eve 0.15.4 → 0.16.0

package/docs/guides/frontend/overview.mdx

@@ -72,9 +72,9 @@ export function Chat() {
 | `stop`    | Abort the active request.                                                      |
 | `reset`   | Clear local events, data, errors, and the local session cursor.                |
 
-Most chat UIs only need `data.messages` and `status`. Drop down to `events` to render lower-level activity such as tool calls and reasoning deltas that the default reducer doesn't surface.
+Most chat UIs only need `data.messages` and `status`. Drop down to `events` when you need the authoritative wire events directly, for example to persist an audit log or build a custom projection.
 
-`data.messages` are `EveMessage[]` following the AI SDK `UIMessage` convention, so they drop straight into any AI SDK UI primitive that accepts a `UIMessage[]`. Parts include user text, assistant text, reasoning, tool calls, tool results, and input requests.
+`data.messages` are `EveMessage[]` following the AI SDK `UIMessage` convention, so they drop straight into any AI SDK UI primitive that accepts a `UIMessage[]`. Parts include user text, assistant text, reasoning, tool calls, tool results, input requests, and connection authorization prompts.
 
 ## Sending and streaming
 
@@ -117,6 +117,38 @@ if (request) {
 
 `request.prompt` and `request.options` give you what you need to render the approve and deny UI. The default reducer marks the part as responded immediately, then updates it again once eve streams the resumed result.
 
+## Authorization prompts
+
+Connections and tools that need OAuth or another grant emit `authorization.required`. The default reducer projects that into an `authorization` message part with the display name, instructions, device code, and user-facing sign-in URL. Render that part as a normal chat message, then keep the session cursor; eve resumes the parked turn when the callback completes and updates the part after `authorization.completed`:
+
+```tsx
+import type { EveMessagePart } from "eve/react";
+
+function AuthorizationPrompt({ part }: { part: EveMessagePart }) {
+  if (part.type !== "authorization") return null;
+
+  if (part.state === "completed") {
+    return (
+      <p>
+        {part.outcome === "authorized"
+          ? `${part.displayName} connected.`
+          : `${part.displayName} authorization ${part.outcome}.`}
+      </p>
+    );
+  }
+
+  return (
+    <section>
+      <p>{part.description}</p>
+      {part.authorization?.userCode ? <code>{part.authorization.userCode}</code> : null}
+      {part.authorization?.url ? <a href={part.authorization.url}>Sign in</a> : null}
+    </section>
+  );
+}
+```
+
+For fully custom state machines, `authorization.required` and `authorization.completed` are still available on `events` and `onEvent`.
+
 ## Attach page context per turn
 
 `clientContext` adds ephemeral context for the next model call only. Strings (or an array of strings) become user-role context messages; an object is JSON-serialized into one. It rides along with a message or HITL response, so it never dispatches a turn on its own and never lands in durable session history. Pass it directly to `send()`:
@@ -222,8 +254,6 @@ For multiple chat threads, keep one saved event log and session cursor per threa
 
 If the user can refresh or navigate immediately after pressing send, create your app-level chat row and store the pending user message before calling `send()`. After the request starts, persist the session state as soon as it contains a `sessionId`, then reconnect an interrupted in-flight turn with `session.stream({ startIndex: savedEvents.length })` from the lower-level client.
 
-Connection authorization prompts need one extra bit of UI state. eve emits `authorization.required` when a tool needs OAuth or another connection grant. Treat that as a parked chat turn for rendering and persistence: show the authorization prompt, disable ordinary text input for that thread, and keep the session cursor so the callback or a structured decline can continue the same session.
-
 ## Custom hosts and headers
 
 Pass `host` when the eve server isn't same-origin, and pass `auth` or `headers` when the channel needs credentials. Function values are re-resolved before every HTTP request, reconnects included:

package/docs/guides/frontend/sveltekit.mdx

@@ -69,13 +69,13 @@ With the plugin in `vite.config.ts`, components call [`useEveAgent`](./use-eve-a
 </form>
 ```
 
-The default eve channel is fail-closed. With no `agent/channels/eve.ts` authored, eve registers `eveChannel({ auth: [localDev(), vercelOidc()] })`: `localDev()` opens the routes on localhost, `vercelOidc()` admits Vercel OIDC callers in production, and everything else gets a `401`. To set your own auth policy, add `agent/channels/eve.ts`:
+The default eve channel is fail-closed. With no `agent/channels/eve.ts` authored, eve registers `eveChannel({ auth: [vercelOidc(), localDev()] })`: `vercelOidc()` gets the first chance to resolve a Vercel caller, `localDev()` opens the remaining localhost requests, and everything else gets a `401`. To set your own auth policy, add `agent/channels/eve.ts`:
 
 ```ts title="agent/channels/eve.ts"
 import { eveChannel } from "eve/channels/eve";
 import { localDev, vercelOidc } from "eve/channels/auth";
 
