eve 0.33.0 → 0.33.2

package/dist/src/setup/scaffold/create/web-template.js

@@ -4969,4 +4969,294 @@ export default config;
   ],
   "exclude": ["node_modules"]
 }
-`},WEB_APP_TEMPLATE_PACKAGE_JSON={scripts:{build:`next build`,"build:eve":`eve build`,dev:`next dev`,"dev:eve":`eve dev`,start:`next start`,"start:eve":`eve start`,typecheck:`tsc --noEmit -p tsconfig.json`},dependencies:{"@radix-ui/react-use-controllable-state":`1.2.2`,"@shikijs/core":`4.1.0`,"@shikijs/engine-javascript":`4.1.0`,"@shikijs/engine-oniguruma":`4.1.0`,"@streamdown/cjk":`1.0.3`,"@streamdown/code":`1.1.1`,"@streamdown/math":`1.0.2`,"@streamdown/mermaid":`1.0.2`,"@tailwindcss/postcss":`4.3.0`,ai:`^7.0.38`,"class-variance-authority":`0.7.1`,clsx:`2.1.1`,cmdk:`1.1.1`,"lucide-react":`1.16.0`,motion:`12.40.0`,nanoid:`5.1.11`,next:`16.3.0-preview.6`,"radix-ui":`1.4.3`,react:`19.2.6`,"react-dom":`19.2.6`,shiki:`4.1.0`,streamdown:`2.5.0`,"tailwind-merge":`3.6.0`,tailwindcss:`4.3.0`,"use-stick-to-bottom":`1.1.4`,zod:`4.4.3`},devDependencies:{"@types/node":`26`,"@types/react":`19.2.15`,"@types/react-dom":`19.2.3`,typescript:`6.0.3`}};export{WEB_APP_TEMPLATE_FILES,WEB_APP_TEMPLATE_PACKAGE_JSON};
+`},WEB_APP_SIGN_IN_WITH_VERCEL_TEMPLATE_FILES={"agent/channels/eve.ts":`import { eveChannel } from "eve/channels/eve";
+import { localDev, type AuthFn, vercelOidc } from "eve/channels/auth";
+import { auth } from "@/lib/auth";
+
+const betterAuthSession: AuthFn<Request> = async (request) => {
+  const session = await auth.api.getSession({ headers: request.headers });
+  if (!session) return null;
+
+  const attributes: Record<string, string> = {
+    email: session.user.email,
+    name: session.user.name,
+  };
+  if (session.user.image) {
+    attributes.picture = session.user.image;
+  }
+
+  return {
+    attributes,
+    authenticator: "better-auth:vercel",
+    issuer: "https://vercel.com",
+    principalId: session.user.id,
+    principalType: "user",
+  };
+};
+
+export default eveChannel({
+  auth: [betterAuthSession, vercelOidc(), localDev()],
+});
+`,"app/_components/web-chat-auth.tsx":`"use client";
+
+import { LogOutIcon } from "lucide-react";
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import { authClient } from "@/lib/auth-client";
+
+const AGENT_NAME = "__EVE_INIT_APP_NAME__";
+
+export function SignIn() {
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState<string>();
+
+  async function signIn() {
+    setPending(true);
+    setError(undefined);
+    try {
+      const result = await authClient.signIn.social({
+        callbackURL: "/",
+        provider: "vercel",
+      });
+      if (!result.error) return;
+      setPending(false);
+      setError("Sign-in failed. Try again.");
+    } catch {
+      setPending(false);
+      setError("Sign-in failed. Try again.");
+    }
+  }
+
+  return (
+    <main className="flex h-dvh items-center justify-center bg-background px-6 text-foreground">
+      <div className="flex w-full max-w-sm flex-col items-center gap-6 text-center">
+        <div className="space-y-2">
+          <h1 className="break-words font-medium text-4xl tracking-tighter">{AGENT_NAME}</h1>
+          <p className="text-muted-foreground text-sm">
+            Team members can sign in with Vercel to chat.
+          </p>
+        </div>
+        <Button disabled={pending} onClick={signIn}>
+          Sign in with Vercel
+        </Button>
+        {error ? (
+          <p className="text-destructive text-sm" role="alert">
+            {error}
+          </p>
+        ) : null}
+      </div>
+    </main>
+  );
+}
+
+export function AccountControl({
+  email,
+  image,
+  name,
+}: {
+  readonly email: string;
+  readonly image?: string | null;
+  readonly name: string;
+}) {
+  const [imageFailed, setImageFailed] = useState(false);
+  const [pending, setPending] = useState(false);
+  const initials = getInitials(name, email);
+
+  async function signOut() {
+    setPending(true);
+    try {
+      await authClient.signOut({
+        fetchOptions: {
+          onError: () => setPending(false),
+          onSuccess: () => window.location.assign("/"),
+        },
+      });
+    } catch {
+      setPending(false);
+    }
+  }
+
+  return (
+    <div className="fixed top-3 right-3 z-10">
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild>
+          <Button
+            aria-label={\`Open account menu for \${name}\`}
+            className="size-9 cursor-pointer overflow-hidden rounded-full p-0"
+            size="icon"
+            variant="outline"
+          >
+            {image && !imageFailed ? (
+              <img
+                alt=""
+                className="size-full object-cover"
+                onError={() => setImageFailed(true)}
+                src={image}
+              />
+            ) : (
+              <span aria-hidden="true" className="font-medium text-xs">
+                {initials}
+              </span>
+            )}
+          </Button>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent align="end" className="w-64">
+          <div className="min-w-0 px-2 py-1.5 text-sm">
+            <span className="block truncate font-medium leading-5" title={name}>
+              {name}
+            </span>
+            <span className="block truncate text-muted-foreground leading-5" title={email}>
+              {email}
+            </span>
+          </div>
+          <DropdownMenuSeparator />
+          <DropdownMenuItem
+            className="cursor-pointer justify-between"
+            disabled={pending}
+            onSelect={signOut}
+          >
+            {pending ? "Logging out…" : "Log out"}
+            <LogOutIcon aria-hidden="true" />
+          </DropdownMenuItem>
+        </DropdownMenuContent>
+      </DropdownMenu>
+    </div>
+  );
+}
+
+function getInitials(name: string, email: string): string {
+  const parts = name.trim().split(/\\s+/).filter(Boolean);
+  if (parts.length >= 2) {
+    return \`\${parts[0]?.[0] ?? ""}\${parts.at(-1)?.[0] ?? ""}\`.toUpperCase();
+  }
+  return (parts[0]?.[0] ?? email[0] ?? "?").toUpperCase();
+}
+`,"app/api/auth/[...all]/route.ts":`import { toNextJsHandler } from "better-auth/next-js";
+import { auth } from "@/lib/auth";
+
+export const { GET, POST } = toNextJsHandler(auth);
+`,"app/layout.tsx":`import type { Metadata } from "next";
+import { Geist, Geist_Mono } from "next/font/google";
+import type { ReactNode } from "react";
+import { TooltipProvider } from "@/components/ui/tooltip";
+import { cn } from "@/lib/utils";
+import "./globals.css";
+
+const sans = Geist({
+  variable: "--font-sans",
+  subsets: ["latin"],
+  weight: "variable",
+  display: "swap",
+});
+
+const mono = Geist_Mono({
+  variable: "--font-mono",
+  subsets: ["latin"],
+  weight: "variable",
+  display: "swap",
+});
+
+export const metadata: Metadata = {
+  title: "__EVE_INIT_APP_NAME__",
+  description: "A Next.js starter for eve agents with AI Elements.",
+};
+
+// The page and Eve routes validate the generated app's Better Auth session.
+export default function RootLayout({ children }: { readonly children: ReactNode }) {
+  return (
+    <html className={cn(sans.variable, mono.variable)} lang="en">
+      <body>
+        <TooltipProvider>{children}</TooltipProvider>
+      </body>
+    </html>
+  );
+}
+`,"app/page.tsx":`import { headers } from "next/headers";
+import { AgentChat } from "./_components/agent-chat";
+import { AccountControl, SignIn } from "./_components/web-chat-auth";
+import { auth } from "@/lib/auth";
+
+export default async function Page() {
+  if (process.env.NODE_ENV === "development") {
+    return <AgentChat />;
+  }
+
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) {
+    return <SignIn />;
+  }
+
+  return (
+    <>
+      <AgentChat />
+      <AccountControl
+        email={session.user.email}
+        image={session.user.image}
+        name={session.user.name}
+      />
+    </>
+  );
+}
+`,"lib/auth-client.ts":`"use client";
+
+import { createAuthClient } from "better-auth/react";
+
+export const authClient = createAuthClient();
+`,"lib/auth.ts":`import { betterAuth } from "better-auth";
+
+const SESSION_MAX_AGE_SECONDS = 8 * 60 * 60;
+const DEVELOPMENT_ALLOWED_HOSTS = ["localhost:*", "127.0.0.1:*"];
+
+function getAllowedHosts(): string[] {
+  if (process.env.NODE_ENV === "development") {
+    return DEVELOPMENT_ALLOWED_HOSTS;
+  }
+  const deploymentHosts = [
+    process.env.VERCEL_URL,
+    process.env.VERCEL_BRANCH_URL,
+    process.env.VERCEL_PROJECT_PRODUCTION_URL,
+  ].filter((host): host is string => Boolean(host));
+  if (deploymentHosts.length === 0) {
+    throw new Error("No trusted deployment hosts are configured");
+  }
+  return Array.from(new Set(deploymentHosts));
+}
+
+function requireEnvironmentVariable(name: string): string {
+  const value = process.env[name];
+  if (value) return value;
+  if (process.env.NODE_ENV === "development") return \`development-\${name}\`;
+  throw new Error(\`Missing required environment variable: \${name}\`);
+}
+
+export const auth = betterAuth({
+  baseURL: {
+    allowedHosts: getAllowedHosts(),
+    protocol: process.env.NODE_ENV === "development" ? "auto" : "https",
+  },
+  secret: requireEnvironmentVariable("BETTER_AUTH_SECRET"),
+  session: {
+    expiresIn: SESSION_MAX_AGE_SECONDS,
+    disableSessionRefresh: true,
+    cookieCache: {
+      enabled: true,
+      maxAge: SESSION_MAX_AGE_SECONDS,
+      refreshCache: false,
+      strategy: "jwe",
+    },
+  },
+  socialProviders: {
+    vercel: {
+      clientId: requireEnvironmentVariable("VERCEL_APP_CLIENT_ID"),
+      clientSecret: requireEnvironmentVariable("VERCEL_APP_CLIENT_SECRET"),
+    },
+  },
+});
+`},WEB_APP_TEMPLATE_PACKAGE_JSON={scripts:{build:`next build`,"build:eve":`eve build`,dev:`next dev`,"dev:eve":`eve dev`,start:`next start`,"start:eve":`eve start`,typecheck:`tsc --noEmit -p tsconfig.json`},dependencies:{"@radix-ui/react-use-controllable-state":`1.2.2`,"@shikijs/core":`4.1.0`,"@shikijs/engine-javascript":`4.1.0`,"@shikijs/engine-oniguruma":`4.1.0`,"@streamdown/cjk":`1.0.3`,"@streamdown/code":`1.1.1`,"@streamdown/math":`1.0.2`,"@streamdown/mermaid":`1.0.2`,"@tailwindcss/postcss":`4.3.0`,ai:`^7.0.38`,"class-variance-authority":`0.7.1`,clsx:`2.1.1`,cmdk:`1.1.1`,"lucide-react":`1.16.0`,motion:`12.40.0`,nanoid:`5.1.11`,next:`16.3.0-preview.6`,"radix-ui":`1.4.3`,react:`19.2.6`,"react-dom":`19.2.6`,shiki:`4.1.0`,streamdown:`2.5.0`,"tailwind-merge":`3.6.0`,tailwindcss:`4.3.0`,"use-stick-to-bottom":`1.1.4`,zod:`4.4.3`},devDependencies:{"@types/node":`26`,"@types/react":`19.2.15`,"@types/react-dom":`19.2.3`,typescript:`6.0.3`}};export{WEB_APP_SIGN_IN_WITH_VERCEL_TEMPLATE_FILES,WEB_APP_TEMPLATE_FILES,WEB_APP_TEMPLATE_PACKAGE_JSON};

