eve-hub 0.10.2 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # eve-hub
 
+## 0.12.0
+
+### Minor Changes
+
+- A deployed bot's calls to the hub carry its project's OIDC token in `x-vercel-trusted-oidc-idp-token` as well as `Authorization`. The hub project's Deployment Protection takes it as a Trusted Source, so a bots project no longer needs `HUB_PROTECTION_BYPASS`; a deployed bot never sends `HUB_PROTECTION_BYPASS`, even while its deployment still holds the env, so deleting the env needs no redeploy. A bot that runs on a Mac still sends the secret it is given.
+
+## 0.11.0
+
+### Minor Changes
+
+- A bot's roster entry can name whose credential its model calls carry: `"modelAuth": "project" | "user" | "codex"` (default `project`, the workspace's bots project). `hub.workspace.json` rejects any other value, and `user` or `codex` on a bot that does not run on the Mac. Nothing acts on `user` or `codex` yet; this release only lets a workspace carry the key before the hub starts writing it.
+
 ## 0.10.2
 
 ### Patch Changes

package/README.md

@@ -61,7 +61,7 @@ A deployed workspace (lib/workspace-template.mjs, staged by hosted-hub/scripts/s
 
 Releases go through Changesets, as in eve. A PR that changes the kit adds a changeset (`pnpm changeset`) and applies it (`pnpm changeset version`); when it merges, `.github/workflows/release.yml` runs `changeset publish` (no bot commits to main: its ruleset allows only PR merges): the kit's `prepack` stages the package into `dist/npm` (its `publishConfig.directory`), npm gets it, and the `eve-hub@<version>` GitHub release is created. npm auth is the repo's `NPM_TOKEN` secret (an npm automation token). The template pins the version this checkout carries.
 
-The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with both `eve/world-hub` and `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` and, since the hosted hub keeps Vercel Authentication on, `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret), each when set.
+The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with both `eve/world-hub` and `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` when set. The hosted hub keeps Vercel Authentication on: a deployed bot sends its project's OIDC token in `x-vercel-trusted-oidc-idp-token` too (the hub project lists each bots project in its Trusted Sources, `hosted-hub/src/onboard/trust.ts` `trustBots`, and never the bypass secret, even while its deployment still holds the env), and a bot on a Mac sends `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret) when it has one.
 
 ## Vercel Kit connection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",

package/registry-fetch.mjs

@@ -1,8 +1,10 @@
 // Registry-relative fetch for the kit, using ROSTER_REGISTRY_URL.
 // HUB_TOKEN is this bot's credential for a hosted hub; unset locally.
 // HUB_PROTECTION_BYPASS is the hosted hub project's Protection Bypass for
-// Automation secret: the hub keeps Vercel Authentication on, and the bots (on
-// the same team) pass it with x-vercel-protection-bypass. Unset locally.
+// Automation secret, sent with x-vercel-protection-bypass by a bot that runs on
+// a Mac (a deployed bot's project token passes the hub's Deployment Protection
+// instead: hubHeaders, which a deployed bot sends whether or not the project
+// still holds the secret). Unset locally.
 // `hub restart` keeps the bots running while the registry is replaced, so a
 // turn can call a tool during the few seconds no registry is listening.
 // Retried, with backoff (250 ms doubling to 2 s) for up to 30 s:
@@ -34,7 +36,7 @@ export const sandboxRegistry = () => (process.env.HUB_SANDBOX_SERVICES === "none
 export function registryHeaders(init, env = process.env) {
   const headers = new Headers(init);
   if (env.HUB_TOKEN && !headers.has("authorization")) headers.set("authorization", `Bearer ${env.HUB_TOKEN}`);
-  if (env.HUB_PROTECTION_BYPASS) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
+  if (env.HUB_PROTECTION_BYPASS && !env.VERCEL) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
   return Object.fromEntries(headers);
 }
 
@@ -59,11 +61,15 @@ const DROPPED = new Set(["ECONNRESET", "EPIPE", "UND_ERR_SOCKET"]);
 
