@ai-sdk/harness-acp 1.0.25 → 1.0.28

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @ai-sdk/harness-acp
 
+## 1.0.28
+
+### Patch Changes
+
+- 0e590d2: feat(harness): harden credential brokering to only apply with correct ephemeral secret
+- Updated dependencies [3e125ba]
+- Updated dependencies [0e590d2]
+  - @ai-sdk/provider-utils@5.0.32
+  - @ai-sdk/harness@1.0.90
+
+## 1.0.27
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.89
+
+## 1.0.26
+
+### Patch Changes
+
+- Updated dependencies [32349cc]
+- Updated dependencies [a9782e1]
+- Updated dependencies [35841f5]
+- Updated dependencies [d2f3353]
+  - @ai-sdk/harness@1.0.88
+  - @ai-sdk/provider-utils@5.0.31
+
 ## 1.0.25
 
 ### Patch Changes

package/README.md

@@ -35,13 +35,20 @@ const codexACP = createACP({
   },
   executable: 'codex-acp',
   credentialEnv: ['CODEX_API_KEY', 'OPENAI_API_KEY'],
-  credentialBrokering: ({ env }) => {
-    const credential = env.CODEX_API_KEY ?? env.OPENAI_API_KEY;
-    if (!credential) return [];
+  credentialBrokering: ({ env, sandboxEnv }) => {
+    const environmentVariableName = env.CODEX_API_KEY
+      ? 'CODEX_API_KEY'
+      : 'OPENAI_API_KEY';
+    const credential = env[environmentVariableName];
+    const sandboxCredential = sandboxEnv?.[environmentVariableName];
+    if (!credential || !sandboxCredential) return [];
     return [
       createCredentialRequestTransformation({
-        baseUrl: 'https://api.openai.com/v1',
-        headers: { Authorization: `Bearer ${credential}` },
+        matchUrl: 'https://api.openai.com/v1',
+        matchHeaders: {
+          Authorization: `Bearer ${sandboxCredential}`,
+        },
+        transformHeaders: { Authorization: `Bearer ${credential}` },
       }),
     ];
   },
@@ -82,7 +89,8 @@ try {
 
 Set `CODEX_API_KEY` or `OPENAI_API_KEY` in the host environment. Sandboxes that
 support additive request transformations receive only credential placeholders;
-the real value is injected into matching outbound requests. Other sandboxes
+the real value is injected only when a matching outbound request contains the
+expected placeholder. Other sandboxes
 retain the legacy behavior of forwarding the value to the ACP process. Codex
 ACP supports only `permissionMode: 'allow-all'` because its
 restrictive modes enable Codex's internal sandbox. A bridge-backed ACP harness

package/dist/bridge/host-tool-mcp.mjs

@@ -12,7 +12,7 @@ import {
   ListToolsRequestSchema,
   McpError
 } from "@modelcontextprotocol/sdk/types.js";
-var VERSION = true ? "1.0.25" : "0.0.0-test";
+var VERSION = true ? "1.0.28" : "0.0.0-test";
 function createHostToolMCPServer({
   tools: tools2,
   revision = 1,

package/dist/index.d.ts

@@ -145,8 +145,9 @@ type ACPProviderAuthentication = {
         readonly env: Readonly<Record<string, ACPProfileValue>>;
     };
 };
-type ACPCredentialBrokering = ({ env, }: {
+type ACPCredentialBrokering = ({ env, sandboxEnv, }: {
     env: Readonly<Record<string, string>>;
+    sandboxEnv?: Readonly<Record<string, string>>;
 }) => ReadonlyArray<HarnessV1RequestTransformation>;
 type ACPPermissionModeTarget = {
     readonly type: 'session-mode';

