eve 0.68.0 → 0.70.0

package/CHANGELOG.md

@@ -1,5 +1,137 @@
 # eve
 
+## 0.70.0
+
+### Minor Changes
+
+- ddc8e12: A connection sign-in or tool approval now holds the turn open, like a question or task: the stream emits `turn.waiting` instead of `turn.completed` and `session.waiting`, and the same turn resumes once the person acts. Every `turn.waiting` now carries `on`: `"input"` when a person must act, `"tasks"` when the turn waits on its own work. A message from that person steers the turn and cancels the pending sign-in or approval, messages from anyone else wait for the turn to end, and cancelling the turn withdraws both, so an approval no longer stays answerable after a cancel. A message sent while a session-limit prompt holds the turn waits in that turn and runs once the budget is granted. Slack's sign-in prompt gains a Cancel button.
+- 9553b51: The first local subagent turn now uses its caller's trace; remote turns remain separate roots with dispatch links, and later child turns start new traces. Queries that followed local `eve.link.type=agent.dispatch` links must use `parentSpanId` or `agent.parent_run.id` and `agent.parent_call.id`; third-party spans receive the conversation ID only when they do not set one.
+- 63f86de: The TUI's `--logs` and `/loglevel` modes are now `none`, `error` (default), `warn`, `debug`, and `all`, replacing the `stderr` and `sandbox` filters. Console warnings retain their severity across local server workers, stay hidden by default, and render yellow when enabled; unclassified output is shown only with `all`, in neutral styling. Complete log records now commit immediately instead of holding completed turns in the clipped live region.
+- 8aca3d8: Frontend hooks and `EveAgentStore` now share one conversation client: default hooks return `ConversationState` (messages plus root turns, input requests, tasks, and agent sessions) instead of `EveMessageData`, and every snapshot exposes canonical `conversation` alongside a custom reducer's `data`. Answers to open input requests are accepted while a turn runs, `followSubagents: true` follows each agent tool's session into `conversation.agents`, a held turn stays `streaming` with `turns[turnId].waiting` set, and `EveAgentStore` adds a `client` option plus `compact()`, `clear()`, and `retire()`.
+
+### Patch Changes
+
+- 8aca3d8: A sign-in prompt that eve raises while checking who may answer an approval now includes its `attemptId`, so clients match the completion to that prompt instead of leaving it open.
+- ddc8e12: A plain `connection_search` no longer asks the user to sign in: connections they have not authorized appear under `unavailable` with `requiresSignIn: true`, and the model signs in to one connection at a time with `connection_search({ connection, signIn: true })`. A turn waiting on several sign-ins resumes once all of them are done.
+- ac77188: The build now fails when a dynamic remote agent's `auth` or `headers` uses a value declared inside the event handler. Before, eve moved the credentials to module scope anyway, so they threw at request time or silently read a same-named module value. Dynamic remote agents imported through an alias or `import * as eve` now compile their credentials too.
+- 1094e52: Eval results now list the models their steps started with: `derived.models` on each session holds the distinct model ids in first-use order, and the eval result's `derived.models` merges them in session order. Only the sessions an eval created or attached are covered.
+- 8aca3d8: The `eve dev` terminal UI now runs on the shared agent store: the prompt stays open while the agent works, including turns the agent starts on its own, approvals and questions open as soon as they arrive, and slash commands run immediately. `Esc` or `Ctrl+C` cancels the running turn instead of steering with queued messages, and an approval or question names the task that asked. While a sign-in is open, the turn bar names the connection it waits for, and a turn cancelled from another client puts its message back in the prompt.
+- 001cc00: Tool, agent, and connection names now read as plain words in activity labels, approval prompts, and the Slack status and task card. An extension or memory namespace before `__` is dropped, and `sync_accounts` or `syncAccounts` shows as `Sync accounts`. A connection call shows as `Linear: List issues`, and its approval asks `Approve Linear: List issues?` instead of naming `connection_execute`. Agent calls read as `Researcher: Find the March incidents`. Labels set with `label.start` are unchanged.
+- 8aca3d8: Keep a tool's completed result visible when an approval decision arrives after that result. The TUI no longer shows a finished workflow call as interrupted during subsequent turns.
+- 4361876: Extensions mounted inside a contributed subagent can now read the enclosing extension's configuration. Previously the nested mount saw an unbound handle, so deriving its configuration from the parent extension failed with `Invalid extension config`.
+- 3f6d9cf: `eve/nuxt` now shares the Next.js dev-server startup: it waits up to 180 seconds by default (configurable with the new `devServerTimeoutMs` option), ignores non-local URLs in eve's startup output, and prefixes eve's logs with `[eve:dev]`. Restarting `nuxt dev` no longer leaves eve requests proxied to a stopped dev server.
+- ddc8e12: Tools and connections that share one Vercel Connect connector now ask the user to sign in once. Before, each tool that called `ctx.getToken(connect(...))` and each connection using the same connector posted its own sign-in prompt for the same grant.
+- a79fca4: Task starts in the terminal UI now use ordinary tool-call styling. A bounded activity drawer above the prompt shows readable subagent labels, nested work, and the parent's current state and elapsed time. Activity remains visible above questions and approvals when screen space permits.
+- 4403122: On Vercel, a remote agent's spans now carry its own session ID as `vercel.session_id` instead of the calling deployment's root session, and its local subagents carry the same ID. Agent Runs in the receiving project lists the remote agent as its own session, with its turns, subagents, and token usage. `gen_ai.conversation.id` still names the caller's conversation.
+- 384af57: Session workflow steps that only publish events or update session state, such as a workflow tool's progress report, no longer store the conversation history in their Workflow step input, so their stored size stops growing with the conversation. The session handoff checkpoint changed shape, so an idle session does not move between deployments on either side of this release; its current owner keeps running it.
+- ff12e85: `session.waiting`, `turn.waiting`, `session.failed`, and `session.completed` now carry `usage`, the session's running token usage and cost including what the agents it delegated to spent. Eval results expose it as `derived.usage`, per session and summed for the eval, so a delegating eval no longer reports only its own model calls.
+- ddc8e12: A completed sign-in now resumes the turn as the user who started it. Before, when someone else posted in a shared thread while the sign-in was pending, the resumed turn ran as that last speaker and failed with "the service rejected the token immediately after authorization".
+- ddc8e12: Slack now cleans up after a tool approval. Once it resolves, the separate tool-input post is deleted, a direct-message approval's `Waiting on approval` note in the thread shows the outcome, and the card loses its buttons even when the approval ends without a click. The `Checking whether you can respond to this approval…` notice is no longer posted, since Slack cannot remove it afterwards.
+- 490ac0d: Slack no longer drops a final reply without a trace. When Slack refuses eve's default reply as too large or malformed, eve uploads it as a Markdown snippet. When a reply still isn't delivered, including when a custom renderer throws, eve posts a short notice with an error id, without the reply, and tells the model on the next message that the user never saw it. Custom renderers can opt in to the same fallbacks by posting through `postCompletedSlackReply` from `eve/channels/slack`, which tries their blocks, then native Markdown, then a snippet, using only the content they pass.
+- ddc8e12: Slack now identifies a person by the app installation workspace on both messages and button clicks, as `slack:<installation team>:<user>`. Before, a Slack Connect or Enterprise Grid user could get one principal from their messages and another from approval clicks, so they were asked to sign in to the same connection again. Their principal changes once with this release, so they sign in to user-scoped connections one more time.
+- 19a2b4f: Slack `onMessage` now receives only newly posted messages. Edits, deletions, and other system message events go to `onEvent`, so updating the agent's own HITL card in a DM no longer starts a stray session.
+- 001cc00: Channels can now handle `step.started`, which fires before each model call in a turn. The default Slack channel uses it to replace a stale thread status when the model starts another step. The status shows `Reviewing results...` after a task finishes and `Thinking...` after a tool call. Before, `Waiting on 3 tasks...` or a finished tool's label lingered until the model streamed its next output.
+- ddc8e12: Slack sign-in prompts now say which service they are for and why. The private message reads `Connect Linear: To continue, I need access to your Linear account` with a `Connect Linear` button, and a device code, when the provider issues one, appears as a short hint below the button instead of leading with `Use code … when prompted`. The thread status names who it is waiting on, as in `Waiting for @alice to connect Linear…`.
+- 8aca3d8: The default message reducer gives assistant text and reasoning parts a stable `id` across streaming, completion, and replay, and keeps late-arriving participant messages ahead of their turn's response. Authorization parts match completions by `attemptId` and mark callback-backed sign-ins with `awaitsCallback`; replayed tool events no longer reopen a settled approval, and rejected tool results render as denied.
+- b3fc842: Pressing a Telegram inline button for an `ask_question` question now answers it. Since `eve@0.65.0` the press was dropped and the agent kept waiting for an answer.
+- e1130dd: Fix generated Web Chat service builds with root-installed pnpm dependencies, and honor Vercel services configuration during project creation instead of prompting to switch to Next.js or eve. Deployment now shows Vercel build logs in the CLI and TUI and provides a command to retrieve them after a failure.
+
+## 0.69.0
+
+### Minor Changes
+
+- efa0869: `ctx.agent(name)` in a workflow tool now returns a session with that agent: `send(message, { outputSchema, signal })` returns a response whose `result()` resolves the turn's `{ data, message, status }`, and the parent stream announces each session with `agent.started`, carrying the opening call's `callId` and `turnId`, which `session.agent(started).stream()` follows. `ctx.agent(name, { message, agentId })` is removed, sessions end when the workflow run finishes, and remote agents now check a protocol version, so upgrade both deployments together.
+- c8d38a8: Every agent tool is now a `serve(receive, ctx)` tool built on `ctx.agent`, so every subagent call is a resumable task: the call returns a receipt, the agent's reply arrives as a task result, and the model continues the same agent by passing `taskId` (replacing `agentId`) or stops its current turn with `task_cancel`. The `subagent.called`, `subagent.started`, `subagent.event`, and `subagent.completed` events, their hooks, the `[Agents]` note, and the `AGENT_*` errors are removed; clients, hooks, and evals read `task.started`, `task.settled`, and `agent.started` instead, and `session.agent(started).stream()` follows a child from its `agent.started` event. `task.started` carries `kind: "agent"` for an agent tool's call and `"tool"` otherwise, so `t.calledSubagent` also sees an agent call that failed before its session opened. The default message reducer behind `useEveAgent()` settles a task call's tool part from `task.settled` (output, error, or cancellation).
+- 7869f50: The Chat SDK bridge's `send` now takes a message plus channel send options, and a new `respond(inputResponses, { thread })` answers pending input requests. To migrate, replace `send({ message, context }, { thread })` with `send(message, { context, thread })`, and replace `send({ inputResponses }, { thread })` with `respond(inputResponses, { thread })`. Channel send options also accept `outputSchema`, as `Session.send()` does.
+  
+  Telegram and Chat SDK inbound messages now go through the public channel `send()`, so route wrappers see them. A Telegram reply to a bot message that no session owns now starts a session instead of failing delivery.
+- c8d38a8: `session.streamSubagent(started)` is now `session.agent(started).stream()`. `session.agent()` takes an `agent.started` event and returns a `ClientAgentSession` handle with the child's `name`, `sessionId`, and `taskId`; eval sessions get the same `session.agent(started).stream()`.
+- cc14b3d: Connection tools no longer break the prompt cache. The model finds them with `connection_search` and calls them with the new `connection_execute` tool, so discovered tools are no longer added to the model's tool list. Connection names now arrive in append-only context messages instead of the system prompt. `connection_execute` returns MCP `structuredContent` or text instead of the raw MCP envelope, and stream events report each call as a nested `<connection>__<tool>` action with a new `parentCallId`. The `eve/tools/connection_search` export is removed, and both tools are reserved names that cannot be replaced or disabled.
+- c8d38a8: When eve holds a turn because its tasks are still working, the stream now emits `turn.waiting` for that turn in every session, and `session.waiting` comes only after the turn really ends. In a root session, the model's text before the wait now completes as an ordinary `"stop"` message, so a person sees it right away. Child and schedule turns still report it as `"tool-calls"`, so they post once. `send().result()` and MCP `agent_get` return the final reply, not the text written before the wait.
+- 1a5bc56: Approval response policies now run for Cancel as well as Approve (`response.decision` is `"approve" | "cancel"`), so a responder the policy rejects can no longer cancel someone else's request; a policy that only restricts approval should return `{ status: "allowed" }` for `cancel`. The responder moved from `responder` to `response.principal`, alongside `request.principal`.
+- b34bab8: Extension configuration and durable state now belong to each logical mount, so duplicate mounts can use independent config and state. Session handoffs across this upgrade boundary are rejected in both directions, including for agents without extensions; keep each session's owning deployment available until it finishes, or start a new session on the deployment you want to use.
+- efa0869: Remove background tasks: workflow tools and subagent calls now always block the turn until they settle, `defineWorkflowTool` rejects `execution`, and `taskDeliveryPolicy`, the `task_cancel` tool, `session.cancel({ tasks })`, task receipts and notifications, and `<eve-empty-delivery/>` are gone. Extensions built against earlier capability epochs must be rebuilt.
+- c8d38a8: Workflow tools can define `serve(receive, ctx)` to run a resumable task: `receive()` resolves the call that started the task, then each later call the model makes with the task's `taskId`, and `ctx.reply(output)` delivers a result while the task stays available. eve adds an optional `taskId` to a `serve` tool's model input (the build fails if `inputSchema` declares its own), idle tasks don't hold the turn and are listed in the `[Tasks]` note, and `task_cancel` aborts the current work's `abortSignal` while the task stays available for its next call, as long as the body returns to `receive()` within 30 seconds. While the task serves a later call, `ctx.session` describes that call, with its turn and the auth it was admitted with, and `ctx.agents` lists the agents that call may open. A session opened with `ctx.agent` is the child in lineage and trace of the call served when it opens, and each message sent to it carries the auth of the call served when it's sent. The events a call causes, including `task.settled`, `agent.started`, and questions, carry its `callId` and `turnId`.
+- 9c36b7c: Slack now shows each turn's tasks in a live task card: one message, updated in place, with a row per task that shows whether it is working or waiting on a person, and how it ended. Slack also acknowledges a mention or DM with `Thinking...` right away, even with a custom `onAppMention` or `onDirectMessage`, and clears it if the hook drops the message. While a turn waits on its tasks, the status names them. Outside DMs and private channels, the card shows a failed task as `Failed` without its error text, and a blocked task without the request's prompt. Channels can now handle `input.resolved` to learn when each question or approval ends, however it ended.
+  
+  `slackChannel({ events })` is replaced by `renderers`, which wrap eve's default rendering instead of replacing it; without `renderers`, eve renders with its default. Move `events: { … }` to `renderers: [{ events: { … } }]` and handlers behave as before; call the new `next` argument to keep eve's default; `next` also replaces `input.requested`'s `defaultDeliver`. A renderer can also shape the task card with `taskCard(view, next)`, whose view includes the turn's other tool calls and their input, so your own tools, such as a checklist, can appear on the card. The experimental `activity` option, the `experimental_slackActivity*` renderers, and the activity collector behind them are removed, along with the `activityObserver` field on delegated and remote-agent sessions; remote agents ignore it when an older caller still sends it.
+- c09c0d6: Slack task cards and typing indicators name work more clearly. A task the agent hands to its own copy shows its brief instead of `agent: …`. Row titles and results use the first sentence, and results are cut to about 100 characters at a word boundary. The typing indicator shows the same labels as the card and says `Waiting on 3 tasks...` instead of naming one task and counting the rest. The `describeActionRequest` and `describeActionRequests` exports from `eve/channels/slack` are removed. A renderer can call `next()` for eve's default status, or read `presentation` from `actions.requested`.
+- efa0869: A steering message now aborts the `ctx.abortSignal` of each `execute` workflow tool call the turn waits on, so a waited call stops early and settles with what its body returns, or `{ interrupted: true }` if the body rejects. `ctx.ask(request, { signal })` withdraws the question when the call's `abortSignal` or `signal` aborts, resolving as `cancelled` with an `input.resolved` outcome of `"cancelled"`. `sleep` and `ask_question` now stop early for a new message, and `dismissible` and the `dismissed` status are removed: a question in an `execute` call lapses when the conversation moves on, and a question asked from a `task` stays open.
+- c8d38a8: A workflow tool now defines exactly one of `execute(input, ctx)` or `task(input, ctx)`. A `task` tool runs each call as a task: the model gets a receipt at once, the result arrives later in a `task.result` message, the model waits with `task_wait` or stops a task with `task_cancel`, and a turn can't end while its tasks work. `agentRouter()` and the `workflow` tool now run as tasks. The stream reports `task.started` and `task.settled` with each call's `turnId`, `turn.waiting` while `task_wait` waits, and the `taskId` on `agent.started` for a session a task opens; task results are not published as `message.received`. `session.cancel()` also stops working tasks, and `execution` now fails with a pointer to `task()`. Authored tools can no longer be named `task_wait` or `task_cancel`. Consecutive queued messages from one principal now share a turn even when their auth claims changed, and the turn runs with the latest claims.
+- 315b353: `eve dev --subagents` now accepts `full`, `collapsed`, or `hidden`, and defaults to `collapsed`. `auto-collapsed` was removed because it rendered the same as `collapsed`; pass `collapsed` instead.
