@ai-sdk/harness-opencode 1.0.71 → 1.0.73

package/dist/index.d.ts

@@ -2,7 +2,12 @@ import * as _ai_sdk_provider_utils from '@ai-sdk/provider-utils';
 import * as _ai_sdk_harness from '@ai-sdk/harness';
 import { HarnessV1, HarnessV1BuiltinTool } from '@ai-sdk/harness';
 
-type OpenCodeAuthOptions = {
+type OpenCodeResolvedAuthenticationMode = 'anthropic' | 'openai' | 'ai-gateway';
+type OpenCodeAuthenticationMode = OpenCodeResolvedAuthenticationMode | 'auto';
+/**
+ * @deprecated Passing an object to auth options is deprecated. Use an `OpenCodeAuthenticationMode` string value ("auto" | "anthropic" | "openai" | "ai-gateway") instead, and pass credentials via environment variables.
+ */
+type LegacyOpenCodeAuthOptions = {
     readonly gateway?: {
         readonly apiKey?: string;
         readonly baseUrl?: string;
@@ -25,6 +30,7 @@ type OpenCodeAuthOptions = {
         readonly queryParams?: Record<string, string>;
     };
 };
+type OpenCodeAuthOptions = OpenCodeAuthenticationMode | LegacyOpenCodeAuthOptions;
 
 type OpenCodeHarnessSettings = {
     readonly auth?: OpenCodeAuthOptions;
@@ -184,4 +190,4 @@ declare const openCode: _ai_sdk_harness.HarnessV1<{
     }, any, any>;
 }>;
 
-export { type OpenCodeAuthOptions, type OpenCodeHarnessSettings, VERSION, createOpenCode, openCode };
+export { type OpenCodeAuthOptions, type OpenCodeAuthenticationMode, type OpenCodeHarnessSettings, VERSION, createOpenCode, openCode };

package/dist/index.js

@@ -1,8 +1,6 @@
 // src/opencode-harness.ts
 import { randomBytes } from "crypto";
-import { readFile } from "fs/promises";
 import path from "path";
-import { fileURLToPath } from "url";
 import {
   commonTool,
   HarnessCapabilityUnsupportedError,
@@ -15,9 +13,11 @@ import {
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
   markBridgeStarting,
+  maskSandboxCredentials,
   resolveSandboxHomeDir,
   SandboxChannel,
   shellQuote,
+  warnCredentialBrokeringUnavailable,
   waitForBridgeReady,
   writeSkills as writeHarnessSkills
 } from "@ai-sdk/harness/utils";
@@ -27,8 +27,106 @@ import {
 import { WebSocket } from "ws";
 import { z as z2 } from "zod/v4";
 
