@ai-sdk/harness-acp 1.0.76 → 1.0.78

package/dist/index.js

@@ -2138,7 +2138,7 @@ function deserializeBridgeError({ error, harnessId }) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION = "1.0.76";
+const VERSION = "1.0.78";
 //#endregion
 //#region src/acp-harness.ts
 const ACP_CLIENT_APP = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-acp",
-  "version": "1.0.76",
+  "version": "1.0.78",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -26,8 +26,8 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/harness": "1.0.138",
-    "@ai-sdk/provider-utils": "5.0.53",
+    "@ai-sdk/harness": "1.0.139",
+    "@ai-sdk/provider-utils": "5.0.54",
     "ws": "^8.21.0"
   },
   "peerDependencies": {

package/src/v1/bridge/canonical-json-fingerprint.ts

@@ -0,0 +1,17 @@
+export function canonicalFingerprint({ value }: { value: unknown }): string {
+  return JSON.stringify(canonicalizeJSON({ value }));
+}
+
+function canonicalizeJSON({ value }: { value: unknown }): unknown {
+  if (Array.isArray(value)) {
+    return value.map(item => canonicalizeJSON({ value: item }));
+  }
+  if (value == null || typeof value !== 'object') return value;
+  const record = value as Readonly<Record<string, unknown>>;
+  return Object.fromEntries(
+    Object.keys(record)
+      .sort()
+      .filter(key => record[key] !== undefined)
+      .map(key => [key, canonicalizeJSON({ value: record[key] })]),
+  );
+}

package/src/v1/bridge/host-tool-correlation.ts

@@ -3,6 +3,7 @@ import type {
   ToolCallUpdate,
 } from '@agentclientprotocol/sdk';
 import type { ACPToolCall } from '../../acp-tool-call';
+import { canonicalFingerprint } from './canonical-json-fingerprint';
 
 type SessionUpdateMessage = Extract<
   ActiveSessionMessage,
@@ -449,23 +450,11 @@ function containsCombinedIdentity({
   serverName: string;
   toolName: string;
 }): boolean {
-  const seen = new Set<object>();
-  const visit = (candidate: unknown): boolean => {
-    if (typeof candidate === 'string') {
-      return hasDelimitedPair({ value: candidate, serverName, toolName });
-    }
-    if (candidate == null || typeof candidate !== 'object') return false;
-    if (seen.has(candidate)) return false;
-    seen.add(candidate);
-    const values = Array.isArray(candidate)
-      ? candidate
-      : Object.values(candidate);
-    for (const item of values) {
-      if (visit(item)) return true;
-    }
-    return false;
-  };
-  return visit(value);
+  return containsString({
+    value,
+    matches: candidate =>
+      hasDelimitedPair({ value: candidate, serverName, toolName }),
+  });
 }
 
 function hasDelimitedPair({
@@ -570,10 +559,20 @@ function containsExactValue({
 }: {
   value: unknown;
   target: string;
+}): boolean {
+  return containsString({ value, matches: candidate => candidate === target });
+}
+
+function containsString({
+  value,
+  matches,
+}: {
+  value: unknown;
+  matches: (candidate: string) => boolean;
 }): boolean {
   const seen = new Set<object>();
   const visit = (candidate: unknown): boolean => {
-    if (candidate === target) return true;
+    if (typeof candidate === 'string') return matches(candidate);
     if (candidate == null || typeof candidate !== 'object') return false;
     if (seen.has(candidate)) return false;
     seen.add(candidate);
@@ -613,28 +612,6 @@ function containsFingerprint({
   return visit(value);
 }
 
-function canonicalFingerprint({ value }: { value: unknown }): string {
-  return JSON.stringify(canonicalizeJSON({ value }));
-}
-
-function canonicalizeJSON({ value }: { value: unknown }): unknown {
-  if (Array.isArray(value)) {
-    return value.map(item => canonicalizeJSON({ value: item }));
-  }
-  if (value == null || typeof value !== 'object') return value;
-  return Object.fromEntries(
-    Object.keys(value as Record<string, unknown>)
-      .sort()
-      .filter(key => (value as Record<string, unknown>)[key] !== undefined)
-      .map(key => [
-        key,
-        canonicalizeJSON({
-          value: (value as Record<string, unknown>)[key],
-        }),
-      ]),
-  );
-}
-
 function getProperty({
   value,
   property,

