@librechat/agents 3.3.10 → 3.3.12

package/src/summarization/node.ts

@@ -6,6 +6,7 @@ import {
 } from '@langchain/core/messages';
 import type { UsageMetadata, BaseMessage } from '@langchain/core/messages';
 import type { RunnableConfig } from '@langchain/core/runnables';
+import type { StreamLimitState } from '@/llm/streamLimits';
 import type { AgentContext } from '@/agents/AgentContext';
 import type { HookRegistry } from '@/hooks';
 import type { OnChunk } from '@/llm/invoke';
@@ -33,6 +34,11 @@ import {
   Providers,
 } from '@/common';
 import { safeDispatchCustomEvent, emitAgentLog } from '@/utils/events';
+import {
+  enforceStreamLimitsForWireChunk,
+  StreamLimitExceededError,
+  STREAM_LIMIT_EPOCH_KEY,
+} from '@/llm/streamLimits';
 import { attemptInvoke, tryFallbackProviders } from '@/llm/invoke';
 import { calculateMaxToolResultChars } from '@/utils/truncation';
 import { createRemoveAllMessage } from '@/messages/reducer';
@@ -611,6 +617,8 @@ async function executeSummarizationWithFallback(params: {
   stepId: string;
   usePromptCache: boolean;
   log: LogFn;
+  /** Carries the run's stream limits so the event cap covers summary streams. */
+  graph?: StreamLimitState & { getBreakerSignal?: () => AbortSignal };
 }): Promise<{
   text: string;
   usage?: Partial<UsageMetadata>;
@@ -629,6 +637,7 @@ async function executeSummarizationWithFallback(params: {
     stepId,
     usePromptCache,
     log,
+    graph,
   } = params;
 
   const priorSummaryText = agentContext.getSummaryText()?.trim() ?? '';
@@ -659,6 +668,7 @@ async function executeSummarizationWithFallback(params: {
       stepId,
       provider: clientConfig.provider as Providers,
       reasoningKey: agentContext.reasoningKey,
+      graph,
       usePromptCache,
       promptCacheTtl:
         (clientConfig.provider as Providers) === Providers.ANTHROPIC ||
@@ -686,6 +696,34 @@ async function executeSummarizationWithFallback(params: {
       messagesToRefineCount: messages.length,
     });
 
+    /**
+     * A tripped stream circuit breaker is a safety abort, not a
+     * summarization failure to recover from: retrying on fallback providers
+     * would spend more provider work after the limit fired, and degrading to
+     * the metadata stub would let the run continue (and periodic compaction
+     * commit the stub) despite the `StreamLimits` contract that a breach
+     * rejects the run. Rethrown so the summarize node fails the run with
+     * the actionable limit error, consistent with agent turns and subagents.
+     */
+    if (primaryError instanceof StreamLimitExceededError) {
+      throw primaryError;
+    }
+    /** A parallel branch's trip aborts the composed summarization signal,
+     * and a provider can surface that as a generic abort error; entering
+     * fallback recovery or degrading to the metadata stub would continue
+     * work after the run-wide safety abort. Checked on BOTH channels: the
+     * graph's own breaker, and the composed config signal that carries a
+     * parent run's trip into subagent child graphs. */
+    {
+      const trippedReason = findStreamLimitAbortReason(
+        graph?.getBreakerSignal?.(),
+        summarizeConfig?.signal
+      );
+      if (trippedReason != null) {
+        throw trippedReason;
+      }
+    }
+
     const rawFallbacks = (
       clientConfig.clientOptions as unknown as t.LLMConfig | undefined
     )?.fallbacks;
@@ -697,6 +735,7 @@ async function executeSummarizationWithFallback(params: {
           config: traceConfig(summarizeConfig, 'cache_hit_compaction'),
           provider: clientConfig.provider as Providers,
           reasoningKey: agentContext.reasoningKey,
+          graph,
         });
         const fbResult = await tryFallbackProviders({
           fallbacks,
@@ -711,9 +750,13 @@ async function executeSummarizationWithFallback(params: {
               )
             ),
           ],
-          config: traceConfig(summarizeConfig, 'cache_hit_compaction'),
+          config: withBreakerSignal(
+            traceConfig(summarizeConfig, 'cache_hit_compaction'),
+            graph
+          ),
           primaryError,
           onChunk,
+          streamLimitState: graph,
         });
         const fbMsg = fbResult?.messages?.[0];
         if (fbMsg) {
@@ -722,6 +765,9 @@ async function executeSummarizationWithFallback(params: {
           );
         }
       } catch (fbErr) {
+        if (fbErr instanceof StreamLimitExceededError) {
+          throw fbErr;
+        }
         const fbDescribed = describeFallbackError(fbErr, fallbacks);
         log('warn', `Fallback providers also failed ${fbDescribed.suffix}`, {
           ...fbDescribed.data,
@@ -858,13 +904,64 @@ interface CreateSummarizeNodeParams {
       result: t.StepCompleted,
       config?: RunnableConfig
     ) => Promise<void>;
-  };
+    /** The run's shared breaker signal, composed into every summarization
+     * model attempt so a sibling branch tripping a stream limit also
+     * cancels in-flight summaries. */
+    getBreakerSignal?: () => AbortSignal;
+    /** The run's shared breaker controller. Preferred over the bare signal
+     * accessor: the node captures it at entry so a breach detected by its
+     * own chunk handler trips the run that STARTED the summarization. */
+    getBreakerController?: () => AbortController;
+    /** The controller's epoch, captured at entry and stamped into summary
+     * attempt metadata so the wire consumer epoch-gates old-run summary
+     * chunks like model-attempt chunks. */
+    getBreakerEpoch?: () => number;
+  } & StreamLimitState;
   generateStepId: (stepKey: string) => [string, number];
 }
 
