead of failing the session with MODEL_SELECTION_FAILED, even when it arrives before the turn's abort signal fires.
  Thanks @​burn2delete for reporting this and proposing the fix in #​4273. (#​4274)
• Session steps now return only the session projection rows they changed, instead of every row of each changed table, so a step's stored output no longer grows with the calls and parts the turn already settled.
  Thanks @​mrud for reporting this in #​5635. (#​5642)
• Slack approval and question cards now show their prompt, tool input, and answer as literal text.
  A model-written <!channel> or <url|label> in a prompt or tool input no longer notifies the channel or hides a link's real destination from the approver. Card(...) rendering is unchanged. (#​5517)
• A connection in agent/connections/*.ts now keeps an approval written as { request, response, prompt }, so its tools ask for approval and run its response policy.
  Previously only the function form was kept and the object form was dropped, so the connection's tools ran without asking anyone. A malformed approval now fails resolution instead of being ignored. (#​5632)
• Teams approval and question cards now show the prompt, tool input, and answer as literal text.
  A model-written [docs](https://evil.example) no longer renders as a link whose label hides its destination. The cards use RichTextBlock text runs, and the message text is sent as plain text. (#​5529)
• Teams inbound verification now accepts only RS256-signed Bot Connector tokens, as Microsoft documents, instead of using the algorithm named in the token header. (#​5530)
• ctx.turn.input keeps the turn's input after the turn pauses for an approval, a question, a sign-in, or a budget answer.
  Dynamic values no longer see empty input after the pause, including auto() if its per-turn memo was invalidated. (#​5628)
• web_fetch now rejects a timeout of zero or less as invalid tool input, instead of throwing an opaque RangeError or aborting the request immediately. (#​5532)
• eve setup now opens browser URLs on Windows through rundll32 instead of cmd /c start, so & or | in a URL is no longer interpreted by the shell. (#​5522)

v0.90.0

Compare Source

Released 2026-10-29 · Compare with 0.89.0

Breaking Changes

• GET /eve/v1/info now serves only operator principals and returns 403 to end users.
  The route answers service and runtime principals and callers a configured localDev() admits, and returns 403 with code info_forbidden to everyone else. To give another credential access, return principalType: "service" from its AuthFn, or allowAgentInfo: true from an EveAuthFn; allowAgentInfo: false denies a caller that would otherwise qualify. The payload stays at version 5 with every field, and client.info() now ignores unknown fields and reads unknown enum strings as "unrecognized", so handle that value when switching on fields such as mode or sourceKind. kind discriminants stay closed, so a new variant needs a version bump. (#​5542)
• Tool-stub grants on Vercel OIDC subjects move from vercelOidc to the new eveVercelOidc helper in eve/channels/eve.
  vercelOidc and AuthResult from eve/channels/auth now carry identity only. Rename grant-bearing vercelOidc calls to eveVercelOidc; the options are unchanged. vercelOidc now throws when a subjects entry is not a string. Type custom callbacks that return allowToolStubs as EveAuthFn from eve/channels/eve. (#​5542)

Features

• A connection's headers and toolCall.providedArguments callbacks now receive ctx.approval.responder while an approved tool call runs, so an MCP or OpenAPI server can act for the person who approved it.
  As in a defineTool tool, ctx.approval.responder.getToken(provider) resolves the approver's token without starting a sign-in. The call still runs as the requester, and its auth token stays the requester's. ctx.approval is absent for calls that needed no approval and while eve lists the connection's tools. (#​5605)

Bug Fixes

• eve build no longer fails with Cannot access '<name>' before initialization while evaluating authored modules whose shared bundle chunks import each other.
  Compile now keeps top-level evaluation in source order. Thanks @​blaesild for reporting this and pinpointing the fix in #​5514. (#​5516)
• Resumed sessions now fill in top-level channel state fields that a later deploy added to the defineChannel seed (or to a built-in channel's state), instead of leaving them undefined.
  This runs at every step boundary, so a seed field a session deletes from channel.state comes back at the next step. Set the field to null (or undefined) to clear it instead. (#​5549)
• A connection tool call with an approval policy now runs once the sign-in it stopped for completes, instead of failing as if its connection had changed.
  Thanks @​exbald for reporting #​5564. (#​5570)
• A connection tool call no longer fails with Instance type "null" is invalid when the model omits an argument whose schema declares a null default it does not allow, such as Pydantic's { "type": "string", "default": null } for x: str = None. eve fills schema defaults once, when the call runs, instead of filling them before approval and rejecting them on the second check. (#​5510)
• The GitHub channel now applies the state a later webhook brings to an existing session, so a turn after a push (or a comment after a push) checks out the new PR head instead of the old one, and reacts to the comment that triggered it.
  Thanks @​blicksky for reporting this in #​1554, and @​haydenbleasel for reporting the reaction symptom. (#​4874)
• Messages a schedule sends with to() on Vercel now carry the deployment that ran the schedule, so an idle session they continue hands off to the new deployment like one a route reaches.
  Thanks @​dohooo for reporting this in #​5598. (#​5599)
• eve dev --agent <name> in an agent workspace now uses the model connection saved by /login.
  Previously the dev host looked for it under the member directory, so a Vercel account sign-in failed every model call with "The model connection is unavailable". Thanks @​cnaccio for reporting this in #​5505. (#​5506)

