[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

eve@0.85.0

Minor Changes

• 24c6b9f: Client requests now reject redirects by default, including session writes and event streams. Update redirecting base URLs to their final destination, use redirect: "manual" to stop at redirects, or explicitly opt into "follow" only when every redirect destination is trusted.

• c8328f8: Protected cross-project callbacks now require reciprocal Vercel Trusted Sources and an explicit EVE_CALLBACK_TRUSTED_ORIGINS allowlist on the remote deployment. Callback URLs no longer include the parent's deployment-wide bypass secret; listed origins instead receive the remote's short-lived OIDC credential.

• 5cfec0e: Slack renderers can restyle approval, question, and budget prompt cards with a new interactionCard(card, next) hook, while eve keeps routing, batching, action IDs, and card updates. Cards now update from the session for every request kind, so a question answered by a typed reply or withdrawn, or a settled budget prompt, no longer keeps live buttons.

  Breaking changes:

  • SlackChannelState.pendingApprovalCards is replaced by interactionCards. Cards posted before the upgrade keep their buttons.
  • SlackTaskCard is renamed to SlackCardMessage, which both taskCard and interactionCard return.
  • Clicking a question no longer rewrites its card from the webhook. The buttons stay until the session admits the answer, and apps that post eve's controls themselves no longer get that rewrite.
  • An approval's buttons disappear once its answer is admitted, so a later click can't change it. A denied approval reads Deny instead of Cancel, and a direct-message request's thread note reports the same outcome as its card.

Patch Changes

• f20a7a1: Bind native Teams activities to the verified Bot Connector token's service URL before dispatch. Connector requests require HTTPS and reject redirects, keeping bearer credentials on the validated destination.

• 4f290a7: Sessions whose deployment runs eve 0.69 through 0.83 now move to a v27 deployment the next time they receive a message while idle, or earlier when a channel prepares them for the next message, instead of staying on their original deployment until they time out. eve compacts the earlier conversation as the session moves, so the model continues from a summary; the stored transcript stays intact, and new turns continue after it. Remembered tool approvals and usage limits start over.

• 0553a67: Keep continuation capabilities out of session lookup and child-interaction failure logs, including capability values embedded in error messages and causes. Failure diagnostics retain correlation fields and non-secret error details.

• e54f078: Render Teams mention display names and fallback IDs as literal text, preserving names that contain ampersands or angle brackets without changing mention identity.

• ba52da4: Remove the deprecated internal setup type alias RunPnpmOptions. Setup tooling should use RunPackageManagerOptions; package-manager command behavior is unchanged.

• 5b8a34b: to(channel, target).send(), Slack's onEvent ctx.send(), dynamic schedules' to().send(), and channel receive hooks now accept the same options as from(address).send(), including history, idempotencyKey, and title. Slack derives a threadless target's session from idempotencyKey, and a dynamic schedule's keyed send reaches the session its earlier attempt started, so a retried send no longer starts a second thread or session.

• 6ea94da: Set codeChannels: true on slackChannel() to serve Slack code channels as one session per channel. The agent answers un-mentioned messages, replies top-level or in the thread a person wrote in, and follows Slack's session status and stop. The option also adds the code channel scopes and events to the app manifest. A code channel session has no thread: threadTs is empty or null, and ctx.slack.codeChannel marks it. Address its session with { channelId, codeChannel: true } in onEvent targets, or with slackCodeChannelContinuationToken(channelId).

  Two changes also reach agents that don't enable code channels: a cancelled turn now clears the Slack thread status by default, and SlackSessionTarget is now a union, so code that reads target.threadTs must handle the { channelId, codeChannel: true } variant. SlackHandle also gains a required codeChannel field, which affects code that builds a handle by hand.

• 2764e1e: Add openCodeChannel(ctx, slack, message, { name }) to eve/channels/slack, which a tool calls to move the Slack conversation it was called from into a new Slack code channel and continue the work there with the conversation so far. Wrap it in your own tool with your own description and inputs, and pass your Slack channel. It finds the conversation from ctx.channel, so it works when message hooks return their own auth. To write your own variant, Slack receive targets accept codeChannel. Message hooks can open a code channel without the model through ctx.openCodeChannel().

