@ai-sdk/harness 1.0.86 → 1.0.90

package/src/agent/internal/run-prompt.ts

@@ -301,6 +301,9 @@ export function runPrompt<
     let stepText = '';
     let stepReasoning = '';
     let stepToolCalls: TurnContentPart[] = [];
+    let expectedStepToolCallCount: number | undefined;
+    let observedStepToolCallCount = 0;
+    let pauseAfterStepToolCalls = false;
     const buildStepContent = (): TurnContentPart[] => {
       const parts: TurnContentPart[] = [];
       if (stepText) parts.push({ type: 'text', text: stepText });
@@ -312,6 +315,9 @@ export function runPrompt<
       stepText = '';
       stepReasoning = '';
       stepToolCalls = [];
+      expectedStepToolCallCount = undefined;
+      observedStepToolCallCount = 0;
+      pauseAfterStepToolCalls = false;
     };
     const zeroUsage: LanguageModelV4Usage = {
       inputTokens: {
@@ -599,6 +605,15 @@ export function runPrompt<
       }
 
       while (true) {
+        if (
+          pauseAfterStepToolCalls &&
+          expectedStepToolCallCount != null &&
+          observedStepToolCallCount >= expectedStepToolCallCount
+        ) {
+          await finishForHostInputPause({ completeCurrentStep: true });
+          return;
+        }
+
         const { value, done } = await reader.read();
         if (done) {
           releasePendingStopBoundary();
@@ -759,6 +774,8 @@ export function runPrompt<
 
         // Telemetry: a tool execution begins on its `tool-call`.
         if (value.type === 'tool-call') {
+          observedStepToolCallCount += 1;
+          expectedStepToolCallCount ??= value.stepToolCallCount;
           stepToolCalls.push({
             type: 'tool-call',
             toolCallId: value.toolCallId,
@@ -962,11 +979,25 @@ export function runPrompt<
               approvalId: pendingApproval.approvalId,
               toolCall: pendingParsedToolCall,
             });
+            if (
+              expectedStepToolCallCount != null &&
+              observedStepToolCallCount < expectedStepToolCallCount
+            ) {
+              pauseAfterStepToolCalls = true;
+              continue;
+            }
             await finishForHostInputPause({ completeCurrentStep: true });
             return;
           }
           if (!isExecutableTool(activeTools[toolCall.toolName])) {
             recordPendingToolResult({ toolCall });
+            if (
+              expectedStepToolCallCount != null &&
+              observedStepToolCallCount < expectedStepToolCallCount
+            ) {
+              pauseAfterStepToolCalls = true;
+              continue;
+            }
             await finishForHostInputPause({ completeCurrentStep: true });
             return;
           }
@@ -1191,10 +1222,10 @@ async function maybeExecuteHostTool<TOOLS extends ToolSet>(input: {
  * part on failure (unknown tool, schema mismatch, malformed JSON).
  *
  * The harness `tool-call` event is structurally a `LanguageModelV4ToolCall`
- * (plus an optional harness-only `nativeName`). `providerExecuted` already
- * lives on the V4 type — `true` for adapter builtins (Claude Code's `Bash`,
- * Codex's `shell`), false/undefined for host tools — and is passed through
- * to the AI SDK part by `parseToolCall`.
+ * plus optional harness-only fields. `providerExecuted` already lives on the
+ * V4 type — `true` for adapter builtins (Claude Code's `Bash`, Codex's
+ * `shell`), false/undefined for host tools — and is passed through to the AI
+ * SDK part by `parseToolCall`.
  */
 export async function validateToolCall<TOOLS extends ToolSet>(args: {
   event: Extract<HarnessV1StreamPart, { type: 'tool-call' }>;

