@librechat/agents 3.1.64 → 3.1.66-dev.0

package/dist/cjs/hooks/matchers.cjs

@@ -0,0 +1,256 @@
+'use strict';
+
+// src/hooks/matchers.ts
+/**
+ * Upper bound on hook-matcher pattern length. Patterns longer than this
+ * are rejected outright — the goal is a cheap cap on pathological inputs
+ * (repeated quantifiers, huge alternation groups) without pulling in a
+ * safe-regex dependency.
+ *
+ * Legitimate matchers are almost always under 50 characters (tool names,
+ * short alternations, simple prefix anchors); 512 leaves generous
+ * headroom while preventing 10KB regexes.
+ */
+const MAX_PATTERN_LENGTH = 512;
+/**
+ * Upper bound on the compilation cache. Chosen to comfortably hold every
+ * distinct pattern a single multi-tenant run is likely to see (tools,
+ * agent types, basename filters) without growing without bound.
+ *
+ * Under hosts that register unique patterns per tenant, LRU eviction
+ * keeps the working set bounded — cold patterns are re-compiled on next
+ * use, which is the correct cost trade-off for long-running processes
+ * that must not leak memory.
+ */
+const MAX_CACHE_SIZE = 256;
+/**
+ * Module-level LRU cache keyed by pattern string. Map iteration order is
+ * insertion order in ECMAScript, so refreshing an entry's position means
+ * "delete then re-set". On overflow we evict the first key (least
+ * recently used).
+ *
+ * Failed compiles are cached as `{ regex: null }` so a malformed pattern
+ * does not re-enter the compiler — and so a tenant spamming bad patterns
+ * doesn't burn CPU on every call.
+ */
+const patternCache = new Map();
+/**
+ * Threshold above which `touchCacheEntry` actually performs the LRU
+ * refresh. Below this watermark the cache has zero eviction pressure, so
+ * the delete+set on every hit would be pure overhead. Above it we refresh
+ * properly so hot patterns survive evictions. 75% of capacity is the
+ * standard sweet spot.
+ */
+const LRU_REFRESH_THRESHOLD = Math.floor((MAX_CACHE_SIZE * 3) / 4);
+function touchCacheEntry(pattern, entry) {
+    if (patternCache.size < LRU_REFRESH_THRESHOLD) {
+        return;
+    }
+    patternCache.delete(pattern);
+    patternCache.set(pattern, entry);
+}
+function setCacheEntry(pattern, entry) {
+    if (patternCache.size >= MAX_CACHE_SIZE) {
+        const oldestKey = patternCache.keys().next().value;
+        if (oldestKey !== undefined) {
+            patternCache.delete(oldestKey);
+        }
+    }
+    patternCache.set(pattern, entry);
+}
+function skipGroupSyntaxPrefix(pattern, start) {
+    if (start >= pattern.length || pattern[start] !== '?') {
+        return start;
+    }
+    let i = start + 1;
+    if (i >= pattern.length) {
+        return i;
+    }
+    const modifier = pattern[i];
+    if (modifier === ':' || modifier === '=' || modifier === '!') {
+        return i + 1;
+    }
+    if (modifier !== '<') {
+        return i;
+    }
+    i++;
+    if (i < pattern.length && (pattern[i] === '=' || pattern[i] === '!')) {
+        return i + 1;
+    }
+    while (i < pattern.length && pattern[i] !== '>') {
+        i++;
+    }
+    if (i < pattern.length) {
+        i++;
+    }
+    return i;
+}
+/**
+ * Cheap syntactic detector for the most common catastrophic-backtracking
+ * shape: a quantified group that contains another quantifier (e.g.
+ * `(a+)+`, `(.*)*`, `(\w+)+$`, `(?:(a+))+`). This is the "nested
+ * quantifier" class of ReDoS — runs in polynomial-or-worse time on
+ * adversarial inputs.
+ *
+ * The scan walks the pattern linearly using an explicit stack of group
+ * frames. For each group it tracks whether the group's contents include
+ * "backtrack risk" — meaning a direct quantifier OR a nested group that
+ * carries risk up. When a group closes with a trailing quantifier AND its
+ * frame carries backtrack risk, the pattern is flagged. Risk propagates
+ * to the enclosing frame when a child group closes (whether the child
+ * itself was quantified or not), so `(?:(a+))+` — equivalent to `(a+)+`
+ * — is flagged correctly even though the outer non-capturing wrapper is
+ * one level removed from the inner quantifier.
+ *
+ * ## Group-syntax prefixes
+ *
+ * Non-capturing groups (`(?:`), lookaheads (`(?=`, `(?!`), lookbehinds
+ * (`(?<=`, `(?<!`), and named groups (`(?<name>`) are skipped over at
+ * the `(` so their `?` is not misread as a quantifier. Without this,
+ * `(?:pre_)?tool_name` would be incorrectly rejected because the scanner
+ * would see the group-syntax `?` as a quantifier at depth 1.
+ *
+ * ## Heuristic, not a proof
+ *
+ * This catches the common forms but not all. Ambiguous-alternation ReDoS
+ * like `(a|a)+` is not detected. Pathologically long patterns are also
+ * caught by {@link MAX_PATTERN_LENGTH}. Hosts that accept user-supplied
+ * patterns must still validate upstream.
+ */
+function hasNestedQuantifier(pattern) {
+    const stack = [];
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === '\\') {
+            i += 2;
+            continue;
+        }
+        if (ch === '[') {
+            i = findCharClassEnd(pattern, i) + 1;
+            continue;
+        }
+        if (ch === '(') {
+            stack.push({ hasBacktrackRisk: false });
+            i = skipGroupSyntaxPrefix(pattern, i + 1);
+            continue;
+        }
+        if (ch === ')') {
+            const frame = stack.pop();
+            if (frame === undefined) {
+                i++;
+                continue;
+            }
+            const next = pattern[i + 1];
+            const isQuantifier = next === '*' || next === '+' || next === '?' || next === '{';
+            if (isQuantifier && frame.hasBacktrackRisk) {
+                return true;
+            }
+            if (stack.length > 0 && (frame.hasBacktrackRisk || isQuantifier)) {
+                stack[stack.length - 1].hasBacktrackRisk = true;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '*' || ch === '+' || ch === '?' || ch === '{') {
+            if (stack.length > 0) {
+                stack[stack.length - 1].hasBacktrackRisk = true;
+            }
+        }
+        i++;
+    }
+    return false;
+}
+function findCharClassEnd(pattern, start) {
+    let i = start + 1;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === '\\') {
+            i += 2;
+            continue;
+        }
+        if (ch === ']') {
+            return i;
+        }
+        i++;
+    }
+    return pattern.length - 1;
+}
+function compile(pattern) {
+    const cached = patternCache.get(pattern);
+    if (cached !== undefined) {
+        touchCacheEntry(pattern, cached);
+        return cached.regex;
+    }
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+        setCacheEntry(pattern, { regex: null });
+        return null;
+    }
+    if (hasNestedQuantifier(pattern)) {
+        setCacheEntry(pattern, { regex: null });
+        return null;
+    }
+    try {
+        const regex = new RegExp(pattern);
+        setCacheEntry(pattern, { regex });
+        return regex;
+    }
+    catch {
+        setCacheEntry(pattern, { regex: null });
+        return null;
+    }
+}
+/**
+ * Tests whether a hook matcher pattern matches the given query string.
+ *
+ * ## Semantics
+ *
+ * - `undefined` or empty `pattern` matches any query (wildcard). This is
+ *   the intended shape for events that do not supply a query string at
+ *   all (`RunStart`, `Stop`, etc.) — register such matchers without a
+ *   pattern.
