@ai-sdk/harness-pi 1.0.71 → 1.0.72

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @ai-sdk/harness-pi
 
+## 1.0.72
+
+### Patch Changes
+
+- 83fe754: chore(harness): simplify the `auth` param to be a simple string to choose the auth method
+- 0f5de2d: fix(harness-pi): ensure Pi's `.sessions` infra directory does not pollute the agent's working directory
+- Updated dependencies [8d717b3]
+  - @ai-sdk/harness@1.0.71
+
 ## 1.0.71
 
 ### Patch Changes

package/dist/index.d.ts

@@ -3,12 +3,14 @@ import { HarnessV1, HarnessV1BuiltinTool } from '@ai-sdk/harness';
 import { ExtensionFactory } from '@earendil-works/pi-coding-agent';
 
 /**
- * Pi auth options. Exactly one of `gateway` or `customEnv` is honoured
- * (precedence: explicit `customEnv`, then explicit `gateway`, then ambient
- * gateway from `process.env`). To use multiple providers, use `customEnv`
- * with the standard `<PREFIX>_API_KEY` / `<PREFIX>_BASE_URL` pattern.
+ * Pi auth options. Choose an explicit mode or rely on 'auto' (precedence:
+ * explicit gateway, then OpenAI / Anthropic / custom environment variables).
  */
-type PiAuthOptions = {
+type PiAuthenticationMode = 'auto' | 'openai' | 'anthropic' | 'custom' | 'ai-gateway';
+/**
+ * @deprecated Passing an object to auth options is deprecated. Use a `PiAuthenticationMode` string value ("auto" | "openai" | "anthropic" | "custom" | "ai-gateway") instead, and pass credentials via environment variables.
+ */
+type LegacyPiAuthOptions = {
     readonly gateway?: {
         readonly apiKey?: string;
         readonly baseUrl?: string;
@@ -25,6 +27,7 @@ type PiAuthOptions = {
      */
     readonly customEnv?: Record<string, string>;
 };
+type PiAuthOptions = PiAuthenticationMode | LegacyPiAuthOptions;
 
 type PiThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
 
@@ -140,4 +143,4 @@ declare const pi: _ai_sdk_harness.HarnessV1<{
     readonly ls: _ai_sdk_harness.HarnessV1BuiltinTool;
 }>;
 
-export { type PiAuthOptions, type PiHarnessSettings, VERSION, createPi, pi };
+export { type PiAuthOptions, type PiAuthenticationMode, type PiHarnessSettings, VERSION, createPi, pi };

package/dist/index.js

@@ -6,9 +6,9 @@ import { tool } from "@ai-sdk/provider-utils";
 import { z as z3 } from "zod/v4";
 
 // src/pi-resume-state.ts
+import { createHash } from "crypto";
 import { readFile, writeFile, mkdir } from "fs/promises";
 import path from "path";
-import { shellQuote } from "@ai-sdk/harness/utils";
 import { z } from "zod/v4";
 var PI_SESSION_FILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*\.jsonl?$/;
 function safePiSessionFileName(sessionFileName) {
@@ -24,7 +24,25 @@ var piSessionFileNameSchema = z.string().refine(
 var piResumeStateSchema = z.looseObject({
   sessionFileName: piSessionFileNameSchema.optional()
 });
-var PI_SESSIONS_DIR = ".pi-sessions";
+function resolvePiPrivateSessionDirectory(input) {
+  const sessionKey = createHash("sha256").update(input.sessionId).digest("hex");
+  const privateSessionDir = path.posix.join(
+    input.sandboxHomeDir,
+    ".ai-sdk",
+    "harness-pi",
+    sessionKey
+  );
+  const relativePath = path.posix.relative(
+    input.sessionWorkDir,
+    privateSessionDir
+  );
+  if (relativePath === "" || !relativePath.startsWith("../") && !path.posix.isAbsolute(relativePath)) {
+    throw new Error(
+      `Pi private session directory ${JSON.stringify(privateSessionDir)} must be outside sessionWorkDir ${JSON.stringify(input.sessionWorkDir)}.`
+    );
+  }
+  return privateSessionDir;
+}
 function resolveContainedHostPath(input) {
   const baseDir = path.resolve(input.baseDir);
   const filePath = path.resolve(
@@ -38,7 +56,7 @@ function resolveContainedHostPath(input) {
   return filePath;
 }
 function resolveContainedSandboxPath(input) {
-  const sessionDir = path.posix.resolve(input.sessionWorkDir, PI_SESSIONS_DIR);
+  const sessionDir = path.posix.resolve(input.privateSessionDir);
   const filePath = path.posix.resolve(
     sessionDir,
     safePiSessionFileName(input.sessionFileName)
@@ -56,13 +74,9 @@ async function persistSessionFileToSandbox(args) {
   });
   const content = await readFile(hostPath);
   const remotePath = resolveContainedSandboxPath({
-    sessionWorkDir: args.sessionWorkDir,
+    privateSessionDir: args.privateSessionDir,
     sessionFileName: args.sessionFileName
   });
-  await args.sandbox.run({
-    command: `mkdir -p ${shellQuote(path.posix.dirname(remotePath))}`,
-    ...args.abortSignal ? { abortSignal: args.abortSignal } : {}
-  });
   await args.sandbox.writeBinaryFile({
     path: remotePath,
     content,
@@ -71,14 +85,14 @@ async function persistSessionFileToSandbox(args) {
 }
 async function pullSessionFileFromSandbox(args) {
   const remotePath = resolveContainedSandboxPath({
-    sessionWorkDir: args.sessionWorkDir,
+    privateSessionDir: args.privateSessionDir,
     sessionFileName: args.sessionFileName
   });
   const bytes = await args.sandbox.readBinaryFile({
     path: remotePath,
     ...args.abortSignal ? { abortSignal: args.abortSignal } : {}
   });
-  if (!bytes) return void 0;
+  if (bytes == null) return void 0;
   await mkdir(args.hostSessionDir, { recursive: true });
   const hostPath = resolveContainedHostPath({
     baseDir: args.hostSessionDir,
@@ -108,7 +122,7 @@ import { resolveSandboxHomeDir } from "@ai-sdk/harness/utils";
 import { getAiGatewayAuthFromEnv } from "@ai-sdk/harness/utils";
 
 // src/version.ts
-var VERSION = true ? "1.0.71" : "0.0.0-test";
+var VERSION = true ? "1.0.72" : "0.0.0-test";
 
 // src/pi-auth.ts
 var DEFAULT_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh";
@@ -149,27 +163,75 @@ function resolvePiEnv({
   options,
   env
 }) {
-  const customEnvConfigured = hasConfiguredValue(options?.customEnv);
+  const normalizedOptions = normalizePiAuthToLegacyAuth(options);
+  const customEnvConfigured = hasConfiguredValue(normalizedOptions?.customEnv);
   if (customEnvConfigured) {
-    return resolveCustomEnv({ customEnv: options.customEnv ?? {} });
+    return resolveCustomEnv({ customEnv: normalizedOptions.customEnv ?? {} });
   }
-  const gatewayConfigured = hasConfiguredValue(options?.gateway);
+  const gatewayConfigured = hasConfiguredValue(normalizedOptions?.gateway);
   const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env });
   if (gatewayConfigured) {
-    const apiKey = options.gateway?.apiKey ?? gatewayAuthFromEnv.apiKey;
-    const baseUrl = options.gateway?.baseUrl ?? gatewayAuthFromEnv.baseUrl;
+    const apiKey = normalizedOptions.gateway?.apiKey ?? gatewayAuthFromEnv.apiKey;
+    const baseUrl = normalizedOptions.gateway?.baseUrl ?? gatewayAuthFromEnv.baseUrl;
     if (apiKey) {
       return { AI_GATEWAY_API_KEY: apiKey, AI_GATEWAY_BASE_URL: baseUrl };
     }
     return {};
   }
+  if (typeof options === "string") {
+    switch (options) {
+      case "openai":
+        if (env.OPENAI_API_KEY) {
+          return {
+            OPENAI_API_KEY: env.OPENAI_API_KEY,
+            ...env.OPENAI_BASE_URL ? { OPENAI_BASE_URL: env.OPENAI_BASE_URL } : {}
+          };
+        }
+        return {};
+      case "anthropic":
+        if (env.ANTHROPIC_API_KEY) {
+          return {
+            ANTHROPIC_API_KEY: env.ANTHROPIC_API_KEY,
+            ...env.ANTHROPIC_BASE_URL ? { ANTHROPIC_BASE_URL: env.ANTHROPIC_BASE_URL } : {},
+            ...env.ANTHROPIC_AUTH_TOKEN ? { ANTHROPIC_AUTH_TOKEN: env.ANTHROPIC_AUTH_TOKEN } : {}
+          };
+        }
+        return {};
+      case "custom": {
+        const result = {};
+        for (const [key, value] of Object.entries(env)) {
+          if (value && (key.endsWith("_API_KEY") || key.endsWith("_BASE_URL") || key === "ANTHROPIC_AUTH_TOKEN")) {
+            result[key] = value;
+          }
+        }
+        return result;
+      }
+      case "ai-gateway":
+        if (gatewayAuthFromEnv.apiKey) {
+          return {
+            AI_GATEWAY_API_KEY: gatewayAuthFromEnv.apiKey,
+            AI_GATEWAY_BASE_URL: gatewayAuthFromEnv.baseUrl
+          };
+        }
+        return {};
+      case "auto":
+      default:
+        break;
+    }
+  }
   if (gatewayAuthFromEnv.apiKey) {
     return {
       AI_GATEWAY_API_KEY: gatewayAuthFromEnv.apiKey,
       AI_GATEWAY_BASE_URL: gatewayAuthFromEnv.baseUrl
     };
   }
-  return {};
+  const ambient = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value && (key.endsWith("_API_KEY") || key.endsWith("_BASE_URL") || key === "ANTHROPIC_AUTH_TOKEN")) {
+      ambient[key] = value;
+    }
+  }
+  return ambient;
 }
 async function registerPiProviders({
   options,
@@ -177,14 +239,91 @@ async function registerPiProviders({
   registries,
   clientApp = HARNESS_CLIENT_APP
 }) {
-  if (hasConfiguredValue(options?.customEnv)) {
+  const normalizedOptions = normalizePiAuthToLegacyAuth(options);
+  if (hasConfiguredValue(normalizedOptions?.customEnv)) {
     await registerCustomProviders({
-      customEnv: options.customEnv ?? {},
+      customEnv: normalizedOptions.customEnv ?? {},
       registries,
       clientApp
     });
     return;
   }
+  const mode = typeof options === "string" ? options : options == null ? "auto" : "legacy";
+  switch (mode) {
+    case "openai": {
+      const env = pickOpenAIEnv(resolvedEnv);
+      await registerCustomProviders({
+        customEnv: { ...pickOpenAIEnv(process.env), ...env },
+        registries,
+        clientApp
+      });
