@ai-sdk/harness-codex 1.0.10 → 1.0.12

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @ai-sdk/harness-codex
 
+## 1.0.12
+
+### Patch Changes
+
+- 2933383: fix(harness): fix harness relay auth
+  - @ai-sdk/harness@1.0.11
+
+## 1.0.11
+
+### Patch Changes
+
+- 0d1cb8e: fix(harness-codex): improve Codex prompt framing and avoid placing relay shim file in session workdir
+
 ## 1.0.10
 
 ### Patch Changes

package/dist/bridge/host-tool-mcp.mjs

@@ -8,7 +8,6 @@ var { McpServer } = mcpServerModule;
 var { StdioServerTransport } = mcpStdioModule;
 var schemas = JSON.parse(process.env.TOOL_SCHEMAS || "[]");
 var relayUrl = process.env.TOOL_RELAY_URL || "";
-var relayToken = process.env.TOOL_RELAY_TOKEN || "";
 if (!schemas.length || !relayUrl) {
   process.stderr.write(
     "[host-tool-mcp] Missing TOOL_SCHEMAS or TOOL_RELAY_URL; exiting\n"
@@ -28,8 +27,7 @@ for (const schema of schemas) {
         const res = await fetch(relayUrl, {
           method: "POST",
           headers: {
-            "Content-Type": "application/json",
-            ...relayToken ? { Authorization: `Bearer ${relayToken}` } : {}
+            "Content-Type": "application/json"
           },
           body: JSON.stringify({ requestId, toolName: schema.name, input })
         });

package/dist/bridge/host-tool-mcp.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/bridge/host-tool-mcp.ts"],"sourcesContent":["#!/usr/bin/env node\n// MCP-stdio tool server spawned by the codex CLI when\n// `mcp_servers.harness-tools` is configured. Exposes host-defined tools\n// over MCP-stdio and round-trips each call to the bridge's HTTP relay.\n//\n// Env vars (set by the bridge when starting a turn):\n//   TOOL_SCHEMAS    — JSON array of { name, description, inputSchema }\n//   TOOL_RELAY_URL  — http://127.0.0.1:<port> of the bridge relay server\n//   TOOL_RELAY_TOKEN — bearer token required by the relay\n\n/*\n * CONSTRAINT — the third-party imports below are NEVER bundled into the\n * compiled `bridge/host-tool-mcp.mjs`. They are declared `external` in\n * tsup.config.ts and resolved at runtime from the node_modules that the\n * bridge installs *inside the sandbox* from `src/bridge/package.json` (and\n * its pinned `pnpm-lock.yaml`). That bridge package.json — NOT this host\n * package — is the single source of truth for these packages and their\n * versions; the published `@ai-sdk/harness-codex` package does not provide\n * them at runtime.\n *\n * When adding or changing a third-party import here you MUST keep all three\n * in sync, or this server will either get the dependency bundled in or fail\n * to resolve it in the sandbox:\n *   1. the import statement below,\n *   2. the `external` array in tsup.config.ts, and\n *   3. the dependency entry in `src/bridge/package.json`.\n */\nimport * as mcpServerModule from '@modelcontextprotocol/sdk/server/mcp.js';\nimport * as mcpStdioModule from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { z } from 'zod/v4';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst { McpServer } = mcpServerModule as any;\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst { StdioServerTransport } = mcpStdioModule as any;\n\ntype ToolSchema = {\n  name: string;\n  description?: string;\n  inputSchema?: JsonSchemaObject;\n};\n\ntype JsonSchemaObject = {\n  type?: string | string[];\n  description?: string;\n  properties?: Record<string, JsonSchemaObject>;\n  required?: string[];\n  items?: JsonSchemaObject;\n  enum?: unknown[];\n  const?: unknown;\n  oneOf?: JsonSchemaObject[];\n  anyOf?: JsonSchemaObject[];\n  additionalProperties?: boolean | JsonSchemaObject;\n  nullable?: boolean;\n};\n\nconst schemas: ToolSchema[] = JSON.parse(process.env.TOOL_SCHEMAS || '[]');\nconst relayUrl = process.env.TOOL_RELAY_URL || '';\nconst relayToken = process.env.TOOL_RELAY_TOKEN || '';\n\nif (!schemas.length || !relayUrl) {\n  process.stderr.write(\n    '[host-tool-mcp] Missing TOOL_SCHEMAS or TOOL_RELAY_URL; exiting\\n',\n  );\n  process.exit(0);\n}\n\nconst server = new McpServer({ name: 'harness-tools', version: '1.0.0' });\n\nfor (const schema of schemas) {\n  const shape = toZodShape(schema.inputSchema);\n  server.tool(\n    schema.name,\n    schema.description ?? '',\n    shape,\n    async (input: Record<string, unknown>) => {\n      const requestId = crypto.randomUUID();\n      try {\n        const res = await fetch(relayUrl, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            ...