Enable microsandbox TLS interception for credential injection

[vercel-gh-bot-2]

Microsandbox header transforms now enable verified TLS interception, allowing the network boundary to replace guest placeholders with brokered credentials.

Fixes #2440

Why

applyMicrosandboxNetwork registered each transformed header as a TLS-identity-bound secret and trusted host certificate authorities. It never enabled TLS interception. HTTPS requests therefore reached the origin with the __EVE_MSB_SECRET_*__ placeholder, so brokered authentication failed without a sandbox error.

Hypothesis

Because microsandbox substitutes requireTlsIdentity secrets inside intercepted TLS, enabling interception on port 443 with upstream verification should activate header injection. Limiting this configuration to policies with header transforms should preserve existing behavior for policies without credentials.

Changes

• Enable TLS interception on port 443 when the network plan contains header transforms
• Keep upstream certificate verification enabled
• Add regression coverage for credentialed and non-credentialed policies
• Add a patch changeset for eve

Validation

• Regression test failed before the source change because network.tls was never called
• pnpm --filter eve exec vitest run --config vitest.unit.config.ts src/execution/sandbox/bindings/microsandbox.test.ts
• pnpm --filter eve typecheck
• pnpm --filter eve build
• pnpm lint
• pnpm guard:invariants
• pnpm --filter eve test:unit passed 7,045 tests; one unrelated IPv6 development-server test timed out under parallel load and passed when rerun alone

The live KVM reproduction was not run because this sandbox has no /dev/kvm. The focused regression test exercises the missing builder configuration directly.

Requested by: tommy5dollar

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview, v0	Aug 24, 2026 2:16pm
eve-docs-4759	Ready	Preview, v0	Aug 24, 2026 2:16pm
eve-pkg	Ready	Preview, v0	Aug 24, 2026 2:16pm

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• Dependency delta: 1 peer dep changed.

Delta vs main (05f002b)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	8.19 MB	8.19 MB	+2.0 kB ⚠️
Package	Unpacked publish size	30.83 MB	30.83 MB	+3.1 kB ⚠️
Package	Installed footprint	75.02 MB	75.02 MB	+3.1 kB ⚠️
Package	Published files	3410	3410	0
Package	Installed files	7124	7124	0
Package	Installed package instances	35	35	0
Package	Distinct installed package names	34	34	0
Package	Installed dependency edges	53	53	0
Package	Installed optional peer edges	47	47	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	18.22 MB	18.22 MB	-40 B ✅
Runtime	Public routes	16	16	0

Dependency manifest changes vs main (05f002b)

Peer dependencies

• Changed: just-bash@^3.0.0 (optional) -> just-bash@^3.1.0 (optional)

Changed function payloads vs main (05f002b) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	9.11 MB	9.11 MB	-20 B ✅	none
functions/.well-known/workflow/v1/flow.func	changed	9.11 MB	9.11 MB	-20 B ✅	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	113.43 MB	113.43 MB	+3.1 kB ⚠️
Installed packages	121	121	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	45.39 MB	45.39 MB	+3.1 kB ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260610-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-08-24T14:17:59.035Z
• Route aliases: 16 public, 1 internal (17 total aliases)
• Vercel routes in config: 19
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.44.3
• Package directory: packages/eve
• Tarball: 8.19 MB (eve-0.44.3.tgz)
• Unpacked payload: 30.83 MB across 3410 published files
• Installed footprint: 75.02 MB across 7124 installed files
• Installed root package: 29.48 MB
• Installed dependencies: 45.55 MB
• Installed package instances: 35
• Distinct installed package names: 34
• Installed dependency edges: 53
• Installed optional peer edges: 47
• Runtime dependencies: 2
• Peer dependencies: 5 (4 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 29.48 MB (39.3%)
• @rolldown/binding-linux-x64-gnu: 19.91 MB (26.5%)
• ai: 6.75 MB (9.0%)
• zod: 5.07 MB (6.8%)
• undici: 3.50 MB (4.7%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [###############.........] 9.76 MB 31.7%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [####....................] 2.44 MB 7.9%
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [##......................] 1.51 MB 4.9%
🟡 dist/src/compiled/_chunks/workflow/undici-Dzn... [#.......................] 512.7 kB 1.7%
🟡 dist/src/compiled/_chunks/node/undici-CUIybhQ... [#.......................] 508.8 kB 1.7%
🔴 Other published files                            [########################] 16.10 MB 52.2%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 29.48 MB 39.3%
🔴 @rolldown/binding-linux-x64-gnu [################........] 19.91 MB 26.5%
🔴 ai                              [#####...................] 6.75 MB 9.0%
🔴 zod                             [####....................] 5.07 MB 6.8%
🟠 undici                          [###.....................] 3.50 MB 4.7%
🟠 nitro                           [##......................] 2.41 MB 3.2%
🔴 Other installed packages        [######..................] 7.90 MB 10.5%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260610-beta
undici	8.9.0

Peer dependencies (5)

