eve-hub 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # eve-hub
 
+## 0.13.0
+
+### Minor Changes
+
+- b2a7266: Bots run plain eve on Vercel's Workflow storage: the kit no longer wires in a workflow world or exports `eve-hub/world`.
+
+## 0.12.0
+
+### Minor Changes
+
+- A deployed bot's calls to the hub carry its project's OIDC token in `x-vercel-trusted-oidc-idp-token` as well as `Authorization`. The hub project's Deployment Protection takes it as a Trusted Source, so a bots project no longer needs `HUB_PROTECTION_BYPASS`; a deployed bot never sends `HUB_PROTECTION_BYPASS`, even while its deployment still holds the env, so deleting the env needs no redeploy. A bot that runs on a Mac still sends the secret it is given.
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -61,7 +61,7 @@ A deployed workspace (lib/workspace-template.mjs, staged by hosted-hub/scripts/s
 
 Releases go through Changesets, as in eve. A PR that changes the kit adds a changeset (`pnpm changeset`) and applies it (`pnpm changeset version`); when it merges, `.github/workflows/release.yml` runs `changeset publish` (no bot commits to main: its ruleset allows only PR merges): the kit's `prepack` stages the package into `dist/npm` (its `publishConfig.directory`), npm gets it, and the `eve-hub@<version>` GitHub release is created. npm auth is the repo's `NPM_TOKEN` secret (an npm automation token). The template pins the version this checkout carries.
 
-The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with both `eve/world-hub` and `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` and, since the hosted hub keeps Vercel Authentication on, `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret), each when set.
+The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` when set. The hosted hub keeps Vercel Authentication on: a deployed bot sends its project's OIDC token in `x-vercel-trusted-oidc-idp-token` too (the hub project lists each bots project in its Trusted Sources, `hosted-hub/src/onboard/trust.ts` `trustBots`, and never the bypass secret, even while its deployment still holds the env), and a bot on a Mac sends `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret) when it has one.
 
 ## Vercel Kit connection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",
@@ -29,8 +29,7 @@
     "./bot-token": "./bot-token.mjs",
     "./hub-oidc": "./hub-oidc.mjs",
     "./prepare": "./prepare.mjs",
-    "./vercel": "./vercel.mjs",
-    "./world": "./world.mjs"
+    "./vercel": "./vercel.mjs"
   },
   "peerDependencies": {
     "eve": "*",

package/prepare.mjs

@@ -9,8 +9,8 @@
 //   token opens it and pays for model calls) with only the kit stubs that run
 //   off the hub's machine (DEPLOYED_KIT_FILES); a hosted bot whose sandbox.ts
 //   is the host's fails the build, and the build never writes a sandbox;
-// - the kit extension, host-only workers and kit stubs are dropped, the hub's
-//   workflow world is wired in (and the Vercel Kit connection), every bot gets eve's git extension, and the
+// - the kit extension, host-only workers and kit stubs are dropped, the
+//   Vercel Kit connection is wired in, every bot gets eve's git extension, and the
 //   workspace's memory and each bot's team architecture are embedded in the bots' memory providers (a function
 //   has no workspace cwd);
 // - /hub/manifest: the roster and the commit sha the deployment was built
@@ -79,12 +79,6 @@ export default defineChannel({
 
 export const MANIFEST_FILE = "hub.manifest.json";
 
-export function injectWorkflowWorld(agent, file) {
-  const count = agent.split("defineAgent({").length - 1;
-  if (count !== 1) throw new Error(`${file}: expected exactly one defineAgent({, found ${count}`);
-  return agent.replace("defineAgent({", `defineAgent({\n  experimental: { workflow: { world: "eve-hub/world" } },`);
-}
-
 // Removes `file` under `bot`, then any directory it leaves empty.
 function removeStub(bot, file) {
   unlinkSync(join(bot, file));
@@ -159,8 +153,6 @@ export function prepareDeployment(dir) {
     for (const item of readdirSync(bot, { recursive: true })) {
       if (item.endsWith(join("extensions", "kit.ts"))) removeStub(bot, item);
     }
-    const agentFile = join(bot, "agent.ts");
-    writeFileSync(agentFile, injectWorkflowWorld(readFileSync(agentFile, "utf8"), agentFile));
     // Slack for the onboarding skill comes through Vercel Kit, with the project's KIT_CONNECTOR;
     // without one the connection resolves to nothing.
     mkdirSync(join(bot, "connections"), { recursive: true });

package/registry-fetch.mjs

@@ -1,8 +1,10 @@
 // Registry-relative fetch for the kit, using ROSTER_REGISTRY_URL.
 // HUB_TOKEN is this bot's credential for a hosted hub; unset locally.
 // HUB_PROTECTION_BYPASS is the hosted hub project's Protection Bypass for
-// Automation secret: the hub keeps Vercel Authentication on, and the bots (on
-// the same team) pass it with x-vercel-protection-bypass. Unset locally.
+// Automation secret, sent with x-vercel-protection-bypass by a bot that runs on
+// a Mac (a deployed bot's project token passes the hub's Deployment Protection
+// instead: hubHeaders, which a deployed bot sends whether or not the project
+// still holds the secret). Unset locally.
 // `hub restart` keeps the bots running while the registry is replaced, so a
 // turn can call a tool during the few seconds no registry is listening.
 // Retried, with backoff (250 ms doubling to 2 s) for up to 30 s:
@@ -34,7 +36,7 @@ export const sandboxRegistry = () => (process.env.HUB_SANDBOX_SERVICES === "none
 export function registryHeaders(init, env = process.env) {
   const headers = new Headers(init);
   if (env.HUB_TOKEN && !headers.has("authorization")) headers.set("authorization", `Bearer ${env.HUB_TOKEN}`);
-  if (env.HUB_PROTECTION_BYPASS) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
+  if (env.HUB_PROTECTION_BYPASS && !env.VERCEL) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
   return Object.fromEntries(headers);
 }
 
@@ -59,11 +61,15 @@ const DROPPED = new Set(["ECONNRESET", "EPIPE", "UND_ERR_SOCKET"]);
 
 // Every call a bot makes to the hub: a deployed bot is the caller its own project's token says (the hub checks it: api/auth.ts);
 // elsewhere HUB_TOKEN is the credential, if any. The one place a call's headers are made.
+// The same token also passes the hub's Deployment Protection, which trusts the bots projects (a Trusted Source) and takes it in
+// its own header: no bypass secret.
 export async function hubHeaders(init, env = process.env) {
   const merged = new Headers(init);
-  if (env.VERCEL && !merged.has("authorization")) {
+  if (env.VERCEL) {
     const { getVercelOidcToken } = await import("@vercel/oidc");
-    merged.set("authorization", `Bearer ${await getVercelOidcToken()}`);
+    const token = await getVercelOidcToken();
+    if (!merged.has("authorization")) merged.set("authorization", `Bearer ${token}`);
+    merged.set("x-vercel-trusted-oidc-idp-token", token);
   }
   return registryHeaders(merged, env);
 }