eve-hub 0.6.67 → 0.6.69

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # eve-hub
 
+## 0.6.69
+
+### Patch Changes
+
+- Hosted hub: a feed update re-reads only the threads it touched and the model calls added since the last one (the cache gaps), and checks itself against a whole read now and then; before, every update read the whole workspace.
+
+## 0.6.68
+
+### Patch Changes
+
+- A deployed bot calls the hub with its own project's OIDC token on every call (the tools, the mention gate, the post-commit delivery), with no HUB_TOKEN. It takes a call as the hub's when the call's `x-hub-oidc-token` is a token of this team's from the hub project (HUB_PROJECT_ID); a call without one (an older hub) still counts by BOT_TOKEN. Tokens are checked with jose. The hub accepts the bots' tokens beside the HMAC one and sends its own beside BOT_TOKEN, and gives each bots project HUB_PROJECT_ID.
+
 ## 0.6.67
 
 ### Patch Changes

package/channels/eve-roster-user.js

@@ -1,10 +1,10 @@
 import { eveChannel } from "eve/channels/eve";
 import { localDev } from "eve/channels/auth";
-import { isBotToken } from "../bot-token.mjs";
+import { getVercelOidcToken } from "@vercel/oidc";
+import { isHubRequest } from "../hub-oidc.mjs";
 // The registry relays for the workspace's human and names them in
 // `x-roster-user`. The name is trusted as a user principal only from the hub:
-// a local-dev request, or one carrying the workspace's BOT_TOKEN (a deployed
-// bot, see bot-token.mjs). Resolving it as a user lets user-scoped
+// a local-dev request, or one from the hub (a deployed bot, see hub-oidc.mjs). Resolving it as a user lets user-scoped
 // connections (open_pull_request's OAuth) key tokens to the configured human;
 // `localDev()` alone is not a user, so eve fails them with principal_required.
 const dev = localDev();
@@ -12,7 +12,7 @@ async function rosterUser(req) {
     const user = req.headers.get("x-roster-user");
     if (!user)
         return null;
-    if (!(await dev(req)) && !isBotToken(req.headers.get("authorization")))
+    if (!(await dev(req)) && !(await isHubRequest(req, getVercelOidcToken)))
         return null;
     return { authenticator: "roster", principalId: `roster:${user}`, principalType: "user", attributes: {} };
 }

package/hooks/mention-gate.js

@@ -16,7 +16,7 @@ const credential = credentialCache(process.env.VERCEL ? deploymentToken : hubCre
 export default defineHook({
     events: {
         async "message.received"(event, ctx) {
-            if (ctx.session.parent || !process.env.HUB_TOKEN)
+            if (ctx.session.parent || !(process.env.VERCEL || process.env.HUB_TOKEN))
                 return; // subagents are never gated; nor is a bot with no hosted hub
             const { cancel } = await screenInbound({
                 text: event.data.message,

package/hub-oidc.d.mts

@@ -0,0 +1,4 @@
+export type TeamClaims = { iss: string; owner_id: string; project_id?: string; environment?: string; user_id?: string; exp: number; [claim: string]: unknown };
+export function looksLikeJwt(token: string | null | undefined): boolean;
+export function verifyTeamToken(token: string, own: string, options?: { fetchImpl?: typeof fetch; now?: number }): Promise<TeamClaims | undefined>;
+export function isHubRequest(request: Request, own: () => Promise<string>, options?: { env?: Record<string, string | undefined>; fetchImpl?: typeof fetch; now?: number }): Promise<boolean>;