+ * - `undefined` or empty `query` with a non-empty `pattern` never matches.
+ *   Setting a pattern on a query-less event is therefore inert: the
+ *   matcher will simply never fire. This is intentional — it keeps
+ *   query-based filtering out of event types where "query" has no meaning,
+ *   and is documented on `HookMatcher.pattern`.
+ * - Otherwise, the pattern is compiled once (via a bounded LRU cache) and
+ *   tested against the query.
+ * - Invalid regex patterns never throw — a failed compile is cached as
+ *   "never matches" so a single malformed pattern cannot take out a whole
+ *   `executeHooks` batch.
+ *
+ * ## ReDoS mitigations
+ *
+ * Patterns compile through three cheap gates before reaching `new RegExp`:
+ *
+ * 1. {@link MAX_PATTERN_LENGTH} length cap rejects oversized inputs.
+ * 2. {@link hasNestedQuantifier} rejects the most common catastrophic-
+ *    backtracking shape (quantified group containing a quantifier).
+ * 3. Successful compiles are cached in a bounded LRU so repeated calls
+ *    never re-enter the regex compiler.
+ *
+ * These are a floor, not a ceiling. Hosts that accept user-supplied
+ * patterns should still validate upstream. The design report §3.8 routes
+ * persistable hooks through a host-side compiler before they reach this
+ * module.
+ */
+function matchesQuery(pattern, query) {
+    if (pattern === undefined || pattern === '') {
+        return true;
+    }
+    if (query === undefined || query === '') {
+        return false;
+    }
+    const regex = compile(pattern);
+    if (regex === null) {
+        return false;
+    }
+    return regex.test(query);
+}
+
+exports.MAX_CACHE_SIZE = MAX_CACHE_SIZE;
+exports.MAX_PATTERN_LENGTH = MAX_PATTERN_LENGTH;
+exports.hasNestedQuantifier = hasNestedQuantifier;
+exports.matchesQuery = matchesQuery;
+//# sourceMappingURL=matchers.cjs.map

package/dist/cjs/hooks/matchers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"matchers.cjs","sources":["../../../src/hooks/matchers.ts"],"sourcesContent":["// src/hooks/matchers.ts\n\n/**\n * Upper bound on hook-matcher pattern length. Patterns longer than this\n * are rejected outright — the goal is a cheap cap on pathological inputs\n * (repeated quantifiers, huge alternation groups) without pulling in a\n * safe-regex dependency.\n *\n * Legitimate matchers are almost always under 50 characters (tool names,\n * short alternations, simple prefix anchors); 512 leaves generous\n * headroom while preventing 10KB regexes.\n */\nexport const MAX_PATTERN_LENGTH = 512;\n\n/**\n * Upper bound on the compilation cache. Chosen to comfortably hold every\n * distinct pattern a single multi-tenant run is likely to see (tools,\n * agent types, basename filters) without growing without bound.\n *\n * Under hosts that register unique patterns per tenant, LRU eviction\n * keeps the working set bounded — cold patterns are re-compiled on next\n * use, which is the correct cost trade-off for long-running processes\n * that must not leak memory.\n */\nexport const MAX_CACHE_SIZE = 256;\n\ninterface CacheEntry {\n  regex: RegExp | null;\n}\n\n/**\n * Module-level LRU cache keyed by pattern string. Map iteration order is\n * insertion order in ECMAScript, so refreshing an entry's position means\n * \"delete then re-set\". On overflow we evict the first key (least\n * recently used).\n *\n * Failed compiles are cached as `{ regex: null }` so a malformed pattern\n * does not re-enter the compiler — and so a tenant spamming bad patterns\n * doesn't burn CPU on every call.\n */\nconst patternCache: Map<string, CacheEntry> = new Map();\n\n/**\n * Threshold above which `touchCacheEntry` actually performs the LRU\n * refresh. Below this watermark the cache has zero eviction pressure, so\n * the delete+set on every hit would be pure overhead. Above it we refresh\n * properly so hot patterns survive evictions. 75% of capacity is the\n * standard sweet spot.\n */\nconst LRU_REFRESH_THRESHOLD = Math.floor((MAX_CACHE_SIZE * 3) / 4);\n\nfunction touchCacheEntry(pattern: string, entry: CacheEntry): void {\n  if (patternCache.size < LRU_REFRESH_THRESHOLD) {\n    return;\n  }\n  patternCache.delete(pattern);\n  patternCache.set(pattern, entry);\n}\n\nfunction setCacheEntry(pattern: string, entry: CacheEntry): void {\n  if (patternCache.size >= MAX_CACHE_SIZE) {\n    const oldestKey = patternCache.keys().next().value;\n    if (oldestKey !== undefined) {\n      patternCache.delete(oldestKey);\n    }\n  }\n  patternCache.set(pattern, entry);\n}\n\ninterface QuantifierFrame {\n  hasBacktrackRisk: boolean;\n}\n\nfunction skipGroupSyntaxPrefix(pattern: string, start: number): number {\n  if (start >= pattern.length || pattern[start] !== '?') {\n    return start;\n  }\n  let i = start + 1;\n  if (i >= pattern.length) {\n    return i;\n  }\n  const modifier = pattern[i];\n  if (modifier === ':' || modifier === '=' || modifier === '!') {\n    return i + 1;\n  }\n  if (modifier !== '<') {\n    return i;\n  }\n  i++;\n  if (i < pattern.length && (pattern[i] === '=' || pattern[i] === '!')) {\n    return i + 1;\n  }\n  while (i < pattern.length && pattern[i] !== '>') {\n    i++;\n  }\n  if (i < pattern.length) {\n    i++;\n  }\n  return i;\n}\n\n/**\n * Cheap syntactic detector for the most common catastrophic-backtracking\n * shape: a quantified group that contains another quantifier (e.g.\n * `(a+)+`, `(.*)*`, `(\\w+)+$`, `(?:(a+))+`). This is the \"nested\n * quantifier\" class of ReDoS — runs in polynomial-or-worse time on\n * adversarial inputs.\n *\n * The scan walks the pattern linearly using an explicit stack of group\n * frames. For each group it tracks whether the group's contents include\n * \"backtrack risk\" — meaning a direct quantifier OR a nested group that\n * carries risk up. When a group closes with a trailing quantifier AND its\n * frame carries backtrack risk, the pattern is flagged. Risk propagates\n * to the enclosing frame when a child group closes (whether the child\n * itself was quantified or not), so `(?:(a+))+` — equivalent to `(a+)+`\n * — is flagged correctly even though the outer non-capturing wrapper is\n * one level removed from the inner quantifier.\n *\n * ## Group-syntax prefixes\n *\n * Non-capturing groups (`(?:`), lookaheads (`(?=`, `(?!`), lookbehinds\n * (`(?<=`, `(?<!`), and named groups (`(?<name>`) are skipped over at\n * the `(` so their `?` is not misread as a quantifier. Without this,\n * `(?:pre_)?tool_name` would be incorrectly rejected because the scanner\n * would see the group-syntax `?` as a quantifier at depth 1.\n *\n * ## Heuristic, not a proof\n *\n * This catches the common forms but not all. Ambiguous-alternation ReDoS\n * like `(a|a)+` is not detected. Pathologically long patterns are also\n * caught by {@link MAX_PATTERN_LENGTH}. Hosts that accept user-supplied\n * patterns must still validate upstream.\n */\nexport function hasNestedQuantifier(pattern: string): boolean {\n  const stack: QuantifierFrame[] = [];\n  let i = 0;\n  while (i < pattern.length) {\n    const ch = pattern[i];\n    if (ch === '\\\\') {\n      i += 2;\n      continue;\n    }\n    if (ch === '[') {\n      i = findCharClassEnd(pattern, i) + 1;\n      continue;\n    }\n    if (ch === '(') {\n      stack.push({ hasBacktrackRisk: false });\n      i = skipGroupSyntaxPrefix(pattern, i + 1);\n      continue;\n    }\n    if (ch === ')') {\n      const frame = stack.pop();\n      if (frame === undefined) {\n        i++;\n        continue;\n      }\n      const next = pattern[i + 1];\n      const isQuantifier =\n        next === '*' || next === '+' || next === '?' || next === '{';\n      if (isQuantifier && frame.hasBacktrackRisk) {\n        return true;\n      }\n      if (stack.length > 0 && (frame.hasBacktrackRisk || isQuantifier)) {\n        stack[stack.length - 1].hasBacktrackRisk = true;\n      }\n      i++;\n      continue;\n    }\n    if (ch === '*' || ch === '+' || ch === '?' || ch === '{') {\n      if (stack.length > 0) {\n        stack[stack.length - 1].hasBacktrackRisk = true;\n      }\n    }\n    i++;\n  }\n  return false;\n}\n\nfunction findCharClassEnd(pattern: string, start: number): number {\n  let i = start + 1;\n  while (i < pattern.length) {\n    const ch = pattern[i];\n    if (ch === '\\\\') {\n      i += 2;\n      continue;\n    }\n    if (ch === ']') {\n      return i;\n    }\n    i++;\n  }\n  return pattern.length - 1;\n}\n\nfunction compile(pattern: string): RegExp | null {\n  const cached = patternCache.get(pattern);\n  if (cached !