eve-hub 0.16.17 → 0.16.18

package/connections/vercel-kit.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("eve").DynamicSentinel<import("eve/connections").DynamicConnectionResult, import("eve").DynamicContext>;
+declare const _default: import("eve/connections").DynamicSentinel<import("eve/connections").DynamicConnectionResult, import("eve/connections").DynamicContext>;
 export default _default;

package/execution-context.mjs

@@ -59,7 +59,7 @@ export function hostedContext({ bot, kit, removed, deployment: d, git = false },
       ? "- **Changing it:** commit to that repository; Vercel builds and deploys the commit."
       : "- **Changing it:** there is no repository to commit to. The hub replaces these files on its next deploy, so an edit made only in this deployment does not last.",
     git
-      ? "- **GitHub:** goes through the `git__gh` tool (`git`, `gh`, `gh-signed-commit`), which runs each command with the human's own GitHub token, swapped in at the sandbox firewall for that command, so pushes, pull requests and commits are theirs. The shell itself holds no credential, so plain `git` and `gh` in bash cannot authenticate."
+      ? "- **GitHub:** goes through the `git__gh` tool (`git`, `gh`, `gh-signed-commit`), which runs each command with the human's own GitHub token, swapped in at the sandbox firewall for that command, so pushes, pull requests and commits are theirs. The shell itself holds no credential, so plain `git` and `gh` in bash cannot authenticate. Every command declares one repository in the workspace's org. Authenticated `git fetch`, `pull`, `push` and `ls-remote` name that repository's URL as the remote, never `origin` (`git push https://github.com/owner/name.git HEAD:branch`, `git fetch https://github.com/owner/name.git +refs/heads/branch:refs/remotes/origin/branch`), and `gh-signed-commit` always takes `--repo`."
       : "- **GitHub:** your shell has no GitHub credential: `git` cannot authenticate, so a private repository won't clone and nothing can be pushed. When a `vercel-kit` connection is listed, reach GitHub through it (eve__search, then eve__tool); otherwise tell the human this deployment has no GitHub access.",
     "- **Memory:** the standing decisions you recall are the `memory/` and `agents/<bot>/memory/` files, built into each deployment. An entry takes effect when the deployment that contains it is live, not on your next turn; with no repository it cannot last.",
     "- **Limits:** there is no `hub` CLI, you cannot restart yourself or any bot, and there are no host paths: your shell is a Vercel Sandbox with its own filesystem, not the owner's machine.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.16.17",
+  "version": "0.16.18",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",
@@ -39,9 +39,9 @@
     "./update": "./update.mjs"
   },
   "peerDependencies": {
-    "@vercel/connect": "^2.4.1",
+    "@vercel/connect": "^2.7.0",
     "@vercel/oidc": "4.0.0",
-    "eve": "~0.88.0",
+    "eve": "~1.0.0-rc.3",
     "zod": "4.5.4"
   },
   "dependencies": {
@@ -55,6 +55,6 @@
     "web-tree-sitter": "0.27.1"
   },
   "hubPins": {
-    "eve": "0.88.0"
+    "eve": "1.0.0-rc.3"
   }
 }

package/prepare.mjs

@@ -53,37 +53,62 @@ import type { VercelSandboxSession } from "eve/sandbox/vercel";
 // wake-ups and bot handoffs included, runs as the workspace's human (channels/eve-roster-user).
 // The sandbox only sees a placeholder; this swaps the real token in at the sandbox firewall for
 // that command and removes it afterwards. All other egress stays open.
+const ORG = ${JSON.stringify(org.toLowerCase())};
+
+// The firewall sees the request Git really sends, after any \`insteadOf\` or \`-c\` rewrite that
+// \`authorize\` can't see, so it swaps the token in only for paths under the workspace's org.
+// Anywhere else the placeholder goes out and GitHub answers 401. api.github.com keeps eve's rule:
+// \`/graphql\` and \`/user\` carry no owner.
+const ORG_PATHS: Record<string, string> = {
+  "github.com": \`(?i)^/\${ORG}/\`,
+  "uploads.github.com": \`(?i)^/repos/\${ORG}/\`,
+};
+const scoped = (rules: Parameters<GitHubLeaseBroker>[1]) =>
+  rules && Object.fromEntries(Object.entries(rules).map(([host, list]) => [
+    host,
+    host in ORG_PATHS ? list.map((rule) => ({ ...rule, match: { ...rule.match, path: { regex: ORG_PATHS[host] } } })) : list,
+  ]));
 const broker: GitHubLeaseBroker = async (sandbox, rules) => {
   if (!("setNetworkPolicy" in sandbox)) throw new Error("GitHub credential leases need a Vercel Sandbox");
-  await (sandbox as VercelSandboxSession).setNetworkPolicy({ allow: { "*": [], ...rules } } as SandboxNetworkPolicy);
+  await (sandbox as VercelSandboxSession).setNetworkPolicy({ allow: { "*": [], ...scoped(rules) } } as SandboxNetworkPolicy);
 };
 