v0.89.0

Compare Source

Released 2026-10-29 · Compare with 0.88.1

Breaking Changes

• Client messages now show only the session's current conversation, so messages from before a clear no longer appear.
  messages and transcriptOf() follow each turn's follows and a completed context change's selects, as conversation(view) does, and leave out turns outside the conversation. The session view still holds every retained turn. (#​5597)
• The gh tool takes an optional repository instead of permissions, runs any gh or git subcommand, and leaves every access decision to github.authorize.
  github.principalType is now required and decides what authorize receives: { argv, auth, owner, repository, token } for "app", and { argv, auth, repository, token } for "user", where repository may be null. eve no longer matches --repo and other explicit targets against the declared repository or limits git to fetch, ls-remote, pull, and push; check argv in authorize if your policy depends on them. (#​5595)
• history passed to send(), create(), or the eve channel's onMessage now rejects an entry with a field other than id, role, or text instead of dropping it.
  InvalidSessionHistoryError names the entry and its unknown fields. Map stored messages to { id, role, text } before passing them, so fields a later release accepts never change what an existing caller sends. (#​5597)

v0.88.1

Compare Source

Released 2026-10-29 · Compare with 0.88.0

Features

• Approval spans now record who approved or denied the call as agent.approval.responder.type and agent.approval.responder.id, an approved call's tool span records its approver as agent.tool.approver.type and agent.tool.approver.id, and the interaction.settled instrumentation event carries the same responder.
  An approved call runs as the requester, so until now traces showed only the requester and an audit had to read the session stream to find the approver. The responder's id follows the same rule as the turn's principal ids: it is recorded only when the trace policy records both inputs and outputs and the conversation is public or running in development. (#​5596)
• The MCP channel's agent_get now returns an optional statusMessage while an invocation is working.
  It names the tool call that is running, using the tool's activity label when it has one, so MCP clients can show progress instead of a bare working. (#​5314)

Bug Fixes

• Release notes now list breaking changes first and use plain headings, one paragraph per change, and a single compare link.
  A minor changeset always appears under Breaking Changes, so breaking changes merged with an internal PR title are no longer left out. The 0.86.0 and 0.87.0 notes now include the two breaking changes they missed. (#​5588)
• Upgrade undici to 8.12.3 for the security fixes published in 8.12.2.
  A TLS 1.2 server that renegotiates to a certificate for another host now fails the web_fetch request instead of crashing the process. Thanks @​pedro757 for reporting this in #​5589. (#​5591)

v0.88.0

Compare Source

Release eve@​0.88.0 | 2026-10-29 | minor

🚀 Features

• git({ github }) now requires an authorize callback as its only repository access control, drops org, and adds principalType: "user" to run gh commands with the caller's own GitHub permissions. #​5562

  To migrate, remove github.org and move the restriction into authorize, for example authorize: ({ repository }) => repository.toLowerCase().startsWith("acme/"). Each command still declares one owner/name repository; app tokens are scoped to that repository in its owner's installation.

  With principalType: "user", the gh tool resolves the caller's token through ctx.getToken, so eve signs the caller in once for every repository and again when GitHub rejects the token.

• Slack channels can add each sender's display name, real name, and email to model-visible message metadata with the new messageContext.users option. #​5536

  users: true adds names, users: { email: true } adds emails too, and users: { name: false, email: true } adds emails only. The triggering author's profile is also written to message.author and the default Slack auth attributes. Pass resolve(user, next) to own caching around eve's users.info lookup.

