@ai-sdk/harness-opencode 1.0.88 → 1.0.92

package/dist/index.js

@@ -9,6 +9,7 @@ import {
 import {
   applyCredentialForwarding,
   classifyDiskLog,
+  createSandboxCredentialEnvironment,
   experimental_createBridgeUserMessageSubmitter,
   createBridgeErrorHandler,
   createBridgeStartupError,
@@ -16,7 +17,6 @@ import {
   forwardBridgeProcessStream,
   getRestrictedSandboxSession,
   markBridgeStarting,
-  maskSandboxCredentials,
   resolveSandboxDefaultWorkingDirectory,
   resolveSandboxHomeDir,
   SandboxChannel,
@@ -102,38 +102,75 @@ var OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_AUTH_TOKEN"
 ];
-function createOpenCodeRequestTransformations(env, auth) {
-  switch (auth) {
+function createOpenCodeRequestTransformations({
+  env: environment,
+  sandboxEnv: sandboxEnvironment,
+  auth: authenticationMode
+}) {
+  switch (authenticationMode) {
     case "ai-gateway":
-      return env.AI_GATEWAY_API_KEY ? [
+      return environment.AI_GATEWAY_API_KEY && sandboxEnvironment.AI_GATEWAY_API_KEY ? [
+        createCredentialRequestTransformation({
+          matchUrl: environment.AI_GATEWAY_BASE_URL,
+          matchHeaders: {
+            "x-api-key": sandboxEnvironment.AI_GATEWAY_API_KEY
+          },
+          transformHeaders: {
+            Authorization: `Bearer ${environment.AI_GATEWAY_API_KEY}`
+          }
+        }),
         createCredentialRequestTransformation({
-          baseUrl: env.AI_GATEWAY_BASE_URL,
-          headers: {
-            Authorization: `Bearer ${env.AI_GATEWAY_API_KEY}`
+          matchUrl: environment.AI_GATEWAY_BASE_URL,
+          matchHeaders: {
+            Authorization: `Bearer ${sandboxEnvironment.AI_GATEWAY_API_KEY}`
+          },
+          transformHeaders: {
+            Authorization: `Bearer ${environment.AI_GATEWAY_API_KEY}`
           }
         })
       ] : [];
     case "openai":
-      return env.OPENAI_API_KEY ? [
+      return environment.OPENAI_API_KEY && sandboxEnvironment.OPENAI_API_KEY ? [
         createCredentialRequestTransformation({
-          baseUrl: env.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
-          headers: { Authorization: `Bearer ${env.OPENAI_API_KEY}` }
+          matchUrl: environment.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
+          matchHeaders: {
+            Authorization: `Bearer ${sandboxEnvironment.OPENAI_API_KEY}`
+          },
+          transformHeaders: {
+            Authorization: `Bearer ${environment.OPENAI_API_KEY}`
+          }
         })
       ] : [];
     case "anthropic": {
-      const headers = {};
-      if (env.ANTHROPIC_API_KEY) {
-        headers["x-api-key"] = env.ANTHROPIC_API_KEY;
+      const matchUrl = environment.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com";
+      const transformations = [];
+      if (environment.ANTHROPIC_API_KEY != null && sandboxEnvironment.ANTHROPIC_API_KEY != null) {
+        transformations.push(
+          createCredentialRequestTransformation({
+            matchUrl,
+            matchHeaders: {
+              "x-api-key": sandboxEnvironment.ANTHROPIC_API_KEY
+            },
+            transformHeaders: {
+              "x-api-key": environment.ANTHROPIC_API_KEY
+            }
+          })
+        );
       }
-      if (env.ANTHROPIC_AUTH_TOKEN) {
-        headers.Authorization = `Bearer ${env.ANTHROPIC_AUTH_TOKEN}`;
+      if (environment.ANTHROPIC_AUTH_TOKEN != null && sandboxEnvironment.ANTHROPIC_AUTH_TOKEN != null) {
+        transformations.push(
+          createCredentialRequestTransformation({
+            matchUrl,
+            matchHeaders: {
+              Authorization: `Bearer ${sandboxEnvironment.ANTHROPIC_AUTH_TOKEN}`
+            },
+            transformHeaders: {
+              Authorization: `Bearer ${environment.ANTHROPIC_AUTH_TOKEN}`
+            }
+          })
+        );
       }
-      return Object.keys(headers).length === 0 ? [] : [
-        createCredentialRequestTransformation({
-          baseUrl: env.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com",
-          headers
-        })
-      ];
+      return transformations;
     }
   }
 }
@@ -327,7 +364,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 ]);
 
 // src/version.ts
-var VERSION = true ? "1.0.88" : "0.0.0-test";
+var VERSION = true ? "1.0.92" : "0.0.0-test";
 