== undefined) {\n    touchCacheEntry(pattern, cached);\n    return cached.regex;\n  }\n  if (pattern.length > MAX_PATTERN_LENGTH) {\n    setCacheEntry(pattern, { regex: null });\n    return null;\n  }\n  if (hasNestedQuantifier(pattern)) {\n    setCacheEntry(pattern, { regex: null });\n    return null;\n  }\n  try {\n    const regex = new RegExp(pattern);\n    setCacheEntry(pattern, { regex });\n    return regex;\n  } catch {\n    setCacheEntry(pattern, { regex: null });\n    return null;\n  }\n}\n\n/**\n * Tests whether a hook matcher pattern matches the given query string.\n *\n * ## Semantics\n *\n * - `undefined` or empty `pattern` matches any query (wildcard). This is\n *   the intended shape for events that do not supply a query string at\n *   all (`RunStart`, `Stop`, etc.) — register such matchers without a\n *   pattern.\n * - `undefined` or empty `query` with a non-empty `pattern` never matches.\n *   Setting a pattern on a query-less event is therefore inert: the\n *   matcher will simply never fire. This is intentional — it keeps\n *   query-based filtering out of event types where \"query\" has no meaning,\n *   and is documented on `HookMatcher.pattern`.\n * - Otherwise, the pattern is compiled once (via a bounded LRU cache) and\n *   tested against the query.\n * - Invalid regex patterns never throw — a failed compile is cached as\n *   \"never matches\" so a single malformed pattern cannot take out a whole\n *   `executeHooks` batch.\n *\n * ## ReDoS mitigations\n *\n * Patterns compile through three cheap gates before reaching `new RegExp`:\n *\n * 1. {@link MAX_PATTERN_LENGTH} length cap rejects oversized inputs.\n * 2. {@link hasNestedQuantifier} rejects the most common catastrophic-\n *    backtracking shape (quantified group containing a quantifier).\n * 3. Successful compiles are cached in a bounded LRU so repeated calls\n *    never re-enter the regex compiler.\n *\n * These are a floor, not a ceiling. Hosts that accept user-supplied\n * patterns should still validate upstream. The design report §3.8 routes\n * persistable hooks through a host-side compiler before they reach this\n * module.\n */\nexport function matchesQuery(\n  pattern: string | undefined,\n  query: string | undefined\n): boolean {\n  if (pattern === undefined || pattern === '') {\n    return true;\n  }\n  if (query === undefined || query === '') {\n    return false;\n  }\n  const regex = compile(pattern);\n  if (regex === null) {\n    return false;\n  }\n  return regex.test(query);\n}\n\n/** Clears the regex compilation cache. Intended for test isolation. */\nexport function clearMatcherCache(): void {\n  patternCache.clear();\n}\n\n/** Returns the current size of the compilation cache. Intended for tests. */\nexport function getMatcherCacheSize(): number {\n  return patternCache.size;\n}\n"],"names":[],"mappings":";;AAAA;AAEA;;;;;;;;;AASG;AACI,MAAM,kBAAkB,GAAG;AAElC;;;;;;;;;AASG;AACI,MAAM,cAAc,GAAG;AAM9B;;;;;;;;;AASG;AACH,MAAM,YAAY,GAA4B,IAAI,GAAG,EAAE;AAEvD;;;;;;AAMG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,CAAC;AAElE,SAAS,eAAe,CAAC,OAAe,EAAE,KAAiB,EAAA;AACzD,IAAA,IAAI,YAAY,CAAC,IAAI,GAAG,qBAAqB,EAAE;QAC7C;IACF;AACA,IAAA,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;AAC5B,IAAA,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAClC;AAEA,SAAS,aAAa,CAAC,OAAe,EAAE,KAAiB,EAAA;AACvD,IAAA,IAAI,YAAY,CAAC,IAAI,IAAI,cAAc,EAAE;QACvC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK;AAClD,QAAA,IAAI,SAAS,KAAK,SAAS,EAAE;AAC3B,YAAA,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC;IACF;AACA,IAAA,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAClC;AAMA,SAAS,qBAAqB,CAAC,OAAe,EAAE,KAAa,EAAA;AAC3D,IAAA,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE;AACrD,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;AACjB,IAAA,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE;AACvB,QAAA,OAAO,CAAC;IACV;AACA,IAAA,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;AAC3B,IAAA,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE;QAC5D,OAAO,CAAC,GAAG,CAAC;IACd;AACA,IAAA,IAAI,QAAQ,KAAK,GAAG,EAAE;AACpB,QAAA,OAAO,CAAC;IACV;AACA,IAAA,CAAC,EAAE;IACH,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE;QACpE,OAAO,CAAC,GAAG,CAAC;IACd;AACA,IAAA,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;AAC/C,QAAA,CAAC,EAAE;IACL;AACA,IAAA,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE;AACtB,QAAA,CAAC,EAAE;IACL;AACA,IAAA,OAAO,CAAC;AACV;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BG;AACG,SAAU,mBAAmB,CAAC,OAAe,EAAA;IACjD,MAAM,KAAK,GAAsB,EAAE;IACnC,IAAI,CAAC,GAAG,CAAC;AACT,IAAA,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE;AACzB,QAAA,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AACrB,QAAA,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,CAAC,IAAI,CAAC;YACN;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;YACd,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;YACpC;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;YACvC,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;YACzC;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;AACd,YAAA,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE;AACzB,YAAA,IAAI,KAAK,KAAK,SAAS,EAAE;AACvB,gBAAA,CAAC,EAAE;gBACH;YACF;YACA,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;AAC3B,YAAA,MAAM,YAAY,GAChB,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;AAC9D,YAAA,IAAI,YAAY,IAAI,KAAK,CAAC,gBAAgB,EAAE;AAC1C,gBAAA,OAAO,IAAI;YACb;AACA,YAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,gBAAgB,IAAI,YAAY,CAAC,EAAE;gBAChE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI;YACjD;AACA,YAAA,CAAC,EAAE;YACH;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE;AACxD,YAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBACpB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI;YACjD;QACF;AACA,QAAA,CAAC,EAAE;IACL;AACA,IAAA,OAAO,KAAK;AACd;AAEA,SAAS,gBAAgB,CAAC,OAAe,EAAE,KAAa,EAAA;AACtD,IAAA,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;AACjB,IAAA,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE;AACzB,QAAA,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AACrB,QAAA,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,CAAC,IAAI,CAAC;YACN;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;AACd,YAAA,OAAO,CAAC;QACV;AACA,QAAA,CAAC,EAAE;IACL;AACA,IAAA,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;AAC3B;AAEA,SAAS,OAAO,CAAC,OAAe,EAAA;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,IAAA,IAAI,MAAM,KAAK,SAAS,EAAE;AACxB,QAAA,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC;QAChC,OAAO,MAAM,CAAC,KAAK;IACrB;AACA,IAAA,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE;QACvC,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AACA,IAAA,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE;QAChC,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AACA,IAAA,IAAI;AACF,QAAA,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC;AACjC,QAAA,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;AACjC,QAAA,OAAO,KAAK;IACd;AAAE,IAAA,MAAM;QACN,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCG;AACG,SAAU,YAAY,CAC1B,OAA2B,EAC3B,KAAyB,EAAA;IAEzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE;AAC3C,QAAA,OAAO,IAAI;IACb;IACA,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE;AACvC,QAAA,OAAO,KAAK;IACd;AACA,IAAA,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;AAC9B,IAAA,IAAI,KAAK,KAAK,IAAI,EAAE;AAClB,QAAA,OAAO,KAAK;IACd;AACA,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;AAC1B;;;;;;;"}

package/dist/cjs/hooks/types.cjs

@@ -0,0 +1,27 @@
+'use strict';
+
+/**
+ * Closed set of hook lifecycle events supported by the hooks system.
