eve 0.27.5 → 0.27.7

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # eve
 
+## 0.27.7
+
+### Patch Changes
+
+- 3c53306: Vercel builds now run a single Nitro build. The workflow flow function is emitted through Nitro's per-route `functionRules` (queue trigger, `maxDuration: "max"`, precondition guard) instead of a second standalone Nitro build that was copied and retargeted into the output, making `eve build` on Vercel roughly twice as fast.
+- e368fcd: The client's `session.stream()` accepts `follow: false` for bounded catch-up reads (`follow` defaults to `true`, following the live stream): it consumes events from the cursor to the durable tail observed when the stream opens — surviving reconnects and still advancing the stored `streamIndex` — then returns instead of following the live stream. The HTTP stream route reports the durable tail as the `x-eve-stream-tail-index` response header when a request opts in with `includeTailIndex=1`, and channel-authoring `Session` objects gain `getStreamTailIndex()` for serving bounded reads from custom routes.
+- 7e4f7ef: Tool calls whose arguments arrive as a raw JSON string (e.g. provider-executed server tools) are now parsed, and arguments that cannot be parsed at all — such as malformed JSON emitted by the model — surface as a failed tool result the model can react to instead of failing the whole turn.
+
+## 0.27.6
+
+### Patch Changes
+
+- 0a8b63c: `eve channels add` now scaffolds portable channel variants when Vercel is unavailable and asks before deploying Vercel-integrated channels. Portable Slack setup uses environment credentials and records the required variables in `.env.example`.
+- ad0dfa7: Remote agents can now forward the end user's identity across deployments. `defineRemoteAgent({ forwardPrincipal: true })` sends the dispatching turn's session principal (metadata only — never tokens) on the create-session request, and the receiving deployment opts in with `eveChannel({ trustedForwarders })`, a predicate over the verified transport forwarder. Accepted forwarding replaces the session principal so per-user connections, local subagents, and chained remote hops see the original user; a receiver that refuses the forwarder (or accepts no forwarded principal) rejects with 403 and the dispatch fails instead of silently downgrading to the calling service's identity.
+- ad0dfa7: Remote agent dispatch now ignores an empty `outputSchema` (`{}`) passed by the model on the lowered subagent tool call, matching local subagent dispatch. An empty schema constrains nothing, but forwarding it flipped the remote child into structured-output mode and replaced its text reply with `{}`.
+- 5cf8ae0: Make `eve dev` return the terminal after one Ctrl+C or termination signal. The local server gets a bounded cleanup window before process-group termination, and interrupted sandbox cleanup resumes on the next start. A forced exit (second Ctrl+C or the shutdown backstop) now restores the terminal — raw mode, cursor, bracketed paste — before the process ends.
+- c2079a4: Preserve remote agent base paths when creating sessions and cancelling turns, so same-origin agents mounted below a route prefix no longer receive requests at the wrong endpoint.
+
 ## 0.27.5
 
 ### Patch Changes

package/dist/src/channel/forwarded-principal.d.ts

@@ -0,0 +1,74 @@
+import type { SessionAuthContext } from "#channel/types.js";
+/**
+ * Attribute key the receiving deployment stamps onto accepted forwarded
+ * principal contexts. Holds the verified transport forwarder's `principalId`,
+ * always overwriting any sender-supplied value — a forwarder must not be able
+ * to falsify the audit trail. On multi-hop chains the attribute names the
+ * most recent hop only.
+ */
+export declare const FORWARDED_BY_ATTRIBUTE = "eve:forwarded-by";
+/**
+ * Wire shape of the create-session `forwardedPrincipal` body field: the
+ * dispatching turn's session principals, asserted by a trusted forwarder.
+ * Only principal metadata crosses the wire — never tokens or credentials.
+ */
+export interface ForwardedPrincipal {
+    readonly current: SessionAuthContext;
+    readonly initiator?: SessionAuthContext;
+}
+/**
+ * Authorizes which transport-authenticated forwarders may assert a forwarded
+ * principal. Receives the *verified* route-auth principal (who is asserting),
+ * never the forwarded identity (what is asserted).
+ */
+export type TrustedForwarders = (forwarder: SessionAuthContext) => boolean | Promise<boolean>;
+export type ForwardedPrincipalParseResult = {
+    readonly forwardedPrincipal: ForwardedPrincipal;
+    readonly ok: true;
+} | {
+    readonly cause: unknown;
+    readonly message: string;
+    readonly ok: false;
+};
+/**
+ * The create route's effective session principals after the forwarded
+ * principal gate: the transport principal untouched when the body carries no
+ * assertion, or the stamped forwarded contexts once a trusted forwarder's
+ * assertion is accepted.
+ */
+export type ResolvedForwardedPrincipal = {
+    readonly accepted: false;
+    readonly auth: SessionAuthContext;
+} | {
+    readonly accepted: true;
+    readonly auth: SessionAuthContext;
+    readonly initiatorAuth: SessionAuthContext;
+};
+/**
+ * Gates the create-session `forwardedPrincipal` body field and resolves the
+ * effective session principals. Returns the failure `Response` on rejection:
+ * 403 when the channel accepts no forwarded principal or the predicate
+ * refuses the forwarder, 400 on a malformed payload, 500 when the authored
+ * predicate throws. Accepted contexts are stamped with
+ * {@link FORWARDED_BY_ATTRIBUTE} before they are returned, so a custom
+ * `onMessage` always sees the transport forwarder on the replaced principal.
+ */
+export declare function resolveForwardedPrincipal(input: {
+    readonly trustedForwarders: TrustedForwarders | undefined;
+    readonly forwarder: SessionAuthContext;
+    readonly payload: Record<string, unknown>;
+}): Promise<ResolvedForwardedPrincipal | Response>;
+/**
+ * Parses the create-session `forwardedPrincipal` body field against the
+ * strict wire schema. Mirrors `parseSessionCallback` for `callback`: strict
+ * keys, formatted error strings, and no exceptions.
+ */
+export declare function parseForwardedPrincipal(value: unknown): ForwardedPrincipalParseResult;
+/**
+ * Returns a copy of `context` with {@link FORWARDED_BY_ATTRIBUTE} set to the
+ * verified transport forwarder's `principalId`, overwriting any
+ * sender-supplied value. Attributes never affect Connect token-cache keying
+ * (`principalKey` reads only issuer + id), so stamping is purely an audit
+ * trail.
+ */
+export declare function stampForwardedBy(context: SessionAuthContext, forwardedBy: string): SessionAuthContext;

