@ai-sdk/harness-acp 1.0.24 → 1.0.25

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { HarnessV1RequestTransformation, HarnessV1PermissionMode, HarnessV1PortEndpoint, HarnessV1 } from '@ai-sdk/harness';
+import { HarnessV1RequestTransformation, HarnessV1CredentialForwarding, HarnessV1PermissionMode, HarnessV1PortEndpoint, HarnessV1 } from '@ai-sdk/harness';
 import { ToolSet } from '@ai-sdk/provider-utils';
 
 type ACPMetadata = Record<string, unknown>;
@@ -126,6 +126,8 @@ type ACPNpmLockedSource = {
     readonly type: 'npm-locked';
     readonly packageJson: string;
     readonly pnpmLockYaml: string;
+    /** Optional pnpm workspace configuration required by the locked install. */
+    readonly pnpmWorkspaceYaml?: string;
 };
 type ACPInstallCommandSource = {
     readonly type: 'install-command';
@@ -184,6 +186,12 @@ type ACPV1Settings = {
     readonly forwardEnv?: ReadonlyArray<string>;
     readonly credentialEnv?: ReadonlyArray<string>;
     readonly credentialBrokering?: ACPCredentialBrokering;
+    /**
+     * Customizes each credential value before it is forwarded into a sandbox
+     * process. This does not restrict which credentials the harness adapter can
+     * discover, read, or otherwise access in the host process.
+     */
+    readonly credentialForwarding?: HarnessV1CredentialForwarding;
     /**
      * Runtime environment values that are safe to persist in bootstrap and
      * lifecycle compatibility identity.
@@ -244,6 +252,12 @@ type ACPHarnessSettings<TBuiltinTools extends ToolSet = {}> = {
     readonly forwardEnv?: ACPV1Settings['forwardEnv'];
     readonly credentialEnv?: ACPV1Settings['credentialEnv'];
     readonly credentialBrokering?: ACPV1Settings['credentialBrokering'];
+    /**
+     * Customizes each credential value before it is forwarded into a sandbox
+     * process. This does not restrict which credentials the harness adapter can
+     * discover, read, or otherwise access in the host process.
+     */
+    readonly credentialForwarding?: ACPV1Settings['credentialForwarding'];
     readonly env?: ACPV1Settings['env'];
     readonly authentication?: ACPV1Settings['authentication'];
     readonly providerAuthentication?: ACPV1Settings['providerAuthentication'];

