@ai-sdk/harness-opencode 1.0.10 → 1.0.12

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @ai-sdk/harness-opencode
 
+## 1.0.12
+
+### Patch Changes
+
+- 7859cea: feat(harness): add tool filtering via `activeTools` and `inactiveTools`
+- c857346: feat(harness): add utility functions for certain duplicated layers in harnesses
+- Updated dependencies [7859cea]
+- Updated dependencies [c857346]
+  - @ai-sdk/harness@1.0.12
+
+## 1.0.11
+
+### Patch Changes
+
+- 2933383: fix(harness): fix harness relay auth
+  - @ai-sdk/harness@1.0.11
+
 ## 1.0.10
 
 ### Patch Changes

package/dist/bridge/host-tool-mcp.mjs

@@ -6,7 +6,6 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod/v4";
 var schemas = JSON.parse(process.env.TOOL_SCHEMAS || "[]");
 var relayUrl = process.env.TOOL_RELAY_URL || "";
-var relayToken = process.env.TOOL_RELAY_TOKEN || "";
 if (!schemas.length || !relayUrl) {
   process.stderr.write(
     "[host-tool-mcp] Missing TOOL_SCHEMAS or TOOL_RELAY_URL; exiting\n"
@@ -26,8 +25,7 @@ for (const schema of schemas) {
         const res = await fetch(relayUrl, {
           method: "POST",
           headers: {
-            "Content-Type": "application/json",
-            ...relayToken ? { Authorization: `Bearer ${relayToken}` } : {}
+            "Content-Type": "application/json"
           },
           body: JSON.stringify({ requestId, toolName: schema.name, input })
         });

package/dist/bridge/host-tool-mcp.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/bridge/host-tool-mcp.ts"],"sourcesContent":["#!/usr/bin/env node\n/*\n * These bridge imports are externalized by tsup and resolved inside the\n * sandbox from src/bridge/package.json and its lockfile. Keep this file,\n * tsup.config.ts, and the bridge package dependency list in sync.\n */\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { z } from 'zod/v4';\n\ntype ToolSchema = {\n  name: string;\n  description?: string;\n  inputSchema?: JsonSchemaObject;\n};\n\ntype JsonSchemaObject = {\n  type?: string | string[];\n  description?: string;\n  properties?: Record<string, JsonSchemaObject>;\n  required?: string[];\n  items?: JsonSchemaObject;\n  enum?: unknown[];\n  const?: unknown;\n  oneOf?: JsonSchemaObject[];\n  anyOf?: JsonSchemaObject[];\n  additionalProperties?: boolean | JsonSchemaObject;\n  nullable?: boolean;\n};\n\ntype ZodShape = Record<string, z.ZodTypeAny>;\n\nconst schemas: ToolSchema[] = JSON.parse(process.env.TOOL_SCHEMAS || '[]');\nconst relayUrl = process.env.TOOL_RELAY_URL || '';\nconst relayToken = process.env.TOOL_RELAY_TOKEN || '';\n\nif (!schemas.length || !relayUrl) {\n  process.stderr.write(\n    '[host-tool-mcp] Missing TOOL_SCHEMAS or TOOL_RELAY_URL; exiting\\n',\n  );\n  process.exit(0);\n}\n\nconst server = new McpServer({ name: 'harness-tools', version: '1.0.0' });\n\nfor (const schema of schemas) {\n  const shape = toZodShape(schema.inputSchema);\n  server.tool(\n    schema.name,\n    schema.description ?? '',\n    shape,\n    async (input: Record<string, unknown>) => {\n      const requestId = crypto.randomUUID();\n      try {\n        const res = await fetch(relayUrl, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            ...