Repository navigation
chore: bump ai sdk family to ai 7.0.158 - #432
Conversation
Dependency batch. Each bump is the newest version with at least 24 hours of publish age at bump time (2026-10-31T15:52Z): - ai ^7.0.157 -> ^7.0.158 (devDeps: agent, effect, provider; deps: private release-please-ai) - @ai-sdk/provider 4.0.34 -> 4.0.35 (deps: agent, effect, provider; exact pin, required by ai 7.0.158) - @ai-sdk/anthropic ^4.0.92 -> ^4.0.93 (deps: provider, private release-please-ai) - @ai-sdk/openai-compatible ^3.0.81 -> ^3.0.82 (deps: provider) - @ai-sdk/provider-utils ^5.0.71 -> ^5.0.72 (devDeps: effect, sandbox) - @ai-sdk/harness ^1.0.168 -> ^1.0.169 (devDeps: effect, sandbox) - @ai-sdk/harness-claude-code ^1.0.172 -> ^1.0.173 (devDeps: sandbox) - @ai-sdk/react 4.0.161 -> 4.0.162 (devDeps: agent, exact pin) - @ai-sdk/tui ^1.0.158 -> ^1.0.159 (devDeps: sandbox) - @ai-sdk/gateway 4.0.130 -> 4.0.131 (transitive, exact dep of ai) - @ai-sdk/mcp 2.0.87 -> 2.0.88 (transitive, exact dep of react) API drift: provider-utils 5.0.72 adds three required methods to Experimental_SandboxSession (stat, listDirectory, deleteFile), so the sandbox package failed tsc. CoderWorkspaceSession and its restricted() view now implement them over the transport's exec, like the existing file I/O: stat follows symlinks and returns null for a missing path, listDirectory lists one level (symlinks reported, names moved as NUL-separated base64) and returns null for a missing path, deleteFile removes a symlink itself and returns false for a missing path. Both list and delete reject on the wrong path type. The same release defines that a relative run/spawn workingDirectory resolves against the base directory used for relative file paths, so the session now resolves it with resolveRemotePath. @ai-sdk/provider 4.0.35 adds only standalone model-catalog types (ModelCapabilities and friends): no new union member and no LanguageModelV4 change. Published runtime range changes: @coder/ai-sdk-provider (@ai-sdk/anthropic ^4.0.93, @ai-sdk/openai-compatible ^3.0.82, @ai-sdk/provider 4.0.35), @coder/ai-sdk-agent (@ai-sdk/provider 4.0.35), @coder/ai-sdk-effect (@ai-sdk/provider 4.0.35). Sandbox has no runtime range change. No peerDependencies change. zod stays 4.6.7 and effect 4.1.0, one copy each. Deferred (under 24 hours old): the 2026-10-30T22:17Z wave (ai 7.0.159 and family), effect 4.1.1 and ws 8.22.1. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I7f02205177818f3e91df97c3b486e511da7f56e3 Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3eef80f70e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review round 1 (two P2 findings): - listDirectory pins the bash glob options (unset GLOBIGNORE, dotglob and nullglob on, failglob and nocaseglob off) and globs `*` once, so a login profile that sets dotglob no longer duplicates dotfiles and failglob no longer empties a listing. - stat reads a regular file's size from metadata (`stat -L -c %s`, BSD fallback `stat -L -f %z`) instead of `wc -c`, so a file the workspace user cannot read still stats. Both new integration tests fail without the change. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: Ied7215309f70320494271eee0aed23bb085fd571 Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0030d09c14
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…teFile Review round 2 (two P2 findings): - stat runs `stat -L` (GNU/busybox `-c '%F|%s'`, BSD `-f '%HT|%z'`) in the C locale. stat, listDirectory and deleteFile now treat a path as missing only when the tool reports ENOENT; a symlink loop or a permission error throws instead of returning null/false. - listDirectory enumerates with `find . -mindepth 1 -maxdepth 1 -print0` under pipefail instead of a glob, so a directory it can search but not read throws instead of listing as empty. This also replaces the round 1 glob-option pinning. - deleteFile runs `rm` (stdin /dev/null, no -f) and classifies its error. The new integration tests fail on the previous commit. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I31bd553c456a6c8f7cbfb7879a06a1b32a542656 Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8a9d59202c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review round 3 (three P2 findings): - The ENOENT match is anchored to the end of the diagnostic, where stat/rm print the errno text, so a path that contains "No such file or directory" no longer turns EACCES into missing. - Each stat/listDirectory/deleteFile command starts with `set +e`, so a login profile or BASH_ENV that enables errexit cannot end the shell at the expected-to-fail probe. - BSD `stat -L` falls back to lstat for a link it cannot resolve; its "Symbolic Link" result now also means missing. The new integration tests fail on the previous commit. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I8ec097cc42f221ecedc2fa7623b2efeb39c8584b Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Daily dependency batch (follow-up F60). Each bump is the newest version with at least 24 hours of publish age at bump time, 2026-10-31T15:52Z (from
date -u, re-verified withnpm view <pkg> time --json).Versions landed
ai^7.0.0peers unchanged)@ai-sdk/provider@ai-sdk/anthropic@ai-sdk/openai-compatible@ai-sdk/provider-utils^5.0.0unchanged)@ai-sdk/harness^1.0.0unchanged)@ai-sdk/harness-claude-code@ai-sdk/react@ai-sdk/tui@ai-sdk/gateway@ai-sdk/mcpEvery bumped package depends only on versions in this table (checked with
npm view <pkg>@<v> dependencies). The lockfile diff swaps exactly these 11 entries and adds nothing else. It holds one@ai-sdk/provider(4.0.35), one zod (4.6.7) and one effect (4.1.0).Unchanged: effect 4.1.0, vitest 5.0.5, zod 4.6.7, tsup ^9.0.0, oxlint/@oxlint/plugins ^1.90.0, oxfmt ^0.75.0, @types/node ^26.6.6, ws ^8.22.0 (lockfile 8.22.0), the TypeScript alias pair, all peer ranges,
packageManagerpnpm 11.28.9, Node 26.12.1, mise tools, Actions.Deferred (under 24 hours old at bump time)
ai@ai-sdk/anthropic@ai-sdk/harness@ai-sdk/harness-claude-code@ai-sdk/react@ai-sdk/tui@ai-sdk/gatewayeffectwsThe lockfile resolves none of them. pnpm 11.28.10 is a separate PR.
API drift and code changes
I ran
npm packon the old and new version of every package thatpackages/*/srcimports (ai,@ai-sdk/provider,@ai-sdk/provider-utils,@ai-sdk/anthropic,@ai-sdk/openai-compatible,@ai-sdk/harness), plus harness-claude-code, tui and react, and diffed every.d.tsfile.@ai-sdk/provider-utils5.0.72 adds three required methods toExperimental_SandboxSession:stat,listDirectoryanddeleteFile(new typesSandboxFileStat,SandboxDirectoryEntryand their option types). Without a change,@coder/ai-sdk-sandboxfailstsc:CoderWorkspaceSessionno longer implementsHarnessV1NetworkSandboxSession, andrestricted()misses the methods. Fix (packages/sandbox/src/file-io.ts,coder-workspace-session.ts): the session and itsrestricted()view implement the three methods over the transport'sexec, the same way as the existing file I/O:statrunsstat -L(GNU/busybox-c '%F|%s', BSD-f '%HT|%z') in the C locale. It follows symlinks and needs no read permission. Directory sizes are whatstatreports (the contract leaves them implementation-defined).listDirectorylists one level withfind . -mindepth 1 -maxdepth 1 -print0underpipefail, keeps dotfiles, and reports symlinks assymlinkwithout following them. Login-profile glob options do not apply, and a directory it cannot read rejects. It rejects when the path is not a directory. Names cross the transport as NUL-separated base64, so newlines and spaces in names survive.deleteFilerunsrm(stdin/dev/null, no-f), removes a symlink itself (not its target), and rejects for a directory.null,null,false) only when the tool's diagnostic ends with the ENOENT text, or when BSDstat -Lfalls back to the link itself (its documented behavior for a link it cannot resolve). A symlink loop, a permission error or any other failure rejects with the tool's message. Each command starts withset +e, so a profile that enables errexit cannot change the result.workingDirectoryoption ofrunandspawn, resolves relative paths against one base directory. File I/O already did that.run/spawnpassed a relativeworkingDirectorytocdas is, so it resolved against the SSH start directory. The session now resolves it withresolveRemotePath. A new unit test insession.test.tsfails without this change.integration-local.test.tsrun the three new methods through the fake coder/ssh (real bash) against a temp tree with a dotfile, a name with a newline and a*, a symlink to a directory, a dangling symlink, a symlink loop, a mode-000 file, a mode-0311 directory, a child of a mode-0600 directory, a path that contains the words "No such file or directory", a stand-in BSDstat, andBASH_ENVprofiles that setdotglob failgloborset -e. The permission cases skip when the tests run as root.