eve 0.79.2 → 0.80.1

package/docs/agent-config.md

@@ -263,7 +263,8 @@ duration. Process restarts, ordinary messages, compaction handoffs, and failed
 or skipped handoffs keep the existing deadline. At the deadline, eve lets an active turn settle,
 then emits `session.completed` and releases every continuation address; the next
 qualifying channel message starts fresh. Set it to `false` to disable the
-timeout. Expiration does not delete stored session data.
+timeout. Session expiration follows [run-data retention](#run-data-retention);
+a zero-retention session loses its stored payloads when it ends.
 
 Input tokens, output tokens, and model token cost are checked independently.
 The model call that crosses a limit is allowed to finish because exact usage
@@ -409,11 +410,24 @@ for the retry behavior.
 
 ## Run data retention
 
-The runtime keeps each run's data after the run finishes: model and tool
-payloads, streamed output, and the event log eve replays from. How long it keeps
-them is the World's decision, and on Vercel that follows your team's plan. Set
-`experimental.workflow.retention` to `0` to have it deleted as soon as the run
-finishes instead:
+By default, eve derives run-data retention from the session's resolved
+[OpenTelemetry trace policy](./observability/otel#configure-opentelemetry):
+
+- When the policy allows both inputs and outputs, eve uses the World's default
+  retention period.
+- When the policy drops the trace or excludes either content direction, eve
+  requests deletion as soon as the run ends with Workflow's
+  `experimental_retention: 0`. Workflow cannot delete inputs and outputs separately.
+
+Without a custom policy, public conversations and development sessions use the
+World's default. Private and unknown-audience sessions outside development request
+`0`, even when no OpenTelemetry destination is installed. This decision is made
+when the session starts; destination export filters and lifecycle-provider
+policies do not change it.
+
+Set `experimental.workflow.retention` explicitly to override this behavior.
+Use `0` to request deletion regardless of the tracing policy, or `"default"` to
+keep run data for the World's default period regardless of the tracing policy:
 
 ```ts title="agent/agent.ts"
 import { defineAgent } from "eve";
@@ -428,18 +442,29 @@ export default defineAgent({
 });
 ```
 
-This applies to every run that owns the session, including successor owners
+The resolved value applies to every run that owns the session, including successor owners
 started after a deployment handoff, and to the run that collects session
 activity. Runs eve starts for other purposes keep the world's default: session
 timeouts and [workflow tools](./tools/workflows).
 
 The value applies per agent. A [subagent](./subagents) that runs its own session
-uses its own value, unlike `experimental.workflow.world`, which is root-only.
-
-Custom Worlds used with eve might not support this feature, in which case
-it falls back to the World's default retention period.
-
-> ⚠️ **At `0`, a finished session's output is usually gone before you can read it.** Since data is deleted immediately before it can be read back, results and transcripts become unreadable and a client polling for a finished session's output can see it disappear.
+uses its own explicit value or derives retention from its resolved trace decision,
+including any inherited content ceiling. `experimental.workflow.world` is root-only.
+
+At `0`, supporting Worlds delete run and step inputs, outputs, and errors;
+event payloads; and stream contents when the run reaches a terminal state. The
+data remains available while the session is active. Run, step, and event records
+remain for the World's default period, including IDs, timestamps, statuses,
+step names, and attributes. Attributes can contain content, including eve's
+session title. This option does not delete local traces, exported telemetry, or
+data stored by tools, channels, or model providers.
+
+The Workflow World enforces deletion, not eve or the SDK. A World older than
+spec version 4 rejects `0`; a spec version 4 World without retention support
+keeps the data. Confirm support with your World provider. See
+[Workflow data retention](https://workflow-sdk.dev/docs/observability/retention).
+
+> ⚠️ **At `0`, completed session transcripts become unreadable.** Deletion races reads of finished runs. Depending on the World, reading deleted session history returns either an empty stream or `410` with `code: "session_expired"`. Persist anything you need to keep from inside a tool, or set `retention: "default"` to preserve completed-session reads independently of tracing.
 
 ## Other defineAgent fields
 

package/docs/code-extension.mdx

@@ -103,9 +103,37 @@ Configure `github` to broker GitHub access through Connect instead. The extensio
 | `github.connector` | With `github` | Connector that mints a GitHub token                                                        |
 | `github.org`       | With `github` | Organization whose repositories the `gh` tool can access                                   |
 | `github.broker`    | With `github` | `broker(sandbox, rules)` callback that installs, then removes, the GitHub credential rules |
+| `github.authorize` | No            | `authorize({ auth, repository, token })` callback that allows or denies each `gh` tool invocation |
 
 The `gh` tool requests a token scoped to exactly one repository in `github.org` for each invocation. The sandbox process receives a placeholder `GH_TOKEN`, and the firewall exchanges it on matching GitHub requests. Your `github.broker` callback receives the header-transform rules for the command, then `null` to remove the lease. The callback must preserve your other network rules. GitHub authentication has no command-delivery option.
 
+`github.authorize` runs during each `gh` tool execution, not when the session starts. The order is: validate the command and repository, mint the repository-scoped app token, await `authorize({ auth, repository, token })`, install the credential lease, then run the command. `auth` is the session's current caller at tool invocation, or `null`. Returning `false` stops execution before the lease is installed or the command runs. The decision applies to that invocation only; it is neither cached for the session nor repeated for each GitHub API request.
+
+For example, use the token to check collaborator status (allowed commands still use the app token's permissions, not the collaborator's):
+
+```ts title="agent/extensions/git.ts"
+import git from "eve/extensions/git";
+
+import { brokerGitHubLease } from "../lib/github";
+
+export default git({
+  github: {
+    connector: "github/my-agent",
+    org: "acme",
+    broker: brokerGitHubLease,
+    // GitHub channel sessions carry the commenter's login as `auth.subject`.
+    async authorize({ auth, repository, token }) {
+      if (auth?.authenticator !== "github-webhook" || !auth.subject) return false;
+      const response = await fetch(
+        `https://api.github.com/repos/${repository}/collaborators/${auth.subject}`,
+        { headers: { authorization: `Bearer ${token}` } },
+      );
+      return response.status === 204;
+    },
+  },
+});
+```
+
 ### Migrate from `code({ github })`
 
 `code({ github })` is deprecated. While it is set, the code extension still contributes `code__gh`, its GitHub instructions, and the signed-commit `code__pr` skill. Without it, the code extension contributes no GitHub tool, instructions, or pull request skill. Move the `github` option to `git({ github })`, and import `gh` and the GitHub sandbox helpers from `eve/extensions/git/tools` and `eve/extensions/git/sandbox`.

package/docs/concepts/built-in-tools.md

@@ -422,6 +422,8 @@ export default noReply();
 
 `no_reply` is a `defineTool` tool with [`endsTurn: true`](/docs/tools#end-the-turn-after-a-tool-call), so the turn ends only when no other tool runs in the same step. Only root sessions receive it. Slack clears the thread status when the turn completes. Remove the file to remove the tool.
 
+A root session also accepts a successful model call that returns no text with `finishReason: "stop"`, without retrying or reporting a model-call failure. A turn that settles with no text completes without a final message. Use `no_reply` when the agent should record an explicit choice to stay quiet, including an optional reason. Delegated sessions still retry an empty reply once and report a failure if it remains empty, so the caller can act on the failure.
+
 ### `sleep`
 
 `sleep` pauses and durably resumes the current turn. The model calls it with `{ seconds }`; the wait does not hold an application runtime open. Concurrent calls run in parallel, and the turn resumes after the longest wait. A steering message, the default for a new message, ends the wait early: `sleep` returns `{ interrupted: true }`, which the model reads as `Stopped early because a new message arrived.`, followed by the message. Add it:

package/docs/connections/mcp.mdx

@@ -205,6 +205,111 @@ An MCP tool call returns the tool's `structuredContent` when the server sends it
 
 When a remote tool returns more data than the model needs, narrow the result at the MCP server. Prefer a purpose-built search or summary tool, or return a stable handle that another call can use to fetch a smaller slice. If you do not control the server and an equivalent upstream API is available, replace only that operation with an authored tool that stores the full payload outside model context and projects the needed fields through `toModelOutput`. Block the original MCP operation through [`tools.block`](#tool-filters) so the model does not see duplicate tools.
 