(relayToken ? { Authorization: `Bearer ${relayToken}` } : {}),\n          },\n          body: JSON.stringify({ requestId, toolName: schema.name, input }),\n        });\n        if (!res.ok) {\n          const body = await res.text();\n          throw new Error(\n            `Tool relay ${schema.name} failed with ${res.status}: ${body.slice(0, 500)}`,\n          );\n        }\n        const data = (await res.json()) as { result?: unknown };\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: JSON.stringify(data.result ?? null),\n            },\n          ],\n        };\n      } catch (err) {\n        return {\n          content: [{ type: 'text' as const, text: `Error: ${String(err)}` }],\n          isError: true,\n        };\n      }\n    },\n  );\n}\n\nfunction toZodShape(schema: JsonSchemaObject | undefined): ZodShape {\n  if (!schema?.properties) return {};\n  const required = new Set(schema.required ?? []);\n  const shape: ZodShape = {};\n  for (const [key, propSchema] of Object.entries(schema.properties)) {\n    const propType = toZodType(propSchema);\n    shape[key] = required.has(key) ? propType : propType.optional();\n  }\n  return shape;\n}\n\nfunction toZodType(schema: JsonSchemaObject | undefined): z.ZodTypeAny {\n  if (!schema) return z.any();\n  const types = Array.isArray(schema.type)\n    ? schema.type.filter((t): t is string => t !== 'null')\n    : ([schema.type].filter(Boolean) as string[]);\n  let zType: z.ZodTypeAny;\n  switch (types[0]) {\n    case 'string':\n      zType = z.string();\n      break;\n    case 'number':\n      zType = z.number();\n      break;\n    case 'integer':\n      zType = z.number().int();\n      break;\n    case 'boolean':\n      zType = z.boolean();\n      break;\n    case 'array':\n      zType = z.array(toZodType(schema.items));\n      break;\n    case 'object':\n      zType = z.object(toZodShape(schema));\n      break;\n    case 'null':\n      zType = z.null();\n      break;\n    default:\n      zType = z.any();\n  }\n  if (schema.description) zType = zType.describe(schema.description);\n  if (schema.nullable) zType = zType.nullable();\n  return zType;\n}\n\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\n"],"mappings":";;;AAMA,SAAS,iBAAiB;AAC1B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAwBlB,IAAM,UAAwB,KAAK,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AACzE,IAAM,WAAW,QAAQ,IAAI,kBAAkB;AAC/C,IAAM,aAAa,QAAQ,IAAI,oBAAoB;AAEnD,IAAI,CAAC,QAAQ,UAAU,CAAC,UAAU;AAChC,UAAQ,OAAO;AAAA,IACb;AAAA,EACF;AACA,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,IAAI,UAAU,EAAE,MAAM,iBAAiB,SAAS,QAAQ,CAAC;AAExE,WAAW,UAAU,SAAS;AAC5B,QAAM,QAAQ,WAAW,OAAO,WAAW;AAC3C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO,eAAe;AAAA,IACtB;AAAA,IACA,OAAO,UAAmC;AACxC,YAAM,YAAY,OAAO,WAAW;AACpC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,UAAU;AAAA,UAChC,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,GAAI,aAAa,EAAE,eAAe,UAAU,UAAU,GAAG,IAAI,CAAC;AAAA,UAChE;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,WAAW,UAAU,OAAO,MAAM,MAAM,CAAC;AAAA,QAClE,CAAC;AACD,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,gBAAM,IAAI;AAAA,YACR,cAAc,OAAO,IAAI,gBAAgB,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,UAC5E;AAAA,QACF;AACA,cAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,eAAO;AAAA,UACL,SAAS;AAAA,YACP;AAAA,cACE,MAAM;AAAA,cACN,MAAM,KAAK,UAAU,KAAK,UAAU,IAAI;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,UAAU,OAAO,GAAG,CAAC,GAAG,CAAC;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WAAW,QAAgD;AAClE,MAAI,CAAC,QAAQ,WAAY,QAAO,CAAC;AACjC,QAAM,WAAW,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;AAC9C,QAAM,QAAkB,CAAC;AACzB,aAAW,CAAC,KAAK,UAAU,KAAK,OAAO,QAAQ,OAAO,UAAU,GAAG;AACjE,UAAM,WAAW,UAAU,UAAU;AACrC,UAAM,GAAG,IAAI,SAAS,IAAI,GAAG,IAAI,WAAW,SAAS,SAAS;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,QAAoD;AACrE,MAAI,CAAC,OAAQ,QAAO,EAAE,IAAI;AAC1B,QAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,IACnC,OAAO,KAAK,OAAO,CAAC,MAAmB,MAAM,MAAM,IAClD,CAAC,OAAO,IAAI,EAAE,OAAO,OAAO;AACjC,MAAI;AACJ,UAAQ,MAAM,CAAC,GAAG;AAAA,IAChB,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,EAAE,IAAI;AACvB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,QAAQ;AAClB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,MAAM,UAAU,OAAO,KAAK,CAAC;AACvC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,WAAW,MAAM,CAAC;AACnC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,KAAK;AACf;AAAA,IACF;AACE,cAAQ,EAAE,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,YAAa,SAAQ,MAAM,SAAS,OAAO,WAAW;AACjE,MAAI,OAAO,SAAU,SAAQ,MAAM,SAAS;AAC5C,SAAO;AACT;AAEA,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;","names":[]}
+{"version":3,"sources":["../../src/bridge/host-tool-mcp.ts"],"sourcesContent":["#!/usr/bin/env node\n/*\n * These bridge imports are externalized by tsup and resolved inside the\n * sandbox from src/bridge/package.json and its lockfile. Keep this file,\n * tsup.config.ts, and the bridge package dependency list in sync.\n */\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { z } from 'zod/v4';\n\ntype ToolSchema = {\n  name: string;\n  description?: string;\n  inputSchema?: JsonSchemaObject;\n};\n\ntype JsonSchemaObject = {\n  type?: string | string[];\n  description?: string;\n  properties?: Record<string, JsonSchemaObject>;\n  required?: string[];\n  items?: JsonSchemaObject;\n  enum?: unknown[];\n  const?: unknown;\n  oneOf?: JsonSchemaObject[];\n  anyOf?: JsonSchemaObject[];\n  additionalProperties?: boolean | JsonSchemaObject;\n  nullable?: boolean;\n};\n\ntype ZodShape = Record<string, z.ZodTypeAny>;\n\nconst schemas: ToolSchema[] = JSON.parse(process.env.TOOL_SCHEMAS || '[]');\nconst relayUrl = process.env.TOOL_RELAY_URL || '';\n\nif (!schemas.length || !relayUrl) {\n  process.stderr.write(\n    '[host-tool-mcp] Missing TOOL_SCHEMAS or TOOL_RELAY_URL; exiting\\n',\n  );\n  process.exit(0);\n}\n\nconst server = new McpServer({ name: 'harness-tools', version: '1.0.0' });\n\nfor (const schema of schemas) {\n  const shape = toZodShape(schema.inputSchema);\n  server.tool(\n    schema.name,\n    schema.description ?? '',\n    shape,\n    async (input: Record<string, unknown>) => {\n      const requestId = crypto.randomUUID();\n      try {\n        const res = await fetch(relayUrl, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({ requestId, toolName: schema.name, input }),\n        });\n        if (!res.ok) {\n          const body = await res.text();\n          throw new Error(\n            `Tool relay ${schema.name} failed with ${res.status}: ${body.slice(0, 500)}`,\n          );\n        }\n        const data = (await res.json()) as { result?: unknown };\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: JSON.stringify(data.result ?? null),\n            },\n          ],\n        };\n      } catch (err) {\n        return {\n          content: [{ type: 'text' as const, text: `Error: ${String(err)}` }],\n          isError: true,\n        };\n      }\n    },\n  );\n}\n\nfunction toZodShape(schema: JsonSchemaObject | undefined): ZodShape {\n  if (!schema?.properties) return {};\n  const required = new Set(schema.required ?? []);\n  const shape: ZodShape = {};\n  for (const [key, propSchema] of Object.entries(schema.properties)) {\n    const propType = toZodType(propSchema);\n    shape[key] = required.has(key) ? propType : propType.optional();\n  }\n  return shape;\n}\n\nfunction toZodType(schema: JsonSchemaObject | undefined): z.ZodTypeAny {\n  if (!schema) return z.any();\n  const types = Array.isArray(schema.type)\n    ? schema.type.filter((t): t is string => t !