fix(eve): bubble subagent connection authorization events to the parent channel#519
Draft
vanessaxteo wants to merge 1 commit into
Draft
fix(eve): bubble subagent connection authorization events to the parent channel#519vanessaxteo wants to merge 1 commit into
vanessaxteo wants to merge 1 commit into
Conversation
…nt channel A connection declared inside a delegated subagent could park on interactive authorization, but the child's authorization.required/authorization.completed events died in the subagent adapter, which forwarded only input.requested. The parent channel never rendered the sign-in affordance, so the child waited on an OAuth callback no user was ever shown. The subagent adapter now forwards both authorization lifecycle events up the same durable resumeHook path as HITL batches, and the parent turn re-emits them through its own channel adapter so sign-in challenges render where the user is (e.g. Slack's ephemeral sign-in button) and resolve on completion. Unlike HITL there is no downward routing: the challenge's OAuth callback already targets the child session's own hook. Nested delegation chains forward recursively through each hop's adapter. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Vanessa Teo <107958558+vanessaxteo@users.noreply.github.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Bundle + Package Summary:
|
| Area | Metric | Baseline | Current | Delta |
|---|---|---|---|---|
| Package | Packed tarball | 3.51 MB | 3.51 MB | +2.2 kB |
| Package | Unpacked publish size | 12.77 MB | 12.78 MB | +9.1 kB |
| Package | Installed footprint | 51.84 MB | 51.85 MB | +9.1 kB |
| Package | Published files | 2425 | 2427 | +2 |
| Package | Installed files | 5651 | 5653 | +2 |
| Runtime | Unique function payloads | 2 | 2 | 0 |
| Runtime | Total function bytes | 9.24 MB | 9.25 MB | +8.7 kB |
| Runtime | Public routes | 9 | 9 | 0 |
Changed function payloads vs main (419b648) (2)
| Function | Status | Baseline | Current | Delta | Route changes |
|---|---|---|---|---|---|
functions/.well-known/workflow/v1/flow.func |
changed | 5.76 MB | 5.77 MB | +7.1 kB |
none |
functions/__server.func |
changed | 3.48 MB | 3.48 MB | +1.7 kB |
none |
eve init install
| Metric | Baseline | Current | Delta |
|---|---|---|---|
| Installed footprint | 91.63 MB | 91.64 MB | +9.1 kB |
| Installed packages | 120 | 120 | 0 |
| dependencies | 4 | 4 | 0 |
| devDependencies | 2 | 2 | 0 |
| Dependency package bytes | 26.93 MB | 26.94 MB | +9.1 kB |
| devDependency package bytes | 4.81 MB | 4.81 MB | 0 B ➖ |
Build Metadata
- Preset:
vercel - Nitro:
nitro@3.0.260610-beta - Output directory:
apps/fixtures/weather-agent/.vercel/output - Build metadata timestamp: 2026-07-03T00:39:11.148Z
- Route aliases: 9 public, 1 internal (10 total aliases)
- Vercel routes in config: 10
- Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small
Package Drill-Down
Package Details
- Package:
eve@0.19.0 - Package directory:
packages/eve - Tarball: 3.51 MB (
eve-0.19.0.tgz) - Unpacked payload: 12.78 MB across 2427 published files
- Installed footprint: 51.85 MB across 5653 installed files
- Installed root package: 11.50 MB
- Installed dependencies: 40.35 MB
- Runtime dependencies: 1
- Peer dependencies: 5 (4 optional)
Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Heavy installed dependencies
@rolldown/binding-linux-x64-gnu: 19.18 MB (37.0%)eve: 11.50 MB (22.2%)ai: 6.34 MB (12.2%)zod: 5.04 MB (9.7%)nitro: 2.41 MB (4.6%)
Publish payload breakdown
Published file size
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [####....................] 1.51 MB 11.8%
🟡 dist/src/compiled/@workflow/core/runtime.js [##......................] 794.4 kB 6.2%
🟡 dist/src/compiled/@vercel/sandbox/index.js [##......................] 632.2 kB 4.9%
🟡 dist/src/compiled/@chat-adapter/slack/index.js [#.......................] 433.8 kB 3.4%
🟡 dist/src/compiled/_chunks/workflow/attribute-... [#.......................] 371.6 kB 2.9%
🔴 Other published files [########################] 9.04 MB 70.7%
Installed footprint breakdown
Installed package size
🔴 @rolldown/binding-linux-x64-gnu [########################] 19.18 MB 37.0%
🔴 eve [##############..........] 11.50 MB 22.2%
🔴 ai [########................] 6.34 MB 12.2%
🔴 zod [######..................] 5.04 MB 9.7%
🟠 nitro [###.....................] 2.41 MB 4.6%
🟡 rolldown [#.......................] 771.7 kB 1.5%
🔴 Other installed packages [########................] 6.62 MB 12.8%
Runtime dependencies (1)
| Package | Range | Notes |
|---|---|---|
nitro |
3.0.260610-beta |
Peer dependencies (5)
| Package | Range | Notes |
|---|---|---|
@opentelemetry/api |
^1.0.0 |
optional peer |
ai |
catalog: |
|
braintrust |
^3.0.0 |
optional peer |
just-bash |
^3.0.0 |
optional peer |
microsandbox |
^0.5.0 |
optional peer |
eve init install drill-down
eve init install details
- Command:
eve init my-agent - Package manager:
npm - Installed footprint: 91.64 MB across 7405 installed files
- Installed packages: 120 total (114 transitive-only)
- dependencies: 4 direct packages totaling 26.94 MB
- devDependencies: 2 direct packages totaling 4.81 MB
- Other transitive package files: 59.89 MB
Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.