+/** Composes the run's breaker signal (when the adapter provides one) into a
+ * summarization attempt's config, so breaches in sibling branches cancel
+ * summaries too. */
+function withBreakerSignal<T extends { signal?: AbortSignal }>(
+  config: T | undefined,
+  graph?: { getBreakerSignal?: () => AbortSignal }
+): T | undefined {
+  const breakerSignal = graph?.getBreakerSignal?.();
+  if (breakerSignal == null) {
+    return config;
+  }
+  if (config == null) {
+    return { signal: breakerSignal } as T;
+  }
+  const existing = config.signal;
+  if (existing == null || existing === breakerSignal) {
+    return { ...config, signal: breakerSignal };
+  }
+  return { ...config, signal: AbortSignal.any([existing, breakerSignal]) };
+}
+
+/** First stream-limit reason found on any of the given signals. Checked
+ * alongside the graph's own breaker because a subagent child graph receives
+ * a ROOT sibling's trip through its constructor/invocation signal — the
+ * child's private breaker never fires for it. */
+function findStreamLimitAbortReason(
+  ...signals: Array<AbortSignal | undefined>
+): StreamLimitExceededError | undefined {
+  for (const signal of signals) {
+    if (
+      signal?.aborted === true &&
+      signal.reason instanceof StreamLimitExceededError
+    ) {
+      return signal.reason;
+    }
+  }
+  return undefined;
+}
+
 export function createSummarizeNode({
   agentContext,
-  graph,
+  graph: adapterGraph,
   generateStepId,
 }: CreateSummarizeNodeParams) {
   return async (
@@ -874,10 +971,45 @@ export function createSummarizeNode({
     },
     config?: RunnableConfig
   ): Promise<{ summarizationRequest: undefined; messages?: BaseMessage[] }> => {
+    /** The breaker signal is captured at node ENTRY, before dispatchRunStep,
+     * ON_SUMMARIZE_START, or PreCompact awaits: a sibling's trip plus a
+     * prompt next run can reset the controller during one of those awaits,
+     * and resolving the live accessor later would bind this summarization
+     * to the fresh controller. `Object.create` freezes the signal while
+     * DELEGATING every other adapter member — spreading would snapshot the
+     * charge-credit accessor pair and detach it from graph resets. */
+    const entryBreakerController = adapterGraph.getBreakerController?.();
+    const entryBreakerSignal =
+      entryBreakerController?.signal ?? adapterGraph.getBreakerSignal?.();
+    const entryBreakerEpoch = adapterGraph.getBreakerEpoch?.();
+    const graph =
+      entryBreakerSignal == null
+        ? adapterGraph
+        : (Object.create(adapterGraph, {
+          getBreakerSignal: { value: (): AbortSignal => entryBreakerSignal },
+          ...(entryBreakerController != null && {
+            getBreakerController: {
+              value: (): AbortController => entryBreakerController,
+            },
+          }),
+        }) as typeof adapterGraph);
     const request = state.summarizationRequest;
     if (request == null) {
       return { summarizationRequest: undefined };
     }
+    /** Already-tripped-at-entry: a parallel sibling's breach failed the run
+     * before this node was scheduled — via this graph's own breaker or, in
+     * a subagent child graph, the parent trip on the invocation signal.
+     * Rethrow before dispatching steps, hooks, or the model call — an
+     * adapter that doesn't synchronously reject an aborted signal would
+     * otherwise spend summarization provider work on a failed run. */
+    const entryTripReason = findStreamLimitAbortReason(
+      entryBreakerSignal,
+      config?.signal
+    );
+    if (entryTripReason != null) {
+      throw entryTripReason;
+    }
 
