fix(eve): inbox upgrades - retain compatible session execution

[AndrewBarba]

Summary

A published 0.49.0 session can complete a background task and then fatally fail its next user turn on a newer eve deployment because the task-state contracts differ. This change forwards turns with an unconfirmed state contract to the session’s retained original deployment before executing agent code, preserving the old input, state-return, stream, and control contracts. Pre-boundary sessions keep their original agent code; new sessions declare a state contract and retain ordinary code upgrades. The unified inbox plan records this conservative upgrade path and its remaining release gates.

Stacked on #3005. Related to #876.

Behavior and boundaries

• A missing or mismatched driverCapabilities.stateContractVersion uses retained Vercel execution. The original input reaches the old child unchanged, and it speaks directly to the original parent’s control and cancellation hooks. Task-free legacy sessions are also retained because their next turn could create incompatible state.
• The forwarding start reuses a run ID persisted by its preceding prepare step, including after an ambiguous start result or child completion. Deduplication across separately created forwarding runs remains a broader dispatch release gate.
• Existing sessions require their original deployments, Workflow data, and credentials to remain available. Their authored instructions/tools stay pinned; fresh sessions use current code. Agent-code rollback keeps the current runtime; a package downgrade to a pre-boundary runtime is unsupported.
• This implementation covers Vercel retained deployments. Self-hosted executable replacement, the new inbox topology, the full historical cohort matrix, and mixed-ingress conversation claims remain release gates.
• The published 0.49.0 probe preserves every runtime code byte; its fixture-only package manifest correction removes source-only exports pointing at files absent from npm. The original 0.30.8 consumer test remains in place.

Validation

• The original hosted failure reproduced at 617b68328: Vercel job and execution records.
• The updated hosted probe requires the old task-owning session to accept its next message, then start and complete another background task. It also covers new blocking work after upgrade, pending answers, cancellation, saved stream cursors, fresh sessions, and code rollback. At e8d44a692, all 56 hosted checks passed: Vercel upgrade and rollback job. The retained 0.30.8 Vercel test and Local/Postgres fixture baselines also passed. Subsequent changes only record these results in the research plan.
• 113 focused unit tests passed across turn dispatch, state-contract construction, turn control, and retained execution.
• The Workflow integration test passed with an injected lost queue acknowledgement, a retry, completion, and another retry; only one run exists.
• pnpm --filter eve build passed, with unresolved-import warnings in the self-modification extension. All 44 workspace typechecks, formatting, git diff --check, pnpm docs:check, lint, and invariant checks passed; lint reported two unrelated existing warnings.
• E2E runs only in CI. A patch changeset and deployment guidance are included.

Checklist

• This change was requested or approved by a maintainer
• I ran the relevant checks from CONTRIBUTING.md
• I added tests and documentation where relevant
• I added a changeset if this touches the published eve package
• DCO sign-off passes for every commit (git commit --signoff)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Building	Preview	Sep 4, 2026 5:30pm UTC
eve-docs-4759	Ready	Preview, v0	Sep 4, 2026 5:30pm UTC
eve-pkg	Ready	Preview	Sep 4, 2026 5:30pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​eve@​0.49.0

View full report

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• No notable deltas vs barba/unified-workflow-hooks (ccbd4b6).

Delta vs barba/unified-workflow-hooks (ccbd4b6)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	8.66 MB	8.66 MB	+1.6 kB ⚠️
Package	Unpacked publish size	32.65 MB	32.65 MB	+4.2 kB ⚠️
Package	Installed footprint	77.82 MB	77.83 MB	+4.2 kB ⚠️
Package	Published files	3845	3847	+2
Package	Installed files	7691	7693	+2
Package	Installed package instances	35	35	0
Package	Distinct installed package names	34	34	0
Package	Installed dependency edges	53	53	0
Package	Installed optional peer edges	47	47	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	20.46 MB	20.47 MB	+10.4 kB ⚠️
Runtime	Public routes	18	18	0

Changed function payloads vs barba/unified-workflow-hooks (ccbd4b6) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	10.23 MB	10.24 MB	+5.2 kB ⚠️	none
functions/.well-known/workflow/v1/flow.func	changed	10.23 MB	10.24 MB	+5.2 kB ⚠️	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	116.26 MB	116.26 MB	+4.2 kB ⚠️
Installed packages	120	120	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	48.71 MB	48.71 MB	+4.2 kB ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260610-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-09-04T17:31:46.873Z
• Route aliases: 18 public, 1 internal (19 total aliases)
• Vercel routes in config: 21
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.51.0
• Package directory: packages/eve
• Tarball: 8.66 MB (eve-0.51.0.tgz)
• Unpacked payload: 32.65 MB across 3847 published files
• Installed footprint: 77.83 MB across 7693 installed files
• Installed root package: 31.19 MB
• Installed dependencies: 46.64 MB
• Installed package instances: 35
• Distinct installed package names: 34
• Installed dependency edges: 53
• Installed optional peer edges: 47
• Runtime dependencies: 2
• Peer dependencies: 5 (4 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 31.19 MB (40.1%)
• @rolldown/binding-linux-x64-gnu: 19.31 MB (24.8%)
• ai: 6.99 MB (9.0%)
• zod: 6.41 MB (8.2%)
• undici: 3.51 MB (4.5%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [#############...........] 9.76 MB 29.9%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.27 MB 7.0%
🟠 dist/src/compiled/@ai-sdk/code-mode/index.js     [#.......................] 1.03 MB 3.1%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 901.8 kB 2.8%
🟡 dist/src/compiled/_chunks/workflow/undici-Dfx... [#.......................] 512.5 kB 1.6%
🔴 Other published files                            [########################] 18.18 MB 55.7%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 31.19 MB 40.1%
🔴 @rolldown/binding-linux-x64-gnu [###############.........] 19.31 MB 24.8%
🔴 ai                              [#####...................] 6.99 MB 9.0%
🔴 zod                             [#####...................] 6.41 MB 8.2%
🟠 undici                          [###.....................] 3.51 MB 4.5%
🟠 nitro                           [##......................] 2.41 MB 3.1%
🔴 Other installed packages        [######..................] 8.00 MB 10.3%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260610-beta
undici	8.9.0

