Prevent connection principal cache key collisions by vercel-gh-bot-2[bot] · Pull Request #2693 · vercel/eve

vercel-gh-bot-2 · 2026-08-28T03:25:54Z

Distinct connection principals no longer share a token-cache key when an issuer or ID contains : or %.

Why

principalKey() concatenated raw segments with :, so { issuer: "slack", id: "U123" } and { id: "slack:U123" } both rendered as user:slack:U123. The cache is step-local to one AuthKey today, so code inspection found no current credential-sharing path. However, the collision broke the cache's documented identity invariant and would make a broader cache lifetime unsafe.

Approach

Because raw delimiters erase segment boundaries, percent-encoding % before : within each segment should make the mapping injective. Values without either reserved character retain their current key shape, and app principals remain app.

The regression coverage includes issuerless and issued principals, separators on either side of the boundary, literal encoded separators, and the forwarded-principal path.

Fixes #2692

Validation

pnpm --filter eve exec vitest run --config vitest.unit.config.ts src/runtime/connections/principal.test.ts
pnpm --filter eve exec vitest run --config vitest.integration.config.ts src/public/channels/eve-forwarded-principal.integration.test.ts
pnpm --filter eve typecheck
pnpm lint
pnpm guard:invariants
pnpm changeset status

pnpm --filter eve test:unit passed 7,283 tests and skipped one. Two unrelated tests exceeded their 5-second timeout, then passed in isolation. The workspace-wide pnpm typecheck reached an external AI Gateway metadata fetch that returned 502 Bad Gateway; the eve package typecheck passed.

Requested by: JelyFishhhhhh

Co-authored-by: JelyFishhhhhh <71597580+JelyFishhhhhh@users.noreply.github.com>

vercel · 2026-08-28T03:26:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview, v0	Aug 28, 2026 3:27am
eve-docs-4759	Ready	Preview, v0	Aug 28, 2026 3:27am
eve-pkg	Ready	Preview, v0	Aug 28, 2026 3:27am

github-actions · 2026-08-28T03:30:02Z

Bundle + Package Summary: `apps/fixtures/weather-agent`

Key takeaways

No notable deltas vs main (c4f9d32).

Delta vs `main (c4f9d32)`

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	8.58 MB	8.58 MB	+1.6 kB ⚠️
Package	Unpacked publish size	32.48 MB	32.48 MB	+298 B ⚠️
Package	Installed footprint	76.21 MB	76.21 MB	+298 B ⚠️
Package	Published files	3620	3620	0
Package	Installed files	7344	7344	0
Package	Installed package instances	35	35	0
Package	Distinct installed package names	34	34	0
Package	Installed dependency edges	53	53	0
Package	Installed optional peer edges	47	47	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	18.91 MB	18.91 MB	+264 B ⚠️
Runtime	Public routes	16	16	0

Changed function payloads vs main (c4f9d32) (2)

Function	Status	Baseline	Current	Delta	Route changes
`functions/__server.func`	changed	9.45 MB	9.45 MB	+132 B ⚠️	none
`functions/.well-known/workflow/v1/flow.func`	changed	9.45 MB	9.46 MB	+132 B ⚠️	none

`eve init` install

Metric	Baseline	Current	Delta
Installed footprint	114.64 MB	114.64 MB	+298 B ⚠️
Installed packages	120	120	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	47.16 MB	47.16 MB	+298 B ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

Build Metadata

Preset: vercel
Nitro: nitro@3.0.260610-beta
Output directory: apps/fixtures/weather-agent/.vercel/output
Build metadata timestamp: 2026-08-28T03:29:05.167Z
Route aliases: 16 public, 1 internal (17 total aliases)
Vercel routes in config: 19
Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

Package: eve@0.47.2
Package directory: packages/eve
Tarball: 8.58 MB (eve-0.47.2.tgz)
Unpacked payload: 32.48 MB across 3620 published files
Installed footprint: 76.21 MB across 7344 installed files
Installed root package: 31.12 MB
Installed dependencies: 45.08 MB
Installed package instances: 35
Distinct installed package names: 34
Installed dependency edges: 53
Installed optional peer edges: 47
Runtime dependencies: 2
Peer dependencies: 5 (4 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