package/dist/src/setup/scaffold/index.d.ts

@@ -1,6 +1,6 @@
 export { byokProviderEnvVar, CURRENT_DIRECTORY_PROJECT_NAME, isEveProject, scaffoldBaseProject, type EvePackageContract, type ScaffoldBaseProjectOptions, } from "./create/project.js";
 export { scaffoldExtensionProject, type ScaffoldExtensionProjectOptions, } from "./create/extension.js";
-export { DEFAULT_SLACK_CONNECTOR_SLUG, SLACK_CHANNEL_DEFAULT_ROUTE, deriveSlackConnectorSlug, ensureChannel, hasVercelHostFramework, isNextJsProject, listAuthoredChannels, normalizeSlackConnectorSlug, resolveVercelHostFrameworkPreset, type ChannelKind, type ChannelMutationResult, type EnsureChannelOptions, type SlackConnectorSlug, type WebPackageVersions, } from "./update/channels.js";
+export { DEFAULT_SLACK_CONNECTOR_SLUG, SLACK_CHANNEL_DEFAULT_ROUTE, deriveSlackConnectorSlug, ensureChannel, hasVercelHostFramework, isNextJsProject, listAuthoredChannels, normalizeSlackConnectorSlug, resolveVercelHostFrameworkPreset, type ChannelKind, type ChannelMutationResult, type EnsureChannelOptions, type SlackConnectorSlug, type WebAuthentication, type WebPackageVersions, } from "./update/channels.js";
 export { SCAFFOLDABLE_CHANNELS, type ScaffoldableChannel } from "./channels-catalog.js";
 export { ensureConnection, ensureConnectionDependencies, listAuthoredConnections, type ConnectionInput, type ConnectionMutationAction, type ConnectionMutationResult, type EnsureConnectionOptions, type EnsureConnectionDependenciesOptions, } from "./update/connections.js";
 export { catalogSlugs, CONNECTION_CATALOG, CUSTOM_CONNECTION_SLUG, effectiveProtocols, endpointForProtocol, getCatalogEntry, isValidConnectionSlug, SUPPORTED_PROTOCOLS, type ConnectionAuthSpec, type ConnectionCatalogEntry, type ConnectionProtocol, type CustomConnectionInput, type EnvHeader, type McpEndpoint, type OpenApiEndpoint, } from "./connections/catalog.js";

package/dist/src/setup/scaffold/update/channels.d.ts

@@ -1,7 +1,8 @@
 import type { PackageManagerKind } from "../../package-manager.js";
 import { type NodeEngineOverride } from "../../node-engine.js";
 import { type WorkspaceRootMutation } from "../workspace-root.js";
-import { type EvePackageContract } from "../create/project.js";
+import { type WebAuthentication, type WebPackageVersions } from "./web-options.js";
+export type { WebAuthentication, WebPackageVersions } from "./web-options.js";
 export declare const SLACK_CHANNEL_DEFAULT_ROUTE = "/eve/v1/slack";
 export declare const DEFAULT_SLACK_CONNECTOR_SLUG = "my-agent";
 declare const slackConnectorSlugBrand: unique symbol;
@@ -97,23 +98,13 @@ export interface EnsureChannelOptions {
     slackCredentials?: "vercel-connect" | "environment";
     connectPackageVersion?: string;
     webPackageVersions?: WebPackageVersions;
+    /** Authentication integration generated for Web Chat. Omit to keep the fail-closed placeholder. */
+    webAuthentication?: WebAuthentication;
     /** When false, Web Chat leaves Vercel Services config unwritten for preview-only scaffolds. */
     configureVercelServices?: boolean;
     onWorkspaceRootMutation?: (mutation: WorkspaceRootMutation) => void | Promise<void>;
     /** Dependencies are already owned and installed by a registry item. */
     skipDependencyMutation?: boolean;
 }
-export interface WebPackageVersions {
-    evePackage?: EvePackageContract;
-    aiPackageVersion?: string;
-    nextPackageVersion?: string;
-    reactPackageVersion?: string;
-    reactDomPackageVersion?: string;
-    streamdownPackageVersion?: string;
-    zodPackageVersion?: string;
-    typesReactPackageVersion?: string;
-    typesReactDomPackageVersion?: string;
-}
 export declare function ensureChannel(options: EnsureChannelOptions): Promise<ChannelMutationResult>;
 export declare function listAuthoredChannels(projectRoot: string): Promise<string[]>;
-export {};

