@illuma-ai/agents 1.4.0-alpha.6 → 1.5.0

package/dist/cjs/tools/ToolNode.cjs

@@ -10,10 +10,9 @@ var toonFormat = require('../utils/toonFormat.cjs');
 var run = require('../utils/run.cjs');
 require('ai-tokenizer');
 require('zod-to-json-schema');
-require('axios');
-require('https-proxy-agent');
-require('../utils/credentials.cjs');
 var events = require('../utils/events.cjs');
+var executeHooks = require('../hooks/executeHooks.cjs');
+var toolOutputReferences = require('./toolOutputReferences.cjs');
 
 /**
  * Helper to check if a value is a Send object
@@ -84,7 +83,30 @@ class ToolNode extends run.RunnableCallable {
     toolApprovalConfig;
     /** Buffer for recovering truncated tool call arguments from streaming data */
     streamingToolCallBuffer;
-    constructor({ tools, toolMap, name, tags, errorHandler, toolCallStepIds, handleToolErrors, loadRuntimeTools, toolRegistry, sessions, eventDrivenMode, agentId, directToolNames, streamingToolCallBuffer, toolApprovalConfig, }) {
+    /** Hook registry threaded down from Run for tool-lifecycle events. */
+    hookRegistry;
+    /**
+     * Tool output reference registry threaded down from Run / Graph
+     * (upstream PR #114). When set, dispatchToolEvents resolves
+     * `{{tool<i>turn<n>}}` placeholders in args before invoking each tool
+     * and stores successful outputs under their stable reference keys for
+     * subsequent calls in the same run to pipe through.
+     */
+    toolOutputRegistry;
+    /**
+     * Per-batch turn counter for the registry. Increments once per
+     * `dispatchToolEvents` invocation so `tool<i>turn<n>` keys remain
+     * unique across overlapping batches in a single run.
+     */
+    toolOutputTurn = 0;
+    /**
+     * Counter for synthesising scope ids when `run()` is called without a
+     * `run_id` in config. Each anonymous batch gets a unique
+     * `\0anon-<n>` scope so concurrent invocations don't collide on the
+     * shared `toolOutputRegistry`.
+     */
+    anonBatchCounter = 0;
+    constructor({ tools, toolMap, name, tags, errorHandler, toolCallStepIds, handleToolErrors, loadRuntimeTools, toolRegistry, sessions, eventDrivenMode, agentId, directToolNames, streamingToolCallBuffer, toolApprovalConfig, hookRegistry, toolOutputRegistry, toolOutputReferences: toolOutputReferences$1, maxToolResultChars: _maxToolResultChars, }) {
         super({ name, tags, func: (input, config) => this.run(input, config) });
         this.toolMap = toolMap ?? new Map(tools.map((tool) => [tool.name, tool]));
         this.toolCallStepIds = toolCallStepIds;
@@ -99,6 +121,31 @@ class ToolNode extends run.RunnableCallable {
         this.directToolNames = directToolNames;
         this.streamingToolCallBuffer = streamingToolCallBuffer;
         this.toolApprovalConfig = toolApprovalConfig;
+        this.hookRegistry = hookRegistry;
+        /**
+         * Precedence: an explicitly passed `toolOutputRegistry` instance
+         * wins (the multi-agent case where every ToolNode shares one registry
+         * for the run); otherwise the per-ToolNode `toolOutputReferences`
+         * config builds an instance scoped to this ToolNode.
+         */
+        if (toolOutputRegistry != null) {
+            this.toolOutputRegistry = toolOutputRegistry;
+        }
+        else if (toolOutputReferences$1?.enabled === true) {
+            this.toolOutputRegistry = new toolOutputReferences.ToolOutputReferenceRegistry({
+                maxOutputSize: toolOutputReferences$1.maxOutputSize,
+                maxTotalSize: toolOutputReferences$1.maxTotalSize,
+            });
+        }
+    }
+    /**
+     * Test-observation accessor for the tool-output reference registry.