     /**
      * Overflow recovery routes through this node purely to get back to the
@@ -1111,10 +1243,31 @@ export function createSummarizeNode({
           ...(clientConfig.modelName != null && clientConfig.modelName !== ''
             ? { [Constants.INVOKED_MODEL]: clientConfig.modelName }
             : {}),
+          /** Entry-captured breaker epoch: the wire consumer epoch-gates
+           * old-run summary chunks exactly like model-attempt chunks —
+           * without the stamp, a straggling summary from a failed run
+           * reads as current and could abort the next run's controller. */
+          ...(entryBreakerEpoch != null
+            ? { [STREAM_LIMIT_EPOCH_KEY]: entryBreakerEpoch }
+            : {}),
         },
       }
       : undefined;
 
+    /** Rechecked after the pre-call awaits (dispatchRunStep,
+     * ON_SUMMARIZE_START, PreCompact): a sibling can trip the breaker while
+     * this node is paused in one of them, and a provider that doesn't
+     * synchronously reject an aborted signal would still start the
+     * summarization call. Mirrors the model node's pre-invoke recheck. */
+    {
+      const preCallTrip = findStreamLimitAbortReason(
+        entryBreakerSignal,
+        config?.signal
+      );
+      if (preCallTrip != null) {
+        throw preCallTrip;
+      }
+    }
     const {
       text: rawText,
       usage: summaryUsage,
@@ -1127,6 +1280,7 @@ export function createSummarizeNode({
       stepId,
       usePromptCache: isSelfSummarizeModel && hasPromptCache,
       log,
+      graph,
     });
 