package/dist/src/channel/forwarded-principal.js

@@ -0,0 +1 @@
+import{createLogger,logError}from"#internal/logging.js";import{z}from"#compiled/zod/index.js";const log=createLogger(`channel.forwarded-principal`),FORWARDED_BY_ATTRIBUTE=`eve:forwarded-by`,attributeValueSchema=z.union([z.string(),z.array(z.string()).readonly()]),forwardedPrincipalContextSchema=z.object({attributes:z.record(z.string(),attributeValueSchema).readonly(),authenticator:z.string().min(1),issuer:z.string().min(1).optional(),principalId:z.string().min(1),principalType:z.string().min(1),subject:z.string().min(1).optional()}).strict(),forwardedPrincipalSchema=z.object({current:forwardedPrincipalContextSchema,initiator:forwardedPrincipalContextSchema.optional()}).strict();async function resolveForwardedPrincipal(e){let n=e.payload.forwardedPrincipal;if(n===void 0)return{accepted:!1,auth:e.forwarder};if(e.trustedForwarders===void 0)return Response.json({error:`This deployment does not accept a forwarded principal.`,ok:!1},{status:403});let r=parseForwardedPrincipal(n);if(!r.ok)return Response.json({error:r.message,ok:!1},{status:400});let i;try{i=await e.trustedForwarders(e.forwarder)}catch(n){let r=logError(log,`trustedForwarders handler failed`,n,{forwarder:e.forwarder.principalId});return Response.json({error:`trustedForwarders handler failed.`,errorId:r,ok:!1},{status:500})}if(!i)return Response.json({error:`Caller is not authorized to assert a forwarded principal.`,ok:!1},{status:403});let a=stampForwardedBy(r.forwardedPrincipal.current,e.forwarder.principalId);return{accepted:!0,auth:a,initiatorAuth:r.forwardedPrincipal.initiator===void 0?a:stampForwardedBy(r.forwardedPrincipal.initiator,e.forwarder.principalId)}}function parseForwardedPrincipal(e){let t=forwardedPrincipalSchema.safeParse(e);if(t.success){let e=toSessionAuthContext(t.data.current);return{forwardedPrincipal:t.data.initiator===void 0?{current:e}:{current:e,initiator:toSessionAuthContext(t.data.initiator)},ok:!0}}return{cause:t.error,message:formatForwardedPrincipalParseError(t.error),ok:!1}}function stampForwardedBy(e,t){return{...e,attributes:{...e.attributes,[FORWARDED_BY_ATTRIBUTE]:t}}}function toSessionAuthContext(e){let t={attributes:e.attributes,authenticator:e.authenticator,principalId:e.principalId,principalType:e.principalType};return e.issuer!==void 0&&(t.issuer=e.issuer),e.subject!==void 0&&(t.subject=e.subject),t}function formatForwardedPrincipalParseError(e){return`Invalid forwardedPrincipal metadata: ${e.issues.map(e=>`${e.path.length===0?`forwardedPrincipal`:`forwardedPrincipal.${e.path.join(`.`)}`}: ${e.message}`).join(`; `)}`}export{FORWARDED_BY_ATTRIBUTE,parseForwardedPrincipal,resolveForwardedPrincipal,stampForwardedBy};

package/dist/src/channel/routes.d.ts

@@ -71,6 +71,13 @@ type BaseSendOptions = {
     auth: SessionAuthContext | null;
     callback?: SessionCallback;
     continuationToken: string;
+    /**
+     * The original (top-level) caller's auth for a newly started session,
+     * becoming `session.auth.initiator`. Defaults to {@link auth} when omitted
+     * (root session behavior). Ignored when the send resolves to an existing
+     * session, whose initiator never changes after start.
+     */
+    initiatorAuth?: SessionAuthContext | null;
     mode?: RunMode;
     /**
      * Human-readable title for a newly started workflow session. Defaults to

package/dist/src/channel/send.js

@@ -1 +1 @@
-import{createSession}from"#channel/session.js";import{isRuntimeNoActiveSessionError}from"#execution/runtime-errors.js";import{serializeUrlFilePart}from"#internal/attachments/url-refs.js";function createSendFn(n,r,i,a={}){return async(o,s)=>{let c=s.auth,l=s.callback,u=s.mode??`conversation`,d=s.state,f=s.title,p=s.continuationToken,m=`${i}:${p}`,{message:h,inputResponses:g,context:_,outputSchema:v}=normalizeSendInput(o),y=serializeUrlFilePartsInMessage(h);try{let t={auth:c,continuationToken:m,requestId:a.requestId,payload:{inputResponses:g,message:y,context:_,outputSchema:v}},{sessionId:r}=await n.deliver(t);return createSession(r,p,n)}catch(e){if(!isRuntimeNoActiveSessionError(e))throw e}if(g&&g.length>0)throw Error(`Cannot deliver inputResponses — the target session was not found via continuation token.`);let b={adapter:d?{...r,state:{...r.state,...d}}:r,auth:c,capabilities:u===`conversation`?{requestInput:!0}:void 0,channelName:i,callback:l,continuationToken:m,input:{message:y??``,context:_,outputSchema:v},mode:u,requestId:a.requestId,title:f};return createSession((await n.run(b)).sessionId,p,n)}}function serializeUrlFilePartsInMessage(e){if(e===void 0||typeof e==`string`)return e;let t=!1,r=e.map(e=>e.type===`file`&&e.data instanceof URL&&e.data.protocol!==`data:`?(t=!0,{...e,data:serializeUrlFilePart(e.data)}):e);return t?r:e}function normalizeSendInput(e){return typeof e==`string`||Array.isArray(e)?{message:e}:e}export{createSendFn};
+import{createSession}from"#channel/session.js";import{isRuntimeNoActiveSessionError}from"#execution/runtime-errors.js";import{serializeUrlFilePart}from"#internal/attachments/url-refs.js";function createSendFn(n,r,i,a={}){return async(o,s)=>{let c=s.auth,l=s.initiatorAuth,u=s.callback,d=s.mode??`conversation`,f=s.state,p=s.title,m=s.continuationToken,h=`${i}:${m}`,{message:g,inputResponses:_,context:v,outputSchema:y}=normalizeSendInput(o),b=serializeUrlFilePartsInMessage(g);try{let t={auth:c,continuationToken:h,requestId:a.requestId,payload:{inputResponses:_,message:b,context:v,outputSchema:y}},{sessionId:r}=await n.deliver(t);return createSession(r,m,n)}catch(e){if(!isRuntimeNoActiveSessionError(e))throw e}if(_&&_.length>0)throw Error(`Cannot deliver inputResponses — the target session was not found via continuation token.`);let x={adapter:f?{...r,state:{...r.state,...f}}:r,auth:c,capabilities:d===`conversation`?{requestInput:!0}:void 0,channelName:i,callback:u,continuationToken:h,input:{message:b??``,context:v,outputSchema:y},mode:d,requestId:a.requestId,title:p};return l!==void 0&&(x.initiatorAuth=l),createSession((await n.run(x)).sessionId,m,n)}}function serializeUrlFilePartsInMessage(e){if(e===void 0||typeof e==`string`)return e;let t=!1,r=e.map(e=>e.type===`file`&&e.data instanceof URL&&e.data.protocol!==`data:`?(t=!0,{...e,data:serializeUrlFilePart(e.data)}):e);return t?r:e}function normalizeSendInput(e){return typeof e==`string`||Array.isArray(e)?{message:e}:e}export{createSendFn};

package/dist/src/channel/session.d.ts

@@ -30,6 +30,11 @@ export interface Session {
     getEventStream(options?: {
         startIndex?: number;
     }): Promise<ReadableStream<HandleMessageStreamEvent>>;
+    /**
+     * Resolves the durable tail of the event stream: the zero-based index of
+     * the last recorded event, or `-1` before the first.
+     */
+    getStreamTailIndex(): Promise<number>;
 }
 /**
  * Live handle to the current session, exposed on `ctx.session` to