package/src/v1/bridge/host-tool-relay-authorization.ts

@@ -0,0 +1,234 @@
+import type { SessionUpdate, ToolCallUpdate } from '@agentclientprotocol/sdk';
+import { canonicalFingerprint } from './canonical-json-fingerprint';
+
+type HostToolCall = {
+  readonly toolName: string;
+  readonly input: Readonly<Record<string, unknown>>;
+};
+
+type ObservedCall = {
+  toolCall: ToolCallUpdate;
+  consumed: boolean;
+  terminal: boolean;
+};
+
+const DEFAULT_AUTHORIZATION_WAIT_MS = 10_000;
+
+export function createHostToolRelayAuthorization({
+  serverName,
+  toolNames,
+  ttlMs = DEFAULT_AUTHORIZATION_WAIT_MS,
+}: {
+  serverName: string;
+  toolNames: ReadonlyArray<string>;
+  ttlMs?: number;
+}): {
+  observeUpdate(options: { update: SessionUpdate }): void;
+  observeAllowedPermission(options: { toolCall: ToolCallUpdate }): void;
+  waitForToolCallAuthorization(options: HostToolCall): Promise<boolean>;
+  close(): void;
+} {
+  const observedCalls = new Map<string, ObservedCall>();
+  const authorizations = new Map<string, string>();
+  const pendingRequests: Array<{
+    key: string;
+    timeout: ReturnType<typeof setTimeout>;
+    resolve: (authorized: boolean) => void;
+  }> = [];
+  let closed = false;
+
+  const observe = ({ toolCall }: { toolCall: ToolCallUpdate }) => {
+    if (closed) return;
+    const previous = observedCalls.get(toolCall.toolCallId);
+    if (previous?.consumed || previous?.terminal) return;
+    const merged: ToolCallUpdate = {
+      ...previous?.toolCall,
+      ...toolCall,
+      ...(toolCall.name == null && previous?.toolCall.name != null
+        ? { name: previous.toolCall.name }
+        : {}),
+      ...(toolCall.rawInput === undefined &&
+      previous?.toolCall.rawInput !== undefined
+        ? { rawInput: previous.toolCall.rawInput }
+        : {}),
+      ...(toolCall.title == null && previous?.toolCall.title != null
+        ? { title: previous.toolCall.title }
+        : {}),
+      ...(toolCall._meta == null && previous?.toolCall._meta != null
+        ? { _meta: previous.toolCall._meta }
+        : {}),
+    };
+    const observed: ObservedCall = {
+      toolCall: merged,
+      consumed: false,
+      terminal: merged.status === 'completed' || merged.status === 'failed',
+    };
+    observedCalls.set(toolCall.toolCallId, observed);
+    if (observed.terminal) {
+      authorizations.delete(toolCall.toolCallId);
+      return;
+    }
+
+    const call = resolveHostToolCall({
+      toolCall: merged,
+      serverName,
+      toolNames,
+    });
+    if (call == null) {
+      authorizations.delete(toolCall.toolCallId);
+      return;
+    }
+    const key = callKey(call);
+    authorizations.set(toolCall.toolCallId, key);
+    const pendingIndex = pendingRequests.findIndex(
+      request => request.key === key,
+    );
+    if (pendingIndex !== -1) {
+      const [pending] = pendingRequests.splice(pendingIndex, 1);
+      clearTimeout(pending.timeout);
+      authorizations.delete(toolCall.toolCallId);
+      observed.consumed = true;
+      pending.resolve(true);
+    }
+  };
+
+  return {
+    observeUpdate: ({ update }) => {
+      if (
+        update.sessionUpdate === 'tool_call' ||
+        update.sessionUpdate === 'tool_call_update'
+      ) {
+        observe({ toolCall: update });
+      }
+    },
+    observeAllowedPermission: ({ toolCall }) => observe({ toolCall }),
+    waitForToolCallAuthorization: ({ toolName, input }) => {
+      if (closed) return Promise.resolve(false);
+      const key = callKey({ toolName, input });
+      for (const [toolCallId, authorizationKey] of authorizations) {
+        if (authorizationKey !== key) continue;
+        authorizations.delete(toolCallId);
+        observedCalls.get(toolCallId)!.consumed = true;
+        return Promise.resolve(true);
+      }
