eve 0.75.1 → 0.76.2

package/docs/skills.mdx

@@ -1,15 +1,15 @@
 ---
 title: "Skills"
-description: "Author load-on-demand procedures the model pulls into context with load_skill."
+description: "Author load-on-demand procedures the model pulls into context with eve__skill."
 ---
 
 A skill is a model-loadable procedure that follows the `SKILL.md` convention. It is a markdown document, optionally a packaged directory with supporting files, that the model pulls into context on demand rather than carrying on every turn. eve advertises each skill's description, and the model loads the full body only when a turn calls for it. This is progressive disclosure, the same model the broader Agent Skills standard uses, so a skill authored against that standard ports over as-is.
 
 ## How loading works
 
-eve scans the files under `agent/skills/` and exposes each one's description to the model alongside a framework-owned `load_skill` tool. When a request matches a skill's description (or you name the skill outright), the model calls `load_skill`, and eve appends that skill's markdown to the active turn's context.
+eve scans the files under `agent/skills/` and lists each one's name and description in the system prompt. When a request matches a skill's description (or you name the skill outright), the model loads it with `eve__skill({ name })`, and the skill's markdown becomes the call's result in the active turn. An agent with skills always has the [`eve__skill` tool](./concepts/built-in-tools#eve__search-eve__tool-and-eve__skill). A load reports a `load-skill` action named for the skill, and `t.loadedSkill` asserts it in [evals](./evals/assertions).
 
-Listing skills and loading their instructions do not require a sandbox: `load_skill` returns static instructions from the compiled agent and dynamic instructions from session state. Only access to supporting package files requires a sandbox. Builds may also prewarm sandbox templates that contain static package files. Supporting files are available under `$HOME/.agents/skills/<skill>/`, with `/workspace/skills/<skill>/` as the fallback when `$HOME` is unavailable. Sibling references inside `SKILL.md`, such as `references/checklist.md`, are relative to the directory containing that specific `SKILL.md`.
+Listing skills and loading their instructions do not require a sandbox: loading returns static instructions from the compiled agent and dynamic instructions from session state. Only access to supporting package files requires a sandbox. Builds may also prewarm sandbox templates that contain static package files. Supporting files are available under `$HOME/.agents/skills/<skill>/`, with `/workspace/skills/<skill>/` as the fallback when `$HOME` is unavailable. Sibling references inside `SKILL.md`, such as `references/checklist.md`, are relative to the directory containing that specific `SKILL.md`.
 
 The description is a routing hint, not a label. Write it as the task that should trigger activation:
 
@@ -19,6 +19,19 @@ Use when the user needs a release checklist or changelog workflow.
 
 Loading a skill adds instructions, never a new execution surface. Tools stay visible whether a skill is loaded or not. If you need typed runtime behavior, reach for a [tool](./tools) instead.
 
+## Deferred skills
+
+An agent with many skills can keep most of them out of the system prompt. Set `deferred: true` in the frontmatter or on `defineSkill`:
+
+```md title="agent/skills/pdf-forms/SKILL.md"
+---
+description: Fill and validate PDF forms.
+deferred: true
+---
+```
+
+A deferred skill isn't named in context; the catalog listing only says that deferred skills exist, and their namespaces. The model finds a deferred skill with `eve__search`, which ranks skills and tools together, and loads it with `eve__skill({ name })`. Its markdown, supporting files, and eval assertions work as they do for any other skill. Dynamic skills accept `deferred` too; see [Dynamic capabilities](./guides/dynamic-capabilities#dynamic-skills).
+
 ## Markdown vs `defineSkill`
 
 The smallest skill is a flat markdown file. The content is the procedure, and the name comes from the path.
@@ -27,6 +40,8 @@ The smallest skill is a flat markdown file. The content is the procedure, and th
 Use the weather tool before answering forecast or temperature questions.
 ```
 
+A skill's name comes from its path and must use only ASCII letters, digits, underscores, and dashes, start with a letter or digit, and have at most 64 characters. The compiler rejects any other name.
+
 A flat markdown skill can skip the `description` frontmatter. When it does, eve advertises the first non-empty, non-code-fence line of the body with any leading `#`, `>`, `*`, or `-` marker stripped. If the body has no such line, eve falls back to the literal `Instructions for the <name> skill.`, which is a weak routing hint, so add a `description` when you want the model to route on intent.
 
 A packaged skill is a directory with a `SKILL.md` plus sibling files like `references/`, `assets/`, and `scripts/`. The packaged `SKILL.md` must carry `description` frontmatter; it has no filename slug to fall back on.
@@ -40,7 +55,7 @@ When the task is novel or ambiguous, gather evidence first, then answer with the
 key facts and the remaining uncertainty.
 ```
 
-eve reads `description`, optional `license`, and string `metadata`; other `SKILL.md` frontmatter is accepted as a no-op.
+eve reads `description`, optional `license`, string `metadata`, and `deferred`; other `SKILL.md` frontmatter is accepted as a no-op.
 
 When markdown can't express what you need (typed values, generated content, or inline sibling files), author the skill in TypeScript with `defineSkill` from `eve/skills`:
 

package/docs/subagents/index.mdx

@@ -74,7 +74,9 @@ export default defineAgent({
 
 The parent can alternatively export `disableTool()` from a same-named tool path, such as `agent/tools/researcher.ts`. This suppresses the derived model tool without removing `researcher` from the workflow invocation registry. A same-named authored tool replaces the model-facing surface while the workflow can still call the underlying subagent with `ctx.agent("researcher", ...)`.
 
-A declared local or remote subagent call returns a receipt, and the child's reply arrives as the task's result. Human input requests from the child surface on the parent session while the task works. `task_cancel` with the task's `taskId` cancels the child's current turn, and so does cancelling the calling turn.
+Set `tool: "deferred"` to keep the subagent out of the parent model's tool list while the model can still call it. eve doesn't name the subagent in the parent's context; the model finds it with [`eve__search`](/docs/concepts/built-in-tools#eve__search-eve__tool-and-eve__skill) and calls it with `eve__tool`. The call then runs exactly like a direct subagent call. Use this when a parent has many specialists and you want to keep its tool list short.
+
+A declared local or remote subagent call returns a receipt, and the child's reply arrives as the task's result. Human input requests from the child surface on the parent session while the task works. `eve__task_cancel` with the task's `taskId` cancels the child's current turn, and so does cancelling the calling turn.
 
