chore: bump ai sdk family, vitest, and @types/node

[ThomasK33]

Summary

Refresh the AI SDK family, Vitest, and Node types to the newest patch/minor versions that met the strict 24-hour npm publish-age rule at the bump. Only five package manifests and the lockfile change.

• Manifests bumped at 2026-09-16T19:29:22Z. npm publication timestamps were fetched immediately beforehand; every added lockfile version was audited afterward. All new versions were already more than 26 hours old at the bump.
• @ai-sdk/provider advances to 4.0.15 only in agent and provider. Effect stays on 4.0.14, matching the exact dependency of published @coder/ai-sdk-provider 0.4.15. Both provider versions in the lockfile are intentional.
• Refresh published provider’s in-range Anthropic/OpenAI-compatible transitives too, while retaining its exact provider pin. No published peer ranges, Coder package pins, toolchain pins, source, examples, or changelogs change.

Versions

Package	Old	New	Scope
@ai-sdk/anthropic	4.0.53	4.0.54	Direct dependency / dev dependency
@ai-sdk/gateway	4.0.81	4.0.82	Transitive
@ai-sdk/harness-claude-code	1.0.114	1.0.116	Direct dependency / dev dependency
@ai-sdk/harness	1.0.110	1.0.112	Direct dependency / dev dependency
@ai-sdk/mcp	2.0.49	2.0.50	Transitive
@ai-sdk/openai-compatible	3.0.48	3.0.49	Direct dependency / dev dependency
@ai-sdk/provider-utils	5.0.40	5.0.41	Direct dependency / dev dependency
@ai-sdk/provider	4.0.14	4.0.15	Agent + provider; Effect remains 4.0.14
@ai-sdk/react	4.0.103	4.0.105	Direct dependency / dev dependency
@ai-sdk/tui	1.0.101	1.0.103	Direct dependency / dev dependency
@types/node	26.5.1	26.6.0	Direct dependency / dev dependency
@vitest/coverage-v8	5.0.0	5.0.1	Direct dependency / dev dependency
@vitest/mocker	5.0.0	5.0.1	Transitive
@vitest/spy	5.0.0	5.0.1	Transitive
ai	7.0.100	7.0.102	Direct dependency / dev dependency
vitest	5.0.0	5.0.1	Direct dependency / dev dependency

Deferred: younger than 24 hours at the bump

Package	Deferred version	npm published at (UTC)
ai	7.0.103	2026-09-16T18:36:07.487Z
@ai-sdk/provider	4.0.16	2026-09-16T18:36:15.101Z
@ai-sdk/provider-utils	5.0.42	2026-09-16T18:36:16.924Z
@ai-sdk/anthropic	4.0.55	2026-09-16T18:36:06.434Z
@ai-sdk/openai-compatible	3.0.50	2026-09-16T18:35:22.876Z
@ai-sdk/harness	1.0.113	2026-09-16T18:35:53.791Z
@ai-sdk/harness-claude-code	1.0.117	2026-09-16T18:35:05.857Z
@ai-sdk/tui	1.0.104	2026-09-16T18:35:09.280Z
@ai-sdk/react	4.0.106	2026-09-16T18:35:25.112Z
@types/node	26.6.1	2026-09-15T20:36:11.000Z
@ai-sdk/mcp	2.0.51	2026-09-16T18:36:07.444Z
@ai-sdk/gateway	4.0.83	2026-09-16T18:35:53.986Z

@types/node 26.6.1 becomes eligible at 2026-09-16T20:36:11Z; this batch was bumped before that cutoff. npm’s latest tag currently points to the 22.x Node types line, so the 26.x timestamp audit is the authority here rather than the outdated output alone.

Out of scope and unchanged: TypeScript 7 (tracking issue #99), pnpm 12 (tracking issue #176), Node 26.9.0, and GitHub Actions. Recheck the age deferrals during the next daily dependency sweep.

Validation

Gate	Final result
mise install	Passed; Node 26.8.2 / pnpm 11.27.0 via mise exec
Age-guarded install + frozen-lockfile reinstall	Passed
Every added lockfile package age	Passed, 16 package versions
pnpm -r outdated	Only age-deferred AI SDK versions and out-of-scope TypeScript; Node types audited separately
pnpm check	Passed: formatting, lint, typecheck
pnpm -r build	Passed
pnpm -r test	640 passed across 30 test files
pnpm publint	Passed
pnpm attw	Passed
coder whoami	Authenticated with ambient credentials on dogfood.cdr.dev
cd packages/agent && npx vitest run test/e2e	7/7 passed, final graph, 31.16 s

The install used command-local minimumReleaseAge=1440 with only @coder/ai-sdk-* excluded because the two unchanged published Coder pins are themselves younger than 24 hours. No Coder versions were added or bumped, and every added lockfile version passed the independent timestamp audit. No persistent configuration was changed.

Live e2e terminal evidence

Final live run on the final installed dependency graph; screenshot shows all seven tests and the native zero exit code. The terminal cast was also retained for the video replay attachment.

---

📋 Implementation Plan

1. Update only eligible patch/minor dependencies and their in-range AI SDK transitives. Verify npm publication timestamps at the bump, unchanged peer ranges, and Effect’s provider 4.0.14 pin.
2. Install with a command-local 1,440-minute minimum age and exceptions only for unchanged published Coder pins. Audit every added lockfile version and confirm remaining outdated dependencies are deferred or out of scope.
3. Run pnpm check, pnpm -r build, pnpm -r test, pnpm publint, and pnpm attw. All must pass before delivery.
4. Dogfood: use the pinned mise toolchain, verify ambient authentication with coder whoami, then run cd packages/agent && npx vitest run test/e2e against dogfood.cdr.dev. Require 7/7 passing; capture terminal screenshots and video without exposing credentials.
5. Open the scoped PR, require CI Required and both current-head Codex reviews to pass, wait about six minutes after settled review summaries, and re-audit all threads before entering the merge queue.

Acceptance: the exact requested title is used for the commit and PR; no peer ranges, release changelogs, toolchain pins, or unrelated files change; only age-eligible versions enter the lockfile; the actual merge SHA and landed/deferred versions are reported.

---

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: xhigh

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T19:40:43.306806Z	fb088b5	Manual request
🔒 Security Review	✅ Completed 2026-09-16T19:42:12.759074Z	fb088b5	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: fb088b57f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: fb088b57f5

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ThomasK33]

Live e2e video evidence

Replay rendered from the raw terminal recording live-final.cast (agent-tty 0.5.0 capture of the final live e2e run against dogfood.cdr.dev, 7/7 passed, exit 0). Rendered with asciinema agg 1.9.0 at 1.0× raw cast timing with no idle compression; not a live rerun. The last 3 seconds hold the final frame. The bottom bar identifies the replay and shows its clock.

live-final-replay.mp4

Checked decoded frames: Vitest running at 8 s and 20 s, transport trace at 37 s, and all seven tests plus LIVE_E2E_EXIT=0 at 38.6 s. The first recorder export lost intermediate screen updates; this replacement is rendered directly from the preserved raw cast.

---

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: xhigh