eve-hub 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # eve-hub
 
+## 0.12.0
+
+### Minor Changes
+
+- A deployed bot's calls to the hub carry its project's OIDC token in `x-vercel-trusted-oidc-idp-token` as well as `Authorization`. The hub project's Deployment Protection takes it as a Trusted Source, so a bots project no longer needs `HUB_PROTECTION_BYPASS`; a deployed bot never sends `HUB_PROTECTION_BYPASS`, even while its deployment still holds the env, so deleting the env needs no redeploy. A bot that runs on a Mac still sends the secret it is given.
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -61,7 +61,7 @@ A deployed workspace (lib/workspace-template.mjs, staged by hosted-hub/scripts/s
 
 Releases go through Changesets, as in eve. A PR that changes the kit adds a changeset (`pnpm changeset`) and applies it (`pnpm changeset version`); when it merges, `.github/workflows/release.yml` runs `changeset publish` (no bot commits to main: its ruleset allows only PR merges): the kit's `prepack` stages the package into `dist/npm` (its `publishConfig.directory`), npm gets it, and the `eve-hub@<version>` GitHub release is created. npm auth is the repo's `NPM_TOKEN` secret (an npm automation token). The template pins the version this checkout carries.
 
-The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with both `eve/world-hub` and `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` and, since the hosted hub keeps Vercel Authentication on, `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret), each when set.
+The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with both `eve/world-hub` and `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` when set. The hosted hub keeps Vercel Authentication on: a deployed bot sends its project's OIDC token in `x-vercel-trusted-oidc-idp-token` too (the hub project lists each bots project in its Trusted Sources, `hosted-hub/src/onboard/trust.ts` `trustBots`, and never the bypass secret, even while its deployment still holds the env), and a bot on a Mac sends `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret) when it has one.
 
 ## Vercel Kit connection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",

package/registry-fetch.mjs

@@ -1,8 +1,10 @@
 // Registry-relative fetch for the kit, using ROSTER_REGISTRY_URL.
 // HUB_TOKEN is this bot's credential for a hosted hub; unset locally.
 // HUB_PROTECTION_BYPASS is the hosted hub project's Protection Bypass for
-// Automation secret: the hub keeps Vercel Authentication on, and the bots (on
-// the same team) pass it with x-vercel-protection-bypass. Unset locally.
+// Automation secret, sent with x-vercel-protection-bypass by a bot that runs on
+// a Mac (a deployed bot's project token passes the hub's Deployment Protection
+// instead: hubHeaders, which a deployed bot sends whether or not the project
+// still holds the secret). Unset locally.
 // `hub restart` keeps the bots running while the registry is replaced, so a
 // turn can call a tool during the few seconds no registry is listening.
 // Retried, with backoff (250 ms doubling to 2 s) for up to 30 s:
@@ -34,7 +36,7 @@ export const sandboxRegistry = () => (process.env.HUB_SANDBOX_SERVICES === "none
 export function registryHeaders(init, env = process.env) {
   const headers = new Headers(init);
   if (env.HUB_TOKEN && !headers.has("authorization")) headers.set("authorization", `Bearer ${env.HUB_TOKEN}`);
-  if (env.HUB_PROTECTION_BYPASS) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
+  if (env.HUB_PROTECTION_BYPASS && !env.VERCEL) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
   return Object.fromEntries(headers);
 }
 
@@ -59,11 +61,15 @@ const DROPPED = new Set(["ECONNRESET", "EPIPE", "UND_ERR_SOCKET"]);
 
 // Every call a bot makes to the hub: a deployed bot is the caller its own project's token says (the hub checks it: api/auth.ts);
 // elsewhere HUB_TOKEN is the credential, if any. The one place a call's headers are made.
+// The same token also passes the hub's Deployment Protection, which trusts the bots projects (a Trusted Source) and takes it in
+// its own header: no bypass secret.
 export async function hubHeaders(init, env = process.env) {
   const merged = new Headers(init);
-  if (env.VERCEL && !merged.has("authorization")) {
+  if (env.VERCEL) {
     const { getVercelOidcToken } = await import("@vercel/oidc");
-    merged.set("authorization", `Bearer ${await getVercelOidcToken()}`);
+    const token = await getVercelOidcToken();
+    if (!merged.has("authorization")) merged.set("authorization", `Bearer ${token}`);
+    merged.set("x-vercel-trusted-oidc-idp-token", token);
   }
   return registryHeaders(merged, env);
 }

package/world.mjs

@@ -10660,14 +10660,16 @@ import { createTursoWorld } from "./vendor/world-turso.mjs";
 function registryHeaders(init, env = process.env) {
   const headers = new Headers(init);
   if (env.HUB_TOKEN && !headers.has("authorization")) headers.set("authorization", `Bearer ${env.HUB_TOKEN}`);
-  if (env.HUB_PROTECTION_BYPASS) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
+  if (env.HUB_PROTECTION_BYPASS && !env.VERCEL) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
   return Object.fromEntries(headers);
 }
 async function hubHeaders(init, env = process.env) {
   const merged = new Headers(init);
-  if (env.VERCEL && !merged.has("authorization")) {
+  if (env.VERCEL) {
     const { getVercelOidcToken: getVercelOidcToken2 } = await Promise.resolve().then(() => __toESM(require_dist3(), 1));
-    merged.set("authorization", `Bearer ${await getVercelOidcToken2()}`);
+    const token = await getVercelOidcToken2();
+    if (!merged.has("authorization")) merged.set("authorization", `Bearer ${token}`);
+    merged.set("x-vercel-trusted-oidc-idp-token", token);
   }
   return registryHeaders(merged, env);
 }