eve 0.6.0-beta.1 → 0.6.0-beta.10

package/CHANGELOG.md

@@ -1 +1,98 @@
 # eve
+
+## 0.6.0-beta.10
+
+### Minor Changes
+
+- 24c4b85: Dissolves the scaffold engine's step flows into the setup boxes. `eve channels add` now runs the same channel boxes as onboarding through the shared runner: the picker enforces the existing-registration conflict checks directly, the slackbot question moves ahead of any file write, and prompts can never interleave with side effects.
+
+  Removes the `eve/setup/scaffold/cli` and `eve/setup/scaffold/primitives` subpath exports. The terminal prompt adapters and process primitives now live in the setup island (`src/setup/cli/`, `src/setup/primitives/`), and the names `create-eve` consumes (`createPromptCommandOutput`, `detectDeployment`, `runPnpmInstall`, `spawnPnpm`, `runVercel`) are exported from `eve/setup` instead. The `eve/setup/scaffold` barrel is unchanged.
+
+- 24c4b85: Route setup questions through a single ask channel. Setup boxes now ask keyed question values through one injected `Asker` whose decorator stack (interactive base, headless base, pre-supplied answers, detected/recommended policies) decides how each question resolves; the select-model, select-chat, select-channels, and resolve-target boxes migrate onto the unified single-gather contract. The channel gains a paired `askMany` method for multi-select questions (whose `T[]` answers cannot ride `ask<T>`), with option-level `locked`/`disabled` row semantics enforced both by the interactive picker and by pre-supplied answer validation. A headless run that reaches a required question without an answer now fails with a structured `InteractionRequired` error naming the question key instead of a `HeadlessPromptError`.
+
+  The Vercel provisioning, channel-scaffold, connection, and deploy boxes now flow through that same channel: the provisioning deploy tree (deploy gate, new/link project, credential wiring, and the AI Gateway key as a sensitive text question rendered through the masked prompt), the slackbot create confirm, and the connection picker plus its custom MCP/OpenAPI sub-prompts are all keyed questions on the asker; the deploy box collapses its two constant gather faces into one. A headless run missing any required provisioning decision now refuses with `InteractionRequired` rather than `HeadlessPromptError`.
+
+  The remaining no-prompt boxes (preflight, scaffold, detect-ai-gateway, link-project, apply-ai-gateway-credential) collapse their dual gather faces into one. Boxes whose two faces differed by mode (preflight derives a model to validate only on a headless `--model`; scaffold skips the write on a headless re-run over an existing Eve project) take a `headless` factory option fixed at the composition site, mirroring the deploy box. With every box migrated, the `SetupBox` contract is now unified-gather only: the `SetupBox` type is the single unified interface and the `LegacySetupBox`/`UnifiedSetupBox` union, the `isUnifiedSetupBox` guard, and the `InteractiveOutcome` type are gone. Both runners call `box.gather` directly; cancel is signaled solely by a thrown `WizardCancelledError`.
+
+- 455866d: Slack authorization prompts are now visible only to the triggering user. The default `authorization.required` handler sends the sign-in link and device code as an ephemeral message, and falls back to a public link-free status only when it has no user to target. Breaking: an `events["authorization.required"]` override now receives a private-delivery context (`postEphemeral`, `postDirectMessage`, `state`) instead of the full event context, so it can change the message but not the audience. Adds `SlackThread.postDirectMessage`, which DMs a user via `conversations.open` and requires the `im:write` scope.
+
+## 0.6.0-beta.9
+
+### Minor Changes
+
+- 1cf3593: Evals gain hard assertions and CI-grade pass/fail. Suites and cases accept a `checks` array (built-ins on `eve/evals/checks`: `Checks.completed`, `Checks.didNotFail`, `Checks.toolCalled` with input/output matchers, `Checks.toolOrder`, `Checks.subagentCalled`, and more); any failed check fails the case and the `eve eval` exit code, while scores stay soft unless `--strict`. Derived facts are now typed records — `toolCalls`/`subagentCalls` carry inputs, outputs, and error state (breaking: previously `string[]`), plus new `inputRequests` and `parked` fields, and `Run.didNotFail` no longer passes runs parked on HITL input. The CLI takes positional suite ids (replacing `--suite`; `--all` is removed) and adds `--tag`, `--case`, `--strict`, and `--list`. Suite `model` is now optional and only required when a model-backed scorer needs it.
+- a648895: Make `agent.ts` optional. Agents without an `agent.ts` now default to
+  `anthropic/claude-sonnet-4.6`; when `agent.ts` is present, `model` remains required.
+
+### Patch Changes
+
+- 74cd2e5: Store local just-bash sandbox templates and sessions as normal on-disk directories instead of JSON filesystem snapshots, and prune stale `eve dev` runtime snapshots and local sandbox templates in the background.
+
+## 0.6.0-beta.8
+
+### Patch Changes
+
+- 02d5272: Discover Markdown-authored agent sources case-insensitively, including instructions, schedules, and packaged skills, while keeping module and directory names case-sensitive.
+- 8aeba87: Expand the deterministic authored-model mock so smoke fixtures can exercise ask-question, bash command, loaded-skill, and subagent-token flows without live model variance.
+- 8d087ff: Run the development server and terminal UI when `eve` is invoked without a command. Use `eve info` explicitly to inspect the resolved application.
+- abaca02: Recover from empty model responses instead of silently ending the turn. When a model call completes with no content (finishReason 'other', e.g. an AI Gateway 200 with an empty stream), the harness reissues the call once within the same step. If the reissue also comes back empty, conversations end with a recoverable, channel-visible failure and task runs end with a failed task result rather than nothing.
