@ai-sdk/harness-claude-code 1.0.11 → 1.0.13

package/src/bridge/index.ts

@@ -9,7 +9,6 @@ import {
   type BridgeEvent,
   type BridgeTurn,
 } from '@ai-sdk/harness/bridge';
-import type { HarnessV1BuiltinToolName } from '@ai-sdk/harness';
 import { createCompactionLatch } from './compaction-latch';
 import type { StartMessage } from '../claude-code-bridge-protocol';
 import { randomUUID } from 'node:crypto';
@@ -42,7 +41,16 @@ import { toClaudeSkillsOption } from './claude-skills-option';
  * map (e.g. `WebFetch`, `NotebookEdit`) have no common equivalent; their
  * native name is forwarded as-is on `tool-call` events.
  */
-const NATIVE_TO_COMMON: Readonly<Record<string, HarnessV1BuiltinToolName>> = {
+type CommonBuiltinToolName =
+  | 'read'
+  | 'write'
+  | 'edit'
+  | 'bash'
+  | 'glob'
+  | 'grep'
+  | 'webSearch';
+
+const NATIVE_TO_COMMON: Readonly<Record<string, CommonBuiltinToolName>> = {
   Read: 'read',
   Write: 'write',
   Edit: 'edit',
@@ -52,6 +60,36 @@ const NATIVE_TO_COMMON: Readonly<Record<string, HarnessV1BuiltinToolName>> = {
   WebSearch: 'webSearch',
 };
 
+const PUBLIC_TO_NATIVE: Readonly<Record<string, string>> = {
+  read: 'Read',
+  write: 'Write',
+  edit: 'Edit',
+  bash: 'Bash',
+  glob: 'Glob',
+  grep: 'Grep',
+  webSearch: 'WebSearch',
+  WebFetch: 'WebFetch',
+  NotebookEdit: 'NotebookEdit',
+  TodoWrite: 'TodoWrite',
+  Agent: 'Agent',
+  TaskCreate: 'TaskCreate',
+  TaskGet: 'TaskGet',
+  TaskUpdate: 'TaskUpdate',
+  TaskList: 'TaskList',
+  TaskStop: 'TaskStop',
+  TaskOutput: 'TaskOutput',
+  Monitor: 'Monitor',
+  ListMcpResources: 'ListMcpResources',
+  ReadMcpResource: 'ReadMcpResource',
+  ExitPlanMode: 'ExitPlanMode',
+  EnterWorktree: 'EnterWorktree',
+  ExitWorktree: 'ExitWorktree',
+  AskUserQuestion: 'AskUserQuestion',
+  Skill: 'Skill',
+};
+
+const PUBLIC_TOOL_NAMES = Object.keys(PUBLIC_TO_NATIVE);
+
 const NATIVE_TOOL_KINDS: Readonly<
   Record<string, 'readonly' | 'edit' | 'bash'>
 > = {
@@ -78,12 +116,41 @@ const NATIVE_TOOL_KINDS: Readonly<
   Skill: 'edit',
   AskUserQuestion: 'readonly',
   Bash: 'bash',
+  Monitor: 'bash',
 };
 
-function toCommonName(nativeName: string): HarnessV1BuiltinToolName | string {
+function toCommonName(nativeName: string): CommonBuiltinToolName | string {
   return NATIVE_TO_COMMON[nativeName] ?? nativeName;
 }
 
+function toNativeName(toolName: string): string {
+  return PUBLIC_TO_NATIVE[toolName] ?? toolName;
+}
+
+function resolveNativeTools(start: StartMessage): string[] | undefined {
+  const toolFiltering = start.builtinToolFiltering;
+  if (toolFiltering == null) return undefined;
+  const activeToolNames =
+    toolFiltering.mode === 'allow'
+      ? toolFiltering.toolNames
+      : PUBLIC_TOOL_NAMES.filter(
+          name => !toolFiltering.toolNames.includes(name),
+        );
+  return activeToolNames.map(name => toNativeName(name));
+}
+
+function resolveInactiveNativeTools(start: StartMessage): string[] {
+  const toolFiltering = start.builtinToolFiltering;
+  if (toolFiltering == null) return [];
+  const inactiveToolNames =
+    toolFiltering.mode === 'allow'
+      ? PUBLIC_TOOL_NAMES.filter(
+          name => !toolFiltering.toolNames.includes(name),
+        )
+      : toolFiltering.toolNames;
+  return inactiveToolNames.map(name => toNativeName(name));
+}
+
 /*
  * The harness exposes a coarse `'off' | 'on' | 'adaptive'` thinking setting,
  * but the Claude Agent SDK's `thinking` option takes a structured
@@ -146,13 +213,19 @@ type Emit = (msg: Record<string, unknown>) => void;
 