  Slack message metadata is now grouped into <sender>, <bot>, and <thread> blocks. sender_type and sender_id become type and id inside <sender>, bot_user_id and is_mentioned become id and mentioned inside <bot>, and the team, channel, and timestamp fields move into <thread>.

Other Changes

See the full list of changes.

Contributors

• @​ruiconti

v0.87.0

Compare Source

Released 2026-10-28 · Compare with 0.86.0

Breaking Changes

• Typed eve/client errors now extend the new EveError (from eve/client and eve/sessions) with a stable snake_case code, and session.snapshot() now returns the full session state, including the opaque inbox value.
  Match SessionNotActiveError on session_not_active or session_not_ready instead of EVE_SESSION_NOT_ACTIVE, expect ClientError.code to be http_error when the response had none, and narrow with ClientError.is(error) and friends instead of instanceof. Persist the session that snapshot() returns as is to keep inbox across restores. (#​5479)
• Rename the terminal display flags on eve dev and eve remote connect to --show-tools, --show-reasoning, --show-subagents, and --show-connection-auth.
  The old --tools, --reasoning, --subagents, and --connection-auth display flags are no longer accepted, and rendering defaults are unchanged. Model reasoning effort still uses --reasoning on eve init and eve set model. (#​5479)
• Rename reset() to end() on client sessions, frontend stores/hooks, and channel/Slack handles, and the HTTP retirement endpoint to POST /eve/v1/session/:sessionId/end (upgrade the server before using the new client).
  Ending keeps the retired ID: use newSession() or client.sessions.create() for a fresh conversation, or clear() to clear context in place; remote-agent and session-history compatibility encodings remain unchanged. (#​5479)
• eve's authoring and configuration types no longer expose AI SDK, zod, OpenTelemetry, or channel-adapter types, so import eve's own types where you named the third-party ones.
  Agent model fields accept EveLanguageModel, DecisionModel requires specification v4, memory providers return MemoryToolSet instead of the removed MemoryToolDefinition, TokenUsage is exported from eve, and eve/instrumentation/otel, eve/channels/linq, and eve/channels/photon export eve-owned span processor/exporter, LinqWebhookVerifier, and PhotonIMessageWebhookVerifier/PhotonProjectCredentials types. Any AI SDK language model or OpenTelemetry processor still type-checks wherever eve accepts one. (#​5479)
• Import durable primitives from eve/workflow and run/hook operations from eve/workflow/api, because bare workflow imports now fail in authored modules.
  Both entries declare eve-owned types: start(workflow, args?) takes no options, runs expose only runId, status, returnValue, and cancel(), and getHookByToken is removed, so pass a deterministic token to createHook and call resumeHook(token, payload). Ambient Workflow types are no longer needed, though existing eve/workflow-modules tsconfig entries can stay through 1.x. (#​5479)
• The just-bash escape hatches and the Discord Gateway relay move to experimental entries, so update their imports.
  Pass customCommands and filesystem as JustBashSandbox.environment({ experimental: { customCommands, filesystem } }) and import their types, such as JustBashCommand and JustBashFilesystem, from eve/experimental/sandbox/just-bash. Import runDiscordGatewayRelay (formerly experimental_runDiscordGatewayRelay) from eve/experimental/channels/discord/gateway instead of eve/channels/discord/gateway. (#​5479)
• Import defineWorkspaceAgent, WorkspaceAgentDefinition, and WorkspaceAgentTransport from eve/experimental/workspace instead of eve.
  The helper is experimental; workspace layout and eve/vercel remain stable. (#​5479)
• Builds now reject agent and connection definitions that don't come from eve's helpers.
  Export defineAgent({...}) from every local agent.ts (and return it from dynamic subagents), wrap static connections in defineMcpClientConnection or defineOpenAPIConnection (plain objects no longer default to MCP), and create sentinels only with defineDynamic(), disableTool(), and disableRoute(). Move an agent/sandbox.ts that sits beside agent/sandbox/ to agent/sandbox/sandbox.ts. (#​5479)
• Remove the undocumented public exports isDisabledToolSentinel, isDisabledRouteSentinel, isInstrumentationDisabled, answerFromText, failureOf, and Linear's defaultOnAgentSession.
  Use failure(view, turnId) from eve/events on a folded view, or check raw turn.settled and session.ended events for outcome === "failed". Omit onAgentSession to keep Linear's default handler. (#​5479)
• Flatten client stream retry settings into reconnect?: false | ReconnectOptions.
  Replace streamReconnectPolicy: { reconnect: false } with reconnect: false, move streamOpenReconnectPolicy fields under reconnect, and rename retryableErrorStatuses to retryableStatuses. The StreamReconnectPolicy and StreamReconnectRetryPolicy types are removed in favor of ReconnectOptions. (#​5479)
• Rename compaction.thresholdPercent to compaction.threshold, which takes a 0–1 fraction.
  The old key now fails with migration guidance. Set limits.sessionUsage: false to disable usage limits, including limits inherited from a parent agent. (#​5479)
• Built-in channel state types no longer publish the default handlers' bookkeeping, so keep custom handler data in your own state keys.
  Hidden fields include Slack taskCards, threadStatus, and the code-channel reply fields replyThreadTs and pendingReplyThreadTs, Chat SDK streaming fields, pendingSignIns, prompt-card fields, and Discord's interactionToken (read it from the Discord handle), and TelegramHitlState is no longer exported. SendTurnPayload is now exported from eve/client. (#​5479)
• Slack initialMessage now accepts Markdown, text, raw blocks, or a card, with optional files uploaded into the root message's thread.
  Remove unsupported Modal*, ExternalSelect*, TextInput*, CardJSXElement, CardJSXProps, isCardElement, and cardChildToFallbackText exports, plus the card builders' JSX-props overloads and their *Props, ContainerProps, and ChatElement types. Call builders with their data forms such as Button({ id, label }), use CardText for labels, native Slack view data for modals, and cardToFallbackText for whole cards (see Slack cards). (#​5479)
• Memory document backend read() and write() inputs use signal again, restoring the pre-0.84.0 contract.
  Only backends and direct calls using the abortSignal input from 0.84.x need updating; memory and tool execution contexts still expose ctx.abortSignal. (#​5433)

