[roboeve]

Refs #4923

Within a turn the principal is now fixed, and only its claims may update. Only the turn's own principal can answer a pending ctx.ask() or ask_question by typing; anyone else's text waits and runs as its own turn. A typed answer from the turn's principal updates ctx.session.auth.current, so its delivery.consumed hooks and the rest of the turn see the request that sent it, also when its payload carries channel state or client context besides the text. Stacked on the repro in #4924; this PR removes its it.fails markers.

Why

Text-answer routing did not check who sent the text. While a turn waits on a question, every admitted delivery is offered to its open prompts, so another person's text could answer it. On main the turn then continued on the asker's auth; a fix that only moved auth.current to the answer's sender would have switched the turn to that other person mid-turn. Steering already enforces the rule this needs: only the turn's own principal joins a running turn.

Approach

• Gate: a typed answer now passes the same check as steering (isSteeringDelivery against the turn's principal) for every relay route: a workflow tool's ctx.ask(), a subagent and a remote agent. Text from anyone else stays in the parent's queue as an ordinary message.
• One owner for the rule: every message that joins a running turn sets the turn's auth through continueTurnAuth (execution/session/principal.ts): the typed-answer join in proxied-deliver-step.ts (joinAnswerToTurn) and the turn step's join in turn-step.ts. It updates the claims of the turn's own principal and throws if another principal's message gets past a gate, so a future path that forgets the gate fails loudly instead of running someone's text under someone else's auth.
• Resumed turns: someone else's answer can resume a parked turn (bob answers alice's session-limit prompt with continue). The resumed turn takes its owner from the persisted session auth, not from the answer's sender, so alice's text keeps steering it and bob's text waits instead of failing the session.
• Mixed deliveries: attributeAnswers gets the open turn's owner. Each answer to an open approval carries its responder, and another principal's answer to a request that is no longer open is dropped instead of becoming text the open turn reads or making that sender the caller.
• Unchanged: someone else's button or structured answer still settles a request with them as its responder, and the turn keeps its caller.

Docs

docs/concepts/security-model.md gets a short section on the rule, and the "What reaches ctx.session.auth" section of the auth guide and the hooks guide state it.

Validation

• Red on test(eve): reproduce a typed ctx.ask answer running under the asking request's auth #4924's head without the markers: the cross-principal tests resolve the question with bob's text (approved: false, answer: "eu-west", relayed 1 forwarded to the child), and the same-principal test sees "asking request".
• Green here: hook-cancellation and edge-cases integration files, all four repros included.
• Parked turns: edge-cases.integration.test.ts adds a regression test where bob types while alice's turn is parked on its session-limit prompt and alice declines. Bob's text runs as his own turn_2. This already holds on current main, so the earlier SessionInputQueue.takeNext change is no longer part of this PR.
• Typed answers with more than text: hook-cancellation.integration.test.ts runs the same-principal typed answer with only text, with channel state, and with client context. The last two kept the asking request's claims before this fix (turn.settled saw "asking request") because the extra fields left a remainder for the parent session, which skipped the claims update.
• A turn waiting on its own tool approval: edge-cases.integration.test.ts adds a test where bob types while alice's turn waits on her approval. Alice approves, her turn completes, and bob's text runs as his own turn_1.
• The queue gate is not needed for program-level parking. A turn with its own open request, working tasks or pending calls pauses inside the session loop, which takes only answers and the turn principal's steering. The program-level parked wait only runs between turns. An instrumented run of the execution, harness, runtime, channel, client, eve-channel, reactions, internal and public integration tiers never parked with an open turn.
• approval-caller.integration.test.ts, new: bob's delivery carries a stale answer with text plus a live approve on alice's requester-only approval. Alice stays the caller and turn auth throughout, nothing settles, and bob's text never reaches the model. Red on main (callers [bob, alice]).
• turn.test.ts: bob's continue answer resumes alice's parked turn; while it runs, alice's pumped text signals steering and bob's does not.
• principal.test.ts covers continueTurnAuth: claims update, input without auth, and refusal for another principal id, another issuer, and an anonymous caller.
• One existing test changed: "keeps the text answer delivery open until the workflow's resumed turn settles" started an anonymous session and answered as alice. Under the rule that is another principal, so its text correctly waits; the session now starts as alice.
• Unit tier → 8229 passed | 1 skipped. Integration tier, run per directory (execution 228, public 834, runtime 90, harness 95, plus channel, client, eve-channel, reactions, internal) → all pass. tsc --noEmit, oxlint and oxfmt pass.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Ready	Preview, v0	Oct 27, 2026 4:17am UTC
eve-pkg	Ready	Preview, v0	Oct 27, 2026 4:17am UTC

[vercel-security-reviewer]

Security review details

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• No notable deltas vs triage/issue-4923-repro (7deee87).