package/dist/src/channel/session.js

@@ -1 +1 @@
-import{AuthKey,ContinuationTokenKey,InitiatorAuthKey,SessionIdKey}from"#context/keys.js";function createSession(e,t,n){return{id:e,continuationToken:t,async cancel(t){return n.cancelTurn({sessionId:e,turnId:t?.turnId})},async getEventStream(t){return n.getEventStream(e,t)}}}function createGetSessionFn(e){return t=>createSession(t,``,e)}function buildSessionHandle(i){return{get id(){return i.get(SessionIdKey)??``},get continuationToken(){return i.get(ContinuationTokenKey)??``},get auth(){return{current:i.get(AuthKey)??null,initiator:i.get(InitiatorAuthKey)??null}},setContinuationToken(e){let n=i.get(ContinuationTokenKey)??``,r=namespaceContinuationToken(n,e);n!==r&&i.set(ContinuationTokenKey,r)}}}function namespaceContinuationToken(e,t){let n=e.indexOf(`:`);if(n<=0)throw Error(`Cannot set session continuation token without an existing namespaced continuation token. Start the session with a placeholder continuationToken.`);return`${e.slice(0,n+1)}${t}`}export{buildSessionHandle,createGetSessionFn,createSession};
+import{AuthKey,ContinuationTokenKey,InitiatorAuthKey,SessionIdKey}from"#context/keys.js";function createSession(e,t,n){return{id:e,continuationToken:t,async cancel(t){return n.cancelTurn({sessionId:e,turnId:t?.turnId})},async getEventStream(t){return n.getEventStream(e,t)},async getStreamTailIndex(){return n.getStreamTailIndex(e)}}}function createGetSessionFn(e){return t=>createSession(t,``,e)}function buildSessionHandle(i){return{get id(){return i.get(SessionIdKey)??``},get continuationToken(){return i.get(ContinuationTokenKey)??``},get auth(){return{current:i.get(AuthKey)??null,initiator:i.get(InitiatorAuthKey)??null}},setContinuationToken(e){let n=i.get(ContinuationTokenKey)??``,r=namespaceContinuationToken(n,e);n!==r&&i.set(ContinuationTokenKey,r)}}}function namespaceContinuationToken(e,t){let n=e.indexOf(`:`);if(n<=0)throw Error(`Cannot set session continuation token without an existing namespaced continuation token. Start the session with a placeholder continuationToken.`);return`${e.slice(0,n+1)}${t}`}export{buildSessionHandle,createGetSessionFn,createSession};

package/dist/src/channel/types.d.ts

@@ -368,6 +368,13 @@ export interface Runtime {
      * parameter unchanged.
      */
     getEventStream(sessionId: string, options?: GetEventStreamOptions): Promise<ReadableStream<HandleMessageStreamEvent>>;
+    /**
+     * Resolves the durable tail of a session's event stream: the zero-based
+     * index of the last recorded event, or `-1` before the first. Callers use
+     * it to bound a read at the tail they observed instead of following the
+     * live stream.
+     */
+    getStreamTailIndex(sessionId: string): Promise<number>;
 }
 /**
  * Options accepted by {@link Runtime.getEventStream}.

package/dist/src/chunks/{use-eve-agent-BtkhbY2I.js → use-eve-agent-JPfBHZJr.js}

@@ -299,6 +299,7 @@ function safeJsonStringify(value) {
 //#endregion
 //#region src/protocol/message.ts
 const EVE_SESSION_ID_HEADER = "x-eve-session-id";
+const EVE_STREAM_TAIL_INDEX_HEADER = "x-eve-stream-tail-index";
 const textEncoder = new TextEncoder();
 function isCurrentTurnBoundaryEvent(event) {
 	return event.type === "session.completed" || event.type === "session.failed" || event.type === "session.waiting";
@@ -531,32 +532,47 @@ function resolveStreamReconnectPolicy(policy) {
 	};
 }
 async function* followStreamIterable(input) {
+	if (input.follow === false && input.startIndex < 0) throw new Error("stream({ follow: false }) requires a nonnegative startIndex; a tail-relative cursor cannot be bounded.");
 	const retryPolicy = resolveStreamReconnectPolicy(input.streamReconnectPolicy);
 	const idleRetryPolicy = retryPolicy.streamIdleReconnectPolicy;
 	let startIndex = input.startIndex;
 	let reconnectDelayMs = idleRetryPolicy.baseDelayMs;
 	let idleReconnects = 0;
 	let initialConnection = true;
+	let tailIndex;
 	while (true) {
-		let body;
+		let connection;
 		try {
-			body = await openStreamBody({
+			connection = await openStreamBody({
 				...input,
 				retryPolicy,
-				startIndex
+				startIndex,
+				requestTailIndex: input.follow === false && tailIndex === void 0
 			});
 		} catch (error) {
 			if (input.signal?.aborted) return;
 			throw error;
 		}
+		if (input.follow === false && tailIndex === void 0) {
+			tailIndex = connection.tailIndex;
+			if (tailIndex === void 0) {
+				await connection.body.cancel().catch(() => {});
+				throw new Error(`stream({ follow: false }) requires the server to report the ${EVE_STREAM_TAIL_INDEX_HEADER} header. The agent may be running an older eve version.`);
+			}
+		}
+		if (tailIndex !== void 0 && startIndex > tailIndex) {
+			await connection.body.cancel().catch(() => {});
+			return;
+		}
 		let deliveredEvent = false;
 		try {
-			for await (const event of readNdjsonStream(body)) {
+			for await (const event of readNdjsonStream(connection.body)) {
 				startIndex += 1;
 				deliveredEvent = true;
 				reconnectDelayMs = idleRetryPolicy.baseDelayMs;
 				idleReconnects = 0;
 				yield event;
+				if (tailIndex !== void 0 && startIndex > tailIndex) return;
 			}
 		} catch (error) {
 			if (!isStreamDisconnectError(error)) throw error;
@@ -576,8 +592,11 @@ async function openStreamBody(input) {
 	let lastBody;
 	let lastHeaders;
 	let retryDelayMs = openRetryPolicy.baseDelayMs;
+	const searchParams = {};
+	if (input.startIndex !== 0) searchParams.startIndex = String(input.startIndex);
+	if (input.requestTailIndex === true) searchParams.includeTailIndex = "1";
 	for (let attempt = 0; attempt < openRetryPolicy.maxAttempts; attempt += 1) {
-		const url = createClientUrl(input.host, createEveMessageStreamRoutePath(input.sessionId), input.startIndex !== 0 ? { startIndex: String(input.startIndex) } : void 0);
+		const url = createClientUrl(input.host, createEveMessageStreamRoutePath(input.sessionId), Object.keys(searchParams).length > 0 ? searchParams : void 0);
 		const headers = await input.resolveHeaders();
 		let response;
 		try {
@@ -594,7 +613,10 @@ async function openStreamBody(input) {
 		}
 		if (response.ok) {
 			if (!response.body) throw new ClientError(response.status, "Response body is null.", response.headers);
-			return response.body;
+			return {
+				body: response.body,
+				tailIndex: parseTailIndexHeader(response.headers)
+			};
 		}
 		lastStatus = response.status;
 		lastBody = await response.text();
@@ -607,6 +629,12 @@ async function openStreamBody(input) {
 	}
 	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to open message stream.", lastHeaders);
 }
+function parseTailIndexHeader(headers) {
+	const raw = headers.get(EVE_STREAM_TAIL_INDEX_HEADER);
+	if (raw === null || !/^-?\d+$/.test(raw)) return;
+	const parsed = Number(raw);
+	return Number.isSafeInteger(parsed) ? parsed : void 0;
+}
 async function sleep$1(ms, signal) {
 	if (signal?.aborted) return;
 	await new Promise((resolve) => {
@@ -784,6 +812,7 @@ var ClientSession = class {
 	stream(options) {
 		const sessionId = this.#state.sessionId;
 		if (!sessionId) throw new Error("Session has no session ID. Send a message first.");
+		if (options?.follow === false && (options.startIndex ?? this.#state.streamIndex) < 0) throw new Error("stream({ follow: false }) requires a nonnegative startIndex; a tail-relative cursor cannot be bounded.");
 		return this.#streamAndAdvance(sessionId, options);
 	}
 	async #postTurn(input, session) {
@@ -845,6 +874,7 @@ var ClientSession = class {
 		const events = [];
 		try {
 			for await (const event of followStreamIterable({
+				follow: options?.follow,
 				host: this.#context.host,
 				resolveHeaders: () => this.#context.resolveHeaders(),
 				redirect: this.#context.redirect,
@@ -996,8 +1026,8 @@ var Client = class {
 		const headers = new Headers();
 		const [baseHeaders, authHeaders] = await Promise.all([resolveHeadersValue(this.#headers), this.#resolveAuthHeaders()]);
 		for (const [key, value] of Object.entries(baseHeaders)) headers.set(key, value);
-		if (perRequest) for (const [key, value] of Object.entries(perRequest)) headers.set(key, value);
 		for (const [key, value] of Object.entries(authHeaders)) headers.set(key, value);
+		if (perRequest) for (const [key, value] of Object.entries(perRequest)) headers.set(key, value);
 		return headers;
 	}
 	async #resolveAuthHeaders() {

