eve 0.64.1 → 0.66.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # eve
 
+## 0.66.0
+
+### Minor Changes
+
+- da906b6: Breaking: `ctx.getSkill()` and the `SkillHandle` and `SkillFile` types from `eve/skills` are removed. The model still reads skill supporting files with its sandbox tools; if your own tool or hook code needs that data, import it from a module in `lib/` instead. Existing extension builds keep loading unless they call `ctx.getSkill()`.
+- ee286fe: Pass a configured sandbox environment to `ctx.getSandbox(environment)` to preserve its provider-specific session capabilities in the returned eve sandbox handle. The common `SandboxSession` no longer exposes optional `setNetworkPolicy`; use the configured environment when accessing that capability.
+
+### Patch Changes
+
+- c541dec: Leave temperature at the model provider's default when generating compaction summaries so providers that reject explicit sampling parameters can compact normally.
+- 1b6366f: Tolerate concurrent Docker sandbox template publication when another Eve application publishes the same deterministic image first.
+- d50a774: Add the `eve/extensions/code` built-in extension for coding agents: mount it with `import code from "eve/extensions/code"` to get `apply_patch`, `gh`, `grep`, computer use, coding skills, and a read-only worker subagent. Sandbox, tool, and PR-watch helpers are exported from `eve/extensions/code/sandbox`, `eve/extensions/code/tools`, and `eve/extensions/code/prwatch`.
+- 23dda94: `subagent.called` and `subagent.completed` hooks can now call `ctx.getSandbox()` for the parent session, and sandbox changes they make are kept for the parent's next turn.
+- 5132625: Add inline, keyboard-navigable catalog completions for `/model` and `/add` in the development TUI.
+- 92505dd: Fix `Cannot read properties of undefined (reading 'push')` failures in turns with MCP tools such as Notion, and with the file-memory tools, when an app installs a different Zod version than eve bundles. Tool schemas now reach the AI SDK only as JSON Schema, MCP and other JSON Schema tools are advertised exactly as published and validated with a standard JSON Schema validator, and the `*_INPUT_SCHEMA` and `*_OUTPUT_SCHEMA` constants from `eve/tools/*` are JSON Schema-backed Standard Schemas instead of Zod objects.
+  
+  eve now ships a single private copy of Zod instead of bundling several. `eve/client` no longer exports `AgentInfoResultSchema`, `HealthResultSchema`, `inputOptionSchema`, `inputRequestKindSchema`, `inputRequestSchema`, or `inputResponseSchema`, and `eve/self-modification` no longer exports `selfModificationConfigSchema`; use the exported types together with `isInputRequest`, `isInputResponse`, and `parseInputResponse`.
+- 136d339: Load optional sandbox provider packages consistently from the application during preparation, start, and resume. Providers installed automatically by `eve dev` can now be used immediately without restarting the development server.
+- da906b6: Dynamic skills no longer start a sandbox to announce or load instructions. Skills that return supporting files are written only when their contents or sandbox change, and a changed package replaces its previous files instead of leaving stale ones behind.
+- 09fed04: The Slack channel's `views.open` and answered-card `chat.update` now go through the channel's own Slack API transport. Slack sees the same calls, and a `views.open` that fails after Slack responds is still logged and acknowledged.
+  
+  A failed `views.open` is now logged as `Slack views.open failed` with the error attached, where it was `Slack views.open returned non-2xx` with a `status` field. Alerts or log queries keyed on either need updating.
+
+## 0.65.0
+
+### Minor Changes
+
+- 60998d6: Remove the `todo` tool, its `eve/tools/todo` export, and the dev TUI todo panel; delete any `agent/tools/todo.ts`, including one that exports `disableTool()`, which now fails the build because there is no default `todo` tool to disable. Compaction no longer resets `write_file` read tracking, so a file read before compaction can be overwritten without re-reading it; stale-read detection still rejects the write if the file changed since that read.
+  
+  `ask_question` is no longer a default tool and is now an ordinary workflow tool built on `ctx.ask()`. Add it with `eve add tool/ask_question`, or change an existing `agent/tools/ask_question.ts` to `import { askQuestion } from "eve/tools/ask_question"; export default askQuestion();`. The model now asks one `question` with up to three `{ label, description }` options, can always receive a free-text answer, and gets back `{ status: "answered", answer }` with the chosen label or the user's words. In sessions that cannot request input, the tool is still available and returns `{ status: "unavailable" }`. If you disabled `ask_question` with `disableTool()`, delete that file; it now fails the build for the same reason.
+  
+  `ctx.ask()` now resolves to `{ status: "answered", optionId?, text? }`, `{ status: "dismissed" }`, or `{ status: "unavailable" }`; check `status` before reading `optionId`. It returns `unavailable` immediately when the session cannot request input. A plain-text message answers a blocking tool's `ctx.ask()` question when it is the only pending question and the message matches an option or the question allows free text. Pass `dismissible: true` to resolve the question as `dismissed` when the user sends an unrelated message instead. An `ask_question` request's `requestId` is no longer its tool call ID; use `action.callId` to relate a request to its tool call.
+
+### Patch Changes
+
+- 155d24a: Make the bundled self-modification subagent scaffold an authored mount before changing its model, reasoning, or policy.
+- 155d24a: `eve dev` now mounts bundled development extensions by default, including the local self-modification subagent. Pass `--no-default-extensions` to run without them; production bundles do not initialize these development-only mounts.
+- ebab950: Fix subagent delegation failing with `Context key "eve.sandbox" is not set` when the parent has dynamic skills. Skill announcements are rebuilt at model preparation boundaries, so subagent notifications no longer require sandbox access.
+- d2ed49e: Exclude lazy development sandbox preparation and its transitive dependencies from every production server bundle, including self-hosted builds without a Vercel preset.
+- f945b80: Stop vendoring the unused `@workflow/builders` directive utilities into the published package.
+- a3b795b: Export an `errored` flag on eval assertion results so scorer failures can be distinguished from legitimate zero scores.
+
 ## 0.64.1
 
