From a5cc57980b4b7e9cfe4a5a7837e8856f56b21f4f Mon Sep 17 00:00:00 2001 From: ycarmel Date: Tue, 25 Aug 2026 11:07:56 +0300 Subject: [PATCH 1/3] feat(eve-extension): accept an async token provider in `token` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The extension's config schema narrowed `token` to `z.string()` while the SDK underneath (`EveGithubToolsOptions.token`) already accepts `GithubTokenInput = string | (() => Promise)`. Agents that authenticate as a GitHub App mint short-lived installation tokens (≤1h), so a string forces them off the extension and onto the `@github-tools/sdk/eve-runtime` subpath — which, since eve 0.43 made dynamic-tool callbacks durable-by-transform, no longer produces replayable tools from library code. Widening the schema (same `z.custom` shape `connector` already uses) lets those agents mount the extension and pass their token minter directly; `buildSessionOptions` forwards it unchanged. --- .changeset/eve-extension-token-provider.md | 5 +++++ packages/github-tools-eve-extension/README.md | 2 +- .../extension/extension.ts | 14 +++++++++++--- 3 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 .changeset/eve-extension-token-provider.md diff --git a/.changeset/eve-extension-token-provider.md b/.changeset/eve-extension-token-provider.md new file mode 100644 index 0000000..9258f68 --- /dev/null +++ b/.changeset/eve-extension-token-provider.md @@ -0,0 +1,5 @@ +--- +'@github-tools/eve-extension': minor +--- + +Accept an async token provider in the extension's `token` config (`string | (() => Promise)`), matching the SDK's `GithubTokenInput`. Agents authenticating with a GitHub App can pass their installation-token minter directly instead of falling back to the `@github-tools/sdk/eve-runtime` subpath. diff --git a/packages/github-tools-eve-extension/README.md b/packages/github-tools-eve-extension/README.md index dd3f829..bd21b21 100644 --- a/packages/github-tools-eve-extension/README.md +++ b/packages/github-tools-eve-extension/README.md @@ -88,7 +88,7 @@ extension/ | Field | Type | Notes | |---|---|---| -| `token` | `string?` | Falls back to `GITHUB_TOKEN` when omitted and `connector` is not set | +| `token` | `string \| (() => Promise)` (optional) | PAT string, or an async provider for rotating tokens (e.g. a GitHub App installation token) — the same `GithubTokenInput` the SDK accepts; falls back to `GITHUB_TOKEN` when omitted and `connector` is not set | | `connector` | `string \| (() => string \| Promise)` (optional) | Vercel Connect connector name, or a resolver to pick one dynamically (e.g. per environment/tenant); takes priority over `token` | | `connect` | `record?` | Passed through to `getToken` when `connector` is set | | `preset` | preset name or array | `code-review`, `issue-triage`, `ci-ops`, `repo-explorer`, `security-audit`, `release-manager`, `discussion-moderator`, `notification-inbox`, `pr-author`, `maintainer` | diff --git a/packages/github-tools-eve-extension/extension/extension.ts b/packages/github-tools-eve-extension/extension/extension.ts index ac173c4..3ab0b47 100644 --- a/packages/github-tools-eve-extension/extension/extension.ts +++ b/packages/github-tools-eve-extension/extension/extension.ts @@ -1,3 +1,4 @@ +import type { GithubTokenInput } from '@github-tools/sdk' import type { GithubConnectorInput } from '@github-tools/sdk/connect' import { GITHUB_TOOL_NAMES, @@ -32,8 +33,13 @@ export interface GithubExtensionContext { * Declared as an interface (not only a Zod schema) so IDE hovers show JSDoc. */ export interface GithubExtensionConfig { - /** GitHub PAT. Falls back to `GITHUB_TOKEN` when omitted and `connector` is not set. */ - token?: string + /** + * GitHub token: a PAT string, or a `() => Promise` provider for + * tokens that rotate (a GitHub App installation token, a vault lease). + * Same input the SDK accepts. Falls back to `GITHUB_TOKEN` when omitted + * and `connector` is not set. + */ + token?: GithubTokenInput /** * Vercel Connect connector name (e.g. `github/my-connector`), or a * `() => string | Promise` resolver for picking one dynamically @@ -91,7 +97,9 @@ const commitIdentitySchema = z.object({ }) const configSchema = z.object({ - token: z.string().optional(), + token: z.custom( + value => typeof value === 'string' || typeof value === 'function', + ).optional(), connector: z.custom( value => typeof value === 'string' || typeof value === 'function', ).optional(), From f81d73336db6807defed087593727eca1afbe590 Mon Sep 17 00:00:00 2001 From: Hugo Richard Date: Tue, 25 Aug 2026 