Let the planning model explore a real clone of the plan's repository

Merged
CH
19d ago
+521-1274

Summary

  • During a planning call, the planning model gets a shallow clone of the plan's commit in eve's Vercel Sandbox (apps/web/eve/sandbox.ts). It explores the clone with one tool, run_in_repository({ command }) (apps/web/server/hosted/repository-shell.ts), which runs the command through eve's own bash tool.
  • How the clone works: the sandbox's onSession hook clones the repo once, when eve creates the sandbox.
    • The sandbox starts with no network.
    • For the clone, network access is opened to github.com only, with the account's token added as a header at the firewall, so the token never enters the VM.
    • Network access is closed again afterwards. Leaving it open would let any command use the token, which is a repo-scope OAuth token, against GitHub.
  • Prompts: the planning prompt and the voice's delegation policy both tell Luke to start exploring the repo as the call starts and to keep talking meanwhile.
  • Deleted: the GitHub MCP read (github-mcp.ts, repository-tools.ts), its tests and golden, the MCP half of the GitHub fake, and @ai-sdk/mcp.
  • eve's bash as a new seam: it reaches the host through BrainHostSeams.bash, passed in from eve/host.ts. A server function bundle may not import eve at runtime.

PRIVACY.md is a product decision called out here. It adds "How the planning model reads your repository" and a GitHub and Vercel line under "Who we send it to". It says deleting a plan does not yet delete its sandbox copy.

Evidence

  • Platform-independent checks: ./scripts/check.sh green
  • macOS Electron verification (./scripts/verify.sh): not run. There is no Mac or UI change.
  • CI could not verify the live path. Nothing has run against real Vercel Sandbox or GitHub yet. Still to check on a preview deploy:
    • git fetch over the firewall-added Authorization header works
    • git is in eve's base image
    • eve surfaces a failed onSession to the tool call and retries it on the next call
    • how long the first clone and a later resume take

Invariants

  • ./scripts/check.sh green. (CI)
  • JSON Schema goldens: get-file-contents-tool-input.json deleted with the tool it recorded; no other golden moved.
  • Behavior changes are tested in tests/repository-shell.test.ts, which runs against a real git repo and real bash:
    • the clone is at the plan's commit, not HEAD
    • later calls reuse the clone
    • an account with no GitHub connection is told to connect
    • extra arguments are refused
    • the token never appears in a result
  • Gateway envelope goldens unchanged.
  • New as assertions are in test files only, each with a SAFETY comment.
  • No new runtime edge. eve/host.ts is already one, and prepareSandbox runs there.
  • Test count: the MCP read's tests were removed with it (repository-tools*.test.ts, one github-connection case, two host cases), and repository-shell.test.ts adds 3.
  • Hand-rolled MCP client deleted.
  • AGENTS.md not edited, and it doesn't name these files.
  • PRIVACY.md changed: product decision, called out above.
  • @ai-sdk/mcp dropped from apps/web/package.json.

Notes

  • Follow-ups:
    • Delete the sandbox when its plan is deleted.
    • Optionally open the sandbox's network after the clone ("allow-all", with the token rule removed) if Luke needs internet inside it.
  • Stacked on #1755.

šŸ¤– Generated with Claude Code

Open workspace in Conductor