ai 5.0.272 → 5.0.273

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # ai
 
+## 5.0.273
+
+### Patch Changes
+
+- 223133e: fix(ai): prevent deleted tools named after Object.prototype properties from exposing persisted output to models
+- 51e2b34: fix(ai): prevent unavailable tools from exposing persisted output to models
+- 5f95b09: fix(ai): avoid duplicate slashes in chat reconnect URLs
+- Updated dependencies [4a65dd5]
+- Updated dependencies [8f63231]
+- Updated dependencies [95c921d]
+- Updated dependencies [c858a31]
+  - @ai-sdk/gateway@2.0.164
+
 ## 5.0.272
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1672,6 +1672,13 @@ type ToolUIPart<TOOLS extends UITools = UITools> = ValueOf<{
 }>;
 type DynamicToolUIPart = {
     type: 'dynamic-tool';
+    /**
+     * `false` when a static tool part was normalized to a dynamic tool part
+     * because its current tool schema was unavailable or incompatible.
+     *
+     * This preserves its static origin across persistence boundaries.
+     */
+    dynamic?: false;
     /**
      * Name of the tool that is being called.
      */

package/dist/index.d.ts

@@ -1672,6 +1672,13 @@ type ToolUIPart<TOOLS extends UITools = UITools> = ValueOf<{
 }>;
 type DynamicToolUIPart = {
     type: 'dynamic-tool';
+    /**
+     * `false` when a static tool part was normalized to a dynamic tool part
+     * because its current tool schema was unavailable or incompatible.
+     *
+     * This preserves its static origin across persistence boundaries.
+     */
+    dynamic?: false;
     /**
      * Name of the tool that is being called.
      */

package/dist/index.js

@@ -817,7 +817,7 @@ function detectMediaType({
 var import_provider_utils2 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "5.0.272" : "0.0.0-test";
+var VERSION = true ? "5.0.273" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -6388,6 +6388,20 @@ var DefaultStreamTextResult = class {
   }
 };
 
+// src/util/get-own.ts
+function getOwn(obj, key) {
+  return obj != null && Object.hasOwn(obj, key) ? obj[key] : void 0;
+}
+
+// src/ui/unavailable-tool.ts
+function markToolPartAsUnavailable(part) {
+  part.dynamic = false;
+  return part;
+}
+function isToolPartFromUnavailableTool(part) {
+  return part.type === "dynamic-tool" && part.dynamic === false;
+}
+
 // src/ui/convert-to-model-messages.ts
 function convertToModelMessages(messages, options) {
   const modelMessages = [];
@@ -6399,6 +6413,25 @@ function convertToModelMessages(messages, options) {
       )
     }));
   }
+  function createModelOutput({
+    toolPart,
+    toolName,
+    output,
+    errorMode
+  }) {
+    const tool2 = getOwn(options == null ? void 0 : options.tools, toolName);
+    if (errorMode === "none" && tool2 == null && isToolPartFromUnavailableTool(toolPart)) {
+      return {
+        type: "text",
+        value: "Tool output omitted because the tool is no longer available."
+      };
+    }
+    return createToolModelOutput({
+      output,
+      tool: tool2,
+      errorMode
+    });
+  }
   for (const message of messages) {
     switch (message.role) {
       case "system": {
@@ -6452,7 +6485,7 @@ function convertToModelMessages(messages, options) {
       case "assistant": {
         if (message.parts != null) {
           let processBlock2 = function() {
-            var _a16, _b, _c;
+            var _a16, _b;
             if (block.length === 0) {
               return;
             }
@@ -6504,9 +6537,10 @@ function convertToModelMessages(messages, options) {
                       type: "tool-result",
                       toolCallId: part.toolCallId,
                       toolName,
-                      output: createToolModelOutput({
+                      output: createModelOutput({
+                        toolPart: part,
+                        toolName,
                         output: part.state === "output-error" ? part.errorText : part.output,
-                        tool: (_b = options == null ? void 0 : options.tools) == null ? void 0 : _b[toolName],
                         errorMode: part.state === "output-error" ? "json" : "none"
                       }),
                       ...part.callProviderMetadata != null ? { providerOptions: part.callProviderMetadata } : {}
@@ -6514,7 +6548,7 @@ function convertToModelMessages(messages, options) {
                   }
                 }
               } else if (isDataUIPart(part)) {
-                const dataPart = (_c = options == null ? void 0 : options.convertDataPart) == null ? void 0 : _c.call(
+                const dataPart = (_b = options == null ? void 0 : options.convertDataPart) == null ? void 0 : _b.call(
                   options,
                   part
                 );
@@ -6537,7 +6571,6 @@ function convertToModelMessages(messages, options) {
               modelMessages.push({
                 role: "tool",
                 content: toolParts.map((toolPart) => {
-                  var _a17;
                   switch (toolPart.state) {
                     case "output-error":
                     case "output-available": {
@@ -6546,9 +6579,10 @@ function convertToModelMessages(messages, options) {
                         type: "tool-result",
                         toolCallId: toolPart.toolCallId,
                         toolName,
-                        output: createToolModelOutput({
+                        output: createModelOutput({
+                          toolPart,
+                          toolName,
                           output: toolPart.state === "output-error" ? toolPart.errorText : toolPart.output,
-                          tool: (_a17 = options == null ? void 0 : options.tools) == null ? void 0 : _a17[toolName],
                           errorMode: toolPart.state === "output-error" ? "text" : "none"
                         }),
                         ...toolPart.callProviderMetadata != null ? { providerOptions: toolPart.callProviderMetadata } : {}
@@ -6741,11 +6775,6 @@ var DefaultEmbedResult = class {
   }
 };
 
