eve-hub 0.6.8 → 0.6.9

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # eve-hub
 
+## 0.6.9
+
+### Patch Changes
+
+- A hosted deployment reaches GitHub one way for every bot: `gh` and `git` in bash through the sandbox firewall token, with eve's git extension mounted on each bot. The build no longer wires in the Vercel Kit connection (`GITHUB_PATH` in `github-path.mjs` is the one switch; `"kit"` brings it back).
+
 ## 0.6.8
 
 ### Patch Changes

package/github-path.d.mts

@@ -0,0 +1 @@
+export const GITHUB_PATH: "gh" | "kit";

package/github-path.mjs

@@ -0,0 +1,8 @@
+// How every deployed bot reaches GitHub, decided here and nowhere else:
+//   "gh"  `gh` and `git` in bash (the firewall token and eve's git extension, both
+//         always on, prepare.mjs); no Vercel Kit connection, so no bot can pick
+//         Kit for GitHub, and onboarding sets up no Kit connector.
+//   "kit" the same, plus the Kit connection on every bot (prepare.mjs, and the
+//         peer dependencies it needs in hosted-hub/scripts/stage-workspace.mjs) and
+//         the Kit connector on each new bots project (hosted-hub/src/onboard/provision-steps.ts).
+export const GITHUB_PATH = "gh";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.6.8",
+  "version": "0.6.9",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",

package/prepare.mjs

@@ -9,7 +9,8 @@
 //   pays for model calls) with only the kit stubs that run off the hub's
 //   machine (DEPLOYED_KIT_FILES);
 // - the kit extension, host-only workers and kit stubs are dropped, the hub's
-//   workflow world and the Vercel Kit connection are wired in, and the
+//   workflow world is wired in (and the Vercel Kit connection, if GITHUB_PATH
+//   says "kit"), every bot gets eve's git extension, and the
 //   workspace's memory is embedded in the bots' memory providers (a function
 //   has no workspace cwd);
 // - /hub/manifest: the roster and the commit sha the deployment was built
@@ -17,6 +18,7 @@
 //   vercel.mjs. Bearer BOT_TOKEN, as on each bot's eve channel (bot-token.mjs).
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
+import { GITHUB_PATH } from "./github-path.mjs";
 import { KIT_FILES, MAIN_KIT_FILES } from "./stubs.mjs";
 import { deploymentFacts, hostedContext } from "./execution-context.mjs";
 import { botDomains, domainFolders, readBotMemory, readMemory, validateMemory } from "./memory.mjs";
@@ -84,11 +86,14 @@ export const VERCEL_SANDBOX = vercelSandbox("");
 // The builder's sandbox also carries eve-code's tooling (agents/builder/agent/extensions/code/).
 export const CODE_SANDBOX = vercelSandbox("\n  await installCodeTooling(sandbox);");
 
+// eve's git extension, for every bot: it points the bot at `gh` and `git` in
+// bash, whose GitHub credential is the sandbox firewall's (VERCEL_SANDBOX above).
+// With no `github` option it brokers no credential. It only guides: its `pr`
+// skill (commit, push, draft PR) loads when a bot publishes.
+export const gitExtensionFiles = () => ({ "extensions/git/extension.ts": `import git from "eve/extensions/git";\n\nexport default git({});\n` });
+
 // Bots that edit code: eve-code (apply_patch, grep, the review skills and its
-// read-only worker) plus eve's git extension, both with no `github` option. The
-// git extension then points the bot at `gh` and `git` in bash, whose GitHub
-// credential is the sandbox firewall's (VERCEL_SANDBOX above), and its `pr` skill
-// is the plain commit, push and draft-PR one. The worker runs on the roster's
+// read-only worker), with no `github` option. The worker runs on the roster's
 // subagent cap like every other subagent, not on eve's built-in default.
 export const CODE_BOTS = ["builder"];
 export const codeExtensionFiles = (bot) => ({
@@ -102,7 +107,6 @@ const { model, reasoning } = resolveSubagent(agents, subagentCap, ${JSON.stringi
 
 export default code({ worker: { model, reasoning } });
 `,
-  "extensions/git/extension.ts": `import git from "eve/extensions/git";\n\nexport default git({});\n`,
 });
 
 const KIT_VERSION = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;
@@ -188,11 +192,9 @@ export function prepareDeployment(dir) {
     const name = basename(dirname(bot));
     const code = CODE_BOTS.includes(name);
     writeFileSync(join(bot, "sandbox.ts"), code ? CODE_SANDBOX : VERCEL_SANDBOX);
-    if (code) {
-      for (const [stub, content] of Object.entries(codeExtensionFiles(name))) {
-        mkdirSync(dirname(join(bot, stub)), { recursive: true });
-        writeFileSync(join(bot, stub), content);
-      }
+    for (const [stub, content] of Object.entries({ ...gitExtensionFiles(), ...(code ? codeExtensionFiles(name) : {}) })) {
+      mkdirSync(dirname(join(bot, stub)), { recursive: true });
+      writeFileSync(join(bot, stub), content);
     }
   }
   const roster = resolved.agents;
@@ -207,10 +209,12 @@ export function prepareDeployment(dir) {
     }
     const agentFile = join(bot, "agent.ts");
     writeFileSync(agentFile, injectWorkflowWorld(readFileSync(agentFile, "utf8"), agentFile));
-    // Hosted bots reach the human's connected services (GitHub) through Vercel Kit,
-    // with the project's KIT_CONNECTOR; there is no host credential to fall back on.
-    mkdirSync(join(bot, "connections"), { recursive: true });
-    writeFileSync(join(bot, "connections", "vercel-kit.ts"), 'export { default } from "eve-hub/connections/vercel-kit";\n');
+    // GITHUB_PATH "kit": the human's connected services (GitHub) come through Vercel Kit,
+    // with the project's KIT_CONNECTOR. "gh" deploys no Kit connection.
+    if (GITHUB_PATH === "kit") {
+      mkdirSync(join(bot, "connections"), { recursive: true });
+      writeFileSync(join(bot, "connections", "vercel-kit.ts"), 'export { default } from "eve-hub/connections/vercel-kit";\n');
+    }
     mkdirSync(join(bot, "memory"), { recursive: true });
     const botDir = join(dir, "agents", name);
     writeFileSync(join(bot, "memory", "workspace.ts"), memoryProvider("workspace", readMemory(dir, { folders: domainFolders(botDomains(dir, botDir)) }).entries, "Standing decision", "workspace"));