package/dist/index.js

@@ -10,6 +10,7 @@ import {
 } from "@ai-sdk/harness";
 import { HarnessBridgeCapabilityUnsupportedError } from "@ai-sdk/harness/bridge";
 import {
+  applyCredentialForwarding,
   createBridgeErrorHandler,
   createBridgeStartupError,
   classifyDiskLog,
@@ -201,6 +202,9 @@ function validateACPV1Implementation(implementation) {
     if (source.pnpmLockYaml.length === 0) {
       throw new Error("ACP source.pnpmLockYaml must not be empty.");
     }
+    if (source.pnpmWorkspaceYaml?.length === 0) {
+      throw new Error("ACP source.pnpmWorkspaceYaml must not be empty.");
+    }
   } else if (source.type === "npm-simple") {
     validateNpmSimpleSource({ source });
   } else if (source.command.trim().length === 0) {
@@ -264,6 +268,12 @@ function getImplementationLockfile({
   const { source } = implementation;
   return source.type === "npm-locked" ? source.pnpmLockYaml : void 0;
 }
+function getImplementationWorkspaceFile({
+  implementation
+}) {
+  const { source } = implementation;
+  return source.type === "npm-locked" ? source.pnpmWorkspaceYaml : void 0;
+}
 function createImplementationDescriptor({
   implementation
 }) {
@@ -290,7 +300,8 @@ function createImplementationIdentity({
   const sourceIdentity = source.type === "npm-locked" ? {
     type: source.type,
     packageJson: source.packageJson,
-    pnpmLockYaml: source.pnpmLockYaml
+    pnpmLockYaml: source.pnpmLockYaml,
+    pnpmWorkspaceYaml: source.pnpmWorkspaceYaml
   } : source.type === "npm-simple" ? {
     type: source.type,
     packageName: source.packageName,
@@ -462,6 +473,9 @@ function createACPBootstrap({
       const implementationLock = getImplementationLockfile({
         implementation
       });
+      const implementationWorkspace = getImplementationWorkspaceFile({
+        implementation
+      });
       const implementationInstallScript = getImplementationInstallScript({
         implementation
       });
@@ -498,6 +512,12 @@ function createACPBootstrap({
               content: implementationLock
             }
           ],
+          ...implementationWorkspace == null ? [] : [
+            {
+              path: `${bootstrapDir}/implementation/pnpm-workspace.yaml`,
+              content: implementationWorkspace
+            }
+          ],
           ...implementationInstallScript == null ? [] : [
             {
               path: `${bootstrapDir}/implementation/install.sh`,
@@ -658,6 +678,8 @@ function unsupportedPromptContent({
 var builtinToolSchema = z2.object({
   toolName: z2.string(),
   nativeName: z2.string().optional(),
+  title: z2.string().optional(),
+  toolUseKind: z2.enum(["readonly", "edit", "bash"]).optional(),
   inputSchema: z2.json().optional()
 });
 var jsonValueSchema = z2.json();
@@ -1303,18 +1325,26 @@ function createACPV1({
       let sandboxImplementationEnvironment = implementationEnvironment;
       let sandboxProviderAuthenticationEnvironment = resolvedProviderAuthentication.env;
       let sandboxProviderEnvironment;
+      const credentialEnvironmentVariables = [
+        .../* @__PURE__ */ new Set([
+          ...settings.credentialEnv ?? [],
+          "AI_GATEWAY_API_KEY",
+          "VERCEL_OIDC_TOKEN"
+        ])
+      ];
+      const credentialForwardingEnvironmentVariables = [
+        .../* @__PURE__ */ new Set([
+          ...credentialEnvironmentVariables,
+          ...resolveACPProviderCredentialEnvironmentVariables({
+            providerAuthentication: resolvedProviderAuthentication.providerAuthentication
+          })
+        ])
+      ];
       if (settings.credentialBrokering != null && "addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
         const providerEnvironment = resolveProviderEnvironment({
           resolvedProviderAuthentication,
           clientApp
         });
-        const credentialEnvironmentVariables = [
-          .../* @__PURE__ */ new Set([
-            ...settings.credentialEnv ?? [],
-            "AI_GATEWAY_API_KEY",
-            "VERCEL_OIDC_TOKEN"
-          ])
-        ];
         const requestTransformations = settings.credentialBrokering({
           env: {
             ...implementationEnvironment,
@@ -1330,21 +1360,29 @@ function createACPV1({
           environment: implementationEnvironment,
           credentialEnvironmentVariables
         });
-        sandboxProviderEnvironment = maskSandboxCredentials({
-          environment: resolveProviderEnvironment({
-            resolvedProviderAuthentication,
-            clientApp,
-            gatewayApiKey: "AI_GATEWAY_API_KEY"
-          }),
-          credentialEnvironmentVariables
+        sandboxProviderEnvironment = resolveBrokeredProviderEnvironment({
+          resolvedProviderAuthentication,
+          clientApp
+        });
+      } else if (settings.credentialBrokering != null) {
+        warnCredentialBrokeringUnavailable();
+      }
+      if (settings.credentialForwarding != null && sandboxProviderEnvironment == null && resolvedProviderAuthentication.providerAuthentication?.type === "ai-gateway") {
+        sandboxProviderEnvironment = resolveProviderEnvironment({
+          resolvedProviderAuthentication,
+          clientApp
         });
+      }
+      if (sandboxProviderEnvironment != null) {
+        sandboxImplementationEnvironment = {
+          ...sandboxImplementationEnvironment,
+          ...sandboxProviderEnvironment
+        };
         sandboxProviderAuthenticationEnvironment = Object.fromEntries(
           Object.entries(resolvedProviderAuthentication.env).filter(
             ([key]) => key !== "AI_SDK_ACP_GATEWAY_API_KEY" && key !== "AI_SDK_ACP_GATEWAY_BASE_URL"
