@ai-sdk/harness-deepagents 1.0.70 → 1.0.72

package/dist/index.d.ts

@@ -2,7 +2,12 @@ import * as _ai_sdk_provider_utils from '@ai-sdk/provider-utils';
 import * as _ai_sdk_harness from '@ai-sdk/harness';
 import { HarnessV1, HarnessV1BuiltinTool } from '@ai-sdk/harness';
 
-type DeepAgentsAuthOptions = {
+type DeepAgentsResolvedAuthenticationMode = 'anthropic' | 'ai-gateway';
+type DeepAgentsAuthenticationMode = DeepAgentsResolvedAuthenticationMode | 'auto';
+/**
+ * @deprecated Passing an object to auth options is deprecated. Use a `DeepAgentsAuthenticationMode` string value ("auto" | "anthropic" | "ai-gateway") instead, and pass credentials via environment variables.
+ */
+type LegacyDeepAgentsAuthOptions = {
     readonly anthropic?: {
         readonly apiKey?: string;
         readonly authToken?: string;
@@ -13,6 +18,7 @@ type DeepAgentsAuthOptions = {
         readonly baseUrl?: string;
     };
 };
+type DeepAgentsAuthOptions = DeepAgentsAuthenticationMode | LegacyDeepAgentsAuthOptions;
 
 type DeepAgentsThinkingConfig = {
     readonly type: 'adaptive';
@@ -130,4 +136,4 @@ declare const deepAgents: _ai_sdk_harness.HarnessV1<{
     }, any, any>;
 }>;
 
-export { type DeepAgentsAuthOptions, type DeepAgentsHarnessSettings, type DeepAgentsThinkingConfig, VERSION, createDeepAgents, deepAgents };
+export { type DeepAgentsAuthOptions, type DeepAgentsAuthenticationMode, type DeepAgentsHarnessSettings, type DeepAgentsThinkingConfig, VERSION, createDeepAgents, deepAgents };

package/dist/index.js

@@ -1,8 +1,6 @@
 // src/deepagents-harness.ts
 import { randomBytes } from "crypto";
-import { readFile } from "fs/promises";
 import { posix } from "path";
-import { fileURLToPath } from "url";
 import {
   commonTool,
   HarnessCapabilityUnsupportedError,
@@ -14,9 +12,11 @@ import {
   createBridgeStartupError,
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
+  maskSandboxCredentials,
   resolveSandboxHomeDir,
   SandboxChannel,
   shellQuote,
+  warnCredentialBrokeringUnavailable,
   waitForBridgeReady,
   writeSkills as writeHarnessSkills
 } from "@ai-sdk/harness/utils";
@@ -24,24 +24,148 @@ import { tool } from "@ai-sdk/provider-utils";
 import { WebSocket } from "ws";
 import { z as z2 } from "zod/v4";
 
