@librechat/agents 3.3.11 → 3.3.12

package/dist/types/llm/openai/index.d.ts

@@ -41,6 +41,9 @@ export declare function shouldIncludeEncryptedReasoning(model: string, params: {
     store?: boolean | null;
     reasoning?: unknown;
 }): boolean;
+export declare function getCacheWriteTokens(message: BaseMessage): number | undefined;
+export declare function attachCacheWriteUsage(message: BaseMessage): void;
+export declare function attachCacheWriteMetadata(response: OpenAIClient.Responses.Response): OpenAIClient.Responses.Response;
 export declare function emitStreamChunkCallback(chunk: ChatGenerationChunk, runManager?: CallbackManagerForLLMRun): Promise<void>;
 export declare function _convertToOpenAITool(tool: BindToolsInput, fields?: {
     /**

package/dist/types/llm/streamLimits.d.ts

@@ -0,0 +1,314 @@
+import type { ToolCallChunk } from '@langchain/core/messages/tool';
+import type * as t from '@/types';
+/**
+ * Circuit breakers for pathological model streams.
+ *
+ * A malformed generation can stream a single tool call's arguments for many
+ * minutes at the provider's full token rate while the arguments never become
+ * executable (observed live: one 149,923-char SQL argument streamed for 26
+ * minutes before the 64k output-token ceiling finally ended the run). These
+ * guards fail fast instead: when a limit trips, the stream handler throws
+ * `StreamLimitExceededError` out of the run's `streamEvents` loop, which
+ * tears down the in-flight provider request where it stands (see the
+ * mid-flight halt notes in `Run.processStream`: leaving the loop cancels the
+ * reader and langgraph aborts the model call).
+ */
+/** Default cap on a single streamed tool call's cumulative argument bytes (64 KiB). */
+export declare const DEFAULT_MAX_TOOL_CALL_ARG_BYTES = 65536;
+/** Limits normalized by {@link resolveStreamLimits}; `0` uniformly means disabled. */
+export interface ResolvedStreamLimits {
+    maxToolCallArgBytes: number;
+    /** Per-tool overrides of the byte cap, keyed by model-facing tool name. */
+    maxToolCallArgBytesByTool?: Readonly<Record<string, number>>;
+    maxDeltaEventsPerTurn: number;
+    /** Precomputed once: whether ANY argument byte limit can fire. False when
+     * the global cap is disabled and every per-tool entry is a zero-valued
+     * disable — accounting must not allocate for guards that judge nothing. */
+    hasEnforceableToolCallArgLimit: boolean;
+}
+/** Cumulative streamed argument bytes for one in-flight tool call. */
+export interface StreamedToolCallArgTally {
+    bytes: number;
+    name?: string;
+    /** The graph's breaker epoch when this tally was created. Entries from
+     * the epoch that is ending survive one `resetValues` sweep, so producer
+     * loops of straggling attempts — which are not behind the consumer-only
+     * epoch gate — stay on their original budgets instead of receiving a
+     * fresh allowance at every run start. */
+    epoch?: number;
+    /** Every tally-map key this tally is registered under: its primary key
+     * (which can migrate through identifier transitions), the batch-position
+     * fallback for id-bearing chunks, and the id for chunks carrying both
+     * identifiers. Release deletes all of them — a call sealed through one
+     * identity must not leave entries behind under another. */
+    keys?: string[];
+    /**
+     * True when the previous chunk ended on an unpaired UTF-16 high surrogate.
+     * Counting each half of a split surrogate pair alone yields 3 bytes per
+     * half (the replacement-character encoding) versus 4 for the pair, so the
+     * next chunk starting with the low surrogate reconciles by subtracting 2.
+     */
+    pendingHighSurrogate?: boolean;
+}
+/** Immutable snapshot of one run's breaker identity. Captured at
+ * model/event/tool-batch entry and revalidated by REFERENCE after awaits —
+ * one identity comparison proves no reset interleaved. */
+export interface RunBreakerScope {
+    readonly epoch: number;
+    readonly controller: AbortController;
+}
+/** Streamed chunk events counted against one generation's event cap. */
+export interface StreamDeltaEventTally {
+    count: number;
+    /** Creation-epoch tag, same grace semantics as
+     * {@link StreamedToolCallArgTally.epoch}. */
+    epoch?: number;
+}
+/**
+ * The graph-owned state the guards read and write. Structural on purpose:
+ * handler-level tests stub graphs with plain objects, and the guards lazily
+ * create the tally maps so partial stubs need no extra setup.
+ */
+export interface StreamLimitState {
+    streamLimits?: ResolvedStreamLimits;
+    streamedToolCallArgTallies?: Map<string, StreamedToolCallArgTally>;
+    streamDeltaEventCounts?: Map<string, StreamDeltaEventTally>;
+    /** The graph's live breaker epoch; new accounting entries are tagged with
+     * it so `resetValues` can sweep by age instead of clearing outright. */
+    breakerEpoch?: number;
+    /** Generation keys of model attempts still in flight. Each attempt leases
+     * its generation at entry and releases it (with its accounting entries)
+     * from its `finally`, so retention follows ATTEMPT LIFETIME — a
+     * cancellation-ignoring straggler keeps its original budget no matter how
+     * many runs start and reset while it drains. */
+    activeStreamLimitGenerations?: Set<string>;
+    /** Per-chunk-object, per-generation charge balance: producer visits
+     * increment, consumer (handler echo) visits decrement, and a visit only
+     * charges when the other side has not pre-charged the same emission.
+     * Count-balancing rather than a lifetime set, because a streaming model
+     * may mutate and re-yield the same chunk object; scoped by generation so
+     * parallel generations sharing one reused object cannot cancel each
+     * other's charges. */
+    streamLimitChargeCredits?: WeakMap<object, Map<string, number>>;
+}
+/**
+ * Normalizes host-supplied limits once at graph construction. `undefined`