+## Events (experimental)
+
+An MCP connection can watch the server's events and run your code when one arrives. Vercel Connect holds the upstream subscription and forwards each event to your agent; eve runs your callback.
+
+Requirements:
+
+- A statically authored MCP connection with a static `connect()` auth provider. Dynamic connections and auth resolvers are not supported.
+- `@vercel/connect@2.5.2` or later.
+- An MCP server that supports events over Streamable HTTP.
+
+### Handle events
+
+Add `experimental_events` to the connection. In this example, a user asks the agent to "watch the support inbox and draft replies to new bug reports". The model subscribes to Bird's `email_mailbox.message_received` event for that mailbox. Each new email then starts a turn in the same conversation, with instructions to triage it:
+
+```ts title="agent/connections/bird.ts"
+import { connect } from "@vercel/connect/eve";
+import { defineMcpClientConnection } from "eve/connections";
+
+export default defineMcpClientConnection({
+  url: "https://mcp.bird.com/",
+  description: "Bird: email, SMS, and contacts. Can watch a mailbox for new mail.",
+  auth: connect("bird/bird"),
+  experimental_events: {
+    async onEvent({ event, origin, auth, attachSession }) {
+      if (event.name !== "email_mailbox.message_received") return;
+      await attachSession(origin.sessionId).send(
+        [
+          "A new email arrived in the mailbox you are watching:",
+          JSON.stringify(event.data),
+          "If it is a bug report, look up the sender's earlier threads, draft a reply " +
+            "that says what we know and what happens next, and ask me before sending it. " +
+            "Otherwise, summarize it in one line.",
+        ].join("\n\n"),
+        { auth, turnPolicy: "queue" },
+      );
+    },
+  },
+});
+```
+
+The model does the work with the connection's own tools: it reads the thread, drafts the reply, and waits for the user's approval in the conversation. `turnPolicy: "queue"` lets a burst of emails run one turn after another instead of interrupting the user.
+
+`onEvent` is required. Defining it does not subscribe to anything: the model subscribes at runtime.
+
+Callbacks run outside any conversation, as the user who subscribed (`auth`). Nothing enters a session unless you call `attachSession(sessionId).send(...)`, and `attachSession` never creates a session.
+
+Each delivery runs in its own durable workflow, so callbacks can run concurrently, out of order, and more than once. Use `deliveryId` to deduplicate side effects:
+
+```ts
+async onEvent({ event, deliveryId }) {
+  await fetch("https://crm.example/notes", {
+    method: "POST",
+    headers: { "Idempotency-Key": deliveryId },
+    body: JSON.stringify(event.data),
+  });
+},
+```
+
+### Handle missed events and ended subscriptions
+
+```ts
+experimental_events: {
+  async onEvent({ event }) {
+    // ...
+  },
+  async onGap({ origin, auth, attachSession }) {
+    // The server could not deliver every event. Re-read the source.
+    await attachSession(origin.sessionId).send(
+      "Some Bird events were missed. Re-check the mailbox.",
+      { auth },
+    );
+  },
+  async onTerminated({ origin, auth, error, attachSession }) {
+    // The upstream subscription ended. The watch ends when this returns.
+    await attachSession(origin.sessionId).send(
+      `The Bird watch ended: ${error.message}`,
+      { auth },
+    );
+  },
+},
+```
+
+### What the model can call
+
+`eve__search` lists three kinds of actions for the connection:
+
+| Action                    | Input                  | Result                                  |
+| ------------------------- | ---------------------- | --------------------------------------- |
+| `events_subscribe_<hash>` | `{ arguments, ttlMs }` | `{ id, status, expiresAt, ... }`        |
+| `events_get_subscription` | `{ id }`               | The subscription, or unknown once ended |
+| `events_unsubscribe`      | `{ id }`               | `{ id, status: "stopping" }`            |
+
+There is one subscribe action per event the server offers; its description names the event. `ttlMs` is required: an integer from `120000` (2 minutes) to `31536000000` (365 days), or `null` to watch until stopped. `expiresAt` is the resulting deadline, or `null`.
+
+- **Pending.** If Connect has not confirmed in time, subscribe returns the `id` with `status: "pending"`. Call get with that `id` later.
+- **Repeats.** Subscribing again to the same event with the same arguments from the same session returns the existing watch. Another session gets its own watch.
+- **Stopping.** Get and stop accept the `id` from any of the creator's sessions. After stop, eve keeps retrying Connect's unsubscribe until cleanup completes; until then get still reports the watch and stop can be called again.
+- **Lifetime.** A watch outlives the session that created it. It ends on stop, at `expiresAt`, or when the upstream subscription terminates.
+
+`tools.allow` and `tools.block` apply to these actions. An allow list hides any event action it does not name, so copy the exact `events_subscribe_<hash>` names from `eve__search`. `toolCall.providedArguments` does not apply to event actions.
+
+### Receiver
+
+eve mounts `POST /eve/v1/hooks/:connectionName`, under any configured agent or public prefix. It accepts only Connect's delivery token and only deliveries for a live watch's subscription; it answers `410` once the watch has ended. The callback's identity always comes from the saved watch, never from the event payload.
+
 ## Troubleshooting
 