+     * @internal Exposed for test observation only. Host code should rely on
+     * `{{tool<i>turn<n>}}` substitution at tool-invocation time and not
+     * mutate the registry directly.
+     */
+    _unsafeGetToolOutputRegistry() {
+        return this.toolOutputRegistry;
     }
     /**
      * Returns cached programmatic tools, computing once on first access.
@@ -166,8 +213,7 @@ class ToolNode extends run.RunnableCallable {
         // `ask_user` execute without ever firing interrupt(), defeating the whole tool.
         // Instead, gate the bypass on the actual routing-tool name prefix.
         if (this.directToolNames?.has(toolName) &&
-            (toolName.startsWith(_enum.Constants.LC_TRANSFER_TO_) ||
-                toolName.startsWith(_enum.Constants.LC_HANDOFF_TO_))) {
+            toolName.startsWith(_enum.Constants.LC_TRANSFER_TO_)) {
             return false;
         }
         // Determine the effective policy for this tool
@@ -221,10 +267,41 @@ class ToolNode extends run.RunnableCallable {
         return response;
     }
     /**
-     * Runs a single tool call with error handling
+     * Runs a single tool call with error handling.
+     *
+     * @param batchContext  Optional per-batch context (upstream PR #117).
+     *   Threaded from `run()` for tool output reference annotation. The
+     *   `batchScopeId` field carries an anonymous synthetic scope when the
+     *   caller has no `run_id`, so concurrent batches don't collide on the
+     *   shared registry.
      */
-    async runTool(call, config) {
+    async runTool(call, config, batchContext = {}) {
+        const { batchIndex, turn: batchTurn, batchScopeId, resolvedArgsByCallId, } = batchContext;
         const tool = this.toolMap.get(call.name);
+        const registry = this.toolOutputRegistry;
+        /**
+         * Precompute the reference key once per call — captured locally so
+         * concurrent `invoke()` calls on the same ToolNode cannot race on a
+         * shared turn field.
+         */
+        const refKey = registry != null && batchIndex != null && batchTurn != null
+            ? toolOutputReferences.buildReferenceKey(batchIndex, batchTurn)
+            : undefined;
+        /**
+         * Hoisted outside the try so the catch branch can stamp
+         * `_unresolvedRefs` into error ToolMessage metadata. This lets the
+         * lazy annotation transform surface a `[unresolved refs: …]` hint to
+         * the LLM, helping the model self-correct when its reference key
+         * caused the failure.
+         */
+        let unresolvedRefs = [];
+        /**
+         * Use the caller-provided `batchScopeId` when threaded from `run()`.
+         * Fall back to the config's `run_id` when runTool is invoked from a
+         * context that doesn't thread the batch context — that still
+         * preserves the runId-based partitioning for named runs.
+         */
+        const runId = batchScopeId ?? config.configurable?.run_id;
         try {
             if (tool === undefined) {
                 throw new Error(`Tool "${call.name}" not found.`);
@@ -244,6 +321,23 @@ class ToolNode extends run.RunnableCallable {
                 args = this.recoverTruncatedArgs(call.name, call.id, args);
                 this.streamingToolCallBuffer.clear(call.id);
             }
+            /**
+             * Resolve `{{tool<i>turn<n>}}` placeholders in args against the
+             * registry. Captures `unresolvedRefs` so error/success branches can
+             * surface them to the LLM via `additional_kwargs._unresolvedRefs`.
+             */
+            if (registry != null) {
+                const { resolved, unresolved } = registry.resolve(runId, args);
+                args = resolved;
+                unresolvedRefs = unresolved;
+                if (resolvedArgsByCallId != null &&
+                    call.id != null &&
+                    call.id !== '' &&
+                    resolved !== call.args &&
+                    typeof resolved === 'object') {
+                    resolvedArgsByCallId.set(call.id, resolved);
+                }
+            }
             // Build invoke params - LangChain extracts non-schema fields to config.toolCall
             let invokeParams = {
                 ...call,
@@ -276,8 +370,7 @@ class ToolNode extends run.RunnableCallable {
              * session_id is always injected when available (even without tracked files)
              * so the CodeExecutor can fall back to the /files endpoint for session continuity.
