ai 7.0.114 → 7.0.116

package/docs/03-ai-sdk-harnesses/07-ui.mdx

@@ -82,53 +82,53 @@ Define the `HarnessAgent` on the server:
 ```ts filename='app/api/chat/agent.ts'
 import { HarnessAgent } from '@ai-sdk/harness/agent';
 import { claudeCode } from '@ai-sdk/harness-claude-code';
-import { createVercelSandbox } from '@ai-sdk/sandbox-vercel';
 
 export const agent = new HarnessAgent({
   harness: claudeCode,
-  sandbox: createVercelSandbox({
-    runtime: 'node24',
-    ports: [4000],
-  }),
   instructions: 'You are a helpful coding assistant.',
 });
 ```
 
 ## Session Store
 
-Persist only the opaque resume state returned by `session.detach()`. If the
+Persist the opaque resume state returned by `session.detach()`. If the
 turn paused for approval or was otherwise interrupted, that resume state carries
 the continuation state internally. The chat id can also be the harness
-`sessionId`, which gives the sandbox a stable identity across requests and
-processes.
+`sessionId`. Here we derive a stable `sandboxId` from that known chat id. If
+you do not derive one, persist the returned `sandboxSession.id` separately.
 
 ```ts filename='app/api/chat/session-store.ts'
-import type {
-  HarnessAgentResumeSessionState,
-  HarnessAgentSession,
-} from '@ai-sdk/harness/agent';
+import type { HarnessAgentResumeSessionState } from '@ai-sdk/harness/agent';
+import {
+  createVercelNetworkSandboxSession,
+  resumeVercelNetworkSandboxSession,
+} from '@ai-sdk/sandbox-vercel';
 
 const states: Record<string, HarnessAgentResumeSessionState | undefined> = {};
 
-type SessionFactory = {
-  createSession(options?: {
-    sessionId?: string;
-    resumeFrom?: HarnessAgentResumeSessionState;
-  }): Promise<HarnessAgentSession>;
-};
-
 export async function resumeOrCreateSession({
   agent,
   chatId,
 }: {
-  agent: SessionFactory;
+  agent: typeof import('./agent').agent;
   chatId: string;
 }) {
   const resumeFrom = states[chatId];
-
-  return agent.createSession(
-    resumeFrom ? { sessionId: chatId, resumeFrom } : { sessionId: chatId },
-  );
+  const sandboxId = `harness-${chatId}`;
+  const sandboxSession = resumeFrom
+    ? await resumeVercelNetworkSandboxSession({ sandboxId })
+    : await createVercelNetworkSandboxSession({
+        sandboxId,
+        runtime: 'node24',
+        ports: [4000],
+        template: await agent.getSandboxTemplate(),
+      });
+  const session = await agent.createSession({
+    sessionId: chatId,
+    resumeFrom,
+    sandboxSession,
+  });
+  return { session, sandboxSession };
 }
 
 export async function detachAndPersist({
@@ -136,13 +136,15 @@ export async function detachAndPersist({
   session,
 }: {
   chatId: string;
-  session: HarnessAgentSession;
+  session: Awaited<ReturnType<typeof resumeOrCreateSession>>['session'];
 }) {
   states[chatId] = await session.detach();
 }
 ```
 
-Use durable storage instead of an in-memory map in production.
+Use durable storage instead of an in-memory map in production. The creator
+always creates a new sandbox and fails on a conflicting `sandboxId`; only the
+resume function reattaches an existing one.
 
 ## Route
 
@@ -177,7 +179,7 @@ export async function POST(request: Request) {
   return createUIMessageStreamResponse({
     stream: createUIMessageStream({
       execute: async ({ writer }) => {
-        const session = await resumeOrCreateSession({ agent, chatId });
+        const { session } = await resumeOrCreateSession({ agent, chatId });
         const result = await agent.stream({ session, messages });
 
         writer.merge(
@@ -212,9 +214,10 @@ sandbox warm for the next request. Bridge-backed adapters can usually reattach
 or replay efficiently. If the turn is unfinished, `detach()` includes the turn
 continuation state in the returned resume state.
 
