@ai-sdk/harness-pi 1.0.118 → 1.0.120

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @ai-sdk/harness-pi
 
+## 1.0.120
+
+### Patch Changes
+
+- f39733b: fix(sandbox-just-bash): seed `realpath` binary via `readlink` so that it is available to consumers that require it, such as the Pi harness
+- a0f7700: fix(harness-pi): make grep compatible with just-bash sandboxes while preserving matches alongside bounded traversal diagnostics
+- Updated dependencies [d975097]
+- Updated dependencies [b2baeba]
+  - @ai-sdk/harness@1.0.118
+
+## 1.0.119
+
+### Patch Changes
+
+- Updated dependencies [2973485]
+- Updated dependencies [a4db5ea]
+- Updated dependencies [2937ea2]
+  - @ai-sdk/provider-utils@5.0.45
+  - @ai-sdk/harness@1.0.117
+
 ## 1.0.118
 
 ### Patch Changes

package/dist/index.js

@@ -111,7 +111,7 @@ import {
   SessionManager,
   SettingsManager
 } from "@earendil-works/pi-coding-agent";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { mkdir as mkdir3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir } from "os";
 import path6 from "path";
@@ -136,7 +136,7 @@ import {
 import { access } from "fs/promises";
 
 // src/version.ts
-var VERSION = true ? "1.0.118" : "0.0.0-test";
+var VERSION = true ? "1.0.120" : "0.0.0-test";
 
 // src/pi-auth.ts
 var DEFAULT_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh";
@@ -795,10 +795,39 @@ function createPiPathMapper(options) {
 }
 