 A mounted extension can also contribute declared subagents from `extension/subagents/`. The mount namespace prefixes the subagent visible to the consuming agent node: mounting an extension as `crm` exposes its `reviewer` subagent as `crm__reviewer`. The contributed subagent keeps its own isolated tools, connections, skills, hooks, instructions, sandbox, and nested subagents, and its modules can read configuration from the extension handle. See [Extensions](./extensions#add-a-subagent) for the authoring and override behavior.
 
@@ -225,7 +227,7 @@ A directly declared subagent's tool name is the bare path-derived name, with no
 
 The tool's description is the subagent's `description` followed by a sentence telling the model that the agent does not see the conversation and that `taskId` continues an agent task.
 
-By default, a subagent named `researcher` collides with an authored tool named `researcher`. Set the subagent's `tool` to `false` when the authored tool intentionally wraps that subagent; the authored tool becomes the model-facing capability while `ctx.agent("researcher", ...)` continues to address the child. A same-named `disableTool()` removes the model-facing capability entirely. Other static and active dynamic collisions remain errors.
+By default, a subagent named `researcher` collides with an authored tool named `researcher`. Set the subagent's `tool` to `false` when the authored tool intentionally wraps that subagent; the authored tool becomes the model-facing capability while `ctx.agent("researcher", ...)` continues to address the child. A same-named `disableTool()` removes the model-facing capability entirely. The same holds for dynamic subagents and dynamic tools: a dynamic subagent whose resolved config sets `tool: false` can be wrapped by an authored tool, and a dynamic tool can wrap a static subagent hidden either way. Any other collision is an error: eve rejects a static one when the deployment builds, and logs a dynamic one and skips that resolver's result.
 
 Do not rely on subagent delegation by itself as an approval boundary. Put sensitive tools behind `approval`, connection approval, route/session authorization, or other controls wherever those tools can be called.
 
@@ -241,7 +243,7 @@ Subagent model calls automatically retry classified transient provider failures,
 
 A child parks after answering instead of terminating, keeping its session and conversation history alive. Pass the task's `taskId` to the same subagent tool with a new `message` to continue that session. Omitting `taskId` always starts a new child. When a child's turn fails, the call fails and the task ends. A `taskId` that names no task of that subagent tool, including one that ended, fails with `UNKNOWN_TASK`. Any later turn can continue the child, and each continuation runs with the auth of the caller that sends it.
 
-A call with the `taskId` of a child that is still working joins the child's current turn, and that turn's final reply settles both calls. If the turn ends before the child reads the message, the message starts the child's next turn, and that turn's reply settles both calls. Use it to correct or add to work in progress. `task_cancel` with the task's `taskId` cancels the child's current turn and keeps its conversation, so a later call with the same `taskId` continues where it left off.
+A call with the `taskId` of a child that is still working joins the child's current turn, and that turn's final reply settles both calls. If the turn ends before the child reads the message, the message starts the child's next turn, and that turn's reply settles both calls. Use it to correct or add to work in progress. `eve__task_cancel` with the task's `taskId` cancels the child's current turn and keeps its conversation, so a later call with the same `taskId` continues where it left off.
 
 eve adds a framework-injected `[Tasks]` note to the conversation that lists the working and idle tasks by `taskId` and tool, so the model can find a child to continue. See [Tasks](./tools/tasks) for how the model waits for, corrects, and cancels agent tasks.
 

package/docs/tools/human-in-the-loop.md

@@ -219,6 +219,8 @@ Approvals and questions share one protocol:
 3. The run parks durably, for as long as it takes. The turn stays open: the stream emits `turn.waiting`, and after the answer the turn resumes under the same `turnId`. That `turn.waiting` carries `on: "input"`, since a person must act.
 4. The client answers with `inputResponses` (structured, keyed by `requestId`) or a normal follow-up `message`. A follow-up whose text matches an option ID, option label, or numeric option index resolves automatically, including approval options such as `approve` and `cancel`.
 
+To tell the model why a call was denied, send `text` with the `cancel` response, for example `{ requestId, optionId: "cancel", text: "Only the three-pack." }`. The model receives the note quoted in the denial result, marked as written by the person who denied the call, who may not be the user. The note is also visible to anyone who can read the session stream, in `input.resolved`.
+
 For `ctx.ask()` questions from tools and prompts proxied from subagents, a follow-up message answers the first open request, as described in [Several requests at once](#several-requests-at-once). The message must match an option, or the question must allow free text. Otherwise the message follows the session's `turnPolicy`. A steering message, the default, aborts the `ctx.abortSignal` of each `execute` workflow tool call the turn waits on, so a question such a call asked, such as `ask_question`'s, is withdrawn and resolves as `cancelled`. The model reads the message once those calls settle.
 
 Each request includes a `kind` discriminator: `tool-approval`, `question`, or

package/docs/tools/overview.mdx

@@ -58,6 +58,25 @@ export default defineTool({
 
 The option defaults to `true` and works with `defineTool` and `defineWorkflowTool`. A root copy does not receive a tool with this option, and a tool authored inside a declared subagent is unavailable because that agent runs in a delegated session. This controls tool availability only; it does not add or remove entries from a workflow's `ctx.agents` registry.
 
+### Keep a tool out of the tool list
+
+Set `deferred: true` when the model needs a tool only occasionally, or when an agent has more tools than you want in every model request:
+
+```ts title="agent/tools/export_report.ts"
+export default defineTool({
+  deferred: true,
+  description: "Export a finished report as a PDF.",
+  inputSchema: z.object({ reportId: z.string() }),
+  execute({ reportId }) {
+    return exportReport(reportId);
+  },
+});
+```
+
+A deferred tool is not in the model's tool list, and eve doesn't name it in context. The model finds its name, description, and signature with [`eve__search`](/docs/concepts/built-in-tools#eve__search-eve__tool-and-eve__skill) and calls it with `eve__tool({ name: "export_report", input })`. After that, the call runs exactly like a direct call: approvals, `endsTurn`, `toModelOutput`, hooks, and stream events see `export_report`, not `execute`.
+
+The option works with `defineTool`, `defineWorkflowTool`, and dynamic tool entries. Provider tools such as `webSearch()` cannot be deferred, because the provider has to see their definition; the compiler rejects `deferred` on them. To defer an agent, set [`tool: "deferred"`](/docs/subagents#declared-subagents) on its `defineAgent` definition.
+
 Compiled tools preserve Zod schema composition, including input and output schemas imported from helper modules. Durable replay metadata stays separate from the original schema, so adding it does not mutate shared schema objects.
 
