@ai-sdk/harness-acp 1.0.15 → 1.0.17

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { HarnessV1RequestTransformation, HarnessV1PermissionMode, HarnessV1 } from '@ai-sdk/harness';
+import { HarnessV1RequestTransformation, HarnessV1PermissionMode, HarnessV1PortEndpoint, HarnessV1 } from '@ai-sdk/harness';
 import { ToolSet } from '@ai-sdk/provider-utils';
 
 type ACPMetadata = Record<string, unknown>;
@@ -224,6 +224,11 @@ type ACPHarnessSettings<TBuiltinTools extends ToolSet = {}> = {
     readonly mcpServers?: Record<string, unknown>;
     readonly isMcpToolCall?: (toolCall: ACPToolCall) => boolean;
     readonly port?: number;
+    /**
+     * Override the host endpoint used to connect to the sandbox bridge. Required
+     * together with `port` when using a basic sandbox session.
+     */
+    readonly portEndpoint?: HarnessV1PortEndpoint;
     readonly startupTimeoutMs?: number;
     readonly clientApp?: ACPClientApp;
     readonly version?: ACPV1Settings['version'];

package/dist/index.js

@@ -15,8 +15,10 @@ import {
   classifyDiskLog,
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
+  getRestrictedSandboxSession,
   markBridgeStarting,
   maskSandboxCredentials,
+  resolveSandboxDefaultWorkingDirectory,
   resolveSandboxHomeDir,
   SandboxChannel,
   shellQuote,
@@ -1158,6 +1160,7 @@ function createACPV1({
   settings,
   builtinTools,
   port: portOverride,
+  portEndpoint: portEndpointOverride,
   startupTimeoutMs,
   clientApp,
   lifecycleStateSchema
@@ -1233,6 +1236,24 @@ function createACPV1({
         compatibility: providerAuthenticationCompatibility
       });
       const sandboxSession = startOptions.sandboxSession;
+      const toolSafeSandboxSession = getRestrictedSandboxSession(sandboxSession);
+      const sandboxId = "id" in sandboxSession ? sandboxSession.id : void 0;
+      validateBasicSandboxSettings({
+        sandboxSession,
+        port: portOverride,
+        portEndpoint: portEndpointOverride,
+        harnessId: settings.harnessId
+      });
+      if (settings.mintBridgeToken != null && sandboxId == null) {
+        throw unsupported({
+          harnessId: settings.harnessId,
+          message: `The ${settings.harnessId} ACP harness cannot use \`mintBridgeToken\` with a sandbox session that does not expose an id.`
+        });
+      }
+      const defaultWorkingDirectory = await resolveSandboxDefaultWorkingDirectory({
+        sandboxSession,
+        abortSignal: startOptions.abortSignal
+      });
       const implementationEnvironment = resolveImplementationEnvironment({
         implementation,
         env
@@ -1240,7 +1261,7 @@ function createACPV1({
       let sandboxImplementationEnvironment = implementationEnvironment;
       let sandboxProviderAuthenticationEnvironment = resolvedProviderAuthentication.env;
       let sandboxProviderEnvironment;
-      if (settings.credentialBrokering != null && sandboxSession.addRequestTransformations != null) {
+      if (settings.credentialBrokering != null && "addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
         const providerEnvironment = resolveProviderEnvironment({
           resolvedProviderAuthentication,
           clientApp
@@ -1283,15 +1304,14 @@ function createACPV1({
       } else if (settings.credentialBrokering != null) {
         warnCredentialBrokeringUnavailable();
       }
-      const sandbox = sandboxSession.restricted();
       const resolvedBridgeDir = posix.resolve(
-        sandboxSession.defaultWorkingDirectory,
+        defaultWorkingDirectory,
         bootstrap.bootstrapDir
       );
       const resolvedImplementationDir = `${resolvedBridgeDir}/implementation`;
       const workDir = startOptions.sessionWorkDir;
       const sandboxHomeDir = await resolveSandboxHomeDir({
-        sandbox,
+        sandbox: toolSafeSandboxSession,
         abortSignal: startOptions.abortSignal
       });
       const privateSessionDir = resolveACPPrivateSessionDirectory({
@@ -1313,7 +1333,7 @@ function createACPV1({
           implementationIdentity,
           authenticationProfile,
           lifecycleData,
-          sandboxId: sandboxSession.id
+          sandboxId
         });
       }
       const skills = startOptions.skills ?? [];
@@ -1326,7 +1346,7 @@ function createACPV1({
       let skillCatalog = [];
       if (skills.length > 0) {
         skillCatalog = (await materializeACPSkills({
-          sandbox,
+          sandbox: toolSafeSandboxSession,
           sandboxHomeDir,
           sessionWorkDir: workDir,
           harnessId: settings.harnessId,
@@ -1362,9 +1382,11 @@ function createACPV1({
         }
         if (coords != null) {
           try {
-            const endpoint2 = await sandboxSession.getPortEndpoint({
+            const endpoint2 = await resolveBridgeEndpoint({
+              sandboxSession,
+              override: portEndpointOverride,
               port: coords.port,
-              protocol: "ws"
+              harnessId: settings.harnessId
             });
             const attachEndpoint = withBridgeToken({
               endpoint: endpoint2,
@@ -1404,7 +1426,7 @@ function createACPV1({
               acpSessionId: lifecycleData.acpSessionId,