-// src/util/get-own.ts
-function getOwn(obj, key) {
-  return obj != null && Object.hasOwn(obj, key) ? obj[key] : void 0;
-}
-
 // src/util/set-own.ts
 function setOwn(object2, key, value) {
   Object.defineProperty(object2, key, {
@@ -9778,7 +9807,9 @@ var import_provider_utils31 = require("@ai-sdk/provider-utils");
 var import_provider_utils30 = require("@ai-sdk/provider-utils");
 function appendPathToUrl(url, path) {
   const queryOrFragmentStart = url.search(/[?#]/);
-  return queryOrFragmentStart === -1 ? `${url}${path}` : `${url.slice(0, queryOrFragmentStart)}${path}${url.slice(queryOrFragmentStart)}`;
+  const urlPath = queryOrFragmentStart === -1 ? url : url.slice(0, queryOrFragmentStart);
+  const suffix = queryOrFragmentStart === -1 ? "" : url.slice(queryOrFragmentStart);
+  return `${urlPath.endsWith("/") && path.startsWith("/") ? urlPath.slice(0, -1) : urlPath}${path}${suffix}`;
 }
 var HttpChatTransport = class {
   constructor({
@@ -10413,20 +10444,20 @@ function asDynamicToolPart(toolPart) {
     ...toolPart.callProviderMetadata === void 0 ? {} : { callProviderMetadata: toolPart.callProviderMetadata }
   };
   if (toolPart.state === "output-available") {
-    return {
+    return markToolPartAsUnavailable({
       ...common,
       state: "output-available",
       input: toolPart.input,
       output: toolPart.output,
       ...toolPart.preliminary === void 0 ? {} : { preliminary: toolPart.preliminary }
-    };
+    });
   }
-  return {
+  return markToolPartAsUnavailable({
     ...common,
     state: "output-error",
     input: toolPart.input,
     errorText: toolPart.errorText
-  };
+  });
 }
 var uiMessagesSchema = (0, import_provider_utils33.lazyValidator)(
   () => (0, import_provider_utils33.zodSchema)(
@@ -10482,6 +10513,7 @@ var uiMessagesSchema = (0, import_provider_utils33.lazyValidator)(
             }),
             import_v48.z.object({
               type: import_v48.z.literal("dynamic-tool"),
+              dynamic: import_v48.z.literal(false).optional(),
               toolName: import_v48.z.string(),
               toolCallId: import_v48.z.string(),
               state: import_v48.z.literal("input-streaming"),
@@ -10493,6 +10525,7 @@ var uiMessagesSchema = (0, import_provider_utils33.lazyValidator)(
             }),
             import_v48.z.object({
               type: import_v48.z.literal("dynamic-tool"),
+              dynamic: import_v48.z.literal(false).optional(),
               toolName: import_v48.z.string(),
               toolCallId: import_v48.z.string(),
               state: import_v48.z.literal("input-available"),
@@ -10504,6 +10537,7 @@ var uiMessagesSchema = (0, import_provider_utils33.lazyValidator)(
             }),
             import_v48.z.object({
               type: import_v48.z.literal("dynamic-tool"),
+              dynamic: import_v48.z.literal(false).optional(),
               toolName: import_v48.z.string(),
               toolCallId: import_v48.z.string(),
               state: import_v48.z.literal("output-available"),
@@ -10516,6 +10550,7 @@ var uiMessagesSchema = (0, import_provider_utils33.lazyValidator)(
             }),
             import_v48.z.object({
               type: import_v48.z.literal("dynamic-tool"),
+              dynamic: import_v48.z.literal(false).optional(),
               toolName: import_v48.z.string(),
               toolCallId: import_v48.z.string(),
               state: import_v48.z.literal("output-error"),
@@ -10715,7 +10750,7 @@ async function safeValidateUIMessages({
           }
           const toolPart = part;
           const toolName = toolPart.type.slice(5);
-          const tool2 = tools[toolName];
+          const tool2 = getOwn(tools, toolName);
           if (!tool2 && (toolPart.state === "output-available" || toolPart.state === "output-error")) {
             message.parts[partIdx] = asDynamicToolPart(toolPart);
             continue;