Delta vs triage/issue-4923-repro (7deee87)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.90 MB	7.90 MB	+925 B ⚠️
Package	Unpacked publish size	27.57 MB	27.58 MB	+3.5 kB ⚠️
Package	Installed footprint	76.02 MB	76.02 MB	+3.5 kB ⚠️
Package	Published files	4366	4366	0
Package	Installed files	8363	8363	0
Package	Installed package instances	34	34	0
Package	Distinct installed package names	32	32	0
Package	Installed dependency edges	51	51	0
Package	Installed optional peer edges	17	17	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	21.86 MB	21.87 MB	+7.8 kB ⚠️
Runtime	Public routes	18	18	0

Changed function payloads vs triage/issue-4923-repro (7deee87) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	10.93 MB	10.94 MB	+3.9 kB ⚠️	none
functions/.well-known/workflow/v1/flow.func	changed	10.93 MB	10.94 MB	+3.9 kB ⚠️	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	114.40 MB	114.40 MB	+3.5 kB ⚠️
Installed packages	97	97	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	46.10 MB	46.11 MB	+3.5 kB ⚠️
devDependency package bytes	5.11 MB	5.11 MB	0 B ➖

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260903-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-10-27T04:18:08.889Z
• Route aliases: 18 public, 1 internal (19 total aliases)
• Vercel routes in config: 21
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.84.0
• Package directory: packages/eve
• Tarball: 7.90 MB (eve-0.84.0.tgz)
• Unpacked payload: 27.58 MB across 4366 published files
• Installed footprint: 76.02 MB across 8363 installed files
• Installed root package: 27.58 MB
• Installed dependencies: 48.44 MB
• Installed package instances: 34
• Distinct installed package names: 32
• Installed dependency edges: 51
• Installed optional peer edges: 17
• Runtime dependencies: 2
• Peer dependencies: 15 (14 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 27.58 MB (36.3%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (26.2%)
• ai: 8.50 MB (11.2%)
• zod: 6.15 MB (8.1%)
• undici: 3.58 MB (4.7%)

Publish payload breakdown

Published file size
🟠 dist/src/compiled/shadcn-registry/index.js       [#####...................] 3.85 MB 14.0%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.29 MB 8.3%
🟠 dist/src/compiled/run/index.js                   [#.......................] 1.00 MB 3.6%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 604.9 kB 2.2%
🟡 dist/src/compiled/_chunks/workflow/undici-D-I... [#.......................] 521.9 kB 1.9%
🔴 Other published files                            [########################] 19.31 MB 70.0%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.58 MB 36.3%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.89 MB 26.2%
🔴 ai                              [#######.................] 8.50 MB 11.2%
🔴 zod                             [#####...................] 6.15 MB 8.1%
🟠 undici                          [###.....................] 3.58 MB 4.7%
🟠 nitro                           [##......................] 1.89 MB 2.5%
🔴 Other installed packages        [#######.................] 8.44 MB 11.1%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260903-beta
undici	8.10.2

Peer dependencies (15)

