eve 0.59.0 → 0.59.1

package/dist/src/setup/scaffold/create/project.js

@@ -1,4 +1,4 @@
-import{pinnedNodeEngineMajor}from"../../node-engine.js";import{parseChatGptModelSelection}from"../../../shared/chatgpt-model.js";import{SUPPORTED_AUTHORED_MODULE_FILE_EXTENSIONS}from"../update/module-files.js";import{pathExists,writeTextFile}from"../files.js";import{blockingCreateInPlaceEntries}from"../create-in-place.js";import{DEFAULT_CONNECT_PACKAGE_VERSION,resolveVersionToken}from"../version-tokens.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{WEB_APP_TEMPLATE_FILES}from"./web-template.js";import{mkdir,readdir,stat}from"node:fs/promises";import{basename,join,resolve}from"node:path";const CURRENT_DIRECTORY_PROJECT_NAME=`.`,DEFAULT_AI_PACKAGE_VERSION=`^7.0.105`,DEFAULT_ZOD_PACKAGE_VERSION=`4.5.4`,DEFAULT_EVE_PACKAGE_CONTRACT={version:`0.59.0`,nodeEngine:`>=24`};function resolveEvePackageContract(e=DEFAULT_EVE_PACKAGE_CONTRACT){return{version:resolveVersionToken(`evePackage.version`,e.version),nodeEngine:resolveVersionToken(`evePackage.nodeEngine`,e.nodeEngine)}}function modelProviderSlug(e){let t=(e.split(`/`)[0]??``).replaceAll(/[^A-Za-z0-9._-]/gu,``);return t.length>0?t:`anthropic`}function byokProviderEnvVar(e){let t=modelProviderSlug(e).toUpperCase().replaceAll(/[^A-Z0-9]/gu,`_`);return`${/^[0-9]/.test(t)?`_`:``}${t}_API_KEY`}function agentTemplateFiles(e,t){return{"agent/agent.ts":renderAgentTemplate(e,t),"agent/channels/eve.ts":WEB_APP_TEMPLATE_FILES[`agent/channels/eve.ts`],"agent/instructions.md":AGENT_INSTRUCTIONS_TEMPLATE}}function renderAgentTemplate(e,t){let n=parseChatGptModelSelection(e);return n===void 0?BASE_AGENT_TEMPLATE.replaceAll(`__EVE_INIT_MODEL__`,e).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t)):`import { defineAgent } from "eve";\nimport { chatgpt } from "eve/models/openai";\n\nexport default defineAgent({\n  model: chatgpt(${JSON.stringify(n)}),\n${reasoningTemplateLine(t)}});\n`}function reasoningTemplateLine(e){return e===void 0||e===`provider-default`?``:`  reasoning: "${e}",\n`}function renderTemplate(e,t){return e===BASE_AGENT_TEMPLATE&&parseChatGptModelSelection(t.model)!==void 0?renderAgentTemplate(t.model,t.reasoning):e.replaceAll(`__EVE_INIT_APP_NAME__`,t.appName).replaceAll(`__EVE_INIT_MODEL__`,t.model).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t.reasoning)).replaceAll(`__EVE_INIT_BYOK_PROVIDER__`,modelProviderSlug(t.model)).replaceAll(`__EVE_INIT_BYOK_ENV_VAR__`,byokProviderEnvVar(t.model)).replaceAll(`__EVE_INIT_PACKAGE_VERSION__`,formatEveDependencySpecifier(t.eveVersion)).replaceAll(`__EVE_INIT_AI_SDK_VERSION__`,t.aiPackageVersion).replaceAll(`__EVE_INIT_CONNECT_VERSION__`,t.connectPackageVersion).replaceAll(`__EVE_INIT_ZOD_VERSION__`,t.zodPackageVersion).replaceAll(`__EVE_INIT_TYPESCRIPT_VERSION__`,t.typescriptPackageVersion).replaceAll(`__EVE_INIT_TYPES_NODE_VERSION__`,t.nodeTypesVersion).replaceAll(`__EVE_INIT_NODE_ENGINE__`,t.nodeEngine)}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}const BASE_AGENT_TEMPLATE=`import { defineAgent } from "eve";