(relayToken ? { Authorization: `Bearer ${relayToken}` } : {}),\n          },\n          body: JSON.stringify({ requestId, toolName: schema.name, input }),\n        });\n        if (!res.ok) {\n          const body = await res.text();\n          throw new Error(\n            `Tool relay ${schema.name} failed with ${res.status}: ${body.slice(0, 500)}`,\n          );\n        }\n        const data = (await res.json()) as { result?: unknown };\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: JSON.stringify(data.result ?? null),\n            },\n          ],\n        };\n      } catch (err) {\n        return {\n          content: [{ type: 'text' as const, text: `Error: ${String(err)}` }],\n          isError: true,\n        };\n      }\n    },\n  );\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction toZodShape(schema: JsonSchemaObject | undefined): Record<string, any> {\n  if (!schema?.properties) return {};\n  const required = new Set(schema.required ?? []);\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const shape: Record<string, any> = {};\n  for (const [key, propSchema] of Object.entries(schema.properties)) {\n    const propType = toZodType(propSchema);\n    shape[key] = required.has(key) ? propType : propType.optional();\n  }\n  return shape;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction toZodType(schema: JsonSchemaObject | undefined): any {\n  if (!schema) return z.any();\n  const types = Array.isArray(schema.type)\n    ? schema.type.filter((t): t is string => t !== 'null')\n    : ([schema.type].filter(Boolean) as string[]);\n  let zType;\n  switch (types[0]) {\n    case 'string':\n      zType = z.string();\n      break;\n    case 'number':\n      zType = z.number();\n      break;\n    case 'integer':\n      zType = z.number().int();\n      break;\n    case 'boolean':\n      zType = z.boolean();\n      break;\n    case 'array':\n      zType = z.array(toZodType(schema.items));\n      break;\n    case 'object':\n      zType = z.object(toZodShape(schema));\n      break;\n    case 'null':\n      zType = z.null();\n      break;\n    default:\n      zType = z.any();\n  }\n  if (schema.description) zType = zType.describe(schema.description);\n  if (schema.nullable) zType = zType.nullable();\n  return zType;\n}\n\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\n"],"mappings":";;;AA2BA,YAAY,qBAAqB;AACjC,YAAY,oBAAoB;AAChC,SAAS,SAAS;AAGlB,IAAM,EAAE,UAAU,IAAI;AAEtB,IAAM,EAAE,qBAAqB,IAAI;AAsBjC,IAAM,UAAwB,KAAK,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AACzE,IAAM,WAAW,QAAQ,IAAI,kBAAkB;AAC/C,IAAM,aAAa,QAAQ,IAAI,oBAAoB;AAEnD,IAAI,CAAC,QAAQ,UAAU,CAAC,UAAU;AAChC,UAAQ,OAAO;AAAA,IACb;AAAA,EACF;AACA,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,IAAI,UAAU,EAAE,MAAM,iBAAiB,SAAS,QAAQ,CAAC;AAExE,WAAW,UAAU,SAAS;AAC5B,QAAM,QAAQ,WAAW,OAAO,WAAW;AAC3C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO,eAAe;AAAA,IACtB;AAAA,IACA,OAAO,UAAmC;AACxC,YAAM,YAAY,OAAO,WAAW;AACpC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,UAAU;AAAA,UAChC,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,GAAI,aAAa,EAAE,eAAe,UAAU,UAAU,GAAG,IAAI,CAAC;AAAA,UAChE;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,WAAW,UAAU,OAAO,MAAM,MAAM,CAAC;AAAA,QAClE,CAAC;AACD,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,gBAAM,IAAI;AAAA,YACR,cAAc,OAAO,IAAI,gBAAgB,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,UAC5E;AAAA,QACF;AACA,cAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,eAAO;AAAA,UACL,SAAS;AAAA,YACP;AAAA,cACE,MAAM;AAAA,cACN,MAAM,KAAK,UAAU,KAAK,UAAU,IAAI;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,UAAU,OAAO,GAAG,CAAC,GAAG,CAAC;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,WAAW,QAA2D;AAC7E,MAAI,CAAC,QAAQ,WAAY,QAAO,CAAC;AACjC,QAAM,WAAW,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;AAE9C,QAAM,QAA6B,CAAC;AACpC,aAAW,CAAC,KAAK,UAAU,KAAK,OAAO,QAAQ,OAAO,UAAU,GAAG;AACjE,UAAM,WAAW,UAAU,UAAU;AACrC,UAAM,GAAG,IAAI,SAAS,IAAI,GAAG,IAAI,WAAW,SAAS,SAAS;AAAA,EAChE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,QAA2C;AAC5D,MAAI,CAAC,OAAQ,QAAO,EAAE,IAAI;AAC1B,QAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,IACnC,OAAO,KAAK,OAAO,CAAC,MAAmB,MAAM,MAAM,IAClD,CAAC,OAAO,IAAI,EAAE,OAAO,OAAO;AACjC,MAAI;AACJ,UAAQ,MAAM,CAAC,GAAG;AAAA,IAChB,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,EAAE,IAAI;AACvB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,QAAQ;AAClB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,MAAM,UAAU,OAAO,KAAK,CAAC;AACvC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,WAAW,MAAM,CAAC;AACnC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,KAAK;AACf;AAAA,IACF;AACE,cAAQ,EAAE,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,YAAa,SAAQ,MAAM,SAAS,OAAO,WAAW;AACjE,MAAI,OAAO,SAAU,SAAQ,MAAM,SAAS;AAC5C,SAAO;AACT;AAEA,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;","names":[]}
