@librechat/agents 3.8.0 → 3.8.2

package/dist/cjs/tools/ToolNode.cjs

@@ -1,19 +1,21 @@
-const require_truncation = require("../utils/truncation.cjs");
 const require_enum = require("../common/enum.cjs");
 require("../common/index.cjs");
+const require_truncation = require("../utils/truncation.cjs");
 const require_runStepResume = require("./runStepResume.cjs");
 const require_SubagentReplay = require("./subagent/SubagentReplay.cjs");
 const require_misc = require("../utils/misc.cjs");
 const require_langfuseRuntimeScope = require("../langfuseRuntimeScope.cjs");
 const require_toolContent = require("../utils/toolContent.cjs");
 const require_provenance = require("../messages/provenance.cjs");
+const require_eagerEventExecution = require("./eagerEventExecution.cjs");
+const require_approvalReview = require("../hitl/approvalReview.cjs");
 const require_types = require("../hooks/types.cjs");
+const require_toolBatchReplay = require("./toolBatchReplay.cjs");
 const require_executeHooks = require("../hooks/executeHooks.cjs");
 require("../hooks/index.cjs");
 const require_injected = require("../messages/injected.cjs");
 const require_events = require("../utils/events.cjs");
 const require_streamLimits = require("../llm/streamLimits.cjs");
-const require_eagerEventExecution = require("./eagerEventExecution.cjs");
 const require_intentArg = require("./intentArg.cjs");
 const require_toolOutputReferences = require("./toolOutputReferences.cjs");
 const require_preparedSubagents = require("./preparedSubagents.cjs");
@@ -28,10 +30,17 @@ let _langchain_core_runnables = require("@langchain/core/runnables");
 let _langchain_core_messages = require("@langchain/core/messages");
 let _langchain_langgraph = require("@langchain/langgraph");
 let _langchain_core_singletons = require("@langchain/core/singletons");
+let crypto = require("crypto");
 //#region src/tools/ToolNode.ts
-function stripRunBreakerScope(configurable) {
-	if (configurable == null || !("lc_run_breaker_scope" in configurable)) return configurable;
-	const { [require_streamLimits.RUN_BREAKER_SCOPE_CONFIG_KEY]: _scope, ...rest } = configurable;
+function stripToolApprovalReviewConfig(configurable) {
+	if (configurable == null || !("__librechat_tool_approval_review" in configurable) && !("__librechat_tool_batch_replay" in configurable)) return configurable;
+	const { [require_approvalReview.TOOL_APPROVAL_REVIEW_CONFIG_KEY]: _review, [require_toolBatchReplay.TOOL_BATCH_REPLAY_KEY]: _replay, ...rest } = configurable;
+	return rest;
+}
+function stripHostExecutionConfig(configurable) {
+	const withoutReview = stripToolApprovalReviewConfig(configurable);
+	if (withoutReview == null || !("lc_run_breaker_scope" in withoutReview)) return withoutReview;
+	const { [require_streamLimits.RUN_BREAKER_SCOPE_CONFIG_KEY]: _scope, ...rest } = withoutReview;
 	return rest;
 }
 function createToolApprovalReplayKey(config, agentId, toolUseId) {
@@ -60,6 +69,9 @@ function withSubagentReplayBatch(config, replayBatchKey) {
 		}
 	};
 }
+function directReplayKey(call, batchIndex) {
+	return call.id == null || call.id === "" ? JSON.stringify(["position", batchIndex]) : JSON.stringify(["id", call.id]);
+}
 function createToolErrorOwnership() {
 	return {
 		handlerOwned: /* @__PURE__ */ new Set(),
@@ -113,20 +125,14 @@ function describeOfferedShape(value) {
 function findAssistantBatch(messages) {
 	for (let i = messages.length - 1; i >= 0; i--) {
 		const message = messages[i];
-		if ((0, _langchain_core_messages.isAIMessage)(message)) return {
-			message,
-			index: i,
-			messageCount: messages.length
-		};
+		if ((0, _langchain_core_messages.isAIMessage)(message)) return { message };
 	}
 }
-function getAssistantBatchReplayKey(batch, runId, threadId) {
+function getAssistantBatchReplayKey(batch, threadId) {
 	return JSON.stringify([
-		runId ?? null,
 		threadId ?? null,
-		batch.message.id ?? null,
-		batch.index,
-		batch.messageCount