Peer dependencies (5)

Package	Range	Notes
@opentelemetry/api	^1.0.0	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
just-bash	^3.1.0	optional peer
microsandbox	^0.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 116.26 MB across 9589 installed files
• Installed packages: 120 total (114 transitive-only)
• dependencies: 4 direct packages totaling 48.71 MB
• devDependencies: 2 direct packages totaling 5.04 MB
• Other transitive package files: 62.51 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• eve: 31.19 MB (26.8%)
• @typescript/typescript-linux-x64: 27.95 MB (24.0%)
• @rolldown/binding-linux-x64-gnu: 19.31 MB (16.6%)
• zod: 10.37 MB (8.9%)
• ai: 6.99 MB (6.0%)

Installed footprint breakdown

Installed package size
🔴 eve                              [########################] 31.19 MB 26.8%
🔴 @typescript/typescript-linux-x64 [######################..] 27.95 MB 24.0%
🔴 @rolldown/binding-linux-x64-gnu  [###############.........] 19.31 MB 16.6%
🔴 zod                              [########................] 10.37 MB 8.9%
🔴 ai                               [#####...................] 6.99 MB 6.0%
🟠 undici                           [###.....................] 3.51 MB 3.0%
🔴 Other installed packages         [#############...........] 16.94 MB 14.6%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	1.0.0	167.9 kB	0.1%
ai	^7.0.82	6.99 MB	6.0%
eve	file:eve-0.51.0.tgz	31.19 MB	26.8%
zod	4.5.4	10.37 MB	8.9%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.54 MB	2.2%
typescript	7.0.2	2.50 MB	2.1%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 10.24 MB 50.0%
🔴 functions/__server.func                         [########################] 10.24 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 10.24 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.24 MB
Function files	10.24 MB across 112 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.21 MB (21.6%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [###########.............] 2.21 MB 21.6%
🟡 _libs/undici.mjs                [#####...................] 980.5 kB 9.6%
🟡 _chunks/decode_jwt-Col8JOnf.mjs [###.....................] 702.6 kB 6.9%
🟡 _chunks/rename-with-retry.mjs   [###.....................] 696.3 kB 6.8%
🟡 _chunks/frames-CZ9eHShe.mjs     [###.....................] 679.1 kB 6.6%
🔴 Other bundled files             [########################] 4.97 MB 48.6%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 17 public routes, 1 internal alias • 10.24 MB

Metric	Value
Public routes	/ /.well-known/workflow/v1/webhook/[token] /eve/v1/activity/[token] /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/task-input/[token]
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.24 MB
Function files	10.24 MB across 112 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.21 MB (21.6%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [###########.............] 2.21 MB 21.6%
🟡 _libs/undici.mjs                [#####...................] 980.5 kB 9.6%
🟡 _chunks/decode_jwt-Col8JOnf.mjs [###.....................] 702.6 kB 6.9%
🟡 _chunks/rename-with-retry.mjs   [###.....................] 696.3 kB 6.8%
🟡 _chunks/frames-CZ9eHShe.mjs     [###.....................] 679.1 kB 6.6%
🔴 Other bundled files             [########################] 4.97 MB 48.6%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 5.27 s -> 2.83 s (-2.43 s) vs barba/unified-workflow-hooks (ccbd4b6).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `barba/unified-workflow-hooks (ccbd4b6)`

Phase	Baseline	Current	Delta
extension.check	12.5 ms	13.0 ms	+0.5 ms
project.resolve	0.4 ms	0.4 ms	0.0 ms
workspace.create	0.7 ms	0.8 ms	+0.1 ms
host.prepare	584.9 ms	547.8 ms	-37.1 ms
vercel.service-prefix.resolve	1.6 ms	1.6 ms	0.0 ms
nitro.create	555.0 ms	557.1 ms	+2.1 ms
sandbox.prewarm	2.66 s	283.8 ms	-2.37 s
nitro.cache.prepare	0.2 ms	0.2 ms	0.0 ms
nitro.prepare	0.7 ms	0.8 ms	+0.1 ms
nitro.public-assets	0.7 ms	0.7 ms	0.0 ms
nitro.prerender	0.5 ms	0.4 ms	-0.1 ms
nitro.bundle	1.40 s	1.38 s	-27.3 ms
nitro.cache.write	0.5 ms	0.3 ms	-0.2 ms
vercel.workflow-function.materialize	42.2 ms	42.5 ms	+0.3 ms
agent-summary.emit	0.7 ms	0.7 ms	0.0 ms
nitro.close	0.2 ms	0.1 ms	-0.1 ms
output.publish	3.1 ms	3.1 ms	0.0 ms
workspace.remove	1.8 ms	1.8 ms	0.0 ms