ai 6.0.201 → 6.0.202

package/src/generate-text/validate-tool-approvals.ts

@@ -0,0 +1,124 @@
+import {
+  asSchema,
+  safeValidateTypes,
+  type ModelMessage,
+} from '@ai-sdk/provider-utils';
+import { InvalidToolApprovalSignatureError } from '../error/invalid-tool-approval-signature-error';
+import { InvalidToolInputError } from '../error/invalid-tool-input-error';
+import type { CollectedToolApprovals } from './collect-tool-approvals';
+import { isApprovalNeeded } from './is-approval-needed';
+import { verifyToolApprovalSignature } from './tool-approval-signature';
+import type { ToolSet } from './tool-set';
+
+/**
+ * Re-validates approved tool approvals reconstructed from client-supplied
+ * message history before they are executed. Checks the HMAC signature (when
+ * `experimental_toolApprovalSecret` is configured), re-validates the tool-call
+ * input against the tool's input schema, and re-resolves whether the tool
+ * actually requires approval.
+ *
+ * Approvals that fail signature or schema validation throw (fail-closed).
+ * Approvals for tools that no longer require approval are moved to the denied
+ * list, since the server would never have issued an approval request for them.
+ */
+export async function validateApprovedToolApprovals<TOOLS extends ToolSet>({
+  approvedToolApprovals,
+  tools,
+  messages,
+  experimental_context,
+  toolApprovalSecret,
+}: {
+  approvedToolApprovals: Array<CollectedToolApprovals<TOOLS>>;
+  tools: TOOLS | undefined;
+  messages: ModelMessage[];
+  experimental_context: unknown;
+  toolApprovalSecret?: string | Uint8Array;
+}): Promise<{
+  approvedToolApprovals: Array<CollectedToolApprovals<TOOLS>>;
+  deniedToolApprovals: Array<CollectedToolApprovals<TOOLS>>;
+}> {
+  const approved: Array<CollectedToolApprovals<TOOLS>> = [];
+  const denied: Array<CollectedToolApprovals<TOOLS>> = [];
+
+  for (const approval of approvedToolApprovals) {
+    const { toolCall, approvalRequest } = approval;
+    const tool = tools?.[toolCall.toolName];
+
+    if (toolApprovalSecret != null) {
+      if (approvalRequest.signature == null) {
+        throw new InvalidToolApprovalSignatureError({
+          approvalId: approvalRequest.approvalId,
+          toolCallId: toolCall.toolCallId,
+          reason: 'missing signature',
+        });
+      }
+
+      const valid = await verifyToolApprovalSignature({
+        secret: toolApprovalSecret,
+        signature: approvalRequest.signature,
+        approvalId: approvalRequest.approvalId,
+        toolCallId: toolCall.toolCallId,
+        toolName: toolCall.toolName,
+        input: toolCall.input,
+      });
+
+      if (!valid) {
+        throw new InvalidToolApprovalSignatureError({
+          approvalId: approvalRequest.approvalId,
+          toolCallId: toolCall.toolCallId,
+          reason: 'invalid signature',
+        });
+      }
+    }
+
+    // Re-validate the (client-supplied) input against the tool's input schema
+    // for tools that are executed on the server.
+    if (
+      tool != null &&
+      typeof tool.execute === 'function' &&
+      tool.inputSchema != null
+    ) {
+      const validation = await safeValidateTypes({
+        value: toolCall.input,
+        schema: asSchema(tool.inputSchema),
+      });
+
+      if (!validation.success) {
+        throw new InvalidToolInputError({
+          toolName: toolCall.toolName,
+          toolInput: JSON.stringify(toolCall.input),
+          cause: validation.error,
+        });
+      }
+    }
+
+    // Re-resolve whether the tool requires approval. A tool that does not
+    // require approval would never have had an approval request issued by the
+    // server, so any approval for it is fabricated and is denied.
+    const approvalNeeded =
+      tool != null &&
+      (await isApprovalNeeded({
+        tool,
+        toolCall,
+        messages,
+        experimental_context,
+      }));
+
+    if (approvalNeeded) {
+      approved.push(approval);
+    } else {
+      denied.push({
+        ...approval,
+        approvalResponse: {
+          ...approval.approvalResponse,
+          approved: false,
+          reason:
+            approval.approvalResponse.reason ??
+            `Tool "${toolCall.toolName}" does not require approval`,
+        },
+      });
+    }
+  }
+
+  return { approvedToolApprovals: approved, deniedToolApprovals: denied };
+}

package/src/ui/convert-to-model-messages.ts

@@ -196,6 +196,9 @@ export async function convertToModelMessages<UI_MESSAGE extends UIMessage>(
                       type: 'tool-approval-request' as const,
                       approvalId: part.approval.id,
                       toolCallId: part.toolCallId,
+                      ...(part.approval.signature != null
+                        ? { signature: part.approval.signature }
+                        : {}),
                     });
                   }
 

package/src/ui/process-ui-message-stream.ts

@@ -675,7 +675,12 @@ export function processUIMessageStream<UI_MESSAGE extends UIMessage>({
             case 'tool-approval-request': {
               const toolInvocation = getToolInvocation(chunk.toolCallId);
               toolInvocation.state = 'approval-requested';
-              toolInvocation.approval = { id: chunk.approvalId };
+              toolInvocation.approval = {
+                id: chunk.approvalId,
+                ...(chunk.signature != null
+                  ? { signature: chunk.signature }
+                  : {}),
+              };
               write();
               break;
             }

package/src/ui/ui-messages.ts

@@ -256,6 +256,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved?: never;
         reason?: never;
+        signature?: string;
       };
     }
   | {
@@ -268,6 +269,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: boolean;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -282,6 +284,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -296,6 +299,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -308,6 +312,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: false;
         reason?: string;
+        signature?: string;
       };
     }
 );
@@ -364,6 +369,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved?: never;
         reason?: never;
+        signature?: string;
       };
     }
   | {
@@ -376,6 +382,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: boolean;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -390,6 +397,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -403,6 +411,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -415,6 +424,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: false;
         reason?: string;
+        signature?: string;
       };
     }
 );

package/src/ui/validate-ui-messages.ts

@@ -122,6 +122,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.never().optional(),
                     reason: z.never().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -139,6 +140,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.boolean(),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -159,6 +161,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -180,6 +183,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -198,6 +202,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.literal(false),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -238,6 +243,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.never().optional(),
                     reason: z.never().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -254,6 +260,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.boolean(),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -273,6 +280,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -293,6 +301,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -310,6 +319,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.literal(false),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
               ]),

package/src/ui-message-stream/ui-message-chunks.ts

@@ -85,6 +85,7 @@ export const uiMessageChunkSchema = lazySchema(() =>
         type: z.literal('tool-approval-request'),
         approvalId: z.string(),
         toolCallId: z.string(),
+        signature: z.string().optional(),
       }),
       z.strictObject({
         type: z.literal('tool-output-available'),
@@ -269,6 +270,7 @@ export type UIMessageChunk<
       type: 'tool-approval-request';
       approvalId: string;
       toolCallId: string;
+      signature?: string;
     }
   | {
       type: 'tool-output-available';