+ * applies the default for each guard (the tool-argument byte cap is ON by
+ * default, the per-turn event cap is opt-in), `0` and negative values
+ * disable a guard, `Infinity` means "no limit" and also disables, and `NaN`
+ * falls back to the default.
+ */
+export declare function resolveStreamLimits(limits?: t.StreamLimits): ResolvedStreamLimits;
+export type StreamLimitKind = 'tool_call_args' | 'delta_events';
+/**
+ * Raised when a {@link t.StreamLimits} guard trips. Thrown from inside the
+ * run's `streamEvents` loop, so the in-flight provider request is torn down
+ * and `processStream` rejects with this error.
+ */
+export declare class StreamLimitExceededError extends Error {
+    readonly kind: StreamLimitKind;
+    readonly limit: number;
+    readonly observed: number;
+    readonly toolName?: string;
+    constructor({ kind, limit, observed, toolName, }: {
+        kind: StreamLimitKind;
+        limit: number;
+        observed: number;
+        toolName?: string;
+    });
+}
+/**
+ * Identity of one model generation, derived from langgraph's node-execution
+ * metadata. Deliberately NOT `Graph.getStepKey()`: the step key forks within
+ * a single generation on reasoning transitions (`'reasoning'` /
+ * `post-reasoning-<n>` suffixes in `getKeyList`) and on mid-turn server-tool
+ * results (`invokedToolIds` count), which would hand a fresh budget to each
+ * segment. One agent-node execution is one superstep, so
+ * `checkpoint_ns + node + step` stays stable for the whole generation and
+ * distinguishes parallel agents in the same superstep.
+ *
+ * The attempt stamp scopes attempts within one node execution:
+ * `attemptInvoke` is the single funnel for primary, fallback, and
+ * summarization model calls and stamps {@link STREAM_LIMIT_ATTEMPT_KEY}
+ * with a unique sequence number into each attempt's callback metadata. A
+ * fallback's chunks therefore key separately from the failed primary's,
+ * even for two fallbacks configured with the same provider and model name,
+ * and even when the decoupled `streamEvents` reader drains a failed
+ * attempt's buffered chunks late. Those late chunks land in their own
+ * attempt's bucket instead of polluting the next one's.
+ */
+export declare function resolveGenerationKey(metadata: Record<string, unknown> | undefined): string;
+/**
+ * Metadata key carrying the unique per-model-attempt sequence number that
+ * `attemptInvoke` stamps into every attempt's callback metadata. Part of
+ * the generation key so budgets never alias across attempts.
+ */
+export declare const STREAM_LIMIT_ATTEMPT_KEY = "lc_stream_limit_attempt";
+/**
+ * Event-metadata marker for a chunk the SDK re-dispatches inline after
+ * transforming it (`attemptInvoke`'s OpenRouter final-reasoning replay). The
+ * original wire chunk still reaches the handler through `streamEvents` and
+ * is counted there, so the re-dispatch must not consume a second
+ * event-budget slot.
+ */
+export declare const STREAM_LIMIT_REDISPATCH_KEY = "lc_stream_limit_redispatch";
+/**
+ * Metadata key carrying the graph's breaker epoch at the time a model
+ * attempt started. The stream handler trips the shared breaker only when
+ * the event's epoch matches the live controller's — a straggling chunk from
+ * a failed run that outlived `resetValues()` must fail its own (dead) run,
+ * not abort the controller now serving the next one. A primitive rather
+ * than the controller itself so attempt metadata stays serialization-safe
+ * for tracing.
+ */
+export declare const STREAM_LIMIT_EPOCH_KEY = "lc_stream_limit_epoch";
+/**
+ * Configurable key carrying the tool batch's entry-captured
+ * {@link RunBreakerScope} to tools that spawn their own runs (subagents).
+ * Captured BEFORE PreToolUse hooks, so a reset during a hook cannot rebind
+ * the spawned child to the new run's controller. Stripped from host-facing
+ * batch requests and from child-graph configurables.
+ */
+export declare const RUN_BREAKER_SCOPE_CONFIG_KEY = "lc_run_breaker_scope";
+/**
+ * Accumulates the UTF-8 byte size of streamed tool-call argument chunks per
+ * in-flight tool call and throws once a single call's cumulative bytes
+ * exceed `maxToolCallArgBytes`. Runs once per streamed chunk event, before
+ * complete tool calls are dispatched or eagerly executed and before chunks
+ * are recorded, so a tripped limit stops the run without dispatching the
+ * offending call.
+ *
+ * Calls are keyed by generation and chunk `index`, falling back to the
+ * chunk `id` and then to the chunk's position within the event's batch when
+ * a provider identifies chunks by neither (Google emits complete parallel
+ * calls with optional ids and no index). A `kind: 'all'` arrival seal marks
+ * every chunk in the event as its own complete call, so those are checked
+ * standalone and never share a budget; a matching `kind: 'single'` seal
+ * replaces the call's tally with the sealing chunk's own bytes (the OpenAI
+ * Responses done-chunk restates the full argument string) and releases it.
+ */
+export declare function enforceStreamedToolCallArgLimit({ graph, metadata, toolCallChunks, responseMetadata, parsedToolCalls, }: {
+    graph: StreamLimitState;
+    metadata: Record<string, unknown> | undefined;
+    toolCallChunks: ToolCallChunk[];
+    responseMetadata?: Record<string, unknown>;
+    /** Complete parsed calls from the same event, used to name anonymous raw
+     * chunks so per-tool overrides are honored before the global cap trips. */
+    parsedToolCalls?: CompleteToolCallLike[];
+}): void;
+/** Structural subset of a complete parsed tool call. */
+interface CompleteToolCallLike {
+    id?: string;
+    name?: string;
+    args?: unknown;
+}
+/**
+ * Standalone byte check for complete parsed tool calls that arrive without a
+ * raw chunk representation: a streaming custom or OpenAI-compatible
+ * `ChatModel` can yield fully parsed `tool_calls` with empty