package/dist/src/setup/scaffold/update/channels.js

@@ -1,10 +1,10 @@
-import{appendEnv}from"../../append-env.js";import{pinnedNodeEngineMajor}from"../../node-engine.js";import{getSupportedModuleBaseName,matchesSupportedModuleBaseName}from"./module-files.js";import{pathExists,writeTextFile}from"../files.js";import{resolveVersionToken}from"../version-tokens.js";import{patchPackageJson}from"./package-json.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{WEB_APP_TEMPLATE_FILES,WEB_APP_TEMPLATE_PACKAGE_JSON}from"../create/web-template.js";import{DEFAULT_EVE_PACKAGE_CONTRACT,resolveEvePackageContract}from"../create/project.js";import{readFile,readdir,unlink,writeFile}from"node:fs/promises";import{basename,join,resolve}from"node:path";const SLACK_CHANNEL_DEFAULT_ROUTE=`/eve/v1/slack`,DEFAULT_SLACK_CONNECTOR_SLUG=`my-agent`,NEXT_PACKAGE_NAME=`next`,PACKAGE_DEPENDENCY_FIELDS=[`dependencies`,`devDependencies`],WEB_NEXT_CONFIG_PATH=`next.config.ts`,WEB_COMPETING_NEXT_CONFIG_PATHS=[`next.config.js`,`next.config.mjs`,WEB_NEXT_CONFIG_PATH,`next.config.mts`].filter(e=>e!==WEB_NEXT_CONFIG_PATH);function toSlackConnectorSlug(e){return e}function isJsonObject(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function readPackageJsonObject(e){if(!await pathExists(e))return;let t=JSON.parse(await readFile(e,`utf8`));return isJsonObject(t)?t:void 0}async function readDependencyVersion(e,t){let n=await readPackageJsonObject(e);if(n===void 0||!isJsonObject(n.dependencies))return;let r=n.dependencies[t];return typeof r==`string`?r:void 0}function packageJsonHasDependency(e,t){for(let n of PACKAGE_DEPENDENCY_FIELDS){let r=e[n];if(isJsonObject(r)&&typeof r[t]==`string`)return!0}return!1}async function hasPackageDependency(e,t){let n=await readPackageJsonObject(e);return n!==void 0&&packageJsonHasDependency(n,t)}async function isNextJsProject(e){return hasPackageDependency(join(e,`package.json`),NEXT_PACKAGE_NAME)}const VERCEL_HOST_FRAMEWORK_PRESETS={"@sveltejs/kit":`sveltekit`,[NEXT_PACKAGE_NAME]:`nextjs`,nuxt:`nuxtjs`,nuxt3:`nuxtjs`,"nuxt-edge":`nuxtjs`,"nuxt-nightly":`nuxtjs`};async function resolveVercelHostFrameworkPreset(e){let t=await readPackageJsonObject(join(e,`package.json`));if(t!==void 0){for(let[e,n]of Object.entries(VERCEL_HOST_FRAMEWORK_PRESETS))if(packageJsonHasDependency(t,e))return n}}async function hasVercelHostFramework(e){return await resolveVercelHostFrameworkPreset(e)!==void 0}async function ensurePackageDependency(e,t,n){return!await pathExists(e)||await readDependencyVersion(e,t)===n?[]:(await patchPackageJson(e,{dependencies:{[t]:n}}),[{path:e,dependencies:[t],devDependencies:[],scripts:[]}])}function resolveWebPackageVersions(e){return{evePackage:e?.evePackage??DEFAULT_EVE_PACKAGE_CONTRACT,aiPackageVersion:e?.aiPackageVersion??`^7.0.58`,nextPackageVersion:e?.nextPackageVersion??`16.3.0-preview.6`,reactPackageVersion:e?.reactPackageVersion??`19.2.6`,reactDomPackageVersion:e?.reactDomPackageVersion??`19.2.6`,streamdownPackageVersion:e?.streamdownPackageVersion??`2.5.0`,zodPackageVersion:e?.zodPackageVersion??`4.4.3`,typesReactPackageVersion:e?.typesReactPackageVersion??`19.2.15`,typesReactDomPackageVersion:e?.typesReactDomPackageVersion??`19.2.3`}}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}async function patchWebPackageJson(e,n,r,a,c,d=!0){let p=join(e,`package.json`);if(!await pathExists(p))return{mutations:[]};let h=resolveEvePackageContract(a.evePackage),g=pinnedNodeEngineMajor(h.nodeEngine),_={...WEB_APP_TEMPLATE_PACKAGE_JSON.dependencies,ai:resolveVersionToken(`aiPackageVersion`,a.aiPackageVersion),eve:formatEveDependencySpecifier(h.version),next:resolveVersionToken(`nextPackageVersion`,a.nextPackageVersion),react:resolveVersionToken(`reactPackageVersion`,a.reactPackageVersion),"react-dom":resolveVersionToken(`reactDomPackageVersion`,a.reactDomPackageVersion),streamdown:resolveVersionToken(`streamdownPackageVersion`,a.streamdownPackageVersion),zod:resolveVersionToken(`zodPackageVersion`,a.zodPackageVersion)},v={...WEB_APP_TEMPLATE_PACKAGE_JSON.devDependencies,"@types/node":g,"@types/react":resolveVersionToken(`typesReactPackageVersion`,a.typesReactPackageVersion),"@types/react-dom":resolveVersionToken(`typesReactDomPackageVersion`,a.typesReactDomPackageVersion),typescript:`6.0.3`},y=WEB_APP_TEMPLATE_PACKAGE_JSON.scripts,b=isPackageManagerWorkspaceMember(n,r),x={scripts:y};d&&(x.dependencies=_,x.devDependencies=v),b||(x.nodeEngineRequirement=h.nodeEngine);let S=await patchPackageJson(p,x),C=(await patchWorkspaceRootPackageJson(n,r,{aiPackageVersion:_.ai,nodeEngineRequirement:h.nodeEngine,onWorkspaceRootMutation:c})).nodeEngineOverride??S.nodeEngineOverride;return{mutations:[{path:p,dependencies:d?Object.keys(_):[],devDependencies:d?Object.keys(v):[],scripts:Object.keys(y)}],nodeEngineOverride:C}}function normalizeSlackConnectorSlug(e){return toSlackConnectorSlug((e.trim().replace(/^@/,``).split(`/`).at(-1)??``).toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^[^a-z0-9]+/,``).replace(/[^a-z0-9]+$/,``).slice(0,100).replace(/[^a-z0-9]+$/,``)||`my-agent`)}async function deriveSlackConnectorSlug(e,t){if(t!==void 0&&t.length>0&&t!==`.`)return normalizeSlackConnectorSlug(t);try{let t=await readFile(join(e,`package.json`),`utf8`),n=JSON.parse(t);if(typeof n.name==`string`&&n.name.length>0)return normalizeSlackConnectorSlug(n.name)}catch{}return normalizeSlackConnectorSlug(basename(resolve(e))||`my-agent`)}function buildSlackConnectTemplate(e){if(!e.startsWith(`slack/`)||e.length===6)throw Error(`Invalid Slack connector UID "${e}".`);return`import { connectSlackCredentials } from "@vercel/connect/eve";
