feat(subagents): support explicit capability inheritance by aatosolavi · Pull Request #1243 · vercel/eve

aatosolavi · 2026-07-27T17:51:05Z

Summary

Allow declared subagents to opt into selected parent capabilities while keeping isolation by default:

inherit.sandbox: true shares the parent's live sandbox session (not a seed copy)
inherit.connections: true reuses the parent's resolved connection definitions (normal auth resolution; no credential copying)
Child keeps its own instructions, tools, skills, hooks, and durable state
Compiler rejects invalid combinations (root inherit, own sandbox + inherit.sandbox)
eve info / agent-info surface effective owned vs inherited capabilities
Extension capability epochs bumped for transitive public-type changes

This rebases and completes the approach from #639 onto current main so CI can run on an up-to-date branch.

Closes #626.
Related: #639 (original implementation by @iroiro147).

Example

export default defineAgent({
  description: "Review this change for security risks.",
  inherit: {
    sandbox: true,
    connections: true,
  },
});

Tests

pnpm --filter eve typecheck
Inheritance-related unit suite (vitest.unit.config.ts): 177 passed
pnpm docs:check
pnpm guard:invariants
pnpm fmt / pnpm lint

Notes for reviewers

Default isolation is unchanged; inheritance is explicit and per capability.
Shared sandbox concurrent-write guidance matches the built-in agent contract.
Nested inheritance resolves from the immediate parent.

vercel · 2026-07-27T17:51:10Z

@aatosolavi is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

aatosolavi · 2026-07-27T17:55:25Z

CI status note

GitHub Actions for this PR are currently action_required (first-time external contributor workflow approval):

A maintainer needs to click Approve and run on those workflows so the full suite can execute. Local verification already passed:

pnpm --filter eve typecheck
Inheritance unit suite: 177 passed
pnpm docs:check
pnpm guard:invariants
DCO + signed commit ✅

aatosolavi · 2026-07-27T20:18:50Z

CONTRIBUTING.md compliance audit

Requirement	Status
Fork + branch from `main`	✅
Issue linked (`#626`)	✅
Tests + docs for public behavior	✅
Changeset for `eve` package	✅
`Signed-off-by` DCO on every commit	✅ (DCO check green)
Cryptographically signed commit	⚠️ signed locally with SSH; GitHub shows Unverified (`unknown_key`) until the SSH key is added as a signing key on the author account
Single reviewable purpose	✅ (no merge commits)
Extension capability epochs bumped + retained fixtures	✅
`pnpm lint`	✅
`pnpm typecheck` (Node 24)	✅
`pnpm test` unit	✅ 5490 passed
`pnpm test` integration	✅ 550 passed
`pnpm docs:check`	✅
`pnpm guard:invariants`	✅

Action needed for Verified commits (CONTRIBUTING “Signed commits”):

Add this public key as an SSH signing key at https://github.com/settings/keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMWGUHmippQ6GYJu6gyljhSlxcSY22uvthEvcFUYsEB+
Confirm the commit badge on the PR becomes Verified.

GitHub Actions still need a maintainer Approve and run for first-time external contributors.

iroiro147 · 2026-07-29T09:28:31Z

Thanks for rebasing and carrying this forward. Since #1243 is based substantially on the original implementation in #639, would you mind adding the following co-author trailer to the implementation commit and preserving it if this is squash-merged? Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com> This would preserve the original implementation attribution in Git history. Thank you!

Allow declared subagents to opt into sharing the parent's live sandbox and connection definitions via `inherit.sandbox` / `inherit.connections`, while keeping isolation as the default and retaining distinct instructions. Rebases and lands the approach from vercel#639 on current main, including runtime shared-sandbox propagation, compiler validation, docs/info surface, tests, and extension-capability epoch bumps for transitive public types. Refs vercel#626. Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com> Signed-off-by: Aatos Akvilander <aatos@akvilander.com>

aatosolavi · 2026-07-29T09:31:01Z

@iroiro147 Done — the implementation commit now includes:

Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com>

Please keep this trailer if the PR is squash-merged so the original implementation attribution is preserved. Thanks for the original work on #639.

iroiro147 · 2026-07-29T09:38:18Z

Thanks, Aatos — confirmed the co-author trailer is present on ab406b4. I really appreciate you preserving the attribution and carrying the implementation forward!