13:37:23 +0100 Subject: [PATCH 2/3] docs(eve): document async token provider and import the type from eve-runtime --- .changeset/eve-runtime-token-input.md | 5 +++++ .../content/docs/2.frameworks/1.eve-extension.md | 13 ++++++++++++- apps/docs/content/docs/4.guide/4.tokens-and-auth.md | 2 ++ .../github-tools-agents/references/eve-extension.md | 2 ++ .../extension/extension.ts | 2 +- packages/github-tools/src/eve-runtime.ts | 1 + 6 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 .changeset/eve-runtime-token-input.md diff --git a/.changeset/eve-runtime-token-input.md b/.changeset/eve-runtime-token-input.md new file mode 100644 index 0000000..2e9c840 --- /dev/null +++ b/.changeset/eve-runtime-token-input.md @@ -0,0 +1,5 @@ +--- +'@github-tools/sdk': patch +--- + +Re-export `GithubTokenInput` from `@github-tools/sdk/eve-runtime`. diff --git a/apps/docs/content/docs/2.frameworks/1.eve-extension.md b/apps/docs/content/docs/2.frameworks/1.eve-extension.md index aa65caa..e22936a 100644 --- a/apps/docs/content/docs/2.frameworks/1.eve-extension.md +++ b/apps/docs/content/docs/2.frameworks/1.eve-extension.md @@ -178,7 +178,7 @@ export default githubExtension({ | Field | Type | Notes | |---|---|---| -| `token` | `string?` | Falls back to `GITHUB_TOKEN` when omitted and `connector` is not set | +| `token` | `string \| (() => Promise)` | PAT string, or an async provider for rotating tokens (e.g. a GitHub App installation token) — the same `GithubTokenInput` the SDK accepts; falls back to `GITHUB_TOKEN` when omitted and `connector` is not set | | `connector` | `string \| (() => string \| Promise)` | Vercel Connect connector name, or a resolver to pick one dynamically (e.g. per environment/tenant); takes priority over `token` | | `connect` | `record?` | Passed through to `getToken` when `connector` is set | | `preset` | preset name or array | `code-review`, `issue-triage`, `ci-ops`, `repo-explorer`, `security-audit`, `release-manager`, `discussion-moderator`, `notification-inbox`, `pr-author`, `maintainer`, see [Presets](/guide/presets) | @@ -189,6 +189,17 @@ export default githubExtension({ | `overrides` | `record` | Per-tool `description` / `approval` / `toModelOutput` / `outputSchema` | | `author` / `committer` / `coAuthors` | commit identity | Attribution for commit-creating tools, see [Commit Attribution](/guide/commit-attribution) | +The provider runs on every tool call, so short-lived tokens stay fresh: + +```ts [agent/extensions/github.ts] +import githubExtension from '@github-tools/eve-extension' + +export default githubExtension({ + token: () => mintInstallationToken(), + preset: 'issue-triage', +}) +``` + ## Durable multi-turn sessions The extension registers each tool with an **authored inline** `execute` and `toModelOutput` that only close over a serializable tool `name`, then rebuilds session options from the extension config on every call via `@github-tools/sdk/eve-runtime`. Tools resolve on `step.started` so registration stays fresh across durable steps. That pattern survives multi-turn eve Workflow replay (see [#51](https://github.com/vercel-labs/github-tools/issues/51), [#99](https://github.com/vercel-labs/github-tools/issues/99)). Prefer this mount over the deprecated [`createGithubTools`](/deprecated/eve) / [`connectGithubTools`](/deprecated/eve) paths for Slack / multi-turn durable agents — those register tools from inside `node_modules` and are skipped on replay. Author `overrides.toModelOutput` inline in the agent; a function imported from a library will not get a durable descriptor. diff --git a/apps/docs/content/docs/4.guide/4.tokens-and-auth.md b/apps/docs/content/docs/4.guide/4.tokens-and-auth.md index 5c7a31d..cfc21bb 100644 --- a/apps/docs/content/docs/4.guide/4.tokens-and-auth.md +++ b/apps/docs/content/docs/4.guide/4.tokens-and-auth.md @@ -143,6 +143,8 @@ import githubExtension from '@github-tools/eve-extension' export default githubExtension({ connector: 'github/my-connector', preset: 'maintainer' }) ``` +For a GitHub App you manage yourself, pass `token: () => mintInstallationToken()` instead — same `GithubTokenInput` as the SDK. + (For the deprecated direct import, [`connectGithubTools` from `@github-tools/sdk/connect/eve`](/deprecated/eve#vercel-connect) still works the same way.) :: diff --git a/apps/docs/skills/github-tools-agents/references/eve-extension.md b/apps/docs/skills/github-tools-agents/references/eve-extension.md index 9d6eff7..f322bf2 100644 --- a/apps/docs/skills/github-tools-agents/references/eve-extension.md +++ b/apps/docs/skills/github-tools-agents/references/eve-extension.md @@ -38,6 +38,8 @@ Tools are exposed to the model as `__`: `agent/extensions/g `token`, `connector`, `connect`, `preset`, `include`, `exclude`, `requireApproval`, `overrides`, `author`/`committer`/`coAuthors`, see `/frameworks/eve-extension#config-schema`. +`token` is `string | (() => Promise)` (`GithubTokenInput`). Pass an async provider for rotating GitHub App installation tokens. Falls back to `GITHUB_TOKEN` when omitted; `connector` takes priority. + `include` **adds** to `preset` (union). Use it standalone for an exact set, or on top of a preset to add a missing tool. `exclude` **removes** tool names from the resolved set, use it to drop a couple of tools from a larger preset: ```ts diff --git a/packages/github-tools-eve-extension/extension/extension.ts b/packages/github-tools-eve-extension/extension/extension.ts index 3ab0b47..821e336 100644 --- a/packages/github-tools-eve-extension/extension/extension.ts +++ b/packages/github-tools-eve-extension/extension/extension.ts @@ -1,4 +1,3 @@ -import type { GithubTokenInput } from '@github-tools/sdk' import type { GithubConnectorInput } from '@github-tools/sdk/connect' import { GITHUB_TOOL_NAMES, @@ -7,6 +6,7 @@ import { type EveToolOverrides, type GithubToolName, type GithubToolPreset, + type GithubTokenInput, } from '@github-tools/sdk/eve-runtime' import { defineExtension } from 'eve/extension' import { z } from 'zod' diff --git a/packages/github-tools/src/eve-runtime.ts b/packages/github-tools/src/eve-runtime.ts index 59d5f7f..8a1b764 100644 --- a/packages/github-tools/src/eve-runtime.ts +++ b/packages/github-tools/src/eve-runtime.ts @@ -28,6 +28,7 @@ export type { GithubToolName } from './core/tool-names' export type { GithubWriteToolName } from './core/write-tools' export type { AllGithubTools, GithubToolsForPreset, PickGithubTools } from './core/tool-types' export type { CommitIdentity } from './types' +export type { GithubTokenInput } from './core/token' export { PRESET_TOOLS } from './core/presets' export { GITHUB_TOOL_NAMES } from './core/tool-names' export { GITHUB_WRITE_TOOLS } from './core/write-tools' From e6e7e3a6f56774122c3d8b34da2d1f2397d0c222 Mon Sep 17 00:00:00 2001 From: Hugo Richard Date: Tue, 25 Aug 2026 13:43:20 +0100 Subject: [PATCH 3/3] fix(eve): keep the token type import off the SDK entry surface Re-exporting GithubTokenInput from eve-runtime pulled chat and the PR review example into --affected, where they already fail on unrelated ai version skew. --- .changeset/eve-runtime-token-input.md | 5 ----- packages/github-tools-eve-extension/extension/extension.ts | 2 +- packages/github-tools/src/eve-runtime.ts | 1 - 3 files changed, 1 insertion(+), 7 deletions(-) delete mode 100644 .changeset/eve-runtime-token-input.md diff --git a/.changeset/eve-runtime-token-input.md b/.changeset/eve-runtime-token-input.md deleted file mode 100644 index 2e9c840..0000000 --- a/.changeset/eve-runtime-token-input.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@github-tools/sdk': patch ---- - -Re-export `GithubTokenInput` from `@github-tools/sdk/eve-runtime`. diff --git a/packages/github-tools-eve-extension/extension/extension.ts b/packages/github-tools-eve-extension/extension/extension.ts index 821e336..3ab0b47 100644 --- a/packages/github-tools-eve-extension/extension/extension.ts +++ b/packages/github-tools-eve-extension/extension/extension.ts @@ -1,3 +1,4 @@ +import type { GithubTokenInput } from '@github-tools/sdk' import type { GithubConnectorInput } from '@github-tools/sdk/connect' import { GITHUB_TOOL_NAMES, @@ -6,7 +7,6 @@ import { type EveToolOverrides, type GithubToolName, type GithubToolPreset, - type GithubTokenInput, } from '@github-tools/sdk/eve-runtime' import { defineExtension } from 'eve/extension' import { z } from 'zod' diff --git a/packages/github-tools/src/eve-runtime.ts b/packages/github-tools/src/eve-runtime.ts index 8a1b764..59d5f7f 100644 --- a/packages/github-tools/src/eve-runtime.ts +++ b/packages/github-tools/src/eve-runtime.ts @@ -28,7 +28,6 @@ export type { GithubToolName } from './core/tool-names' export type { GithubWriteToolName } from './core/write-tools' export type { AllGithubTools, GithubToolsForPreset, PickGithubTools } from './core/tool-types' export type { CommitIdentity } from './types' -export type { GithubTokenInput } from './core/token' export { PRESET_TOOLS } from './core/presets' export { GITHUB_TOOL_NAMES } from './core/tool-names' export { GITHUB_WRITE_TOOLS } from './core/write-tools'