eve-hub 0.16.13 → 0.16.14

package/github-connector.mjs

@@ -0,0 +1,9 @@
+// The Vercel Connect connector that holds the workspace human's GitHub token (the eve-hub-github
+// App). The bots' `git__gh` (prepare.mjs) and main's dash pass (schedules/dash-run.mjs) ask it for
+// the same subject, so both act as the human. Its own module so a schedule can import it without
+// prepare.mjs's build-time imports.
+export const GITHUB_CONNECTOR = "github/eve-hub-github";
+
+// The subject eve's connections resolve for a hub turn (channels/eve-roster-user.ts: principal
+// `roster:<human>`, authenticator `roster`, no issuer of its own, so eve uses the authenticator).
+export const rosterSubject = (human) => ({ type: "user", id: `roster:${human}`, issuer: "roster" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.16.13",
+  "version": "0.16.14",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",

package/prepare.mjs

@@ -28,6 +28,8 @@ import { botDomains, domainFolders, readBotMemory, readMemory, validateMemory }
 import { agentRunsOn, readWorkspaceFile, removeWorkspaceAgent } from "./workspace.mjs";
 import { architectureText } from "./team.mjs";
 import { sandboxReady } from "./sandbox-migrate.mjs";
+import { GITHUB_CONNECTOR } from "./github-connector.mjs";
+export { GITHUB_CONNECTOR };
 
 // eve's git extension, for each bot of a build from a workspace repo that edits files: its `git__gh` tool runs
 // git, gh and gh-signed-commit against the workspace's org with the human's own GitHub token,
@@ -36,7 +38,6 @@ import { sandboxReady } from "./sandbox-migrate.mjs";
 // hub turn runs as the workspace's human (channels/eve-roster-user.ts), so pushes, PRs and commits
 // are theirs. The shell holds no credential. A build without a repo (an uploaded deployment)
 // mounts none.
-export const GITHUB_CONNECTOR = "github/eve-hub-github";
 export const GIT_EXTENSION_FILE = "extensions/git.ts";
 // The read-only preset's stub (lib/agent-template.mjs): eve's write_file, disabled.
 const READ_ONLY_FILE = "tools/write_file.ts";

package/schedules/dash-run.mjs

@@ -1,15 +1,23 @@
-// One tick of main's dash schedule (schedules/dash.ts): the `gh` probe and
+// One tick of main's dash schedule (schedules/dash.ts): the GitHub probe and
 // the run around it. A failed GitHub call never fails the tick: the probe is
 // retried once on a 5xx or a timeout, and if it still fails every PR keeps
 // what was last known (nothing said of any), threads and waits are still
 // scanned and posted, and the post carries a one-line note of what was
 // skipped. Only then is the Dash's checkedAt left alone, so the sidebar shows
-// the Dash stale while GitHub stays unreachable (gh logged out, offline).
+// the Dash stale while GitHub stays unreachable (no token, offline).
+//
+// The probe is one GraphQL query over HTTPS, as the workspace human: the
+// search is `author:@me`, so it needs their own user token, never an App's.
+// A hosted hub's function has no `gh`, so it asks Vercel Connect for the
+// token the bots' `git__gh` gets (github-connector.mjs); a local hub asks
+// `gh auth token`. The token goes in the request header and nowhere else.
 //
 // Plain JS on purpose: the schedule (TypeScript, bundled by eve) and the
 // tests (plain node) import the same module.
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
+import { NoValidTokenError, UserAuthorizationRequiredError, getToken } from "@vercel/connect";
+import { GITHUB_CONNECTOR, rosterSubject } from "../github-connector.mjs";
 import { runOnce } from "./hub.mjs";
 import { REFS_PER_QUERY, dashPrs, dashQuery, dashScan, dashWatchList, failedRefs, prsFromSearch } from "./dash-rules.mjs";
 