 | Symptom                                    | Check                                                                                                                                     |

package/docs/connections/openapi.mdx

@@ -119,6 +119,8 @@ Filters match `operationId`. If an operation does not declare one, use the deter
 
 When an operation path contains dynamic segments, the spec must declare matching OpenAPI path parameters. eve exposes path, query, header, and cookie parameters as top-level tool inputs, then substitutes `in: "path"` values into the matching `{name}` placeholder before making the request.
 
+Path parameter values must not be exactly `.` or `..`. eve rejects these values before URL parsing can normalize them and change the route, including values resolved through `toolCall.providedArguments`. Other values remain URL-encoded during substitution, including embedded slashes.
+
 ```ts title="agent/connections/cart.ts"
 import { defineOpenAPIConnection } from "eve/connections";
 

package/docs/guides/instrumentation/otel.mdx

@@ -38,6 +38,16 @@ does not affect lifecycle instrumentation created with `defineInstrumentation()`
 See [Audience](../channels/overview#audience) for how channels classify the
 conversation passed to this policy.
 
+The session's resolved capture decision also selects its default
+[Workflow run-data retention](/docs/agent-config#run-data-retention). Allowing
+both inputs and outputs uses the World's default; dropping the trace or excluding
+either direction requests deletion of durable payloads and streams when the run
+ends. This makes completed private and unknown-audience transcripts unreadable
+under the default policy outside development. Set
+`experimental.workflow.retention: "default"` on the agent to retain completed
+sessions independently of tracing. Destination `exportPolicy` filters do not
+change Workflow retention, and Workflow deletion does not delete exported traces.
+
 ## Instrument Node.js dependencies
 
 Pass OpenTelemetry instrumentation instances to `otel({ instrumentations })`.

package/docs/sandbox/vercel.mdx

@@ -104,6 +104,52 @@ const sandbox = await ctx.getSandbox(environment);
 const sandboxName = sandbox.name;
 ```
 
+## Mount a Drive
+
+A [Vercel Sandbox Drive](https://vercel.com/docs/sandbox/concepts/drives) stores files independently of a sandbox. Create or retrieve the Drive before calling `open()`, then pass it in `mounts` under an absolute path:
+
+```ts
+import { defineSandbox } from "eve/sandbox";
+import { Drive, VercelSandbox } from "eve/sandbox/vercel";
+
+const REGION = "iad1";
+
+export const environment = VercelSandbox.environment({ region: REGION });
+
+export default defineSandbox(async () => {
+  const drive = await Drive.getOrCreate({
+    name: "agent-workspace",
+    region: REGION,
+  });
+
+  return environment.open({
+    mounts: {
+      "/data": drive,
+    },
+  });
+});
+```
+
+This example mounts the Drive read-write at `/data`. Files written there remain on the Drive after the sandbox stops. Keep Drive mounts separate from eve's managed `/workspace` directory.
+
+Set the same region on the environment and the Drive. The environment region places the prepared snapshot and each session sandbox together with the Drive.
+
+A Drive supports one active read-write mount. Because each eve session gets its own sandbox, the fixed `agent-workspace` name works only when one eve session uses the Drive at a time. If sessions can overlap, derive an opaque, stable Drive name per owner or tenant. The [Vercel guide to using Drives with eve](https://vercel.com/kb/guide/vercel-drives-eve-agent) shows how to derive a Drive name from the session initiator.
+
+To share a point-in-time view across concurrent sandboxes, mount a read-only snapshot instead:
+
+```ts
+return environment.open({
+  mounts: {
+    "/data": drive.snapshot(),
+  },
+});
+```
+
+Before mounting `drive.snapshot()`, seed a new Drive by mounting it read-write and writing at least one file. An uninitialized Drive cannot be mounted as a snapshot.
+
+Vercel allows up to four non-overlapping, absolute Drive mount paths per sandbox. See the Vercel documentation for [Drive lifecycle, limits, and pricing](https://vercel.com/docs/sandbox/concepts/drives).
+
 ## Live sandbox options
 