Features

• Clarify that Next.js servicePrefix supports manually configured Vercel services and production proxying; it is not a legacy option. (#​5479)

v0.86.0

Compare Source

Released 2026-10-28 · Compare with 0.85.0

Breaking Changes

• Remove the disabled scaffold agent helper and the legacy root-tool registry setup handoff.
  Old scaffold imports must migrate to eve/extensions/self-modification/local; the current local and remote extensions and the old-layout migration error remain unchanged. (#​5518)

Features

• EVE_CALLBACK_TRUSTED_ORIGINS now accepts a leading *. label, such as https://*.preview.example.com, so a remote agent can trust preview parents whose deployment URLs change on every deploy.
  The wildcard matches exactly one subdomain label, and *.vercel.app and trailing dots are rejected. (#​5539)
• Hide eve init --channel-web-nextjs from eve init --help in favor of eve add channel/web.
  The flag still works. The README and coding-agent setup instructions now point to eve add channel/web, which also sets up sign-in. (#​5474)
• Ship current release notes at dist/CHANGELOG.md with a version-pinned link to the full changelog. (#​5446)

Bug Fixes

• The experimental Vercel schedule provider bundles Schedules SDK alpha.19 and identifies eve to the Schedules API with an x-vss-framework: eve header. (#​5528)
• A file returned by a tool now becomes a "could not be stored" note when the session's sandbox rejects the write, instead of failing the step and replaying its model call and tools. (#​4843)
• A turn's principal no longer changes while it runs.
  Only the turn's own principal can answer a pending ctx.ask() or ask_question by typing, whether a workflow tool, a subagent or a remote agent asked; another person's text waits and runs as their own turn instead of answering the question under the asker's auth. A typed answer updates the claims on ctx.session.auth.current, so its delivery.consumed hook and the rest of the turn see the request that sent it. Someone else's button answer still settles the request as its responder. (#​4925)

v0.85.0

Compare Source

Minor Changes

• 24c6b9f: Client requests now reject redirects by default, including session writes and event streams. Update redirecting base URLs to their final destination, use redirect: "manual" to stop at redirects, or explicitly opt into "follow" only when every redirect destination is trusted.

• c8328f8: Protected cross-project callbacks now require reciprocal Vercel Trusted Sources and an explicit EVE_CALLBACK_TRUSTED_ORIGINS allowlist on the remote deployment. Callback URLs no longer include the parent's deployment-wide bypass secret; listed origins instead receive the remote's short-lived OIDC credential.

• 5cfec0e: Slack renderers can restyle approval, question, and budget prompt cards with a new interactionCard(card, next) hook, while eve keeps routing, batching, action IDs, and card updates. Cards now update from the session for every request kind, so a question answered by a typed reply or withdrawn, or a settled budget prompt, no longer keeps live buttons.

