@ai-sdk/harness 1.0.91 → 1.0.93

package/dist/utils/index.d.ts

@@ -233,6 +233,16 @@ declare function getAiGatewayAuthFromEnv({ env, }: {
     baseUrl: string;
 };
 
+/**
+ * Authentication-related environment variables supplied directly to a harness.
+ *
+ * When used as an adapter's `auth` option, this environment replaces the host
+ * process environment for authentication discovery.
+ */
+type HarnessV1AuthenticationEnvironment = Readonly<Record<string, string>>;
+
+declare function isHarnessAuthenticationEnvironment(value: unknown): value is HarnessV1AuthenticationEnvironment;
+
 /**
  * Connection details for a sandbox-exposed port. Headers are scoped to the
  * returned URL and must be included when opening the connection.
@@ -521,7 +531,13 @@ type WriteSkillsOptions = {
     }) => string;
     trailingNewline?: boolean;
 };
-declare function writeSkills({ sandbox, rootDir, skills, abortSignal, skillNamePattern, invalidSkillNameMessage, filePathMode, invalidSkillFilePathMessage, trailingNewline, }: WriteSkillsOptions): Promise<void>;
+type WriteSkillsResult = {
+    changed: boolean;
+    written: string[];
+    removed: string[];
+    unchanged: string[];
+};
+declare function writeSkills({ sandbox, rootDir, skills, abortSignal, skillNamePattern, invalidSkillNameMessage, filePathMode, invalidSkillFilePathMessage, trailingNewline, }: WriteSkillsOptions): Promise<WriteSkillsResult>;
 
 type BridgeReadySource = 'stdout' | 'metadata';
 type BridgeReadyErrorContext = {
@@ -591,4 +607,4 @@ declare function resolveSandboxDefaultWorkingDirectory({ sandboxSession, abortSi
 
 declare function getRestrictedSandboxSession(sandboxSession: HarnessV1NetworkSandboxSession | Experimental_SandboxSession): Experimental_SandboxSession;
 
-export { type BridgeReadyErrorContext, type BridgeReadySource, type DiskLogRecoveryMode, type Experimental_BridgeUserMessageRequest, type Experimental_BridgeUserMessageResponse, type Experimental_BridgeUserMessageSubmitter, SandboxChannel, type SandboxChannelDebugEvent, type SandboxChannelOptions, type SandboxChannelReconnectOptions, type SkillFilePathMode, type WaitForBridgeReadyOptions, type WaitForBridgeReadyResult, type WriteSkillsOptions, applyCredentialForwarding, classifyDiskLog, createBridgeErrorHandler, createBridgeStartupError, createCredentialRequestTransformation, createSandboxCredentialEnvironment, drainBridgeProcessStream, experimental_createBridgeUserMessageSubmitter, formatBridgeError, forwardBridgeProcessStream, generateSandboxCredentialPlaceholder, getAiGatewayAuthFromEnv, getRestrictedSandboxSession, isSandboxCredentialPlaceholder, logBridgeError, markBridgeStarting, maskSandboxCredentials, resolveSandboxDefaultWorkingDirectory, resolveSandboxHomeDir, shellQuote, waitForBridgeReady, warnCredentialBrokeringUnavailable, writeSkills };
+export { type BridgeReadyErrorContext, type BridgeReadySource, type DiskLogRecoveryMode, type Experimental_BridgeUserMessageRequest, type Experimental_BridgeUserMessageResponse, type Experimental_BridgeUserMessageSubmitter, SandboxChannel, type SandboxChannelDebugEvent, type SandboxChannelOptions, type SandboxChannelReconnectOptions, type SkillFilePathMode, type WaitForBridgeReadyOptions, type WaitForBridgeReadyResult, type WriteSkillsOptions, type WriteSkillsResult, applyCredentialForwarding, classifyDiskLog, createBridgeErrorHandler, createBridgeStartupError, createCredentialRequestTransformation, createSandboxCredentialEnvironment, drainBridgeProcessStream, experimental_createBridgeUserMessageSubmitter, formatBridgeError, forwardBridgeProcessStream, generateSandboxCredentialPlaceholder, getAiGatewayAuthFromEnv, getRestrictedSandboxSession, isHarnessAuthenticationEnvironment, isSandboxCredentialPlaceholder, logBridgeError, markBridgeStarting, maskSandboxCredentials, resolveSandboxDefaultWorkingDirectory, resolveSandboxHomeDir, shellQuote, waitForBridgeReady, warnCredentialBrokeringUnavailable, writeSkills };

