Repository navigation
Conversation
A program that launches `eve dev` on someone's behalf (a hub running bots on a laptop, say) already holds that person's Gateway sign-in, but had no way to hand it to eve: eve only looked at its own /login store, the Vercel CLI, and environment keys. With EVE_MODEL_CREDENTIAL_URL and EVE_MODEL_CREDENTIAL_TOKEN set, every Gateway model call, compaction included, GETs its credential from that URL with the token as a bearer, ahead of every other source. When Gateway refuses an oauth token, eve asks again with the refused token's SHA-256 in x-eve-model-rejected-token-sha256 so the server can refresh it. The broker fetch is shared with the existing loopback broker client. Signed-off-by: Rui Conti <ruiconti@gmail.com>
20cd15b to
24a4df5
Compare
Bundle + Package Summary:
|
| Area | Metric | Baseline | Current | Delta |
|---|---|---|---|---|
| Package | Packed tarball | 8.46 MB | 8.47 MB | +755 B |
| Package | Unpacked publish size | 31.03 MB | 31.03 MB | +2.3 kB |
| Package | Installed footprint | 79.17 MB | 79.17 MB | +2.3 kB |
| Package | Published files | 3802 | 3802 | 0 |
| Package | Installed files | 7813 | 7813 | 0 |
| Package | Installed package instances | 34 | 34 | 0 |
| Package | Distinct installed package names | 32 | 32 | 0 |
| Package | Installed dependency edges | 51 | 51 | 0 |
| Package | Installed optional peer edges | 9 | 9 | 0 |
| Runtime | Unique function payloads | 2 | 2 | 0 |
| Runtime | Total function bytes | 19.05 MB | 19.05 MB | +1.3 kB |
| Runtime | Public routes | 17 | 17 | 0 |
Changed function payloads vs rui/hosted-bots-git-on-5efe7424 (018311c) (2)
| Function | Status | Baseline | Current | Delta | Route changes |
|---|---|---|---|---|---|
functions/__server.func |
changed | 9.53 MB | 9.53 MB | +650 B |
none |
functions/.well-known/workflow/v1/flow.func |
changed | 9.53 MB | 9.53 MB | +650 B |
none |
eve init install
| Metric | Baseline | Current | Delta |
|---|---|---|---|
| Installed footprint | 117.46 MB | 117.46 MB | +2.3 kB |
| Installed packages | 97 | 97 | 0 |
| dependencies | 4 | 4 | 0 |
| devDependencies | 2 | 2 | 0 |
| Dependency package bytes | 49.22 MB | 49.22 MB | +2.3 kB |
| devDependency package bytes | 5.11 MB | 5.11 MB | 0 B ➖ |
Build Metadata
- Preset:
vercel - Nitro:
nitro@3.0.260903-beta - Output directory:
apps/fixtures/weather-agent/.vercel/output - Build metadata timestamp: 2026-10-17T21:04:10.691Z
- Route aliases: 17 public, 1 internal (18 total aliases)
- Vercel routes in config: 20
- Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small
Package Drill-Down
Package Details
- Package:
eve@0.69.0 - Package directory:
packages/eve - Tarball: 8.47 MB (
eve-0.69.0.tgz) - Unpacked payload: 31.03 MB across 3802 published files
- Installed footprint: 79.17 MB across 7813 installed files
- Installed root package: 31.03 MB
- Installed dependencies: 48.14 MB
- Installed package instances: 34
- Distinct installed package names: 32
- Installed dependency edges: 51
- Installed optional peer edges: 9
- Runtime dependencies: 2
- Peer dependencies: 7 (6 optional)
Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.