+// src/opencode-bootstrap.ts
+import { readFile } from "fs/promises";
+import { fileURLToPath } from "url";
+var OPENCODE_BOOTSTRAP_DIR = ".harness-bootstrap/opencode";
+var cachedBootstrap;
+async function getOpenCodeBootstrap() {
+  if (cachedBootstrap != null) return cachedBootstrap;
+  const [pkg, lock, bridge, hostToolMcp] = await Promise.all([
+    readBridgeAsset("package.json"),
+    readBridgeAsset("pnpm-lock.yaml"),
+    readBridgeAsset("index.mjs"),
+    readBridgeAsset("host-tool-mcp.mjs")
+  ]);
+  cachedBootstrap = {
+    harnessId: "opencode",
+    bootstrapDir: OPENCODE_BOOTSTRAP_DIR,
+    files: [
+      { path: `${OPENCODE_BOOTSTRAP_DIR}/package.json`, content: pkg },
+      { path: `${OPENCODE_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },
+      { path: `${OPENCODE_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },
+      {
+        path: `${OPENCODE_BOOTSTRAP_DIR}/host-tool-mcp.mjs`,
+        content: hostToolMcp
+      }
+    ],
+    commands: [
+      {
+        command: "pnpm install --frozen-lockfile --store-dir .pnpm-store"
+      },
+      {
+        command: "node node_modules/opencode-ai/postinstall.mjs && ./node_modules/.bin/opencode --version"
+      }
+    ]
+  };
+  return cachedBootstrap;
+}
+async function readBridgeAsset(name) {
+  const candidates = [
+    new URL(`./bridge/${name}`, import.meta.url),
+    new URL(`../bridge/${name}`, import.meta.url)
+  ];
+  let lastErr;
+  for (const url of candidates) {
+    try {
+      return await readFile(fileURLToPath(url), "utf8");
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT") throw err;
+      lastErr = err;
+    }
+  }
+  throw lastErr ?? new Error(`bridge asset not found: ${name}`);
+}
+
 // src/opencode-auth.ts
-import { getAiGatewayAuthFromEnv } from "@ai-sdk/harness/utils";
+import {
+  createCredentialRequestTransformation,
+  getAiGatewayAuthFromEnv
+} from "@ai-sdk/harness/utils";
+var OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES = [
+  "AI_GATEWAY_API_KEY",
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN"
+];
+function createOpenCodeRequestTransformations(env, auth) {
+  switch (auth) {
+    case "ai-gateway":
+      return env.AI_GATEWAY_API_KEY ? [
+        createCredentialRequestTransformation({
+          baseUrl: env.AI_GATEWAY_BASE_URL,
+          headers: {
+            Authorization: `Bearer ${env.AI_GATEWAY_API_KEY}`
+          }
+        })
+      ] : [];
+    case "openai":
+      return env.OPENAI_API_KEY ? [
+        createCredentialRequestTransformation({
+          baseUrl: env.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
+          headers: { Authorization: `Bearer ${env.OPENAI_API_KEY}` }
+        })
+      ] : [];
+    case "anthropic": {
+      const headers = {};
+      if (env.ANTHROPIC_API_KEY) {
+        headers["x-api-key"] = env.ANTHROPIC_API_KEY;
+      }
+      if (env.ANTHROPIC_AUTH_TOKEN) {
+        headers.Authorization = `Bearer ${env.ANTHROPIC_AUTH_TOKEN}`;
+      }
+      return Object.keys(headers).length === 0 ? [] : [
+        createCredentialRequestTransformation({
+          baseUrl: env.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com",
+          headers
+        })
+      ];
+    }
+  }
+}
 function resolveOpenCodeProvider({
   model,
   provider
@@ -66,26 +164,75 @@ function resolveOpenCodeEnv({
   provider,
   processEnv = process.env
 }) {
