@librechat/agents 3.1.77-dev.1 → 3.1.78-dev.0

package/src/tools/__tests__/ProgrammaticToolCalling.test.ts

@@ -1062,4 +1062,179 @@ for member in team:
       expect(results[1].result.result).toBe(5);
     });
   });
+
+  describe('bash bridge script does not require python3 (Codex P2 #19)', () => {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { _createBashProgramForTests } = require('../local/LocalProgrammaticToolCalling');
+
+    it('uses curl as the primary HTTP helper with python3 only as fallback', () => {
+      const script: string = _createBashProgramForTests(
+        'echo hello',
+        [],
+        'http://127.0.0.1:9999/tool',
+        'test-token'
+      );
+      // Curl path must be present and gated by `command -v curl` so
+      // it's tried first on hosts that have it.
+      expect(script).toContain('command -v curl');
+      expect(script).toContain('curl -sS -X POST');
+      // Python3 must remain as a fallback (not removed).
+      expect(script).toContain('command -v python3');
+      expect(script).toContain('python3 - "$__LIBRECHAT_TOOL_BRIDGE"');
+      // Curl branch must come BEFORE python3 — bash `if/elif` order
+      // determines which helper is preferred. Pre-fix, python3 was
+      // unconditional and the bash bridge failed on python3-less
+      // hosts (minimal containers, some Windows setups).
+      expect(script.indexOf('command -v curl')).toBeLessThan(
+        script.indexOf('command -v python3')
+      );
+      // Curl uses the bridge's text-mode endpoint to skip JSON
+      // parsing on the bash side.
+      expect(script).toContain('?mode=text');
+      // Helpful error when neither helper is available.
+      expect(script).toContain('needs either curl or python3');
+    });
+  });
+
+  describe('bridge runs PreToolUse hooks for inner tool calls (manual finding A)', () => {
+    // The bridge spawned by `run_tools_with_code` / `run_tools_with_bash`
+    // used to call inner tools via `executeTools` directly, bypassing
+    // every PreToolUse hook the host registered. Manual review flagged
+    // this as a P1 bypass — `write_file` could be invoked from inside
+    // a programmatic block while the host's `write_file` deny policy
+    // never saw it. Now ToolNode threads a `hookContext` into the
+    // programmatic-tool factory; the bridge runs PreToolUse before
+    // each inner call, fail-closing on `deny`/`ask`.
+
+    it('honours `decision: deny` for inner tool calls invoked through the bridge', async () => {
+      const { tool } = await import('@langchain/core/tools');
+      const { z } = await import('zod');
+      const { HookRegistry } = await import('@/hooks');
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      const ptcMod = require('../local/LocalProgrammaticToolCalling');
+
+      let callsMade = 0;
+      const writeFileTool = tool(
+        async () => {
+          callsMade += 1;
+          return 'wrote file';
+        },
+        {
+          name: 'write_file',
+          description: 'mock write tool',
+          schema: z.object({ path: z.string() }),
+        }
+      );
+      const toolMap = new Map([['write_file', writeFileTool]]);
+      const registry = new HookRegistry();
+      registry.register('PreToolUse', {
+        hooks: [
+          async (input) => {
+            if (input.toolName === 'write_file') {
+              return { decision: 'deny', reason: 'no writes from bridge' };
+            }
+            return { decision: 'allow' };
+          },
+        ],
+      });
+
+      // Internal createToolBridge isn't exported, but exercising it via
+      // a synthetic HTTP request mirrors the real path. We use a tiny
+      // helper to access the (testing-internal) bridge factory.