+
+## 0.6.0-beta.7
+
+### Minor Changes
+
+- edf9f1a: Redesign the `eve dev` terminal UI and add `Client.info()`.
+
+  The TUI now streams its transcript into the terminal's native scrollback instead of a bordered alt-screen, so scrolling, copy/paste, and the transcript all survive after you exit. The visual language follows the Vercel / Next.js CLI: a monochrome base with the `▲` brand mark, colored gutter glyphs per speaker, the `dots` spinner, and status icons (`✓` done, `⨯` error). Tool calls collapse to a one-line summary (`✓ get_weather  city="SF" → 73°F`) that expands under `--tools full`, subagent work is indented beneath a `◆` header, and a startup header prints the connected agent's model, instructions, tools, skills, and subagents. Subagents now default to `auto-collapsed`.
+
+  The prompt input gains shell-style editing: `↑`/`↓` cycle through your previously sent messages, `←`/`→`/Home/End/`Ctrl+A`/`Ctrl+E` move the caret, and `Ctrl+U`/`Ctrl+K`/`Ctrl+W` kill the line/word. Escape sequences that arrive split across reads (common with PTYs) are reassembled, and pasted text is sanitized of stray control bytes.
+
+  Failures read more cleanly: a terminal `session.failed` (or a dead-socket transport error) no longer leaves you stuck — the TUI starts a fresh session before the next prompt and notes it inline, so you can keep going. A failure cascade (`step.failed` → `turn.failed` → `session.failed`) renders one error block instead of three, and code bugs escaping user code show their stack trace dim beneath the headline (capped to a dozen lines; recognized provider/config failures keep their curated one-line summary). Error blocks no longer double-print a `Code: Code:` prefix and render docs links in cyan, and denied tool approvals settle to a `→ denied` line instead of a frozen `?`.
+
+  Captured server `stdout`/`stderr` renders as quiet, indented log runs: consecutive lines from the same source coalesce behind one `stdout ·` / `stderr ·` label with a hanging indent, runs get a blank line of breathing room on both sides, and nothing is ever truncated — a transcript can't be clicked open, so the full output is always shown.
+
+  `Client.info()` fetches the agent inspection payload (`GET /eve/v1/info`) — model id, instructions source, tools, skills, subagents, schedules, and sandbox — for both local and remote targets, returning the new `AgentInfoResult` type.
+
+## 0.6.0-beta.6
+
+### Minor Changes
+
+- ed176f9: Adds `eve setup`: in a fresh directory it runs the same guided onboarding as `create-eve` (name, Vercel project, model, channels, deploy); inside an existing agent it runs in-project setup. The onboarding flow now lives in the eve package as reusable setup boxes with split interactive/headless faces, and `create-eve` drives that shared flow, so the wizard behaves identically from either entry point.
+
+### Patch Changes
+
+- 5e87d70: Per-tool interactive authorization never leaks a raw `Required` error into
+  the model. When a tool's `auth` strategy is interactive but no callback URL
+  can be minted for the run, the tool now fails with a classified
+  `ConnectionAuthorizationFailedError` (`reason: "authorization_callback_unavailable"`,
+  non-retryable) instead of rethrowing the raw authorization error — which the
+  model would otherwise surface as a sign-in URL and loop on. Non-interactive
+  strategies still rethrow their original error, since they have no consent
+  flow to park on.
+
+## 0.6.0-beta.5
+
+### Patch Changes
+
+- ca1ca18: Per-tool authorization now evicts the rejected bearer from its per-step cache before re-running the consent flow, so a tool that re-reports `Required` (e.g. after a downstream `401`/`requireAuth()`) re-resolves a fresh token instead of re-reading the rejected one. This mirrors the MCP client's behavior. Documented the recommended pattern: map a provider `401` inside a tool's `execute` to `ctx.requireAuth()` so Eve re-challenges.
+
+## 0.6.0-beta.4
+
+### Patch Changes
+
+- 2aec0cf: Raise the derived `$eve.title` cap (`EVE_SESSION_TITLE_MAX_CHARS`) from 80 to 125 code points so Agent Runs titles keep more of the original prompt.
+- 5b69978: Fix `eve dev` source snapshots so monorepo-relative config paths and local workspace package links keep resolving from immutable dev-runtime snapshots.
+
+## 0.6.0-beta.3
+
+### Patch Changes
+
+- 3f71a5c: Add `repository`, `homepage`, and `bugs` metadata to published packages, ship the Apache-2.0 NOTICE file in npm tarballs, and add an `exports` map and `sideEffects: false` to `create-eve`.
+
+## 0.6.0-beta.2
+
+### Patch Changes
+
+- 3af511f: Bump `@workflow/core` to `5.0.0-beta.13`.
+- 5923ebc: fix(eve): prevent provider-executed tool calls from being emitted as client actions
+- beddb37: Prepare packages for open source: remove the internal `eve/dev-tui-test` subpath export, point the deployed home page and headless onboarding hints at the public docs site, add a README and packed CHANGELOG for `create-eve`, and remove internal doc references from runtime error messages.

package/NOTICE

@@ -0,0 +1,5 @@
+eve
+Copyright 2026 Vercel, Inc. and contributors
+
+This product includes software developed at Vercel, Inc.
+(https://vercel.com/).

package/README.md

@@ -105,12 +105,12 @@ export default defineAgent({
 ## Quick Start
 
 ```bash
-pnpm create eve
+pnpm create eve@beta
 cd my-agent
 pnpm dev
 ```
 
-The wizard scaffolds the project, picks a model, and (for the REPL channel) installs dependencies and starts the dev server for you. To scaffold into the current empty directory, run `pnpm create eve .`.
+The wizard scaffolds the project, picks a model, and (for the REPL channel) installs dependencies and starts the dev server for you. To scaffold into the current empty directory, run `pnpm create eve@beta .`.
 
 CLI commands: