@ai-sdk/harness-pi 1.0.34 → 1.0.36

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @ai-sdk/harness-pi
 
+## 1.0.36
+
+### Patch Changes
+
+- cc3e121: fix(harness-pi): block workspace symlink escapes in file tools
+- Updated dependencies [cd06458]
+  - @ai-sdk/provider-utils@5.0.11
+  - @ai-sdk/harness@1.0.36
+
+## 1.0.35
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.35
+
 ## 1.0.34
 
 ### Patch Changes

package/dist/index.js

@@ -108,7 +108,7 @@ import { resolveSandboxHomeDir } from "@ai-sdk/harness/utils";
 import { getAiGatewayAuthFromEnv } from "@ai-sdk/harness/utils";
 
 // src/version.ts
-var VERSION = true ? "1.0.34" : "0.0.0-test";
+var VERSION = true ? "1.0.36" : "0.0.0-test";
 
 // src/pi-auth.ts
 var DEFAULT_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh";
@@ -399,11 +399,28 @@ function createPiPathMapper(options) {
   const readableRoots = options.readableRoots?.map((root) => ({
     sandboxDir: path2.posix.normalize(root.sandboxDir)
   })) ?? [];
+  const assertWorkspaceSandboxPath = (inputPath) => {
+    const normalizedInput = path2.posix.normalize(inputPath);
+    if (!isInsidePosixPath(normalizedSandbox, normalizedInput)) {
+      throw new Error(`Pi path escapes the workspace: ${inputPath}`);
+    }
+    return normalizedInput;
+  };
+  const assertReadableSandboxPath = (inputPath) => {
+    const normalizedInput = path2.posix.normalize(inputPath);
+    if (!isInsidePosixPath(normalizedSandbox, normalizedInput) && !readableRoots.some(
+      (root) => isInsidePosixPath(root.sandboxDir, normalizedInput)
+    )) {
+      throw new Error(`Pi path escapes the readable roots: ${inputPath}`);
+    }
+    return normalizedInput;
+  };
   const toWorkspaceSandboxPath = (inputPath) => {
     if (path2.posix.isAbsolute(inputPath)) {
       const normalizedInput = path2.posix.normalize(inputPath);
-      if (isInsidePosixPath(normalizedSandbox, normalizedInput)) {
-        return normalizedInput;
+      try {
+        return assertWorkspaceSandboxPath(normalizedInput);
+      } catch {
       }
     }
     const resolvedHost = path2.isAbsolute(inputPath) ? path2.resolve(inputPath) : path2.resolve(normalizedHost, inputPath);
@@ -423,14 +440,19 @@ function createPiPathMapper(options) {
     toReadableSandboxPath(inputPath) {
       if (path2.posix.isAbsolute(inputPath)) {
         const normalizedInput = path2.posix.normalize(inputPath);
-        if (isInsidePosixPath(normalizedSandbox, normalizedInput) || readableRoots.some(
-          (root) => isInsidePosixPath(root.sandboxDir, normalizedInput)
-        )) {
-          return normalizedInput;
+        try {
+          return assertReadableSandboxPath(normalizedInput);
+        } catch {
         }
       }
       return toWorkspaceSandboxPath(inputPath);
     },
+    assertSandboxPath(inputPath) {
+      return assertWorkspaceSandboxPath(inputPath);
+    },
+    assertReadableSandboxPath(inputPath) {
+      return assertReadableSandboxPath(inputPath);
+    },
     toRelativePath(inputPath) {
       const sandboxPath = path2.posix.isAbsolute(inputPath) ? path2.posix.normalize(inputPath) : path2.posix.join(
         normalizedSandbox,
@@ -445,6 +467,9 @@ function createPiPathMapper(options) {
 // src/pi-remote-ops.ts
 import path3 from "path";
 import { shellQuote as shellQuote2 } from "@ai-sdk/harness/utils";
+function lastOutputLine(output) {
+  return output.toString("utf8").trim().split("\n").filter(Boolean).at(-1);
+}
 function createPiRemoteOps(options) {
   const runShell = async (command, input = {}) => {
     const result = await options.sandbox.run({
@@ -463,9 +488,62 @@ function createPiRemoteOps(options) {
       output
     };
   };
+  const resolveExistingSandboxPath = async (remotePath, inputPath) => {
+    const result = await runShell(
+      [
+        `target=${shellQuote2(remotePath)}`,
+        `if [ ! -e "$target" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi`,
+        `resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }`,
+        `printf '%s\\n' "$resolved"`
+      ].join("; ")
+    );
+    const output = result.output.toString("utf8");
+    if (output.includes("__PI_REALPATH_NOT_FOUND__")) {
+      throw new Error(`Path not found: ${inputPath}`);
+    }
+    if (output.includes("__PI_REALPATH_FAILED__") || result.exitCode !== 0) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    const resolvedPath = lastOutputLine(result.output);
+    if (!resolvedPath) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    return resolvedPath;
+  };
+  const resolveReadableSandboxPath = async (remotePath, inputPath) => options.paths.assertReadableSandboxPath(
+    await resolveExistingSandboxPath(remotePath, inputPath)
+  );
+  const resolveWritableSandboxPath = async (remotePath, inputPath) => {
+    const result = await runShell(
+      [
+        `target=${shellQuote2(remotePath)}`,
+        `if [ -e "$target" ] || [ -L "$target" ]; then resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }; printf '%s\\n' "$resolved"; exit 0; fi`,
+        `dir=$(dirname "$target")`,
+        `base=$(basename "$target")`,
+        `missing="$base"`,
+        `while [ ! -e "$dir" ] && [ ! -L "$dir" ]; do parent=$(dirname "$dir"); if [ "$parent" = "$dir" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi; missing="$(basename "$dir")/$missing"; dir="$parent"; done`,
+        `resolved_dir=$(realpath "$dir" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }`,
+        `printf '%s/%s\\n' "$resolved_dir" "$missing"`
+      ].join("; ")
+    );
+    const output = result.output.toString("utf8");
+    if (output.includes("__PI_REALPATH_NOT_FOUND__") || output.includes("__PI_REALPATH_FAILED__") || result.exitCode !== 0) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    const resolvedPath = lastOutputLine(result.output);
+    if (!resolvedPath) {
+      throw new Error(`Unable to resolve path: ${inputPath}`);
+    }
+    return options.paths.assertSandboxPath(resolvedPath);
+  };
   const readBuffer = async (inputPath) => {
+    const remotePath = options.paths.toReadableSandboxPath(inputPath);
+    const resolvedPath = await resolveReadableSandboxPath(
+      remotePath,
+      inputPath
+    );
     const bytes = await options.sandbox.readBinaryFile({
-      path: options.paths.toReadableSandboxPath(inputPath)
+      path: resolvedPath
     });
     if (!bytes) {
       throw new Error(`Path not found: ${inputPath}`);
@@ -474,12 +552,18 @@ function createPiRemoteOps(options) {
   };
   const writeFile3 = async (inputPath, content) => {
     const remotePath = options.paths.toSandboxPath(inputPath);
-    const previous = await options.sandbox.readBinaryFile({ path: remotePath });
-    await runShell(`mkdir -p ${shellQuote2(path3.posix.dirname(remotePath))}`);
-    await options.sandbox.writeTextFile({ path: remotePath, content });
+    const resolvedPath = await resolveWritableSandboxPath(
+      remotePath,
+      inputPath
+    );
+    const previous = await options.sandbox.readBinaryFile({
+      path: resolvedPath
+    });
+    await runShell(`mkdir -p ${shellQuote2(path3.posix.dirname(resolvedPath))}`);
+    await options.sandbox.writeTextFile({ path: resolvedPath, content });
     options.onFileChange?.(
       previous ? "modify" : "create",