+ *
+ * These mirror the subset of Claude Code's event surface that makes sense
+ * for a library context (no filesystem/CLI-specific events). See
+ * `docs/hooks-design-report.md` §3.2 for the mapping to existing
+ * `@librechat/agents` emission points.
+ */
+const HOOK_EVENTS = [
+    'RunStart',
+    'UserPromptSubmit',
+    'PreToolUse',
+    'PostToolUse',
+    'PostToolUseFailure',
+    'PermissionDenied',
+    'SubagentStart',
+    'SubagentStop',
+    'Stop',
+    'StopFailure',
+    'PreCompact',
+    'PostCompact',
+];
+
+exports.HOOK_EVENTS = HOOK_EVENTS;
+//# sourceMappingURL=types.cjs.map

package/dist/cjs/hooks/types.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.cjs","sources":["../../../src/hooks/types.ts"],"sourcesContent":["// src/hooks/types.ts\nimport type { BaseMessage } from '@langchain/core/messages';\n\n/**\n * Closed set of hook lifecycle events supported by the hooks system.\n *\n * These mirror the subset of Claude Code's event surface that makes sense\n * for a library context (no filesystem/CLI-specific events). See\n * `docs/hooks-design-report.md` §3.2 for the mapping to existing\n * `@librechat/agents` emission points.\n */\nexport const HOOK_EVENTS = [\n  'RunStart',\n  'UserPromptSubmit',\n  'PreToolUse',\n  'PostToolUse',\n  'PostToolUseFailure',\n  'PermissionDenied',\n  'SubagentStart',\n  'SubagentStop',\n  'Stop',\n  'StopFailure',\n  'PreCompact',\n  'PostCompact',\n] as const;\n\nexport type HookEvent = (typeof HOOK_EVENTS)[number];\n\n/** Tool-gating decision; executeHooks folds with `deny > ask > allow` precedence. */\nexport type ToolDecision = 'allow' | 'deny' | 'ask';\n\n/** Stop-loop decision; `block` means \"do not stop, run another turn\". Any `block` wins. */\nexport type StopDecision = 'continue' | 'block';\n\n/**\n * Fields shared by every `HookInput`. Discriminated by `hook_event_name`.\n *\n * - `runId` identifies the current agent run and is always present.\n * - `threadId` identifies the conversation thread when the host has one.\n * - `agentId` is only set when the hook fires inside a subagent scope.\n */\nexport interface BaseHookInput {\n  runId: string;\n  threadId?: string;\n  agentId?: string;\n}\n\nexport interface RunStartHookInput extends BaseHookInput {\n  hook_event_name: 'RunStart';\n  messages: BaseMessage[];\n}\n\nexport interface UserPromptSubmitHookInput extends BaseHookInput {\n  hook_event_name: 'UserPromptSubmit';\n  prompt: string;\n  attachments?: BaseMessage[];\n}\n\n/**\n * Fires before a tool is invoked. Hook may return `deny`/`ask`/`allow` and/or\n * an `updatedInput` that replaces the tool arguments before invocation.\n *\n * `toolInput` is intentionally typed as `Record<string, unknown>` because the\n * SDK is tool-agnostic — concrete tool argument shapes are only known at the\n * call site and are narrowed by the host. This is the one escape hatch in\n * the hook type system.\n */\nexport interface PreToolUseHookInput extends BaseHookInput {\n  hook_event_name: 'PreToolUse';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolUseId: string;\n  stepId?: string;\n  /**\n   * Number of times this tool has been invoked in prior batches within the\n   * current run. Within a single batch of parallel calls, all calls to the\n   * same tool share the same turn value — per-call discrimination within a\n   * batch is not supported in v1.\n   */\n  turn?: number;\n}\n\nexport interface PostToolUseHookInput extends BaseHookInput {\n  hook_event_name: 'PostToolUse';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolOutput: unknown;\n  toolUseId: string;\n  stepId?: string;\n  turn?: number;\n}\n\nexport interface PostToolUseFailureHookInput extends BaseHookInput {\n  hook_event_name: 'PostToolUseFailure';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolUseId: string;\n  error: string;\n  stepId?: string;\n  turn?: number;\n}\n\nexport interface PermissionDeniedHookInput extends BaseHookInput {\n  hook_event_name: 'PermissionDenied';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolUseId: string;\n  reason: string;\n}\n\nexport interface SubagentStartHookInput extends BaseHookInput {\n  hook_event_name: 'SubagentStart';\n  parentAgentId?: string;\n  agentId: string;\n  agentType: string;\n  inputs: BaseMessage[];\n}\n\nexport interface SubagentStopHookInput extends BaseHookInput {\n  hook_event_name: 'SubagentStop';\n  agentId: string;\n  agentType: string;\n  messages: BaseMessage[];\n}\n\nexport interface StopHookInput extends BaseHookInput {\n  hook_event_name: 'Stop';\n  messages: BaseMessage[];\n  stopReason?: string;\n  stopHookActive: boolean;\n}\n\nexport interface StopFailureHookInput extends BaseHookInput {\n  hook_event_name: 'StopFailure';\n  error: string;\n  lastAssistantMessage?: BaseMessage;\n}\n\nexport interface PreCompactHookInput extends BaseHookInput {\n  hook_event_name: 'PreCompact';\n  messagesBeforeCount: number;\n  trigger: 'threshold' | 'manual' | 'error';\n}\n\nexport interface PostCompactHookInput extends BaseHookInput {\n  hook_event_name: 'PostCompact';\n  summary: string;\n  messagesAfterCount: number;\n}\n\n/** Discriminated union of every hook input shape. */\nexport type HookInput =\n  | RunStartHookInput\n  | UserPromptSubmitHookInput\n  | PreToolUseHookInput\n  | PostToolUseHookInput\n  | PostToolUseFailureHookInput\n  | PermissionDeniedHookInput\n  | SubagentStartHookInput\n  | SubagentStopHookInput\n  | StopHookInput\n  | StopFailureHookInput\n  | PreCompactHookInput\n  | PostCompactHookInput;\n\n/** Compile-time map from event name to its input shape. */\nexport type HookInputByEvent = {\n  RunStart: RunStartHookInput;\n  UserPromptSubmit: UserPromptSubmitHookInput;\n  PreToolUse: PreToolUseHookInput;\n  PostToolUse: PostToolUseHookInput;\n  PostToolUseFailure: PostToolUseFailureHookInput;\n  PermissionDenied: PermissionDeniedHookInput;\n  SubagentStart: SubagentStartHookInput;\n  SubagentStop: SubagentStopHookInput;\n  Stop: StopHookInput;\n  StopFailure: StopFailureHookInput;\n  PreCompact: PreCompactHookInput;\n  PostCompact: PostCompactHookInput;\n};\n\n/**\n * Fields common to every hook output. Hooks that have nothing to say simply\n * return `{}` (or omit the fields below).\n */\nexport interface BaseHookOutput {\n  /** Context string to inject into the conversation. Accumulated across hooks. */\n  additionalContext?: string;\n  /** True to prevent the next model turn. Any hook can set this. */\n  preventContinuation?: boolean;\n  /** Reason reported alongside `preventContinuation`. */\n  stopReason?: string;\n}\n\nexport type RunStartHookOutput = BaseHookOutput;\n\nexport interface UserPromptSubmitHookOutput extends BaseHookOutput {\n  decision?: ToolDecision;\n  reason?: string;\n}\n\nexport interface PreToolUseHookOutput extends BaseHookOutput {\n  decision?: ToolDecision;\n  reason?: string;\n  /**\n   * Replacement tool input. Merged into the pending tool call by the host.