@ai-sdk/harness-opencode 0.0.0-cca10482-20260708215408

package/src/bridge/tool-relay-auth.ts

@@ -0,0 +1,151 @@
+import { readdir, readFile, readlink } from 'node:fs/promises';
+import type { Socket } from 'node:net';
+
+export type ToolRelayCall = {
+  toolName: string;
+  input: unknown;
+};
+
+export class ToolRelayAuthorizer {
+  private readonly ttlMs: number;
+  private readonly now: () => number;
+  private readonly authorizations: Array<{ key: string; expiresAt: number }> =
+    [];
+
+  constructor({
+    ttlMs = 10_000,
+    now = Date.now,
+  }: {
+    ttlMs?: number;
+    now?: () => number;
+  } = {}) {
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+
+  authorizeToolCall(call: ToolRelayCall): void {
+    this.pruneExpired();
+    this.authorizations.push({
+      key: toolRelayCallKey(call),
+      expiresAt: this.now() + this.ttlMs,
+    });
+  }
+
+  consumeToolCall(call: ToolRelayCall): boolean {
+    this.pruneExpired();
+    const key = toolRelayCallKey(call);
+    const index = this.authorizations.findIndex(auth => auth.key === key);
+    if (index === -1) return false;
+    this.authorizations.splice(index, 1);
+    return true;
+  }
+
+  private pruneExpired(): void {
+    const now = this.now();
+    for (let i = this.authorizations.length - 1; i >= 0; i--) {
+      if (this.authorizations[i].expiresAt <= now) {
+        this.authorizations.splice(i, 1);
+      }
+    }
+  }
+}
+
+function toolRelayCallKey({ toolName, input }: ToolRelayCall): string {
+  return `${toolName}\0${canonicalJson(input ?? {})}`;
+}
+
+function canonicalJson(value: unknown): string {
+  return JSON.stringify(normalizeJsonValue(value));
+}
+
+function normalizeJsonValue(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(normalizeJsonValue);
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([, entryValue]) => entryValue !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entryValue]) => [key, normalizeJsonValue(entryValue)]),
+    );
+  }
+  return value;
+}
+
+export async function isToolRelayRequestFromAllowedProcess({
+  socket,
+  allowedScriptPaths,
+}: {
+  socket: Socket;
+  allowedScriptPaths: ReadonlySet<string>;
+}): Promise<boolean> {
+  if (process.platform !== 'linux') return false;
+  if (!socket.remotePort || !socket.localPort) return false;
+
+  const inode = await findTcpSocketInode({
+    clientPort: socket.remotePort,
+    serverPort: socket.localPort,
+  });
+  if (!inode) return false;
+
+  const cmdline = await findProcessCmdlineForSocketInode({ inode });
+  return cmdline?.some(arg => allowedScriptPaths.has(arg)) ?? false;
+}
+
+async function findTcpSocketInode({
+  clientPort,
+  serverPort,
+}: {
+  clientPort: number;
+  serverPort: number;
+}): Promise<string | undefined> {
+  for (const tablePath of ['/proc/net/tcp', '/proc/net/tcp6']) {
+    const table = await readFile(tablePath, 'utf8').catch(() => undefined);
+    if (!table) continue;
+    for (const line of table.split('\n').slice(1)) {
+      const columns = line.trim().split(/\s+/);
+      if (columns.length < 10) continue;
+      const local = parseProcNetAddress(columns[1]);
+      const remote = parseProcNetAddress(columns[2]);
+      if (
+        local?.port === clientPort &&
+        remote?.port === serverPort &&
+        columns[9] !== '0'
+      ) {
+        return columns[9];
+      }
+    }
+  }
+  return undefined;
+}
+
+function parseProcNetAddress(value: string): { port: number } | undefined {
+  const [, portHex] = value.split(':');
+  if (!portHex) return undefined;
+  return { port: Number.parseInt(portHex, 16) };
+}
+
+async function findProcessCmdlineForSocketInode({
+  inode,
+}: {
+  inode: string;
+}): Promise<string[] | undefined> {
+  const procEntries = await readdir('/proc', { withFileTypes: true }).catch(
+    () => [],
+  );
+  for (const entry of procEntries) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    const fdDir = `/proc/${entry.name}/fd`;
+    const fds = await readdir(fdDir).catch(() => []);
+    for (const fd of fds) {
+      const target = await readlink(`${fdDir}/${fd}`).catch(() => undefined);
+      if (target !== `socket:[${inode}]`) continue;
+      const cmdline = await readFile(`/proc/${entry.name}/cmdline`, 'utf8')
+        .then(value => value.split('\0').filter(Boolean))
+        .catch(() => undefined);
+      if (cmdline) return cmdline;
+    }
+  }
+  return undefined;
+}