+import{appendEnv}from"../../append-env.js";import{pinnedNodeEngineMajor}from"../../node-engine.js";import{getSupportedModuleBaseName,matchesSupportedModuleBaseName}from"./module-files.js";import{pathExists,writeTextFile}from"../files.js";import{resolveVersionToken}from"../version-tokens.js";import{patchPackageJson}from"./package-json.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{WEB_APP_SIGN_IN_WITH_VERCEL_TEMPLATE_FILES,WEB_APP_TEMPLATE_FILES,WEB_APP_TEMPLATE_PACKAGE_JSON}from"../create/web-template.js";import{resolveEvePackageContract}from"../create/project.js";import{resolveWebPackageVersions}from"./web-options.js";import{readFile,readdir,unlink,writeFile}from"node:fs/promises";import{basename,join,resolve}from"node:path";const SLACK_CHANNEL_DEFAULT_ROUTE=`/eve/v1/slack`,DEFAULT_SLACK_CONNECTOR_SLUG=`my-agent`,NEXT_PACKAGE_NAME=`next`,PACKAGE_DEPENDENCY_FIELDS=[`dependencies`,`devDependencies`],WEB_NEXT_CONFIG_PATH=`next.config.ts`,WEB_COMPETING_NEXT_CONFIG_PATHS=[`next.config.js`,`next.config.mjs`,WEB_NEXT_CONFIG_PATH,`next.config.mts`].filter(e=>e!==WEB_NEXT_CONFIG_PATH);function toSlackConnectorSlug(e){return e}function isJsonObject(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function readPackageJsonObject(e){if(!await pathExists(e))return;let t=JSON.parse(await readFile(e,`utf8`));return isJsonObject(t)?t:void 0}async function readDependencyVersion(e,t){let n=await readPackageJsonObject(e);if(n===void 0||!isJsonObject(n.dependencies))return;let r=n.dependencies[t];return typeof r==`string`?r:void 0}function packageJsonHasDependency(e,t){for(let n of PACKAGE_DEPENDENCY_FIELDS){let r=e[n];if(isJsonObject(r)&&typeof r[t]==`string`)return!0}return!1}async function hasPackageDependency(e,t){let n=await readPackageJsonObject(e);return n!==void 0&&packageJsonHasDependency(n,t)}async function isNextJsProject(e){return hasPackageDependency(join(e,`package.json`),NEXT_PACKAGE_NAME)}const VERCEL_HOST_FRAMEWORK_PRESETS={"@sveltejs/kit":`sveltekit`,[NEXT_PACKAGE_NAME]:`nextjs`,nuxt:`nuxtjs`,nuxt3:`nuxtjs`,"nuxt-edge":`nuxtjs`,"nuxt-nightly":`nuxtjs`};async function resolveVercelHostFrameworkPreset(e){let t=await readPackageJsonObject(join(e,`package.json`));if(t!==void 0){for(let[e,n]of Object.entries(VERCEL_HOST_FRAMEWORK_PRESETS))if(packageJsonHasDependency(t,e))return n}}async function hasVercelHostFramework(e){return await resolveVercelHostFrameworkPreset(e)!==void 0}async function ensurePackageDependency(e,t,n){return!await pathExists(e)||await readDependencyVersion(e,t)===n?[]:(await patchPackageJson(e,{dependencies:{[t]:n}}),[{path:e,dependencies:[t],devDependencies:[],scripts:[]}])}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}async function patchWebPackageJson(e,n,r,a,c,d=!0,f){let h=join(e,`package.json`);if(!await pathExists(h))return{mutations:[]};let g=resolveEvePackageContract(a.evePackage),_=pinnedNodeEngineMajor(g.nodeEngine),v={...WEB_APP_TEMPLATE_PACKAGE_JSON.dependencies,ai:resolveVersionToken(`aiPackageVersion`,a.aiPackageVersion),eve:formatEveDependencySpecifier(g.version),next:resolveVersionToken(`nextPackageVersion`,a.nextPackageVersion),react:resolveVersionToken(`reactPackageVersion`,a.reactPackageVersion),"react-dom":resolveVersionToken(`reactDomPackageVersion`,a.reactDomPackageVersion),streamdown:resolveVersionToken(`streamdownPackageVersion`,a.streamdownPackageVersion),zod:resolveVersionToken(`zodPackageVersion`,a.zodPackageVersion),...f===`sign-in-with-vercel`?{"better-auth":resolveVersionToken(`betterAuthPackageVersion`,a.betterAuthPackageVersion)}:{}},y={...WEB_APP_TEMPLATE_PACKAGE_JSON.devDependencies,"@types/node":_,"@types/react":resolveVersionToken(`typesReactPackageVersion`,a.typesReactPackageVersion),"@types/react-dom":resolveVersionToken(`typesReactDomPackageVersion`,a.typesReactDomPackageVersion),typescript:`6.0.3`},b=WEB_APP_TEMPLATE_PACKAGE_JSON.scripts,x=isPackageManagerWorkspaceMember(n,r),S={scripts:b};d&&(S.dependencies=v,S.devDependencies=y),x||(S.nodeEngineRequirement=g.nodeEngine);let C=await patchPackageJson(h,S),w=(await patchWorkspaceRootPackageJson(n,r,{aiPackageVersion:v.ai,nodeEngineRequirement:g.nodeEngine,onWorkspaceRootMutation:c})).nodeEngineOverride??C.nodeEngineOverride;return{mutations:[{path:h,dependencies:d?Object.keys(v):[],devDependencies:d?Object.keys(y):[],scripts:Object.keys(b)}],nodeEngineOverride:w}}function normalizeSlackConnectorSlug(e){return toSlackConnectorSlug((e.trim().replace(/^@/,``).split(`/`).at(-1)??``).toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^[^a-z0-9]+/,``).replace(/[^a-z0-9]+$/,``).slice(0,100).replace(/[^a-z0-9]+$/,``)||`my-agent`)}async function deriveSlackConnectorSlug(e,t){if(t!==void 0&&t.length>0&&t!==`.`)return normalizeSlackConnectorSlug(t);try{let t=await readFile(join(e,`package.json`),`utf8`),n=JSON.parse(t);if(typeof n.name==`string`&&n.name.length>0)return normalizeSlackConnectorSlug(n.name)}catch{}return normalizeSlackConnectorSlug(basename(resolve(e))||`my-agent`)}function buildSlackConnectTemplate(e){if(!e.startsWith(`slack/`)||e.length===6)throw Error(`Invalid Slack connector UID "${e}".`);return`import { connectSlackCredentials } from "@vercel/connect/eve";
 import { slackChannel } from "eve/channels/slack";
 
