eve 0.59.0 → 0.60.0

package/docs/guides/instrumentation/otel.mdx

@@ -100,52 +100,56 @@ export default disableInstrumentation();
 
 ## Filter a managed destination
 
-`localTraces()` and `agentRuns()` accept an `exportPolicy`. It filters spans
-and attributes before that destination's processors receive them:
+`localTraces()` and `agentRuns()` accept one `exportPolicy` object or an array
+applied in order. Each policy filters spans and attributes before that
+destination's processors receive them:
 
 ```ts title="agent/instrumentation/agent-runs.ts"
 import { agentRuns } from "eve/instrumentation/otel";
 
 export default agentRuns({
   exportPolicy: {
-    span: ({ name }) => name !== "internal.cache.refresh",
-    attribute: ({ key }) => (key === "customer.id" ? { action: "drop" } : { action: "keep" }),
+    span: ({ name }) => ({ emit: name !== "internal.cache.refresh" }),
+    attribute: ({ key }) => (key === "customer.id" ? { emit: false } : { emit: true }),
   },
 });
 ```
 
-Return `false` from `span` to omit that span from this destination. Return
-`{ action: "keep" }`, `{ action: "drop" }`, or
-`{ action: "replace", value }` from `attribute` to retain, remove, or change
+Return `{ emit: true }` from `span` to retain a span unchanged, or
+`{ emit: false }` to omit it from this destination. To retain the span while
+redacting content, return `{ redact: true }` with `inputs: true`,
+`outputs: true`, or both. A redaction decision implies emission and requires
+at least one direction. For example, return
+`{ redact: true, inputs: true, outputs: true }` to redact both directions.
+A throwing `span` callback drops the span from this destination. Return
+`{ emit: true }`, `{ emit: false }`, or
+`{ replace: true, value }` from `attribute` to retain, remove, or change
 one attribute.
 
 ### Further narrow a built-in destination
 
-Use the content redactors to further narrow what a built-in destination
+Return a redaction decision to further narrow what a built-in destination
 receives after the process-wide `otel({ tracePolicy })` has admitted a trace.
 For example, keep the spans in Agent Runs while redacting their inputs and
 outputs unless the session is public:
 
 ```ts title="agent/instrumentation/agent-runs.ts"
-import {
-  agentRuns,
-  composeSpanExportPolicies,
-  redactSpanInputs,
-  redactSpanOutputs,
-} from "eve/instrumentation/otel";
+import { agentRuns } from "eve/instrumentation/otel";
 
 export default agentRuns({
-  exportPolicy: composeSpanExportPolicies(
-    redactSpanInputs(({ audience }) => audience !== "public"),
-    redactSpanOutputs(({ audience }) => audience !== "public"),
-  ),
+  exportPolicy: {
+    span: ({ audience }) =>
+      audience === "public" ? { emit: true } : { redact: true, inputs: true, outputs: true },
+  },
 });
 ```
 
-`redactSpanInputs()` removes eve's known prompt, instruction, document, and
-tool-argument attributes. `redactSpanOutputs()` removes response, reasoning,
-tool-result, exception, and status attributes. They narrow only this
-destination; they do not mutate spans sent to another destination.
+Input redaction removes eve's known prompt, instruction, document, and
+tool-argument attributes. Output redaction removes response, reasoning,
+tool-result, exception, and status attributes. Redaction narrows only this
+destination; it does not mutate spans sent to another destination. Policies run
+in array order, and each policy receives the facade produced by the policies
+before it.
 
 ## What to read next
 

package/docs/guides/remote-agents.md

@@ -29,6 +29,7 @@ export default defineRemoteAgent({
 | `headers`          | `HeadersValue`                                | No       | none              | Static or lazily resolved request headers.                                                                                                               |
 | `path`             | `string`                                      | No       | `/eve/v1/session` | Route appended to `url` for the create-session request.                                                                                                  |
 | `outputSchema`     | `StandardSchema \| JSON Schema`               | No       | none              | Structured return type for the first turn of each fresh remote session. A continuation may provide its own per-call schema.                              |
+| `tool`             | `boolean`                                     | No       | `true`            | Expose the remote agent as a tool to the parent model. Set `false` to allow only `ctx.agent()` calls from authored workflow tools.                       |
 