 // Every call a bot makes to the hub: a deployed bot is the caller its own project's token says (the hub checks it: api/auth.ts);
 // elsewhere HUB_TOKEN is the credential, if any. The one place a call's headers are made.
+// The same token also passes the hub's Deployment Protection, which trusts the bots projects (a Trusted Source) and takes it in
+// its own header: no bypass secret.
 export async function hubHeaders(init, env = process.env) {
   const merged = new Headers(init);
-  if (env.VERCEL && !merged.has("authorization")) {
+  if (env.VERCEL) {
     const { getVercelOidcToken } = await import("@vercel/oidc");
-    merged.set("authorization", `Bearer ${await getVercelOidcToken()}`);
+    const token = await getVercelOidcToken();
+    if (!merged.has("authorization")) merged.set("authorization", `Bearer ${token}`);
+    merged.set("x-vercel-trusted-oidc-idp-token", token);
   }
   return registryHeaders(merged, env);
 }

package/workspace.mjs

@@ -47,9 +47,12 @@ export const DOMAIN = /^[a-z][a-z0-9-]*(\/[a-z][a-z0-9-]*)*$/;
 export const NAME = /^[a-z][a-z0-9-]{1,30}$/;
 export const HUMAN_NAME = /^[a-z][a-z0-9-]{0,30}$/;
 const COLOR = /^#[0-9a-f]{3}([0-9a-f]{3})?$/i;
-const AGENT_KEYS = new Set(["name", "model", "role", "color", "subagents", "subagentCap", "limits", "port", "runsOn", "domains", "kind"]);
+const AGENT_KEYS = new Set(["name", "model", "role", "color", "subagents", "subagentCap", "limits", "port", "runsOn", "modelAuth", "domains", "kind"]);
 
 export const RUNS_ON = ["hosted", "local"];
+// Whose credential a bot's model calls carry: the workspace's bots project (default), the human's own
+// Vercel sign-in, or the human's ChatGPT plan. Fixed at definition, like `runsOn`.
+const MODEL_AUTH = ["project", "user", "codex"];
 // The bot's place in the team (team.mjs draws the handoffs between kinds).
 export const KINDS = ["coordinator", "planner", "builder", "reviewer", "git-ops", "demo"];
 
@@ -104,6 +107,7 @@ export function parseWorkspace(data, file = WORKSPACE_FILE) {
     // Where the bot runs: on the hosted bots project (default), or on the human's Mac, started by
     // the app's local runner. Fixed at definition.
     if (agent.runsOn !== undefined && !RUNS_ON.includes(agent.runsOn)) fail(file, `${label}.runsOn must be "hosted" or "local"`);
+    if (agent.modelAuth !== undefined && !MODEL_AUTH.includes(agent.modelAuth)) fail(file, `${label}.modelAuth must be one of ${MODEL_AUTH.join(", ")}`);
     if (agent.kind !== undefined && !KINDS.includes(agent.kind)) fail(file, `${label}.kind must be one of ${KINDS.join(", ")}`);
     if (agent.domains !== undefined && (!Array.isArray(agent.domains) || agent.domains.some((d) => typeof d !== "string" || !DOMAIN.test(d)))) fail(file, `${label}.domains must be an array of memory folders like "ui" or "ui/motion"`);
     const unknown = Object.keys(agent).filter((k) => !AGENT_KEYS.has(k));
@@ -115,6 +119,10 @@ export function parseWorkspace(data, file = WORKSPACE_FILE) {
     if (!RUNS_ON.includes(data.runsOn)) fail(file, '"runsOn" must be "hosted" or "local"');
     out.runsOn = data.runsOn;
   }
+  // `user` and `codex` are credentials only the human's Mac holds; a hosted bot has the bots project's.
+  for (const a of agents) {
+    if (a.modelAuth !== undefined && a.modelAuth !== "project" && agentRunsOn(out, a.name) !== "local") fail(file, `${a.name}: modelAuth \"${a.modelAuth}\" needs runsOn \"local\"`);
+  }
   if (data.humans !== undefined) {
     if (!Array.isArray(data.humans) || !data.humans.length) fail(file, "\"humans\" must be a non-empty array");
     out.humans = data.humans.map((h, i) => {

package/world.mjs

@@ -10660,14 +10660,16 @@ import { createTursoWorld } from "./vendor/world-turso.mjs";
 function registryHeaders(init, env = process.env) {
   const headers = new Headers(init);
   if (env.HUB_TOKEN && !headers.has("authorization")) headers.set("authorization", `Bearer ${env.HUB_TOKEN}`);
-  if (env.HUB_PROTECTION_BYPASS) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
+  if (env.HUB_PROTECTION_BYPASS && !env.VERCEL) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
   return Object.fromEntries(headers);
 }
 async function hubHeaders(init, env = process.env) {
   const merged = new Headers(init);
-  if (env.VERCEL && !merged.has("authorization")) {
+  if (env.VERCEL) {
     const { getVercelOidcToken: getVercelOidcToken2 } = await Promise.resolve().then(() => __toESM(require_dist3(), 1));
-    merged.set("authorization", `Bearer ${await getVercelOidcToken2()}`);
+    const token = await getVercelOidcToken2();
+    if (!merged.has("authorization")) merged.set("authorization", `Bearer ${token}`);
+    merged.set("x-vercel-trusted-oidc-idp-token", token);
   }
   return registryHeaders(merged, env);
 }