@ai-sdk/harness 1.0.123 → 1.0.124

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @ai-sdk/harness
 
+## 1.0.124
+
+### Patch Changes
+
+- 40231b6: fix(harness): enforce tool input schemas at execution and consistently reject invalid inputs
+- Updated dependencies [b5679a7]
+- Updated dependencies [ca31b89]
+  - ai@7.0.114
+
 ## 1.0.123
 
 ### Patch Changes

package/dist/agent/index.js

@@ -1103,6 +1103,45 @@ function stripWorkDir(part, sessionWorkDir) {
       return part;
   }
 }
+function stripParsedToolInputWorkDir({
+  value,
+  sessionWorkDir
+}) {
+  if (sessionWorkDir.length === 0) return value;
+  const projected = /* @__PURE__ */ new WeakMap();
+  const pending = [];
+  const project = (item) => {
+    if (typeof item === "string") return stripString(item, sessionWorkDir);
+    if (item === null || typeof item !== "object") return item;
+    if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) {
+      return item;
+    }
+    if (projected.has(item)) return projected.get(item);
+    const target = Array.isArray(item) ? new Array(item.length) : {};
+    projected.set(item, target);
+    pending.push({ source: item, target });
+    return target;
+  };
+  const result = project(value);
+  while (pending.length > 0) {
+    const { source, target } = pending.pop();
+    if (Array.isArray(source) && Array.isArray(target)) {
+      for (let index = 0; index < source.length; index++) {
+        if (index in source) target[index] = project(source[index]);
+      }
+    } else {
+      for (const [key, item] of Object.entries(source)) {
+        Object.defineProperty(target, key, {
+          value: project(item),
+          enumerable: true,
+          writable: true,
+          configurable: true
+        });
+      }
+    }
+  }
+  return result;
+}
 function stripString(value, workDir) {
   return stripStreamingString({
     value,
@@ -1531,6 +1570,7 @@ function pinSandboxChannelEventCheckpoint(event) {
 }
 
