@ai-sdk/harness-claude-code 1.0.175 → 1.0.176

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-claude-code",
-  "version": "1.0.175",
+  "version": "1.0.176",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -26,9 +26,9 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/harness": "1.0.171",
+    "@ai-sdk/harness": "1.0.172",
     "@ai-sdk/provider": "4.0.35",
-    "@ai-sdk/provider-utils": "5.0.72",
+    "@ai-sdk/provider-utils": "5.0.73",
     "ws": "^8.21.0"
   },
   "peerDependencies": {

package/src/bridge/index.ts

@@ -55,6 +55,7 @@ import {
   type ClaudeMessage,
 } from './create-emit-stream-event';
 import { jsonSchemaToZodObject } from './json-schema-to-zod';
+import { areFileToolPathsTrusted } from './permission-paths';
 import {
   resolveInactiveNativeTools,
   resolveNativeTools,
@@ -173,6 +174,7 @@ function createPermissionOptions(input: {
   approvalRequestedToolUseIds: Set<string>;
   emittedToolCallIds: Set<string>;
   approvalDecisions: Map<string, { approved: boolean; reason?: string }>;
+  toolCwds: Map<string, string>;
 }): Record<string, unknown> {
   const permissionMode = input.start.permissionMode ?? 'allow-all';
   const inactiveNativeTools = new Set(input.inactiveNativeTools);
@@ -210,10 +212,18 @@ function createPermissionOptions(input: {
     canUseTool: async (
       toolName: string,
       toolInput: Record<string, unknown>,
-      options: { toolUseID: string },
+      options: { toolUseID: string; blockedPath?: string },
     ) => {
       if (
-        !needsHostApproval({ toolName, permissionMode, inactiveNativeTools })
+        !(await needsHostApproval({
+          toolName,
+          toolInput,
+          permissionMode,
+          inactiveNativeTools,
+          cwd: input.toolCwds.get(options.toolUseID) ?? '',
+          readableSkillRoots: input.start.readableSkillRoots ?? [],
+          blockedPath: options.blockedPath,
+        }))
       ) {
         return { behavior: 'allow', updatedInput: toolInput };
       }
@@ -390,19 +400,72 @@ function createGatewayModelOverrides(
   return id.includes('.') ? { [id.replace(/\./g, '-')]: model } : undefined;
 }
 
-function needsHostApproval(input: {
+async function needsHostApproval(input: {
   toolName: string;
+  toolInput: unknown;
+  cwd: string;
+  readableSkillRoots: readonly string[];
+  blockedPath?: string;
   permissionMode: 'allow-reads' | 'allow-edits' | 'allow-all';
   inactiveNativeTools: ReadonlySet<string>;
-}): boolean {
+}): Promise<boolean> {
   if (input.toolName.startsWith('mcp__harness-tools__')) return false;
-  return (
+  if (
     input.inactiveNativeTools.has(input.toolName) ||
     nativeToolRequiresApproval({
       nativeName: input.toolName,
       permissionMode: input.permissionMode,
     })
-  );
+  )
+    return true;
+  const args =
+    input.toolInput != null && typeof input.toolInput === 'object'
+      ? (input.toolInput as Record<string, unknown>)
+      : {};
+  let paths: unknown[];
+  let access: 'read' | 'write';
+  if (
+    input.toolName === 'Glob' &&
+    (typeof args.pattern !== 'string' ||
+      /\.\.|[{}()[\]]/.test(args.pattern) ||
+      args.pattern.includes('\\') ||
+      args.pattern.startsWith('/'))
+  )
+    return true;
+  switch (input.toolName) {
+    case 'Read':
+      paths = [args.file_path];
+      access = 'read';
+      break;
+    case 'Write':
+    case 'Edit':
+      paths = [args.file_path];
+      access = 'write';
+      break;
+    case 'NotebookEdit':
+      paths = [args.notebook_path];
+      access = 'write';
+      break;
+    case 'Glob':
+    case 'Grep':
+      paths = [args.path ?? input.cwd];
+      access = 'read';
+      break;
+    default:
+      if (input.blockedPath == null) return false;
+      paths = [];
+      access = 'read';
+  }
+  if (input.blockedPath != null) paths.push(input.blockedPath);
+  if (!paths.every((value): value is string => typeof value === 'string'))
+    return true;
+  return !(await areFileToolPathsTrusted({
+    workDir: workdir!,
+    cwd: input.cwd,
+    paths,
+    access,
+    readableSkillRoots: input.readableSkillRoots,
+  }));
 }
 
