usepr/eva

EVA’s appeal is its simplicity: a capable command-line agent in a single Python file, with no required third-party dependency and support for OpenAI-compatible local or remote models. Directory-scoped sessions, Ctrl-C interruption, configurable EVA.md, one-shot automation, goal mode, and confirmation for non-read commands create a surprisingly complete workflow. The design is easy to copy, inspect, and embed in constrained servers, containers, or operations environments.

Shell access still creates substantial risk, especially when users enable unrestricted execution. EVA would benefit from a compact threat model and an exact table of which commands are allowed, blocked, or confirmed. A dry-run mode, path sandbox, environment-variable redaction, structured audit log, and allowlist policy could improve safety without sacrificing portability. Tests against prompt injection, shell escaping, and malicious working-directory content are more important than adding many tools. EVA is best for experienced Python and shell users who want a transparent local agent they can understand quickly; it should not run unrestricted in sensitive directories without additional containment.