@ai-sdk/provider-utils 5.0.0-canary.46 → 5.0.0-canary.47

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @ai-sdk/provider-utils
 
+## 5.0.0-canary.47
+
+### Patch Changes
+
+- bae5e2b: fix(security): re-validate tool approvals from client message history before execution
+
+  The approval-replay path in `generateText`/`streamText` (and `WorkflowAgent.stream`) reconstructed approved tool calls from the client-supplied messages array and executed them without re-validating input against the tool's schema or re-applying the approval policy. A client could forge an assistant message with a pre-approved tool-call part and have the server execute a tool with attacker-chosen arguments.
+
+  The replay path now validates HMAC signature (when `experimental_toolApprovalSecret` is configured), re-validates tool-call input against the tool's input schema, and re-resolves the approval policy before execution.
+
 ## 5.0.0-canary.46
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1203,6 +1203,11 @@ type ToolApprovalRequest = {
      * @default false
      */
     isAutomatic?: boolean;
+    /**
+     * HMAC-SHA256 signature binding this approval to its tool call.
+     * Present only when `experimental_toolApprovalSecret` is configured.
+     */
+    signature?: string;
 };
 
 /**

package/dist/index.js

@@ -876,7 +876,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "5.0.0-canary.46" : "0.0.0-test";
+var VERSION = true ? "5.0.0-canary.47" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/provider-utils",
-  "version": "5.0.0-canary.46",
+  "version": "5.0.0-canary.47",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,

package/src/types/tool-approval-request.ts

@@ -20,4 +20,10 @@ export type ToolApprovalRequest = {
    * @default false
    */
   isAutomatic?: boolean;
+
+  /**
+   * HMAC-SHA256 signature binding this approval to its tool call.
+   * Present only when `experimental_toolApprovalSecret` is configured.
+   */
+  signature?: string;
 };