@ai-sdk/harness 1.0.122 → 1.0.124

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness",
-  "version": "1.0.122",
+  "version": "1.0.124",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -45,8 +45,8 @@
   },
   "dependencies": {
     "@ai-sdk/provider": "4.0.18",
-    "@ai-sdk/provider-utils": "5.0.46",
-    "ai": "7.0.112"
+    "@ai-sdk/provider-utils": "5.0.47",
+    "ai": "7.0.114"
   },
   "peerDependencies": {
     "ws": "^8.21.0",
@@ -58,7 +58,7 @@
     }
   },
   "devDependencies": {
-    "@ai-sdk/otel": "1.0.112",
+    "@ai-sdk/otel": "1.0.114",
     "@opentelemetry/sdk-trace-base": "2.7.1",
     "@types/node": "22.19.19",
     "@types/ws": "^8.5.13",

package/src/agent/harness-agent.ts

@@ -1,10 +1,11 @@
 import { HarnessCapabilityUnsupportedError } from '../errors/harness-capability-unsupported-error';
-import type {
-  HarnessV1,
-  HarnessV1BuiltinToolFiltering,
-  HarnessV1JSONSchema,
-  HarnessV1NetworkSandboxSession,
-  HarnessV1ResponseFormat,
+import {
+  harnessStateDirectoryPath,
+  type HarnessV1,
+  type HarnessV1BuiltinToolFiltering,
+  type HarnessV1JSONSchema,
+  type HarnessV1NetworkSandboxSession,
+  type HarnessV1ResponseFormat,
 } from '../v1';
 import {
   asArray,
@@ -68,6 +69,7 @@ import {
 } from './internal/permission-mode';
 import { resolveHarnessAgentToolFiltering } from './internal/tool-filtering';
 import { resolveSandboxDefaultWorkingDirectory } from '../utils/resolve-sandbox-default-working-directory';
+import { resolveSandboxHomeDir } from '../utils/sandbox-home-dir';
 import { getRestrictedSandboxSession } from '../utils/get-restricted-sandbox-session';
 import type { HarnessAgentLifecycleCallbacks } from './internal/turn-telemetry';
 
@@ -402,7 +404,14 @@ export class HarnessAgent<
             session: toolSafeSandboxSession,
             recipe,
             identity: recipeIdentity,
-            defaultWorkingDirectory,
+            // Harness infrastructure always lives under the sandbox's own
+            // HOME, never the session's working directory.
+            stateDirectory: harnessStateDirectoryPath({
+              sandboxHomeDir: await resolveSandboxHomeDir({
+                sandbox: toolSafeSandboxSession,
+                abortSignal,
+              }),
+            }),
             abortSignal,
           });
         } catch (err) {
@@ -455,8 +464,14 @@ export class HarnessAgent<
               session: resumedSandboxSession.restricted(),
               recipe,
               identity: recipeIdentity,
-              defaultWorkingDirectory:
-                resumedSandboxSession.defaultWorkingDirectory,
+              // Harness infrastructure always lives under the sandbox's own
+              // HOME, never the working directory.
+              stateDirectory: harnessStateDirectoryPath({
+                sandboxHomeDir: await resolveSandboxHomeDir({
+                  sandbox: resumedSandboxSession,
+                  abortSignal,
+                }),
+              }),
               abortSignal,
             });
           } catch (err) {
@@ -503,8 +518,14 @@ export class HarnessAgent<
               session: createdSandboxSession.restricted(),
               recipe: sandboxBootstrapPlan.recipe,
               identity: sandboxBootstrapPlan.recipeIdentity,
-              defaultWorkingDirectory:
-                createdSandboxSession.defaultWorkingDirectory,
+              // Harness infrastructure always lives under the sandbox's own
+              // HOME, never the working directory.
+              stateDirectory: harnessStateDirectoryPath({
+                sandboxHomeDir: await resolveSandboxHomeDir({
+                  sandbox: createdSandboxSession,
+                  abortSignal,
+                }),
+              }),
               abortSignal,
             });
           } catch (err) {
@@ -877,7 +898,6 @@ export class HarnessAgent<
         };
       }
     }
-    return undefined;
   }
 