package/dist/utils/index.js

@@ -437,6 +437,19 @@ function getAiGatewayAuthFromEnv({
   };
 }
 
+// src/utils/authentication-environment.ts
+function isHarnessAuthenticationEnvironment(value) {
+  if (value == null || typeof value !== "object") {
+    return false;
+  }
+  if (Array.isArray(value) || Object.values(value).some((entry) => typeof entry !== "string")) {
+    throw new TypeError(
+      "Invalid auth: expected an authentication mode or a flat record with string values."
+    );
+  }
+  return true;
+}
+
 // src/utils/sandbox-credential-brokering.ts
 import { randomBytes } from "crypto";
 var SANDBOX_CREDENTIAL_PLACEHOLDER_PREFIX = "aisdkhc_";
@@ -547,7 +560,14 @@ function shellQuote(value) {
 }
 
 // src/utils/write-skills.ts
+import { createHash } from "crypto";
 import path2 from "path";
+import {
+  safeParseJSON as safeParseJSON3
+} from "@ai-sdk/provider-utils";
+var SKILLS_MANIFEST_FILENAME = ".ai-sdk-harness-skills.json";
+var SKILLS_MANIFEST_VERSION = 1;
+var SAFE_MANIFEST_SKILL_NAME = /^[A-Za-z0-9._-]+$/;
 async function writeSkills({
   sandbox,
   rootDir,
@@ -559,60 +579,333 @@ async function writeSkills({
   invalidSkillFilePathMessage = ({ skillName, filePath }) => `Invalid skill file path for ${skillName}: ${filePath}`,
   trailingNewline = false
 }) {
-  var _a, _b;
-  for (const skill of skills) {
-    validateSkillName({
-      name: skill.name,
-      pattern: skillNamePattern,
-      message: invalidSkillNameMessage
+  var _a;
+  const projectedSkills = skills.map(
+    (skill) => projectSkill({
+      skill,
+      skillNamePattern,
+      invalidSkillNameMessage,
+      filePathMode,
+      invalidSkillFilePathMessage,
+      trailingNewline
+    })
+  ).sort((a, b) => a.name.localeCompare(b.name));
+  assertUniqueSkillNames(projectedSkills);
+  const manifestPath = path2.posix.join(rootDir, SKILLS_MANIFEST_FILENAME);
+  const existingManifest = await readSkillsManifest({
+    sandbox,
+    manifestPath,
+    abortSignal
+  });
+  const nextEntries = projectedSkills.map(({ name, hash }) => ({ name, hash }));
+  const nextByName = new Map(nextEntries.map((entry) => [entry.name, entry]));
+  if ((existingManifest == null ? void 0 : existingManifest.state) === "pending") {
+    await ensureSkillsDirectory({ sandbox, rootDir, abortSignal });
+    const recoveryNames = existingManifest.skills.map((skill) => skill.name);
+    await removeSkillDirectories({
+      sandbox,
+      rootDir,
+      skillNames: recoveryNames,
+      abortSignal
     });
-    for (const file of (_a = skill.files) != null ? _a : []) {
+    const removed2 = recoveryNames.filter((name) => !nextByName.has(name)).sort((a, b) => a.localeCompare(b));
+    await writeProjectedSkills({
+      sandbox,
+      rootDir,
+      skills: projectedSkills,
+      abortSignal
+    });
+    await writeSkillsManifest({
+      sandbox,
+      manifestPath,
+      manifest: {
+        version: SKILLS_MANIFEST_VERSION,
+        state: "complete",
+        skills: nextEntries
+      },
+      abortSignal
+    });
+    return {
+      changed: recoveryNames.length > 0 || projectedSkills.length > 0,
+      written: projectedSkills.map((skill) => skill.name),
+      removed: removed2,
+      unchanged: []
+    };
+  }
+  const previousEntries = (_a = existingManifest == null ? void 0 : existingManifest.skills) != null ? _a : [];
+  const previousByName = new Map(
+    previousEntries.map((entry) => [entry.name, entry])
+  );
+  const removed = previousEntries.filter((entry) => !nextByName.has(entry.name)).map((entry) => entry.name).sort((a, b) => a.localeCompare(b));
+  const written = projectedSkills.filter((skill) => {
+    var _a2;
+    return ((_a2 = previousByName.get(skill.name)) == null ? void 0 : _a2.hash) !== skill.hash;
+  }).map((skill) => skill.name).sort((a, b) => a.localeCompare(b));
+  const unchanged = projectedSkills.filter((skill) => {
+    var _a2;
+    return ((_a2 = previousByName.get(skill.name)) == null ? void 0 : _a2.hash) === skill.hash;
+  }).map((skill) => skill.name).sort((a, b) => a.localeCompare(b));
+  const changed = removed.length > 0 || written.length > 0;
+  if (!changed && existingManifest != null) {