 export default slackChannel({
   credentials: connectSlackCredentials(${JSON.stringify(e)}),
 });
-`}const SLACK_ENV_EXAMPLE_VALUES={SLACK_BOT_TOKEN:``,SLACK_SIGNING_SECRET:``};function renderWebAppTemplate(e,t){return e.replaceAll(`__EVE_INIT_APP_NAME__`,t).replaceAll(`__EVE_INIT_WITH_EVE_OPTIONS__`,``)}async function ensureWebVercelJson(e){return await pathExists(e)?`skipped`:(await writeTextFile(e,`${JSON.stringify({$schema:`https://openapi.vercel.sh/vercel.json`},null,2)}\n`,{force:!0}),`written`)}async function findCompetingNextConfigFiles(e){let t=[];for(let n of WEB_COMPETING_NEXT_CONFIG_PATHS){let r=join(e,n);await pathExists(r)&&t.push(r)}return t}async function ensureChannel(e){switch(e.kind){case`slack`:return ensureSlackChannel({...e,kind:`slack`});case`web`:return ensureWebChannel({...e,kind:`web`})}}async function ensureWebChannel(e){let t=join(e.projectRoot,`package.json`),n=await pathExists(join(e.projectRoot,`app/page.tsx`));if(!e.force&&await isNextJsProject(e.projectRoot))return{kind:`web`,action:`skipped`,skipReason:`nextjs-project`,filesWritten:[],filesSkipped:[t],packageJsonUpdated:[]};let r=resolveWebPackageVersions(e.webPackageVersions),o=e.packageManager??`pnpm`,s=resolve(e.workspaceProbeDirectory??e.projectRoot),l=await patchWebPackageJson(e.projectRoot,o,s,r,e.onWorkspaceRootMutation,!e.skipDependencyMutation),u=[],f=[],p=[],m=[],h=basename(resolve(e.projectRoot));if(e.configureVercelServices??!0){let t=join(e.projectRoot,`vercel.json`);await ensureWebVercelJson(t)===`written`?u.push(t):m.push(t)}let g=await applyPackageManagerWorkspaceConfiguration({packageManager:o,projectRoot:e.projectRoot,workspaceProbeRoot:s,onWorkspaceRootMutation:e.onWorkspaceRootMutation});if(u.push(...g.filesWritten),m.push(...g.filesSkipped),!e.skipDependencyMutation)for(let[t,n]of Object.entries(WEB_APP_TEMPLATE_FILES)){let r=join(e.projectRoot,t);if(t===`agent/channels/eve.ts`&&!e.force&&await pathExists(r)){m.push(r);continue}let o=await pathExists(r);await writeTextFile(r,renderWebAppTemplate(n,h),{force:!0}),u.push(r),o&&f.push(r)}p.push(...await findCompetingNextConfigFiles(e.projectRoot));let _=[...new Set(u)],v=[...new Set(m)].filter(e=>!_.includes(e)),x={kind:`web`,action:n?`overwritten`:`created`,filesWritten:_,filesSkipped:v,packageJsonUpdated:l.mutations};return f.length>0&&(x.filesOverwritten=f),p.length>0&&(x.competingNextConfigFiles=p),l.nodeEngineOverride!==void 0&&(x.nodeEngineOverride=l.nodeEngineOverride),x}async function ensureSlackChannel(t){let n=join(t.projectRoot,`agent/channels/slack.ts`),r=await pathExists(n);if(!t.force&&r)return{kind:`slack`,action:`skipped`,filesWritten:[],filesSkipped:[n],packageJsonUpdated:[]};let s=t.slackCredentials??`vercel-connect`,c=t.slackConnectorSlug??await deriveSlackConnectorSlug(t.projectRoot),l,u=[],d=[n],f=[],p;if(s===`vercel-connect`){if(!t.skipDependencyMutation){let e=resolveVersionToken(`connectPackageVersion`,t.connectPackageVersion??`0.4.3`);u=await ensurePackageDependency(join(t.projectRoot,`package.json`),`@vercel/connect`,e)}l=buildSlackConnectTemplate(t.slackConnectorUid??`slack/${c}`)}else{l=`import { slackChannel } from "eve/channels/slack";
+`}const SLACK_ENV_EXAMPLE_VALUES={SLACK_BOT_TOKEN:``,SLACK_SIGNING_SECRET:``};function renderWebAppTemplate(e,t){return e.replaceAll(`__EVE_INIT_APP_NAME__`,t).replaceAll(`__EVE_INIT_WITH_EVE_OPTIONS__`,``)}async function ensureWebVercelJson(e){return await pathExists(e)?`skipped`:(await writeTextFile(e,`${JSON.stringify({$schema:`https://openapi.vercel.sh/vercel.json`},null,2)}\n`,{force:!0}),`written`)}async function findCompetingNextConfigFiles(e){let t=[];for(let n of WEB_COMPETING_NEXT_CONFIG_PATHS){let r=join(e,n);await pathExists(r)&&t.push(r)}return t}async function ensureChannel(e){switch(e.kind){case`slack`:return ensureSlackChannel({...e,kind:`slack`});case`web`:return ensureWebChannel({...e,kind:`web`})}}async function ensureWebChannel(e){let t=join(e.projectRoot,`package.json`),n=await pathExists(join(e.projectRoot,`app/page.tsx`));if(!e.force&&await isNextJsProject(e.projectRoot))return{kind:`web`,action:`skipped`,skipReason:`nextjs-project`,filesWritten:[],filesSkipped:[t],packageJsonUpdated:[]};let r=resolveWebPackageVersions(e.webPackageVersions,e.webAuthentication),o=e.packageManager??`pnpm`,s=resolve(e.workspaceProbeDirectory??e.projectRoot),l=await patchWebPackageJson(e.projectRoot,o,s,r,e.onWorkspaceRootMutation,!e.skipDependencyMutation,e.webAuthentication),u=[],p=[],m=[],g=[],_=basename(resolve(e.projectRoot));if(e.configureVercelServices??!0){let t=join(e.projectRoot,`vercel.json`);await ensureWebVercelJson(t)===`written`?u.push(t):g.push(t)}let v=await applyPackageManagerWorkspaceConfiguration({packageManager:o,projectRoot:e.projectRoot,workspaceProbeRoot:s,onWorkspaceRootMutation:e.onWorkspaceRootMutation});if(u.push(...v.filesWritten),g.push(...v.filesSkipped),!e.skipDependencyMutation){let t={...WEB_APP_TEMPLATE_FILES,...e.webAuthentication===`sign-in-with-vercel`?WEB_APP_SIGN_IN_WITH_VERCEL_TEMPLATE_FILES:{}};for(let[n,r]of Object.entries(t)){let t=join(e.projectRoot,n);if(n===`agent/channels/eve.ts`&&!e.force&&await pathExists(t)){g.push(t);continue}let o=await pathExists(t);await writeTextFile(t,renderWebAppTemplate(r,_),{force:!0}),u.push(t),o&&p.push(t)}}m.push(...await findCompetingNextConfigFiles(e.projectRoot));let y=[...new Set(u)],S=[...new Set(g)].filter(e=>!y.includes(e)),C={kind:`web`,action:n?`overwritten`:`created`,filesWritten:y,filesSkipped:S,packageJsonUpdated:l.mutations};return p.length>0&&(C.filesOverwritten=p),m.length>0&&(C.competingNextConfigFiles=m),l.nodeEngineOverride!==void 0&&(C.nodeEngineOverride=l.nodeEngineOverride),C}async function ensureSlackChannel(t){let n=join(t.projectRoot,`agent/channels/slack.ts`),r=await pathExists(n);if(!t.force&&r)return{kind:`slack`,action:`skipped`,filesWritten:[],filesSkipped:[n],packageJsonUpdated:[]};let s=t.slackCredentials??`vercel-connect`,c=t.slackConnectorSlug??await deriveSlackConnectorSlug(t.projectRoot),l,u=[],d=[n],f=[],p;if(s===`vercel-connect`){if(!t.skipDependencyMutation){let e=resolveVersionToken(`connectPackageVersion`,t.connectPackageVersion??`0.4.3`);u=await ensurePackageDependency(join(t.projectRoot,`package.json`),`@vercel/connect`,e)}l=buildSlackConnectTemplate(t.slackConnectorUid??`slack/${c}`)}else{l=`import { slackChannel } from "eve/channels/slack";
 