+// src/deepagents-bootstrap.ts
+import { readFile } from "fs/promises";
+import { fileURLToPath } from "url";
+var DEEPAGENTS_BOOTSTRAP_DIR = ".harness-bootstrap/deepagents";
+var RIPGREP_VERSION = "14.1.1";
+var RIPGREP_SHA256_X64 = "4cf9f2741e6c465ffdb7c26f38056a59e2a2544b51f7cc128ef28337eeae4d8e";
+var RIPGREP_SHA256_ARM = "c827481c4ff4ea10c9dc7a4022c8de5db34a5737cb74484d62eb94a95841ab2f";
+var cachedBootstrap;
+async function getDeepAgentsBootstrap() {
+  if (cachedBootstrap != null) return cachedBootstrap;
+  const [bridge, pkg, lock] = await Promise.all([
+    readBridgeAsset("index.mjs"),
+    readBridgeAsset("package.json"),
+    readBridgeAsset("pnpm-lock.yaml")
+  ]);
+  cachedBootstrap = {
+    harnessId: "deepagents",
+    bootstrapDir: DEEPAGENTS_BOOTSTRAP_DIR,
+    files: [
+      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },
+      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/package.json`, content: pkg },
+      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock }
+    ],
+    commands: [
+      { command: installRipgrepCommand() },
+      {
+        command: "pnpm install --frozen-lockfile --store-dir .pnpm-store"
+      }
+    ]
+  };
+  return cachedBootstrap;
+}
+function installRipgrepCommand() {
+  const v = RIPGREP_VERSION;
+  return [
+    "command -v rg >/dev/null 2>&1 || {",
+    'case "$(uname -m)" in',
+    `aarch64) a=aarch64-unknown-linux-gnu; sha=${RIPGREP_SHA256_ARM} ;;`,
+    `*) a=x86_64-unknown-linux-musl; sha=${RIPGREP_SHA256_X64} ;;`,
+    "esac;",
+    `f=/tmp/ripgrep-${v}.tar.gz;`,
+    `curl -fsSL "https://github.com/BurntSushi/ripgrep/releases/download/${v}/ripgrep-${v}-$a.tar.gz" -o "$f"`,
+    '&& echo "$sha  $f" | sha256sum -c -',
+    '&& tar xzf "$f" -C /tmp',
+    `&& mv "/tmp/ripgrep-${v}-$a/rg" /usr/local/bin/rg && chmod +x /usr/local/bin/rg;`,
+    "}"
+  ].join(" ");
+}
+async function readBridgeAsset(name) {
+  const candidates = [
+    new URL(`./bridge/${name}`, import.meta.url),
+    new URL(`../bridge/${name}`, import.meta.url)
+  ];
+  let lastErr;
+  for (const url of candidates) {
+    try {
+      return await readFile(fileURLToPath(url), "utf8");
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT") throw err;
+      lastErr = err;
+    }
+  }
+  throw lastErr ?? new Error(`bridge asset not found: ${name}`);
+}
+
 // src/deepagents-auth.ts
-import { getAiGatewayAuthFromEnv } from "@ai-sdk/harness/utils";
+import {
+  createCredentialRequestTransformation,
+  getAiGatewayAuthFromEnv
+} from "@ai-sdk/harness/utils";
+var DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES = [
+  "AI_GATEWAY_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN"
+];
+function createDeepAgentsRequestTransformations(env, auth) {
+  const headers = {};
+  if (env.ANTHROPIC_API_KEY) {
+    headers["x-api-key"] = env.ANTHROPIC_API_KEY;
+  }
+  if (env.ANTHROPIC_AUTH_TOKEN) {
+    headers.Authorization = `Bearer ${env.ANTHROPIC_AUTH_TOKEN}`;
+  }
+  return Object.keys(headers).length === 0 ? [] : [
+    createCredentialRequestTransformation({
+      baseUrl: auth === "ai-gateway" ? env.ANTHROPIC_BASE_URL : env.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com",
+      headers
+    })
+  ];
+}
 function resolveDeepAgentsEnv({
   auth,
   processEnv = process.env
 }) {
-  if (auth?.anthropic) {
-    return pickAnthropic({ explicit: auth.anthropic, processEnv });
+  const normalizedAuth = normalizeDeepAgentsAuthToLegacyAuth(auth);
+  if (normalizedAuth?.anthropic) {
+    return pickAnthropic({ explicit: normalizedAuth.anthropic, processEnv });
   }
   const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env: processEnv });
-  if (auth?.gateway) {
-    return pickGateway({ explicit: auth.gateway, gatewayAuthFromEnv });
+  if (normalizedAuth?.gateway) {
+    return pickGateway({
+      explicit: normalizedAuth.gateway,
+      gatewayAuthFromEnv
+    });
   }
   if (gatewayAuthFromEnv.apiKey) {
     return pickGateway({ explicit: {}, gatewayAuthFromEnv });
   }
   return pickAnthropic({ processEnv });
 }
+function resolveDeepAgentsAuthenticationMode({
+  auth,
+  processEnv = process.env
+}) {
+  if (auth === "anthropic" || typeof auth !== "string" && auth?.anthropic) {
+    return "anthropic";
+  }
+  if (auth === "ai-gateway" || typeof auth !== "string" && auth?.gateway) {
+    return "ai-gateway";
+  }
+  return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey ? "ai-gateway" : "anthropic";
+}
+function normalizeDeepAgentsAuthToLegacyAuth(auth) {
+  if (auth == null || auth === "auto") {
+    return void 0;
+  }
+  if (typeof auth === "string") {
+    switch (auth) {
+      case "anthropic":
+        return { anthropic: {} };
+      case "ai-gateway":
+        return { gateway: {} };
+      default:
+        return void 0;
+    }
+  }
+  console.warn(
+    '[deepagents] Passing an object to auth options is deprecated. Use a string mode ("auto" | "anthropic" | "ai-gateway") instead, and pass credentials via environment variables.'
+  );
+  return auth;
+}
 function pickAnthropic({
   explicit,
   processEnv
@@ -114,30 +238,10 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 ]);
 
