vercel-labs · HugoRCD · Sep 11, 2026 · Sep 11, 2026
diff --git a/.changeset/config.json b/.changeset/config.json
@@ -1,5 +1,5 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": ["@changesets/changelog-github", { "repo": "vercel-labs/github-tools" }],
   "commit": false,
   "access": "public",

diff --git a/.changeset/eve-extension-053.md b/.changeset/eve-extension-053.md
@@ -0,0 +1,9 @@
+---
+"@github-tools/eve-extension": patch
+---
+
+Rebuild the extension against eve 0.53. eve 0.50 changed the dynamic-tool capability contract and requires extensions built against the earlier contract to be rebuilt, so agents on eve 0.50 or newer need this release.
+
+`eve` is now declared as a `*` peer dependency instead of `>=0.44.0 <0.48.0`. The consuming agent supplies the runtime copy of eve, and eve validates the extension's generated capability metadata at build time rather than an npm range, so a new eve release no longer produces a peer conflict. The exact `eve` devDependency is the authoring and build version.
+
+`engines.node` widens from `24.x` to `>=24`. Mount configuration and tool behavior are unchanged.
diff --git a/.changeset/sdk-eve-peer-053.md b/.changeset/sdk-eve-peer-053.md
@@ -0,0 +1,7 @@
+---
+"@github-tools/sdk": patch
+---
+
+Widen the optional `eve` peer dependency from `>=0.44.0 <0.48.0` to `>=0.44.0`, so `@github-tools/sdk/eve-runtime` and the deprecated `@github-tools/sdk/eve` / `@github-tools/sdk/connect/eve` entry points install against current eve releases without a peer conflict. Verified against eve 0.53.
+
+These entry points keep their existing behavior and stay deprecated in favor of `@github-tools/eve-extension`.
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
@@ -72,7 +72,7 @@ pnpm build && pnpm lint && pnpm typecheck && pnpm test
 
 ### eve extension durable callbacks
 
-`packages/github-tools-eve-extension/extension/tools/github.ts` must set `execute`, `toModelOutput`, and `approval` as **direct** `defineTool` properties with inline functions. Spreading those keys, or passing `resolveEveApproval(...)` / `always()` as the property value, leaves them without a durable descriptor: on eve 0.44+ the resolver then drops every `github__*` tool. `test/durable-define-tool.test.ts` fails CI if that pattern returns.
+`packages/github-tools-eve-extension/extension/tools/github.ts` must set `execute`, `toModelOutput`, and `approval` as **direct** `defineTool` properties with inline functions. Spreading those keys, or passing `resolveEveApproval(...)` / `always()` as the property value, leaves them without a durable descriptor, and eve rejects a dynamic tool whose callback is missing one. The same rule covers `approvalKey` and the `label` callbacks if they are ever authored here. `test/durable-define-tool.test.ts` fails CI if that pattern returns.
 
 ## Pull requests
 

diff --git a/.github/workflows/eve-canary.yml b/.github/workflows/eve-canary.yml
@@ -1,10 +1,10 @@
 name: eve canary
 
-# The durable-stamp contract this repo depends on is not part of eve's
-# documented API, and eve ships multiple releases a week. The AST guard in
-# packages/github-tools-eve-extension/test/ only encodes the rules we know
-# about; this job builds and tests against eve@latest on a schedule so
-# upstream drift (as at eve 0.44) fails here before it reaches consumers.
+# eve ships multiple releases a week, and the durable-callback contract has
+# changed shape before (0.44 stamping, 0.50 capability format). The AST guard in
+# packages/github-tools-eve-extension/test/ only checks the authored source;
+# this job builds and tests against eve@latest on a schedule so upstream drift
+# fails here before it reaches consumers.
 
 on:
   schedule:

diff --git a/AGENTS.md b/AGENTS.md
@@ -100,7 +100,7 @@ Ten presets (`code-review`, `issue-triage`, `repo-explorer`, `ci-ops`, `security
 