 export default slackChannel();
 `;let n=join(t.projectRoot,`.env.example`);p={path:n,...await pathExists(n)?{content:await readFile(n,`utf8`)}:{}},(await appendEnv(n,SLACK_ENV_EXAMPLE_VALUES)).written.length>0?d.push(n):f.push(n)}try{await writeTextFile(n,l,{force:t.force})}catch(e){throw p!==void 0&&(p.content===void 0?await unlink(p.path):await writeFile(p.path,p.content,`utf8`)),e}let m={kind:`slack`,action:r?`overwritten`:`created`,filesWritten:d,filesSkipped:f,packageJsonUpdated:u,slackConnectorSlug:c};return r&&(m.filesOverwritten=[n]),m}async function listAuthoredChannels(e){let t=join(e,`agent/channels`),i;try{i=await readdir(t,{withFileTypes:!0})}catch(e){if(e.code===`ENOENT`)return[];throw e}let a=[];for(let e of i){if(e.isFile()){let t=getSupportedModuleBaseName(e.name);t!==null&&a.push(t);continue}if(e.isDirectory())try{(await readdir(join(t,e.name))).some(e=>matchesSupportedModuleBaseName(e,`connection`))&&a.push(e.name)}catch{}}return a.sort()}export{DEFAULT_SLACK_CONNECTOR_SLUG,SLACK_CHANNEL_DEFAULT_ROUTE,deriveSlackConnectorSlug,ensureChannel,hasVercelHostFramework,isNextJsProject,listAuthoredChannels,normalizeSlackConnectorSlug,resolveVercelHostFrameworkPreset};

