chore: update ai-sdk family and node pin - #129

Merged
ThomasK33 merged 2 commits into
mainfrom
deps-batch-aug27
Aug 27, 2026
Merged

chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom
deps-batch-aug27

Conversation

@ThomasK33

@ThomasK33ThomasK33 commented Aug 27, 2026•
edited
Loading

Copy link
Copy Markdown
Member

Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.

Dependency bumps

PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments

Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).

Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).

Upstream changelog review

Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:

  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.

Adaptation: node 26.8 test scheduling fix

The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.

Validation

  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.

Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh

@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33

ThomasK33 commented Aug 27, 2026

Copy link
Copy Markdown
MemberAuthor

@codex review

@ThomasK33

ThomasK33 commented Aug 27, 2026

Copy link
Copy Markdown
MemberAuthor

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connectorBot commented Aug 27, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Swish!

Reviewed commit:836f0a2c56

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

chatgpt-codex-connectorBot commented Aug 27, 2026

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit:836f0a2c56

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ThomasK33
ThomasK33 added this pull request to the merge queueAug 27, 2026
Merged via the queue into main with commit 0dcd3f7Aug 27, 2026
7 checks passed
@ThomasK33
ThomasK33 deleted the deps-batch-aug27 branch August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore: update ai-sdk family and node pin - #129
Merged
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Aug 27, 2026
Merged
chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Conversation
@ThomasK33
@ThomasK33ThomasK33
commented
Aug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Member
Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.
Dependency bumps
PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments
Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).
Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).
Upstream changelog review
Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:
  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.
Adaptation: node 26.8 test scheduling fix
The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.
Validation
  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex review
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex security review
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Swish!
Reviewed commit:836f0a2c56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Security review completed. No security issues were found in this pull request.
Reviewed commit:836f0a2c56
View security finding report
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
@ThomasK33
ThomasK33
added this pull request to the merge queueAug 27, 2026

Merged
via the queue into
main
with commit 0dcd3f7Aug 27, 2026

7 checks passed

@ThomasK33
ThomasK33
deleted the

deps-batch-aug27

branch
August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: update ai-sdk family and node pin - #129
Merged
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Aug 27, 2026
Merged
chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Conversation
@ThomasK33
@ThomasK33ThomasK33
commented
Aug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Member
Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.
Dependency bumps
PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments
Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).
Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).
Upstream changelog review
Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:
  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.
Adaptation: node 26.8 test scheduling fix
The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.
Validation
  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex review
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex security review
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Swish!
Reviewed commit:836f0a2c56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Security review completed. No security issues were found in this pull request.
Reviewed commit:836f0a2c56
View security finding report
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
@ThomasK33
ThomasK33
added this pull request to the merge queueAug 27, 2026

Merged
via the queue into
main
with commit 0dcd3f7Aug 27, 2026

7 checks passed

@ThomasK33
ThomasK33
deleted the

deps-batch-aug27

branch
August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: update ai-sdk family and node pin - #129
Merged
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Aug 27, 2026
Merged
chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Conversation
@ThomasK33
@ThomasK33ThomasK33
commented
Aug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Member
Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.
Dependency bumps
PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments
Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).
Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).
Upstream changelog review
Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:
  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.
Adaptation: node 26.8 test scheduling fix
The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.
Validation
  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex review
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex security review
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Swish!
Reviewed commit:836f0a2c56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Security review completed. No security issues were found in this pull request.
Reviewed commit:836f0a2c56
View security finding report
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
@ThomasK33
ThomasK33
added this pull request to the merge queueAug 27, 2026

Merged
via the queue into
main
with commit 0dcd3f7Aug 27, 2026

7 checks passed

@ThomasK33
ThomasK33
deleted the

deps-batch-aug27

branch
August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore: update ai-sdk family and node pin - #129
Merged
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Aug 27, 2026
Merged
chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Conversation
@ThomasK33
@ThomasK33ThomasK33
commented
Aug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Member
Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.
Dependency bumps
PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments
Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).
Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).
Upstream changelog review
Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:
  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.
Adaptation: node 26.8 test scheduling fix
The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.
Validation
  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex review
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex security review
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Swish!
Reviewed commit:836f0a2c56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Security review completed. No security issues were found in this pull request.
Reviewed commit:836f0a2c56
View security finding report
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
@ThomasK33
ThomasK33
added this pull request to the merge queueAug 27, 2026

Merged
via the queue into
main
with commit 0dcd3f7Aug 27, 2026

7 checks passed

@ThomasK33
ThomasK33
deleted the

deps-batch-aug27

branch
August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: update ai-sdk family and node pin - #129
Merged
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Aug 27, 2026
Merged
chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Conversation
@ThomasK33
@ThomasK33ThomasK33
commented
Aug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Member
Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.
Dependency bumps
PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments
Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).
Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).
Upstream changelog review
Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:
  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.
Adaptation: node 26.8 test scheduling fix
The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.
Validation
  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex review
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex security review
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Swish!
Reviewed commit:836f0a2c56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Security review completed. No security issues were found in this pull request.
Reviewed commit:836f0a2c56
View security finding report
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
@ThomasK33
ThomasK33
added this pull request to the merge queueAug 27, 2026

Merged
via the queue into
main
with commit 0dcd3f7Aug 27, 2026

7 checks passed

@ThomasK33
ThomasK33
deleted the

deps-batch-aug27

branch
August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: update ai-sdk family and node pin - #129
Merged
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Aug 27, 2026
Merged
chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Conversation
@ThomasK33
@ThomasK33ThomasK33
commented
Aug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Member
Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.
Dependency bumps
PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments
Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).
Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).
Upstream changelog review
Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:
  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.
Adaptation: node 26.8 test scheduling fix
The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.
Validation
  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex review
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex security review
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Swish!
Reviewed commit:836f0a2c56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Security review completed. No security issues were found in this pull request.
Reviewed commit:836f0a2c56
View security finding report
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
@ThomasK33
ThomasK33
added this pull request to the merge queueAug 27, 2026