package/hub-oidc.mjs

@@ -0,0 +1,52 @@
+// Who a Vercel OIDC token says its caller is, for the hub and its bots to check each other with:
+// a bot calls the hub with its bots project's token, the hub calls a bot with its own (`x-hub-oidc-token`).
+// A token counts when the team's keys signed it (RS256, JWKS at `<iss>/.well-known/jwks.json`), it is within
+// its `nbf`/`exp`, and it comes from the checker's own team: both `iss` and `owner_id` equal those of the checker's
+// own token, so nothing is configured. The caller then checks which project (`project_id`) it may be.
+import { createRemoteJWKSet, customFetch, decodeJwt, errors, jwtVerify } from "jose";
+import { isBotToken } from "./bot-token.mjs";
+
+// One key set per issuer (and per fetch): jose shares a pending fetch between concurrent checks, keeps the keys an hour, and
+// refetches on an unknown `kid` no more than every 30 s, so a stream of made-up tokens is not a stream of fetches.
+const keySets = new WeakMap();
+// Not a bad token but the keys that could not be read (a timeout, a non-200 answer, an unreadable key set): an outage, so it throws.
+const KEY_FETCH_FAILED = new Set([errors.JWKSTimeout.code, errors.JWKSInvalid.code, errors.JOSEError.code]);
+function keysOf(iss, fetchImpl) {
+  if (!keySets.has(fetchImpl)) keySets.set(fetchImpl, new Map());
+  const sets = keySets.get(fetchImpl);
+  if (!sets.has(iss)) sets.set(iss, createRemoteJWKSet(new URL(`${iss}/.well-known/jwks.json`), { [customFetch]: fetchImpl, cooldownDuration: 30_000, cacheMaxAge: 60 * 60_000 }));
+  return sets.get(iss);
+}
+
+export const looksLikeJwt = (token) => /^[\w-]+\.[\w-]+\.[\w-]*$/.test(String(token ?? ""));
+
+/**
+ * The verified claims of `token`, or undefined for any token that is not the checker's team's.
+ * `own` is the checker's own token (its `iss` and `owner_id` say which team to trust).
+ */
+export async function verifyTeamToken(token, own, { fetchImpl = fetch, now = Date.now() } = {}) {
+  const { iss, owner_id: owner } = decodeJwt(own);
+  if (!iss || !owner) return undefined;
+  try {
+    const { payload } = await jwtVerify(token, keysOf(iss, fetchImpl), { issuer: iss, algorithms: ["RS256"], requiredClaims: ["exp"], currentDate: new Date(now) });
+    return payload.owner_id === owner ? payload : undefined;
+  } catch (error) {
+    if (error instanceof errors.JOSEError && !KEY_FETCH_FAILED.has(error.code)) return undefined;
+    throw error;
+  }
+}
+
+/**
+ * Whether `request` comes from the hub. A call carrying `x-hub-oidc-token` is decided by that token alone: it is of this team's,
+ * from the hub project (HUB_PROJECT_ID) and no development token (the hub's own function minted it). A call without one
+ * (a hub that does not send it yet) is the workspace's BOT_TOKEN. `own` is this deployment's own token.
+ */
+export async function isHubRequest(request, own, { env = process.env, ...options } = {}) {
+  const token = request.headers.get("x-hub-oidc-token");
+  if (!token) return isBotToken(request.headers.get("authorization"), env.BOT_TOKEN);
+  if (!env.HUB_PROJECT_ID) return false;
+  let claims;
+  try { claims = await verifyTeamToken(token, await own(), options); }
+  catch (error) { console.error(`[eve-hub] could not check the hub's token: ${error?.message}`); return false; }
+  return claims !== undefined && claims.project_id === env.HUB_PROJECT_ID && (claims.environment === "production" || claims.environment === "preview");
+}

package/mention-gate.mjs

@@ -21,7 +21,7 @@
 // HUB_MENTION_GATE_REASONING, HUB_MENTION_GATE_TIMEOUT_MS and
 // HUB_MENTION_GATE_URL (tests).
 import { codeRanges } from "./mention-tokens.mjs";
-import { registryHeaders } from "./registry-fetch.mjs";
+import { hubHeaders } from "./registry-fetch.mjs";
 import { createHash } from "node:crypto";
 
 export { codeRanges };
@@ -400,7 +400,7 @@ export function credentialCache(load, { ttlMs = 10 * 60e3, failMs = 60e3, now =
 const HUB_CALL_MS = 2000;
 
 async function hubCall(fetchImpl, url, body) {
-  const res = await fetchImpl(url, { method: "POST", headers: registryHeaders({ "content-type": "application/json" }), body: JSON.stringify(body), signal: AbortSignal.timeout(HUB_CALL_MS) });
+  const res = await fetchImpl(url, { method: "POST", headers: await hubHeaders({ "content-type": "application/json" }), body: JSON.stringify(body), signal: AbortSignal.timeout(HUB_CALL_MS) });
   if (!res.ok) throw new Error(`hub ${res.status}`);
   return res.json();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.6.67",
+  "version": "0.6.69",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",
@@ -26,6 +26,7 @@
     "./execution-context": "./execution-context.mjs",
     "./connections/*": "./connections/*.js",
     "./bot-token": "./bot-token.mjs",
+    "./hub-oidc": "./hub-oidc.mjs",
     "./prepare": "./prepare.mjs",
     "./vercel": "./vercel.mjs",
     "./world": "./world.mjs"
@@ -37,6 +38,7 @@
     "@vercel/oidc": "4.0.0"
   },
   "dependencies": {
-    "ai": "^7.0.137"
+    "ai": "^7.0.137",
+    "jose": "^6.2.3"
   }
 }