 ## Dynamic remote agents
 
@@ -80,7 +81,7 @@ The function may be async and must return a non-empty string. `auth` and `header
 
 ## Calling a remote agent
 
-To the model, a remote agent is another subagent tool. You call it the same way you call a local subagent, with a `message` and an optional `outputSchema`. The message must carry the full task, including any context the remote agent needs, because it never receives the parent's conversation history.
+By default, a remote agent is another subagent tool to the model. The model calls it the same way it calls a local subagent, with a `message` and an optional `outputSchema`. Set `tool: false` when an authored workflow tool should be the only model-facing routing surface; the workflow can still call the remote agent by its path-derived name through `ctx.agent()`. The message must carry the full task, including any context the remote agent needs, because it never receives the parent's conversation history.
 
 To require structured output, set an `outputSchema` on the agent definition for fresh delegations or on an individual call for that turn. The structured value arrives in the task's completion notification, and the remote child remains available for follow-up messages. See [Subagents](../subagents) for continuation behavior.
 

package/docs/reference/typescript-api.md

@@ -115,7 +115,7 @@ import template from "../../prompts/template.txt?raw";
 | `eve`                                                                       | `defineAgent`, `defineRemoteAgent`, `defineDynamic`, agent config types                                                        |
 | `eve/tools`                                                                 | `defineTool`, `defineWorkflowTool`, `defineDurableCallback`, `defineDurableSchema`, `defineDynamic`, `disableTool`, tool types |
 | `eve/tools/{bash,read_file,write_file,todo,web_fetch,load_skill,glob,grep}` | Individual reusable tool definitions                                                                                           |
-| `eve/tools/approval`                                                        | Approval types and `always`, `once`, `never`                                                                                   |
+| `eve/tools/approval`                                                        | Approval types and `auto`, `always`, `once`, `never`                                                                           |
 | `eve/tools/web_search`                                                      | Provider-managed `webSearch` configuration                                                                                     |
 | `eve/tools/workflow`                                                        | Runtime-generated `workflow` tool factory                                                                                      |
 | `eve/tools/sleep`                                                           | Opt-in durable `sleep` tool                                                                                                    |
@@ -136,9 +136,10 @@ import template from "../../prompts/template.txt?raw";
 | `eve/sandbox`                                                               | `defineSandbox`, backends                                                                                                      |
 | `eve/instrumentation`                                                       | `defineInstrumentation`, `isChannel`                                                                                           |
 | `eve/local-dev`                                                             | `getLocalDevCapability`, `LocalDevCapability`                                                                                  |
+| [`eve/models`](../guides/evaluate)                                          | Automatic model selection with `auto`                                                                                          |
 | `eve/models/openai`                                                         | `openai`, `chatgpt`, deprecated `experimental_chatgpt`                                                                         |
 | `eve/models/anthropic`                                                      | `anthropic`                                                                                                                    |
-| [`eve/experimental/evaluate`](../guides/evaluate)                           | Experimental `autoModel` and standalone `evaluate`                                                                             |
+| [`eve/ai`](../guides/evaluate#evaluate-inside-a-tool)                       | Standalone `evaluate`                                                                                                          |
 | `eve/evals`                                                                 | `defineEval`, `defineEvalConfig`, `mockModel`, eval types                                                                      |
 | `eve/evals/expect`                                                          | `includes`, `equals`, `matches`, `similarity`                                                                                  |
 | `eve/evals/reporters`                                                       | `Braintrust`, `JUnit`, `EvalReporter`                                                                                          |

package/docs/subagents/index.mdx

@@ -38,15 +38,18 @@ The copy uses the root's instructions, connections, auth, and sandbox. It receiv
 
 The parent transfers data to the child through the `message` input it gives the subagent. Do not include sensitive data in a subagent request unless that child and its inherited tools, connections, sandbox, and telemetry path are appropriate for that data.
 