-Use `session.stop()` when you want to save resume state and stop the runtime and
-sandbox after each turn. The next request resumes from persisted state and
-continues any unfinished turn before accepting a new prompt.
+`session.stop()` saves resume state and stops the harness runtime, but does not
+stop a supplied sandbox. The caller owns that network session and should call
+its `destroy()` method when the chat ends, not while a later request needs to
+reattach. Preserve the chosen `sandboxId` across processes.
 
 ## Rendering Harness Parts
 

package/docs/03-ai-sdk-harnesses/08-terminal-ui.mdx

@@ -19,15 +19,11 @@ session for the lifetime of the terminal UI.
 ```ts filename='tui.ts'
 import { HarnessAgent, type HarnessAgentSession } from '@ai-sdk/harness/agent';
 import { codex } from '@ai-sdk/harness-codex';
-import { createVercelSandbox } from '@ai-sdk/sandbox-vercel';
+import { createVercelNetworkSandboxSession } from '@ai-sdk/sandbox-vercel';
 import { runAgentTUI, type AgentTUIAgent } from '@ai-sdk/tui';
 
 const agent = new HarnessAgent({
   harness: codex,
-  sandbox: createVercelSandbox({
-    runtime: 'node24',
-    ports: [4000],
-  }),
 });
 
 function createTUIAgent({
@@ -56,7 +52,12 @@ function createTUIAgent({
   } as AgentTUIAgent;
 }
 
-const session = await agent.createSession();
+const sandboxSession = await createVercelNetworkSandboxSession({
+  runtime: 'node24',
+  ports: [4000],
+  template: await agent.getSandboxTemplate(),
+});
+const session = await agent.createSession({ sandboxSession });
 
 try {
   await runAgentTUI({
@@ -67,6 +68,7 @@ try {
   });
 } finally {
   await session.destroy();
+  await sandboxSession.destroy();
 }
 ```
 

package/docs/06-advanced/11-secure-url-fetching.mdx

@@ -45,6 +45,45 @@ When the SDK fetches a URL taken from a provider response, it:
 
 A blocked URL surfaces as a `DownloadError`.
 
+## Fetching untrusted URLs directly
+
+For custom integrations using `@ai-sdk/provider-utils`, use `fetchUntrustedUrl`
+when the URL comes from a response or other untrusted input. It validates URLs
+and redirects and withholds credentials and unknown custom headers on the first
+request unless the URL matches a configured origin:
+
+```ts
+import { fetchUntrustedUrl } from '@ai-sdk/provider-utils';
+
+const response = await fetchUntrustedUrl({
+  url: result.downloadUrl,
+  headers: {
+    authorization: `Bearer ${apiKey}`,
+    accept: 'image/*',
+  },
+  credentialedOrigin: providerBaseURL,
+});
+```
+
+Here, `Authorization` is sent only when the initial URL has the same origin as
+`providerBaseURL`. Otherwise, only allowlisted metadata such as `Accept`,
+`Range`, and `User-Agent` is sent. A cross-origin redirect drops all caller
+headers except `User-Agent`, and credentials are never reattached on later hops.
+
+`credentialedOrigin` must come from your configuration, never from the response
+URL. It does not disable URL validation. For a configured private endpoint, pass
+`trustedOrigin` as well; if `credentialedOrigin` is omitted, `fetchUntrustedUrl`
+uses `trustedOrigin` as the origin allowed to receive credentials. Extra protocol
+metadata can be allowed with `untrustedFirstHopHeaders: ['x-protocol-version']`.
+Only list headers that are safe to disclose to any destination; use a configured
+origin for credentials.
+
+The existing `fetchWithValidatedRedirects` helper preserves its first-request
+behavior: it sanitizes risky headers but still forwards authentication and
+custom headers. Switch to `fetchUntrustedUrl` to opt into first-request
+credential isolation. Existing calls to `getFromApi` also retain their behavior;
+pass `credentialedOrigin` when fetching response-supplied URLs with credentials.
+
 ## Self-hosted and local endpoints
 