Heavy installed dependencies
eve: 31.03 MB (39.2%)@rolldown/binding-linux-x64-gnu: 19.81 MB (25.0%)ai: 8.24 MB (10.4%)zod: 6.15 MB (7.8%)undici: 3.58 MB (4.5%)
Publish payload breakdown
Published file size
🔴 dist/src/compiled/shadcn-registry/index.js [##############..........] 9.70 MB 31.3%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.29 MB 7.4%
🟠 dist/src/compiled/@ai-sdk/code-mode/index.js [#.......................] 1.03 MB 3.3%
🟡 dist/src/compiled/@vercel/blob/index.js [#.......................] 604.9 kB 1.9%
🟡 dist/src/compiled/_chunks/workflow/signal-exi... [#.......................] 514.5 kB 1.7%
🔴 Other published files [########################] 16.90 MB 54.4%
Installed footprint breakdown
Installed package size
🔴 eve [########################] 31.03 MB 39.2%
🔴 @rolldown/binding-linux-x64-gnu [###############.........] 19.81 MB 25.0%
🔴 ai [######..................] 8.24 MB 10.4%
🔴 zod [#####...................] 6.15 MB 7.8%
🟠 undici [###.....................] 3.58 MB 4.5%
🟠 nitro [#.......................] 1.89 MB 2.4%
🔴 Other installed packages [#######.................] 8.46 MB 10.7%
Runtime dependencies (2)
| Package | Range | Notes |
|---|---|---|
nitro |
3.0.260903-beta |
|
undici |
8.10.2 |
Peer dependencies (7)
| Package | Range | Notes |
|---|---|---|
@opentelemetry/api |
^1.0.0 |
optional peer |
ai |
catalog: |
|
braintrust |
^3.0.0 |
optional peer |
chat |
^4.41.0 |
optional peer |
dd-trace |
^6.13.0 |
optional peer |
just-bash |
^3.1.0 |
optional peer |
microsandbox |
^0.5.0 |
optional peer |
eve init install drill-down
eve init install details
- Command:
eve init my-agent - Package manager:
npm - Installed footprint: 117.46 MB across 9708 installed files
- Installed packages: 97 total (91 transitive-only)
- dependencies: 4 direct packages totaling 49.22 MB
- devDependencies: 2 direct packages totaling 5.11 MB
- Other transitive package files: 63.13 MB
Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.
Heavy installed dependencies
eve: 31.03 MB (26.4%)@typescript/typescript-linux-x64: 27.95 MB (23.8%)@rolldown/binding-linux-x64-gnu: 19.81 MB (16.9%)zod: 9.76 MB (8.3%)ai: 8.24 MB (7.0%)
Installed footprint breakdown
Installed package size
🔴 eve [########################] 31.03 MB 26.4%
🔴 @typescript/typescript-linux-x64 [######################..] 27.95 MB 23.8%
🔴 @rolldown/binding-linux-x64-gnu [###############.........] 19.81 MB 16.9%
🔴 zod [########................] 9.76 MB 8.3%
🔴 ai [######..................] 8.24 MB 7.0%
🟠 undici [###.....................] 3.58 MB 3.0%
🔴 Other installed packages [#############...........] 17.09 MB 14.6%
dependencies (4)
| Package | Range | Installed size | Share |
|---|---|---|---|
@vercel/connect |
2.2.0 |
188.7 kB | 0.2% |
ai |
^7.0.105 |
8.24 MB | 7.0% |
eve |
file:eve-0.69.0.tgz |
31.03 MB | 26.4% |
zod |
4.5.4 |
9.76 MB | 8.3% |
devDependencies (2)
| Package | Range | Installed size | Share |
|---|---|---|---|
@types/node |
24.x |
2.61 MB | 2.2% |
typescript |
7.0.2 |
2.50 MB | 2.1% |
Function Drill-Down
Payload Size Graph
Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func [########################] 9.53 MB 50.0%
🔴 functions/__server.func [########################] 9.53 MB 50.0%
Top Function Payloads
🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 9.53 MB
| Metric | Value |
|---|---|
| Public routes | /.well-known/workflow/v1/flow |
| Runtime | nodejs24.x |
| Handler | index.mjs |
| Payload | 9.53 MB |
| Function files | 9.53 MB across 111 files |
| Traced dependencies | 0 B |
| Signal | 🟠 Bundled file _chunks/vercel.web.mjs is 2.10 MB (22.0%) |
🟠 🔎 Dependency Analysis
📦 Bundled files:
Bundled file size
🟠 _chunks/vercel.web.mjs [############............] 2.10 MB 22.0%
🟠 _libs/undici.mjs [######..................] 1.01 MB 10.6%
🟡 _chunks/sandbox.mjs [#####...................] 811.4 kB 8.5%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 756.2 kB 7.9%
🟡 _chunks/signal-exit-DZKTacNU.mjs [###.....................] 616.2 kB 6.5%
🔴 Other bundled files [########################] 4.24 MB 44.5%
🧾 Vercel Config
{
"handler": "index.mjs",
"launcherType": "Nodejs",
"shouldAddHelpers": false,
