ai-harness: an input with no principal runs with the owner session's principal
维护者通常 1 天内回复
@tombeckenham 已经在做这个了。
开始于 2026年10月15日。
评估
这个 Issue 还没有评估数据。
描述
TanStack AI version
@tanstack/ai-harness on the feat/harness-core branch, with #1780 (not released yet).
Framework/Library version
Node 24.8.0. No UI framework: the bug is in the durable host.
Describe the bug and the steps to reproduce it
An input that has no principal runs with the principal of the owner's session. So an anonymous input can get the credentials and provider keys of another user.
How it happens with #1780:
- Host B opens a thread with no principal. Host A opened the same thread with principal
alice, and owns it. - Host B gets an input. It stores it in
stores.inboxwith noprincipal. - Host A applies it in
applyForwarded(packages/ai-harness/src/session/base.ts). With noprincipal,prompt()usesoptions?.principal ?? this.principal, which isalice.
The same fallback runs today when a session recovers a logged input that has no principal, so this is not new to #1780. But forwarding makes it reachable across hosts.
Possible fixes:
- Store a principal on every input. Refuse an input with no principal on a host that has an authorizer.
- Add a way to say "no principal" on
promptand the other inputs, so the owner does not fall back to its own.
This needs a decision on the public API, so it is an issue and not a change in #1780.
Your Minimal, Reproducible Example - (Sandbox Highly Recommended)
packages/ai-harness/tests/forwarding.test.ts on #1780 has the two-host setup (sharedStores()). Open the owner with principal: { id: 'alice' } and the other host with no principal. Then check which principal a tool sees in a turn sent from the other host.
Do you intend to try to help solve this bug with your own PR?
Maybe, I'll investigate and start debugging
Terms & Code of Conduct
- I agree to follow this project's Code of Conduct
- I understand that if my bug cannot be reliable reproduced in a debuggable environment, it will probably not be fixed and this issue may even be closed.
- 主要语言
- TypeScript
- 星标
- 3.2k
- 派生
- 365
- 平均合并
- 1 天 9 小时
- 30 天内合并 PR
- 242
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
TanStack/ai 的其他 Issue
-
withPersistence does not save activity rows when a run is stopped or fails可能已有人在做 @tombeckenham 于 5 天前认领。 未关闭waiting-on: maintainer
维护者通常 1 天内回复
-
Activity events that a chat middleware emits are streamed but never recorded or persisted可能已有人在做 @AlemTuzlak 于 5 天前认领。 未关闭waiting-on: maintainer
维护者通常 1 天内回复
-
withPersistence stores the durability batch hint on a stopped or failed assistant message可能已有人在做 @tombeckenham 于 5 天前认领。 未关闭has-pr waiting-on: maintainer
维护者通常 1 天内回复
-
Discriminate status-dependent record and option types (RunRecord, SessionIndexEntry, InputState, durable-only options)可能已有人在做 @jherr 于 5 天前认领。 未关闭enhancement waiting-on: maintainer
维护者通常 1 天内回复
-
ai-harness: a forwarded command completes with no result, also when the owner rejects it可能已有人在做 @tombeckenham 于 6 天前认领。 未关闭waiting-on: maintainer
维护者通常 1 天内回复
相似的 Issue
-
[BUG] rag: sentence content can cross the reported sentence boundaries可能已有人在做 @LJK-ikun 今天认领。 未关闭bug
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
bug needs-triage
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复
-
README: the Resource URI Schemas example's file://documents/* pattern only matches that literal URI未关闭
难度 1/5 1 小时以内 新手友好度 88/100
platformatic/mcp#361 ·
维护者通常 1 天内回复
-
frontend
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
Push: sem service worker ou sem VAPID, o interruptor de Notificações fica ligado sem avisar nada未关闭
难度 2/5 1-3 小时 新手友好度 76/100
melgarafael/DeskcommCRM#3164 ·
维护者通常 1 天内回复