@ai-sdk/harness-claude-code 1.0.174 → 1.0.176

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @ai-sdk/harness-claude-code
 
+## 1.0.176
+
+### Patch Changes
+
+- e3f24b6: fix(harness-claude-code): require approval when accessing files outside of workDir with permission modes `allow-reads` and `allow-edits`
+- Updated dependencies [51ca5b7]
+- Updated dependencies [8a20b57]
+- Updated dependencies [dc6f1c3]
+- Updated dependencies [4ae6986]
+  - @ai-sdk/provider-utils@5.0.73
+  - @ai-sdk/harness@1.0.172
+
+## 1.0.175
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.171
+
 ## 1.0.174
 
 ### Patch Changes

package/dist/bridge/index.mjs

@@ -1,4 +1,4 @@
-import { appendFile, mkdir, writeFile } from "node:fs/promises";
+import { appendFile, lstat, mkdir, realpath, writeFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { argv, env, pid, stdout } from "node:process";
@@ -7,6 +7,7 @@ import * as claudeAgentSdk from "@anthropic-ai/claude-agent-sdk";
 import * as mcpServerModule from "@modelcontextprotocol/sdk/server/mcp.js";
 import { isDeepStrictEqual } from "node:util";
 import { z } from "zod/v4";
+import path from "node:path";
 //#region ../harness/dist/bridge/index.js
 const name = "AI_HarnessBridgeCapabilityUnsupportedError";
 /**
@@ -1315,6 +1316,53 @@ function isJsonLiteral(value) {
 	return value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
 }
 //#endregion
+//#region src/bridge/permission-paths.ts
+async function areFileToolPathsTrusted(options) {
+	if (options.paths.length === 0) return false;
+	try {
+		const roots = [await realpath(options.workDir)];
+		if (options.access === "read") for (const root of options.readableSkillRoots) try {
+			roots.push(await realpath(root));
+		} catch {
+			continue;
+		}
+		for (const filePath of options.paths) {
+			if (typeof filePath !== "string" || filePath.length === 0 || filePath !== filePath.trim() || filePath === "~" || filePath.startsWith("~/")) return false;
+			if (!path.posix.isAbsolute(filePath) && !path.posix.isAbsolute(options.cwd)) return false;
+			const absolutePath = path.posix.isAbsolute(filePath) ? filePath : `${options.cwd}/${filePath}`;
+			for (const candidatePath of [absolutePath, path.posix.normalize(absolutePath)]) {
+				const candidate = await resolvePermissionPath({ filePath: candidatePath });
+				if (!roots.some((root) => {
+					const relative = path.posix.relative(root, candidate);
+					return relative === "" || relative !== ".." && !relative.startsWith("../") && !path.posix.isAbsolute(relative);
+				})) return false;
+			}
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function resolvePermissionPath(options) {
+	let existingPath = options.filePath;
+	const missing = [];
+	for (;;) {
+		let exists = true;
+		try {
+			await lstat(existingPath);
+		} catch (error) {
+			if (error == null || typeof error !== "object" || !("code" in error) || error.code !== "ENOENT") throw error;
+			exists = false;
+		}
+		if (exists) return path.posix.join(await realpath(existingPath), ...missing);
+		const parent = path.posix.dirname(existingPath);
+		const segment = path.posix.basename(existingPath);
+		if (parent === existingPath || segment === "." || segment === "..") throw new Error("Unable to resolve permission path.");
+		missing.unshift(segment);
+		existingPath = parent;
+	}
+}
+//#endregion
 //#region src/bridge/tool-filtering.ts
 const PUBLIC_TO_NATIVE = {
 	read: "Read",
@@ -1503,10 +1551,14 @@ function createPermissionOptions(input) {
 	return {
 		...baseOptions,
 		canUseTool: async (toolName, toolInput, options) => {
-			if (!needsHostApproval({
+			if (!await needsHostApproval({
 				toolName,
+				toolInput,
 				permissionMode,
-				inactiveNativeTools
+				inactiveNativeTools,
+				cwd: input.toolCwds.get(options.toolUseID) ?? "",
+				readableSkillRoots: input.start.readableSkillRoots ?? [],
+				blockedPath: options.blockedPath
 			})) return {
 				behavior: "allow",
 				updatedInput: toolInput
