Fix Chrome passkey BYOK with the published AI packages

[tannerlinsley]

Updates Builder to ai-client 0.31.1 and the matching AI packages from TanStack/ai#1333. This includes the Chrome/1Password PRF byte-array fix from TanStack/ai#1351.

Preserves the existing OpenAI tool-continuation patch on openai-base 0.10.11. Reads tool-loop finish reasons from the new SDK metadata and keeps encrypted reasoning out of the browser stream. The regression test now covers the actual adapter through the Builder stream boundary.

Validation: pnpm test passed with 490 tests passing and one existing skip, including type checking and lint. pnpm build passed.

The packages used here are verified on npm. The broader AI release partially failed because ai-reactor and ai-sandbox-blaxel received npm publishing 404s; Builder does not depend on those packages.

Summary by CodeRabbit

• New Features

  • Improved OpenAI tool-call continuations, preserving conversation context and reasoning across multi-step interactions.
  • Enhanced AI response streaming with more reliable tool-call completion metadata and workflow event handling.

• Bug Fixes

  • Fixed streaming behavior when completion details are provided through nested metadata.
  • Improved handling of encrypted reasoning content and intermediate tool-loop completions.
  • Reduced spurious runtime errors during tool-based execution.
  • Updated TanStack AI integrations for improved compatibility and reliability.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	tanstack-com	828b803	Commit Preview URL Branch Preview URL	Sep 10 2026, 04:51 AM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tanstack/​ai-anthropic@​0.18.0 ⏵ 0.18.6	+1		+1	+1
	@​tanstack/​ai-openai@​0.22.0 ⏵ 0.22.6	+1		+1	+1
	@​tanstack/​ai-client@​0.28.0 ⏵ 0.31.1	+1		+1	+1
	@​tanstack/​ai@​0.49.1 ⏵ 0.54.0	+1		+1	+1

View full report

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 02cc0539-cc05-4579-a9d8-0282a0fd8291

📥 Commits

Reviewing files that changed from the base of the PR and between 828b803 and 43c9ad9.

📒 Files selected for processing (1)

• tests/builder-ai-stream.test.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The update bumps TanStack AI packages, patches OpenAI Responses tool continuations, and updates builder stream handling for TanStack finish metadata, encrypted reasoning chunks, and step completion events. Tests cover continuation output and metadata-based finish reasons.

Changes

AI stream updates

Layer / File(s)	Summary
OpenAI response continuation patches/@tanstack__openai-base@0.10.11.patch, pnpm-workspace.yaml, package.json, tests/openai-responses-tool-continuation.test.ts	The OpenAI Responses adapter stores response IDs and model metadata, detects matching tool-result continuations, and sends previous_response_id with converted tool results. Package versions and the patched dependency reference are updated. The continuation test validates builder execution output without run errors.
Builder stream processing src/utils/builder-ai-stream.client.ts, src/utils/builder-ai.ts, tests/builder-ai-stream.test.ts	Builder stream handling reads finish reasons from TanStack metadata before top-level fields, skips encrypted reasoning chunks, emits STEP_FINISHED events, and updates native tool-call fixtures.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant OpenAIResponses as OpenAI Responses API
  participant ResponsesAdapter as OpenAIBaseResponsesTextAdapter
  participant BuilderStream as streamBuilderAiResponse
  participant BuilderExecution as builder.project.execution
  OpenAIResponses-->>ResponsesAdapter: response and tool-call events
  ResponsesAdapter->>BuilderStream: provider stream with response metadata
  BuilderStream->>ResponsesAdapter: tool results for continuation
  ResponsesAdapter->>OpenAIResponses: previous_response_id and tool-result input
  BuilderStream->>BuilderExecution: CUSTOM execution chunk

Loading

Merge Risk: ⚪ Minimal · up to 43c9a

This update aligns Builder with newer AI stream metadata and OpenAI tool-continuation behavior while preserving native tool validation; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: fixing Chrome passkey BYOK by updating to the published AI packages. It is concise and related to the pull request objectives.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch taren/builder-byok-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tannerlinsley]

Fixed the CI validation failures in 43c9ad9. The native client-tool fixture also emitted the legacy tool-input-available event, which could execute and submit the same validation twice. It now matches the native interrupt protocol. All 490 tests pass (one existing skip), type checking and lint pass, and the client-stream tests passed 20 consecutive runs. The existing regression also exercises the real OpenAI adapter through the Builder stream boundary. Ready for Website Maintainer review once CI finishes.