+import{pinnedNodeEngineMajor}from"../../node-engine.js";import{parseChatGptModelSelection}from"../../../shared/chatgpt-model.js";import{SUPPORTED_AUTHORED_MODULE_FILE_EXTENSIONS}from"../update/module-files.js";import{pathExists,writeTextFile}from"../files.js";import{blockingCreateInPlaceEntries}from"../create-in-place.js";import{DEFAULT_CONNECT_PACKAGE_VERSION,resolveVersionToken}from"../version-tokens.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{WEB_APP_TEMPLATE_FILES}from"./web-template.js";import{mkdir,readdir,stat}from"node:fs/promises";import{basename,join,resolve}from"node:path";const CURRENT_DIRECTORY_PROJECT_NAME=`.`,DEFAULT_AI_PACKAGE_VERSION=`^7.0.105`,DEFAULT_ZOD_PACKAGE_VERSION=`4.5.4`,DEFAULT_EVE_PACKAGE_CONTRACT={version:`0.59.1`,nodeEngine:`>=24`};function resolveEvePackageContract(e=DEFAULT_EVE_PACKAGE_CONTRACT){return{version:resolveVersionToken(`evePackage.version`,e.version),nodeEngine:resolveVersionToken(`evePackage.nodeEngine`,e.nodeEngine)}}function modelProviderSlug(e){let t=(e.split(`/`)[0]??``).replaceAll(/[^A-Za-z0-9._-]/gu,``);return t.length>0?t:`anthropic`}function byokProviderEnvVar(e){let t=modelProviderSlug(e).toUpperCase().replaceAll(/[^A-Z0-9]/gu,`_`);return`${/^[0-9]/.test(t)?`_`:``}${t}_API_KEY`}function agentTemplateFiles(e,t){return{"agent/agent.ts":renderAgentTemplate(e,t),"agent/channels/eve.ts":WEB_APP_TEMPLATE_FILES[`agent/channels/eve.ts`],"agent/instructions.md":AGENT_INSTRUCTIONS_TEMPLATE}}function renderAgentTemplate(e,t){let n=parseChatGptModelSelection(e);return n===void 0?BASE_AGENT_TEMPLATE.replaceAll(`__EVE_INIT_MODEL__`,e).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t)):`import { defineAgent } from "eve";\nimport { chatgpt } from "eve/models/openai";\n\nexport default defineAgent({\n  model: chatgpt(${JSON.stringify(n)}),\n${reasoningTemplateLine(t)}});\n`}function reasoningTemplateLine(e){return e===void 0||e===`provider-default`?``:`  reasoning: "${e}",\n`}function renderTemplate(e,t){return e===BASE_AGENT_TEMPLATE&&parseChatGptModelSelection(t.model)!==void 0?renderAgentTemplate(t.model,t.reasoning):e.replaceAll(`__EVE_INIT_APP_NAME__`,t.appName).replaceAll(`__EVE_INIT_MODEL__`,t.model).replaceAll(`__EVE_INIT_REASONING__`,reasoningTemplateLine(t.reasoning)).replaceAll(`__EVE_INIT_BYOK_PROVIDER__`,modelProviderSlug(t.model)).replaceAll(`__EVE_INIT_BYOK_ENV_VAR__`,byokProviderEnvVar(t.model)).replaceAll(`__EVE_INIT_PACKAGE_VERSION__`,formatEveDependencySpecifier(t.eveVersion)).replaceAll(`__EVE_INIT_AI_SDK_VERSION__`,t.aiPackageVersion).replaceAll(`__EVE_INIT_CONNECT_VERSION__`,t.connectPackageVersion).replaceAll(`__EVE_INIT_ZOD_VERSION__`,t.zodPackageVersion).replaceAll(`__EVE_INIT_TYPESCRIPT_VERSION__`,t.typescriptPackageVersion).replaceAll(`__EVE_INIT_TYPES_NODE_VERSION__`,t.nodeTypesVersion).replaceAll(`__EVE_INIT_NODE_ENGINE__`,t.nodeEngine)}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}const BASE_AGENT_TEMPLATE=`import { defineAgent } from "eve";
 