package/dist/src/chunks/{use-eve-agent-NUjD28Iu.js → use-eve-agent-r5tkzjmt.js}

@@ -299,6 +299,7 @@ function safeJsonStringify(value) {
 //#endregion
 //#region src/protocol/message.ts
 const EVE_SESSION_ID_HEADER = "x-eve-session-id";
+const EVE_STREAM_TAIL_INDEX_HEADER = "x-eve-stream-tail-index";
 const textEncoder = new TextEncoder();
 function isCurrentTurnBoundaryEvent(event) {
 	return event.type === "session.completed" || event.type === "session.failed" || event.type === "session.waiting";
@@ -531,32 +532,47 @@ function resolveStreamReconnectPolicy(policy) {
 	};
 }
 async function* followStreamIterable(input) {
+	if (input.follow === false && input.startIndex < 0) throw new Error("stream({ follow: false }) requires a nonnegative startIndex; a tail-relative cursor cannot be bounded.");
 	const retryPolicy = resolveStreamReconnectPolicy(input.streamReconnectPolicy);
 	const idleRetryPolicy = retryPolicy.streamIdleReconnectPolicy;
 	let startIndex = input.startIndex;
 	let reconnectDelayMs = idleRetryPolicy.baseDelayMs;
 	let idleReconnects = 0;
 	let initialConnection = true;
+	let tailIndex;
 	while (true) {
-		let body;
+		let connection;
 		try {
-			body = await openStreamBody({
+			connection = await openStreamBody({
 				...input,
 				retryPolicy,
-				startIndex
+				startIndex,
+				requestTailIndex: input.follow === false && tailIndex === void 0
 			});
 		} catch (error) {
 			if (input.signal?.aborted) return;
 			throw error;
 		}
+		if (input.follow === false && tailIndex === void 0) {
+			tailIndex = connection.tailIndex;
+			if (tailIndex === void 0) {
+				await connection.body.cancel().catch(() => {});
+				throw new Error(`stream({ follow: false }) requires the server to report the ${EVE_STREAM_TAIL_INDEX_HEADER} header. The agent may be running an older eve version.`);
+			}
+		}
+		if (tailIndex !== void 0 && startIndex > tailIndex) {
+			await connection.body.cancel().catch(() => {});
+			return;
+		}
 		let deliveredEvent = false;
 		try {
-			for await (const event of readNdjsonStream(body)) {
+			for await (const event of readNdjsonStream(connection.body)) {
 				startIndex += 1;
 				deliveredEvent = true;
 				reconnectDelayMs = idleRetryPolicy.baseDelayMs;
 				idleReconnects = 0;
 				yield event;
+				if (tailIndex !== void 0 && startIndex > tailIndex) return;
 			}
 		} catch (error) {
 			if (!isStreamDisconnectError(error)) throw error;
@@ -576,8 +592,11 @@ async function openStreamBody(input) {
 	let lastBody;
 	let lastHeaders;
 	let retryDelayMs = openRetryPolicy.baseDelayMs;
+	const searchParams = {};
+	if (input.startIndex !== 0) searchParams.startIndex = String(input.startIndex);
+	if (input.requestTailIndex === true) searchParams.includeTailIndex = "1";
 	for (let attempt = 0; attempt < openRetryPolicy.maxAttempts; attempt += 1) {
-		const url = createClientUrl(input.host, createEveMessageStreamRoutePath(input.sessionId), input.startIndex !== 0 ? { startIndex: String(input.startIndex) } : void 0);
+		const url = createClientUrl(input.host, createEveMessageStreamRoutePath(input.sessionId), Object.keys(searchParams).length > 0 ? searchParams : void 0);
 		const headers = await input.resolveHeaders();
 		let response;
 		try {
@@ -594,7 +613,10 @@ async function openStreamBody(input) {
 		}
 		if (response.ok) {
 			if (!response.body) throw new ClientError(response.status, "Response body is null.", response.headers);
-			return response.body;
+			return {
+				body: response.body,
+				tailIndex: parseTailIndexHeader(response.headers)
+			};
 		}
 		lastStatus = response.status;
 		lastBody = await response.text();
@@ -607,6 +629,12 @@ async function openStreamBody(input) {
 	}
 	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to open message stream.", lastHeaders);
 }
+function parseTailIndexHeader(headers) {
+	const raw = headers.get(EVE_STREAM_TAIL_INDEX_HEADER);
+	if (raw === null || !/^-?\d+$/.test(raw)) return;
+	const parsed = Number(raw);
+	return Number.isSafeInteger(parsed) ? parsed : void 0;
+}
 async function sleep$1(ms, signal) {
 	if (signal?.aborted) return;
 	await new Promise((resolve) => {
@@ -784,6 +812,7 @@ var ClientSession = class {
 	stream(options) {
 		const sessionId = this.#state.sessionId;
 		if (!sessionId) throw new Error("Session has no session ID. Send a message first.");
+		if (options?.follow === false && (options.startIndex ?? this.#state.streamIndex) < 0) throw new Error("stream({ follow: false }) requires a nonnegative startIndex; a tail-relative cursor cannot be bounded.");
 		return this.#streamAndAdvance(sessionId, options);
 	}
 	async #postTurn(input, session) {
@@ -845,6 +874,7 @@ var ClientSession = class {
 		const events = [];
 		try {
 			for await (const event of followStreamIterable({
+				follow: options?.follow,
 				host: this.#context.host,
 				resolveHeaders: () => this.#context.resolveHeaders(),
 				redirect: this.#context.redirect,
@@ -996,8 +1026,8 @@ var Client = class {
 		const headers = new Headers();
 		const [baseHeaders, authHeaders] = await Promise.all([resolveHeadersValue(this.#headers), this.#resolveAuthHeaders()]);
 		for (const [key, value] of Object.entries(baseHeaders)) headers.set(key, value);
-		if (perRequest) for (const [key, value] of Object.entries(perRequest)) headers.set(key, value);
 		for (const [key, value] of Object.entries(authHeaders)) headers.set(key, value);
+		if (perRequest) for (const [key, value] of Object.entries(perRequest)) headers.set(key, value);
 		return headers;
 	}
 	async #resolveAuthHeaders() {

package/dist/src/cli/commands/channels.d.ts

@@ -1,7 +1,8 @@
-import { type AddChannelsDeps } from "#setup/boxes/add-channels.js";
-import { type DeployProjectDeps } from "#setup/boxes/deploy-project.js";
+import type { AddChannelsDeps } from "#setup/boxes/add-channels.js";
+import type { DeployProjectDeps } from "#setup/boxes/deploy-project.js";
 import { type DeploymentInfo } from "#setup/project-resolution.js";
 import { type Prompter } from "#setup/prompter.js";
+import { type VercelAuthStatus } from "#setup/vercel-project.js";
 export interface CliLogger {
     error(message: string): void;
     log(message: string): void;
@@ -14,6 +15,8 @@ export interface AddChannelCommandOptions {
 export interface ChannelsAddDependencies {
     createPrompter?: () => Prompter;
     detectDeployment(projectPath: string): Promise<DeploymentInfo>;
+    /** Read-only Vercel session probe. Optional only for legacy test seams. */
+    getVercelAuthStatus(projectPath: string): Promise<VercelAuthStatus>;
     /** Test seam into the add-channels box's scaffold/Connect/Vercel effects. */
     addChannelsDeps?: AddChannelsDeps;
     /** Test seam into the deploy box's subprocess effects. */

