@librechat/agents 3.6.9 → 3.6.10

package/src/tools/cloudflare/CloudflareProgrammaticToolCalling.ts

@@ -9,14 +9,17 @@ import {
   ProgrammaticToolCallingDescription,
   ProgrammaticToolCallingName,
   ProgrammaticToolCallingSchema,
-  filterToolsByUsage,
 } from '@/tools/ProgrammaticToolCalling';
 import {
   BashProgrammaticToolCallingDescription,
   BashProgrammaticToolCallingSchema,
-  filterBashToolsByUsage,
   normalizeToBashIdentifier,
 } from '@/tools/BashProgrammaticToolCalling';
+import {
+  resolveProgrammaticToolDefinitions,
+  selectProgrammaticTools,
+  type ProgrammaticInvocationParams,
+} from '@/tools/ProgrammaticCallerPolicy';
 import { Constants } from '@/common';
 import {
   clientExecTimeoutMs,
@@ -27,13 +30,7 @@ import {
   validateCloudflareBashCommand,
 } from './CloudflareSandboxExecutionEngine';
 
-type ProgrammaticParams = {
-  code: string;
-  timeout?: number;
-  lang?: string;
-  runtime?: string;
-  language?: string;
-};
+type ProgrammaticParams = ProgrammaticInvocationParams;
 
 const DEFAULT_TIMEOUT = 60000;
 const MIN_TIMEOUT = 1000;
@@ -224,15 +221,8 @@ function resolveRuntime(params: ProgrammaticParams): 'python' | 'bash' {
   return raw === 'py' || raw === 'python' ? 'python' : 'bash';
 }
 
-function filterNativeTools(
-  toolDefs: t.LCTool[],
-  code: string,
-  runtime: 'python' | 'bash'
-): t.LCTool[] {
-  const nativeDefs = toolDefs.filter((def) => NATIVE_TOOL_NAMES.has(def.name));
-  const filter =
-    runtime === 'bash' ? filterBashToolsByUsage : filterToolsByUsage;
-  return filter(nativeDefs, code);
+function filterNativeTools(toolDefs: t.LCTool[]): t.LCTool[] {
+  return toolDefs.filter((def) => NATIVE_TOOL_NAMES.has(def.name));
 }
 
 function indent(code: string, spaces = 4): string {
@@ -1060,14 +1050,22 @@ async function runProgrammatic(args: {
   cloudflareConfig: t.CloudflareSandboxExecutionConfig;
   runtime: 'python' | 'bash';
 }): Promise<[string, t.ProgrammaticExecutionArtifact]> {
-  const toolCall = (args.config?.toolCall ??
-    {}) as Partial<t.ProgrammaticCache>;
-  const toolDefs = toolCall.toolDefs ?? [];
-  const effectiveTools = filterNativeTools(
-    toolDefs,
-    args.params.code,
-    args.runtime
-  );
+  const toolCall = (args.config?.toolCall ?? {}) as Partial<
+    t.ProgrammaticCache
+  > & { tools?: t.LCTool[] };
+  const toolDefs = resolveProgrammaticToolDefinitions(toolCall);
+  const programmaticToolName =
+    toolCall.programmaticToolName ??
+    (args.runtime === 'bash'
+      ? Constants.BASH_PROGRAMMATIC_TOOL_CALLING
+      : Constants.PROGRAMMATIC_TOOL_CALLING);
+  const selectedTools = selectProgrammaticTools({
+    requestedToolNames: args.params.tool_manifest,
+    allowedToolDefs: toolDefs,
+    disallowedToolDefs: toolCall.disallowedToolDefs,
+    programmaticToolName,
+  });
+  const effectiveTools = filterNativeTools(selectedTools);
   const timeoutMs = clampExecutionTimeout(
     args.params.timeout,
     args.cloudflareConfig.timeoutMs

