fix(eve): keep sessions live while authorization waits for its callback by ruiconti · Pull Request #1830 · vercel/eve

ruiconti · 2026-08-08T04:48:34Z

Fixes the second session-wedge from research/hitl-request-lifecycle.md (auth-1): while an interactive authorization challenge was open, the session driver waited exclusively on the OAuth callback, so every ordinary message sat unread and the session looked dead.

What

The authorization-callback hook becomes a third, window-gated source of the SessionCommandInbox (claimAuthorization / setAuthorizationWindow / nextWithSource). The driver's exclusive callback wait is replaced by one FIFO wait over callbacks and ordinary session activity.
Integration coverage: a message runs as a full model turn while the challenge stays open, the callback still completes it, and the granted authorization serves the next tool request (workflow-entry.integration.test.ts).
Ungated e2e (agent-tools-hitl/evals/auth/authorization-nonblocking.eval.ts + auth-probe fixture tool): challenge open → message turn → callback completes → session stays conversational.

Data flow

before → park with authorizationNames made the driver loop on authIterator.next() only; deliveries queued unseen until the callback arrived (old loop).
after → the driver waits on the inbox with the authorization window open: callback reads are consumed there; a session read closes the window and falls through to the existing parked-delivery path unchanged. Every park re-derives authorizationNames from durable state, so the challenge survives intervening turns.

Why the inbox, not a race

A first cut raced the callback read against an inbox peek. Under workflow replay both journaled reads resolve in the same tick and Promise.race picks by array order, which diverged from the live winner and hung the run on a determinism mismatch. The inbox already orders multi-hook reads by arrival (order counter) and is replay-stable in production for the stable/continuation pair, so the callback hook joins that mechanism instead. The window gate keeps callbacks from ever surfacing as ordinary deliveries — stray-callback behavior outside an authorization park is unchanged.

Behavior notes

Session timeouts, cancel, clear/compact, and reset now also apply during an open challenge (they arrive through the same inbox); previously they queued behind the callback.
After an intervening turn, the callback turn completes the challenge and re-drives the model; whether the blocked tool re-executes immediately is the model's call. The persisted callback result serves the next explicit tool request either way — pinned by the integration test's final phase.
Multi-challenge parks still batch: callbacks accumulate until every expected challenge reports, across intervening turns.

Checks run: pnpm test:unit, pnpm test:integration, pnpm typecheck, pnpm lint, pnpm guard:invariants — all green locally.

Signed-off-by: Rui Conti <ruiconti@gmail.com>

vercel · 2026-08-08T04:48:40Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview	Aug 8, 2026 4:49am
eve-docs-4759	Ready	Preview, v0	Aug 8, 2026 4:49am

github-actions · 2026-08-08T04:51:59Z

Bundle + Package Summary: `apps/fixtures/weather-agent`

Key takeaways

No notable deltas vs main (f835ad5).

Delta vs `main (f835ad5)`

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.69 MB	7.69 MB	+366 B ⚠️
Package	Unpacked publish size	28.79 MB	28.80 MB	+1.8 kB ⚠️
Package	Installed footprint	72.23 MB	72.23 MB	+1.8 kB ⚠️
Package	Published files	3063	3063	0
Package	Installed files	6773	6773	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	17.06 MB	17.08 MB	+18.3 kB ⚠️
Runtime	Public routes	13	13	0

Changed function payloads vs main (f835ad5) (2)

Function	Status	Baseline	Current	Delta	Route changes
`functions/__server.func`	changed	8.53 MB	8.54 MB	+9.1 kB ⚠️	none
`functions/.well-known/workflow/v1/flow.func`	changed	8.53 MB	8.54 MB	+9.1 kB ⚠️	none

`eve init` install

Metric	Baseline	Current	Delta
Installed footprint	110.64 MB	110.64 MB	+1.8 kB ⚠️
Installed packages	121	121	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	43.28 MB	43.28 MB	+1.8 kB ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

Build Metadata

Preset: vercel
Nitro: nitro@3.0.260610-beta
Output directory: apps/fixtures/weather-agent/.vercel/output
Build metadata timestamp: 2026-08-08T04:51:07.119Z
Route aliases: 13 public, 1 internal (14 total aliases)
Vercel routes in config: 16
Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

Package: eve@0.31.3
Package directory: packages/eve
Tarball: 7.69 MB (eve-0.31.3.tgz)
Unpacked payload: 28.80 MB across 3063 published files
Installed footprint: 72.23 MB across 6773 installed files
Installed root package: 27.44 MB
Installed dependencies: 44.79 MB
Runtime dependencies: 2
Peer dependencies: 5 (4 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.

