Migrate Eve to upstream fixes and minimize compatibility patches

agent/agent.ts

@@ -5,9 +5,7 @@ import { getGatewayModel } from "@db/services/settings";
 import { scopeFromPrincipal } from "@agent/lib/principal-scope";
 
 export default defineAgent({
-  experimental: {
-    tasks: true,
-  },
+  defaultTools: false,
   model: defineDynamic({
     events: {
       "step.started": async (_event, ctx) => {

agent/channels/eve.ts

@@ -1,7 +1,9 @@
+import { defineChannel } from "eve/channels";
 import { eveChannel } from "eve/channels/eve";
 import {
   ForbiddenError,
   localDev,
+  routeAuth,
   UnauthenticatedError,
 } from "eve/channels/auth";
 import { z } from "zod";
@@ -20,52 +22,54 @@ import {
 
 const authenticateLocalDev = localDev();
 
-export default eveChannel({
-  auth: [
-    async (request) => {
-      const identity = await requestIdentityFromRequest(request);
-      if (!identity) return null;
-      const { phoneNumber, scope } = identity;
-
-      await requireOwnedRouteSubject(scope, request);
-
-      return {
-        attributes: {
-          conversationChannel: "eve",
-          phoneNumber,
-          workspaceId: scope.workspaceId,
-        },
-        authenticator: "authjs",
-        principalId: scope.userId,
-        principalType: "user",
-      };
-    },
-    async (request) => {
-      const local = await authenticateLocalDev(request);
-      if (!local) return null;
-
-      const scope = accessScopeForUser("better-auth:browser-benchmark");
-      await requireOwnedRouteSubject(scope, request);
-
-      return {
-        ...local,
-        attributes: {
-          ...local.attributes,
-          conversationChannel: "eve",
-          phoneNumber: "+15555550100",
-          workspaceId: scope.workspaceId,
-        },
-        principalId: scope.userId,
-        principalType: "user" as const,
-      };
-    },
-    () => {
-      throw new UnauthenticatedError({
-        code: "authentication_required",
-        message: "Sign in to continue.",
-      });
-    },
-  ],
+const authenticate: Parameters<typeof routeAuth>[1] = [
+  async (request) => {
+    const identity = await requestIdentityFromRequest(request);
+    if (!identity) return null;
+    const { phoneNumber, scope } = identity;
+
+    await requireOwnedRouteSubject(scope, request);
+
+    return {
+      attributes: {
+        conversationChannel: "eve",
+        phoneNumber,
+        workspaceId: scope.workspaceId,
+      },
+      authenticator: "authjs",
+      principalId: scope.userId,
+      principalType: "user",
+    };
+  },
+  async (request) => {
+    const local = await authenticateLocalDev(request);
+    if (!local) return null;
+
+    const scope = accessScopeForUser("better-auth:browser-benchmark");
+    await requireOwnedRouteSubject(scope, request);
+
+    return {
+      ...local,
+      attributes: {
+        ...local.attributes,
+        conversationChannel: "eve",
+        phoneNumber: "+15555550100",
+        workspaceId: scope.workspaceId,
+      },
+      principalId: scope.userId,
+      principalType: "user" as const,
+    };
+  },
+  () => {
+    throw new UnauthenticatedError({
+      code: "authentication_required",
+      message: "Sign in to continue.",
+    });
+  },
+];
+
+const channel = eveChannel({
+  auth: authenticate,
   events: {
     async "action.result"(event, _channel, session) {
       if (
@@ -98,6 +102,36 @@ export default eveChannel({
   },
 });
 
+// Eve callback handlers authenticate their capability tokens internally. Apply
+// this app's caller and workspace ownership policy at the public route boundary.
+const ownedCallbackRoutes = new Set([
+  "/eve/v1/connections/:name/callback/:attemptId/:token",
+  "/eve/v1/connections/:name/callback/:token",
+  "/eve/v1/callback/:token",
+  "/eve/v1/task-input/:token",
+]);
+
+export default defineChannel({
+  ...channel,
+  // oxlint-disable-next-line oxc/no-map-spread -- Keep Eve's original route definitions intact when adding the app authorization boundary.
+  routes: channel.routes.map((route) => {
+    if (
+      route.transport === "websocket" ||
+      !ownedCallbackRoutes.has(route.path)
+    ) {
+      return route;
+    }
+    return {
+      ...route,
+      async handler(request, context) {
+        const principal = await routeAuth(request, authenticate);
+        if (principal instanceof Response) return principal;
+        return route.handler(request, context);
+      },
+    };
+  }),
+});
+
 // Routes without a session subject. Every other eve route must name a session
 // this caller owns, either in the path or inside a hook token.
 const subjectFreeRoutes = new Set(["/eve/v1/info", "/eve/v1/session"]);

agent/subagents/browser-agent/lib/trace/timeline.ts

@@ -46,7 +46,7 @@ export function traceTimelineRows(event: HookEvent): TraceTimelineRow[] {
         detail: compactJson(action.input),
         id: `${id}:${String(index)}`,
         label:
-          action.kind === "tool-call"
+          action.kind === "tool-call" || action.kind === "workflow-tool-call"
             ? action.toolName
             : action.kind === "load-skill"
               ? "Load skill"

agent/tools/ask_question.ts

@@ -0,0 +1 @@
+export { default } from "eve/tools/ask_question";

