[ruiconti]

Continue on a subagent's session-limit prompt now raises the allowance of every session in the asking tree, so the parent and the subagent's siblings no longer ask again for the same spend. This replaces #5061 with a much smaller design.

Why

Since #5028, each session owns a usage window, and a Continue only reset the window of the session that answered. In a delegation tree, that meant the same spend got approved more than once. A worker asked at 45M and the user chose Continue. Then the root asked again as soon as that 45M reported up, and so did any sibling worker near its own limit. The session-limit-renewal eval reproduces this: two lease workers under one root produced 3 asks, where 2 are expected.

Approach

An allowance stays what #5028 made it: the window start plus the quota. A Continue only moves the window start, and it moves it for the whole asking tree.

• Own prompt: the window starts at the session's current totals, as before.
• Prompts relayed from a task run: the window starts at the session's totals plus that run's unreported spend. For each prompt, that's its total minus what the session has already counted from the run, cost included. When one run relays several prompts, it gets the largest of these, not their sum, because nested prompts share spend. That spend then counts in the window being approved, not the next one. The run's count includes everything already reported through it, so this credit can fall short but never overshoot. Prompts relayed through runs that don't report usage up earn no credit.
• Clamp: the window is clamped at 0 per field while the start sits above the totals.
• What counts as Continue: only a real Continue moves the window (sessionLimitDecision, shared by the session and the proxy). Answers like "maybe" or a typed "Approve" do not.
• Push down the tree: each session that moves its window sends a usage-continued control message to its started task runs and blocking workflow tool runs. Those runs pass it to the ctx.agent sessions they opened.
  • A receiving session applies it before its next model call. A parked child closes its own limit prompt once it's back under the limit.
  • The root mints one numbered grant per answered payload: { seq, askers: [{ requestId, total }] }. Every forwarded copy of the answer and every push down the tree carries that same grant.
  • Each session records the last grant seq it applied, and every delivery path goes through one apply step that ignores a grant whose seq is not higher. So a Continue that reaches a session twice, as the answer it forwards and as the push from above, in any order, moves its window once.
  • An answer that carries a grant applies it on admission, before the turn runs, so a session that receives the answer before the push doesn't ask again.
  • Delivery is best-effort. A gone hook is skipped, any other error is logged with the run id, and nothing is retried. A session that misses the push asks once more on its own.
  • The message carries no principal. It never starts a turn and never touches the turn's auth.

A relayed Stop is resolved by the parent before it cancels its turn, and the child's own Stop resolution isn't relayed back up.

Compared with #5061, this drops the extra window fields, the task-table usageWindow, the extension-contract changes and epoch bumps, the renewal-id dedup and overlap check, and the hook-wait, retry and stale-session tracking.

Validation

• e2e (agent-subagents, mock model):
  • session-limit-renewal: 2 asks, the second one from the root at 90M against 85M approved. It was 3 asks before.
  • session-limit-renewal-parked: still 1 answer.
• Cross-principal:
  • Bob's Continue on Alice's relayed prompt settles through responder, and the root turn keeps Alice's auth.
  • The push settles a parked worker's prompt under its own principal.
  • The push starts no turn on an idle session and is applied before that session's next model call.
  • Bob's typed "continue" stays queued while the prompt is open.
• A middle session with two leaf askers, over all 6 delivery orders plus a duplicate copy: one window change and the same window start every time.
• A grant with an older seq changes nothing. The root mints one grant and forwards it; a middle session forwards the grant it was given.
• End to end, an answer forwarded before its push: the asker doesn't ask again, and the push changes nothing. This test fails when admission skips the grant.
• Credit: two prompts open from different sessions under one run are credited by the largest, not the sum. Unreported cost is credited too.
• hitl/relayed-budget-stop-cancels-parent passes. A relayed Stop's answered resolution is recorded at the parent, and the child's Stop isn't relayed back.
• Tree isolation: a Continue in one tree pushes only to that tree's runs, and an answer other than Continue pushes nothing and leaves the window alone.
• Unit tests:
  • credit: the root asks at 90M, not at 45M;
  • credit is limited to what the run hasn't reported;
  • the window clamp;
  • a window start never moves back;
  • a failed push still renews the sender;
  • gone and unreachable ctx.agent sessions;
  • a workflow tool run keeps running when continueUsage fails.
• tsc, oxlint and oxfmt are clean.