"supportsResponseStreaming": true,
"runtime": "nodejs24.x",
"maxDuration": "max",
"experimentalTriggers": [
{
"type": "queue/v2beta",
"topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
"consumer": "default",
"retryAfterSeconds": 5,
"initialDelaySeconds": 0
}
],
"environment": {
"WORKFLOW_PRECONDITION_GUARD": "1"
}
}🟠 functions/__server.func • 16 public routes, 1 internal alias • 9.53 MB
| Metric | Value |
|---|---|
| Public routes | //.well-known/workflow/v1/webhook/[token]/eve/v1/callback/[token]/eve/v1/connections/[name]/callback/[attemptId]/[token]/eve/v1/connections/[name]/callback/[token]/eve/v1/health/eve/v1/info/eve/v1/session/eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream/eve/v1/session/[sessionId]/eve/v1/session/[sessionId]/cancel/eve/v1/session/[sessionId]/clear/eve/v1/session/[sessionId]/compact/eve/v1/session/[sessionId]/reset/eve/v1/session/[sessionId]/stream/eve/v1/task-input/[token] |
| Internal aliases | /__server |
| Runtime | nodejs24.x |
| Handler | index.mjs |
| Payload | 9.53 MB |
| Function files | 9.53 MB across 111 files |
| Traced dependencies | 0 B |
| Signal | 🟠 Bundled file _chunks/vercel.web.mjs is 2.10 MB (22.0%) |
🟠 🔎 Dependency Analysis
📦 Bundled files:
Bundled file size
🟠 _chunks/vercel.web.mjs [############............] 2.10 MB 22.0%
🟠 _libs/undici.mjs [######..................] 1.01 MB 10.6%
🟡 _chunks/sandbox.mjs [#####...................] 811.4 kB 8.5%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 756.2 kB 7.9%
🟡 _chunks/signal-exit-DZKTacNU.mjs [###.....................] 616.2 kB 6.5%
🔴 Other bundled files [########################] 4.24 MB 44.5%
🧾 Vercel Config
{
"handler": "index.mjs",
"launcherType": "Nodejs",
"shouldAddHelpers": false,
"supportsResponseStreaming": true,
"runtime": "nodejs24.x"
}Build Timing: e2e/fixtures/agent-tools-sandbox
This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.
Build mode: deployable Vercel build with sandbox template prewarm included.
- Build pipeline: 3.61 s -> 3.50 s (-113.0 ms) vs
rui/hosted-bots-git-on-5efe7424 (018311c). - Timing is informational: shared GitHub runners are too variable for a hard timing budget.
Detailed phase timings vs `rui/hosted-bots-git-on-5efe7424 (018311c)`
| Phase | Baseline | Current | Delta |
|---|---|---|---|
extension.check |
0.5 ms | 0.4 ms | -0.1 ms |
project.resolve |
0.3 ms | 0.3 ms | 0.0 ms |
workspace.create |
0.6 ms | 0.6 ms | 0.0 ms |
host.prepare |
736.1 ms | 730.1 ms | -6.0 ms |
vercel.service-prefix.resolve |
1.9 ms | 2.2 ms | +0.3 ms |
nitro.create |
596.9 ms | 615.1 ms | +18.2 ms |
sandbox.prewarm |
357.4 ms | 307.7 ms | -49.7 ms |
nitro.cache.prepare |
0.3 ms | 0.3 ms | 0.0 ms |
nitro.prepare |
0.8 ms | 0.8 ms | 0.0 ms |
nitro.public-assets |
0.8 ms | 0.8 ms | 0.0 ms |
nitro.prerender |
0.5 ms | 0.5 ms | 0.0 ms |
nitro.bundle |
1.78 s | 1.70 s | -72.7 ms |
nitro.cache.write |
0.4 ms | 0.4 ms | 0.0 ms |
vercel.workflow-function.materialize |
51.8 ms | 49.9 ms | -1.9 ms |
agent-summary.emit |
0.6 ms | 0.7 ms | +0.1 ms |
connect-manifest.emit |
0.3 ms | 0.3 ms | 0.0 ms |
nitro.close |
0.1 ms | 0.1 ms | 0.0 ms |
output.publish |
3.6 ms | 3.5 ms | -0.1 ms |
workspace.remove |
2.8 ms | 2.7 ms | -0.1 ms |
![roboeve[bot]](https://avatars.githubusercontent.com/b/10660?s=60&v=4){kind=small}
| throw new Error( | ||
| typeof value.error === "string" | ||
| ? value.error | ||
| : "The model connection is unavailable. Run /login to reconnect.", |
There was a problem hiding this comment.
The served { error } only reaches the user when there's no dev broker. In a normal eve dev, the worker asks the host broker (developmentModelBrokerAvailable() is true once EVE_DEV_CONTROL_URL and the workflow secret are set). The host calls resolveGatewayModelCredential() in development-broker-server.ts:38-41, and its catch at :54-58 swaps every failure for a 503 that says "The model connection is unavailable. Run /login to reconnect." The worker then shows that message here. So a launcher message like "the Vercel sign-in needs renewing in the app" turns into a /login hint, and /login can't fix it because the URL still outranks every other source.