 // src/pi-remote-ops.ts
+import { randomUUID } from "crypto";
 import path3 from "path";
 import { shellQuote } from "@ai-sdk/harness/utils";
-function lastOutputLine(output) {
-  return output.toString("utf8").trim().split("\n").filter(Boolean).at(-1);
+var MAX_GREP_DIAGNOSTIC_BYTES = 8192;
+var REALPATH_FRAME = "__PI_REALPATH_FRAME__";
+var BASE64_PATH_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function realpathShellLines(targetVariable) {
+  return [
+    "set -o pipefail",
+    `realpath_marker=${shellQuote(REALPATH_FRAME)}`,
+    `realpath_framed=$(realpath "$${targetVariable}" 2>/dev/null; realpath_status=$?; printf '%s' "$realpath_marker"; exit "$realpath_status")`,
+    "realpath_status=$?",
+    'if [ "$realpath_status" -ne 0 ]; then echo "__PI_REALPATH_FAILED__"; exit 3; fi',
+    "resolved=${realpath_framed%$realpath_marker}",
+    "resolved=${resolved%$'\\n'}"
+  ];
+}
+function framePathShell(pathExpression) {
+  return `if ! printf '%s' ${pathExpression} | base64 | tr -d '\\r\\n'; then exit 4; fi; printf '%s' "$realpath_marker"`;
+}
+function parseFramedPath(output) {
+  if (!output.endsWith(REALPATH_FRAME)) return void 0;
+  const encodedPath = output.slice(0, -REALPATH_FRAME.length);
+  if (!encodedPath || !BASE64_PATH_PATTERN.test(encodedPath)) {
+    return void 0;
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(
+      Buffer.from(encodedPath, "base64")
+    );
+  } catch {
+    return void 0;
+  }
 }
 function createPiRemoteOps(options) {
   const runShell = async (command, input = {}) => {
@@ -808,23 +837,24 @@ function createPiRemoteOps(options) {
       ...options.env ? { env: options.env } : {},
       ...input.signal ? { abortSignal: input.signal } : {}
     });
-    const combined = `${result.stdout}${result.stderr}`;
-    const output = Buffer.from(combined, "utf8");
+    const output = Buffer.from(`${result.stdout}${result.stderr}`, "utf8");
     if (output.length > 0) {
       input.onData?.(output);
     }
     return {
       exitCode: result.exitCode,
-      output
+      output,
+      stdout: result.stdout,
+      stderr: result.stderr
     };
   };
   const resolveExistingSandboxPath = async (remotePath, inputPath) => {
     const result = await runShell(
       [
         `target=${shellQuote(remotePath)}`,
-        `if [ ! -e "$target" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi`,
-        `resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }`,
-        `printf '%s\\n' "$resolved"`
+        ...realpathShellLines("target"),
+        `if [ ! -e "$resolved" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi`,
+        framePathShell('"$resolved"')
       ].join("; ")
     );
     const output = result.output.toString("utf8");
@@ -834,7 +864,7 @@ function createPiRemoteOps(options) {
     if (output.includes("__PI_REALPATH_FAILED__") || result.exitCode !== 0) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
-    const resolvedPath = lastOutputLine(result.output);
+    const resolvedPath = parseFramedPath(result.stdout);
     if (!resolvedPath) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
@@ -847,20 +877,21 @@ function createPiRemoteOps(options) {
     const result = await runShell(
       [
         `target=${shellQuote(remotePath)}`,
-        `if [ -e "$target" ] || [ -L "$target" ]; then resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }; printf '%s\\n' "$resolved"; exit 0; fi`,
-        `dir=$(dirname "$target")`,
-        `base=$(basename "$target")`,
+        `if [ -e "$target" ] || [ -L "$target" ]; then ${realpathShellLines("target").join("; ")}; ${framePathShell('"$resolved"')}; exit 0; fi`,
+        "dir=${target%/*}",
+        "base=${target##*/}",
+        '[ -n "$dir" ] || dir=/',
         `missing="$base"`,
-        `while [ ! -e "$dir" ] && [ ! -L "$dir" ]; do parent=$(dirname "$dir"); if [ "$parent" = "$dir" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi; missing="$(basename "$dir")/$missing"; dir="$parent"; done`,
-        `resolved_dir=$(realpath "$dir" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }`,
-        `printf '%s/%s\\n' "$resolved_dir" "$missing"`