               bridgePort: coords.port,
               bridgeToken: coords.token,
-              sandboxId: sandboxSession.id,
+              sandboxId,
               isResume: true,
               turnInFlight: isContinue,
               bridgeStateDir,
@@ -1417,7 +1439,7 @@ function createACPV1({
           } catch (error) {
             if (isContinue) {
               const eventLog = await Promise.resolve(
-                sandbox.readTextFile({
+                toolSafeSandboxSession.readTextFile({
                   path: `${bridgeStateDir}/event-log.ndjson`,
                   abortSignal: startOptions.abortSignal
                 })
@@ -1493,18 +1515,18 @@ function createACPV1({
         override: portOverride,
         harnessId: settings.harnessId
       });
-      const token = settings.mintBridgeToken == null ? randomBytes(32).toString("hex") : settings.mintBridgeToken(sandboxSession.id);
-      await sandbox.run({
+      const token = settings.mintBridgeToken == null ? randomBytes(32).toString("hex") : settings.mintBridgeToken(sandboxId);
+      await toolSafeSandboxSession.run({
         command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,
         abortSignal: startOptions.abortSignal
       });
       await markBridgeStarting({
-        sandbox,
+        sandbox: toolSafeSandboxSession,
         bridgeStateDir,
         bridgeType: settings.harnessId,
         abortSignal: startOptions.abortSignal
       });
-      const proc = await sandbox.spawn({
+      const proc = await toolSafeSandboxSession.spawn({
         command: `node ${shellQuote(`${resolvedBridgeDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)} --implementation-dir ${shellQuote(resolvedImplementationDir)} --bridge-type ${shellQuote(settings.harnessId)}`,
         env: {
           ...sandboxImplementationEnvironment,
@@ -1533,7 +1555,7 @@ function createACPV1({
       const timeoutMs = startupTimeoutMs ?? 12e4;
       const { port: boundPort } = await waitForBridgeReady({
         proc,
-        sandbox,
+        sandbox: toolSafeSandboxSession,
         bridgeStateDir,
         bridgeType: settings.harnessId,
         timeoutMs,
@@ -1554,9 +1576,11 @@ function createACPV1({
         })
       });
       void drainBridgeProcessStream(proc.stdout);
-      const endpoint = await sandboxSession.getPortEndpoint({
+      const endpoint = await resolveBridgeEndpoint({
+        sandboxSession,
+        override: portEndpointOverride,
         port: boundPort,
-        protocol: "ws"
+        harnessId: settings.harnessId
       });
       const bridgeEndpoint = withBridgeToken({ endpoint, token });
       const channel = new SandboxChannel({
@@ -1634,7 +1658,7 @@ function createACPV1({
         acpSessionId: lifecycleData?.acpSessionId,
         bridgePort: boundPort,
         bridgeToken: token,
-        sandboxId: sandboxSession.id,
+        sandboxId,
         isResume,
         turnInFlight: respawnStrategy?.mode === "disk-replay" || respawnStrategy?.mode === "lossy-rerun",
         bridgeStateDir,
@@ -1690,12 +1714,49 @@ function resolveBridgePort({
   harnessId
 }) {
   if (override !== void 0) return override;
-  if (sandboxSession.ports.length > 0) return sandboxSession.ports[0];
+  if ("ports" in sandboxSession && sandboxSession.ports.length > 0) {
+    return sandboxSession.ports[0];
+  }
   throw unsupported({
     harnessId,
     message: `The ${harnessId} ACP harness needs a TCP port exposed by the sandbox. Create the sandbox with \`ports: [<port>]\` or configure the harness \`port\`.`
   });
 }
+function validateBasicSandboxSettings({
+  sandboxSession,
+  port,
+  portEndpoint,
+  harnessId
+}) {
+  if ("getPortEndpoint" in sandboxSession) return;
+  if (port == null) {
+    throw unsupported({
+      harnessId,
+      message: `The ${harnessId} ACP harness requires an explicit \`port\` when using a basic sandbox session.`
+    });
+  }
+  if (portEndpoint == null) {
+    throw unsupported({
+      harnessId,
+      message: `The ${harnessId} ACP harness requires an explicit \`portEndpoint\` when using a basic sandbox session.`
+    });
+  }
+}
+async function resolveBridgeEndpoint({
+  sandboxSession,
+  override,
+  port,
+  harnessId
+}) {
+  if (override != null) return override;
+  if ("getPortEndpoint" in sandboxSession) {
+    return sandboxSession.getPortEndpoint({ port, protocol: "ws" });
+  }
+  throw unsupported({
+    harnessId,
+    message: `The ${harnessId} ACP harness requires an explicit \`portEndpoint\` when using a basic sandbox session.`
+  });
+}
 function openWebSocket({
   url,
   headers
@@ -2433,7 +2494,7 @@ function deserializeBridgeError({
 }
 
 // src/version.ts
-var VERSION = true ? "1.0.15" : "0.0.0-test";
+var VERSION = true ? "1.0.17" : "0.0.0-test";
 
 // src/acp-harness.ts
 var ACP_CLIENT_APP = {
@@ -2496,6 +2557,7 @@ function createACP(settings) {
         settings,
         builtinTools: settings.builtinTools ?? ACP_BUILTIN_TOOLS,
         port: settings.port,
+        portEndpoint: settings.portEndpoint,
         startupTimeoutMs: settings.startupTimeoutMs,
         clientApp,
         lifecycleStateSchema: acpResumeStateSchema