+- efa0869: A question or sign-in from inside a running call, such as a workflow tool's `ctx.ask()`, `ask_question`, or a subagent's question or connection sign-in, no longer ends the turn: the stream emits `input.requested` or `authorization.required`, then the new `turn.waiting` event, and the turn resumes under the same `turnId`. The session you answer on now emits `input.resolved` for every subagent or workflow tool question it routes an answer to, and `send().result()` stops at `turn.waiting` only while a question is pending. The message stream version is now 26, which older eve clients reject, so upgrade them with the server.
+
+### Patch Changes
+
+- 0ec0381: Channel activity, such as Slack, now shows each agent task or `ctx.agent` session as its own row under the call that opened it. The row settles as completed, failed, or cancelled when the agent's first turn ends, and a turn cancelled while it waits for an answer, including the caller's own, now settles as cancelled unless its own approval or sign-in can still be answered. Before, a local agent's activity merged into the caller's row and marked it done early, a remote agent's row stayed running until the caller's turn ended, and a later message to a remote agent, such as continuing its task by `taskId`, failed while activity was on. Later turns of the same session, such as a second `send` or a task continued by `taskId`, still appear under its first row.
+- c8d38a8: A message sent to an agent task by `taskId` just as the agent's turn ends now reaches the agent and gets the reply of the turn that read it. Before, the message could be settled with the earlier turn's reply without the agent ever seeing it, and a message sent just after a `task_cancel` could be left unanswered.
+- c8d38a8: Correcting an agent by `taskId` while it works now gets the agent's corrected reply, and a correction sent during the agent's first turn joins that turn instead of waiting for it to end. Before, a message the agent read only after its turn ended was answered with the earlier turn's reply, and the corrected reply was lost, which could leave the caller's turn waiting forever. The same applies to `ctx.agent(name).send()`: a response resolves with the result of the turn that read its message.
+- bbbf9fc: `agent.started` hooks keep the session state and sandbox changes they make. A child session that opens while the parent's model is generating appears on the parent stream when that model step ends.
+- c8d38a8: A `ctx.agent` turn that fails now reports why: `result()` returns `error.message` alongside `status: "failed"`. Agent tasks and `workflow` program calls include that reason in their failure, so the parent sees the agent's error instead of "The agent's session ended."
+- 66f295e: Approved tools now execute correctly when memory recall and dynamic user instructions run during approval resume.
+- efa0869: A `ctx.ask()` question now resolves the way the session decided it: an answer that reached the session before its withdrawal resolves the ask as `answered`, even after the signal aborted, so `ask_question` and the channel never disagree. Cancelling a `task()` also reports its pending questions `cancelled`, and question `requestId`s are now `<runId>-ask-<n>` instead of an internal hook token.
+- a402836: `authorization.required` and `authorization.completed` events now include `principalId`, the session principal who started the sign-in, using the same value as `responderPrincipalId` on approval events. Candidate sign-in events also now include their `attemptId`.
+- e9dd418: Add an optional `fallback` model to `auto` model routing. When the evaluation model fails, eve now uses the configured fallback for the rest of the turn while preserving cancellation behavior.
+- c8d38a8: Cancelling a turn no longer erases the tool calls it was waiting on from the model's history. Each one stays, answered as cancelled, so in the next turn the model sees that the work was started and stopped instead of redoing a request that looks unanswered.
+- ce14b1e: `defineChannel` event handlers can now subscribe to `step.completed`, the same event hooks receive when a model step finishes.
+- cd3f263: Include channel kind and origin on agent step spans so traces can be classified while a turn is still running or waiting for input.
+- aa73bcb: Trace viewers now use the GenAI system-instructions attribute instead of recording a duplicate system prompt attribute.
+- 4902e93: The `eve` CLI now finishes writing stdout and stderr before it exits. A parent process that reads large output through a pipe, such as `eve info --json` for an agent with many tool schemas, now receives the complete output instead of output cut off partway through.
+- f0a9ee1: The Datadog reporter now records eval content by default and reuses one dataset across runs, so experiments can be compared in Datadog.
+- 47c2844: eve now defaults to `openai/gpt-6-luna-fast` with high reasoning when no model is configured, including newly initialized agents; explicit model and reasoning selections remain unchanged. The terminal UI shows compact model labels with dot-separated reasoning and a `⚡︎` speed marker in place of a trailing `-fast` suffix.
+- a9da46c: Delegated agents again share and count against the parent's session token and cost budgets: agent tasks started in the same model step split the parent's remaining quota, and delegated usage, including remote agents and nested subagents, counts toward the parent's `maxInputTokensPerSession`, `maxOutputTokensPerSession`, and `maxTokenCostUsdPerSession` and the usage the parent reports. An agent task's usage counts with each reply and when a cancelled turn ends; other workflow tools' `ctx.agent` usage counts when the tool replies or finishes.
+- 8149c72: The Braintrust and Datadog reporters now report one score per assertion name, the lowest, instead of numbering repeats like `judge_boolean_2`.
+- 4b195e9: Add `eve/server`, whose `sessions.attach(sessionId).stream({ startIndex, follow, signal })` reads a session's durable event stream in process from hooks, tools, schedules, and channel routes, with the same shape as the client and no HTTP round trip.
+- 21e11d0: `eve dev` now reaches a ready server about 40% sooner. The bundled self-modification extension no longer re-bundles eve's internals for each module it loads, and dev builds no longer re-parse large output chunks. Installing eve also no longer reports `npm audit` advisories for `undici`, which is now 8.10.2.
+- e0dd11e: Fix imports of `eve/extensions/code/sandbox` from ES module consumers when bundled Connect dependencies include CommonJS code.
+- 0afae69: Restore completed-turn memory capture by providing memory providers with the settled conversation history.
+- f9c785f: When a target deployment cannot read the session checkpoint version, validation returns incompatibility instead of throwing so Workflow no longer retries the step. The turn is processed on the current owner immediately.
+  
+  Owners running this eve build remember every deployment that reported incompatibility and skip handoff to those targets for later turns in the same run. Sessions whose owner workflow started on an older build still attempt handoff each turn, but each attempt no longer triggers validation retries on the target.
+- 5181b14: Approval response policies now receive `request.principal`, the person whose turn requested the call, so a policy can let only that person approve it in a shared conversation. It is `null` when the caller was unauthenticated or anonymous.
+- 7869f50: Inbound Slack messages now go through the public `from(address).send()`, so a route wrapper that replaces `send` sees every inbound message and receives delivery failures as errors. Channel `send()` also forwards its `state` option to the `deliver` hook as `payload.state` on every delivery, as `respond()` already did.
+- 7869f50: `eve info --json` now includes `toolInputSchemas`: each static tool's input schema, for the root agent and each declared subagent, in the form eve sends to the model. Subagent entries are keyed by their path from the root agent, such as `forecaster/reviewer`, so nested subagents that share a name each get their own entry. `eve/tools` also exports `serializeModelInputSchema(schema)`, which returns that JSON Schema for any tool input schema, so checks no longer need to read `.eve/` build output.
+- 7869f50: `eve/schedules` now exports `isScheduleAuth(auth)`, which returns `true` for the app principal that schedules pass as `appAuth`. Use it to tell the agent's own scheduled work from a user's turn without copying eve's internal principal values.
+- e6c90d0: Keep slash-command suggestions visible after a command name is fully typed, so the matching command and its description remain visible alongside any inline argument hint.
+- 7a33f37: Isolate extension module instances and configuration per logical mount, including directory overrides and their subagents, while preserving asset imports and extension-owned dependencies. Durable extension state still uses package-scoped keys.
+- 0e0fa1b: Record canonical logical mount identities in compiled extension metadata and contribution ownership. Flat and directory mounts share an identity, while mounts in different subagents retain distinct paths; this does not yet change extension configuration or state isolation.
+- c8d38a8: A `serve` task's `ctx.reply()` that answers several calls, such as an agent's reply to a message and its correction, now settles them together: `task_wait` no longer reports the task as both done and still working, and the model receives the reply once instead of once per call. Each call still gets its own `task.settled` event.
+- c8d38a8: A model response that mixes AI Gateway `web_search` results with local tool calls such as `web_fetch` no longer breaks the next model call. eve kept a local call ahead of a later search result, so Anthropic rejected the history with "`tool_use` ids were found without `tool_result` blocks" and the turn failed.
+- e0ad9a0: Agents using AI Gateway web search no longer claim on the next turn that they answered before searching. When a reply continues after a search result in the same model call, eve now stores that text as its own assistant message, so AI Gateway replays it after the result instead of before the search.
+- cd13d12: The initial `eve dev` composer now suggests concrete changes you can ask your agent to make, based on its instructions and capabilities. Fresh `eve init` agents get the customization hint even when scaffolded channels expose workflow webhook routes; agents with an added channel keep the minimal “Send a message…” placeholder.
+- 631122f: The `eve dev` terminal UI now hides Workflow SDK output such as `[workflow-sdk]` lines unless `/loglevel all` is on; the diagnostic log still records every line. eve also no longer warns with "Step execution already in flight in this process" when a queued step delivery loses a normal race with a new inline step.
+- 23dc0da: A remote agent on this release now serves callers on eve 0.66 through 0.68 instead of rejecting them with `REMOTE_AGENT_PROTOCOL_MISMATCH`, so you can upgrade remote agents before the deployments that call them. Those callers' turns, results, follow-ups, and resets work as before, and the remote agent's tool approvals and sign-in requests still reach the caller and accept its answers.
+- b0b975b: Remote subagents inherit the parent's human-input capability and forward questions and authorization requests through the parent channel, including concurrent workflow questions. Trusted remote receivers can read the replay-stable invocation operation ID in `onMessage`.
+- e005932: Traces no longer give each `ctx.agent()` call in a workflow tool its own `agent.action` caller span, and a workflow tool that calls agents stays an `agent.action` span instead of becoming `invoke_workflow <tool>` with `gen_ai.workflow.name`. Sessions opened with `ctx.agent()` now link to the calling tool's `agent.action` span, and their usage no longer appears on a separate caller span; it still counts toward the parent session's usage.
+- ba96305: Include provider-reported `costUsd` alongside token counts on terminal subagent action instrumentation events and spans.
+- 7e4ceb8: The self-modification `registry_add` tool no longer pauses for approval before installing an official registry item. It now refuses items that would replace the self-modification subagent's own mount, and `search_registry` hides them.
+- cd8fb87: The self-modification subagent no longer tries to install `eve/self-modification` when asked to change the agent's own instructions. To change the subagent's own model or reasoning, it now creates or edits `agent/extensions/self-modification/extension.ts` directly.
+- e167dd3: `ctx.reply()` in a `serve` workflow tool now withdraws the `ctx.ask()` questions still pending for the calls it settles, so they resolve as `cancelled` and channels stop offering them. Before, such a question stayed pending after its call had a result: it kept steering from interrupting a model step and could take the person's next plain message as its answer.
+- 99b4166: Session workflow steps now return only the session state they changed, and the workflow applies that change to the state it passed in. Each step used to return a full copy of the session, so stored step output and the data a workflow replay reads grew with conversation length on every step; they now grow only with what each step changes.
+- 138e3b1: The Shopify integration setup now scaffolds a UCP agent profile for protocol version `2026-08-25`, with `spec` and `schema` declared on every capability.
+- 8d6cd3e: Slack now sends sign-in challenges and approval feedback privately to the Slack user behind the event's principal, not to whoever spoke last in the thread. Channel state replaces `approvalResponderUsers` and `pendingApprovalCandidateUsers` with a single `slackUsersByPrincipal` map.
+- 7869f50: `eve/channels/slack` now exports `renderInputRequestBlocks`, `deriveHitlResponse`, and `HITL_ACTION_PREFIX`, with the `SlackHitlAction`, `DerivedHitlResponse`, and `SlackHitlRoute` types. Apps can render eve's HITL Block Kit controls and decode clicks on them without importing from eve's build output.
+- 79fa2aa: `task.settled` for a cancelled call now carries `cancel.reason`: `"task_cancel"` when the model called `task_cancel`, `"turn_cancelled"` when someone cancelled the turn, or `"turn_ended"` when the turn ended while the task still worked. The Slack task card uses it: a task the model cancelled now shows a success check and `Stopped early since it was no longer needed`, and other stopped tasks say why, such as `Stopped by request` or `Stopped when the turn ended`.
+- ce19751: The Slack task card now shows how long each task took, as in `Done in 1m 14s: Found three incidents.` or `Failed after 3m`, and the finished plan title includes the turn's total time. A plan whose tasks are all subagent or remote agent calls names them, as in `Asking researcher and reviewer` or `Waiting on reviewer · 1 of 2 tasks done`. The card also keeps one `block_id` for the whole turn, so rows a reader expanded can stay open as the card updates. When a turn you keep messaging starts new tasks after its earlier ones settled, eve marks the earlier card finished and posts a new card instead of updating the old one further up the thread.
+- 47c2844: Clarify that `task_wait` should be called sparingly, only to deliberately withhold a user-facing reply while waiting for a task result. Tasks keep running and their results reach the model without an explicit wait.
+- 7869f50: Spreading a channel into a new object with replaced routes, such as `{ ...slackChannel(), routes }`, now keeps its build metadata, so the Slack app manifest and Vercel Connect credentials still reach the build. The custom channels docs now describe wrapping an existing channel's routes as supported.
+- e5d45dd: A message that steers a turn right after a tool call, such as a question sent while a task works, now gets answered on Anthropic models. Before, the message reached the model in the same turn as the tool results, and Claude often treated it as tool output and kept waiting on its tasks without replying.
+- e0ad9a0: A message that interrupts a waiting tool call, such as a `sleep` or `task_wait`, no longer also interrupts the step that reads it. The stream no longer emits a stray `step.started` with no model call before the step that answers the message.
+- c8d38a8: Channel activity, such as Slack's activity message, now shows a call to a task as running from its receipt until the task settles, then marks it completed, failed, or cancelled. Before, the receipt marked the call done as soon as the task started.
+- c8d38a8: The task system prompt now tells the model it can reply before a task's result when it doesn't need the result yet. Its turn stays open and it gets the result when the task finishes, so a person who says there's no rush gets a reply right away. A question asked while tasks work is now answered before the model waits again.
+- 67ae5b5: A question or approval that a task run or workflow tool call relays, from its own `ctx.ask()` or from a session it opened with `ctx.agent`, now emits `input.resolved` with `outcome: "cancelled"` when that run finishes before anyone answers. Every question or approval a session relays does the same when the turn is cancelled. Previously these requests were dropped silently or left in place, so channels and `useEveAgent` UIs kept offering them even though no answer could reach anyone.
+- 7869f50: `task.settled` events now carry the task's tool `name` and `kind`, the same values as on the call's `task.started`, so clients and hooks can label a settled task without tracking its start. Events recorded by earlier versions omit both fields.
+- ce14b1e: Models now get clearer task guidance: call `task_wait` when there's nothing to say until a result arrives, reply when the person should hear something first, and in child and schedule sessions wait instead of replying. `task_wait` takes `timeoutSeconds` instead of `timeout` in milliseconds, `task_cancel` answers in plain text, and receipts and failed agent results tell the model what happens next.
+- 50afc41: Allow `eve remote info` to inspect deployments that report retired kernel-effect options, marking those options as unrecognized instead of rejecting the agent-info response.
+- ed2c04b: `ToolContext` now exposes `messages`, the model input for the step that requested the call, so tools can evaluate the conversation that led to them without recording it separately. It matches the `ctx.messages` dynamic resolvers receive at `step.started`.
+- 5a5561a: Tools can now end a turn without a reply. Set `endsTurn: true` on a `defineTool` tool whose action is the whole answer, such as a reaction: once every call in the model's step succeeds, the turn completes with no final message, so channels and schedule sends post nothing. With `true`, eve appends a sentence to the tool's model-facing description saying the call ends the turn; pass a function instead to decide from the `execute` output. The new opt-in `no_reply` tool (`eve add tool/no_reply`, or `noReply()` from `eve/tools/no_reply`) uses it to let the agent stay quiet, for example when a scheduled check finds nothing to report. Slack now clears its thread status when a turn completes.
+- f442363: System instructions now remain available in traces when JSON encoding would otherwise push them over the span attribute size limit.
+- d09e381: The `eve dev` TUI now labels the self-modification subagent as `agent editor` instead of its raw tool name, `self-modification__agent`, and the turn bar reads "Modifying your agent" while it works.
+- 315b353: The `eve dev` terminal UI now shows each task, such as a subagent call, as one line when it starts and one when it finishes, fails, or is stopped, with a panel above the prompt showing what every working task is doing. The transcript no longer jumps or rewrites while tasks work, the model's own `task_wait` and `task_cancel` calls no longer appear in the terminal UI or Slack typing indicators, and tools with a `label` show it instead of their raw arguments.
+- e0ad9a0: The `eve dev` terminal UI now shows text the model writes after a provider-executed tool such as web search in the same model call. Before, the answer after a search was dropped from the transcript even though the agent sent it.
+- bb70743: Workflow tools now wait for approval before starting, and calls denied by a person or policy never run. An approved workflow starts when it is approved.
+- efa0869: A workflow tool's `action.partial` updates now reach the channel adapter, stream-event hooks, and instrumentation, like the events a turn publishes, and the `input.resolved` a session emits when a question raised inside a call is answered or withdrawn now reaches the channel adapter and stream-event hooks. Both were previously written only to the session stream.
+
 ## 0.68.0
 