              */
-            if (call.name === _enum.Constants.EXECUTE_CODE ||
-                call.name === _enum.Constants.PROGRAMMATIC_TOOL_CALLING) {
+            if (_enum.CODE_EXECUTION_TOOLS.has(call.name)) {
                 const codeSession = this.sessions?.get(_enum.Constants.EXECUTE_CODE);
                 if (codeSession != null && codeSession.session_id !== '') {
                     /**
@@ -362,22 +455,49 @@ class ToolNode extends run.RunnableCallable {
                 minSizeForToon: 1000,
                 minReductionPercent: 10, // Only apply TOON when clearly beneficial
             });
-            // Step 4: Return ToolMessage with processed string content
+            /**
+             * Tool output reference metadata (upstream PR #117). Register the
+             * raw, untruncated content so future `{{...}}` substitutions deliver
+             * the full payload, and stamp `_refKey` / `_refScope` /
+             * `_unresolvedRefs` into `additional_kwargs` for the lazy
+             * annotation transform to apply at LLM request time. Persisted
+             * `content` stays clean.
+             *
+             * For error ToolMessages from the underlying tool: bypass
+             * registration but still stamp `_unresolvedRefs` so the model can
+             * self-correct.
+             */
             if (messages.isBaseMessage(output) && output._getType() === 'tool') {
                 const toolMsg = output;
+                const isError = toolMsg.status === 'error';
+                const refMeta = isError
+                    ? unresolvedRefs.length > 0
+                        ? { _unresolvedRefs: unresolvedRefs }
+                        : undefined
+                    : this.recordOutputReference(runId, rawContent, refKey, unresolvedRefs);
                 return new messages.ToolMessage({
                     status: toolMsg.status,
                     name: toolMsg.name,
                     content: processed.content,
                     tool_call_id: toolMsg.tool_call_id,
+                    ...(refMeta != null && {
+                        additional_kwargs: {
+                            ...toolMsg.additional_kwargs,
+                            ...refMeta,
+                        },
+                    }),
                 });
             }
             else {
+                const refMeta = this.recordOutputReference(runId, rawContent, refKey, unresolvedRefs);
                 return new messages.ToolMessage({
                     status: 'success',
                     name: tool.name,
                     content: processed.content,
                     tool_call_id: call.id,
+                    ...(refMeta != null && {
+                        additional_kwargs: refMeta,
+                    }),
                 });
             }
         }
@@ -427,6 +547,9 @@ class ToolNode extends run.RunnableCallable {
                 content: `Error: ${e.message}\n Please fix your mistakes.`,
                 name: call.name,
                 tool_call_id: call.id ?? '',
+                ...(unresolvedRefs.length > 0 && {
+                    additional_kwargs: { _unresolvedRefs: unresolvedRefs },
+                }),
             });
         }
     }
@@ -510,6 +633,31 @@ class ToolNode extends run.RunnableCallable {
         }
         return parsedArgs;
     }
+    /**
+     * Stores the raw, untruncated tool output in the registry under `refKey`
+     * (when registry + refKey are both present) and returns the metadata
+     * envelope to stamp on `ToolMessage.additional_kwargs`. The lazy
+     * annotation transform reads `_refKey` / `_refScope` / `_unresolvedRefs`
+     * at LLM request time to produce the transient annotated copy.
+     */
+    recordOutputReference(runId, registryContent, refKey, unresolved) {
+        if (this.toolOutputRegistry != null && refKey != null) {
+            this.toolOutputRegistry.set(runId, refKey, registryContent);
+        }
+        if (refKey == null && unresolved.length === 0)
+            return undefined;
+        const meta = {};
+        if (refKey != null) {
+            meta._refKey = refKey;
+            // Anonymous invocations use a synthetic scope minted in run() — stamp
+            // it onto the message so annotateMessagesForLLM can recover it later.
