@ai-sdk/workflow 1.0.0-canary.93 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,179 @@
 # @ai-sdk/workflow
 
+## 1.0.1
+
+### Patch Changes
+
+- ai@7.0.1
+
+## 1.0.0
+
+### Major Changes
+
+- 1949571: feat(ai): make experimental_telemetry stable
+- b3976a2: initial version
+
+### Patch Changes
+
+- 19736ee: feat(ai): rename onStepFinish to onStepEnd
+- 382d53b: refactoring: rename context to runtimeContext
+- b567a6c: dependency updates
+- b402b95: `WorkflowAgent` now rejects system messages inside `prompt` or `messages` by default, matching the behavior of `generateText`/`streamText`. Set `allowSystemInMessages: true` to opt in to the previous behavior.
+- eea8d98: refactoring: rename tool execution events
+- 98627e5: feat(ai): remove onChunk event from telemetry
+- ca446f8: feat: flexible tool descriptions
+- 75763b0: agents: tag outgoing requests with an ai-sdk-agent user-agent segment for usage attribution (tool-loop, workflow)
+- 9f0e36c: trigger release for all packages after provenance setup
+- 29d8cf4: feat(ai): rename the core-event types
+- 7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.
+- a0ca584: fix (workflow): preserve invalid tool calls as errors instead of emitting synthetic success results
+- eba685c: Remove `maxSteps` option from `WorkflowAgent`. Use `stopWhen` with stop conditions like `isStepCount()` instead.
+- 0c4c275: trigger initial canary release
+- 258c093: chore: ensure consistent import handling and avoid import duplicates or cycles
+- 334ae5d: Update step performance metrics with explicit effective, input, output, and total token throughput fields.
+- b8396f0: trigger initial beta release
+- c3d4019: chore(ai): rename 'TelemetrySettings' to 'TelemetryOptions'
+- 083947b: feat(ai): separate toolsContext from context
+- bae5e2b: fix(security): re-validate tool approvals from client message history before execution
+
+  The approval-replay path in `generateText`/`streamText` (and `WorkflowAgent.stream`) reconstructed approved tool calls from the client-supplied messages array and executed them without re-validating input against the tool's schema or re-applying the approval policy. A client could forge an assistant message with a pre-approved tool-call part and have the server execute a tool with attacker-chosen arguments.
+
+  The replay path now validates HMAC signature (when `experimental_toolApprovalSecret` is configured), re-validates tool-call input against the tool's input schema, and re-resolves the approval policy before execution.
+
+- d775a57: feat: introduce Instructions type
+- f32c750: refactoring(ai): simplify mergeAbortSignals
+- bf6c17b: Add `id` property to WorkflowAgent for telemetry identification, matching ToolLoopAgent's API surface.
+- 3ca592a: Add `prompt` as an alternative to `messages` in `WorkflowAgent.stream()`, matching the `AgentCallParameters` pattern from ToolLoopAgent.
+- eb49d29: Add constructor-level defaults for `stopWhen`, `activeTools`, `output`, `experimental_repairToolCall`, and `experimental_download` to WorkflowAgent, matching ToolLoopAgent's pattern. Stream-level values override constructor defaults.
+- 0455f24: Enrich WorkflowAgent callback event shapes to align with ToolLoopAgent:
+  - Add `stepNumber` to `onToolCallStart` and `onToolCallFinish`
+  - Add `steps` (previous step results) to `onStepStart`
+  - Adopt discriminated union pattern (`success: true/false`) for `onToolCallFinish`
+  - Add `durationMs` to `onToolCallFinish`
+- 43543dc: Add `experimental_sandbox` support to `WorkflowAgent`. The sandbox is passed to tool execution, configurable on the constructor or per stream, and available to `prepareStep` for per-step overrides.
+- 0e462a7: Use `LanguageModel` type for model parameter, aligning with `ToolLoopAgent`. Remove async factory model form. Rename callback types to use `WorkflowAgentOn*` prefix.
+- 39dad72: feat(workflow): add stable telemetry integration support to `WorkflowAgent` and remove legacy telemetry options.
+- 1e4b350: Honor `tool.toModelOutput` in `WorkflowAgent`.
+
+  `WorkflowAgent` now routes successful local, provider-executed, and approved tool results through each tool's optional `toModelOutput` hook, matching `generateText`, `streamText`, and `ToolLoopAgent`. Previously the hook was ignored and results were always serialized as `text` or `json`.
+
+  Internally exports the shared tool-result model-output helpers from `ai/internal`, and uses the shared `getErrorMessage` behavior for workflow tool error results.
+
+- c3a6524: Add a `stepNumber` option to `doStreamStep` so callers can create `StepResult` objects with the correct step number.
+- 907e002: fix (workflow): forward provider-executed tool approvals to the provider on resume
+
+  `WorkflowAgent` stripped every `tool-approval-request` and `tool-approval-response` part from the messages when resuming after a tool approval, regardless of whether the tool was locally or provider-executed. For provider-executed tools (e.g. MCP via the OpenAI Responses API) this silently dropped the approval before `convertToLanguageModelPrompt` could forward it, so the provider never learned of the approval and the tool was never executed. Local approvals are still executed and stripped, while provider-executed approvals are now preserved and forwarded to the provider, matching the discriminator core's `streamText` already uses. This is the inverse of the bug fixed in #14289.