+		batch.message.id == null || batch.message.id === "" ? null : batch.message.id,
+		(0, crypto.createHash)("sha256").update(require_eagerEventExecution.stableStringify(batch.message.tool_calls ?? [])).digest("hex")
 	]);
 }
 function buildToolApprovalInterruptPayload(askEntries, hookSessionId) {
@@ -244,7 +250,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 	toolUsageCount;
 	toolCallTurns = /* @__PURE__ */ new Map();
 	directPathTurns = /* @__PURE__ */ new Map();
-	settledInterruptingResults = /* @__PURE__ */ new Map();
+	settledDirectResultsByBatch = /* @__PURE__ */ new Map();
 	toolRegistry;
 	toolDefinitions;
 	localImplementationNames = /* @__PURE__ */ new Set();
@@ -279,16 +285,44 @@ var ToolNode = class extends require_run.RunnableCallable {
 			name: name ?? TOOL_NODE_RUN_NAME,
 			tags,
 			func: async (input, config) => {
+				const messages = Array.isArray(input) ? input : input.messages;
+				const assistantBatch = messages == null ? void 0 : findAssistantBatch(messages);
+				const activeReplayKey = assistantBatch == null || require_toolBatchReplay.getToolBatchReplayScope(config) == null ? void 0 : getAssistantBatchReplayKey(assistantBatch, require_toolBatchReplay.getToolBatchReplayScope(config));
+				const replayOwner = require_toolBatchReplay.getToolBatchReplayOwner(config, this.executingAgentId ?? this.agentId ?? "");
+				const reviewEvidence = require_approvalReview.getToolApprovalReviewEvidence(config);
+				if (reviewEvidence?.owner != null && reviewEvidence.owner !== replayOwner) {
+					const calls = this.isSendInput(input) ? [input.lg_tool_call] : assistantBatch?.message.tool_calls ?? [];
+					const trustedParentCallIds = new Set(calls.filter((call) => call.name === "subagent" && this.toolMap.get(call.name)?.[require_SubagentReplay.SUBAGENT_REPLAY_CONTROLLER] != null).map((call) => call.id ?? ""));
+					if (!(require_toolBatchReplay.getToolBatchReplayState(config.configurable)?.records.some((record) => record.owner === replayOwner && record.batch === activeReplayKey) === true) || !require_toolBatchReplay.isChildToolApprovalOwner(config, reviewEvidence.owner, trustedParentCallIds)) throw new Error("Tool approval execution owner changed before resume — failing closed");
+				}
+				const referenceReplay = {};
+				const restoredBatches = await require_toolBatchReplay.restoreToolBatchReplayState(config, replayOwner);
+				if (restoredBatches.length > 0 && !restoredBatches.some(({ batch }) => batch === activeReplayKey)) throw new Error("Tool batch proposal changed before approval replay — failing closed");
+				if (activeReplayKey != null && require_toolBatchReplay.getToolBatchReplayState(config.configurable) != null) this.settledDirectResultsByBatch.delete(activeReplayKey);
+				for (const { batch, results, turnState, referenceState } of restoredBatches) {
+					if (batch !== activeReplayKey) continue;
+					this.settledDirectResultsByBatch.set(batch, new Map(results));
+					if (turnState != null) this.restoreSubagentResumeState(turnState);
+					referenceReplay.state = referenceState;
+				}
 				restoreRunStepResumeState?.(input.runStepState, config);
 				let result;
 				try {
-					result = await this.run(input, config);
+					result = await this.run(input, config, referenceReplay);
 				} catch (error) {
-					if (!(0, _langchain_langgraph.isGraphInterrupt)(error) || createRunStepResumeState == null) throw error;
-					const resumeState = createRunStepResumeState();
-					throw new _langchain_langgraph.GraphInterrupt(error.interrupts.map((pendingInterrupt) => ({
-						...pendingInterrupt,
-						value: require_runStepResume.attachRunStepResumeState(pendingInterrupt.value, resumeState)
+					if (!(0, _langchain_langgraph.isGraphInterrupt)(error)) throw error;
+					const resumeState = createRunStepResumeState?.();
+					const activeResults = activeReplayKey == null ? void 0 : this.settledDirectResultsByBatch.get(activeReplayKey);