package/src/utils/credential-forwarding.ts

@@ -0,0 +1,58 @@
+import type { HarnessV1CredentialForwarding } from '../v1';
+import { generateSandboxCredentialPlaceholder } from './sandbox-credential-brokering';
+
+export async function applyCredentialForwarding({
+  environment,
+  credentialEnvironmentVariables,
+  credentialForwarding,
+}: {
+  environment: Readonly<Record<string, string>>;
+  credentialEnvironmentVariables: ReadonlyArray<string>;
+  credentialForwarding: HarnessV1CredentialForwarding | undefined;
+}): Promise<Record<string, string>> {
+  const forwardedEnvironment = { ...environment };
+  if (credentialForwarding == null) return forwardedEnvironment;
+
+  for (const environmentVariableName of new Set(
+    credentialEnvironmentVariables,
+  )) {
+    const credential = forwardedEnvironment[environmentVariableName];
+    if (credential == null) continue;
+
+    forwardedEnvironment[environmentVariableName] = await credentialForwarding({
+      credential,
+      environmentVariableName,
+    });
+  }
+
+  return forwardedEnvironment;
+}
+
+export async function createSandboxCredentialEnvironment({
+  environment,
+  credentialEnvironmentVariables,
+  credentialForwarding,
+}: {
+  environment: Readonly<Record<string, string>>;
+  credentialEnvironmentVariables: ReadonlyArray<string>;
+  credentialForwarding: HarnessV1CredentialForwarding | undefined;
+}): Promise<Record<string, string>> {
+  const sandboxCredentialEnvironment: Record<string, string> = {};
+
+  for (const environmentVariableName of new Set(
+    credentialEnvironmentVariables,
+  )) {
+    if (environment[environmentVariableName] == null) continue;
+
+    const placeholder = generateSandboxCredentialPlaceholder();
+    sandboxCredentialEnvironment[environmentVariableName] =
+      credentialForwarding == null
+        ? placeholder
+        : await credentialForwarding({
+            credential: placeholder,
+            environmentVariableName,
+          });
+  }
+
+  return sandboxCredentialEnvironment;
+}

package/src/utils/index.ts

@@ -12,8 +12,14 @@ export {
 } from './bridge-user-message-submitter';
 export { classifyDiskLog, type DiskLogRecoveryMode } from './classify-disk-log';
 export { getAiGatewayAuthFromEnv } from './ai-gateway-auth';
+export {
+  applyCredentialForwarding,
+  createSandboxCredentialEnvironment,
+} from './credential-forwarding';
 export {
   createCredentialRequestTransformation,
+  generateSandboxCredentialPlaceholder,
+  isSandboxCredentialPlaceholder,
   maskSandboxCredentials,
   warnCredentialBrokeringUnavailable,
 } from './sandbox-credential-brokering';

package/src/utils/sandbox-credential-brokering.ts

@@ -1,5 +1,16 @@
+import { randomBytes } from 'node:crypto';
 import type { HarnessV1RequestTransformation } from '../v1';
 
+const SANDBOX_CREDENTIAL_PLACEHOLDER_PREFIX = 'aisdkhc_';
+
+export function generateSandboxCredentialPlaceholder(): string {
+  return `${SANDBOX_CREDENTIAL_PLACEHOLDER_PREFIX}${randomBytes(32).toString('base64url')}`;
+}
+
+export function isSandboxCredentialPlaceholder(value: string): boolean {
+  return /^aisdkhc_[A-Za-z0-9_-]{43}$/.test(value);
+}
+
 export function warnCredentialBrokeringUnavailable(): void {
   console.warn(
     'The sandbox implementation does not support configuring request transformations, so credential brokering does not work. Falling back to less secure credential forwarding.',
@@ -23,19 +34,25 @@ export function maskSandboxCredentials({
 }
 
 export function createCredentialRequestTransformation({
-  baseUrl,
-  headers,
+  matchUrl,
+  matchHeaders,
+  transformHeaders,
 }: {
-  baseUrl: string;
-  headers: Readonly<Record<string, string>>;
+  matchUrl: string;
+  matchHeaders: Readonly<Record<string, string>>;
+  transformHeaders: Readonly<Record<string, string>>;
 }): HarnessV1RequestTransformation {
-  const url = new URL(baseUrl);
+  const url = new URL(matchUrl);
   const pathname = url.pathname.replace(/\/+$/, '');
   return {
     match: {
       host: url.hostname,
       ...(pathname.length === 0 ? {} : { path: { startsWith: pathname } }),
+      headers: Object.entries(matchHeaders).map(([key, value]) => ({
+        key: { exact: key },
+        value: { exact: value },
+      })),
     },
-    transform: { headers },
+    transform: { headers: transformHeaders },
   };
 }