Package	Range	Notes
@linqapp/sdk	^0.47.1	optional peer
@nuxt/kit	^4.0.0	optional peer
@nuxt/schema	^4.0.0	optional peer
@opentelemetry/api	^1.0.0	optional peer
@vercel/connect	^2.5.2	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
chat	^4.42.0	optional peer
dd-trace	^6.13.0	optional peer
just-bash	^3.6.0	optional peer
next	^16.0.0	optional peer
react	^19.0.0	optional peer
svelte	^5.0.0	optional peer
vite	^8.3.1	optional peer
vue	^3.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 114.40 MB across 10280 installed files
• Installed packages: 97 total (91 transitive-only)
• dependencies: 4 direct packages totaling 46.11 MB
• devDependencies: 2 direct packages totaling 5.11 MB
• Other transitive package files: 63.19 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• @typescript/typescript-linux-x64: 27.95 MB (24.4%)
• eve: 27.58 MB (24.1%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (17.4%)
• zod: 9.76 MB (8.5%)
• ai: 8.50 MB (7.4%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 24.4%
🔴 eve                              [########################] 27.58 MB 24.1%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.89 MB 17.4%
🔴 zod                              [########................] 9.76 MB 8.5%
🔴 ai                               [#######.................] 8.50 MB 7.4%
🟠 undici                           [###.....................] 3.58 MB 3.1%
🔴 Other installed packages         [###############.........] 17.16 MB 15.0%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	2.5.2	276.3 kB	0.2%
ai	^7.0.137	8.50 MB	7.4%
eve	file:eve-0.84.0.tgz	27.58 MB	24.1%
zod	4.5.4	9.76 MB	8.5%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.61 MB	2.3%
typescript	7.0.2	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 10.94 MB 50.0%
🔴 functions/__server.func                         [########################] 10.94 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 10.94 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.94 MB
Function files	10.94 MB across 124 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.61 MB (23.8%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.61 MB 23.8%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.1%
🟡 _chunks/sandbox2.mjs                           [#####...................] 937.1 kB 8.6%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 730.7 kB 6.7%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [###.....................] 704.5 kB 6.4%
🔴 Other bundled files                            [########################] 4.96 MB 45.4%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 17 public routes, 1 internal alias • 10.94 MB

Metric	Value
Public routes	/ /.well-known/workflow/v1/webhook/[token] /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/descendants/stream /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/session/[sessionId]/stubs
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.94 MB
Function files	10.94 MB across 124 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.61 MB (23.8%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.61 MB 23.8%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.1%
🟡 _chunks/sandbox2.mjs                           [#####...................] 937.1 kB 8.6%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 730.7 kB 6.7%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [###.....................] 704.5 kB 6.4%
🔴 Other bundled files                            [########################] 4.96 MB 45.4%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 3.74 s -> 4.10 s (+358.2 ms) vs triage/issue-4923-repro (7deee87).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `triage/issue-4923-repro (7deee87)`

Phase	Baseline	Current	Delta
extension.check	7.0 ms	0.5 ms	-6.5 ms
project.resolve	0.4 ms	0.4 ms	0.0 ms
workspace.create	0.6 ms	0.6 ms	0.0 ms
host.prepare	604.6 ms	620.0 ms	+15.4 ms
vercel.service-prefix.resolve	1.9 ms	2.1 ms	+0.2 ms
nitro.create	435.6 ms	447.5 ms	+11.9 ms
sandbox.prewarm	474.9 ms	564.7 ms	+89.8 ms
nitro.cache.prepare	0.3 ms	0.4 ms	+0.1 ms
nitro.prepare	0.8 ms	1.0 ms	+0.2 ms
nitro.public-assets	0.8 ms	0.9 ms	+0.1 ms
nitro.prerender	0.5 ms	0.5 ms	0.0 ms
nitro.bundle	2.06 s	2.31 s	+247.0 ms
nitro.cache.write	0.4 ms	0.3 ms	-0.1 ms
vercel.workflow-function.materialize	56.7 ms	56.1 ms	-0.6 ms
agent-summary.emit	0.6 ms	0.7 ms	+0.1 ms
connect-manifest.emit	0.3 ms	0.3 ms	0.0 ms
nitro.close	0.1 ms	0.1 ms	0.0 ms
output.publish	3.3 ms	3.6 ms	+0.3 ms
workspace.remove	3.1 ms	2.8 ms	-0.3 ms

[roboeve]

This session could not recover from an error (SerializationError: Failed to serialize stream chunk
╰▶ hint: Ensure you're passing workflow serializable types. Check the serialization docs to see what's serializable: https://w…).

Start a new comment to continue.

Error id: 6c9cc615-20fb-40df-a6b1-ff2278f9c1a5

[roboeve]

CI on e2efed0 failed on two tests the rebase onto main left stale, not on the fix itself:

• input-queue.test.ts still called new SessionInputQueue() and read .sequence off enqueueDelivery, which now takes the admitted keys and can return undefined (typecheck TS2554/TS18048).
• The parked-turn test still set limits.maxInputTokensPerSession, which feat(eve)!: replace numeric session limits with a limits.sessionUsage function #5028 replaced with limits.sessionUsage, so the agent config was rejected. On test(eve): reproduce a typed ctx.ask answer running under the asking request's auth #4924 its it.fails marker hid this, since the test failed on config instead of the bug.

Repairs: 422cdc6 on #4924 switches the test to sessionUsage. Without the marker it now fails for the right reason (bob's message cancels alice's turn as bob), and with the marker it's green. 3525086 here does the same and updates the queue test.