+      return;
+    }
+    case "anthropic": {
+      const env = pickAnthropicEnv(resolvedEnv);
+      await registerCustomProviders({
+        customEnv: { ...pickAnthropicEnv(process.env), ...env },
+        registries,
+        clientApp
+      });
+      return;
+    }
+    case "custom": {
+      const env = pickProviderEnv(resolvedEnv);
+      await registerCustomProviders({
+        customEnv: { ...pickProviderEnv(process.env), ...env },
+        registries,
+        clientApp
+      });
+      return;
+    }
+    case "ai-gateway": {
+      const gatewayAuth = getAiGatewayAuthFromEnv({ env: process.env });
+      const gatewayApiKey = resolvedEnv.AI_GATEWAY_API_KEY ?? gatewayAuth.apiKey;
+      const gatewayBaseUrl = resolvedEnv.AI_GATEWAY_BASE_URL ?? gatewayAuth.baseUrl;
+      if (!gatewayApiKey) return;
+      await register({
+        registries,
+        provider: "vercel-ai-gateway",
+        apiKey: gatewayApiKey,
+        config: createGatewayProviderConfig({
+          apiKey: gatewayApiKey,
+          baseUrl: gatewayBaseUrl,
+          clientApp
+        })
+      });
+      return;
+    }
+    case "legacy":
+      break;
+    // handled below
+    case "auto":
+    default: {
+      const gatewayAuth = getAiGatewayAuthFromEnv({ env: process.env });
+      const gatewayApiKey = resolvedEnv.AI_GATEWAY_API_KEY ?? gatewayAuth.apiKey;
+      const gatewayBaseUrl = resolvedEnv.AI_GATEWAY_BASE_URL ?? gatewayAuth.baseUrl;
+      if (gatewayApiKey) {
+        await register({
+          registries,
+          provider: "vercel-ai-gateway",
+          apiKey: gatewayApiKey,
+          config: createGatewayProviderConfig({
+            apiKey: gatewayApiKey,
+            baseUrl: gatewayBaseUrl,
+            clientApp
+          })
+        });
+        return;
+      }
+      const env = pickProviderEnv(resolvedEnv);
+      await registerCustomProviders({
+        customEnv: { ...pickProviderEnv(process.env), ...env },
+        registries,
+        clientApp
+      });
+      return;
+    }
+  }
   const apiKey = resolvedEnv.AI_GATEWAY_API_KEY;
   const baseUrl = resolvedEnv.AI_GATEWAY_BASE_URL;
   if (!apiKey || !baseUrl) return;
@@ -195,6 +334,51 @@ async function registerPiProviders({
     config: createGatewayProviderConfig({ apiKey, baseUrl, clientApp })
   });
 }
+function pickOpenAIEnv(env) {
+  const result = {};
+  if (env.OPENAI_API_KEY) result.OPENAI_API_KEY = env.OPENAI_API_KEY;
+  if (env.OPENAI_BASE_URL) result.OPENAI_BASE_URL = env.OPENAI_BASE_URL;
+  return result;
+}
+function pickAnthropicEnv(env) {
+  const result = {};
+  if (env.ANTHROPIC_API_KEY) result.ANTHROPIC_API_KEY = env.ANTHROPIC_API_KEY;
+  if (env.ANTHROPIC_BASE_URL)
+    result.ANTHROPIC_BASE_URL = env.ANTHROPIC_BASE_URL;
+  if (env.ANTHROPIC_AUTH_TOKEN)
+    result.ANTHROPIC_AUTH_TOKEN = env.ANTHROPIC_AUTH_TOKEN;
+  return result;
+}
+function pickProviderEnv(env) {
+  const result = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value && (key.endsWith("_API_KEY") || key.endsWith("_BASE_URL") || key === "ANTHROPIC_AUTH_TOKEN")) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function normalizePiAuthToLegacyAuth(options) {
+  if (options == null || options === "auto") {
+    return void 0;
+  }
+  if (typeof options === "string") {
+    switch (options) {
+      case "ai-gateway":
+        return { gateway: {} };
+      case "custom":
+      case "openai":
+      case "anthropic":
+        return { customEnv: {} };
+      default:
+        return void 0;
+    }
+  }
+  console.warn(
+    '[pi] Passing an object to auth options is deprecated. Use a string mode ("auto" | "openai" | "anthropic" | "custom" | "ai-gateway") instead, and pass credentials via environment variables.'
+  );
+  return options;
+}
 function resolveCustomEnv({
   customEnv
 }) {
@@ -513,7 +697,7 @@ function createPiPathMapper(options) {
 