+        'while [ ! -e "$dir" ] && [ ! -L "$dir" ]; do parent=${dir%/*}; [ -n "$parent" ] || parent=/; if [ "$parent" = "$dir" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi; missing=${dir##*/}/$missing; dir=$parent; done',
+        ...realpathShellLines("dir"),
+        framePathShell('"$resolved/$missing"')
       ].join("; ")
     );
     const output = result.output.toString("utf8");
     if (output.includes("__PI_REALPATH_NOT_FOUND__") || output.includes("__PI_REALPATH_FAILED__") || result.exitCode !== 0) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
-    const resolvedPath = lastOutputLine(result.output);
+    const resolvedPath = parseFramedPath(result.stdout);
     if (!resolvedPath) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
@@ -969,29 +1000,126 @@ function createPiRemoteOps(options) {
       input.path ?? "."
     );
     const relativeTarget = options.paths.toRelativePath(resolvedPath);
-    const targetPath = relativeTarget.startsWith("../") || path3.posix.isAbsolute(relativeTarget) ? resolvedPath : relativeTarget;
-    const flags = [
-      "-r",
+    const targetPath = relativeTarget.startsWith("../") || path3.posix.isAbsolute(relativeTarget) ? resolvedPath : relativeTarget.startsWith("-") ? `./${relativeTarget}` : relativeTarget;
+    const limit = Math.max(1, input.limit ?? 100);
+    const commonFlags = [
       "-n",
-      "--binary-files=without-match",
       ...input.ignoreCase ? ["-i"] : [],
       ...input.literal ? ["-F"] : [],
-      ...typeof input.context === "number" && input.context > 0 ? ["-C", String(input.context)] : [],
-      ...input.glob ? ["--include", input.glob] : []
+      ...typeof input.context === "number" && input.context > 0 ? ["-C", String(input.context)] : []
     ];
-    const limit = Math.max(1, input.limit ?? 100);
+    const recursiveFlags = [
+      "-r",
+      ...commonFlags,
+      "-m",
+      String(limit),
+      ...input.glob ? [`--include=${input.glob}`] : []
+    ];
+    const temporaryPathPrefix = `/tmp/.ai-sdk-harness-pi-grep-${randomUUID()}`;
+    const outputPath = `${temporaryPathPrefix}.stdout`;
+    const stderrPath = `${temporaryPathPrefix}.stderr`;
+    const statusPath = `${temporaryPathPrefix}.status`;
+    const fileOutputPath = `${temporaryPathPrefix}.file.stdout`;
+    const fileStderrPath = `${temporaryPathPrefix}.file.stderr`;
+    const findStderrPath = `${temporaryPathPrefix}.find.stderr`;
+    const boundedFileGrepScript = [
+      `grep_limit=${limit}`,
+      `grep_output=${shellQuote(outputPath)}`,
+      `grep_stderr=${shellQuote(stderrPath)}`,
+      `grep_status=${shellQuote(statusPath)}`,
+      `grep_file_output=${shellQuote(fileOutputPath)}`,
+      `grep_file_stderr=${shellQuote(fileStderrPath)}`,
+      'grep_output_lines=$(wc -l < "$grep_output")',
+      'grep_overall_status=$(cat "$grep_status")',
+      'for grep_file in "$@"; do',
+      "grep_remaining=$((grep_limit - grep_output_lines))",
+      'if [ "$grep_remaining" -le 0 ]; then break; fi',
+      `grep ${commonFlags.map(shellQuote).join(" ")} -m "$grep_remaining" -e ${shellQuote(pattern)} "$grep_file" > "$grep_file_output" 2> "$grep_file_stderr"`,
+      "grep_file_status=$?",
+      'if [ "$grep_file_status" -eq 0 ]; then',
+      "grep_display_file=${grep_file#./}",
+      "grep_file_lines=0",
+      "while IFS= read -r grep_line; do",
+      'if [ "$grep_file_lines" -ge "$grep_remaining" ]; then break; fi',
+      'case "$grep_line" in',
+      `'--') printf '%s\\n' "$grep_line" ;;`,
+      `[0-9]*:*) printf '%s:%s\\n' "$grep_display_file" "$grep_line" ;;`,
+      `[0-9]*-*) printf '%s-%s\\n' "$grep_display_file" "$grep_line" ;;`,
+      `*) printf '%s:%s\\n' "$grep_display_file" "$grep_line" ;;`,
+      "esac",
+      "grep_file_lines=$((grep_file_lines + 1))",
+      'done < "$grep_file_output" >> "$grep_output"',
+      "grep_output_lines=$((grep_output_lines + grep_file_lines))",
+      "grep_overall_status=0",
+      'elif [ "$grep_file_status" -gt 1 ]; then',
+      `grep_diagnostic_size=$(wc -c < "$grep_stderr")`,
+      `grep_diagnostic_remaining=$((${MAX_GREP_DIAGNOSTIC_BYTES} - grep_diagnostic_size))`,