-      options.paths.toRelativePath(remotePath),
+      options.paths.toRelativePath(resolvedPath),
       Buffer.from(content, "utf8")
     );
   };
@@ -497,11 +581,15 @@ function createPiRemoteOps(options) {
   };
   const listDirectory = async (inputPath = ".", limit = 500) => {
     const remotePath = options.paths.toReadableSandboxPath(inputPath);
+    const resolvedPath = await resolveReadableSandboxPath(
+      remotePath,
+      inputPath
+    );
     const result = await runShell(
       [
-        `if [ ! -e ${shellQuote2(remotePath)} ]; then echo "__PI_LS_NOT_FOUND__"; exit 2; fi`,
-        `if [ ! -d ${shellQuote2(remotePath)} ]; then echo "__PI_LS_NOT_DIR__"; exit 3; fi`,
-        `cd ${shellQuote2(remotePath)}`,
+        `if [ ! -e ${shellQuote2(resolvedPath)} ]; then echo "__PI_LS_NOT_FOUND__"; exit 2; fi`,
+        `if [ ! -d ${shellQuote2(resolvedPath)} ]; then echo "__PI_LS_NOT_DIR__"; exit 3; fi`,
+        `cd ${shellQuote2(resolvedPath)}`,
         "ls -1Ap"
       ].join("; ")
     );
@@ -518,17 +606,21 @@ function createPiRemoteOps(options) {
   };
   const findFiles = async (pattern, inputPath = ".", limit = 1e3) => {
     const remotePath = options.paths.toReadableSandboxPath(inputPath);
+    const resolvedPath = await resolveReadableSandboxPath(
+      remotePath,
+      inputPath
+    );
     const result = await runShell(
       [
-        `if [ ! -e ${shellQuote2(remotePath)} ]; then echo "__PI_FIND_NOT_FOUND__"; exit 2; fi`,
-        `if [ -d ${shellQuote2(remotePath)} ]; then find ${shellQuote2(remotePath)} -type f -print; else printf '%s\\n' ${shellQuote2(remotePath)}; fi`
+        `if [ ! -e ${shellQuote2(resolvedPath)} ]; then echo "__PI_FIND_NOT_FOUND__"; exit 2; fi`,
+        `if [ -d ${shellQuote2(resolvedPath)} ]; then find ${shellQuote2(resolvedPath)} -type f -print; else printf '%s\\n' ${shellQuote2(resolvedPath)}; fi`
       ].join("; ")
     );
     const output = result.output.toString("utf8").trim();
     if (output.includes("__PI_FIND_NOT_FOUND__")) {
       throw new Error(`Path not found: ${inputPath}`);
     }
-    const searchRoot = remotePath;
+    const searchRoot = resolvedPath;
     return output.split("\n").filter(Boolean).map((absolutePath) => {
       if (absolutePath === searchRoot) {
         return path3.posix.basename(absolutePath);
@@ -542,8 +634,12 @@ function createPiRemoteOps(options) {
   };
   const grepFiles = async (pattern, input) => {
     const remotePath = options.paths.toReadableSandboxPath(input.path ?? ".");
-    const relativeTarget = options.paths.toRelativePath(remotePath);
-    const targetPath = relativeTarget.startsWith("../") || path3.posix.isAbsolute(relativeTarget) ? remotePath : relativeTarget;
+    const resolvedPath = await resolveReadableSandboxPath(
+      remotePath,
+      input.path ?? "."
+    );
+    const relativeTarget = options.paths.toRelativePath(resolvedPath);
+    const targetPath = relativeTarget.startsWith("../") || path3.posix.isAbsolute(relativeTarget) ? resolvedPath : relativeTarget;
     const flags = [
       "-R",
       "-n",
@@ -556,7 +652,7 @@ function createPiRemoteOps(options) {
     const limit = Math.max(1, input.limit ?? 100);
     const result = await runShell(
       [
-        `if [ ! -e ${shellQuote2(remotePath)} ]; then echo "__PI_GREP_NOT_FOUND__"; exit 2; fi`,
+        `if [ ! -e ${shellQuote2(resolvedPath)} ]; then echo "__PI_GREP_NOT_FOUND__"; exit 2; fi`,
         `cd ${shellQuote2(options.paths.sandboxWorkDir)}`,
         `grep ${flags.map(shellQuote2).join(" ")} -- ${shellQuote2(pattern)} ${shellQuote2(targetPath)} 2>/dev/null | head -n ${limit}`
       ].join("; ")