     /**
@@ -1331,21 +1485,58 @@ function buildSummarizationInstruction(
 }
 
 /** Creates an `onChunk` callback that dispatches `ON_SUMMARIZE_DELTA` events for streaming. */
-function createSummarizationChunkHandler({
+export function createSummarizationChunkHandler({
   stepId,
   config,
   provider,
   reasoningKey = 'reasoning_content',
+  graph,
 }: {
   stepId?: string;
   config?: RunnableConfig;
   provider?: Providers;
   reasoningKey?: 'reasoning_content' | 'reasoning';
+  graph?: StreamLimitState & { getBreakerController?: () => AbortController };
 }): OnChunk | undefined {
   if (stepId == null || stepId === '' || !config) {
     return undefined;
   }
-  return (chunk) => {
+  const limitMetadata = config.metadata as Record<string, unknown> | undefined;
+  return (chunk, attemptMetadata) => {
+    /**
+     * Charged as `producer` so it PAIRS with the run's registered stream
+     * handler: inside a live run the provider callbacks route each chunk
+     * through the graph's `on_chat_model_stream` consumer too, and two
+     * same-side consumer claims would charge the chunk twice — halving an
+     * opt-in event cap. Standalone callers (tests, custom hosts, runs with
+     * no registered handler) still get single-sided enforcement from this
+     * one claim. Summarization deliberately passes NO `context` to
+     * `attemptInvoke`, whose onChunk branch would otherwise add a second
+     * producer claim. A breach trips the run's shared breaker (the
+     * ENTRY-captured controller when the adapter provides one) before
+     * rethrowing: this producer claim wins the race, so the wire consumer's
+     * breaker-aborting catch never fires for the same chunk — without the
+     * trip here, sibling model calls, tools, and subagents would keep
+     * consuming quota while the summary branch rejects.
+     * `executeSummarizationWithFallback` then rethrows past fallbacks and
+     * the metadata stub, failing the run like any other breach.
+     */
+    if (graph != null) {
+      try {
+        enforceStreamLimitsForWireChunk({
+          graph,
+          metadata: attemptMetadata ?? limitMetadata,
+          chunk: chunk as Parameters<
+            typeof enforceStreamLimitsForWireChunk
+          >[0]['chunk'],
+        });
+      } catch (error) {
+        if (error instanceof StreamLimitExceededError) {
+          graph.getBreakerController?.().abort(error);
+        }
+        throw error;
+      }
+    }
     const chunkAny = chunk as Parameters<typeof getChunkContent>[0]['chunk'];
     const raw = getChunkContent({ chunk: chunkAny, provider, reasoningKey });
     if (raw == null || (typeof raw === 'string' && !raw)) {
@@ -1404,6 +1595,7 @@ async function summarizeWithCacheHit({
   stepId,
   provider,
   reasoningKey,
+  graph,
   usePromptCache,
   promptCacheTtl,
   log,
@@ -1417,6 +1609,7 @@ async function summarizeWithCacheHit({
   stepId?: string;
   provider: Providers;
   reasoningKey?: 'reasoning_content' | 'reasoning';
+  graph?: StreamLimitState & { getBreakerSignal?: () => AbortSignal };
   usePromptCache?: boolean;
   promptCacheTtl?: PromptCacheTtl;
   log?: LogFn;
@@ -1443,9 +1636,13 @@ async function summarizeWithCacheHit({
         config: traceConfig(config, 'cache_hit_compaction'),
         provider,
         reasoningKey,
+        graph,
       }),
+      /** Accounting lease only (summarization passes no `context` so its
+       * producer claim never stacks with the onChunk handler's). */
+      streamLimitState: graph,
     },
-    traceConfig(config, 'cache_hit_compaction')
+    withBreakerSignal(traceConfig(config, 'cache_hit_compaction'), graph)
   );
 
   const responseMsg = result.messages?.[0];

package/src/tools/BashExecutor.ts

@@ -1,6 +1,5 @@
 import { config } from 'dotenv';
 import fetch, { RequestInit } from 'node-fetch';
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import { tool, DynamicStructuredTool } from '@langchain/core/tools';
 import type * as t from '@/types';
 import {
@@ -16,6 +15,7 @@ import {
   normalizeCodeApiRequestError,
   resolveCodeApiAuthHeaders,
 } from './CodeExecutor';
+import { resolveFetchProxyAgent } from '@/utils/proxy';
 import { INTENT_PROPERTY } from '@/tools/intentArg';
 import { Constants } from '@/common';
 
@@ -253,8 +253,9 @@ function createBashExecutionTool(
           body: JSON.stringify(postData),
         };
 
-        if (process.env.PROXY != null && process.env.PROXY !== '') {
-          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
+        const proxyAgent = resolveFetchProxyAgent(EXEC_ENDPOINT);
+        if (proxyAgent) {
+          fetchOptions.agent = proxyAgent;
         }
         const response = await fetch(EXEC_ENDPOINT, fetchOptions);
         if (!response.ok) {

package/src/tools/CodeExecutor.ts

@@ -1,10 +1,10 @@
 import { config } from 'dotenv';
 import fetch, { RequestInit } from 'node-fetch';
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import { getEnvironmentVariable } from '@langchain/core/utils/env';
 import { tool, DynamicStructuredTool } from '@langchain/core/tools';
 import type * as t from '@/types';
 import { appendCodeSessionFileSummary } from '@/tools/CodeSessionFileSummary';
+import { resolveFetchProxyAgent } from '@/utils/proxy';
 import { INTENT_PROPERTY } from '@/tools/intentArg';
 import { EnvVar, Constants } from '@/common';
 