package/dist/src/cli/commands/channels.js

@@ -1 +1 @@
-import{assertCanAddSelectedChannels,inspectExistingChannelRegistrations}from"./channel-add-conflicts.js";import{NOT_AN_AGENT_MESSAGE}from"./preconditions.js";import{isEveProject,listAuthoredChannels}from"#setup/scaffold/index.js";import{interactiveAsker}from"#setup/ask.js";import{addChannels}from"#setup/boxes/add-channels.js";import{deployProject}from"#setup/boxes/deploy-project.js";import{selectChannels}from"#setup/boxes/select-channels.js";import{detectDeployment,projectResolutionFromDeployment}from"#setup/project-resolution.js";import{createPrompter}from"#setup/prompter.js";import{runInteractive}from"#setup/runner.js";import{createDefaultSetupState,snapshotSetupState}from"#setup/state.js";const KNOWN_CHANNEL_KINDS=[`slack`,`web`];function isChannelKind(e){return KNOWN_CHANNEL_KINDS.includes(e)}function parseChannelKind(e){if(!isChannelKind(e))throw Error(`Unknown channel kind "${e}". Known: ${KNOWN_CHANNEL_KINDS.join(`, `)}.`);return e}const defaultChannelsAddDependencies={detectDeployment};async function runAddChannelsFlow(n,r,i,s){if(r===void 0&&(i.yes||!process.stdin.isTTY||!process.stdout.isTTY))throw Error(`Pass a channel kind: \`eve channels add <${KNOWN_CHANNEL_KINDS.join(`|`)}>\`.`);let c=s.createPrompter?.()??createPrompter();c.intro(`Add channels to your eve agent`),c.log.message(`Checking the current Vercel project...`);let l={...createDefaultSetupState(),project:projectResolutionFromDeployment(await s.detectDeployment(n)),projectPath:{kind:`resolved`,inPlace:!0,path:n}},u;function inspectRegistrations(){return u===void 0&&(c.log.message(`Inspecting existing channel registrations...`),u=inspectExistingChannelRegistrations(n)),u}let d=r===void 0?(await inspectRegistrations()).disabledChannelReasons:void 0,f=await runInteractive([selectChannels({asker:interactiveAsker(c),variant:`channels-add`,presetChannels:r===void 0?void 0:[r],disabledChannelReasons:d,validateSelection:async t=>{!t.includes(`web`)&&!t.includes(`slack`)||assertCanAddSelectedChannels(t,await inspectRegistrations())}}),addChannels({asker:interactiveAsker(c),prompter:c,presetCreateSlackbot:i.yes?!0:void 0,force:i.force,configureVercelServices:!0,ensureLinkedProject:`interactive-vercel-link`,deps:s.addChannelsDeps}),deployProject({prompter:c,ensureLinkedProject:`interactive-vercel-link`,deps:s.deployProjectDeps})],l,{write:e=>c.log.message(e)},{snapshot:snapshotSetupState});f.kind!==`cancelled`&&c.outro(f.state.channels.length===0?`No channels added.`:`Channels added.`)}async function runChannelsAddCommand(e,t,i,a=defaultChannelsAddDependencies){if(!await isEveProject(t)){e.error(NOT_AN_AGENT_MESSAGE),process.exitCode=1;return}try{await runAddChannelsFlow(t,i.kind===void 0?void 0:parseChannelKind(i.kind),i.options,a)}catch(t){e.error(t instanceof Error?t.message:String(t)),process.exitCode=1}}async function runChannelsListCommand(e,t,a){if(!await isEveProject(t)){e.error(NOT_AN_AGENT_MESSAGE),process.exitCode=1;return}let o=await listAuthoredChannels(t);if(a.json){e.log(JSON.stringify({channels:o},null,2));return}if(o.length===0){e.log("No channels defined. Run `eve channels add` to add one.");return}for(let t of o)e.log(t)}export{runChannelsAddCommand,runChannelsListCommand};
+import{assertCanAddSelectedChannels,inspectExistingChannelRegistrations}from"./channel-add-conflicts.js";import{NOT_AN_AGENT_MESSAGE}from"./preconditions.js";import{isEveProject,listAuthoredChannels}from"#setup/scaffold/index.js";import{interactiveAsker}from"#setup/ask.js";import{channelSetupEnvironment,describeChannelSetupEnvironment}from"#setup/channel-setup-environment.js";import{deployChannelSetup}from"#setup/channel-setup-deployment.js";import{channelSetupIntegration,createChannelSetupUi}from"#setup/channel-setup-integrations.js";import{selectChannels}from"#setup/boxes/select-channels.js";import{detectDeployment,projectResolutionFromDeployment}from"#setup/project-resolution.js";import{createPrompter}from"#setup/prompter.js";import{runInteractive}from"#setup/runner.js";import{createDefaultSetupState,snapshotSetupState}from"#setup/state.js";import{getVercelAuthStatus}from"#setup/vercel-project.js";const KNOWN_CHANNEL_KINDS=[`slack`,`web`];function isChannelKind(e){return KNOWN_CHANNEL_KINDS.includes(e)}function parseChannelKind(e){if(!isChannelKind(e))throw Error(`Unknown channel kind "${e}". Known: ${KNOWN_CHANNEL_KINDS.join(`, `)}.`);return e}const defaultChannelsAddDependencies={detectDeployment,getVercelAuthStatus};async function runAddChannelsFlow(n,r,i,s){if(r===void 0&&(i.yes||!process.stdin.isTTY||!process.stdout.isTTY))throw Error(`Pass a channel kind: \`eve channels add <${KNOWN_CHANNEL_KINDS.join(`|`)}>\`.`);let c=s.createPrompter?.()??createPrompter();c.intro(`Add channels to your eve agent`),c.log.message(`Checking Vercel setup...`);let l=await s.detectDeployment(n),u=channelSetupEnvironment(await s.getVercelAuthStatus(n),projectResolutionFromDeployment(l));c.log.info(describeChannelSetupEnvironment(u));let d={...createDefaultSetupState(),project:projectResolutionFromDeployment(l),projectPath:{kind:`resolved`,inPlace:!0,path:n}},f;function inspectRegistrations(){return f===void 0&&(c.log.message(`Inspecting existing channel registrations...`),f=inspectExistingChannelRegistrations(n)),f}let p=r===void 0?(await inspectRegistrations()).disabledChannelReasons:void 0,m=await runInteractive([selectChannels({asker:interactiveAsker(c),variant:`channels-add`,presetChannels:r===void 0?void 0:[r],disabledChannelReasons:p,validateSelection:async t=>{!t.includes(`web`)&&!t.includes(`slack`)||assertCanAddSelectedChannels(t,await inspectRegistrations())}})],d,{write:e=>c.log.message(e)},{snapshot:snapshotSetupState});if(m.kind===`cancelled`)return;let h=m.state,g=createChannelSetupUi({asker:interactiveAsker(c),prompter:c});for(let e of m.state.channelSelection){let t=await channelSetupIntegration(e).setup({environment:u,state:{...h,channelSelection:[e]},ui:g,force:i.force,presetCreateSlackbot:i.yes?!0:void 0,presetPortableCredentials:i.yes===!0?!0:void 0,deps:s.addChannelsDeps});if(t.kind===`cancelled`)return;h=t.state}(h.slackbotAttached||u.vercel.kind===`available`&&h.channels.includes(`web`))&&(h=await deployChannelSetup({state:h,ui:g,presetDeploy:i.yes===!0?!0:!process.stdin.isTTY||!process.stdout.isTTY?!1:void 0,deps:s.deployProjectDeps})),c.outro(h.channels.length===0?`No channels added.`:`Channels added.`)}async function runChannelsAddCommand(e,t,i,a=defaultChannelsAddDependencies){if(!await isEveProject(t)){e.error(NOT_AN_AGENT_MESSAGE),process.exitCode=1;return}try{await runAddChannelsFlow(t,i.kind===void 0?void 0:parseChannelKind(i.kind),i.options,a)}catch(t){e.error(t instanceof Error?t.message:String(t)),process.exitCode=1}}async function runChannelsListCommand(e,t,a){if(!await isEveProject(t)){e.error(NOT_AN_AGENT_MESSAGE),process.exitCode=1;return}let o=await listAuthoredChannels(t);if(a.json){e.log(JSON.stringify({channels:o},null,2));return}if(o.length===0){e.log("No channels defined. Run `eve channels add` to add one.");return}for(let t of o)e.log(t)}export{runChannelsAddCommand,runChannelsListCommand};