Relevant context

• This merges fix(eve): keep a turn's principal fixed for typed ctx.ask answers #4925, which brings test(eve): reproduce a typed ctx.ask answer running under the asking request's auth #4924's commits with it: typed ctx.ask answers from another principal no longer drive the turn. The cross-principal tests above need it. The follow-up commit adapts its tests to limits.sessionUsage and keyed admission.
• The base is main, which already contains feat(eve)!: replace numeric session limits with a limits.sessionUsage function #5028.
• Known gap: in trees three or more levels deep, an ancestor above the asker's direct parent may ask once more when that spend reports up.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Ready	Preview, v0	Oct 26, 2026 5:33pm UTC
eve-pkg	Ready	Preview, v0	Oct 26, 2026 5:33pm UTC

[vercel-internal-security-reviewer]

Security review details

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• No notable deltas vs main (6bc6d68).

Delta vs main (6bc6d68)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.79 MB	7.79 MB	+5.2 kB ⚠️
Package	Unpacked publish size	27.34 MB	27.36 MB	+20.8 kB ⚠️
Package	Installed footprint	75.65 MB	75.67 MB	+20.8 kB ⚠️
Package	Published files	4230	4234	+4
Package	Installed files	8223	8227	+4
Package	Installed package instances	34	34	0
Package	Distinct installed package names	32	32	0
Package	Installed dependency edges	51	51	0
Package	Installed optional peer edges	9	9	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	20.93 MB	21.03 MB	+104.0 kB ⚠️
Runtime	Public routes	18	18	0

Changed function payloads vs main (6bc6d68) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	10.46 MB	10.52 MB	+52.0 kB ⚠️	none
functions/.well-known/workflow/v1/flow.func	changed	10.46 MB	10.52 MB	+52.0 kB ⚠️	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	114.04 MB	114.06 MB	+20.8 kB ⚠️
Installed packages	97	97	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	45.74 MB	45.76 MB	+20.8 kB ⚠️
devDependency package bytes	5.11 MB	5.11 MB	0 B ➖

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260903-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-10-26T17:32:30.445Z
• Route aliases: 18 public, 1 internal (19 total aliases)
• Vercel routes in config: 21
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.83.2
• Package directory: packages/eve
• Tarball: 7.79 MB (eve-0.83.2.tgz)
• Unpacked payload: 27.36 MB across 4234 published files
• Installed footprint: 75.67 MB across 8227 installed files
• Installed root package: 27.36 MB
• Installed dependencies: 48.32 MB
• Installed package instances: 34
• Distinct installed package names: 32
• Installed dependency edges: 51
• Installed optional peer edges: 9
• Runtime dependencies: 2
• Peer dependencies: 7 (6 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 27.36 MB (36.2%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (26.3%)
• ai: 8.37 MB (11.1%)
• zod: 6.15 MB (8.1%)
• undici: 3.58 MB (4.7%)

Publish payload breakdown

Published file size
🟠 dist/src/compiled/shadcn-registry/index.js       [#####...................] 3.85 MB 14.1%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.29 MB 8.4%
🟠 dist/src/compiled/run/index.js                   [#.......................] 1.00 MB 3.7%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 604.9 kB 2.2%
🟡 dist/src/compiled/_chunks/workflow/undici-D-I... [#.......................] 521.9 kB 1.9%
🔴 Other published files                            [########################] 19.09 MB 69.8%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.36 MB 36.2%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.89 MB 26.3%
🔴 ai                              [#######.................] 8.37 MB 11.1%
🔴 zod                             [#####...................] 6.15 MB 8.1%
🟠 undici                          [###.....................] 3.58 MB 4.7%
🟠 nitro                           [##......................] 1.89 MB 2.5%
🔴 Other installed packages        [#######.................] 8.43 MB 11.1%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260903-beta
undici	8.10.2

Peer dependencies (7)

Package	Range	Notes
@opentelemetry/api	^1.0.0	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
chat	^4.42.0	optional peer
dd-trace	^6.13.0	optional peer
just-bash	^3.1.0	optional peer
next	^16.0.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 114.06 MB across 10144 installed files
• Installed packages: 97 total (91 transitive-only)
• dependencies: 4 direct packages totaling 45.76 MB
• devDependencies: 2 direct packages totaling 5.11 MB
• Other transitive package files: 63.18 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• @typescript/typescript-linux-x64: 27.95 MB (24.5%)
• eve: 27.36 MB (24.0%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (17.4%)
• zod: 9.76 MB (8.6%)
• ai: 8.37 MB (7.3%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 24.5%
🔴 eve                              [#######################.] 27.36 MB 24.0%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.89 MB 17.4%
🔴 zod                              [########................] 9.76 MB 8.6%
🔴 ai                               [#######.................] 8.37 MB 7.3%
🟠 undici                           [###.....................] 3.58 MB 3.1%
🔴 Other installed packages         [###############.........] 17.16 MB 15.0%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	2.5.2	276.3 kB	0.2%
ai	^7.0.137	8.37 MB	7.3%
eve	file:eve-0.83.2.tgz	27.36 MB	24.0%
zod	4.5.4	9.76 MB	8.6%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.61 MB	2.3%
typescript	7.0.2	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 10.52 MB 50.0%
🔴 functions/__server.func                         [########################] 10.52 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 10.52 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.52 MB
Function files	10.52 MB across 121 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.55 MB (24.2%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.55 MB 24.2%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.5%
🟡 _chunks/sandbox2.mjs                           [####....................] 815.0 kB 7.8%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 732.3 kB 7.0%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [####....................] 704.5 kB 6.7%
🔴 Other bundled files                            [########################] 4.72 MB 44.9%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 17 public routes, 1 internal alias • 10.52 MB