== 'null')\n    : ([schema.type].filter(Boolean) as string[]);\n  let zType: z.ZodTypeAny;\n  switch (types[0]) {\n    case 'string':\n      zType = z.string();\n      break;\n    case 'number':\n      zType = z.number();\n      break;\n    case 'integer':\n      zType = z.number().int();\n      break;\n    case 'boolean':\n      zType = z.boolean();\n      break;\n    case 'array':\n      zType = z.array(toZodType(schema.items));\n      break;\n    case 'object':\n      zType = z.object(toZodShape(schema));\n      break;\n    case 'null':\n      zType = z.null();\n      break;\n    default:\n      zType = z.any();\n  }\n  if (schema.description) zType = zType.describe(schema.description);\n  if (schema.nullable) zType = zType.nullable();\n  return zType;\n}\n\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\n"],"mappings":";;;AAMA,SAAS,iBAAiB;AAC1B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAwBlB,IAAM,UAAwB,KAAK,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AACzE,IAAM,WAAW,QAAQ,IAAI,kBAAkB;AAE/C,IAAI,CAAC,QAAQ,UAAU,CAAC,UAAU;AAChC,UAAQ,OAAO;AAAA,IACb;AAAA,EACF;AACA,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,IAAI,UAAU,EAAE,MAAM,iBAAiB,SAAS,QAAQ,CAAC;AAExE,WAAW,UAAU,SAAS;AAC5B,QAAM,QAAQ,WAAW,OAAO,WAAW;AAC3C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO,eAAe;AAAA,IACtB;AAAA,IACA,OAAO,UAAmC;AACxC,YAAM,YAAY,OAAO,WAAW;AACpC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,UAAU;AAAA,UAChC,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,UAClB;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,WAAW,UAAU,OAAO,MAAM,MAAM,CAAC;AAAA,QAClE,CAAC;AACD,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,gBAAM,IAAI;AAAA,YACR,cAAc,OAAO,IAAI,gBAAgB,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,UAC5E;AAAA,QACF;AACA,cAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,eAAO;AAAA,UACL,SAAS;AAAA,YACP;AAAA,cACE,MAAM;AAAA,cACN,MAAM,KAAK,UAAU,KAAK,UAAU,IAAI;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,UAAU,OAAO,GAAG,CAAC,GAAG,CAAC;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WAAW,QAAgD;AAClE,MAAI,CAAC,QAAQ,WAAY,QAAO,CAAC;AACjC,QAAM,WAAW,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;AAC9C,QAAM,QAAkB,CAAC;AACzB,aAAW,CAAC,KAAK,UAAU,KAAK,OAAO,QAAQ,OAAO,UAAU,GAAG;AACjE,UAAM,WAAW,UAAU,UAAU;AACrC,UAAM,GAAG,IAAI,SAAS,IAAI,GAAG,IAAI,WAAW,SAAS,SAAS;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,QAAoD;AACrE,MAAI,CAAC,OAAQ,QAAO,EAAE,IAAI;AAC1B,QAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,IACnC,OAAO,KAAK,OAAO,CAAC,MAAmB,MAAM,MAAM,IAClD,CAAC,OAAO,IAAI,EAAE,OAAO,OAAO;AACjC,MAAI;AACJ,UAAQ,MAAM,CAAC,GAAG;AAAA,IAChB,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO;AACjB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,EAAE,IAAI;AACvB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,QAAQ;AAClB;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,MAAM,UAAU,OAAO,KAAK,CAAC;AACvC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,OAAO,WAAW,MAAM,CAAC;AACnC;AAAA,IACF,KAAK;AACH,cAAQ,EAAE,KAAK;AACf;AAAA,IACF;AACE,cAAQ,EAAE,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,YAAa,SAAQ,MAAM,SAAS,OAAO,WAAW;AACjE,MAAI,OAAO,SAAU,SAAQ,MAAM,SAAS;AAC5C,SAAO;AACT;AAEA,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;","names":[]}

package/dist/bridge/index.mjs

@@ -608,6 +608,116 @@ function add({
   return leftNumber == null && rightNumber == null ? void 0 : (leftNumber ?? 0) + (rightNumber ?? 0);
 }
 
+// src/bridge/tool-relay-auth.ts
+import { readdir, readFile, readlink } from "fs/promises";
+var ToolRelayAuthorizer = class {
+  constructor({
+    ttlMs = 1e4,
+    now = Date.now