package/dist/src/setup/scaffold/update/web-options.d.ts

@@ -0,0 +1,15 @@
+import { type EvePackageContract } from "../create/project.js";
+export type WebAuthentication = "sign-in-with-vercel";
+export interface WebPackageVersions {
+    evePackage?: EvePackageContract;
+    aiPackageVersion?: string;
+    betterAuthPackageVersion?: string;
+    nextPackageVersion?: string;
+    reactPackageVersion?: string;
+    reactDomPackageVersion?: string;
+    streamdownPackageVersion?: string;
+    zodPackageVersion?: string;
+    typesReactPackageVersion?: string;
+    typesReactDomPackageVersion?: string;
+}
+export declare function resolveWebPackageVersions(input: WebPackageVersions | undefined, authentication?: WebAuthentication): Required<WebPackageVersions>;

package/dist/src/setup/scaffold/update/web-options.js

@@ -0,0 +1 @@
+import{DEFAULT_EVE_PACKAGE_CONTRACT}from"../create/project.js";function resolveWebPackageVersions(e,t){return{evePackage:e?.evePackage??DEFAULT_EVE_PACKAGE_CONTRACT,aiPackageVersion:e?.aiPackageVersion??`^7.0.58`,betterAuthPackageVersion:e?.betterAuthPackageVersion??`1.6.26`,nextPackageVersion:e?.nextPackageVersion??(t===`sign-in-with-vercel`?`16.3.0`:`16.3.0-preview.6`),reactPackageVersion:e?.reactPackageVersion??`19.2.6`,reactDomPackageVersion:e?.reactDomPackageVersion??`19.2.6`,streamdownPackageVersion:e?.streamdownPackageVersion??`2.5.0`,zodPackageVersion:e?.zodPackageVersion??`4.4.3`,typesReactPackageVersion:e?.typesReactPackageVersion??`19.2.15`,typesReactDomPackageVersion:e?.typesReactDomPackageVersion??`19.2.3`}}export{resolveWebPackageVersions};

package/docs/concepts/sessions-runs-and-streaming.md

@@ -150,13 +150,13 @@ curl -X POST http://127.0.0.1:2000/eve/v1/session/<sessionId> \
 
 The follow-up reuses the same durable session: same history, same state. Message sends default to cancellation-backed `"steer"`; if a turn is active, eve buffers the follow-up, cancels that turn, and starts the message under a new turn ID. Channels and TypeScript `Session.send(...)` calls can select `turnPolicy: "queue"` when active work should finish first. Structured `inputResponses` never steer.
 
-If the session is waiting on a human-in-the-loop approval, a matching text reply such as `approve` or `cancel` answers the approval. Other follow-up text is held until the approval is answered, so an unrelated message does not implicitly deny the pending tool call.
+If one pending batch is waiting on a human-in-the-loop approval, a matching text reply such as `approve` or `cancel` answers it. Unrelated text starts an ordinary turn immediately without denying the tool call; the approval stays pending and answerable. A later structured `inputResponses` answer keyed by its `requestId` still resumes the original tool call, even after intervening turns.
 
-If the session is waiting on `ask_question`, a follow-up message clears that pending request before the model continues. An exact option match or permitted freeform response answers the question; any other message marks the question unanswered and starts the follow-up turn.
+With one question-only batch, an exact option match or permitted freeform response answers `ask_question`. Any other follow-up marks the question unanswered and starts the new turn. With several approval or question batches pending, eve does not guess which batch plain text addresses: the message starts an ordinary turn and the batches stay open. Use structured responses to target requests unambiguously.
 
-A response is stale when its request is no longer pending: the question or approval was already answered, cleared by a follow-up message, or cancelled. eve delivers a stale response to the model as a new user message, and the model decides whether the old selection still matters. A stale approval never authorizes the earlier tool call; the model must request the action and approval again if they are still needed.
+A structured response matches any currently pending request by ID, not only the newest batch. It becomes stale only after that request was answered, cleared, or cancelled. eve delivers a stale response to the model as a new user message, and the model decides whether the old selection still matters. A stale approval never authorizes the earlier tool call; the model must request the action and approval again if they are still needed.
 
-Responses match pending requests by request ID, so a response to an older request stays a plain user message even while a different question or approval is pending. Like any follow-up message, a stale response clears a pending question and is held while an approval is pending.
+One delivery can answer requests from several batches. eve resumes approval-bearing batches in durable order and carries later answers forward until each batch can resume.
 
 Multiple replacement messages retain their durable arrival order and may be folded into the same replacement turn when they arrive before cancellation settles. See [message delivery and steering](./execution-model-and-durability#message-delivery-and-steering) for the current runtime contract.
 

package/docs/guides/frontend/overview.mdx

@@ -113,20 +113,41 @@ received attachment as a `file` part on the user message. The part includes `med
 
 ## Human-in-the-loop prompts
 
-Tools opt into approval with `approval`, and the model can also ask a question with `ask_question` — see [Human-in-the-loop](/docs/human-in-the-loop) for the server-side model. Either way the stream emits an `input.requested` event, and the pending request rides on a `dynamic-tool` part of the latest message at `part.toolMetadata?.eve?.inputRequest`. Read it, then answer through the same session with `respond()`:
+Tools opt into approval with `approval`, and the model can also ask a question with `ask_question` — see [Human-in-the-loop](/docs/human-in-the-loop) for the server-side model. Either way the stream emits an `input.requested` event, and the pending request rides on a `dynamic-tool` part at `part.toolMetadata?.eve?.inputRequest`. Scan every message because an unrelated turn can add newer messages while an approval stays open, then answer through the same session with `respond()`:
 
 ```tsx
-const request = agent.data.messages
-  .at(-1)
-  ?.parts.find((part) => part.type === "dynamic-tool" && part.toolMetadata?.eve?.inputRequest)
-  ?.toolMetadata?.eve?.inputRequest;
-
-if (request) {
-  await agent.respond([{ requestId: request.requestId, optionId: "approve" }]);
-}
+const pendingRequests = agent.data.messages
+  .flatMap((message) => message.parts)
+  .flatMap((part) => {
+    if (part.type !== "dynamic-tool" || part.state !== "approval-requested") return [];
+    const request = part.toolMetadata?.eve?.inputRequest;
+    return request ? [request] : [];
+  });
+
+return pendingRequests.map((request) => (
+  <fieldset key={request.requestId}>
+    <legend>
+      {request.kind === "tool-approval"
+        ? "Approval required"
+        : request.kind === "question"
+          ? "Question"
+          : "Session limit"}
+    </legend>
+    <p>{request.prompt}</p>
+    {request.options?.map((option) => (
+      <button
+        key={option.id}
+        onClick={() => void agent.respond([{ requestId: request.requestId, optionId: option.id }])}
+        type="button"
+      >
+        {option.label}
+      </button>
+    ))}
+  </fieldset>
+));
 ```
 