+    return { changed: false, written, removed, unchanged };
+  }
+  const previouslyOwned = new Set(previousEntries.map((entry) => entry.name));
+  for (const skillName of written) {
+    if (previouslyOwned.has(skillName)) continue;
+    await assertSkillDirectoryAvailable({
+      sandbox,
+      rootDir,
+      skillName,
+      abortSignal
+    });
+  }
+  await ensureSkillsDirectory({ sandbox, rootDir, abortSignal });
+  const pendingNames = Array.from(
+    /* @__PURE__ */ new Set([
+      ...previousEntries.map((entry) => entry.name),
+      ...nextEntries.map((entry) => entry.name)
+    ])
+  ).sort((a, b) => a.localeCompare(b));
+  await writeSkillsManifest({
+    sandbox,
+    manifestPath,
+    manifest: {
+      version: SKILLS_MANIFEST_VERSION,
+      state: "pending",
+      skills: pendingNames.map((name) => {
+        var _a2, _b;
+        return {
+          name,
+          hash: (_b = (_a2 = nextByName.get(name)) == null ? void 0 : _a2.hash) != null ? _b : previousByName.get(name).hash
+        };
+      })
+    },
+    abortSignal
+  });
+  await removeSkillDirectories({
+    sandbox,
+    rootDir,
+    skillNames: [
+      ...removed,
+      ...written.filter((name) => previouslyOwned.has(name))
+    ],
+    abortSignal
+  });
+  const writtenSet = new Set(written);
+  await writeProjectedSkills({
+    sandbox,
+    rootDir,
+    skills: projectedSkills.filter((skill) => writtenSet.has(skill.name)),
+    abortSignal
+  });
+  await writeSkillsManifest({
+    sandbox,
+    manifestPath,
+    manifest: {
+      version: SKILLS_MANIFEST_VERSION,
+      state: "complete",
+      skills: nextEntries
+    },
+    abortSignal
+  });
+  return { changed, written, removed, unchanged };
+}
+async function ensureSkillsDirectory({
+  sandbox,
+  rootDir,
+  abortSignal
+}) {
+  await runSandboxCommand({
+    sandbox,
+    command: `mkdir -p ${shellQuote(rootDir)}`,
+    abortSignal,
+    errorMessage: `Failed to create skills directory: ${rootDir}`
+  });
+}
+function projectSkill({
+  skill,
+  skillNamePattern,
+  invalidSkillNameMessage,
+  filePathMode,
+  invalidSkillFilePathMessage,
+  trailingNewline
+}) {
+  var _a;
+  const name = validateSkillName({
+    name: skill.name,
+    pattern: skillNamePattern,
+    message: invalidSkillNameMessage
+  });
+  const files = /* @__PURE__ */ new Map();
+  files.set("SKILL.md", renderSkillFile({ skill, trailingNewline }));
+  for (const file of (_a = skill.files) != null ? _a : []) {
+    files.set(
       normalizeSkillFilePath({
         skillName: skill.name,
         filePath: file.path,
         mode: filePathMode,
         message: invalidSkillFilePathMessage
-      });
+      }),
+      file.content
+    );
+  }
+  const projectedFiles = Array.from(files, ([filePath, content]) => ({
+    path: filePath,
+    content
+  })).sort((a, b) => a.path.localeCompare(b.path));
+  const hash = createHash("sha256");
+  for (const file of projectedFiles) {
+    hash.update(String(Buffer.byteLength(file.path)));
+    hash.update(":");
+    hash.update(file.path);
+    hash.update(String(Buffer.byteLength(file.content)));
+    hash.update(":");
+    hash.update(file.content);
+  }
+  return { name, hash: hash.digest("hex"), files: projectedFiles };
+}
+async function readSkillsManifest({
+  sandbox,
+  manifestPath,
+  abortSignal
+}) {
+  const content = await sandbox.readTextFile({
+    path: manifestPath,
+    abortSignal
+  });
+  if (content == null) return void 0;
+  const parsed = await safeParseJSON3({ text: content });
+  if (!parsed.success || !isSkillsManifest(parsed.value)) {
+    throw new Error(`Invalid AI SDK harness skills manifest: ${manifestPath}`);
+  }
+  return parsed.value;
+}
+function isSkillsManifest(value) {
+  if (value == null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const manifest = value;
+  if (manifest.version !== SKILLS_MANIFEST_VERSION || manifest.state !== "complete" && manifest.state !== "pending" || !Array.isArray(manifest.skills)) {
+    return false;
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const entry of manifest.skills) {
+    if (entry == null || typeof entry !== "object" || Array.isArray(entry)) {
+      return false;
