Major Changes

• 1949571: feat(ai): make experimental_telemetry stable
• b3976a2: initial version

Patch Changes

• 19736ee: feat(ai): rename onStepFinish to onStepEnd

• 382d53b: refactoring: rename context to runtimeContext

• b567a6c: dependency updates

• b402b95: WorkflowAgent now rejects system messages inside prompt or messages by default, matching the behavior of generateText/streamText. Set allowSystemInMessages: true to opt in to the previous behavior.

• eea8d98: refactoring: rename tool execution events

• 98627e5: feat(ai): remove onChunk event from telemetry

• ca446f8: feat: flexible tool descriptions

• 75763b0: agents: tag outgoing requests with an ai-sdk-agent user-agent segment for usage attribution (tool-loop, workflow)

• 9f0e36c: trigger release for all packages after provenance setup

• 29d8cf4: feat(ai): rename the core-event types

• 7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.

• a0ca584: fix (workflow): preserve invalid tool calls as errors instead of emitting synthetic success results

• eba685c: Remove maxSteps option from WorkflowAgent. Use stopWhen with stop conditions like isStepCount() instead.

• 0c4c275: trigger initial canary release

• 258c093: chore: ensure consistent import handling and avoid import duplicates or cycles

• 334ae5d: Update step performance metrics with explicit effective, input, output, and total token throughput fields.

• b8396f0: trigger initial beta release

• c3d4019: chore(ai): rename 'TelemetrySettings' to 'TelemetryOptions'

• 083947b: feat(ai): separate toolsContext from context

• bae5e2b: fix(security): re-validate tool approvals from client message history before execution

  The approval-replay path in generateText/streamText (and WorkflowAgent.stream) reconstructed approved tool calls from the client-supplied messages array and executed them without re-validating input against the tool's schema or re-applying the approval policy. A client could forge an assistant message with a pre-approved tool-call part and have the server execute a tool with attacker-chosen arguments.

  The replay path now validates HMAC signature (when experimental_toolApprovalSecret is configured), re-validates tool-call input against the tool's input schema, and re-resolves the approval policy before execution.

• d775a57: feat: introduce Instructions type

• f32c750: refactoring(ai): simplify mergeAbortSignals

• bf6c17b: Add id property to WorkflowAgent for telemetry identification, matching ToolLoopAgent's API surface.

• 3ca592a: Add prompt as an alternative to messages in WorkflowAgent.stream(), matching the AgentCallParameters pattern from ToolLoopAgent.

• eb49d29: Add constructor-level defaults for stopWhen, activeTools, output, experimental_repairToolCall, and experimental_download to WorkflowAgent, matching ToolLoopAgent's pattern. Stream-level values override constructor defaults.

• 0455f24: Enrich WorkflowAgent callback event shapes to align with ToolLoopAgent:

  • Add stepNumber to onToolCallStart and onToolCallFinish
  • Add steps (previous step results) to onStepStart
  • Adopt discriminated union pattern (success: true/false) for onToolCallFinish
  • Add durationMs to onToolCallFinish

• 43543dc: Add experimental_sandbox support to WorkflowAgent. The sandbox is passed to tool execution, configurable on the constructor or per stream, and available to prepareStep for per-step overrides.

• 0e462a7: Use LanguageModel type for model parameter, aligning with ToolLoopAgent. Remove async factory model form. Rename callback types to use WorkflowAgentOn* prefix.

• 39dad72: feat(workflow): add stable telemetry integration support to WorkflowAgent and remove legacy telemetry options.

• 1e4b350: Honor tool.toModelOutput in WorkflowAgent.

  WorkflowAgent now routes successful local, provider-executed, and approved tool results through each tool's optional toModelOutput hook, matching generateText, streamText, and ToolLoopAgent. Previously the hook was ignored and results were always serialized as text or json.

  Internally exports the shared tool-result model-output helpers from ai/internal, and uses the shared getErrorMessage behavior for workflow tool error results.

• c3a6524: Add a stepNumber option to doStreamStep so callers can create StepResult objects with the correct step number.

• 907e002: fix (workflow): forward provider-executed tool approvals to the provider on resume

  WorkflowAgent stripped every tool-approval-request and tool-approval-response part from the messages when resuming after a tool approval, regardless of whether the tool was locally or provider-executed. For provider-executed tools (e.g. MCP via the OpenAI Responses API) this silently dropped the approval before convertToLanguageModelPrompt could forward it, so the provider never learned of the approval and the tool was never executed. Local approvals are still executed and stripped, while provider-executed approvals are now preserved and forwarded to the provider, matching the discriminator core's streamText already uses. This is the inverse of the bug fixed in #14289.

• 1d56275: feat(workflow): add runtimeContext and toolsContext to WorkflowAgent.

  runtimeContext is shared agent state that flows through prepareCall, prepareStep, step results, and onFinish. toolsContext is a per-tool map; each tool receives its own validated entry as context, validated against tool.contextSchema when defined. The previous experimental_context option (and corresponding fields on related callbacks and option types) has been removed — use runtimeContext for shared state and toolsContext for per-tool values. Context values in WorkflowAgent should be serializable because they can cross workflow and step boundaries.

• 81e68da: Fix stepNumber on telemetry events emitted by WorkflowAgent.stream so per-step telemetry integrations (e.g. @ai-sdk/devtools) correctly key state per step.

• 69d7128: fix(workflow): reuse the core tool-approval validation in WorkflowAgent

  WorkflowAgent.stream previously reconstructed approved tool calls with a copy of the core collection logic and validated them inline. Because the logic was duplicated, it could drift from the hardened generateText/streamText implementation. WorkflowAgent now collects approvals via the shared collectToolApprovals and re-validates each one through the shared validateApprovedToolApprovals (input-schema re-validation, HMAC signature verification when configured, and approval-policy re-resolution) in addition to its existing needsApproval guard, so a client-forged approval cannot execute a tool with unvalidated input. The duplicated collector was removed; collectToolApprovals and validateApprovedToolApprovals are now exported from ai/internal.

• fbea042: refactor: replace duplicate filterTools/filterToolSet with shared experimental_filterActiveTools from ai