+            if (runId != null)
+                meta._refScope = runId;
+        }
+        if (unresolved.length > 0)
+            meta._unresolvedRefs = unresolved;
+        return meta;
+    }
     /**
      * Builds code session context for injection into event-driven tool calls.
      * Mirrors the session injection logic in runTool() for direct execution.
@@ -664,8 +812,33 @@ class ToolNode extends run.RunnableCallable {
         }
     }
     /**
-     * Dispatches tool calls to the host via ON_TOOL_EXECUTE event and returns raw ToolMessages.
-     * Core logic for event-driven execution, separated from output shaping.
+     * Converts InjectedMessage entries into LangChain HumanMessages.
+     * 'user' and 'system' both become HumanMessage to avoid provider rejections
+     * (Anthropic/Google reject non-leading SystemMessages); the original role
+     * and metadata are preserved in additional_kwargs for downstream consumers.
+     */
+    convertInjectedMessages(messages$1) {
+        const converted = [];
+        for (const msg of messages$1) {
+            const additional_kwargs = {
+                role: msg.role,
+            };
+            if (msg.isMeta != null)
+                additional_kwargs.isMeta = msg.isMeta;
+            if (msg.source != null)
+                additional_kwargs.source = msg.source;
+            if (msg.skillName != null)
+                additional_kwargs.skillName = msg.skillName;
+            converted.push(new messages.HumanMessage({ content: msg.content, additional_kwargs }));
+        }
+        return converted;
+    }
+    /**
+     * Dispatches tool calls to the host via ON_TOOL_EXECUTE event and returns
+     * the resulting ToolMessages along with any injected messages emitted by
+     * the host (e.g. SkillTool body injection). Injected messages must be
+     * placed AFTER the ToolMessages so the AIMessage tool_calls -> ToolMessage
+     * adjacency required by some providers is preserved.
      */
     async dispatchToolEvents(toolCalls, config) {
         // ========================================================================
@@ -696,9 +869,117 @@ class ToolNode extends run.RunnableCallable {
         }
         // If all tools were denied, return denial messages without dispatching
         if (approvedCalls.length === 0) {
-            return denialMessages;
+            return { toolMessages: denialMessages, injected: [] };
+        }
+        const runId = config.configurable?.run_id;
+        const threadId = config.configurable?.thread_id;
+        /**
+         * PreToolUse hooks may deny / ask / allow each call, and may rewrite
+         * `toolInput` via `updatedInput`. A denied/asked call short-circuits
+         * with a synthetic error ToolMessage and fires PermissionDenied so
+         * the host can audit. Survivors continue to dispatch.
+         */
+        const hookDenialMessages = [];
+        let postHookCalls = approvedCalls;
+        if (runId != null &&
+            this.hookRegistry?.hasHookFor('PreToolUse', runId) === true) {
+            const HOOK_FALLBACK = {
+                additionalContexts: [],
+                errors: [],
+            };
+            const surviving = [];
+            const preResults = await Promise.all(approvedCalls.map((call) => executeHooks.executeHooks({
+                registry: this.hookRegistry,
+                input: {
+                    hook_event_name: 'PreToolUse',
+                    runId,
+                    threadId,
+                    agentId: this.agentId,
+                    toolName: call.name,
+                    toolInput: call.args,
+                    toolUseId: call.id ?? '',
+                    stepId: this.toolCallStepIds?.get(call.id ?? ''),
+                    turn: this.toolUsageCount.get(call.name) ?? 0,
+                },
+                sessionId: runId,
+                matchQuery: call.name,
+            }).catch(() => HOOK_FALLBACK)));
+            for (let i = 0; i < approvedCalls.length; i++) {
+                const call = approvedCalls[i];
+                const hookResult = preResults[i];
+                const denied = hookResult.decision === 'deny' || hookResult.decision === 'ask';
+                if (denied) {
+                    const reason = hookResult.reason ?? 'Blocked by hook';
+                    hookDenialMessages.push(new messages.ToolMessage({
+                        status: 'error',
+                        content: `Blocked: ${reason}`,
+                        name: call.name,
+                        tool_call_id: call.id ?? '',
+                    }));
+                    if (this.hookRegistry.hasHookFor('PermissionDenied', runId)) {
+                        // Fire-and-forget — denial accounting must not block dispatch.