 // src/version.ts
-var VERSION = true ? "1.0.70" : "0.0.0-test";
+var VERSION = true ? "1.0.72" : "0.0.0-test";
 
 // src/deepagents-harness.ts
-var BOOTSTRAP_DIR = ".harness-bootstrap/deepagents";
 var DEEPAGENTS_CLIENT_APP = `ai-sdk/harness-deepagents/${VERSION}`;
-var RIPGREP_VERSION = "14.1.1";
-var RIPGREP_SHA256_X64 = "4cf9f2741e6c465ffdb7c26f38056a59e2a2544b51f7cc128ef28337eeae4d8e";
-var RIPGREP_SHA256_ARM = "c827481c4ff4ea10c9dc7a4022c8de5db34a5737cb74484d62eb94a95841ab2f";
-function installRipgrepCommand() {
-  const v = RIPGREP_VERSION;
-  return [
-    "command -v rg >/dev/null 2>&1 || {",
-    'case "$(uname -m)" in',
-    `aarch64) a=aarch64-unknown-linux-gnu; sha=${RIPGREP_SHA256_ARM} ;;`,
-    `*) a=x86_64-unknown-linux-musl; sha=${RIPGREP_SHA256_X64} ;;`,
-    "esac;",
-    `f=/tmp/ripgrep-${v}.tar.gz;`,
-    `curl -fsSL "https://github.com/BurntSushi/ripgrep/releases/download/${v}/ripgrep-${v}-$a.tar.gz" -o "$f"`,
-    '&& echo "$sha  $f" | sha256sum -c -',
-    '&& tar xzf "$f" -C /tmp',
-    `&& mv "/tmp/ripgrep-${v}-$a/rg" /usr/local/bin/rg && chmod +x /usr/local/bin/rg;`,
-    "}"
-  ].join(" ");
-}
 var SKILLS_SOURCE_PATH = "/.agents/skills";
 var DEEPAGENTS_BUILTIN_TOOLS = {
   read: commonTool("read", {
@@ -207,7 +311,6 @@ var deepAgentsResumeStateSchema = z2.object({
   bridge: deepAgentsBridgeCoordsSchema.optional()
 });
 function createDeepAgents(settings = {}) {
-  let cachedBootstrap;
   return {
     specificationVersion: "harness-v1",
     harnessId: "deepagents",
@@ -215,38 +318,39 @@ function createDeepAgents(settings = {}) {
     // Built-in tool approvals are gated in-bridge via DeepAgents' interruptOn (HITL) middleware.
     supportsBuiltinToolApprovals: true,
     lifecycleStateSchema: deepAgentsResumeStateSchema,
-    getBootstrap: async () => {
-      if (cachedBootstrap != null) return cachedBootstrap;
-      const [bridge, pkg, lock] = await Promise.all([
-        readBridgeAsset("index.mjs"),
-        readBridgeAsset("package.json"),
-        readBridgeAsset("pnpm-lock.yaml")
-      ]);
-      cachedBootstrap = {
-        harnessId: "deepagents",
-        bootstrapDir: BOOTSTRAP_DIR,
-        files: [
-          { path: `${BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },
-          { path: `${BOOTSTRAP_DIR}/package.json`, content: pkg },
-          { path: `${BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock }
-        ],
-        commands: [
-          { command: installRipgrepCommand() },
-          {
-            command: "pnpm install --frozen-lockfile --store-dir .pnpm-store"
-          }
-        ]
-      };
-      return cachedBootstrap;
-    },
+    getBootstrap: getDeepAgentsBootstrap,
     doStart: async (startOpts) => {
       const permissionMode = startOpts.permissionMode;
       const sandboxSession = startOpts.sandboxSession;
+      const authenticationMode = resolveDeepAgentsAuthenticationMode({
+        auth: settings.auth
+      });
+      const resolvedAuthEnvironment = resolveDeepAgentsEnv({
+        auth: settings.auth
+      });
+      let sandboxAuthEnvironment = resolvedAuthEnvironment;
+      if (sandboxSession.addRequestTransformations != null) {
+        const requestTransformations = createDeepAgentsRequestTransformations(
+          resolvedAuthEnvironment,
+          authenticationMode
+        );
+        if (requestTransformations.length > 0) {
+          await sandboxSession.addRequestTransformations(
+            requestTransformations
+          );
+        }
+        sandboxAuthEnvironment = maskSandboxCredentials({
+          environment: resolvedAuthEnvironment,
+          credentialEnvironmentVariables: DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES
+        });
+      } else {
+        warnCredentialBrokeringUnavailable();
+      }
       const session = sandboxSession.restricted();
