eve-hub 0.12.0 → 0.13.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # eve-hub
 
+## 0.13.1
+
+### Patch Changes
+
+- `show` opens a web page (`uri`) or a file from the bot's sandbox (`path`) in a tab beside the thread.
+
+## 0.13.0
+
+### Minor Changes
+
+- b2a7266: Bots run plain eve on Vercel's Workflow storage: the kit no longer wires in a workflow world or exports `eve-hub/world`.
+
 ## 0.12.0
 
 ### Minor Changes

package/README.md

@@ -61,7 +61,7 @@ A deployed workspace (lib/workspace-template.mjs, staged by hosted-hub/scripts/s
 
 Releases go through Changesets, as in eve. A PR that changes the kit adds a changeset (`pnpm changeset`) and applies it (`pnpm changeset version`); when it merges, `.github/workflows/release.yml` runs `changeset publish` (no bot commits to main: its ruleset allows only PR merges): the kit's `prepack` stages the package into `dist/npm` (its `publishConfig.directory`), npm gets it, and the `eve-hub@<version>` GitHub release is created. npm auth is the repo's `NPM_TOKEN` secret (an npm automation token). The template pins the version this checkout carries.
 
-The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with both `eve/world-hub` and `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` when set. The hosted hub keeps Vercel Authentication on: a deployed bot sends its project's OIDC token in `x-vercel-trusted-oidc-idp-token` too (the hub project lists each bots project in its Trusted Sources, `hosted-hub/src/onboard/trust.ts` `trustBots`, and never the bypass secret, even while its deployment still holds the env), and a bot on a Mac sends `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret) when it has one.
+The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` when set. The hosted hub keeps Vercel Authentication on: a deployed bot sends its project's OIDC token in `x-vercel-trusted-oidc-idp-token` too (the hub project lists each bots project in its Trusted Sources, `hosted-hub/src/onboard/trust.ts` `trustBots`, and never the bypass secret, even while its deployment still holds the env), and a bot on a Mac sends `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret) when it has one.
 
 ## Vercel Kit connection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",
@@ -29,8 +29,7 @@
     "./bot-token": "./bot-token.mjs",
     "./hub-oidc": "./hub-oidc.mjs",
     "./prepare": "./prepare.mjs",
-    "./vercel": "./vercel.mjs",
-    "./world": "./world.mjs"
+    "./vercel": "./vercel.mjs"
   },
   "peerDependencies": {
     "eve": "*",

package/prepare.mjs

@@ -9,8 +9,8 @@
 //   token opens it and pays for model calls) with only the kit stubs that run
 //   off the hub's machine (DEPLOYED_KIT_FILES); a hosted bot whose sandbox.ts
 //   is the host's fails the build, and the build never writes a sandbox;
-// - the kit extension, host-only workers and kit stubs are dropped, the hub's
-//   workflow world is wired in (and the Vercel Kit connection), every bot gets eve's git extension, and the
+// - the kit extension, host-only workers and kit stubs are dropped, the
+//   Vercel Kit connection is wired in, every bot gets eve's git extension, and the
 //   workspace's memory and each bot's team architecture are embedded in the bots' memory providers (a function
 //   has no workspace cwd);
 // - /hub/manifest: the roster and the commit sha the deployment was built
@@ -79,12 +79,6 @@ export default defineChannel({
 
 export const MANIFEST_FILE = "hub.manifest.json";
 
-export function injectWorkflowWorld(agent, file) {
-  const count = agent.split("defineAgent({").length - 1;
-  if (count !== 1) throw new Error(`${file}: expected exactly one defineAgent({, found ${count}`);
-  return agent.replace("defineAgent({", `defineAgent({\n  experimental: { workflow: { world: "eve-hub/world" } },`);
-}
-
 // Removes `file` under `bot`, then any directory it leaves empty.
 function removeStub(bot, file) {
   unlinkSync(join(bot, file));
@@ -159,8 +153,6 @@ export function prepareDeployment(dir) {
     for (const item of readdirSync(bot, { recursive: true })) {
       if (item.endsWith(join("extensions", "kit.ts"))) removeStub(bot, item);
     }
-    const agentFile = join(bot, "agent.ts");
-    writeFileSync(agentFile, injectWorkflowWorld(readFileSync(agentFile, "utf8"), agentFile));
     // Slack for the onboarding skill comes through Vercel Kit, with the project's KIT_CONNECTOR;
     // without one the connection resolves to nothing.
     mkdirSync(join(bot, "connections"), { recursive: true });

package/stubs.mjs

@@ -8,7 +8,7 @@ export const KIT_FILES = {
   "hooks/sandbox.ts": ["Migrates legacy Docker sessions to the host sandbox."],
   "tools/bash.ts": ["eve's bash with a default time limit (kills the process group) and the workspace's code location."],
   "tools/react.ts": ["React to a message with an emoji."],
-  "tools/show.ts": ["Move the human's screen to a thread, DM, or message."],
+  "tools/show.ts": ["Move the human's screen to a thread, DM, or message, or open a page or file beside the thread."],
   "tools/browser.ts": ["Its own headless browser, watched live in the Computer view."],
   "tools/attach_image.ts": ["Puts an image (a sandbox file or a browser screenshot) on this turn's reply."],
   "tools/view_image.ts": ["Shows the bot an image (a sandbox file or a browser screenshot) so it can see it."],

