@ai-sdk/harness-pi 1.0.4 → 1.0.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-pi",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -28,8 +28,8 @@
   "dependencies": {
     "@earendil-works/pi-coding-agent": "^0.79.0",
     "typebox": "^1.1.38",
-    "@ai-sdk/harness": "1.0.4",
-    "@ai-sdk/provider-utils": "5.0.0"
+    "@ai-sdk/harness": "1.0.6",
+    "@ai-sdk/provider-utils": "5.0.1"
   },
   "peerDependencies": {
     "zod": "^3.25.76 || ^4.1.8"

package/src/pi-events.ts

@@ -2,54 +2,48 @@ import { z } from 'zod/v4';
 
 /**
  * Pi `session.subscribe` emits a discriminated union of events. The exact
- * shape evolves with Pi versions; we accept the events with `passthrough()`
- * and extract only the fields we recognise. The `type` field is required
- * and stringly-typed because Pi may add new types we want to ignore.
+ * shape evolves with Pi versions; we accept loose objects and extract only
+ * the fields we recognise. The `type` field is required and stringly-typed
+ * because Pi may add new types we want to ignore.
  */
-export const piSessionEventSchema = z
-  .object({
-    type: z.string(),
-    assistantMessageEvent: z
-      .object({
-        type: z.string().optional(),
-        delta: z.string().optional(),
-      })
-      .passthrough()
-      .optional(),
-    toolCallId: z.string().optional(),
-    toolName: z.string().optional(),
-    args: z.unknown().optional(),
-    input: z.unknown().optional(),
-    result: z.unknown().optional(),
-    content: z.unknown().optional(),
-    isError: z.boolean().optional(),
-    // Compaction events (`compaction_start` / `compaction_end`). `result` (a
-    // `CompactionResult`) rides the shared `result` field above; `reason`
-    // distinguishes manual vs automatic (threshold/overflow) compaction.
-    reason: z.string().optional(),
-    aborted: z.boolean().optional(),
-    error: z
-      .union([
-        z.string(),
-        z
-          .object({
-            errorMessage: z.string().optional(),
-            stopReason: z.string().optional(),
-          })
-          .passthrough(),
-      ])
-      .optional(),
-    message: z
-      .object({
-        role: z.string().optional(),
-        content: z.unknown().optional(),
-        stopReason: z.string().optional(),
+export const piSessionEventSchema = z.looseObject({
+  type: z.string(),
+  assistantMessageEvent: z
+    .looseObject({
+      type: z.string().optional(),
+      delta: z.string().optional(),
+    })
+    .optional(),
+  toolCallId: z.string().optional(),
+  toolName: z.string().optional(),
+  args: z.unknown().optional(),
+  input: z.unknown().optional(),
+  result: z.unknown().optional(),
+  content: z.unknown().optional(),
+  isError: z.boolean().optional(),
+  // Compaction events (`compaction_start` / `compaction_end`). `result` (a
+  // `CompactionResult`) rides the shared `result` field above; `reason`
+  // distinguishes manual vs automatic (threshold/overflow) compaction.
+  reason: z.string().optional(),
+  aborted: z.boolean().optional(),
+  error: z
+    .union([
+      z.string(),
+      z.looseObject({
         errorMessage: z.string().optional(),
-      })
-      .passthrough()
-      .optional(),
-  })
-  .passthrough();
+        stopReason: z.string().optional(),
+      }),
+    ])
+    .optional(),
+  message: z
+    .looseObject({
+      role: z.string().optional(),
+      content: z.unknown().optional(),
+      stopReason: z.string().optional(),
+      errorMessage: z.string().optional(),
+    })
+    .optional(),
+});
 
 export type PiSessionEvent = z.infer<typeof piSessionEventSchema>;
 

package/src/pi-resume-state.ts

@@ -2,6 +2,23 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import path from 'node:path';
 import type { Experimental_SandboxSession } from '@ai-sdk/provider-utils';
 import { z } from 'zod/v4';
+import { shellQuote } from './pi-utils';
+
+const PI_SESSION_FILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*\.jsonl?$/;
+
+export function safePiSessionFileName(sessionFileName: string): string {
+  if (!PI_SESSION_FILE_NAME_PATTERN.test(sessionFileName)) {
+    throw new Error(`Invalid Pi session file name: ${sessionFileName}`);
+  }
+  return sessionFileName;
+}
+
+const piSessionFileNameSchema = z
+  .string()
+  .refine(
+    sessionFileName => PI_SESSION_FILE_NAME_PATTERN.test(sessionFileName),
+    'Pi sessionFileName must be a safe .jsonl or .json basename.',
+  );
 
 /**
  * Schema for the adapter-specific portion of lifecycle state `data` produced
@@ -10,16 +27,54 @@ import { z } from 'zod/v4';
  * in the sandbox under `${sessionWorkDir}/.pi-sessions/<sessionFileName>` so
  * they survive cross-process resume via the sandbox snapshot.
  */
-export const piResumeStateSchema = z
-  .object({
-    sessionFileName: z.string().optional(),
-  })
-  .passthrough();
+export const piResumeStateSchema = z.looseObject({
+  sessionFileName: piSessionFileNameSchema.optional(),
+});
 
 export type PiResumeStateData = z.infer<typeof piResumeStateSchema>;
 
 const PI_SESSIONS_DIR = '.pi-sessions';
 
+function resolveContainedHostPath(input: {
+  readonly baseDir: string;
+  readonly sessionFileName: string;
+}): string {
+  const baseDir = path.resolve(input.baseDir);
+  const filePath = path.resolve(
+    baseDir,
+    safePiSessionFileName(input.sessionFileName),
+  );
+  const relativePath = path.relative(baseDir, filePath);
+  if (
+    relativePath === '' ||
+    relativePath.startsWith('..') ||
+    path.isAbsolute(relativePath)
+  ) {
+    throw new Error(`Invalid Pi session file name: ${input.sessionFileName}`);
+  }
+  return filePath;
+}
+
+function resolveContainedSandboxPath(input: {
+  readonly sessionWorkDir: string;
+  readonly sessionFileName: string;
+}): string {
+  const sessionDir = path.posix.resolve(input.sessionWorkDir, PI_SESSIONS_DIR);
+  const filePath = path.posix.resolve(
+    sessionDir,
+    safePiSessionFileName(input.sessionFileName),
+  );
+  const relativePath = path.posix.relative(sessionDir, filePath);
+  if (
+    relativePath === '' ||
+    relativePath.startsWith('..') ||
+    path.posix.isAbsolute(relativePath)
+  ) {
+    throw new Error(`Invalid Pi session file name: ${input.sessionFileName}`);
+  }
+  return filePath;
+}
+
 /**
  * Copy the Pi session file from the host's local mirror to a stable location
  * inside the sandbox workspace. Called during resumable lifecycle methods so
@@ -32,16 +87,18 @@ export async function persistSessionFileToSandbox(args: {
   readonly sessionFileName: string;
   readonly abortSignal?: AbortSignal;
 }): Promise<void> {
-  const hostPath = path.join(args.hostSessionDir, args.sessionFileName);
+  const hostPath = resolveContainedHostPath({
+    baseDir: args.hostSessionDir,
+    sessionFileName: args.sessionFileName,
+  });
   const content = await readFile(hostPath);
-  const remotePath = path.posix.join(
-    args.sessionWorkDir,
-    PI_SESSIONS_DIR,
-    args.sessionFileName,
-  );
+  const remotePath = resolveContainedSandboxPath({
+    sessionWorkDir: args.sessionWorkDir,
+    sessionFileName: args.sessionFileName,
+  });
   // Ensure the parent dir exists in the sandbox before writing.
   await args.sandbox.run({
-    command: `mkdir -p ${path.posix.dirname(remotePath)}`,
+    command: `mkdir -p ${shellQuote(path.posix.dirname(remotePath))}`,
     ...(args.abortSignal ? { abortSignal: args.abortSignal } : {}),
   });
   await args.sandbox.writeBinaryFile({
@@ -64,18 +121,20 @@ export async function pullSessionFileFromSandbox(args: {
   readonly sessionFileName: string;
   readonly abortSignal?: AbortSignal;
 }): Promise<string | undefined> {
-  const remotePath = path.posix.join(
-    args.sessionWorkDir,
-    PI_SESSIONS_DIR,
-    args.sessionFileName,
-  );
+  const remotePath = resolveContainedSandboxPath({
+    sessionWorkDir: args.sessionWorkDir,
+    sessionFileName: args.sessionFileName,
+  });
   const bytes = await args.sandbox.readBinaryFile({
     path: remotePath,
     ...(args.abortSignal ? { abortSignal: args.abortSignal } : {}),
   });
   if (!bytes) return undefined;
   await mkdir(args.hostSessionDir, { recursive: true });
-  const hostPath = path.join(args.hostSessionDir, args.sessionFileName);
+  const hostPath = resolveContainedHostPath({
+    baseDir: args.hostSessionDir,
+    sessionFileName: args.sessionFileName,
+  });
   await writeFile(hostPath, bytes);
   return hostPath;
 }

package/src/pi-session.ts

@@ -38,6 +38,7 @@ import { writePiSkills } from './pi-skills';
 import {
   persistSessionFileToSandbox,
   pullSessionFileFromSandbox,
+  safePiSessionFileName,
 } from './pi-resume-state';
 import {
   createPiTranslatorState,
@@ -268,11 +269,14 @@ export async function createPiSession(
   // host mirror so SessionManager.open can read it.
   let resumeSessionFilePath: string | undefined;
   if (input.isResume && input.resumeSessionFileName) {
+    const resumeSessionFileName = safePiSessionFileName(
+      input.resumeSessionFileName,
+    );
     resumeSessionFilePath = await pullSessionFileFromSandbox({
       sandbox,
       sessionWorkDir: input.sessionWorkDir,
       hostSessionDir,
-      sessionFileName: input.resumeSessionFileName,
+      sessionFileName: resumeSessionFileName,
       ...(input.abortSignal ? { abortSignal: input.abortSignal } : {}),
     });
   }
@@ -569,7 +573,7 @@ export async function createPiSession(
     // round-trip it without guessing the extension.
     const candidatePath = sessionManager.getSessionFile();
     if (candidatePath) {
-      sessionFileName = path.basename(candidatePath);
+      sessionFileName = safePiSessionFileName(path.basename(candidatePath));
     }
 
     translatorState = createPiTranslatorState({