\n   *\n   * When multiple hooks set `updatedInput` within a single `executeHooks`\n   * call, the last writer in registration order wins (outer loop: matcher\n   * registration order; inner loop: hook position within the matcher). The\n   * winner is deterministic — `Promise.all` preserves input-array order.\n   * Consumers that need a single authoritative rewrite should still scope\n   * `updatedInput` to one hook per matcher to avoid confusing precedence.\n   */\n  updatedInput?: Record<string, unknown>;\n}\n\nexport interface PostToolUseHookOutput extends BaseHookOutput {\n  /**\n   * Replacement tool output. Flows through the aggregated result so the\n   * host can substitute it before appending the tool result message.\n   * Ordering semantics match `PreToolUseHookOutput.updatedInput`:\n   * last-writer-wins in registration order.\n   */\n  updatedOutput?: unknown;\n}\n\nexport type PostToolUseFailureHookOutput = BaseHookOutput;\n\nexport type PermissionDeniedHookOutput = BaseHookOutput;\n\nexport interface SubagentStartHookOutput extends BaseHookOutput {\n  decision?: ToolDecision;\n  reason?: string;\n}\n\nexport type SubagentStopHookOutput = BaseHookOutput;\n\nexport interface StopHookOutput extends BaseHookOutput {\n  decision?: StopDecision;\n  reason?: string;\n}\n\nexport type StopFailureHookOutput = BaseHookOutput;\n\nexport type PreCompactHookOutput = BaseHookOutput;\n\nexport type PostCompactHookOutput = BaseHookOutput;\n\n/** Compile-time map from event name to its output shape. */\nexport type HookOutputByEvent = {\n  RunStart: RunStartHookOutput;\n  UserPromptSubmit: UserPromptSubmitHookOutput;\n  PreToolUse: PreToolUseHookOutput;\n  PostToolUse: PostToolUseHookOutput;\n  PostToolUseFailure: PostToolUseFailureHookOutput;\n  PermissionDenied: PermissionDeniedHookOutput;\n  SubagentStart: SubagentStartHookOutput;\n  SubagentStop: SubagentStopHookOutput;\n  Stop: StopHookOutput;\n  StopFailure: StopFailureHookOutput;\n  PreCompact: PreCompactHookOutput;\n  PostCompact: PostCompactHookOutput;\n};\n\n/** Superset output shape used by the executor's fold loop. */\nexport type HookOutput =\n  | RunStartHookOutput\n  | UserPromptSubmitHookOutput\n  | PreToolUseHookOutput\n  | PostToolUseHookOutput\n  | PostToolUseFailureHookOutput\n  | PermissionDeniedHookOutput\n  | SubagentStartHookOutput\n  | SubagentStopHookOutput\n  | StopHookOutput\n  | StopFailureHookOutput\n  | PreCompactHookOutput\n  | PostCompactHookOutput;\n\n/**\n * A hook callback is a plain async function registered against a specific\n * event. The `signal` is always supplied by `executeHooks` and combines the\n * batch's parent signal with the per-hook timeout — callbacks that perform\n * long-running work should observe it.\n */\nexport type HookCallback<E extends HookEvent = HookEvent> = (\n  input: HookInputByEvent[E],\n  signal: AbortSignal\n) => HookOutputByEvent[E] | Promise<HookOutputByEvent[E]>;\n\n/**\n * A matcher groups one or more callbacks under a shared regex filter and\n * shared timeout/once/internal flags. The generic `E` ties the callback\n * types to the event the matcher is registered against.\n */\nexport interface HookMatcher<E extends HookEvent = HookEvent> {\n  /**\n   * Regex pattern matched against the event's primary query string (e.g.\n   * the tool name for `PreToolUse`, the agent type for `SubagentStart`).\n   *\n   * Omitted or empty means \"always match\". For events that do not supply a\n   * query string (`RunStart`, `Stop`, etc.), only wildcard matchers fire —\n   * a non-empty pattern on such events will never match.\n   *\n   * Patterns are treated as trusted input: `executeHooks` compiles them\n   * with `new RegExp(pattern)` without any sandbox, and a pathological\n   * pattern can block the event loop. Host registration code is expected\n   * to validate or length-bound patterns that originate from user input.\n   */\n  pattern?: string;\n  /** Callbacks that fire when the matcher hits. Executed in parallel. */\n  hooks: HookCallback<E>[];\n  /** Per-matcher timeout in ms. Defaults to the executor's batch timeout. */\n  timeout?: number;\n  /**\n   * Atomically remove the matcher before its first dispatch.\n   *\n   * `executeHooks` claims `once: true` matchers synchronously — between\n   * `getMatchers` and its first `await` — so two concurrent calls cannot\n   * both dispatch the same matcher. Whichever call runs its sync prefix\n   * first wins the matcher; the other sees an empty bucket.\n   *\n   * Semantics are \"at most one dispatch, ever\" — if every hook in the\n   * matcher throws, the matcher is still gone. Use `once` for\n   * fire-and-forget bootstrapping (registration, telemetry, setup). Hosts\n   * that need retry semantics should register a normal matcher and\n   * self-unregister via the callback returned from `registry.register`.\n   */\n  once?: boolean;\n  /** Internal hooks are excluded from telemetry and non-fatal error logging. */\n  internal?: boolean;\n}\n\n/**\n * Storage shape for matchers keyed by event. Each event's matcher list is\n * a generic array parameterized by that event type, so lookup via\n * `HooksByEvent[E]` preserves type-safe callback signatures.\n */\nexport type HooksByEvent = {\n  [E in HookEvent]?: HookMatcher<E>[];\n};\n\n/**\n * Aggregated result of a single `executeHooks` call. Fields are populated\n * according to the fold rules in `executeHooks.ts`.\n */\nexport interface AggregatedHookResult {\n  /** Folded tool-gating decision; `deny > ask > allow`. */\n  decision?: ToolDecision;\n  /** Folded stop decision; any `block` wins. */\n  stopDecision?: StopDecision;\n  /** Reason from the hook that set the winning decision. */\n  reason?: string;\n  /**\n   * Replacement tool input from a `PreToolUse` hook.\n   *\n   * Last-writer-wins in **registration order**: `executeHooks` uses\n   * `Promise.all`, which preserves input-array order, so the fold iterates\n   * outcomes in the same order they were pushed — outer loop over matchers\n   * as they sit in the registry, inner loop over each matcher's `hooks`\n   * array. The winner is therefore deterministic but may not match the\n   * order in which hooks actually completed. Consumers that want a single\n   * authoritative rewrite should still register one `updatedInput`-setting\n   * hook per matcher to avoid subtle precedence bugs.\n   */\n  updatedInput?: Record<string, unknown>;\n  /**\n   * Replacement tool output from a `PostToolUse` hook.