[STG-2463] fix: silence AI SDK "system message in messages" warning on agent.execute()

.changeset/aisdk-allow-system-in-messages.md

@@ -0,0 +1,7 @@
+---
+"@browserbasehq/stagehand": patch
+---
+
+Silence the AI SDK "System messages in the prompt or messages fields can be a security risk" warning emitted on every hybrid/DOM `agent.execute()` call.
+
+The agent loop intentionally supplies its system prompt as a system-role message (rather than the top-level `system` param) so it can carry Anthropic ephemeral cache-control via `providerOptions`. AI SDK v5 warns whenever it sees a system message inside `messages`, since it can't tell a trusted system prompt from untrusted input. Because the prompt is Stagehand's own, we now pass `allowSystemInMessages: true` to the `generateText`/`streamText` calls, which keeps prompt caching intact and removes the noisy warning. Bumps the `ai` floor to `^5.0.185`, where this option is available.

packages/core/lib/v3/handlers/v3AgentHandler.ts

@@ -458,6 +458,7 @@ export class V3AgentHandler {
       const result = await this.llmClient.generateText({
         model: wrappedModel,
         messages: prependSystemMessage(systemPrompt, messages),
+        allowSystemInMessages: true,
         tools: allTools,
         stopWhen: (result) => this.handleStop(result, maxSteps),
         toolChoice: "auto",
@@ -616,6 +617,7 @@ export class V3AgentHandler {
       streamResult = this.llmClient.streamText({
         model: wrappedModel,
         messages: prependSystemMessage(systemPrompt, messages),
+        allowSystemInMessages: true,
         tools: allTools,
         stopWhen: (result) => this.handleStop(result, maxSteps),
         toolChoice: "auto",

packages/core/lib/v3/llm/LLMProvider.ts

@@ -1,4 +1,7 @@
-import type { LanguageModelV2Middleware } from "@ai-sdk/provider";
+import type {
+  LanguageModelV2,
+  LanguageModelV2Middleware,
+} from "@ai-sdk/provider";
 import {
   UnsupportedAISDKModelProviderError,
   UnsupportedModelError,
@@ -156,7 +159,7 @@ export function getAISDKLanguageModel(
   subModelName: string,
   clientOptions?: ClientOptions,
   middleware?: LanguageModelV2Middleware,
-) {
+): LanguageModelV2 {
   const aiSdkClientOptions = toAISDKClientOptions(subProvider, clientOptions);
   const hasValidOptions =
     aiSdkClientOptions &&

packages/core/package.json

@@ -89,7 +89,7 @@
     "@browserbasehq/sdk": "^2.10.0",
     "@google/genai": "^1.22.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "ai": "^5.0.133",
+    "ai": "^5.0.185",
     "devtools-protocol": "^0.0.1642743",
     "fetch-cookie": "^3.1.0",
     "openai": "^4.104.0",