vercel/eve eve@1.0.0-rc.3

on GitHub

Released 2026-11-03 · Compare with 1.0.0-rc.2

Breaking Changes

• The code extension (eve/extensions/code) no longer mounts its code__grep tool, which removes about 1.6K characters of tool schema from every model step.
  To keep a structured search tool, run eve add tool/grep, which writes agent/tools/grep.ts re-exporting eve/tools/grep. eve/extensions/code/tools still exports the same grep definition. Delete an agent/tools/code__grep.ts file that exports disableTool(), because eve build now rejects it with disables a slot with no lower-precedence source. An agent/tools/code__grep.ts override that spreads grep keeps working as your own tool named code__grep. (#5815)
• The code extension (eve/extensions/code) no longer adds the read-only code__worker subagent, and code() rejects the worker option.
  To migrate, remove worker from your code() mount and delegate with the built-in agent tool. If an agent/tools/agent.ts override disables agent so delegation goes to code__worker, delete the override. A mount that still passes worker fails with Invalid extension config: eve-code no longer ships a worker subagent; delegate with the built-in `agent` tool and remove the `worker` option.
  The code__review skill starts a fresh-context agent with a no-edit audit brief when one is available and otherwise audits in the current session. The code__lookup-agent-run skill and the internal eve/internal/code/prwatch export are removed. (#5800)
• A dynamic tool no longer replaces a static tool of the same name: the static tool keeps the name and eve logs an error, as it already did for two dynamic tools with the same name.
  To change a tool for some sessions only, define it only in a dynamic file that returns the usual version to the other sessions.
  Agents whose only tools are dynamic now get the parallel-calls note in their system prompt, and the $eve.tool_count span attribute counts the tools offered to the model rather than the tools the agent declares. (#5638)

Features

• The provided bash tool accepts an optional timeout in seconds, so the model can wait up to 120 seconds for a build or test suite before the command keeps running in the background.
  Calls without timeout still wait 30 seconds. Values above 120 wait 120 seconds, and values below 1 wait 1 second. A command still running after the wait returns status: "running" as before. (#5813)
• eve/events exports createStreamChecker, which checks a stored session stream against its lifecycle rules.
  Run it over a stored or recorded stream to find lines that break the lifecycle rules, such as a turn that settles twice or a fact that names something never introduced. Its StreamChecker, Violation, and ViolationRule types, and the StoredLine, CommitLine, and ProgressLine types it reads, are exported beside it. (#5834)
• Slack message hooks can return status: "deferred" to keep a message's turn quiet until a tool call finishes, and guidance to tell the model how to treat that one message, so an agent can follow a thread and stay silent with no_reply when a reply isn't meant for it.
  status: "deferred" skips the received acknowledgement. Mentions and DMs outside code channels get that acknowledgement before their hook runs, so for them it keeps only the rest of the turn quiet. A message that isn't deferred and joins the turn shows the status again. eve adds guidance as a <guidance> block inside the message's <slack_message> or <slack_message_edit> block, after the metadata and before the content. The Slack docs show how to follow threads the agent already serves with onMessage.
  Message edits now go through an app's own message hooks. Without an authored onMessageEdited, an edit goes to the hook a new message of the same kind would reach: onDirectMessage, then onMessage, for DMs; onAppMention, then onMessage, for messages that mention the agent; onMessage, then onAppMention, in code channels; and onMessage for other messages. Without those hooks, the built-in defaults send edits to DMs, code channel messages, and messages that mention the agent before or after the edit, and drop the rest. Edits are always quiet and ignore status, and an authored onEvent still comes before this default. The new ctx.edit is set while a hook decides an edit.
  In 1.0.0-rc.2, an authored onAppMention, onDirectMessage, or onMessage turned off edits unless the app also defined onMessageEdited. Those hooks now also run for edits in threads that have a session. If a hook has side effects, such as ctx.send(), ctx.end(), or a decision model call, return early when ctx.edit is set. To keep edits off, define onMessageEdited and return null. (#5801)
• The provided bash tool shows the model its output as plain text instead of JSON, so source code, diffs, and test logs reach the model without escaped newlines and quotes.
  The model reads stdout, then any stderr after a [stderr] line, then a final [exit code: N] line; for a command still running, its instructions replace the exit code line. The tool's execute output, its output schema, and call.settled events keep the structured fields. Authored code that reads the conversation, through ctx.messages in tools or ctx.messages() in dynamic capabilities, sees this text for new bash results, and sessions keep the JSON results they already saved. A bash tool published over MCP sends the text in content[0].text, and its structuredContent keeps the structured fields. Wrappers that spread bash keep the plain-text view: a wrapper's execute that returns a string reaches the model as text, and any other shape as JSON. (#5822)
• auto() from eve/models and eve/tools/approval accept modelOptions.providerOptions, and decide() accepts providerOptions, so decision calls can set options such as AI Gateway's zeroDataRetention. (#5846)
• The code extension (eve/extensions/code) sends a prompt about a third of its previous size (4,942 to 1,636 characters) that keeps only coding and safety rules, so agents spend fewer tokens on every step.
  The prompt no longer assumes a chat product or sets consumer policy, such as brevity, asking one question, avoiding em dashes, omitting private references, or not rebasing. Agents that relied on those rules should state them in their own agent/instructions.md. Agents publish or write to external systems only when the requester asks for it or for an outcome that requires it, such as a pull request. The prompt asks agents to edit files with the editing tool instead of the shell, and no longer names apply_patch specifically. The issue and design checklists moved into the code__investigate skill. (#5805)
• Update the bundled Workflow runtime to 5.3.0 and create new runs with Workflow spec version 9, which drives each run from one orchestrator.
  Workflow 5.3.0 lets parallel branches advance inline steps without waiting on slower siblings, reuses resolved hooks to skip token lookups on later resumes, and fixes a step that could be created but never run when two executions raced in one process. eve now sets WORKFLOW_SPEC_VERSION=9 before it creates a world unless WORKFLOW_SPEC_VERSION or WORKFLOW_SEALED_LOG is already set. Set WORKFLOW_SPEC_VERSION=8 to keep creating spec 8 runs. Existing runs keep their version. (#5860)