   /*

package/src/agent/internal/bootstrap-recipe.ts

@@ -1,6 +1,6 @@
 import { posix } from 'node:path';
 import type { Experimental_SandboxSession as SandboxSession } from '@ai-sdk/provider-utils';
-import type { HarnessV1Bootstrap } from '../../v1';
+import { harnessStateDirectoryPath, type HarnessV1Bootstrap } from '../../v1';
 
 /**
  * Version of the bootstrap recipe shape itself. Bump to force every existing
@@ -10,7 +10,9 @@ export const BOOTSTRAP_SCHEMA_VERSION = 1;
 
 /**
  * Deterministic 16-char hex identity derived from the recipe's content
- * (harnessId, bootstrapDir, file paths + contents, commands, schema version).
+ * (harness state directory, harnessId, bootstrapDir, file paths + contents,
+ * commands, schema version). The sandbox's concrete HOME is unavailable until
+ * creation, so the directory is hashed with a symbolic HOME prefix.
  * Two adapters with equivalent recipes produce the same identity; any
  * content change produces a different identity.
  *
@@ -27,6 +29,7 @@ export async function hashHarnessBootstrap(
     chunks.push(encoder.encode('\0'));
   };
 
+  pushString(harnessStateDirectoryPath({ sandboxHomeDir: '$HOME' }));
   pushString(recipe.harnessId);
   pushString(recipe.bootstrapDir);
 
@@ -66,16 +69,16 @@ export async function hashHarnessBootstrap(
 export function bootstrapMarkerPath({
   recipe,
   identity,
-  defaultWorkingDirectory,
+  stateDirectory,
 }: {
   recipe: HarnessV1Bootstrap;
   identity: string;
-  defaultWorkingDirectory: string;
+  stateDirectory: string;
 }): string {
   return posix.join(
     resolveBootstrapPath({
       path: recipe.bootstrapDir,
-      defaultWorkingDirectory,
+      stateDirectory,
     }),
     `.bootstrap-${identity}.ok`,
   );
@@ -95,19 +98,19 @@ export async function applyBootstrapRecipe({
   session,
   recipe,
   identity,
-  defaultWorkingDirectory,
+  stateDirectory,
   abortSignal,
 }: {
   session: SandboxSession;
   recipe: HarnessV1Bootstrap;
   identity: string;
-  defaultWorkingDirectory: string;
+  stateDirectory: string;
   abortSignal?: AbortSignal;
 }): Promise<void> {
   const markerPath = bootstrapMarkerPath({
     recipe,
     identity,
-    defaultWorkingDirectory,
+    stateDirectory,
   });
 
   const existingMarker = await session.readTextFile({
@@ -120,11 +123,10 @@ export async function applyBootstrapRecipe({
 
   const bootstrapDir = resolveBootstrapPath({
     path: recipe.bootstrapDir,
-    defaultWorkingDirectory,
+    stateDirectory,
   });
   const mkdirResult = await session.run({
     command: 'mkdir -p "$BOOTSTRAP_DIR"',
-    workingDirectory: defaultWorkingDirectory,
     env: { BOOTSTRAP_DIR: bootstrapDir },
     abortSignal,
   });
@@ -138,7 +140,7 @@ export async function applyBootstrapRecipe({
     await session.writeTextFile({
       path: resolveBootstrapPath({
         path: file.path,
-        defaultWorkingDirectory,
+        stateDirectory,
       }),
       content: file.content,
       abortSignal,
@@ -167,12 +169,10 @@ export async function applyBootstrapRecipe({
 
 function resolveBootstrapPath({
   path,
-  defaultWorkingDirectory,
+  stateDirectory,
 }: {
   path: string;
-  defaultWorkingDirectory: string;
+  stateDirectory: string;
 }): string {
-  return posix.isAbsolute(path)
-    ? path
-    : posix.resolve(defaultWorkingDirectory, path);
+  return posix.isAbsolute(path) ? path : posix.resolve(stateDirectory, path);
 }

package/src/agent/internal/harness-stream-text-result.ts

@@ -853,10 +853,8 @@ export class HarnessStreamTextResult<
         this.currentStepContent.push({
           ...(part as object),
         } as ContentPart<TOOLS>);
-        return;
       default:
-        // Boundary, raw, error, and finish parts are not ContentParts.
-        return;
+      // Boundary, raw, error, and finish parts are not ContentParts.
     }
   }
 }