@@ -17,12 +25,16 @@ import { REFS_PER_QUERY, dashPrs, dashQuery, dashScan, dashWatchList, failedRefs
 // SCHEDULE_DISPATCH_TIMEOUT_MS): two 20 s tries and the registry calls fit.
 export const GH_TIMEOUT_MS = 20_000;
 export const GH_RETRY_DELAY_MS = 1_000;
+// The token comes first, once a tick, and leaves the two tries their 20 s.
+export const TOKEN_TIMEOUT_MS = 5_000;
+export const GITHUB_GRAPHQL_URL = "https://api.github.com/graphql";
 
 // A failure worth one more try: GitHub's 5xx, or no answer in time.
 export const retryable = (err) => !!(err?.timedOut || /HTTP 5\d\d|timed? ?out|ETIMEDOUT|ECONNRESET|unexpected EOF/i.test(String(err?.message ?? "")));
 
-// What a failure is called in the tick's note: "gh 504", "gh timeout", …
+// What a failure is called in the tick's note: "gh 504", "gh timeout", "GitHub approval needed", …
 export function ghReason(err) {
+  if (err instanceof UserAuthorizationRequiredError || err instanceof NoValidTokenError) return "GitHub approval needed";
   const msg = String(err?.message ?? "");
   const http = msg.match(/HTTP (\d{3})/);
   if (http) return `gh ${http[1]}`;
@@ -32,19 +44,23 @@ export function ghReason(err) {
   return "gh failed";
 }
 
-// One `gh api graphql` call: the parsed answer, or an Error (`timedOut` set
-// when gh was killed for taking too long). A PR asked about by name that's
-// gone fails only its own alias: gh exits non-zero but the rest of the
-// answer is good, so any answer with the search in it counts.
-export function ghGraphql(query, { timeoutMs = GH_TIMEOUT_MS, bin = "gh" } = {}) {
+const timedOut = (what) => Object.assign(new Error(`gh: ${what} timed out`), { timedOut: true });
+
+// The workspace human's GitHub user token. Hosted: Vercel Connect's, for the
+// subject `git__gh` resolves (`roster:<human>`); its errors pass through, so
+// a missing approval reads as one. Local: `gh auth token`.
+export function githubToken(human, { hosted = Boolean(process.env.VERCEL), connect = getToken, bin = "gh", timeoutMs = TOKEN_TIMEOUT_MS } = {}) {
+  if (hosted) {
+    if (!human) return Promise.reject(new Error("gh: the hub names no human to ask GitHub as"));
+    let timer;
+    const deadline = new Promise((_, reject) => { timer = setTimeout(() => reject(timedOut("Vercel Connect")), timeoutMs); });
+    return Promise.race([connect(GITHUB_CONNECTOR, { subject: rosterSubject(human) }), deadline]).finally(() => clearTimeout(timer));
+  }
   return new Promise((resolve, reject) => {
-    execFile(bin, ["api", "graphql", "-f", `query=${query}`], { timeout: timeoutMs, maxBuffer: 4 << 20 }, (error, stdout, stderr) => {
-      let body = null;
-      try {
-        body = JSON.parse(stdout);
-      } catch {}
-      if (body?.data?.search) return resolve(body);
-      const err = new Error(`gh: ${String(stderr || error?.message || "no answer").trim().replace(/^gh: /, "").slice(0, 300)}`);
+    execFile(bin, ["auth", "token"], { timeout: timeoutMs }, (error, stdout, stderr) => {
+      const token = String(stdout ?? "").trim();
+      if (!error && token) return resolve(token);
+      const err = new Error(`gh: ${String(stderr || error?.message || "no token").trim().replace(/^gh: /, "").slice(0, 300)}`);
       if (error?.killed || error?.signal) err.timedOut = true;
       if (error?.code === "ENOENT") err.code = "ENOENT";
       reject(err);
@@ -52,6 +68,44 @@ export function ghGraphql(query, { timeoutMs = GH_TIMEOUT_MS, bin = "gh" } = {})
   });
 }
 