package/dist/index.js

@@ -13,12 +13,12 @@ import {
   applyCredentialForwarding,
   createBridgeErrorHandler,
   createBridgeStartupError,
+  createSandboxCredentialEnvironment,
   classifyDiskLog,
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
   getRestrictedSandboxSession,
   markBridgeStarting,
-  maskSandboxCredentials,
   resolveSandboxDefaultWorkingDirectory,
   resolveSandboxHomeDir,
   SandboxChannel,
@@ -1318,6 +1318,21 @@ function createACPV1({
         sandboxSession,
         abortSignal: startOptions.abortSignal
       });
+      const continueFrom = startOptions.continueFrom ?? startOptions.resumeFrom?.continueFrom;
+      const lifecycleState = continueFrom ?? startOptions.resumeFrom;
+      const isContinue = continueFrom != null;
+      const isResume = lifecycleState != null;
+      const lifecycleData = lifecycleState != null ? lifecycleState.data : void 0;
+      if (lifecycleData != null && lifecycleState != null) {
+        validateACPLifecycleCompatibility({
+          harnessId: settings.harnessId,
+          lifecycleHarnessId: lifecycleState.harnessId,
+          implementationIdentity,
+          authenticationProfile,
+          lifecycleData,
+          sandboxId
+        });
+      }
       const implementationEnvironment = resolveImplementationEnvironment({
         implementation,
         env
@@ -1340,30 +1355,35 @@ function createACPV1({
           })
         ])
       ];
+      let sandboxCredentialEnvironment;
       if (settings.credentialBrokering != null && "addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
         const providerEnvironment = resolveProviderEnvironment({
           resolvedProviderAuthentication,
           clientApp
         });
+        const brokeringEnvironment = {
+          ...implementationEnvironment,
+          ...providerEnvironment
+        };
+        sandboxCredentialEnvironment = lifecycleData?.sandboxCredentialEnvironment ?? await createSandboxCredentialEnvironment({
+          environment: brokeringEnvironment,
+          credentialEnvironmentVariables: credentialForwardingEnvironmentVariables,
+          credentialForwarding: settings.credentialForwarding
+        });
+        sandboxImplementationEnvironment = {
+          ...brokeringEnvironment,
+          ...sandboxCredentialEnvironment
+        };
         const requestTransformations = settings.credentialBrokering({
-          env: {
-            ...implementationEnvironment,
-            ...providerEnvironment
-          }
+          env: brokeringEnvironment,
+          sandboxEnv: sandboxImplementationEnvironment
         });
         if (requestTransformations.length > 0) {
           await sandboxSession.addRequestTransformations(
             requestTransformations
           );
         }
-        sandboxImplementationEnvironment = maskSandboxCredentials({
-          environment: implementationEnvironment,
-          credentialEnvironmentVariables
-        });
-        sandboxProviderEnvironment = resolveBrokeredProviderEnvironment({
-          resolvedProviderAuthentication,
-          clientApp
-        });
+        sandboxProviderEnvironment = resolvedProviderAuthentication.providerAuthentication?.type === "ai-gateway" ? {} : void 0;
       } else if (settings.credentialBrokering != null) {
         warnCredentialBrokeringUnavailable();
       }
@@ -1401,21 +1421,6 @@ function createACPV1({
         sessionId: startOptions.sessionId
       });
       const bridgeStateDir = `${privateSessionDir}/bridge`;
-      const continueFrom = startOptions.continueFrom ?? startOptions.resumeFrom?.continueFrom;
-      const lifecycleState = continueFrom ?? startOptions.resumeFrom;
-      const isContinue = continueFrom != null;
-      const isResume = lifecycleState != null;
-      const lifecycleData = lifecycleState != null ? lifecycleState.data : void 0;
-      if (lifecycleData != null && lifecycleState != null) {
-        validateACPLifecycleCompatibility({
-          harnessId: settings.harnessId,
-          lifecycleHarnessId: lifecycleState.harnessId,
-          implementationIdentity,