 ### End the turn after a tool call
@@ -128,7 +147,9 @@ export default defineTool({
 
 The label is presentation only. It does not replace the path-derived tool name, enter model input, or change execution. eve records the bounded label on the corresponding public action event so activity renderers and other authorized stream consumers can use it without interpreting raw tool data. Built-in channel activity can show `Deploy storefront to production` instead of `Deploy`; if the callback throws or returns an empty label, activity falls back to a readable form of the tool name, such as `Sync accounts` for `sync_accounts`.
 
-Provided tools define labels for `bash`, `glob`, `grep`, `load_skill`, `read_file`, `web_fetch`, `web_search`, and `write_file`.
+Provided tools define labels for `bash`, `glob`, `grep`, `read_file`, `web_fetch`, `web_search`, and `write_file`.
+
+Calls the model makes through the [catalog](/docs/concepts/built-in-tools#eve__search-eve__tool-and-eve__skill) read the same way. A deferred tool, agent, or connection tool called through `eve__tool` shows its own label, exactly as a direct call would. An `eve__search` call shows `Search tools for “linear issues”`, then `Searched tools for “linear issues”, found 5` when it returns. A skill load shows `Load skill release-notes`, then `Loaded skill release-notes`, and a connection's sign-in entry shows `Sign in to Linear`.
 
 ### Stream preliminary tool results
 

package/docs/tools/tasks-upgrade.md

@@ -148,7 +148,7 @@ The eval assertion `t.calledSubagent(name, { status })` keeps its API and reads
 A turn doesn't end while tasks are working, so one turn can span a wait. The stream
 reports each wait with the new `turn.waiting` event, which carries the open turn's `turnId`:
 
-- **Held turns.** When the model ends its text while its tasks work, and when `task_wait` has no
+- **Held turns.** When the model ends its text while its tasks work, and when `eve__task_wait` has no
   result yet, the stream emits `turn.waiting`. The next `step.started` for the same `turnId` means
   the turn resumed. In a root session, the text before the wait completes as a normal
   `message.completed`; in child sessions and a schedule's sessions, that step reports

package/docs/tools/tasks.md

@@ -31,7 +31,7 @@ Defining none of the three, or more than one, throws when the tool is defined.
 | `execute` workflow tool, including `sleep` and `ask_question`           | Tool call; the turn waits | The tool result                                   | Aborts the call's `abortSignal`   |
 | `task` workflow tool, including `agentRouter()` and the `workflow` tool | Task                      | A receipt, then a `task.result` message           | Nothing                           |
 | `serve` workflow tool, including every agent tool                       | Resumable task            | A receipt, then a `task.result` message per reply | Nothing                           |
-| `task_wait`                                                             | Wait inside the turn      | Which tasks settled                               | Ends the wait                     |
+| `eve__task_wait`                                                        | Wait inside the turn      | Which tasks settled                               | Ends the wait                     |
 | Plain and MCP tools                                                     | Inside the model step     | The tool result                                   | Applied at the next step boundary |
 
 Waiting alone doesn't need a task. A question, a `sleep`, or an approval inside an `execute` call
@@ -97,7 +97,7 @@ conversation should continue while the review runs.
 A workflow tool body receives its signals from its context or, in a `serve` body, from each call
 `receive()` resolves:
 
-- **`abortSignal`** aborts when the call's work should stop: by `task_cancel`, `session.cancel()`,
+- **`abortSignal`** aborts when the call's work should stop: by `eve__task_cancel`, `session.cancel()`,
   a cancelled or failed turn, or the end of the session, and, for an `execute` call, by a steering
   message that arrives while the turn waits on it. `execute` and `task` bodies read it as
   `ctx.abortSignal`. In a `serve` body, each call from `receive()` carries its own `abortSignal`;
@@ -134,12 +134,12 @@ provided `sleep` tool races its timer against the signal.
 
 ## What the model sees
 
-eve adds `task_wait`, `task_cancel`, and a short system prompt block that explains tasks whenever
+eve adds `eve__task_wait`, `eve__task_cancel`, and a short system prompt block that explains tasks whenever
 the agent has an agent tool or a `task` or `serve` workflow tool. The block tells the model to call
-`task_wait` when it has nothing to say until a result arrives, and to reply when the person should
+`eve__task_wait` when it has nothing to say until a result arrives, and to reply when the person should
 hear from it first, such as a confirmation that work is underway. In a child session or a
 schedule's session, where only the final reply reaches the caller, it tells the model to call
-`task_wait` instead of replying while tasks work.
+`eve__task_wait` instead of replying while tasks work.
 
 **Receipts.** A call that starts a task returns a receipt as its tool result. Task ids are the tool
 name and six characters. A resumable task's receipt tells the model how to reach it again, and a
@@ -152,7 +152,7 @@ Sent to task researcher-7k2m9q. Its reply will arrive in a <task_result> message
 ```
 
 **Results.** Each result arrives once, as a `<task_result>` block in a `task.result` message that
-eve appends at the next step boundary, right after `task_wait` returns, or when a held turn
+eve appends at the next step boundary, right after `eve__task_wait` returns, or when a held turn
 resumes. The body is the tool's `toModelOutput` projection of the output, or the error message for
 a failed call. All results in one message share a budget of 50 KB and 2,000 lines, after which the
 text is cut and marked `[truncated]`.
@@ -161,7 +161,7 @@ text is cut and marked `[truncated]`.
 <task_result id="deploy-4hd8sa" tool="deploy" status="completed">{"url":"https://…"}</task_result>
 ```
 