package/dist/src/cli/dev/local-server-child.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/cli/dev/local-server-child.js

@@ -0,0 +1 @@
+import{createDevelopmentServer}from"#internal/nitro/host.js";import{getDevelopmentSandboxRunId}from"#execution/sandbox/development-run.js";import{reconcileCleanupIntents,recordCleanupIntent}from"#cli/dev/local-server-cleanup.js";const options=JSON.parse(process.argv[2]??`{}`),server=createDevelopmentServer(process.cwd(),{...options,onBootProgress:e=>send({type:`progress`,event:e})});let stopping=!1,removeCleanupIntent;reconcileCleanupIntents(process.cwd()).catch(()=>void 0);const send=e=>{try{process.connected&&process.send?.(e,()=>{})}catch{}},stop=()=>{if(stopping)return;stopping=!0,console.log=console.warn=console.error=()=>{},process.stdout.on(`error`,()=>{}),process.stderr.on(`error`,()=>{});let e=server.close();process.connected&&process.disconnect?.(),e.then(async()=>{await intentReady.catch(()=>void 0),await removeCleanupIntent?.().catch(()=>void 0),process.exit(0)},()=>process.exit(1))};process.on(`message`,e=>{e.type===`shutdown`&&stop()}),process.once(`disconnect`,stop),process.once(`SIGINT`,stop),process.once(`SIGTERM`,stop);const intentReady=server.start().then(async e=>{let n=getDevelopmentSandboxRunId();e.kind===`started`&&n!==void 0&&(removeCleanupIntent=await recordCleanupIntent(process.cwd(),{ownerPid:process.pid,runId:n})),send({type:`started`,handle:e}),e.kind===`existing`&&process.connected&&process.disconnect?.()},e=>{let t=e instanceof Error?e:Error(String(e));send({type:`failed`,message:t.message,stack:t.stack}),process.exitCode=1,process.connected&&process.disconnect?.()});export{};

package/dist/src/cli/dev/local-server-cleanup.d.ts

@@ -0,0 +1,5 @@
+export declare function recordCleanupIntent(appRoot: string, input: {
+    readonly ownerPid: number;
+    readonly runId: string;
+}): Promise<() => Promise<void>>;
+export declare function reconcileCleanupIntents(appRoot: string): Promise<void>;

package/dist/src/cli/dev/local-server-cleanup.js

@@ -0,0 +1 @@
+import{join}from"node:path";import{mkdir,readFile,readdir,rm,writeFile}from"node:fs/promises";import{stopDevelopmentSandboxResources}from"#execution/sandbox/bindings/local.js";const PREFIX=`dev-cleanup-intent.`,SUFFIX=`.json`;async function recordCleanupIntent(n,r){let a=join(n,`.eve`),c=join(a,`${PREFIX}${r.runId}${SUFFIX}`);return await mkdir(a,{recursive:!0}),await writeFile(c,`${JSON.stringify(r)}\n`,`utf8`),async()=>await rm(c,{force:!0})}async function reconcileCleanupIntents(t){let i=join(t,`.eve`),c;try{c=await readdir(i)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;throw e}await Promise.all(c.filter(e=>e.startsWith(PREFIX)&&e.endsWith(SUFFIX)).map(async r=>{try{let o=join(i,r),s=JSON.parse(await readFile(o,`utf8`));if(typeof s.runId!=`string`||typeof s.ownerPid!=`number`||!Number.isInteger(s.ownerPid)||s.ownerPid<=0||isProcessAlive(s.ownerPid))return;await stopDevelopmentSandboxResources({appRoot:t,devRunId:s.runId}),await rm(o,{force:!0})}catch{}}))}function isProcessAlive(e){try{return process.kill(e,0),!0}catch(e){return e instanceof Error&&`code`in e&&e.code===`EPERM`}}export{reconcileCleanupIntents,recordCleanupIntent};

package/dist/src/cli/dev/local-server-process.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The `eve dev` server child: forked `detached` (its own process group) and
+ * bound to the CLI's lifetime through the IPC channel, never through the OS.
+ *
+ * Why the child is not bound to the parent at the OS level (shared process
+ * group, inherited terminal signals):
+ *
+ * - The TUI puts stdin in raw mode, which disables ISIG: Ctrl+C never becomes
+ *   a terminal-generated SIGINT, so same-group signal delivery does nothing in
+ *   the mode where Ctrl+C matters most.
+ * - In headless mode, same-group delivery would signal parent and child
+ *   simultaneously, racing the parent's graceful IPC shutdown against the
+ *   child's own signal handler.
+ * - macOS has no parent-death signal. IPC `disconnect` is the portable
+ *   equivalent: the child self-stops whenever this process exits, for any
+ *   reason including SIGKILL (see local-server-child.ts).
+ *
+ * `detached` makes the child a process-group leader, so close() can escalate
+ * to a group-wide SIGTERM/SIGKILL that reaps the entire server tree. Sandbox
+ * resources leaked by a crash are reconciled by the cleanup-intent janitor on
+ * the next run (see local-server-cleanup.ts).
+ */
+import type { DevelopmentServer, DevelopmentServerOptions } from "#internal/nitro/host/types.js";
+/**
+ * Worst-case close() duration. Must stay below the forced-exit backstop the
+ * dev command arms on its lifecycle (FORCED_EXIT_BACKSTOP_MS in
+ * `#cli/shutdown.js`), so a graceful close always beats the backstop and
+ * `eve dev` exits 0 after Ctrl+C. Enforced by local-server-process.test.ts.
+ */
+export declare const DEV_SERVER_CLOSE_BUDGET_MS: number;
+export interface DevelopmentServerProcess extends DevelopmentServer {
+    wait(): Promise<void>;
+}
+/** Runs the CLI-owned local server outside the foreground TUI process. */
+export declare function createDevelopmentServer(appRoot: string, options?: DevelopmentServerOptions): DevelopmentServerProcess;