Heavy installed dependencies

eve: 27.44 MB (38.0%)
@rolldown/binding-linux-x64-gnu: 19.35 MB (26.8%)
ai: 6.67 MB (9.2%)
zod: 5.07 MB (7.0%)
undici: 3.50 MB (4.9%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [################........] 9.68 MB 33.6%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [####....................] 2.42 MB 8.4%
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [###.....................] 1.51 MB 5.2%
🟡 dist/src/compiled/_chunks/workflow/undici-CUI... [#.......................] 508.8 kB 1.8%
🟡 dist/src/compiled/_chunks/node/undici-DWL_MYm... [#.......................] 502.4 kB 1.7%
🔴 Other published files                            [########################] 14.17 MB 49.2%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.44 MB 38.0%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.35 MB 26.8%
🔴 ai                              [######..................] 6.67 MB 9.2%
🔴 zod                             [####....................] 5.07 MB 7.0%
🟠 undici                          [###.....................] 3.50 MB 4.9%
🟠 nitro                           [##......................] 2.41 MB 3.3%
🔴 Other installed packages        [#######.................] 7.79 MB 10.8%

Runtime dependencies (2)

Package	Range	Notes
`nitro`	`3.0.260610-beta`
`undici`	`8.9.0`

Peer dependencies (5)

Package	Range	Notes
`@opentelemetry/api`	`^1.0.0`	optional peer
`ai`	`catalog:`
`braintrust`	`^3.0.0`	optional peer
`just-bash`	`^3.0.0`	optional peer
`microsandbox`	`^0.5.0`	optional peer

eve init install drill-down

`eve init` install details

Command: eve init my-agent
Package manager: npm
Installed footprint: 110.64 MB across 8649 installed files
Installed packages: 121 total (115 transitive-only)
dependencies: 4 direct packages totaling 43.28 MB
devDependencies: 2 direct packages totaling 5.04 MB
Other transitive package files: 62.32 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

@typescript/typescript-linux-x64: 27.95 MB (25.3%)
eve: 27.44 MB (24.8%)
@rolldown/binding-linux-x64-gnu: 19.35 MB (17.5%)
zod: 9.02 MB (8.2%)
ai: 6.67 MB (6.0%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 25.3%
🔴 eve                              [########################] 27.44 MB 24.8%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.35 MB 17.5%
🔴 zod                              [########................] 9.02 MB 8.2%
🔴 ai                               [######..................] 6.67 MB 6.0%
🟠 undici                           [###.....................] 3.50 MB 3.2%
🔴 Other installed packages         [##############..........] 16.71 MB 15.1%

dependencies (4)

Package	Range	Installed size	Share
`@vercel/connect`	`0.4.3`	141.0 kB	0.1%
`ai`	`^7.0.38`	6.67 MB	6.0%
`eve`	`file:eve-0.31.3.tgz`	27.44 MB	24.8%
`zod`	`4.4.3`	9.02 MB	8.2%

devDependencies (2)

Package	Range	Installed size	Share
`@types/node`	`24.x`	2.54 MB	2.3%
`typescript`	`7.0.2`	2.50 MB	2.3%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 8.54 MB 50.0%
🔴 functions/__server.func                         [########################] 8.54 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 8.54 MB

Metric	Value
Public routes	`/.well-known/workflow/v1/flow`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	8.54 MB
Function files	8.54 MB across 44 files
Traced dependencies	0 B
Signal	🟠 Bundled file `index.mjs` is 2.34 MB (27.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [########################] 2.34 MB 27.4%
🟠 _chunks/runtime-artifacts.mjs   [################........] 1.63 MB 19.1%
🟡 _libs/undici.mjs                [##########..............] 980.5 kB 11.5%
🟡 _chunks/sandbox.mjs             [########................] 769.0 kB 9.0%
🟡 _libs/@ai-sdk/gateway+[...].mjs [####....................] 432.8 kB 5.1%
🟠 Other bundled files             [########################] 2.38 MB 27.9%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