-**`task_wait({ timeoutSeconds? })`** controls when the model replies. The model should call it
+**`eve__task_wait({ timeoutSeconds? })`** controls when the model replies. The model should call it
 sparingly, only when it deliberately wants to withhold a message from the user while waiting for
 a task result. Tasks keep running and their results reach the model without this call; the model
 can reply now if the user should hear from it.
@@ -175,9 +175,9 @@ model reads which tasks settled and which are still working, for example:
 deploy-4hd8sa completed; its result follows. 1 task is still working: researcher-7k2m9q.
 ```
 
-**`task_cancel({ taskId })`** stops a task's current work and says so. A resumable task's answer
+**`eve__task_cancel({ taskId })`** stops a task's current work and says so. A resumable task's answer
 also tells the model how to give it new work. When the task has no work to stop, because it already
-finished or is an idle resumable task, `task_cancel` says that instead:
+finished or is an idle resumable task, `eve__task_cancel` says that instead:
 
 ```text
 Stopped deploy-4hd8sa; it won't report back.
@@ -201,22 +201,22 @@ lists the working tasks and the 10 most recently used idle resumable tasks. The
 
 **Errors.** Two error codes are specific to tasks:
 
-| Code             | When                                                                               |
-| ---------------- | ---------------------------------------------------------------------------------- |
-| `UNKNOWN_TASK`   | A call's `taskId` names no unfinished resumable task that the same tool started    |
-| `UNKNOWN_TASK`   | `task_cancel`'s `taskId` names no task; a finished or idle one has no work to stop |
-| `TOO_MANY_TASKS` | A call would start a task, or make an idle one work, while 32 tasks are working    |
+| Code             | When                                                                                    |
+| ---------------- | --------------------------------------------------------------------------------------- |
+| `UNKNOWN_TASK`   | A call's `taskId` names no unfinished resumable task that the same tool started         |
+| `UNKNOWN_TASK`   | `eve__task_cancel`'s `taskId` names no task; a finished or idle one has no work to stop |
+| `TOO_MANY_TASKS` | A call would start a task, or make an idle one work, while 32 tasks are working         |
 
-A `final_output` call made while tasks are working returns an error that names them.
+An `eve__reply` call made while tasks are working returns an error that names them.
 
 ## Turns wait for their tasks
 
 No turn ends while any task is working. When the model ends a turn early, eve waits as
-`task_wait` does: it parks until one of the tasks settles or the turn's own caller steers it,
+`eve__task_wait` does: it parks until one of the tasks settles or the turn's own caller steers it,
 appends the results, and calls the model again in the same turn. No result ever starts a turn on
 its own. An idle resumable task isn't working, so it doesn't hold the turn.
 
-A held turn stays open. Each time it parks, when eve holds it or when `task_wait` has no result
+A held turn stays open. Each time it parks, when eve holds it or when `eve__task_wait` has no result
 yet, the stream emits `turn.waiting` with the turn's `turnId`. The next `step.started` for the
 same `turnId` means the turn resumed, and `session.waiting` comes only after the turn ends. The
 model's text before the wait depends on the session:
@@ -240,14 +240,14 @@ ordinary reply, then post the reply after the results as another message. Slack
 turn's tasks in a live [task card](/docs/channels/slack#task-card).
 
 A steering message from the turn's own caller, one sent with `turnPolicy: "steer"`, the default,
-ends a `task_wait` and aborts the `abortSignal` of any `execute` call the turn waits on, but it
+ends an `eve__task_wait` and aborts the `abortSignal` of any `execute` call the turn waits on, but it
 never interrupts a task. The model reads the message and decides whether to keep each task,
-correct an agent by calling it again with its `taskId`, or stop a task with `task_cancel`. A
+correct an agent by calling it again with its `taskId`, or stop a task with `eve__task_cancel`. A
 `"queue"` message, or a message from another caller, waits for the turn to end.
 
 ## Cancel a task
 
-- **`task_cancel`** stops one task's current work.
+- **`eve__task_cancel`** stops one task's current work.
 - **`session.cancel()`** cancels the turn, the `execute` calls it waits on, and every working task
   in the session.
 - **A failed turn** cancels every working task.
@@ -263,12 +263,12 @@ same `taskId` continues where it left off. A `serve` body that doesn't return to
 
 ## Stream events
 
-| Event           | When                                                                                  | Data                                                                                       |
-| --------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
-| `task.started`  | A call starts a task, or reaches a resumable task by its `taskId`                     | `taskId`, `callId`, `turnId`, the tool `name`, and `kind`                                  |
-| `task.settled`  | A reply, return, failure, or cancel settles one call                                  | `taskId`, `callId`, `turnId`, `name`, `kind`, `status`, and `output`, `error`, or `cancel` |
-| `agent.started` | A workflow run, including an agent tool's, opens a session with an agent              | `callId`, `turnId`, `taskId`, `name`, `sessionId`, `streamPath`                            |
-| `turn.waiting`  | An open turn parks on its tasks, a `task_wait`, a question, a sign-in, or an approval | `turnId`, `sequence`, and `on`: `"input"` when a person must act, otherwise `"tasks"`      |
+| Event           | When                                                                                        | Data                                                                                       |
+| --------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
+| `task.started`  | A call starts a task, or reaches a resumable task by its `taskId`                           | `taskId`, `callId`, `turnId`, the tool `name`, and `kind`                                  |
+| `task.settled`  | A reply, return, failure, or cancel settles one call                                        | `taskId`, `callId`, `turnId`, `name`, `kind`, `status`, and `output`, `error`, or `cancel` |
+| `agent.started` | A workflow run, including an agent tool's, opens a session with an agent                    | `callId`, `turnId`, `taskId`, `name`, `sessionId`, `streamPath`                            |
+| `turn.waiting`  | An open turn parks on its tasks, an `eve__task_wait`, a question, a sign-in, or an approval | `turnId`, `sequence`, and `on`: `"input"` when a person must act, otherwise `"tasks"`      |
 