 export default defineAgent({
   model: "__EVE_INIT_MODEL__",

package/dist/src/shared/agent-definition.d.ts

@@ -298,6 +298,7 @@ export type InternalAgentDefinition = {
     outputSchema?: JsonObject;
     reasoning?: AgentReasoningDefinition;
     source?: ModuleSourceRef;
+    tool?: boolean;
     limits?: AgentLimitsDefinition;
 };
 /**
@@ -336,6 +337,14 @@ type PublicAgentDefinitionBase = {
      * Framework-owned runtime limits for this agent's runs.
      */
     readonly limits?: AgentLimitsDefinition;
+    /**
+     * Whether eve exposes this agent to its parent model as a tool. On the root
+     * agent, this controls the built-in `agent` tool. Defaults to `true`.
+     *
+     * A subagent with this set to `false` remains callable through `ctx.agent()`
+     * in workflow tools.
+     */
+    readonly tool?: boolean;
     /**
      * Optional structured return type used when this agent runs in task mode
      * (for example as a subagent, schedule, or remote job). Interactive

package/dist/src/tools/approval/policies.d.ts

@@ -1,4 +1,22 @@
+import type { Experimental_EvaluationModel as EvaluationModel } from "ai";
 import type { ApprovalPolicy } from "#approval/definition.js";
+export interface AutoApprovalOptions {
+    /** Evaluation model instance or ID. Defaults to TypeSafe Jev. */
+    readonly model?: EvaluationModel;
+    /** Instructions used to classify the exact tool call. */
+    readonly instructions?: string;
+    /** Descriptions of the fixed approval outcomes. */
+    readonly criteria?: {
+        readonly clear?: string;
+        readonly caution?: string;
+    };
+}
+/**
+ * Returns an `approval` callback that asks an AI SDK evaluation model whether
+ * the exact tool call presents concrete security danger. Defaults to TypeSafe Jev.
+ * Unavailable or invalid evaluations require user approval.
+ */
+export declare function auto<TInput = unknown>(options?: AutoApprovalOptions): ApprovalPolicy<TInput>;
 /**
  * Returns an `approval` callback that always requires user approval before
  * the tool executes.

package/dist/src/tools/approval/policies.js

@@ -1 +1 @@
-import{stampDurableDynamicCallback}from"#tools/durable-callbacks.js";function alwaysApproval(e){return`user-approval`}function neverApproval(e){return`not-applicable`}function onceApproval(e,t){return t.approvedTools.has(t.toolName)?`not-applicable`:`user-approval`}function always(){return stampDurableDynamicCallback(()=>`user-approval`,{callback:alwaysApproval,closure:{}})}function never(){return stampDurableDynamicCallback(()=>`not-applicable`,{callback:neverApproval,closure:{}})}function once(){return stampDurableDynamicCallback(({approvedTools:e,toolName:t})=>e.has(t)?`not-applicable`:`user-approval`,{callback:onceApproval,closure:{}})}export{always,never,once};
+import{parseJsonValue}from"#shared/json.js";import{stampDurableDynamicCallback}from"#tools/durable-callbacks.js";import{evaluate}from"#experimental/evaluate/evaluate.js";async function autoApproval(e,t,n){try{let r=parseJsonValue(n.toolInput??null),i=JSON.stringify(r);if(new TextEncoder().encode(i).byteLength>65536)return`user-approval`;let a=AbortSignal.any([n.abortSignal,AbortSignal.timeout(3e4)]);return(await evaluate({model:e,state:{action:{input:r,tool:n.toolName}},questions:{permission:{type:`choice`,instructions:t.instructions??`Review the exact tool action for dangerous effects. Return caution when it could cause meaningful harm, including destructive data loss, credential exposure, financial transactions, deployments or public changes, external communication, privilege or system changes, or concealed execution. Return clear for routine, low-impact actions. Judge the action's actual effects from its name and input. If important effects are unclear, return caution.`,criteria:{clear:t.criteria?.clear??`The action is routine and low impact.`,caution:t.criteria?.caution??`The action is dangerous or its important effects are unclear.`}}},abortSignal:a,maxRetries:0})).answers.permission.choice===`clear`?`approved`:`user-approval`}catch{return n.abortSignal.throwIfAborted(),`user-approval`}}function alwaysApproval(e){return`user-approval`}function neverApproval(e){return`not-applicable`}function onceApproval(e,t){return t.approvedTools.has(t.toolName)?`not-applicable`:`user-approval`}function auto(e={}){let t=e.model??`typesafe-ai/jev`;return stampDurableDynamicCallback(n=>autoApproval(t,e,n),{callback:(n,r)=>autoApproval(t,e,r),closure:{}})}function always(){return stampDurableDynamicCallback(()=>`user-approval`,{callback:alwaysApproval,closure:{}})}function never(){return stampDurableDynamicCallback(()=>`not-applicable`,{callback:neverApproval,closure:{}})}function once(){return stampDurableDynamicCallback(({approvedTools:e,toolName:t})=>e.has(t)?`not-applicable`:`user-approval`,{callback:onceApproval,closure:{}})}export{always,auto,never,once};