package/tools/show.d.ts

@@ -2,17 +2,25 @@ declare const _default: import("eve/tools").ToolDefinition<{
     threadId?: string | undefined;
     agent?: string | undefined;
     messageId?: string | undefined;
+    uri?: string | undefined;
+    path?: string | undefined;
+    line?: number | undefined;
     reason: string;
 }, {
     ok: boolean;
+    opened?: string | undefined;
 }> & {
     execute(input: {
         threadId?: string | undefined;
         agent?: string | undefined;
         messageId?: string | undefined;
+        uri?: string | undefined;
+        path?: string | undefined;
+        line?: number | undefined;
         reason: string;
     }, ctx: import("eve/tools").ToolContext): Promise<{
         ok: boolean;
+        opened?: string | undefined;
     }>;
 };
 export default _default;

package/tools/show.js

@@ -1,24 +1,61 @@
+import { basename } from "node:path";
+import { pathToFileURL } from "node:url";
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { registryFetch } from "../registry-fetch.mjs";
 // Moves the human's workspace UI, e.g. to a thread you just opened or a
-// message they need to look at. They see a note saying you did it and why.
+// message they need to look at, or opens a page or file in the pane beside
+// the thread. They see a note saying you did it and why.
+//
+// A file goes as file:// on a local hub (the bot's files are the human's) and,
+// on a hosted hub (a deployed bot, or HUB_TOKEN set), as a snapshot uploaded to the hub
+// (hub://upload/<sha>.<ext>), since the human's Mac can't read the sandbox.
 export default defineTool({
-    description: "Move the human's screen to a place in the workspace: a thread (threadId), a bot's DM (agent), optionally scrolled to and highlighting one message (messageId). Use when you want them to look at something now. Rarely: only when they must look now.",
+    description: "Move the human's screen to a place in the workspace: a thread (threadId), a bot's DM (agent), optionally scrolled to and highlighting one message (messageId). Or open a web page (uri) or a file from your sandbox (path: markdown, text or code, an image, a PDF; line for text) in a tab beside this thread, without moving them. Use when you want them to look at something now. Rarely move their screen: only when they must look now.",
     inputSchema: z.object({
         threadId: z.string().optional().describe("Thread id, e.g. thr_0002."),
         agent: z.string().optional().describe("Open this bot's DM instead of a thread."),
         messageId: z.string().optional().describe("Also scroll to and highlight this message, like opening a link to it."),
+        uri: z.string().optional().describe("An http(s) page to open beside the thread."),
+        path: z.string().optional().describe("A file in your sandbox to open beside the thread, e.g. /workspace/repo/PLAN.md."),
+        line: z.number().int().positive().optional().describe("With path: the line a text or code file opens at."),
         reason: z.string().describe("One short line shown to the human, e.g. 'the plan is ready for review'."),
     }),
-    async execute(input, ctx) {
+    async execute({ path, uri, line, ...input }, ctx) {
+        if (path && uri)
+            throw new Error("pass path or uri, not both");
+        if (line && !path)
+            throw new Error("line goes with path");
+        let open = uri, title;
+        if (path) {
+            title = basename(path);
+            const sandbox = await ctx.getSandbox();
+            if (process.env.VERCEL || process.env.HUB_TOKEN) {
+                const bytes = await sandbox.readBinaryFile({ path });
+                if (!bytes)
+                    throw new Error(`no file at ${path}`);
+                const res = await registryFetch(`/api/uploads`, {
+                    method: "POST",
+                    headers: { "content-type": "application/octet-stream", "x-filename": encodeURIComponent(basename(path)) },
+                    body: new Uint8Array(bytes),
+                    signal: AbortSignal.timeout(30_000),
+                });
+                const body = await res.json().catch(() => ({}));
+                if (!res.ok)
+                    throw new Error(`show failed: the upload was refused (${body.error ?? res.status})`);
+                open = `hub://upload/${body.id}`;
+            }
+            else {
+                open = pathToFileURL(sandbox.resolvePath(path)).href;
+            }
+        }
         const res = await registryFetch(`/api/ui`, {
             method: "POST",
             headers: { "content-type": "application/json" },
-            body: JSON.stringify({ ...input, sessionId: ctx.session.id }),
+            body: JSON.stringify({ ...input, ...(open ? { uri: open, ...(line ? { line } : {}), ...(title ? { title } : {}) } : {}), sessionId: ctx.session.id }),
         });
         if (!res.ok)
             throw new Error(`show failed: ${res.status} ${await res.text()}`);
-        return { ok: true };
+        return { ok: true, ...(open ? { opened: open } : {}) };
     },
 });