• cb14c32: Reject framework-owned adapter attachment references in HTTP messages and restrict Linq attachment downloads to bounded public HTTPS destinations. Thanks to HackerOne researcher ryota for reporting the attachment-reference boundary issue.

• 412b077: Tools can start or reach sessions on the agent's channels with ctx.to(channel, target).send(message, options), the same call route handlers and schedules use, such as forking a conversation into a new Slack thread. Ordinary tools call it directly, and workflow tools call it in a "use step" helper. Pass idempotencyKey: `${ctx.session.id}:${ctx.callId}` so a retried call reaches the same session once. ctx.to() throws in a subagent, a root copy, or a remote agent call. Tools also get ctx.channel, the calling session's channel kind, continuationToken, and metadata, as hooks and dynamic resolvers read it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Ready	Preview, v0	Oct 28, 2026 2:39am UTC
eve-pkg	Ready	Preview, v0	Oct 28, 2026 2:39am UTC

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• No notable deltas vs main (5cfec0e).

Delta vs main (5cfec0e)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.93 MB	7.93 MB	+1.5 kB ⚠️
Package	Unpacked publish size	27.68 MB	27.68 MB	+5.9 kB ⚠️
Package	Installed footprint	76.08 MB	76.09 MB	+5.9 kB ⚠️
Package	Published files	4385	4385	0
Package	Installed files	8382	8382	0
Package	Installed package instances	34	34	0
Package	Distinct installed package names	32	32	0
Package	Installed dependency edges	51	51	0
Package	Installed optional peer edges	17	17	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	22.18 MB	22.18 MB	-80 B ✅
Runtime	Public routes	18	18	0

Changed function payloads vs main (5cfec0e) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	11.09 MB	11.09 MB	-40 B ✅	none
functions/.well-known/workflow/v1/flow.func	changed	11.09 MB	11.09 MB	-40 B ✅	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	114.46 MB	114.47 MB	+5.9 kB ⚠️
Installed packages	97	97	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	46.16 MB	46.16 MB	+5.9 kB ⚠️
devDependency package bytes	5.11 MB	5.11 MB	0 B ➖

eve init dependency changes vs main (5cfec0e)

dependencies

• Changed: eve@file:eve-0.84.1.tgz -> eve@file:eve-0.85.0.tgz

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260903-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-10-28T02:40:30.140Z
• Route aliases: 18 public, 1 internal (19 total aliases)
• Vercel routes in config: 21
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.85.0
• Package directory: packages/eve
• Tarball: 7.93 MB (eve-0.85.0.tgz)
• Unpacked payload: 27.68 MB across 4385 published files
• Installed footprint: 76.09 MB across 8382 installed files
• Installed root package: 27.68 MB
• Installed dependencies: 48.40 MB
• Installed package instances: 34
• Distinct installed package names: 32
• Installed dependency edges: 51
• Installed optional peer edges: 17
• Runtime dependencies: 2
• Peer dependencies: 15 (14 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 27.68 MB (36.4%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (26.1%)
• ai: 8.45 MB (11.1%)
• zod: 6.15 MB (8.1%)
• undici: 3.58 MB (4.7%)

Publish payload breakdown

Published file size
🟠 dist/src/compiled/shadcn-registry/index.js       [#####...................] 3.85 MB 13.9%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.29 MB 8.3%
🟠 dist/src/compiled/run/index.js                   [#.......................] 1.00 MB 3.6%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 604.9 kB 2.2%
🟡 dist/src/compiled/_chunks/workflow/undici-D-I... [#.......................] 521.9 kB 1.9%
🔴 Other published files                            [########################] 19.42 MB 70.1%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.68 MB 36.4%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.89 MB 26.1%
🔴 ai                              [#######.................] 8.45 MB 11.1%
🔴 zod                             [#####...................] 6.15 MB 8.1%
🟠 undici                          [###.....................] 3.58 MB 4.7%
🟠 nitro                           [##......................] 1.89 MB 2.5%
🔴 Other installed packages        [#######.................] 8.45 MB 11.1%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260903-beta
undici	8.10.2

Peer dependencies (15)