 `open()` also accepts Vercel compute resources, timeout, and Drive mounts. Configure project credentials and custom fetch behavior on the environment, not in `open()`, because resume does not reconstruct start-only options.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.79.2",
+  "version": "0.80.1",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [
@@ -569,12 +569,11 @@
     "@ai-sdk/provider": "^4.0.26",
     "@ai-sdk/provider-utils": "^5.0.58",
     "@cfworker/json-schema": "4.1.1",
-    "@chat-adapter/slack": "4.41.0",
-    "@chat-adapter/state-memory": "4.41.0",
-    "@chat-adapter/twilio": "4.41.0",
+    "@chat-adapter/slack": "4.42.0",
+    "@chat-adapter/state-memory": "4.42.0",
+    "@chat-adapter/twilio": "4.42.0",
     "@clack/core": "1.3.1",
     "@eve/catalog": "0.0.1",
-    "@eve/tracing": "0.0.0",
     "@linqapp/chat-sdk-adapter": "^0.5.1",
     "@modelcontextprotocol/server": "2.0.0",
     "@nuxt/kit": "^4.0.0",
@@ -591,8 +590,9 @@
     "@types/json-schema": "7.0.15",
     "@types/react": "19.2.15",
     "@types/react-test-renderer": "19.1.0",
+    "@vercel/agent-runs": "0.0.1",
     "@vercel/blob": "2.8.0",
-    "@vercel/connect": "2.3.3",
+    "@vercel/connect": "2.5.2",
     "@vercel/detect-agent": "1.2.3",
     "@vercel/oidc": "3.8.0",
     "@vercel/otel": "2.1.3",
@@ -607,7 +607,7 @@
     "@workflow/world-local": "5.1.0",
     "@workflow/world-vercel": "5.2.0",
     "ai": "^7.0.137",
-    "chat": "4.41.0",
+    "chat": "4.42.0",
     "chokidar": "5.0.0",
     "commander": "14.0.3",
     "dd-trace": "6.13.0",
@@ -640,7 +640,7 @@
     "@opentelemetry/api": "^1.0.0",
     "ai": "^7.0.137",
     "braintrust": "^3.0.0",
-    "chat": "^4.41.0",
+    "chat": "^4.42.0",
     "dd-trace": "^6.13.0",
     "just-bash": "^3.1.0",
     "microsandbox": "^0.5.0"

