feat(eve): require approval for self-modification by prha · Pull Request #1397 · vercel/eve

prha · 2026-07-30T06:27:00Z

Description

Requires explicit eve approval before staged source changes can be applied. Proposal generation remains side-effect free, while application is gated through the existing approval lifecycle and uses the exact reviewed proposal bytes.

This PR adds the approval boundary and regression coverage on top of the local development editing primitive in #1396.

How did you test your changes?

Focused approval, editing-policy, tool-loop, and application tests.
pnpm typecheck
pnpm lint
pnpm guard:invariants
pnpm docs:check

PR Checklist

I linked an issue with prior discussion confirming this change is wanted
I ran the relevant checks from CONTRIBUTING.md
I added tests and documentation where relevant
I added a changeset if this touches the published eve package
DCO sign-off passes for every commit (git commit --signoff)

vercel · 2026-07-30T06:27:10Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview	Jul 30, 2026 8:48pm
eve-docs-4759	Ready	Preview, v0	Jul 30, 2026 8:48pm

prha · 2026-07-30T06:27:12Z

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

This stack of pull requests is managed by Graphite. Learn more about stacking.

github-actions · 2026-07-30T06:30:32Z

Bundle + Package Summary: `apps/fixtures/weather-agent`

Key takeaways

No notable deltas vs prha/1_selfmod_local_subagent (7cbd97d).

Delta vs `prha/1_selfmod_local_subagent (7cbd97d)`

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.63 MB	7.63 MB	+2.1 kB ⚠️
Package	Unpacked publish size	28.81 MB	28.82 MB	+9.2 kB ⚠️
Package	Installed footprint	91.29 MB	91.30 MB	+9.2 kB ⚠️
Package	Published files	2886	2890	+4
Package	Installed files	6675	6679	+4
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	16.81 MB	16.83 MB	+12.3 kB ⚠️
Runtime	Public routes	11	11	0

Changed function payloads vs prha/1_selfmod_local_subagent (7cbd97d) (2)

Function	Status	Baseline	Current	Delta	Route changes
`functions/__server.func`	changed	8.41 MB	8.41 MB	+6.1 kB ⚠️	none
`functions/.well-known/workflow/v1/flow.func`	changed	8.41 MB	8.41 MB	+6.1 kB ⚠️	none

`eve init` install

Metric	Baseline	Current	Delta
Installed footprint	129.69 MB	129.70 MB	+9.2 kB ⚠️
Installed packages	128	128	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	43.15 MB	43.16 MB	+9.2 kB ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

Build Metadata

Preset: vercel
Nitro: nitro@3.0.260610-beta
Output directory: apps/fixtures/weather-agent/.vercel/output
Build metadata timestamp: 2026-07-30T20:49:03.615Z
Route aliases: 11 public, 1 internal (12 total aliases)
Vercel routes in config: 14
Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

Package: eve@0.28.0
Package directory: packages/eve
Tarball: 7.63 MB (eve-0.28.0.tgz)
Unpacked payload: 28.82 MB across 2890 published files
Installed footprint: 91.30 MB across 6679 installed files
Installed root package: 27.47 MB
Installed dependencies: 63.83 MB
Runtime dependencies: 2
Peer dependencies: 5 (4 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.

Heavy installed dependencies

eve: 27.47 MB (30.1%)
@rolldown/binding-linux-x64-gnu: 19.28 MB (21.1%)
@rolldown/binding-wasm32-wasi: 10.66 MB (11.7%)
@napi-rs/wasm-runtime: 6.56 MB (7.2%)
ai: 6.53 MB (7.2%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [########################] 13.15 MB 45.6%
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [###.....................] 1.51 MB 5.2%
🟡 dist/src/compiled/@vercel/sandbox/index.js       [#.......................] 632.5 kB 2.2%
🟡 dist/src/compiled/_chunks/workflow/undici-DWL... [#.......................] 502.4 kB 1.7%
🟡 dist/src/compiled/@chat-adapter/slack/index.js   [#.......................] 440.5 kB 1.5%
🔴 Other published files                            [#######################.] 12.59 MB 43.7%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.47 MB 30.1%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.28 MB 21.1%
🔴 @rolldown/binding-wasm32-wasi   [#########...............] 10.66 MB 11.7%
🔴 @napi-rs/wasm-runtime           [######..................] 6.56 MB 7.2%
🔴 ai                              [######..................] 6.53 MB 7.2%
🔴 zod                             [####....................] 5.07 MB 5.6%
🔴 Other installed packages        [##############..........] 15.73 MB 17.2%