+					const activeBatches = activeReplayKey == null ? /* @__PURE__ */ new Map() : new Map([[activeReplayKey, activeResults ?? /* @__PURE__ */ new Map()]]);
+					const turnState = this.createSubagentResumeState();
+					const activeCallIds = new Set(assistantBatch?.message.tool_calls?.map((call) => call.id));
+					turnState.directPathTurns = turnState.directPathTurns.filter(({ toolCallId }) => activeCallIds.has(toolCallId));
+					throw new _langchain_langgraph.GraphInterrupt(await Promise.all(error.interrupts.map(async (pendingInterrupt) => {
+						const value = await require_toolBatchReplay.attachToolBatchReplayState(pendingInterrupt.value, replayOwner, activeBatches, turnState, referenceReplay.state);
+						return {
+							...pendingInterrupt,
+							value: resumeState == null ? value : require_runStepResume.attachRunStepResumeState(value, resumeState)
+						};
 					})));
 				}
 				if (createRunStepResumeState == null) return result;
@@ -416,7 +450,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 	}
 	clearDirectPathTurns() {
 		this.directPathTurns.clear();
-		this.settledInterruptingResults.clear();
+		this.settledDirectResultsByBatch.clear();
 	}
 	getCallerCapabilityProjection() {
 		const discoveredToolNames = new Set(this.getDiscoveredToolNames?.() ?? []);
@@ -486,11 +520,16 @@ var ToolNode = class extends require_run.RunnableCallable {
 	}
 	invokeWithRuntime(tool, invokeParams, call, config, runInput) {
 		const lgConfig = config;
-		const runtime = {
+		const isTrustedSubagentHop = call.name === "subagent" && tool[require_SubagentReplay.SUBAGENT_REPLAY_CONTROLLER] != null;
+		const toolConfig = {
 			...config,
+			configurable: isTrustedSubagentHop ? config.configurable : stripToolApprovalReviewConfig(config.configurable)
+		};
+		const runtime = {
+			...toolConfig,
 			state: runInput,
 			toolCallId: call.id ?? "",
-			config,
+			config: toolConfig,
 			context: lgConfig.context,
 			store: lgConfig.store ?? null,
 			writer: lgConfig.writer ?? config.configurable?.writer ?? null
@@ -576,6 +615,8 @@ var ToolNode = class extends require_run.RunnableCallable {
 				if (call.id != null && call.id !== "") this.toolCallTurns.set(call.id, next);
 				return next;
 			})();
+			this.recordToolUsageTurn(call.name, usageCount, call.id);
+			if (batchContext.replayBatchKey != null && call.id != null && call.id !== "") this.directPathTurns.set(call.id, usageCount);
 			let args = call.args;
 			if (resolveFn != null) {
 				const { resolved, unresolved } = resolveFn(runId, args);
@@ -724,6 +765,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 			throw new require_preparedSubagents.PreparedSubagentError("Tool hooks changed after a subagent started.");
 		}
 		const replayController = this.toolMap.get(call.name)?.[require_SubagentReplay.SUBAGENT_REPLAY_CONTROLLER];
+		const isTrustedSubagentReviewHop = call.name === "subagent" && replayController != null;
 		const replayConfig = replayController == null ? config : withSubagentReplayBatch(config, batchContext.replayBatchKey);
 		const settledOutput = await replayController?.getSettledOutput(call, replayConfig);
 		if (settledOutput != null) {
@@ -754,9 +796,12 @@ var ToolNode = class extends require_run.RunnableCallable {
 		const approvalReplayKey = call.id == null || call.id === "" ? void 0 : createToolApprovalReplayKey(config, this.executingAgentId ?? this.agentId ?? "", call.id);
 		const approvalReplaySessionId = getToolApprovalReplaySessionId(config, runId);
 		const pendingApproval = approvalReplayKey == null ? void 0 : hookRegistry?.getPendingToolApproval(approvalReplaySessionId, approvalReplayKey);
+		const approvalReviewEvidence = require_approvalReview.getToolApprovalReviewEvidence(config, require_toolBatchReplay.getToolBatchReplayOwner(config, this.executingAgentId ?? this.agentId ?? ""));
+		const reviewedApproval = require_approvalReview.getReviewedToolApproval(approvalReviewEvidence?.payload, call.id);