 function createPermissionOptions(input: {
   start: StartMessage;
+  inactiveNativeTools: readonly string[];
   turn: BridgeTurn;
   emit: Emit;
   nativeToolCallNames: Map<string, string>;
   approvalRequestedToolUseIds: Set<string>;
 }): Record<string, unknown> {
   const permissionMode = input.start.permissionMode ?? 'allow-all';
-  if (permissionMode === 'allow-all') {
+  const inactiveNativeTools = new Set(input.inactiveNativeTools);
+  const permissionSettings = createPermissionSettings({
+    permissionMode,
+    inactiveNativeTools,
+  });
+  if (permissionMode === 'allow-all' && inactiveNativeTools.size === 0) {
     return {
       permissionMode: 'bypassPermissions',
       allowDangerouslySkipPermissions: true,
@@ -163,7 +236,7 @@ function createPermissionOptions(input: {
     permissionMode:
       permissionMode === 'allow-edits' ? 'acceptEdits' : 'default',
     allowDangerouslySkipPermissions: false,
-    settings: createPermissionSettings({ permissionMode }),
+    ...(permissionSettings ? { settings: permissionSettings } : {}),
     canUseTool: async (
       toolName: string,
       toolInput: Record<string, unknown>,
@@ -173,6 +246,7 @@ function createPermissionOptions(input: {
         return { behavior: 'allow', updatedInput: toolInput };
       }
       if (
+        !inactiveNativeTools.has(toolName) &&
         !nativeToolRequiresApproval({
           nativeName: toolName,
           permissionMode,
@@ -212,21 +286,26 @@ function createPermissionOptions(input: {
 
 function createPermissionSettings(input: {
   permissionMode: 'allow-reads' | 'allow-edits' | 'allow-all';
+  inactiveNativeTools: ReadonlySet<string>;
 }): Record<string, unknown> | undefined {
-  const askRules = Object.entries(NATIVE_TOOL_KINDS)
-    .filter(([, kind]) =>
-      input.permissionMode === 'allow-reads'
+  const askRules = new Set<string>();
+  for (const [nativeName, kind] of Object.entries(NATIVE_TOOL_KINDS)) {
+    if (
+      input.inactiveNativeTools.has(nativeName) ||
+      (input.permissionMode === 'allow-reads'
         ? kind === 'edit' || kind === 'bash'
         : input.permissionMode === 'allow-edits'
           ? kind === 'bash'
-          : false,
-    )
-    .map(([nativeName]) => `${nativeName}(*)`);
+          : false)
+    ) {
+      askRules.add(`${nativeName}(*)`);
+    }
+  }
 
-  if (askRules.length === 0) return undefined;
+  if (askRules.size === 0) return undefined;
 
   return {
-    permissions: { ask: askRules },
+    permissions: { ask: [...askRules] },
     sandbox: { autoAllowBashIfSandboxed: false },
   };
 }
@@ -330,8 +409,11 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
     abortSignal: abortCtl.signal,
   });
   const skillsOption = toClaudeSkillsOption(start.skills);
+  const nativeTools = resolveNativeTools(start);
+  const inactiveNativeTools = resolveInactiveNativeTools(start);
   const permissionOptions = createPermissionOptions({
     start,
+    inactiveNativeTools,
     turn,
     emit,
     nativeToolCallNames,
@@ -344,6 +426,10 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
       ...(start.model ? { model: start.model } : {}),
       ...(start.maxTurns !== undefined ? { maxTurns: start.maxTurns } : {}),
       ...(skillsOption ? { skills: skillsOption } : {}),
+      ...(nativeTools !== undefined ? { tools: nativeTools } : {}),
+      ...(inactiveNativeTools.length > 0
+        ? { disallowedTools: inactiveNativeTools }
+        : {}),
       ...(toThinkingConfig(start.thinking)
         ? { thinking: toThinkingConfig(start.thinking) }
         : {}),

