eve-hub 0.16.13 → 0.16.15

package/github-connector.mjs

@@ -0,0 +1,9 @@
+// The Vercel Connect connector that holds the workspace human's GitHub token (the eve-hub-github
+// App). The bots' `git__gh` (prepare.mjs) and main's dash pass (schedules/dash-run.mjs) ask it for
+// the same subject, so both act as the human. Its own module so a schedule can import it without
+// prepare.mjs's build-time imports.
+export const GITHUB_CONNECTOR = "github/eve-hub-github";
+
+// The subject eve's connections resolve for a hub turn (channels/eve-roster-user.ts: principal
+// `roster:<human>`, authenticator `roster`, no issuer of its own, so eve uses the authenticator).
+export const rosterSubject = (human) => ({ type: "user", id: `roster:${human}`, issuer: "roster" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.16.13",
+  "version": "0.16.15",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",

package/prepare.mjs

@@ -28,6 +28,8 @@ import { botDomains, domainFolders, readBotMemory, readMemory, validateMemory }
 import { agentRunsOn, readWorkspaceFile, removeWorkspaceAgent } from "./workspace.mjs";
 import { architectureText } from "./team.mjs";
 import { sandboxReady } from "./sandbox-migrate.mjs";
+import { GITHUB_CONNECTOR } from "./github-connector.mjs";
+export { GITHUB_CONNECTOR };
 
 // eve's git extension, for each bot of a build from a workspace repo that edits files: its `git__gh` tool runs
 // git, gh and gh-signed-commit against the workspace's org with the human's own GitHub token,
@@ -36,7 +38,6 @@ import { sandboxReady } from "./sandbox-migrate.mjs";
 // hub turn runs as the workspace's human (channels/eve-roster-user.ts), so pushes, PRs and commits
 // are theirs. The shell holds no credential. A build without a repo (an uploaded deployment)
 // mounts none.
-export const GITHUB_CONNECTOR = "github/eve-hub-github";
 export const GIT_EXTENSION_FILE = "extensions/git.ts";
 // The read-only preset's stub (lib/agent-template.mjs): eve's write_file, disabled.
 const READ_ONLY_FILE = "tools/write_file.ts";

package/schedules/dash-plan.mjs

@@ -23,6 +23,8 @@ export const PLAN_TIMEOUT_MS = 240_000;
 const MS_DAY = 86_400_000;
 const PRS_PER_CARD = 6;
 export const LINE_MAX = 90;
+// The wire's PLAN_BASIS_MAX (SetDashPlan.basis); test/dash-plan.test.mjs keeps the two equal.
+export const PLAN_BASIS_MAX = 100_000;
 
 const humanOf = (snap) => snap?.humans?.[0]?.name ?? "me";
 const isHuman = (m, human) => m.author === human || m.authorKind === "human";
@@ -308,6 +310,12 @@ export async function runPlan(hub, { generate, decisions = "", sizes = {}, now =
   const reason = replanReason(s, now);
   if (!reason) return { planned: null, reason: "plan is current" };
   if (!waitingThreads(s).length) return { planned: null, reason: "nothing waits on the human" };
+  const basis = planBasis(s, now);
+  if (basis.length > PLAN_BASIS_MAX) {
+    const why = `${JSON.parse(basis).asks.length} asks exceed the plan basis limit`;
+    log?.warn?.(`dash plan: skipped, ${why}`);
+    return { planned: null, reason: why };
+  }
   let plan;
   try {
     const cards = planCards(s, { now, sizes });
@@ -318,7 +326,7 @@ export async function runPlan(hub, { generate, decisions = "", sizes = {}, now =
     return { planned: null, reason: String(err?.message ?? err) };
   }
   if (!plan.chunks.length && !plan.later) return { planned: null, reason: "no asks" };
-  const { id } = await hub.dashPlan(planBasis(s, now), plan);
+  const { id } = await hub.dashPlan(basis, plan);
   log?.log?.(`dash plan: ${id} (${reason}): ${plan.chunks.length} chunks, ${planned(plan).length} rows`);
   return { planned: id, reason };
 }