package/dist/src/tools/definition.d.ts

@@ -257,14 +257,15 @@ export declare function stampToolDefinition<T extends {
 declare const DISABLED_TOOL_SENTINEL_KIND = "eve:disabled-tool";
 /**
  * Marker value returned from {@link disableTool}. Export this as the default
- * export of a file in `agent/tools/` to remove the framework default whose
- * name matches the file's slug.
+ * export of a file in `agent/tools/` to remove the model tool whose name
+ * matches the file's slug, including framework defaults and derived subagent
+ * tools.
  */
 export interface DisabledToolSentinel {
     readonly kind: typeof DISABLED_TOOL_SENTINEL_KIND;
 }
 /**
- * Returns a sentinel that disables the framework tool whose name matches the
+ * Returns a sentinel that disables the model tool whose name matches the
  * containing file's slug.
  */
 export declare function disableTool(): DisabledToolSentinel;

package/docs/agent-config.md

@@ -336,6 +336,7 @@ it falls back to the World's default retention period.
 | `experimental` | `AgentExperimentalDefinition`           | unset            | Unstable opt-ins. `workflow.world` selects the Workflow world package on the root agent; `workflow.modelCallsPerStep` batches sequential model calls into a wider replay unit; `workflow.retention` controls how long the durable runtime keeps run data. |
 | `outputSchema` | Standard Schema or a JSON Schema object | none             | Structured return type for function-like invocations such as a subagent turn, schedule, or remote job. Ordinary interactive turns ignore it unless the client supplies a per-message schema.                                                              |
 | `build`        | `{ externalDependencies?: string[] }`   | none             | Hosted-build packaging controls. `externalDependencies` keeps listed packages external while eve compiles authored modules such as tools and channels, and traces those packages into the hosted output.                                                  |
+| `tool`         | `boolean`                               | `true`           | Exposes this agent to its parent model as a tool. On the root agent, controls the built-in `agent` tool. A subagent with `tool: false` remains callable from authored workflow tools through `ctx.agent()`.                                               |
 
 `externalDependencies` is a packaging control only. It keeps selected packages as runtime dependencies in the hosted output; it does not authorize, configure, or review any third-party service those packages may call.
 

package/docs/connections/mcp.mdx

@@ -100,11 +100,11 @@ Prefer `allow` for the smallest safe surface, especially when the server exposes
 
 ## Approval gates
 
-Use the shared `approval` option to gate every tool served by an MCP connection. The [connections overview](../connections#per-connection-approval) defines the `never()`, `once()`, and `always()` helpers; [Human-in-the-loop](../human-in-the-loop#approvals) defines the pause-and-resume contract.
+Use the shared `approval` option to gate every tool served by an MCP connection. The [connections overview](../connections#per-connection-approval) defines the `never()`, `once()`, `always()`, and `auto()` helpers; [Human-in-the-loop](../human-in-the-loop#approvals) defines the pause-and-resume contract.
 
 ### Gate specific tools by name or input
 
-A remote MCP server usually mixes read tools with destructive or publishing ones, so a blanket `always()` would prompt on every harmless call. Pass a custom policy instead — the same [`Approval`](/docs/human-in-the-loop#approvals) shape authored tools use — to gate only the calls that matter. The policy receives `{ session, toolName, toolInput, approvedTools }` and returns an approval status, synchronously or as a promise.
+A remote MCP server usually mixes read tools with destructive or publishing ones, so a blanket `always()` would prompt on every harmless call. Pass a custom policy instead — the same [`Approval`](/docs/human-in-the-loop#approvals) shape authored tools use — to gate only the calls that matter. The policy receives `{ session, toolName, toolInput, approvedTools, callId, abortSignal }` and returns an approval status, synchronously or as a promise.
 