Metric	Value
Public routes	/ /.well-known/workflow/v1/webhook/[token] /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/session/[sessionId]/stubs /eve/v1/task-input/[token]
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.52 MB
Function files	10.52 MB across 121 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.55 MB (24.2%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.55 MB 24.2%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.5%
🟡 _chunks/sandbox2.mjs                           [####....................] 815.0 kB 7.8%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 732.3 kB 7.0%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [####....................] 704.5 kB 6.7%
🔴 Other bundled files                            [########################] 4.72 MB 44.9%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 3.86 s -> 3.95 s (+87.4 ms) vs main (6bc6d68).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (6bc6d68)`

Phase	Baseline	Current	Delta
extension.check	16.4 ms	18.4 ms	+2.0 ms
project.resolve	0.4 ms	0.4 ms	0.0 ms
workspace.create	0.6 ms	0.6 ms	0.0 ms
host.prepare	576.3 ms	534.3 ms	-42.0 ms
vercel.service-prefix.resolve	1.5 ms	1.8 ms	+0.3 ms
nitro.create	718.7 ms	727.3 ms	+8.6 ms
sandbox.prewarm	572.9 ms	538.8 ms	-34.1 ms
nitro.cache.prepare	0.3 ms	0.2 ms	-0.1 ms
nitro.prepare	0.8 ms	0.7 ms	-0.1 ms
nitro.public-assets	0.8 ms	0.8 ms	0.0 ms
nitro.prerender	0.5 ms	0.5 ms	0.0 ms
nitro.bundle	1.84 s	1.98 s	+149.1 ms
nitro.cache.write	0.3 ms	0.3 ms	0.0 ms
vercel.workflow-function.materialize	49.1 ms	49.8 ms	+0.7 ms
agent-summary.emit	0.8 ms	0.7 ms	-0.1 ms
connect-manifest.emit	0.3 ms	0.4 ms	+0.1 ms
nitro.close	0.1 ms	0.1 ms	0.0 ms
output.publish	3.3 ms	3.3 ms	0.0 ms
workspace.remove	2.5 ms	2.5 ms	0.0 ms

[roboeve]

The credit skips costUsd. unreported only has the four token fields, and the loop on line 53 walks Object.keys(unreported), so a relayed prompt's total.costUsd never gets credited.

The prompt does carry cost (toJsonUsage in harness/hitl/budget-request.ts), resetSessionUsageWindow handles it, and docs/agent-config.md documents a cost limit ((window.costUsd ?? 0) >= 1.5). So with a cost-based sessionUsage, the parent still asks again once the child's already-approved cost reports up. That's the same double ask this PR fixes for tokens.

Suggested fix: credit costUsd when the prompt has it, clamped at 0 like the other fields. A shared clamped-delta helper with usageSince in execution/agent-sessions/usage.ts (which already handles costUsd) would keep the two field lists from drifting apart again.

[roboeve]

An execute workflow tool run that only opens ctx.agent sessions never gets this push.

workflow.ts registers the control hook up front only for task/serve runs (isTask). An execute run registers it later, and only when it relays a message that passes isAnsweredOnControlHook (an ask request or a withdrawal). A ctx.agent child's session-limit prompt goes up as an input-batch, which doesn't pass that check. So the hook can still be missing here while the run is live. ignoreGoneTarget then treats the HookNotFoundError as "gone" and drops the push without logging anything. The run's other ctx.agent sessions keep their old windows and ask again, even though the docs say the running sessions below get the new window.

Suggested fix: register the execute run's hook before it shows up in getBlockingWorkflowToolRuns, at least once it opens a ctx.agent session. Or skip runs whose hook isn't registered yet, and log it, instead of treating them as gone. A test with an execute tool whose ctx.agent children never call ctx.ask would cover this.

[roboeve]

Nit: AGENTS.md (Changesets) asks for a 1 to 2 sentence body. This one has four, and the message.received and claims details are already in docs/guides/hooks.md and auth-and-route-protection.md. Something like: "A turn's principal no longer changes while it runs: only the turn's own principal can answer a pending ctx.ask() or ask_question by typing, and anyone else's text runs as their own turn. Someone else's button answer still settles the request as its responder."