@ai-sdk/harness-opencode 1.0.9 → 1.0.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-opencode",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -27,8 +27,8 @@
   },
   "dependencies": {
     "ws": "8.21.0",
-    "@ai-sdk/harness": "1.0.9",
-    "@ai-sdk/provider-utils": "5.0.1"
+    "@ai-sdk/harness": "1.0.11",
+    "@ai-sdk/provider-utils": "5.0.2"
   },
   "peerDependencies": {
     "zod": "^3.25.76 || ^4.1.8"

package/src/bridge/host-tool-mcp.ts

@@ -32,7 +32,6 @@ type ZodShape = Record<string, z.ZodTypeAny>;
 
 const schemas: ToolSchema[] = JSON.parse(process.env.TOOL_SCHEMAS || '[]');
 const relayUrl = process.env.TOOL_RELAY_URL || '';
-const relayToken = process.env.TOOL_RELAY_TOKEN || '';
 
 if (!schemas.length || !relayUrl) {
   process.stderr.write(
@@ -56,7 +55,6 @@ for (const schema of schemas) {
           method: 'POST',
           headers: {
             'Content-Type': 'application/json',
-            ...(relayToken ? { Authorization: `Bearer ${relayToken}` } : {}),
           },
           body: JSON.stringify({ requestId, toolName: schema.name, input }),
         });

package/src/bridge/index.ts

@@ -32,17 +32,27 @@ import {
   type HarnessUsage,
   type OpenCodeTokenUsage,
 } from './opencode-usage';
+import {
+  ToolRelayAuthorizer,
+  isToolRelayRequestFromAllowedProcess,
+  type ToolRelayCall,
+} from './tool-relay-auth';
 
 type Emit = (msg: Record<string, unknown>) => void;
 
 type OpenCodeClient = ReturnType<typeof createOpencodeClient>;
 type OpenCodeServer = Awaited<ReturnType<typeof createOpencodeServer>>;
+type ToolRelay = {
+  port: number;
+  close(): void;
+  authorizeToolCall(call: ToolRelayCall): void;
+};
 
 type RuntimeState = {
   server?: OpenCodeServer;
   client?: OpenCodeClient;
   sessionId?: string;
-  relay?: { port: number; close(): void };
+  relay?: ToolRelay;
   toolNames: Set<string>;
 };
 
@@ -133,12 +143,10 @@ async function ensureRuntime({
 }): Promise<void> {
   if (runtime.client) return;
 
-  let relayToken: string | undefined;
   if (start.tools && start.tools.length > 0) {
-    relayToken = randomUUID();
     runtime.toolNames = new Set(start.tools.map(tool => tool.name));
     runtime.relay = await startToolRelay({
-      relayToken,
+      allowedScriptPaths: [`${bootstrapDir}/host-tool-mcp.mjs`],
       tools: start.tools,
       emit,
       requestToolResult: turn.requestToolResult,
@@ -151,7 +159,6 @@ async function ensureRuntime({
     timeout: 30_000,
     config: buildOpenCodeConfig({
       start,
-      relayToken,
       relayPort: runtime.relay?.port,
     }) as never,
   });
@@ -164,11 +171,9 @@ async function ensureRuntime({
 
