vercel/eve eve@0.83.0

on GitHub

Minor Changes

• 12a1e90: DefaultSandbox now selects its provider once, when eve prepares the sandbox, and records the choice in the build: Vercel Sandbox on Vercel, then Docker when a daemon is reachable, then just-bash only in eve dev and eve eval. The runtime uses the recorded provider instead of probing the host again, so a build and its server can no longer select different providers. A production eve build with neither Vercel nor Docker no longer falls back to just-bash: the build succeeds, and opening the sandbox fails with an error that asks you to start Docker and rebuild, deploy to Vercel, or select a provider explicitly.

  DefaultSandbox.environment().open() now accepts networkPolicy, and its sessions expose setNetworkPolicy(). eve forwards the policy to the selected provider. Docker rejects any policy other than "allow-all" or "deny-all" when it opens the sandbox, instead of starting the container with open network access, and just-bash rejects any policy other than "allow-all".

  Sessions now record their sandbox under the provider name "default" instead of vercel, docker, or just-bash. Sessions saved by an earlier eve under the provider that DefaultSandbox selected resume the same sandbox. When a session's recorded state belongs to another provider or state protocol, for example after you change providers, eve now starts a fresh sandbox instead of failing; the old sandbox is not deleted. This upgrade is one-way: if you roll back to an earlier eve release, sessions created on this release fail to open their sandbox, because earlier releases reject state recorded under "default".

  VercelSandbox.environment() no longer captures a snapshot when the environment has no prepare callback, no managed workspace or skill files, and no source. Session sandboxes start from the image and install the base runtime themselves, as DefaultSandbox already did on Vercel. Such sessions now apply a networkPolicy set on the environment after base setup; before, only a policy passed to open() applied, so VercelSandbox.environment({ networkPolicy }) and DefaultSandbox.environment({ vercel: { networkPolicy } }) could leave a session with open network access.

• 62112b5: The just-bash sandbox provider now runs on the public defineSandboxProvider() API, and customCommands and filesystem use eve-owned types from eve/sandbox/just-bash, such as JustBashCommand and JustBashFilesystem, that still accept just-bash's defineCommand() results and filesystems. Local just-bash templates rebuild once after upgrading, since their keys no longer include custom commands or the filesystem; reading a directory now rejects instead of returning null, and a command ending in a # comment runs in any working directory.

• 8b68a92: Remove the microsandbox sandbox provider. The eve/sandbox/microsandbox export and the microsandbox option on DefaultSandbox.environment() are gone, and DefaultSandbox now selects Vercel Sandbox on Vercel, then Docker when a daemon is reachable, then just-bash. To migrate, switch MicrosandboxSandbox.image() and MicrosandboxSandbox.dockerfile() to DockerSandbox.image() and DockerSandbox.dockerfile() from eve/sandbox/docker, and remove the microsandbox dependency. A session that recorded a microsandbox sandbox starts a fresh sandbox from its current provider on its next ctx.getSandbox().

  eve no longer cleans up what microsandbox left on your machine. Before you uninstall microsandbox, use its tooling to remove sandboxes and snapshots whose names start with eve-sbx-. Then delete .eve/sandbox-cache/microsandbox in each app. If you used MicrosandboxSandbox.dockerfile(), also run docker rm -f eve-sandbox-registry to remove the local image registry it started, and remove the local images tagged 127.0.0.1:51921/eve/….

  Deployed self-modification (eve/self-modification/remote) now requires deploying on Vercel. Builds still succeed on any host, but in a deployment outside Vercel the deployed subagent fails with an error that names this requirement when it opens its sandbox.