@@ -1615,17 +1667,56 @@ function createGatewayModelOverrides(model) {
 	const id = model.slice(10).replace(/\[[^\]]*\]$/, "");
 	return id.includes(".") ? { [id.replace(/\./g, "-")]: model } : void 0;
 }
-function needsHostApproval(input) {
+async function needsHostApproval(input) {
 	if (input.toolName.startsWith("mcp__harness-tools__")) return false;
-	return input.inactiveNativeTools.has(input.toolName) || nativeToolRequiresApproval({
+	if (input.inactiveNativeTools.has(input.toolName) || nativeToolRequiresApproval({
 		nativeName: input.toolName,
 		permissionMode: input.permissionMode
+	})) return true;
+	const args = input.toolInput != null && typeof input.toolInput === "object" ? input.toolInput : {};
+	let paths;
+	let access;
+	if (input.toolName === "Glob" && (typeof args.pattern !== "string" || /\.\.|[{}()[\]]/.test(args.pattern) || args.pattern.includes("\\") || args.pattern.startsWith("/"))) return true;
+	switch (input.toolName) {
+		case "Read":
+			paths = [args.file_path];
+			access = "read";
+			break;
+		case "Write":
+		case "Edit":
+			paths = [args.file_path];
+			access = "write";
+			break;
+		case "NotebookEdit":
+			paths = [args.notebook_path];
+			access = "write";
+			break;
+		case "Glob":
+		case "Grep":
+			paths = [args.path ?? input.cwd];
+			access = "read";
+			break;
+		default:
+			if (input.blockedPath == null) return false;
+			paths = [];
+			access = "read";
+	}
+	if (input.blockedPath != null) paths.push(input.blockedPath);
+	if (!paths.every((value) => typeof value === "string")) return true;
+	return !await areFileToolPathsTrusted({
+		workDir: workdir,
+		cwd: input.cwd,
+		paths,
+		access,
+		readableSkillRoots: input.readableSkillRoots
 	});
 }
 function createApprovalPreToolUseHook(input) {
 	return async (hookInput, toolUseID) => {
+		if (hookInput.hook_event_name !== "PreToolUse") return {};
 		const toolName = hookInput.tool_name;
 		if (toolUseID == null || typeof toolName !== "string" || toolName === "AskUserQuestion") return {};
+		input.toolCwds.set(toolUseID, hookInput.cwd);
 		const decision = input.decisions.get(toolUseID);
 		if (decision != null) {
 			input.nativeToolCallNames.set(toolUseID, toolName);
@@ -1638,8 +1729,11 @@ function createApprovalPreToolUseHook(input) {
 				}
 			} };
 		}
-		if (!needsHostApproval({
+		if (!await needsHostApproval({
 			toolName,
+			toolInput: hookInput.tool_input,
+			cwd: hookInput.cwd,
+			readableSkillRoots: input.readableSkillRoots,
 			permissionMode: input.permissionMode,
 			inactiveNativeTools: input.inactiveNativeTools
 		})) return {};
@@ -1652,6 +1746,8 @@ function createApprovalPreToolUseHook(input) {
 }
 function nativeToolRequiresApproval(input) {
 	if (input.permissionMode === "allow-all") return false;
+	if (input.nativeName === "EnterWorktree" || input.nativeName === "ExitWorktree") return true;
+	if (!(input.nativeName in NATIVE_TOOL_KINDS)) return true;
 	const kind = NATIVE_TOOL_KINDS[input.nativeName] ?? "edit";
 	if (input.permissionMode === "allow-edits") return kind === "bash";
 	return kind === "edit" || kind === "bash";
@@ -1768,7 +1864,9 @@ async function runTurn(start, turn) {
 	const inactiveNativeTools = resolveInactiveNativeTools(start.builtinToolFiltering);
 	const permissionMode = start.permissionMode ?? "allow-all";
 	const approvalDecisions = /* @__PURE__ */ new Map();
+	const toolCwds = /* @__PURE__ */ new Map();
 	const permissionOptions = createPermissionOptions({
+		toolCwds,
 		approvalDecisions,
 		start,
 		inactiveNativeTools,
@@ -1790,6 +1888,8 @@ async function runTurn(start, turn) {
 	const modelOverrides = createGatewayModelOverrides(start.model);
 	const deferredToolUseIds = /* @__PURE__ */ new Set();
 	const approvalPreToolUseHook = createApprovalPreToolUseHook({
+		toolCwds,
+		readableSkillRoots: start.readableSkillRoots ?? [],
 		permissionMode,
 		inactiveNativeTools: new Set(inactiveNativeTools),
 		decisions: approvalDecisions,