 // src/pi-remote-ops.ts
 import path3 from "path";
-import { shellQuote as shellQuote2 } from "@ai-sdk/harness/utils";
+import { shellQuote } from "@ai-sdk/harness/utils";
 function lastOutputLine(output) {
   return output.toString("utf8").trim().split("\n").filter(Boolean).at(-1);
 }
@@ -538,7 +722,7 @@ function createPiRemoteOps(options) {
   const resolveExistingSandboxPath = async (remotePath, inputPath) => {
     const result = await runShell(
       [
-        `target=${shellQuote2(remotePath)}`,
+        `target=${shellQuote(remotePath)}`,
         `if [ ! -e "$target" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi`,
         `resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }`,
         `printf '%s\\n' "$resolved"`
@@ -563,7 +747,7 @@ function createPiRemoteOps(options) {
   const resolveWritableSandboxPath = async (remotePath, inputPath) => {
     const result = await runShell(
       [
-        `target=${shellQuote2(remotePath)}`,
+        `target=${shellQuote(remotePath)}`,
         `if [ -e "$target" ] || [ -L "$target" ]; then resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }; printf '%s\\n' "$resolved"; exit 0; fi`,
         `dir=$(dirname "$target")`,
         `base=$(basename "$target")`,
@@ -606,7 +790,7 @@ function createPiRemoteOps(options) {
     const previous = await options.sandbox.readBinaryFile({
       path: resolvedPath
     });
-    await runShell(`mkdir -p ${shellQuote2(path3.posix.dirname(resolvedPath))}`);
+    await runShell(`mkdir -p ${shellQuote(path3.posix.dirname(resolvedPath))}`);
     await options.sandbox.writeTextFile({ path: resolvedPath, content });
     options.onFileChange?.(
       previous ? "modify" : "create",
@@ -634,9 +818,9 @@ function createPiRemoteOps(options) {
     );
     const result = await runShell(
       [
-        `if [ ! -e ${shellQuote2(resolvedPath)} ]; then echo "__PI_LS_NOT_FOUND__"; exit 2; fi`,
-        `if [ ! -d ${shellQuote2(resolvedPath)} ]; then echo "__PI_LS_NOT_DIR__"; exit 3; fi`,
-        `cd ${shellQuote2(resolvedPath)}`,
+        `if [ ! -e ${shellQuote(resolvedPath)} ]; then echo "__PI_LS_NOT_FOUND__"; exit 2; fi`,
+        `if [ ! -d ${shellQuote(resolvedPath)} ]; then echo "__PI_LS_NOT_DIR__"; exit 3; fi`,
+        `cd ${shellQuote(resolvedPath)}`,
         "ls -1Ap"
       ].join("; ")
     );
@@ -659,8 +843,8 @@ function createPiRemoteOps(options) {
     );
     const result = await runShell(
       [
-        `if [ ! -e ${shellQuote2(resolvedPath)} ]; then echo "__PI_FIND_NOT_FOUND__"; exit 2; fi`,
-        `if [ -d ${shellQuote2(resolvedPath)} ]; then find ${shellQuote2(resolvedPath)} -type f -print; else printf '%s\\n' ${shellQuote2(resolvedPath)}; fi`
+        `if [ ! -e ${shellQuote(resolvedPath)} ]; then echo "__PI_FIND_NOT_FOUND__"; exit 2; fi`,
+        `if [ -d ${shellQuote(resolvedPath)} ]; then find ${shellQuote(resolvedPath)} -type f -print; else printf '%s\\n' ${shellQuote(resolvedPath)}; fi`
       ].join("; ")
     );
     const output = result.output.toString("utf8").trim();
@@ -699,9 +883,9 @@ function createPiRemoteOps(options) {
     const limit = Math.max(1, input.limit ?? 100);
     const result = await runShell(
       [
-        `if [ ! -e ${shellQuote2(resolvedPath)} ]; then echo "__PI_GREP_NOT_FOUND__"; exit 2; fi`,
-        `cd ${shellQuote2(options.paths.sandboxWorkDir)}`,