Heavy installed dependencies
@typescript/typescript-linux-x64: 29.69 MB (32.4%)@rolldown/binding-linux-x64-gnu: 19.18 MB (20.9%)eve: 11.50 MB (12.6%)zod: 9.00 MB (9.8%)ai: 6.34 MB (6.9%)
Installed footprint breakdown
Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 29.69 MB 32.4%
🔴 @rolldown/binding-linux-x64-gnu [###############.........] 19.18 MB 20.9%
🔴 eve [#########...............] 11.50 MB 12.6%
🔴 zod [#######.................] 9.00 MB 9.8%
🔴 ai [#####...................] 6.34 MB 6.9%
🟠 @types/node [##......................] 2.54 MB 2.8%
🔴 Other installed packages [###########.............] 13.39 MB 14.6%
dependencies (4)
| Package | Range | Installed size | Share |
|---|---|---|---|
@vercel/connect |
0.2.2 |
98.6 kB | 0.1% |
ai |
^7.0.0 |
6.34 MB | 6.9% |
eve |
file:eve-0.19.0.tgz |
11.50 MB | 12.6% |
zod |
4.4.3 |
9.00 MB | 9.8% |
devDependencies (2)
| Package | Range | Installed size | Share |
|---|---|---|---|
@types/node |
24.x |
2.54 MB | 2.8% |
typescript |
7.0.1-rc |
2.27 MB | 2.5% |
Function Drill-Down
Payload Size Graph
Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func [########################] 5.77 MB 62.4%
🟠 functions/__server.func [##############..........] 3.48 MB 37.6%
Top Function Payloads
🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 5.77 MB
| Metric | Value |
|---|---|
| Public routes | /.well-known/workflow/v1/flow |
| Runtime | nodejs24.x |
| Handler | index.mjs |
| Payload | 5.77 MB |
| Function files | 5.77 MB across 26 files |
| Traced dependencies | 0 B |
| Signal | 🟠 Bundled file __eve_nitro_handler__.mjs is 1.99 MB (34.5%) |
🟠 🔎 Dependency Analysis
📦 Bundled files:
Bundled file size
🟠 __eve_nitro_handler__.mjs [########################] 1.99 MB 34.5%
🟠 _chunks/runtime.mjs [############............] 983.9 kB 17.1%
🟡 _chunks/sandbox.mjs [#########...............] 766.3 kB 13.3%
🟡 _chunks/attribute-changes-zAifvEhb.mjs [######..................] 473.4 kB 8.2%
🟡 _libs/@ai-sdk/gateway+[...].mjs [#####...................] 413.5 kB 7.2%
🟠 Other bundled files [##############..........] 1.14 MB 19.7%
🧾 Vercel Config
{
"handler": "index.mjs",
"launcherType": "Nodejs",
"shouldAddHelpers": false,
"supportsResponseStreaming": true,
"runtime": "nodejs24.x",
"environment": {
"NODE_OPTIONS": "--experimental-require-module"
},
"maxDuration": "max",
"experimentalTriggers": [
{
"type": "queue/v2beta",
"topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
"consumer": "default",
"retryAfterSeconds": 5,
"initialDelaySeconds": 0
}
]
}🟠 functions/__server.func • 8 public routes, 1 internal alias • 3.48 MB
| Metric | Value |
|---|---|
| Public routes | //eve/v1/callback/[token]/eve/v1/connections/[name]/callback/[token]/eve/v1/health/eve/v1/info/eve/v1/session/eve/v1/session/[sessionId]/eve/v1/session/[sessionId]/stream |
| Internal aliases | /__server |
| Runtime | nodejs24.x |
| Handler | index.mjs |
| Payload | 3.48 MB |
| Function files | 3.48 MB across 21 files |
| Traced dependencies | 0 B |
| Signal | 🟠 Bundled file _chunks/dev-runtime-artifacts.mjs is 913.8 kB (26.3%) |
🟠 🔎 Dependency Analysis
📦 Bundled files:
Bundled file size
🟠 _chunks/dev-runtime-artifacts.mjs [########################] 913.8 kB 26.3%
🟠 _chunks/runtime.mjs [#######################.] 891.6 kB 25.6%
🟠 _chunks/sandbox.mjs [####################....] 766.3 kB 22.0%
🟡 _chunks/attribute-changes-zAifvEhb.mjs [############............] 449.0 kB 12.9%
⚪ _libs/zod.mjs [###.....................] 114.2 kB 3.3%
🟡 Other bundled files [#########...............] 345.2 kB 9.9%