 ## eve extension durable callbacks (`packages/github-tools-eve-extension`)
 
-On eve 0.44+, a missing durable descriptor on **any** dynamic-tool callback (`execute`, `toModelOutput`, `approval` / `approvalRequest`) discards the **entire** GitHub toolset. In `extension/tools/github.ts`, those three must be **direct** `defineTool` properties with inline functions (or identifiers). Conditional spreads and call expressions (`resolveEveApproval(...)`, `always()`) are invisible to eve's stamp. Callbacks may only close over a serializable tool `name` and re-read config via `buildSessionOptions()`. CI enforces this via `test/durable-define-tool.test.ts`. A scheduled canary (`.github/workflows/eve-canary.yml`) additionally builds and tests against `eve@latest` daily to catch upstream drift the static guard cannot see.
+eve rejects a dynamic tool whose callback has no durable descriptor. It stamps one per callback phase (`execute`, `toModelOutput`, `approval` / `approvalRequest`, `approvalKey`, and the `label` callbacks), and `execute` is the only required phase. In `extension/tools/github.ts`, every authored callback must be a **direct** `defineTool` property with an inline function (or identifier). Conditional spreads and call expressions (`resolveEveApproval(...)`, `always()`) are invisible to eve's stamp. Callbacks may only close over a serializable tool `name` and re-read config via `buildSessionOptions()`. CI enforces this via `test/durable-define-tool.test.ts`. A scheduled canary (`.github/workflows/eve-canary.yml`) additionally builds and tests against `eve@latest` daily to catch upstream drift the static guard cannot see.
 
 ## Chat App Architecture (`apps/chat`)
 
@@ -114,7 +114,7 @@ On eve 0.44+, a missing durable descriptor on **any** dynamic-tool callback (`ex
 
 - **TypeScript**: Strict mode, ESNext target, `verbatimModuleSyntax: true`
 - **ESLint**: `typescript-eslint` flat config for SDK; `@nuxt/eslint` with stylistic rules for apps (no trailing commas, 1tbs brace style)
-- **Peer deps**: `ai` and `zod` are peer deps of the SDK; `workflow` and `@workflow/ai` are optional peer deps for the workflow subpath; `@github-tools/eve-extension` requires `eve` `>=0.44`
+- **Peer deps**: `ai` and `zod` are peer deps of the SDK; `workflow` and `@workflow/ai` are optional peer deps for the workflow subpath; `@github-tools/eve-extension` declares `eve` as `*` (the consumer supplies the runtime copy; eve validates the built capability metadata) and pins an exact `eve` devDependency as its authoring/build version
 