package/src/tools/local/LocalProgrammaticToolCalling.ts

@@ -7,7 +7,6 @@ import type { AddressInfo } from 'net';
 import type * as t from '@/types';
 import {
   executeTools,
-  filterToolsByUsage,
   formatCompletedResponse,
   normalizeToPythonIdentifier,
   ProgrammaticToolCallingName,
@@ -17,9 +16,13 @@ import {
 import {
   BashProgrammaticToolCallingSchema,
   BashProgrammaticToolCallingDescription,
-  filterBashToolsByUsage,
   normalizeToBashIdentifier,
 } from '@/tools/BashProgrammaticToolCalling';
+import {
+  resolveProgrammaticToolDefinitions,
+  selectProgrammaticTools,
+  type ProgrammaticInvocationParams,
+} from '@/tools/ProgrammaticCallerPolicy';
 import {
   executeLocalBash,
   executeLocalCode,
@@ -150,15 +153,7 @@ function constantTimeEquals(a: string, b: string): boolean {
 
 type LocalProgrammaticRuntime = 'python' | 'bash';
 
-type LocalProgrammaticParams = {
-  code: string;
-  timeout?: number;
-  lang?: string;
-  runtime?: string;
-  language?: string;
-};
-
-type ToolFilter = (toolDefs: t.LCTool[], code: string) => t.LCTool[];
+type LocalProgrammaticParams = ProgrammaticInvocationParams;
 
 function resolveRuntime(
   params: LocalProgrammaticParams
@@ -547,17 +542,16 @@ ${code}
 
 function getProgrammaticContext(config?: {
   toolCall?: unknown;
-}): Partial<t.ProgrammaticCache> {
-  return (config?.toolCall ?? {}) as Partial<t.ProgrammaticCache>;
+}): Partial<t.ProgrammaticCache> & { tools?: t.LCTool[] } {
+  return (config?.toolCall ?? {}) as Partial<t.ProgrammaticCache> & {
+    tools?: t.LCTool[];
+  };
 }
 
 function createEffectiveToolMap(
   toolMap: t.ToolMap,
-  toolDefs: t.LCTool[],
-  code: string,
-  filterTools: ToolFilter
+  effectiveTools: t.LCTool[]
 ): { effectiveTools: t.LCTool[]; effectiveMap: t.ToolMap } {
-  const effectiveTools = filterTools(toolDefs, code);
   const effectiveMap = new Map<string, t.GenericTool>(
     effectiveTools
       .map((def) => {
@@ -578,9 +572,22 @@ async function runLocalProgrammaticTool(args: {
   localConfig: t.LocalExecutionConfig;
   runtime: LocalProgrammaticRuntime;
 }): Promise<[string, t.ProgrammaticExecutionArtifact]> {
-  const { toolMap, toolDefs, hookContext } = getProgrammaticContext(
-    args.config
-  );
+  const context = getProgrammaticContext(args.config);
+  const { toolMap, disallowedToolDefs, programmaticToolName, hookContext } =
+    context;
+  const toolDefs = resolveProgrammaticToolDefinitions(context);
+
+  const runnerName =
+    programmaticToolName ??
+    (args.runtime === 'bash'
+      ? Constants.BASH_PROGRAMMATIC_TOOL_CALLING
+      : Constants.PROGRAMMATIC_TOOL_CALLING);
+  const selectedTools = selectProgrammaticTools({
+    requestedToolNames: args.params.tool_manifest,
+    allowedToolDefs: toolDefs,
+    disallowedToolDefs,
+    programmaticToolName: runnerName,
+  });
 
   if (toolMap == null || toolMap.size === 0) {
     throw new Error('No toolMap provided for local programmatic execution.');
@@ -593,9 +600,7 @@ async function runLocalProgrammaticTool(args: {
 
   const { effectiveTools, effectiveMap } = createEffectiveToolMap(
     toolMap,
-    toolDefs,
-    args.params.code,
-    args.runtime === 'bash' ? filterBashToolsByUsage : filterToolsByUsage
+    selectedTools
   );
   const bridge = await createToolBridge(effectiveMap, hookContext);
 

package/src/tools/local/resolveLocalExecutionTools.ts

@@ -17,6 +17,10 @@ import {
   createLocalBashExecutionTool,
   createLocalCodeExecutionTool,
 } from './LocalExecutionTools';
+import {
+  allowsToolCaller,
+  isToolDefinitionActive,
+} from '@/tools/CallerCapabilities';
 import {
   Constants,
   CODE_EXECUTION_TOOLS,
@@ -58,6 +62,25 @@ function shouldIncludeCodingTools(config?: t.ToolExecutionConfig): boolean {
   );
 }
 