  Breaking changes:

  • SlackChannelState.pendingApprovalCards is replaced by interactionCards. Cards posted before the upgrade keep their buttons.
  • SlackTaskCard is renamed to SlackCardMessage, which both taskCard and interactionCard return.
  • Clicking a question no longer rewrites its card from the webhook. The buttons stay until the session admits the answer, and apps that post eve's controls themselves no longer get that rewrite.
  • An approval's buttons disappear once its answer is admitted, so a later click can't change it. A denied approval reads Deny instead of Cancel, and a direct-message request's thread note reports the same outcome as its card.

Patch Changes

• f20a7a1: Bind native Teams activities to the verified Bot Connector token's service URL before dispatch. Connector requests require HTTPS and reject redirects, keeping bearer credentials on the validated destination.

• 4f290a7: Sessions whose deployment runs eve 0.69 through 0.83 now move to a v27 deployment the next time they receive a message while idle, or earlier when a channel prepares them for the next message, instead of staying on their original deployment until they time out. eve compacts the earlier conversation as the session moves, so the model continues from a summary; the stored transcript stays intact, and new turns continue after it. Remembered tool approvals and usage limits start over.

• 0553a67: Keep continuation capabilities out of session lookup and child-interaction failure logs, including capability values embedded in error messages and causes. Failure diagnostics retain correlation fields and non-secret error details.

• e54f078: Render Teams mention display names and fallback IDs as literal text, preserving names that contain ampersands or angle brackets without changing mention identity.

• ba52da4: Remove the deprecated internal setup type alias RunPnpmOptions. Setup tooling should use RunPackageManagerOptions; package-manager command behavior is unchanged.

• 5b8a34b: to(channel, target).send(), Slack's onEvent ctx.send(), dynamic schedules' to().send(), and channel receive hooks now accept the same options as from(address).send(), including history, idempotencyKey, and title. Slack derives a threadless target's session from idempotencyKey, and a dynamic schedule's keyed send reaches the session its earlier attempt started, so a retried send no longer starts a second thread or session.

• 6ea94da: Set codeChannels: true on slackChannel() to serve Slack code channels as one session per channel. The agent answers un-mentioned messages, replies top-level or in the thread a person wrote in, and follows Slack's session status and stop. The option also adds the code channel scopes and events to the app manifest. A code channel session has no thread: threadTs is empty or null, and ctx.slack.codeChannel marks it. Address its session with { channelId, codeChannel: true } in onEvent targets, or with slackCodeChannelContinuationToken(channelId).

  Two changes also reach agents that don't enable code channels: a cancelled turn now clears the Slack thread status by default, and SlackSessionTarget is now a union, so code that reads target.threadTs must handle the { channelId, codeChannel: true } variant. SlackHandle also gains a required codeChannel field, which affects code that builds a handle by hand.

• 2764e1e: Add openCodeChannel(ctx, slack, message, { name }) to eve/channels/slack, which a tool calls to move the Slack conversation it was called from into a new Slack code channel and continue the work there with the conversation so far. Wrap it in your own tool with your own description and inputs, and pass your Slack channel. It finds the conversation from ctx.channel, so it works when message hooks return their own auth. To write your own variant, Slack receive targets accept codeChannel. Message hooks can open a code channel without the model through ctx.openCodeChannel().

• cb14c32: Reject framework-owned adapter attachment references in HTTP messages and restrict Linq attachment downloads to bounded public HTTPS destinations. Thanks to HackerOne researcher ryota for reporting the attachment-reference boundary issue.

• 412b077: Tools can start or reach sessions on the agent's channels with ctx.to(channel, target).send(message, options), the same call route handlers and schedules use, such as forking a conversation into a new Slack thread. Ordinary tools call it directly, and workflow tools call it in a "use step" helper. Pass idempotencyKey: `${ctx.session.id}:${ctx.callId}` so a retried call reaches the same session once. ctx.to() throws in a subagent, a root copy, or a remote agent call. Tools also get ctx.channel, the calling session's channel kind, continuationToken, and metadata, as hooks and dynamic resolvers read it.

