@ai-sdk/provider-utils 4.0.27 → 4.0.28

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @ai-sdk/provider-utils
 
+## 4.0.28
+
+### Patch Changes
+
+- 942f2f8: fix(security): re-validate tool approvals from client message history before execution
+
+  The approval-replay path in `generateText`/`streamText` reconstructed approved tool calls from the client-supplied messages array and executed them without re-validating input against the tool's schema or re-checking that the tool actually requires approval. A client could forge an assistant message with a pre-approved tool-call part and have the server execute a tool with attacker-chosen arguments.
+
+  The replay path now verifies the HMAC signature (when `experimental_toolApprovalSecret` is configured), re-validates tool-call input against the tool's input schema, and re-resolves whether the tool requires approval before execution.
+
 ## 4.0.27
 
 ### Patch Changes

package/dist/index.d.mts

@@ -874,6 +874,11 @@ type ToolApprovalRequest = {
      * ID of the tool call that the approval request is for.
      */
     toolCallId: string;
+    /**
+     * HMAC-SHA256 signature binding this approval to its tool call.
+     * Present only when `experimental_toolApprovalSecret` is configured.
+     */
+    signature?: string;
 };
 
 /**

package/dist/index.d.ts

@@ -874,6 +874,11 @@ type ToolApprovalRequest = {
      * ID of the tool call that the approval request is for.
      */
     toolCallId: string;
+    /**
+     * HMAC-SHA256 signature binding this approval to its tool call.
+     * Present only when `experimental_toolApprovalSecret` is configured.
+     */
+    signature?: string;
 };
 
 /**

package/dist/index.js

@@ -678,7 +678,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "4.0.27" : "0.0.0-test";
+var VERSION = true ? "4.0.28" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;

package/dist/index.mjs

@@ -582,7 +582,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "4.0.27" : "0.0.0-test";
+var VERSION = true ? "4.0.28" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/provider-utils",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",

package/src/types/tool-approval-request.ts

@@ -13,4 +13,10 @@ export type ToolApprovalRequest = {
    * ID of the tool call that the approval request is for.
    */
   toolCallId: string;
+
+  /**
+   * HMAC-SHA256 signature binding this approval to its tool call.
+   * Present only when `experimental_toolApprovalSecret` is configured.
+   */
+  signature?: string;
 };