package/dist/src/cli/dev/local-server-process.js

@@ -0,0 +1 @@
+import{fork}from"node:child_process";import{fileURLToPath}from"node:url";import{loadDevelopmentEnvironmentFiles}from"#cli/dev/environment.js";import{EVE_DEV_ENV_FLAG}from"#internal/application/optional-package-install.js";const childPath=fileURLToPath(new URL(`./local-server-child.js`,import.meta.url)),DEV_SERVER_CLOSE_BUDGET_MS=800;function createDevelopmentServer(t,i={}){let a,o,s=!1,c=Promise.withResolvers(),l=Promise.withResolvers();c.promise.catch(()=>void 0);let release=()=>{let e=a;e!==void 0&&(a=void 0,e.stdout?.destroy(),e.stderr?.destroy(),e.connected&&e.disconnect(),e.unref())};return{start:()=>{if(a!==void 0)throw Error(`DevelopmentServer.start() was already called.`);let o={...process.env};loadDevelopmentEnvironmentFiles(t),process.env[EVE_DEV_ENV_FLAG]??=`1`;let u=fork(childPath,[JSON.stringify({existing:i.existing,host:i.host,port:i.port})],{cwd:t,detached:!0,env:{...o,[EVE_DEV_ENV_FLAG]:`1`},stdio:[`ignore`,`pipe`,`pipe`,`ipc`]});return a=u,u.stdout?.on(`data`,e=>process.stdout.write(e)),u.stderr?.on(`data`,e=>process.stderr.write(e)),new Promise((e,t)=>{let n=!1;u.once(`error`,t),u.once(`exit`,(e,r)=>{l.resolve(),release(),n?s?c.resolve():c.reject(Error(`Development server exited unexpectedly (${String(e)}, ${String(r)}).`)):t(Error(`Development server exited during startup (${String(e)}, ${String(r)}).`))}),u.on(`message`,r=>{if(r.type===`progress`&&i.onBootProgress?.(r.event),r.type===`started`&&!n&&(n=!0,e(r.handle),r.handle.kind===`existing`&&(s=!0,release())),r.type===`failed`&&!n){n=!0;let e=Error(r.message);r.stack!==void 0&&(e.stack=r.stack),t(e)}})})},close(){if(o!==void 0)return o;let e=a;return e===void 0?Promise.resolve():(s=!0,o=(async()=>{e.connected&&e.send({type:`shutdown`}),!await settlesWithin(l.promise,550)&&(signalProcessGroup(e,`SIGTERM`),!await settlesWithin(l.promise,150)&&(signalProcessGroup(e,`SIGKILL`),await settlesWithin(l.promise,100),release()))})(),o)},wait:()=>c.promise}}async function settlesWithin(e,t){let n;try{return await Promise.race([e.then(()=>!0),new Promise(e=>{n=setTimeout(()=>e(!1),t)})])}finally{n!==void 0&&clearTimeout(n)}}function signalProcessGroup(e,t){if(process.platform!==`win32`&&e.pid!==void 0)try{process.kill(-e.pid,t);return}catch{}e.kill(t)}export{DEV_SERVER_CLOSE_BUDGET_MS,createDevelopmentServer};