+  const normalizedAuth = normalizeOpenCodeAuthToLegacyAuth(auth);
   const selectedProvider = resolveOpenCodeProvider({ model, provider });
-  if (auth?.openaiCompatible) {
-    return pickOpenAICompatible(auth.openaiCompatible, processEnv);
+  if (normalizedAuth?.openaiCompatible) {
+    return pickOpenAICompatible(normalizedAuth.openaiCompatible, processEnv);
   }
   if (selectedProvider === "openai") {
-    if (auth?.openai) {
-      return pickOpenAI({ explicit: auth.openai, processEnv });
+    if (normalizedAuth?.openai) {
+      return pickOpenAI({ explicit: normalizedAuth.openai, processEnv });
     }
-  } else if (auth?.anthropic) {
-    return pickAnthropic({ explicit: auth.anthropic, processEnv });
+  } else if (normalizedAuth?.anthropic) {
+    return pickAnthropic({ explicit: normalizedAuth.anthropic, processEnv });
   }
   const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env: processEnv });
-  if (auth?.gateway) {
-    return pickGateway({ explicit: auth.gateway, gatewayAuthFromEnv });
+  if (normalizedAuth?.gateway) {
+    return pickGateway({
+      explicit: normalizedAuth.gateway,
+      gatewayAuthFromEnv
+    });
   }
   if (gatewayAuthFromEnv.apiKey) {
     return pickGateway({ explicit: {}, gatewayAuthFromEnv });
   }
   return selectedProvider === "openai" ? pickOpenAI({ processEnv }) : pickAnthropic({ processEnv });
 }
+function resolveOpenCodeAuthenticationMode({
+  auth,
+  model,
+  provider,
+  processEnv = process.env
+}) {
+  if (typeof auth !== "string" && auth?.openaiCompatible) {
+    return "openai";
+  }
+  const selectedProvider = resolveOpenCodeProvider({ model, provider });
+  if (selectedProvider === "openai" && (auth === "openai" || typeof auth !== "string" && auth?.openai)) {
+    return "openai";
+  }
+  if (selectedProvider === "anthropic" && (auth === "anthropic" || typeof auth !== "string" && auth?.anthropic)) {
+    return "anthropic";
+  }
+  if (auth === "ai-gateway" || typeof auth !== "string" && auth?.gateway) {
+    return "ai-gateway";
+  }
+  if (getAiGatewayAuthFromEnv({ env: processEnv }).apiKey) {
+    return "ai-gateway";
+  }
+  return selectedProvider;
+}
+function normalizeOpenCodeAuthToLegacyAuth(auth) {
+  if (auth == null || auth === "auto") {
+    return void 0;
+  }
+  if (typeof auth === "string") {
+    switch (auth) {
+      case "anthropic":
+        return { anthropic: {} };
+      case "openai":
+        return { openai: {} };
+      case "ai-gateway":
+        return { gateway: {} };
+      default:
+        return void 0;
+    }
+  }
+  console.warn(
+    '[opencode] Passing an object to auth options is deprecated. Use a string mode ("auto" | "anthropic" | "openai" | "ai-gateway") instead, and pass credentials via environment variables.'
+  );
+  return auth;
+}
 function pickOpenAICompatible(explicit, processEnv) {
   const env = {};
   const apiKey = explicit.apiKey ?? processEnv.OPENAI_API_KEY;
@@ -136,9 +283,10 @@ function pickGateway({
   const env = {};
   const apiKey = explicit.apiKey ?? gatewayAuthFromEnv.apiKey;
   if (apiKey) env.AI_GATEWAY_API_KEY = apiKey;
-  env.AI_GATEWAY_BASE_URL = toOpenCodeGatewayBaseUrl(
+  const baseUrl = toOpenCodeGatewayBaseUrl(
     explicit.baseUrl ?? gatewayAuthFromEnv.baseUrl
   );
+  env.AI_GATEWAY_BASE_URL = baseUrl;
   return env;
 }
 function toOpenCodeGatewayBaseUrl(baseUrl) {
@@ -169,7 +317,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 ]);
 