• 5b27aa8: Breaking for custom sandbox providers. defineSandboxProvider() now takes a byte-level SandboxConnection (spawn, readFile, writeFiles, removePath, stop, optional close and extensions), and eve derives the full sandbox session from it. Built-in providers are unchanged. See the custom sandbox providers guide. To migrate a provider:

  • Return { connection, state } from start() and a connection from resume(). onSandboxStop() and onRuntimeShutdown() become connection.stop(), and onSandboxDelete() folds into onSessionEnd() with reason: "deleted".
  • Replace ctx.resources and ctx.sourceRevision with ctx.templateKey() and ctx.populate(), and remove your own prepare option, which eve now runs. environment() receives {} instead of undefined when no options are passed. Set toolSessions: true to support keyed invokeTool calls.
  • Rename SandboxPreparedArtifact to SandboxJson, SandboxProviderSessionContext to SandboxSessionContext, and SandboxProviderPrepareContext to SandboxPrepareContext. SandboxProviderHandle and the SandboxProviderResource* and SandboxProviderTargetFile types are removed, as is ctx.host.

  eve/sandbox/provider also exports SandboxSessionGoneError, SandboxTemplateNotProvisionedError, and SANDBOX_AGENT_ENV. In eve/sandbox, SandboxSession gains a required writeFiles(), so hand-built sessions such as test doubles need one, and SandboxNetworkPolicy is now an eve-owned type rather than the Vercel Sandbox SDK's NetworkPolicy.

• 3f698dd: Sandbox providers now key each sandbox by its session: start() must return the existing sandbox for ctx.session.id when one exists, and the required onSessionEnd(ctx, state | null, { reason }) takes no artifact and must delete by key when state is null. Session end now removes a sandbox even when the session never recorded it, such as one a subagent sharing the sandbox opened first. Built-in providers keep a session's sandbox across rebuilds and open-option changes.

• 950409f: VercelSandbox now runs on the public defineSandboxProvider() API, keeping existing sandbox names, session state, and snapshots. Breaking: a relative workingDirectory now resolves from /workspace, and eve/sandbox/vercel no longer re-exports Drive, so import it from @vercel/sandbox instead.

Patch Changes

• bd050f8: Clearer sandbox error messages. Sandbox errors now say what went wrong and how to fix it, for example when the build and the runtime select different providers, a prepared template is missing, a session's sandbox came from another provider, or the sandbox file does not export its environment.

• 95571f1: Fix discovery of extension mounts written as export { default } from "<pkg>" inside a packaged extension, which eve extension build compiles to import x from "<pkg>"; export { x as default };.

• 7066b20: eve dev memory no longer grows with every save. Each rebuild now compiles and bundles your agent in a short-lived child process, and each new version of your code is served by a fresh worker, so old copies of authored modules no longer stay loaded. Modules imported by relative path now keep their package's sideEffects setting, so identical source bundles the same way on every save; in "type": "module" apps, default imports of older CommonJS packages that set __esModule now follow Node's rules. Thanks @callicles for reporting this in #5203.

• dff87bc: eve dev now rebuilds once per edit to a source-backed workspace extension. Before, the temporary .eve-extension-build-* files from the extension build started a second, unnecessary rebuild.

• 2b07d0a: The Discord channel can now answer DMs, mentions, and thread replies. discordChannel({ gateway: {} }) accepts messages forwarded from the Discord Gateway, and experimental_runDiscordGatewayRelay from the new eve/channels/discord/gateway entry point holds that connection, for example in a Vercel Daemon. In text channels, a mention starts a thread that holds the conversation, and a reply to any bot message continues the session that posted it; set gateway.startThread: false to answer in the channel, or return conversation or startThread from gateway.onMessage to decide per message. defaultDiscordMessageAuth gives a message's author the same principal defaultDiscordAuth gives them for commands and button presses.

• 87962a0: eve add channel/discord now first asks whether people reach the agent through DMs, mentions, and threads, or a slash command. The first scaffolds the Discord Gateway relay in daemon/, registers it as a Vercel Daemon in vercel.json, enables gateway on the channel, turns on the bot's Message Content intent when Discord allows it, and skips registering /ask; the second keeps today's slash command setup and is what --yes picks. Non-interactive runs answer discord-messages with "gateway" or "commands".

• acc76d5: The Discord channel now shows connection sign-ins. In a DM it posts the sign-in link and any confirmation code; in a server it posts a Sign in button that shows the link only to the person who has to sign in, in an ephemeral message. The message updates once the sign-in completes or is cancelled.