@ai-sdk/provider4.0.35 adds only standalone model-catalog types (ModelCapabilities,ModelCapability,ModelEntry,ModelProviderOptions,ProviderOptionDefinition(s)). No new union member (finish reasons, stream parts, content, warnings, tool-result outputs) and no new or changed field onLanguageModelV4call options or results. The agent translators and the effect bridge (language-model.ts,errors.ts) need no change.ai7.0.158 only re-exports the two new sandbox types.@ai-sdk/openai-compatible3.0.82 widensapiKey/headerstoResolvable<...>(a value, a function, or a promise). We pass plain values, so behavior is unchanged.@ai-sdk/anthropic4.0.93 changes only/internal(getModelCapabilitiesmoved to a model catalog), which we do not import. harness, harness-claude-code and tui have no.d.tschange. react 4.0.162 exportsMCPAppRendereras stable (we do not use it).packages/sandbox/src/EGM.mdlists the new methods and their behavior.Review
Round 1 (head 3eef80f): the normal review raised two P2 findings, both fixed in 0030d09 with tests that fail on 3eef80f: login-profile glob options could duplicate or hide
listDirectoryentries, andstatneeded read permission (wc -c). The security review on 3eef80f found no issues.Round 2 (head 0030d09): two more P2 findings, both fixed in 8a9d592 with tests that fail on 0030d09:
listDirectorylisted an unreadable directory as empty, andstatreturnednullfor a symlink loop or a permission error. I changed the design instead of patching each case: the three methods now treat only ENOENT as missing, andlistDirectoryenumerates withfindinstead of a glob. The security review on 0030d09 found no issues.Round 3 (head 8a9d592): three more P2 findings in the same area, all fixed in ce806f3 with tests that fail on 8a9d592: the ENOENT match also searched the echoed path, an errexit-enabling profile ended the shell before the probe was classified, and BSD
stat -Lreports a dangling link instead of failing. The security review on 8a9d592 found no issues. Round 4 (head ce806f3): the normal review found no major issues and the security review found no security issues. Total: 4 review rounds.Advisor pass (clean-context sub-agent, given the goal, diff, findings and test results): "ready with tracked follow-ups". It found no blocker and confirmed the 24-hour ages, the upstream contract match, path quoting and that
deleteFilecannot remove a directory tree. Its notes: the BSDstat -fbranch runs here only against a stand-instat(no macOS CI cell), and the sandbox peer stays^5.0.0on purpose (the class only adds members, so older provider-utils types still accept it).Published runtime range changes
@coder/ai-sdk-provider@ai-sdk/anthropic^4.0.93,@ai-sdk/openai-compatible^3.0.82,@ai-sdk/provider4.0.35@coder/ai-sdk-agent@ai-sdk/provider4.0.35@coder/ai-sdk-effect@ai-sdk/provider4.0.35@coder/ai-sdk-sandboxNo
peerDependencieschange. The held effect release PR #325 (effect 0.1.0) will pick up the@ai-sdk/provider4.0.35 pin. The provider and agent releases from this change reach npm before #325 merges, because #325 is held for owner npm steps.Validation
Toolchain: mise Node 26.12.1 (
node --versioninsidepnpm execprints v26.12.1), pnpm 11.28.9.minimumReleaseAge: 1440with theminimumReleaseAgeExcludeblock removed (no@coder/*npm pins exist),pnpm install,pnpm dedupe(already up to date), thenpnpm-workspace.yamlrestored byte for byte. Every added lockfile version is at least 24.2 hours old at bump time.rm -rf node_modules && CI=true pnpm install --frozen-lockfilewith the default store: passed.pnpm -r build,pnpm check(oxfmt, oxlint, typecheck),pnpm -r test(provider 22, release-please-ai 15, agent 393, sandbox 205, effect 101 unit tests),pnpm publint,pnpm attw: all pass..agents/skills/verify-agent-stream-exactly-once/check.sh: all scenarios pass, 0 violating runs.coder whoamiok, server v2.38.5-devel; the later commits change only sandbox file I/O, which these suites do not use): agentpnpm exec vitest run test/e2e7/7, effectpnpm exec vitest run test/e2e3/3. No unarchived chats left behind.Verification tier for the sandbox contract claims: verified against the published
@ai-sdk/provider-utils5.0.72.d.ts, and exercised locally through the fake coder transport (real bash). Not exercised against a live Coder workspace or a macOS (BSD userland) workspace.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high