+export function isProgrammaticRunnerAutoBound(
+  name: string,
+  config?: t.ToolExecutionConfig
+): boolean {
+  if (
+    !shouldIncludeCodingTools(config) ||
+    (name !== Constants.PROGRAMMATIC_TOOL_CALLING &&
+      name !== Constants.BASH_PROGRAMMATIC_TOOL_CALLING)
+  ) {
+    return false;
+  }
+  if (shouldUseCloudflareSandboxExecution(config)) {
+    return getSelectedCloudflareCodingToolNames(
+      getCloudflareConfig(config)
+    ).has(name);
+  }
+  return shouldUseLocalExecution(config);
+}
+
 function getCloudflareConfig(
   config?: t.ToolExecutionConfig
 ): t.CloudflareSandboxExecutionConfig {
@@ -150,9 +173,43 @@ function mergeToolsByName(
   return orderedTools;
 }
 
+function filterToolsForDirectCaller(
+  tools: t.GraphTools | undefined,
+  toolRegistry?: t.LCToolRegistry,
+  discoveredToolNames: ReadonlySet<string> = new Set()
+): t.GraphTools | undefined {
+  if (tools == null || toolRegistry == null) {
+    return tools;
+  }
+  return tools.filter((tool) => {
+    if (!('name' in tool) || typeof tool.name !== 'string') {
+      return true;
+    }
+    const toolDef = toolRegistry.get(tool.name);
+    return (
+      toolDef == null ||
+      (allowsToolCaller(toolDef, 'direct') &&
+        isToolDefinitionActive(toolDef, discoveredToolNames))
+    );
+  });
+}
+
+function addDirectToolName(
+  directToolNames: Set<string>,
+  name: string,
+  toolRegistry?: t.LCToolRegistry
+): void {
+  const toolDef = toolRegistry?.get(name);
+  if (toolDef == null || allowsToolCaller(toolDef, 'direct')) {
+    directToolNames.add(name);
+  }
+}
+
 export function resolveLocalToolsForBinding(args: {
   tools?: t.GraphTools;
   toolExecution?: t.ToolExecutionConfig;
+  toolRegistry?: t.LCToolRegistry;
+  discoveredToolNames?: ReadonlySet<string>;
 }): t.GraphTools | undefined {
   if (
     !shouldUseLocalExecution(args.toolExecution) &&
@@ -166,9 +223,13 @@ export function resolveLocalToolsForBinding(args: {
     if (shouldIncludeCodingTools(args.toolExecution)) {
       const selectedNames =
         getSelectedCloudflareCodingToolNames(cloudflareConfig);
-      return mergeToolsByName(
-        filterCloudflareCodingToolAllowlist(args.tools, selectedNames),
-        createCloudflareCodingTools(cloudflareConfig)
+      return filterToolsForDirectCaller(
+        mergeToolsByName(
+          filterCloudflareCodingToolAllowlist(args.tools, selectedNames),
+          createCloudflareCodingTools(cloudflareConfig)
+        ),
+        args.toolRegistry,
+        args.discoveredToolNames
       );
     }
 
@@ -187,14 +248,23 @@ export function resolveLocalToolsForBinding(args: {
           cloudflareTool != null
       );
 
-    return replacements.length === 0
+    const resolvedTools = replacements.length === 0
       ? args.tools
       : mergeToolsByName(args.tools, replacements);
+    return filterToolsForDirectCaller(
+      resolvedTools,
+      args.toolRegistry,
+      args.discoveredToolNames
+    );
   }
 
   const localConfig = args.toolExecution?.local ?? {};
   if (shouldIncludeCodingTools(args.toolExecution)) {
-    return mergeToolsByName(args.tools, createLocalCodingTools(localConfig));
+    return filterToolsForDirectCaller(
+      mergeToolsByName(args.tools, createLocalCodingTools(localConfig)),
+      args.toolRegistry,
+      args.discoveredToolNames
+    );
   }
 
   const replacements = ((args.tools as t.GenericTool[] | undefined) ?? [])
@@ -209,9 +279,14 @@ export function resolveLocalToolsForBinding(args: {
     )
     .filter((localTool): localTool is t.GenericTool => localTool != null);
 
