ai 7.0.85 → 7.0.86

package/docs/03-agents/06-tool-approvals.mdx

@@ -319,9 +319,12 @@ Every serverless instance that might handle a request needs the same secret, sin
 - The secret is never sent to the client or included in the stream
 
 <Note>
-  `experimental_toolApprovalSecret` is not yet supported on `WorkflowAgent`. For
-  durable workflows, the workflow runtime provides its own persistence layer
-  that can be used to verify approvals.
+  `WorkflowAgent` also supports `experimental_toolApprovalSecret`. It signs in
+  a workflow step before writing the durable approval request. Pass an
+  environment variable reference, such as
+  `{ environmentVariable: 'TOOL_APPROVAL_SECRET' }`, so the raw secret is read
+  only inside signing and verification steps. Only the signature is persisted
+  and sent to the client.
 </Note>
 
 ## Related APIs

package/docs/03-agents/07-workflow-agent.mdx

@@ -354,6 +354,49 @@ const agent = new WorkflowAgent({
 
 Because the workflow is durable, the approval request survives process restarts — the user can approve hours later and the agent will resume.
 
+### Signed Tool Approvals
+
+Client-supplied message history can be modified before it is replayed to the
+workflow. For tools that perform sensitive operations, configure
+`experimental_toolApprovalSecret` to authenticate approval requests:
+
+```ts highlight="4"
+const agent = new WorkflowAgent({
+  model: 'anthropic/claude-sonnet-4-6',
+  experimental_toolApprovalSecret: {
+    environmentVariable: 'TOOL_APPROVAL_SECRET',
+  },
+  tools: {
+    bookFlight: tool({
+      description: 'Book a flight',
+      inputSchema: z.object({ flightId: z.string() }),
+      needsApproval: true,
+      execute: bookFlightStep,
+    }),
+  },
+});
+```
+
+The agent HMAC-signs the approval ID, tool call ID, tool name, and validated
+input. When approved message history is replayed, a missing or invalid
+signature prevents the tool from executing. The signature is preserved through
+the durable model-call stream, `createModelCallToUIChunkTransform()`,
+`addToolApprovalResponse()`, and `convertToModelMessages()`.
+
+Use a high-entropy secret of at least 32 bytes and make the same secret
+available to every worker that can issue or resume an approval. Keep old keys
+available while approvals signed with them are pending; changing the secret
+invalidates those pending approvals.
+
+`WorkflowAgent` passes only the environment variable name into signing and
+verification steps. Each step reads the secret from its local environment, and
+the raw value is never included in step arguments, durable stream parts,
+callbacks, or telemetry events. Configure the environment variable on every
+worker, and do not put the secret value in `runtimeContext` or `toolsContext`.
+
+You can also provide `experimental_toolApprovalSecret` to `agent.stream()`.
+The stream-level value overrides the constructor default.
+
 ## Loop Control
 
 Control how many steps the agent can take:

package/docs/03-ai-sdk-harnesses/02-harness-agent.mdx

@@ -526,6 +526,10 @@ console.log(preparation.identity);
 - `sandboxConfig`: sandbox working-directory and lifecycle hook configuration.
 - `telemetry`, `debug`, and `onLog`: observability and diagnostics.
 
+Telemetry reports each turn's resolved model, instructions, and active
+host-defined tools. Skills are adapter context and do not have a corresponding
+AI SDK telemetry field, so they are not included in standard telemetry events.
+
 Adapter-specific settings belong on the adapter factory, for example
 `createCodex({ reasoningEffort: 'high' })`.
 

package/docs/07-reference/04-ai-sdk-workflow/01-workflow-agent.mdx

@@ -136,6 +136,13 @@ To see `WorkflowAgent` in action, check out [these examples](#examples).
       description:
         'Default sandbox session passed to tool descriptions and execution as `experimental_sandbox`, and exposed to `prepareStep`. Per-stream values override this default.',
     },
+    {
+      name: 'experimental_toolApprovalSecret',
+      type: 'WorkflowToolApprovalSecret',
+      isOptional: true,
+      description:
+        'Workflow-safe reference to the environment variable containing the secret used to HMAC-sign tool approval requests and verify approved message history before tool execution. Only the environment variable name crosses workflow boundaries; the secret is read inside signing and verification steps. Per-stream values override this default.',
+    },
     {
       name: 'prepareStep',
       type: 'PrepareStepCallback',
@@ -559,6 +566,13 @@ const result = await agent.stream({
       description:
         'Sandbox session passed to tool descriptions and execution as `experimental_sandbox`, and exposed to `prepareStep`. Overrides the constructor default.',
     },
+    {
+      name: 'experimental_toolApprovalSecret',
+      type: 'WorkflowToolApprovalSecret',
+      isOptional: true,
+      description:
+        'Workflow-safe reference to the environment variable containing the secret used to HMAC-sign tool approval requests and verify approved message history before tool execution. Only the environment variable name crosses workflow boundaries; the secret is read inside signing and verification steps. Overrides the constructor default.',
+    },
     {
       name: 'telemetry',
       type: 'TelemetryOptions',
@@ -922,6 +936,9 @@ import { z } from 'zod';
 
 const agent = new WorkflowAgent({
   model: 'anthropic/claude-sonnet-4-6',
+  experimental_toolApprovalSecret: {
+    environmentVariable: 'TOOL_APPROVAL_SECRET',
+  },
   tools: {
     bookFlight: tool({
       description: 'Book a flight',
@@ -936,6 +953,14 @@ const agent = new WorkflowAgent({
 });
 ```
 
+When `experimental_toolApprovalSecret` is configured, each approval request is
+signed over its approval ID, tool call ID, tool name, and validated input.
+Replayed approvals with a missing or invalid signature do not execute the tool.
+The signature is preserved in the durable stream and UI message history, while
+only the environment variable name crosses workflow boundaries. Signing and
+verification steps read the raw secret from their local environment and do not
+serialize it. A stream-level reference overrides the constructor value.
+
 ### Agent with Lifecycle Callbacks
 
 ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.85",
+  "version": "7.0.86",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,7 +42,7 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.69",
+    "@ai-sdk/gateway": "4.0.70",
     "@ai-sdk/provider": "4.0.9",
     "@ai-sdk/provider-utils": "5.0.34"
   },