🧾 Vercel Config
{
"handler": "index.mjs",
"launcherType": "Nodejs",
"shouldAddHelpers": false,
"supportsResponseStreaming": true,
"runtime": "nodejs24.x"
}![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| await writer.write(encodeMessageStreamEvent(timestampHandleMessageStreamEvent(transformed))); | ||
| }; | ||
|
|
||
| await withContextScope(ctx, session, async (enrichedSession) => { |
Contributor
There was a problem hiding this comment.
runProxyAuthorizationEventStep persists the pre-scope session instead of the session returned by withContextScope, dropping provider-committed session mutations (notably the sandbox snapshot).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A connection declared inside a delegated subagent can park on interactive authorization, but its
authorization.required/authorization.completedevents die in the subagent adapter, which forwards onlyinput.requested. The parent channel never renders the sign-in affordance, so the child sits parked on an OAuth callback no user was ever shown, and the parent's delegation call hangs with it.Concretely: a
defineMcpClientConnectionwith interactive auth works perfectly at the agent root — Slack posts its link-free status plus the ephemeral "Sign in with X" button — but the identical connection moved underagent/subagents/<name>/connections/silently loses the entire sign-in flow. Connection placement (an isolation/architecture choice) currently changes auth UX (a channel concern).Fix
Mirror the existing HITL proxy, minus the part authorization doesn't need:
execution/subagent-adapter.ts— two new handlers forwardauthorization.requiredandauthorization.completedup the durableresumeHookpath, exactly like the existinginput.requestedhandler.channel/types.ts—SubagentAuthorizationRequestHookPayload/SubagentAuthorizationCompletedHookPayload, added to theHookPayloadunion (and thereforeTurnInboxPayload).execution/subagent-authorization-proxy.ts(new) —emitProxiedAuthorizationEventre-creates the protocol event from the forwarded payload, andrunProxyAuthorizationEventStepre-emits it through the parent's channel adapter (persisting adapter-state mutations such as Slack's pending-authorization status cache, soauthorization.completedcan resolve the status it posted).execution/turn-workflow.ts— inbox branch dispatching the two new payload kinds to the proxy step.Unlike HITL there is no downward routing: the challenge's OAuth callback already targets the child session's own hook (
…/connections/:name/callback/<childSessionId>:auth), so the parent's job is display-only. Nested delegation chains forward recursively — the re-emit passes through each hop's adapter, and a middle hop's subagent adapter forwards again.Notes for review
turnId/sequence/stepIndexverbatim, same convention as the proxiedinput.requested.pendingAuthMessageTsbookkeeping keys by connection name; a child connection sharing a name with a parent connection could collide on the status-edit cache. Pre-existing keying scheme — flagging rather than changing it here.runProxyAuthorizationEventSteplives in the new proxy module rather thanworkflow-steps.ts(which is at the 700-line structural cap).Testing
subagent-adapter.test.ts); the emit helper re-creates both protocol events faithfully (subagent-authorization-proxy.test.ts).pnpm typecheck,lint,fmt,guard:invariants,docs:check,test:unit(4385 passed),test:integration(379 passed),buildall pass.Draft while I validate end-to-end against a real deployment (Slack channel parent + subagent connection with interactive auth).