+		const approvalEvidenceAppliesToBatch = approvalReviewEvidence?.payload.action_requests.some((request) => batchContext.approvalScopeCallIds == null ? request.tool_call_id === call.id : batchContext.approvalScopeCallIds.has(request.tool_call_id)) === true;
 		const hasPostHook = hookRegistry?.hasHookFor("PostToolUse", runId) === true;
 		const hasFailureHook = hookRegistry?.hasHookFor("PostToolUseFailure", runId) === true;
-		if (hookRegistry == null || !hasPreHook && pendingApproval == null && !hasPostHook && !hasFailureHook) {
+		if (!hasPreHook && pendingApproval == null && reviewedApproval == null && approvalReviewEvidence == null && !hasPostHook && !hasFailureHook) {
 			const output = await this.runTool(call, replayConfig, batchContext);
 			return output instanceof _langchain_core_messages.ToolMessage ? persistOutput(output) : output;
 		}
@@ -774,18 +819,21 @@ var ToolNode = class extends require_run.RunnableCallable {
 		}
 		const turn = usageCount;
 		const stepId = this.toolCallStepIds?.get(call.id ?? "") ?? "";
-		let resolvedArgs = call.args;
 		const hookResolveOptions = { substituteIntentKey: this.toolDeclaresBusinessIntent(call.name) };
-		if (batchContext.preBatchSnapshot != null) {
-			const { resolved } = batchContext.preBatchSnapshot.resolve(call.args, hookResolveOptions);
-			resolvedArgs = resolved;
-		} else if (this.toolOutputRegistry != null) {
-			const { resolved } = this.toolOutputRegistry.resolve(registryRunId, call.args, hookResolveOptions);
-			resolvedArgs = resolved;
-		}
+		const resolveDirectArgs = (args) => {
+			if (batchContext.preBatchSnapshot != null) return batchContext.preBatchSnapshot.resolve(args, hookResolveOptions).resolved;
+			if (this.toolOutputRegistry != null) return this.toolOutputRegistry.resolve(registryRunId, args, hookResolveOptions).resolved;
+			return args;
+		};
+		const originalResolvedArgs = resolveDirectArgs(call.args);
+		let resolvedArgs = hasPreHook || pendingApproval != null ? originalResolvedArgs : reviewedApproval?.request.arguments ?? originalResolvedArgs;
 		let effectiveCall = call;
-		if (hasPreHook || pendingApproval != null) {
-			const preResult = await require_executeHooks.executeHooks({
+		if (hasPreHook || pendingApproval != null || reviewedApproval != null || approvalReviewEvidence != null) {
+			const preResult = hookRegistry == null ? {
+				additionalContexts: [],
+				injectedMessages: [],
+				errors: []
+			} : await require_executeHooks.executeHooks({
 				registry: hookRegistry,
 				input: {
 					hook_event_name: "PreToolUse",
@@ -803,16 +851,31 @@ var ToolNode = class extends require_run.RunnableCallable {
 				matchQuery: call.name,
 				onceReplayKey: approvalReplayKey,
 				onceReplaySessionId: approvalReplaySessionId
-			}).catch(() => void 0);
+			}).catch(() => approvalReviewEvidence == null ? void 0 : {
+				decision: "deny",
+				reason: "Approval policy could not be evaluated on resume",
+				additionalContexts: [],
+				injectedMessages: [],
+				errors: []
+			});
 			if (preResult != null) {
 				if (preResult.additionalContexts.length > 0) {
 					replayAdditionalContexts.push(...preResult.additionalContexts);
 					batchContext.additionalContextsSink?.push(...preResult.additionalContexts);
 				}
-				if (preResult.updatedInput != null) effectiveCall = {
-					...call,
-					args: preResult.updatedInput
-				};
+				if (preResult.updatedInput != null) {
+					resolvedArgs = resolveDirectArgs(preResult.updatedInput);
+					effectiveCall = {
+						...call,
+						args: resolvedArgs
+					};
+				} else if (reviewedApproval != null) {
+					resolvedArgs = reviewedApproval.request.arguments;
+					effectiveCall = {
+						...call,
+						args: resolvedArgs
+					};
+				}
 				if (preResult.decision === "deny") return persistOutput(this.blockDirectCall({
 					call,
 					resolvedArgs,
@@ -821,7 +884,15 @@ var ToolNode = class extends require_run.RunnableCallable {
