fix(ai,policy-opa): use own-property checks when resolving per-tool approvals (#16900)

## What

Tool sets, tool contexts, and per-tool approval maps are indexed by
names that come from model output or client-supplied message history.
Plain bracket access (`tools[name]`) resolves names that match inherited
object properties (`constructor`, `toString`, `valueOf`, `__proto__`) to
values on `Object.prototype` instead of `undefined`, which can slip past
the "unknown tool" / "unconfigured approval" guards.

This routes those lookups through a new `getOwn` helper (own-property
check via `Object.hasOwn`), builds the human-in-the-loop
approval-matching maps with a null prototype, and adds the same
own-property guards in policy-opa `wrapMcpTools` and `shadow`.

Behavior is identical for every real tool set, since tool names are
always own properties. The only change is that an inherited-property
name now reads as absent.

## Flow

Happy path (real tool named `weather`, unchanged):
1. Model or client references `weather`.
2. `getOwn(tools, "weather")` finds it as an own property and returns
the tool.
3. Approval, validation, and execution proceed exactly as before.

Unhappy path (name collides with a prototype member, e.g.
`constructor`):
1. Model or client references `constructor`, which is not a registered
tool.
2. Before: `tools["constructor"]` returned
`Object.prototype.constructor` (a function), passed the `!= null` guard,
and could be treated as a tool or invoked as an approval callback.
3. After: `getOwn(tools, "constructor")` returns `undefined`, so the
name routes to the safe "no such tool" / "unconfigured, apply fallback"
branch (`NoSuchToolError`, denied/user-approval fallback, etc.).

## Notes

Covers the approval path (per-tool resolution and replay re-validation),
tool-call parsing, execution, streaming callbacks, and UI message
conversion/validation. Includes a `getOwn` unit test plus regression
tests in `wrap-mcp-tools`, `shadow`, `resolve-tool-approval`, and
`collect-tool-approvals`.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: dnukumamras

.changeset/tool-approval-inherited-property-names.md

@@ -0,0 +1,9 @@
+---
+'@ai-sdk/policy-opa': patch
+'ai': patch
+---
+
+Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. `constructor`, `toString`, `valueOf`, `__proto__`) are treated as unconfigured/absent.
+
+- `@ai-sdk/policy-opa`: `wrapMcpTools` builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and `shadow` guards its per-tool map lookup the same way.
+- `ai`: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (`getOwn`), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (`collectToolApprovals`) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

packages/ai/src/generate-text/collect-tool-approvals.test.ts

@@ -335,6 +335,44 @@ describe('collectToolApprovals', () => {
     );
   });
 
+  it.each(['toString', 'constructor', 'valueOf', '__proto__'])(
+    'should throw for an unknown approvalId that matches the inherited object property "%s"',
+    approvalId => {
+      // Guards against inherited-property lookups: an approvalId that is not an
+      // own key of the request map must be treated as unknown, not resolved to
+      // a value on Object.prototype.
+      expect(() =>
+        collectToolApprovals({
+          messages: [
+            {
+              role: 'assistant',
+              content: [
+                {
+                  type: 'tool-call',
+                  toolCallId: 'call-1',
+                  toolName: 'tool1',
+                  input: { value: 'test-input' },
+                },
+              ],
+            },
+            {
+              role: 'tool',
+              content: [
+                {
+                  type: 'tool-approval-response',
+                  approvalId, // no request with this id exists
+                  approved: true,
+                },
+              ],
+            },
+          ],
+        }),
+      ).toThrow(
+        `Tool approval response references unknown approvalId: ${JSON.stringify(approvalId)}`,
+      );
+    },
+  );
+
   it('should work for 2 approvals, 2 rejections, 1 approval with tool result, 1 rejection with tool result', () => {
     const result = collectToolApprovals({
       messages: [

packages/ai/src/generate-text/collect-tool-approvals.ts

@@ -36,8 +36,19 @@ export function collectToolApprovals<TOOLS extends ToolSet>({
     };
   }
 
-  // gather tool calls and prepare lookup
-  const toolCallsByToolCallId: Record<string, TypedToolCall<TOOLS>> = {};
+  // gather tool calls and prepare lookup.
+  //
+  // These maps are keyed by client-supplied ids (`toolCallId`, `approvalId`)
+  // from the message history. Using `Object.create(null)` gives them no
+  // prototype, so an id that matches an inherited object property (e.g.
+  // `toString`, `constructor`, `__proto__`) is treated as absent instead of
+  // resolving to a prototype value and slipping past the `== null` guards
+  // below (which would otherwise skip the InvalidToolApproval /
+  // ToolCallNotFound checks).
+  const toolCallsByToolCallId: Record<
+    string,
+    TypedToolCall<TOOLS>
+  > = Object.create(null);
   for (const message of messages) {
     if (message.role === 'assistant' && typeof message.content !== 'string') {
       const content = message.content;
@@ -51,7 +62,7 @@ export function collectToolApprovals<TOOLS extends ToolSet>({
 