 ### Minor Changes

package/bin/eve.js

@@ -321,6 +321,17 @@ export async function runEveCli(argv = process.argv.slice(2), overrides = {}, de
   await cliModule.runCli(argv);
 }
 
+/**
+ * Resolves once every write already queued on the stream has been handed to the OS.
+ */
+async function flushWritable(stream) {
+  if (stream.destroyed || stream.writableEnded) {
+    return;
+  }
+
+  await new Promise((resolveFlush) => stream.write("", () => resolveFlush()));
+}
+
 async function isDirectExecution() {
   if (!process.argv[1]) {
     return false;
@@ -354,6 +365,10 @@ if (await isDirectExecution()) {
     }
     process.exitCode = 1;
   } finally {
+    // Pipes and sockets can accept writes asynchronously, and `process.exit`
+    // drops anything still queued, truncating large output such as
+    // `eve info --json` read by a parent Node process.
+    await Promise.all([flushWritable(process.stdout), flushWritable(process.stderr)]);
     // The CLI bootstraps build/dev toolchains that can leave native service
     // handles alive after the command has completed. Once the top-level
     // command resolves, terminate the bin process explicitly so commands like

package/dist/src/_virtual/_rolldown/runtime.js

@@ -1 +1 @@
-import"node:module";var __create=Object.create,__defProp=Object.defineProperty,__getOwnPropDesc=Object.getOwnPropertyDescriptor,__getOwnPropNames=Object.getOwnPropertyNames,__getProtoOf=Object.getPrototypeOf,__hasOwnProp=Object.prototype.hasOwnProperty,__commonJSMin=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),__copyProps=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var i=__getOwnPropNames(t),a=0,o=i.length,s;a<o;a++)s=i[a],!__hasOwnProp.call(e,s)&&s!==n&&__defProp(e,s,{get:(e=>t[e]).bind(null,s),enumerable:!(r=__getOwnPropDesc(t,s))||r.enumerable});return e},__toESM=(e,t,n)=>(n=e==null?{}:__create(__getProtoOf(e)),__copyProps(t||!e||!e.__esModule||!__hasOwnProp.call(e,`default`)?__defProp(n,`default`,{value:e,enumerable:!0}):n,e));export{__commonJSMin,__toESM};
+import"node:module";export{};