 `task.started` and `task.settled` come once each per call, and `(taskId, callId)` identifies the
 call. Both carry that call's `turnId`, which for a resumable task's later call can be a later turn
@@ -276,7 +276,7 @@ than the one that started the task, and the task's tool `name` and `kind`. `kind
 an agent tool's call and `"tool"` otherwise. Events recorded by earlier eve versions omit `name`
 and `kind` on `task.settled`; match those to their `task.started` by `callId`. `status` is `"completed"`, `"failed"`, or `"cancelled"`. A completed call carries
 `output`, a failed call carries `error`, and a cancelled call carries `cancel.reason`:
-`"task_cancel"` when the model called `task_cancel`, `"turn_cancelled"` when someone cancelled
+`"task_cancel"` when the model called `eve__task_cancel`, `"turn_cancelled"` when someone cancelled
 the turn, or the working tasks between turns, or `"turn_ended"` when the turn ended, such as by
 failing, while the task still worked. `cancel` is absent when the task's run stopped on its own, and on events recorded by
 earlier eve versions.
@@ -284,9 +284,9 @@ earlier eve versions.
 when an `execute` call opened it. Results reach the model as a message in its history, not as a
 stream event, so read outcomes from `task.settled`. An `input.requested`,
 `authorization.required`, or `authorization.completed` event from a task's run carries its
-`taskId`. Hooks subscribe to the same events. The stream also carries the model's `task_wait` and
-`task_cancel` calls as ordinary `actions.requested` tool calls, so evals can assert on them. The
-`eve dev` terminal UI and Slack typing indicators leave those calls out; the terminal UI shows each
+`taskId`. Hooks subscribe to the same events. The stream also carries the model's `eve__task_wait` and
+`eve__task_cancel` calls as ordinary `actions.requested` tool calls, so evals can assert on them. The
+`eve dev` terminal UI, channel activity such as Slack's status line, and ACP clients leave those calls out; the terminal UI shows each
 task's start and end instead. See
 [Sessions, runs, and streaming](/docs/concepts/sessions-runs-and-streaming#task-events) and
 [Follow a subagent](/docs/guides/client/streaming#follow-a-subagent).
@@ -294,12 +294,12 @@ task's start and end instead. See
 ## Ownership and limits
 
 - **Ownership.** Tasks belong to the session's open turn, not to the caller that started them. A
-  session has at most one open turn, so `task_wait`, `task_cancel`, task results, and the `[Tasks]`
+  session has at most one open turn, so `eve__task_wait`, `eve__task_cancel`, task results, and the `[Tasks]`
   note cover every task in the session. Any later turn can continue an idle resumable task by its
   `taskId`, and that call runs with its own caller's auth. Only the turn's own caller steers it;
   anonymous callers share one identity.
   eve doesn't check which caller started a task: in a session with several people, such as a
-  shared Slack thread, the model working for one person can continue or `task_cancel` a task
+  shared Slack thread, the model working for one person can continue or `eve__task_cancel` a task
   another person started. A continued `serve` task keeps the state its body built for earlier
   calls, so [key per-caller data on the principal](/docs/tools/workflows#resumable-tasks-serve)
   and enforce per-person access inside the tool.

package/docs/tools/workflows.mdx

@@ -273,8 +273,8 @@ Each call is a task with its own id, `<tool>-<6 characters>`:
   `task.result` message, which eve appends at the next step boundary. `toModelOutput` projects the
   result, not the receipt.
 
-The model waits for results with `task_wait` and stops a task with `task_cancel`, and a turn can't
-end while tasks are working. `task_cancel`, `session.cancel()`, a failed turn, and the
+The model waits for results with `eve__task_wait` and stops a task with `eve__task_cancel`, and a turn can't
+end while tasks are working. `eve__task_cancel`, `session.cancel()`, a failed turn, and the
 end of the session abort the call's `abortSignal`; the run waits up to 30 seconds for the body to
 finish unwinding, then ends as cancelled. See [Tasks](/docs/tools/tasks) for what the model sees,
 how held turns look on the stream, steering, events, and limits.
@@ -370,9 +370,9 @@ described in [Tasks](/docs/tools/tasks). What differs:
 - **One `abortSignal` per stretch of work:** a stretch starts when a call reaches an idle task and
   ends when a reply or a cancel settles its calls. Calls that arrive during a stretch share its
   signal, and the next stretch gets a new one, so a task can be cancelled any number of times.
-- **Cancellation:** `task_cancel`, `session.cancel()`, and a failed turn settle the task's waiting
+- **Cancellation:** `eve__task_cancel`, `session.cancel()`, and a failed turn settle the task's waiting
   calls as `cancelled` and abort the stretch's `abortSignal`. The run keeps waiting for more calls,
-  so the task becomes idle and stays available. `task_cancel` on an idle task says the task had no
+  so the task becomes idle and stays available. `eve__task_cancel` on an idle task says the task had no
   work to stop. To stay available, a body must catch its stretch's abort and
   return to `receive()`, as the example does; an abort that escapes the body finishes the task. A
   body that ignores the signal keeps working and its reply is dropped, but a body that doesn't
@@ -408,7 +408,7 @@ async function readRepository(ctx: WorkflowStepToolContext, repository: string)
 }
 ```
 
-Connection tools called through `connection_execute`, ordinary tools, and workflow steps use the same
+Connection tools, ordinary tools, and workflow steps use the same
 authorization machinery for requester identity, token caching, callback completion, and rejection
 after sign-in. The execution runtime owns the wait: an agent returns to its model after authorization,
 while a workflow retries the interrupted step and continues the authored body.
@@ -709,7 +709,7 @@ Use [`ctx.ask`](#ask-a-human-ctxask) when the workflow needs a human answer. See
 ## Cancel and clean up: `ctx.abortSignal`
 
 `ctx.abortSignal` aborts when the call is cancelled: by `session.cancel()`, or, for a task, by
-`task_cancel`, a failed turn, or the end of the session. A steering message also aborts it for an
+`eve__task_cancel`, a failed turn, or the end of the session. A steering message also aborts it for an
 `execute` call; see [Stop early for a new message](#stop-early-for-a-new-message). It is durable:
 it survives replay, and a step that receives it observes the abort. Pass it into the steps that
 should stop, and clean up in `try/finally`:

package/docs/tutorial/ship-it.mdx

@@ -7,7 +7,7 @@ The analytics assistant runs in the TUI. Now add a web dashboard and deploy a pr
 
 ## Add the Web Chat app
 
-Step 1 scaffolded the agent without a web frontend. Add one now with `eve add channel/web`, run from the `analytics-assistant/` directory:
+Step 1 scaffolded the agent without a web frontend. Add one now with `eve add channel/web`, run from the `analytics-assistant/` directory, and choose **Next.js** when it asks which framework to use:
 
 ```bash
 npx eve add channel/web

package/docs/tutorial/team-playbooks.mdx

@@ -5,7 +5,7 @@ description: "Part 6 of the Build an Agent tutorial. Load the caller's team play
 
 The glossary from [Step 5](./remember-definitions) is per-session. But your teams have standing analysis conventions for the analytics assistant (Growth groups revenue by date, Finance reconciles customer totals), and those shouldn't bleed across tenants. Load the right team's playbook for whoever is asking.
 