   // gather approval responses and prepare lookup
   const toolApprovalRequestsByApprovalId: Record<string, ToolApprovalRequest> =
-    {};
+    Object.create(null);
   for (const message of messages) {
     if (message.role === 'assistant' && typeof message.content !== 'string') {
       const content = message.content;
@@ -64,7 +75,9 @@ export function collectToolApprovals<TOOLS extends ToolSet>({
   }
 
   // gather tool results from the last tool message
-  const toolResults: Record<string, TypedToolResult<TOOLS>> = {};
+  const toolResults: Record<string, TypedToolResult<TOOLS>> = Object.create(
+    null,
+  );
   for (const part of lastMessage.content) {
     if (part.type === 'tool-result') {
       toolResults[part.toolCallId] = part as TypedToolResult<TOOLS>;

packages/ai/src/generate-text/execute-tool-call.ts

@@ -13,6 +13,7 @@ import {
   type TimeoutConfiguration,
 } from '../prompt/request-options';
 import type { TelemetryDispatcher } from '../telemetry/telemetry';
+import { getOwn } from '../util/get-own';
 import { mergeAbortSignals } from '../util/merge-abort-signals';
 import { notify } from '../util/notify';
 import { now } from '../util/now';
@@ -83,15 +84,15 @@ export async function executeToolCall<TOOLS extends ToolSet>({
   | undefined
 > {
   const { toolName, toolCallId, input } = toolCall;
-  const tool = tools?.[toolName];
+  const tool = getOwn(tools, toolName);
 
   if (!isExecutableTool(tool)) {
     return undefined;
   }
 
   const context = await validateToolContext({
     toolName,
-    context: toolsContext?.[toolName as keyof typeof toolsContext],
+    context: getOwn(toolsContext, toolName),
     contextSchema: tool.contextSchema,
   });
 

packages/ai/src/generate-text/execute-tools-from-stream.ts

@@ -9,6 +9,7 @@ import type {
 } from '@ai-sdk/provider-utils';
 import type { TimeoutConfiguration } from '../prompt/request-options';
 import type { Telemetry, TelemetryDispatcher } from '../telemetry/telemetry';
+import { getOwn } from '../util/get-own';
 import { executeToolCall } from './execute-tool-call';
 import { resolveToolApproval } from './resolve-tool-approval';
 import type { LanguageModelStreamPart } from './stream-language-model-call';
@@ -95,7 +96,7 @@ export function executeToolsFromStream<
               return;
             }
 
-            const tool = tools?.[chunk.toolName];
+            const tool = getOwn(tools, chunk.toolName);
 
             if (tool == null) {
               // ignore tool calls for tools that are not available,

packages/ai/src/generate-text/generate-text.ts

@@ -50,6 +50,7 @@ import {
   type LanguageModelUsage,
 } from '../types/usage';
 import type { DownloadFunction } from '../util/download/download-function';
+import { getOwn } from '../util/get-own';
 import { mergeAbortSignals } from '../util/merge-abort-signals';
 import { mergeObjects } from '../util/merge-objects';
 import { now as originalNow } from '../util/now';
@@ -717,7 +718,7 @@ export async function generateText<
           const modelOutput = await createToolModelOutput({
             toolCallId: output.toolCallId,
             input: output.input,
-            tool: tools?.[output.toolName],
+            tool: getOwn(tools, output.toolName),
             output:
               output.type === 'tool-result' ? output.output : output.error,
             errorMode: output.type === 'tool-error' ? 'text' : 'none',
@@ -1040,7 +1041,7 @@ export async function generateText<
                   continue; // ignore invalid tool calls
                 }
 