Package	Range	Notes
@opentelemetry/api	^1.0.0	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
just-bash	^3.1.0	optional peer
microsandbox	^0.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 113.43 MB across 9000 installed files
• Installed packages: 121 total (115 transitive-only)
• dependencies: 4 direct packages totaling 45.39 MB
• devDependencies: 2 direct packages totaling 5.04 MB
• Other transitive package files: 63.00 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• eve: 29.48 MB (26.0%)
• @typescript/typescript-linux-x64: 27.95 MB (24.6%)
• @rolldown/binding-linux-x64-gnu: 19.91 MB (17.6%)
• zod: 9.02 MB (8.0%)
• ai: 6.75 MB (6.0%)

Installed footprint breakdown

Installed package size
🔴 eve                              [########################] 29.48 MB 26.0%
🔴 @typescript/typescript-linux-x64 [#######################.] 27.95 MB 24.6%
🔴 @rolldown/binding-linux-x64-gnu  [################........] 19.91 MB 17.6%
🔴 zod                              [#######.................] 9.02 MB 8.0%
🔴 ai                               [#####...................] 6.75 MB 6.0%
🟠 undici                           [###.....................] 3.50 MB 3.1%
🔴 Other installed packages         [##############..........] 16.82 MB 14.8%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	0.4.3	141.0 kB	0.1%
ai	^7.0.58	6.75 MB	6.0%
eve	file:eve-0.44.3.tgz	29.48 MB	26.0%
zod	4.4.3	9.02 MB	8.0%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.54 MB	2.2%
typescript	7.0.2	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 9.11 MB 50.0%
🔴 functions/__server.func                         [########################] 9.11 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 9.11 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	9.11 MB
Function files	9.11 MB across 50 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.07 MB (22.7%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                     [##################......] 2.07 MB 22.7%
🟠 _chunks/runtime-artifacts.mjs [###############.........] 1.80 MB 19.8%
🟡 _libs/undici.mjs              [########................] 980.5 kB 10.8%
🟡 _chunks/sandbox.mjs           [#######.................] 781.9 kB 8.6%
🟡 _chunks/frames-Dl2Hcma4.mjs   [######..................] 678.7 kB 7.5%
🟠 Other bundled files           [########################] 2.80 MB 30.7%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 15 public routes, 1 internal alias • 9.11 MB

Metric	Value
Public routes	/ /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/task-input/[token]
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	9.11 MB
Function files	9.11 MB across 50 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.07 MB (22.7%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                     [##################......] 2.07 MB 22.7%
🟠 _chunks/runtime-artifacts.mjs [###############.........] 1.80 MB 19.8%
🟡 _libs/undici.mjs              [########................] 980.5 kB 10.8%
🟡 _chunks/sandbox.mjs           [#######.................] 781.9 kB 8.6%
🟡 _chunks/frames-Dl2Hcma4.mjs   [######..................] 678.7 kB 7.5%
🟠 Other bundled files           [########################] 2.80 MB 30.7%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 2.40 s -> 2.06 s (-340.8 ms) vs main (05f002b).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (05f002b)`

Phase	Baseline	Current	Delta
extension.check	11.2 ms	11.3 ms	+0.1 ms
project.resolve	0.4 ms	0.4 ms	0.0 ms
workspace.create	0.7 ms	0.8 ms	+0.1 ms
host.prepare	436.3 ms	221.9 ms	-214.4 ms
vercel.service-prefix.resolve	2.1 ms	1.8 ms	-0.3 ms
nitro.create	242.1 ms	239.0 ms	-3.1 ms
sandbox.prewarm	268.4 ms	172.6 ms	-95.8 ms
nitro.cache.prepare	0.2 ms	0.2 ms	0.0 ms
nitro.prepare	0.7 ms	0.8 ms	+0.1 ms
nitro.public-assets	0.7 ms	0.7 ms	0.0 ms
nitro.prerender	0.4 ms	0.4 ms	0.0 ms
nitro.bundle	1.41 s	1.38 s	-29.1 ms
nitro.cache.write	0.4 ms	0.3 ms	-0.1 ms
vercel.workflow-function.materialize	22.1 ms	23.4 ms	+1.3 ms
agent-summary.emit	0.5 ms	0.5 ms	0.0 ms
nitro.close	0.2 ms	0.1 ms	-0.1 ms
output.publish	3.2 ms	3.3 ms	+0.1 ms
workspace.remove	1.7 ms	1.9 ms	+0.2 ms

[ruiconti]

@!e0 look up microsandbox documentation on the recommended idiom for brokering credentials. The TLS interception seems sus.

[e0-gh-vercel-connect]

you were right about the idiom, but TLS interception itself is intentional.

microsandbox’s secret docs recommend top-level SandboxBuilder.secret(...). That API automatically enables verified TLS interception. Our nested NetworkBuilder.secret(...) stored the secret but left TLS disabled. A 0.5.5 builder probe confirmed both behaviors.

I updated #2441 to use the sandbox-level secret API and removed manual .tls(...) plus unrelated trustHostCAs(true). Focused tests, typecheck, build, lint, and invariants pass. The live KVM flow remains untested because /dev/kvm isn’t available.

[e0-gh-vercel-connect]

independent correctness review found no material issues. host restrictions, TLS identity enforcement, and non-credentialed policy behavior remain intact.