-  return replacements.length === 0
+  const resolvedTools = replacements.length === 0
     ? args.tools
     : mergeToolsByName(args.tools, replacements);
+  return filterToolsForDirectCaller(
+    resolvedTools,
+    args.toolRegistry,
+    args.discoveredToolNames
+  );
 }
 
 export function resolveLocalToolRegistry(args: {
@@ -228,12 +303,39 @@ export function resolveLocalToolRegistry(args: {
       getCloudflareConfig(args.toolExecution)
     )
     : undefined;
+
+  if (selectedNames != null) {
+    const callableInsideCloudflare = new Set(selectedNames);
+    callableInsideCloudflare.delete(Constants.PROGRAMMATIC_TOOL_CALLING);
+    callableInsideCloudflare.delete(Constants.BASH_PROGRAMMATIC_TOOL_CALLING);
+    for (const [name, definition] of registry) {
+      if (callableInsideCloudflare.has(name)) {
+        continue;
+      }
+      const allowedCallers = definition.allowed_callers ?? ['direct'];
+      if (allowedCallers.includes('code_execution')) {
+        registry.set(name, {
+          ...definition,
+          allowed_callers: allowedCallers.filter(
+            (caller) => caller !== 'code_execution'
+          ),
+        });
+      }
+    }
+  }
+
   for (const definition of createLocalCodingToolDefinitions()) {
     if (selectedNames != null && !selectedNames.has(definition.name)) {
       registry.delete(definition.name);
       continue;
     }
-    registry.set(definition.name, definition);
+    const existingDefinition = registry.get(definition.name);
+    registry.set(
+      definition.name,
+      existingDefinition == null
+        ? definition
+        : { ...definition, ...existingDefinition }
+    );
   }
   return registry;
 }
@@ -241,6 +343,7 @@ export function resolveLocalToolRegistry(args: {
 export function resolveLocalExecutionTools(args: {
   toolMap: t.ToolMap;
   toolExecution?: t.ToolExecutionConfig;
+  toolRegistry?: t.LCToolRegistry;
   /**
    * Caller-provided checkpointer that overrides the bundle's
    * auto-created one. The Graph layer threads a single per-Run
@@ -281,14 +384,22 @@ export function resolveLocalExecutionTools(args: {
         fileCheckpointer = bundle.checkpointer;
         for (const cloudflareTool of bundle.tools) {
           toolMap.set(cloudflareTool.name, cloudflareTool);
-          directToolNames.add(cloudflareTool.name);
+          addDirectToolName(
+            directToolNames,
+            cloudflareTool.name,
+            args.toolRegistry
+          );
         }
       } else {
         for (const cloudflareTool of createCloudflareCodingTools(
           cloudflareConfig
         )) {
           toolMap.set(cloudflareTool.name, cloudflareTool);
-          directToolNames.add(cloudflareTool.name);
+          addDirectToolName(
+            directToolNames,
+            cloudflareTool.name,
+            args.toolRegistry
+          );
         }
       }
     }
@@ -307,7 +418,7 @@ export function resolveLocalExecutionTools(args: {
       }
 
       toolMap.set(name, cloudflareTool);
-      directToolNames.add(name);
+      addDirectToolName(directToolNames, name, args.toolRegistry);
     }
 
     return { toolMap, directToolNames, fileCheckpointer };
@@ -332,12 +443,20 @@ export function resolveLocalExecutionTools(args: {
       fileCheckpointer = bundle.checkpointer;
       for (const localTool of bundle.tools) {
         toolMap.set(localTool.name, localTool);
-        directToolNames.add(localTool.name);
+        addDirectToolName(
+          directToolNames,
+          localTool.name,
+          args.toolRegistry
+        );
       }
     } else {
       for (const localTool of createLocalCodingTools(localConfig)) {
         toolMap.set(localTool.name, localTool);
-        directToolNames.add(localTool.name);
+        addDirectToolName(
+          directToolNames,
+          localTool.name,
+          args.toolRegistry
+        );
       }
     }
   }
@@ -363,7 +482,7 @@ export function resolveLocalExecutionTools(args: {
     }
 