-                const tool = tools?.[toolCall.toolName];
+                const tool = getOwn(tools, toolCall.toolName);
 
                 if (tool == null) {
                   // ignore tool calls for tools that are not available,
@@ -1234,7 +1235,7 @@ export async function generateText<
               // the client tool's result is sent back.
               for (const toolCall of stepToolCalls) {
                 if (!toolCall.providerExecuted) continue;
-                const tool = tools?.[toolCall.toolName];
+                const tool = getOwn(tools, toolCall.toolName);
                 if (tool?.type === 'provider' && tool.supportsDeferredResults) {
                   // Check if this tool call already has a result in the current response
                   const hasResultInResponse = currentModelResponse.content.some(
@@ -1699,7 +1700,7 @@ function asContent<TOOLS extends ToolSet>({
         // result may be deferred to a later turn. In this case, there's no matching tool-call
         // in the current response.
         if (toolCall == null) {
-          const tool = tools?.[part.toolName];
+          const tool = getOwn(tools, part.toolName);
           const supportsDeferredResults =
             tool?.type === 'provider' && tool.supportsDeferredResults;
 

packages/ai/src/generate-text/invoke-tool-callbacks-from-stream.ts

@@ -1,4 +1,6 @@
 import type { Context, ModelMessage, ToolSet } from '@ai-sdk/provider-utils';
+import { createIdMap } from '../util/create-id-map';
+import { getOwn } from '../util/get-own';
 import type { LanguageModelStreamPart } from './stream-language-model-call';
 
 export function invokeToolCallbacksFromStream<
@@ -19,7 +21,7 @@ export function invokeToolCallbacksFromStream<
 }): ReadableStream<LanguageModelStreamPart<TOOLS>> {
   if (tools == null) return stream;
 
-  const ongoingToolCallToolNames: Record<string, string> = {};
+  const ongoingToolCallToolNames: Record<string, string> = createIdMap();
 
   return stream.pipeThrough(
     new TransformStream({
@@ -30,7 +32,7 @@ export function invokeToolCallbacksFromStream<
           case 'tool-input-start': {
             ongoingToolCallToolNames[chunk.id] = chunk.toolName;
 
-            const tool = tools?.[chunk.toolName];
+            const tool = getOwn(tools, chunk.toolName);
             if (tool?.onInputStart != null) {
               await tool.onInputStart({
                 toolCallId: chunk.id,
@@ -45,7 +47,7 @@ export function invokeToolCallbacksFromStream<
 
           case 'tool-input-delta': {
             const toolName = ongoingToolCallToolNames[chunk.id];
-            const tool = tools?.[toolName];
+            const tool = getOwn(tools, toolName);
 
             if (tool?.onInputDelta != null) {
               await tool.onInputDelta({
@@ -62,7 +64,7 @@ export function invokeToolCallbacksFromStream<
 
           case 'tool-call': {
             const toolName = ongoingToolCallToolNames[chunk.toolCallId];
-            const tool = tools?.[toolName];
+            const tool = getOwn(tools, toolName);
 
             delete ongoingToolCallToolNames[chunk.toolCallId];
 

packages/ai/src/generate-text/parse-tool-call.test.ts

@@ -80,6 +80,32 @@ describe('parseToolCall', () => {
     `);
   });
 
+  it('should not treat an inherited object property as a refinement for a tool whose name collides with it', async () => {
+    // `refineToolInput` is keyed by tool name; a tool named after an
+    // Object.prototype member must not resolve to the inherited method and be
+    // invoked as a refiner. With no own entry for `toString`, the raw parsed
+    // input is returned unchanged.
+    const result = await parseToolCall({
+      toolCall: {
+        type: 'tool-call',
+        toolName: 'toString',
+        toolCallId: '123',
+        input: '{"value": "raw"}',
+      },
+      tools: {
+        toString: tool({
+          inputSchema: z.object({ value: z.string() }),
+        }),
+      } as const,
+      repairToolCall: undefined,
+      refineToolInput: { testTool: () => ({ value: 'refined' }) } as any,
+      messages: [],
+      instructions: undefined,
+    });
+
+    expect(result.input).toEqual({ value: 'raw' });
+  });
+
   it('should successfully parse a valid provider-executed dynamic tool call', async () => {
     const result = await parseToolCall({
       toolCall: {