 ### Patch Changes

package/README.md

@@ -61,7 +61,7 @@ Every authored directory has a typed helper. Import each from the matching subpa
 | `defineInstructions(...)`                                       | `eve/instructions`                    | `instructions.ts` (or `instructions.md`)         |
 | `defineTool(...)`, `defineDynamic(...)`, `disableTool(...)`     | `eve/tools`                           | `tools/<name>.ts`                                |
 | `bash`, `readFile`, `writeFile`, and other provided definitions | `eve/tools/<name>`                    | `tools/<name>.ts`                                |
-| `defineSkill(...)`, `getSkill(...)`                             | `eve/skills`                          | `skills/<name>.ts` (or `skills/<name>.md`)       |
+| `defineSkill(...)`                                              | `eve/skills`                          | `skills/<name>.ts` (or `skills/<name>.md`)       |
 | `defineHook(...)`                                               | `eve/hooks`                           | `hooks/<slug>.ts`                                |
 | `defineChannel(...)`, `POST`, `GET`                             | `eve/channels`                        | `channels/<name>.ts`                             |
 | `eveChannel(...)`, `slackChannel(...)`, `vercelOidc(...)`       | `eve/channels/eve`, `/slack`, `/auth` | reused from `channels/<name>.ts`                 |
@@ -73,7 +73,6 @@ Runtime accessors live on the subpath that owns the concern:
 
 - `getSession()` — current session, turn, auth, parent lineage (`eve/context`)
 - `getSandbox()` — live sandbox handle for the current agent (`eve/sandbox`)
-- `getSkill(identifier)` — handle for a named skill visible to the current agent (`eve/skills`)
 - `getContext(key)`, `requireContext(key)`, `hasContext(key)`, `setContext(key)`, `ensureContext(key, factory)` — unified context helpers (`eve/context`)
 
 The complete API reference, including types and lower-level runtime primitives, is in the [TypeScript API Reference](https://eve.dev/docs/reference/typescript-api).

