eve-hub 0.14.9 → 0.14.11

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # eve-hub
 
+## 0.14.11
+
+### Patch Changes
+
+- The README and pack script name the job that publishes the kit, `ci.yml`'s `deploy-hub` (the old `release.yml` is gone).
+
+## 0.14.10
+
+### Patch Changes
+
+- Image sizes: `displaySize` gives an image's shown size, after a JPEG's EXIF orientation.
+
 ## 0.14.9
 
 ### Patch Changes

package/README.md

@@ -59,7 +59,7 @@ Add a changeset (`pnpm changeset`, pick `eve-hub`) when a tool's name, schema, o
 
 A deployed workspace (lib/workspace-template.mjs, staged by hosted-hub/scripts/stage-workspace.mjs) has no hub checkout to link, so it installs the kit from npm, published as [`eve-hub`](https://www.npmjs.com/package/eve-hub): `"eve-hub": "<version>"`. `node packages/agent-kit/scripts/pack.mjs <outDir>` builds the package: every `.ts` module compiled to `.js` + `.d.ts` in place (node won't strip types under `node_modules`), the `exports` map pointed at them, and `templates/` included.
 
-Releases go through Changesets, as in eve. A PR that changes the kit adds a changeset (`pnpm changeset`) and applies it (`pnpm changeset version`); when it merges, `.github/workflows/release.yml` runs `changeset publish` (no bot commits to main: its ruleset allows only PR merges): the kit's `prepack` stages the package into `dist/npm` (its `publishConfig.directory`), npm gets it, and the `eve-hub@<version>` GitHub release is created. npm auth is the repo's `NPM_TOKEN` secret (an npm automation token). The template pins the version this checkout carries.
+Releases go through Changesets, as in eve. A PR that changes the kit adds a changeset (`pnpm changeset`) and applies it (`pnpm changeset version`); when it merges, `ci.yml`'s `deploy-hub` job runs `changeset publish` (no bot commits to main: its ruleset allows only PR merges): the kit's `prepack` stages the package into `dist/npm` (its `publishConfig.directory`), npm gets it, and the `eve-hub@<version>` GitHub release is created. npm auth is the repo's `NPM_TOKEN` secret (an npm automation token). The template pins the version this checkout carries.
 
 The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. Every bot of a build with the project's `GITHUB_TOKEN` mounts `eve/extensions/git`; a build without one mounts it nowhere, and the execution context points the bot to the `vercel-kit` connection instead (packages/agent-kit/prepare.mjs, execution-context.mjs; the rendered prompts are snapshotted in hosted-hub/test/prompts). The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (the Vercel sandbox `create_agent` writes, lib/agent-template.mjs `sandboxFile`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` when set. The hosted hub keeps Vercel Authentication on: a deployed bot sends its project's OIDC token in `x-vercel-trusted-oidc-idp-token` too (the hub project lists each bots project in its Trusted Sources, `hosted-hub/src/onboard/trust.ts` `trustBots`, and never the bypass secret, even while its deployment still holds the env), and a bot on a Mac sends `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret) when it has one.
 

package/image-limits.d.mts

@@ -2,4 +2,5 @@ export const MAX_BYTES: number;
 export const MODEL_MAX_EDGE: number;
 export function sniffImage(bytes: Uint8Array): string | null;
 export function imageSize(bytes: Uint8Array, mediaType: string): { width: number; height: number } | null;
+export function displaySize(bytes: Uint8Array, mediaType: string): { width: number; height: number } | null;
 export function modelUnsafe(bytes: Uint8Array): string | null;

package/image-limits.mjs

@@ -45,6 +45,41 @@ export function imageSize(bytes, mediaType) {
   return null;
 }
 
+// The size the image is shown at: a JPEG whose EXIF orientation turns it a quarter (5 to 8) is drawn with its sides swapped, as
+// AppKit and browsers draw it. imageSize is the stored frame, which is what a model provider's limits apply to.
+export function displaySize(bytes, mediaType) {
+  const size = imageSize(bytes, mediaType);
+  if (!size || mediaType !== "image/jpeg") return size;
+  const o = jpegOrientation(bytes);
+  return o >= 5 && o <= 8 ? { width: size.height, height: size.width } : size;
+}
+
+// The EXIF orientation (1 to 8) in a JPEG's APP1 segment; 1 when it has none.
+function jpegOrientation(bytes) {
+  const v = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let i = 2;
+  while (i + 4 <= bytes.length && bytes[i] === 0xff) {
+    const marker = bytes[i + 1];
+    if (marker === 0xda || marker === 0xd9) return 1;
+    const len = v.getUint16(i + 2);
+    const start = i + 4, end = Math.min(i + 2 + len, bytes.length);
+    if (marker === 0xe1 && end - start >= 14 && String.fromCharCode(...bytes.subarray(start, start + 4)) === "Exif" && bytes[start + 4] === 0 && bytes[start + 5] === 0) {
+      const tiff = start + 6, little = bytes[tiff] === 0x49;
+      const u16 = (o) => v.getUint16(o, little), u32 = (o) => v.getUint32(o, little);
+      const ifd = tiff + u32(tiff + 4);
+      if (ifd + 2 > end) return 1;
+      const n = u16(ifd);
+      for (let e = 0; e < n && ifd + 2 + e * 12 + 12 <= end; e++) {
+        const at = ifd + 2 + e * 12;
+        if (u16(at) === 0x0112) return u16(at + 8);
+      }
+      return 1;
+    }
+    i += 2 + len;
+  }
+  return 1;
+}
+
 // Why a model provider would reject these bytes as an image part, or null if
 // it takes them: an unknown format, a size we can't read, a side over 8000px,
 // or more than MAX_BYTES. Checked before any file part is emitted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.14.9",
+  "version": "0.14.11",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",