@ai-sdk/harness-acp 1.0.7 → 1.0.9

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @ai-sdk/harness-acp
 
+## 1.0.9
+
+### Patch Changes
+
+- 69bb613: feat(harness): support request transformations in network sandbox abstraction and use it to apply credential brokering when available
+- 52bc889: feat(harness): add `getPortEndpoint()` as more comprehensive replacement to `getPortUrl()` (now deprecated) in `HarnessV1NetworkSandboxSession`
+- 4cd4989: chore(harness): decouple bridge based harness bootstrap recipe logic from dynamic params and enforce unique harnesses in `prepareSandboxForHarness()` helper
+- Updated dependencies [69bb613]
+- Updated dependencies [52bc889]
+- Updated dependencies [4cd4989]
+  - @ai-sdk/harness@1.0.72
+
+## 1.0.8
+
+### Patch Changes
+
+- Updated dependencies [8d717b3]
+  - @ai-sdk/harness@1.0.71
+
 ## 1.0.7
 
 ### Patch Changes

package/README.md

@@ -23,6 +23,7 @@ authentication:
 ```ts
 import { HarnessAgent } from '@ai-sdk/harness/agent';
 import { createACP } from '@ai-sdk/harness-acp';
+import { createCredentialRequestTransformation } from '@ai-sdk/harness/utils';
 import { createVercelSandbox } from '@ai-sdk/sandbox-vercel';
 
 const codexACP = createACP({
@@ -33,7 +34,17 @@ const codexACP = createACP({
     packageVersion: '1.1.4',
   },
   executable: 'codex-acp',
-  forwardEnv: ['CODEX_API_KEY', 'OPENAI_API_KEY'],
+  credentialEnv: ['CODEX_API_KEY', 'OPENAI_API_KEY'],
+  credentialBrokering: ({ env }) => {
+    const credential = env.CODEX_API_KEY ?? env.OPENAI_API_KEY;
+    if (!credential) return [];
+    return [
+      createCredentialRequestTransformation({
+        baseUrl: 'https://api.openai.com/v1',
+        headers: { Authorization: `Bearer ${credential}` },
+      }),
+    ];
+  },
   instructionMapping: {
     type: 'launch-env-json',
     variable: 'CODEX_CONFIG',
@@ -69,9 +80,11 @@ try {
 }
 ```
 
-Set `CODEX_API_KEY` or `OPENAI_API_KEY` in the host environment. The adapter
-resolves the value when the ACP process starts and does not store it in the
-profile. Codex ACP supports only `permissionMode: 'allow-all'` because its
+Set `CODEX_API_KEY` or `OPENAI_API_KEY` in the host environment. Sandboxes that
+support additive request transformations receive only credential placeholders;
+the real value is injected into matching outbound requests. Other sandboxes
+retain the legacy behavior of forwarding the value to the ACP process. Codex
+ACP supports only `permissionMode: 'allow-all'` because its
 restrictive modes enable Codex's internal sandbox. A bridge-backed ACP harness
 requires a sandbox with at least one exposed port.
 

package/dist/bridge/host-tool-mcp.mjs

@@ -12,7 +12,7 @@ import {
   ListToolsRequestSchema,
   McpError
 } from "@modelcontextprotocol/sdk/types.js";
-var VERSION = true ? "1.0.7" : "0.0.0-test";
+var VERSION = true ? "1.0.9" : "0.0.0-test";
 function createHostToolMCPServer({
   tools: tools2,
   revision = 1,

package/dist/bridge/index.mjs

@@ -529,6 +529,7 @@ var providerAuthenticationSchema = z.discriminatedUnion("type", [
 var bridgeConfigurationSchema = z.object({
   authentication: authenticationSchema.optional(),
   providerAuthentication: providerAuthenticationSchema.optional(),
+  providerEnvironment: z.record(z.string(), z.string()).optional(),
   sessionMeta: serializableRecordSchema.optional()
 });
 async function readACPBridgeEnvironment({
@@ -3107,6 +3108,7 @@ async function ensureSession({
   const fingerprint = JSON.stringify({
     authentication: bridgeConfiguration.authentication,
     providerAuthentication: bridgeConfiguration.providerAuthentication,
+    providerEnvironment: bridgeConfiguration.providerEnvironment,
     sessionMeta: bridgeConfiguration.sessionMeta,
     instructionMapping: start.instructionMapping,
     permissionMode: start.permissionMode,
@@ -3140,11 +3142,10 @@ async function ensureSession({
     return;
   }
   const clientApp = resolveClientApp();
-  const gateway = bridgeConfiguration.providerAuthentication?.type === "ai-gateway" ? resolveGatewayValues({ clientApp }) : void 0;
   const authentication = bridgeConfiguration.authentication;
-  const launchEnv = resolveACPLaunchEnvironment({
+  const launchEnv = bridgeConfiguration.providerEnvironment ?? resolveACPLaunchEnvironment({
     providerAuthentication: bridgeConfiguration.providerAuthentication,
-    gateway
+    gateway: bridgeConfiguration.providerAuthentication?.type === "ai-gateway" ? resolveGatewayValues({ clientApp }) : void 0
   });
   const instructionConfiguration = await resolveACPInstructionConfiguration({
     instructions: start.instructions,