+                        void executeHooks.executeHooks({
+                            registry: this.hookRegistry,
+                            input: {
+                                hook_event_name: 'PermissionDenied',
+                                runId,
+                                threadId,
+                                agentId: this.agentId,
+                                toolName: call.name,
+                                toolInput: call.args,
+                                toolUseId: call.id ?? '',
+                                reason,
+                            },
+                            sessionId: runId,
+                            matchQuery: call.name,
+                        }).catch(() => {
+                            /* swallow — denial is informational */
+                        });
+                    }
+                    continue;
+                }
+                if (hookResult.updatedInput != null &&
+                    typeof hookResult.updatedInput === 'object') {
+                    call.args = hookResult.updatedInput;
+                }
+                surviving.push(call);
+            }
+            postHookCalls = surviving;
+            if (postHookCalls.length === 0) {
+                return {
+                    toolMessages: [...denialMessages, ...hookDenialMessages],
+                    injected: [],
+                };
+            }
         }
-        const requests = approvedCalls.map((call) => {
+        /**
+         * Tool output reference resolution (upstream PR #114): walk each call's
+         * args and substitute `{{tool<i>turn<n>}}` placeholders with the stored
+         * raw output. Captured here BEFORE request shaping so the substituted
+         * args flow through the rest of the dispatch unchanged.
+         *
+         * Failures are non-fatal: the registry resolver returns the original
+         * string unchanged for unknown keys, and surfaces them via `unresolved`
+         * which we currently log-only. Future work can route unresolved-key
+         * complaints into a hint message for the LLM.
+         */
+        const batchTurn = this.toolOutputTurn++;
+        if (this.toolOutputRegistry != null && runId != null) {
+            const registry = this.toolOutputRegistry;
+            for (const call of postHookCalls) {
+                const args = call.args;
+                if (args == null)
+                    continue;
+                try {
+                    const { resolved } = registry.resolve(runId, args);
+                    call.args = resolved;
+                }
+                catch {
+                    /* leave args untouched on resolver failure */
+                }
+            }
+        }
+        const requests = postHookCalls.map((call) => {
             const turn = this.toolUsageCount.get(call.name) ?? 0;
             this.toolUsageCount.set(call.name, turn + 1);
             // Recover truncated args from streaming buffer (same as runTool path)
@@ -733,7 +1014,77 @@ class ToolNode extends run.RunnableCallable {
             events.safeDispatchCustomEvent(_enum.GraphEvents.ON_TOOL_EXECUTE, request, config);
         });
         this.storeCodeSessionFromResults(results, requests);
-        const eventMessages = results.map((result) => {
+        const injected = [];
+        for (const result of results) {
+            if (result.injectedMessages && result.injectedMessages.length > 0) {
+                try {
+                    injected.push(...this.convertInjectedMessages(result.injectedMessages));
+                }
+                catch (e) {
+                    // eslint-disable-next-line no-console
+                    console.warn(`[ToolNode] Failed to convert injectedMessages for toolCallId=${result.toolCallId}:`, e instanceof Error ? e.message : e);
+                }
+            }
+        }
+        /**
+         * Fire PostToolUse / PostToolUseFailure hooks after results are in.
+         * These run in parallel and never block the return — failures are
+         * swallowed so a hook bug can't masquerade as a tool failure.