@@ -23,7 +23,7 @@ export const emptyOutputMessage =
   'stdout: Empty. Ensure you\'re writing output explicitly.\n';
 
 export const CODE_ARTIFACT_PATH_GUIDANCE =
-  'Persist handoff artifacts in `/mnt/data` with standard extensions (.json/.txt/.csv/.tsv/.log/.parquet/.png/.jpg/.pdf/.xlsx); failed executions do not register new files; `/tmp` and odd extensions are same-call scratch only, not later-call storage.';
+  'Anything a later call needs (data, helper scripts/modules, partial results) MUST be written under `/mnt/data` in the same call that produces it; `/tmp` never survives the call. `/mnt/data` keeps files with recognized extensions, covering common source, text, data, document, image, and archive formats (.py/.sh/.sql/.md/.json/.csv/.parquet/.png/.pdf/.zip and similar); extensionless or unusual extensions are not kept. Failed executions register nothing; fix the error and rerun before relying on new files.';
 
 export const BASH_SHELL_GUIDANCE =
   'Bash: multi-line files use heredoc/printf; run Python via python3 -c/heredoc, not bare Python.';
@@ -426,8 +426,9 @@ function createCodeExecutionTool(
           body: JSON.stringify(postData),
         };
 
-        if (process.env.PROXY != null && process.env.PROXY !== '') {
-          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
+        const proxyAgent = resolveFetchProxyAgent(EXEC_ENDPOINT);
+        if (proxyAgent) {
+          fetchOptions.agent = proxyAgent;
         }
         const response = await fetch(EXEC_ENDPOINT, fetchOptions);
         if (!response.ok) {

package/src/tools/ProgrammaticToolCalling.ts

@@ -1,7 +1,6 @@
 // src/tools/ProgrammaticToolCalling.ts
 import { config } from 'dotenv';
 import fetch, { RequestInit } from 'node-fetch';
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import { tool, DynamicStructuredTool } from '@langchain/core/tools';
 import type { ToolCall } from '@langchain/core/messages/tool';
 import type { ProgrammaticToolCallingJsonSchema } from './ptcTimeout';
@@ -24,6 +23,7 @@ import {
   createCodeApiRunTimeoutSchema,
   resolveCodeApiRunTimeoutMs,
 } from './ptcTimeout';
+import { resolveFetchProxyAgent } from '@/utils/proxy';
 import { INTENT_PROPERTY } from '@/tools/intentArg';
 import { Constants } from '@/common';
 
@@ -438,8 +438,9 @@ export async function fetchSessionFiles(
       },
     };
 
-    if (proxy != null && proxy !== '') {
-      fetchOptions.agent = new HttpsProxyAgent(proxy);
+    const proxyAgent = resolveFetchProxyAgent(filesEndpoint, proxy);
+    if (proxyAgent) {
+      fetchOptions.agent = proxyAgent;
     }
 
     const response = await fetch(filesEndpoint, fetchOptions);
@@ -491,8 +492,9 @@ export async function makeRequest(
       body: JSON.stringify(body),
     };
 
-    if (proxy != null && proxy !== '') {
-      fetchOptions.agent = new HttpsProxyAgent(proxy);
+    const proxyAgent = resolveFetchProxyAgent(endpoint, proxy);
+    if (proxyAgent) {
+      fetchOptions.agent = proxyAgent;
     }
 
     const response = await fetch(endpoint, fetchOptions);

package/src/tools/ToolNode.ts

@@ -79,9 +79,26 @@ import {
 } from '@/tools/local';
 import { stripCodeSessionFileSummary } from '@/tools/CodeSessionFileSummary';
 import { Constants, GraphEvents, CODE_EXECUTION_TOOLS } from '@/common';
+import type { RunBreakerScope } from '@/llm/streamLimits';
+import {
+  StreamLimitExceededError,
+  RUN_BREAKER_SCOPE_CONFIG_KEY,
+} from '@/llm/streamLimits';
+
+/** Host-facing batch requests must not carry the batch's breaker scope —
+ * hosts spread `configurable` into their own run configs. */
+function stripRunBreakerScope(
+  configurable: Record<string, unknown> | undefined
+): Record<string, unknown> | undefined {
+  if (configurable == null || !(RUN_BREAKER_SCOPE_CONFIG_KEY in configurable)) {
+    return configurable;
+  }
+  const { [RUN_BREAKER_SCOPE_CONFIG_KEY]: _scope, ...rest } = configurable;
+  return rest;
+}
 import { convertInjectedMessages } from '@/messages/injected';
 import { safeDispatchCustomEvent } from '@/utils/events';
-import { RunnableCallable } from '@/utils';
+import { RunnableCallable, composeAbortSignals } from '@/utils';
 import { executeHooks } from '@/hooks';
 