 This connection always gates deletes, gates a publish only when the call actually schedules a post, and lets everything else through:
 

package/docs/connections/overview.mdx

@@ -172,7 +172,7 @@ export default defineMcpClientConnection({
 });
 ```
 
-`never()` lets every call through, `once()` asks for approval the first time in a session, and `always()` asks every time. The pause and resume is the same human-in-the-loop flow covered in [Tools](/docs/tools).
+`never()` lets every call through, `once()` asks for approval the first time in a session, `always()` asks every time, and `auto()` uses an evaluation model to allow routine calls and ask about dangerous or unclear effects. The pause and resume is the same human-in-the-loop flow covered in [Tools](/docs/tools).
 
 For connection tools that can create, modify, delete, transmit, purchase, message, or access sensitive data, use approval, allow-lists, or other safeguards appropriate to the action.
 

package/docs/guides/evaluate.md

@@ -152,6 +152,31 @@ You can also call `evaluate` outside a tool; it does not require an active eve
 session. Each call performs its own evaluation. `autoModel` uses this function
 and adds the per-turn routing behavior described below.
 
+## Evaluate tool approvals
+
+Use `auto({ model? })` when an evaluation model should decide whether a
+tool call can run automatically or needs human approval. It accepts the same
+AI SDK evaluation model strings and provider instances described above and
+defaults to `typesafe-ai/jev`:
+
+```ts title="agent/tools/deploy.ts"
+import { defineTool } from "eve/tools";
+import { auto } from "eve/tools/approval";
+import { z } from "zod";
+
+export default defineTool({
+  description: "Deploy an application.",
+  inputSchema: z.object({ environment: z.string() }),
+  approval: auto({ model: "typesafe-ai/jev" }), // Uses AI SDK string-model resolution
+  execute: ({ environment }) => deploy(environment),
+});
+```
+
+The evaluation model reviews the tool name and input for dangerous effects. A
+caution, failed review, or incomplete input requires human approval. See
+[Human-in-the-loop approvals](/docs/human-in-the-loop#approvals) for classifier
+options and data handling.
+
 ## Runtime behavior
 
 `autoModel` evaluates at the first `step.started` event, after the incoming prompt

package/docs/guides/remote-agents.md

@@ -29,6 +29,7 @@ export default defineRemoteAgent({
 | `headers`          | `HeadersValue`                                | No       | none              | Static or lazily resolved request headers.                                                                                                               |
 | `path`             | `string`                                      | No       | `/eve/v1/session` | Route appended to `url` for the create-session request.                                                                                                  |
 | `outputSchema`     | `StandardSchema \| JSON Schema`               | No       | none              | Structured return type for the first turn of each fresh remote session. A continuation may provide its own per-call schema.                              |
+| `tool`             | `boolean`                                     | No       | `true`            | Expose the remote agent as a tool to the parent model. Set `false` to allow only `ctx.agent()` calls from authored workflow tools.                       |
 
 ## Dynamic remote agents
 
@@ -80,7 +81,7 @@ The function may be async and must return a non-empty string. `auth` and `header
 
 ## Calling a remote agent
 
-To the model, a remote agent is another subagent tool. You call it the same way you call a local subagent, with a `message` and an optional `outputSchema`. The message must carry the full task, including any context the remote agent needs, because it never receives the parent's conversation history.
+By default, a remote agent is another subagent tool to the model. The model calls it the same way it calls a local subagent, with a `message` and an optional `outputSchema`. Set `tool: false` when an authored workflow tool should be the only model-facing routing surface; the workflow can still call the remote agent by its path-derived name through `ctx.agent()`. The message must carry the full task, including any context the remote agent needs, because it never receives the parent's conversation history.
 
 To require structured output, set an `outputSchema` on the agent definition for fresh delegations or on an individual call for that turn. The structured value arrives in the task's completion notification, and the remote child remains available for follow-up messages. See [Subagents](../subagents) for continuation behavior.
 

package/docs/reference/typescript-api.md

@@ -115,7 +115,7 @@ import template from "../../prompts/template.txt?raw";
 | `eve`                                                                       | `defineAgent`, `defineRemoteAgent`, `defineDynamic`, agent config types                                                        |
 | `eve/tools`                                                                 | `defineTool`, `defineWorkflowTool`, `defineDurableCallback`, `defineDurableSchema`, `defineDynamic`, `disableTool`, tool types |
 | `eve/tools/{bash,read_file,write_file,todo,web_fetch,load_skill,glob,grep}` | Individual reusable tool definitions                                                                                           |
-| `eve/tools/approval`                                                        | Approval types and `always`, `once`, `never`                                                                                   |
+| `eve/tools/approval`                                                        | Approval types and `auto`, `always`, `once`, `never`                                                                           |
 | `eve/tools/web_search`                                                      | Provider-managed `webSearch` configuration                                                                                     |
 | `eve/tools/workflow`                                                        | Runtime-generated `workflow` tool factory                                                                                      |
 | `eve/tools/sleep`                                                           | Opt-in durable `sleep` tool                                                                                                    |

package/docs/subagents/index.mdx

@@ -38,15 +38,18 @@ The copy uses the root's instructions, connections, auth, and sandbox. It receiv
 
 The parent transfers data to the child through the `message` input it gives the subagent. Do not include sensitive data in a subagent request unless that child and its inherited tools, connections, sandbox, and telemetry path are appropriate for that data.
 
-To prevent the root session from delegating to a fresh copy of itself, disable `agent` the same way as any other built-in tool:
+To prevent the root session from delegating to a fresh copy of itself, set `tool: false` on the root agent:
 
-```ts title="agent/tools/agent.ts"
-import { disableTool } from "eve/tools";
+```ts title="agent/agent.ts"
+import { defineAgent } from "eve";
 
-export default disableTool();
+export default defineAgent({
+  model: "anthropic/claude-opus-4.8",
+  tool: false,
+});
 ```
 