package/src/agent/internal/run-prompt.ts

@@ -53,7 +53,11 @@ import type { HarnessAgentToolApprovalConfiguration } from '../harness-agent-set
 import { HarnessStreamTextResult } from './harness-stream-text-result';
 import { getOwn } from './get-own';
 import { translateStreamPart } from './translate-stream-part';
-import { createToolInputWorkDirStripper, stripWorkDir } from './strip-work-dir';
+import {
+  createToolInputWorkDirStripper,
+  stripParsedToolInputWorkDir,
+  stripWorkDir,
+} from './strip-work-dir';
 import {
   createTurnLifecycle,
   type HarnessAgentLifecycleCallbacks,
@@ -63,6 +67,8 @@ import { resolveCustomToolApproval } from './permission-mode';
 import { logBridgeError } from '../../utils/bridge-diagnostics';
 import { pinSandboxChannelEventCheckpoint } from '../../utils/sandbox-channel';
 
+const invalidToolInputMessage = 'Tool input validation failed.';
+
 function unwrapToolResultOutput(toolResult: ToolResultPart): {
   output: unknown;
   isError?: boolean;
@@ -647,7 +653,9 @@ export function runPrompt<
       continuation: ToolApprovalResponse,
     ): Promise<'continued' | 'awaiting-tool-result'> => {
       const rawToolCall =
-        rawToolCallsByToolCallId.get(approval.toolCallId) ??
+        (approval.kind === 'builtin'
+          ? rawToolCallsByToolCallId.get(approval.toolCallId)
+          : undefined) ??
         ({
           type: 'tool-call',
           toolCallId: approval.toolCallId,
@@ -656,16 +664,31 @@ export function runPrompt<
           providerExecuted: approval.providerExecuted,
           nativeName: approval.nativeName,
         } satisfies Extract<HarnessV1StreamPart, { type: 'tool-call' }>);
-      const parsedInput = await safeParseJSON({ text: rawToolCall.input });
-      const toolCall: ToolCallTextStreamPart = {
-        type: 'tool-call',
-        toolCallId: rawToolCall.toolCallId,
-        toolName: rawToolCall.toolName,
-        input: parsedInput.success ? parsedInput.value : rawToolCall.input,
-        ...(rawToolCall.providerExecuted !== undefined
-          ? { providerExecuted: rawToolCall.providerExecuted }
-          : {}),
-      };
+      let validatedToolCall: ToolCallTextStreamPart | undefined;
+      let toolCall: ToolCallTextStreamPart;
+      if (approval.kind === 'custom' && continuation.approved) {
+        validatedToolCall = asToolCallTextStreamPart({
+          part: await validateToolCall({
+            event: rawToolCall,
+            tools: input.tools,
+          }),
+        });
+        toolCall = displayHostToolCall({
+          toolCall: validatedToolCall,
+          sessionWorkDir: input.sessionWorkDir,
+        });
+      } else {
+        const parsedInput = await safeParseJSON({ text: rawToolCall.input });
+        toolCall = {
+          type: 'tool-call',
+          toolCallId: rawToolCall.toolCallId,
+          toolName: rawToolCall.toolName,
+          input: parsedInput.success ? parsedInput.value : rawToolCall.input,
+          ...(rawToolCall.providerExecuted !== undefined
+            ? { providerExecuted: rawToolCall.providerExecuted }
+            : {}),
+        };
+      }
 
       enqueueApprovalResponse(approval, continuation, toolCall);
       onToolApprovalSettled(approval.approvalId);
@@ -699,6 +722,29 @@ export function runPrompt<
         return 'continued';
       }
 