+ * `tool_call_chunks`, which would otherwise dispatch without consuming any
+ * byte budget. Complete calls are self-contained, so each is judged
+ * standalone without tallying.
+ */
+export declare function enforceCompleteToolCallArgLimit({ graph, metadata, toolCalls, }: {
+    graph: StreamLimitState;
+    metadata: Record<string, unknown> | undefined;
+    toolCalls: CompleteToolCallLike[];
+}): void;
+/**
+ * Whether a chunk needs charge accounting at all. With the event cap off
+ * (the default) and no tool payload on the chunk, there is nothing a claim
+ * could ever gate — skipping restores the documented zero-cost-disabled
+ * behavior by avoiding a WeakMap entry and nested Map per ordinary text
+ * delta. Both the producer and consumer paths use this same predicate on
+ * the same chunk, so claim pairing is unaffected.
+ */
+export declare function requiresStreamLimitAccounting(graph: StreamLimitState, chunk: {
+    tool_call_chunks?: unknown[];
+    tool_calls?: unknown[];
+    invalid_tool_calls?: unknown[];
+}): boolean;
+/** True when any stream-limit guard can fire for this graph. The attempt
+ * lease and per-chunk claims are both gated on it — fully disabled guards
+ * must allocate no bookkeeping at all, per-attempt included. */
+export declare function streamLimitAccountingEnabled(graph: StreamLimitState): boolean;
+/** Leases a model attempt's generation: entries under it are exempt from
+ * the reset sweep until {@link releaseStreamLimitGeneration} runs from the
+ * attempt's `finally`. */
+export declare function registerActiveStreamLimitGeneration(graph: StreamLimitState, generationKey: string): void;
+/** Ends an attempt's lease and deletes its accounting entries — the
+ * authoritative retirement point for attempt-scoped state. */
+export declare function releaseStreamLimitGeneration(graph: StreamLimitState, generationKey: string): void;
+/**
+ * Deletes accounting entries older than the epoch that is ending, EXCEPT
+ * entries leased by a still-active attempt. Called by `resetValues` instead
+ * of clearing: producer loops of straggling attempts use the graph's maps
+ * directly and are not behind the consumer-only epoch gate, so a clear
+ * would hand a cancellation-ignoring provider a fresh allowance at every
+ * run start. Leased entries live until their attempt's `finally` releases
+ * them; unleased entries (direct callers with no attempt stamp) get one
+ * grace reset via their epoch tag.
+ */
+export declare function sweepStaleStreamLimitEntries(entries: Map<string, {
+    epoch?: number;
+}>, endingEpoch: number, activeGenerations?: ReadonlySet<string>): void;
+export declare function linkStreamLimitCanonical(copy: object, canonical: object): void;
+/**
+ * Claims accounting ownership of one EMISSION of a wire chunk. LangChain can
+ * hand the same chunk object to the decoupled `streamEvents` handler
+ * (`consumer`) and to the dispatch loop (`producer`) in either order, and a
+ * streaming model may mutate and re-yield the same object across emissions —
+ * so dedup is a signed credit balance per object rather than a lifetime set.
+ * Each producer visit adds a credit, each consumer visit removes one, and a
+ * visit charges only when the other side has not already charged that
+ * emission (positive balance = producer ahead, negative = consumer ahead).
+ * Paths where only one side ever observes the chunk (summarization, local
+ * replay-skip) charge every visit, since their balance never crosses zero
+ * the other way. Balances are scoped by generation identity so parallel
+ * generations sharing one reused chunk object cannot cancel each other's
+ * charges. Non-object chunks cannot be identity-tracked and are always
+ * claimable.
+ */
+export declare function claimStreamLimitCharge(graph: StreamLimitState, chunk: unknown, side: 'producer' | 'consumer', metadata: Record<string, unknown> | undefined): boolean;
+/**
+ * Synchronous producer-side accounting for wire chunks that would otherwise
+ * be judged only when the decoupled `streamEvents` reader catches up — or,
+ * on replay-skipped and summarization chunks, not at all. A lagging reader
+ * would let an oversized complete call return to LangGraph and reach
+ * `ToolNode` before the queued handler throws; charging in the producer
+ * loop keeps the breaker ahead of graph progression. Claim-based, so
+ * whichever of this path and the handler echo sees the chunk object first
+ * charges it and the other skips.
+ */
+export declare function enforceStreamLimitsForWireChunk({ graph, metadata, chunk, side, }: {
+    graph: StreamLimitState;
+    metadata: Record<string, unknown> | undefined;
+    chunk: {
+        tool_call_chunks?: ToolCallChunk[];
+        tool_calls?: CompleteToolCallLike[];
+        invalid_tool_calls?: CompleteToolCallLike[];
+        response_metadata?: Record<string, unknown>;
+    };
+    /** Claim side for the credit balance. The local dispatch branch charges
+     * as `consumer` because its handler-handled and replay-skipped emissions
+     * of one reused object ALTERNATE — mixed sides would pair them as
+     * producer/echo and swallow a charge. */
+    side?: 'producer' | 'consumer';
+}): void;
+/** Combined view of a chunk's parsed and invalid complete calls, avoiding
+ * allocation on the common paths where one or both are absent. */
+export declare function combineCompleteToolCalls(chunk: {
+    tool_calls?: CompleteToolCallLike[];
+    invalid_tool_calls?: CompleteToolCallLike[];
+}): CompleteToolCallLike[] | undefined;
+/**
+ * Counts streamed chunk events per model generation and throws once a single
+ * generation exceeds `maxDeltaEventsPerTurn`. Opt-in defense in depth for
+ * pathologies a byte cap cannot see, such as a provider stream looping on
+ * empty chunks. Zero cost while disabled.
+ */
+export declare function enforceStreamDeltaEventLimit({ graph, metadata, }: {
+    graph: StreamLimitState;
+    metadata: Record<string, unknown> | undefined;
+}): void;
+export {};