\n   *\n   * Same last-writer-wins-in-registration-order semantics as\n   * `updatedInput`. Present only when at least one hook set it; `undefined`\n   * means \"use the original tool output\".\n   */\n  updatedOutput?: unknown;\n  /** Accumulated `additionalContext` strings from every hook, in order. */\n  additionalContexts: string[];\n  /** True if any hook returned `preventContinuation`. */\n  preventContinuation?: boolean;\n  /**\n   * Reason recorded alongside `preventContinuation`. First winner wins:\n   * once a hook sets both flags, later hooks that also set\n   * `preventContinuation` do not overwrite the reason.\n   */\n  stopReason?: string;\n  /** Error messages from hooks that threw; always present (possibly empty). */\n  errors: string[];\n}\n"],"names":[],"mappings":";;AAGA;;;;;;;AAOG;AACI,MAAM,WAAW,GAAG;IACzB,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,oBAAoB;IACpB,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,MAAM;IACN,aAAa;IACb,YAAY;IACZ,aAAa;;;;;"}

package/dist/cjs/llm/anthropic/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sources":["../../../../src/llm/anthropic/types.ts"],"sourcesContent":["import Anthropic from '@anthropic-ai/sdk';\nimport { BindToolsInput } from '@langchain/core/language_models/chat_models';\n\nexport type AnthropicStreamUsage = Anthropic.Usage;\nexport type AnthropicMessageDeltaEvent = Anthropic.MessageDeltaEvent;\nexport type AnthropicMessageStartEvent = Anthropic.MessageStartEvent;\n\nexport type AnthropicToolResponse = {\n  type: 'tool_use';\n  id: string;\n  name: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  input: Record<string, any>;\n};\n\nexport type AnthropicMessageParam = Anthropic.MessageParam;\nexport type AnthropicMessageResponse =\n  | Anthropic.ContentBlock\n  | AnthropicToolResponse;\nexport type AnthropicMessageCreateParams =\n  Anthropic.MessageCreateParamsNonStreaming;\nexport type AnthropicStreamingMessageCreateParams =\n  Anthropic.MessageCreateParamsStreaming;\nexport type AnthropicThinkingConfigParam = Anthropic.ThinkingConfigParam;\nexport type AnthropicMessageStreamEvent = Anthropic.MessageStreamEvent;\nexport type AnthropicRequestOptions = Anthropic.RequestOptions;\nexport type AnthropicToolChoice =\n  | {\n      type: 'tool';\n      name: string;\n    }\n  | 'any'\n  | 'auto'\n  | 'none'\n  | string;\nexport type ChatAnthropicToolType = Anthropic.Messages.Tool | BindToolsInput;\nexport type AnthropicTextBlockParam = Anthropic.Messages.TextBlockParam;\nexport type AnthropicImageBlockParam = Anthropic.Messages.ImageBlockParam;\nexport type AnthropicToolUseBlockParam = Anthropic.Messages.ToolUseBlockParam;\nexport type AnthropicToolResultBlockParam =\n  Anthropic.Messages.ToolResultBlockParam;\nexport type AnthropicDocumentBlockParam = Anthropic.Messages.DocumentBlockParam;\nexport type AnthropicThinkingBlockParam = Anthropic.Messages.ThinkingBlockParam;\nexport type AnthropicRedactedThinkingBlockParam =\n  Anthropic.Messages.RedactedThinkingBlockParam;\nexport type AnthropicServerToolUseBlockParam =\n  Anthropic.Messages.ServerToolUseBlockParam;\nexport type AnthropicWebSearchToolResultBlockParam =\n  Anthropic.Messages.WebSearchToolResultBlockParam;\nexport type AnthropicWebSearchResultBlockParam =\n  Anthropic.Messages.WebSearchResultBlockParam;\nexport type AnthropicSearchResultBlockParam =\n  Anthropic.Beta.BetaSearchResultBlockParam;\nexport type AnthropicCompactionBlockParam =\n  Anthropic.Beta.BetaCompactionBlockParam;\nexport type AnthropicOutputConfig = Anthropic.Messages.OutputConfig;\nexport type ChatAnthropicOutputFormat = Anthropic.Messages.JSONOutputFormat;\n\n// Union of all possible content block types including server tool use\nexport type AnthropicContentBlock =\n  | AnthropicTextBlockParam\n  | AnthropicImageBlockParam\n  | AnthropicToolUseBlockParam\n  | AnthropicToolResultBlockParam\n  | AnthropicDocumentBlockParam\n  | AnthropicThinkingBlockParam\n  | AnthropicRedactedThinkingBlockParam\n  | AnthropicServerToolUseBlockParam\n  | AnthropicWebSearchToolResultBlockParam\n  | AnthropicWebSearchResultBlockParam\n  | AnthropicCompactionBlockParam;\n\n// Union of all possible content block types including server tool use\nexport type ChatAnthropicContentBlock =\n  | AnthropicTextBlockParam\n  | AnthropicImageBlockParam\n  | AnthropicToolUseBlockParam\n  | AnthropicToolResultBlockParam\n  | AnthropicDocumentBlockParam\n  | AnthropicThinkingBlockParam\n  | AnthropicRedactedThinkingBlockParam\n  | AnthropicServerToolUseBlockParam\n  | AnthropicWebSearchToolResultBlockParam\n  | AnthropicWebSearchResultBlockParam\n  | AnthropicSearchResultBlockParam\n  | AnthropicCompactionBlockParam;\n\nexport function isAnthropicImageBlockParam(\n  block: unknown\n): block is AnthropicImageBlockParam {\n  if (block == null) {\n    return false;\n  }\n  if (typeof block !== 'object') {\n    return false;\n  }\n  if (!('type' in block) || block.type !== 'image') {\n    return false;\n  }\n\n  if (!('source' in block) || typeof block.source !== 'object') {\n    return false;\n  }\n\n  if (block.source == null) {\n    return false;\n  }\n\n  if (!('type' in block.source)) {\n    return false;\n  }\n\n  if (block.source.type === 'base64') {\n    if (!('media_type' in block.source)) {\n      return false;\n    }\n\n    if (typeof block.source.media_type !== 'string') {\n      return false;\n    }\n\n    if (!('data' in block.source)) {\n      return false;\n    }\n\n    if (typeof block.source.data !== 'string') {\n      return false;\n    }\n\n    return true;\n  }\n\n  if (block.source.type === 'url') {\n    if (!('url' in block.source)) {\n      return false;\n    }\n\n    if (typeof block.source.url !== 'string') {\n      return false;\n    }\n\n    return true;\n  }\n\n  return false;\n}\n"],"names":[],"mappings":";;AAuFM,SAAU,0BAA0B,CACxC,KAAc,EAAA;AAEd,IAAA,IAAI,KAAK,IAAI,IAAI,EAAE;AACjB,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE;AAChD,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE;AAC5D,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE;AACxB,QAAA,OAAO,KAAK;IACd;IAEA,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AAC7B,QAAA,OAAO,KAAK;IACd;IAEA,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE;QAClC,IAAI,EAAE,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AACnC,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE;AAC/C,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AAC7B,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE;AACzC,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,OAAO,IAAI;IACb;IAEA,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE;QAC/B,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AAC5B,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE;AACxC,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,OAAO,KAAK;AACd;;;;"}
