@librechat/agents 3.2.61 → 3.2.63

package/src/tools/ToolNode.ts

@@ -822,10 +822,11 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
   private recordEventToolPlanningTurn(
     toolName: string,
     turn: number,
-    callId?: string
+    callId?: string,
+    runId?: string
   ): void {
     this.recordToolUsageTurn(toolName, turn, callId);
-    if (this.canConsumeEagerEventExecution()) {
+    if (this.canConsumeEagerEventExecution(runId)) {
       this.eagerEventToolUsageCount?.set(
         toolName,
         Math.max(this.eagerEventToolUsageCount.get(toolName) ?? 0, turn + 1)
@@ -2091,6 +2092,7 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
     const postToolBatchEntryByCallId = new Map<string, PostToolBatchEntry>();
     const HOOK_FALLBACK: AggregatedHookResult = Object.freeze({
       additionalContexts: [] as string[],
+      injectedMessages: [] as t.InjectedMessage[],
       errors: [] as string[],
     });
 
@@ -2101,6 +2103,32 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
        * to defensively `?.` it across every reference inside.
        */
       const hookRegistry = this.hookRegistry;
+      /**
+       * Pull each call's prestarted eager record BEFORE awaiting the hooks:
+       * an async deny must never race the eager host promise into emitting a
+       * successful completion (`dispatchEagerToolCompletions`' map-identity
+       * check skips deleted records). Allowed entries get their record
+       * restored in the decision loop below so consumption still works;
+       * denied entries stay deleted. Ask/interrupt configs never have eager
+       * records (HITL disables the reservation gate).
+       */
+      const preemptedEagerRecords = new Map<
+        string,
+        t.EagerEventToolExecution
+      >();
+      if (this.eagerEventToolExecutions != null) {
+        for (const entry of preToolCalls) {
+          const callId = entry.call.id;
+          if (callId == null) {
+            continue;
+          }
+          const record = this.eagerEventToolExecutions.get(callId);
+          if (record != null) {
+            preemptedEagerRecords.set(callId, record);
+            this.eagerEventToolExecutions.delete(callId);
+          }
+        }
+      }
       const preResults = await Promise.all(
         preToolCalls.map((entry) =>
           executeHooks({
@@ -2183,6 +2211,14 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
           contentString,
           reason,
         });
+        /**
+         * A prestarted eager execution for a now-blocked call must neither be
+         * consumed nor emit its completion — the run reports this call as
+         * blocked. Deleting the record makes `dispatchEagerToolCompletions`'
+         * map-identity check skip the pending emission (same pattern as the
+         * rejected-results cleanup below).
+         */
+        this.eagerEventToolExecutions?.delete(entry.call.id!);
       };
 
       const flushDeferredBlockedSideEffects = async (): Promise<void> => {
@@ -2312,6 +2348,12 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
         if (hookResult.updatedInput != null) {
           applyInputOverride(entry, hookResult.updatedInput);
         }
+        if (entry.call.id != null) {
+          const preempted = preemptedEagerRecords.get(entry.call.id);
+          if (preempted != null) {
+            this.eagerEventToolExecutions?.set(entry.call.id, preempted);
+          }
+        }
         approvedEntries.push(entry);
       }
 
@@ -2592,7 +2634,12 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
         usageCount: this.toolUsageCount,
         invalidArgsBehavior: 'error-result',
         recordTurn: (toolName, reservedTurn, callId) => {
-          this.recordEventToolPlanningTurn(toolName, reservedTurn, callId);
+          this.recordEventToolPlanningTurn(
+            toolName,
+            reservedTurn,
+            callId,
+            runId
+          );
         },
       });
       if (plan == null) {
@@ -2637,7 +2684,20 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
        * released if the dispatch fails, letting the batch path re-emit.
        */
       const canEmitEarlyCompletions =
-        this.hookRegistry == null && this.humanInTheLoop?.enabled !== true;
+        this.hookRegistry?.hasResultAlteringHooks(runId) !== true &&
+        this.humanInTheLoop?.enabled !== true;
+      /**
+       * Snapshot the post-hook gates at the same instant as the early-emission
+       * gate: a result-altering hook registered while this batch is in flight
+       * applies from the NEXT batch. Evaluating these after results settle
+       * would let a late hook rewrite the ToolMessage AFTER an early
+       * completion already emitted the pre-hook output — two views of the
+       * same call.
+       */
+      const hasPostHook =
+        this.hookRegistry?.hasHookFor('PostToolUse', runId) === true;
+      const hasFailureHook =
+        this.hookRegistry?.hasHookFor('PostToolUseFailure', runId) === true;
       const earlyCompletionDispatchedIds = new Set<string>();
       const earlyCompletionDispatches: Array<Promise<void>> = [];
       const dispatchRequestById = new Map(
@@ -2686,7 +2746,11 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
             const batchRequest: t.ToolExecuteBatchRequest = {
               toolCalls: dispatchRequests,
               userId: config.configurable?.user_id as string | undefined,
-              agentId: this.agentId,
+              // Dispatch attribution, NOT the hook subagent-scope marker:
+              // hosts key tool/credential lookup on the owning agent, and
+              // the eager path sends `agentContext.agentId` — this must
+              // match it at the top level too.
+              agentId: this.executingAgentId,
               configurable: config.configurable as
                   | Record<string, unknown>
                   | undefined,
@@ -2753,11 +2817,6 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
 