 // src/agent/internal/run-prompt.ts
+var invalidToolInputMessage = "Tool input validation failed.";
 function unwrapToolResultOutput(toolResult) {
   switch (toolResult.output.type) {
     case "text":
@@ -1945,7 +1985,7 @@ function runPrompt(input) {
     };
     const processPendingApprovalContinuation = async (approval, continuation) => {
       var _a6;
-      const rawToolCall = (_a6 = rawToolCallsByToolCallId.get(approval.toolCallId)) != null ? _a6 : {
+      const rawToolCall = (_a6 = approval.kind === "builtin" ? rawToolCallsByToolCallId.get(approval.toolCallId) : void 0) != null ? _a6 : {
         type: "tool-call",
         toolCallId: approval.toolCallId,
         toolName: approval.toolName,
@@ -1953,14 +1993,29 @@ function runPrompt(input) {
         providerExecuted: approval.providerExecuted,
         nativeName: approval.nativeName
       };
-      const parsedInput = await safeParseJSON2({ text: rawToolCall.input });
-      const toolCall = {
-        type: "tool-call",
-        toolCallId: rawToolCall.toolCallId,
-        toolName: rawToolCall.toolName,
-        input: parsedInput.success ? parsedInput.value : rawToolCall.input,
-        ...rawToolCall.providerExecuted !== void 0 ? { providerExecuted: rawToolCall.providerExecuted } : {}
-      };
+      let validatedToolCall;
+      let toolCall;
+      if (approval.kind === "custom" && continuation.approved) {
+        validatedToolCall = asToolCallTextStreamPart({
+          part: await validateToolCall({
+            event: rawToolCall,
+            tools: input.tools
+          })
+        });
+        toolCall = displayHostToolCall({
+          toolCall: validatedToolCall,
+          sessionWorkDir: input.sessionWorkDir
+        });
+      } else {
+        const parsedInput = await safeParseJSON2({ text: rawToolCall.input });
+        toolCall = {
+          type: "tool-call",
+          toolCallId: rawToolCall.toolCallId,
+          toolName: rawToolCall.toolName,
+          input: parsedInput.success ? parsedInput.value : rawToolCall.input,
+          ...rawToolCall.providerExecuted !== void 0 ? { providerExecuted: rawToolCall.providerExecuted } : {}
+        };
+      }
       enqueueApprovalResponse(approval, continuation, toolCall);
       onToolApprovalSettled(approval.approvalId);
       pendingApprovalsByApprovalId.delete(approval.approvalId);
@@ -1990,6 +2045,27 @@ function runPrompt(input) {
         });
         return "continued";
       }
+      if (validatedToolCall == null) {
+        throw new Error(
+          `Harness '${input.harness.harnessId}' could not validate approved host tool '${approval.toolName}'.`
+        );
+      }
+      if (validatedToolCall.invalid) {
+        const error = new Error(invalidToolInputMessage);
+        await submitToolResult({
+          toolCallId: approval.toolCallId,
+          output: { error: invalidToolInputMessage },
+          isError: true
+        });
+        bufferedToolOutcomes.push(() => {
+          enqueueHostToolOutcome({
+            toolCall,
+            outcome: { ok: false, error }
+          });
+        });
+        await publishToolExecutions();
+        return "continued";
+      }
       await lifecycle.start(input.model);
       toolExecutions.set(rawToolCall.toolCallId, {
         toolCall
@@ -1997,6 +2073,7 @@ function runPrompt(input) {
       const executionStartedAt = Date.now();
       const execution = await maybeExecuteHostTool({
         event: rawToolCall,
+        parsedToolCall: validatedToolCall,
         tools: activeTools,
         toolsContext,
         wrappedExecuteTool: lifecycle.executeTool,
@@ -2191,15 +2268,25 @@ function runPrompt(input) {
         } else {
           for (const part of translatedParts) result.enqueue(part);
         }
+        let validatedHostToolCall;
         if (displayValue.type === "tool-call") {
+          const isHostTool = value.type === "tool-call" && !value.providerExecuted && hasTool({ tools: activeTools, toolName: value.toolName }) && !(value.toolName === "askUserQuestions" && hasTool({
+            tools: input.harness.builtinTools,
+            toolName: value.toolName
+          }));
           const parsed = await validateToolCall({
-            event: displayValue,
+            event: isHostTool ? value : displayValue,
             tools: input.tools
           });
           const parsedToolCall = asToolCallTextStreamPart({ part: parsed });
+          validatedHostToolCall = isHostTool ? parsedToolCall : void 0;
+          const displayToolCall = isHostTool ? displayHostToolCall({
+            toolCall: parsedToolCall,
+            sessionWorkDir: input.sessionWorkDir
+          }) : parsedToolCall;
           rawToolCallsByToolCallId.set(displayValue.toolCallId, displayValue);
-          toolCallsByToolCallId.set(displayValue.toolCallId, parsedToolCall);
-          result.enqueue(parsed);
+          toolCallsByToolCallId.set(displayValue.toolCallId, displayToolCall);
+          result.enqueue(displayToolCall);
         }
         if (value.type === "text-delta") {
           stepText += value.delta;
@@ -2345,6 +2432,31 @@ function runPrompt(input) {
             await finishForHostInputPause({ completeCurrentStep: true });
             return;
           }
+          if (validatedHostToolCall == null) {
+            throw new Error(
+              `Harness '${input.harness.harnessId}' could not validate host tool '${toolCall.toolName}'.`
+            );
+          }
+          if (validatedHostToolCall.invalid) {
+            settledHostToolCallIds.add(toolCall.toolCallId);
+            toolExecutions.delete(toolCall.toolCallId);
+            bufferedToolOutcomes.push(() => {
+              result.enqueue({
+                type: "tool-error",
+                toolCallId: toolCall.toolCallId,
+                toolName: toolCall.toolName,
+                input: parsedToolCall.input,
+                error: new Error(invalidToolInputMessage),
+                dynamic: true
+              });
+            });
+            await submitToolResult({
+              toolCallId: toolCall.toolCallId,
+              output: { error: invalidToolInputMessage },
+              isError: true
+            });
+            continue;
+          }
           const customToolApprovalDecision = resolveCustomToolApproval({
             toolName: toolCall.toolName,
             toolApproval: input.toolApproval
@@ -2444,6 +2556,7 @@ function runPrompt(input) {
               const executionStartedAt = Date.now();
               const execution = await maybeExecuteHostTool({
                 event: toolCall,
+                parsedToolCall: validatedHostToolCall,
                 tools: activeTools,
                 toolsContext,
                 wrappedExecuteTool: lifecycle.executeTool,
@@ -2549,14 +2662,31 @@ function asToolCallTextStreamPart(input) {
   }
   return input.part;
 }
+function displayHostToolCall(input) {
+  return {
+    ...input.toolCall,
+    input: stripParsedToolInputWorkDir({
+      value: input.toolCall.input,
+      sessionWorkDir: input.sessionWorkDir
+    }),
+    ...input.toolCall.invalid ? { error: new Error(invalidToolInputMessage) } : {}
+  };
+}
 function hasTool(input) {
   return Object.prototype.hasOwnProperty.call(input.tools, input.toolName);
 }
 async function maybeExecuteHostTool(input) {
   const tool = input.tools[input.event.toolName];
   if (!isExecutableTool(tool)) return { executed: false };
-  const parsed = await safeParseJSON2({ text: input.event.input });
-  const args = parsed.success ? parsed.value : input.event.input;
+  if (input.parsedToolCall.invalid) {
+    const error = new Error(invalidToolInputMessage);
+    await input.submitToolResult({
+      toolCallId: input.event.toolCallId,
+      output: { error: invalidToolInputMessage },
+      isError: true
+    });
+    return { executed: true, outcome: { ok: false, error } };
+  }
   let context;
   try {
     context = await validateToolContext({
@@ -2579,7 +2709,7 @@ async function maybeExecuteHostTool(input) {
         let output2;
         const stream = executeTool({
           tool,
-          input: args,
+          input: input.parsedToolCall.input,
           options: {
             toolCallId: input.event.toolCallId,
             messages: [],