eve-hub 0.6.59 → 0.6.60

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # eve-hub
 
+## 0.6.60
+
+### Patch Changes
+
+- A deployed bot's mention gate uses its own deployment's OIDC token for AI Gateway; a Mac bot's gate gets a project token from the hub, never the owner's OAuth token.
+
 ## 0.6.59
 
 ### Patch Changes

package/hooks/mention-gate.js

@@ -1,3 +1,4 @@
+import { getVercelOidcToken } from "@vercel/oidc";
 import { defineHook } from "eve/hooks";
 import { registryBase, registryFetch } from "../registry-fetch.mjs";
 import { credentialCache, hubCredentialLoader, screenInbound } from "../mention-gate.mjs";
@@ -6,9 +7,12 @@ import { credentialCache, hubCredentialLoader, screenInbound } from "../mention-
 // and the delivery whether a reply is needed. On a skip the hub posts
 // "<bot> skipped: <reason>" and the turn is cancelled before any model call.
 // Any failure answers. The hub names the bot from its session and serves its
-// instructions and the model credential, so a deployed bot and a Mac bot run
-// the same code. See packages/agent-kit/mention-gate.mjs.
-const credential = credentialCache(hubCredentialLoader(registryFetch));
+// instructions, so a deployed bot and a Mac bot run the same code. Its AI Gateway
+// credential is an OIDC token for the workspace's bots project: a deployed bot
+// carries its own, and a Mac bot has none, so it asks the hub for one.
+// See packages/agent-kit/mention-gate.mjs.
+const deploymentToken = async () => ({ ok: true, token: await getVercelOidcToken() });
+const credential = credentialCache(process.env.VERCEL ? deploymentToken : hubCredentialLoader(registryFetch));
 export default defineHook({
     events: {
         async "message.received"(event, ctx) {

package/mention-gate.d.mts

@@ -3,4 +3,4 @@ export function gateConfig(env?: Record<string, string | undefined>, file?: unkn
 export function opensWithHandle(text: string, agent: string): boolean;
 export function cleanReason(reason: unknown): string;
 export function screenInbound(input: { text: string; sessionId: string; agent?: string; registryUrl: string; credential: (opts?: { refresh?: boolean }) => Promise<{ token: string; teamId?: string | null } | null>; instructions?: string; fetchImpl?: typeof fetch; log?: ((line: string) => void) | null }): Promise<{ cancel: boolean; result?: unknown }>;
-export function hubCredentialLoader(fetchHub: (path: string, init: { headers?: Record<string, string> }) => Promise<Response>): (opts?: { refresh?: boolean }) => Promise<{ ok: boolean; token?: string; teamId?: string | null; error?: string }>;
+export function hubCredentialLoader(fetchHub: (path: string, init: { headers?: Record<string, string> }) => Promise<Response>): (opts?: { refresh?: boolean }) => Promise<{ ok: boolean; token?: string; error?: string }>;

package/mention-gate.mjs

@@ -434,7 +434,7 @@ export async function screenInbound({ text, sessionId, agent, registryUrl, instr
   }
 }
 
-// A deployed bot's AI Gateway credential: the hub's own (the workspace owner's sign-in, kept fresh there), asked for with the bot's HUB_TOKEN.
+// A Mac bot's AI Gateway credential: the hub mints an OIDC token for the workspace's bots project, asked for with the bot's HUB_TOKEN.
 // `fetchHub(path, init)` is registryFetch. On a refresh it names the token AI Gateway refused, as eve's served credential does.
 export function hubCredentialLoader(fetchHub) {
   let last = null;
@@ -443,6 +443,6 @@ export function hubCredentialLoader(fetchHub) {
     if (!res.ok) return { ok: false, error: `model credential ${res.status}` };
     const c = await res.json();
     last = c.token ?? null;
-    return { ok: Boolean(c.token), token: c.token, teamId: c.teamId ?? null };
+    return { ok: Boolean(c.token), token: c.token };
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.6.59",
+  "version": "0.6.60",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",