-export default eveChannel({ auth: [localDev(), vercelOidc()] });
+export default eveChannel({ auth: [vercelOidc(), localDev()] });
 ```
 
 For a public demo, use `none()` (also from `eve/channels/auth`) to skip authentication. See [Channels](../../channels/overview) and [Auth & route protection](../auth-and-route-protection).

package/docs/reference/cli.md

@@ -100,7 +100,7 @@ Pass a bare URL as the only argument and the UI connects to that server instead
 | `-u, --url <url>`                   | string | none               | Connect to an existing server URL instead of starting one                                 |
 | `--no-ui`                           | flag   | UI on              | Start the server without an interactive UI                                                |
 | `--name <name>`                     | string | app folder name    | Title shown in the terminal UI                                                            |
-| `--input <text>`                    | string | none               | Pre-fill the prompt input after launching the UI (editable, not auto-submitted)           |
+| `--input <text>`                    | string | none               | Pre-fill the prompt input; bare local `/model` starts onboarding                          |
 | `--tools <mode>`                    | enum   | `auto-collapsed`   | Tool-call rendering: `full` \| `collapsed` \| `auto-collapsed` \| `hidden`                |
 | `--reasoning <mode>`                | enum   | `full`             | Reasoning rendering: `full` \| `collapsed` \| `auto-collapsed` \| `hidden`                |
 | `--subagents <mode>`                | enum   | `auto-collapsed`   | Subagent-section rendering: `full` \| `collapsed` \| `auto-collapsed` \| `hidden`         |
@@ -109,6 +109,8 @@ Pass a bare URL as the only argument and the UI connects to that server instead
 | `--context-size <tokens>`           | number | none               | Model context window size, shown as a usage percentage                                    |
 | `--logs <mode>`                     | enum   | `stderr`           | Server/agent logs to show: `all` \| `stderr` \| `sandbox` \| `none`                       |
 
+A fresh `eve init` passes `--input /model`. That bare local input starts onboarding: the TUI installs the Vercel CLI if needed, asks you to log in if needed, then opens `/model`. Other input stays editable in the prompt.
+
 Local dev records the last ready URL per resolved app root in `.eve/dev-server-state.v1.json`. A second interactive `eve dev` reconnects only when that URL is loopback and healthy; each terminal UI creates a fresh client session while sharing the server process. A stale or malformed record is replaced when eve starts a new server. Passing `--host`, `--port`, or a `PORT` environment value skips reconnection and reports a healthy recorded server instead.
 
 Local dev keeps immutable runtime source snapshots under `.eve/dev-runtime/snapshots/` so in-flight sessions hold a consistent code revision while new prompts pick up rebuilds. On startup, `eve dev` prunes stale runtime snapshots and old local sandbox templates in the background. For manual cleanup, stop `eve dev` and delete `.eve/dev-runtime/snapshots/` or `.eve/sandbox-cache/local/templates/`.

package/docs/tutorial/ship-it.mdx

@@ -113,7 +113,7 @@ const appAuth: AuthFn<Request> = async (request) => {
 };
 
 export default eveChannel({
-  auth: [appAuth, localDev(), vercelOidc()],
+  auth: [appAuth, vercelOidc(), localDev()],
 });
 ```
 

package/docs/tutorial/team-playbooks.mdx

@@ -71,7 +71,7 @@ const devTeam: AuthFn<Request> = () =>
       };
 
 export default eveChannel({
-  auth: [devTeam, localDev(), vercelOidc(), placeholderAuth()],
+  auth: [devTeam, vercelOidc(), localDev(), placeholderAuth()],
 });
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.15.4",
+  "version": "0.16.0",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [
@@ -269,7 +269,7 @@
   "devDependencies": {
     "@ai-sdk/anthropic": "^4.0.0",
     "@ai-sdk/google": "^4.0.0",
-    "@ai-sdk/mcp": "^2.0.0",
+    "@ai-sdk/mcp": "^2.0.1",
     "@ai-sdk/openai": "^4.0.0",
     "@ai-sdk/otel": "^1.0.0",
     "@ai-sdk/provider": "^4.0.0",

package/dist/src/internal/nitro/host/dev-rebuild-registry.d.ts

@@ -1,5 +0,0 @@
-export interface DevelopmentRebuildHandle {
-    flush(): Promise<void>;
-}
-export declare function registerDevelopmentRebuildHandle(appRoot: string, handle: DevelopmentRebuildHandle): () => void;
-export declare function flushDevelopmentRebuild(appRoot: string): Promise<void>;

package/dist/src/internal/nitro/host/dev-rebuild-registry.js

@@ -1 +0,0 @@
-import{resolve}from"node:path";const developmentRebuildHandles=new Map;function registerDevelopmentRebuildHandle(e,t){let n=resolve(e);return developmentRebuildHandles.set(n,t),()=>{developmentRebuildHandles.get(n)===t&&developmentRebuildHandles.delete(n)}}async function flushDevelopmentRebuild(e){await developmentRebuildHandles.get(resolve(e))?.flush()}export{flushDevelopmentRebuild,registerDevelopmentRebuildHandle};