package/dist/src/acp/adapter.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{realpath}from"node:fs/promises";import{PROTOCOL_VERSION,RequestError,methods}from"#compiled/@agentclientprotocol/sdk/index.js";import{Client,ClientError}from"#client/index.js";const ANSWER_FIELD=`answer`,ERROR_CODE_EVE=-32002;var EveAcpAdapter=class{#e;#t;#n;#r=!1;#i=new Map;constructor(e){this.#t=e.eveVersion,this.#n=e.workspaceRoot,this.#e=e.client??new Client({auth:e.auth,headers:e.headers,host:e.serverUrl,redirect:`manual`})}initialize(e){return this.#r=e.clientCapabilities?.elicitation?.form!==void 0,{protocolVersion:PROTOCOL_VERSION,agentCapabilities:{loadSession:!1,promptCapabilities:{},sessionCapabilities:{close:{}}},agentInfo:{name:`eve`,title:`eve`,version:this.#t},authMethods:[]}}async newSession(e){if(e.mcpServers.length>0)throw unsupported(`Client-provided MCP servers are not supported by eve ACP mode.`);if((e.additionalDirectories?.length??0)>0)throw unsupported(`Additional workspace directories are not supported by eve ACP mode.`);if(this.#n!==void 0){let t=await normalizedRealpath(e.cwd,`session/new.cwd`),n=await normalizedRealpath(this.#n,`the eve application root`);if(t!==n)throw RequestError.invalidParams({cwd:e.cwd,workspaceRoot:n},`ACP cwd must be the eve application root`)}let t=randomUUID();return this.#i.set(t,{tools:new Map}),{sessionId:t}}async prompt(e,t,n){let r=this.#s(e.sessionId);if(r.active!==void 0)throw new RequestError(-32001,`ACP session ${e.sessionId} already has an active prompt.`);let i=promptContent(e);r.tools.clear();let a=Promise.withResolvers(),o={cancelRequested:!1,protocolCancelled:!1,outboundController:new AbortController,settled:a.promise,resolveSettled:a.resolve};r.active=o;let onProtocolCancel=()=>{o.protocolCancelled=!0,this.#o(r).catch(()=>void 0)};n.aborted?onProtocolCancel():n.addEventListener(`abort`,onProtocolCancel,{once:!0});try{if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});let a={message:i};for(;;){let i;if(r.client===void 0){if(a.message===void 0)throw Error(`ACP session has not started.`);let e=await this.#e.sessions.create({...a,message:a.message});r.client=e.session,i=e.response}else i=a.inputResponses===void 0?await r.client.send(a.message):await r.client.respond(a.inputResponses);(o.cancelRequested||o.protocolCancelled)&&await this.#o(r);let s=[],c=!1,l,u;for await(let n of i){let i=`data`in n&&`turnId`in n.data?n.data.turnId:void 0;typeof i==`string`&&(o.turnId=i),n.type===`input.requested`&&s.push(...n.data.requests),n.type===`authorization.required`&&(u=unsupported(`Connection authorization cannot be completed through eve ACP mode.`)),n.type===`turn.cancelled`&&(c=!0),(n.type===`turn.failed`||n.type===`session.failed`)&&(l=n),await this.#c(e.sessionId,r,n,t)}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(c||o.cancelRequested)return{stopReason:`cancelled`};if(l!==void 0)throw eveFailure(l);if(u!==void 0)throw u;if(s.length===0)return{stopReason:`end_turn`};let d;try{d=await Promise.all(s.map(i=>this.#l(e.sessionId,r,i,t,n)))}catch(t){if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};throw t}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};a={inputResponses:d}}}catch(e){throw acpRequestError(e)}finally{n.removeEventListener(`abort`,onProtocolCancel),r.tools.clear(),o.resolveSettled(),r.active===o&&(r.active=void 0)}}async cancel(e){let t=this.#i.get(e);t!==void 0&&t.active!==void 0&&(t.active.cancelRequested=!0,await this.#o(t))}async closeSession(e){let t=this.#s(e);this.#i.delete(e),await this.#a(t)}async close(){let e=[...this.#i.values()];this.#i.clear(),await Promise.allSettled(e.map(e=>this.#a(e)))}async#a(e){let t;if(e.active!==void 0){let n=e.active;n.cancelRequested=!0;try{await this.#o(e)}catch(e){t=e}await n.settled}try{await e.client?.reset()}catch(e){throw t===void 0?e:AggregateError([t,e],`Could not cancel or reset the eve session`)}if(t!==void 0)throw t}async#o(e){e.active?.outboundController.abort(),e.client!==void 0&&await e.client.cancel(e.active?.turnId===void 0?void 0:{turnId:e.active.turnId})}#s(e){let t=this.#i.get(e);if(t===void 0)throw RequestError.invalidParams({sessionId:e},`Unknown or closed ACP session`);return t}async#c(e,t,n,r){switch(n.type){case`message.appended`:await notifyUpdate(r,e,{sessionUpdate:`agent_message_chunk`,content:{type:`text`,text:n.data.messageDelta},messageId:`${n.data.turnId}:message:${n.data.stepIndex}`});return;case`reasoning.appended`:await notifyUpdate(r,e,{sessionUpdate:`agent_thought_chunk`,content:{type:`text`,text:n.data.reasoningDelta},messageId:`${n.data.turnId}:thought:${n.data.stepIndex}`});return;case`actions.requested`:for(let i of n.data.actions){let n=toolCallForAction(i);t.tools.set(i.callId,n),await notifyUpdate(r,e,{sessionUpdate:`tool_call`,...n})}return;case`action.result`:{let t=n.data.result,i=n.data.status!==`completed`||t.isError?`failed`:`completed`;await notifyUpdate(r,e,{sessionUpdate:`tool_call_update`,toolCallId:t.callId,status:i,content:[{type:`content`,content:{type:`text`,text:stringifyOutput(t.output)}}],rawOutput:t.output});return}default:return}}async#l(e,t,n,r,i){let a=AbortSignal.any([i,t.active.outboundController.signal]);if(n.display===`confirmation`){let i=`${n.requestId}:approve`,o=`${n.requestId}:deny`,s=t.tools.get(n.action.callId)??toolCallForAction(n.action),c=await r.request(methods.client.session.requestPermission,{sessionId:e,toolCall:s,options:[{kind:`allow_once`,name:`Approve`,optionId:i},{kind:`reject_once`,name:`Deny`,optionId:o}]},{cancellationSignal:a});if(c.outcome.outcome===`cancelled`)return this.#u(t),{requestId:n.requestId};if(c.outcome.optionId===i)return{requestId:n.requestId,optionId:`approve`};if(c.outcome.optionId===o)return{requestId:n.requestId,optionId:`deny`};throw RequestError.invalidParams({optionId:c.outcome.optionId},`Unknown ACP permission option`)}if(!this.#r)throw unsupported(`The ACP client does not support form elicitation required by this eve question.`);let o=elicitationProperty(n),s=await r.request(methods.client.elicitation.create,{mode:`form`,sessionId:e,message:n.prompt,requestedSchema:{type:`object`,properties:{[ANSWER_FIELD]:o},required:[ANSWER_FIELD]}},{cancellationSignal:a});if(s.action!==`accept`)return this.#u(t),{requestId:n.requestId};let c=s.content?.[ANSWER_FIELD];if(typeof c!=`string`)throw RequestError.invalidParams(s.content,`ACP elicitation response must contain a string answer`);if(n.display===`select`){if(!n.options?.some(e=>e.id===c))throw RequestError.invalidParams({answer:c},`Unknown eve question option`);return{requestId:n.requestId,optionId:c}}return{requestId:n.requestId,text:c}}#u(e){let t=e.active;t.cancelRequested=!0,t.outboundController.abort()}};async function normalizedRealpath(e,t){try{return await realpath(e)}catch(n){throw RequestError.invalidParams({path:e},`Could not resolve ${t}: ${errorMessage(n)}`)}}function promptContent(e){let t=e.prompt.map(e=>{if(e.type!==`text`)throw unsupported(`ACP prompt content type ${JSON.stringify(e.type)} is not supported.`);return{type:`text`,text:e.text}});if(t.every(e=>e.text.length===0))throw RequestError.invalidParams(e.prompt,`ACP prompt must contain at least one non-empty text block`);return t}function toolCallForAction(e){let t=e.kind===`tool-call`||e.kind===`workflow-tool-call`?e.toolName:e.kind===`load-skill`?`Load skill`:e.name;return{toolCallId:e.callId,title:t,kind:`other`,status:`pending`,rawInput:e.input}}function elicitationProperty(e){if(e.display===`select`&&e.allowFreeform!==!0&&e.options?.length)return{type:`string`,title:e.prompt,oneOf:e.options.map(e=>({const:e.id,title:e.label,description:e.description}))};if(e.display===`text`&&e.allowFreeform!==!1)return{type:`string`,title:e.prompt,minLength:1};throw unsupported(`This eve question shape cannot be represented by ACP form elicitation.`)}async function notifyUpdate(e,t,n){await e.notify(methods.client.session.update,{sessionId:t,update:n})}function stringifyOutput(e){return typeof e==`string`?e:JSON.stringify(e,null,2)}function unsupported(e){return new RequestError(-32003,e)}function eveFailure(e){return new RequestError(ERROR_CODE_EVE,e.data.message,{code:e.data.code,details:e.data.details})}function acpRequestError(e){return e instanceof RequestError?e:e instanceof ClientError?new RequestError(ERROR_CODE_EVE,e.message,{httpStatus:e.status}):new RequestError(ERROR_CODE_EVE,errorMessage(e))}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{EveAcpAdapter};
+import{randomUUID}from"node:crypto";import{realpath}from"node:fs/promises";import{PROTOCOL_VERSION,RequestError,methods}from"#compiled/@agentclientprotocol/sdk/index.js";import{Client,ClientError}from"#client/index.js";const ANSWER_FIELD=`answer`,ERROR_CODE_EVE=-32002;var EveAcpAdapter=class{#e;#t;#n;#r=!1;#i=new Map;constructor(e){this.#t=e.eveVersion,this.#n=e.workspaceRoot,this.#e=e.client??new Client({auth:e.auth,headers:e.headers,host:e.serverUrl,redirect:`manual`})}initialize(e){return this.#r=e.clientCapabilities?.elicitation?.form!==void 0,{protocolVersion:PROTOCOL_VERSION,agentCapabilities:{loadSession:!1,promptCapabilities:{},sessionCapabilities:{close:{}}},agentInfo:{name:`eve`,title:`eve`,version:this.#t},authMethods:[]}}async newSession(e){if(e.mcpServers.length>0)throw unsupported(`Client-provided MCP servers are not supported by eve ACP mode.`);if((e.additionalDirectories?.length??0)>0)throw unsupported(`Additional workspace directories are not supported by eve ACP mode.`);if(this.#n!==void 0){let t=await normalizedRealpath(e.cwd,`session/new.cwd`),n=await normalizedRealpath(this.#n,`the eve application root`);if(t!==n)throw RequestError.invalidParams({cwd:e.cwd,workspaceRoot:n},`ACP cwd must be the eve application root`)}let t=randomUUID();return this.#i.set(t,{tools:new Map}),{sessionId:t}}async prompt(e,t,n){let r=this.#s(e.sessionId);if(r.active!==void 0)throw new RequestError(-32001,`ACP session ${e.sessionId} already has an active prompt.`);let i=promptContent(e);r.tools.clear();let a=Promise.withResolvers(),o={cancelRequested:!1,protocolCancelled:!1,outboundController:new AbortController,settled:a.promise,resolveSettled:a.resolve};r.active=o;let onProtocolCancel=()=>{o.protocolCancelled=!0,this.#o(r).catch(()=>void 0)};n.aborted?onProtocolCancel():n.addEventListener(`abort`,onProtocolCancel,{once:!0});try{if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});let a={message:i};for(;;){let i;if(r.client===void 0){if(a.message===void 0)throw Error(`ACP session has not started.`);let e=await this.#e.sessions.create({...a,message:a.message});r.client=e.session,i=e.response}else i=a.inputResponses===void 0?await r.client.send(a.message):await r.client.respond(a.inputResponses);(o.cancelRequested||o.protocolCancelled)&&await this.#o(r);let s=[],c=!1,l,u;for await(let n of i){let i=`data`in n?n.data:void 0,a=i!==void 0&&`turnId`in i?i.turnId:void 0;typeof a==`string`&&(o.turnId=a),n.type===`input.requested`&&s.push(...n.data.requests),n.type===`authorization.required`&&(u=unsupported(`Connection authorization cannot be completed through eve ACP mode.`)),n.type===`turn.cancelled`&&(c=!0),(n.type===`turn.failed`||n.type===`session.failed`)&&(l=n),await this.#c(e.sessionId,r,n,t)}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(c||o.cancelRequested)return{stopReason:`cancelled`};if(l!==void 0)throw eveFailure(l);if(u!==void 0)throw u;if(s.length===0)return{stopReason:`end_turn`};let d;try{d=await Promise.all(s.map(i=>this.#l(e.sessionId,r,i,t,n)))}catch(t){if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};throw t}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};a={inputResponses:d}}}catch(e){throw acpRequestError(e)}finally{n.removeEventListener(`abort`,onProtocolCancel),r.tools.clear(),o.resolveSettled(),r.active===o&&(r.active=void 0)}}async cancel(e){let t=this.#i.get(e);t!==void 0&&t.active!==void 0&&(t.active.cancelRequested=!0,await this.#o(t))}async closeSession(e){let t=this.#s(e);this.#i.delete(e),await this.#a(t)}async close(){let e=[...this.#i.values()];this.#i.clear(),await Promise.allSettled(e.map(e=>this.#a(e)))}async#a(e){let t;if(e.active!==void 0){let n=e.active;n.cancelRequested=!0;try{await this.#o(e)}catch(e){t=e}await n.settled}try{await e.client?.reset()}catch(e){throw t===void 0?e:AggregateError([t,e],`Could not cancel or reset the eve session`)}if(t!==void 0)throw t}async#o(e){e.active?.outboundController.abort(),e.client!==void 0&&await e.client.cancel(e.active?.turnId===void 0?void 0:{turnId:e.active.turnId})}#s(e){let t=this.#i.get(e);if(t===void 0)throw RequestError.invalidParams({sessionId:e},`Unknown or closed ACP session`);return t}async#c(e,t,n,r){switch(n.type){case`message.appended`:await notifyUpdate(r,e,{sessionUpdate:`agent_message_chunk`,content:{type:`text`,text:n.data.messageDelta},messageId:`${n.data.turnId}:message:${n.data.stepIndex}`});return;case`reasoning.appended`:await notifyUpdate(r,e,{sessionUpdate:`agent_thought_chunk`,content:{type:`text`,text:n.data.reasoningDelta},messageId:`${n.data.turnId}:thought:${n.data.stepIndex}`});return;case`actions.requested`:for(let i of n.data.actions){let n=toolCallForAction(i);t.tools.set(i.callId,n),await notifyUpdate(r,e,{sessionUpdate:`tool_call`,...n})}return;case`action.result`:{let t=n.data.result,i=n.data.status!==`completed`||t.isError?`failed`:`completed`;await notifyUpdate(r,e,{sessionUpdate:`tool_call_update`,toolCallId:t.callId,status:i,content:[{type:`content`,content:{type:`text`,text:stringifyOutput(t.output)}}],rawOutput:t.output});return}default:return}}async#l(e,t,n,r,i){let a=AbortSignal.any([i,t.active.outboundController.signal]);if(n.display===`confirmation`){let i=`${n.requestId}:approve`,o=`${n.requestId}:deny`,s=t.tools.get(n.action.callId)??toolCallForAction(n.action),c=await r.request(methods.client.session.requestPermission,{sessionId:e,toolCall:s,options:[{kind:`allow_once`,name:`Approve`,optionId:i},{kind:`reject_once`,name:`Deny`,optionId:o}]},{cancellationSignal:a});if(c.outcome.outcome===`cancelled`)return this.#u(t),{requestId:n.requestId};if(c.outcome.optionId===i)return{requestId:n.requestId,optionId:`approve`};if(c.outcome.optionId===o)return{requestId:n.requestId,optionId:`deny`};throw RequestError.invalidParams({optionId:c.outcome.optionId},`Unknown ACP permission option`)}if(!this.#r)throw unsupported(`The ACP client does not support form elicitation required by this eve question.`);let o=elicitationProperty(n),s=await r.request(methods.client.elicitation.create,{mode:`form`,sessionId:e,message:n.prompt,requestedSchema:{type:`object`,properties:{[ANSWER_FIELD]:o},required:[ANSWER_FIELD]}},{cancellationSignal:a});if(s.action!==`accept`)return this.#u(t),{requestId:n.requestId};let c=s.content?.[ANSWER_FIELD];if(typeof c!=`string`)throw RequestError.invalidParams(s.content,`ACP elicitation response must contain a string answer`);if(n.display===`select`){if(!n.options?.some(e=>e.id===c))throw RequestError.invalidParams({answer:c},`Unknown eve question option`);return{requestId:n.requestId,optionId:c}}return{requestId:n.requestId,text:c}}#u(e){let t=e.active;t.cancelRequested=!0,t.outboundController.abort()}};async function normalizedRealpath(e,t){try{return await realpath(e)}catch(n){throw RequestError.invalidParams({path:e},`Could not resolve ${t}: ${errorMessage(n)}`)}}function promptContent(e){let t=e.prompt.map(e=>{if(e.type!==`text`)throw unsupported(`ACP prompt content type ${JSON.stringify(e.type)} is not supported.`);return{type:`text`,text:e.text}});if(t.every(e=>e.text.length===0))throw RequestError.invalidParams(e.prompt,`ACP prompt must contain at least one non-empty text block`);return t}function toolCallForAction(e){let t=e.kind===`tool-call`||e.kind===`workflow-tool-call`?e.toolName:e.kind===`load-skill`?`Load skill`:e.name;return{toolCallId:e.callId,title:t,kind:`other`,status:`pending`,rawInput:e.input}}function elicitationProperty(e){if(e.display===`select`&&e.allowFreeform!==!0&&e.options?.length)return{type:`string`,title:e.prompt,oneOf:e.options.map(e=>({const:e.id,title:e.label,description:e.description}))};if(e.display===`text`&&e.allowFreeform!==!1)return{type:`string`,title:e.prompt,minLength:1};throw unsupported(`This eve question shape cannot be represented by ACP form elicitation.`)}async function notifyUpdate(e,t,n){await e.notify(methods.client.session.update,{sessionId:t,update:n})}function stringifyOutput(e){return typeof e==`string`?e:JSON.stringify(e,null,2)}function unsupported(e){return new RequestError(-32003,e)}function eveFailure(e){return new RequestError(ERROR_CODE_EVE,e.data.message,{code:e.data.code,details:e.data.details})}function acpRequestError(e){return e instanceof RequestError?e:e instanceof ClientError?new RequestError(ERROR_CODE_EVE,e.message,{httpStatus:e.status}):new RequestError(ERROR_CODE_EVE,errorMessage(e))}function errorMessage(e){return e instanceof Error?e.message:String(e)}export{EveAcpAdapter};