-A skill is an on-demand procedure. The model pulls it in with `load_skill` only when a turn needs it. Make it dynamic and the skill gets decided at runtime instead of baked in. A `defineDynamic` resolver reads the session and returns a `defineSkill` (or nothing). Here you key that decision on the caller's identity in `ctx.session.auth`.
+A skill is an on-demand procedure. The model pulls it in with `eve__skill({ name })` only when a turn needs it. Make it dynamic and the skill gets decided at runtime instead of baked in. A `defineDynamic` resolver reads the session and returns a `defineSkill` (or nothing). Here you key that decision on the caller's identity in `ctx.session.auth`.
 
 ## A playbook per principal
 
@@ -75,7 +75,7 @@ export default eveChannel({
 });
 ```
 
-Restart with `npm run dev` and ask "Summarize May 2026 revenue using our team's playbook." The model calls `load_skill`, queries the sample data, and applies Growth's daily and plan groupings. Switch `team` to `"finance"`, restart, and start a new session before asking again. The resolver runs at `session.started`, so changing the team does not replace the playbook in an existing session. The same question in the new session uses Finance's reconciliation rules.
+Restart with `npm run dev` and ask "Summarize May 2026 revenue using our team's playbook." The model loads the skill with `eve__skill`, queries the sample data, and applies Growth's daily and plan groupings. Switch `team` to `"finance"`, restart, and start a new session before asking again. The resolver runs at `session.started`, so changing the team does not replace the playbook in an existing session. The same question in the new session uses Finance's reconciliation rules.
 
 Because the team comes from authenticated claims, not from the message, one tenant can't borrow another's playbook through the message content.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.75.1",
+  "version": "0.76.2",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [
@@ -16,6 +16,7 @@
     "observability",
     "react",
     "serverless",
+    "tanstack",
     "tools",
     "vercel",
     "workflow"
@@ -102,6 +103,11 @@
       "import": "./dist/src/public/sveltekit/index.js",
       "default": "./dist/src/public/sveltekit/index.js"
     },
+    "./tanstack": {
+      "types": "./dist/src/public/tanstack/index.d.ts",
+      "import": "./dist/src/public/tanstack/index.js",
+      "default": "./dist/src/public/tanstack/index.js"
+    },
     "./tools/approval": {
       "types": "./dist/src/public/tools/approval/index.d.ts",
       "import": "./dist/src/public/tools/approval/index.js",
@@ -182,11 +188,6 @@
       "import": "./dist/src/public/tools/web-search.js",
       "default": "./dist/src/public/tools/web-search.js"
     },
-    "./tools/load_skill": {
-      "types": "./dist/src/public/tools/load-skill.d.ts",
-      "import": "./dist/src/public/tools/load-skill.js",
-      "default": "./dist/src/public/tools/load-skill.js"
-    },
     "./tools/glob": {
       "types": "./dist/src/public/tools/glob.d.ts",
       "import": "./dist/src/public/tools/glob.js",
@@ -381,6 +382,24 @@
       "import": "./dist/src/extensions/code/extension/lib/prwatch.js",
       "default": "./dist/src/extensions/code/extension/lib/prwatch.js"
     },
+    "./extensions/git": {
+      "eve-source": "./dist/src/extensions/git/extension/extension.js",
+      "types": "./dist/src/extensions/git/extension/extension.d.ts",
+      "import": "./dist/src/extensions/git/extension/extension.js",
+      "default": "./dist/src/extensions/git/extension/extension.js"
+    },
+    "./extensions/git/tools": {
+      "eve-source": "./dist/src/extensions/git/tools.js",
+      "types": "./dist/src/extensions/git/tools.d.ts",
+      "import": "./dist/src/extensions/git/tools.js",
+      "default": "./dist/src/extensions/git/tools.js"
+    },
+    "./extensions/git/sandbox": {
+      "eve-source": "./dist/src/extensions/git/extension/lib/sandbox.js",
+      "types": "./dist/src/extensions/git/extension/lib/sandbox.d.ts",
+      "import": "./dist/src/extensions/git/extension/lib/sandbox.js",
+      "default": "./dist/src/extensions/git/extension/lib/sandbox.js"
+    },
     "./computer-use": {
       "eve-source": "./dist/src/computer-use/extension/extension.js",
       "types": "./dist/src/computer-use/extension/extension.d.ts",
@@ -662,6 +681,9 @@
       "./extensions/code": {
         "dist": "./dist/src/extensions/code/extension"
       },
+      "./extensions/git": {
+        "dist": "./dist/src/extensions/git/extension"
+      },
       "./computer-use": {
         "dist": "./dist/src/computer-use/extension"
       }

package/dist/src/execution/connection-announcement.d.ts

@@ -1,7 +0,0 @@
-import type { ContextContainer } from "#context/container.js";
-/**
- * Announces the agent's connections for the current step: a baseline listing
- * the first time, then only what changed. Tool names and signatures stay out
- * of the listing; `connection_search` returns them.
- */
-export declare function announceConnections(ctx: ContextContainer): void;

package/dist/src/execution/connection-announcement.js

@@ -1,4 +0,0 @@
-import{ConnectionRegistryKey}from"#context/providers/connection-key.js";import{setPendingAnnouncement}from"#harness/announcements.js";const ANNOUNCEMENT_KEY=`connections`;function announceConnections(e){let t=e.get(ConnectionRegistryKey);if(t===void 0){setPendingAnnouncement(e,ANNOUNCEMENT_KEY,void 0);return}let n=t.getConnections().map(e=>({description:e.description,name:e.connectionName})).sort((e,t)=>e.name.localeCompare(t.name));setPendingAnnouncement(e,ANNOUNCEMENT_KEY,{value:JSON.stringify(n),render:e=>renderConnectionsAnnouncement(parseListing(e),n)})}function renderConnectionsAnnouncement(e,t){if(e===void 0||e.length===0)return t.length===0?void 0:renderListing(t);if(t.length===0)return`Connections changed. No connections are available now; do not call connection_execute.`;let n=new Map(e.map(e=>[e.name,e])),r=new Set(t.map(e=>e.name)),i=t.filter(e=>n.get(e.name)?.description!==e.description),a=e.filter(e=>!r.has(e.name)),o=[`Connections changed.`];i.length>0&&o.push([`Added or updated:`,...i.map(formatEntry)].join(`