v0.84.1

Compare Source

Patch Changes

• 41916a5: Dynamic models, dynamic subagent configs, and ctx.agent(name, { model }) overrides now read context windows from the AI Gateway model catalog recorded at build time instead of downloading it at runtime; a model that catalog doesn't list fails until you return modelContextWindowTokens or rebuild. Builds no longer carry built-in limits for anthropic/claude-opus-4.7, openai/gpt-5.4, and openai/gpt-5.4-mini, so a static model needs the catalog, a cached copy, or modelContextWindowTokens to compile offline.
• b322096: A compaction that fails during a turn, for example on a provider 429 that outlasts its retries, now fails that turn with MODEL_CALL_FAILED and leaves the session waiting with its history uncompacted. Previously the error escaped the turn step, so eve replayed the step and then ended the session. Thanks @​gshost1 for the report and reproduction in #​5350.
• 4276727: Messages a route forwards with ctx.to() now carry the deployment and request that accepted them, so an idle session reached that way hands off to the new deployment like one reached with from(). Thanks @​haydenbleasel for reporting this in #​5408.
• bea10fd: Model calls that AI Gateway rejects with a 402 because it temporarily throttled the credit balance check now retry with backoff. They previously reported "AI Gateway credit balance exhausted", told users to add credits, and parked the session without retrying.
• 105bf60: eve init apps/my-agent now creates missing parent directories such as apps/ instead of failing with ENOENT from mkdtemp. Thanks @​otakusboy for reporting this in #​5422.
• 5bb6d43: Nuxt apps that call the auto-imported useEveAgent() now hydrate in nuxt dev. The eve/nuxt module pre-bundles eve/vue with Vite, which previously served its CommonJS dependencies to the browser unbundled and failed with does not provide an export named 'getContext'.
• cb1db12: Sending a message from a web client served over plain HTTP on a host other than localhost no longer fails with crypto.randomUUID is not a function. Thanks @​KingAmo for reporting this in #​5415.
• 5458bc4: Reuse signed inbox routing information between client turns when the Workflow SDK and adapter support guarded resumes and EVE_INBOX_HANDLE_SECRET is configured. Refresh stale routing after a confirmed refusal without retrying uncertain deliveries.
• a5328b4: sandbox.spawn({ stdin: true }) returns a process with a writable stdin stream; closing it sends EOF. The Vercel and Docker sandboxes support it, and just-bash and custom providers without stdin support reject the call.
• 66103be: eve dev on Windows no longer opens a console window for each Docker command, dev build process, or optional package install. Thanks @​satish860 for reporting this in #​5291.
• 040519a: The browser client no longer triggers a Content Security Policy eval violation on pages whose script-src omits 'unsafe-eval'. eve's bundled Zod now skips its Function("") probe and always uses its interpreted parser. Your app's own Zod and z.config() are not affected. Thanks @​wasimxyz for reporting this in #​5365.

v0.84.0

Compare Source

Minor Changes

• 4a4951e: Tools and connections now share the Approval policy contract; approvalKey and ApprovalContext.approvedTools are removed. once() remembers the latest approval or denial per resolved tool for the session; custom policies must return its decision unchanged to reuse or record consent.

• 4a4951e: Session commands now return Delivery receipts with independent stream() and result() reads; the eve HTTP message route accepts idempotencyKey for retries within a session's recent-key window. Session creation returns { session, delivery } when a message is supplied and { session } otherwise; import shared contracts from eve/sessions.

• 4a4951e: Public APIs now use eve-owned contracts for history, decisions, channel integrations, and sandboxes; legacy aliases and internal helpers are no longer exported. decide takes signal instead of abortSignal and returns only answers and usage; update other imports using the v27 upgrade guide.

• 4a4951e: Define dynamic capabilities with defineDynamic(ctx => value) instead of lifecycle maps, and use ordinary functions and schemas instead of defineDurableCallback and defineDurableSchema. Cache external JSON observations with ctx.memo(key, fn).

• 4a4951e: Extension distributions now record the eve version they were built with and a distribution generation instead of per-capability epochs. Extensions built with the old epoch-based manifest must be rebuilt with this release and republished; eve rejects old manifests with rebuild guidance before loading extension code.

• 4a4951e: Recalled memory is supplied to the model outside durable conversation history, and dynamic user instructions are added only when their content changes. Memory no longer supports compaction recall or visibility, and compaction fails if memory capture fails.

• 4a4951e: Sends, channels, and schedules now accept eve-owned MessageContent; images use file parts, and Chat SDK's messageToUserContent is renamed to messageContentOf. File parts sent through ctx.agent().send() must contain HTTP(S) URLs, not inline bytes or base64.

• 4a4951e: SessionStore replaces EveAgentStore, and clients and frontend bindings use baseUrl instead of host. Frontend bindings expose view, messages, and agents directly with native tool and interaction parts; use followWhile(view) instead of followIdle, and activeTurn(view) rather than busy status for Stop controls.