eve: 31.12 MB (40.8%)
@rolldown/binding-linux-x64-gnu: 19.33 MB (25.4%)
ai: 6.85 MB (9.0%)
zod: 5.07 MB (6.6%)
undici: 3.50 MB (4.6%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [#############...........] 9.76 MB 30.1%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.44 MB 7.5%
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [##......................] 1.51 MB 4.6%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 901.8 kB 2.8%
🟡 dist/src/compiled/_chunks/workflow/undici-Dzn... [#.......................] 512.7 kB 1.6%
🔴 Other published files                            [########################] 17.35 MB 53.4%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 31.12 MB 40.8%
🔴 @rolldown/binding-linux-x64-gnu [###############.........] 19.33 MB 25.4%
🔴 ai                              [#####...................] 6.85 MB 9.0%
🔴 zod                             [####....................] 5.07 MB 6.6%
🟠 undici                          [###.....................] 3.50 MB 4.6%
🟠 nitro                           [##......................] 2.41 MB 3.2%
🔴 Other installed packages        [######..................] 7.93 MB 10.4%

Runtime dependencies (2)

Package	Range	Notes
`nitro`	`3.0.260610-beta`
`undici`	`8.9.0`

Peer dependencies (5)

Package	Range	Notes
`@opentelemetry/api`	`^1.0.0`	optional peer
`ai`	`catalog:`
`braintrust`	`^3.0.0`	optional peer
`just-bash`	`^3.1.0`	optional peer
`microsandbox`	`^0.5.0`	optional peer

eve init install drill-down

`eve init` install details

Command: eve init my-agent
Package manager: npm
Installed footprint: 114.64 MB across 9240 installed files
Installed packages: 120 total (114 transitive-only)
dependencies: 4 direct packages totaling 47.16 MB
devDependencies: 2 direct packages totaling 5.04 MB
Other transitive package files: 62.44 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

eve: 31.12 MB (27.1%)
@typescript/typescript-linux-x64: 27.95 MB (24.4%)
@rolldown/binding-linux-x64-gnu: 19.33 MB (16.9%)
zod: 9.02 MB (7.9%)
ai: 6.85 MB (6.0%)

Installed footprint breakdown

Installed package size
🔴 eve                              [########################] 31.12 MB 27.1%
🔴 @typescript/typescript-linux-x64 [######################..] 27.95 MB 24.4%
🔴 @rolldown/binding-linux-x64-gnu  [###############.........] 19.33 MB 16.9%
🔴 zod                              [#######.................] 9.02 MB 7.9%
🔴 ai                               [#####...................] 6.85 MB 6.0%
🟠 undici                           [###.....................] 3.50 MB 3.1%
🔴 Other installed packages         [#############...........] 16.87 MB 14.7%

dependencies (4)

Package	Range	Installed size	Share
`@vercel/connect`	`1.0.0`	167.9 kB	0.1%
`ai`	`^7.0.58`	6.85 MB	6.0%
`eve`	`file:eve-0.47.2.tgz`	31.12 MB	27.1%
`zod`	`4.4.3`	9.02 MB	7.9%

devDependencies (2)

Package	Range	Installed size	Share
`@types/node`	`24.x`	2.54 MB	2.2%
`typescript`	`7.0.2`	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 9.46 MB 50.0%
🔴 functions/__server.func                         [########################] 9.45 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 9.46 MB

Metric	Value
Public routes	`/.well-known/workflow/v1/flow`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	9.46 MB
Function files	9.46 MB across 111 files
Traced dependencies	0 B
Signal	🟠 Bundled file `index.mjs` is 1.93 MB (20.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [##########..............] 1.93 MB 20.4%
🟡 _libs/undici.mjs                [#####...................] 980.5 kB 10.4%
🟡 _chunks/decode_jwt-Col8JOnf.mjs [####....................] 702.6 kB 7.4%
🟡 _chunks/frames-Dl2Hcma4.mjs     [####....................] 678.7 kB 7.2%
🟡 _chunks/chatgpt-model.mjs       [####....................] 666.2 kB 7.0%
🔴 Other bundled files             [########################] 4.50 MB 47.6%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