package/schedules/dash-run.mjs

@@ -1,15 +1,23 @@
-// One tick of main's dash schedule (schedules/dash.ts): the `gh` probe and
+// One tick of main's dash schedule (schedules/dash.ts): the GitHub probe and
 // the run around it. A failed GitHub call never fails the tick: the probe is
 // retried once on a 5xx or a timeout, and if it still fails every PR keeps
 // what was last known (nothing said of any), threads and waits are still
 // scanned and posted, and the post carries a one-line note of what was
 // skipped. Only then is the Dash's checkedAt left alone, so the sidebar shows
-// the Dash stale while GitHub stays unreachable (gh logged out, offline).
+// the Dash stale while GitHub stays unreachable (no token, offline).
+//
+// The probe is one GraphQL query over HTTPS, as the workspace human: the
+// search is `author:@me`, so it needs their own user token, never an App's.
+// A hosted hub's function has no `gh`, so it asks Vercel Connect for the
+// token the bots' `git__gh` gets (github-connector.mjs); a local hub asks
+// `gh auth token`. The token goes in the request header and nowhere else.
 //
 // Plain JS on purpose: the schedule (TypeScript, bundled by eve) and the
 // tests (plain node) import the same module.
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
+import { NoValidTokenError, UserAuthorizationRequiredError, getToken } from "@vercel/connect";
+import { GITHUB_CONNECTOR, rosterSubject } from "../github-connector.mjs";
 import { runOnce } from "./hub.mjs";
 import { REFS_PER_QUERY, dashPrs, dashQuery, dashScan, dashWatchList, failedRefs, prsFromSearch } from "./dash-rules.mjs";
 
@@ -17,12 +25,16 @@ import { REFS_PER_QUERY, dashPrs, dashQuery, dashScan, dashWatchList, failedRefs
 // SCHEDULE_DISPATCH_TIMEOUT_MS): two 20 s tries and the registry calls fit.
 export const GH_TIMEOUT_MS = 20_000;
 export const GH_RETRY_DELAY_MS = 1_000;
+// The token comes first, once a tick, and leaves the two tries their 20 s.
+export const TOKEN_TIMEOUT_MS = 5_000;
+export const GITHUB_GRAPHQL_URL = "https://api.github.com/graphql";
 
 // A failure worth one more try: GitHub's 5xx, or no answer in time.
 export const retryable = (err) => !!(err?.timedOut || /HTTP 5\d\d|timed? ?out|ETIMEDOUT|ECONNRESET|unexpected EOF/i.test(String(err?.message ?? "")));
 
-// What a failure is called in the tick's note: "gh 504", "gh timeout", …
+// What a failure is called in the tick's note: "gh 504", "gh timeout", "GitHub approval needed", …
 export function ghReason(err) {
+  if (err instanceof UserAuthorizationRequiredError || err instanceof NoValidTokenError) return "GitHub approval needed";
   const msg = String(err?.message ?? "");
   const http = msg.match(/HTTP (\d{3})/);
   if (http) return `gh ${http[1]}`;
@@ -32,19 +44,23 @@ export function ghReason(err) {
   return "gh failed";
 }
 