 					runId,
 					threadId
 				}), effectiveCall.args);
-				if (preResult.decision === "ask") {
+				if (approvalEvidenceAppliesToBatch && reviewedApproval == null && !isTrustedSubagentReviewHop && preResult.decision !== "ask") return persistOutput(this.blockDirectCall({
+					call,
+					resolvedArgs,
+					reason: "Tool call was not included in the restored approval batch — failing closed",
+					hookRegistry,
+					runId,
+					threadId
+				}), resolvedArgs);
+				if (preResult.decision === "ask" || reviewedApproval != null) {
 					if (this.humanInTheLoop?.enabled !== true) {
 						const reason = this.resolveAskDecisionForDirectTool(preResult.reason, call.name);
 						return persistOutput(this.blockDirectCall({
@@ -842,26 +913,41 @@ var ToolNode = class extends require_run.RunnableCallable {
 						runId,
 						threadId
 					}), effectiveCall.args);
+					const allowedDecisions = preResult.decision === "ask" ? preResult.allowedDecisions : reviewedApproval?.reviewConfig.allowed_decisions;
+					const askReason = preResult.decision === "ask" ? preResult.reason : reviewedApproval?.request.description;
+					if (effectiveCall === call) effectiveCall = {
+						...call,
+						args: resolvedArgs
+					};
 					const payload = buildToolApprovalInterruptPayload([{
 						entry: {
 							call: effectiveCall,
 							args: effectiveCall.args,
 							stepId
 						},
-						reason: preResult.reason,
-						allowedDecisions: preResult.allowedDecisions
+						reason: askReason,
+						allowedDecisions
 					}], runId);
 					const resumeValue = _langchain_core_singletons.AsyncLocalStorageProviderSingleton.runWithConfig(config, () => (0, _langchain_langgraph.interrupt)(payload));
-					hookRegistry.clearPendingToolApproval(approvalReplaySessionId, approvalReplayKey);
+					hookRegistry?.clearPendingToolApproval(approvalReplaySessionId, approvalReplayKey);
+					const currentApproval = require_approvalReview.getReviewedToolApproval(payload, toolCallId);
+					if (reviewedApproval != null && (currentApproval == null || !require_approvalReview.toolApprovalProposalMatches(currentApproval, reviewedApproval))) return persistOutput(this.blockDirectCall({
+						call,
+						resolvedArgs,
+						reason: "Reviewed tool proposal changed before resume; retry approval",
+						hookRegistry,
+						runId,
+						threadId
+					}), effectiveCall.args);
 					const decision = normalizeApprovalDecisions([toolCallId], resumeValue).get(toolCallId) ?? {
 						type: "reject",
 						reason: "No decision provided for tool approval"
 					};
 					const declaredType = decision.type;
-					if (preResult.allowedDecisions != null && (typeof declaredType !== "string" || !preResult.allowedDecisions.includes(declaredType))) return persistOutput(this.blockDirectCall({
+					if (allowedDecisions != null && (typeof declaredType !== "string" || !allowedDecisions.includes(declaredType))) return persistOutput(this.blockDirectCall({
 						call,
 						resolvedArgs,
-						reason: `Decision "${typeof declaredType === "string" ? declaredType : "<missing>"}" not in allowedDecisions [${preResult.allowedDecisions.join(", ")}] — failing closed`,
+						reason: `Decision "${typeof declaredType === "string" ? declaredType : "<missing>"}" not in allowedDecisions [${allowedDecisions.join(", ")}] — failing closed`,
 						hookRegistry,
 						runId,
 						threadId
@@ -869,7 +955,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 					if (decision.type === "reject") return persistOutput(this.blockDirectCall({
 						call,
 						resolvedArgs,
-						reason: decision.reason ?? preResult.reason ?? "Rejected by user",
+						reason: decision.reason ?? askReason ?? "Rejected by user",
 						hookRegistry,
 						runId,
 						threadId
@@ -997,7 +1083,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 	}
 	blockDirectCall(args) {
 		const { call, resolvedArgs, reason, hookRegistry, runId, threadId } = args;