+{"version":3,"file":"types.cjs","sources":["../../../../src/llm/anthropic/types.ts"],"sourcesContent":["import Anthropic from '@anthropic-ai/sdk';\nimport { BindToolsInput } from '@langchain/core/language_models/chat_models';\n\nexport type AnthropicStreamUsage = Anthropic.Usage;\nexport type AnthropicMessageDeltaEvent = Anthropic.MessageDeltaEvent;\nexport type AnthropicMessageStartEvent = Anthropic.MessageStartEvent;\n\nexport type AnthropicToolResponse = {\n  type: 'tool_use' | 'server_tool_use';\n  id: string;\n  name: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  input: Record<string, any>;\n};\n\nexport type AnthropicMessageParam = Anthropic.MessageParam;\nexport type AnthropicMessageResponse =\n  | Anthropic.ContentBlock\n  | AnthropicToolResponse;\nexport type AnthropicMessageCreateParams =\n  Anthropic.MessageCreateParamsNonStreaming;\nexport type AnthropicStreamingMessageCreateParams =\n  Anthropic.MessageCreateParamsStreaming;\nexport type AnthropicThinkingConfigParam = Anthropic.ThinkingConfigParam;\nexport type AnthropicMessageStreamEvent = Anthropic.MessageStreamEvent;\nexport type AnthropicRequestOptions = Anthropic.RequestOptions;\nexport type AnthropicToolChoice =\n  | {\n      type: 'tool';\n      name: string;\n    }\n  | 'any'\n  | 'auto'\n  | 'none'\n  | string;\nexport type ChatAnthropicToolType = Anthropic.Messages.Tool | BindToolsInput;\nexport type AnthropicTextBlockParam = Anthropic.Messages.TextBlockParam;\nexport type AnthropicImageBlockParam = Anthropic.Messages.ImageBlockParam;\nexport type AnthropicToolUseBlockParam = Anthropic.Messages.ToolUseBlockParam;\nexport type AnthropicToolResultBlockParam =\n  Anthropic.Messages.ToolResultBlockParam;\nexport type AnthropicDocumentBlockParam = Anthropic.Messages.DocumentBlockParam;\nexport type AnthropicThinkingBlockParam = Anthropic.Messages.ThinkingBlockParam;\nexport type AnthropicRedactedThinkingBlockParam =\n  Anthropic.Messages.RedactedThinkingBlockParam;\nexport type AnthropicServerToolUseBlockParam =\n  Anthropic.Messages.ServerToolUseBlockParam;\nexport type AnthropicWebSearchToolResultBlockParam =\n  Anthropic.Messages.WebSearchToolResultBlockParam;\nexport type AnthropicWebSearchResultBlockParam =\n  Anthropic.Messages.WebSearchResultBlockParam;\nexport type AnthropicSearchResultBlockParam =\n  Anthropic.Beta.BetaSearchResultBlockParam;\nexport type AnthropicCompactionBlockParam =\n  Anthropic.Beta.BetaCompactionBlockParam;\nexport type AnthropicOutputConfig = Anthropic.Messages.OutputConfig;\nexport type ChatAnthropicOutputFormat = Anthropic.Messages.JSONOutputFormat;\n\n// Union of all possible content block types including server tool use\nexport type AnthropicContentBlock =\n  | AnthropicTextBlockParam\n  | AnthropicImageBlockParam\n  | AnthropicToolUseBlockParam\n  | AnthropicToolResultBlockParam\n  | AnthropicDocumentBlockParam\n  | AnthropicThinkingBlockParam\n  | AnthropicRedactedThinkingBlockParam\n  | AnthropicServerToolUseBlockParam\n  | AnthropicWebSearchToolResultBlockParam\n  | AnthropicWebSearchResultBlockParam\n  | AnthropicCompactionBlockParam;\n\n// Union of all possible content block types including server tool use\nexport type ChatAnthropicContentBlock =\n  | AnthropicTextBlockParam\n  | AnthropicImageBlockParam\n  | AnthropicToolUseBlockParam\n  | AnthropicToolResultBlockParam\n  | AnthropicDocumentBlockParam\n  | AnthropicThinkingBlockParam\n  | AnthropicRedactedThinkingBlockParam\n  | AnthropicServerToolUseBlockParam\n  | AnthropicWebSearchToolResultBlockParam\n  | AnthropicWebSearchResultBlockParam\n  | AnthropicSearchResultBlockParam\n  | AnthropicCompactionBlockParam;\n\nexport function isAnthropicImageBlockParam(\n  block: unknown\n): block is AnthropicImageBlockParam {\n  if (block == null) {\n    return false;\n  }\n  if (typeof block !== 'object') {\n    return false;\n  }\n  if (!('type' in block) || block.type !== 'image') {\n    return false;\n  }\n\n  if (!('source' in block) || typeof block.source !== 'object') {\n    return false;\n  }\n\n  if (block.source == null) {\n    return false;\n  }\n\n  if (!('type' in block.source)) {\n    return false;\n  }\n\n  if (block.source.type === 'base64') {\n    if (!('media_type' in block.source)) {\n      return false;\n    }\n\n    if (typeof block.source.media_type !== 'string') {\n      return false;\n    }\n\n    if (!('data' in block.source)) {\n      return false;\n    }\n\n    if (typeof block.source.data !== 'string') {\n      return false;\n    }\n\n    return true;\n  }\n\n  if (block.source.type === 'url') {\n    if (!('url' in block.source)) {\n      return false;\n    }\n\n    if (typeof block.source.url !== 'string') {\n      return false;\n    }\n\n    return true;\n  }\n\n  return false;\n}\n"],"names":[],"mappings":";;AAuFM,SAAU,0BAA0B,CACxC,KAAc,EAAA;AAEd,IAAA,IAAI,KAAK,IAAI,IAAI,EAAE;AACjB,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE;AAChD,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE;AAC5D,QAAA,OAAO,KAAK;IACd;AAEA,IAAA,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE;AACxB,QAAA,OAAO,KAAK;IACd;IAEA,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AAC7B,QAAA,OAAO,KAAK;IACd;IAEA,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE;QAClC,IAAI,EAAE,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AACnC,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE;AAC/C,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AAC7B,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE;AACzC,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,OAAO,IAAI;IACb;IAEA,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE;QAC/B,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;AAC5B,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE;AACxC,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,OAAO,KAAK;AACd;;;;"}

package/dist/cjs/llm/anthropic/utils/message_inputs.cjs

@@ -98,7 +98,9 @@ function _convertLangChainToolCallToAnthropic(toolCall) {
         throw new Error('Anthropic requires all tool calls to have an "id".');
     }
     return {
-        type: 'tool_use',
+        type: toolCall.id.startsWith(_enum.Constants.ANTHROPIC_SERVER_TOOL_PREFIX)
+            ? 'server_tool_use'
+            : 'tool_use',
         id: toolCall.id,
         name: toolCall.name,
         input: toolCall.args,
@@ -303,71 +305,74 @@ function _formatContent(message) {
     else {
         const contentBlocks = content.map((contentPart) => {
             /**
-             * Handle malformed blocks that have server tool fields mixed with text type.