+      if (validatedToolCall == null) {
+        throw new Error(
+          `Harness '${input.harness.harnessId}' could not validate approved host tool '${approval.toolName}'.`,
+        );
+      }
+
+      if (validatedToolCall.invalid) {
+        const error = new Error(invalidToolInputMessage);
+        await submitToolResult({
+          toolCallId: approval.toolCallId,
+          output: { error: invalidToolInputMessage },
+          isError: true,
+        });
+        bufferedToolOutcomes.push(() => {
+          enqueueHostToolOutcome({
+            toolCall,
+            outcome: { ok: false, error },
+          });
+        });
+        await publishToolExecutions();
+        return 'continued';
+      }
+
       await lifecycle.start(input.model);
       toolExecutions.set(rawToolCall.toolCallId, {
         toolCall: toolCall as TypedToolCall<TOOLS>,
@@ -706,6 +752,7 @@ export function runPrompt<
       const executionStartedAt = Date.now();
       const execution = await maybeExecuteHostTool({
         event: rawToolCall,
+        parsedToolCall: validatedToolCall,
         tools: activeTools,
         toolsContext,
         wrappedExecuteTool: lifecycle.executeTool,
@@ -886,7 +933,6 @@ export function runPrompt<
         if (settledHostInputReplay || settledBuiltinApprovalReplay) {
           continue;
         }
-
         if (displayValue.type === 'finish-step' && closingResumedStep) {
           closingResumedStep = false;
           await publishToolExecutions();
@@ -971,15 +1017,34 @@ export function runPrompt<
 
         // Tool-call validation lives here (not in translateStreamPart) because
         // schema parsing is async and needs the merged tool set in scope.
+        let validatedHostToolCall: ToolCallTextStreamPart | undefined;
         if (displayValue.type === 'tool-call') {
+          const isHostTool =
+            value.type === 'tool-call' &&
+            !value.providerExecuted &&
+            hasTool({ tools: activeTools, toolName: value.toolName }) &&
+            !(
+              value.toolName === 'askUserQuestions' &&
+              hasTool({
+                tools: input.harness.builtinTools,
+                toolName: value.toolName,
+              })
+            );
           const parsed = await validateToolCall<TOOLS>({
-            event: displayValue,
+            event: isHostTool ? value : displayValue,
             tools: input.tools,
           });
           const parsedToolCall = asToolCallTextStreamPart({ part: parsed });
+          validatedHostToolCall = isHostTool ? parsedToolCall : undefined;
+          const displayToolCall = isHostTool
+            ? displayHostToolCall({
+                toolCall: parsedToolCall,
+                sessionWorkDir: input.sessionWorkDir,
+              })
+            : parsedToolCall;
           rawToolCallsByToolCallId.set(displayValue.toolCallId, displayValue);
-          toolCallsByToolCallId.set(displayValue.toolCallId, parsedToolCall);
-          result.enqueue(parsed);
+          toolCallsByToolCallId.set(displayValue.toolCallId, displayToolCall);
+          result.enqueue(displayToolCall as TextStreamPart<TOOLS>);
         }
 
         if (value.type === 'text-delta') {
@@ -1155,6 +1220,31 @@ export function runPrompt<
             await finishForHostInputPause({ completeCurrentStep: true });
             return;
           }
+          if (validatedHostToolCall == null) {
+            throw new Error(
+              `Harness '${input.harness.harnessId}' could not validate host tool '${toolCall.toolName}'.`,
+            );
+          }
+          if (validatedHostToolCall.invalid) {
+            settledHostToolCallIds.add(toolCall.toolCallId);
+            toolExecutions.delete(toolCall.toolCallId);
+            bufferedToolOutcomes.push(() => {
+              result.enqueue({
+                type: 'tool-error',
+                toolCallId: toolCall.toolCallId,
+                toolName: toolCall.toolName,
+                input: parsedToolCall.input,
+                error: new Error(invalidToolInputMessage),
+                dynamic: true,
+              } as TextStreamPart<TOOLS>);
+            });
+            await submitToolResult({
+              toolCallId: toolCall.toolCallId,
+              output: { error: invalidToolInputMessage },
+              isError: true,
+            });
+            continue;
+          }
           const customToolApprovalDecision = resolveCustomToolApproval({
             toolName: toolCall.toolName,
             toolApproval: input.toolApproval,
@@ -1266,6 +1356,7 @@ export function runPrompt<
               const executionStartedAt = Date.now();
               const execution = await maybeExecuteHostTool({
                 event: toolCall,
+                parsedToolCall: validatedHostToolCall,
                 tools: activeTools,
                 toolsContext,
                 wrappedExecuteTool: lifecycle.executeTool,
@@ -1414,6 +1505,22 @@ function asToolCallTextStreamPart<TOOLS extends ToolSet>(input: {
   return input.part as ToolCallTextStreamPart;
 }
 