package/dist/src/approval/definition.d.ts

@@ -38,6 +38,13 @@ export type ApprovalPolicy<TInput = Record<string, unknown>> = (ctx: ApprovalCon
 export interface ApprovalRequest<TInput = Record<string, unknown>> {
     readonly callId: string;
     readonly requestId: string;
+    /**
+     * Who requested the tool call: the auth of the caller whose turn made it,
+     * captured when the approval was requested. It stays the same while the
+     * request is pending, however many people continue the session, and is
+     * `null` when that caller was unauthenticated or anonymous.
+     */
+    readonly principal: SessionAuthContext | null;
     readonly toolInput?: ApprovalToolInput<TInput>;
     readonly toolName: string;
 }
@@ -53,26 +60,33 @@ export interface ApprovalResponseAuth {
     getToken(provider: ToolAuthProvider, options?: ToolAuthOptions): Promise<TokenResult>;
     requireAuth(provider: ToolAuthProvider, options?: ToolAuthOptions): never;
 }
-/** Submitted decision passed to an approval response policy. */
+/** Submitted response passed to an approval response policy. */
 export interface ApprovalResponse {
-    readonly decision: "approve";
+    readonly decision: "approve" | "cancel";
+    /**
+     * Who submitted the response: the authenticated principal, including its
+     * `principalId`, `principalType`, `authenticator`, and `attributes`.
+     */
+    readonly principal: SessionAuthContext;
 }
 /** Context passed to an approval response policy. */
 export interface ApprovalResponseContext<TInput = Record<string, unknown>> {
     readonly auth: ApprovalResponseAuth;
     readonly request: ApprovalRequest<TInput>;
     readonly response: ApprovalResponse;
-    readonly responder: SessionAuthContext;
     readonly session: ApprovalResponseSession;
 }
-/** Response policy decision. Rejection keeps the shared request pending. */
+/**
+ * Response policy decision. Rejection keeps the shared request pending, so
+ * another responder can still settle it.
+ */
 export type ApprovalResponseDecision = {
     readonly status: "allowed";
 } | {
     readonly reason: string;
     readonly status: "rejected";
 };
-/** Decides whether an authenticated responder may approve one request. */
+/** Decides whether an authenticated responder may approve or cancel one request. */
 export type ApprovalResponsePolicy<TInput = Record<string, unknown>> = (ctx: ApprovalResponseContext<TInput>) => ApprovalResponseDecision | Promise<ApprovalResponseDecision>;
 /** Approval definition with request- and response-time policy. */
 export interface ApprovalConfiguration<TInput = Record<string, unknown>> {

package/dist/src/channel/adapter.d.ts

@@ -34,6 +34,8 @@ export interface ChannelAdapterContext<TState = Record<string, unknown>> {
      * Live handle to the current session.
      */
     readonly session: SessionHandle;
+    /** @internal Independent source of a relayed child input batch. */
+    readonly inputSource?: string;
 }
 /**
  * Extracts the state type from a {@link ChannelAdapterContext} generic.

package/dist/src/channel/auth/oidc.js

@@ -1 +1 @@
-import{z}from"#compiled/zod/index.js";import{createRemoteJWKSet,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#channel/auth/token-claims.js";import{isVercelOidcIssuer}from"#shared/vercel-project.js";const oidcDiscoveryDocumentSchema=z.object({issuer:z.string().optional(),jwks_uri:z.string().url()}).passthrough(),oidcDiscoveryDocumentCache=new Map,oidcJwksCache=new Map;async function authenticateOidcStrategy(e){let t;try{t=await getOidcRemoteJwks(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to load OIDC discovery metadata. ${e instanceof Error?e.message:`Unknown discovery failure.`}`}}try{let n=await jwtVerify(e.token,t,{audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});if(e.strategy.acceptCurrentVercelProject&&isVercelOidcIssuer(e.strategy.issuer)&&n.payload.external_sub!==void 0)return typeof n.payload.external_sub!=`string`||n.payload.external_sub.length===0||!currentVercelProjectMatches({payload:n.payload,strategy:e.strategy})||!currentVercelEnvironmentMatches({payload:n.payload,strategy:e.strategy})?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,issuerClaims:[`external_iss`,`connector_id`],payload:n.payload,principalType:`user`,subjectClaim:`external_sub`})};if(e.strategy.acceptCurrentVercelProject&&isVercelOidcIssuer(e.strategy.issuer)&&n.payload.user_id!==void 0){if(typeof n.payload.user_id!=`string`||n.payload.user_id.length===0||n.payload.environment!==`development`||!currentVercelProjectMatches({payload:n.payload,strategy:e.strategy}))return{kind:`caller-not-allowed`};if(currentVercelEnvironmentMatches({payload:n.payload,strategy:e.strategy}))return{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:n.payload,principalType:`user`,subjectClaim:`user_id`})}}if(typeof n.payload.sub!=`string`||n.payload.sub.length===0)return{kind:`not-authenticated`};let r=e.strategy.acceptCurrentVercelProject&&isCurrentVercelProjectToken({issuer:e.strategy.issuer,payload:n.payload,strategy:e.strategy}),i=r&&isCurrentVercelEnvironmentToken({payload:n.payload,strategy:e.strategy});return!r&&!areTokenClaimMatchersSatisfied(n.payload,e.strategy)?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:n.payload,principalType:i?`runtime`:`service`})}}catch{return{kind:`not-authenticated`}}}async function getOidcRemoteJwks(e){let t=await getOidcDiscoveryDocument(e.discoveryUrl),n=oidcJwksCache.get(t.jwks_uri);if(n!==void 0)return n;let r=createRemoteJWKSet(new URL(t.jwks_uri));return oidcJwksCache.set(t.jwks_uri,r),r}async function getOidcDiscoveryDocument(e){let t=oidcDiscoveryDocumentCache.get(e);if(t!==void 0)return await t;let n=fetch(e,{headers:{accept:`application/json`}}).then(async e=>{if(!e.ok)throw Error(`Discovery route returned HTTP ${e.status}.`);return oidcDiscoveryDocumentSchema.parse(await e.json())}).catch(t=>{throw oidcDiscoveryDocumentCache.delete(e),t});return oidcDiscoveryDocumentCache.set(e,n),await n}function isCurrentVercelProjectToken(e){if(!isVercelOidcIssuer(e.issuer))return!1;let t=e.strategy.currentVercelProject;return t!==void 0&&typeof e.payload.project_id==`string`&&e.payload.project_id===t.projectId}function currentVercelProjectMatches(e){let t=e.strategy.currentVercelProject;return t!==void 0&&typeof e.payload.project_id==`string`&&e.payload.project_id===t.projectId}function isCurrentVercelEnvironmentToken(e){let t=e.strategy.currentVercelProject?.environment;return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}function currentVercelEnvironmentMatches(e){let t=e.strategy.currentVercelProject?.environment;return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}export{authenticateOidcStrategy};
+import{createRemoteJWKSet,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#channel/auth/token-claims.js";import{z}from"#compiled/zod/index.js";import{isVercelOidcIssuer}from"#shared/vercel-project.js";const oidcDiscoveryDocumentSchema=z.object({issuer:z.string().optional(),jwks_uri:z.string().url()}).passthrough(),oidcDiscoveryDocumentCache=new Map,oidcJwksCache=new Map;async function authenticateOidcStrategy(e){let t;try{t=await getOidcRemoteJwks(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to load OIDC discovery metadata. ${e instanceof Error?e.message:`Unknown discovery failure.`}`}}try{let n=await jwtVerify(e.token,t,{audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});if(e.strategy.acceptCurrentVercelProject&&isVercelOidcIssuer(e.strategy.issuer)&&n.payload.external_sub!==void 0)return typeof n.payload.external_sub!=`string`||n.payload.external_sub.length===0||!currentVercelProjectMatches({payload:n.payload,strategy:e.strategy})||!currentVercelEnvironmentMatches({payload:n.payload,strategy:e.strategy})?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,issuerClaims:[`external_iss`,`connector_id`],payload:n.payload,principalType:`user`,subjectClaim:`external_sub`})};if(e.strategy.acceptCurrentVercelProject&&isVercelOidcIssuer(e.strategy.issuer)&&n.payload.user_id!==void 0){if(typeof n.payload.user_id!=`string`||n.payload.user_id.length===0||n.payload.environment!==`development`||!currentVercelProjectMatches({payload:n.payload,strategy:e.strategy}))return{kind:`caller-not-allowed`};if(currentVercelEnvironmentMatches({payload:n.payload,strategy:e.strategy}))return{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:n.payload,principalType:`user`,subjectClaim:`user_id`})}}if(typeof n.payload.sub!=`string`||n.payload.sub.length===0)return{kind:`not-authenticated`};let r=e.strategy.acceptCurrentVercelProject&&isCurrentVercelProjectToken({issuer:e.strategy.issuer,payload:n.payload,strategy:e.strategy}),i=r&&isCurrentVercelEnvironmentToken({payload:n.payload,strategy:e.strategy});return!r&&!areTokenClaimMatchersSatisfied(n.payload,e.strategy)?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:n.payload,principalType:i?`runtime`:`service`})}}catch{return{kind:`not-authenticated`}}}async function getOidcRemoteJwks(e){let t=await getOidcDiscoveryDocument(e.discoveryUrl),n=oidcJwksCache.get(t.jwks_uri);if(n!==void 0)return n;let r=createRemoteJWKSet(new URL(t.jwks_uri));return oidcJwksCache.set(t.jwks_uri,r),r}async function getOidcDiscoveryDocument(e){let t=oidcDiscoveryDocumentCache.get(e);if(t!==void 0)return await t;let n=fetch(e,{headers:{accept:`application/json`}}).then(async e=>{if(!e.ok)throw Error(`Discovery route returned HTTP ${e.status}.`);return oidcDiscoveryDocumentSchema.parse(await e.json())}).catch(t=>{throw oidcDiscoveryDocumentCache.delete(e),t});return oidcDiscoveryDocumentCache.set(e,n),await n}function isCurrentVercelProjectToken(e){if(!isVercelOidcIssuer(e.issuer))return!1;let t=e.strategy.currentVercelProject;return t!==void 0&&typeof e.payload.project_id==`string`&&e.payload.project_id===t.projectId}function currentVercelProjectMatches(e){let t=e.strategy.currentVercelProject;return t!==void 0&&typeof e.payload.project_id==`string`&&e.payload.project_id===t.projectId}function isCurrentVercelEnvironmentToken(e){let t=e.strategy.currentVercelProject?.environment;return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}function currentVercelEnvironmentMatches(e){let t=e.strategy.currentVercelProject?.environment;return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}export{authenticateOidcStrategy};

