@rulvar/bridge-ai-sdk 1.187.0 → 1.188.0

package/dist/index.d.ts

@@ -17,6 +17,22 @@ interface BridgeAiSdkOptions {
   provider?: string;
   /** Per-model capability overrides merged over the conservative defaults. */
   caps?: (model: string) => ModelCaps | Partial<ModelCaps>;
+  /**
+  * Provider-executed tool policy (RV1806). The wrapped provider can
+  * run tools SERVER-SIDE (web search, code execution, computer use):
+  * those calls never pass the engine's ToolDef registry, risk
+  * classes, ask rules, or approvals, and their effects happen on
+  * provider infrastructure regardless of any engine permission chain.
+  * The default 'deny' fails the turn with a typed terminal error the
+  * moment a provider-executed exchange appears, because a policy
+  * surface that cannot see a call must not silently absorb it.
+  * 'allow' opts in: the exchange is retained for prompt
+  * reconstruction exactly as before, and the finish metadata
+  * additionally names every provider-executed call
+  * (`providerExecutedTools: [{ toolName, toolCallId }]`) so the
+  * journaled record of the turn says what the provider ran.
+  */
+  providerExecutedTools?: "allow" | "deny";
 }
 /**
 * Wraps a Vercel AI SDK LanguageModelV4 as a ProviderAdapter. The bridge

package/dist/index.js

@@ -106,6 +106,8 @@ function bridgeAiSdk(model, options = {}) {
 	const id = options.id ?? model.provider;
 	if (id === void 0 || id === "") throw new ConfigError("bridgeAiSdk requires a non-empty adapter id (model.provider was empty)");
 	const family = options.provider ?? model.provider;
+	const providerExecutedTools = options.providerExecutedTools ?? "deny";
+	if (providerExecutedTools !== "allow" && providerExecutedTools !== "deny") throw new ConfigError("bridgeAiSdk options.providerExecutedTools must be 'allow' or 'deny' when given");
 	const ids = new BridgeIdMap(createCanonicalIdMinter());
 	return {
 		id,
@@ -136,7 +138,7 @@ function bridgeAiSdk(model, options = {}) {
 				};
 				return;
 			}
-			const mapper = new StreamMapper(id, ids, built.effortDownmapped);
+			const mapper = new StreamMapper(id, ids, built.effortDownmapped, providerExecutedTools);
 			try {
 				for await (const part of iterateStream(result.stream)) {
 					for (const event of mapper.map(part)) yield event;
@@ -394,16 +396,42 @@ var StreamMapper = class {
 	adapterId;
 	ids;
 	effortDownmapped;
+	providerExecutedPolicy;
 	startedToolWireIds = /* @__PURE__ */ new Set();
 	providerExecutedWireIds = /* @__PURE__ */ new Set();
+	/** Provider-executed calls seen under 'allow' (RV1806), by wire id. */
+	providerExecutedSeen = /* @__PURE__ */ new Map();
 	reasoning = /* @__PURE__ */ new Map();
 	retained = [];
 	warnings = [];
 	response;
-	constructor(adapterId, ids, effortDownmapped) {
+	constructor(adapterId, ids, effortDownmapped, providerExecutedPolicy = "deny") {
 		this.adapterId = adapterId;
 		this.ids = ids;
 		this.effortDownmapped = effortDownmapped;
+		this.providerExecutedPolicy = providerExecutedPolicy;
+	}
+	/**
+	* The deny arm (RV1806): a provider-executed exchange under the
+	* default policy fails the turn typed. The refusal cannot un-run a
+	* tool the provider already executed server-side; it refuses to
+	* CONTINUE a turn the engine's permission chain cannot see, and the
+	* journaled terminal names the tool that ran.
+	*/
+	denyProviderExecuted(toolName) {
+		this.terminal = true;
+		return [{
+			type: "error",
+			error: {
+				code: "agent",
+				message: `the bridged provider executed tool '${toolName}' server-side; provider-executed tools bypass the engine's ToolDef registry, risk classes, and approvals, and are refused by default. Opt in with bridgeAiSdk(model, { providerExecutedTools: 'allow' })`,
+				retryable: false,
+				data: {
+					kind: "terminal",
+					providerExecutedTool: toolName
+				}
+			}
+		}];
 	}
 	map(part) {
 		switch (part.type) {
@@ -455,7 +483,9 @@ var StreamMapper = class {
 			}
 			case "tool-input-start":
 				if (part.providerExecuted === true) {
+					if (this.providerExecutedPolicy === "deny") return this.denyProviderExecuted(part.toolName);
 					this.providerExecutedWireIds.add(part.id);
+					this.providerExecutedSeen.set(part.id, part.toolName);
 					return [];
 				}
 				this.startedToolWireIds.add(part.id);
@@ -474,7 +504,9 @@ var StreamMapper = class {
 			case "tool-input-end": return [];
 			case "tool-call": {
 				if (part.providerExecuted === true) {
+					if (this.providerExecutedPolicy === "deny") return this.denyProviderExecuted(part.toolName);
 					this.providerExecutedWireIds.add(part.toolCallId);
+					this.providerExecutedSeen.set(part.toolCallId, part.toolName);
 					const parsed = parseToolArgs(part.input);
 					this.retained.push({
 						type: "tool-call",
@@ -587,6 +619,10 @@ var StreamMapper = class {
 			if (typeof this.response.id === "string") bag.responseId = this.response.id;
 		}
 		if (part.providerMetadata !== void 0) bag.upstream = part.providerMetadata;
+		if (this.providerExecutedSeen.size > 0) bag.providerExecutedTools = [...this.providerExecutedSeen.entries()].map(([toolCallId, toolName]) => ({
+			toolName,
+			toolCallId
+		}));
 		if (this.effortDownmapped) bag.effortDownmap = "max->xhigh";
 		if (part.finishReason.unified === "other" && part.finishReason.raw !== void 0) bag.finishRaw = part.finishReason.raw;
 		return [{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/bridge-ai-sdk",
-  "version": "1.187.0",
+  "version": "1.188.0",
   "description": "Rulvar bridge adapter wrapping any Vercel AI SDK LanguageModelV4 as a ProviderAdapter.",
   "type": "module",
   "license": "Apache-2.0",
@@ -23,14 +23,14 @@
   },
   "dependencies": {
     "@ai-sdk/provider": "^4.0.3",
-    "@rulvar/core": "1.187.0"
+    "@rulvar/core": "1.188.0"
   },
   "devDependencies": {
     "@ai-sdk/google": "^4.0.24",
     "@types/node": "^22.20.1",
     "tsdown": "^0.22.14",
     "typescript": "~6.0.3",
-    "@rulvar/testing": "1.187.0"
+    "@rulvar/testing": "1.188.0"
   },
   "repository": {
     "type": "git",