 /*
@@ -418,8 +481,11 @@ function createApprovalPreToolUseHook(input: {
   decisions: Map<string, { approved: boolean; reason?: string }>;
   deferredToolUseIds: Set<string>;
   nativeToolCallNames: Map<string, string>;
+  readableSkillRoots: readonly string[];
+  toolCwds: Map<string, string>;
 }): HookCallback {
   return async (hookInput, toolUseID): Promise<HookJSONOutput> => {
+    if (hookInput.hook_event_name !== 'PreToolUse') return {};
     const toolName = (hookInput as { tool_name?: unknown }).tool_name;
     if (
       toolUseID == null ||
@@ -428,6 +494,7 @@ function createApprovalPreToolUseHook(input: {
     ) {
       return {};
     }
+    input.toolCwds.set(toolUseID, hookInput.cwd);
     const decision = input.decisions.get(toolUseID);
     if (decision != null) {
       // A bridge that resumes another bridge's deferred call never saw its
@@ -447,11 +514,14 @@ function createApprovalPreToolUseHook(input: {
       };
     }
     if (
-      !needsHostApproval({
+      !(await needsHostApproval({
         toolName,
+        toolInput: hookInput.tool_input,
+        cwd: hookInput.cwd,
+        readableSkillRoots: input.readableSkillRoots,
         permissionMode: input.permissionMode,
         inactiveNativeTools: input.inactiveNativeTools,
-      })
+      }))
     ) {
       return {};
     }
@@ -470,6 +540,12 @@ function nativeToolRequiresApproval(input: {
   permissionMode: 'allow-reads' | 'allow-edits' | 'allow-all';
 }): boolean {
   if (input.permissionMode === 'allow-all') return false;
+  if (
+    input.nativeName === 'EnterWorktree' ||
+    input.nativeName === 'ExitWorktree'
+  )
+    return true;
+  if (!(input.nativeName in NATIVE_TOOL_KINDS)) return true;
   const kind = NATIVE_TOOL_KINDS[input.nativeName] ?? 'edit';
   if (input.permissionMode === 'allow-edits') return kind === 'bash';
   return kind === 'edit' || kind === 'bash';
@@ -653,7 +729,9 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
     string,
     { approved: boolean; reason?: string }
   >();
+  const toolCwds = new Map<string, string>();
   const permissionOptions = createPermissionOptions({
+    toolCwds,
     approvalDecisions,
     start,
     inactiveNativeTools,
@@ -670,6 +748,8 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
   const modelOverrides = createGatewayModelOverrides(start.model);
   const deferredToolUseIds = new Set<string>();
   const approvalPreToolUseHook = createApprovalPreToolUseHook({
+    toolCwds,
+    readableSkillRoots: start.readableSkillRoots ?? [],
     permissionMode,
     inactiveNativeTools: new Set(inactiveNativeTools),
     decisions: approvalDecisions,

