feat(eve): propagate authorized approval state through subagents

[benpankow]

Summary

Extends eve's existing local-subagent HITL proxy so responder-authorized approvals keep the same identity, policy ownership, OAuth lifecycle, and client events across parent/child boundaries.

Identity flow

The root channel still authenticates the person responding to the approval. Existing delivery routing sends that verified auth context to the child session:

root channel click
  → verified responder auth
  → parent requestId → childContinuationToken routing
  → child delivery
  → child session.auth.current

The child runs its own currently deployed response authorizer. The parent does not authorize on the child's behalf.

Upward lifecycle proxy

The subagent adapter now forwards these child events through the existing parent continuation hook:

"approval.candidate"
"approval.settled"
"authorization.required"
"authorization.completed"

The parent channel receives the same event payload it would receive for a root-owned approval, so Slack/client presentation does not need separate child-specific behavior.

child candidate/policy/OAuth
  → subagent adapter
  → parent durable hook
  → root channel event handler

Ownership

The child session remains the canonical owner of:

• the pending approval request;
• active candidates and responder binding;
• the response-authorizer callback;
• OAuth challenge/callback state;
• candidate audit history and terminal settlement;
• eventual tool execution.

The root session owns only routing and user-facing presentation.

Local and remote agents

Local subagents use eve's capability-protected durable continuation hooks, so verified delivery auth can be forwarded without a new trust protocol.

Remote agents are intentionally unchanged. They continue to require the existing forwardPrincipal: true opt-in and receiver-side trustedForwarders validation. This PR does not let a remote parent assert approval on behalf of a child.

Depends on #1371.

Validation

Validated with:

• pnpm --filter eve typecheck
• focused subagent adapter, authorization proxy, HITL routing, and turn-workflow tests

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview	Jul 30, 2026 9:04pm
eve-docs-4759	Ready	Preview, v0	Jul 30, 2026 9:04pm

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• No notable deltas vs ben/hitl-v2-clients (420de1b).

Delta vs ben/hitl-v2-clients (420de1b)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.63 MB	7.63 MB	+2.4 kB ⚠️
Package	Unpacked publish size	28.82 MB	28.82 MB	+4.1 kB ⚠️
Package	Installed footprint	91.29 MB	91.30 MB	+4.1 kB ⚠️
Package	Published files	2872	2872	0
Package	Installed files	6661	6661	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	16.86 MB	16.86 MB	+492 B ⚠️
Runtime	Public routes	11	11	0

Changed function payloads vs ben/hitl-v2-clients (420de1b) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	8.43 MB	8.43 MB	+246 B ⚠️	none
functions/.well-known/workflow/v1/flow.func	changed	8.43 MB	8.43 MB	+246 B ⚠️	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	129.70 MB	129.70 MB	+4.1 kB ⚠️
Installed packages	128	128	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	43.16 MB	43.16 MB	+4.1 kB ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

eve init dependency changes vs ben/hitl-v2-clients (420de1b)

dependencies

• Changed: eve@file:eve-0.28.0.tgz -> eve@file:eve-0.29.0.tgz

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260610-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-07-30T21:04:49.176Z
• Route aliases: 11 public, 1 internal (12 total aliases)
• Vercel routes in config: 14
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.29.0
• Package directory: packages/eve
• Tarball: 7.63 MB (eve-0.29.0.tgz)
• Unpacked payload: 28.82 MB across 2872 published files
• Installed footprint: 91.30 MB across 6661 installed files
• Installed root package: 27.47 MB
• Installed dependencies: 63.83 MB
• Runtime dependencies: 2
• Peer dependencies: 5 (4 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.

Heavy installed dependencies

• eve: 27.47 MB (30.1%)
• @rolldown/binding-linux-x64-gnu: 19.28 MB (21.1%)
• @rolldown/binding-wasm32-wasi: 10.66 MB (11.7%)
• @napi-rs/wasm-runtime: 6.56 MB (7.2%)
• ai: 6.53 MB (7.2%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [########################] 13.15 MB 45.6%
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [###.....................] 1.51 MB 5.2%
🟡 dist/src/compiled/@vercel/sandbox/index.js       [#.......................] 632.5 kB 2.2%
🟡 dist/src/compiled/_chunks/workflow/undici-DWL... [#.......................] 502.4 kB 1.7%
🟡 dist/src/compiled/@chat-adapter/slack/index.js   [#.......................] 440.5 kB 1.5%
🔴 Other published files                            [#######################.] 12.59 MB 43.7%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.47 MB 30.1%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.28 MB 21.1%
🔴 @rolldown/binding-wasm32-wasi   [#########...............] 10.66 MB 11.7%
🔴 @napi-rs/wasm-runtime           [######..................] 6.56 MB 7.2%
🔴 ai                              [######..................] 6.53 MB 7.2%
🔴 zod                             [####....................] 5.07 MB 5.6%
🔴 Other installed packages        [##############..........] 15.73 MB 17.2%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260610-beta
undici	8.9.0