package/dist/src/compiled/_chunks/node/chunk-6QHBXN7B-gl4n6nmi.js

@@ -1,12 +0,0 @@
-var e=/[<>|]/,t=/[\^|>]/,n=/^[A-Z0-9_]+$/,r=/(?<![<\w])@([A-Z][A-Z0-9_]+)/g,i=3e3,a=/^[ \t]+/,o=/^(?:&gt;|&lt;|#{1,6}(?=[ \t\n]|$)|[-+*](?=[ \t\n]|$)|`{3,}|~{3,}|(?:[-*_][ \t]*){3,}(?=\n|$))/,s=/^(\d{1,9})([.)])(?=[ \t\n]|$)/;function c(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`)}function l(e){return e.replace(/&lt;/g,`<`).replace(/&gt;/g,`>`).replace(/&amp;/g,`&`)}function u(e,t={}){return O(e),{...t.emoji===void 0?{}:{emoji:t.emoji},text:e,type:`plain_text`}}function d(e,t={}){return O(e),{text:e,type:`mrkdwn`,...t.verbatim===void 0?{}:{verbatim:t.verbatim}}}function f(e){return k(e,`userId`),`<@${e}>`}function p(e){return k(e,`channelId`),`<#${e}>`}function m(e){return k(e,`userGroupId`),`<!subteam^${e}>`}function h(e){return`<!${e}>`}function g(e,t){return A(e,`url`),t?`<${e}|${c(t)}>`:`<${e}>`}function _(e,t,n,r={}){j(t,`token`);let i=e instanceof Date?Math.floor(e.getTime()/1e3):e;if(!Number.isInteger(i))throw TypeError(`timestamp must be an integer unix timestamp or Date`);return`<!date^${i}^${t}${r.link?`^${M(r.link)}`:``}|${c(n)}>`}function v(e){return l(e.includes("```")?x(e):b(e))}function y(e){let t=e.replace(/<@([A-Z0-9_]+)\|([^<>]+)>/g,`@$2`);return t=t.replace(/<@([A-Z0-9_]+)>/g,`@$1`),t=t.replace(/<#([A-Z0-9_]+)\|([^<>]+)>/g,`#$2 ($1)`),t=t.replace(/<#([A-Z0-9_]+)>/g,`#$1`),t=t.replace(/<(?!https?:\/\/)([^<>|]+)\|(https?:\/\/[^|<>]+)>/g,`<$2|$1>`),t=t.replace(/<(https?:\/\/[^|<>]+)\|([^<>]+)>/g,`[$2]($1)`),t=t.replace(/<(https?:\/\/[^<>]+)>/g,`$1`),t}function b(e){let t=y(e);return t=t.replace(/(?<![_*\\])\*([^*\n]+)\*(?![_*])/g,`**$1**`),t=t.replace(/(?<!~)~([^~\n]+)~(?!~)/g,`~~$1~~`),t}function x(e){let t=``,n=0,r=0,i=!1,a=r=>{let a=e.slice(n,r);i&&=(a=T(a),!1),t+=b(a)};for(;r<e.length;){let o=e[r];if(o===`<`){let t=S(e,r);r=t===-1?r+1:t;continue}if(o!=="`"){r+=1;continue}if(!e.startsWith("```",r)){let t=C(e,r);r=t===-1?r+1:t;continue}let s=r+3,c=e.indexOf("```",s);if(c===-1||w(e,r)){r=s;continue}a(r),t.length>0&&!t.endsWith(`
-`)&&(t+=`
-`);let l=e.slice(s,c);t+="```",l.startsWith(`
-`)||(t+=`
-`),t+=y(l),l.endsWith(`
-`)||(t+=`
-`),t+="```",r=c+3,n=r,r<e.length&&e[r]!==`
-`&&(t+=`
-`,i=!0)}return a(e.length),t}function S(e,t){let n=t+1;for(;n<e.length&&e[n]!==`>`&&e[n]!==`
-`&&e[n]!==`\r`;)n+=1;return e[n]===`>`?n+1:-1}function C(e,t){let n=e.indexOf("`",t+1);if(n===-1)return-1;let r=e.indexOf(`
-`,t+1);return r!==-1&&r<n?-1:n+1}function w(e,t){let n=e.lastIndexOf(`
-`,t-1)+1;return e.slice(n,t).trimStart().startsWith(`&gt;`)}function T(e){let t=a.exec(e)?.[0]??``,n=t.length>0?` `:``,r=e.slice(t.length);return o.test(r)?`${n}\\${r}`:n+r.replace(s,`$1\\$2`)}function E(e){return e.replace(/\*\*(.+?)\*\*/g,`*$1*`)}function D(e){return e.replace(r,`<@$1>`)}function O(e){if(e.length<1||e.length>i)throw TypeError(`text must be between 1 and ${i} characters`)}function k(e,t){if(!n.test(e))throw TypeError(`${t} must be a Slack ID`)}function A(t,n){if(e.test(t))throw TypeError(`${n} cannot contain Slack control characters`)}function j(e,n){if(t.test(e))throw TypeError(`${n} cannot contain Slack date control characters`)}function M(e){return j(e,`link`),e}export{_ as a,f as c,E as d,v as f,p as i,m as l,u as n,g as o,l as p,c as r,h as s,d as t,D as u};