@ai-sdk/harness-cline 1.0.7 → 1.0.9

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @ai-sdk/harness-cline
 
+## 1.0.9
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.82
+
+## 1.0.8
+
+### Patch Changes
+
+- cb78370: fix(harness-cline): fix bug with reading and writing files
+- Updated dependencies [7f50d28]
+  - @ai-sdk/harness@1.0.81
+
+## 1.0.8
+
+### Patch Changes
+
+- 016b944: fix(harness-cline): fix bug with reading and writing files
+  - @ai-sdk/harness@1.0.80
+
 ## 1.0.7
 
 ### Patch Changes

package/dist/index.js

@@ -229,23 +229,124 @@ import path2 from "path";
 import { shellQuote } from "@ai-sdk/harness/utils";
 function createClineRemoteOps(options) {
   const { sandbox, workDir } = options;
-  const resolvePath = (inputPath) => {
-    const normalized = path2.posix.isAbsolute(inputPath) ? path2.posix.normalize(inputPath) : path2.posix.normalize(path2.posix.join(workDir, inputPath));
+  const normalizedWorkDir = path2.posix.normalize(workDir);
+  const readableRoots = options.readableRoots?.map((root) => path2.posix.normalize(root.sandboxDir)) ?? [];
+  const isInsidePath = ({
+    parent,
+    candidate
+  }) => {
+    const relative = path2.posix.relative(parent, candidate);
+    return relative === "" || relative !== ".." && !relative.startsWith("../") && !path2.posix.isAbsolute(relative);
+  };
+  const assertWorkspacePath = (inputPath) => {
+    const normalized = path2.posix.normalize(inputPath);
+    if (!isInsidePath({ parent: normalizedWorkDir, candidate: normalized })) {
+      throw new Error(`Cline path escapes the workspace: ${inputPath}`);
+    }
+    return normalized;
+  };
+  const assertReadablePath = (inputPath) => {
+    const normalized = path2.posix.normalize(inputPath);
+    if (!isInsidePath({ parent: normalizedWorkDir, candidate: normalized }) && !readableRoots.some(
+      (parent) => isInsidePath({ parent, candidate: normalized })
+    )) {
+      throw new Error(`Cline path escapes the readable roots: ${inputPath}`);
+    }
     return normalized;
   };
-  const runShell = async (command, input) => {
+  const resolvePath = (inputPath) => {
+    const resolved = path2.posix.isAbsolute(inputPath) ? path2.posix.normalize(inputPath) : path2.posix.normalize(path2.posix.join(normalizedWorkDir, inputPath));
+    return assertWorkspacePath(resolved);
+  };
+  const resolveReadablePath = (inputPath) => {
+    if (!path2.posix.isAbsolute(inputPath)) {
+      return resolvePath(inputPath);
+    }
+    return assertReadablePath(inputPath);
+  };
+  const runShell = async ({
+    command,
+    signal
+  }) => {
     const result = await sandbox.run({
       command,
-      workingDirectory: workDir,
-      ...input?.signal ? { abortSignal: input.signal } : {}
+      workingDirectory: normalizedWorkDir,
+      ...signal ? { abortSignal: signal } : {}
     });
     return {
       exitCode: result.exitCode,
       output: `${result.stdout}${result.stderr}`
     };
   };
+  const lastOutputLine = (output) => output.trim().split("\n").filter(Boolean).at(-1);
+  const resolveExistingSandboxPath = async ({
+    remotePath,
+    inputPath,
+    missingMessage
+  }) => {
+    const result = await runShell({
+      command: [
+        `target=${shellQuote(remotePath)}`,
+        'if [ ! -e "$target" ]; then echo "__CLINE_REALPATH_NOT_FOUND__"; exit 2; fi',
+        'resolved=$(realpath "$target" 2>/dev/null) || { echo "__CLINE_REALPATH_FAILED__"; exit 3; }',
+        `printf '%s\\n' "$resolved"`
+      ].join("; ")
+    });
+    if (result.output.includes("__CLINE_REALPATH_NOT_FOUND__")) {
+      throw new Error(missingMessage ?? `Path not found: ${inputPath}`);
+    }
+    if (result.output.includes("__CLINE_REALPATH_FAILED__") || result.exitCode !== 0) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    const resolvedPath = lastOutputLine(result.output);
+    if (!resolvedPath) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    return resolvedPath;
+  };
+  const resolveReadableSandboxPath = async ({
+    remotePath,