Peer dependencies (5)

Package	Range	Notes
@opentelemetry/api	^1.0.0	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
just-bash	^3.0.0	optional peer
microsandbox	^0.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 129.70 MB across 8529 installed files
• Installed packages: 128 total (122 transitive-only)
• dependencies: 4 direct packages totaling 43.16 MB
• devDependencies: 2 direct packages totaling 5.04 MB
• Other transitive package files: 81.50 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• @typescript/typescript-linux-x64: 27.95 MB (21.5%)
• eve: 27.47 MB (21.2%)
• @rolldown/binding-linux-x64-gnu: 19.28 MB (14.9%)
• @rolldown/binding-wasm32-wasi: 10.66 MB (8.2%)
• zod: 9.02 MB (7.0%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 21.5%
🔴 eve                              [########################] 27.47 MB 21.2%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.28 MB 14.9%
🔴 @rolldown/binding-wasm32-wasi    [#########...............] 10.66 MB 8.2%
🔴 zod                              [########................] 9.02 MB 7.0%
🔴 @napi-rs/wasm-runtime            [######..................] 6.56 MB 5.1%
🔴 ai                               [######..................] 6.53 MB 5.0%
🔴 Other installed packages         [###################.....] 22.23 MB 17.1%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	0.4.2	135.8 kB	0.1%
ai	^7.0.38	6.53 MB	5.0%
eve	file:eve-0.29.0.tgz	27.47 MB	21.2%
zod	4.4.3	9.02 MB	7.0%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.54 MB	2.0%
typescript	7.0.2	2.50 MB	1.9%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 8.43 MB 50.0%
🔴 functions/__server.func                         [########################] 8.43 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 8.43 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	8.43 MB
Function files	8.43 MB across 43 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.33 MB (27.7%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [########################] 2.33 MB 27.7%
🟠 _chunks/runtime-artifacts.mjs   [################........] 1.59 MB 18.9%
🟡 _libs/undici.mjs                [##########..............] 980.5 kB 11.6%
🟡 _chunks/sandbox.mjs             [########................] 768.8 kB 9.1%
🟡 _libs/@ai-sdk/gateway+[...].mjs [####....................] 432.8 kB 5.1%
🟠 Other bundled files             [########################] 2.32 MB 27.6%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 10 public routes, 1 internal alias • 8.43 MB

Metric	Value
Public routes	/ /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/stream /eve/v1/session/reset
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	8.43 MB
Function files	8.43 MB across 43 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.33 MB (27.7%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [########################] 2.33 MB 27.7%
🟠 _chunks/runtime-artifacts.mjs   [################........] 1.59 MB 18.9%
🟡 _libs/undici.mjs                [##########..............] 980.5 kB 11.6%
🟡 _chunks/sandbox.mjs             [########................] 768.8 kB 9.1%
🟡 _libs/@ai-sdk/gateway+[...].mjs [####....................] 432.8 kB 5.1%
🟠 Other bundled files             [########################] 2.32 MB 27.5%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 2.27 s -> 2.03 s (-233.3 ms) vs ben/hitl-v2-clients (420de1b).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `ben/hitl-v2-clients (420de1b)`

Phase	Baseline	Current	Delta
extension.check	6.6 ms	8.5 ms	+1.9 ms
project.resolve	3.6 ms	3.6 ms	0.0 ms
workspace.create	1.1 ms	3.3 ms	+2.2 ms
host.prepare	269.2 ms	176.5 ms	-92.7 ms
vercel.service-prefix.resolve	2.3 ms	2.4 ms	+0.1 ms
nitro.create	215.9 ms	211.7 ms	-4.2 ms
sandbox.prewarm	376.2 ms	219.8 ms	-156.4 ms
nitro.cache.prepare	0.3 ms	0.3 ms	0.0 ms
nitro.prepare	0.9 ms	1.0 ms	+0.1 ms
nitro.public-assets	0.7 ms	0.9 ms	+0.2 ms
nitro.prerender	0.6 ms	0.5 ms	-0.1 ms
nitro.bundle	1.36 s	1.37 s	+15.1 ms
nitro.cache.write	0.4 ms	0.4 ms	0.0 ms
vercel.workflow-function.materialize	23.4 ms	23.6 ms	+0.2 ms
agent-summary.emit	0.6 ms	0.6 ms	0.0 ms
nitro.close	0.1 ms	0.2 ms	+0.1 ms
output.publish	3.5 ms	3.5 ms	0.0 ms
workspace.remove	2.2 ms	2.2 ms	0.0 ms