+  } = {}) {
+    this.authorizations = [];
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+  authorizeToolCall(call) {
+    this.pruneExpired();
+    this.authorizations.push({
+      key: toolRelayCallKey(call),
+      expiresAt: this.now() + this.ttlMs
+    });
+  }
+  consumeToolCall(call) {
+    this.pruneExpired();
+    const key = toolRelayCallKey(call);
+    const index = this.authorizations.findIndex((auth) => auth.key === key);
+    if (index === -1) return false;
+    this.authorizations.splice(index, 1);
+    return true;
+  }
+  pruneExpired() {
+    const now = this.now();
+    for (let i = this.authorizations.length - 1; i >= 0; i--) {
+      if (this.authorizations[i].expiresAt <= now) {
+        this.authorizations.splice(i, 1);
+      }
+    }
+  }
+};
+function toolRelayCallKey({ toolName, input }) {
+  return `${toolName}\0${canonicalJson(input ?? {})}`;
+}
+function canonicalJson(value) {
+  return JSON.stringify(normalizeJsonValue(value));
+}
+function normalizeJsonValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(normalizeJsonValue);
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue)])
+    );
+  }
+  return value;
+}
+async function isToolRelayRequestFromAllowedProcess({
+  socket,
+  allowedScriptPaths
+}) {
+  if (process.platform !== "linux") return false;
+  if (!socket.remotePort || !socket.localPort) return false;
+  const inode = await findTcpSocketInode({
+    clientPort: socket.remotePort,
+    serverPort: socket.localPort
+  });
+  if (!inode) return false;
+  const cmdline = await findProcessCmdlineForSocketInode({ inode });
+  return cmdline?.some((arg) => allowedScriptPaths.has(arg)) ?? false;
+}
+async function findTcpSocketInode({
+  clientPort,
+  serverPort
+}) {
+  for (const tablePath of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+    const table = await readFile(tablePath, "utf8").catch(() => void 0);
+    if (!table) continue;
+    for (const line of table.split("\n").slice(1)) {
+      const columns = line.trim().split(/\s+/);
+      if (columns.length < 10) continue;
+      const local = parseProcNetAddress(columns[1]);
+      const remote = parseProcNetAddress(columns[2]);
+      if (local?.port === clientPort && remote?.port === serverPort && columns[9] !== "0") {
+        return columns[9];
+      }
+    }
+  }
+  return void 0;
+}
+function parseProcNetAddress(value) {
+  const [, portHex] = value.split(":");
+  if (!portHex) return void 0;
+  return { port: Number.parseInt(portHex, 16) };
+}
+async function findProcessCmdlineForSocketInode({
+  inode
+}) {
+  const procEntries = await readdir("/proc", { withFileTypes: true }).catch(
+    () => []
+  );
+  for (const entry of procEntries) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    const fdDir = `/proc/${entry.name}/fd`;
+    const fds = await readdir(fdDir).catch(() => []);
+    for (const fd of fds) {
+      const target = await readlink(`${fdDir}/${fd}`).catch(() => void 0);
+      if (target !== `socket:[${inode}]`) continue;
+      const cmdline = await readFile(`/proc/${entry.name}/cmdline`, "utf8").then((value) => value.split("\0").filter(Boolean)).catch(() => void 0);
+      if (cmdline) return cmdline;
+    }
+  }
+  return void 0;
+}
+
 // src/bridge/index.ts
 var NATIVE_TO_COMMON = {
   view: "read",
@@ -626,6 +736,19 @@ var OPENCODE_TO_WIRE = {
   agent: "agent",
   subtask: "agent"
 };
+var PUBLIC_TO_NATIVE = {
+  read: "view",
+  write: "write",
+  edit: "edit",
+  bash: "bash",
+  glob: "glob",
+  grep: "grep",
+  ls: "list",
+  webfetch: "webfetch",
+  skill: "skill",
+  todowrite: "todowrite",