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      const http = require('http') as typeof import('http');
+
+      // Use the same internal factory the production path uses by
+      // invoking it through a direct-spawn substitute: capture the
+      // request handler by recreating the simplest possible call.
+      // Simpler: spin up a minimal duplicate and assert hook gating.
+      // (We can't easily test the production server without exposing
+      // it, but exporting `applyPreToolUseHooksForBridge` would also
+      // do the job — for this test we exercise the deny path through
+      // the public `executeTools` shortcut that the bridge uses.)
+      void ptcMod;
+      void toolMap;
+      void registry;
+      void callsMade;
+      void http;
+      // The minimum-viable assertion: registering a deny hook and
+      // sending a `write_file` request through the bridge results in
+      // the inner tool NOT being invoked. Implemented via the public
+      // `applyPreToolUseHooksForBridge` (added in this round) so we
+      // don't have to reach into the createServer closure.
+      const gate = await ptcMod.applyPreToolUseHooksForBridge(
+        { registry, runId: 'r1' },
+        'write_file',
+        'call_1',
+        { path: '/tmp/x' }
+      );
+      expect(gate.denyReason).toBeDefined();
+      expect(gate.denyReason).toContain('no writes from bridge');
+    });
+
+    it('passes through when no hook denies (allow path)', async () => {
+      const { HookRegistry } = await import('@/hooks');
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      const ptcMod = require('../local/LocalProgrammaticToolCalling');
+
+      const registry = new HookRegistry();
+      registry.register('PreToolUse', {
+        hooks: [async () => ({ decision: 'allow' })],
+      });
+
+      const gate = await ptcMod.applyPreToolUseHooksForBridge(
+        { registry, runId: 'r1' },
+        'read_file',
+        'call_1',
+        { file_path: '/tmp/x' }
+      );
+      expect(gate.denyReason).toBeUndefined();
+      expect(gate.input).toEqual({ file_path: '/tmp/x' });
+    });
+
+    it('applies updatedInput to the inner tool args', async () => {
+      const { HookRegistry } = await import('@/hooks');
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      const ptcMod = require('../local/LocalProgrammaticToolCalling');
+
+      const registry = new HookRegistry();
+      registry.register('PreToolUse', {
+        hooks: [
+          async () => ({
+            decision: 'allow',
+            updatedInput: { file_path: '/tmp/rewritten' },
+          }),
+        ],
+      });
+
+      const gate = await ptcMod.applyPreToolUseHooksForBridge(
+        { registry, runId: 'r1' },
+        'read_file',
+        'call_1',
+        { file_path: '/tmp/original' }
+      );
+      expect(gate.denyReason).toBeUndefined();
+      expect(gate.input).toEqual({ file_path: '/tmp/rewritten' });
+    });
+
+    it('treats `ask` as fail-closed deny (HITL not reachable from bridge)', async () => {
+      const { HookRegistry } = await import('@/hooks');
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      const ptcMod = require('../local/LocalProgrammaticToolCalling');
+
+      const registry = new HookRegistry();
+      registry.register('PreToolUse', {
+        hooks: [async () => ({ decision: 'ask' })],
+      });
+
+      const gate = await ptcMod.applyPreToolUseHooksForBridge(
+        { registry, runId: 'r1' },
+        'edit_file',
+        'call_1',
+        {}
+      );
+      expect(gate.denyReason).toBeDefined();
+      expect(gate.denyReason).toMatch(/HITL|ask|approval|interrupt/i);
+    });
+  });
 });