 function buildOpenCodeConfig({
   start,
-  relayToken,
   relayPort,
 }: {
   start: StartMessage;
-  relayToken: string | undefined;
   relayPort: number | undefined;
 }): Record<string, unknown> {
   const config: Record<string, unknown> = {
@@ -191,7 +196,7 @@ function buildOpenCodeConfig({
   if (skillsDir) config.skills = { paths: [skillsDir] };
   const provider = buildProviderConfig(start);
   if (provider) config.provider = provider;
-  if (relayToken && relayPort && start.tools && start.tools.length > 0) {
+  if (relayPort && start.tools && start.tools.length > 0) {
     config.mcp = {
       'harness-tools': {
         type: 'local',
@@ -206,7 +211,6 @@ function buildOpenCodeConfig({
             })),
           ),
           TOOL_RELAY_URL: `http://127.0.0.1:${relayPort}`,
-          TOOL_RELAY_TOKEN: relayToken,
         },
       },
     };
@@ -725,6 +729,7 @@ type TranslationState = {
   toolNames: Map<string, { rawToolName: string; toolName: string }>;
   toolCallsEmitted: Set<string>;
   toolResultsEmitted: Set<string>;
+  hostToolCallsAuthorized: Set<string>;
   shellCommands: Map<string, string>;
   messageRoles: Map<string, string>;
   turnUsage: Record<string, unknown> | undefined;
@@ -740,6 +745,7 @@ function createTranslationState(): TranslationState {
     toolNames: new Map(),
     toolCallsEmitted: new Set(),
     toolResultsEmitted: new Set(),
+    hostToolCallsAuthorized: new Set(),
     shellCommands: new Map(),
     messageRoles: new Map(),
     turnUsage: undefined,
@@ -922,7 +928,16 @@ async function translateAndEmit({
     const rawToolName = String(props.tool ?? 'unknown');
     const toolName = toWireToolName(rawToolName);
     state.toolNames.set(callID, { rawToolName, toolName });
-    if (isHostTool(toolName, props.tool)) return;
+    const hostToolName = getHostToolName(toolName, props.tool);
+    if (hostToolName) {
+      authorizeHostToolCall({
+        callID,
+        toolName: hostToolName,
+        input: props.input ?? parseToolInput(state, props),
+        state,
+      });
+      return;
+    }
     emit({
       type: 'tool-call',
       toolCallId: callID,
@@ -947,7 +962,7 @@ async function translateAndEmit({
       String((props as { tool?: unknown }).tool ?? '');
     const toolName =
       cachedTool?.toolName ?? toWireToolName(rawToolName || 'unknown');
-    if (isHostTool(toolName, rawToolName)) return;
+    if (getHostToolName(toolName, rawToolName)) return;
     emit({
       type: 'tool-result',
       toolCallId: callID,
@@ -1152,7 +1167,18 @@ function emitLegacyToolPart({
   const rawToolName = toolPart.tool;
   const toolName = toWireToolName(rawToolName);
   state.toolNames.set(callID, { rawToolName, toolName });
-  if (isHostTool(toolName, rawToolName)) return;
+  const hostToolName = getHostToolName(toolName, rawToolName);
+  if (hostToolName) {
+    if (status === 'running') {
+      authorizeHostToolCall({
+        callID,
+        toolName: hostToolName,
+        input: legacyToolPartInput(toolPart),
+        state,
+      });
+    }
+    return;
+  }
   if (!state.toolCallsEmitted.has(callID)) {
     state.toolCallsEmitted.add(callID);
     emit({
@@ -1413,19 +1439,38 @@ function nativeNameField({
   return { nativeName };
 }
 
-function isHostTool(toolName: string, rawToolName: unknown): boolean {
-  if (runtime.toolNames.has(toolName)) return true;
+function getHostToolName(
+  toolName: string,
+  rawToolName: unknown,
+): string | undefined {
+  if (runtime.toolNames.has(toolName)) return toolName;
   if (typeof rawToolName === 'string' && runtime.toolNames.has(rawToolName)) {
-    return true;
+    return rawToolName;
   }
   if (
     typeof rawToolName === 'string' &&
     rawToolName.startsWith('harness-tools_') &&
     runtime.toolNames.has(rawToolName.slice('harness-tools_'.length))
   ) {
-    return true;
+    return rawToolName.slice('harness-tools_'.length);
   }
-  return false;
+  return undefined;
+}
+
+function authorizeHostToolCall({
+  callID,
+  toolName,
+  input,
+  state,
+}: {
+  callID: string;
+  toolName: string;
+  input: unknown;
+  state: TranslationState;
+}): void {
+  if (state.hostToolCallsAuthorized.has(callID)) return;
+  state.hostToolCallsAuthorized.add(callID);
+  runtime.relay?.authorizeToolCall({ toolName, input });
 }
 
 async function emitContextFallback({
@@ -1601,26 +1646,24 @@ function mapFinishReason(
 }
 
 async function startToolRelay({
-  relayToken,
+  allowedScriptPaths,
   tools,
   emit,
   requestToolResult,
 }: {
-  relayToken: string;
+  allowedScriptPaths: ReadonlyArray<string>;
   tools: ReadonlyArray<{ name: string }>;
   emit: Emit;
   requestToolResult: (
     toolCallId: string,
   ) => Promise<{ output: unknown; isError?: boolean }>;
-}): Promise<{ port: number; close(): void }> {
+}): Promise<ToolRelay> {
   const toolNames = new Set(tools.map(t => t.name));
+  const allowedScriptPathSet = new Set(allowedScriptPaths);
+  const authorizer = new ToolRelayAuthorizer();
   const server = createServer(async (req, res) => {
     try {
-      if (
-        req.method !== 'POST' ||
-        req.url !== '/' ||
-        req.headers.authorization !== `Bearer ${relayToken}`
-      ) {
+      if (req.method !== 'POST' || req.url !== '/') {
         res.writeHead(401, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));
         return;
@@ -1643,6 +1686,17 @@ async function startToolRelay({
         );
         return;
       }
+      const authorized =
+        authorizer.consumeToolCall({ toolName, input }) ||
+        (await isToolRelayRequestFromAllowedProcess({
+          socket: req.socket,
+          allowedScriptPaths: allowedScriptPathSet,
+        }));
+      if (!authorized) {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));
+        return;
+      }
 