package/src/v1/harness-v1-credential-forwarding.ts

@@ -0,0 +1,19 @@
+/**
+ * Customizes a credential value immediately before a harness adapter forwards
+ * it into a sandbox process.
+ *
+ * This callback only controls the value exposed to sandbox processes. It does
+ * not restrict which credentials the harness adapter can discover, read, or
+ * otherwise access in the host process.
+ */
+export type HarnessV1CredentialForwarding = (options: {
+  /**
+   * The credential value that the adapter would otherwise forward. This is a
+   * generated sandbox placeholder when credential brokering is available and
+   * the real credential otherwise. Use `isSandboxCredentialPlaceholder` from
+   * `@ai-sdk/harness/utils` to distinguish generated placeholders.
+   */
+  readonly credential: string;
+  /** The environment variable name used to expose the value in the sandbox. */
+  readonly environmentVariableName: string;
+}) => string | PromiseLike<string>;

package/src/v1/harness-v1-network-sandbox-session.ts

@@ -205,3 +205,9 @@ export type HarnessV1RequestTransformation = {
     readonly headers: Readonly<Record<string, string>>;
   };
 };
+
+export type HarnessV1RequestTransformationSources<AuthenticationMode> = {
+  env: Record<string, string>;
+  sandboxEnv: Record<string, string>;
+  auth: AuthenticationMode;
+};

package/src/v1/harness-v1-stream-part.ts

@@ -60,9 +60,14 @@ export type HarnessV1StreamPart =
 
   // Tool calls, approvals, results — reuse V4 primitives.
   //
-  // `nativeName` is the only harness-only extension on `tool-call`. It lets
-  // adapters surface the runtime's native name for a builtin when it differs
-  // from the wire `toolName` (e.g. `toolName: 'bash'`, `nativeName: 'Bash'`).
+  // `nativeName` lets adapters surface the runtime's native name for a builtin
+  // when it differs from the wire `toolName` (e.g. `toolName: 'bash'`,
+  // `nativeName: 'Bash'`).
+  //
+  // `stepToolCallCount` lets adapters that know a step's complete tool-call
+  // set up front report its cardinality. The host uses it to collect every
+  // approval/result request from the step before pausing; adapters that cannot
+  // know the count omit it and retain pause-on-first behavior.
   //
   // Whether the call was executed by the underlying runtime (Claude Code's
   // built-in `Bash`, Codex's `shell`) vs. needs host dispatch is signalled by
@@ -70,6 +75,11 @@ export type HarnessV1StreamPart =
   // `true` for runtime-executed builtins, false/undefined for host tools.
   | (LanguageModelV4ToolCall & {
       nativeName?: string;
+      /**
+       * Total tool calls in the current model step, when known before tool
+       * execution begins. Populate this on every tool call in the step.
+       */
+      stepToolCallCount?: number;
     })
   | LanguageModelV4ToolApprovalRequest
   | LanguageModelV4ToolResult
@@ -267,6 +277,7 @@ export const harnessV1ToolCallPartSchema = z.object({
   dynamic: z.boolean().optional(),
   providerMetadata: harnessV1ProviderMetadataSchema.optional(),
   nativeName: z.string().optional(),
+  stepToolCallCount: z.number().int().positive().optional(),
 });
 
 export const harnessV1ToolApprovalRequestPartSchema = z.object({

package/src/v1/index.ts

@@ -1,4 +1,5 @@
 export type { HarnessV1 } from './harness-v1';
+export type { HarnessV1CredentialForwarding } from './harness-v1-credential-forwarding';
 export type {
   HarnessV1Bootstrap,
   HarnessV1BootstrapCommand,
@@ -45,6 +46,7 @@ export type {
   HarnessV1NetworkSandboxSession,
   HarnessV1PortEndpoint,
   HarnessV1RequestTransformation,
+  HarnessV1RequestTransformationSources,
 } from './harness-v1-network-sandbox-session';
 export type { HarnessV1Skill } from './harness-v1-skill';
 export type { HarnessV1StreamPart } from './harness-v1-stream-part';