-An authored root tool at `agent/tools/agent.ts` takes priority over the built-in.
+You can also export `disableTool()` from `agent/tools/agent.ts`. An authored root tool at that path takes priority over `tool: false` and the built-in.
 
 ## Declared subagents
 
@@ -61,7 +64,21 @@ export default defineAgent({
 });
 ```
 
-`description` is required. The parent reads it to decide whether to delegate, so the compiler rejects any subagent whose `agent.ts` leaves it out. Every declared local or remote subagent runs as a durable background task: the call returns `{ status: "working", taskId, agentId }` immediately, then task notifications wake the parent with completion, failure, or cancellation. Human input requests surface separately on the parent session.
+`description` is required. The parent reads it to decide whether to delegate, so the compiler rejects any subagent whose `agent.ts` leaves it out. Set `tool: false` to keep the subagent out of the parent model's tools while allowing an authored [workflow tool](/docs/tools/workflows) to call it by name through `ctx.agent()`:
+
+```ts title="agent/subagents/researcher/agent.ts"
+import { defineAgent } from "eve";
+
+export default defineAgent({
+  description: "Investigate ambiguous questions for the routing workflow.",
+  model: "anthropic/claude-opus-4.8",
+  tool: false,
+});
+```
+
+The parent can alternatively export `disableTool()` from a same-named tool path, such as `agent/tools/researcher.ts`. This suppresses the derived model tool without removing `researcher` from the workflow invocation registry. A same-named authored tool replaces the model-facing surface while the workflow can still call the underlying subagent with `ctx.agent("researcher", ...)`.
+
+Every declared local or remote subagent runs as a durable background task: the call returns `{ status: "working", taskId, agentId }` immediately, then task notifications wake the parent with completion, failure, or cancellation. Human input requests surface separately on the parent session.
 
 `task_cancel` is available to sessions that own background tasks, including a child that starts nested background work.
 
@@ -195,7 +212,7 @@ The root built-in `agent` tool is the exception. Its children share the root's s
 
 ## What the parent sees
 
-eve lowers every subagent visible to the current agent (the root built-in copy, declared, or [remote](./guides/remote-agents)) into a model-visible tool with the same `{ message, agentId?, outputSchema? }` shape. The parent packs `message` with everything the child needs, since the child never sees the parent's history. Set `outputSchema` to require structured output for that turn; the child remains available for follow-up messages afterward.
+eve lowers every tool-enabled subagent visible to the current agent (the root built-in copy, declared, or [remote](./guides/remote-agents)) into a model-visible tool with the same `{ message, agentId?, outputSchema? }` shape. The parent packs `message` with everything the child needs, since the child never sees the parent's history. Set `outputSchema` to require structured output for that turn; the child remains available for follow-up messages afterward.
 
 Declared subagents can call nested subagents defined under their own directories. eve does not apply a separate depth limit; nesting ends where the authored directory tree ends. The built-in `agent` follows the stricter root-only rule above, so `limits.maxSubagentDepth` no longer exists.
 
@@ -211,7 +228,7 @@ A directly declared subagent's tool name is the bare path-derived name, with no
 }
 ```
 
