ai 7.0.147 → 7.0.148

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # ai
 
+## 7.0.148
+
+### Patch Changes
+
+- Updated dependencies [b089ce8]
+- Updated dependencies [39a776b]
+- Updated dependencies [f1b550e]
+  - @ai-sdk/provider-utils@5.0.65
+  - @ai-sdk/gateway@4.0.121
+
 ## 7.0.147
 
 ### Patch Changes

package/dist/index.js

@@ -1174,7 +1174,7 @@ function cloneValue(value) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION = "7.0.147";
+const VERSION = "7.0.148";
 //#endregion
 //#region src/util/download/download.ts
 /**

package/dist/internal/index.js

@@ -111,7 +111,7 @@ function asAsyncIterableStream(stream) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION = "7.0.147";
+const VERSION = "7.0.148";
 //#endregion
 //#region src/util/download/download.ts
 /**

package/docs/03-ai-sdk-core/18-tools.mdx

@@ -107,6 +107,7 @@ Raw runtime instances need their respective adapters; a custom
 | `sandbox`          | `Experimental_SandboxSession` | Required session for command execution and file operations.                                                                   |
 | `workingDirectory` | `string`                      | Optional absolute starting directory for each command, created if needed. When omitted, uses the sandbox's default directory. |
 | `maxOutputLength`  | `number`                      | Positive integer limiting characters retained from each output stream before a truncation notice. Defaults to `30000`.        |
+| `timeout`          | `number`                      | Optional timeout per command execution, in milliseconds (integer from `1` to `2147483647`). No tool-level timeout by default. |
 
 The model calls the tool with `{ command: string }` and receives
 `{ stdout, stderr, exitCode }`. Nonzero exit codes are returned so the model can
@@ -114,6 +115,24 @@ inspect failures and recover. AI SDK cancellation is forwarded to the session.
 Output truncation happens after execution and does not limit execution memory or
 duration.
 
+### Command timeout
+
+Set `timeout` to cancel commands that run longer than the configured duration:
+
+```ts
+const bash = await createBashTool({
+  sandbox,
+  timeout: 10_000,
+});
+```
+
+Each command gets a fresh timeout starting when its execution begins. This does
+not include tool initialization or time waiting for model output or approval.
+The timeout is combined with the caller's abort signal; either can cancel the
+command. The sandbox must honor cancellation. Its result or error is passed
+through; for example, just-bash returns exit code `124` when a running command is
+cancelled. SDK and sandbox timeouts still apply when this option is omitted.
+
 ### Files and lifecycle
 
 Commands use the sandbox's default working directory unless `workingDirectory`

package/docs/03-ai-sdk-harnesses/02-harness-agent.mdx

@@ -106,6 +106,38 @@ try {
 }
 ```
 
+### Image Inputs
+
+For harness adapters that support images, you can include an image as a file part
+in the latest user message. Set `mediaType` to the image's MIME type:
+
+```ts
+import { readFileSync } from 'node:fs';
+
+const result = await agent.generate({
+  session,
+  messages: [
+    {
+      role: 'user',
+      content: [
+        {
+          type: 'text',
+          text: 'Describe the image in one sentence.',
+        },
+        {
+          type: 'file',
+          mediaType: 'image/png',
+          data: readFileSync('image.png'),
+        },
+      ],
+    },
+  ],
+});
+```
+
+For image input support, see the
+[adapter capability table](/docs/ai-sdk-harnesses/harness-adapters#adapter-capabilities).
+
 ## Lifecycle Callbacks
 
 Configure lifecycle callbacks on `HarnessAgent` to observe agent calls, model

package/docs/06-advanced/11-secure-url-fetching.mdx

@@ -28,8 +28,8 @@ When the SDK fetches a URL taken from a provider response, it:
 
 - **Rejects private, loopback, and link-local targets** — IPv4 (`10/8`,
   `172.16/12`, `192.168/16`, `127/8`, `169.254/16`, CGNAT, multicast, …) and the
-  equivalent IPv6 ranges, plus `localhost` and `.local`. Non-`http(s)` schemes
-  are rejected too.
+  equivalent IPv6 ranges, plus `localhost`, `.local`, `.localhost`, and
+  `.internal` hostnames. Non-`http(s)` schemes are rejected too.
 - **Re-validates every redirect hop** — a URL that passes but then redirects to
   an internal address is blocked; the redirect is never followed blindly.
 - **Validates DNS at connection time on Node.js** — every resolved address is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.147",
+  "version": "7.0.148",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,20 +42,20 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.120",
+    "@ai-sdk/gateway": "4.0.121",
     "@ai-sdk/provider": "4.0.31",
-    "@ai-sdk/provider-utils": "5.0.64"
+    "@ai-sdk/provider-utils": "5.0.65"
   },
   "devDependencies": {
-    "@ai-sdk/amazon-bedrock": "5.0.120",
-    "@ai-sdk/deepseek": "3.0.69",
-    "@ai-sdk/google": "4.0.101",
-    "@ai-sdk/groq": "4.0.66",
-    "@ai-sdk/huggingface": "2.0.74",
-    "@ai-sdk/moonshotai": "3.0.73",
-    "@ai-sdk/openai": "4.0.98",
+    "@ai-sdk/amazon-bedrock": "5.0.121",
+    "@ai-sdk/deepseek": "3.0.70",
+    "@ai-sdk/google": "4.0.102",
+    "@ai-sdk/groq": "4.0.67",
+    "@ai-sdk/huggingface": "2.0.75",
+    "@ai-sdk/moonshotai": "3.0.74",
+    "@ai-sdk/openai": "4.0.99",
     "@ai-sdk/test-server": "2.0.4",
-    "@ai-sdk/xai": "5.0.26",
+    "@ai-sdk/xai": "5.0.27",
     "@edge-runtime/vm": "^5.0.0",
     "@smithy/eventstream-codec": "^4.3.3",
     "@smithy/util-utf8": "^4.3.3",