package/dist/src/_virtual/_rolldown/runtime.js

@@ -1 +1 @@
-import"node:module";var __defProp=Object.defineProperty,__exportAll=(e,t)=>{let n={};for(var r in e)__defProp(n,r,{get:e[r],enumerable:!0});return t||__defProp(n,Symbol.toStringTag,{value:`Module`}),n};export{__exportAll};
+import"node:module";var __create=Object.create,__defProp=Object.defineProperty,__getOwnPropDesc=Object.getOwnPropertyDescriptor,__getOwnPropNames=Object.getOwnPropertyNames,__getProtoOf=Object.getPrototypeOf,__hasOwnProp=Object.prototype.hasOwnProperty,__commonJSMin=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),__copyProps=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var i=__getOwnPropNames(t),a=0,o=i.length,s;a<o;a++)s=i[a],!__hasOwnProp.call(e,s)&&s!==n&&__defProp(e,s,{get:(e=>t[e]).bind(null,s),enumerable:!(r=__getOwnPropDesc(t,s))||r.enumerable});return e},__toESM=(e,t,n)=>(n=e==null?{}:__create(__getProtoOf(e)),__copyProps(t||!e||!e.__esModule||!__hasOwnProp.call(e,`default`)?__defProp(n,`default`,{value:e,enumerable:!0}):n,e));export{__commonJSMin,__toESM};

package/dist/src/channel/resolve-text.d.ts

@@ -1,19 +1,23 @@
-import type { InputRequest, InputResponse } from "#shared/input.js";
+import type { InputOption, InputResponse } from "#shared/input.js";
+/** The request fields plain text is resolved against. */
+export interface TextResolvableRequest {
+    readonly allowFreeform?: boolean;
+    readonly options?: readonly InputOption[];
+    readonly requestId: string;
+}
 /**
  * Maps freeform text to an {@link InputResponse} for a single request.
  *
- * Emitters import this utility to resolve text-based user input against
- * pending request options. The harness and runtime do not call it.
- *
  * Resolution order:
  * 1. Exact option ID (case-insensitive)
  * 2. Exact option label (case-insensitive)
  * 3. 1-based numeric index into the options array
- * 4. Freeform text if {@link InputRequest.allowFreeform} is not `false`
+ * 4. Freeform text when {@link InputRequest.allowFreeform} is `true` or the
+ *    request has no options
  */
-export declare function resolveTextToResponse(text: string, request: InputRequest): InputResponse | undefined;
+export declare function resolveTextToResponse(text: string, request: TextResolvableRequest): InputResponse | undefined;
 /**
  * Resolves text against all pending requests, returning one
  * {@link InputResponse} for each request that could be matched.
  */
-export declare function resolveTextToResponses(text: string, requests: readonly InputRequest[]): readonly InputResponse[];
+export declare function resolveTextToResponses(text: string, requests: readonly TextResolvableRequest[]): readonly InputResponse[];

package/dist/src/channel/resolve-text.js

@@ -1 +1 @@
-function resolveTextToResponse(e,t){let n=e.trim();if(n.length===0)return;let r=n.toLowerCase();if(t.options!==void 0&&t.options.length>0){let e=matchOption(r,t.options);if(e!==void 0)return{requestId:t.requestId,optionId:e.id}}if((t.allowFreeform===!0||t.options===void 0||t.options.length===0)&&n.length>0)return{requestId:t.requestId,text:n}}function resolveTextToResponses(e,t){let n=[];for(let r of t){let t=resolveTextToResponse(e,r);t!==void 0&&n.push(t)}return n}function matchOption(e,t){let n=t.find(t=>t.id.toLowerCase()===e);if(n!==void 0)return n;let r=t.find(t=>t.label.toLowerCase()===e);if(r!==void 0)return r;let i=Number(e);if(Number.isInteger(i)&&i>0&&i<=t.length)return t[i-1]}export{resolveTextToResponse,resolveTextToResponses};
+function resolveTextToResponse(e,t){let n=e.trim();if(n.length===0)return;let r=n.toLowerCase();if(t.options!==void 0&&t.options.length>0){let e=matchOption(r,t.options);if(e!==void 0)return{requestId:t.requestId,optionId:e.id}}if(t.allowFreeform===!0||t.options===void 0||t.options.length===0)return{requestId:t.requestId,text:n}}function resolveTextToResponses(e,t){let n=[];for(let r of t){let t=resolveTextToResponse(e,r);t!==void 0&&n.push(t)}return n}function matchOption(e,t){let n=t.find(t=>t.id.toLowerCase()===e);if(n!==void 0)return n;let r=t.find(t=>t.label.toLowerCase()===e);if(r!==void 0)return r;let i=Number(e);if(Number.isInteger(i)&&i>0&&i<=t.length)return t[i-1]}export{resolveTextToResponse,resolveTextToResponses};