-`)),a.length>0&&o.push(`No longer available, do not call: ${a.map(e=>e.name).join(`, `)}`);let s=o.join(`
-`),c=`Connections changed. This list replaces the previous one.\n${renderListing(t)}`;return s.length<c.length?s:c}function renderListing(e){return[`Connections. Find their tools with connection_search and call them with connection_execute.`,...e.map(formatEntry)].join(`
-`)}function formatEntry(e){return e.description.length===0?`- ${e.name}`:`- ${e.name}: ${e.description}`}function parseListing(e){if(e!==void 0)try{let t=JSON.parse(e);return Array.isArray(t)?t:void 0}catch{return}}export{announceConnections};

package/dist/src/execution/tools/connection-approval.d.ts

@@ -1,25 +0,0 @@
-/**
- * Approval for `connection_execute`: each call is approved under the called
- * connection's own policy, keyed by connection and tool, and an approved call
- * runs only against the connection instance it was approved for.
- */
-import { type Approval, type ApprovalContext, type ApprovalResponseContext, type ApprovalResponseDecision, type ApprovalStatus } from "#approval/definition.js";
-import type { ResolvedConnectionDefinition } from "#runtime/types.js";
-/**
- * Delegates approval to the called connection's policy. The request and
- * response phases exist only when some registered connection defines them,
- * so connections without a response policy keep the default response flow
- * unless another connection in the same agent defines one.
- */
-export declare function connectionExecuteApproval(approvals: readonly Approval[]): {
-    approvalKey?: undefined;
-    approval?: undefined;
-} | {
-    approvalKey: (input: unknown) => string;
-    approval: ((context: ApprovalContext<Record<string, unknown>>) => Promise<ApprovalStatus>) | {
-        request: (context: ApprovalContext<Record<string, unknown>>) => Promise<ApprovalStatus>;
-        response: (context: ApprovalResponseContext<Record<string, unknown>>) => Promise<ApprovalResponseDecision>;
-    };
-};
-/** Consumes the call's approval pin, rejecting the call if its connection changed. */
-export declare function releaseApprovalPin(callId: string, connection: ResolvedConnectionDefinition): void;

package/dist/src/execution/tools/connection-approval.js

@@ -1 +0,0 @@
-import{CONNECTION_EXECUTE_TOOL_NAME,findConnection,qualifiedToolName,readExecuteTarget}from"./connection-target.js";import{loadContext}from"#context/container.js";import{defineDurableCallback}from"#tools/durable-callbacks.js";import{ContextKey}from"#context/key.js";import{ConnectionRegistryKey}from"#context/providers/connection-key.js";import{resolveApprovalPolicy}from"#approval/definition.js";import{isApprovalRecheck}from"#harness/approval-recheck.js";const ConnectionApprovalPinsKey=new ContextKey(`eve.connectionApprovalPins`);function connectionExecuteApproval(e){if(e.length===0)return{};let t=defineDurableCallback({callback:requestConnectionApproval,closure:{}}),n=e.some(e=>typeof e!=`function`&&e.response!==void 0);return{approvalKey:defineDurableCallback({callback:connectionApprovalKey,closure:{}}),approval:n?{request:t,response:defineDurableCallback({callback:authorizeConnectionApprovalResponse,closure:{}})}:t}}function connectionApprovalKey(e,t){let n=readExecuteTarget(t);return n===void 0?CONNECTION_EXECUTE_TOOL_NAME:approvalKeyFor(n)}function approvalKeyFor(e){return JSON.stringify([e.connection,e.tool])}function policyApprovedTools(e,t){let n=qualifiedToolName(t),r=new Set([...e].filter(e=>e!==n));return e.has(approvalKeyFor(t))&&r.add(n),r}async function requestConnectionApproval(e,t){let n=readExecuteTarget(t.toolInput),r=loadContext().get(ConnectionRegistryKey);if(n===void 0||r===void 0)return`not-applicable`;let i=findConnection(r,n.connection),a=i===void 0?void 0:r.getConnectionApproval(i.connectionName);if(i===void 0||a===void 0)return`not-applicable`;isApprovalRecheck(t)&&!matchesApprovalPin(t.callId,i)&&markApprovalPinChanged(t.callId);let o=await resolveApprovalPolicy(a)({...t,approvedTools:policyApprovedTools(t.approvedTools,n),toolInput:n.input,toolName:qualifiedToolName(n)});return!isApprovalRecheck(t)&&parksForApproval(o)&&pinApprovedInstance(t.callId,i),o}function parksForApproval(e){return e===!0||e===`user-approval`||typeof e==`object`&&e.type===`user-approval`}async function authorizeConnectionApprovalResponse(e,t){let n=readExecuteTarget(t.request.toolInput),r=loadContext().get(ConnectionRegistryKey),i=n===void 0||r===void 0?void 0:findConnection(r,n.connection);if(n===void 0||r===void 0||i===void 0)return{reason:`The connection for this tool call is unavailable.`,status:`rejected`};if(!matchesApprovalPin(t.request.callId,i))return{reason:CONNECTION_CHANGED_MESSAGE,status:`rejected`};let a=r.getConnectionApproval(i.connectionName),o=a===void 0||typeof a==`function`?void 0:a.response;return o===void 0?{status:`allowed`}:await o({...t,request:{...t.request,toolInput:n.input,toolName:qualifiedToolName(n)}})}const CONNECTION_CHANGED_MESSAGE=`The connection for this tool call changed or is unavailable. Request a new tool call and approval.`;function pinApprovedInstance(e,t){let n=t.instanceId??``,r=loadContext();r.get(ConnectionApprovalPinsKey)?.[e]===void 0&&r.set(ConnectionApprovalPinsKey,(t={})=>Object.fromEntries([...Object.entries(t).slice(-49),[e,n]]))}function matchesApprovalPin(e,t){let n=loadContext().get(ConnectionApprovalPinsKey)?.[e];return n!==void 0&&n===(t.instanceId??``)}function markApprovalPinChanged(e){loadContext().set(ConnectionApprovalPinsKey,(t={})=>({...t,[e]:`\0changed`}))}function releaseApprovalPin(e,t){let n=loadContext(),r=n.get(ConnectionApprovalPinsKey);if(r?.[e]===void 0)return;let{[e]:i,...a}=r;if(n.set(ConnectionApprovalPinsKey,a),i!==(t.instanceId??``))throw Error(CONNECTION_CHANGED_MESSAGE)}export{connectionExecuteApproval,releaseApprovalPin};