packages/ai/src/generate-text/parse-tool-call.ts

@@ -11,6 +11,7 @@ import { InvalidToolInputError } from '../error/invalid-tool-input-error';
 import { NoSuchToolError } from '../error/no-such-tool-error';
 import { ToolCallRepairError } from '../error/tool-call-repair-error';
 import type { Instructions } from '../prompt';
+import { getOwn } from '../util/get-own';
 import type { DynamicToolCall, TypedToolCall } from './tool-call';
 import type { ToolCallRepairFunction } from './tool-call-repair-function';
 import type { ToolInputRefinement } from './tool-input-refinement';
@@ -66,7 +67,7 @@ export async function parseToolCall<TOOLS extends ToolSet>({
           toolCall,
           tools,
           inputSchema: async ({ toolName }) => {
-            const { inputSchema } = tools[toolName];
+            const inputSchema = getOwn(tools, toolName)?.inputSchema;
             return await asSchema(inputSchema).jsonSchema;
           },
           instructions,
@@ -95,7 +96,7 @@ export async function parseToolCall<TOOLS extends ToolSet>({
     // use parsed input when possible
     const parsedInput = await safeParseJSON({ text: toolCall.input });
     const input = parsedInput.success ? parsedInput.value : toolCall.input;
-    const tool = tools?.[toolCall.toolName];
+    const tool = getOwn(tools, toolCall.toolName);
 
     // TODO AI SDK 6: special invalid tool call parts
     return {
@@ -121,7 +122,7 @@ async function refineParsedToolCallInput<TOOLS extends ToolSet>({
   toolCall: TypedToolCall<TOOLS>;
   refineToolInput: ToolInputRefinement<TOOLS> | undefined;
 }): Promise<TypedToolCall<TOOLS>> {
-  const refine = refineToolInput?.[toolCall.toolName];
+  const refine = getOwn(refineToolInput, toolCall.toolName);
 
   if (refine == null) {
     return toolCall;
@@ -169,7 +170,7 @@ async function doParseToolCall<TOOLS extends ToolSet>({
 }): Promise<TypedToolCall<TOOLS>> {
   const toolName = toolCall.toolName as keyof TOOLS & string;
 
-  const tool = tools[toolName];
+  const tool = getOwn(tools, toolName);
 
   if (tool == null) {
     // provider-executed dynamic tools are not part of our list of tools:

packages/ai/src/generate-text/resolve-tool-approval.test.ts

@@ -338,6 +338,70 @@ describe('resolveToolApproval', () => {
     });
   });
 
+  describe('tool names that match inherited object properties', () => {
+    const createToolCallNamed = (toolName: string) => ({
+      type: 'tool-call' as const,
+      toolCallId: 'call-1',
+      toolName: toolName as never,
+      input: { city: 'Berlin' },
+      dynamic: false as const,
+    });
+
+    // Regression guard for the fix: `toolApproval[toolName]` used to resolve
+    // through the prototype chain, so a tool literally named `constructor`
+    // would pick up `Object.prototype.constructor` (a function) and be invoked
+    // as if it were a per-tool approval callback. With an own-property check it
+    // is treated as unconfigured and honors the configured fallback instead.
+    for (const toolName of ['constructor', 'toString', 'valueOf']) {
+      it(`does not execute a tool named "${toolName}" when the fallback is denied`, async () => {
+        const result = await resolveToolApproval({
+          tools: {
+            [toolName]: tool({ inputSchema: z.object({ city: z.string() }) }),
+          },
+          // simulates the total map produced by wrapMcpTools
+          toolApproval: { [toolName]: 'denied' },
+          toolCall: createToolCallNamed(toolName),
+          messages: [...messages],
+          toolsContext: {},
+          runtimeContext: {},
+        });
+
+        expect(result).toEqual({ type: 'denied' });
+      });
+
+      it(`pauses a tool named "${toolName}" for approval when the fallback is user-approval`, async () => {
+        const result = await resolveToolApproval({
+          tools: {
+            [toolName]: tool({ inputSchema: z.object({ city: z.string() }) }),
+          },
+          toolApproval: { [toolName]: 'user-approval' },
+          toolCall: createToolCallNamed(toolName),
+          messages: [...messages],
+          toolsContext: {},
+          runtimeContext: {},
+        });
+
+        expect(result).toEqual({ type: 'user-approval' });
+      });
+
+      it(`treats an unconfigured tool named "${toolName}" as not-applicable rather than reading the inherited property`, async () => {
+        const result = await resolveToolApproval({
+          tools: {
+            [toolName]: tool({ inputSchema: z.object({ city: z.string() }) }),
+          },
+          // plain object map that does NOT list the colliding name
+          toolApproval: { weather: 'denied' } as never,
+          toolCall: createToolCallNamed(toolName),
+          messages: [...messages],
+          toolsContext: {},
+          runtimeContext: {},
+        });
+
+        expect(result).toEqual({ type: 'not-applicable' });
+      });
+    }
+  });
+
   it('normalizes a user-defined static string approval value before checking tool-defined approval', async () => {
     const toolDefinedNeedsApproval = vi.fn(() => true);