-const ORG = ${JSON.stringify(org.toLowerCase())};
+// From eve 1.0, \`authorize\` is the only check: eve no longer refuses a command whose \`--repo\`,
+// \`-R\` or \`gh repo clone|view|fork\` target differs from the declared repository, nor a \`git\`
+// remote outside it, so this does. \`authorize\` can't read the sandbox, so a remote name such as
+// \`origin\` can't be resolved: authenticated git names the declared repository's URL itself.
+const GIT_REMOTE_COMMANDS = ["fetch", "ls-remote", "pull", "push"];
+const targets = (argv: readonly string[]) => [
+  ...argv.flatMap((a, i) => (a === "--repo" || a === "-R" ? [argv[i + 1] ?? ""] : a.startsWith("--repo=") ? [a.slice(7)] : [])),
+  ...(argv[0] === "gh" && argv[1] === "repo" && ["clone", "view", "fork"].includes(argv[2] ?? "") && argv[3] && !argv[3].startsWith("-") ? [argv[3]] : []),
+];
+const GITHUB_URL = /^(?:https:\\/\\/github\\.com\\/|git@github\\.com:|ssh:\\/\\/git@github\\.com\\/)/i;
+const canonical = (repo: string) => repo.toLowerCase().replace(GITHUB_URL, "").replace(/\\/$/, "").replace(/\\.git$/, "");
+const commandTargets = (argv: readonly string[]) =>
+  argv[0] === "git" ? (GIT_REMOTE_COMMANDS.includes(argv[1] ?? "") && GITHUB_URL.test(argv[2] ?? "") ? [argv[2]] : null)
+  : argv[0] === "gh-signed-commit" ? (targets(argv).length ? targets(argv) : null)
+  : targets(argv);
 
 export default git({
   github: {
     connector: ${JSON.stringify(GITHUB_CONNECTOR)},
     broker,
-    authorize: ({ repository }) => repository.toLowerCase().startsWith(\`\${ORG}/\`),
+    authorize: ({ argv, repository }) => {
+      const found = commandTargets(argv);
+      return repository !== null && canonical(repository).startsWith(\`\${ORG}/\`) && found !== null && found.every((t) => canonical(t) === canonical(repository));
+    },
     principalType: "user",
   },
 });
 ` });
 
-// Bots that edit code: eve-code (apply_patch, grep, the review skills and its
-// read-only worker), with no `github` option. The worker runs on the roster's
-// subagent cap like every other subagent, not on eve's built-in default.
+// Bots that edit code: eve-code (apply_patch, grep and the review skills), with
+// no `github` option.
 export const CODE_BOTS = ["builder"];
-export const codeExtensionFiles = (bot) => ({
+export const codeExtensionFiles = () => ({
   "extensions/code/extension.ts": `import code from "eve/extensions/code";
-import { bindRoster } from "eve-hub/roster-model";
-import { resolveSubagent } from "eve-hub/subagent-cap";
-import workspace from "../../../../../hub.workspace.json" with { type: "json" };
-
-const { agents, subagentCap } = bindRoster(workspace);
-const { model, reasoning } = resolveSubagent(agents, subagentCap, ${JSON.stringify(bot)}, "code__worker");
 
-export default code({ worker: { model, reasoning } });
+export default code();
 `,
 });
 
@@ -196,7 +221,7 @@ export function prepareDeployment(dir) {
     // A user token carries all of the human's write access and can't be narrowed, so a read-only bot
     // gets none. A bot's own committed git.ts (a wider org list, say) is the workspace's and stays.
     const git = deployment.repoOwner && !existsSync(join(bot, READ_ONLY_FILE)) && !existsSync(join(bot, GIT_EXTENSION_FILE));
-    for (const [stub, content] of Object.entries({ ...(git ? gitExtensionFiles(deployment.repoOwner) : {}), ...(code ? codeExtensionFiles(name) : {}) })) {
+    for (const [stub, content] of Object.entries({ ...(git ? gitExtensionFiles(deployment.repoOwner) : {}), ...(code ? codeExtensionFiles() : {}) })) {
       mkdirSync(dirname(join(bot, stub)), { recursive: true });
       writeFileSync(join(bot, stub), content);
     }