Run locally on 3525086: tsc --noEmit is clean, the five session unit files pass (129 tests), and the session-limit, workflow-tool-run and event-proxy-step integration files pass (38 tests). CI on the new head hasn't finished yet.

[roboeve]

The only failure on 21aacc6 was in test-integration (windows-latest): entry-handoff.integration.test.ts > "stops attempting a deployment that cannot read the checkpoint version". That test expects no unexpected output, but a [world-local] Queue message failed (attempt 1, HTTP 500) notice was logged. This PR doesn't touch the handoff path, and all 1539 other integration tests passed on that runner, including the #4923 ones. That points to a timing flake on Windows rather than a regression, so I re-ran the failed job once.

[roboeve]

Attempt 2 of run 40359632606 failed again, still only in test-integration (windows-latest) and still only in entry-handoff.integration.test.ts. Three handoff tests timed out or missed their writes, then the worker hit a JS heap OOM (exit 134). The other 175 files passed, including session-limit-cancellation.

This isn't from this PR: main at de1b9aa fails the same job in the same file (run 40360448250: 4 handoff tests failed, including the same Alice writes ... assertion at line 793). Linux integration passes on this head.

I'm not rerunning again, because it has already been retried and also fails on main. Merging is blocked only on that Windows handoff flake.

[roboeve]

Run 40369187484 on d5b5de1 failed in one job: e2e-local (agent-basic-runtime, openai-sol). One live-model eval failed, runtime/trace-topology (1/2 gates). Its trace had the model step and the schema identity, but not the captured input/output content (content: false), and the eval spent about 40s waiting for it. The other 20 evals passed, including the multi-principal ones (multi-turn-session, workspace-credentials-cancel, client-context).

This PR doesn't touch tracing or content capture, so I'm treating it as transient trace-export timing and re-ran the failed job once.

[roboeve]

CI run 40369187435 on d5b5de1 failed in one job, test-integration (windows-latest), on one test: entry-handoff.integration.test.ts > "stops attempting a deployment that cannot read the checkpoint version". It's the same unexpected [world-local] Queue message failed (attempt 1, HTTP 500) log as before. The other 1544 tests passed, including session-limit-cancellation (both tests green on Windows). This is the Windows handoff flake that also fails on main (run 40360448250), so I re-ran the failed job once.

[roboeve]

Attempt 2 of run 40369187435 failed again in test-integration (windows-latest), but on a different test this time. The entry-handoff flake passed; workflow-tool-run-authorization.integration.test.ts:90 failed with Session stream contract (turn-order) at event 2: step.started outside a turn.

That test passed on this same head in attempt 1 on Windows and in both Linux integration runs. That points to Windows timing flakiness rather than a deterministic regression, but I haven't proven it: this PR does touch turn joining, so a race in turn ordering is possible.

The job has already been retried, so I'm not rerunning it again. The cheapest check is to run workflow-tool-run-authorization in a loop on Windows, or to compare against a recent main Windows run of that file.

[roboeve]

E2E (Vercel) run 40444125995 on 3eaca67 failed in e2e-vercel (agent-deferred-tools) on one eval: billing-specialist.subagent hit The operation was aborted due to timeout after about 4 minutes. The other 6 evals in that fixture passed (29 gates). The e2e-vercel job is just the aggregate.

That eval runs a single mock-model subagent call with no ctx.ask, no typed answer and only one principal, so it shouldn't reach the gate this PR adds. I re-ran the failed jobs once. If it times out again, the next thing to check is workflow run wrun_41M5XPC6FK0GW906S35VH9203S on the preview deployment.

[roboeve]

Both CI runs on 3eaca67 (40444124975, 40444126020) failed only in test-integration (windows-latest). Linux integration passed in both.

• Both runs failed in session-stranded.integration.test.ts:197, which this PR doesn't touch and which is identical to main. The failing assertion is the teardown vi.waitFor (default 1s) waiting for the reset run to reach a terminal status: expected [completed, cancelled, failed] to include 'running'.
• One run also timed out in edge-cases.integration.test.ts:208, the shared waitForChildModelStart helper: "Timed out waiting for child model start". The parent had reached task.started and the child model never started before the deadline.

Recent main Windows runs are green, so the same file failing on both runs here is worth watching. Both failures are timeouts on Windows rather than wrong values, and neither is on a typed-answer or cross-principal path, so I re-ran the failed jobs on both runs once. If session-stranded fails again, it needs a closer look on Windows instead of another rerun.