+{"version":3,"sources":["../../src/bridge/host-tool-mcp.ts"],"sourcesContent":["#!/usr/bin/env node\n// MCP-stdio tool server spawned by the codex CLI when\n// `mcp_servers.harness-tools` is configured. Exposes host-defined tools\n// over MCP-stdio and round-trips each call to the bridge's HTTP relay.\n//\n// Env vars (set by the bridge when starting a turn):\n//   TOOL_SCHEMAS    — JSON array of { name, description, inputSchema }\n//   TOOL_RELAY_URL  — http://127.0.0.1:<port> of the bridge relay server\n// Relay authorization is issued by bridge runtime events, not an env token.\n\n/*\n * CONSTRAINT — the third-party imports below are NEVER bundled into the\n * compiled `bridge/host-tool-mcp.mjs`. They are declared `external` in\n * tsup.config.ts and resolved at runtime from the node_modules that the\n * bridge installs *inside the sandbox* from `src/bridge/package.json` (and\n * its pinned `pnpm-lock.yaml`). That bridge package.json — NOT this host\n * package — is the single source of truth for these packages and their\n * versions; the published `@ai-sdk/harness-codex` package does not provide\n * them at runtime.\n *\n * When adding or changing a third-party import here you MUST keep all three\n * in sync, or this server will either get the dependency bundled in or fail\n * to resolve it in the sandbox:\n *   1. the import statement below,\n *   2. the `external` array in tsup.config.ts, and\n *   3. the dependency entry in `src/bridge/package.json`.\n */\nimport * as mcpServerModule from '@modelcontextprotocol/sdk/server/mcp.js';\nimport * as mcpStdioModule from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { z } from 'zod/v4';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst { McpServer } = mcpServerModule as any;\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst { StdioServerTransport } = mcpStdioModule as any;\n\ntype ToolSchema = {\n  name: string;\n  description?: string;\n  inputSchema?: JsonSchemaObject;\n};\n\ntype JsonSchemaObject = {\n  type?: string | string[];\n  description?: string;\n  properties?: Record<string, JsonSchemaObject>;\n  required?: string[];\n  items?: JsonSchemaObject;\n  enum?: unknown[];\n  const?: unknown;\n  oneOf?: JsonSchemaObject[];\n  anyOf?: JsonSchemaObject[];\n  additionalProperties?: boolean | JsonSchemaObject;\n  nullable?: boolean;\n};\n\nconst schemas: ToolSchema[] = JSON.parse(process.env.TOOL_SCHEMAS || '[]');\nconst relayUrl = process.env.TOOL_RELAY_URL || '';\n\nif (!schemas.length || !relayUrl) {\n  process.stderr.write(\n    '[host-tool-mcp] Missing TOOL_SCHEMAS or TOOL_RELAY_URL; exiting\\n',\n  );\n  process.exit(0);\n}\n\nconst server = new McpServer({ name: 'harness-tools', version: '1.0.0' });\n\nfor (const schema of schemas) {\n  const shape = toZodShape(schema.inputSchema);\n  server.tool(\n    schema.name,\n    schema.description ?? '',\n    shape,\n    async (input: Record<string, unknown>) => {\n      const requestId = crypto.randomUUID();\n      try {\n        const res = await fetch(relayUrl, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({ requestId, toolName: schema.name, input }),\n        });\n        if (!res.ok) {\n          const body = await res.text();\n          throw new Error(\n            `Tool relay ${schema.name} failed with ${res.status}: ${body.slice(0, 500)}`,\n          );\n        }\n        const data = (await res.json()) as { result?: unknown };\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: JSON.stringify(data.result ?? null),\n            },\n          ],\n        };\n      } catch (err) {\n        return {\n          content: [{ type: 'text' as const, text: `Error: ${String(err)}` }],\n          isError: true,\n        };\n      }\n    },\n  );\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction toZodShape(schema: JsonSchemaObject | undefined): Record<string, any> {\n  if (!schema?.properties) return {};\n  const required = new Set(schema.required ?? []);\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const shape: Record<string, any> = {};\n  for (const [key, propSchema] of Object.entries(schema.properties)) {\n    const propType = toZodType(propSchema);\n    shape[key] = required.has(key) ? propType : propType.optional();\n  }\n  return shape;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction toZodType(schema: JsonSchemaObject | undefined): any {\n  if (!schema) return z.any();\n  const types = Array.isArray(schema.type)\n    ? schema.type.filter((t): t is string => t !