     }
+    const skill = entry;
+    if (typeof skill.name !== "string" || !isSafeManifestSkillName(skill.name) || typeof skill.hash !== "string" || !/^[a-f0-9]{64}$/.test(skill.hash) || names.has(skill.name)) {
+      return false;
+    }
+    names.add(skill.name);
   }
-  await sandbox.run({
-    command: `mkdir -p ${shellQuote(rootDir)}`,
+  return true;
+}
+async function writeSkillsManifest({
+  sandbox,
+  manifestPath,
+  manifest,
+  abortSignal
+}) {
+  const temporaryPath = `${manifestPath}.tmp`;
+  await sandbox.writeTextFile({
+    path: temporaryPath,
+    content: `${JSON.stringify(manifest, null, 2)}
+`,
     abortSignal
   });
+  await runSandboxCommand({
+    sandbox,
+    command: `mv -f ${shellQuote(temporaryPath)} ${shellQuote(manifestPath)}`,
+    abortSignal,
+    errorMessage: `Failed to update skills manifest: ${manifestPath}`
+  });
+}
+async function assertSkillDirectoryAvailable({
+  sandbox,
+  rootDir,
+  skillName,
+  abortSignal
+}) {
+  const skillDir = path2.posix.join(rootDir, skillName);
+  const result = await sandbox.run({
+    command: `test ! -e ${shellQuote(skillDir)}`,
+    abortSignal
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Cannot write harness skill '${skillName}': ${skillDir} already exists and is not owned by the AI SDK harness.`
+    );
+  }
+}
+async function removeSkillDirectories({
+  sandbox,
+  rootDir,
+  skillNames,
+  abortSignal
+}) {
+  if (skillNames.length === 0) return;
+  const directories = Array.from(new Set(skillNames)).sort((a, b) => a.localeCompare(b)).map((name) => shellQuote(path2.posix.join(rootDir, name))).join(" ");
+  await runSandboxCommand({
+    sandbox,
+    command: `rm -rf -- ${directories}`,
+    abortSignal,
+    errorMessage: `Failed to replace harness skills in: ${rootDir}`
+  });
+}
+async function writeProjectedSkills({
+  sandbox,
+  rootDir,
+  skills,
+  abortSignal
+}) {
   for (const skill of skills) {
-    const name = validateSkillName({
-      name: skill.name,
-      pattern: skillNamePattern,
-      message: invalidSkillNameMessage
-    });
-    const skillDir = path2.posix.join(rootDir, name);
-    await sandbox.writeTextFile({
-      path: path2.posix.join(skillDir, "SKILL.md"),
-      content: renderSkillFile({ skill, trailingNewline }),
-      abortSignal
-    });
-    for (const file of (_b = skill.files) != null ? _b : []) {
-      const filePath = normalizeSkillFilePath({
-        skillName: skill.name,
-        filePath: file.path,
-        mode: filePathMode,
-        message: invalidSkillFilePathMessage
-      });
+    const skillDir = path2.posix.join(rootDir, skill.name);
+    for (const file of skill.files) {
       await sandbox.writeTextFile({
-        path: path2.posix.join(skillDir, filePath),
+        path: path2.posix.join(skillDir, file.path),
         content: file.content,
         abortSignal
       });
     }
   }
 }
+async function runSandboxCommand({
+  sandbox,
+  command,
+  abortSignal,
+  errorMessage
+}) {
+  const result = await sandbox.run({ command, abortSignal });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `${errorMessage} (exit ${result.exitCode})${result.stderr ? `: ${result.stderr}` : ""}`
+    );
+  }
+}
+function assertUniqueSkillNames(skills) {
+  for (let index = 1; index < skills.length; index++) {
+    if (skills[index - 1].name === skills[index].name) {
+      throw new Error(`Duplicate skill name: ${skills[index].name}`);
+    }
+  }
+}
+function isSafeManifestSkillName(name) {
+  SAFE_MANIFEST_SKILL_NAME.lastIndex = 0;
+  const matches = SAFE_MANIFEST_SKILL_NAME.test(name);
+  SAFE_MANIFEST_SKILL_NAME.lastIndex = 0;
+  return matches && name !== "." && name !== ".." && !name.includes("/");
+}
 function validateSkillName({
   name,
   pattern,
   message
 }) {
   var _a;
-  if (!pattern.test(name) || name === "." || name === "..") {
+  pattern.lastIndex = 0;
+  const matches = pattern.test(name);
+  pattern.lastIndex = 0;
+  if (!matches || name === "." || name === "..") {
     throw new Error((_a = message == null ? void 0 : message({ name })) != null ? _a : `Invalid skill name: ${name}`);
   }
   return name;
@@ -649,7 +942,7 @@ ${skill.content}`;
 