• 4a4951e: followAgents: true now observes child sessions recursively, including workflow-created children, with predicate selection, bounded traversal, and per-session positions and progress. SessionStore.observe() supports headless capture; child readers require source-positioned opening events to verify each hop through its parent.

• 69346ff: Remote agents no longer serve callers on eve 0.66 through 0.68 (remote agent protocol 1), and callers no longer accept remote agents on those releases. Calls in either direction now fail at start with REMOTE_AGENT_PROTOCOL_MISMATCH; upgrade both deployments to the same eve release. The /eve/v1/task-input/:token route is gone. It accepted unauthenticated answers that settled approvals and added turn input as the session's current user.

• 4a4951e: Replace eve remote invoke and its resumable JSON workflow with eve remote connect --print <prompt> for one-shot requests that print the final assistant text and exit. Interactive eve remote connect is unchanged; use eve/client for scripted multi-turn sessions and input responses.

• 8efe110: eve's default sandbox image is now tagged by its Dockerfile contents instead of the eve version, so upgrading eve reuses existing sandbox templates unless the image itself changed. Expect one template rebuild on the first upgrade to this release.

  The default sandbox image no longer includes pnpm or pip, which makes it smaller. Install them in your sandbox prepare callback when your agent needs them: run npm install -g pnpm for pnpm, and use a Python virtual environment for pip.

• 4a4951e: The eve HTTP channel now rejects unknown top-level fields on session creation, message, and control requests with HTTP 400 and a list of accepted fields. Correct unsupported options and misspellings instead of relying on them being ignored.

• 4a4951e: Channel delivery hooks now receive typed ChannelDelivery payloads and return replacements; use channel.state for state changes. kindHint is removed; use path-derived channel:<name> identities, audience() visibility classification, and the renamed CORS options described in the v27 upgrade guide.

• 4a4951e: Slack's renderers.taskCard now receives TaskCard instead of TaskCardView; use callState and callLabel from eve/events for call rendering. Teams channel state replaces pendingAuthActivityId with pendingAuthActivityIds.

• 4a4951e: Evals now use v27 facts and interaction projections, with call matchers such as turn.waitForToolCall() and renamed helpers such as calledAgent() and awaitingInput(). The remoteUrl field and matcher are removed; use the v27 upgrade guide to migrate legacy assertions.

• 4a4951e: Hooks and channel handlers now receive v27 facts with coordinates in event.scope and session state in ctx.view. Update channel handlers to (event, ctx) with ctx.channel, and migrate instrumentation providers to InstrumentationEvent<K> and the new lifecycle names.

• 4a4951e: Approvals, questions, sign-ins, and budget prompts now share the Interaction model, with answers shaped as { interactionId, optionId?, text? } and approval choices approve / deny. Turns pause only for human input, and cancelling an agent task retires it.

• 4a4951e: Remote agents now use protocol 3 and can still relay approvals, questions, and sign-ins from protocol-2 children. Upgrade callers before their remote agents, or both together: protocol-3 children cannot relay human-input requests to older callers.

• 4a4951e: Session streams now use v27 facts, line-based cursors, and immutable SessionView snapshots queried through eve/events. Checkpoints require version 18; keep older sessions on their original deployments and follow the v27 upgrade guide before updating event consumers or restoring persisted history.