-To prevent the root session from delegating to a fresh copy of itself, disable `agent` the same way as any other built-in tool:
+To prevent the root session from delegating to a fresh copy of itself, set `tool: false` on the root agent:
 
-```ts title="agent/tools/agent.ts"
-import { disableTool } from "eve/tools";
+```ts title="agent/agent.ts"
+import { defineAgent } from "eve";
 
-export default disableTool();
+export default defineAgent({
+  model: "anthropic/claude-opus-4.8",
+  tool: false,
+});
 ```
 
-An authored root tool at `agent/tools/agent.ts` takes priority over the built-in.
+You can also export `disableTool()` from `agent/tools/agent.ts`. An authored root tool at that path takes priority over `tool: false` and the built-in.
 
 ## Declared subagents
 
@@ -61,7 +64,21 @@ export default defineAgent({
 });
 ```
 
-`description` is required. The parent reads it to decide whether to delegate, so the compiler rejects any subagent whose `agent.ts` leaves it out. Every declared local or remote subagent runs as a durable background task: the call returns `{ status: "working", taskId, agentId }` immediately, then task notifications wake the parent with completion, failure, or cancellation. Human input requests surface separately on the parent session.
+`description` is required. The parent reads it to decide whether to delegate, so the compiler rejects any subagent whose `agent.ts` leaves it out. Set `tool: false` to keep the subagent out of the parent model's tools while allowing an authored [workflow tool](/docs/tools/workflows) to call it by name through `ctx.agent()`:
+
+```ts title="agent/subagents/researcher/agent.ts"
+import { defineAgent } from "eve";
+
+export default defineAgent({
+  description: "Investigate ambiguous questions for the routing workflow.",
+  model: "anthropic/claude-opus-4.8",
+  tool: false,
+});
+```
+
+The parent can alternatively export `disableTool()` from a same-named tool path, such as `agent/tools/researcher.ts`. This suppresses the derived model tool without removing `researcher` from the workflow invocation registry. A same-named authored tool replaces the model-facing surface while the workflow can still call the underlying subagent with `ctx.agent("researcher", ...)`.
+
+Every declared local or remote subagent runs as a durable background task: the call returns `{ status: "working", taskId, agentId }` immediately, then task notifications wake the parent with completion, failure, or cancellation. Human input requests surface separately on the parent session.
 
 `task_cancel` is available to sessions that own background tasks, including a child that starts nested background work.
 
@@ -195,7 +212,7 @@ The root built-in `agent` tool is the exception. Its children share the root's s
 
 ## What the parent sees
 
-eve lowers every subagent visible to the current agent (the root built-in copy, declared, or [remote](./guides/remote-agents)) into a model-visible tool with the same `{ message, agentId?, outputSchema? }` shape. The parent packs `message` with everything the child needs, since the child never sees the parent's history. Set `outputSchema` to require structured output for that turn; the child remains available for follow-up messages afterward.
+eve lowers every tool-enabled subagent visible to the current agent (the root built-in copy, declared, or [remote](./guides/remote-agents)) into a model-visible tool with the same `{ message, agentId?, outputSchema? }` shape. The parent packs `message` with everything the child needs, since the child never sees the parent's history. Set `outputSchema` to require structured output for that turn; the child remains available for follow-up messages afterward.
 
 Declared subagents can call nested subagents defined under their own directories. eve does not apply a separate depth limit; nesting ends where the authored directory tree ends. The built-in `agent` follows the stricter root-only rule above, so `limits.maxSubagentDepth` no longer exists.
 
@@ -211,7 +228,7 @@ A directly declared subagent's tool name is the bare path-derived name, with no
 }
 ```
 
-Because the name lives in the same runtime tool namespace as authored tools, a subagent named `researcher` collides with a tool named `researcher`. eve rejects static collisions at build time and active dynamic collisions at runtime rather than picking a winner, so keep subagent directory names distinct from tool names.
+By default, a subagent named `researcher` collides with an authored tool named `researcher`. Set the subagent's `tool` to `false` when the authored tool intentionally wraps that subagent; the authored tool becomes the model-facing capability while `ctx.agent("researcher", ...)` continues to address the child. A same-named `disableTool()` removes the model-facing capability entirely. Other static and active dynamic collisions remain errors.
 
 Do not rely on subagent delegation by itself as an approval boundary. Put sensitive tools behind `approval`, connection approval, route/session authorization, or other controls wherever those tools can be called.
 

package/docs/tools/human-in-the-loop.md

@@ -6,24 +6,24 @@ url: /human-in-the-loop
 
 Human-in-the-loop (HITL) is any point where the agent durably pauses and waits for a person. Two things trigger it, and both ride the same pause-and-resume protocol:
 
-- **Approvals** — a tool requires a person to sign off before (or instead of) running. The agent decides to call the tool; a human decides whether it does.
+- **Approvals** — a tool policy allows, denies, or pauses a call for a person to review. The agent decides to call the tool; the policy decides whether it runs automatically or needs a human decision.
 - **Questions** — the agent itself asks the user a clarifying question or a choice mid-turn, and parks until they answer.
 
 Either way the run parks at `session.waiting`, durably, for as long as it takes — seconds or days — and picks back up exactly where it left off once the answer arrives. Channels render the request for you.
 
 ## Approvals
 
-Approval is a property of a [tool](/docs/tools) that pauses for a person before it runs. Gate a tool with `approval` and the helpers from `eve/tools/approval`:
+Approval is a property of a [tool](/docs/tools) that gates it before it runs. The policy can decide automatically or pause for a person. Set `approval` with the helpers from `eve/tools/approval`:
 