+      return new Promise(resolve => {
+        const pending = {
+          key,
+          timeout: setTimeout(() => {
+            const index = pendingRequests.indexOf(pending);
+            if (index !== -1) pendingRequests.splice(index, 1);
+            resolve(false);
+          }, ttlMs),
+          resolve,
+        };
+        pendingRequests.push(pending);
+      });
+    },
+    close: () => {
+      if (closed) return;
+      closed = true;
+      observedCalls.clear();
+      authorizations.clear();
+      for (const request of pendingRequests.splice(0)) {
+        clearTimeout(request.timeout);
+        request.resolve(false);
+      }
+    },
+  };
+}
+
+function resolveHostToolCall({
+  toolCall,
+  serverName,
+  toolNames,
+}: {
+  toolCall: ToolCallUpdate;
+  serverName: string;
+  toolNames: ReadonlyArray<string>;
+}): HostToolCall | undefined {
+  const rawInput = toolCall.rawInput;
+  if (!isRecord(rawInput)) return undefined;
+  const isDeferred = 'tool_name' in rawInput;
+  const isProvider =
+    'providerIdentifier' in rawInput &&
+    'toolName' in rawInput &&
+    'args' in rawInput;
+  const isOrigin =
+    'origin' in rawInput && 'operation' in rawInput && 'arguments' in rawInput;
+  const isCodex =
+    'server' in rawInput && 'tool' in rawInput && 'arguments' in rawInput;
+  if ([isDeferred, isProvider, isOrigin, isCodex].filter(Boolean).length > 1) {
+    return undefined;
+  }
+  const matches: HostToolCall[] = [];
+  for (const toolName of toolNames) {
+    const qualifiedNames = [
+      `mcp__${serverName}__${toolName}`,
+      `${serverName}__${toolName}`,
+      `mcp_${serverName}_${toolName}`,
+    ];
+    const isQualified = (value: unknown) =>
+      typeof value === 'string' && qualifiedNames.includes(value);
+    const isDirect =
+      toolCall.name === toolName &&
+      isRecord(toolCall._meta) &&
+      toolCall._meta.serverName === serverName;
+    if (
+      isDeferred &&
+      isQualified(rawInput.tool_name) &&
+      isRecord(rawInput.tool_input) &&
+      (toolCall.name == null ||
+        toolCall.name === 'use_tool' ||
+        isQualified(toolCall.name))
+    ) {
+      matches.push({ toolName, input: rawInput.tool_input });
+    } else if (
+      isProvider &&
+      rawInput.providerIdentifier === serverName &&
+      rawInput.toolName === toolName &&
+      isRecord(rawInput.args) &&
+      (toolCall.name == null || isQualified(toolCall.name))
+    ) {
+      matches.push({ toolName, input: rawInput.args });
+    } else if (
+      isCodex &&
+      rawInput.server === serverName &&
+      rawInput.tool === toolName &&
+      isRecord(rawInput.arguments) &&
+      (toolCall.name == null || isQualified(toolCall.name))
+    ) {
+      matches.push({ toolName, input: rawInput.arguments });
+    } else if (
+      isOrigin &&
+      rawInput.origin === serverName &&
+      rawInput.operation === toolName &&
+      isRecord(rawInput.arguments) &&
+      (toolCall.name == null ||
+        toolCall.name === toolName ||
+        isQualified(toolCall.name))
+    ) {
+      matches.push({ toolName, input: rawInput.arguments });
+    } else if (
+      !isDeferred &&
+      !isProvider &&
+      !isOrigin &&
+      !isCodex &&
+      (isDirect ||
+        isQualified(toolCall.name) ||
+        (toolCall.name == null &&
+          (isQualified(toolCall.title) ||
+            toolCall.title === `${serverName}-${toolName}`)))
+    ) {
+      matches.push({ toolName, input: rawInput });
+    }
+  }
+  return matches.length === 1 ? matches[0] : undefined;
+}
+
+function callKey({ toolName, input }: HostToolCall): string {
+  return `${toolName}\0${canonicalFingerprint({ value: input })}`;
+}
+
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+  return value != null && typeof value === 'object' && !Array.isArray(value);
+}