 // src/utils/bridge-ready.ts
 import {
-  safeParseJSON as safeParseJSON3
+  safeParseJSON as safeParseJSON4
 } from "@ai-sdk/provider-utils";
 import { z as z4 } from "zod/v4";
 
@@ -1114,7 +1407,7 @@ async function waitForBridgeReady({
       if (value === void 0) continue;
       for (const line of decoder.push(value)) {
         pushTail({ lines: stdoutTail, line });
-        const parsed = await safeParseJSON3({
+        const parsed = await safeParseJSON4({
           text: line,
           schema: harnessV1BridgeReadySchema
         });
@@ -1151,7 +1444,7 @@ async function readBridgeMetaReady({
     })
   ).catch(() => null);
   if (raw == null) return void 0;
-  const parsed = await safeParseJSON3({ text: raw, schema: bridgeMetaSchema });
+  const parsed = await safeParseJSON4({ text: raw, schema: bridgeMetaSchema });
   if (!parsed.success) return void 0;
   if (parsed.value.type !== bridgeType) return void 0;
   if (parsed.value.state !== "waiting") return void 0;
@@ -1413,6 +1706,7 @@ export {
   generateSandboxCredentialPlaceholder,
   getAiGatewayAuthFromEnv,
   getRestrictedSandboxSession,
+  isHarnessAuthenticationEnvironment,
   isSandboxCredentialPlaceholder,
   logBridgeError,
   markBridgeStarting,