package/src/claude-code-harness.ts

@@ -1,6 +1,5 @@
 import { randomBytes } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
   commonTool,
@@ -8,9 +7,10 @@ import {
   HarnessCapabilityUnsupportedError,
   type HarnessV1,
   type HarnessV1Bootstrap,
-  type HarnessV1DebugConfig,
+  type HarnessV1BuiltinToolFiltering,
   type HarnessV1BuiltinTool,
   type HarnessV1ContinueTurnState,
+  type HarnessV1DebugConfig,
   type HarnessV1PermissionMode,
   type HarnessV1Prompt,
   type HarnessV1PromptControl,
@@ -23,8 +23,11 @@ import {
 import {
   classifyDiskLog,
   markBridgeStarting,
+  resolveSandboxHomeDir,
   SandboxChannel,
+  shellQuote,
   waitForBridgeReady,
+  writeSkills as writeHarnessSkills,
 } from '@ai-sdk/harness/utils';
 import {
   tool,
@@ -276,6 +279,15 @@ const CLAUDE_CODE_BUILTIN_TOOLS = {
       timeout: z.number(),
     }),
   }),
+  Monitor: tool({
+    description: 'Run and monitor a shell command',
+    inputSchema: z.object({
+      command: z.string(),
+      description: z.string().optional(),
+      timeout_ms: z.number().optional(),
+      persistent: z.boolean().optional(),
+    }),
+  }),
   ListMcpResources: tool({
     description: 'List resources available from MCP servers',
     inputSchema: z.object({ server: z.string().optional() }),
@@ -404,6 +416,7 @@ export function createClaudeCode(
     harnessId: 'claude-code',
     builtinTools: CLAUDE_CODE_BUILTIN_TOOLS,
     supportsBuiltinToolApprovals: true,
+    supportsBuiltinToolFiltering: true,
     lifecycleStateSchema: claudeCodeResumeStateSchema,
     getBootstrap: async () => {
       if (cachedBootstrap != null) return cachedBootstrap;
@@ -509,6 +522,7 @@ export function createClaudeCode(
             sandboxId,
             debug: startOpts.observability?.debug,
             permissionMode: startOpts.permissionMode,
+            builtinToolFiltering: startOpts.builtinToolFiltering,
             skills: startOpts.skills ?? [],
           });
         } catch {
@@ -575,7 +589,7 @@ export function createClaudeCode(
           if (!sandboxHomeDir) {
             throw new Error('Unable to resolve sandbox HOME directory.');
           }
-          await writeSkills({
+          await writeClaudeCodeSkills({
             sandbox: session,
             homeDir: sandboxHomeDir,
             skills: startOpts.skills,
@@ -671,6 +685,7 @@ export function createClaudeCode(
         sandboxId,
         debug: startOpts.observability?.debug,
         permissionMode: startOpts.permissionMode,
+        builtinToolFiltering: startOpts.builtinToolFiltering,
         skills: startOpts.skills ?? [],
       });
     },
@@ -698,7 +713,7 @@ function resolveBridgePort(
  * be in place before the bridge is spawned without mutating the session
  * workdir. Each file uses the YAML-frontmatter shape the CLI expects.
  */
-async function writeSkills({
+async function writeClaudeCodeSkills({
   sandbox,
   homeDir,
   skills,
@@ -709,89 +724,17 @@ async function writeSkills({
   skills: ReadonlyArray<HarnessV1Skill>;
   abortSignal?: AbortSignal;
 }): Promise<void> {
-  for (const skill of skills) {
-    safeClaudeSkillName(skill.name);
-    for (const file of skill.files ?? []) {
-      safeClaudeSkillFilePath({
-        skillName: skill.name,
-        filePath: file.path,
-      });
-    }
-  }
-
-  await sandbox.run({
-    command: `mkdir -p ${shellQuote(homeDir)}/.claude/skills`,
-    abortSignal,
-  });
-  for (const skill of skills) {
-    const name = safeClaudeSkillName(skill.name);
-    const skillDir = `${homeDir}/.claude/skills/${name}`;
-    const path = `${skillDir}/SKILL.md`;
-    const content = `---\nname: ${skill.name}\ndescription: ${skill.description}\n---\n\n${skill.content}\n`;
-    await sandbox.writeTextFile({ path, content, abortSignal });
-    for (const file of skill.files ?? []) {
-      const filePath = safeClaudeSkillFilePath({
-        skillName: skill.name,
-        filePath: file.path,
-      });
-      await sandbox.writeTextFile({
-        path: `${skillDir}/${filePath}`,
-        content: file.content,
-        abortSignal,
-      });
-    }
-  }
-}
-
-async function resolveSandboxHomeDir({
-  sandbox,
-  abortSignal,
-}: {
-  sandbox: Experimental_SandboxSession;
-  abortSignal?: AbortSignal;
-}): Promise<string> {
-  const result = await sandbox.run({
-    command: 'printf "%s" "$HOME"',
+  await writeHarnessSkills({
+    sandbox,
+    rootDir: `${homeDir}/.claude/skills`,
+    skills,
     abortSignal,
-  });
-  const homeDir = result.stdout.trim();
-  if (result.exitCode !== 0 || !homeDir || !path.posix.isAbsolute(homeDir)) {
-    throw new Error(
-      `Unable to resolve sandbox HOME directory: ${result.stderr || result.stdout}`,
-    );
-  }
-  return homeDir;
-}
-
-function safeClaudeSkillName(name: string): string {
-  if (!/^[A-Za-z0-9._-]+$/.test(name) || name === '.' || name === '..') {
-    throw new Error(`Invalid Claude Code skill name: ${name}`);
-  }
-  return name;
-}
-
-function safeClaudeSkillFilePath({
-  skillName,
-  filePath,
-}: {
-  skillName: string;
-  filePath: string;
-}): string {
-  const normalized = path.posix.normalize(filePath);
-  if (
-    normalized === '.' ||
-    normalized.startsWith('../') ||
-    path.posix.isAbsolute(normalized)
-  ) {
-    throw new Error(
+    invalidSkillNameMessage: ({ name }) =>
+      `Invalid Claude Code skill name: ${name}`,
+    invalidSkillFilePathMessage: ({ skillName, filePath }) =>
       `Invalid Claude Code skill file path for ${skillName}: ${filePath}`,
-    );
-  }
-  return normalized;
-}
-
-function shellQuote(value: string): string {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+    trailingNewline: true,
+  });
 }
 