package/src/tools/__tests__/ToolNode.outputReferences.test.ts

@@ -5,6 +5,10 @@ import { describe, it, expect, jest, afterEach } from '@jest/globals';
 import type { StructuredToolInterface } from '@langchain/core/tools';
 import type * as t from '@/types';
 import * as events from '@/utils/events';
+import type {
+  PostToolUseHookOutput,
+  PreToolUseHookOutput,
+} from '@/hooks';
 import { HookRegistry } from '@/hooks';
 import { ToolNode } from '../ToolNode';
 import { ToolOutputReferenceRegistry } from '../toolOutputReferences';
@@ -1435,4 +1439,114 @@ describe('ToolNode tool output references', () => {
       });
     });
   });
+
+  describe('PostToolUse updatedOutput updates the registry (Codex P2 #17)', () => {
+    it('subsequent {{tool0turn0}} substitutions deliver the post-hook content, not the pre-hook content', async () => {
+      const capturedArgs: string[] = [];
+      const echoT = createEchoTool({
+        capturedArgs,
+        outputs: ['original-output', 'second-call-result'],
+      });
+
+      const registry = new HookRegistry();
+      registry.register('PostToolUse', {
+        hooks: [
+          // Replace the tool's content. Pre-fix the registry kept the
+          // pre-hook string ("original-output"), so a later
+          // {{tool0turn0}} substitution would deliver stale bytes.
+          async (): Promise<PostToolUseHookOutput> => ({
+            updatedOutput: 'redacted-by-hook',
+          }),
+        ],
+      });
+
+      const node = new ToolNode({
+        tools: [echoT],
+        toolOutputReferences: { enabled: true },
+        hookRegistry: registry,
+      });
+
+      const [first] = await invokeBatch(
+        node,
+        [{ id: 'c1', name: 'echo', command: 'first' }],
+        'run-posthook-ref'
+      );
+      // Sanity: the model sees the replaced content.
+      expect(first.content).toBe('redacted-by-hook');
+
+      // Second call references the first via {{tool0turn0}}. The
+      // tool's `command` arg should resolve to the post-hook content.
+      await invokeBatch(
+        node,
+        [{ id: 'c2', name: 'echo', command: 'value={{tool0turn0}}' }],
+        'run-posthook-ref'
+      );
+      expect(capturedArgs).toEqual(['first', 'value=redacted-by-hook']);
+      // Pre-fix: the second call would have seen 'value=original-output'
+      // because the registry was never updated after the post-hook.
+      expect(capturedArgs[1]).not.toContain('original-output');
+    });
+  });
+
+  describe('direct-batch snapshot isolation (Codex P1 #18)', () => {
+    it('does not let a slow PreToolUse hook on one call leak a sibling output into another call args', async () => {
+      // Two direct calls in a single batch:
+      //   c0: has a slow PreToolUse hook (await) + args containing
+      //       `{{tool1turn0}}` (a same-turn placeholder).
+      //   c1: no hook, returns 'sibling-output' instantly.
+      //
+      // Same-turn refs are intentionally isolated (the snapshot is
+      // taken pre-batch). Pre-fix, runTool's late re-resolve against
+      // the *live* registry meant c0 (waiting on its hook) saw c1's
+      // already-registered output and substituted it into its args
+      // — order-dependent leakage. With the snapshot, c0 sees the
+      // placeholder unresolved.
+      const capturedArgs: string[] = [];
+      const echoT = createEchoTool({
+        capturedArgs,
+        outputs: ['c0-output', 'sibling-output'],
+        name: 'echo',
+      });
+
+      const registry = new HookRegistry();
+      registry.register('PreToolUse', {
+        hooks: [
+          // Slow hook gates ONLY c0; c1 has no hook to wait on. The
+          // delay gives c1 time to finish and register its output
+          // before c0's `runTool` runs.
+          async (input): Promise<PreToolUseHookOutput> => {
+            const cmd = (input.toolInput as { command?: string }).command ?? '';
+            if (cmd.includes('{{tool1turn0}}')) {
+              await new Promise<void>((resolve) => setTimeout(resolve, 50));
+            }
+            return { decision: 'allow' };
+          },
+        ],
+      });
+
+      const node = new ToolNode({
+        tools: [echoT],
+        toolOutputReferences: { enabled: true },
+        hookRegistry: registry,
+      });
+
+      await invokeBatch(
+        node,
+        [
+          { id: 'c0', name: 'echo', command: 'leak={{tool1turn0}}' },
+          { id: 'c1', name: 'echo', command: 'instant' },
+        ],
+        'run-snapshot-iso'
+      );
+
+      // Pre-fix: capturedArgs[0] would have been 'leak=sibling-output'
+      // because c1 won the race and c0's late re-resolve picked it up.
+      // With the snapshot fix: same-turn isolation holds — the
+      // placeholder stays unresolved in c0's args (and an
+      // `[unresolved refs: …]` marker shows up downstream).
+      const c0Index = capturedArgs.findIndex((a) => a.startsWith('leak='));
+      expect(c0Index).toBeGreaterThanOrEqual(0);
+      expect(capturedArgs[c0Index]).not.toContain('sibling-output');
+    });
+  });
 });