+  agent: "agent"
+};
 var TOOL_KIND = {
   read: "readonly",
   glob: "readonly",
@@ -681,12 +804,10 @@ async function ensureRuntime({
   emit
 }) {
   if (runtime.client) return;
-  let relayToken;
   if (start.tools && start.tools.length > 0) {
-    relayToken = randomUUID();
     runtime.toolNames = new Set(start.tools.map((tool) => tool.name));
     runtime.relay = await startToolRelay({
-      relayToken,
+      allowedScriptPaths: [`${bootstrapDir}/host-tool-mcp.mjs`],
       tools: start.tools,
       emit,
       requestToolResult: turn.requestToolResult
@@ -698,7 +819,6 @@ async function ensureRuntime({
     timeout: 3e4,
     config: buildOpenCodeConfig({
       start,
-      relayToken,
       relayPort: runtime.relay?.port
     })
   });
@@ -710,7 +830,6 @@ async function ensureRuntime({
 }
 function buildOpenCodeConfig({
   start,
-  relayToken,
   relayPort
 }) {
   const config = {
@@ -731,9 +850,21 @@ function buildOpenCodeConfig({
   };
   if (start.model) config.model = start.model;
   if (skillsDir) config.skills = { paths: [skillsDir] };
+  const inactiveToolNames = resolveInactiveBuiltinToolNames(start);
+  const permission = config.permission;
+  for (const toolName of inactiveToolNames) {
+    const permissionName = toPermissionToolName(
+      PUBLIC_TO_NATIVE[toolName] ?? toolName
+    );
+    if (permissionName === "ls") {
+      permission.list = "ask";
+    } else {
+      permission[permissionName] = "ask";
+    }
+  }
   const provider = buildProviderConfig(start);
   if (provider) config.provider = provider;
-  if (relayToken && relayPort && start.tools && start.tools.length > 0) {
+  if (relayPort && start.tools && start.tools.length > 0) {
     config.mcp = {
       "harness-tools": {
         type: "local",
@@ -747,8 +878,7 @@ function buildOpenCodeConfig({
               inputSchema: t.inputSchema
             }))
           ),
-          TOOL_RELAY_URL: `http://127.0.0.1:${relayPort}`,
-          TOOL_RELAY_TOKEN: relayToken
+          TOOL_RELAY_URL: `http://127.0.0.1:${relayPort}`
         }
       }
     };
@@ -958,6 +1088,7 @@ async function runPrompt({
     client,
     sessionId,
     permissionMode: start.permissionMode,
+    builtinToolFiltering: start.builtinToolFiltering,
     turn,
     emit: (msg) => {
       if (msg.type === "text-delta" || msg.type === "reasoning-delta") {
@@ -1071,6 +1202,7 @@ async function runCompaction({
     client,
     sessionId,
     permissionMode: start.permissionMode,
+    builtinToolFiltering: start.builtinToolFiltering,
     turn,
     emit: (msg) => {
       if (msg.type === "compaction") sawCompaction = true;
@@ -1132,6 +1264,7 @@ async function consumeEvents({
   client,
   sessionId,
   permissionMode,
+  builtinToolFiltering,
   turn,
   emit,
   signal,
@@ -1150,6 +1283,7 @@ async function consumeEvents({
       state,
       sessionId,
       permissionMode,
+      builtinToolFiltering,
       client,
       turn,
       emit
@@ -1165,6 +1299,7 @@ function createTranslationState() {
     toolNames: /* @__PURE__ */ new Map(),
     toolCallsEmitted: /* @__PURE__ */ new Set(),
     toolResultsEmitted: /* @__PURE__ */ new Set(),
+    hostToolCallsAuthorized: /* @__PURE__ */ new Set(),
     shellCommands: /* @__PURE__ */ new Map(),
     messageRoles: /* @__PURE__ */ new Map(),
     turnUsage: void 0,
@@ -1177,6 +1312,7 @@ async function translateAndEmit({
   state,
   sessionId,
   permissionMode,
+  builtinToolFiltering,
   client,
   turn,
   emit
@@ -1334,7 +1470,16 @@ async function translateAndEmit({
     const rawToolName = String(props.tool ?? "unknown");