Merged
via the queue into
main
with commit 0dcd3f7Aug 27, 2026

7 checks passed

@ThomasK33
ThomasK33
deleted the

deps-batch-aug27

branch
August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore: update ai-sdk family and node pin - #129
Merged
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Aug 27, 2026
Merged
chore: update ai-sdk family and node pin#129
ThomasK33 merged 2 commits into
mainfrom 
deps-batch-aug27
Conversation
@ThomasK33
@ThomasK33ThomasK33
commented
Aug 27, 2026•

edited

Loading

Copy link


Copy Markdown

Member
Routine anti-rot batch update: AI SDK family (minor/patch only) plus the Node toolchain pin.
Dependency bumps
PackageOldNewWhere
ai^7.0.79^7.0.83agent (dev), provider (dev), release-please-ai (dep)
@ai-sdk/anthropic^4.0.42^4.0.44provider (dep), release-please-ai (dep)
@ai-sdk/openai-compatible^3.0.37^3.0.39provider (dep)
@ai-sdk/provider-utils^5.0.30^5.0.32sandbox (dev)
@ai-sdk/react4.0.824.0.86agent (dev, exact pin preserved)
@ai-sdk/harness^1.0.87^1.0.91sandbox (dev)
@ai-sdk/harness-claude-code^1.0.90^1.0.94sandbox (dev)
@ai-sdk/tui^1.0.80^1.0.84sandbox (dev)
node (mise pin)26.7.026.8.1mise.toml, mise.lock, ci.yml matrix + comments
Published peerDependency ranges are untouched (ai ^7.0.0 in agent/provider; @ai-sdk/harness ^1.0.0 and @ai-sdk/provider-utils ^5.0.0 in sandbox). typescript intentionally not touched (7.x deferred per #99).
Incidental: pnpm install auto-appended transitive @ai-sdk/mcp@2.0.39 to minimumReleaseAgeExclude in pnpm-workspace.yaml (same pattern as existing entries).
Upstream changelog review
Patch-only across the range; no dev-API/breaking changes affecting our usage (sandbox imports only HarnessV1SandboxProvider / HarnessV1NetworkSandboxSession / HarnessV1PortEndpoint types plus HarnessAgent/createClaudeCode in examples — all unchanged). No code adaptations needed. Notable upstream items:
  • @ai-sdk/harness 1.0.90: hardened credential brokering (applies only with correct ephemeral secret) — internal to the harness bridge.
  • ai 7.0.80–7.0.83: persisted tool-call schema validation, tool-approval denial continuation, mid-stream provider error normalization, stitchable-stream cancellation fix.
Adaptation: node 26.8 test scheduling fix
The Node 26.8.1 CI cell deterministically failed one agent unit test (does not retain the stream when an abort lands while the pause's tool calls are being yielded) that passed on 22/24. Root cause (minimal repro in plain node, bisected across 22 / 26.7.0 / 26.8.1): Node 26.8's whatwg-stream pull path lost a microtask hop (nodejs/node#65138, "cut promise churn in webstreams hot paths"), so the ReadableStream HWM=1 refill pull now resumes the turn generator past its abort checkpoints before a consumer continuation two hops away runs — the test's abort() then landed after the segment had already settled as a healthy retained pause (a documented, designed state: "aborted between segments"), not mid-yield as the test intends. Test-only fix: fire the abort synchronously in the read continuation that observes the tool-call part; the read fulfillment is queued before the refill pull, so the abort deterministically lands while the generator is suspended at the tool-call yield on all supported node versions. No product code changed.
Validation
  • pnpm install, pnpm check (oxfmt + oxlint + typecheck ×4), pnpm -r build, pnpm -r test (agent 316, sandbox 191, all pass), pnpm publint, pnpm attw, actionlint: all green on node 26.8.1.
  • Live e2e (dev.coder.com, temp token, expired after use): 1 passed / 6 failed — every failure is GET /api/experimental/chats/model-configs → 404 (Route not found). This is pre-existing platform drift, not caused by this PR: the identical suite on an origin/main worktree (442faed) with the same token fails identically (6 failed / 1 passed, same 404). The file upload/download round-trip test (no model resolution) passes on both.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
@ThomasK33
chore: update ai-sdk family and node pin
b832471
Change-Id: Ide0d43ed83d90583b7d411c53d357afb2b3c8333
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
test(agent): fire the abort in the read microtask to dodge node 26.8 …
836f0a2
…stream refill run-ahead
Change-Id: I0ae7410e55bed8ef35ea94b7a29b29a9b09e9b2b
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex review
@ThomasK33
ThomasK33
commented
Aug 27, 2026

Copy link


Copy Markdown

MemberAuthor
@codex security review
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Swish!
Reviewed commit:836f0a2c56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Aug 27, 2026

Copy link


Copy Markdown

Security review completed. No security issues were found in this pull request.
Reviewed commit:836f0a2c56
View security finding report
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
@ThomasK33
ThomasK33
added this pull request to the merge queueAug 27, 2026

Merged
via the queue into
main
with commit 0dcd3f7Aug 27, 2026

7 checks passed

@ThomasK33
ThomasK33
deleted the

deps-batch-aug27

branch
August 27, 2026 13:19
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33