-Because the name lives in the same runtime tool namespace as authored tools, a subagent named `researcher` collides with a tool named `researcher`. eve rejects static collisions at build time and active dynamic collisions at runtime rather than picking a winner, so keep subagent directory names distinct from tool names.
+By default, a subagent named `researcher` collides with an authored tool named `researcher`. Set the subagent's `tool` to `false` when the authored tool intentionally wraps that subagent; the authored tool becomes the model-facing capability while `ctx.agent("researcher", ...)` continues to address the child. A same-named `disableTool()` removes the model-facing capability entirely. Other static and active dynamic collisions remain errors.
 
 Do not rely on subagent delegation by itself as an approval boundary. Put sensitive tools behind `approval`, connection approval, route/session authorization, or other controls wherever those tools can be called.
 

package/docs/tools/human-in-the-loop.md

@@ -6,24 +6,24 @@ url: /human-in-the-loop
 
 Human-in-the-loop (HITL) is any point where the agent durably pauses and waits for a person. Two things trigger it, and both ride the same pause-and-resume protocol:
 
-- **Approvals** — a tool requires a person to sign off before (or instead of) running. The agent decides to call the tool; a human decides whether it does.
+- **Approvals** — a tool policy allows, denies, or pauses a call for a person to review. The agent decides to call the tool; the policy decides whether it runs automatically or needs a human decision.
 - **Questions** — the agent itself asks the user a clarifying question or a choice mid-turn, and parks until they answer.
 
 Either way the run parks at `session.waiting`, durably, for as long as it takes — seconds or days — and picks back up exactly where it left off once the answer arrives. Channels render the request for you.
 