-        `grep ${flags.map(shellQuote2).join(" ")} -- ${shellQuote2(pattern)} ${shellQuote2(targetPath)} 2>/dev/null | head -n ${limit}`
+        `if [ ! -e ${shellQuote(resolvedPath)} ]; then echo "__PI_GREP_NOT_FOUND__"; exit 2; fi`,
+        `cd ${shellQuote(options.paths.sandboxWorkDir)}`,
+        `grep ${flags.map(shellQuote).join(" ")} -- ${shellQuote(pattern)} ${shellQuote(targetPath)} 2>/dev/null | head -n ${limit}`
       ].join("; ")
     );
     const output = result.output.toString("utf8").trim();
@@ -1358,7 +1542,7 @@ import {
   writeFile as writeFile2
 } from "fs/promises";
 import path6 from "path";
-import { shellQuote as shellQuote3 } from "@ai-sdk/harness/utils";
+import { shellQuote as shellQuote2 } from "@ai-sdk/harness/utils";
 var PI_CONFIG_DIRS = [".pi", ".agents"];
 var PI_CONTEXT_FILENAMES = ["AGENTS.md", "AGENTS.MD"];
 function normalizeRelativePath(inputPath) {
@@ -1383,7 +1567,7 @@ async function readCommandOutput(sandbox, command) {
 }
 async function listRemoteWorkspaceEntries(sandbox, sandboxWorkDir) {
   const contextPredicate = PI_CONTEXT_FILENAMES.map(
-    (name) => `-name ${shellQuote3(name)}`
+    (name) => `-name ${shellQuote2(name)}`
   ).join(" -o ");
   const configFinds = PI_CONFIG_DIRS.map(
     (dir) => `  if [ -d ./${dir} ]; then find -L ./${dir} \\( -type d -o -type f \\) -print0; fi;`
@@ -1404,7 +1588,7 @@ async function listRemoteWorkspaceEntries(sandbox, sandboxWorkDir) {
   ].join("\n");
   const output = await readCommandOutput(
     sandbox,
-    [`cd ${shellQuote3(sandboxWorkDir)}`, listCommand].join(" && ")
+    [`cd ${shellQuote2(sandboxWorkDir)}`, listCommand].join(" && ")
   );
   const directories = [];
   const files = [];
@@ -1625,14 +1809,19 @@ async function createPiSession(input) {
   await mkdir3(hostAgentDir, { recursive: true });
   await mkdir3(hostSessionDir, { recursive: true });
   const sandbox = input.sandboxSession.restricted();
+  const sandboxHomeDir = await resolveSandboxHomeDir({
+    sandbox,
+    ...input.abortSignal ? { abortSignal: input.abortSignal } : {}
+  });
+  const privateSessionDir = resolvePiPrivateSessionDirectory({
+    sandboxHomeDir,
+    sessionWorkDir: input.sessionWorkDir,
+    sessionId: input.sessionId
+  });
   const permissionMode = input.permissionMode ?? "allow-all";
   let sandboxSkillRootDir;
   let harnessSkills = [];
   if (input.skills.length > 0) {
-    const sandboxHomeDir = await resolveSandboxHomeDir({
-      sandbox,
-      ...input.abortSignal ? { abortSignal: input.abortSignal } : {}
-    });
     sandboxSkillRootDir = path7.posix.join(sandboxHomeDir, ".agents", "skills");
     harnessSkills = createHarnessPiSkills({
       skills: input.skills,
@@ -1652,7 +1841,7 @@ async function createPiSession(input) {
     );
     resumeSessionFilePath = await pullSessionFileFromSandbox({
       sandbox,
-      sessionWorkDir: input.sessionWorkDir,
+      privateSessionDir,
       hostSessionDir,
       sessionFileName: resumeSessionFileName,
       ...input.abortSignal ? { abortSignal: input.abortSignal } : {}
@@ -1817,7 +2006,7 @@ async function createPiSession(input) {
     if (!sessionFileName) return;
     await persistSessionFileToSandbox({
       sandbox,
-      sessionWorkDir: input.sessionWorkDir,
+      privateSessionDir,
       hostSessionDir,
       sessionFileName
     });