package/dist/src/channel/types.d.ts

@@ -377,13 +377,12 @@ export interface SessionCallback {
 export interface SessionCapabilities {
     /**
      * True when the session may request input from a human (tool approvals,
-     * `ask_question`). The runtime reads this in every HITL gate:
+     * `ctx.ask()`). The runtime reads this in every HITL gate:
      *
-     * 1. `ask_question` tool registration in `buildToolSet`: the tool is hidden
-     *    from the model when the session cannot request input.
+     * 1. `ctx.ask()` resolves as `unavailable` instead of waiting when the
+     *    session cannot request input.
      * 2. The pending-input park guard: scheduled task sessions without this flag
-     *    fail fast rather than waiting for a response, covering both tool
-     *    approvals and `ask_question` prompts the model has already emitted.
+     *    fail fast rather than waiting for a response to a tool approval.
      */
     readonly requestInput?: boolean;
 }

package/dist/src/chunks/{use-eve-agent-BdKlQF32.js → use-eve-agent-BUeSjwIk.js}

@@ -1,6 +1,7 @@
 import { computed, onScopeDispose, shallowRef } from "vue";
 import { z } from "#compiled/zod/index.js";
 import { asSchema } from "ai";
+import { Validator } from "#compiled/@cfworker/json-schema/index.js";
 
