eve 0.83.2 → 0.83.3

package/docs/connections/openapi.mdx

@@ -115,7 +115,7 @@ export default defineOpenAPIConnection({
 });
 ```
 
-Filters match `operationId`. If an operation does not declare one, use the deterministic name eve derives from the method and path.
+Filters match an operation's `operationId` and its generated tool name, so `block: ["repos.delete"]` also hides the `repos_delete` tool. If an operation does not declare an `operationId`, use the deterministic name eve derives from the method and path.
 
 ## Path parameters
 

package/docs/guides/auth-and-route-protection.md

@@ -105,6 +105,10 @@ Exercise caution for agents that process non-public, sensitive, regulated, or pr
 
 Authenticates a synthetic `local-dev` principal, but only while the process is a local development server: `eve dev` (which sets `EVE_DEV=1`) or `vercel dev` (detected by `VERCEL=1` and `VERCEL_ENV=development` together). This is a property of the deployment, not the request, so no request header can flip it. A production deployment (`eve start`, a Vercel deployment, or any container host) sets neither flag, so `localDev()` authenticates nothing there and every request falls through to the next entry.
 
+On a development server, `localDev()` also refuses requests that a browser sends for another website: the request host or its `Origin` is neither a loopback host nor one of this machine's own addresses. A web page that the developer opens cannot call the local agent, even through DNS rebinding. A frontend served from any loopback host and port, such as `http://localhost:3000` calling `http://127.0.0.1:2000`, still authenticates.
+
+On `eve dev`, `localDev()` also refuses callers whose connection comes from another machine. A server started with `eve dev --host 0.0.0.0` accepts LAN connections, but those callers do not get the `local-dev` principal. A tunnel or reverse proxy on the same machine, such as ngrok or a local nginx, connects from this machine, so the callers it forwards still get `local-dev`.
+
 Because it never opens a production deployment, `localDev()` is safe to leave in the walk. Still put a real authenticator ahead of it so production traffic has something to match.
 
 ### `vercelOidc()`

package/docs/reference/cli.md

@@ -273,7 +273,7 @@ Starts a local development server and terminal UI. To connect the UI to an exist
 
 | Flag                                | Type   | Default            | Description                                                     |
 | ----------------------------------- | ------ | ------------------ | --------------------------------------------------------------- |
-| `--host <host>`                     | string | all interfaces     | Host interface to bind                                          |
+| `--host <host>`                     | string | `127.0.0.1`        | Host interface to bind                                          |
 | `--port <port>`                     | number | `$PORT`, then 2000 | Port to listen on                                               |
 | `--no-ui`                           | flag   | UI on              | Start the server without an interactive UI                      |
 | `--resume`                          | flag   | off                | Attempt recovery of retained runs from previous dev invocations |
@@ -288,6 +288,8 @@ Starts a local development server and terminal UI. To connect the UI to an exist
 | `--context-size <tokens>`           | number | none               | Model context window size                                       |
 | `--logs <mode>`                     | enum   | `error`            | Display `none`, `error`, `warn`, `debug`, or `all` logs         |
 
+`localDev()` refuses callers whose connection comes from another machine. When `--host` binds another interface, such as `0.0.0.0`, those callers need another authenticator in the channel's `auth` list. A tunnel or reverse proxy on the same machine, such as ngrok, cloudflared, or a local nginx, connects from this machine, so every caller it forwards still gets `local-dev`. Put an authenticator in front of any dev server you expose that way.
+
 Local development mounts bundled development extensions without adding files to your project. Pass `--no-default-extensions` to disable them. See [Self-Modification](../guides/self-modification) for details.
 
 A fresh `eve init` opens the TUI and reuses an available model connection or opens `/login`. No Vercel project, channels, integrations, or review step is required before chat. Use `/model` to change models and settings, and `/add` to install an addition. Other `--input` text stays editable in the prompt. See [Terminal UI](../guides/dev-tui) for credential precedence and login options.

package/docs/reference/typescript-api.md

@@ -99,7 +99,9 @@ import icon from "../../assets/icon.png";
 import template from "../../prompts/template.txt?raw";
 ```
 
-`?raw` embeds the file as UTF-8 text. Other non-code asset imports produce a data URL with an inferred media type. Compilation, local development, and production builds use the same resolution behavior. Imports that escape the project package are rejected; package those files with the application instead.
+`?raw` embeds any file as UTF-8 text, including code files such as `.json` and files without an extension, such as a `Dockerfile`. Other non-code asset imports produce a data URL with an inferred media type. Compilation, local development, and production builds use the same resolution behavior.
+
+A workspace package bundled from TypeScript source can import its own assets the same way. Each import may reach files inside the project package or inside the package that contains the importing module. Imports that escape both are rejected; package those files with the application or the workspace package instead.
 
 ## Runtime context (`ctx`)
 

package/docs/tools/tasks.md

@@ -221,8 +221,8 @@ yet, the stream emits `turn.waiting` with the turn's `turnId`. The next `step.st
 same `turnId` means the turn resumed, and `session.waiting` comes only after the turn ends. The
 model's text before the wait depends on the session:
 
-- **Root sessions:** the text completes as an ordinary message. The person can keep writing, and
-  the turn resumes under the same id.
+- **Root sessions:** the text completes as an ordinary message, including text written before
+  `eve__task_wait` in the same step. The person can keep writing, and the turn resumes under the same id.
 - **Child sessions and a schedule's sessions:** the held text step reports
   `finishReason: "tool-calls"` on `message.completed`, so channels post only the final reply.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve",
-  "version": "0.83.2",
+  "version": "0.83.3",
   "private": false,
   "description": "Filesystem-first framework for durable backend AI agents that run anywhere.",
   "keywords": [
@@ -640,7 +640,8 @@
     "braintrust": "^3.0.0",
     "chat": "^4.42.0",
     "dd-trace": "^6.13.0",
-    "just-bash": "^3.1.0"
+    "just-bash": "^3.1.0",
+    "next": "^16.0.0"
   },
   "peerDependenciesMeta": {
     "@opentelemetry/api": {
@@ -657,6 +658,9 @@
     },
     "just-bash": {
       "optional": true
+    },
+    "next": {
+      "optional": true
     }
   },
   "engines": {