The fails with the server's own error test calls the resolver directly, so it never goes through the broker. Either let the broker pass the served error through (or at least switch to a launcher-specific hint when EVE_MODEL_CREDENTIAL_URL is set), and add a test through handleDevelopmentModelCredentialRequest, or narrow the test name and docs to the direct path.
| const served = process.env[MODEL_CREDENTIAL_URL_ENV]; | ||
| if (served) { | ||
| const token = process.env[MODEL_CREDENTIAL_TOKEN_ENV]; | ||
| if (!token) | ||
| throw new Error(`${MODEL_CREDENTIAL_URL_ENV} is set without ${MODEL_CREDENTIAL_TOKEN_ENV}.`); | ||
| return fetchModelCredential(served, { authorization: `Bearer ${token}` }, rejectedToken); |
There was a problem hiding this comment.
This sends the bearer token to any URL and accepts an OAuth token back, with no check on scheme or host. http://hub.example/... would send both the launcher token and the user's Gateway OAuth token over the network in plaintext. The sibling broker client already rejects anything other than loopback http: with no userinfo (development-broker-client.ts:29-31). Can we require https:, or http: only on a loopback host (isLoopbackHostname), and reject url.username/url.password, so a misconfigured launcher fails loudly instead of leaking?
|
|
||
| eve saves API keys and eve-owned OAuth refresh credentials in the OS secret store through just-secrets. It saves the last successful login as the machine default and records the project's connection and team separately as nonsecret metadata in `.eve/provider.json`. Newly entered keys are never written into project files. A key explicitly selected through `/login` takes precedence over another key for that provider in your shell; a project connected through environment credentials continues to use its environment. Vercel CLI retains ownership of its credentials and refresh tokens. | ||
|
|
||
| A program that starts `eve dev` and already holds a Gateway credential can serve it instead. Set `EVE_MODEL_CREDENTIAL_URL` and `EVE_MODEL_CREDENTIAL_TOKEN` in the environment of `eve dev`. eve then sends a `GET` to that URL with `Authorization: Bearer <token>` for every Gateway model call, including compaction, ahead of every other connection. The response is `{ "kind": "oauth", "token": "...", "teamId": "..." }` (`kind` may also be `api-key` or `oidc`; `teamId` is optional), or `{ "error": "..." }` with a failure status. When Gateway refuses an `oauth` token, eve asks again with `x-eve-model-rejected-token-sha256` set to the refused token's SHA-256 hex digest, so the server can return a fresh one. |
There was a problem hiding this comment.
"for every Gateway model call, including compaction" claims more than the code does. The override lives in localGatewayModel, and only string model IDs reach it (runtime/agent/resolve-model.ts:74). An authored model instance such as gateway("..."), or a dynamic selection that returns a model object, is returned as-is (resolve-model.ts:70-71, :113) and never fetches from this URL. The same goes for a compaction.model instance. Suggest "for every model call that names a Gateway model by its string ID, including compaction".
| beforeEach(() => { | ||
| vi.stubGlobal("fetch", fetch); | ||
| vi.stubEnv("EVE_DEV", "1"); | ||
| vi.stubEnv("EVE_MODEL_CONNECTION", ""); | ||
| vi.stubEnv("AI_GATEWAY_API_KEY", "machine-key"); | ||
| vi.stubEnv("EVE_MODEL_CREDENTIAL_URL", "https://hub.example/api/model-credential"); | ||
| vi.stubEnv("EVE_MODEL_CREDENTIAL_TOKEN", "bot-token"); |
There was a problem hiding this comment.
These tests depend on the environment they run in: EVE_DEV_CONTROL_URL and EVE_DEV_WORKFLOW_TRANSPORT_SECRET aren't stubbed. If both are inherited (say, the suite runs from a shell inside eve dev), developmentModelBrokerAvailable() returns true and the final localGatewayModel(...)).toBeUndefined() fails even with the served URL blank. Stub both to "" here.
eve dev's credential relay replaced every failure with "Run /login to reconnect", so a turn never saw the served URL's own message (say, that the sign-in needs renewing in the app that launched eve), and got advice that doesn't apply when the launcher holds the sign-in. The relay now passes that message through; other resolver errors stay generic. Tested on the path a dev turn takes, worker model to relay to served URL: the URL's error reaches the turn, and a token Gateway refused is refreshed by asking the URL again with the refused token's hash. Signed-off-by: Rui Conti <ruiconti@gmail.com>
This branch had an error being deployed
1 participant
Package build only; not for merge.
#4997 (eve takes its dev Gateway credential from a URL its launcher serves) cherry-picked onto
018311cf, the head of #4995, the eve build the hosted hub's bots pin to. Bots that the hub runs on a laptop need that change on the eve they run, which is this one plus #4997.Close with #4995, once the bots move to an eve release that has both.