 async function readBridgeAsset(name: string): Promise<string> {
@@ -1104,6 +1047,7 @@ function createSession({
   sandboxId,
   debug,
   permissionMode,
+  builtinToolFiltering,
   skills,
 }: {
   sessionId: string;
@@ -1121,6 +1065,7 @@ function createSession({
   sandboxId: string;
   debug: HarnessV1DebugConfig | undefined;
   permissionMode: HarnessV1PermissionMode | undefined;
+  builtinToolFiltering: HarnessV1BuiltinToolFiltering | undefined;
   skills: ReadonlyArray<HarnessV1Skill>;
 }): HarnessV1Session {
   let stopped = false;
@@ -1306,6 +1251,7 @@ function createSession({
           ? { skills: skills.map(skill => skill.name) }
           : {}),
         ...(permissionMode ? { permissionMode } : {}),
+        ...(builtinToolFiltering ? { builtinToolFiltering } : {}),
         ...(debug ? { debug } : {}),
         ...(pendingResumeFlag ? { continue: true } : {}),
       };
@@ -1357,6 +1303,7 @@ function createSession({
             ? { skills: skills.map(skill => skill.name) }
             : {}),
           ...(permissionMode ? { permissionMode } : {}),
+          ...(builtinToolFiltering ? { builtinToolFiltering } : {}),
           ...(debug ? { debug } : {}),
           continue: true,
         });