Bug Fixes

• Fix durable agent traces keeping every finished turn that called tools in parallel: each one stayed in the session's serialized context, so step inputs grew with every turn.
  A checkpoint this process had already written, read back through another execution context, was treated as another process's write and forked the turn's trace tree; the stale copy then overwrote the tool completions and the checkpoint was never deleted. A replaced tree now also stops persisting. (#5835)
• User-role instructions, static and dynamic, now join the conversation the same way: once ahead of the next turn's input, again when their content changes, and again after a compaction or clear removes them from the history.
  A newer deployment that changes a static user-role instruction adds the new text to existing sessions instead of keeping the text the session started with. Sessions that already hold an instruction don't receive it twice. (#5638)
• Every eve build now reads paths aliases from the authored package's own tsconfig.json or jsconfig.json, and an asset import that leaves the authored package fails the build.
  The Nitro host, authored module bundles, and the workflow driver share one resolver. The workflow driver no longer searches parent directories for a config, and an agent directory without its own package.json uses the enclosing package's config in every build. Before, only ?raw asset imports were checked against the package root; now plain imports such as import notes from "../../notes.txt" are checked too. If a build fails with "resolves outside package root", move the file into the authored package or into the workspace package that imports it. (#5879)
• Model calls made by decide() from eve/ai, and so by auto() and approval auto(), now count toward the session's usage and limits.sessionUsage. (#5638)
• Inline tool execution now requires permission from eve's approval gate.
  When a person answers the same call more than once, eve uses their latest answer. (#5638)
• eve now records which of its catalog tools a session has been offered in the same session state as its other definitions, rather than under a separate context key.
  A session an earlier deployment ran still keeps every catalog tool it was offered. (#5638)
• Under eve dev, eve now throws if a tool call starts before its approval is accepted, or names a different approval as what cleared it. (#5638)
• Compacting a session between turns no longer repeats the last question after its answer, so the next turn's new message follows the summary and recent history instead of an already-answered question. (#5638)
• Keep child questions and approvals answerable while a serving task remains active after replying to its original call.
  Upgrading a session whose history was cleared or compacted also restores its dynamic user instructions before the next model call. (#5638)
• Fix tool-stub validation for memory-only agents, mounted dynamic connection names, and sandbox skill files when an earlier definition starts offering a colliding skill.
  The chosen model also remains visible to session code across separately bundled runtime modules. (#5638)
• Dynamic connection resolvers can exchange names within one evaluation without a transient collision, and namespaced tools and skills retain their full name-length validation. (#5638)
• Fix release asset uploads failing with 401 through the git extension's gh tool.
  The credential lease now covers uploads.github.com, not only api.github.com and github.com. A 401 there was read as a revoked token and opened a sign-in for a user who was already signed in.
  When Vercel Connect starts an authorization without a sign-in URL or device code, the user-scoped GitHub sign-in now fails with ConnectionAuthorizationFailedError instead of opening a sign-in prompt with no link. (#5852)
• A workflow tool's question that reaches the session after its turn was cancelled no longer fails the session: eve drops it, and the next message starts a turn. (#5638)
• Memory slots and schedule collections now offer their tools themselves, so agent info no longer lists them as generated dynamic tool files.