 /**
@@ -636,6 +653,10 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
   private toolOutputRegistry?: ToolOutputReferenceRegistry;
   /** Run-scoped selection for swapping remote code tools to local executors. */
   private toolExecution?: t.ToolExecutionConfig;
+  /** Owning graph's run-scoped breaker signal, composed into each batch's config. */
+  private getBreakerSignal?: () => AbortSignal | undefined;
+  /** Owning graph's immutable run scope; captured once per batch. */
+  private getRunScope?: () => RunBreakerScope;
   /**
    * Monotonic counter used to mint a unique scope id for anonymous
    * batches (ones invoked without a `run_id` in
@@ -677,6 +698,8 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
     toolOutputRegistry,
     toolExecution,
     fileCheckpointer,
+    getBreakerSignal,
+    getRunScope,
   }: t.ToolNodeConstructorParams) {
     super({
       name: name ?? TOOL_NODE_RUN_NAME,
@@ -720,6 +743,8 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
     this.hookRegistry = hookRegistry;
     this.humanInTheLoop = humanInTheLoop;
     this.toolExecution = toolExecution;
+    this.getBreakerSignal = getBreakerSignal;
+    this.getRunScope = getRunScope;
     // Caller-provided checkpointer wins. Graphs use this to share a
     // single per-Run instance across every ToolNode they compile so
     // `Run.rewindFiles()` reaches the same snapshot store regardless
@@ -1212,6 +1237,10 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
           (config.configurable?.writer as ToolRuntime<T>['writer']) ??
           null,
       };
+      /** A sibling can trip the breaker while the PreToolUse hooks above
+       * are awaited; a tool that never inspects its runtime signal would
+       * still run. Recheck at the last moment before execution. */
+      this.throwIfBreakerTripped(config);
       const output = await tool.invoke(invokeParams, runtime);
       if (isCommand(output)) {
         return output;
@@ -1323,6 +1352,14 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
       if (isGraphInterrupt(e)) {
         throw e;
       }
+      /**
+       * A stream circuit breaker tripped by a child run (subagent) is a
+       * safety abort, not a tool failure to report back to the model. It
+       * passes through like an interrupt so the whole run rejects.
+       */
+      if (e instanceof StreamLimitExceededError) {
+        throw e;
+      }
       if (this.errorHandler) {
         try {
           const dispatched = await this.errorHandler(
@@ -2237,11 +2274,27 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
    * 4. Injected messages from results are collected and returned alongside
    *    ToolMessages (appended AFTER to respect provider ordering).
    */
+  /** Rethrows a stream-limit trip carried on the batch config's composed
+   * signal. Rechecked at each later execution/dispatch stage because a tool
+   * that ignores cancellation can complete normally across the trip, and
+   * the next stage would otherwise start fresh side effects on a failed
+   * run. */
+  private throwIfBreakerTripped(config: RunnableConfig): void {
+    const signal = config.signal;
+    if (
+      signal?.aborted === true &&
+      signal.reason instanceof StreamLimitExceededError
+    ) {
+      throw signal.reason;
+    }
+  }
+
   private async dispatchToolEvents(
     toolCalls: ToolCall[],
     config: RunnableConfig,
     batchContext: DispatchBatchContext = {}
   ): Promise<{ toolMessages: ToolMessage[]; injected: BaseMessage[] }> {
+    this.throwIfBreakerTripped(config);
     const {
       batchIndices,
       turn,
@@ -2941,9 +2994,12 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
         dispatchRequests.map((request) => [request.id, request])
       );
       const onResult = (result: t.ToolExecuteResult): void => {
+        /** Runtime-honest widening: hosts may omit the id despite the
+         * field type. */
+        const resultToolCallId = result.toolCallId as string | undefined;
         const request =
-          result.toolCallId != null
-            ? dispatchRequestById.get(result.toolCallId)
+          resultToolCallId != null
+            ? dispatchRequestById.get(resultToolCallId)
             : undefined;
         if (
           request == null ||
@@ -2966,6 +3022,12 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
         );
       };
 