package/src/bridge/permission-paths.ts

@@ -0,0 +1,108 @@
+import { lstat, realpath } from 'node:fs/promises';
+import path from 'node:path';
+
+export async function areFileToolPathsTrusted(options: {
+  workDir: string;
+  cwd: string;
+  paths: readonly string[];
+  access: 'read' | 'write';
+  readableSkillRoots: readonly string[];
+}): Promise<boolean> {
+  if (options.paths.length === 0) return false;
+  try {
+    const roots = [await realpath(options.workDir)];
+    if (options.access === 'read') {
+      for (const root of options.readableSkillRoots) {
+        try {
+          roots.push(await realpath(root));
+        } catch {
+          continue;
+        }
+      }
+    }
+    for (const filePath of options.paths) {
+      /*
+       * Grep and Glob trim paths and expand home-directory shorthand after
+       * the approval hook. Require approval for these forms so a literal
+       * workdir-relative path cannot authorize a different resolved path.
+       */
+      if (
+        typeof filePath !== 'string' ||
+        filePath.length === 0 ||
+        filePath !== filePath.trim() ||
+        filePath === '~' ||
+        filePath.startsWith('~/')
+      ) {
+        return false;
+      }
+      if (
+        !path.posix.isAbsolute(filePath) &&
+        !path.posix.isAbsolute(options.cwd)
+      ) {
+        return false;
+      }
+      const absolutePath = path.posix.isAbsolute(filePath)
+        ? filePath
+        : `${options.cwd}/${filePath}`;
+      /*
+       * Native runtimes differ in whether they normalize parent components
+       * before filesystem access. Both interpretations must stay within a
+       * trusted root, including when a symlink precedes a parent component.
+       */
+      for (const candidatePath of [
+        absolutePath,
+        path.posix.normalize(absolutePath),
+      ]) {
+        const candidate = await resolvePermissionPath({
+          filePath: candidatePath,
+        });
+        if (
+          !roots.some(root => {
+            const relative = path.posix.relative(root, candidate);
+            return (
+              relative === '' ||
+              (relative !== '..' &&
+                !relative.startsWith('../') &&
+                !path.posix.isAbsolute(relative))
+            );
+          })
+        )
+          return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function resolvePermissionPath(options: {
+  filePath: string;
+}): Promise<string> {
+  let existingPath = options.filePath;
+  const missing: string[] = [];
+  for (;;) {
+    let exists = true;
+    try {
+      await lstat(existingPath);
+    } catch (error) {
+      if (
+        error == null ||
+        typeof error !== 'object' ||
+        !('code' in error) ||
+        error.code !== 'ENOENT'
+      )
+        throw error;
+      exists = false;
+    }
+    if (exists)
+      return path.posix.join(await realpath(existingPath), ...missing);
+    const parent = path.posix.dirname(existingPath);
+    const segment = path.posix.basename(existingPath);
+    if (parent === existingPath || segment === '.' || segment === '..') {
+      throw new Error('Unable to resolve permission path.');
+    }
+    missing.unshift(segment);
+    existingPath = parent;
+  }
+}

package/src/claude-code-bridge-protocol.ts

@@ -38,6 +38,7 @@ const skillOverridesSchema = z.record(
 
 export const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({
   prompt: harnessPromptContentSchema,
+  readableSkillRoots: z.array(z.string()).optional(),
   instructions: z.string().optional(),
   thinking: thinkingSchema,
   effort: z.enum(['low', 'medium', 'high', 'xhigh', 'max']).optional(),

package/src/claude-code-harness.ts

@@ -1670,7 +1670,12 @@ function createSession({
         thinking,
         ...(effort !== undefined ? { effort } : {}),
         ...(promptOpts.skills.length > 0
-          ? { skills: promptOpts.skills.map(skill => skill.name) }
+          ? {
+              skills: promptOpts.skills.map(skill => skill.name),
+              readableSkillRoots: promptOpts.skills.map(
+                skill => `${sandboxHomeDir}/.claude/skills/${skill.name}`,
+              ),
+            }
           : {}),
         ...(mcpServers == null ? {} : { mcpServers }),
         ...(toolHints == null ? {} : { toolHints }),
@@ -1749,7 +1754,12 @@ function createSession({
           thinking,
           ...(effort !== undefined ? { effort } : {}),
           ...(continueOpts.skills.length > 0
-            ? { skills: continueOpts.skills.map(skill => skill.name) }
+            ? {
+                skills: continueOpts.skills.map(skill => skill.name),
+                readableSkillRoots: continueOpts.skills.map(
+                  skill => `${sandboxHomeDir}/.claude/skills/${skill.name}`,
+                ),
+              }
             : {}),
           ...(mcpServers == null ? {} : { mcpServers }),
           ...(toolHints == null ? {} : { toolHints }),