@ai-sdk/harness-pi 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @ai-sdk/harness-pi
 
+## 1.0.5
+
+### Patch Changes
+
+- b6d0025: fix(harness-pi): fix potential path traversal issues in Pi harness adapter
+- 43a8c68: fix(harness): use `shellQuote` where appropriate in harness adapters
+- ba6d510: chore: fix deprecated use of zod `.passthrough()`
+  - @ai-sdk/harness@1.0.5
+
+## 1.0.4
+
+### Patch Changes
+
+- c493634: fix(harness): fix harness Zod usage to be v3/v4 compatible
+- Updated dependencies [c493634]
+  - @ai-sdk/harness@1.0.4
+
 ## 1.0.3
 
 ### Patch Changes

package/dist/index.d.ts

@@ -65,8 +65,8 @@ declare const PI_BUILTIN_TOOLS: {
     }, unknown>;
     readonly grep: HarnessV1BuiltinTool<{
         pattern: string;
-        glob?: string | undefined;
         path?: string | undefined;
+        glob?: string | undefined;
         ignoreCase?: boolean | undefined;
         literal?: boolean | undefined;
         context?: number | undefined;
@@ -104,8 +104,8 @@ declare const pi: _ai_sdk_harness.HarnessV1<{
     }, unknown>;
     readonly grep: _ai_sdk_harness.HarnessV1BuiltinTool<{
         pattern: string;
-        glob?: string | undefined;
         path?: string | undefined;
+        glob?: string | undefined;
         ignoreCase?: boolean | undefined;
         literal?: boolean | undefined;
         context?: number | undefined;

package/dist/index.js

@@ -3,26 +3,126 @@ import {
   commonTool
 } from "@ai-sdk/harness";
 import { tool } from "@ai-sdk/provider-utils";
-import { z as z3 } from "zod";
+import { z as z3 } from "zod/v4";
 
 // src/pi-resume-state.ts
 import { readFile, writeFile, mkdir } from "fs/promises";
 import path from "path";
-import { z } from "zod";
-var piResumeStateSchema = z.object({
-  sessionFileName: z.string().optional()
-}).passthrough();
+import { z } from "zod/v4";
+
+// src/pi-utils.ts
+import {
+  HarnessCapabilityUnsupportedError
+} from "@ai-sdk/harness";
+var HARNESS_ID = "pi";
+function extractUserText(prompt) {
+  if (typeof prompt === "string") {
+    return prompt;
+  }
+  const { content } = prompt;
+  if (typeof content === "string") {
+    return content;
+  }
+  const parts = [];
+  for (const part of content) {
+    if (part.type !== "text") {
+      throw new HarnessCapabilityUnsupportedError({
+        message: `pi: only text user-message parts are supported; got '${part.type}'.`,
+        harnessId: HARNESS_ID
+      });
+    }
+    parts.push(part.text);
+  }
+  return parts.join("\n\n");
+}
+function frameInstructions(instructions, userText) {
+  return `<session-instructions>
+The block below is operating guidance from the system, not a message from the user \u2014 follow it, but do not mention it or attribute it to the user.
+
+${instructions}
+</session-instructions>
+
+<user-message>
+${userText}
+</user-message>`;
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function serializeToolOutput(output) {
+  if (typeof output === "string") {
+    return output;
+  }
+  const serialized = JSON.stringify(output);
+  return serialized ?? "null";
+}
+function safePiMetadataSegment(name, label) {
+  if (!/^[A-Za-z0-9._-]+$/.test(name) || name === "." || name === "..") {
+    throw new Error(`Invalid Pi ${label} name: ${name}`);
+  }
+  return name;
+}
+function renderPiSkillFile(skill) {
+  return `---
+name: ${skill.name}
+description: ${skill.description}
+---
+
+${skill.content}`;
+}
+
+// src/pi-resume-state.ts
+var PI_SESSION_FILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*\.jsonl?$/;
+function safePiSessionFileName(sessionFileName) {
+  if (!PI_SESSION_FILE_NAME_PATTERN.test(sessionFileName)) {
+    throw new Error(`Invalid Pi session file name: ${sessionFileName}`);
+  }
+  return sessionFileName;
+}
+var piSessionFileNameSchema = z.string().refine(
+  (sessionFileName) => PI_SESSION_FILE_NAME_PATTERN.test(sessionFileName),
+  "Pi sessionFileName must be a safe .jsonl or .json basename."
+);
+var piResumeStateSchema = z.looseObject({
+  sessionFileName: piSessionFileNameSchema.optional()
+});
 var PI_SESSIONS_DIR = ".pi-sessions";
+function resolveContainedHostPath(input) {
+  const baseDir = path.resolve(input.baseDir);
+  const filePath = path.resolve(
+    baseDir,
+    safePiSessionFileName(input.sessionFileName)
+  );
+  const relativePath = path.relative(baseDir, filePath);
+  if (relativePath === "" || relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+    throw new Error(`Invalid Pi session file name: ${input.sessionFileName}`);
+  }
+  return filePath;
+}
+function resolveContainedSandboxPath(input) {
+  const sessionDir = path.posix.resolve(input.sessionWorkDir, PI_SESSIONS_DIR);
+  const filePath = path.posix.resolve(
+    sessionDir,
+    safePiSessionFileName(input.sessionFileName)
+  );
+  const relativePath = path.posix.relative(sessionDir, filePath);
+  if (relativePath === "" || relativePath.startsWith("..") || path.posix.isAbsolute(relativePath)) {
+    throw new Error(`Invalid Pi session file name: ${input.sessionFileName}`);
+  }
+  return filePath;
+}
 async function persistSessionFileToSandbox(args) {
-  const hostPath = path.join(args.hostSessionDir, args.sessionFileName);
+  const hostPath = resolveContainedHostPath({
+    baseDir: args.hostSessionDir,
+    sessionFileName: args.sessionFileName
+  });
   const content = await readFile(hostPath);
-  const remotePath = path.posix.join(
-    args.sessionWorkDir,
-    PI_SESSIONS_DIR,
-    args.sessionFileName
-  );
+  const remotePath = resolveContainedSandboxPath({
+    sessionWorkDir: args.sessionWorkDir,
+    sessionFileName: args.sessionFileName
+  });
   await args.sandbox.run({
-    command: `mkdir -p ${path.posix.dirname(remotePath)}`,
+    command: `mkdir -p ${shellQuote(path.posix.dirname(remotePath))}`,
     ...args.abortSignal ? { abortSignal: args.abortSignal } : {}
   });
   await args.sandbox.writeBinaryFile({
@@ -32,18 +132,20 @@ async function persistSessionFileToSandbox(args) {
   });
 }
 async function pullSessionFileFromSandbox(args) {
-  const remotePath = path.posix.join(
-    args.sessionWorkDir,
-    PI_SESSIONS_DIR,
-    args.sessionFileName
-  );
+  const remotePath = resolveContainedSandboxPath({
+    sessionWorkDir: args.sessionWorkDir,
+    sessionFileName: args.sessionFileName
+  });
   const bytes = await args.sandbox.readBinaryFile({
     path: remotePath,
     ...args.abortSignal ? { abortSignal: args.abortSignal } : {}
   });
   if (!bytes) return void 0;
   await mkdir(args.hostSessionDir, { recursive: true });
-  const hostPath = path.join(args.hostSessionDir, args.sessionFileName);
+  const hostPath = resolveContainedHostPath({
+    baseDir: args.hostSessionDir,
+    sessionFileName: args.sessionFileName
+  });
   await writeFile(hostPath, bytes);
   return hostPath;
 }
@@ -171,13 +273,13 @@ function applyCustomEnv(customEnv, registries) {
 }
 
 // src/pi-events.ts
-import { z as z2 } from "zod";
-var piSessionEventSchema = z2.object({
+import { z as z2 } from "zod/v4";
+var piSessionEventSchema = z2.looseObject({
   type: z2.string(),
-  assistantMessageEvent: z2.object({
+  assistantMessageEvent: z2.looseObject({
     type: z2.string().optional(),
     delta: z2.string().optional()
-  }).passthrough().optional(),
+  }).optional(),
   toolCallId: z2.string().optional(),
   toolName: z2.string().optional(),
   args: z2.unknown().optional(),
@@ -192,18 +294,18 @@ var piSessionEventSchema = z2.object({
   aborted: z2.boolean().optional(),
   error: z2.union([
     z2.string(),
-    z2.object({
+    z2.looseObject({
       errorMessage: z2.string().optional(),
       stopReason: z2.string().optional()
-    }).passthrough()
+    })
   ]).optional(),
-  message: z2.object({
+  message: z2.looseObject({
     role: z2.string().optional(),
     content: z2.unknown().optional(),
     stopReason: z2.string().optional(),
     errorMessage: z2.string().optional()
-  }).passthrough().optional()
-}).passthrough();
+  }).optional()
+});
 function parseNativeEvent(raw) {
   const parsed = piSessionEventSchema.safeParse(raw);
   return parsed.success ? parsed.data : void 0;
@@ -358,69 +460,6 @@ function createPiPathMapper(options) {
 
 // src/pi-remote-ops.ts
 import path3 from "path";
-
-// src/pi-utils.ts
-import {
-  HarnessCapabilityUnsupportedError
-} from "@ai-sdk/harness";
-var HARNESS_ID = "pi";
-function extractUserText(prompt) {
-  if (typeof prompt === "string") {
-    return prompt;
-  }
-  const { content } = prompt;
-  if (typeof content === "string") {
-    return content;
-  }
-  const parts = [];
-  for (const part of content) {
-    if (part.type !== "text") {
-      throw new HarnessCapabilityUnsupportedError({
-        message: `pi: only text user-message parts are supported; got '${part.type}'.`,
-        harnessId: HARNESS_ID
-      });
-    }
-    parts.push(part.text);
-  }
-  return parts.join("\n\n");
-}
-function frameInstructions(instructions, userText) {
-  return `<session-instructions>
-The block below is operating guidance from the system, not a message from the user \u2014 follow it, but do not mention it or attribute it to the user.
-
-${instructions}
-</session-instructions>
-
-<user-message>
-${userText}
-</user-message>`;
-}
-function shellQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function serializeToolOutput(output) {
-  if (typeof output === "string") {
-    return output;
-  }
-  const serialized = JSON.stringify(output);
-  return serialized ?? "null";
-}
-function safePiMetadataSegment(name, label) {
-  if (!/^[A-Za-z0-9._-]+$/.test(name) || name === "." || name === "..") {
-    throw new Error(`Invalid Pi ${label} name: ${name}`);
-  }
-  return name;
-}
-function renderPiSkillFile(skill) {
-  return `---
-name: ${skill.name}
-description: ${skill.description}
----
-
-${skill.content}`;
-}
-
-// src/pi-remote-ops.ts
 function createPiRemoteOps(options) {
   const runShell = async (command, input = {}) => {
     const result = await options.sandbox.run({
@@ -1402,11 +1441,14 @@ async function createPiSession(input) {
   }
   let resumeSessionFilePath;
   if (input.isResume && input.resumeSessionFileName) {
+    const resumeSessionFileName = safePiSessionFileName(
+      input.resumeSessionFileName
+    );
     resumeSessionFilePath = await pullSessionFileFromSandbox({
       sandbox,
       sessionWorkDir: input.sessionWorkDir,
       hostSessionDir,
-      sessionFileName: input.resumeSessionFileName,
+      sessionFileName: resumeSessionFileName,
       ...input.abortSignal ? { abortSignal: input.abortSignal } : {}
     });
   }
@@ -1612,7 +1654,7 @@ async function createPiSession(input) {
     piSession = session;
     const candidatePath = sessionManager.getSessionFile();
     if (candidatePath) {
-      sessionFileName = path7.basename(candidatePath);
+      sessionFileName = safePiSessionFileName(path7.basename(candidatePath));
     }
     translatorState = createPiTranslatorState({
       builtinToolNames: builtinNames,