+    inputPath,
+    missingMessage
+  }) => assertReadablePath(
+    await resolveExistingSandboxPath({
+      remotePath,
+      inputPath,
+      ...missingMessage ? { missingMessage } : {}
+    })
+  );
+  const resolveWritableSandboxPath = async ({
+    remotePath,
+    inputPath
+  }) => {
+    const result = await runShell({
+      command: [
+        `target=${shellQuote(remotePath)}`,
+        `if [ -e "$target" ] || [ -L "$target" ]; then resolved=$(realpath "$target" 2>/dev/null) || { echo "__CLINE_REALPATH_FAILED__"; exit 3; }; printf '%s\\n' "$resolved"; exit 0; fi`,
+        'dir=$(dirname "$target")',
+        'base=$(basename "$target")',
+        'missing="$base"',
+        'while [ ! -e "$dir" ] && [ ! -L "$dir" ]; do parent=$(dirname "$dir"); if [ "$parent" = "$dir" ]; then echo "__CLINE_REALPATH_NOT_FOUND__"; exit 2; fi; missing="$(basename "$dir")/$missing"; dir="$parent"; done',
+        'resolved_dir=$(realpath "$dir" 2>/dev/null) || { echo "__CLINE_REALPATH_FAILED__"; exit 3; }',
+        `printf '%s/%s\\n' "$resolved_dir" "$missing"`
+      ].join("; ")
+    });
+    if (result.output.includes("__CLINE_REALPATH_NOT_FOUND__") || result.output.includes("__CLINE_REALPATH_FAILED__") || result.exitCode !== 0) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    const resolvedPath = lastOutputLine(result.output);
+    if (!resolvedPath) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    return assertWorkspacePath(resolvedPath);
+  };
   const readFile = async (inputPath) => {
-    const resolved = resolvePath(inputPath);
+    const remotePath = resolveReadablePath(inputPath);
+    const resolved = await resolveReadableSandboxPath({
+      remotePath,
+      inputPath,
+      missingMessage: `File not found: ${inputPath}`
+    });
     const content = await sandbox.readTextFile({ path: resolved });
     if (content == null) {
       throw new Error(`File not found: ${inputPath}`);
@@ -253,11 +354,26 @@ function createClineRemoteOps(options) {
     return content;
   };
   const writeFile = async (inputPath, content) => {
-    const resolved = resolvePath(inputPath);
+    const remotePath = resolvePath(inputPath);
+    const resolved = await resolveWritableSandboxPath({
+      remotePath,
+      inputPath
+    });
     await sandbox.writeTextFile({ path: resolved, content });
   };
   const editFile = async (inputPath, oldText, newText) => {
-    const current = await readFile(inputPath);
+    const remotePath = resolvePath(inputPath);
+    const resolved = assertWorkspacePath(
+      await resolveExistingSandboxPath({
+        remotePath,
+        inputPath,
+        missingMessage: `File not found: ${inputPath}`
+      })
+    );
+    const current = await sandbox.readTextFile({ path: resolved });
+    if (current == null) {
+      throw new Error(`File not found: ${inputPath}`);
+    }
     const index = current.indexOf(oldText);
     if (index === -1) {
       throw new Error(`Text to replace was not found in ${inputPath}`);
@@ -279,7 +395,10 @@ function createClineRemoteOps(options) {
       const onAbort = () => controller.abort();
       forwardedSignal?.addEventListener("abort", onAbort, { once: true });
       try {
-        const result = await runShell(command, { signal: controller.signal });
+        const result = await runShell({
+          command,
+          signal: controller.signal
+        });
         return { output: result.output, exitCode: result.exitCode };
       } finally {
         forwardedSignal?.removeEventListener("abort", onAbort);
@@ -289,9 +408,14 @@ function createClineRemoteOps(options) {
       }
     },
     async grep(pattern, input = {}) {
-      const target = resolvePath(input.path ?? ".");
+      const inputPath = input.path ?? ".";
+      const remotePath = resolveReadablePath(inputPath);
+      const target = await resolveReadableSandboxPath({
+        remotePath,
+        inputPath
+      });
       const flags = [
-        "-R",
+        "-r",
         "-n",
         "--binary-files=without-match",