       this.storeCodeSessionFromResults(results, requestMap);
 
-      const hasPostHook =
-        this.hookRegistry?.hasHookFor('PostToolUse', runId) === true;
-      const hasFailureHook =
-        this.hookRegistry?.hasHookFor('PostToolUseFailure', runId) === true;
-
       for (const result of results) {
         if (result.injectedMessages && result.injectedMessages.length > 0) {
           try {
@@ -2895,6 +2954,15 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
                 this.maxToolResultChars
               );
               finalToolOutput = hookResult.updatedOutput;
+              /**
+               * The hook ACTUALLY rewrote this output: any completion the
+               * stream already emitted for the consumed eager result showed
+               * the raw content, so un-mark it and let the dispatch below
+               * re-emit the corrected version. Hooks that merely observe or
+               * add context leave the original emission final — no
+               * duplicates.
+               */
+              eagerCompletionDispatchedIds.delete(result.toolCallId);
             }
           }
 
@@ -2971,11 +3039,12 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
     return { toolMessages, injected };
   }
 
-  private canConsumeEagerEventExecution(): boolean {
+  /** Run-scoped so another run's session hooks can't flip this run's gate. */
+  private canConsumeEagerEventExecution(runId?: string): boolean {
     return (
       this.eventDrivenMode &&
       this.eagerEventToolExecution?.enabled === true &&
-      this.hookRegistry == null &&
+      this.hookRegistry?.hasResultAlteringHooks(runId) !== true &&
       this.humanInTheLoop?.enabled !== true
     );
   }
@@ -2983,7 +3052,15 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
   private takeMatchingEagerEventExecution(
     request: t.ToolCallRequest
   ): t.EagerEventToolExecution | undefined {
-    if (!this.canConsumeEagerEventExecution()) {
+    // Static enablement only: a stored record means the reservation-time
+    // gates passed and the host already dispatched the execution. Re-checking
+    // the dynamic hook gate here could decline consumption after a mid-run
+    // registration and send the same call through normal dispatch — executing
+    // the tool twice. PostToolUse hooks still process consumed results below.
+    if (
+      !this.eventDrivenMode ||
+      this.eagerEventToolExecution?.enabled !== true
+    ) {
       return undefined;
     }
 
@@ -3098,6 +3175,7 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
         orderedBatchEntries.push(entry);
       }
     }
+    const hookInjectedMessages: t.InjectedMessage[] = [];
     if (
       this.hookRegistry?.hasHookFor('PostToolBatch', runId) === true &&
       orderedBatchEntries.length > 0
@@ -3118,6 +3196,9 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
         for (const ctx of batchHookResult.additionalContexts) {
           batchAdditionalContexts.push(ctx);
         }
+        for (const msg of batchHookResult.injectedMessages) {
+          hookInjectedMessages.push(msg);
+        }
       }
     }
 
@@ -3137,6 +3218,24 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
         })
       );
     }
+
+    /**
+     * Hook-returned `injectedMessages` land AFTER the consolidated context
+     * message: one converted `HumanMessage` per entry (role/source kept in
+     * `additional_kwargs`), preserving per-message identity so verbatim
+     * user speech (e.g. steering) sits closest to the next model call.
+     */
+    if (hookInjectedMessages.length > 0) {
+      try {
+        injected.push(...this.convertInjectedMessages(hookInjectedMessages));
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        console.warn(
+          '[ToolNode] Failed to convert PostToolBatch injectedMessages:',
+          e instanceof Error ? e.message : e
+        );
+      }
+    }
   }
 
   private async dispatchStepCompleted(