-             * These can occur when server_tool_use blocks get mislabeled during aggregation.
-             * Correct their type ONLY if we can confirm it's a server tool by checking the ID prefix.
-             * Anthropic needs both server_tool_use and web_search_tool_result blocks for citations to work.
+             * Normalize server_tool_use blocks into a clean shape the API accepts.
+             * These blocks may arrive with the correct type (server_tool_use) or mislabeled
+             * as text/tool_use after chunk concatenation or state serialization.
+             * Regardless of current type, if the id starts with 'srvtoolu_' we rebuild
+             * a clean block with only the properties the API expects.
              */
             if ('id' in contentPart &&
-                'name' in contentPart &&
-                'input' in contentPart &&
-                contentPart.type === 'text') {
+                typeof contentPart.id === 'string' &&
+                contentPart.id.startsWith(_enum.Constants.ANTHROPIC_SERVER_TOOL_PREFIX) &&
+                'name' in contentPart) {
                 const rawPart = contentPart;
-                const id = rawPart.id;
-                if (id && id.startsWith(_enum.Constants.ANTHROPIC_SERVER_TOOL_PREFIX)) {
-                    let input = rawPart.input;
-                    // Ensure input is an object
-                    if (typeof input === 'string') {
-                        try {
-                            input = JSON.parse(input);
-                        }
-                        catch {
-                            input = {};
-                        }
+                let input = rawPart.input;
+                if (typeof input === 'string') {
+                    try {
+                        input = JSON.parse(input);
                     }
+                    catch {
+                        input = {};
+                    }
+                }
+                const corrected = {
+                    type: 'server_tool_use',
+                    id: rawPart.id,
+                    name: (rawPart.name ?? 'web_search'),
+                    input: (input ?? {}),
+                };
+                return corrected;
+            }
+            /**
+             * Normalize web_search_tool_result blocks into a clean shape.
+             * Same rationale as above — the block may carry extra properties from
+             * streaming (input, index, etc.) that the API rejects. Rebuild cleanly.
+             */
+            if ('tool_use_id' in contentPart &&
+                typeof contentPart.tool_use_id ===
+                    'string' &&
+                contentPart.tool_use_id.startsWith(_enum.Constants.ANTHROPIC_SERVER_TOOL_PREFIX) &&
+                'content' in contentPart) {
+                const rawPart = contentPart;
+                const content = rawPart.content;
+                const isValidContent = Array.isArray(content) ||
+                    (content != null &&
+                        typeof content === 'object' &&
+                        'type' in content &&
+                        content.type ===
+                            'web_search_tool_result_error');
+                if (isValidContent) {
                     const corrected = {
-                        type: 'server_tool_use',
-                        id,
-                        name: 'web_search',
-                        input: input,
+                        type: 'web_search_tool_result',
+                        tool_use_id: rawPart.tool_use_id,
+                        content: content,
                     };
                     return corrected;
                 }
-                // If it's not a server tool, skip it (return null to filter it out)
                 return null;
             }
             /**
-             * Handle malformed web_search_tool_result blocks marked as text.
-             * These have tool_use_id and nested content - fix their type instead of filtering.
-             * Only correct if we can confirm it's a web search result by checking the tool_use_id prefix.
-             *
-             * Handles both success results (array content) and error results (object with error_code).
+             * Skip non-server malformed blocks that have tool fields mixed with text type.
              */
+            if ('id' in contentPart &&
+                'name' in contentPart &&
+                'input' in contentPart &&
+                contentPart.type === 'text') {
+                return null;
+            }
             if ('tool_use_id' in contentPart &&
                 'content' in contentPart &&
                 contentPart.type === 'text') {
-                const rawPart = contentPart;
-                const toolUseId = rawPart.tool_use_id;
-                const content = rawPart.content;
-                if (toolUseId &&
-                    toolUseId.startsWith(_enum.Constants.ANTHROPIC_SERVER_TOOL_PREFIX)) {
-                    // Verify content is either an array (success) or error object
-                    const isValidContent = Array.isArray(content) ||
-                        (content != null &&
-                            typeof content === 'object' &&
-                            'type' in content &&
-                            content.type ===
-                                'web_search_tool_result_error');
-                    if (isValidContent) {
-                        const corrected = {
-                            type: 'web_search_tool_result',
-                            tool_use_id: toolUseId,
-                            content: content,
-                        };
-                        return corrected;
-                    }
-                }
-                // If it's not a recognized server tool result format, skip it (return null to filter it out)
                 return null;
             }
             if (messages.isDataContentBlock(contentPart)) {
@@ -461,6 +466,12 @@ function _formatContent(message) {
                     // and is not a valid type for Anthropic messages.
                     contentPartCopy.type = 'tool_use';
                 }
+                if (contentPartCopy.type === 'tool_use' &&
+                    'id' in contentPartCopy &&
+                    typeof contentPartCopy.id === 'string' &&
+                    contentPartCopy.id.startsWith(_enum.Constants.ANTHROPIC_SERVER_TOOL_PREFIX)) {
+                    contentPartCopy.type = 'server_tool_use';
+                }
                 if ('input' in contentPartCopy) {
                     // Anthropic tool use inputs should be valid objects, when applicable.
                     if (typeof contentPartCopy.input === 'string') {
@@ -507,7 +518,8 @@ function _formatContent(message) {
                 throw new Error('Unsupported message content format');
             }
         });
-        return contentBlocks.filter((block) => block !== null);
+        return contentBlocks.filter((block) => block !== null &&
+            !(block.type === 'text' && 'text' in block && block.text === ''));
     }
 }
 /**
@@ -542,10 +554,13 @@ function _convertMessagesToAnthropicPayload(messages$1) {
         }
         if (messages.isAIMessage(message) && !!message.tool_calls?.length) {
             if (typeof message.content === 'string') {
+                const clientToolCalls = message.tool_calls.filter((tc) => !(tc.id?.startsWith(_enum.Constants.ANTHROPIC_SERVER_TOOL_PREFIX) ?? false));
                 if (message.content === '') {
                     return {
                         role,
-                        content: message.tool_calls.map(_convertLangChainToolCallToAnthropic),
+                        content: clientToolCalls.length > 0
+                            ? clientToolCalls.map(_convertLangChainToolCallToAnthropic)
+                            : [{ type: 'text', text: ' ' }],
                     };
                 }
                 else {
@@ -553,7 +568,7 @@ function _convertMessagesToAnthropicPayload(messages$1) {
                         role,
                         content: [
                             { type: 'text', text: message.content },
-                            ...message.tool_calls.map(_convertLangChainToolCallToAnthropic),
+                            ...clientToolCalls.map(_convertLangChainToolCallToAnthropic),
                         ],
                     };
                 }