     const toolName = toWireToolName(rawToolName);
     state.toolNames.set(callID, { rawToolName, toolName });
-    if (isHostTool(toolName, props.tool)) return;
+    const hostToolName = getHostToolName(toolName, props.tool);
+    if (hostToolName) {
+      authorizeHostToolCall({
+        callID,
+        toolName: hostToolName,
+        input: props.input ?? parseToolInput(state, props),
+        state
+      });
+      return;
+    }
     emit({
       type: "tool-call",
       toolCallId: callID,
@@ -1351,7 +1496,7 @@ async function translateAndEmit({
     const cachedTool = state.toolNames.get(callID);
     const rawToolName = cachedTool?.rawToolName ?? String(props.tool ?? "");
     const toolName = cachedTool?.toolName ?? toWireToolName(rawToolName || "unknown");
-    if (isHostTool(toolName, rawToolName)) return;
+    if (getHostToolName(toolName, rawToolName)) return;
     emit({
       type: "tool-result",
       toolCallId: callID,
@@ -1405,6 +1550,7 @@ async function translateAndEmit({
       client,
       sessionId,
       permissionMode,
+      builtinToolFiltering,
       turn,
       emit,
       event
@@ -1416,6 +1562,7 @@ async function translateAndEmit({
       client,
       sessionId,
       permissionMode,
+      builtinToolFiltering,
       turn,
       emit,
       event
@@ -1514,7 +1661,18 @@ function emitLegacyToolPart({
   const rawToolName = toolPart.tool;
   const toolName = toWireToolName(rawToolName);
   state.toolNames.set(callID, { rawToolName, toolName });
-  if (isHostTool(toolName, rawToolName)) return;
+  const hostToolName = getHostToolName(toolName, rawToolName);
+  if (hostToolName) {
+    if (status === "running") {
+      authorizeHostToolCall({
+        callID,
+        toolName: hostToolName,
+        input: legacyToolPartInput(toolPart),
+        state
+      });
+    }
+    return;
+  }
   if (!state.toolCallsEmitted.has(callID)) {
     state.toolCallsEmitted.add(callID);
     emit({
@@ -1572,6 +1730,7 @@ async function handlePermissionV2({
   client,
   sessionId,
   permissionMode,
+  builtinToolFiltering,
   turn,
   emit,
   event
@@ -1585,6 +1744,7 @@ async function handlePermissionV2({
     requestID,
     toolCallId: typeof props.source === "object" && props.source !== null && "callID" in props.source ? String(props.source.callID) : requestID,
     permissionMode,
+    builtinToolFiltering,
     turn,
     emit
   });
@@ -1599,6 +1759,7 @@ async function handlePermission({
   client,
   sessionId,
   permissionMode,
+  builtinToolFiltering,
   turn,
   emit,
   event
@@ -1612,6 +1773,7 @@ async function handlePermission({
     requestID,
     toolCallId: typeof props.tool === "object" && props.tool !== null && "callID" in props.tool ? String(props.tool.callID) : requestID,
     permissionMode,
+    builtinToolFiltering,
     turn,
     emit
   });
@@ -1629,6 +1791,7 @@ async function selectPermissionReply({
   requestID,
   toolCallId,
   permissionMode,
+  builtinToolFiltering,
   turn,
   emit
 }) {
@@ -1636,6 +1799,18 @@ async function selectPermissionReply({
   if (resources.some((resource) => isExternalPath(resource))) {
     return { reply: "reject", message: "External directory access rejected." };
   }
+  if (isBuiltinToolInactive({ toolName, toolFiltering: builtinToolFiltering })) {
+    emit({
+      type: "tool-approval-request",
+      approvalId: requestID,
+      toolCallId
+    });
+    const decision2 = await turn.requestToolApproval(requestID);
+    return decision2.approved ? { reply: "once" } : {
+      reply: "reject",