Keep process-lifetime init tracking so sequential inheriting children do not re-run onSession after the first open completes. Hard-fail unknown sandbox node ids, attach effectiveSandbox only when sharing, collapse shared-sandbox adapter assembly, prefer initialized backfill, share capability projection, and reject connection name collisions at compile. Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com> Signed-off-by: Aatos Akvilander <aatos@akvilander.com>

Treat inheritedSandbox.sessionId as the immediate parent (parentSessionId), not the sandbox owner, so mid-chain inherit.sandbox parents accept and forward captures. Also align empty-string identity handling, preserve reattach metadata when merging backfills, document completed-set growth, and cover nested connection collisions plus open/init split. Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com> Signed-off-by: Aatos Akvilander <aatos@akvilander.com>

…-capabilities-626 Signed-off-by: Aatos Akvilander <aatos@akvilander.com> # Conflicts: # packages/eve/extension-contracts/compatibility/dynamicInstructions/v1.ts # packages/eve/extension-contracts/compatibility/dynamicSkill/v1.ts # packages/eve/extension-contracts/compatibility/dynamicTool/v4.ts # packages/eve/extension-contracts/compatibility/hook/v2.ts # packages/eve/extension-contracts/reports/dynamicInstructions/v2.json # packages/eve/extension-contracts/reports/dynamicSkill/v2.json # packages/eve/extension-contracts/reports/dynamicTool/v5.json # packages/eve/extension-contracts/reports/hook/v3.json # packages/eve/src/compiler/extension-compatibility.ts

Merge origin/main and re-bump transitive extension capability epochs that this PR's public surface changes (tool, dynamicTool, hook, dynamicSkill, dynamicInstructions), retaining prior epochs with fixtures. Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com> Signed-off-by: Aatos Akvilander <aatos@akvilander.com>

…-capabilities-626 Signed-off-by: Aatos Akvilander <aatos@akvilander.com> # Conflicts: # packages/eve/src/compiler/normalize-agent-config.test.ts # packages/eve/src/compiler/normalize-manifest.test.ts # packages/eve/src/compiler/normalize-manifest.ts # packages/eve/src/compiler/normalize-subagent.ts # packages/eve/src/execution/delegated-parent-notification.ts # packages/eve/src/execution/dispatch-runtime-actions-step.ts # packages/eve/src/execution/workflow-steps.test.ts # packages/eve/src/runtime/resolve-agent-graph.ts # packages/eve/src/runtime/types.ts

This was referenced Jul 27, 2026

Allow declared subagents to inherit selected parent capabilities #626

Open

feat(subagents): support explicit capability inheritance #639

Closed

aatosolavi force-pushed the feat/subagent-inherit-capabilities-626 branch 2 times, most recently from fa1a724 to b5a99d8 Compare July 27, 2026 20:18

aatosolavi force-pushed the feat/subagent-inherit-capabilities-626 branch 5 times, most recently from 3d34d45 to 559590b Compare July 28, 2026 20:13

De-ASI-INTERFACE approved these changes Jul 29, 2026

View reviewed changes

aatosolavi force-pushed the feat/subagent-inherit-capabilities-626 branch from 0a93b0b to ab406b4 Compare July 29, 2026 09:30

Merge branch 'main' into feat/subagent-inherit-capabilities-626

8a82792

aatosolavi and others added 5 commits July 29, 2026 13:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(subagents): support explicit capability inheritance - #1243

feat(subagents): support explicit capability inheritance#1243
aatosolavi wants to merge 7 commits into
vercel:mainfrom
aatosolavi:feat/subagent-inherit-capabilities-626

aatosolavi commented Jul 27, 2026

Uh oh!

vercel Bot commented Jul 27, 2026

Uh oh!

aatosolavi commented Jul 27, 2026

Uh oh!

aatosolavi commented Jul 27, 2026

Uh oh!

iroiro147 commented Jul 29, 2026

Uh oh!

aatosolavi commented Jul 29, 2026

Uh oh!

iroiro147 commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

aatosolavi commented Jul 27, 2026

Summary

Example

Tests

Notes for reviewers

Uh oh!

vercel Bot commented Jul 27, 2026

Uh oh!

aatosolavi commented Jul 27, 2026

CI status note

Uh oh!

aatosolavi commented Jul 27, 2026

CONTRIBUTING.md compliance audit

Uh oh!

iroiro147 commented Jul 29, 2026

Uh oh!

aatosolavi commented Jul 29, 2026

Uh oh!

iroiro147 commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants