Changelog

Patch Changes

• MCP connections now ask the user to sign in only when the server asks for it. When a connection has auth but no token yet, eve connects without an Authorization header, so servers that allow anonymous initialize and tools/list have their tools listed by connection_search and run by connection_execute with no prompt. Sign-in starts when a call returns HTTP 401 or an error result with a _meta["mcp/www_authenticate"] challenge, and the call runs again with the token once the user signs in. Servers that reject every request without a token behave as before, and connections that already have a token are unchanged.
• mockModel responders see tool-result files again as { type: "file", data: { type: "data", data } } parts in toolResults[].output. Since ai@7.0.116, they had received legacy file-data parts, so a scripted model that looked for an image from toModelOutput could miss it and keep calling the tool.

Minor Changes

• Breaking: follows the AI SDK rename from evaluation to decisions and updates to ai@7.0.128. evaluate from eve/ai is now decide, and auto and t.judge(...) accept Experimental_DecisionModel instances such as provider.decisionModel(...). Replace evaluate imports with decide and evaluationModel(...) calls with decisionModel(...). Extensions built against the previous tool or dynamicTool capability must be rebuilt against this release.

• Tool calls now export one execute_tool span instead of an agent.action wrapper and a tool child. Durable outcomes, approvals, execution metadata, and subagent trace correlation stay on the tool span; the trace schema remains version 4.

  defineInstrumentation no longer supports action.* handlers or InstrumentationAction* types; use tool.call.*, InstrumentationToolCall*, and InstrumentationToolOutput instead. Tool events now describe one durable call lifecycle, and start handlers read event.toolName instead of event.name.

Patch Changes

• Approvals without a response policy can now be approved or cancelled only by the principal whose turn requested the call, so a shared thread no longer lets another person run a tool under the requester's turn. Calls requested by unauthenticated or anonymous callers are unchanged. Tools that need other approvers define approval.response, which replaces the default.
• Add Browserbase web search through AI Gateway, using existing Gateway credentials.
• Files people send now reach the agent on more channels. Telegram keeps a file's real type instead of application/octet-stream, Linear reads uploaded files linked in a prompt (not only images) and leaves a note for one it can't download, and Twilio passes MMS media to the agent. Slack, Telegram, Twilio, and Linear stop a file download at the upload limit instead of reading the whole file into memory.
• Files people send over Chat SDK adapters that download attachments, such as Slack, Google Chat, WhatsApp, and Twilio, now reach the agent instead of a URL the model provider can't open. eve downloads each one in the step with the adapter's credentials, rebuilt through the adapter's rehydrateAttachment; a failed download, or a file over 25 MB, reaches the agent as a short note.
• Discord and Teams now pass files people send to the agent. Discord reads files from slash-command attachment options, and guided setup registers an optional file option. Teams accepts files by default from Bot Connector and SharePoint hosts; set files: { enabled: false } to opt out, and allowedHosts now adds hosts instead of replacing them. Downloads on both stop at the upload limit.
• Fix a TypeScript build error caused by a duplicate duration field in direct tool-call tracing. Direct tool spans now include the same non-framework classification as conversation tool spans.
• Mark eve-provided tools on tool execution spans, and emit tool execution spans for task controls and deferred workflow calls. Local and remote agent tool calls retain their dispatch kind, including background tasks.
• The harness step is now a short pipeline over focused modules: the model call, its recovery, and the human-in-the-loop lifecycle each live in their own module. Behavior is unchanged.
• Restoring a session no longer loads the workflow runtime up front. It now loads when a subagent forwards an approval, sign-in, or question to its parent.
• mcpChannel can now publish the agent's own tools next to the agent_* tools. Set tools: true to list every tool the agent can run outside a conversation, with its JSON schemas, and run each tools/call as the route-authenticated caller. Set agent: false to stop serving the agent_* tools. Both default to what the channel served before, so existing channels do not change.
• Photon iMessage now passes files people send to the agent. eve downloads each attachment from Photon by its id, since the webhook carries no bytes; a failed download reaches the agent as a short note instead of being dropped.
• Approved local tools execute through eve's tool wrappers instead of AI SDK approval-history replay. Execution retains schema and authorization rechecks, concurrent siblings, the originating tool bindings, and the AI SDK's tool telemetry in the step's first attempt; approval markers are replaced by ordinary tool results before the next model call.
• Pending input is withdrawn when cancellation, context clearing, or a finished workflow removes its owner. Messages behind a session-limit prompt enter a held turn once and resume after a grant without duplicate receipt, and a typed approval or budget answer no longer passes the channel context of its consumed message to the model.
• The input.requested stream event type gains an optional callId. On a request relayed from a subagent or workflow tool run, it names the call in the receiving session that the request serves; the request keeps its original turn and step coordinates, and the stream stays on version 26.
• Remove duplicate tool call IDs, error codes, and model provider attributes from agent traces. Runtime context no longer repeats structural channel, session, step, turn, and framework identifiers; trace schema remains version 4. Model and activation spans now emit token counts only under gen_ai.usage.*; step and tool usage and cost values remain unchanged.
• Added toolCallState(conversation, callId, { streaming }) to the client and frontend bindings. Tool parts and ACP tool calls follow task outcomes rather than start receipts (an ACP task call still running when its turn fails ends as failed), withdrawn approvals render as denied, and results marked isError render as errors; public conversation fields and eval policy remain unchanged.
• Add a Sign in with Vercel option to eve add channel/web and the terminal UI's channel picker. Setup offers eligible teams, provisions team-only authentication with production and preview credentials, and explains app limits and name conflicts.