     toolMap.set(name, localTool);
-    directToolNames.add(name);
+    addDirectToolName(directToolNames, name, args.toolRegistry);
   }
 
   return { toolMap, directToolNames, fileCheckpointer };

package/src/tools/ptcTimeout.ts

@@ -22,6 +22,12 @@ export type ProgrammaticToolCallingJsonSchema = {
       minLength: number;
       description: string;
     };
+    tool_manifest: {
+      type: 'array';
+      items: { type: 'string' };
+      uniqueItems: true;
+      description: string;
+    };
     timeout: TimeoutSchema;
   };
   required: readonly ['code'];

package/src/types/graph.ts

@@ -31,6 +31,7 @@ import type {
   ToolEndEvent,
   GenericTool,
   LCTool,
+  ToolExecutionConfig,
   ToolExecuteBatchRequest,
 } from '@/types/tools';
 import type {
@@ -338,6 +339,8 @@ export type StandardGraphInput = {
   runId?: string;
   signal?: AbortSignal;
   agents: AgentInputs[];
+  /** Execution backend used to resolve the effective tool registry. */
+  toolExecution?: ToolExecutionConfig;
   langfuse?: LangfuseConfig;
   tokenCounter?: TokenCounter;
   indexTokenCountMap?: Record<string, number>;

package/src/types/tools.ts

@@ -1,17 +1,17 @@
 // src/types/tools.ts
-import type { StructuredToolInterface } from '@langchain/core/tools';
 import type {
   RunnableConfig,
   RunnableToolLike,
 } from '@langchain/core/runnables';
+import type { StructuredToolInterface } from '@langchain/core/tools';
 import type { ToolCall } from '@langchain/core/messages/tool';
-import type { ToolOutputReferenceRegistry } from '@/tools/toolOutputReferences';
-import type { RunBreakerScope } from '@/llm/streamLimits';
 import type {
   MessageContentComplex,
   RunStepResumeState,
   ToolErrorData,
 } from './stream';
+import type { ToolOutputReferenceRegistry } from '@/tools/toolOutputReferences';
+import type { RunBreakerScope } from '@/llm/streamLimits';
 import type { HumanInTheLoopConfig } from './hitl';
 import type { LangfuseConfig } from './graph';
 import type { HookRegistry } from '@/hooks';
@@ -133,6 +133,8 @@ export type ToolNodeOptions = {
   ) => Promise<boolean | void>;
   /** Tool registry for lazy computation of programmatic tools and tool search */
   toolRegistry?: LCToolRegistry;
+  /** Returns the owning agent's currently discovered deferred tool names. */
+  getDiscoveredToolNames?: () => readonly string[];
   /** Reference to Graph's sessions map for automatic session injection */
   sessions?: ToolSessionMap;
   /** Partition within `sessions` used by this agent's code tools. */
@@ -1171,6 +1173,15 @@ export type ToolExecutionConfig = {
 export type ProgrammaticCache = {
   toolMap: ToolMap;
   toolDefs: LCTool[];
+  /** Actual outer runner name used for caller-policy diagnostics. */
+  programmaticToolName?: string;
+  /**
+   * Known tools that cannot be invoked from programmatic execution. Kept
+   * separate from `toolDefs` so the Programmatic Tool Manifest can be
+   * validated before the execution runtime starts without exposing their
+   * schemas to that runtime.
+   */
+  disallowedToolDefs?: LCTool[];
   /**
    * Hook context plumbed through by ToolNode for the local
    * programmatic-tool path so the in-process bridge can run

package/src/utils/toolContent.ts

@@ -1818,7 +1818,7 @@ function classifyToolContentBlock(
     }
   }
   const remaining = { value: MAX_ATOMIC_VALIDATION_WORK };
-  let kind = TOOL_BLOCK_OPAQUE;
+  let kind: number;
   try {
     if (
       hasUnsafeCallableToJSON(
@@ -2701,7 +2701,7 @@ export function cloneToolMessageWithContent(
     status: message.status,
     artifact,
     metadata: message.metadata,
-    additional_kwargs: message.additional_kwargs,
+    additional_kwargs: { ...message.additional_kwargs },
     response_metadata: message.response_metadata,
   });
 }