 ### Code style — no slop
 

diff --git a/apps/chat/package.json b/apps/chat/package.json
@@ -14,46 +14,46 @@
     "db:migrate": "nuxt db migrate"
   },
   "dependencies": {
-    "@ai-sdk/gateway": "^4.0.56",
-    "@ai-sdk/vue": "^4.0.70",
+    "@ai-sdk/gateway": "^4.0.78",
+    "@ai-sdk/vue": "^4.0.97",
     "@ai-sdk/workflow": "^1.0.70",
     "@github-tools/sdk": "workspace:*",
-    "@iconify-json/logos": "^1.2.12",
-    "@iconify-json/lucide": "^1.2.121",
-    "@iconify-json/simple-icons": "^1.2.93",
-    "@libsql/client": "^0.17.4",
+    "@iconify-json/logos": "^1.2.14",
+    "@iconify-json/lucide": "^1.2.130",
+    "@iconify-json/simple-icons": "^1.2.95",
+    "@libsql/client": "^0.18.0",
     "@nuxt/fonts": "^0.14.0",
-    "@nuxt/ui": "^4.10.0",
+    "@nuxt/ui": "^4.11.1",
     "@nuxthub/core": "^0.10.8",
-    "@nuxtjs/mdc": "^0.22.2",
-    "@vercel/blob": "^2.6.1",
+    "@nuxtjs/mdc": "^0.23.1",
+    "@vercel/blob": "^2.8.0",
     "@vueuse/core": "^14.4.0",
-    "@workflow/ai": "^4.2.0",
+    "@workflow/ai": "^4.2.1",
     "@workflow/nitro": "4.1.6",
-    "@workflow/nuxt": "^4.0.16",
-    "ai": "^7.0.70",
+    "@workflow/nuxt": "^4.0.22",
+    "ai": "^7.0.97",
     "date-fns": "^4.4.0",
     "drizzle-orm": "^0.45.2",
     "h3": "^1.15.11",
-    "motion-v": "^2.3.0",
-    "nuxt": "^4.5.1",
-    "nuxt-auth-utils": "^0.5.29",
-    "nuxt-charts": "^2.2.0",
-    "pg": "^8.22.0",
-    "shiki": "^4.4.1",
+    "motion-v": "^2.4.2",
+    "nuxt": "^4.5.2",
+    "nuxt-auth-utils": "^0.5.30",
+    "nuxt-charts": "^2.2.1",
+    "pg": "^8.23.0",
+    "shiki": "^4.4.3",
     "shiki-stream": "^0.1.5",
     "striptags": "3.2.0",
     "tailwindcss": "^4.3.3",
-    "workflow": "^4.8.0",
-    "zod": "^4.4.3"
+    "workflow": "^4.8.6",
+    "zod": "^4.5.4"
   },
   "devDependencies": {
-    "@nuxt/eslint": "^1.16.0",
-    "@types/node": "^26.1.2",
+    "@nuxt/eslint": "^1.17.0",
+    "@types/node": "^26.5.0",
     "drizzle-kit": "^0.31.10",
-    "eslint": "^10.8.0",
+    "eslint": "^10.10.0",
     "typescript": "^6.0.3",
-    "vue-tsc": "^3.3.9"
+    "vue-tsc": "^3.3.11"
   },
-  "packageManager": "pnpm@10.30.2"
+  "packageManager": "pnpm@11.1.3"
 }
diff --git a/apps/docs/content/docs/1.getting-started/2.installation.md b/apps/docs/content/docs/1.getting-started/2.installation.md
@@ -60,7 +60,7 @@ What you install next depends on the [framework](/frameworks/ai-sdk) you build o
 | Framework | Import path | Peer dependencies |
 |---|---|---|
 | [AI SDK](/frameworks/ai-sdk) | `@github-tools/sdk` | `ai` (v6 or v7), `zod` |
-| [eve extension](/frameworks/eve-extension) | `@github-tools/eve-extension` | `eve` (`>=0.44`, **`ai` v7** transitively) |
+| [eve extension](/frameworks/eve-extension) | `@github-tools/eve-extension` | `eve` (declared `*`, built against 0.53, **`ai` v7** transitively) |
 | [eve (direct import, deprecated)](/deprecated/eve) | `@github-tools/sdk/eve` | `eve`, `ai` **v7**, `zod` |
 | [Vercel Workflow](/frameworks/vercel-workflow) | `@github-tools/sdk/workflow` | `workflow`, `@ai-sdk/workflow`, `ai`, `zod` |
 | [Chat SDK](/frameworks/chat-sdk) | `@github-tools/sdk` | `chat`, `@chat-adapter/github`, `ai`, `zod` |
@@ -86,7 +86,7 @@ bun add ai zod
 
 ### Optional: eve extension (recommended for eve agents)
 
-For [eve](https://eve.dev) filesystem-first agents, install `@github-tools/eve-extension` and its `eve` `>=0.44` peer (which itself requires **`ai` v7**):
+For [eve](https://eve.dev) filesystem-first agents, install `@github-tools/eve-extension` and its `eve` peer (which itself requires **`ai` v7**). The extension declares `eve` as `*` so your agent supplies the runtime copy; eve checks the extension's generated capability metadata rather than an npm range:
 
 :::code-group
 ```bash [pnpm]

diff --git a/apps/docs/content/docs/2.frameworks/1.eve-extension.md b/apps/docs/content/docs/2.frameworks/1.eve-extension.md
@@ -111,7 +111,7 @@ bun add @github-tools/eve-extension
 ```
 :::
 
-`eve` is a required peer dependency (`>=0.44`, which itself requires **`ai` v7**):
+`eve` is a required peer dependency (which itself requires **`ai` v7**). The extension declares it as `*`: your agent provides the runtime copy of eve, and eve validates the extension's generated capability metadata at build time instead of an npm range. This release is built against eve 0.53:
 