Patch Changes

• 4a4951e: Deliver concurrent messages to the same ctx.agent() session in send order, preventing out-of-order delivery from leaving calls waiting indefinitely for a reply.
• 4a4951e: Parent session streams now record accepted child deliveries as child.sent; use agentCallActivity(state, callId) from eve/client to inspect per-call child activity, including shared turns.
• 4a4951e: An unhandled hook error now fails the running turn instead of only being logged. Cancellation requested with ctx.cancel() takes effect only if the handler returns successfully.
• caa9172: The bundled eve dev self-modification subagent is now offered only to the local developer: sessions authenticated by localDev() or by the linked project's Vercel development token. Chat users and principals from authored authenticators, including HTTP Basic operators, no longer get the editor and must edit files directly; there is no local authorization override, and callers forwarded by a same-machine tunnel can still get the editor if the channel uses localDev().
• 4a4951e: Remote child sessions no longer fail solely because the parent has already consumed their result or stopped waiting for it, such as after a lost acknowledgement.
• 4a4951e: Remote session stream proxies now reject unexpected content types and prevent upstream responses from being served as executable content. Error responses with unexpected content types are replaced with generic JSON while preserving the error status.
• e7453f1: Session callbacks now reach only public addresses. The eve channel rejects callback URLs with a non-HTTP scheme or a loopback host, and callback delivery refuses to connect when a callback hostname resolves to a loopback, private, link-local, or reserved address. Loopback callbacks still work on local development servers (eve dev and vercel dev).
• 4a4951e: Built-in channels keep sign-in links and codes out of shared messages; when private delivery is unavailable, they show a credential-free status instead.
• 4a4951e: Interrupted durable steps recover from recorded outcomes without automatically replaying observed tool calls. Exhausted step retries fail the turn without closing the session, but external effects with unrecorded outcomes still require application-level idempotency.
• 4a4951e: v27 deployments can read v26 session history through the v27 client and stream APIs. Convert previously saved legacy events with convertLegacyEvents from eve/internal/legacy-events, a temporary migration aid.
• 4a4951e: eve dev now validates session event lines before writing them and rejects lines larger than 8 MiB. Set EVE_CHECK_SESSION_EVENTS=0 to disable validation or =1 to enable it outside development.

v0.83.3

Compare Source

Patch Changes

• 3e96a14: An optimistic message no longer stays in the submitted state when its turn is cancelled or fails before the agent reads it. EveAgentStore now marks that message failed, so it keeps its own text, and later messages reconcile against their own submissions. A steered message the cancelled turn never read now also lets its send() settle. Thanks @​brettcrane for reporting this in #​3102.
• 8077f2d: With otel({ traceChannelRequests: true }), the agent.channel.request span now ends when the response body finishes, fails, or is cancelled, not when the route handler returns. Session stream requests no longer log You can only call end() on a span once. for workflow.stream.read.connect, and request spans now cover the full streaming time. Thanks @​ahcarpenter for reporting this and proposing the fix in #​4256.
• 54adf15: chatSdkChannel now reports failed final reply delivery with an error-id notice and a note to the model, avoids reposting streamed replies, and skips unchanged final edits after state restoration. Thanks @​diegojohnsonl for reporting this in #​4801.
• 4280d51: A hook that cancels the turn at compaction.completed no longer drops the compaction's summary call from the session's usage. session.waiting and session limits now count it.
• 181caed: Compaction no longer re-runs on every step when the current user message is most of the context window. After a compaction, eve keeps at most 20,000 tokens of the latest conversation word for word next to the summary, with tool results shortened to 2,000 characters; a current message larger than that keeps its start and end, and the cut-out middle is summarized. A compaction that cannot bring the history under the threshold now fails the session, without retrying the step, with an error that says to start a new session or send a smaller message.
• cea4eb0: Declare next as an optional peer dependency, so eve/next types resolve the app's own next in pnpm workspaces that install more than one next version. Thanks @​laugharn for reporting this in #​5341.
• 80db4b3: A session started before eve 0.57 now imports on its next message instead of failing with IncompatibleStateLayoutError for eve.mode. The import drops the framework context keys that those builds saved and the current build no longer defines. Thanks @​sunlanchang for reporting this in #​5213.
• 200d2d8: localDev() now refuses requests that a browser sends for another website: a non-loopback request host or Origin. A web page open in the developer's browser can no longer start sessions or run the agent's tools on an eve dev server, including through DNS rebinding. Frontends served from any loopback host and port still authenticate.
• 243a4a4: localDev() now refus

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "before 3am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
evi	Ready	Preview	Nov 2, 2026 4:58pm UTC
evlog-telemetry	Ready	Preview	Nov 2, 2026 4:58pm UTC

3 Skipped Deployments

Project	Deployment	Actions	Updated
evlog-docs	Skipped		Nov 2, 2026 4:58pm UTC
evlog-render-lab	Skipped		Nov 2, 2026 4:58pm UTC
just-use-evlog	Skipped		Nov 2, 2026 4:58pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 85e6c624-2776-4c3c-ac8d-2ce2158571f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pkg-pr-new]

@evlog/cli

npm i https://pkg.pr.new/@evlog/cli@958

evlog

npm i https://pkg.pr.new/evlog@958

@evlog/nuxthub

npm i https://pkg.pr.new/@evlog/nuxthub@958

@evlog/signals

npm i https://pkg.pr.new/@evlog/signals@958

@evlog/telemetry

npm i https://pkg.pr.new/@evlog/telemetry@958

commit: 0bd137f

[github-actions]

Thank you for following the naming conventions! 🙏