+function displayHostToolCall(input: {
+  toolCall: ToolCallTextStreamPart;
+  sessionWorkDir: string;
+}): ToolCallTextStreamPart {
+  return {
+    ...input.toolCall,
+    input: stripParsedToolInputWorkDir({
+      value: input.toolCall.input,
+      sessionWorkDir: input.sessionWorkDir,
+    }),
+    ...(input.toolCall.invalid
+      ? { error: new Error(invalidToolInputMessage) }
+      : {}),
+  };
+}
+
 type ToolCallTextStreamPart = {
   readonly type: 'tool-call';
   readonly toolCallId: string;
@@ -1433,6 +1540,7 @@ function hasTool(input: { tools: ToolSet; toolName: string }): boolean {
 
 async function maybeExecuteHostTool<TOOLS extends ToolSet>(input: {
   event: { toolCallId: string; toolName: string; input: string };
+  parsedToolCall: ToolCallTextStreamPart;
   tools: TOOLS;
   toolsContext: InferToolSetContext<TOOLS>;
   wrappedExecuteTool: TurnLifecycle<ToolSet, Context>['executeTool'];
@@ -1450,8 +1558,15 @@ async function maybeExecuteHostTool<TOOLS extends ToolSet>(input: {
 
   if (!isExecutableTool(tool)) return { executed: false };
 
-  const parsed = await safeParseJSON({ text: input.event.input });
-  const args = parsed.success ? parsed.value : input.event.input;
+  if (input.parsedToolCall.invalid) {
+    const error = new Error(invalidToolInputMessage);
+    await input.submitToolResult({
+      toolCallId: input.event.toolCallId,
+      output: { error: invalidToolInputMessage },
+      isError: true,
+    });
+    return { executed: true, outcome: { ok: false, error } };
+  }
 
   let context: unknown;
   try {
@@ -1489,7 +1604,7 @@ async function maybeExecuteHostTool<TOOLS extends ToolSet>(input: {
         let output: unknown;
         const stream = executeTool({
           tool,
-          input: args as never,
+          input: input.parsedToolCall.input as never,
           options: {
             toolCallId: input.event.toolCallId,
             messages: [],

package/src/agent/internal/sandbox-bootstrap.ts

@@ -1,7 +1,9 @@
 import { posix } from 'node:path';
 import type { Experimental_SandboxSession as SandboxSession } from '@ai-sdk/provider-utils';
-import type { HarnessV1Bootstrap } from '../../v1';
+import { harnessStateDirectoryPath, type HarnessV1Bootstrap } from '../../v1';
+import { encodeHarnessPathSegment } from '../../v1/harness-session-data-directory-path';
 import { resolveSandboxDefaultWorkingDirectory } from '../../utils/resolve-sandbox-default-working-directory';
+import { resolveSandboxHomeDir } from '../../utils/sandbox-home-dir';
 import type { HarnessAgentSandboxConfig } from '../harness-agent-settings';
 import { applyBootstrapRecipe, hashHarnessBootstrap } from './bootstrap-recipe';
 
@@ -78,7 +80,9 @@ export function resolveSessionWorkDir({
 }): string {
   return joinSandboxPath({
     base: defaultWorkingDirectory,
-    path: workDir ?? `${harnessId}-${sessionId}`,
+    path:
+      workDir ??
+      `${encodeHarnessPathSegment(harnessId)}-${encodeHarnessPathSegment(sessionId)}`,
   });
 }
 
@@ -147,25 +151,35 @@ export async function runSandboxBootstrap({
 }): Promise<void> {
   if (recipe == null && onBootstrap == null) return;
 
-  const resolvedDefaultWorkingDirectory =
-    defaultWorkingDirectory ??
-    (await resolveSandboxDefaultWorkingDirectory({
-      sandboxSession: session,
-      abortSignal,
-    }));
-
   if (recipe != null && recipeIdentity != null) {
     await applyBootstrapRecipe({
       session,
       recipe,
       identity: recipeIdentity,
-      defaultWorkingDirectory: resolvedDefaultWorkingDirectory,
+      // Harness infrastructure always lives under the sandbox's own HOME,
+      // never the working directory resolved below for the caller's own
+      // `onBootstrap` hook. Resolved directly from `session` — this runs
+      // from a provider's `onFirstCreate`, before a
+      // `HarnessV1NetworkSandboxSession` even exists.
+      stateDirectory: harnessStateDirectoryPath({
+        sandboxHomeDir: await resolveSandboxHomeDir({
+          sandbox: session,
+          abortSignal,
+        }),
+      }),
       abortSignal,
     });
   }
 
   if (onBootstrap == null) return;
 