package/dist/src/execution/tools/connection-search-rank.d.ts

@@ -1,21 +0,0 @@
-/**
- * Keyword ranking for `connection_search` and for `connection_execute`'s
- * suggestions when a tool name is unknown. Query and field text split into
- * lowercase words (camelCase and punctuation are boundaries); a query word
- * matches a field word when either is a prefix of the other, so `repo` finds
- * `repositories` and `issues` finds `issue`. Each query word adds the weight of
- * every field it matches, so broad fields rank below a tool's own name.
- */
-import type { ResolvedConnectionDefinition } from "#runtime/types.js";
-import type { ConnectionToolMetadata } from "#shared/connection-types.js";
-export interface RankCandidate {
-    readonly connection: Pick<ResolvedConnectionDefinition, "connectionName" | "description">;
-    readonly tool: ConnectionToolMetadata;
-}
-/** Candidates matching `query`, best first. An empty query matches every candidate. */
-export declare function rankConnectionTools<T extends RankCandidate>(query: string, candidates: readonly T[]): T[];
-/**
- * Names of one connection's tools closest to an unknown `name`. Only the tools'
- * own fields count, since every candidate shares the connection.
- */
-export declare function closestToolNames(name: string, tools: readonly ConnectionToolMetadata[], limit: number): string[];

package/dist/src/execution/tools/connection-search-rank.js

@@ -1 +0,0 @@
-import{isObject}from"#shared/guards.js";function rankConnectionTools(e,t){let n=tokenize(e);return t.map(e=>({candidate:e,score:n.length===0?1:scoreFields(n,[...toolFields(e.tool),[tokenize(e.connection.connectionName),4],[tokenize(e.connection.description),1]])})).filter(e=>e.score>0).sort((e,t)=>t.score-e.score||e.candidate.connection.connectionName.localeCompare(t.candidate.connection.connectionName)||e.candidate.tool.name.localeCompare(t.candidate.tool.name)).map(e=>e.candidate)}function closestToolNames(e,t,n){let r=tokenize(e);return r.length===0?[]:t.map(e=>({name:e.name,score:scoreFields(r,toolFields(e))})).filter(e=>e.score>0).sort((e,t)=>t.score-e.score||e.name.localeCompare(t.name)).slice(0,n).map(e=>e.name)}function toolFields(e){let t=isObject(e.inputSchema.properties)?Object.entries(e.inputSchema.properties):[],n=t.flatMap(([,e])=>isObject(e)&&typeof e.description==`string`?[e.description]:[]);return[[tokenize(e.name),6],[t.flatMap(([e])=>tokenize(e)),3],[tokenize(e.description),2],[n.flatMap(tokenize),1]]}function scoreFields(e,t){let n=0;for(let r of e)for(let[e,i]of t)e.some(e=>matchesWord(e,r))&&(n+=i);return n}function matchesWord(e,t){return e.startsWith(t)||e.length>=3&&t.startsWith(e)}function tokenize(e){return e.replaceAll(/([a-z0-9])([A-Z])/gu,`$1 $2`).toLowerCase().split(/[^a-z0-9]+/u).filter(e=>e.length>1)}export{closestToolNames,rankConnectionTools};

package/dist/src/execution/tools/connection-target.d.ts

@@ -1,18 +0,0 @@
-/** The `connection_execute` call target, shared by execution and approval. */
-import type { ConnectionRegistry } from "#runtime/connections/registry-types.js";
-import type { ResolvedConnectionDefinition } from "#runtime/types.js";
-import type { JsonObject } from "#shared/json.js";
-export declare const CONNECTION_EXECUTE_TOOL_NAME = "connection_execute";
-export interface ExecuteTarget {
-    readonly connection: string;
-    readonly input: JsonObject;
-    readonly tool: string;
-}
-export declare function readExecuteTarget(value: unknown): ExecuteTarget | undefined;
-export declare function qualifiedToolName(target: Pick<ExecuteTarget, "connection" | "tool">): string;
-/**
- * How a tool call reads to a person: `Linear: List issues` for a
- * `connection_execute` call, otherwise the tool's display title.
- */
-export declare function toolCallDisplayName(toolName: string, input: unknown): string;
-export declare function findConnection(registry: ConnectionRegistry, name: string): ResolvedConnectionDefinition | undefined;

package/dist/src/execution/tools/connection-target.js

@@ -1 +0,0 @@
-import{isObject}from"#shared/guards.js";import{displayProperName,displayTitle}from"#shared/display-name.js";const CONNECTION_EXECUTE_TOOL_NAME=`connection_execute`;function readExecuteTarget(e){if(!isObject(e))return;let{connection:t,input:n,tool:r}=e;if(typeof t==`string`&&typeof r==`string`)return{connection:t,input:isObject(n)?n:{},tool:r}}function qualifiedToolName(e){return`${e.connection}__${e.tool}`}function toolCallDisplayName(e,t){let n=e===`connection_execute`?readExecuteTarget(t):void 0;return n===void 0?displayTitle(e):`${displayProperName(n.connection)}: ${displayTitle(n.tool)}`}function findConnection(e,t){return e.getConnections().find(e=>e.connectionName===t)}export{CONNECTION_EXECUTE_TOOL_NAME,findConnection,qualifiedToolName,readExecuteTarget,toolCallDisplayName};

package/dist/src/execution/tools/connection-tools.d.ts

@@ -1,4 +0,0 @@
-import type { DynamicToolSet } from "#tools/dynamic.js";
-export declare const CONNECTION_SEARCH_TOOL_NAME = "connection_search";
-/** Builds both tools for the current step, or `null` when the agent has no connections. */
-export declare function resolveConnectionTools(): DynamicToolSet | null;