+
+- 1d56275: feat(workflow): add `runtimeContext` and `toolsContext` to `WorkflowAgent`.
+
+  `runtimeContext` is shared agent state that flows through `prepareCall`, `prepareStep`, step results, and `onFinish`. `toolsContext` is a per-tool map; each tool receives its own validated entry as `context`, validated against `tool.contextSchema` when defined. The previous `experimental_context` option (and corresponding fields on related callbacks and option types) has been removed — use `runtimeContext` for shared state and `toolsContext` for per-tool values. Context values in `WorkflowAgent` should be serializable because they can cross workflow and step boundaries.
+
+- 81e68da: Fix `stepNumber` on telemetry events emitted by `WorkflowAgent.stream` so per-step telemetry integrations (e.g. `@ai-sdk/devtools`) correctly key state per step.
+- 69d7128: fix(workflow): reuse the core tool-approval validation in WorkflowAgent
+
+  `WorkflowAgent.stream` previously reconstructed approved tool calls with a copy of the core collection logic and validated them inline. Because the logic was duplicated, it could drift from the hardened `generateText`/`streamText` implementation. WorkflowAgent now collects approvals via the shared `collectToolApprovals` and re-validates each one through the shared `validateApprovedToolApprovals` (input-schema re-validation, HMAC signature verification when configured, and approval-policy re-resolution) in addition to its existing `needsApproval` guard, so a client-forged approval cannot execute a tool with unvalidated input. The duplicated collector was removed; `collectToolApprovals` and `validateApprovedToolApprovals` are now exported from `ai/internal`.
+
+- fbea042: refactor: replace duplicate `filterTools`/`filterToolSet` with shared `experimental_filterActiveTools` from `ai`
+
+## 1.0.0-beta.107
+
+### Patch Changes
+
+- ai@7.0.0-beta.187
+
+## 1.0.0-beta.106
+
+### Patch Changes
+
+- ai@7.0.0-beta.186
+
+## 1.0.0-beta.105
+
+### Patch Changes
+
+- 75763b0: agents: tag outgoing requests with an ai-sdk-agent user-agent segment for usage attribution (tool-loop, workflow)
+- Updated dependencies [75763b0]
+  - ai@7.0.0-beta.185
+
+## 1.0.0-beta.104
+
+### Patch Changes
+
+- 43543dc: Add `experimental_sandbox` support to `WorkflowAgent`. The sandbox is passed to tool execution, configurable on the constructor or per stream, and available to `prepareStep` for per-step overrides.
+
+## 1.0.0-beta.103
+
+### Patch Changes
+
+- Updated dependencies [0416e3e]
+  - @ai-sdk/provider@4.0.0-beta.20
+  - ai@7.0.0-beta.184
+  - @ai-sdk/provider-utils@5.0.0-beta.50
+
+## 1.0.0-beta.102
+
+### Patch Changes
+
+- ai@7.0.0-beta.183
+
+## 1.0.0-beta.101
+
+### Patch Changes
+
+- b402b95: `WorkflowAgent` now rejects system messages inside `prompt` or `messages` by default, matching the behavior of `generateText`/`streamText`. Set `allowSystemInMessages: true` to opt in to the previous behavior.
+
+## 1.0.0-beta.100
+
+### Patch Changes
+
+- 907e002: fix (workflow): forward provider-executed tool approvals to the provider on resume
+
+  `WorkflowAgent` stripped every `tool-approval-request` and `tool-approval-response` part from the messages when resuming after a tool approval, regardless of whether the tool was locally or provider-executed. For provider-executed tools (e.g. MCP via the OpenAI Responses API) this silently dropped the approval before `convertToLanguageModelPrompt` could forward it, so the provider never learned of the approval and the tool was never executed. Local approvals are still executed and stripped, while provider-executed approvals are now preserved and forwarded to the provider, matching the discriminator core's `streamText` already uses. This is the inverse of the bug fixed in #14289.