 ```ts title="agent/tools/refund_charge.ts"
 import { defineTool } from "eve/tools";
-import { always } from "eve/tools/approval";
+import { auto } from "eve/tools/approval";
 import { z } from "zod";
 
 export default defineTool({
   description: "Refund a charge.",
   inputSchema: z.object({ tenantId: z.string(), chargeId: z.string(), amount: z.number() }),
-  approval: always(), // or once() / never() / a policy
+  approval: auto(), // or always() / once() / never() / a policy
   async execute(input) {
     return refund(input);
   },
@@ -35,12 +35,34 @@ export default defineTool({
 | `never()`  | Never require approval (the default when omitted).                                 |
 | `once()`   | Require approval only the first time the tool runs in a session; auto-allow after. |
 | `always()` | Require approval before every call.                                                |
+| `auto()`   | Ask an evaluation model whether to run the exact call or require user approval.    |
 
 By default, omitted `approval` behaves like `never()`, so tool calls may execute without human approval. Require human approval or other safeguards for sensitive, irreversible, regulated, financial, healthcare, employment, housing, legal, safety-impacting, user-impacting, or external side-effecting actions.
 
+`auto()` uses an [AI SDK evaluation model](/docs/guides/evaluate) to classify each call as `clear` or `caution`. It defaults to `typesafe-ai/jev`. Like `evaluate`, a model string uses Vercel AI Gateway unless the application configures a global AI SDK default provider:
+
+```ts
+approval: auto({ model: "typesafe-ai/jev" });
+```
+
+The evaluation model reviews the tool name and input for dangerous effects. A caution, failed review, or incomplete input requires user approval. The tool input is sent to the evaluation model's provider.
+
+Override the classifier text for application-specific policy:
+
+```ts
+approval: auto({
+  model: "typesafe-ai/jev",
+  instructions: "Review whether this refund needs finance approval.",
+  criteria: {
+    clear: "The refund can proceed automatically.",
+    caution: "A person must review the refund.",
+  },
+});
+```
+
 A reusable approval grant applies only after every matching request that is already pending has been resolved. If several calls to a `once()`-gated tool have each produced an approval prompt, approving one does not authorize the others; each visible prompt remains an independent decision. After those pending requests are resolved, later calls in the session are allowed automatically.
 