+  const resolvedDefaultWorkingDirectory =
+    defaultWorkingDirectory ??
+    (await resolveSandboxDefaultWorkingDirectory({
+      sandboxSession: session,
+      abortSignal,
+    }));
+
   const bootstrapWorkDir =
     workDir == null
       ? resolvedDefaultWorkingDirectory

package/src/agent/internal/strip-work-dir.ts

@@ -120,6 +120,63 @@ export function stripWorkDir(
   }
 }
 
+export function stripParsedToolInputWorkDir({
+  value,
+  sessionWorkDir,
+}: {
+  value: unknown;
+  sessionWorkDir: string;
+}): unknown {
+  if (sessionWorkDir.length === 0) return value;
+
+  const projected = new WeakMap<object, unknown>();
+  const pending: Array<{
+    source: object;
+    target: Record<string, unknown> | unknown[];
+  }> = [];
+
+  const project = (item: unknown): unknown => {
+    if (typeof item === 'string') return stripString(item, sessionWorkDir);
+    if (item === null || typeof item !== 'object') return item;
+    if (
+      !Array.isArray(item) &&
+      Object.getPrototypeOf(item) !== Object.prototype &&
+      Object.getPrototypeOf(item) !== null
+    ) {
+      return item;
+    }
+    if (projected.has(item)) return projected.get(item);
+
+    const target: Record<string, unknown> | unknown[] = Array.isArray(item)
+      ? new Array(item.length)
+      : {};
+    projected.set(item, target);
+    pending.push({ source: item, target });
+    return target;
+  };
+
+  const result = project(value);
+  while (pending.length > 0) {
+    const { source, target } = pending.pop()!;
+    if (Array.isArray(source) && Array.isArray(target)) {
+      for (let index = 0; index < source.length; index++) {
+        if (index in source) target[index] = project(source[index]);
+      }
+    } else {
+      for (const [key, item] of Object.entries(source)) {
+        Object.defineProperty(target, key, {
+          value: project(item),
+          enumerable: true,
+          writable: true,
+          configurable: true,
+        });
+      }
+    }
+  }
+
+  return result;
+}
+
 /**
  * Replace occurrences of the working directory in a string. A reference to the
  * directory followed by a separator becomes workspace-relative

package/src/agent/prepare-harness-sandbox-template.ts

@@ -1,4 +1,9 @@
-import type { HarnessV1Bootstrap, HarnessV1SandboxProvider } from '../v1';
+import {
+  harnessStateDirectoryPath,
+  type HarnessV1Bootstrap,
+  type HarnessV1SandboxProvider,
+} from '../v1';
+import { resolveSandboxHomeDir } from '../utils/sandbox-home-dir';
 import type { HarnessAgentAdapter } from './harness-agent-types';
 import type { HarnessAgentSandboxConfig } from './harness-agent-settings';
 import { applyBootstrapRecipe } from './internal/bootstrap-recipe';
@@ -58,11 +63,19 @@ export async function prepareHarnessSandboxTemplate(options: {
   // general harness utility, not for a concrete agent.
   try {
     if (bootstrapPlan.recipe != null && bootstrapPlan.recipeIdentity != null) {
+      const restrictedSession = sandboxSession.restricted();
       await applyBootstrapRecipe({
-        session: sandboxSession.restricted(),
+        session: restrictedSession,
         recipe: bootstrapPlan.recipe,
         identity: bootstrapPlan.recipeIdentity,
-        defaultWorkingDirectory: sandboxSession.defaultWorkingDirectory,
+        // Harness infrastructure always lives under the sandbox's own HOME,
+        // never the working directory.
+        stateDirectory: harnessStateDirectoryPath({
+          sandboxHomeDir: await resolveSandboxHomeDir({
+            sandbox: restrictedSession,
+            abortSignal,
+          }),
+        }),
         abortSignal,
       });
     }