+
+## 1.0.0-beta.99
+
+### Patch Changes
+
+- Updated dependencies [cc6ab90]
+  - ai@7.0.0-beta.182
+
+## 1.0.0-beta.98
+
+### Patch Changes
+
+- Updated dependencies [6a2caf9]
+  - ai@7.0.0-beta.181
+
+## 1.0.0-beta.97
+
+### Patch Changes
+
+- Updated dependencies [81a284b]
+  - ai@7.0.0-beta.180
+
+## 1.0.0-beta.96
+
+### Patch Changes
+
+- ai@7.0.0-beta.179
+
+## 1.0.0-beta.95
+
+### Patch Changes
+
+- Updated dependencies [b097c52]
+  - ai@7.0.0-beta.178
+
+## 1.0.0-beta.94
+
+### Patch Changes
+
+- b8396f0: trigger initial beta release
+- Updated dependencies [b8396f0]
+  - @ai-sdk/provider-utils@5.0.0-beta.49
+  - @ai-sdk/provider@4.0.0-beta.19
+  - ai@7.0.0-beta.177
+
 ## 1.0.0-canary.93
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { LanguageModelV4, SharedV4ProviderOptions, LanguageModelV4CallOptions, LanguageModelV4Prompt, LanguageModelV4StreamPart } from '@ai-sdk/provider';
 import { Context, HasRequiredKey, InferToolSetContext } from '@ai-sdk/provider-utils';
-import { ToolSet, LanguageModel, Instructions, ToolChoice, TelemetryOptions as TelemetryOptions$1, StopCondition, ActiveTools, LanguageModelResponseMetadata, LanguageModelUsage, FinishReason, ToolCallRepairFunction, StepResult, GenerateTextOnStepEndCallback, ModelMessage, Experimental_LanguageModelStreamPart, UIMessage, UIMessageChunk, ChatTransport, PrepareSendMessagesRequest, PrepareReconnectToStreamRequest, ChatRequestOptions } from 'ai';
+import { ToolSet, LanguageModel, Instructions, ToolChoice, TelemetryOptions as TelemetryOptions$1, StopCondition, ActiveTools, LanguageModelResponseMetadata, LanguageModelUsage, FinishReason, ToolCallRepairFunction, Experimental_SandboxSession, StepResult, GenerateTextOnStepEndCallback, ModelMessage, Experimental_LanguageModelStreamPart, UIMessage, UIMessageChunk, ChatTransport, PrepareSendMessagesRequest, PrepareReconnectToStreamRequest, ChatRequestOptions } from 'ai';
 export { Experimental_LanguageModelStreamPart as ModelCallStreamPart, Output, ToolCallRepairFunction } from 'ai';
 
 /**
@@ -193,6 +193,10 @@ interface PrepareStepInfo<TTools extends ToolSet = ToolSet, TRuntimeContext exte
      * `prepareStep` to update it for the current and subsequent steps.
      */
     toolsContext: InferToolSetContext<TTools>;
+    /**
+     * The sandbox environment that the step is operating in.
+     */
+    experimental_sandbox?: Experimental_SandboxSession;
 }
 /**
  * Return type from the prepareStep callback.
@@ -231,6 +235,10 @@ interface PrepareStepResult<TTools extends ToolSet = ToolSet, TRuntimeContext ex
      * Returning a value replaces the agent's tools context.
      */
     toolsContext?: InferToolSetContext<TTools>;
+    /**
+     * Override the sandbox environment for this step.
+     */
+    experimental_sandbox?: Experimental_SandboxSession;
 }
 /**
  * Callback function called before each step in the agent loop.
@@ -354,6 +362,13 @@ type WorkflowAgentOptions<TTools extends ToolSet = ToolSet, TRuntimeContext exte
      * Per-stream `experimental_download` values passed to `stream()` override this default.
      */
     experimental_download?: DownloadFunction;
+    /**
+     * Default sandbox environment passed through to tool execution as
+     * `experimental_sandbox`.
+     *
+     * Per-stream `experimental_sandbox` values passed to `stream()` override this default.
+     */
+    experimental_sandbox?: Experimental_SandboxSession;
     /**
      * Default callback function called before each step in the agent loop.
      * Use this to modify settings, manage context, or inject messages dynamically
@@ -404,6 +419,15 @@ type WorkflowAgentOptions<TTools extends ToolSet = ToolSet, TRuntimeContext exte
      * model, tools, instructions, or other settings based on runtime context.
      */
     prepareCall?: PrepareCallCallback<TTools, TRuntimeContext>;
+    /**
+     * Whether to allow system messages inside the `prompt` or `messages` fields.
+     * When `false` (the default), system messages in `prompt` or `messages` are
+     * rejected to prevent prompt-injection attacks. Set to `true` only when you
+     * intentionally interleave system messages with user messages.
+     *
+     * @default false
+     */
+    allowSystemInMessages?: boolean;
 };
 /**
  * Callback that is called when the LLM response and all request tool executions are finished.
@@ -694,6 +718,11 @@ type WorkflowAgentStreamOptions<TTools extends ToolSet = ToolSet, TRuntimeContex
      * By default, files are downloaded if the model does not support the URL for the given media type.
      */
     experimental_download?: DownloadFunction;
+    /**
+     * Sandbox environment passed through to tool execution as
+     * `experimental_sandbox`. Overrides the constructor-level value if provided.
+     */
+    experimental_sandbox?: Experimental_SandboxSession;
     /**
      * Callback function to be called after each step completes.
      */
@@ -896,7 +925,9 @@ declare class WorkflowAgent<TBaseTools extends ToolSet = ToolSet, TRuntimeContex
     private output?;
     private experimentalRepairToolCall?;
     private experimentalDownload?;
+    private experimentalSandbox?;
     private prepareStep?;
+    private allowSystemInMessages;
     private constructorOnStepEnd?;
     private constructorOnEnd?;
     private constructorOnStart?;