package/dist/types/run.d.ts

@@ -18,6 +18,7 @@ export declare class Run<_T extends t.BaseGraphState> {
     private toolExecution?;
     private subagentUsageSink?;
     private preemption?;
+    private streamLimits?;
     private indexTokenCountMap?;
     calibrationRatio: number;
     graphRunnable?: t.CompiledStateWorkflow;

package/dist/types/summarization/node.d.ts

@@ -1,8 +1,11 @@
 import type { BaseMessage } from '@langchain/core/messages';
 import type { RunnableConfig } from '@langchain/core/runnables';
+import type { StreamLimitState } from '@/llm/streamLimits';
 import type { AgentContext } from '@/agents/AgentContext';
 import type { HookRegistry } from '@/hooks';
+import type { OnChunk } from '@/llm/invoke';
 import type * as t from '@/types';
+import { Providers } from '@/common';
 /** Structured checkpoint prompt for fresh summarization (no prior summary). */
 export declare const DEFAULT_SUMMARIZATION_PROMPT = "Hold on, before you continue I need you to write me a checkpoint of everything so far. Your context window is filling up and this checkpoint replaces the messages above, so capture everything you need to pick right back up.\n\nDon't second-guess or fact-check anything you did, your tool results reflect exactly what happened. If a tool result appears truncated, that's just a display artifact from context management: the tool executed fully. Just record what you did and what you observed. Only the checkpoint, don't respond to me or continue the conversation.\n\n## Checkpoint\n\n## Goal\nWhat I asked you to do and any sub-goals you identified.\n\n## Constraints & Preferences\nAny rules, preferences, or configuration I established.\n\n## Progress\n### Done\n- What you completed and the outcomes\n\n### In Progress\n- What you're currently working on\n\n## Key Decisions\nDecisions you made and why.\n\n## Next Steps\nConcrete task actions remaining, in priority order.\n\n## Critical Context\nExact identifiers, names, error messages, URLs, and details you need to preserve verbatim.\n\nRules:\n- Record what you did and observed, don't judge or re-evaluate it\n- For each tool call: the tool name, key inputs, and the outcome\n- Preserve exact identifiers, names, errors, and references verbatim\n- Short declarative sentences\n- Skip empty sections";
 /** Prompt for re-compaction when a prior summary exists. */
@@ -18,14 +21,36 @@ interface CreateSummarizeNodeParams {
         hookRegistry?: HookRegistry;
         dispatchRunStep: (runStep: t.RunStep, config?: RunnableConfig) => Promise<void>;
         dispatchRunStepCompleted: (stepId: string, result: t.StepCompleted, config?: RunnableConfig) => Promise<void>;
-    };
+        /** The run's shared breaker signal, composed into every summarization
+         * model attempt so a sibling branch tripping a stream limit also
+         * cancels in-flight summaries. */
+        getBreakerSignal?: () => AbortSignal;
+        /** The run's shared breaker controller. Preferred over the bare signal
+         * accessor: the node captures it at entry so a breach detected by its
+         * own chunk handler trips the run that STARTED the summarization. */
+        getBreakerController?: () => AbortController;
+        /** The controller's epoch, captured at entry and stamped into summary
+         * attempt metadata so the wire consumer epoch-gates old-run summary
+         * chunks like model-attempt chunks. */
+        getBreakerEpoch?: () => number;
+    } & StreamLimitState;
     generateStepId: (stepKey: string) => [string, number];
 }
-export declare function createSummarizeNode({ agentContext, graph, generateStepId, }: CreateSummarizeNodeParams): (state: {
+export declare function createSummarizeNode({ agentContext, graph: adapterGraph, generateStepId, }: CreateSummarizeNodeParams): (state: {
     messages: BaseMessage[];
     summarizationRequest?: t.SummarizationNodeInput;
 }, config?: RunnableConfig) => Promise<{
     summarizationRequest: undefined;
     messages?: BaseMessage[];
 }>;
+/** Creates an `onChunk` callback that dispatches `ON_SUMMARIZE_DELTA` events for streaming. */
+export declare function createSummarizationChunkHandler({ stepId, config, provider, reasoningKey, graph, }: {
+    stepId?: string;
+    config?: RunnableConfig;
+    provider?: Providers;
+    reasoningKey?: 'reasoning_content' | 'reasoning';
+    graph?: StreamLimitState & {
+        getBreakerController?: () => AbortController;
+    };
+}): OnChunk | undefined;
 export {};