package/src/v1/bridge/host-tool-relay.ts

@@ -3,6 +3,7 @@ import { createServer, type IncomingMessage, type Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 import type { HarnessV1BridgeToolWire } from '@ai-sdk/harness';
 import type { ACPHostToolMCPTransport } from '../acp-v1-settings';
+import { canonicalFingerprint } from './canonical-json-fingerprint';
 import {
   createHostToolMCPHttpEndpoint,
   HOST_TOOL_MCP_ENDPOINT_PATH,
@@ -18,6 +19,10 @@ export type HostToolCorrelationInvocation = {
 };
 
 export type HostToolRelayTurn = {
+  readonly waitForToolCallAuthorization: (options: {
+    toolName: string;
+    input: Readonly<Record<string, unknown>>;
+  }) => Promise<boolean>;
   readonly emitToolCall: (options: {
     toolCallId: string;
     toolName: string;
@@ -384,6 +389,18 @@ async function handleInvocation({
     });
   }
 
+  if (
+    !(await turn.waitForToolCallAuthorization({
+      toolName: tool.name,
+      input: body.input,
+    }))
+  ) {
+    throw new RelayRequestError({
+      status: 401,
+      message: 'Unauthorized host tool relay request.',
+    });
+  }
+
   const correlationToken = randomBytes(32).toString('hex');
   turn.registerCorrelationInvocation({
     token: correlationToken,
@@ -494,20 +511,7 @@ export function catalogFingerprint({
 }: {
   tools: ReadonlyArray<HarnessV1BridgeToolWire>;
 }): string {
-  return JSON.stringify(canonicalizeJSON({ value: tools }));
-}
-
-function canonicalizeJSON({ value }: { value: unknown }): unknown {
-  if (Array.isArray(value)) {
-    return value.map(item => canonicalizeJSON({ value: item }));
-  }
-  if (!isRecord(value)) return value;
-  return Object.fromEntries(
-    Object.keys(value)
-      .sort()
-      .filter(key => value[key] !== undefined)
-      .map(key => [key, canonicalizeJSON({ value: value[key] })]),
-  );
+  return canonicalFingerprint({ value: tools });
 }
 
 async function readJSONBody({

package/src/v1/bridge/index.ts

@@ -37,6 +37,7 @@ import {
   type HostToolRelay,
   type HostToolRelayTurn,
 } from './host-tool-relay';
+import { createHostToolRelayAuthorization } from './host-tool-relay-authorization';
 import { createHostToolMcpServerDefinition } from './host-tool-mcp-definition';
 import {
   promptAndRefreshInitialHostToolCatalog,
@@ -236,9 +237,14 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
   void cancellationFailure.catch(() => {});
   let cancellationRequested = false;
   let cancellationFailureError: Error | undefined;
+  const hostToolAuthorization = createHostToolRelayAuthorization({
+    serverName: HOST_TOOL_MCP_SERVER_NAME,
+    toolNames: (start.tools ?? []).map(tool => tool.name),
+  });
   const cancel = async () => {
     if (cancellationRequested) return;
     cancellationRequested = true;
+    hostToolAuthorization.close();
     activePermissionController?.cancelAll();
     try {
       if (connection == null) {
@@ -296,9 +302,12 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
     hasPermissionModeMapping: start.permissionModeMapping != null,
     emitToolCall: emitStreamEvent.permissionToolCall,
     claimHostToolPermission: emitStreamEvent.claimHostToolPermission,
+    onHostToolPermissionAllowed: hostToolAuthorization.observeAllowedPermission,
   });
   activePermissionController = permissionController;
   const relayTurn: HostToolRelayTurn = {
+    waitForToolCallAuthorization:
+      hostToolAuthorization.waitForToolCallAuthorization,
     emitToolCall: emitStreamEvent.hostToolCall,
     emitToolResult: emitStreamEvent.hostToolResult,
     requestToolResult: toolCallId => turn.requestToolResult(toolCallId),
@@ -366,6 +375,7 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
         const captured = streamCapture?.takeForUpdate({
           update: message.update,
         });
+        hostToolAuthorization.observeUpdate({ update: message.update });
         for (const rawValue of captured?.precedingRawValues ?? []) {
           emitStreamEvent.raw({ rawValue });
         }
@@ -381,6 +391,7 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
       if (emitStreamEvent.message({ message })) return;
     }
   } finally {
+    hostToolAuthorization.close();
     if (activeQuestionRequest?.turn === turn) {
       activeQuestionRequest = undefined;
     }

package/src/v1/bridge/permission-controller.ts

@@ -19,6 +19,7 @@ export function createACPPermissionController({
   hasPermissionModeMapping,
   emitToolCall,
   claimHostToolPermission,
+  onHostToolPermissionAllowed,
 }: {
   turn: BridgeTurn;
   sessionId: string;
@@ -26,6 +27,7 @@ export function createACPPermissionController({
   hasPermissionModeMapping: boolean;
   emitToolCall: (options: { toolCall: ToolCallUpdate }) => void;
   claimHostToolPermission: (options: { toolCall: ToolCallUpdate }) => boolean;
+  onHostToolPermissionAllowed?: (options: { toolCall: ToolCallUpdate }) => void;
 }): {
   requestPermission(
     request: RequestPermissionRequest,
@@ -63,6 +65,7 @@ export function createACPPermissionController({
         return cancelled();
       }
       if (claimHostToolPermission({ toolCall: request.toolCall })) {
+        onHostToolPermissionAllowed?.({ toolCall: request.toolCall });
         return {
           outcome: {
             outcome: 'selected',