  A tool file at agent/tools/<slot>.ts or agent/tools/schedule__<name>.ts still replaces those tools, and disableTool() there still removes them. Sessions and approvals parked across the upgrade keep working. (#5638)
• Upgrade Nitro to 3.0.261103-rc, the first Nitro 3 release candidate eve builds on.
  eve now declares Rolldown 1.2.16 itself and hands that copy to Nitro, so a plain npm install builds without relying on another package to provide Rolldown, and Nitro never installs a package into your app on demand. Importing nitro/storage, nitro/kv, or nitro/database from agent code now fails the build with an explanation instead of pulling in storage drivers. A request with a method its path doesn't declare, other than HEAD, now gets 405 Method Not Allowed with an Allow header instead of 404. eve dev runs on env-runner 0.3, and a stopped eve start server runs Nitro's close hooks and exits on its own.
  Thanks @pi0 for the investigation in #5167. (#5870)
• eve now compiles an agent's dynamic tool, skill, connection, and instructions files, hooks, and memories to one list in the compiled manifest, and runs them as definitions of one shape.
  Rebuild agents after upgrading; authored files don't change. (#5638)
• The discovery manifest in .eve/discovery/agent-discovery-manifest.json now lists an agent's authored files in one sources array, with each file's kind given by its path, instead of one array per kind. (#5638)
• Session history now changes in one place, which checks every message as it joins, and under eve dev fails a step whose tool results don't follow the calls they answer.
  A turn that fails after the model delivered its structured reply keeps that reply in history instead of an unanswered eve__reply call. A compaction whose summary model fails to resolve now appears on the stream as a failed compaction instead of failing the turn before it starts. (#5638)
• The model no longer sees an "awaiting approval" note in history after the approval it describes is answered or dropped, because eve now tells each model call about pending approvals from the session's current state instead of writing a note into history when the call parks. (#5638)
• eve now renders each model call's system prompt from the current deployment's agent files instead of storing it with the session.
  Session checkpoints move to version 19, without agent.system. A deployment from before this change refuses to take over a session this one wrote, so the session stays on the deployment that wrote it, such as after a rollback. (#5638)
• A turn's input now joins history before its first model call, so a model call that fails keeps the person's message for the next turn.
  A response the provider filters is the exception: a refusal note replaces its turn's input, so the next turn doesn't send that input again. Completed tool calls and their results stay in history, so the model knows which actions already ran.
  A compaction now opens only once it summarizes or rewrites the history, so session.compact() records no change when its model doesn't resolve or the history has nothing to compact. (#5638)
• eve's session loop now runs as a kernel that owns every session transition, with no change in behavior. (#5638)
• Prevent gh-signed-commit from publishing another file's contents for paths that resemble Git stage syntax or silently losing file modes and types.
  The command now reads staged paths literally and rejects additions or updates involving executable files, symlinks, submodules, or mode changes before contacting GitHub. Staged changes remain intact; publish unsupported changes with native Git and a configured signing key. (#5863)
• Ending a stranded session now writes the same checked commit as any other session end.
  A stranded stream that never recorded session.started, such as one an older deployment opened, gets it in the commit that ends the session. (#5638)
• Self-hosted eve servers now close their Workflow world on shutdown, so a pending workflow sleep or delivery retry no longer holds the process open until the supervisor kills it.
  If closing the world fails or takes longer than 5 seconds, eve logs it and still runs the rest of its shutdown, including sandbox shutdown and the final trace flush. (#5879)