package/dist/types/tools/BashExecutor.d.ts

@@ -15,7 +15,7 @@ export declare const BashExecutionToolSchema: {
         };
         readonly command: {
             readonly type: "string";
-            readonly description: "The bash command or script to execute.\n- The environment is stateless; variables and state don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Persist handoff artifacts in `/mnt/data` with standard extensions (.json/.txt/.csv/.tsv/.log/.parquet/.png/.jpg/.pdf/.xlsx); failed executions do not register new files; `/tmp` and odd extensions are same-call scratch only, not later-call storage.\n- Bash: multi-line files use heredoc/printf; run Python via python3 -c/heredoc, not bare Python.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- Use `echo`, `printf`, or `cat` for all outputs.";
+            readonly description: "The bash command or script to execute.\n- The environment is stateless; variables and state don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Anything a later call needs (data, helper scripts/modules, partial results) MUST be written under `/mnt/data` in the same call that produces it; `/tmp` never survives the call. `/mnt/data` keeps files with recognized extensions, covering common source, text, data, document, image, and archive formats (.py/.sh/.sql/.md/.json/.csv/.parquet/.png/.pdf/.zip and similar); extensionless or unusual extensions are not kept. Failed executions register nothing; fix the error and rerun before relying on new files.\n- Bash: multi-line files use heredoc/printf; run Python via python3 -c/heredoc, not bare Python.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- Use `echo`, `printf`, or `cat` for all outputs.";
         };
         readonly args: {
             readonly type: "array";
@@ -91,7 +91,7 @@ export declare const BashExecutionToolDefinition: {
             };
             readonly command: {
                 readonly type: "string";
-                readonly description: "The bash command or script to execute.\n- The environment is stateless; variables and state don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Persist handoff artifacts in `/mnt/data` with standard extensions (.json/.txt/.csv/.tsv/.log/.parquet/.png/.jpg/.pdf/.xlsx); failed executions do not register new files; `/tmp` and odd extensions are same-call scratch only, not later-call storage.\n- Bash: multi-line files use heredoc/printf; run Python via python3 -c/heredoc, not bare Python.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- Use `echo`, `printf`, or `cat` for all outputs.";
+                readonly description: "The bash command or script to execute.\n- The environment is stateless; variables and state don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Anything a later call needs (data, helper scripts/modules, partial results) MUST be written under `/mnt/data` in the same call that produces it; `/tmp` never survives the call. `/mnt/data` keeps files with recognized extensions, covering common source, text, data, document, image, and archive formats (.py/.sh/.sql/.md/.json/.csv/.parquet/.png/.pdf/.zip and similar); extensionless or unusual extensions are not kept. Failed executions register nothing; fix the error and rerun before relying on new files.\n- Bash: multi-line files use heredoc/printf; run Python via python3 -c/heredoc, not bare Python.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- Use `echo`, `printf`, or `cat` for all outputs.";
             };
             readonly args: {
                 readonly type: "array";

package/dist/types/tools/CodeExecutor.d.ts

@@ -4,7 +4,7 @@ import { Constants } from '@/common';
 export { appendCodeSessionFileSummary, stripCodeSessionFileSummary, } from '@/tools/CodeSessionFileSummary';
 export declare const getCodeBaseURL: () => string;
 export declare const emptyOutputMessage = "stdout: Empty. Ensure you're writing output explicitly.\n";
-export declare const CODE_ARTIFACT_PATH_GUIDANCE = "Persist handoff artifacts in `/mnt/data` with standard extensions (.json/.txt/.csv/.tsv/.log/.parquet/.png/.jpg/.pdf/.xlsx); failed executions do not register new files; `/tmp` and odd extensions are same-call scratch only, not later-call storage.";
+export declare const CODE_ARTIFACT_PATH_GUIDANCE = "Anything a later call needs (data, helper scripts/modules, partial results) MUST be written under `/mnt/data` in the same call that produces it; `/tmp` never survives the call. `/mnt/data` keeps files with recognized extensions, covering common source, text, data, document, image, and archive formats (.py/.sh/.sql/.md/.json/.csv/.parquet/.png/.pdf/.zip and similar); extensionless or unusual extensions are not kept. Failed executions register nothing; fix the error and rerun before relying on new files.";
 export declare const BASH_SHELL_GUIDANCE = "Bash: multi-line files use heredoc/printf; run Python via python3 -c/heredoc, not bare Python.";