       const sandboxId = sandboxSession.id;
       const bootstrapDir = posix.resolve(
         sandboxSession.defaultWorkingDirectory,
-        BOOTSTRAP_DIR
+        DEEPAGENTS_BOOTSTRAP_DIR
       );
       const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
       const isResume = lifecycleState != null;
@@ -269,12 +373,16 @@ function createDeepAgents(settings = {}) {
       });
       if (coords) {
         try {
-          const attachUrl = await sandboxSession.getPortUrl({
+          const endpoint2 = await sandboxSession.getPortEndpoint({
             port: coords.port,
             protocol: "ws"
-          }) + `?agent_bridge_token=${encodeURIComponent(coords.token)}`;
+          });
+          const attachEndpoint = withBridgeToken({
+            endpoint: endpoint2,
+            token: coords.token
+          });
           const attachChannel = new SandboxChannel({
-            connect: () => openWebSocket(attachUrl),
+            connect: () => openWebSocket(attachEndpoint),
             outboundSchema: outboundMessageSchema,
             initialLastSeenEventId: coords.lastSeenEventId,
             onDiagnostic,
@@ -319,7 +427,7 @@ function createDeepAgents(settings = {}) {
         skillsPaths.push(homeSkillsRoot);
       }
       const env = {
-        ...resolveDeepAgentsEnv({ auth: settings.auth }),
+        ...sandboxAuthEnvironment,
         AI_SDK_HARNESS_CLIENT_APP: DEEPAGENTS_CLIENT_APP,
         BRIDGE_CHANNEL_TOKEN: token,
         BRIDGE_WS_PORT: String(port)
@@ -369,12 +477,13 @@ function createDeepAgents(settings = {}) {
         })
       });
       void drainBridgeProcessStream(proc.stdout);
-      const wsUrl = await sandboxSession.getPortUrl({
+      const endpoint = await sandboxSession.getPortEndpoint({
         port: boundPort,
         protocol: "ws"
-      }) + `?agent_bridge_token=${encodeURIComponent(token)}`;
+      });
+      const bridgeEndpoint = withBridgeToken({ endpoint, token });
       const channel = new SandboxChannel({
-        connect: () => openWebSocket(wsUrl),
+        connect: () => openWebSocket(bridgeEndpoint),
         outboundSchema: outboundMessageSchema,
         onDiagnostic,
         onBridgeError
@@ -410,23 +519,6 @@ function resolveBridgePort(sandboxSession, override) {
     message: "The deepagents harness needs a TCP port exposed by the sandbox. Create the sandbox with `ports: [<port>]` or pass `createDeepAgents({ port })`."
   });
 }
-async function readBridgeAsset(name) {
-  const candidates = [
-    new URL(`./bridge/${name}`, import.meta.url),
-    new URL(`../bridge/${name}`, import.meta.url)
-  ];
-  let lastErr;
-  for (const url of candidates) {
-    try {
-      return await readFile(fileURLToPath(url), "utf8");
-    } catch (err) {
-      const code = err.code;
-      if (code !== "ENOENT") throw err;
-      lastErr = err;
-    }
-  }
-  throw lastErr ?? new Error(`bridge asset not found: ${name}`);
-}
 async function writeSkills({
   sandbox,
   root,
@@ -444,9 +536,14 @@ async function writeSkills({
     invalidSkillFilePathMessage: ({ skillName, filePath }) => `Invalid skill file path for '${skillName}': ${filePath}`
   });
 }
-function openWebSocket(url) {
+function openWebSocket({
+  url,
+  headers
+}) {
   return new Promise((resolve, reject) => {
-    const ws = new WebSocket(url);
+    const ws = new WebSocket(url, {
+      headers: headers == null ? void 0 : { ...headers }
+    });
     const onOpen = () => {
       ws.off("error", onError);
       resolve(ws);
@@ -459,6 +556,14 @@ function openWebSocket(url) {
     ws.once("error", onError);
   });
 }
+function withBridgeToken({
+  endpoint,
+  token
+}) {
+  const bridgeUrl = new URL(endpoint.url);
+  bridgeUrl.searchParams.set("agent_bridge_token", token);
+  return { ...endpoint, url: bridgeUrl.toString() };
+}
 function createSession({
   sessionId,
   channel,