package/dist/src/cli/dev/tui/remote-auth.js

@@ -1 +1 @@
-import{__toESM}from"../../../_virtual/_rolldown/runtime.js";import{require_picocolors}from"../../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js";import{applyVercelTrustedSourceAccess,prepareVercelTrustedSourceAccess}from"./vercel-trusted-sources.js";import{appendRemoteAuthMutationSummary}from"./remote-auth-result.js";import{WizardCancelledError}from"#setup/step.js";import{toErrorMessage}from"#shared/errors.js";import{resolveDevelopmentOidcToken}from"#services/dev-client/request-headers.js";import{formatDevelopmentOidcTokenFailure}from"#services/dev-client/vercel-auth-error.js";import{runLoginFlow}from"#setup/flows/login.js";import{pickTeam}from"#setup/vercel-project.js";import{resolveVercelDeployment}from"#setup/vercel-deployment.js";var import_picocolors=__toESM(require_picocolors(),1);const defaultDeps={runLoginFlow,pickTeam,resolveVercelDeployment,resolveOidcToken:resolveDevelopmentOidcToken,prepareVercelTrustedSourceAccess,applyVercelTrustedSourceAccess};function failed(e,t=[]){return{kind:`failed`,message:appendRemoteAuthMutationSummary(e,t),completedMutations:[...t]}}function cancelled(e=[]){return{kind:`cancelled`,completedMutations:[...e]}}function loginFailure(e){switch(e.kind){case`already`:case`logged-in`:return;case`cancelled`:return cancelled();case`cli-missing`:return failed("The Vercel CLI is not installed. Install it with `npm i -g vercel@latest`, then retry /vc:login.");case`failed`:return failed(`Vercel login did not complete. Retry /vc:login.`);case`unavailable`:return failed(`Vercel could not verify your account. Check your connection, then retry /vc:login.`)}}function deploymentFailureMessage(e){return e.cause===`vercel`?e.failure.message:e.message}async function selectVercelDeploymentScope(e,t,n,r,i){return await e.pickTeam(r,t,void 0,{signal:i,selectMessage:e=>`${import_picocolors.default.blue(n)} is not accessible via current team (${import_picocolors.default.bold(e)})\nYou can try selecting another team:`})}async function runRemoteAuthFlow(e){let{workspaceRoot:t,serverUrl:n,prompter:r,signal:i}=e,a=new URL(n).host,o={...defaultDeps,...e.deps},s=[],c=!1;try{let n=await o.runLoginFlow({appRoot:t,prompter:r,signal:i}),l=loginFailure(n);if(l!==void 0)return l;n.kind===`logged-in`&&s.push({kind:`vercel-login`});let u=await o.resolveVercelDeployment({workspaceRoot:t,host:a,signal:i});if(u.kind===`forbidden`){let e=await o.runLoginFlow({appRoot:t,force:!0,prompter:r,signal:i}),n=loginFailure(e);if(n!==void 0)return n;e.kind===`logged-in`&&s.push({kind:`vercel-login`}),i?.throwIfAborted(),u=await o.resolveVercelDeployment({workspaceRoot:t,host:a,signal:i})}if(u.kind===`not-found`)try{let e=await selectVercelDeploymentScope(o,t,a,r,i);i?.throwIfAborted(),u=await o.resolveVercelDeployment({workspaceRoot:t,host:a,scope:e,signal:i})}catch(e){return e instanceof WizardCancelledError?cancelled(s):(i?.throwIfAborted(),failed(`Could not select a Vercel team: ${toErrorMessage(e)}`,s))}let d;switch(u.kind){case`resolved`:d=u.target;break;case`cancelled`:return cancelled(s);case`forbidden`:return failed(`Could not access ${a}. Re-authenticate (for example to complete a team's SSO), then retry /vc:login.`,s);case`not-found`:return failed(`Vercel did not resolve ${a} for the selected Vercel team.`,s);case`project-mismatch`:return failed(`Could not verify ${a}: Vercel resolved project ${u.actualProjectId}, not ${u.expectedProjectId}.`,s);case`failed`:return failed(`Could not verify ${a} through Vercel: ${deploymentFailureMessage(u.failure)}`,s)}let f;if(e.configureTrustedSources===!0){let e=await o.prepareVercelTrustedSourceAccess({workspaceRoot:t,target:d,prompter:r,signal:i});if(i?.throwIfAborted(),e.kind===`cancelled`)return cancelled(s);if(e.kind===`failed`)return failed(e.message,s);e.kind===`approved`&&(f=e.grant)}if(i?.throwIfAborted(),f!==void 0){c=!0;let e=await o.applyVercelTrustedSourceAccess({workspaceRoot:t,grant:f,signal:i});if(e.kind===`failed`)return failed(e.message,s);e.kind===`updated`&&s.push({kind:`trusted-sources-updated`,targetProjectName:e.targetProjectName})}let p=await o.resolveOidcToken({ownerId:d.deployment.ownerId,projectId:d.deployment.projectId,forceRefresh:!0});if(i?.throwIfAborted(),p.kind!==`resolved`)return failed(formatDevelopmentOidcTokenFailure(p),s);let m=p.token.trim();return{kind:`prepared`,target:d,resolveToken:async()=>{let e=await o.resolveOidcToken(d.deployment);return e.kind===`resolved`&&(m=e.token.trim()),m},completedMutations:[...s]}}catch(e){return!c&&(e instanceof WizardCancelledError||i?.aborted===!0)?cancelled(s):failed(`Could not authenticate ${a}: ${toErrorMessage(e)}`,s)}}export{runRemoteAuthFlow};
+import{__toESM}from"../../../_virtual/_rolldown/runtime.js";import{require_picocolors}from"../../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js";import{applyVercelTrustedSourceAccess,prepareVercelTrustedSourceAccess}from"./vercel-trusted-sources.js";import{appendRemoteAuthMutationSummary}from"./remote-auth-result.js";import{pickTeam}from"#setup/vercel-project.js";import{WizardCancelledError}from"#setup/step.js";import{toErrorMessage}from"#shared/errors.js";import{resolveDevelopmentOidcToken}from"#services/dev-client/request-headers.js";import{formatDevelopmentOidcTokenFailure}from"#services/dev-client/vercel-auth-error.js";import{runLoginFlow}from"#setup/flows/login.js";import{resolveVercelDeployment}from"#setup/vercel-deployment.js";var import_picocolors=__toESM(require_picocolors(),1);const defaultDeps={runLoginFlow,pickTeam,resolveVercelDeployment,resolveOidcToken:resolveDevelopmentOidcToken,prepareVercelTrustedSourceAccess,applyVercelTrustedSourceAccess};function failed(e,t=[]){return{kind:`failed`,message:appendRemoteAuthMutationSummary(e,t),completedMutations:[...t]}}function cancelled(e=[]){return{kind:`cancelled`,completedMutations:[...e]}}function loginFailure(e){switch(e.kind){case`already`:case`logged-in`:return;case`cancelled`:return cancelled();case`cli-missing`:return failed("The Vercel CLI is not installed. Install it with `npm i -g vercel@latest`, then retry /vc:login.");case`failed`:return failed(`Vercel login did not complete. Retry /vc:login.`);case`unavailable`:return failed(`Vercel could not verify your account. Check your connection, then retry /vc:login.`)}}function deploymentFailureMessage(e){return e.cause===`vercel`?e.failure.message:e.message}async function selectVercelDeploymentScope(e,t,n,r,i){return await e.pickTeam(r,t,void 0,{signal:i,selectMessage:e=>`${import_picocolors.default.blue(n)} is not accessible via current team (${import_picocolors.default.bold(e)})\nYou can try selecting another team:`})}async function runRemoteAuthFlow(e){let{workspaceRoot:t,serverUrl:n,prompter:r,signal:i}=e,a=new URL(n).host,o={...defaultDeps,...e.deps},s=[],c=!1;try{let n=await o.runLoginFlow({appRoot:t,prompter:r,signal:i}),l=loginFailure(n);if(l!==void 0)return l;n.kind===`logged-in`&&s.push({kind:`vercel-login`});let u=await o.resolveVercelDeployment({workspaceRoot:t,host:a,signal:i});if(u.kind===`forbidden`){let e=await o.runLoginFlow({appRoot:t,force:!0,prompter:r,signal:i}),n=loginFailure(e);if(n!==void 0)return n;e.kind===`logged-in`&&s.push({kind:`vercel-login`}),i?.throwIfAborted(),u=await o.resolveVercelDeployment({workspaceRoot:t,host:a,signal:i})}if(u.kind===`not-found`)try{let e=await selectVercelDeploymentScope(o,t,a,r,i);i?.throwIfAborted(),u=await o.resolveVercelDeployment({workspaceRoot:t,host:a,scope:e,signal:i})}catch(e){return e instanceof WizardCancelledError?cancelled(s):(i?.throwIfAborted(),failed(`Could not select a Vercel team: ${toErrorMessage(e)}`,s))}let d;switch(u.kind){case`resolved`:d=u.target;break;case`cancelled`:return cancelled(s);case`forbidden`:return failed(`Could not access ${a}. Re-authenticate (for example to complete a team's SSO), then retry /vc:login.`,s);case`not-found`:return failed(`Vercel did not resolve ${a} for the selected Vercel team.`,s);case`project-mismatch`:return failed(`Could not verify ${a}: Vercel resolved project ${u.actualProjectId}, not ${u.expectedProjectId}.`,s);case`failed`:return failed(`Could not verify ${a} through Vercel: ${deploymentFailureMessage(u.failure)}`,s)}let f;if(e.configureTrustedSources===!0){let e=await o.prepareVercelTrustedSourceAccess({workspaceRoot:t,target:d,prompter:r,signal:i});if(i?.throwIfAborted(),e.kind===`cancelled`)return cancelled(s);if(e.kind===`failed`)return failed(e.message,s);e.kind===`approved`&&(f=e.grant)}if(i?.throwIfAborted(),f!==void 0){c=!0;let e=await o.applyVercelTrustedSourceAccess({workspaceRoot:t,grant:f,signal:i});if(e.kind===`failed`)return failed(e.message,s);e.kind===`updated`&&s.push({kind:`trusted-sources-updated`,targetProjectName:e.targetProjectName})}let p=await o.resolveOidcToken({ownerId:d.deployment.ownerId,projectId:d.deployment.projectId,forceRefresh:!0});if(i?.throwIfAborted(),p.kind!==`resolved`)return failed(formatDevelopmentOidcTokenFailure(p),s);let m=p.token.trim();return{kind:`prepared`,target:d,resolveToken:async()=>{let e=await o.resolveOidcToken(d.deployment);return e.kind===`resolved`&&(m=e.token.trim()),m},completedMutations:[...s]}}catch(e){return!c&&(e instanceof WizardCancelledError||i?.aborted===!0)?cancelled(s):failed(`Could not authenticate ${a}: ${toErrorMessage(e)}`,s)}}export{runRemoteAuthFlow};

package/dist/src/cli/dev/tui/runner.d.ts

@@ -15,6 +15,7 @@ import { type McpConnectionProbe } from "./mcp-connection-status.js";
 import type { detectProjectIdentity } from "#setup/project-resolution.js";
 import { getVercelAuthStatus } from "#setup/vercel-project.js";
 import type { DevDiagnostics } from "../diagnostics.js";
+import type { CommandLifecycle } from "../../shutdown.js";
 export { parsePromptCommand, type PromptCommand } from "./prompt-commands.js";
 export type AgentTUIStreamResult = {
     events: AsyncIterable<AgentTUIStreamEvent> | ReadableStream<AgentTUIStreamEvent>;
@@ -268,6 +269,8 @@ export type AgentTUIRenderer = {
      * lifecycle ends.
      */
     shutdown?(): void;
+    requestInterrupt?(): void;
+    exitRequested?(): boolean;
 };
 export interface PromptCommandHandlerContext {
     readonly renderer: AgentTUIRenderer;
@@ -356,6 +359,7 @@ export type EveTUIRunnerOptions = TuiDisplayOptions & {
     onBootProgress?: DevBootProgressReporter;
     /** Parent-owned diagnostics recorder; omitted for remote and test renderers. */
     diagnostics?: DevDiagnostics;
+    lifecycle?: CommandLifecycle;
 };
 export declare class EveTUIRunner {
     #private;