 export declare const TMP_SCRATCH_OUTPUT_REMINDER = "Note: /tmp files are same-call scratch only and were not persisted; use /mnt/data for files needed later.";
 export declare const FAILED_EXECUTION_FILE_REMINDER = "Note: any files written during this failed call were not registered for later calls; fix the error and rerun before relying on them.";
@@ -29,7 +29,7 @@ export declare const CodeExecutionToolSchema: {
         };
         readonly code: {
             readonly type: "string";
-            readonly description: "The complete, self-contained code to execute, without any truncation or minimization.\n- The environment is stateless; variables and imports don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Persist handoff artifacts in `/mnt/data` with standard extensions (.json/.txt/.csv/.tsv/.log/.parquet/.png/.jpg/.pdf/.xlsx); failed executions do not register new files; `/tmp` and odd extensions are same-call scratch only, not later-call storage.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- py: This is not a Jupyter notebook environment. Use `print()` for all outputs.\n- py: Matplotlib: Use `plt.savefig()` to save plots as files.\n- js: use the `console` or `process` methods for all outputs.\n- r: IMPORTANT: No X11 display available. ALL graphics MUST use Cairo library (library(Cairo)).\n- Other languages: use appropriate output functions.";
+            readonly description: "The complete, self-contained code to execute, without any truncation or minimization.\n- The environment is stateless; variables and imports don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Anything a later call needs (data, helper scripts/modules, partial results) MUST be written under `/mnt/data` in the same call that produces it; `/tmp` never survives the call. `/mnt/data` keeps files with recognized extensions, covering common source, text, data, document, image, and archive formats (.py/.sh/.sql/.md/.json/.csv/.parquet/.png/.pdf/.zip and similar); extensionless or unusual extensions are not kept. Failed executions register nothing; fix the error and rerun before relying on new files.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- py: This is not a Jupyter notebook environment. Use `print()` for all outputs.\n- py: Matplotlib: Use `plt.savefig()` to save plots as files.\n- js: use the `console` or `process` methods for all outputs.\n- r: IMPORTANT: No X11 display available. ALL graphics MUST use Cairo library (library(Cairo)).\n- Other languages: use appropriate output functions.";
         };
         readonly args: {
             readonly type: "array";
@@ -99,7 +99,7 @@ export declare const CodeExecutionToolDefinition: {
             };
             readonly code: {
                 readonly type: "string";
-                readonly description: "The complete, self-contained code to execute, without any truncation or minimization.\n- The environment is stateless; variables and imports don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Persist handoff artifacts in `/mnt/data` with standard extensions (.json/.txt/.csv/.tsv/.log/.parquet/.png/.jpg/.pdf/.xlsx); failed executions do not register new files; `/tmp` and odd extensions are same-call scratch only, not later-call storage.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- py: This is not a Jupyter notebook environment. Use `print()` for all outputs.\n- py: Matplotlib: Use `plt.savefig()` to save plots as files.\n- js: use the `console` or `process` methods for all outputs.\n- r: IMPORTANT: No X11 display available. ALL graphics MUST use Cairo library (library(Cairo)).\n- Other languages: use appropriate output functions.";
+                readonly description: "The complete, self-contained code to execute, without any truncation or minimization.\n- The environment is stateless; variables and imports don't persist between executions.\n- Prior /mnt/data files are available and can be modified in place.\n- Anything a later call needs (data, helper scripts/modules, partial results) MUST be written under `/mnt/data` in the same call that produces it; `/tmp` never survives the call. `/mnt/data` keeps files with recognized extensions, covering common source, text, data, document, image, and archive formats (.py/.sh/.sql/.md/.json/.csv/.parquet/.png/.pdf/.zip and similar); extensionless or unusual extensions are not kept. Failed executions register nothing; fix the error and rerun before relying on new files.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- py: This is not a Jupyter notebook environment. Use `print()` for all outputs.\n- py: Matplotlib: Use `plt.savefig()` to save plots as files.\n- js: use the `console` or `process` methods for all outputs.\n- r: IMPORTANT: No X11 display available. ALL graphics MUST use Cairo library (library(Cairo)).\n- Other languages: use appropriate output functions.";
             };
             readonly args: {
                 readonly type: "array";