         ...input.ignoreCase ? ["-i"] : [],
@@ -300,8 +424,8 @@ function createClineRemoteOps(options) {
         ...input.glob ? ["--include", input.glob] : []
       ];
       const limit = Math.max(1, input.limit ?? 100);
-      const result = await runShell(
-        [
+      const result = await runShell({
+        command: [
           `if [ ! -e ${shellQuote(
             target
           )} ]; then echo "__CLINE_GREP_NOT_FOUND__"; exit 2; fi`,
@@ -309,7 +433,7 @@ function createClineRemoteOps(options) {
             pattern
           )} ${shellQuote(target)} 2>/dev/null | head -n ${limit}`
         ].join("; ")
-      );
+      });
       const output = result.output.trim();
       if (output.includes("__CLINE_GREP_NOT_FOUND__")) {
         throw new Error(`Path not found: ${input.path ?? "."}`);
@@ -317,9 +441,13 @@ function createClineRemoteOps(options) {
       return output || "No matches found";
     },
     async glob(pattern, inputPath = ".", limit = 1e3) {
-      const target = resolvePath(inputPath);
-      const result = await runShell(
-        [
+      const remotePath = resolveReadablePath(inputPath);
+      const target = await resolveReadableSandboxPath({
+        remotePath,
+        inputPath
+      });
+      const result = await runShell({
+        command: [
           `if [ ! -e ${shellQuote(
             target
           )} ]; then echo "__CLINE_FIND_NOT_FOUND__"; exit 2; fi`,
@@ -327,7 +455,7 @@ function createClineRemoteOps(options) {
             target
           )} -type f -print; else printf '%s\\n' ${shellQuote(target)}; fi`
         ].join("; ")
-      );
+      });
       const output = result.output.trim();
       if (output.includes("__CLINE_FIND_NOT_FOUND__")) {
         throw new Error(`Path not found: ${inputPath}`);
@@ -344,9 +472,13 @@ function createClineRemoteOps(options) {
       ).slice(0, limit);
     },
     async ls(inputPath = ".", limit = 500) {
-      const target = resolvePath(inputPath);
-      const result = await runShell(
-        [
+      const remotePath = resolveReadablePath(inputPath);
+      const target = await resolveReadableSandboxPath({
+        remotePath,
+        inputPath
+      });
+      const result = await runShell({
+        command: [
           `if [ ! -e ${shellQuote(
             target
           )} ]; then echo "__CLINE_LS_NOT_FOUND__"; exit 2; fi`,
@@ -356,7 +488,7 @@ function createClineRemoteOps(options) {
           `cd ${shellQuote(target)}`,
           "ls -1Ap"
         ].join("; ")
-      );
+      });
       const output = result.output.trim();
       if (output.includes("__CLINE_LS_NOT_FOUND__")) {
         throw new Error(`Path not found: ${inputPath}`);
@@ -1056,13 +1188,10 @@ async function createClineSession(input) {
   const activeBuiltinNames = resolveActiveClineBuiltinNames(
     input.builtinToolFiltering
   );
-  const ops = createClineRemoteOps({
-    sandbox: toolSafeSandboxSession,
-    workDir: input.sessionWorkDir
-  });
   let skillsSection;
+  let skillRootDir;
   if (input.skills.length > 0) {
-    const skillRootDir = await writeClineSkills({
+    skillRootDir = await writeClineSkills({
       sandbox: toolSafeSandboxSession,
       sandboxHomeDir,
       skills: input.skills,
@@ -1072,6 +1201,11 @@ async function createClineSession(input) {
       skillsSection = renderSkillsPromptSection(input.skills, skillRootDir);
     }
   }
+  const ops = createClineRemoteOps({
+    sandbox: toolSafeSandboxSession,
+    workDir: input.sessionWorkDir,
+    ...skillRootDir ? { readableRoots: [{ sandboxDir: skillRootDir }] } : {}
+  });
   const baseSystemPrompt = buildSystemPrompt({
     sessionWorkDir: input.sessionWorkDir,
     sandboxDescription: toolSafeSandboxSession.description,
@@ -1565,7 +1699,7 @@ ${rebuildInput.instructions}` : baseSystemPrompt,
 }
 
 // src/version.ts
-var VERSION = true ? "1.0.7" : "0.0.0-test";
+var VERSION = true ? "1.0.9" : "0.0.0-test";
 
 // src/cline-harness.ts
 var CLINE_CLIENT_APP = `ai-sdk/harness-cline/${VERSION}`;