 :::code-group
 ```bash [pnpm]
@@ -208,7 +208,7 @@ export default githubExtension({
 
 ## Durable multi-turn sessions
 
-The extension registers each tool with an **authored inline** `execute`, `toModelOutput`, and `approval` as **direct** `defineTool` properties that only close over a serializable tool `name`, then rebuilds session options from the extension config on every call via `@github-tools/sdk/eve-runtime`. Tools resolve on `step.started` so registration stays fresh across durable steps. That pattern survives multi-turn eve Workflow replay (see [#51](https://github.com/vercel-labs/github-tools/issues/51), [#99](https://github.com/vercel-labs/github-tools/issues/99)). A spread or call-expression callback (`resolveEveApproval(...)`, a ternary-wrapped `toModelOutput`) has no durable descriptor: on eve 0.44+ the resolver discards the **entire** GitHub toolset. Prefer this mount over the deprecated [`createGithubTools`](/deprecated/eve) / [`connectGithubTools`](/deprecated/eve) paths for Slack / multi-turn durable agents — those register tools from inside `node_modules` and are skipped on replay. Author `overrides.toModelOutput` inline in the agent; a function imported from a library will not get a durable descriptor.
+The extension registers each tool with an **authored inline** `execute`, `toModelOutput`, and `approval` as **direct** `defineTool` properties that only close over a serializable tool `name`, then rebuilds session options from the extension config on every call via `@github-tools/sdk/eve-runtime`. Tools resolve on `step.started` so registration stays fresh across durable steps. That pattern survives multi-turn eve Workflow replay (see [#51](https://github.com/vercel-labs/github-tools/issues/51), [#99](https://github.com/vercel-labs/github-tools/issues/99)). A spread or call-expression callback (`resolveEveApproval(...)`, a ternary-wrapped `toModelOutput`) has no durable descriptor, and eve rejects a dynamic tool whose callback is missing one. Prefer this mount over the deprecated [`createGithubTools`](/deprecated/eve) / [`connectGithubTools`](/deprecated/eve) paths for Slack / multi-turn durable agents — those register tools from inside `node_modules` and are skipped on replay. Author `overrides.toModelOutput` inline in the agent; a function imported from a library will not get a durable descriptor.
 
 Object-shaped execute results include `rateLimit` (`remaining`, `limit`, `reset`, `resource`). `toModelOutput` strips it so the model never sees the remaining count; `toolResultFrom` and channels still do. See [Rate-limit metadata](/api/reference#rate-limit-metadata).
 

diff --git a/apps/docs/content/docs/3.examples/2.eve-stale-issue-triager.md b/apps/docs/content/docs/3.examples/2.eve-stale-issue-triager.md
@@ -105,7 +105,7 @@ bun add @github-tools/eve-extension @vercel/connect eve
 ```
 :::
 
-`eve` `>=0.44` is a required peer (itself requiring **`ai` v7**). See [Install optional workflow dependencies](/frameworks/eve-extension#install) for the full peer chart.
+`eve` is a required peer (itself requiring **`ai` v7**), declared `*` so your agent provides the runtime copy. See [Install optional workflow dependencies](/frameworks/eve-extension#install) for the full peer chart.
 
 ## Set up the connector
 

diff --git a/apps/docs/package.json b/apps/docs/package.json
@@ -16,18 +16,18 @@
     "@resvg/resvg-js": "^2.6.2",
     "@vercel/analytics": "^2.0.1",
     "@vercel/speed-insights": "^2.0.0",
-    "better-sqlite3": "^12.11.1",
+    "better-sqlite3": "^13.0.3",
     "docus": "^5.13.0",
-    "nuxt": "^4.5.1",
-    "satori": "^0.29.0",
-    "zod": "^4.4.3",
+    "nuxt": "^4.5.2",
+    "satori": "^0.33.4",
+    "zod": "^4.5.4",
     "zod-to-json-schema": "^3.25.2"
   },
   "devDependencies": {
-    "@nuxt/eslint": "^1.16.0",
-    "eslint": "^10.8.0",
+    "@nuxt/eslint": "^1.17.0",
+    "eslint": "^10.10.0",
     "nuxtseo-layer-devtools": "5.3.2",
     "typescript": "^6.0.3"
   },
-  "packageManager": "pnpm@10.30.2"
+  "packageManager": "pnpm@11.1.3"
 }
diff --git a/apps/docs/skills/github-tools-agents/SKILL.md b/apps/docs/skills/github-tools-agents/SKILL.md
@@ -82,7 +82,7 @@ export async function run(messages: ModelMessage[], token: string) {
 
 ### eve extension (recommended for eve agents)
 
-Requires `eve` `>=0.44` (transitively **`ai` v7**). Mount from `@github-tools/eve-extension` under `agent/extensions/`.
+Requires `eve` as a peer, declared `*` and checked through the extension's generated capability metadata (transitively **`ai` v7**); built against eve 0.53. Mount from `@github-tools/eve-extension` under `agent/extensions/`.
 
 ```ts
 // agent/extensions/github.ts

diff --git a/apps/docs/skills/github-tools-agents/references/eve-extension.md b/apps/docs/skills/github-tools-agents/references/eve-extension.md
@@ -14,7 +14,7 @@ Use `@github-tools/eve-extension` when the user builds an [eve](https://eve.dev)
 pnpm add @github-tools/eve-extension eve
 ```
 