package/src/index.ts

@@ -0,0 +1,12 @@
+import { createOpenCode } from './opencode-harness';
+
+/**
+ * Default `openCode` harness instance with no overrides. Equivalent to
+ * `createOpenCode()`.
+ */
+export const openCode = createOpenCode();
+
+export { createOpenCode } from './opencode-harness';
+export { VERSION } from './version';
+export type { OpenCodeHarnessSettings } from './opencode-harness';
+export type { OpenCodeAuthOptions } from './opencode-auth';

package/src/opencode-auth.ts

@@ -0,0 +1,175 @@
+import { getAiGatewayAuthFromEnv } from '@ai-sdk/harness/utils';
+
+export type OpenCodeAuthOptions = {
+  readonly gateway?: {
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+  };
+  readonly anthropic?: {
+    readonly apiKey?: string;
+    readonly authToken?: string;
+    readonly baseUrl?: string;
+  };
+  readonly openai?: {
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+    readonly organization?: string;
+    readonly project?: string;
+  };
+  readonly openaiCompatible?: {
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+    readonly name?: string;
+    readonly queryParams?: Record<string, string>;
+  };
+};
+
+export function resolveOpenCodeProvider({
+  model,
+  provider,
+}: {
+  model?: string;
+  provider?: string;
+}): 'anthropic' | 'openai' {
+  if (provider === 'anthropic' || provider === 'openai') {
+    return provider;
+  }
+  if (model?.includes('/')) {
+    const [modelProvider] = model.split('/');
+    if (modelProvider === 'anthropic' || modelProvider === 'openai') {
+      return modelProvider;
+    }
+  }
+  return 'anthropic';
+}
+
+export function splitOpenCodeModel(
+  model: string | undefined,
+  provider: string | undefined,
+): { providerID?: string; modelID?: string; model?: string } {
+  if (!model) return {};
+  if (model.includes('/')) {
+    const [providerID, ...rest] = model.split('/');
+    return {
+      providerID,
+      modelID: rest.join('/'),
+      model,
+    };
+  }
+  return {
+    providerID: provider,
+    modelID: model,
+    model: provider ? `${provider}/${model}` : model,
+  };
+}
+
+export function resolveOpenCodeEnv({
+  auth,
+  model,
+  provider,
+  processEnv = process.env,
+}: {
+  auth: OpenCodeAuthOptions | undefined;
+  model?: string;
+  provider?: string;
+  processEnv?: Record<string, string | undefined>;
+}): Record<string, string> {
+  const selectedProvider = resolveOpenCodeProvider({ model, provider });
+  if (auth?.openaiCompatible) {
+    return pickOpenAICompatible(auth.openaiCompatible, processEnv);
+  }
+  if (selectedProvider === 'openai') {
+    if (auth?.openai) {
+      return pickOpenAI({ explicit: auth.openai, processEnv });
+    }
+  } else if (auth?.anthropic) {
+    return pickAnthropic({ explicit: auth.anthropic, processEnv });
+  }
+
+  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env: processEnv });
+  if (auth?.gateway) {
+    return pickGateway({ explicit: auth.gateway, gatewayAuthFromEnv });
+  }
+  if (gatewayAuthFromEnv.apiKey) {
+    return pickGateway({ explicit: {}, gatewayAuthFromEnv });
+  }
+  return selectedProvider === 'openai'
+    ? pickOpenAI({ processEnv })
+    : pickAnthropic({ processEnv });
+}
+
+function pickOpenAICompatible(
+  explicit: NonNullable<OpenCodeAuthOptions['openaiCompatible']>,
+  processEnv: Record<string, string | undefined>,
+): Record<string, string> {
+  const env: Record<string, string> = {};
+  const apiKey = explicit.apiKey ?? processEnv.OPENAI_API_KEY;
+  if (apiKey) env.OPENAI_API_KEY = apiKey;
+  const baseUrl = explicit.baseUrl ?? processEnv.OPENAI_BASE_URL;