-// One `gh api graphql` call: the parsed answer, or an Error (`timedOut` set
-// when gh was killed for taking too long). A PR asked about by name that's
-// gone fails only its own alias: gh exits non-zero but the rest of the
-// answer is good, so any answer with the search in it counts.
-export function ghGraphql(query, { timeoutMs = GH_TIMEOUT_MS, bin = "gh" } = {}) {
+const timedOut = (what) => Object.assign(new Error(`gh: ${what} timed out`), { timedOut: true });
+
+// The workspace human's GitHub user token. Hosted: Vercel Connect's, for the
+// subject `git__gh` resolves (`roster:<human>`); its errors pass through, so
+// a missing approval reads as one. Local: `gh auth token`.
+export function githubToken(human, { hosted = Boolean(process.env.VERCEL), connect = getToken, bin = "gh", timeoutMs = TOKEN_TIMEOUT_MS } = {}) {
+  if (hosted) {
+    if (!human) return Promise.reject(new Error("gh: the hub names no human to ask GitHub as"));
+    let timer;
+    const deadline = new Promise((_, reject) => { timer = setTimeout(() => reject(timedOut("Vercel Connect")), timeoutMs); });
+    return Promise.race([connect(GITHUB_CONNECTOR, { subject: rosterSubject(human) }), deadline]).finally(() => clearTimeout(timer));
+  }
   return new Promise((resolve, reject) => {
-    execFile(bin, ["api", "graphql", "-f", `query=${query}`], { timeout: timeoutMs, maxBuffer: 4 << 20 }, (error, stdout, stderr) => {
-      let body = null;
-      try {
-        body = JSON.parse(stdout);
-      } catch {}
-      if (body?.data?.search) return resolve(body);
-      const err = new Error(`gh: ${String(stderr || error?.message || "no answer").trim().replace(/^gh: /, "").slice(0, 300)}`);
+    execFile(bin, ["auth", "token"], { timeout: timeoutMs }, (error, stdout, stderr) => {
+      const token = String(stdout ?? "").trim();
+      if (!error && token) return resolve(token);
+      const err = new Error(`gh: ${String(stderr || error?.message || "no token").trim().replace(/^gh: /, "").slice(0, 300)}`);
       if (error?.killed || error?.signal) err.timedOut = true;
       if (error?.code === "ENOENT") err.code = "ENOENT";
       reject(err);
@@ -52,6 +68,44 @@ export function ghGraphql(query, { timeoutMs = GH_TIMEOUT_MS, bin = "gh" } = {})
   });
 }
 
+// One GraphQL query: the parsed answer, or an Error ("gh: HTTP 502: …", or
+// `timedOut` set when GitHub didn't answer in time). A PR asked about by name
+// that's gone fails only its own alias and the rest of the answer is good, so
+// any answer with the search in it counts.
+export async function ghGraphql(query, { token, timeoutMs = GH_TIMEOUT_MS, fetchImpl = fetch } = {}) {
+  let res;
+  let text;
+  try {
+    res = await fetchImpl(GITHUB_GRAPHQL_URL, {
+      method: "POST",
+      headers: { authorization: `bearer ${token}`, "content-type": "application/json", "user-agent": "eve-hub-dash" },
+      body: JSON.stringify({ query }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    text = await res.text();
+  } catch (cause) {
+    if (cause?.name === "TimeoutError" || cause?.name === "AbortError") throw timedOut("GitHub");
+    throw new Error(`gh: ${String(cause?.message ?? cause).slice(0, 200)}${cause?.cause?.code ? ` (${cause.cause.code})` : ""}`);
+  }
+  let body = null;
+  try {
+    body = JSON.parse(text);
+  } catch {}
+  if (body?.data?.search) return body;
+  const why = String(body?.errors?.[0]?.message ?? body?.message ?? text ?? "").trim() || "no answer";
+  throw new Error(`gh: ${res.ok ? "" : `HTTP ${res.status}: `}${why.slice(0, 300)}`);
+}
+
+// The tick's probe: the token asked for once (again only after it failed), each query retried once.
+export function githubProbe(tokenOf, { delayMs = GH_RETRY_DELAY_MS, fetchImpl = fetch, timeoutMs = GH_TIMEOUT_MS } = {}) {
+  let token = null;
+  const once = () => (token ??= tokenOf().catch((err) => {
+    token = null;
+    throw err;
+  }));
+  return (query) => withRetry(async () => ghGraphql(query, { token: await once(), fetchImpl, timeoutMs }), { delayMs });
+}
+
 // `call` retried once (after `delayMs`) when it fails in a way worth retrying.
 export async function withRetry(call, { delayMs = GH_RETRY_DELAY_MS } = {}) {
   try {
@@ -66,16 +120,18 @@ export async function withRetry(call, { delayMs = GH_RETRY_DELAY_MS } = {}) {
 const hashOf = (text) => createHash("sha256").update(text).digest("base64url").slice(0, 22);
 const plural = (n) => `${n} PR${n === 1 ? "" : "s"}`;
 