Package	Range	Notes
@linqapp/sdk	^0.47.1	optional peer
@nuxt/kit	^4.0.0	optional peer
@nuxt/schema	^4.0.0	optional peer
@opentelemetry/api	^1.0.0	optional peer
@vercel/connect	^2.5.2	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
chat	^4.42.0	optional peer
dd-trace	^6.13.0	optional peer
just-bash	^3.6.0	optional peer
next	^16.0.0	optional peer
react	^19.0.0	optional peer
svelte	^5.0.0	optional peer
vite	^8.3.1	optional peer
vue	^3.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 114.47 MB across 10299 installed files
• Installed packages: 97 total (91 transitive-only)
• dependencies: 4 direct packages totaling 46.16 MB
• devDependencies: 2 direct packages totaling 5.11 MB
• Other transitive package files: 63.20 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• @typescript/typescript-linux-x64: 27.95 MB (24.4%)
• eve: 27.68 MB (24.2%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (17.4%)
• zod: 9.76 MB (8.5%)
• ai: 8.45 MB (7.4%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 24.4%
🔴 eve                              [########################] 27.68 MB 24.2%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.89 MB 17.4%
🔴 zod                              [########................] 9.76 MB 8.5%
🔴 ai                               [#######.................] 8.45 MB 7.4%
🟠 undici                           [###.....................] 3.58 MB 3.1%
🔴 Other installed packages         [###############.........] 17.17 MB 15.0%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	2.5.2	276.3 kB	0.2%
ai	^7.0.137	8.45 MB	7.4%
eve	file:eve-0.85.0.tgz	27.68 MB	24.2%
zod	4.5.4	9.76 MB	8.5%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.61 MB	2.3%
typescript	7.0.2	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 11.09 MB 50.0%
🔴 functions/__server.func                         [########################] 11.09 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 11.09 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	11.09 MB
Function files	11.09 MB across 124 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.76 MB (24.8%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.76 MB 24.8%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.0%
🟡 _chunks/sandbox2.mjs                           [#####...................] 937.1 kB 8.4%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 730.7 kB 6.6%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [###.....................] 704.5 kB 6.4%
🔴 Other bundled files                            [########################] 4.97 MB 44.8%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 17 public routes, 1 internal alias • 11.09 MB

Metric	Value
Public routes	/ /.well-known/workflow/v1/webhook/[token] /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/descendants/stream /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/session/[sessionId]/stubs
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	11.09 MB
Function files	11.09 MB across 124 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.76 MB (24.8%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.76 MB 24.8%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.0%
🟡 _chunks/sandbox2.mjs                           [#####...................] 937.1 kB 8.4%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 730.7 kB 6.6%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [###.....................] 704.5 kB 6.4%
🔴 Other bundled files                            [########################] 4.97 MB 44.8%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 3.46 s -> 3.37 s (-93.2 ms) vs main (5cfec0e).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (5cfec0e)`

Phase	Baseline	Current	Delta
extension.check	17.0 ms	17.6 ms	+0.6 ms
project.resolve	0.4 ms	0.4 ms	0.0 ms
workspace.create	0.6 ms	0.6 ms	0.0 ms
host.prepare	536.1 ms	433.1 ms	-103.0 ms
vercel.service-prefix.resolve	1.4 ms	1.5 ms	+0.1 ms
nitro.create	409.7 ms	399.0 ms	-10.7 ms
sandbox.prewarm	478.4 ms	423.3 ms	-55.1 ms
nitro.cache.prepare	0.3 ms	0.2 ms	-0.1 ms
nitro.prepare	0.6 ms	0.6 ms	0.0 ms
nitro.public-assets	0.8 ms	0.7 ms	-0.1 ms
nitro.prerender	0.4 ms	0.4 ms	0.0 ms
nitro.bundle	1.86 s	1.92 s	+61.5 ms
nitro.cache.write	0.4 ms	0.3 ms	-0.1 ms
vercel.workflow-function.materialize	73.9 ms	87.1 ms	+13.2 ms
agent-summary.emit	0.9 ms	0.8 ms	-0.1 ms
connect-manifest.emit	0.3 ms	0.3 ms	0.0 ms
nitro.close	0.1 ms	0.1 ms	0.0 ms
output.publish	4.1 ms	4.1 ms	0.0 ms
workspace.remove	2.6 ms	2.7 ms	+0.1 ms