           )
         );
-      } else if (settings.credentialBrokering != null) {
-        warnCredentialBrokeringUnavailable();
       }
       const resolvedBridgeDir = posix.resolve(
         defaultWorkingDirectory,
@@ -1552,6 +1590,11 @@ function createACPV1({
           };
         }
       }
+      const forwardedImplementationEnvironment = await applyCredentialForwarding({
+        environment: sandboxImplementationEnvironment,
+        credentialEnvironmentVariables: credentialForwardingEnvironmentVariables,
+        credentialForwarding: settings.credentialForwarding
+      });
       const port = resolveBridgePort({
         sandboxSession,
         override: portOverride,
@@ -1571,11 +1614,11 @@ function createACPV1({
       const proc = await toolSafeSandboxSession.spawn({
         command: `node ${shellQuote(`${resolvedBridgeDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)} --implementation-dir ${shellQuote(resolvedImplementationDir)} --bridge-type ${shellQuote(settings.harnessId)}`,
         env: {
-          ...sandboxImplementationEnvironment,
+          ...forwardedImplementationEnvironment,
           ...createACPBridgeEnvironment({
             authentication: settings.authentication,
             providerAuthentication: resolvedProviderAuthentication.providerAuthentication,
-            providerEnvironment: sandboxProviderEnvironment,
+            providerEnvironment: sandboxProviderEnvironment == null ? void 0 : {},
             sessionMeta: settings.session?.meta
           }),
           ...sandboxProviderAuthenticationEnvironment,
@@ -1718,8 +1761,7 @@ function createACPV1({
 }
 function resolveProviderEnvironment({
   resolvedProviderAuthentication,
-  clientApp,
-  gatewayApiKey
+  clientApp
 }) {
   if (resolvedProviderAuthentication.providerAuthentication?.type !== "ai-gateway") {
     return {};
@@ -1727,7 +1769,7 @@ function resolveProviderEnvironment({
   return resolveACPLaunchEnvironment({
     providerAuthentication: resolvedProviderAuthentication.providerAuthentication,
     gateway: {
-      apiKey: gatewayApiKey ?? requireResolvedEnvironmentValue({
+      apiKey: requireResolvedEnvironmentValue({
         environment: resolvedProviderAuthentication.env,
         name: "AI_SDK_ACP_GATEWAY_API_KEY"
       }),
@@ -1740,6 +1782,56 @@ function resolveProviderEnvironment({
     }
   });
 }
+function resolveBrokeredProviderEnvironment({
+  resolvedProviderAuthentication,
+  clientApp
+}) {
+  const providerAuthentication = resolvedProviderAuthentication.providerAuthentication;
+  if (providerAuthentication?.type !== "ai-gateway") return {};
+  const baseUrl = requireResolvedEnvironmentValue({
+    environment: resolvedProviderAuthentication.env,
+    name: "AI_SDK_ACP_GATEWAY_BASE_URL"
+  });
+  return Object.fromEntries(
+    Object.entries(providerAuthentication.env).map(
+      ([environmentVariableName, value]) => {
+        const environment = resolveACPLaunchEnvironment({
+          providerAuthentication: {
+            type: "ai-gateway",
+            env: { [environmentVariableName]: value }
+          },
+          gateway: {
+            apiKey: environmentVariableName,
+            baseUrl,
+            clientAppName: clientApp.name,
+            clientAppVersion: clientApp.version
+          }
+        });
+        return [environmentVariableName, environment[environmentVariableName]];
+      }
+    )
+  );
+}
+function resolveACPProviderCredentialEnvironmentVariables({
+  providerAuthentication
+}) {
+  if (providerAuthentication?.type !== "ai-gateway") return [];
+  return Object.entries(providerAuthentication.env).filter(([, value]) => containsACPProviderCredential({ value })).map(([name]) => name);
+}
+function containsACPProviderCredential({
+  value
+}) {
+  if (Array.isArray(value)) {
+    return value.some((item) => containsACPProviderCredential({ value: item }));
+  }
+  if (value == null || typeof value !== "object") return false;
+  if ("$source" in value) {
+    return value.$source === "gateway-api-key" || value.$source === "gateway-authorization";
+  }
+  return Object.values(value).some(
+    (item) => containsACPProviderCredential({ value: item })
+  );
+}
 function requireResolvedEnvironmentValue({
   environment,
   name
@@ -2418,6 +2510,8 @@ function serializeBuiltinTools({
 }) {
   return Object.entries(builtinTools).map(([toolName, tool]) => {
     const nativeName = tool != null && typeof tool === "object" && "nativeName" in tool && typeof tool.nativeName === "string" ? tool.nativeName : void 0;
+    const title = tool != null && typeof tool === "object" && "title" in tool && typeof tool.title === "string" ? tool.title : void 0;
+    const toolUseKind = tool != null && typeof tool === "object" && "toolUseKind" in tool && (tool.toolUseKind === "readonly" || tool.toolUseKind === "edit" || tool.toolUseKind === "bash") ? tool.toolUseKind : void 0;
     let inputSchema;
     if (tool != null && typeof tool === "object" && "inputSchema" in tool && tool.inputSchema != null) {
       try {
@@ -2430,6 +2524,8 @@ function serializeBuiltinTools({
     return {
       toolName,
       ...nativeName == null ? {} : { nativeName },
+      ...title == null ? {} : { title },
+      ...toolUseKind == null ? {} : { toolUseKind },
       ...inputSchema == null ? {} : { inputSchema }
     };
   });
@@ -2536,7 +2632,7 @@ function deserializeBridgeError({
 }
 
 // src/version.ts
-var VERSION = true ? "1.0.24" : "0.0.0-test";
+var VERSION = true ? "1.0.25" : "0.0.0-test";
 
 // src/acp-harness.ts
 var ACP_CLIENT_APP = {