fix(eve): validate resolved OIDC token

.changeset/sharp-dolphins-check.md

@@ -0,0 +1,5 @@
+---
+"eve": patch
+---
+
+Treat empty Vercel OIDC resolver results as unavailable credentials instead of reporting AI Gateway as connected.

packages/eve/src/internal/nitro/routes/info.test.ts

@@ -113,6 +113,19 @@ describe("handleAgentInfoRequest", () => {
     expect(mocks.getVercelOidcToken).toHaveBeenCalledOnce();
   });
 
+  it("does not report OIDC when the Vercel SDK returns an empty token", async () => {
+    mocks.getVercelOidcToken.mockResolvedValue("");
+
+    const response = await requestAgentInfo();
+
+    expect(response.status).toBe(200);
+    expect(mocks.buildAgentInfoResponseFromManifest).toHaveBeenCalledWith(GATEWAY_MANIFEST_DATA, {
+      mode: "development",
+      gatewayCredentials: { apiKey: false, oidc: false },
+    });
+    expect(mocks.getVercelOidcToken).toHaveBeenCalledOnce();
+  });
+
   it("does not resolve OIDC when an AI Gateway API key is present", async () => {
     vi.stubEnv("AI_GATEWAY_API_KEY", "gateway-key");
 

packages/eve/src/internal/nitro/routes/info.ts

@@ -45,8 +45,8 @@ async function resolveGatewayCredentialPresence(
   }
 
   try {
-    await getVercelOidcToken();
-    return { apiKey: false, oidc: true };
+    const token = await getVercelOidcToken();
+    return { apiKey: false, oidc: token.trim() !== "" };
   } catch {
     return { apiKey: false, oidc: false };
   }