+// One GraphQL query: the parsed answer, or an Error ("gh: HTTP 502: …", or
+// `timedOut` set when GitHub didn't answer in time). A PR asked about by name
+// that's gone fails only its own alias and the rest of the answer is good, so
+// any answer with the search in it counts.
+export async function ghGraphql(query, { token, timeoutMs = GH_TIMEOUT_MS, fetchImpl = fetch } = {}) {
+  let res;
+  let text;
+  try {
+    res = await fetchImpl(GITHUB_GRAPHQL_URL, {
+      method: "POST",
+      headers: { authorization: `bearer ${token}`, "content-type": "application/json", "user-agent": "eve-hub-dash" },
+      body: JSON.stringify({ query }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    text = await res.text();
+  } catch (cause) {
+    if (cause?.name === "TimeoutError" || cause?.name === "AbortError") throw timedOut("GitHub");
+    throw new Error(`gh: ${String(cause?.message ?? cause).slice(0, 200)}${cause?.cause?.code ? ` (${cause.cause.code})` : ""}`);
+  }
+  let body = null;
+  try {
+    body = JSON.parse(text);
+  } catch {}
+  if (body?.data?.search) return body;
+  const why = String(body?.errors?.[0]?.message ?? body?.message ?? text ?? "").trim() || "no answer";
+  throw new Error(`gh: ${res.ok ? "" : `HTTP ${res.status}: `}${why.slice(0, 300)}`);
+}
+
+// The tick's probe: the token asked for once (again only after it failed), each query retried once.
+export function githubProbe(tokenOf, { delayMs = GH_RETRY_DELAY_MS, fetchImpl = fetch, timeoutMs = GH_TIMEOUT_MS } = {}) {
+  let token = null;
+  const once = () => (token ??= tokenOf().catch((err) => {
+    token = null;
+    throw err;
+  }));
+  return (query) => withRetry(async () => ghGraphql(query, { token: await once(), fetchImpl, timeoutMs }), { delayMs });
+}
+
 // `call` retried once (after `delayMs`) when it fails in a way worth retrying.
 export async function withRetry(call, { delayMs = GH_RETRY_DELAY_MS } = {}) {
   try {
@@ -66,16 +120,18 @@ export async function withRetry(call, { delayMs = GH_RETRY_DELAY_MS } = {}) {
 const hashOf = (text) => createHash("sha256").update(text).digest("base64url").slice(0, 22);
 const plural = (n) => `${n} PR${n === 1 ? "" : "s"}`;
 
-// One tick. `probe(query)` -> the GraphQL answer (rejects on failure).
+// One tick. `probe(query)` -> the GraphQL answer (rejects on failure); by default GitHub's, as the snapshot's human
+// (`token(human)`: githubToken).
 // Returns { ok, sizes }: ok is false when the PRs couldn't be fetched at all; sizes is each PR's title and
 // diff size ("owner/repo#12" -> { title, add, del, files }) as GitHub said this tick, for the plan's cards.
-export async function runDash(hub, { probe = (q) => withRetry(() => ghGraphql(q)), now = Date.now(), log = console } = {}) {
+export async function runDash(hub, { probe, token = githubToken, now = Date.now(), log = console } = {}) {
   let ok = true;
   let prFacts = {};
   const sizes = {};
   await runOnce(hub, "dash", async (snap, saved, at) => {
     const { refs, reviewed, keep: waited } = dashWatchList(snap, saved);
     const tracked = new Set(Object.keys(dashPrs(saved)));
+    const ask = probe ?? githubProbe(() => token(snap?.humans?.[0]?.name));
     const facts = {};
     let prs = null;
     let skip = new Set();
@@ -83,7 +139,7 @@ export async function runDash(hub, { probe = (q) => withRetry(() => ghGraphql(q)
     try {
       const chunks = [];
       for (let i = 0; i < Math.max(refs.length, 1); i += REFS_PER_QUERY) chunks.push(refs.slice(i, i + REFS_PER_QUERY));
-      const answers = await Promise.all(chunks.map((c) => probe(dashQuery(c))));
+      const answers = await Promise.all(chunks.map((c) => ask(dashQuery(c))));
       const found = answers.flatMap(prsFromSearch);
       const searched = new Set(answers.flatMap((a) => prsFromSearch({ data: { search: a?.data?.search } })).map((p) => p.key));
       prs = found.filter((p) => !reviewed.has(p.key) || searched.has(p.key) || tracked.has(p.key) || waited.has(p.key));