-When the decision depends on the input, pass your own policy instead of a helper. It receives the same session context as tool execution, plus `{ toolName, toolInput, approvedTools, callId }`, and returns an AI SDK 7 approval status synchronously or as a promise. Use `ctx.session.auth.current` to guard by the caller of the current turn and `ctx.session.auth.initiator` to guard by the caller that created the session. Return `"user-approval"` to pause for a person or `"not-applicable"` to continue without a prompt. `toolInput` can be undefined, so guard the access. This policy denies cross-tenant calls, then requires approval only when an amount crosses a threshold:
+When the decision depends on the input, pass your own policy instead of a helper. It receives the same session context as tool execution, plus `{ toolName, toolInput, approvedTools, callId, abortSignal }`, and returns an AI SDK 7 approval status synchronously or as a promise. Use `abortSignal` for asynchronous policy work so cancellation stops it with the turn. Use `ctx.session.auth.current` to guard by the caller of the current turn and `ctx.session.auth.initiator` to guard by the caller that created the session. Return `"user-approval"` to pause for a person or `"not-applicable"` to continue without a prompt. `toolInput` can be undefined, so guard the access. This policy denies cross-tenant calls, then requires approval only when an amount crosses a threshold:
 
 ```ts
 approval: ({ session, toolInput }) => {

package/docs/tools/overview.mdx

@@ -32,6 +32,8 @@ A tool definition needs:
 
 When a tool returns structured data, add an optional `outputSchema`. With Zod or Standard Schema it also types the `execute` return.
 
+Compiled tools preserve Zod schema composition, including input and output schemas imported from helper modules. Durable replay metadata stays separate from the original schema, so adding it does not mutate shared schema objects.
+
 ### Label tool activity
 
 Use `label.start(input)` to describe a call in user-facing activity. The callback receives the validated tool input, so it can select the useful fields without exposing the full argument object:
@@ -212,14 +214,14 @@ import { z } from "zod";
 export default defineTool({
   description: "Refund a charge.",
   inputSchema: z.object({ chargeId: z.string(), amount: z.number() }),
-  approval: always(), // or once() / never() / a policy
+  approval: always(), // or auto() / once() / never() / a policy
   async execute(input) {
     return refund(input);
   },
 });
 ```
 
-Approval is one half of eve's [human-in-the-loop](./human-in-the-loop) model — the page covers the `always/once/never` helpers, input-dependent policies, and how a gated call pauses and resumes durably.
+Approval is one half of eve's [human-in-the-loop](./human-in-the-loop) model — the page covers the `auto`/`always`/`once`/`never` helpers, input-dependent policies, and how a gated call pauses and resumes durably.
 
 ## Shape what the model sees with `toModelOutput`
 

package/docs/tools/workflows.mdx

@@ -111,7 +111,7 @@ export default workflow({ maxSubagents: 20 });
 ```
 
 The model supplies an async function body through the tool's `js` input. Its only host capability is
-`ctx.agent(name, { message, agentId?, outputSchema? })`. For example:
+`ctx.agent(name, { message, agentId?, outputSchema? })`. This can invoke subagents configured with `tool: false` or hidden by a same-named `disableTool()` file. Include those path-derived names in the workflow tool description or agent instructions when the model writes the program. For example:
 
 ```js
 const [triage, review] = await Promise.all([
@@ -317,8 +317,7 @@ const result = await ctx.agent("reviewer", {
 });
 ```
 
-The first argument is the model-visible subagent name. eve assigns each call a replay-stable
-invocation identity, including repeated and parallel calls to the same subagent. Pass `agentId` to
+The first argument is the subagent's path-derived name. It can identify a model-visible subagent or one hidden with `tool: false` or `disableTool()`. eve assigns each call a replay-stable invocation identity, including repeated and parallel calls to the same subagent. Pass `agentId` to
 continue an existing child. An inline `outputSchema` requires structured output and determines the
 return type, so `result` in the example is typed as `{ findings: string[] }`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.59.0",
+  "version": "0.60.0",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [
@@ -211,6 +211,16 @@
       "eve-source": "./dist/src/public/workflow-modules.d.ts",
       "types": "./dist/src/public/workflow-modules.d.ts"
     },
+    "./ai": {
+      "types": "./dist/src/public/ai/index.d.ts",
+      "import": "./dist/src/public/ai/index.js",
+      "default": "./dist/src/public/ai/index.js"
+    },
+    "./models": {
+      "types": "./dist/src/public/models/index.d.ts",
+      "import": "./dist/src/public/models/index.js",
+      "default": "./dist/src/public/models/index.js"
+    },
     "./models/anthropic": {
       "types": "./dist/src/public/models/anthropic/index.d.ts",
       "import": "./dist/src/public/models/anthropic/index.js",
@@ -437,11 +447,6 @@
       "types": "./dist/src/self-modification/config.d.ts",
       "import": "./dist/src/self-modification/config.js",
       "default": "./dist/src/self-modification/config.js"
-    },
-    "./experimental/evaluate": {
-      "types": "./dist/src/public/experimental/evaluate/index.d.ts",
-      "import": "./dist/src/public/experimental/evaluate/index.js",
-      "default": "./dist/src/public/experimental/evaluate/index.js"
     }
   },
   "publishConfig": {