+      'if [ "$grep_diagnostic_remaining" -gt 0 ]; then head -c "$grep_diagnostic_remaining" "$grep_file_stderr" >> "$grep_stderr"; fi',
+      "grep_overall_status=2",
+      "break",
+      "fi",
+      "done",
+      `printf '%s\\n' "$grep_overall_status" > "$grep_status"`
+    ].join("\n");
+    const findFlags = [
+      shellQuote(targetPath),
+      "-type",
+      "f",
+      ...input.glob ? ["-name", shellQuote(input.glob)] : []
+    ].join(" ");
     const result = await runShell(
       [
         `if [ ! -e ${shellQuote(resolvedPath)} ]; then echo "__PI_GREP_NOT_FOUND__"; exit 2; fi`,
         `cd ${shellQuote(options.paths.sandboxWorkDir)}`,
-        `grep ${flags.map(shellQuote).join(" ")} -- ${shellQuote(pattern)} ${shellQuote(targetPath)} 2>/dev/null | head -n ${limit}`
+        // Preserve binary skipping where grep supports it without passing an
+        // unsupported option to just-bash.
+        `binary_option_error=$(grep --binary-files=without-match -e '' /dev/null 2>&1)`,
+        `if [ -z "$binary_option_error" ]; then binary_option='--binary-files=without-match'; else binary_option=''; fi`,
+        `grep_stderr=${shellQuote(stderrPath)}`,
+        `grep_output=${shellQuote(outputPath)}`,
+        `grep_status_file=${shellQuote(statusPath)}`,
+        `grep_find_stderr=${shellQuote(findStderrPath)}`,
+        ': > "$grep_stderr"',
+        // just-bash buffers every pipeline stage and applies grep -m per file.
+        // Search files individually there so the producer never emits more
+        // than the remaining global result limit.
+        `if [ -n "$binary_option" ] || [ ! -d ${shellQuote(targetPath)} ]; then set -o pipefail; grep $binary_option ${recursiveFlags.map(shellQuote).join(" ")} -e ${shellQuote(pattern)} ${shellQuote(targetPath)} 2>"$grep_stderr" | head -n ${limit}; grep_status=$?; else : > "$grep_output"; printf '1\\n' > "$grep_status_file"; find ${findFlags} -exec bash -c ${shellQuote(boundedFileGrepScript)} bash {} + 2>"$grep_find_stderr"; find_status=$?; grep_diagnostic_size=$(wc -c < "$grep_stderr"); grep_diagnostic_remaining=$((${MAX_GREP_DIAGNOSTIC_BYTES} - grep_diagnostic_size)); if [ "$grep_diagnostic_remaining" -gt 0 ]; then head -c "$grep_diagnostic_remaining" "$grep_find_stderr" >> "$grep_stderr"; fi; grep_status=$(cat "$grep_status_file"); if [ "$find_status" -ne 0 ]; then grep_status=2; fi; cat "$grep_output"; fi`,
+        `head -c ${MAX_GREP_DIAGNOSTIC_BYTES} "$grep_stderr" >&2`,
+        `rm -f ${[
+          outputPath,
+          stderrPath,
+          statusPath,
+          fileOutputPath,
+          fileStderrPath,
+          findStderrPath
+        ].map(shellQuote).join(" ")}`,
+        'exit "$grep_status"'
       ].join("; ")
     );
     const output = result.output.toString("utf8").trim();
     if (output.includes("__PI_GREP_NOT_FOUND__")) {
       throw new Error(`Path not found: ${input.path ?? "."}`);
     }
-    return output || "No matches found";
+    const stdout = result.stdout.trim();
+    const stderr = result.stderr.trim();
+    if (result.exitCode === 0 || result.exitCode === 1 || // GNU grep can receive SIGPIPE after head reaches the requested limit.
+    result.exitCode === 141) {
+      if (stdout) {
+        return [stdout, stderr].filter(Boolean).join("\n");
+      }
+      if (stderr) {
+        throw new Error(stderr);
+      }
+      return "No matches found";
+    }
+    if (result.exitCode === 2 && stdout && stderr) {
+      return `${stdout}
+${stderr}`;
+    }
+    if (stderr) {
+      throw new Error(stderr);
+    }
+    throw new Error(output || `grep failed with exit code ${result.exitCode}`);
   };
   return {
     paths: options.paths,
@@ -2106,9 +2234,9 @@ async function isWorkspaceAvailableOnHost({
 }) {
   const probePath = path6.join(
     sessionWorkDir,
-    `.ai-sdk-harness-pi-${randomUUID()}`
+    `.ai-sdk-harness-pi-${randomUUID2()}`
   );
-  const probeContent = randomUUID();
+  const probeContent = randomUUID2();
   try {
     await writeFile3(probePath, probeContent, { flag: "wx" });
     const sandboxContent = await sandbox.readBinaryFile({ path: probePath });