-// One tick. `probe(query)` -> the GraphQL answer (rejects on failure).
+// One tick. `probe(query)` -> the GraphQL answer (rejects on failure); by default GitHub's, as the snapshot's human
+// (`token(human)`: githubToken).
 // Returns { ok, sizes }: ok is false when the PRs couldn't be fetched at all; sizes is each PR's title and
 // diff size ("owner/repo#12" -> { title, add, del, files }) as GitHub said this tick, for the plan's cards.
-export async function runDash(hub, { probe = (q) => withRetry(() => ghGraphql(q)), now = Date.now(), log = console } = {}) {
+export async function runDash(hub, { probe, token = githubToken, now = Date.now(), log = console } = {}) {
   let ok = true;
   let prFacts = {};
   const sizes = {};
   await runOnce(hub, "dash", async (snap, saved, at) => {
     const { refs, reviewed, keep: waited } = dashWatchList(snap, saved);
     const tracked = new Set(Object.keys(dashPrs(saved)));
+    const ask = probe ?? githubProbe(() => token(snap?.humans?.[0]?.name));
     const facts = {};
     let prs = null;
     let skip = new Set();
@@ -83,7 +139,7 @@ export async function runDash(hub, { probe = (q) => withRetry(() => ghGraphql(q)
     try {
       const chunks = [];
       for (let i = 0; i < Math.max(refs.length, 1); i += REFS_PER_QUERY) chunks.push(refs.slice(i, i + REFS_PER_QUERY));
-      const answers = await Promise.all(chunks.map((c) => probe(dashQuery(c))));
+      const answers = await Promise.all(chunks.map((c) => ask(dashQuery(c))));
       const found = answers.flatMap(prsFromSearch);
       const searched = new Set(answers.flatMap((a) => prsFromSearch({ data: { search: a?.data?.search } })).map((p) => p.key));
       prs = found.filter((p) => !reviewed.has(p.key) || searched.has(p.key) || tracked.has(p.key) || waited.has(p.key));

package/schedules/hub.d.mts

@@ -21,7 +21,7 @@ export type Hub = {
   dashPlan(basis: string, plan: object): Promise<Ok & { id: string }>;
   dashEntries(entries: object[], remove?: string[], notice?: Notice | null): Promise<Ok & { entries: DashEntries }>;
 };
-export function createHub(options?: { base?: string; agent?: string; fetchImpl?: typeof fetch }): Hub;
+export function createHub(options?: { base?: string; agent?: string; fetchImpl?: typeof fetch; log?: Pick<Console, "log"> }): Hub;
 export const POST_MAX_BYTES: number;
 export const POSTS_PER_COMMIT: number;
 export function toPosts(notices: string[]): string[];

package/schedules/hub.mjs

@@ -8,7 +8,7 @@
 import { createHash } from "node:crypto";
 import { registryBase, registryFetch } from "../registry-fetch.mjs";
 
-export function createHub({ base = registryBase(), agent = "main", fetchImpl = fetch } = {}) {
+export function createHub({ base = registryBase(), agent = "main", fetchImpl = fetch, log = console } = {}) {
   const call = async (path, init = {}) => {
     const res = await registryFetch(path, { ...init, headers: { "content-type": "application/json", ...(init.headers ?? {}) } }, { base, fetchImpl, deadlineMs: 10_000 });
     const text = await res.text();
@@ -45,7 +45,10 @@ export function createHub({ base = registryBase(), agent = "main", fetchImpl = f
     track: async (id, fn) => {
       const started = await call(`${statePath(id).slice(0, -"/state".length)}/runs`, { method: "POST", body: "{}" }).catch(() => null);
       if (!started?.ok) return fn();
-      if (started.body.paused) return;
+      if (started.body.paused) {
+        log.log(`schedule ${agent}/${id} skipped: paused`);
+        return;
+      }
       run = { id, run: started.body.run };
       const end = (error) => call(`${statePath(id).slice(0, -"/state".length)}/runs/${encodeURIComponent(run.run)}/end`, { method: "POST", body: JSON.stringify(error ? { error: error.slice(0, 2000) } : {}) }).catch(() => null);
       try {