+      /** The approval hooks above are awaited; a sibling's trip during them
+       * must stop the approved batch before it reaches a host handler that
+       * may never inspect the request signal. */
+      if (dispatchRequests.length > 0) {
+        this.throwIfBreakerTripped(config);
+      }
       const dispatchPromise =
         dispatchRequests.length === 0
           ? Promise.resolve([] as t.ToolExecuteResult[])
@@ -2988,12 +3050,13 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
               // the eager path sends `agentContext.agentId` — this must
               // match it at the top level too.
               agentId: this.executingAgentId,
-              configurable: config.configurable as
-                  | Record<string, unknown>
-                  | undefined,
+              configurable: stripRunBreakerScope(
+                config.configurable as Record<string, unknown> | undefined
+              ),
               metadata: config.metadata as
                   | Record<string, unknown>
                   | undefined,
+              signal: config.signal,
               resolve: (results): void => {
                 resultSettled = true;
                 settledResults = results;
@@ -3678,6 +3741,11 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
       outputs[i] = interruptingOutputs[k];
     });
 
+    /** The breaker can trip while the interrupting group is awaited — e.g.
+     * a tool that ignores cancellation and completes normally. Recheck
+     * before starting the non-idempotent siblings. */
+    this.throwIfBreakerTripped(config);
+
     // No interrupting call suspended — safe to run the remaining siblings.
     const regularOutputs = await Promise.all(
       regularPositions.map((i) => runOne(directCalls[i], i))
@@ -3718,6 +3786,41 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
 
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   protected async run(input: any, config: RunnableConfig): Promise<T> {
+    /**
+     * Breaker read once at batch entry: every downstream path (direct
+     * `tool.invoke` runtimes and the ON_TOOL_EXECUTE dispatch) inherits this
+     * config, and a graph reset mid-batch must not detach in-flight tools
+     * from an already-tripped signal.
+     */
+    const breakerSignal = this.getBreakerSignal?.();
+    const composedSignal = composeAbortSignals(config.signal, breakerSignal);
+    /** Immutable batch scope, captured with the signal BEFORE hooks: tools
+     * that spawn runs (subagents) bind their child to this controller, so a
+     * reset during a PreToolUse hook cannot hand them the new run's one. */
+    const batchRunScope = this.getRunScope?.();
+    if (composedSignal !== config.signal || batchRunScope != null) {
+      config = {
+        ...config,
+        signal: composedSignal,
+        ...(batchRunScope != null && {
+          configurable: {
+            ...config.configurable,
+            [RUN_BREAKER_SCOPE_CONFIG_KEY]: batchRunScope,
+          },
+        }),
+      };
+    }
+    /** Already-tripped-at-entry: a parallel sibling's breach failed the run
+     * before this batch was scheduled. Rethrow before hooks, direct
+     * `tool.invoke` calls, or ON_TOOL_EXECUTE dispatch — a tool or host
+     * handler that doesn't synchronously inspect an aborted signal would
+     * otherwise perform side effects on a failed run. */
+    if (
+      composedSignal?.aborted === true &&
+      composedSignal.reason instanceof StreamLimitExceededError
+    ) {
+      throw composedSignal.reason;
+    }
     this.toolCallTurns.clear();
     /**
      * Per-batch local map for resolved (post-substitution) args.

package/src/tools/ToolSearch.ts

@@ -21,7 +21,7 @@ function getBM25Function(): BM25Fn {
 
 const BM25 = getBM25Function();
 import fetch, { RequestInit } from 'node-fetch';
-import { HttpsProxyAgent } from 'https-proxy-agent';
+import { resolveFetchProxyAgent } from '@/utils/proxy';
 import { tool, DynamicStructuredTool } from '@langchain/core/tools';
 import type * as t from '@/types';
 import { INTENT_PROPERTY } from '@/tools/intentArg';
@@ -1102,8 +1102,9 @@ ${mcpNote}${toolsListSection}
           body: JSON.stringify(postData),
         };
 
-        if (process.env.PROXY != null && process.env.PROXY !== '') {
-          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
+        const proxyAgent = resolveFetchProxyAgent(EXEC_ENDPOINT);
+        if (proxyAgent) {
+          fetchOptions.agent = proxyAgent;
         }
 
         const response = await fetch(EXEC_ENDPOINT, fetchOptions);