chore: bump dependencies (eve 0.83, @vercel/connect 2.5) and migrate breaking changes

Bumps every dependency to latest and migrates the breaking changes, most of them from eve 0.39 → 0.83 and @vercel/connect 0.8 → 2.5.

Versions

The lockfile is regenerated, so transitive dependencies are current too. TypeScript was already on the latest version.

Breaking changes

• GitHub tools were silently dropped at runtime. eve 0.83 skips every tool from the deprecated @github-tools/sdk/connect/eve one-liner (callback "execute" does not have a durable descriptor). Type checks don't catch this. The tools are now mounted from @github-tools/eve-extension at agent/extensions/github.ts, with the same maintainer preset and requireApproval: "never" list. They are now named github__<tool>.
• Session limits. limits.maxOutputTokensPerSession was removed. It's replaced with limits.sessionUsage, keeping the 20k output cap per window and restating eve's 40M new-input default, which a custom check otherwise drops.
• Sandbox. vercel() and backend were removed. agent/sandbox.ts now exports VercelSandbox.environment() and opens it in defineSandbox.
• Researcher structured output. defineAgent no longer accepts outputSchema.
  • The researcher subagent sets tool: false.
  • A new research workflow tool (agent/tools/research.ts) opens a session with it via ctx.agent() and requests the same cited-findings schema per turn.
  • eve's docs say a tool may share a tool: false subagent's name, but its build still rejects it, so the tool is named research. instructions.ts is updated to match.
• Biome. ultracite 8's core config references a rule Biome 2.6 renamed, so Biome is pinned to ~2.5.15 until ultracite catches up.

Smaller changes

• Resend channel: forwards emails with idempotencyKey: resend:<email id>, as eve now recommends, so webhook redeliveries don't reach the agent twice.
• Weekly digest: the prompt now tells the agent to page through issue lists. GitHub list tools return { items, hasMore, nextPage } since github-tools 1.14.
• Dependencies: @chat-adapter/shared is now a direct dependency, so only one copy of chat is installed (the Resend adapter's peer was pulling in a second).
• Docs: README, ARCHITECTURE and AGENTS are updated. This also fixes the dev schedule URL, which pointed at port 3000 instead of 2000.

Testing

• pnpm validate: lint, typecheck and eve info all report 0 errors and 0 warnings.
• eve build --skip-sandbox-prewarm succeeds. The production server boots, and the GitHub, Linear and Resend webhook routes reject unsigned requests.
• An end-to-end eve dev run with a scripted mock model confirmed:
  • github__* tools load;
  • addIssueComment runs without approval, while mergePullRequest prompts;
  • research returns a schema-validated result, and failures return { error };
  • the user-preference tools resolve a user principal;
  • skills load;
  • the Linear and Resend connections are discovered;
  • the weekly-digest dev dispatch runs.
• Throwaway tests covered the GitHub onComment/onPullRequest gates, the Linear onAgentSession context, sessionUsage thresholds and the preference-key helpers.

Notes for reviewers

• pnpm build now prepares the Vercel Sandbox snapshot at build time. Local builds therefore need the linked project's credentials; Vercel deploys have them automatically.
• @vercel/connect 2.x no longer creates connectors automatically at runtime. This doesn't affect the template, because the README already creates and attaches them with vercel connect.
• The externalDependencies: ["@vercel/connect"] workaround in agent.ts no longer appears necessary: the build and server work without it. I left it in to keep this change focused.

---

Generated by Claude Code