 //#region src/protocol/routes.ts
 const EVE_ROUTE_PREFIX = "/eve/v1";
@@ -319,16 +320,8 @@ const kernelEffect = z.object({
 		"task-cancel",
 		"workflow-tool-call"
 	]).optional(),
-	audience: z.array(z.enum([
-		"root-session",
-		"delegated-task-child",
-		"requires-request-input"
-	])),
-	kind: z.enum([
-		"request-input",
-		"dispatch",
-		"provider-tool"
-	]),
+	audience: z.array(z.enum(["root-session", "delegated-task-child"])),
+	kind: z.enum(["dispatch", "provider-tool"]),
 	sourceId: z.string()
 }).strict();
 const compositionDiagnostic = z.object({
@@ -1444,7 +1437,22 @@ const JSON_SCHEMA_TARGET = "draft-07";
 function serializeOutputSchema(source) {
 	return serializeSchema(source, "output");
 }
-const UNSPECIFIED_INPUT_SCHEMA = z.fromJSONSchema({});
+function defineJsonSchema(schema, check) {
+	const emit = () => structuredClone(schema);
+	const toolSchema = { "~standard": {
+		version: 1,
+		vendor: "eve",
+		validate: createJsonSchemaValidator(schema, check),
+		jsonSchema: {
+			input: emit,
+			output: emit
+		}
+	} };
+	plainJsonSchemas.add(toolSchema);
+	return toolSchema;
+}
+const plainJsonSchemas = /* @__PURE__ */ new WeakSet();
+const UNSPECIFIED_INPUT_SCHEMA = defineJsonSchema({});
 function serializeSchema(source, direction) {
 	if (source === null || source === void 0) return source;
 	return toJsonObject(source, direction);
@@ -1471,6 +1479,231 @@ function getStandardSchemaProperties(value) {
 	const standard = value["~standard"];
 	return typeof standard === "object" && standard !== null ? standard : void 0;
 }
+function createJsonSchemaValidator(schema, check) {
+	let validator;
+	let warned = false;
+	const passThrough = (value, reason) => {
+		if (!warned) {
+			warned = true;
+			console.warn(`[eve] Tool schema cannot validate values locally; passing them through unvalidated: ${reason}`);
+		}
+		return { value };
+	};
+	return (value) => {
+		if (validator === void 0) {
+			const built = buildValidator(schema);
+			if (typeof built === "string") {
+				validator = null;
+				return passThrough(value, built);
+			}
+			validator = built;
+		}
+		if (validator === null) return { value };
+		let result;
+		try {
+			result = validator.validate(value);
+		} catch (error) {
+			if (value === void 0) return { issues: [{ message: "Expected a JSON value." }] };
+			return passThrough(value, toErrorMessage(error));
+		}
+		if (!result.valid) return { issues: toIssues(result.errors) };
+		const filled = applyDefaults(schema, schema, value);
+		const message = check?.(filled);
+		return message === void 0 ? { value: filled } : { issues: [{ message }] };
+	};
+}
+function applyDefaults(root, schema, value) {
+	let result = value;
+	for (const node of followRefs(root, schema)) {
+		const { items, properties } = node;
+		if (isObject(result) && isObject(properties)) result = fillProperties(root, properties, result);
+		else if (Array.isArray(result) && isObject(items)) {
+			const list = result;
+			const next = list.map((item) => applyDefaults(root, items, item));
+			if (next.some((item, index) => item !== list[index])) result = next;
+		}
+	}
+	return result;
+}
+function fillProperties(root, properties, value) {
+	let result = value;
+	for (const [key, property] of Object.entries(properties)) {
+		const current = Object.hasOwn(value, key) ? value[key] : void 0;
+		const next = current === void 0 ? findDefault(root, property) : applyDefaults(root, property, current);
+		if (next === current) continue;
+		if (result === value) result = { ...value };
+		result[key] = next;
+	}
+	return result;
+}
+function findDefault(root, schema) {
+	for (const node of followRefs(root, schema)) if ("default" in node) return structuredClone(node.default);
+}
+function* followRefs(root, schema) {
+	const seen = /* @__PURE__ */ new Set();
+	let node = schema;
+	while (isObject(node) && !seen.has(node)) {
+		seen.add(node);
+		yield node;
+		node = resolveLocalRef(root, node.$ref);
+	}
+}
+function resolveLocalRef(root, ref) {
+	if (typeof ref !== "string" || ref !== "#" && !ref.startsWith("#/")) return void 0;
+	let node = root;
+	for (const segment of decodePointer(ref)) {
+		if (typeof node !== "object" || node === null || !Object.hasOwn(node, segment)) return;
+		node = node[segment];
+	}
+	return node;
+}
+function buildValidator(schema) {
+	try {
+		const copy = structuredClone(schema);
+		return prepareForValidation(copy) ?? new Validator(copy, "2020-12", false);
+	} catch (error) {
+		return toErrorMessage(error);
+	}
+}
+const JSON_TYPES = /* @__PURE__ */ new Set([
+	"array",
+	"boolean",
+	"integer",
+	"null",
+	"number",
+	"object",
+	"string"
+]);
+const EXCLUSIVE_BOUNDS = [["exclusiveMinimum", "minimum"], ["exclusiveMaximum", "maximum"]];
+const SUBSCHEMA_KEYWORDS = [
+	"additionalItems",
+	"additionalProperties",
+	"contains",
+	"else",
+	"if",
+	"not",
+	"propertyNames",
+	"then",
+	"unevaluatedItems",
+	"unevaluatedProperties"
+];
+const SUBSCHEMA_LIST_KEYWORDS = [
+	"allOf",
+	"anyOf",
+	"oneOf",
+	"prefixItems"
+];
+const SUBSCHEMA_MAP_KEYWORDS = [
+	"$defs",
+	"definitions",
+	"dependencies",
+	"dependentSchemas",
+	"patternProperties",
+	"properties"
+];
+function prepareForValidation(schema) {
+	if (typeof schema === "boolean") return void 0;
+	if (typeof schema !== "object" || schema === null || Array.isArray(schema)) return "a subschema is neither an object nor a boolean";
+	const node = schema;
+	delete node.format;
+	for (const [flag, bound] of EXCLUSIVE_BOUNDS) {
+		if (typeof node[flag] !== "boolean") continue;
+		if (node[flag] && typeof node[bound] === "number") {
+			node[flag] = node[bound];
+			delete node[bound];
+		} else delete node[flag];
+	}
+	const { enum: values, pattern, required, type } = node;
+	if (type !== void 0 && !(Array.isArray(type) ? type.every(isJsonType) : isJsonType(type))) return `unsupported type ${JSON.stringify(type)}`;
+	if (values !== void 0 && !Array.isArray(values)) return "`enum` is not an array";
+	if (required !== void 0 && !(Array.isArray(required) && required.every((key) => typeof key === "string"))) return "`required` is not an array of strings";
+	if (pattern !== void 0 && !isRegExpSource(pattern)) return `invalid pattern ${JSON.stringify(pattern)}`;
+	for (const keyword of SUBSCHEMA_KEYWORDS) if (keyword in node) {
+		const problem = prepareForValidation(node[keyword]);
+		if (problem !== void 0) return problem;
+	}
+	const items = node.items;
+	for (const subschema of Array.isArray(items) ? items : items === void 0 ? [] : [items]) {
+		const problem = prepareForValidation(subschema);
+		if (problem !== void 0) return problem;
+	}
+	for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+		const list = node[keyword];
+		if (list === void 0) continue;
+		if (!Array.isArray(list)) return `\`${keyword}\` is not an array`;
+		for (const subschema of list) {
+			const problem = prepareForValidation(subschema);
+			if (problem !== void 0) return problem;
+		}
+	}
+	for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+		const map = node[keyword];
+		if (map === void 0) continue;
+		if (typeof map !== "object" || map === null || Array.isArray(map)) return `\`${keyword}\` is not an object`;
+		for (const [key, subschema] of Object.entries(map)) {
+			if (keyword === "patternProperties" && !isRegExpSource(key)) return `invalid pattern ${JSON.stringify(key)}`;
+			if (keyword === "dependencies" && Array.isArray(subschema)) continue;
+			const problem = prepareForValidation(subschema);
+			if (problem !== void 0) return problem;
+		}
+	}
+}
+function isJsonType(value) {
+	return typeof value === "string" && JSON_TYPES.has(value);
+}
+function isRegExpSource(value) {
+	if (typeof value !== "string") return false;
+	try {
+		new RegExp(value, "u");
+		return true;
+	} catch {
+		return false;
+	}
+}
+const CLOSED_OBJECT_KEYWORD = /\/(?:additional|unevaluated)Properties$/;
+function toIssues(errors) {
+	const failures = [];
+	for (let index = 0; index < errors.length; index++) {
+		const unit = errors[index];
+		const rejected = errors[index + 1];
+		if (CLOSED_OBJECT_KEYWORD.test(unit.keywordLocation) && rejected?.keyword === "false") {
+			const key = decodePointer(rejected.instanceLocation).at(-1);
+			failures.push({
+				keyword: "false",
+				location: rejected.instanceLocation,
+				message: `Unrecognized key: ${JSON.stringify(key)}`,
+				object: unit.instanceLocation
+			});
+			index++;
+		} else failures.push({
+			keyword: unit.keyword,
+			location: unit.instanceLocation,
+			message: unit.error
+		});
+	}
+	const relevant = failures.filter((failure) => failure.object === void 0 || !failures.some((other) => other.object === void 0 && (other.location === failure.location || other.location.startsWith(`${failure.location}/`))));
+	return relevant.filter((failure, index) => {
+		const next = relevant[index + 1];
+		if (next === void 0) return true;
+		if (next.location.startsWith(`${failure.location}/`)) return false;
+		return !(failure.keyword === "$ref" && next.location === failure.location);
+	}).map(({ location, message, object }) => {
+		const path = decodePointer(object ?? location);
+		return path.length === 0 ? { message } : {
+			message,
+			path
+		};
+	});
+}
+function decodePointer(location) {
+	return location.split("/").slice(1).map((segment) => {
+		let decoded = segment;
+		try {
+			decoded = decodeURIComponent(segment);
+		} catch {}
+		return decoded.replaceAll("~1", "/").replaceAll("~0", "~");
+	});
+}
 
 //#endregion
 //#region src/client/session.ts