Add TypeScript Eve example with Zep memory - #599

Critical

• examples/typescript/eve/agent/channels/eve.ts:22-28 and agent/lib/identity.ts:52-60 — placeholderAuth() permits unauthenticated production requests while all non-user principals fall back to the shared ZEP_DEMO_USER_ID. Consequently, unrelated visitors share one Zep memory graph and can retrieve each other’s conversation-derived facts. Concurrent new sessions can also have utterances swapped by the shared FIFO stash. Remove placeholderAuth() from deployable configuration, or assign an isolated identity per authenticated principal/session; restrict the fixed demo identity to local development.

Warning

• examples/typescript/eve/scripts/seed-company-graph.ts:106-124 — A partially completed seed run is not idempotent. If fewer than ten episodes exist, rerunning adds all ten again, duplicating previously inserted facts. Identify seed episodes by a stable source ID and add only missing entries, or recreate/abort when a partial seed is detected.

• examples/typescript/eve/scripts/smoke-memory.ts:20-31 — Processing readiness is measured against the user’s total episode count. For the default reused demo user, two old processed episodes satisfy the condition immediately, so the test can query before its newly added messages are processed and may pass using stale Service A facts. Track the newly created thread/episode identifiers or record the baseline count and wait for the new episodes specifically.

• Critical — agent/channels/eve.ts:24-27, agent/lib/identity.ts:51-56: placeholderAuth() permits unauthenticated production browser requests, while those callers fall back to the shared ZEP_DEMO_USER_ID. Any visitor can therefore read and poison every other demo visitor’s persisted memory through zep_search and message ingestion. Remove placeholderAuth() from deployable configuration, or assign each authenticated principal an isolated Zep user ID and reject callers without one.

• Warning — scripts/seed-company-graph.ts:108-125: Partial reruns duplicate existing seed episodes. When fewer than ten episodes exist, the script adds all ten rather than only the missing entries, polluting search results despite claiming reruns avoid duplicates. Check stable source IDs/content and add only absent episodes, or recreate the graph before reseeding.

• Warning — scripts/smoke-memory.ts:61-100: The smoke test reuses the configured demo user and waits only for that user to have two processed episodes. Existing episodes from an earlier run satisfy the condition immediately, so the test can pass using stale context/search results without verifying the newly added messages were processed. Use a unique user per run or record the initial episode count and wait for the expected increment.