package/dist/src/channel/channel-address.d.ts

@@ -3,14 +3,13 @@ import type { ChannelAdapter } from "#channel/adapter.js";
 import { type ChannelDeliverySource } from "#channel/delivery-metadata.js";
 import type { SendPayload } from "#channel/routes.js";
 import { type Session } from "#channel/session.js";
-import type { CancelTurnResult, ClearSessionResult, CompactSessionResult, ResetSessionResult, Runtime, SessionAuthContext, SessionCallback, TurnPolicy, TaskDeliveryPolicy } from "#channel/types.js";
+import type { CancelTurnResult, ClearSessionResult, CompactSessionResult, ResetSessionResult, Runtime, SessionAuthContext, SessionCallback, TurnPolicy } from "#channel/types.js";
 interface BaseChannelAddressDeliveryOptions {
     readonly auth: SessionAuthContext | null;
     readonly callback?: SessionCallback;
     readonly initiatorAuth?: SessionAuthContext | null;
     readonly title?: string;
     readonly turnPolicy?: TurnPolicy;
-    readonly taskDeliveryPolicy?: TaskDeliveryPolicy;
 }
 /** Delivery options for a channel address whose continuation token is already bound. */
 export type ChannelAddressDeliveryOptions<TState = undefined> = [TState] extends [undefined] ? BaseChannelAddressDeliveryOptions : BaseChannelAddressDeliveryOptions & {
@@ -45,7 +44,6 @@ export declare function createChannelAddress<TState = undefined>(input: {
     readonly metadata?: ChannelDeliverySource;
     readonly runtime: Runtime;
     readonly turnPolicy?: TurnPolicy;
-    readonly taskDeliveryPolicy?: TaskDeliveryPolicy;
 }): ChannelAddress<TState>;
 /** Builds a request-scoped factory for channel addresses on one authored channel. */
 export declare function createChannelAddressFn<TState = undefined>(input: {
@@ -54,6 +52,5 @@ export declare function createChannelAddressFn<TState = undefined>(input: {
     readonly metadata?: ChannelDeliverySource;
     readonly runtime: Runtime;
     readonly turnPolicy?: TurnPolicy;
-    readonly taskDeliveryPolicy?: TaskDeliveryPolicy;
 }): ChannelAddressFn<TState>;
 export {};

package/dist/src/channel/channel-address.js

@@ -1 +1 @@
-import{createSession,sessionCallbackToTurnCaller}from"#channel/session.js";import{copyChannelActivityPresentation}from"#channel/activity-renderer.js";import{createChannelDeliveryMetadata}from"#channel/delivery-metadata.js";import{normalizeSendInput,serializeUrlFilePartsInMessage}from"#channel/send-input.js";import{DEFAULT_TURN_POLICY}from"#channel/types.js";import{isReservedSessionCommandToken}from"#execution/session-inbox/address.js";function createChannelAddress(e){let t=e.metadata??{},n=`${e.channelName}:${e.continuationToken}`;if(isReservedSessionCommandToken(n))throw Error(`Channel address "${n}" uses eve's reserved session namespace.`);return{continuationToken:e.continuationToken,async deliver(r,i){let a=t.channelKind!==void 0&&t.channelName!==void 0?createChannelDeliveryMetadata(t):void 0,o=normalizeSendInput(r),s=sessionCallbackToTurnCaller(i.callback),c=i.taskDeliveryPolicy??e.taskDeliveryPolicy,l={taskDeliveryPolicy:c,auth:i.auth,delivery:a,kind:`send`,payload:{...o,message:serializeUrlFilePartsInMessage(o.message)},requestId:t.requestId,turnPolicy:o.message===void 0?void 0:i.turnPolicy??e.turnPolicy??DEFAULT_TURN_POLICY},u=s===void 0?l:{...l,caller:s},d=await(async()=>{let r=await e.runtime.dispatchContinuation({command:u,continuationToken:n});return r.status===`accepted`?createSession(r.sessionId,e.runtime,{...t,turnPolicy:e.turnPolicy}):void 0})();if(d!==void 0)return d;if(o.inputResponses&&o.inputResponses.length>0)throw Error(`Cannot deliver inputResponses — the target session was not found via continuation token.`);let f=i.state,p=f===void 0?e.adapter:{...e.adapter,state:{...e.adapter.state,...f}};p!==e.adapter&&copyChannelActivityPresentation(e.adapter,p);let m={taskDeliveryPolicy:c,adapter:p,auth:i.auth,capabilities:{requestInput:!0},callback:i.callback,channelName:e.channelName,continuationConflictCommand:u,continuationToken:n,delivery:a,initiatorAuth:i.initiatorAuth,input:{context:o.context,message:serializeUrlFilePartsInMessage(o.message)??``,outputSchema:o.outputSchema},requestId:t.requestId,title:i.title},h=await e.runtime.createSession(m);return createSession(h.sessionId,e.runtime,{...t,turnPolicy:e.turnPolicy})},async send(e,t){return await this.deliver({message:e},t)},async respond(e,t){if(e===void 0||e.length===0)throw Error(`respond() requires at least one input response.`);return await this.deliver({inputResponses:e},t)},async cancel(t){return await e.runtime.dispatchContinuation({command:{kind:`cancel`,turnId:t?.turnId},continuationToken:n})},async compact(){return await e.runtime.dispatchContinuation({command:{kind:`compact`},continuationToken:n})},async clear(){return await e.runtime.dispatchContinuation({command:{kind:`clear`},continuationToken:n})},async reset(t){return await e.runtime.dispatchContinuation({command:{kind:`reset`,reason:t?.reason},continuationToken:n})},async resolveSession(){let r=await e.runtime.resolveContinuation(n);return r===void 0?void 0:createSession(r.sessionId,e.runtime,{...t,turnPolicy:e.turnPolicy})}}}function createChannelAddressFn(e){return t=>createChannelAddress({...e,continuationToken:t})}export{createChannelAddress,createChannelAddressFn};
+import{createSession,sessionCallbackToTurnCaller}from"#channel/session.js";import{createChannelDeliveryMetadata}from"#channel/delivery-metadata.js";import{normalizeSendInput,serializeUrlFilePartsInMessage}from"#channel/send-input.js";import{DEFAULT_TURN_POLICY}from"#channel/types.js";import{isReservedSessionCommandToken}from"#execution/session-inbox/address.js";function createChannelAddress(e){let t=e.metadata??{},n=`${e.channelName}:${e.continuationToken}`;if(isReservedSessionCommandToken(n))throw Error(`Channel address "${n}" uses eve's reserved session namespace.`);return{continuationToken:e.continuationToken,async deliver(r,i){let a=t.channelKind!==void 0&&t.channelName!==void 0?createChannelDeliveryMetadata(t):void 0,o=normalizeSendInput(r),s=sessionCallbackToTurnCaller(i.callback),c={auth:i.auth,delivery:a,kind:`send`,payload:{...o,message:serializeUrlFilePartsInMessage(o.message)},requestId:t.requestId,turnPolicy:o.message===void 0?void 0:i.turnPolicy??e.turnPolicy??DEFAULT_TURN_POLICY},l=s===void 0?c:{...c,caller:s},u=await(async()=>{let r=await e.runtime.dispatchContinuation({command:l,continuationToken:n});return r.status===`accepted`?createSession(r.sessionId,e.runtime,{...t,turnPolicy:e.turnPolicy}):void 0})();if(u!==void 0)return u;if(o.inputResponses&&o.inputResponses.length>0)throw Error(`Cannot deliver inputResponses — the target session was not found via continuation token.`);let d=i.state,f={adapter:d===void 0?e.adapter:{...e.adapter,state:{...e.adapter.state,...d}},auth:i.auth,capabilities:{requestInput:!0},callback:i.callback,channelName:e.channelName,continuationConflictCommand:l,continuationToken:n,delivery:a,initiatorAuth:i.initiatorAuth,input:{context:o.context,message:serializeUrlFilePartsInMessage(o.message)??``,outputSchema:o.outputSchema,state:o.state},requestId:t.requestId,title:i.title},p=await e.runtime.createSession(f);return createSession(p.sessionId,e.runtime,{...t,turnPolicy:e.turnPolicy})},async send(e,t){return await this.deliver({message:e},t)},async respond(e,t){if(e===void 0||e.length===0)throw Error(`respond() requires at least one input response.`);return await this.deliver({inputResponses:e},t)},async cancel(t){return await e.runtime.dispatchContinuation({command:{kind:`cancel`,turnId:t?.turnId},continuationToken:n})},async compact(){return await e.runtime.dispatchContinuation({command:{kind:`compact`},continuationToken:n})},async clear(){return await e.runtime.dispatchContinuation({command:{kind:`clear`},continuationToken:n})},async reset(t){return await e.runtime.dispatchContinuation({command:{kind:`reset`,reason:t?.reason},continuationToken:n})},async resolveSession(){let r=await e.runtime.resolveContinuation(n);return r===void 0?void 0:createSession(r.sessionId,e.runtime,{...t,turnPolicy:e.turnPolicy})}}}function createChannelAddressFn(e){return t=>createChannelAddress({...e,continuationToken:t})}export{createChannelAddress,createChannelAddressFn};

package/dist/src/channel/channel-operations.d.ts

@@ -1,20 +1,19 @@
 import type { UserContent } from "ai";
 import type { ChannelAdapter } from "#channel/adapter.js";
 import type { ChannelDeliverySource } from "#channel/delivery-metadata.js";
-import { type ChannelAddressDeliveryOptions } from "#channel/channel-address.js";
-import type { SendPayload } from "#channel/routes.js";
 import type { Session } from "#channel/session.js";
-import type { CancelTurnResult, ClearSessionResult, CompactSessionResult, ResetSessionResult, Runtime, SessionAuthContext, SessionCallback, TurnPolicy, TaskDeliveryPolicy } from "#channel/types.js";
+import type { CancelTurnResult, ClearSessionResult, CompactSessionResult, ResetSessionResult, Runtime, SessionAuthContext, SessionCallback, TurnPolicy } from "#channel/types.js";
 import { type InputResponse, type StrictInputResponses } from "#shared/input.js";
+import type { JsonObject } from "#shared/json.js";
 interface BaseChannelSendOptions {
     readonly auth: SessionAuthContext | null;
     readonly callback?: SessionCallback;
     readonly context?: readonly string[];
     readonly initiatorAuth?: SessionAuthContext | null;
+    /** JSON Schema for a structured final answer, as on `Session.send()`. */
+    readonly outputSchema?: JsonObject;
     readonly title?: string;
     readonly turnPolicy?: TurnPolicy;
-    /** Updates the session policy; omission preserves it. New sessions default to auto, schedules to cohort. */
-    readonly taskDeliveryPolicy?: TaskDeliveryPolicy;
 }
 /** Options for sending a message from a channel-local continuation address. */
 export type ChannelSendOptions<TState = undefined> = [TState] extends [undefined] ? BaseChannelSendOptions : BaseChannelSendOptions & {
@@ -55,11 +54,6 @@ export interface ChannelReceiveContext<TState = undefined> {
     readonly from: ChannelFrom<TState>;
     readonly resolveSession: ChannelResolveSession;
 }
-export declare const INTERNAL_CHANNEL_DELIVER: unique symbol;
-/** @internal Permissive transport delivery retained below public authoring surfaces. */
-export interface InternalChannelSource<TState = undefined> extends ChannelSource<TState> {
-    [INTERNAL_CHANNEL_DELIVER](payload: SendPayload, options: ChannelAddressDeliveryOptions<TState>): Promise<Session>;
-}
 /** Creates request-scoped channel operations backed by continuation dispatch. */
 export declare function createChannelOperations<TState = undefined>(input: {
     readonly adapter: ChannelAdapter<any>;
@@ -67,6 +61,5 @@ export declare function createChannelOperations<TState = undefined>(input: {
     readonly metadata?: ChannelDeliverySource;
     readonly runtime: Runtime;
     readonly turnPolicy?: TurnPolicy;
-    readonly taskDeliveryPolicy?: TaskDeliveryPolicy;
 }): ChannelReceiveContext<TState>;
 export {};

package/dist/src/channel/channel-operations.js

@@ -1 +1 @@
-import{createChannelAddressFn}from"#channel/channel-address.js";import{parseInputResponses}from"#shared/input.js";const INTERNAL_CHANNEL_DELIVER=Symbol(`eve.internal.channel-deliver`);function createChannelOperations(e){let t=createChannelAddressFn(e);return{from(e){let n=t(e);return{async send(e,t){return await n.deliver({context:t.context,message:e},t)},async respond(e,t){if(e.length===0)throw Error(`respond() requires at least one input response.`);let r=parseInputResponses(e);return await n.deliver({context:t.context,inputResponses:r,state:t.state},t)},async cancel(e){return await n.cancel(e)},async compact(){return await n.compact()},async clear(){return await n.clear()},async reset(e){return await n.reset(e)},async[INTERNAL_CHANNEL_DELIVER](e,t){return await n.deliver(e,t)}}},async resolveSession(e){return await t(e).resolveSession()}}}export{INTERNAL_CHANNEL_DELIVER,createChannelOperations};
+import{createChannelAddressFn}from"#channel/channel-address.js";import{parseInputResponses}from"#shared/input.js";function createChannelOperations(e){let t=createChannelAddressFn(e);return{from(e){let n=t(e);return{async send(e,t){return await n.deliver({context:t.context,message:e,outputSchema:t.outputSchema,state:t.state},t)},async respond(e,t){if(e.length===0)throw Error(`respond() requires at least one input response.`);let r=parseInputResponses(e);return await n.deliver({context:t.context,inputResponses:r,state:t.state},t)},async cancel(e){return await n.cancel(e)},async compact(){return await n.compact()},async clear(){return await n.clear()},async reset(e){return await n.reset(e)}}},async resolveSession(e){return await t(e).resolveSession()}}}export{createChannelOperations};

package/dist/src/channel/compiled-channel.d.ts

@@ -1,5 +1,4 @@
 import type { ChannelAdapter } from "#channel/adapter.js";
-import { type ChannelActivityPresentation } from "#channel/activity-renderer.js";
 import type { UserContent } from "ai";
 import type { ChannelReceiveContext } from "#channel/channel-operations.js";
 import type { NormalizedChannelCorsOptions } from "#channel/cors.js";
@@ -34,6 +33,5 @@ export declare function isCompiledChannel(value: unknown): value is CompiledChan
 export declare function getChannelBuildMetadata(value: unknown, channelName: string): ChannelBuildMetadata | undefined;
 export declare function setChannelBuildMetadata(channel: unknown, factory: ChannelBuildMetadataFactory): void;
 export declare function getChannelInstrumentationKind(value: unknown): string | undefined;
-export declare function setChannelActivityRenderers(channel: unknown, input: ChannelActivityPresentation): void;
 export declare function setChannelInstrumentationKind(channel: CompiledChannel, kind: string): void;
 export {};

package/dist/src/channel/compiled-channel.js

@@ -1,2 +1,2 @@
-import{attachChannelActivityPresentation}from"#channel/activity-renderer.js";const CHANNEL_SENTINEL=`eve:channel`,CHANNEL_BUILD_METADATA=Symbol.for(`eve.channel.buildMetadata`),CHANNEL_INSTRUMENTATION_KIND=Symbol.for(`eve.channel.instrumentationKind`),CHANNEL_INSTRUMENTATION_KINDS=Symbol.for(`eve.channel.instrumentationKinds`),channelInstrumentationKindGlobal=globalThis;channelInstrumentationKindGlobal[CHANNEL_INSTRUMENTATION_KINDS]??=new Map;const channelInstrumentationKinds=channelInstrumentationKindGlobal[CHANNEL_INSTRUMENTATION_KINDS];function isCompiledChannel(e){return typeof e==`object`&&!!e&&e.__kind===`eve:channel`}function getChannelBuildMetadata(e,t){if(!isCompiledChannel(e))return;let n=Reflect.get(e,CHANNEL_BUILD_METADATA);return typeof n==`function`?n(t):void 0}function setChannelBuildMetadata(e,t){if(!isCompiledChannel(e))throw TypeError(`Expected a compiled channel.`);Object.defineProperty(e,CHANNEL_BUILD_METADATA,{configurable:!0,enumerable:!1,value:t})}function getChannelInstrumentationKind(e){if(!isCompiledChannel(e))return;let t=Reflect.get(e,CHANNEL_INSTRUMENTATION_KIND);if(typeof t==`string`&&t.length>0)return t;let n=e.adapter.kind;if(typeof n==`string`&&n.startsWith(`channel:`))return n;let r=channelRouteSignature(e);return r===void 0?void 0:channelInstrumentationKinds.get(r)}function setChannelActivityRenderers(e,t){if(!isCompiledChannel(e))throw TypeError(`Expected a compiled channel.`);attachChannelActivityPresentation(e.adapter,t)}function setChannelInstrumentationKind(e,t){Object.defineProperty(e,CHANNEL_INSTRUMENTATION_KIND,{configurable:!0,enumerable:!1,value:t});let n=channelRouteSignature(e);n!==void 0&&channelInstrumentationKinds.set(n,t)}function channelRouteSignature(e){if(e.routes.length!==0)return e.routes.map(e=>`${e.method.toUpperCase()} ${e.path}`).sort().join(`
-`)}export{CHANNEL_SENTINEL,getChannelBuildMetadata,getChannelInstrumentationKind,isCompiledChannel,setChannelActivityRenderers,setChannelBuildMetadata,setChannelInstrumentationKind};
+const CHANNEL_SENTINEL=`eve:channel`,CHANNEL_BUILD_METADATA=Symbol.for(`eve.channel.buildMetadata`),CHANNEL_INSTRUMENTATION_KIND=Symbol.for(`eve.channel.instrumentationKind`),CHANNEL_INSTRUMENTATION_KINDS=Symbol.for(`eve.channel.instrumentationKinds`),channelInstrumentationKindGlobal=globalThis;channelInstrumentationKindGlobal[CHANNEL_INSTRUMENTATION_KINDS]??=new Map;const channelInstrumentationKinds=channelInstrumentationKindGlobal[CHANNEL_INSTRUMENTATION_KINDS];function isCompiledChannel(e){return typeof e==`object`&&!!e&&e.__kind===`eve:channel`}function getChannelBuildMetadata(e,t){if(!isCompiledChannel(e))return;let n=Reflect.get(e,CHANNEL_BUILD_METADATA);return typeof n==`function`?n(t):void 0}function setChannelBuildMetadata(e,t){if(!isCompiledChannel(e))throw TypeError(`Expected a compiled channel.`);Object.defineProperty(e,CHANNEL_BUILD_METADATA,{configurable:!0,enumerable:!0,value:t})}function getChannelInstrumentationKind(e){if(!isCompiledChannel(e))return;let t=Reflect.get(e,CHANNEL_INSTRUMENTATION_KIND);if(typeof t==`string`&&t.length>0)return t;let n=e.adapter.kind;if(typeof n==`string`&&n.startsWith(`channel:`))return n;let r=channelRouteSignature(e);return r===void 0?void 0:channelInstrumentationKinds.get(r)}function setChannelInstrumentationKind(e,t){Object.defineProperty(e,CHANNEL_INSTRUMENTATION_KIND,{configurable:!0,enumerable:!1,value:t});let n=channelRouteSignature(e);n!==void 0&&channelInstrumentationKinds.set(n,t)}function channelRouteSignature(e){if(e.routes.length!==0)return e.routes.map(e=>`${e.method.toUpperCase()} ${e.path}`).sort().join(`
+`)}export{CHANNEL_SENTINEL,getChannelBuildMetadata,getChannelInstrumentationKind,isCompiledChannel,setChannelBuildMetadata,setChannelInstrumentationKind};

package/dist/src/channel/cross-channel-receive.d.ts

@@ -3,7 +3,7 @@ import type { ChannelAdapter } from "#channel/adapter.js";
 import { type ChannelReference, type CompiledChannel } from "#channel/compiled-channel.js";
 import type { InferReceiveTarget } from "#channel/receive-target.js";
 import type { Session } from "#channel/session.js";
-import type { Runtime, SessionAuthContext, TurnPolicy, TaskDeliveryPolicy } from "#channel/types.js";
+import type { Runtime, SessionAuthContext, TurnPolicy } from "#channel/types.js";
 import type { ResolvedChannelDefinition } from "#runtime/types.js";
 /**
  * Options for sending a message to a channel selected with `ctx.to(...)`.
@@ -11,8 +11,6 @@ import type { ResolvedChannelDefinition } from "#runtime/types.js";
 interface CrossChannelSendOptions {
     readonly auth: SessionAuthContext | null;
     readonly turnPolicy?: TurnPolicy;
-    /** Updates the session policy; omission preserves it. New sessions default to auto, schedules to cohort. */
-    readonly taskDeliveryPolicy?: TaskDeliveryPolicy;
 }
 /** Message delivery bound to one channel-specific proactive target. */
 export interface CrossChannelTargetHandle {

package/dist/src/channel/cross-channel-receive.js

@@ -1,2 +1,2 @@
-import{createChannelOperations}from"#channel/channel-operations.js";import{isCompiledChannel}from"#channel/compiled-channel.js";function toCrossChannelTargets(e){return e.flatMap(e=>e.definition===void 0?[]:[{name:e.name,definition:e.definition,receive:e.receive,adapter:e.adapter,turnPolicy:e.turnPolicy}])}function createCrossChannelToFn(e,t){return(n,r)=>{let i=resolveTargetByReference(n,t);return{async send(t,n){return await invokeChannelReceive({runtime:e,target:i,input:{message:t,target:r,auth:n.auth},turnPolicy:n.turnPolicy,taskDeliveryPolicy:n.taskDeliveryPolicy,describeMissingReceive:()=>`ctx.to(): channel "${i.name}" does not implement receive(). Declare a receive hook on the channel to accept cross-channel sessions.`,describeMissingAdapter:()=>`ctx.to(): channel "${i.name}" has no adapter — cannot build ctx.from().`})}}}}async function invokeChannelReceive(e){if(!e.target.receive)throw Error(e.describeMissingReceive());if(!e.target.adapter)throw Error(e.describeMissingAdapter());let t=createChannelOperations({adapter:e.target.adapter,channelName:e.target.name,runtime:e.runtime,turnPolicy:e.turnPolicy??e.target.turnPolicy,taskDeliveryPolicy:e.taskDeliveryPolicy});return await e.target.receive(e.input,t)}function resolveTargetByReference(e,t){for(let n of t)if(n.definition===e)return n;let n=resolveTargetByRouteFingerprint(e,t);if(n!==null)return n;throw Error(`ctx.to(): the channel passed as the first argument is not registered in this agent's channels/. Import the channel module's default export from agent/channels/<name>.ts and pass that value.`)}function resolveTargetByRouteFingerprint(e,t){if(!isCompiledChannel(e))return null;let n=createRouteFingerprint(e);if(n===null)return null;let r=new Map;for(let e of t)createRouteFingerprint(e.definition)===n&&r.set(e.name,e);if(r.size===1)return[...r.values()][0];if(r.size>1)throw Error(`ctx.to(): the channel passed as the first argument matches multiple registered channels by route shape. Import a channel with a unique route set from agent/channels/<name>.ts before passing it to ctx.to().`);return null}function createRouteFingerprint(e){return e.routes.length===0?null:e.routes.map(e=>`${e.method.toUpperCase()} ${e.path}`).sort().join(`
+import{createChannelOperations}from"#channel/channel-operations.js";import{isCompiledChannel}from"#channel/compiled-channel.js";function toCrossChannelTargets(e){return e.flatMap(e=>e.definition===void 0?[]:[{name:e.name,definition:e.definition,receive:e.receive,adapter:e.adapter,turnPolicy:e.turnPolicy}])}function createCrossChannelToFn(e,t){return(n,r)=>{let i=resolveTargetByReference(n,t);return{async send(t,n){return await invokeChannelReceive({runtime:e,target:i,input:{message:t,target:r,auth:n.auth},turnPolicy:n.turnPolicy,describeMissingReceive:()=>`ctx.to(): channel "${i.name}" does not implement receive(). Declare a receive hook on the channel to accept cross-channel sessions.`,describeMissingAdapter:()=>`ctx.to(): channel "${i.name}" has no adapter — cannot build ctx.from().`})}}}}async function invokeChannelReceive(e){if(!e.target.receive)throw Error(e.describeMissingReceive());if(!e.target.adapter)throw Error(e.describeMissingAdapter());let t=createChannelOperations({adapter:e.target.adapter,channelName:e.target.name,runtime:e.runtime,turnPolicy:e.turnPolicy??e.target.turnPolicy});return await e.target.receive(e.input,t)}function resolveTargetByReference(e,t){for(let n of t)if(n.definition===e)return n;let n=resolveTargetByRouteFingerprint(e,t);if(n!==null)return n;throw Error(`ctx.to(): the channel passed as the first argument is not registered in this agent's channels/. Import the channel module's default export from agent/channels/<name>.ts and pass that value.`)}function resolveTargetByRouteFingerprint(e,t){if(!isCompiledChannel(e))return null;let n=createRouteFingerprint(e);if(n===null)return null;let r=new Map;for(let e of t)createRouteFingerprint(e.definition)===n&&r.set(e.name,e);if(r.size===1)return[...r.values()][0];if(r.size>1)throw Error(`ctx.to(): the channel passed as the first argument matches multiple registered channels by route shape. Import a channel with a unique route set from agent/channels/<name>.ts before passing it to ctx.to().`);return null}function createRouteFingerprint(e){return e.routes.length===0?null:e.routes.map(e=>`${e.method.toUpperCase()} ${e.path}`).sort().join(`
 `)}export{createCrossChannelToFn,toCrossChannelTargets};