== 'null')\n    : ([schema.type].filter(Boolean) as string[]);\n  let zType;\n  switch (types[0]) {\n    case 'string':\n      zType = z.string();\n      break;\n    case 'number':\n      zType = z.number();\n      break;\n    case 'integer':\n      zType = z.number().int();\n      break;\n    case 'boolean':\n      zType = z.boolean();\n      break;\n    case 'array':\n      zType = z.array(toZodType(schema.items));\n      break;\n    case 'object':\n      zType = z.object(toZodShape(schema));\n      break;\n    case 'null':\n      zType = z.null();\n      break;\n    default:\n      zType = z.any();\n  }\n  if (schema.description) zType = zType.describe(schema.description);\n  if (schema.nullable) zType = zType.nullable();\n  return zType;\n}\n\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\n"],"mappings":";;;AA2BA,YAAY,qBAAqB;AACjC,YAAY,oBAAoB;AAChC,SAAS,SAAS;AAGlB,IAAM,EAAE,UAAU,IAAI;AAEtB,IAAM,EAAE,qBAAqB,IAAI;AAsBjC,IAAM,UAAwB,KAAK,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AACzE,IAAM,WAAW,QAAQ,IAAI,kBAAkB;AAE/C,IAAI,CAAC,QAAQ,UAAU,CAAC,UAAU;AAChC,UAAQ,OAAO;AAAA,IACb;AAAA,EACF;AACA,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,IAAI,UAAU,EAAE,MAAM,iBAAiB,SAAS,QAAQ,CAAC;AAExE,WAAW,UAAU,SAAS;AAC5B,QAAM,QAAQ,WAAW,OAAO,WAAW;AAC3C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO,eAAe;AAAA,IACtB;AAAA,IACA,OAAO,UAAmC;AACxC,YAAM,YAAY,OAAO,WAAW;AACpC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,UAAU;AAAA,UAChC,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,UAClB;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,WAAW,UAAU,OAAO,MAAM,MAAM,CAAC;AAAA,QAClE,CAAC;AACD,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,gBAAM,IAAI;AAAA,YACR,cAAc,OAAO,IAAI,gBAAgB,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,UAC5E;AAAA,QACF;AACA,cAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,eAAO;AAAA,UACL,SAAS;AAAA,YACP;AAAA,cACE,MAAM;AAAA,cACN,MAAM,KAAK,UAAU,KAAK,UAAU,IAAI;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,UAAU,OAAO,GAAG,CAAC,GAAG,CAAC;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,WAAW,QAA2D;AAC7E,MAAI,CAAC,QAAQ,WAAY,QAAO,CAAC;AACjC,QAAM,WAAW,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;AAE9C,QAAM,QAA6B,CAAC;AACpC,aAAW,CAAC,KAAK,UAAU,KAAK,OAAO,QAAQ,OAAO,UAAU,GAAG;AACjE,UAAM,WAAW,UAAU,UAAU;AACrC,UAAM,GAAG,IAAI,SAAS,IAAI,GAAG,IAAI,WAAW,SAAS,SAAS;AAAA,EAChE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,QAA2C;AAC5D,MAAI,CAAC,OAAQ,QAAO,EAAE,IAAI;AAC1B,QAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,IACnC,OAAO,KAAK,OAAO,CAAC,MAAmB,MAAM,MAAM,IAClD,CAAC,OAAO,IAAI,EAAE,OAAO,OAAO;AACjC,MAAI;AACJ,UAAQ,MAAM,CAAC,GAAG;AAAA,IAChB,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,EAAE,IAAI;AACvB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,QAAQ;AAClB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,MAAM,UAAU,OAAO,KAAK,CAAC;AACvC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,WAAW,MAAM,CAAC;AACnC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,KAAK;AACf;AAAA,IACF;AACE,cAAQ,EAAE,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,YAAa,SAAQ,MAAM,SAAS,OAAO,WAAW;AACjE,MAAI,OAAO,SAAU,SAAQ,MAAM,SAAS;AAC5C,SAAO;AACT;AAEA,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;","names":[]}

package/dist/bridge/index.mjs

@@ -412,14 +412,13 @@ function serialiseError(err) {
 
 // src/bridge/index.ts
 import { randomUUID } from "crypto";
-import { writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { createServer } from "http";
 
 // src/bridge/cli-relay.ts
 var CLI_SHIM_FILENAME = "harness-tool.mjs";
 function buildCliShimScript({
-  relayPort,
-  relayToken
+  relayPort
 }) {
   return `#!/usr/bin/env node
 const [toolName, inputJson = '{}'] = process.argv.slice(2);
@@ -437,7 +436,7 @@ try {
 const requestId = 'cli-' + Date.now() + '-' + Math.random().toString(16).slice(2);
 const response = await fetch('http://127.0.0.1:${relayPort}', {
   method: 'POST',
-  headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ${relayToken}' },
+  headers: { 'Content-Type': 'application/json' },
   body: JSON.stringify({ requestId, toolName, input }),
 });
 const text = await response.text();
@@ -454,36 +453,247 @@ if (!response.ok || payload.error) {
 console.log(JSON.stringify(payload.result ?? payload, null, 2));
 `;
 }
-function composeToolUsageInstructions({
-  tools,
+function parseToolRelayCommand({
+  command,
   cliShimPath
 }) {
-  const lines = [
-    "## Host tools",
-    "",
-    "You have access to the following host-provided tools. To use one, run the following command via your built-in `bash` tool:",
-    "",
-    `  node ${cliShimPath} <toolName> '<jsonInput>'`,
-    "",
-    "The script prints the JSON result to stdout. Do not invent another way to call these tools \u2014 only this CLI invocation will work. Pass the JSON input as a single-quoted argument.",
-    "For every user request that depends on a host-provided tool, run a separate CLI invocation for each needed tool call in the current turn before answering. Do not reuse previous tool results, and do not say you used a host tool unless the command has completed in the current turn.",
-    ""
-  ];
-  for (const tool of tools) {
-    lines.push(`### ${tool.name}`);
-    if (tool.description) lines.push(tool.description);
-    lines.push(
-      `Input schema: \`${JSON.stringify(tool.inputSchema ?? {})}\``,
-      ""
-    );
-  }
-  return lines.join("\n");
+  return parseToolRelayCommandInternal({ command, cliShimPath, depth: 0 });
 }
-function isToolRelayCommand({
+function parseToolRelayCommandInternal({
   command,
+  cliShimPath,
+  depth
+}) {
+  const argv2 = parseShellWords(command);
+  if (!argv2) return void 0;
+  const relayCall = parseDirectToolRelayArgv({ argv: argv2, cliShimPath });
+  if (relayCall) return relayCall;
+  const innerCommand = extractShellEvalCommand(argv2);
+  if (!innerCommand || depth >= 2) return void 0;
+  return parseToolRelayCommandInternal({
+    command: innerCommand,
+    cliShimPath,
+    depth: depth + 1
+  });
+}
+function parseDirectToolRelayArgv({
+  argv: argv2,
   cliShimPath
 }) {
-  return command.includes(cliShimPath);
+  if (argv2.length < 3 || argv2.length > 4) return void 0;
+  if (argv2[0] !== "node" || argv2[1] !== cliShimPath) return void 0;
+  const toolName = argv2[2];
+  if (!toolName) return void 0;
+  try {
+    return { toolName, input: JSON.parse(argv2[3] ?? "{}") };
+  } catch {
+    return void 0;
+  }
+}
+function extractShellEvalCommand(argv2) {
+  if (argv2.length !== 3) return void 0;
+  const shellName = argv2[0].split("/").at(-1);
+  if (shellName !== "bash" && shellName !== "sh" && shellName !== "zsh") {
+    return void 0;
+  }
+  if (argv2[1] !== "-c" && argv2[1] !== "-lc") return void 0;
+  return argv2[2];
+}
+function parseShellWords(command) {
+  const words = [];
+  let current = "";
+  let quote;
+  let hasCurrent = false;
+  const pushCurrent = () => {
+    if (!hasCurrent) return;
+    words.push(current);
+    current = "";
+    hasCurrent = false;
+  };
+  for (let i = 0; i < command.length; i++) {
+    const char = command[i];
+    if (quote === "'") {
+      if (char === "'") {
+        quote = void 0;
+      } else {
+        current += char;
+      }
+      hasCurrent = true;
+      continue;
+    }
+    if (quote === '"') {
+      if (char === '"') {
+        quote = void 0;
+      } else if (char === "\\" && i + 1 < command.length) {
+        current += command[++i];
+      } else {
+        current += char;
+      }
+      hasCurrent = true;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      pushCurrent();
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      hasCurrent = true;
+      continue;
+    }
+    if (char === "\\" && i + 1 < command.length) {
+      current += command[++i];
+      hasCurrent = true;
+      continue;
+    }
+    if (/[;&|<>()`$]/.test(char)) return void 0;
+    current += char;
+    hasCurrent = true;
+  }
+  if (quote) return void 0;
+  pushCurrent();
+  return words;
+}
+
+// src/bridge/tool-relay-auth.ts
+import { readdir, readFile, readlink } from "fs/promises";
+var ToolRelayAuthorizer = class {
+  constructor({
+    ttlMs = 1e4,
+    now = Date.now
+  } = {}) {
+    this.authorizations = [];
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+  authorizeToolCall(call) {
+    this.pruneExpired();
+    this.authorizations.push({
+      key: toolRelayCallKey(call),
+      expiresAt: this.now() + this.ttlMs
+    });
+  }
+  authorizeAnyToolCall() {
+    this.pruneExpired();
+    this.authorizations.push({
+      expiresAt: this.now() + this.ttlMs
+    });
+  }
+  consumeToolCall(call) {
+    this.pruneExpired();
+    const key = toolRelayCallKey(call);
+    let index = this.authorizations.findIndex((auth) => auth.key === key);
+    if (index === -1) {
+      index = this.authorizations.findIndex((auth) => auth.key === void 0);
+    }
+    if (index === -1) return false;
+    this.authorizations.splice(index, 1);
+    return true;
+  }
+  pruneExpired() {
+    const now = this.now();
+    for (let i = this.authorizations.length - 1; i >= 0; i--) {
+      if (this.authorizations[i].expiresAt <= now) {
+        this.authorizations.splice(i, 1);
+      }
+    }
+  }
+};
+var ToolRelayPendingCalls = class {
+  constructor() {
+    this.calls = /* @__PURE__ */ new Map();
+  }
+  begin({
+    call,
+    run
+  }) {
+    const key = toolRelayCallKey(call);
+    const existing = this.calls.get(key);
+    if (existing) return { result: existing, isNew: false };
+    const result = run();
+    this.calls.set(key, result);
+    void result.finally(() => {
+      if (this.calls.get(key) === result) {
+        this.calls.delete(key);
+      }
+    }).catch(() => {
+    });
+    return { result, isNew: true };
+  }
+};
+function toolRelayCallKey({ toolName, input }) {
+  return `${toolName}\0${canonicalJson(input ?? {})}`;
+}
+function canonicalJson(value) {
+  return JSON.stringify(normalizeJsonValue(value));
+}
+function normalizeJsonValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(normalizeJsonValue);
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue)])
+    );
+  }
+  return value;
+}
+async function isToolRelayRequestFromAllowedProcess({
+  socket,
+  allowedScriptPaths
+}) {
+  if (process.platform !== "linux") return false;
+  if (!socket.remotePort || !socket.localPort) return false;
+  const inode = await findTcpSocketInode({
+    clientPort: socket.remotePort,
+    serverPort: socket.localPort
+  });
+  if (!inode) return false;
+  const cmdline = await findProcessCmdlineForSocketInode({ inode });
+  return cmdline?.some((arg) => allowedScriptPaths.has(arg)) ?? false;
+}
+async function findTcpSocketInode({
+  clientPort,
+  serverPort
+}) {
+  for (const tablePath of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+    const table = await readFile(tablePath, "utf8").catch(() => void 0);
+    if (!table) continue;
+    for (const line of table.split("\n").slice(1)) {
+      const columns = line.trim().split(/\s+/);
+      if (columns.length < 10) continue;
+      const local = parseProcNetAddress(columns[1]);
+      const remote = parseProcNetAddress(columns[2]);
+      if (local?.port === clientPort && remote?.port === serverPort && columns[9] !== "0") {
+        return columns[9];
+      }
+    }
+  }
+  return void 0;
+}
+function parseProcNetAddress(value) {
+  const [, portHex] = value.split(":");
+  if (!portHex) return void 0;
+  return { port: Number.parseInt(portHex, 16) };
+}
+async function findProcessCmdlineForSocketInode({
+  inode
+}) {
+  const procEntries = await readdir("/proc", { withFileTypes: true }).catch(
+    () => []
+  );
+  for (const entry of procEntries) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    const fdDir = `/proc/${entry.name}/fd`;
+    const fds = await readdir(fdDir).catch(() => []);
+    for (const fd of fds) {
+      const target = await readlink(`${fdDir}/${fd}`).catch(() => void 0);
+      if (target !== `socket:[${inode}]`) continue;
+      const cmdline = await readFile(`/proc/${entry.name}/cmdline`, "utf8").then((value) => value.split("\0").filter(Boolean)).catch(() => void 0);
+      if (cmdline) return cmdline;
+    }
+  }
+  return void 0;
 }
 
 // src/bridge/index.ts
@@ -497,14 +707,15 @@ function toCommonName(nativeName) {
   return NATIVE_TO_COMMON[nativeName] ?? nativeName;
 }
 var args = parseArgs(argv.slice(2));
-var workdir = args.workdir;
-var bridgeStateDir = args.bridgeStateDir;
-if (!workdir) {
-  emitFatal("Missing --workdir argument.");
-}
-if (!bridgeStateDir) {
-  emitFatal("Missing --bridge-state-dir argument.");
-}
+var workdir = requireArg({ value: args.workdir, name: "--workdir" });
+var bridgeStateDir = requireArg({
+  value: args.bridgeStateDir,
+  name: "--bridge-state-dir"
+});
+var cliShimDir = requireArg({
+  value: args.cliShimDir,
+  name: "--cli-shim-dir"
+});
 var bootstrapDir = args.bootstrapDir ?? workdir;
 var codexSdk = codexSdkModule;
 var threadState = { id: void 0 };
@@ -523,9 +734,9 @@ async function runTurn(start, turn) {
   let relay;
   let cliShimPath;
   if (start.tools && start.tools.length > 0) {
-    const relayToken = randomUUID();
+    cliShimPath = `${cliShimDir}/${CLI_SHIM_FILENAME}`;
     relay = await startToolRelay({
-      relayToken,
+      allowedScriptPaths: [cliShimPath, `${bootstrapDir}/host-tool-mcp.mjs`],
       tools: start.tools,
       emit,
       requestToolResult: turn.requestToolResult
@@ -542,14 +753,13 @@ async function runTurn(start, turn) {
             inputSchema: t.inputSchema
           }))
         ),
-        TOOL_RELAY_URL: `http://127.0.0.1:${relay.port}`,
-        TOOL_RELAY_TOKEN: relayToken
+        TOOL_RELAY_URL: `http://127.0.0.1:${relay.port}`
       }
     };
-    cliShimPath = `${workdir}/${CLI_SHIM_FILENAME}`;
+    await mkdir2(cliShimDir, { recursive: true });
     await writeFile2(
       cliShimPath,
-      buildCliShimScript({ relayPort: relay.port, relayToken }),
+      buildCliShimScript({ relayPort: relay.port }),
       "utf8"
     );
   }
@@ -598,15 +808,7 @@ async function runTurn(start, turn) {
   };
   const thread = threadState.id ? codex.resumeThread(threadState.id, threadOptions) : codex.startThread(threadOptions);
   emit({ type: "stream-start" });
-  const userMessage = composeUserMessage({
-    text: start.prompt,
-    instructions: start.instructions,
-    // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts
-    toolUsageBlock: cliShimPath && start.tools && start.tools.length > 0 ? composeToolUsageInstructions({
-      tools: start.tools,
-      cliShimPath
-    }) : void 0
-  });
+  const userMessage = start.prompt;
   let turnUsage;
   const textByItem = /* @__PURE__ */ new Map();
   const reasoningByItem = /* @__PURE__ */ new Map();
@@ -620,7 +822,25 @@ async function runTurn(start, turn) {
         threadState.id = event.thread_id;
         emit({ type: "bridge-thread", threadId: event.thread_id });
       }
-      if (cliShimPath && event.item?.type === "command_execution" && typeof event.item.command === "string" && isToolRelayCommand({ command: event.item.command, cliShimPath })) {
+      if (cliShimPath && event.item?.type === "command_execution") {
+        const relayCall = typeof event.item.command === "string" ? parseToolRelayCommand({
+          command: event.item.command,
+          cliShimPath
+        }) : void 0;
+        if (event.type === "item.started" && relay) {
+          if (relayCall) {
+            relay.authorizeToolCall(relayCall);
+          } else if (typeof event.item.command !== "string") {
+            relay.authorizeAnyToolCall();
+          }
+        }
+        if (relayCall) {
+          continue;
+        }
+      }
+      if (relay && isHostMcpToolEvent(event)) {
+        const relayCall = relayCallFromCodexMcpEvent(event);
+        if (relayCall) relay.authorizeToolCall(relayCall);
         continue;
       }
       translateAndEmit(event, {
@@ -653,6 +873,18 @@ function extractMcpToolCallResult(item) {
   }
   return result.content ?? null;
 }
+function isHostMcpToolEvent(event) {
+  return event.item?.type === "mcp_tool_call" && event.item.server === "harness-tools";
+}
+function relayCallFromCodexMcpEvent(event) {
+  if (event.type !== "item.started") return void 0;
+  const toolName = event.item?.tool;
+  if (!toolName) return void 0;
+  return {
+    toolName,
+    input: event.item?.arguments ?? {}
+  };
+}
 function translateAndEmit(event, ctx) {
   if (event.type === "turn.completed") {
     if (event.usage) ctx.setTurnUsage(mapUsage(event.usage));
@@ -813,37 +1045,19 @@ function defaultUsage() {
     outputTokens: { total: 0, text: 0 }
   };
 }
-function composeUserMessage({
-  text,
-  instructions,
-  toolUsageBlock
-}) {
-  const blocks = [];
-  if (instructions) {
-    blocks.push(
-      `<session-instructions>
-The block below is operating guidance from the system, not a message from the user \u2014 follow it, but do not mention it or attribute it to the user.
-
-${instructions}
-</session-instructions>`
-    );
-  }
-  if (toolUsageBlock) blocks.push(toolUsageBlock);
-  blocks.push(instructions ? `<user-message>
-${text}
-</user-message>` : text);
-  return blocks.join("\n\n");
-}
 async function startToolRelay({
-  relayToken,
+  allowedScriptPaths,
   tools,
   emit,
   requestToolResult
 }) {
   const toolNames = new Set(tools.map((t) => t.name));
+  const allowedScriptPathSet = new Set(allowedScriptPaths);
+  const authorizer = new ToolRelayAuthorizer();
+  const pendingCalls = new ToolRelayPendingCalls();
   const server = createServer(async (req, res) => {
     try {
-      if (req.method !== "POST" || req.url !== "/" || req.headers.authorization !== `Bearer ${relayToken}`) {
+      if (req.method !== "POST" || req.url !== "/") {
         res.writeHead(401, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "unauthorized tool relay request" }));
         return;
@@ -861,21 +1075,38 @@ async function startToolRelay({
         );
         return;
       }
-      emit({
-        type: "tool-call",
-        toolCallId: requestId,
-        toolName,
-        input: JSON.stringify(input ?? {}),
-        providerExecuted: false
+      const relayCall = { toolName, input };
+      const authorized = authorizer.consumeToolCall(relayCall) || await isToolRelayRequestFromAllowedProcess({
+        socket: req.socket,
+        allowedScriptPaths: allowedScriptPathSet
       });
-      const { output, isError } = await requestToolResult(requestId);
-      emit({
-        type: "tool-result",
-        toolCallId: requestId,
-        toolName,
-        result: output ?? null,
-        isError: !!isError
+      if (!authorized) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "unauthorized tool relay request" }));
+        return;
+      }
+      const { result } = pendingCalls.begin({
+        call: relayCall,
+        run: async () => {
+          emit({
+            type: "tool-call",
+            toolCallId: requestId,
+            toolName,
+            input: JSON.stringify(input ?? {}),
+            providerExecuted: false
+          });
+          const toolResult = await requestToolResult(requestId);
+          emit({
+            type: "tool-result",
+            toolCallId: requestId,
+            toolName,
+            result: toolResult.output ?? null,
+            isError: !!toolResult.isError
+          });
+          return toolResult;
+        }
       });
+      const { output } = await result;
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ result: output }));
     } catch (error) {
@@ -896,7 +1127,9 @@ async function startToolRelay({
   }
   return {
     port: address.port,
-    close: () => closeServer(server)
+    close: () => closeServer(server),
+    authorizeToolCall: (call) => authorizer.authorizeToolCall(call),
+    authorizeAnyToolCall: () => authorizer.authorizeAnyToolCall()
   };
 }
 function closeServer(server) {
@@ -914,6 +1147,8 @@ function parseArgs(args2) {
       out.bridgeStateDir = args2[++i];
     } else if (args2[i] === "--bootstrap-dir" && i + 1 < args2.length) {
       out.bootstrapDir = args2[++i];
+    } else if (args2[i] === "--cli-shim-dir" && i + 1 < args2.length) {
+      out.cliShimDir = args2[++i];
     }
   }
   return out;
@@ -928,4 +1163,13 @@ function emitFatal(message) {
   stdout2.write(JSON.stringify({ type: "bridge-fatal", message }) + "\n");
   process.exit(1);
 }
+function requireArg({
+  value,
+  name
+}) {
+  if (!value) {
+    emitFatal(`Missing ${name} argument.`);
+  }
+  return value;
+}
 //# sourceMappingURL=index.mjs.map