+      ...decision2.reason ? { message: decision2.reason } : {}
+    };
+  }
   if (!permissionMode || permissionMode === "allow-all") {
     return { reply: "always" };
   }
@@ -1668,6 +1843,17 @@ function toPermissionToolName(action) {
   if (normalized.includes("read")) return "read";
   return toWireToolName(normalized);
 }
+function resolveInactiveBuiltinToolNames(start) {
+  const toolFiltering = start.builtinToolFiltering;
+  if (toolFiltering == null) return [];
+  return toolFiltering.mode === "allow" ? Object.keys(PUBLIC_TO_NATIVE).filter(
+    (name) => !toolFiltering.toolNames.includes(name)
+  ) : toolFiltering.toolNames;
+}
+function isBuiltinToolInactive(input) {
+  if (input.toolFiltering == null) return false;
+  return input.toolFiltering.mode === "allow" ? !input.toolFiltering.toolNames.includes(input.toolName) : input.toolFiltering.toolNames.includes(input.toolName);
+}
 function isExternalPath(resource) {
   if (!path2.isAbsolute(resource)) return false;
   const normalized = path2.resolve(resource);
@@ -1687,15 +1873,25 @@ function nativeNameField({
   if (!nativeName || nativeName === toolName || toolName === "agent") return {};
   return { nativeName };
 }
-function isHostTool(toolName, rawToolName) {
-  if (runtime.toolNames.has(toolName)) return true;
+function getHostToolName(toolName, rawToolName) {
+  if (runtime.toolNames.has(toolName)) return toolName;
   if (typeof rawToolName === "string" && runtime.toolNames.has(rawToolName)) {
-    return true;
+    return rawToolName;
   }
   if (typeof rawToolName === "string" && rawToolName.startsWith("harness-tools_") && runtime.toolNames.has(rawToolName.slice("harness-tools_".length))) {
-    return true;
+    return rawToolName.slice("harness-tools_".length);
   }
-  return false;
+  return void 0;
+}
+function authorizeHostToolCall({
+  callID,
+  toolName,
+  input,
+  state
+}) {
+  if (state.hostToolCallsAuthorized.has(callID)) return;
+  state.hostToolCallsAuthorized.add(callID);
+  runtime.relay?.authorizeToolCall({ toolName, input });
 }
 async function emitContextFallback({
   client,
@@ -1802,15 +1998,17 @@ function mapFinishReason(reason) {
   return "other";
 }
 async function startToolRelay({
-  relayToken,
+  allowedScriptPaths,
   tools,
   emit,
   requestToolResult
 }) {
   const toolNames = new Set(tools.map((t) => t.name));
+  const allowedScriptPathSet = new Set(allowedScriptPaths);
+  const authorizer = new ToolRelayAuthorizer();
   const server = createServer(async (req, res) => {
     try {
-      if (req.method !== "POST" || req.url !== "/" || req.headers.authorization !== `Bearer ${relayToken}`) {
+      if (req.method !== "POST" || req.url !== "/") {
         res.writeHead(401, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "unauthorized tool relay request" }));
         return;
@@ -1828,6 +2026,15 @@ async function startToolRelay({
         );
         return;
       }
+      const authorized = authorizer.consumeToolCall({ toolName, input }) || await isToolRelayRequestFromAllowedProcess({
+        socket: req.socket,
+        allowedScriptPaths: allowedScriptPathSet
+      });
+      if (!authorized) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "unauthorized tool relay request" }));
+        return;
+      }
       emit({
         type: "tool-call",
         toolCallId: requestId,
@@ -1863,7 +2070,8 @@ async function startToolRelay({
   }
   return {
     port: address.port,
-    close: () => closeServer(server)
+    close: () => closeServer(server),
+    authorizeToolCall: (call) => authorizer.authorizeToolCall(call)
   };
 }
 function closeServer(server) {