+  if (baseUrl) env.OPENAI_BASE_URL = baseUrl;
+  const name = explicit.name ?? processEnv.OPENAI_NAME;
+  if (name) env.OPENAI_NAME = name;
+  if (explicit.queryParams && Object.keys(explicit.queryParams).length > 0) {
+    env.OPENAI_QUERY_PARAMS_JSON = JSON.stringify(explicit.queryParams);
+  } else if (processEnv.OPENAI_QUERY_PARAMS_JSON) {
+    env.OPENAI_QUERY_PARAMS_JSON = processEnv.OPENAI_QUERY_PARAMS_JSON;
+  }
+  return env;
+}
+
+function pickOpenAI({
+  explicit,
+  processEnv,
+}: {
+  explicit?: NonNullable<OpenCodeAuthOptions['openai']>;
+  processEnv: Record<string, string | undefined>;
+}): Record<string, string> {
+  const env: Record<string, string> = {};
+  const apiKey = explicit?.apiKey ?? processEnv.OPENAI_API_KEY;
+  if (apiKey) env.OPENAI_API_KEY = apiKey;
+  const baseUrl = explicit?.baseUrl ?? processEnv.OPENAI_BASE_URL;
+  if (baseUrl) env.OPENAI_BASE_URL = baseUrl;
+  const organization = explicit?.organization ?? processEnv.OPENAI_ORGANIZATION;
+  if (organization) env.OPENAI_ORGANIZATION = organization;
+  const project = explicit?.project ?? processEnv.OPENAI_PROJECT;
+  if (project) env.OPENAI_PROJECT = project;
+  return env;
+}
+
+function pickAnthropic({
+  explicit,
+  processEnv,
+}: {
+  explicit?: NonNullable<OpenCodeAuthOptions['anthropic']>;
+  processEnv: Record<string, string | undefined>;
+}): Record<string, string> {
+  const env: Record<string, string> = {};
+  const apiKey = explicit?.apiKey ?? processEnv.ANTHROPIC_API_KEY;
+  if (apiKey) env.ANTHROPIC_API_KEY = apiKey;
+  const authToken = explicit?.authToken ?? processEnv.ANTHROPIC_AUTH_TOKEN;
+  if (authToken) env.ANTHROPIC_AUTH_TOKEN = authToken;
+  const baseUrl = explicit?.baseUrl ?? processEnv.ANTHROPIC_BASE_URL;
+  if (baseUrl) env.ANTHROPIC_BASE_URL = baseUrl;
+  return env;
+}
+
+function pickGateway({
+  explicit,
+  gatewayAuthFromEnv,
+}: {
+  explicit: NonNullable<OpenCodeAuthOptions['gateway']>;
+  gatewayAuthFromEnv: ReturnType<typeof getAiGatewayAuthFromEnv>;
+}): Record<string, string> {
+  const env: Record<string, string> = {};
+  const apiKey = explicit.apiKey ?? gatewayAuthFromEnv.apiKey;
+  if (apiKey) env.AI_GATEWAY_API_KEY = apiKey;
+  env.AI_GATEWAY_BASE_URL = toOpenCodeGatewayBaseUrl(
+    explicit.baseUrl ?? gatewayAuthFromEnv.baseUrl,
+  );
+  return env;
+}
+
+export function toOpenCodeGatewayBaseUrl(baseUrl: string): string {
+  const trimmed = baseUrl.replace(/\/+$/, '');
+  return trimmed.endsWith('/v1') ? trimmed : `${trimmed}/v1`;
+}

package/src/opencode-bridge-protocol.ts

@@ -0,0 +1,29 @@
+import {
+  harnessV1BridgeInboundCommandSchemas,
+  harnessV1BridgeOutboundMessageSchema,
+  harnessV1BridgeReadySchema,
+  harnessV1BridgeStartBaseSchema,
+} from '@ai-sdk/harness';
+import { z } from 'zod/v4';
+
+export const outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;
+export type OutboundMessage = z.infer<typeof outboundMessageSchema>;
+
+export const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({
+  operation: z.enum(['prompt', 'compact']).optional(),
+  provider: z.string().optional(),
+  variant: z.string().optional(),
+  instructions: z.string().optional(),
+  resumeSessionId: z.string().optional(),
+});
+
+export type StartMessage = z.infer<typeof startMessageSchema>;
+
+export const inboundMessageSchema = z.discriminatedUnion('type', [
+  startMessageSchema,
+  ...harnessV1BridgeInboundCommandSchemas,
+]);
+export type InboundMessage = z.infer<typeof inboundMessageSchema>;
+
+export const bridgeReadySchema = harnessV1BridgeReadySchema;
+export type BridgeReady = z.infer<typeof bridgeReadySchema>;