package/dist/types/tools/ToolNode.d.ts

@@ -192,6 +192,10 @@ export declare class ToolNode<T = any> extends RunnableCallable<T, T> {
     private toolOutputRegistry?;
     /** Run-scoped selection for swapping remote code tools to local executors. */
     private toolExecution?;
+    /** Owning graph's run-scoped breaker signal, composed into each batch's config. */
+    private getBreakerSignal?;
+    /** Owning graph's immutable run scope; captured once per batch. */
+    private getRunScope?;
     /**
      * Monotonic counter used to mint a unique scope id for anonymous
      * batches (ones invoked without a `run_id` in
@@ -200,7 +204,7 @@ export declare class ToolNode<T = any> extends RunnableCallable<T, T> {
      * other's in-flight state.
      */
     private anonBatchCounter;
-    constructor({ tools, toolMap, name, tags, trace, runLangfuse, agentLangfuse, errorHandler, toolCallStepIds, handleToolErrors, loadRuntimeTools, toolRegistry, sessions, eventDrivenMode, eagerEventToolExecution, eagerEventToolExecutions, eagerEventToolUsageCount, eagerEventToolSuppressions, agentId, executingAgentId, directToolNames, interruptingToolNames, codeSessionToolNames, maxContextTokens, maxToolResultChars, hookRegistry, humanInTheLoop, toolOutputReferences, toolOutputRegistry, toolExecution, fileCheckpointer, }: t.ToolNodeConstructorParams);
+    constructor({ tools, toolMap, name, tags, trace, runLangfuse, agentLangfuse, errorHandler, toolCallStepIds, handleToolErrors, loadRuntimeTools, toolRegistry, sessions, eventDrivenMode, eagerEventToolExecution, eagerEventToolExecutions, eagerEventToolUsageCount, eagerEventToolSuppressions, agentId, executingAgentId, directToolNames, interruptingToolNames, codeSessionToolNames, maxContextTokens, maxToolResultChars, hookRegistry, humanInTheLoop, toolOutputReferences, toolOutputRegistry, toolExecution, fileCheckpointer, getBreakerSignal, getRunScope, }: t.ToolNodeConstructorParams);
     invoke(input: any, options?: Partial<RunnableConfig>): Promise<any>;
     /**
      * Returns the run-scoped tool output registry, or `undefined` when
@@ -399,6 +403,12 @@ export declare class ToolNode<T = any> extends RunnableCallable<T, T> {
      * 4. Injected messages from results are collected and returned alongside
      *    ToolMessages (appended AFTER to respect provider ordering).
      */
+    /** Rethrows a stream-limit trip carried on the batch config's composed
+     * signal. Rechecked at each later execution/dispatch stage because a tool
+     * that ignores cancellation can complete normally across the trip, and
+     * the next stage would otherwise start fresh side effects on a failed
+     * run. */
+    private throwIfBreakerTripped;
     private dispatchToolEvents;
     /** Run-scoped so another run's session hooks can't flip this run's gate. */
     private canConsumeEagerEventExecution;