-`request.prompt` and `request.options` give you what you need to render the approve and cancel UI. The default reducer marks the part as responded immediately, then updates it again once eve streams the resumed result.
+For a question with `allowFreeform`, render a text input and send `{ requestId, text }`. The default reducer marks each matching part as responded immediately. Approved tools update again when eve streams their result.
 
 ## Authorization prompts
 

package/docs/guides/frontend/use-eve-agent-svelte.mdx

@@ -77,26 +77,48 @@ await agent.send([
 
 ## Human-in-the-loop prompts
 
-A tool opts into approval with `approval` ([Tools](../../tools)). When one fires, the pending request rides along on a `dynamic-tool` part of the latest message at `part.toolMetadata?.eve?.inputRequest`. Read it, then answer through the same session with `agent.respond(inputResponses)`:
+A tool opts into approval with `approval` ([Tools](../../tools)). When one fires, the pending request rides along on a `dynamic-tool` part at `part.toolMetadata?.eve?.inputRequest`. Scan every message because an unrelated turn can add newer messages while the approval stays open, then answer through the same session with `agent.respond(inputResponses)`:
 
-```ts
-import type { EveDynamicToolPart, EveMessagePart } from "eve/svelte";
-
-const isDynamicToolPart = (part: EveMessagePart): part is EveDynamicToolPart =>
-  part.type === "dynamic-tool";
+```svelte
+<script lang="ts">
+  import { useEveAgent } from "eve/svelte";
 
-const request = agent.data.messages
-  .at(-1)
-  ?.parts.filter(isDynamicToolPart)
-  .map((part) => part.toolMetadata?.eve?.inputRequest)
-  .find((value) => value !== undefined);
+  const agent = useEveAgent();
+  const pendingRequests = $derived(
+    agent.data.messages.flatMap((message) =>
+      message.parts.flatMap((part) => {
+        if (part.type !== "dynamic-tool" || part.state !== "approval-requested") return [];
+        const request = part.toolMetadata?.eve?.inputRequest;
+        return request ? [request] : [];
+      }),
+    ),
+  );
+</script>
 
-if (request) {
-  await agent.respond([{ requestId: request.requestId, optionId: "approve" }]);
-}
+{#each pendingRequests as request (request.requestId)}
+  <fieldset>
+    <legend>
+      {request.kind === "tool-approval"
+        ? "Approval required"
+        : request.kind === "question"
+          ? "Question"
+          : "Session limit"}
+    </legend>
+    <p>{request.prompt}</p>
+    {#each request.options ?? [] as option (option.id)}
+      <button
+        type="button"
+        onclick={() =>
+          void agent.respond([{ requestId: request.requestId, optionId: option.id }])}
+      >
+        {option.label}
+      </button>
+    {/each}
+  </fieldset>
+{/each}
 ```
 
-The find-and-answer flow is identical across frameworks. The [React hook reference](./overview) covers the longer walkthrough.
+For a question with `allowFreeform`, bind a text input and send `{ requestId, text }`. The [React hook reference](./overview) covers the shared behavior.
 
 ## Stop, reset, and resume
 

package/docs/guides/frontend/use-eve-agent-vue.mdx

@@ -88,28 +88,51 @@ async function onFileChange(event: Event) {
 
 ## Human-in-the-loop prompts
 
-A tool opts into approval with `approval` ([Tools](../../tools)). When it triggers, the pending request shows up as a `dynamic-tool` part on the latest message at `part.toolMetadata?.eve?.inputRequest`. Read it, then answer through the same session with `respond(inputResponses)`:
+A tool opts into approval with `approval` ([Tools](../../tools)). When it triggers, the pending request shows up on a `dynamic-tool` part at `part.toolMetadata?.eve?.inputRequest`. Scan every message because an unrelated turn can add newer messages while the approval stays open, then answer through the same session with `respond(inputResponses)`:
 
-```ts
-import type { EveDynamicToolPart, EveMessagePart } from "eve/vue";
+```vue
+<script setup lang="ts">
+import { computed } from "vue";
+import { useEveAgent } from "eve/vue";
 
 const { data, respond } = useEveAgent();
 
-const isDynamicToolPart = (part: EveMessagePart): part is EveDynamicToolPart =>
-  part.type === "dynamic-tool";
-
-const request = data.value.messages
-  .at(-1)
-  ?.parts.filter(isDynamicToolPart)
-  .map((part) => part.toolMetadata?.eve?.inputRequest)
-  .find((value) => value !== undefined);
+const pendingRequests = computed(() =>
+  data.value.messages.flatMap((message) =>
+    message.parts.flatMap((part) => {
+      if (part.type !== "dynamic-tool" || part.state !== "approval-requested") return [];
+      const request = part.toolMetadata?.eve?.inputRequest;
+      return request ? [request] : [];
+    }),
+  ),
+);
+</script>
 
-if (request) {
-  await respond([{ requestId: request.requestId, optionId: "approve" }]);
-}
+<template>
+  <fieldset v-for="request in pendingRequests" :key="request.requestId">
+    <legend>
+      {{
+        request.kind === "tool-approval"
+          ? "Approval required"
+          : request.kind === "question"
+            ? "Question"
+            : "Session limit"
+      }}
+    </legend>
+    <p>{{ request.prompt }}</p>
+    <button
+      v-for="option in request.options ?? []"
+      :key="option.id"
+      type="button"
+      @click="respond([{ requestId: request.requestId, optionId: option.id }])"
+    >
+      {{ option.label }}
+    </button>
+  </fieldset>
+</template>
 ```
 
-The find-and-answer flow is the same across every framework. The [React hook reference](./overview) covers the longer walkthrough.
+For a question with `allowFreeform`, bind a text input and send `{ requestId, text }`. The [React hook reference](./overview) covers the shared behavior.
 
 ## Stop, reset, and resume