-- **`ai` v7** required (transitive `eve` `>=0.44` peer)
+- **`ai` v7** required (transitive `eve` peer); the extension declares `eve` as `*` and eve checks its generated capability metadata, not an npm range. Built against eve 0.53
 - `GITHUB_TOKEN`, explicit `token`, or a Vercel Connect `connector`
 
 ## Mount under `agent/extensions/`
@@ -55,7 +55,7 @@ export default githubExtension({
 })
 ```
 
-`execute`, `toModelOutput`, and `approval` are direct `defineTool` properties whose callbacks only close over the tool name (a spread or `resolveEveApproval(...)` call is not stamped). `toModelOutput` also strips `rateLimit` from the model-facing payload. Author `overrides.toModelOutput` inline in the agent — a library function will not get a durable descriptor on eve 0.44+, and the resolver then drops every `github__*` tool. Execute failures return `{ error }` so the model still receives a `tool_result` — a structured `{ code, message, why, fix, link }` object for catalog errors (e.g. `github_tools.NOT_FOUND` explains GitHub masks no-access private repos as 404), a plain string otherwise. Requires `eve` `>=0.44`.
+`execute`, `toModelOutput`, and `approval` are direct `defineTool` properties whose callbacks only close over the tool name (a spread or `resolveEveApproval(...)` call is not stamped). `toModelOutput` also strips `rateLimit` from the model-facing payload. Author `overrides.toModelOutput` inline in the agent — a library function will not get a durable descriptor, and eve rejects a dynamic tool whose callback is missing one. Execute failures return `{ error }` so the model still receives a `tool_result` — a structured `{ code, message, why, fix, link }` object for catalog errors (e.g. `github_tools.NOT_FOUND` explains GitHub masks no-access private repos as 404), a plain string otherwise.
 
 ## Approval
 

diff --git a/examples/eve/package.json b/examples/eve/package.json
@@ -11,9 +11,9 @@
   },
   "dependencies": {
     "@github-tools/eve-extension": "workspace:*",
-    "@vercel/connect": "^0.6.1",
-    "ai": "^7.0.58",
-    "eve": "^0.46.1",
-    "zod": "^4.3.6"
+    "@vercel/connect": "^2.0.4",
+    "ai": "^7.0.97",
+    "eve": "^0.53.1",
+    "zod": "^4.5.4"
   }
 }
diff --git a/examples/pr-review-agent/package.json b/examples/pr-review-agent/package.json
@@ -12,15 +12,15 @@
     "@chat-adapter/state-memory": "latest",
     "@github-tools/sdk": "workspace:*",
     "@workflow/ai": "latest",
-    "ai": "^6.0.242",
+    "ai": "^7.0.97",
     "chat": "latest",
     "evlog": "latest",
     "workflow": "latest",
-    "zod": "^4.4.3"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "nitro": "latest",
     "typescript": "^6.0.3",
-    "vite": "^8.2.0"
+    "vite": "^8.2.2"
   }
 }
diff --git a/package.json b/package.json
@@ -22,8 +22,8 @@
     "release": "turbo run build --filter=@github-tools/sdk --filter=@github-tools/eve-extension && changeset publish"
   },
   "devDependencies": {
-    "@changesets/changelog-github": "^0.7.0",
-    "@changesets/cli": "^2.31.1",
+    "@changesets/changelog-github": "^1.0.1",
+    "@changesets/cli": "^3.0.2",
     "turbo": "latest"
   },
   "packageManager": "pnpm@11.1.3"
-Original file line number
+Diff line change
@@ Expand Up / @@ -105,7 +105,7 @@ bun add @github-tools/eve-extension @vercel/connect eve @@
     ```
     :::
-    `eve` `>=0.44` is a required peer (itself requiring **`ai` v7**). See [Install optional workflow dependencies](/frameworks/eve-extension#install) for the full peer chart.
+    `eve` is a required peer (itself requiring **`ai` v7**), declared `*` so your agent provides the runtime copy. See [Install optional workflow dependencies](/frameworks/eve-extension#install) for the full peer chart.
     ## Set up the connector
@@ Expand Down @@