 // src/version.ts
-var VERSION = true ? "1.0.71" : "0.0.0-test";
+var VERSION = true ? "1.0.73" : "0.0.0-test";
 
 // src/opencode-harness.ts
 var OPENCODE_CLIENT_APP = `ai-sdk/harness-opencode/${VERSION}`;
@@ -272,7 +420,6 @@ var OPENCODE_BUILTIN_TOOLS = {
     })
   })
 };
-var BOOTSTRAP_DIR = ".harness-bootstrap/opencode";
 var openCodeBridgeCoordsSchema = z2.object({
   port: z2.number(),
   token: z2.string(),
@@ -289,51 +436,48 @@ function createOpenCode(settings = {}) {
       'OpenCode MCP server name "harness-tools" is reserved for HarnessAgent tools.'
     );
   }
-  let cachedBootstrap;
   return {
     specificationVersion: "harness-v1",
     harnessId: "opencode",
     builtinTools: OPENCODE_BUILTIN_TOOLS,
     supportsBuiltinToolApprovals: true,
     lifecycleStateSchema: openCodeResumeStateSchema,
-    getBootstrap: async () => {
-      if (cachedBootstrap != null) return cachedBootstrap;
-      const [pkg, lock, bridge, hostToolMcp] = await Promise.all([
-        readBridgeAsset("package.json"),
-        readBridgeAsset("pnpm-lock.yaml"),
-        readBridgeAsset("index.mjs"),
-        readBridgeAsset("host-tool-mcp.mjs")
-      ]);
-      cachedBootstrap = {
-        harnessId: "opencode",
-        bootstrapDir: BOOTSTRAP_DIR,
-        files: [
-          { path: `${BOOTSTRAP_DIR}/package.json`, content: pkg },
-          { path: `${BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },
-          { path: `${BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },
-          {
-            path: `${BOOTSTRAP_DIR}/host-tool-mcp.mjs`,
-            content: hostToolMcp
-          }
-        ],
-        commands: [
-          {
-            command: "pnpm install --frozen-lockfile --store-dir .pnpm-store"
-          },
-          {
-            command: "node node_modules/opencode-ai/postinstall.mjs && ./node_modules/.bin/opencode --version"
-          }
-        ]
-      };
-      return cachedBootstrap;
-    },
+    getBootstrap: getOpenCodeBootstrap,
     doStart: async (startOpts) => {
       const sandboxSession = startOpts.sandboxSession;
+      const authenticationMode = resolveOpenCodeAuthenticationMode({
+        auth: settings.auth,
+        model: settings.model,
+        provider: settings.provider
+      });
+      const resolvedAuthEnvironment = resolveOpenCodeEnv({
+        auth: settings.auth,
+        model: settings.model,
+        provider: settings.provider
+      });
+      let sandboxAuthEnvironment = resolvedAuthEnvironment;
+      if (sandboxSession.addRequestTransformations != null) {
+        const requestTransformations = createOpenCodeRequestTransformations(
+          resolvedAuthEnvironment,
+          authenticationMode
+        );
+        if (requestTransformations.length > 0) {
+          await sandboxSession.addRequestTransformations(
+            requestTransformations
+          );
+        }
+        sandboxAuthEnvironment = maskSandboxCredentials({
+          environment: resolvedAuthEnvironment,
+          credentialEnvironmentVariables: OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES
+        });
+      } else {
+        warnCredentialBrokeringUnavailable();
+      }
       const session = sandboxSession.restricted();
       const sandboxId = sandboxSession.id;
       const bootstrapDir = path.posix.resolve(
         sandboxSession.defaultWorkingDirectory,
-        BOOTSTRAP_DIR
+        OPENCODE_BOOTSTRAP_DIR
       );
       const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
       const isResume = lifecycleState != null;
@@ -359,12 +503,16 @@ function createOpenCode(settings = {}) {
       });
       if (coords) {
         try {
-          const attachUrl = await sandboxSession.getPortUrl({
+          const endpoint2 = await sandboxSession.getPortEndpoint({
             port: coords.port,
             protocol: "ws"
-          }) + `?agent_bridge_token=${encodeURIComponent(coords.token)}`;
+          });
+          const attachEndpoint = withBridgeToken({
+            endpoint: endpoint2,
+            token: coords.token
+          });
           const attachChannel = new SandboxChannel({
-            connect: () => openWebSocket(attachUrl),
+            connect: () => openWebSocket(attachEndpoint),
             outboundSchema: outboundMessageSchema,
             initialLastSeenEventId: coords.lastSeenEventId,
             onDiagnostic,
@@ -422,11 +570,7 @@ function createOpenCode(settings = {}) {
         abortSignal: startOpts.abortSignal
       }) : void 0;
       const env = {
-        ...resolveOpenCodeEnv({
-          auth: settings.auth,
-          model: settings.model,
-          provider: settings.provider
-        }),
+        ...sandboxAuthEnvironment,
         AI_SDK_HARNESS_CLIENT_APP: OPENCODE_CLIENT_APP,
         BRIDGE_CHANNEL_TOKEN: token,
         BRIDGE_WS_PORT: String(port),
@@ -485,12 +629,13 @@ function createOpenCode(settings = {}) {
         })
       });
       void drainBridgeProcessStream(proc.stdout);
-      const wsUrl = await sandboxSession.getPortUrl({
+      const endpoint = await sandboxSession.getPortEndpoint({
         port: boundPort,
         protocol: "ws"
-      }) + `?agent_bridge_token=${encodeURIComponent(token)}`;
+      });
+      const bridgeEndpoint = withBridgeToken({ endpoint, token });
       const channel = new SandboxChannel({
-        connect: () => openWebSocket(wsUrl),
+        connect: () => openWebSocket(bridgeEndpoint),
         outboundSchema: outboundMessageSchema,
         onDiagnostic,
         onBridgeError,
@@ -529,23 +674,6 @@ function resolveBridgePort(sandboxSession, override) {
     message: "The OpenCode harness needs a TCP port exposed by the sandbox. Create the sandbox with `ports: [<port>]` or pass `createOpenCode({ port })`."
   });
 }
-async function readBridgeAsset(name) {
-  const candidates = [
-    new URL(`./bridge/${name}`, import.meta.url),
-    new URL(`../bridge/${name}`, import.meta.url)
-  ];
-  let lastErr;
-  for (const url of candidates) {
-    try {
-      return await readFile(fileURLToPath(url), "utf8");
-    } catch (err) {
-      const code = err.code;
-      if (code !== "ENOENT") throw err;
-      lastErr = err;
-    }
-  }
-  throw lastErr ?? new Error(`bridge asset not found: ${name}`);
-}
 async function writeOpenCodeSkills({
   sandbox,
   skills,
@@ -563,9 +691,14 @@ async function writeOpenCodeSkills({
   });
   return { skillsDir };
 }
-function openWebSocket(url) {
+function openWebSocket({
+  url,
+  headers
+}) {
   return new Promise((resolve, reject) => {
-    const ws = new WebSocket(url);
+    const ws = new WebSocket(url, {
+      headers: headers == null ? void 0 : { ...headers }
+    });
     const onOpen = () => {
       ws.off("error", onError);
       resolve(ws);
@@ -578,6 +711,14 @@ function openWebSocket(url) {
     ws.once("error", onError);
   });
 }
+function withBridgeToken({
+  endpoint,
+  token
+}) {
+  const bridgeUrl = new URL(endpoint.url);
+  bridgeUrl.searchParams.set("agent_bridge_token", token);
+  return { ...endpoint, url: bridgeUrl.toString() };
+}
 function createSession({
   sessionId,
   channel,