Runtime dependencies (2)

Package	Range	Notes
`nitro`	`3.0.260610-beta`
`undici`	`8.9.0`

Peer dependencies (5)

Package	Range	Notes
`@opentelemetry/api`	`^1.0.0`	optional peer
`ai`	`catalog:`
`braintrust`	`^3.0.0`	optional peer
`just-bash`	`^3.0.0`	optional peer
`microsandbox`	`^0.5.0`	optional peer

eve init install drill-down

`eve init` install details

Command: eve init my-agent
Package manager: npm
Installed footprint: 129.70 MB across 8547 installed files
Installed packages: 128 total (122 transitive-only)
dependencies: 4 direct packages totaling 43.16 MB
devDependencies: 2 direct packages totaling 5.04 MB
Other transitive package files: 81.50 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

@typescript/typescript-linux-x64: 27.95 MB (21.5%)
eve: 27.47 MB (21.2%)
@rolldown/binding-linux-x64-gnu: 19.28 MB (14.9%)
@rolldown/binding-wasm32-wasi: 10.66 MB (8.2%)
zod: 9.02 MB (7.0%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 21.5%
🔴 eve                              [########################] 27.47 MB 21.2%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.28 MB 14.9%
🔴 @rolldown/binding-wasm32-wasi    [#########...............] 10.66 MB 8.2%
🔴 zod                              [########................] 9.02 MB 7.0%
🔴 @napi-rs/wasm-runtime            [######..................] 6.56 MB 5.1%
🔴 ai                               [######..................] 6.53 MB 5.0%
🔴 Other installed packages         [###################.....] 22.23 MB 17.1%

dependencies (4)

Package	Range	Installed size	Share
`@vercel/connect`	`0.4.2`	135.8 kB	0.1%
`ai`	`^7.0.38`	6.53 MB	5.0%
`eve`	`file:eve-0.28.0.tgz`	27.47 MB	21.2%
`zod`	`4.4.3`	9.02 MB	7.0%

devDependencies (2)

Package	Range	Installed size	Share
`@types/node`	`24.x`	2.54 MB	2.0%
`typescript`	`7.0.2`	2.50 MB	1.9%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 8.41 MB 50.0%
🔴 functions/__server.func                         [########################] 8.41 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 8.41 MB

Metric	Value
Public routes	`/.well-known/workflow/v1/flow`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	8.41 MB
Function files	8.41 MB across 43 files
Traced dependencies	0 B
Signal	🟠 Bundled file `index.mjs` is 2.31 MB (27.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [########################] 2.31 MB 27.4%
🟠 _chunks/runtime-artifacts.mjs   [#################.......] 1.60 MB 19.0%
🟡 _libs/undici.mjs                [##########..............] 980.5 kB 11.7%
🟡 _chunks/sandbox.mjs             [########................] 768.8 kB 9.1%
🟡 _libs/@ai-sdk/gateway+[...].mjs [####....................] 432.8 kB 5.1%
🟠 Other bundled files             [########################] 2.32 MB 27.6%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

🟠 functions/__server.func • 10 public routes, 1 internal alias • 8.41 MB

Metric	Value
Public routes	`/` `/eve/v1/callback/[token]` `/eve/v1/connections/[name]/callback/[token]` `/eve/v1/health` `/eve/v1/info` `/eve/v1/session` `/eve/v1/session/[sessionId]` `/eve/v1/session/[sessionId]/cancel` `/eve/v1/session/[sessionId]/stream` `/eve/v1/session/reset`
Internal aliases	`/__server`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	8.41 MB
Function files	8.41 MB across 43 files
Traced dependencies	0 B
Signal	🟠 Bundled file `index.mjs` is 2.31 MB (27.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [########################] 2.31 MB 27.4%
🟠 _chunks/runtime-artifacts.mjs   [#################.......] 1.60 MB 19.0%
🟡 _libs/undici.mjs                [##########..............] 980.5 kB 11.7%
🟡 _chunks/sandbox.mjs             [########................] 768.8 kB 9.1%
🟡 _libs/@ai-sdk/gateway+[...].mjs [####....................] 432.8 kB 5.1%
🟠 Other bundled files             [########################] 2.32 MB 27.6%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: `e2e/fixtures/agent-tools-sandbox`

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

Build pipeline: 2.06 s -> 1.99 s (-64.6 ms) vs prha/1_selfmod_local_subagent (7cbd97d).
Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `prha/1_selfmod_local_subagent (7cbd97d)`