Patch Changes

• When someone other than the person who asked approves a tool call, only that call now runs as the approver. Before, the approver became the caller for the rest of the turn, so later tool calls and approvals in that turn also ran with the approver's identity and credentials.
• Show the budget prompt again when someone sends a message after pressing Stop on it. The re-raised prompt reused the earlier prompt's request id, so eve/client, the Web Chat template, and the dev TUI treated it as already answered and left it unanswerable.
• Typing "approve" on a session budget prompt now resumes the session when you had already sent another message while the prompt was open. Before, eve joined your queued message and the approval into a single message that matched neither option, so the agent stayed blocked. The queued message now runs after the approval.
• chatgpt() now sends serviceTier: "fast" to the Codex backend as priority, the value the Codex CLI uses for Fast mode, instead of failing with 400 Unsupported service_tier: fast.
• Select web search backends using the resolved model provider so dynamic models from non-Gateway providers do not receive AI Gateway tools.
• Return a not-found or transient error before opening an unavailable session stream, and close streams after terminal failures.
• Include a new message in the first model step after cancelling a turn that was waiting for tool approval, instead of first replying to the cancelled call alone.
• eve build keeps the named exports of the Nitro preset entry. Builds with presets such as NITRO_PRESET=node-middleware export middleware and handleUpgrade again instead of only default.
• Channel route handlers now receive invokeTool(name, input, { auth }), which runs one of the agent's tools as the given caller outside any conversation, with a sandbox that lasts for the call. Tools whose approval policy asks a person resolve to approval-required without running.
• Fix channel session.completed handlers throwing when a session expires, resets, or closes between turns. The handler's ctx.session.turn reports the session's last turn.
• Fix nested connector actions appearing as unrelated model tool calls in traces: they now carry their parent call ID and nest beneath the calling action. Action spans also retain their request start time and cover tool execution when SDK telemetry arrives first.
• The Web Chat template now shows every question a tool call asks at once. Before, when a workflow called ctx.ask twice in parallel, the second question replaced the first, so the first question couldn't be answered and the tool stayed blocked.

Patch Changes

• Return a not-found or transient error before opening an unavailable session stream, and close streams after terminal failures.
• Discord now posts session budget prompts instead of failing on a button ID over 100 characters. Slack sends its private sign-in prompt for sign-ins that only have instructions. Teams sign-in cards show the confirmation code and instructions, Twilio texts sign-ins and their outcome, and the dev TUI labels a sign-in with its display name. Discord buttons posted before this update stop working once it's deployed.

Patch Changes

• Telegram, Discord, Teams, and chatSdkChannel now remove a question's or approval's buttons once it's answered and show the outcome, such as Approved or Answered: Saturday. This covers pressed buttons, typed replies, and requests withdrawn when a turn is cancelled. Adapters that can't edit messages keep the original prompt.
• A follow-up message cancelled before its first model call now keeps its own sender as ctx.session.auth.current. Previously the cancelled turn reverted to the previous caller, even when the follow-up was anonymous, so turn.cancelled hooks saw the wrong identity.
• Discord buttons now answer every pending request when a turn asks more than one at once, such as two questions, two tool approvals, or a question beside an approval. Before, only the first request's buttons reached the session; pressing another request's buttons failed with "the target session was not found via continuation token".
• Fix Docker sandbox template pruning so eve dev removes stale template images again, and drop the intermediate eve-sandbox-dockerfile image once its template is committed.
• Sessions saved before eve 0.64 that used a sandbox no longer fail every sandbox call with Sandbox session state belongs to provider "undefined" or the Session checkpoint sandbox provider state is incompatible handoff error. A sandbox record without a provider is treated as no sandbox, so the next sandbox call starts a fresh one.
• Keep MCP connections over HTTP on the 2026-07-28 protocol when the server is slow to answer server/discover. Previously eve gave up after 1 s and fell back to the legacy handshake, which servers that only speak the new protocol reject with Unsupported protocol version: 2025-11-25.
• MCP tools/call requests whose arguments don't match the tool's input schema now return structuredContent.error with code invalid_input, like every other rejected call, instead of only a text message.
• Detect PNG, JPEG, GIF, and WebP files from their bytes in read_file, so images with missing or incorrect filename extensions remain viewable. Text files are always read as text, even with an image extension, and unreadable binary files now get a clear error.
• Channel route handlers now receive describe(), which returns the agent's name, description, and the compiled tools a caller can run outside a turn, with their JSON schemas, without the inspection detail of GET /eve/v1/info.
• Fix a spurious toolResultFrom identity warning when one tool definition is mounted under more than one name, such as the code extension's grep tool in its worker subagent. toolResultFrom now matches results from every name that definition is mounted under.
• Pressing a Telegram question button again after the question is answered now sends that option to the agent as a new message, as it does on other channels. Before, the press was acknowledged and dropped. Button presses also act as the person who pressed them instead of an anonymous caller.
• A plain-text message that answers a pending ctx.ask() question is now recorded as message.received, stamped with its delivery id, before the input.resolved it produces. Clients rendering from the session stream now show what the person typed, and an optimistic copy of the message reconciles instead of lingering. The answer joins the open turn like a steering message, so the turn's later events carry its delivery id too. Model history is unchanged.