🟠 functions/__server.func • 12 public routes, 1 internal alias • 8.54 MB

Metric	Value
Public routes	`/` `/eve/v1/callback/[token]` `/eve/v1/connections/[name]/callback/[token]` `/eve/v1/health` `/eve/v1/info` `/eve/v1/session` `/eve/v1/session/[sessionId]` `/eve/v1/session/[sessionId]/cancel` `/eve/v1/session/[sessionId]/clear` `/eve/v1/session/[sessionId]/compact` `/eve/v1/session/[sessionId]/reset` `/eve/v1/session/[sessionId]/stream`
Internal aliases	`/__server`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	8.54 MB
Function files	8.54 MB across 44 files
Traced dependencies	0 B
Signal	🟠 Bundled file `index.mjs` is 2.34 MB (27.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [########################] 2.34 MB 27.4%
🟠 _chunks/runtime-artifacts.mjs   [################........] 1.63 MB 19.1%
🟡 _libs/undici.mjs                [##########..............] 980.5 kB 11.5%
🟡 _chunks/sandbox.mjs             [########................] 769.0 kB 9.0%
🟡 _libs/@ai-sdk/gateway+[...].mjs [####....................] 432.8 kB 5.1%
🟠 Other bundled files             [########################] 2.38 MB 27.9%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: `e2e/fixtures/agent-tools-sandbox`

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

Build pipeline: 2.48 s -> 1.92 s (-554.1 ms) vs main (f835ad5).
Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (f835ad5)`

Phase	Baseline	Current	Delta
`extension.check`	1.1 ms	4.6 ms	+3.5 ms
`project.resolve`	0.7 ms	2.5 ms	+1.8 ms
`workspace.create`	0.7 ms	1.3 ms	+0.6 ms
`host.prepare`	647.1 ms	164.1 ms	-483.0 ms
`vercel.service-prefix.resolve`	2.8 ms	2.2 ms	-0.6 ms
`nitro.create`	250.8 ms	200.9 ms	-49.9 ms
`sandbox.prewarm`	182.5 ms	207.9 ms	+25.4 ms
`nitro.cache.prepare`	0.2 ms	0.2 ms	0.0 ms
`nitro.prepare`	0.8 ms	0.8 ms	0.0 ms
`nitro.public-assets`	0.7 ms	0.7 ms	0.0 ms
`nitro.prerender`	0.6 ms	0.5 ms	-0.1 ms
`nitro.bundle`	1.36 s	1.31 s	-51.7 ms
`nitro.cache.write`	0.4 ms	0.3 ms	-0.1 ms
`vercel.workflow-function.materialize`	23.1 ms	23.1 ms	0.0 ms
`agent-summary.emit`	0.5 ms	0.5 ms	0.0 ms
`nitro.close`	0.1 ms	0.1 ms	0.0 ms
`output.publish`	3.7 ms	3.5 ms	-0.2 ms
`workspace.remove`	2.4 ms	2.3 ms	-0.1 ms

vercel · 2026-08-08T05:02:44Z

-  const authIterator: AsyncIterator<HookPayload> = authHook[Symbol.asyncIterator]();
+  // Payloads collected for a multi-challenge authorization park accumulate
+  // across intervening turns until every expected callback has reported.
+  const collectedAuthPayloads: DeliverPayload[] = [];


The driver-loop collectedAuthPayloads accumulator is not scoped to the current pending-challenge set, so a stale OAuth callback from an abandoned/replaced authorization challenge can leak into a later, unrelated challenge's collection.

fix(eve): keep sessions live while authorization waits for its callback

2a87780

Signed-off-by: Rui Conti <ruiconti@gmail.com>

vercel Bot deployed to Preview – eve-docs-4759 August 8, 2026 04:49 View deployment

vercel Bot deployed to Preview – eve-docs August 8, 2026 04:49 View deployment

vercel Bot reviewed Aug 8, 2026

View reviewed changes

AndrewBarba approved these changes Aug 8, 2026

View reviewed changes

AndrewBarba enabled auto-merge (squash) August 8, 2026 14:12

Navigation Menu

Uh oh!

fix(eve): keep sessions live while authorization waits for its callback - #1830

fix(eve): keep sessions live while authorization waits for its callback#1830
ruiconti wants to merge 1 commit into
mainfrom
rui/hitl-mitigation-auth

ruiconti commented Aug 8, 2026

Uh oh!

vercel Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 8, 2026

Package Details

`eve init` install details

Payload Size Graph

Top Function Payloads

Uh oh!

vercel Bot Aug 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ruiconti commented Aug 8, 2026

What

Data flow

Why the inbox, not a race

Behavior notes

Uh oh!

vercel Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 8, 2026

Bundle + Package Summary: apps/fixtures/weather-agent

Delta vs main (f835ad5)

eve init install

Package Details

eve init install details

Payload Size Graph

Top Function Payloads

Build Timing: e2e/fixtures/agent-tools-sandbox

Uh oh!

vercel Bot Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Aug 8, 2026 •

edited

Loading

Bundle + Package Summary: `apps/fixtures/weather-agent`

Delta vs `main (f835ad5)`

`eve init` install

`eve init` install details

Build Timing: `e2e/fixtures/agent-tools-sandbox`

vercel Bot Aug 8, 2026 •

edited

Loading