+         */
+        if (runId != null && this.hookRegistry != null) {
+            const hasPost = this.hookRegistry.hasHookFor('PostToolUse', runId);
+            const hasFail = this.hookRegistry.hasHookFor('PostToolUseFailure', runId);
+            if (hasPost || hasFail) {
+                const postPromises = [];
+                for (const result of results) {
+                    const request = requests.find((r) => r.id === result.toolCallId);
+                    if (!request)
+                        continue;
+                    if (result.status === 'success' && hasPost) {
+                        postPromises.push(executeHooks.executeHooks({
+                            registry: this.hookRegistry,
+                            input: {
+                                hook_event_name: 'PostToolUse',
+                                runId,
+                                threadId,
+                                agentId: this.agentId,
+                                toolName: request.name,
+                                toolInput: request.args,
+                                toolOutput: result.content,
+                                toolUseId: result.toolCallId,
+                                stepId: this.toolCallStepIds?.get(result.toolCallId),
+                                turn: request.turn,
+                            },
+                            sessionId: runId,
+                            matchQuery: request.name,
+                        }).catch(() => undefined));
+                    }
+                    else if (result.status === 'error' && hasFail) {
+                        postPromises.push(executeHooks.executeHooks({
+                            registry: this.hookRegistry,
+                            input: {
+                                hook_event_name: 'PostToolUseFailure',
+                                runId,
+                                threadId,
+                                agentId: this.agentId,
+                                toolName: request.name,
+                                toolInput: request.args,
+                                toolUseId: result.toolCallId,
+                                error: result.errorMessage ?? 'Unknown error',
+                                stepId: this.toolCallStepIds?.get(result.toolCallId),
+                                turn: request.turn,
+                            },
+                            sessionId: runId,
+                            matchQuery: request.name,
+                        }).catch(() => undefined));
+                    }
+                }
+                if (postPromises.length > 0) {
+                    await Promise.all(postPromises);
+                }
+            }
+        }
+        const eventMessages = results.map((result, idx) => {
             const request = requests.find((r) => r.id === result.toolCallId);
             const toolName = request?.name ?? 'unknown';
             const stepId = this.toolCallStepIds?.get(result.toolCallId) ?? '';
@@ -759,12 +1110,40 @@ class ToolNode extends run.RunnableCallable {
                     typeof result.content === 'string'
                         ? result.content
                         : JSON.stringify(result.content);
+                /**
+                 * Tool output reference — lazy annotation (upstream PRs #114 + #117).
+                 * Register the raw output under `tool<idx>turn<turn>` in the
+                 * registry but leave `ToolMessage.content` clean. Stamp the ref
+                 * metadata into `additional_kwargs` instead. The lazy
+                 * `annotateMessagesForLLM` transform applies the visible
+                 * `[ref: …]` / `_ref` annotation only on the transient copy sent
+                 * to the model. Persisted message stays unannotated so
+                 * conversation exports / pruning / token accounting stay clean.
+                 */
+                const additionalKwargs = {};
+                if (this.toolOutputRegistry != null && runId != null) {
+                    try {
+                        const refKey = toolOutputReferences.buildReferenceKey(idx, batchTurn);
+                        this.toolOutputRegistry.set(runId, refKey, contentString);
+                        const meta = {
+                            _refKey: refKey,
+                            _refScope: runId,
+                        };
+                        Object.assign(additionalKwargs, meta);
+                    }
+                    catch {
+                        /* registry store failure is non-fatal — message stays clean, no annotation */
+                    }
+                }
                 toolMessage = new messages.ToolMessage({
                     status: 'success',
                     name: toolName,
                     content: contentString,
                     artifact: result.artifact,
                     tool_call_id: result.toolCallId,
+                    additional_kwargs: Object.keys(additionalKwargs).length > 0
+                        ? additionalKwargs
+                        : undefined,
                 });
             }
             const tool_call = {
@@ -787,7 +1166,14 @@ class ToolNode extends run.RunnableCallable {
             events.safeDispatchCustomEvent(_enum.GraphEvents.ON_RUN_STEP_COMPLETED, runStepCompletedData, config);
             return toolMessage;
         });
-        return [...denialMessages, ...eventMessages];
+        return {
+            toolMessages: [
+                ...denialMessages,
+                ...hookDenialMessages,
+                ...eventMessages,
+            ],
+            injected,
+        };
     }
     /**
      * Execute all tool calls via ON_TOOL_EXECUTE event dispatch.