 // src/opencode-harness.ts
 var OPENCODE_CLIENT_APP = `ai-sdk/harness-opencode/${VERSION}`;
@@ -438,7 +475,8 @@ var openCodeBridgeCoordsSchema = z2.object({
 });
 var openCodeResumeStateSchema = z2.object({
   openCodeSessionId: z2.string().optional(),
-  bridge: openCodeBridgeCoordsSchema.optional()
+  bridge: openCodeBridgeCoordsSchema.optional(),
+  sandboxCredentialEnvironment: z2.record(z2.string(), z2.string()).optional()
 });
 function createOpenCode(settings = {}) {
   if (settings.mcpServers != null && Object.prototype.hasOwnProperty.call(settings.mcpServers, "harness-tools")) {
@@ -472,6 +510,12 @@ function createOpenCode(settings = {}) {
         sandboxSession,
         abortSignal: startOpts.abortSignal
       });
+      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
+      const isResume = lifecycleState != null;
+      const isContinue = startOpts.continueFrom != null;
+      const resumeData = isResume && typeof lifecycleState?.data === "object" ? lifecycleState.data : void 0;
+      const resumeSessionId = typeof resumeData?.openCodeSessionId === "string" && resumeData.openCodeSessionId.length > 0 ? resumeData.openCodeSessionId : void 0;
+      const coords = resumeData?.bridge;
       const authenticationMode = resolveOpenCodeAuthenticationMode({
         auth: settings.auth,
         model: settings.model,
@@ -483,20 +527,29 @@ function createOpenCode(settings = {}) {
         provider: settings.provider
       });
       let sandboxAuthEnvironment = resolvedAuthEnvironment;
+      let sandboxCredentialEnvironment;
+      let credentialsBrokered = false;
       if ("addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
-        const requestTransformations = createOpenCodeRequestTransformations(
-          resolvedAuthEnvironment,
-          authenticationMode
-        );
+        sandboxCredentialEnvironment = resumeData?.sandboxCredentialEnvironment ?? await createSandboxCredentialEnvironment({
+          environment: resolvedAuthEnvironment,
+          credentialEnvironmentVariables: OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES,
+          credentialForwarding: settings.credentialForwarding
+        });
+        sandboxAuthEnvironment = {
+          ...resolvedAuthEnvironment,
+          ...sandboxCredentialEnvironment
+        };
+        const requestTransformations = createOpenCodeRequestTransformations({
+          env: resolvedAuthEnvironment,
+          sandboxEnv: sandboxAuthEnvironment,
+          auth: authenticationMode
+        });
         if (requestTransformations.length > 0) {
           await sandboxSession.addRequestTransformations(
             requestTransformations
           );
         }
-        sandboxAuthEnvironment = maskSandboxCredentials({
-          environment: resolvedAuthEnvironment,
-          credentialEnvironmentVariables: OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES
-        });
+        credentialsBrokered = true;
       } else {
         warnCredentialBrokeringUnavailable();
       }
@@ -504,12 +557,6 @@ function createOpenCode(settings = {}) {
         defaultWorkingDirectory,
         OPENCODE_BOOTSTRAP_DIR
       );
-      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
-      const isResume = lifecycleState != null;
-      const isContinue = startOpts.continueFrom != null;
-      const resumeData = isResume && typeof lifecycleState?.data === "object" ? lifecycleState.data : void 0;
-      const resumeSessionId = typeof resumeData?.openCodeSessionId === "string" && resumeData.openCodeSessionId.length > 0 ? resumeData.openCodeSessionId : void 0;
-      const coords = resumeData?.bridge;
       const workDir = startOpts.sessionWorkDir;
       const sessionDataDir = `${defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;
       const bridgeStateDir = `${sessionDataDir}/bridge`;
@@ -567,6 +614,7 @@ function createOpenCode(settings = {}) {
             bridgePort: coords.port,
             bridgeToken: coords.token,
             sandboxId,
+            sandboxCredentialEnvironment,
             debug: startOpts.observability?.debug,
             permissionMode: startOpts.permissionMode,
             builtinToolFiltering: startOpts.builtinToolFiltering,
@@ -606,7 +654,7 @@ function createOpenCode(settings = {}) {
         homeDir: sandboxHomeDir,
         abortSignal: startOpts.abortSignal
       }) : void 0;
-      const forwardedAuthEnvironment = await applyCredentialForwarding({
+      const forwardedAuthEnvironment = credentialsBrokered ? sandboxAuthEnvironment : await applyCredentialForwarding({
         environment: sandboxAuthEnvironment,
         credentialEnvironmentVariables: OPENCODE_CREDENTIAL_ENVIRONMENT_VARIABLES,
         credentialForwarding: settings.credentialForwarding
@@ -709,6 +757,7 @@ function createOpenCode(settings = {}) {
         bridgePort: boundPort,
         bridgeToken: token,
         sandboxId,
+        sandboxCredentialEnvironment,
         debug: startOpts.observability?.debug,
         permissionMode: startOpts.permissionMode,
         builtinToolFiltering: startOpts.builtinToolFiltering,
@@ -886,6 +935,7 @@ function createSession({
   bridgePort,
   bridgeToken,
   sandboxId,
+  sandboxCredentialEnvironment,
   debug,
   permissionMode,
   builtinToolFiltering,
@@ -1138,6 +1188,7 @@ function createSession({
         specificationVersion: "harness-v1",
         data: {
           ...latestOpenCodeSessionId ? { openCodeSessionId: latestOpenCodeSessionId } : {},
+          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
           bridge: {
             port: bridgePort,
             token: bridgeToken,
@@ -1230,11 +1281,15 @@ function createSession({
         }
         channel.close();
       }
+      const lifecycleData = data != null && typeof data === "object" && !Array.isArray(data) ? { ...data } : {};
       const payload = {
         type: "resume-session",
         harnessId: "opencode",
         specificationVersion: "harness-v1",
-        data: data ?? {}
+        data: {
+          ...lifecycleData,
+          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment }
+        }
       };
       return payload;
     },
@@ -1252,6 +1307,7 @@ function createSession({
         specificationVersion: "harness-v1",
         data: {
           ...latestOpenCodeSessionId ? { openCodeSessionId: latestOpenCodeSessionId } : {},
+          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
           bridge: {
             port: bridgePort,
             token: bridgeToken,