       emit({
         type: 'tool-call',
@@ -1683,6 +1737,7 @@ async function startToolRelay({
   return {
     port: address.port,
     close: () => closeServer(server),
+    authorizeToolCall: call => authorizer.authorizeToolCall(call),
   };
 }
 

package/src/bridge/tool-relay-auth.ts

@@ -0,0 +1,151 @@
+import { readdir, readFile, readlink } from 'node:fs/promises';
+import type { Socket } from 'node:net';
+
+export type ToolRelayCall = {
+  toolName: string;
+  input: unknown;
+};
+
+export class ToolRelayAuthorizer {
+  private readonly ttlMs: number;
+  private readonly now: () => number;
+  private readonly authorizations: Array<{ key: string; expiresAt: number }> =
+    [];
+
+  constructor({
+    ttlMs = 10_000,
+    now = Date.now,
+  }: {
+    ttlMs?: number;
+    now?: () => number;
+  } = {}) {
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+
+  authorizeToolCall(call: ToolRelayCall): void {
+    this.pruneExpired();
+    this.authorizations.push({
+      key: toolRelayCallKey(call),
+      expiresAt: this.now() + this.ttlMs,
+    });
+  }
+
+  consumeToolCall(call: ToolRelayCall): boolean {
+    this.pruneExpired();
+    const key = toolRelayCallKey(call);
+    const index = this.authorizations.findIndex(auth => auth.key === key);
+    if (index === -1) return false;
+    this.authorizations.splice(index, 1);
+    return true;
+  }
+
+  private pruneExpired(): void {
+    const now = this.now();
+    for (let i = this.authorizations.length - 1; i >= 0; i--) {
+      if (this.authorizations[i].expiresAt <= now) {
+        this.authorizations.splice(i, 1);
+      }
+    }
+  }
+}
+
+function toolRelayCallKey({ toolName, input }: ToolRelayCall): string {
+  return `${toolName}\0${canonicalJson(input ?? {})}`;
+}
+
+function canonicalJson(value: unknown): string {
+  return JSON.stringify(normalizeJsonValue(value));
+}
+
+function normalizeJsonValue(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(normalizeJsonValue);
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([, entryValue]) => entryValue !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entryValue]) => [key, normalizeJsonValue(entryValue)]),
+    );
+  }
+  return value;
+}
+
+export async function isToolRelayRequestFromAllowedProcess({
+  socket,
+  allowedScriptPaths,
+}: {
+  socket: Socket;
+  allowedScriptPaths: ReadonlySet<string>;
+}): Promise<boolean> {
+  if (process.platform !== 'linux') return false;
+  if (!socket.remotePort || !socket.localPort) return false;
+
+  const inode = await findTcpSocketInode({
+    clientPort: socket.remotePort,
+    serverPort: socket.localPort,
+  });
+  if (!inode) return false;
+
+  const cmdline = await findProcessCmdlineForSocketInode({ inode });
+  return cmdline?.some(arg => allowedScriptPaths.has(arg)) ?? false;
+}
+
+async function findTcpSocketInode({
+  clientPort,
+  serverPort,
+}: {
+  clientPort: number;
+  serverPort: number;
+}): Promise<string | undefined> {
+  for (const tablePath of ['/proc/net/tcp', '/proc/net/tcp6']) {
+    const table = await readFile(tablePath, 'utf8').catch(() => undefined);
+    if (!table) continue;
+    for (const line of table.split('\n').slice(1)) {
+      const columns = line.trim().split(/\s+/);
+      if (columns.length < 10) continue;
+      const local = parseProcNetAddress(columns[1]);
+      const remote = parseProcNetAddress(columns[2]);
+      if (
+        local?.port === clientPort &&
+        remote?.port === serverPort &&
+        columns[9] !== '0'
+      ) {
+        return columns[9];
+      }
+    }
+  }
+  return undefined;
+}
+
+function parseProcNetAddress(value: string): { port: number } | undefined {
+  const [, portHex] = value.split(':');
+  if (!portHex) return undefined;
+  return { port: Number.parseInt(portHex, 16) };
+}
+
+async function findProcessCmdlineForSocketInode({
+  inode,
+}: {
+  inode: string;
+}): Promise<string[] | undefined> {
+  const procEntries = await readdir('/proc', { withFileTypes: true }).catch(
+    () => [],
+  );
+  for (const entry of procEntries) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    const fdDir = `/proc/${entry.name}/fd`;
+    const fds = await readdir(fdDir).catch(() => []);
+    for (const fd of fds) {
+      const target = await readlink(`${fdDir}/${fd}`).catch(() => undefined);
+      if (target !== `socket:[${inode}]`) continue;
+      const cmdline = await readFile(`/proc/${entry.name}/cmdline`, 'utf8')
+        .then(value => value.split('\0').filter(Boolean))
+        .catch(() => undefined);
+      if (cmdline) return cmdline;
+    }
+  }
+  return undefined;
+}