package/prepare.mjs

@@ -15,7 +15,7 @@
 //   has no workspace cwd);
 // - /hub/manifest: the roster and the commit sha the deployment was built
 //   from, for the hub to sync from: a custom channel on main, routed in
-//   vercel.mjs. Bearer BOT_TOKEN, as on each bot's eve channel (bot-token.mjs).
+//   vercel.mjs. From the hub, as on each bot's eve channel (hub-oidc.mjs).
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { DEPLOYED_KIT_FILES, KIT_FILES, MAIN_KIT_FILES } from "./stubs.mjs";
@@ -51,7 +51,8 @@ export default code({ worker: { model, reasoning } });
 
 const KIT_VERSION = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;
 const MANIFEST_CHANNEL = `import { defineChannel, GET } from "eve/channels";
-import { isBotToken } from "eve-hub/bot-token";
+import { getVercelOidcToken } from "@vercel/oidc";
+import { isHubRequest } from "eve-hub/hub-oidc";
 import { parseWorkspace } from "eve-hub/workspace";
 import workspace from "../../../../hub.manifest.json" with { type: "json" };
 
@@ -66,8 +67,8 @@ const manifest = { sha, kit: ${JSON.stringify(KIT_VERSION)}, agents, humans, sub
 
 export default defineChannel({
   routes: [
-    GET("/hub/manifest", (request) => {
-      if (!isBotToken(request.headers.get("authorization"))) return new Response("unauthorized", { status: 401 });
+    GET("/hub/manifest", async (request) => {
+      if (!(await isHubRequest(request, getVercelOidcToken))) return new Response("unauthorized", { status: 401 });
       if (!sha) return new Response("no commit sha: this deployment wasn't built from git", { status: 500 });
       return Response.json(manifest);
     }),

package/registry-fetch.mjs

@@ -31,10 +31,10 @@ export const sandboxRegistry = () => (process.env.HUB_SANDBOX_SERVICES === "none
 
 // Also used by the sandbox's node:http transport, which distinguishes
 // requests that never connected from ones whose result may have been lost.
-export function registryHeaders(init) {
+export function registryHeaders(init, env = process.env) {
   const headers = new Headers(init);
-  if (process.env.HUB_TOKEN && !headers.has("authorization")) headers.set("authorization", `Bearer ${process.env.HUB_TOKEN}`);
-  if (process.env.HUB_PROTECTION_BYPASS) headers.set("x-vercel-protection-bypass", process.env.HUB_PROTECTION_BYPASS);
+  if (env.HUB_TOKEN && !headers.has("authorization")) headers.set("authorization", `Bearer ${env.HUB_TOKEN}`);
+  if (env.HUB_PROTECTION_BYPASS) headers.set("x-vercel-protection-bypass", env.HUB_PROTECTION_BYPASS);
   return Object.fromEntries(headers);
 }
 
@@ -57,8 +57,19 @@ export function connectionErrorCode(error) {
 
 const DROPPED = new Set(["ECONNRESET", "EPIPE", "UND_ERR_SOCKET"]);
 
+// Every call a bot makes to the hub: a deployed bot is the caller its own project's token says (the hub checks it: api/auth.ts);
+// elsewhere HUB_TOKEN is the credential, if any. The one place a call's headers are made.
+export async function hubHeaders(init, env = process.env) {
+  const merged = new Headers(init);
+  if (env.VERCEL && !merged.has("authorization")) {
+    const { getVercelOidcToken } = await import("@vercel/oidc");
+    merged.set("authorization", `Bearer ${await getVercelOidcToken()}`);
+  }
+  return registryHeaders(merged, env);
+}
+
 export async function registryFetch(path, init = {}, { base = registryBase(), deadlineMs = num(process.env.ROSTER_REGISTRY_RETRY_MS, 30_000), attemptTimeoutMs, fetchImpl = fetch } = {}) {
-  init = { ...init, headers: registryHeaders(init.headers) };
+  init = { ...init, headers: await hubHeaders(init.headers) };
   const input = `${base}${path}`;
   const method = String(init.method ?? "GET").toUpperCase();
   const deadline = Date.now() + deadlineMs;