-		if (hookRegistry.hasHookFor("PermissionDenied", runId) === true) require_executeHooks.executeHooks({
+		if (hookRegistry?.hasHookFor("PermissionDenied", runId) === true) require_executeHooks.executeHooks({
 			registry: hookRegistry,
 			input: {
 				hook_event_name: "PermissionDenied",
@@ -1126,7 +1212,8 @@ var ToolNode = class extends require_run.RunnableCallable {
 				resolvedArgs = pre.resolved;
 				if (pre.unresolved.length > 0 && call.id != null) unresolvedByCallId.set(call.id, pre.unresolved);
 			} else if (registry != null) {
-				const { resolved, unresolved } = registry.resolve(registryRunId, originalArgs, { substituteIntentKey: this.toolDeclaresBusinessIntent(call.name) });
+				const options = { substituteIntentKey: this.toolDeclaresBusinessIntent(call.name) };
+				const { resolved, unresolved } = preBatchSnapshot != null ? preBatchSnapshot.resolve(originalArgs, options) : registry.resolve(registryRunId, originalArgs, options);
 				resolvedArgs = resolved;
 				if (unresolved.length > 0 && call.id != null) unresolvedByCallId.set(call.id, unresolved);
 			}
@@ -1148,8 +1235,9 @@ var ToolNode = class extends require_run.RunnableCallable {
 		});
 		const hookRegistry = this.hookRegistry;
 		const approvalReplaySessionId = getToolApprovalReplaySessionId(config, runId);
+		const approvalReviewEvidence = require_approvalReview.getToolApprovalReviewEvidence(config, require_toolBatchReplay.getToolBatchReplayOwner(config, this.executingAgentId ?? this.agentId ?? ""));
 		const hasPendingApproval = preToolCalls.some((entry) => entry.call.id != null && hookRegistry?.getPendingToolApproval(approvalReplaySessionId, createToolApprovalReplayKey(config, this.executingAgentId ?? this.agentId ?? "", entry.call.id)) != null);
-		if (hookRegistry != null && (hookRegistry.hasHookFor("PreToolUse", runId) || hasPendingApproval)) {
+		if (hookRegistry?.hasHookFor("PreToolUse", runId) === true || hasPendingApproval || approvalReviewEvidence != null) {
 			const preemptedEagerRecords = /* @__PURE__ */ new Map();
 			if (this.eagerEventToolExecutions != null) for (const entry of preToolCalls) {
 				const callId = entry.call.id;
@@ -1160,7 +1248,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 					this.eagerEventToolExecutions.delete(callId);
 				}
 			}
-			const preResults = await Promise.all(preToolCalls.map((entry) => {
+			const preResults = hookRegistry == null ? preToolCalls.map(() => HOOK_FALLBACK) : await Promise.all(preToolCalls.map((entry) => {
 				const toolUseId = entry.call.id;
 				const approvalReplayKey = toolUseId == null ? void 0 : createToolApprovalReplayKey(config, this.executingAgentId ?? this.agentId ?? "", toolUseId);
 				return require_executeHooks.executeHooks({
@@ -1213,7 +1301,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 			const flushDeferredBlockedSideEffects = async () => {
 				for (const item of deferredBlockedSideEffects) {
 					await this.dispatchStepCompleted(item.callId, item.toolName, item.args, item.contentString, config);
-					if (hookRegistry.hasHookFor("PermissionDenied", runId)) require_executeHooks.executeHooks({
+					if (hookRegistry?.hasHookFor("PermissionDenied", runId) === true) require_executeHooks.executeHooks({
 						registry: hookRegistry,
 						input: {
 							hook_event_name: "PermissionDenied",
@@ -1257,6 +1345,13 @@ var ToolNode = class extends require_run.RunnableCallable {
 						continue;
 					}
 					if (hookResult.updatedInput != null) applyInputOverride(entry, hookResult.updatedInput);
+					else {
+						const reviewed = require_approvalReview.getReviewedToolApproval(approvalReviewEvidence?.payload, entry.call.id);
+						if (reviewed != null) {
+							entry.args = this.coerceEventToolArgs(entry.call.name, reviewed.request.arguments);
+							if (entry.call.id != null) unresolvedByCallId.delete(entry.call.id);
+						}
+					}
 					askEntries.push({
 						entry,