-          authenticationProfile,
-          lifecycleData,
-          sandboxId
-        });
-      }
       const skills = startOptions.skills ?? [];
       const skillsFingerprint = createACPSkillsFingerprint({ skills });
       const shouldMaterializeSkills = shouldMaterializeACPSkills({
@@ -1513,6 +1518,7 @@ function createACPV1({
               turnStartConfig: lifecycleData.turnStartConfig,
               recoveryStatus: lifecycleData.recovery,
               restoration: lifecycleData.restoration,
+              sandboxCredentialEnvironment,
               replayOnly: false,
               lossyRerun: false
             });
@@ -1590,11 +1596,11 @@ function createACPV1({
           };
         }
       }
-      const forwardedImplementationEnvironment = await applyCredentialForwarding({
+      const forwardedImplementationEnvironment = sandboxCredentialEnvironment == null ? await applyCredentialForwarding({
         environment: sandboxImplementationEnvironment,
         credentialEnvironmentVariables: credentialForwardingEnvironmentVariables,
         credentialForwarding: settings.credentialForwarding
-      });
+      }) : sandboxImplementationEnvironment;
       const port = resolveBridgePort({
         sandboxSession,
         override: portOverride,
@@ -1753,6 +1759,7 @@ function createACPV1({
           reason: respawnStrategy.reason
         } : void 0,
         restoration: coldRestoration == null ? lifecycleData?.restoration : { method: coldRestoration },
+        sandboxCredentialEnvironment,
         replayOnly: respawnStrategy?.mode === "disk-replay",
         lossyRerun: respawnStrategy?.mode === "lossy-rerun"
       });
@@ -1782,36 +1789,6 @@ function resolveProviderEnvironment({
     }
   });
 }
-function resolveBrokeredProviderEnvironment({
-  resolvedProviderAuthentication,
-  clientApp
-}) {
-  const providerAuthentication = resolvedProviderAuthentication.providerAuthentication;
-  if (providerAuthentication?.type !== "ai-gateway") return {};
-  const baseUrl = requireResolvedEnvironmentValue({
-    environment: resolvedProviderAuthentication.env,
-    name: "AI_SDK_ACP_GATEWAY_BASE_URL"
-  });
-  return Object.fromEntries(
-    Object.entries(providerAuthentication.env).map(
-      ([environmentVariableName, value]) => {
-        const environment = resolveACPLaunchEnvironment({
-          providerAuthentication: {
-            type: "ai-gateway",
-            env: { [environmentVariableName]: value }
-          },
-          gateway: {
-            apiKey: environmentVariableName,
-            baseUrl,
-            clientAppName: clientApp.name,
-            clientAppVersion: clientApp.version
-          }
-        });
-        return [environmentVariableName, environment[environmentVariableName]];
-      }
-    )
-  );
-}
 function resolveACPProviderCredentialEnvironmentVariables({
   providerAuthentication
 }) {
@@ -2018,6 +1995,7 @@ function createSession({
   turnStartConfig: turnStartConfigAtStart,
   recoveryStatus,
   restoration,
+  sandboxCredentialEnvironment,
   replayOnly,
   lossyRerun
 }) {
@@ -2253,6 +2231,7 @@ function createSession({
   }) => ({
     implementationIdentity,
     authenticationProfile,
+    ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
     ...latestACPSessionId == null ? {} : { acpSessionId: latestACPSessionId },
     ...bridge == null ? {} : { bridge },
     ...latestTurnStartConfig == null ? {} : {
@@ -2632,7 +2611,7 @@ function deserializeBridgeError({
 }
 
 // src/version.ts
-var VERSION = true ? "1.0.25" : "0.0.0-test";
+var VERSION = true ? "1.0.28" : "0.0.0-test";
 
 // src/acp-harness.ts
 var ACP_CLIENT_APP = {
@@ -2658,6 +2637,7 @@ var acpResumeStateSchema = z4.object({
     providerMode: z4.enum(["auto", "direct", "ai-gateway"]).optional(),
     gatewayCredentialSource: z4.enum(["AI_GATEWAY_API_KEY", "VERCEL_OIDC_TOKEN"]).nullable().optional()
   }).optional(),
+  sandboxCredentialEnvironment: z4.record(z4.string(), z4.string()).optional(),
   acpSessionId: z4.string().optional(),
   bridge: acpBridgeCoordsSchema.optional(),
   coldSession: acpColdSessionStateSchema.optional(),