@@ -796,19 +1182,42 @@ class ToolNode extends run.RunnableCallable {
     async executeViaEvent(toolCalls, config, 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     input) {
-        const outputs = await this.dispatchToolEvents(toolCalls, config);
+        const { toolMessages, injected } = await this.dispatchToolEvents(toolCalls, config);
+        const outputs = [...toolMessages, ...injected];
         return (Array.isArray(input) ? outputs : { messages: outputs });
     }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     async run(input, config) {
         this.toolCallTurns.clear();
+        /**
+         * Per-batch local map for resolved (post-substitution) args. Lives
+         * on the stack so concurrent `run()` calls on the same ToolNode
+         * cannot read or wipe each other's entries.
+         */
+        const resolvedArgsByCallId = new Map();
+        /**
+         * Claim this batch's turn synchronously from the registry (or fall
+         * back to 0 when the feature is disabled). For anonymous callers
+         * (no `run_id` in config), mint a unique per-batch scope id so two
+         * concurrent anonymous invocations don't target the same bucket.
+         */
+        const incomingRunId = config.configurable?.run_id;
+        const batchScopeId = incomingRunId ?? `\0anon-${this.anonBatchCounter++}`;
+        const batchTurn = this.toolOutputRegistry?.nextTurn(batchScopeId) ?? 0;
         let outputs;
         if (this.isSendInput(input)) {
             const isDirectTool = this.directToolNames?.has(input.lg_tool_call.name);
             if (this.eventDrivenMode && isDirectTool !== true) {
                 return this.executeViaEvent([input.lg_tool_call], config, input);
             }
-            outputs = [await this.runTool(input.lg_tool_call, config)];
+            outputs = [
+                await this.runTool(input.lg_tool_call, config, {
+                    batchIndex: 0,
+                    turn: batchTurn,
+                    batchScopeId,
+                    resolvedArgsByCallId,
+                }),
+            ];
             this.handleRunToolCompletions([input.lg_tool_call], outputs, config);
         }
         else {
@@ -859,21 +1268,38 @@ class ToolNode extends run.RunnableCallable {
                 const directCalls = filteredCalls.filter((c) => this.directToolNames.has(c.name));
                 const eventCalls = filteredCalls.filter((c) => !this.directToolNames.has(c.name));
                 // Run direct tools and event tools in parallel — they are independent
-                const [directOutputs, eventOutputs] = (await Promise.all([
+                const [directOutputs, eventDispatch] = (await Promise.all([
                     directCalls.length > 0
-                        ? Promise.all(directCalls.map((call) => this.runTool(call, config)))
+                        ? Promise.all(directCalls.map((call, idx) => this.runTool(call, config, {
+                            batchIndex: idx,
+                            turn: batchTurn,
+                            batchScopeId,
+                            resolvedArgsByCallId,
+                        })))
                         : [],
                     eventCalls.length > 0
                         ? this.dispatchToolEvents(eventCalls, config)
-                        : [],
+                        : { toolMessages: [], injected: [] },
                 ]));
                 if (directCalls.length > 0 && directOutputs.length > 0) {
                     this.handleRunToolCompletions(directCalls, directOutputs, config);
                 }
-                outputs = [...directOutputs, ...eventOutputs];
+                // Injected messages MUST follow ToolMessages so the AIMessage
+                // tool_calls -> ToolMessage adjacency required by some providers
+                // is preserved.
+                outputs = [
+                    ...directOutputs,
+                    ...eventDispatch.toolMessages,
+                    ...eventDispatch.injected,
+                ];
             }
             else {
-                outputs = await Promise.all(filteredCalls.map((call) => this.runTool(call, config)));
+                outputs = await Promise.all(filteredCalls.map((call, idx) => this.runTool(call, config, {
+                    batchIndex: idx,
+                    turn: batchTurn,
+                    batchScopeId,
+                    resolvedArgsByCallId,
+                })));
                 this.handleRunToolCompletions(filteredCalls, outputs, config);
             }
         }