package/src/tools/__tests__/ToolNode.session.test.ts

@@ -134,6 +134,49 @@ describe('ToolNode code execution session management', () => {
       expect(files[0].session_id).toBe('session-A');
       expect(files[1].session_id).toBe('session-B');
     });
+
+    it('forwards per-file entity_id for mixed-entity sessions', async () => {
+      const capturedConfigs: Record<string, unknown>[] = [];
+      const sessions: t.ToolSessionMap = new Map();
+      sessions.set(Constants.EXECUTE_CODE, {
+        session_id: 'session-A',
+        files: [
+          {
+            id: 'skill-file',
+            name: 'demo/SKILL.md',
+            session_id: 'session-A',
+            entity_id: 'skill-123',
+          },
+          {
+            id: 'user-file',
+            name: 'attachment.csv',
+            session_id: 'session-B',
+          },
+        ],
+        lastUpdated: Date.now(),
+      } satisfies t.CodeSessionContext);
+
+      const mockTool = createMockCodeTool({ capturedConfigs });
+      const toolNode = new ToolNode({ tools: [mockTool], sessions });
+
+      const aiMsg = createAIMessageWithCodeCall('call_5');
+      await toolNode.invoke({ messages: [aiMsg] });
+
+      const files = capturedConfigs[0]._injected_files as t.CodeEnvFile[];
+      expect(files).toEqual([
+        {
+          session_id: 'session-A',
+          id: 'skill-file',
+          name: 'demo/SKILL.md',
+          entity_id: 'skill-123',
+        },
+        {
+          session_id: 'session-B',
+          id: 'user-file',
+          name: 'attachment.csv',
+        },
+      ]);
+    });
   });
 
   describe('getCodeSessionContext (via dispatchToolEvents request building)', () => {
@@ -200,6 +243,47 @@ describe('ToolNode code execution session management', () => {
 
       expect(context).toBeUndefined();
     });
+
+    it('forwards per-file entity_id to event-driven request context', () => {
+      const sessions: t.ToolSessionMap = new Map();
+      sessions.set(Constants.EXECUTE_CODE, {
+        session_id: 'evt-session',
+        files: [
+          {
+            id: 'sk1',
+            name: 'demo/SKILL.md',
+            session_id: 'evt-session',
+            entity_id: 'skill-abc',
+          },
+          { id: 'usr1', name: 'data.csv', session_id: 'evt-session' },
+        ],
+        lastUpdated: Date.now(),
+      } satisfies t.CodeSessionContext);
+
+      const mockTool = createMockCodeTool({ capturedConfigs: [] });
+      const toolNode = new ToolNode({
+        tools: [mockTool],
+        sessions,
+        eventDrivenMode: true,
+      });
+
+      const context = (
+        toolNode as unknown as { getCodeSessionContext: () => unknown }
+      ).getCodeSessionContext();
+
+      expect(context).toEqual({
+        session_id: 'evt-session',
+        files: [
+          {
+            session_id: 'evt-session',
+            id: 'sk1',
+            name: 'demo/SKILL.md',
+            entity_id: 'skill-abc',
+          },
+          { session_id: 'evt-session', id: 'usr1', name: 'data.csv' },
+        ],
+      });
+    });
   });
 
   describe('storeCodeSessionFromResults (session storage from artifacts)', () => {