🟠 functions/__server.func • 15 public routes, 1 internal alias • 9.45 MB

Metric	Value
Public routes	`/` `/eve/v1/callback/[token]` `/eve/v1/connections/[name]/callback/[attemptId]/[token]` `/eve/v1/connections/[name]/callback/[token]` `/eve/v1/health` `/eve/v1/info` `/eve/v1/session` `/eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream` `/eve/v1/session/[sessionId]` `/eve/v1/session/[sessionId]/cancel` `/eve/v1/session/[sessionId]/clear` `/eve/v1/session/[sessionId]/compact` `/eve/v1/session/[sessionId]/reset` `/eve/v1/session/[sessionId]/stream` `/eve/v1/task-input/[token]`
Internal aliases	`/__server`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	9.45 MB
Function files	9.45 MB across 111 files
Traced dependencies	0 B
Signal	🟠 Bundled file `index.mjs` is 1.93 MB (20.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                       [##########..............] 1.93 MB 20.4%
🟡 _libs/undici.mjs                [#####...................] 980.5 kB 10.4%
🟡 _chunks/decode_jwt-Col8JOnf.mjs [####....................] 702.6 kB 7.4%
🟡 _chunks/frames-Dl2Hcma4.mjs     [####....................] 678.7 kB 7.2%
🟡 _chunks/chatgpt-model.mjs       [####....................] 666.2 kB 7.0%
🔴 Other bundled files             [########################] 4.50 MB 47.6%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: `e2e/fixtures/agent-tools-sandbox`

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

Build pipeline: 2.58 s -> 2.51 s (-69.7 ms) vs main (c4f9d32).
Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (c4f9d32)`

Phase	Baseline	Current	Delta
`extension.check`	1.1 ms	13.8 ms	+12.7 ms
`project.resolve`	0.3 ms	0.3 ms	0.0 ms
`workspace.create`	0.7 ms	0.7 ms	0.0 ms
`host.prepare`	566.1 ms	477.9 ms	-88.2 ms
`vercel.service-prefix.resolve`	2.7 ms	2.2 ms	-0.5 ms
`nitro.create`	275.3 ms	292.8 ms	+17.5 ms
`sandbox.prewarm`	267.9 ms	281.0 ms	+13.1 ms
`nitro.cache.prepare`	0.2 ms	0.3 ms	+0.1 ms
`nitro.prepare`	0.8 ms	1.0 ms	+0.2 ms
`nitro.public-assets`	0.8 ms	0.7 ms	-0.1 ms
`nitro.prerender`	0.4 ms	0.6 ms	+0.2 ms
`nitro.bundle`	1.41 s	1.39 s	-23.6 ms
`nitro.cache.write`	0.4 ms	0.3 ms	-0.1 ms
`vercel.workflow-function.materialize`	50.0 ms	48.3 ms	-1.7 ms
`agent-summary.emit`	0.6 ms	0.7 ms	+0.1 ms
`nitro.close`	0.1 ms	0.1 ms	0.0 ms
`output.publish`	3.4 ms	3.6 ms	+0.2 ms
`workspace.remove`	2.1 ms	2.4 ms	+0.3 ms

Prevent connection principal cache key collisions

338f3fd

Co-authored-by: JelyFishhhhhh <71597580+JelyFishhhhhh@users.noreply.github.com>

e0-gh-vercel-connect Bot mentioned this pull request Aug 28, 2026

principalKey() is non-injective: unescaped : lets two distinct principals share a token-cache key #2692

Open

vercel Bot deployed to Preview – eve-pkg August 28, 2026 03:26 View deployment

vercel Bot deployed to Preview – eve-docs-4759 August 28, 2026 03:27 View deployment

vercel Bot deployed to Preview – eve-docs August 28, 2026 03:27 View deployment

Navigation Menu

Uh oh!

Prevent connection principal cache key collisions - #2693

Prevent connection principal cache key collisions#2693
vercel-gh-bot-2[bot] wants to merge 1 commit into
mainfrom
e0/0ac14c24-1a07-4360-b40e-ad1bc25e6539

vercel-gh-bot-2 Bot commented Aug 28, 2026

Uh oh!

vercel Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026

Package Details

`eve init` install details

Payload Size Graph

Top Function Payloads

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

vercel-gh-bot-2 Bot commented Aug 28, 2026

Why

Approach

Validation

Uh oh!

vercel Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026

Bundle + Package Summary: apps/fixtures/weather-agent

Delta vs main (c4f9d32)

eve init install

Package Details

eve init install details

Payload Size Graph

Top Function Payloads

Build Timing: e2e/fixtures/agent-tools-sandbox

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Aug 28, 2026 •

edited

Loading

Bundle + Package Summary: `apps/fixtures/weather-agent`

Delta vs `main (c4f9d32)`

`eve init` install

`eve init` install details

Build Timing: `e2e/fixtures/agent-tools-sandbox`