Phase	Baseline	Current	Delta
`extension.check`	5.5 ms	9.4 ms	+3.9 ms
`project.resolve`	5.7 ms	2.4 ms	-3.3 ms
`workspace.create`	1.3 ms	4.8 ms	+3.5 ms
`host.prepare`	302.0 ms	172.7 ms	-129.3 ms
`vercel.service-prefix.resolve`	2.1 ms	2.5 ms	+0.4 ms
`nitro.create`	205.2 ms	213.1 ms	+7.9 ms
`sandbox.prewarm`	218.5 ms	229.4 ms	+10.9 ms
`nitro.cache.prepare`	0.3 ms	0.3 ms	0.0 ms
`nitro.prepare`	0.9 ms	1.0 ms	+0.1 ms
`nitro.public-assets`	0.8 ms	0.8 ms	0.0 ms
`nitro.prerender`	0.6 ms	0.5 ms	-0.1 ms
`nitro.bundle`	1.28 s	1.33 s	+40.2 ms
`nitro.cache.write`	0.4 ms	0.3 ms	-0.1 ms
`vercel.workflow-function.materialize`	21.9 ms	23.6 ms	+1.7 ms
`agent-summary.emit`	0.5 ms	0.5 ms	0.0 ms
`nitro.close`	0.2 ms	0.1 ms	-0.1 ms
`output.publish`	3.6 ms	3.5 ms	-0.1 ms
`workspace.remove`	2.4 ms	2.1 ms	-0.3 ms

Signed-off-by: prha <prha@vercel.com>

This was referenced Jul 30, 2026

feat(eve): add local self-modification #1396

Open

feat(eve): add trusted self-modification review #1398

Draft

feat(eve): add source editing dev flag #1399

Draft

vercel Bot deployed to Preview – eve-docs July 30, 2026 06:28 View deployment

prha force-pushed the prha/1_selfmod_local_subagent branch from 5dd1c83 to 8f56e4b Compare July 30, 2026 16:00

prha force-pushed the prha/2_selfmod_approval branch from 40b4d3b to 8292314 Compare July 30, 2026 16:00

vercel Bot deployed to Preview – eve-docs-4759 July 30, 2026 16:02 View deployment

vercel Bot deployed to Preview – eve-docs July 30, 2026 16:02 View deployment

prha force-pushed the prha/1_selfmod_local_subagent branch from 8f56e4b to dcc242c Compare July 30, 2026 16:27

prha force-pushed the prha/2_selfmod_approval branch from 8292314 to 9718b25 Compare July 30, 2026 16:27

vercel Bot deployed to Preview – eve-docs-4759 July 30, 2026 16:28 View deployment

vercel Bot deployed to Preview – eve-docs July 30, 2026 16:28 View deployment

feat(eve): require approval for self-modification

3fea393

Signed-off-by: prha <prha@vercel.com>

prha force-pushed the prha/2_selfmod_approval branch from 9718b25 to 3fea393 Compare July 30, 2026 20:46

prha force-pushed the prha/1_selfmod_local_subagent branch from dcc242c to 7cbd97d Compare July 30, 2026 20:46

vercel Bot deployed to Preview – eve-docs-4759 July 30, 2026 20:48 View deployment

vercel Bot deployed to Preview – eve-docs July 30, 2026 20:48 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(eve): require approval for self-modification - #1397

feat(eve): require approval for self-modification#1397
prha wants to merge 1 commit into
prha/1_selfmod_local_subagentfrom
prha/2_selfmod_approval

prha commented Jul 30, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

prha commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026 •

edited

Loading

Package Details

`eve init` install details

Payload Size Graph

Top Function Payloads

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

prha commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How did you test your changes?

PR Checklist

Uh oh!

vercel Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

prha commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle + Package Summary: apps/fixtures/weather-agent

Delta vs prha/1_selfmod_local_subagent (7cbd97d)

eve init install

Package Details

eve init install details

Payload Size Graph

Top Function Payloads

Build Timing: e2e/fixtures/agent-tools-sandbox

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

prha commented Jul 30, 2026 •

edited

Loading

vercel Bot commented Jul 30, 2026 •

edited

Loading

github-actions Bot commented Jul 30, 2026 •

edited

Loading

Bundle + Package Summary: `apps/fixtures/weather-agent`

Delta vs `prha/1_selfmod_local_subagent (7cbd97d)`

`eve init` install

`eve init` install details

Build Timing: `e2e/fixtures/agent-tools-sandbox`