package/dist/types/tools/search/crw-scraper.d.ts

@@ -19,6 +19,8 @@ export declare class CrwScraper implements t.BaseScraper {
     private xpath?;
     private proxy?;
     private stealth?;
+    private httpAgent?;
+    private httpsAgent?;
     constructor(config?: t.CrwScraperConfig);
     scrapeUrl(url: string, options?: t.CrwScrapeOptions): Promise<[string, t.CrwScrapeResponse]>;
     /**

package/dist/types/tools/search/firecrawl.d.ts

@@ -25,6 +25,8 @@ export declare class FirecrawlScraper implements t.BaseScraper {
     private location?;
     private onlyMainContent?;
     private changeTrackingOptions?;
+    private httpAgent?;
+    private httpsAgent?;
     constructor(config?: t.FirecrawlScraperConfig);
     /**
      * Scrape a single URL

package/dist/types/tools/search/keenable-scraper.d.ts

@@ -5,6 +5,8 @@ export declare class KeenableScraper implements t.BaseScraper {
     private timeout;
     private attributionTitle;
     private logger;
+    private httpAgent?;
+    private httpsAgent?;
     constructor(config?: t.KeenableScraperConfig);
     private buildHeaders;
     scrapeUrl(url: string, options?: t.KeenableScrapeOptions): Promise<[string, t.KeenableScrapeResponse]>;

package/dist/types/tools/search/rerankers.d.ts

@@ -9,21 +9,25 @@ export declare abstract class BaseReranker {
 export declare class JinaReranker extends BaseReranker {
     private apiUrl;
     private timeout;
-    constructor({ apiKey, apiUrl, timeout, logger, }: {
+    private httpAgent?;
+    private httpsAgent?;
+    constructor({ apiKey, apiUrl, timeout, logger, httpAgent, httpsAgent, }: {
         apiKey?: string;
         apiUrl?: string;
         timeout?: number;
         logger?: t.Logger;
-    });
+    } & t.HttpAgentConfig);
     rerank(query: string, documents: string[], topK?: number): Promise<t.Highlight[]>;
 }
 export declare class CohereReranker extends BaseReranker {
     private timeout;
-    constructor({ apiKey, timeout, logger, }: {
+    private httpAgent?;
+    private httpsAgent?;
+    constructor({ apiKey, timeout, logger, httpAgent, httpsAgent, }: {
         apiKey?: string;
         timeout?: number;
         logger?: t.Logger;
-    });
+    } & t.HttpAgentConfig);
     rerank(query: string, documents: string[], topK?: number): Promise<t.Highlight[]>;
 }
 export declare class InfinityReranker extends BaseReranker {
@@ -40,4 +44,4 @@ export declare const createReranker: (config: {
     cohereApiKey?: string;
     rerankerTimeout?: number;
     logger?: t.Logger;
-}) => BaseReranker | undefined;
+} & t.HttpAgentConfig) => BaseReranker | undefined;

package/dist/types/tools/search/serper-scraper.d.ts

@@ -30,6 +30,8 @@ export declare class SerperScraper implements t.BaseScraper {
     private timeout;
     private logger;
     private includeMarkdown;
+    private httpAgent?;
+    private httpsAgent?;
     constructor(config?: t.SerperScraperConfig);
     /**
      * Scrape a single URL

package/dist/types/tools/search/tavily-scraper.d.ts

@@ -9,6 +9,8 @@ export declare class TavilyScraper implements t.BaseScraper {
     private includeImages;
     private includeFavicon;
     private format;
+    private httpAgent?;
+    private httpsAgent?;
     constructor(config?: t.TavilyScraperConfig);
     scrapeUrl(url: string, options?: t.TavilyScrapeOptions): Promise<[string, t.TavilyScrapeResponse]>;
     scrapeUrls(urls: string[], options?: t.TavilyScrapeOptions): Promise<Array<[string, t.TavilyScrapeResponse]>>;