 ## Approvals
 
-Approval is a property of a [tool](/docs/tools) that pauses for a person before it runs. Gate a tool with `approval` and the helpers from `eve/tools/approval`:
+Approval is a property of a [tool](/docs/tools) that gates it before it runs. The policy can decide automatically or pause for a person. Set `approval` with the helpers from `eve/tools/approval`:
 
 ```ts title="agent/tools/refund_charge.ts"
 import { defineTool } from "eve/tools";
-import { always } from "eve/tools/approval";
+import { auto } from "eve/tools/approval";
 import { z } from "zod";
 
 export default defineTool({
   description: "Refund a charge.",
   inputSchema: z.object({ tenantId: z.string(), chargeId: z.string(), amount: z.number() }),
-  approval: always(), // or once() / never() / a policy
+  approval: auto(), // or always() / once() / never() / a policy
   async execute(input) {
     return refund(input);
   },
@@ -35,12 +35,34 @@ export default defineTool({
 | `never()`  | Never require approval (the default when omitted).                                 |
 | `once()`   | Require approval only the first time the tool runs in a session; auto-allow after. |
 | `always()` | Require approval before every call.                                                |
+| `auto()`   | Ask an evaluation model whether to run the exact call or require user approval.    |
 
 By default, omitted `approval` behaves like `never()`, so tool calls may execute without human approval. Require human approval or other safeguards for sensitive, irreversible, regulated, financial, healthcare, employment, housing, legal, safety-impacting, user-impacting, or external side-effecting actions.
 
+`auto()` uses an [AI SDK evaluation model](/docs/guides/evaluate) to classify each call as `clear` or `caution`. It defaults to `typesafe-ai/jev`. Like `evaluate`, a model string uses Vercel AI Gateway unless the application configures a global AI SDK default provider:
+
+```ts
+approval: auto({ model: "typesafe-ai/jev" });
+```
+
+The evaluation model reviews the tool name and input for dangerous effects. A caution, failed review, or incomplete input requires user approval. The tool input is sent to the evaluation model's provider.
+
+Override the classifier text for application-specific policy:
+
+```ts
+approval: auto({
+  model: "typesafe-ai/jev",
+  instructions: "Review whether this refund needs finance approval.",
+  criteria: {
+    clear: "The refund can proceed automatically.",
+    caution: "A person must review the refund.",
+  },
+});
+```
+
 A reusable approval grant applies only after every matching request that is already pending has been resolved. If several calls to a `once()`-gated tool have each produced an approval prompt, approving one does not authorize the others; each visible prompt remains an independent decision. After those pending requests are resolved, later calls in the session are allowed automatically.
 
-When the decision depends on the input, pass your own policy instead of a helper. It receives the same session context as tool execution, plus `{ toolName, toolInput, approvedTools, callId }`, and returns an AI SDK 7 approval status synchronously or as a promise. Use `ctx.session.auth.current` to guard by the caller of the current turn and `ctx.session.auth.initiator` to guard by the caller that created the session. Return `"user-approval"` to pause for a person or `"not-applicable"` to continue without a prompt. `toolInput` can be undefined, so guard the access. This policy denies cross-tenant calls, then requires approval only when an amount crosses a threshold:
+When the decision depends on the input, pass your own policy instead of a helper. It receives the same session context as tool execution, plus `{ toolName, toolInput, approvedTools, callId, abortSignal }`, and returns an AI SDK 7 approval status synchronously or as a promise. Use `abortSignal` for asynchronous policy work so cancellation stops it with the turn. Use `ctx.session.auth.current` to guard by the caller of the current turn and `ctx.session.auth.initiator` to guard by the caller that created the session. Return `"user-approval"` to pause for a person or `"not-applicable"` to continue without a prompt. `toolInput` can be undefined, so guard the access. This policy denies cross-tenant calls, then requires approval only when an amount crosses a threshold:
 
 ```ts
 approval: ({ session, toolInput }) => {

package/docs/tools/overview.mdx

@@ -212,14 +212,14 @@ import { z } from "zod";
 export default defineTool({
   description: "Refund a charge.",
   inputSchema: z.object({ chargeId: z.string(), amount: z.number() }),
-  approval: always(), // or once() / never() / a policy
+  approval: always(), // or auto() / once() / never() / a policy
   async execute(input) {
     return refund(input);
   },
 });
 ```
 
-Approval is one half of eve's [human-in-the-loop](./human-in-the-loop) model — the page covers the `always/once/never` helpers, input-dependent policies, and how a gated call pauses and resumes durably.
+Approval is one half of eve's [human-in-the-loop](./human-in-the-loop) model — the page covers the `auto`/`always`/`once`/`never` helpers, input-dependent policies, and how a gated call pauses and resumes durably.
 
 ## Shape what the model sees with `toModelOutput`
 

package/docs/tools/workflows.mdx

@@ -111,7 +111,7 @@ export default workflow({ maxSubagents: 20 });
 ```
 
 The model supplies an async function body through the tool's `js` input. Its only host capability is
-`ctx.agent(name, { message, agentId?, outputSchema? })`. For example:
+`ctx.agent(name, { message, agentId?, outputSchema? })`. This can invoke subagents configured with `tool: false` or hidden by a same-named `disableTool()` file. Include those path-derived names in the workflow tool description or agent instructions when the model writes the program. For example:
 
 ```js
 const [triage, review] = await Promise.all([
@@ -317,8 +317,7 @@ const result = await ctx.agent("reviewer", {
 });
 ```
 
-The first argument is the model-visible subagent name. eve assigns each call a replay-stable
-invocation identity, including repeated and parallel calls to the same subagent. Pass `agentId` to
+The first argument is the subagent's path-derived name. It can identify a model-visible subagent or one hidden with `tool: false` or `disableTool()`. eve assigns each call a replay-stable invocation identity, including repeated and parallel calls to the same subagent. Pass `agentId` to
 continue an existing child. An inline `outputSchema` requires structured output and determines the
 return type, so `result` in the example is typed as `{ findings: string[] }`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.59.0",
+  "version": "0.59.1",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [