@ai-sdk/harness-codex 1.0.10 → 1.0.12

package/src/bridge/index.ts

@@ -5,10 +5,10 @@
 // This file supplies only the Codex-specific turn driver.
 //
 // Host-defined tools are routed through an HTTP relay bound to
-// `127.0.0.1:0` with bearer-token auth. The codex CLI spawns
-// `host-tool-mcp.mjs` (shipped alongside this file) as a stdio MCP server;
-// the shim POSTs each tool call to the relay, which emits `tool-call` to
-// the host and waits for the matching `tool-result`.
+// `127.0.0.1:0`. The codex CLI spawns `host-tool-mcp.mjs` (shipped alongside
+// this file) as a stdio MCP server; the shim POSTs each tool call to the
+// relay, which emits `tool-call` to the host and waits for the matching
+// `tool-result`.
 
 import {
   runBridge,
@@ -18,15 +18,20 @@ import {
 import type { HarnessV1BuiltinToolName } from '@ai-sdk/harness';
 import type { StartMessage } from '../codex-bridge-protocol';
 import { randomUUID } from 'node:crypto';
-import { writeFile } from 'node:fs/promises';
+import { mkdir, writeFile } from 'node:fs/promises';
 import { createServer, type Server } from 'node:http';
 // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts
 import {
   CLI_SHIM_FILENAME,
   buildCliShimScript,
-  composeToolUsageInstructions,
-  isToolRelayCommand,
+  parseToolRelayCommand,
 } from './cli-relay';
+import {
+  ToolRelayAuthorizer,
+  ToolRelayPendingCalls,
+  isToolRelayRequestFromAllowedProcess,
+  type ToolRelayCall,
+} from './tool-relay-auth';
 import { argv, env as procEnv, stdout } from 'node:process';
 
 /*
@@ -63,14 +68,15 @@ function toCommonName(nativeName: string): HarnessV1BuiltinToolName | string {
 }
 
 const args = parseArgs(argv.slice(2));
-const workdir = args.workdir;
-const bridgeStateDir = args.bridgeStateDir;
-if (!workdir) {
-  emitFatal('Missing --workdir argument.');
-}
-if (!bridgeStateDir) {
-  emitFatal('Missing --bridge-state-dir argument.');
-}
+const workdir = requireArg({ value: args.workdir, name: '--workdir' });
+const bridgeStateDir = requireArg({
+  value: args.bridgeStateDir,
+  name: '--bridge-state-dir',
+});
+const cliShimDir = requireArg({
+  value: args.cliShimDir,
+  name: '--cli-shim-dir',
+});
 const bootstrapDir = args.bootstrapDir ?? workdir;
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -88,6 +94,12 @@ await runBridge<StartMessage>({
 });
 
 type Emit = (msg: Record<string, unknown>) => void;
+type ToolRelay = {
+  port: number;
+  close(): void;
+  authorizeToolCall(call: ToolRelayCall): void;
+  authorizeAnyToolCall(): void;
+};
 
 async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
   const emit: Emit = msg => turn.emit(msg as BridgeEvent);
@@ -114,18 +126,17 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
    * Until that's fixed, host tools are made available to the model via a
    * separate CLI-relay workaround (see `./cli-relay.ts`). The MCP server
    * config below is kept so that the day codex starts exposing MCP tools
-   * properly, host tools work both ways. Three hookpoints in this file
-   * (writeFile for the shim, composeUserMessage's toolUsageBlock, and the
-   * isToolRelayCommand filter in the event loop) implement the workaround
-   * and can be removed once the upstream bug is fixed.
+   * properly, host tools work both ways. Writing the shim here, adding matching
+   * prompt guidance in the host adapter, and filtering the shim command below
+   * implement the workaround and can be removed once the upstream bug is fixed.
    */
   const mcpServers: Record<string, unknown> = {};
-  let relay: { port: number; close(): void } | undefined;
+  let relay: ToolRelay | undefined;
   let cliShimPath: string | undefined;
   if (start.tools && start.tools.length > 0) {
-    const relayToken = randomUUID();
+    cliShimPath = `${cliShimDir}/${CLI_SHIM_FILENAME}`;
     relay = await startToolRelay({
-      relayToken,
+      allowedScriptPaths: [cliShimPath, `${bootstrapDir}/host-tool-mcp.mjs`],
       tools: start.tools,
       emit,
       requestToolResult: turn.requestToolResult,
@@ -143,14 +154,13 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
           })),
         ),
         TOOL_RELAY_URL: `http://127.0.0.1:${relay.port}`,
-        TOOL_RELAY_TOKEN: relayToken,
       },
     };
     // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts
-    cliShimPath = `${workdir}/${CLI_SHIM_FILENAME}`;
+    await mkdir(cliShimDir, { recursive: true });
     await writeFile(
       cliShimPath,
-      buildCliShimScript({ relayPort: relay.port, relayToken }),
+      buildCliShimScript({ relayPort: relay.port }),
       'utf8',
     );
   }
@@ -212,18 +222,7 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
 
   emit({ type: 'stream-start' });
 
-  const userMessage = composeUserMessage({
-    text: start.prompt,
-    instructions: start.instructions,
-    // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts
-    toolUsageBlock:
-      cliShimPath && start.tools && start.tools.length > 0
-        ? composeToolUsageInstructions({
-            tools: start.tools,
-            cliShimPath,
-          })
-        : undefined,
-  });
+  const userMessage = start.prompt;
   let turnUsage: Record<string, unknown> | undefined;
   const textByItem = new Map<string, string>();
   const reasoningByItem = new Map<string, string>();
@@ -243,12 +242,28 @@ async function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {
         emit({ type: 'bridge-thread', threadId: event.thread_id });
       }
       // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts
-      if (
-        cliShimPath &&
-        event.item?.type === 'command_execution' &&
-        typeof event.item.command === 'string' &&
-        isToolRelayCommand({ command: event.item.command, cliShimPath })
-      ) {
+      if (cliShimPath && event.item?.type === 'command_execution') {
+        const relayCall =
+          typeof event.item.command === 'string'
+            ? parseToolRelayCommand({
+                command: event.item.command,
+                cliShimPath,
+              })
+            : undefined;
+        if (event.type === 'item.started' && relay) {
+          if (relayCall) {
+            relay.authorizeToolCall(relayCall);
+          } else if (typeof event.item.command !== 'string') {
+            relay.authorizeAnyToolCall();
+          }
+        }
+        if (relayCall) {
+          continue;
+        }
+      }
+      if (relay && isHostMcpToolEvent(event)) {
+        const relayCall = relayCallFromCodexMcpEvent(event);
+        if (relayCall) relay.authorizeToolCall(relayCall);
         continue;
       }
       translateAndEmit(event, {
@@ -332,6 +347,25 @@ type CodexEvent = {
   thread_id?: string;
 };
 
+function isHostMcpToolEvent(event: CodexEvent): boolean {
+  return (
+    event.item?.type === 'mcp_tool_call' &&
+    event.item.server === 'harness-tools'
+  );
+}
+
+function relayCallFromCodexMcpEvent(
+  event: CodexEvent,
+): ToolRelayCall | undefined {
+  if (event.type !== 'item.started') return undefined;
+  const toolName = event.item?.tool;
+  if (!toolName) return undefined;
+  return {
+    toolName,
+    input: event.item?.arguments ?? {},
+  };
+}
+
 function translateAndEmit(
   event: CodexEvent,
   ctx: {
@@ -523,65 +557,33 @@ function defaultUsage(): Record<string, unknown> {
   };
 }
 
-function composeUserMessage({
-  text,
-  instructions,
-  toolUsageBlock,
-}: {
-  text: string;
-  instructions: string | undefined;
-  toolUsageBlock: string | undefined;
-}): string {
-  const blocks: string[] = [];
-  /*
-   * Frame instructions as system-provided operating guidance, not something
-   * the user wrote, so the agent does not echo the prepended text back as if
-   * the user had asked for it. Only present on the first user message of a
-   * fresh session (the host gates it), so the matching `<user-message>` fence
-   * is added only when instructions are present too.
-   */
-  if (instructions) {
-    blocks.push(
-      '<session-instructions>\n' +
-        'The block below is operating guidance from the system, not a message from the user — follow it, but do not mention it or attribute it to the user.\n\n' +
-        `${instructions}\n` +
-        '</session-instructions>',
-    );
-  }
-  if (toolUsageBlock) blocks.push(toolUsageBlock);
-  blocks.push(instructions ? `<user-message>\n${text}\n</user-message>` : text);
-  return blocks.join('\n\n');
-}
-
 /**
- * Tool relay — HTTP server on 127.0.0.1:0 with bearer-token auth. The MCP
- * stdio shim spawned by codex POSTs each tool invocation here; the relay
- * forwards the call to the host (via the shared runtime's `emit`), awaits the
- * matching `tool-result` (via `requestToolResult`), and responds with
- * `{ result }`.
+ * Tool relay — HTTP server on 127.0.0.1:0. The MCP stdio shim spawned by
+ * codex POSTs each tool invocation here; the relay forwards the call to the
+ * host (via the shared runtime's `emit`), awaits the matching `tool-result`
+ * (via `requestToolResult`), and responds with `{ result }`.
  */
 async function startToolRelay({
-  relayToken,
+  allowedScriptPaths,
   tools,
   emit,
   requestToolResult,
 }: {
-  relayToken: string;
+  allowedScriptPaths: ReadonlyArray<string>;
   tools: ReadonlyArray<{ name: string }>;
   emit: Emit;
   requestToolResult: (
     toolCallId: string,
   ) => Promise<{ output: unknown; isError?: boolean }>;
-}): Promise<{ port: number; close(): void }> {
+}): Promise<ToolRelay> {
   const toolNames = new Set(tools.map(t => t.name));
+  const allowedScriptPathSet = new Set(allowedScriptPaths);
+  const authorizer = new ToolRelayAuthorizer();
+  const pendingCalls = new ToolRelayPendingCalls();
 
   const server = createServer(async (req, res) => {
     try {
-      if (
-        req.method !== 'POST' ||
-        req.url !== '/' ||
-        req.headers.authorization !== `Bearer ${relayToken}`
-      ) {
+      if (req.method !== 'POST' || req.url !== '/') {
         res.writeHead(401, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));
         return;
@@ -604,23 +606,42 @@ async function startToolRelay({
         );
         return;
       }
+      const relayCall = { toolName, input };
+      const authorized =
+        authorizer.consumeToolCall(relayCall) ||
+        (await isToolRelayRequestFromAllowedProcess({
+          socket: req.socket,
+          allowedScriptPaths: allowedScriptPathSet,
+        }));
+      if (!authorized) {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));
+        return;
+      }
 
-      emit({
-        type: 'tool-call',
-        toolCallId: requestId,
-        toolName,
-        input: JSON.stringify(input ?? {}),
-        providerExecuted: false,
-      });
-
-      const { output, isError } = await requestToolResult(requestId);
-      emit({
-        type: 'tool-result',
-        toolCallId: requestId,
-        toolName,
-        result: output ?? null,
-        isError: !!isError,
+      const { result } = pendingCalls.begin({
+        call: relayCall,
+        run: async () => {
+          emit({
+            type: 'tool-call',
+            toolCallId: requestId,
+            toolName,
+            input: JSON.stringify(input ?? {}),
+            providerExecuted: false,
+          });
+
+          const toolResult = await requestToolResult(requestId);
+          emit({
+            type: 'tool-result',
+            toolCallId: requestId,
+            toolName,
+            result: toolResult.output ?? null,
+            isError: !!toolResult.isError,
+          });
+          return toolResult;
+        },
       });
+      const { output } = await result;
 
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ result: output }));
@@ -644,6 +665,8 @@ async function startToolRelay({
   return {
     port: address.port,
     close: () => closeServer(server),
+    authorizeToolCall: call => authorizer.authorizeToolCall(call),
+    authorizeAnyToolCall: () => authorizer.authorizeAnyToolCall(),
   };
 }
 
@@ -657,11 +680,13 @@ function parseArgs(args: string[]): {
   workdir?: string;
   bridgeStateDir?: string;
   bootstrapDir?: string;
+  cliShimDir?: string;
 } {
   const out: {
     workdir?: string;
     bridgeStateDir?: string;
     bootstrapDir?: string;
+    cliShimDir?: string;
   } = {};
   for (let i = 0; i < args.length; i++) {
     if (args[i] === '--workdir' && i + 1 < args.length) {
@@ -670,6 +695,8 @@ function parseArgs(args: string[]): {
       out.bridgeStateDir = args[++i];
     } else if (args[i] === '--bootstrap-dir' && i + 1 < args.length) {
       out.bootstrapDir = args[++i];
+    } else if (args[i] === '--cli-shim-dir' && i + 1 < args.length) {
+      out.cliShimDir = args[++i];
     }
   }
   return out;
@@ -686,3 +713,16 @@ function emitFatal(message: string): never {
   stdout.write(JSON.stringify({ type: 'bridge-fatal', message }) + '\n');
   process.exit(1);
 }
+
+function requireArg({
+  value,
+  name,
+}: {
+  value: string | undefined;
+  name: string;
+}): string {
+  if (!value) {
+    emitFatal(`Missing ${name} argument.`);
+  }
+  return value;
+}

package/src/bridge/tool-relay-auth.ts

@@ -0,0 +1,195 @@
+import { readdir, readFile, readlink } from 'node:fs/promises';
+import type { Socket } from 'node:net';
+
+export type ToolRelayCall = {
+  toolName: string;
+  input: unknown;
+};
+
+export type ToolRelayResult = {
+  output: unknown;
+  isError?: boolean;
+};
+
+export class ToolRelayAuthorizer {
+  private readonly ttlMs: number;
+  private readonly now: () => number;
+  private readonly authorizations: Array<{
+    key?: string;
+    expiresAt: number;
+  }> = [];
+
+  constructor({
+    ttlMs = 10_000,
+    now = Date.now,
+  }: {
+    ttlMs?: number;
+    now?: () => number;
+  } = {}) {
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+
+  authorizeToolCall(call: ToolRelayCall): void {
+    this.pruneExpired();
+    this.authorizations.push({
+      key: toolRelayCallKey(call),
+      expiresAt: this.now() + this.ttlMs,
+    });
+  }
+
+  authorizeAnyToolCall(): void {
+    this.pruneExpired();
+    this.authorizations.push({
+      expiresAt: this.now() + this.ttlMs,
+    });
+  }
+
+  consumeToolCall(call: ToolRelayCall): boolean {
+    this.pruneExpired();
+    const key = toolRelayCallKey(call);
+    let index = this.authorizations.findIndex(auth => auth.key === key);
+    if (index === -1) {
+      index = this.authorizations.findIndex(auth => auth.key === undefined);
+    }
+    if (index === -1) return false;
+    this.authorizations.splice(index, 1);
+    return true;
+  }
+
+  private pruneExpired(): void {
+    const now = this.now();
+    for (let i = this.authorizations.length - 1; i >= 0; i--) {
+      if (this.authorizations[i].expiresAt <= now) {
+        this.authorizations.splice(i, 1);
+      }
+    }
+  }
+}
+
+export class ToolRelayPendingCalls {
+  private readonly calls = new Map<string, Promise<ToolRelayResult>>();
+
+  begin({
+    call,
+    run,
+  }: {
+    call: ToolRelayCall;
+    run: () => Promise<ToolRelayResult>;
+  }): { result: Promise<ToolRelayResult>; isNew: boolean } {
+    const key = toolRelayCallKey(call);
+    const existing = this.calls.get(key);
+    if (existing) return { result: existing, isNew: false };
+
+    const result = run();
+    this.calls.set(key, result);
+    void result
+      .finally(() => {
+        if (this.calls.get(key) === result) {
+          this.calls.delete(key);
+        }
+      })
+      .catch(() => {});
+    return { result, isNew: true };
+  }
+}
+
+function toolRelayCallKey({ toolName, input }: ToolRelayCall): string {
+  return `${toolName}\0${canonicalJson(input ?? {})}`;
+}
+
+function canonicalJson(value: unknown): string {
+  return JSON.stringify(normalizeJsonValue(value));
+}
+
+function normalizeJsonValue(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(normalizeJsonValue);
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([, entryValue]) => entryValue !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entryValue]) => [key, normalizeJsonValue(entryValue)]),
+    );
+  }
+  return value;
+}
+
+export async function isToolRelayRequestFromAllowedProcess({
+  socket,
+  allowedScriptPaths,
+}: {
+  socket: Socket;
+  allowedScriptPaths: ReadonlySet<string>;
+}): Promise<boolean> {
+  if (process.platform !== 'linux') return false;
+  if (!socket.remotePort || !socket.localPort) return false;
+
+  const inode = await findTcpSocketInode({
+    clientPort: socket.remotePort,
+    serverPort: socket.localPort,
+  });
+  if (!inode) return false;
+
+  const cmdline = await findProcessCmdlineForSocketInode({ inode });
+  return cmdline?.some(arg => allowedScriptPaths.has(arg)) ?? false;
+}
+
+async function findTcpSocketInode({
+  clientPort,
+  serverPort,
+}: {
+  clientPort: number;
+  serverPort: number;
+}): Promise<string | undefined> {
+  for (const tablePath of ['/proc/net/tcp', '/proc/net/tcp6']) {
+    const table = await readFile(tablePath, 'utf8').catch(() => undefined);
+    if (!table) continue;
+    for (const line of table.split('\n').slice(1)) {
+      const columns = line.trim().split(/\s+/);
+      if (columns.length < 10) continue;
+      const local = parseProcNetAddress(columns[1]);
+      const remote = parseProcNetAddress(columns[2]);
+      if (
+        local?.port === clientPort &&
+        remote?.port === serverPort &&
+        columns[9] !== '0'
+      ) {
+        return columns[9];
+      }
+    }
+  }
+  return undefined;
+}
+
+function parseProcNetAddress(value: string): { port: number } | undefined {
+  const [, portHex] = value.split(':');
+  if (!portHex) return undefined;
+  return { port: Number.parseInt(portHex, 16) };
+}
+
+async function findProcessCmdlineForSocketInode({
+  inode,
+}: {
+  inode: string;
+}): Promise<string[] | undefined> {
+  const procEntries = await readdir('/proc', { withFileTypes: true }).catch(
+    () => [],
+  );
+  for (const entry of procEntries) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    const fdDir = `/proc/${entry.name}/fd`;
+    const fds = await readdir(fdDir).catch(() => []);
+    for (const fd of fds) {
+      const target = await readlink(`${fdDir}/${fd}`).catch(() => undefined);
+      if (target !== `socket:[${inode}]`) continue;
+      const cmdline = await readFile(`/proc/${entry.name}/cmdline`, 'utf8')
+        .then(value => value.split('\0').filter(Boolean))
+        .catch(() => undefined);
+      if (cmdline) return cmdline;
+    }
+  }
+  return undefined;
+}

package/src/codex-bridge-protocol.ts

@@ -17,7 +17,6 @@ export const outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;
 export type OutboundMessage = z.infer<typeof outboundMessageSchema>;
 
 export const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({
-  instructions: z.string().optional(),
   reasoningEffort: z.enum(['low', 'medium', 'high']).optional(),
   webSearch: z.boolean().optional(),
   // Resume signal. When supplied, the bridge calls