 URLs that are same-origin with the provider endpoint **you configured** (e.g. a

package/docs/07-reference/06-ai-sdk-tui/01-run-agent-tui.mdx

@@ -191,17 +191,21 @@ await runAgentTUI({
 ## Example with Sandbox
 
 ```ts
-import { createJustBashSandbox } from '@ai-sdk/sandbox-just-bash';
+import { createJustBashNetworkSandboxSession } from '@ai-sdk/sandbox-just-bash';
 
-const sandboxSession = await createJustBashSandbox({
+const sandboxSession = await createJustBashNetworkSandboxSession({
   cwd: '/home/user',
-}).createSession();
-
-await runAgentTUI({
-  title: 'Sandbox Assistant',
-  agent,
-  sandbox: sandboxSession.restricted(),
 });
+
+try {
+  await runAgentTUI({
+    title: 'Sandbox Assistant',
+    agent,
+    sandbox: sandboxSession.restricted(),
+  });
+} finally {
+  await sandboxSession.destroy();
+}
 ```
 
 The sandbox is forwarded to every `agent.stream()` call as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.114",
+  "version": "7.0.116",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,20 +42,20 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.92",
+    "@ai-sdk/gateway": "4.0.94",
     "@ai-sdk/provider": "4.0.18",
-    "@ai-sdk/provider-utils": "5.0.47"
+    "@ai-sdk/provider-utils": "5.0.49"
   },
   "devDependencies": {
-    "@ai-sdk/amazon-bedrock": "5.0.94",
-    "@ai-sdk/deepseek": "3.0.52",
-    "@ai-sdk/google": "4.0.80",
-    "@ai-sdk/groq": "4.0.48",
-    "@ai-sdk/huggingface": "2.0.55",
-    "@ai-sdk/moonshotai": "3.0.56",
-    "@ai-sdk/openai": "4.0.75",
-    "@ai-sdk/test-server": "2.0.1",
-    "@ai-sdk/xai": "5.0.8",
+    "@ai-sdk/amazon-bedrock": "5.0.96",
+    "@ai-sdk/deepseek": "3.0.54",
+    "@ai-sdk/google": "4.0.82",
+    "@ai-sdk/groq": "4.0.50",
+    "@ai-sdk/huggingface": "2.0.57",
+    "@ai-sdk/moonshotai": "3.0.58",
+    "@ai-sdk/openai": "4.0.77",
+    "@ai-sdk/test-server": "2.0.2",
+    "@ai-sdk/xai": "5.0.10",
     "@edge-runtime/vm": "^5.0.0",
     "@smithy/eventstream-codec": "^4.3.3",
     "@smithy/util-utf8": "^4.3.3",

package/src/prompt/file-part-data.ts

@@ -24,7 +24,10 @@ type ConvertResult = {
   mediaType: string | undefined;
 };
 
-function convertUrlToFilePartData(url: URL): ConvertResult {
+function convertUrlToFilePartData(
+  url: URL,
+  originalUrl?: string,
+): ConvertResult {
   if (url.protocol === 'data:') {
     const { mediaType, base64Content } = splitDataUrl(url.toString());
 
@@ -38,7 +41,10 @@ function convertUrlToFilePartData(url: URL): ConvertResult {
     return { data: { type: 'data', data: base64Content }, mediaType };
   }
 
-  return { data: { type: 'url', url }, mediaType: undefined };
+  return {
+    data: { type: 'url', url, ...(originalUrl != null ? { originalUrl } : {}) },
+    mediaType: undefined,
+  };
 }
 
 function convertUrlStringToFilePartData(content: string): ConvertResult {
@@ -98,7 +104,7 @@ export function convertToLanguageModelV4FilePart(
         }
         return convertInlineDataToFilePartData(content.data);
       case 'url':
-        return convertUrlToFilePartData(content.url);
+        return convertUrlToFilePartData(content.url, content.originalUrl);
       case 'reference':
         return {
           data: { type: 'reference', reference: content.reference },

package/src/util/download/download.ts

@@ -3,7 +3,7 @@ import {
   DownloadError,
   readResponseWithSizeLimit,
   DEFAULT_MAX_DOWNLOAD_SIZE,
-  fetchWithValidatedRedirects,
+  fetchUntrustedUrl,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
 } from '@ai-sdk/provider-utils';
@@ -36,7 +36,7 @@ export const download = async ({
       getRuntimeEnvironmentUserAgent(),
     );
 
-    const response = await fetchWithValidatedRedirects({
+    const response = await fetchUntrustedUrl({
       url: urlText,
       headers,
       abortSignal,