agent/tools/task_cancel.ts

@@ -0,0 +1 @@
+export { default } from "eve/tools/task_cancel";

agent/tools/task_update.ts

@@ -0,0 +1 @@
+export { default } from "eve/tools/task_update";

agent/tools/web_fetch.ts

@@ -0,0 +1 @@
+export { default } from "eve/tools/web_fetch";

agent/tools/web_search.ts

@@ -0,0 +1 @@
+export { default } from "eve/tools/web_search";

evals/browser/benchmark-activity.ts

@@ -31,7 +31,17 @@ export function browserBenchmarkActivity(
 ) {
   for (const event of events.toReversed()) {
     if (event.type === "message.appended") {
-      const message = activityLine(event.data.messageSoFar);
+      const message = activityLine(
+        events
+          .flatMap((candidate) =>
+            candidate.type === "message.appended" &&
+            candidate.data.turnId === event.data.turnId &&
+            candidate.data.stepIndex === event.data.stepIndex
+              ? [candidate.data.messageDelta]
+              : []
+          )
+          .join("")
+      );
       if (message) return message;
     }
     if (event.type === "message.completed") {

evals/browser/tests/browser-benchmark-activity.test.ts

@@ -46,15 +46,24 @@ describe("browser benchmark live activity", () => {
         } satisfies MessageStreamEvent,
         {
           data: {
-            messageDelta: "Searching",
-            messageSoFar: "Searching current Brooklyn showtimes",
+            messageDelta: "Searching ",
             sequence: 0,
             stepIndex: 0,
             turnId: "turn_1",
           },
           meta: { at: "2026-08-31T17:00:01.000Z", id: "evt_message" },
           type: "message.appended",
         } satisfies MessageStreamEvent,
+        {
+          data: {
+            messageDelta: "current Brooklyn showtimes",
+            sequence: 0,
+            stepIndex: 0,
+            turnId: "turn_1",
+          },
+          meta: { at: "2026-08-31T17:00:02.000Z", id: "evt_message_2" },
+          type: "message.appended",
+        } satisfies MessageStreamEvent,
       ])
     ).toBe("Searching current Brooklyn showtimes");
   });

package.json

@@ -23,15 +23,15 @@
     "@vercel/blob": "2.8.0",
     "@vercel/connect": "^2.0.0",
     "@vercel/oidc": "3.8.5",
-    "ai": "^7.0.79",
+    "ai": "^7.0.93",
     "better-auth": "1.7.2",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "cmdk": "1.1.1",
     "credit-card-type": "^10.3.0",
     "drizzle-orm": "^0.45.2",
-    "eve": "^0.49.0",
-    "evlog": "2.27.1",
+    "eve": "https://pkg.eve.dev/59ec96cc99f65a80f7a2daf4ca5e2a0ad95455f2/eve.tgz",
+    "evlog": "2.28.1",
     "lucide-react": "1.34.0",
     "motion": "13.1.1",
     "nanoid": "6.0.1",
@@ -43,7 +43,7 @@
     "tailwind-merge": "3.6.0",
     "tailwindcss": "4.3.3",
     "use-stick-to-bottom": "1.1.6",
-    "zod": "4.4.3"
+    "zod": "4.5.4"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.8",

patches/README.md

@@ -0,0 +1,37 @@
+# Eve and Linq patches
+
+Eve is pinned to the official, immutable `pkg.eve.dev` build at
+`59ec96cc99f65a80f7a2daf4ca5e2a0ad95455f2` (`0.52.2+main.59ec96cc99f65a80`).
+It includes the merged turn-context placement fix in
+[vercel/eve#3089](https://github.com/vercel/eve/pull/3089), which is absent from
+npm's `0.52.2` release. Return to a registry version once a release contains this
+commit and the patches below have been checked against it.
+
+The tarball SHA-256 is
+`633c0d9ebf5d0d5733d8cc2fdc5315952a7ccca8cb7902c31f550dc8ab0750a9`.
+The lockfile also records its package integrity. pnpm matches URL dependency
+patches by package name, so keep the immutable dependency pin when changing the
+Eve patch.
+
+## Remaining patches
+
+- `@linqapp__chat-sdk-adapter@0.5.1.patch` adds `replyToMessageId` to native
+  message delivery, preserving attachments and idempotency keys.
+- `eve@0.52.2+main.59ec96cc99f65a80.patch` applies that same reply option to the
+  adapter Eve actually bundles. It also redirects incomplete bundled Linq and
+  Chat SDK declaration exports to the explicitly installed packages. Eve's
+  runtime still uses its bundled adapter and Chat SDK.
+
+Remove reply changes when upstream Linq and Eve's bundled adapter both support
+native replies. Remove declaration bridges when the published declaration
+files resolve without them. `linq-bundled-adapter.test.ts` exercises Eve's actual
+bundled runtime; `linq-message-delivery.test.ts` covers application delivery and
+the separately installed adapter.
+
+The old Eve patches for `ask_question` and `task_cancel` exports are no longer
+needed: both now have public entry points. Callback authorization is composed
+in `agent/channels/eve.ts` using public `defineChannel` and `routeAuth` APIs.
+The Linq webhook verifier already converts an unsuccessful OIDC verification
+into `false`, so the extra bundled null-verifier patch was redundant.
+
+No task-loop or prompt-placement patch is applied locally.