• 4db529f: DockerSandbox now runs on the public defineSandboxProvider() contract. Container names, recorded session state, and template image references stay the same, so running sessions and prepared images from earlier builds keep working. A few behaviors change: sandbox.delete() removes the session's container by its session-derived name, honors the caller's abortSignal, and succeeds when the container is already gone; eve normalizes relative paths such as logs/../out.txt to /workspace/out.txt before they reach the container; and a Docker environment's prepare callback is typed with DockerSandboxSession.

• 5cf30b6: A dynamic model resolver's step.started event now carries the index of the step it selects a model for. From the second step of a turn on, it used to carry the previous step's index, so per-step work keyed on stepIndex was attributed to the wrong step.

• 3c25e62: A dynamic skill that stops returning files but is still returned now keeps the files already written to the sandbox, so files the sandbox provides another way, such as from its snapshot, stay in place. If you dropped files to take files away from some callers, stop returning the skill for them instead: a skill the resolver stops returning still has its files removed. On Vercel Sandbox, eve now writes a dynamic skill's files in one batch, with one path lookup and one upload instead of two round trips per file.

• 1bbe939: eve eval artifacts now record each eval's startedAt and completedAt in summary.json, results.jsonl, and the per-eval detail file.

• 448804d: An eval's derived.usage now takes each session's latest usage by time. An eval that captured a session again with an earlier snapshot reported that snapshot's lower total. Its costUsd is now absent when a counted session reported no cost, instead of summing only the sessions that did.

• 94784e1: Validate idle session state inside the workflow before starting a deployment handoff, avoiding unnecessary successor starts when durable work is still pending. Preserve inbox ownership and the original session stream throughout the move.

• 580417f: Fix repeated horizontal rules and question text accumulating in terminal scrollback during human-in-the-loop prompts. Question and approval drawers now fit small terminals, keeping the focused choice or text editor visible.

• b848a51: Avoid an extra setup command when creating a Vercel sandbox from a prepared snapshot of the standard eve image without Drive mounts. eve now checks the base runtime again after authored preparation, so a prepare callback that breaks it fails the build; existing sandboxes, resumes, custom images or sources, Drive mounts, and sandboxes without a prepared snapshot keep their setup checks. Vercel templates rebuild once so every snapshot has passed the new check.

• 39a8b4c: A session whose sandbox is gone (for example after a removed Docker container, a deleted Vercel Sandbox, or a deleted just-bash session directory) now starts a fresh sandbox on its next ctx.getSandbox(). Previously every sandbox call in that session failed with the same resume error until the session ended. Thanks @bradhallett for reporting this in #5113 and @moinulmoin for the just-bash case in #4440.

• bb4afff: New sessions start their first model step sooner, and later turns no longer wait for their cancellation hooks to register before their first step. Thanks @Lukavyi for reporting the startup latency in #876.

• 798a91e: The Linq channel now rejects inbound webhooks with a 401 whenever its webhook verifier returns any falsy value, including the null that vercelOidc() returns for a missing or invalid token. Previously only false rejected a request, so Vercel Connect setups without a signingSecret accepted unsigned webhooks.

• aaae448: Self-hosted eve start servers now reject requests to /.well-known/workflow/v1/flow that did not come from the server's own workflow queue, so a client can no longer forge a workflow delivery with a chosen run context or principal. Startup always recovers pending and running local workflow runs through the authenticated queue, ignoring WORKFLOW_LOCAL_RECOVER_ACTIVE_RUNS; queue deliveries must stay on the process that enqueued them.

• 9d1998f: Export agentWithModel for agent/tools/agent.ts to opt into a root-copy tool whose model-facing input selects the AI Gateway model for each task.

• cbc87ae: OpenAPI connection tool calls now follow redirects only within the base URL's origin. A redirect to another origin is returned as the tool result, with its target in location, instead of followed, so credentials in custom headers, such as an apiKey security scheme's header, no longer reach the redirect target. A same-origin redirect loop now fails after 10 hops with an explicit error.

• 7a908f5: Compaction summaries now run on the AI SDK model instance set as compaction.model. Before, a direct model instance there was ignored and summaries ran on the agent's top-level model.