package/dist/src/channel/forwarded-principal.js

@@ -1 +1 @@
-import{z}from"#compiled/zod/index.js";import{createLogger,logError}from"#internal/logging.js";const log=createLogger(`channel.forwarded-principal`),FORWARDED_BY_ATTRIBUTE=`eve:forwarded-by`,attributeValueSchema=z.union([z.string(),z.array(z.string()).readonly()]),forwardedPrincipalContextSchema=z.object({attributes:z.record(z.string(),attributeValueSchema).readonly(),authenticator:z.string().min(1),issuer:z.string().min(1).optional(),principalId:z.string().min(1),principalType:z.string().min(1),subject:z.string().min(1).optional()}).strict(),forwardedPrincipalSchema=z.object({current:forwardedPrincipalContextSchema,initiator:forwardedPrincipalContextSchema.optional()}).strict();async function resolveForwardedPrincipal(e){let t=e.payload.forwardedPrincipal;if(t===void 0)return{accepted:!1,auth:e.forwarder};if(e.trustedForwarders===void 0)return Response.json({error:`This deployment does not accept a forwarded principal.`,ok:!1},{status:403});let n=parseForwardedPrincipal(t);if(!n.ok)return Response.json({error:n.message,ok:!1},{status:400});let r=stampForwardedBy(n.forwardedPrincipal.current,e.forwarder.principalId),i=n.forwardedPrincipal.initiator===void 0?r:stampForwardedBy(n.forwardedPrincipal.initiator,e.forwarder.principalId),a;try{a=await e.trustedForwarders(e.forwarder,{principal:{current:r,initiator:i}})}catch(t){let n=logError(log,`trustedForwarders handler failed`,t,{forwarder:e.forwarder.principalId});return Response.json({error:`trustedForwarders handler failed.`,errorId:n,ok:!1},{status:500})}return a?{accepted:!0,auth:r,initiatorAuth:i}:Response.json({error:`Caller is not authorized to assert a forwarded principal.`,ok:!1},{status:403})}function parseForwardedPrincipal(e){let t=forwardedPrincipalSchema.safeParse(e);if(t.success){let e=toSessionAuthContext(t.data.current);return{forwardedPrincipal:t.data.initiator===void 0?{current:e}:{current:e,initiator:toSessionAuthContext(t.data.initiator)},ok:!0}}return{cause:t.error,message:formatForwardedPrincipalParseError(t.error),ok:!1}}function stampForwardedBy(e,t){return{...e,attributes:{...e.attributes,[FORWARDED_BY_ATTRIBUTE]:t}}}function toSessionAuthContext(e){let t={attributes:e.attributes,authenticator:e.authenticator,principalId:e.principalId,principalType:e.principalType};return e.issuer!==void 0&&(t.issuer=e.issuer),e.subject!==void 0&&(t.subject=e.subject),t}function formatForwardedPrincipalParseError(e){return`Invalid forwardedPrincipal metadata: ${e.issues.map(e=>`${e.path.length===0?`forwardedPrincipal`:`forwardedPrincipal.${e.path.join(`.`)}`}: ${e.message}`).join(`; `)}`}export{FORWARDED_BY_ATTRIBUTE,parseForwardedPrincipal,resolveForwardedPrincipal,stampForwardedBy};
+import{createLogger,logError}from"#internal/logging.js";import{z}from"#compiled/zod/index.js";const log=createLogger(`channel.forwarded-principal`),FORWARDED_BY_ATTRIBUTE=`eve:forwarded-by`,attributeValueSchema=z.union([z.string(),z.array(z.string()).readonly()]),forwardedPrincipalContextSchema=z.object({attributes:z.record(z.string(),attributeValueSchema).readonly(),authenticator:z.string().min(1),issuer:z.string().min(1).optional(),principalId:z.string().min(1),principalType:z.string().min(1),subject:z.string().min(1).optional()}).strict(),forwardedPrincipalSchema=z.object({current:forwardedPrincipalContextSchema,initiator:forwardedPrincipalContextSchema.optional()}).strict();async function resolveForwardedPrincipal(e){let t=e.payload.forwardedPrincipal;if(t===void 0)return{accepted:!1,auth:e.forwarder};if(e.trustedForwarders===void 0)return Response.json({error:`This deployment does not accept a forwarded principal.`,ok:!1},{status:403});let n=parseForwardedPrincipal(t);if(!n.ok)return Response.json({error:n.message,ok:!1},{status:400});let r=stampForwardedBy(n.forwardedPrincipal.current,e.forwarder.principalId),i=n.forwardedPrincipal.initiator===void 0?r:stampForwardedBy(n.forwardedPrincipal.initiator,e.forwarder.principalId),a;try{a=await e.trustedForwarders(e.forwarder,{principal:{current:r,initiator:i}})}catch(t){let n=logError(log,`trustedForwarders handler failed`,t,{forwarder:e.forwarder.principalId});return Response.json({error:`trustedForwarders handler failed.`,errorId:n,ok:!1},{status:500})}return a?{accepted:!0,auth:r,initiatorAuth:i}:Response.json({error:`Caller is not authorized to assert a forwarded principal.`,ok:!1},{status:403})}function parseForwardedPrincipal(e){let t=forwardedPrincipalSchema.safeParse(e);if(t.success){let e=toSessionAuthContext(t.data.current);return{forwardedPrincipal:t.data.initiator===void 0?{current:e}:{current:e,initiator:toSessionAuthContext(t.data.initiator)},ok:!0}}return{cause:t.error,message:formatForwardedPrincipalParseError(t.error),ok:!1}}function stampForwardedBy(e,t){return{...e,attributes:{...e.attributes,[FORWARDED_BY_ATTRIBUTE]:t}}}function toSessionAuthContext(e){let t={attributes:e.attributes,authenticator:e.authenticator,principalId:e.principalId,principalType:e.principalType};return e.issuer!==void 0&&(t.issuer=e.issuer),e.subject!==void 0&&(t.subject=e.subject),t}function formatForwardedPrincipalParseError(e){return`Invalid forwardedPrincipal metadata: ${e.issues.map(e=>`${e.path.length===0?`forwardedPrincipal`:`forwardedPrincipal.${e.path.join(`.`)}`}: ${e.message}`).join(`; `)}`}export{FORWARDED_BY_ATTRIBUTE,parseForwardedPrincipal,resolveForwardedPrincipal,stampForwardedBy};

package/dist/src/channel/schedule-auth.d.ts

@@ -3,3 +3,19 @@ import type { SessionAuthContext } from "#channel/types.js";
  * Framework-owned principal used when a schedule runs on behalf of the agent.
  */
 export declare const SCHEDULE_APP_AUTH: SessionAuthContext;
+/**
+ * Returns true when `auth` is the default app principal that schedules pass
+ * as `appAuth`. It identifies that principal, not how a turn started: a
+ * schedule handler may send with a user's auth instead, and any code can
+ * reuse `appAuth`.
+ *
+ * @example
+ * ```ts
+ * import { isScheduleAuth } from "eve/schedules";
+ *
+ * if (isScheduleAuth(ctx.session.auth.current)) {
+ *   // Work the agent does on its own behalf.
+ * }
+ * ```
+ */
+export declare function isScheduleAuth(auth: SessionAuthContext | null | undefined): boolean;

package/dist/src/channel/schedule-auth.js

@@ -1 +1 @@
-const SCHEDULE_APP_AUTH={attributes:{},authenticator:`app`,principalId:`eve:app`,principalType:`runtime`};export{SCHEDULE_APP_AUTH};
+const SCHEDULE_APP_AUTH={attributes:{},authenticator:`app`,principalId:`eve:app`,principalType:`runtime`};function isScheduleAuth(e){return e?.authenticator===SCHEDULE_APP_AUTH.authenticator&&e.principalId===SCHEDULE_APP_AUTH.principalId&&e.principalType===SCHEDULE_APP_AUTH.principalType}export{SCHEDULE_APP_AUTH,isScheduleAuth};

package/dist/src/channel/session-callback.js

@@ -1 +1 @@
-import{z}from"#compiled/zod/index.js";import{createEveCallbackRoutePath}from"#protocol/routes.js";import{normalizePublicEveRoutePath}from"#shared/eve-route-path.js";import{isReservedIpAddress}from"#shared/network-address.js";const sessionCallbackSchema=z.object({callId:z.string().min(1),subagentName:z.string().min(1),taskId:z.string().min(1).optional(),token:z.string().min(1),url:z.string().min(1)}).strict().superRefine((e,t)=>{let n;try{n=new URL(e.url)}catch{t.addIssue({code:`custom`,message:`Callback url must be absolute.`,path:[`url`]});return}readCallbackUrlToken(n)!==e.token&&t.addIssue({code:`custom`,message:`Callback url token must match callback token.`,path:[`url`]}),isReservedIpAddress(n.hostname)&&t.addIssue({code:`custom`,message:`Callback url host must not be a private or reserved address.`,path:[`url`]})});function parseSessionCallback(e){let t=sessionCallbackSchema.safeParse(e);return t.success?{callback:t.data,ok:!0}:{cause:t.error,message:formatSessionCallbackParseError(t.error),ok:!1}}function readCallbackUrlToken(e){let t=createEveCallbackRoutePath(``),n=normalizePublicEveRoutePath(e.pathname),r=n.lastIndexOf(t);if(r===-1)return null;let i=n.slice(r+t.length);if(i.length===0||i.includes(`/`))return null;try{return decodeURIComponent(i)}catch{return null}}function formatSessionCallbackParseError(e){return`Invalid callback metadata: ${e.issues.map(e=>`${e.path.length===0?`callback`:`callback.${e.path.join(`.`)}`}: ${e.message}`).join(`; `)}`}export{parseSessionCallback};
+import{z}from"#compiled/zod/index.js";import{createEveCallbackRoutePath}from"#protocol/routes.js";import{normalizePublicEveRoutePath}from"#shared/eve-route-path.js";import{isReservedIpAddress}from"#shared/network-address.js";const sessionCallbackSchema=z.object({callId:z.string().min(1),subagentName:z.string().min(1),token:z.string().min(1),url:z.string().min(1)}).strict().superRefine((e,t)=>{let n;try{n=new URL(e.url)}catch{t.addIssue({code:`custom`,message:`Callback url must be absolute.`,path:[`url`]});return}readCallbackUrlToken(n)!==e.token&&t.addIssue({code:`custom`,message:`Callback url token must match callback token.`,path:[`url`]}),isReservedIpAddress(n.hostname)&&t.addIssue({code:`custom`,message:`Callback url host must not be a private or reserved address.`,path:[`url`]})});function parseSessionCallback(e){let t=sessionCallbackSchema.safeParse(e);return t.success?{callback:t.data,ok:!0}:{cause:t.error,message:formatSessionCallbackParseError(t.error),ok:!1}}function readCallbackUrlToken(e){let t=createEveCallbackRoutePath(``),n=normalizePublicEveRoutePath(e.pathname),r=n.lastIndexOf(t);if(r===-1)return null;let i=n.slice(r+t.length);if(i.length===0||i.includes(`/`))return null;try{return decodeURIComponent(i)}catch{return null}}function formatSessionCallbackParseError(e){return`Invalid callback metadata: ${e.issues.map(e=>`${e.path.length===0?`callback`:`callback.${e.path.join(`.`)}`}: ${e.message}`).join(`; `)}`}export{parseSessionCallback};