• 84daf59: Compiles now prune node_modules/.cache/eve/authored-modules in the background, deleting cached bundles that no running eve process can still import, so the directory no longer grows without bound locally or in persisted Vercel build caches. Thanks @ryantbrown for reporting this in #847 and @kevludwig for reporting the Vercel build-cache impact.

• 9bd75df: server-only and client-only imports now load as empty modules in every eve bundle, so tools, channels, workflow steps, and shared workspace packages that import them build and boot without --conditions=react-server or a direct dependency. Thanks @jakeleventhal for the original implementation in #3752.

• b9f984c: Update the bundled Workflow runtime to reduce redundant history reads during concurrent hook registration and avoid unnecessary input/output reads when resuming hooks. Include replay-ordering fixes and the local-world fix for deliveries that race a session handoff.

• f5b36b3: Repair orphaned local tool calls in saved history before the next model request with an explicit unknown-outcome error. The repair never reruns tools or moves recorded results, and leaves provider-executed calls, approval requests and duplicate call IDs alone.

• 1fe0d91: Dynamic skills with supporting files are written into a sandbox that eve recreates after the old one was gone, at the start of the next turn. Before, the recreated sandbox got the same identity as the old one, so its skills were missing their files until the skill changed.

• b3ede07: The Linq and Photon channels' default webhook verification now only accepts Vercel OIDC tokens from the same project and environment.

• 00aa593: eve now runs every sandbox provider, including DefaultSandbox, directly on the public defineSandboxProvider() contract, and calls connection.close() when the step that opened a connection ends, so the next step resumes through a new connection. Server shutdown stops only connections eve still holds, so a custom provider that defines close() and runs remote compute should bound idle compute itself, for example with an idle timeout.

• c3bbae4: Relative symlinks in an agent's sandbox/workspace/ files, in skill packages, and in sandbox templates now stay relative in build output and in each sandbox session. Before, eve rewrote them as absolute host paths: just-bash sessions rejected them with EACCES ... resolves outside sandbox, and they did not resolve inside Docker, microsandbox, or remote sandboxes.

• 00aa593: Custom sandbox providers can declare workspaceRoot on a connection, and eve resolves relative paths, the default working directory, resolvePath("."), and build-time workspace seeding from it; built-in providers keep /workspace. The read_file, write_file, glob, and grep tools now accept paths relative to the workspace root, and the workspace and skills prompt sections no longer name /workspace.

• db18149: eve start and the withEve production server for Next.js now fail fast with a clear "port is already in use" error when another process holds the port, instead of reporting a server they did not start and leaving the built server running in the background. Thanks @KingAmo for reporting this in #4938.

• 9d804f2: A sandbox that was stopped and then ended no longer stays registered for server shutdown, so long-running eve servers stop accumulating ended sessions and shutdown no longer stops their connections again.

• f1656a5: Tools can now hand the model a file by URL. toolOutputPart.fileUrl(url, { mediaType }) from eve/tools returns a { type: "file", data: { type: "url", url } } content part from toModelOutput, so a large file such as a presigned PDF link reaches the model without being base64-encoded, staged into the sandbox, or stored in session history. Only https: URLs are accepted, and the URL must stay readable for the rest of the session because every later model call sends it again.

• ea3a387: Calling prewarm() on an existing session can now prepare an idle owner on the Vercel deployment accepting the request before the next message. Apps can trigger it when typing starts; it preserves the session, history, stream, and expiry, and does not block Send or run the model.

  Preparation uses the existing POST /eve/v1/session/:sessionId endpoint with no body or {}. Requests with messages or input responses keep their existing behavior.

• 07dbdef: Each start or resume of a workflow tool program may now run up to 30 seconds of JavaScript and take up to 5 minutes in total, and time spent waiting for child agents counts toward neither limit.

• dd0aac6: A "use step" helper in a workflow tool can now call ctx.getSandbox() to open the sandbox of the session that called the tool, on any sandbox provider, so a task can prepare files the session's later tool calls read. When the session had not recorded its sandbox when it called the tool, the step opens it with the owning session's sandbox definition; the step never owns the sandbox, and the session removes it when the session ends.