 						reason: hookResult.reason,
@@ -1265,6 +1360,19 @@ var ToolNode = class extends require_run.RunnableCallable {
 					continue;
 				}
 				if (hookResult.updatedInput != null) applyInputOverride(entry, hookResult.updatedInput);
+				const reviewedApproval = require_approvalReview.getReviewedToolApproval(approvalReviewEvidence?.payload, entry.call.id);
+				if (reviewedApproval != null) {
+					if (hookResult.updatedInput == null) {
+						entry.args = this.coerceEventToolArgs(entry.call.name, reviewedApproval.request.arguments);
+						if (entry.call.id != null) unresolvedByCallId.delete(entry.call.id);
+					}
+					askEntries.push({
+						entry,
+						reason: reviewedApproval.request.description,
+						allowedDecisions: reviewedApproval.reviewConfig.allowed_decisions
+					});
+					continue;
+				}
 				if (entry.call.id != null) {
 					const preempted = preemptedEagerRecords.get(entry.call.id);
 					if (preempted != null) this.eagerEventToolExecutions?.set(entry.call.id, preempted);
@@ -1274,9 +1382,12 @@ var ToolNode = class extends require_run.RunnableCallable {
 			if (askEntries.length > 0) {
 				const payload = buildToolApprovalInterruptPayload(askEntries, runId);
 				const resumeValue = _langchain_core_singletons.AsyncLocalStorageProviderSingleton.runWithConfig(config, () => (0, _langchain_langgraph.interrupt)(payload));
-				for (const { entry } of askEntries) hookRegistry.clearPendingToolApproval(approvalReplaySessionId, createToolApprovalReplayKey(config, this.executingAgentId ?? this.agentId ?? "", entry.call.id));
-				const decisionByCallId = normalizeApprovalDecisions(askEntries.map(({ entry }) => entry.call.id), resumeValue);
-				for (const { entry, reason: askReason, allowedDecisions } of askEntries) {
+				for (const { entry } of askEntries) hookRegistry?.clearPendingToolApproval(approvalReplaySessionId, createToolApprovalReplayKey(config, this.executingAgentId ?? this.agentId ?? "", entry.call.id));
+				const proposalMatches = approvalReviewEvidence == null || require_approvalReview.toolApprovalPayloadMatches(payload, approvalReviewEvidence.payload);
+				if (!proposalMatches) for (const { entry } of askEntries) blockEntry(entry, "Reviewed tool proposal changed before resume; retry approval");
+				const decisionEntries = proposalMatches ? askEntries : [];
+				const decisionByCallId = normalizeApprovalDecisions(decisionEntries.map(({ entry }) => entry.call.id), resumeValue);
+				for (const { entry, reason: askReason, allowedDecisions } of decisionEntries) {
 					const decision = decisionByCallId.get(entry.call.id) ?? {
 						type: "reject",
 						reason: "No decision provided for tool approval"
@@ -1402,7 +1513,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 					userId: config.configurable?.user_id,
 					agentId: this.executingAgentId,
 					callerCapabilityProjection: this.getCallerCapabilityProjectionSnapshot(),
-					configurable: stripRunBreakerScope(config.configurable),
+					configurable: stripHostExecutionConfig(config.configurable),
 					metadata: config.metadata,
 					signal: config.signal,
 					resolve: (results) => {
@@ -1661,15 +1772,39 @@ var ToolNode = class extends require_run.RunnableCallable {
 		return this.dispatchStepCompleted(result.toolCallId, request.name, request.args, output, config, request.turn, require_intentArg.resolveToolOutcome(request.args, require_intentArg.outcomeFieldsFromResult(result), { isError: result.status === "error" }));
 	}
 	async runDirectBatchInterruptSafe(directCalls, batchIndices, config, baseContext) {
-		const settledBatchResults = baseContext.replayBatchKey == null ? void 0 : this.settledInterruptingResults.get(baseContext.replayBatchKey);
+		const settledBatchResults = baseContext.replayBatchKey == null ? void 0 : this.settledDirectResultsByBatch.get(baseContext.replayBatchKey) ?? /* @__PURE__ */ new Map();
+		const cacheResult = (call, position, result) => {
+			if (baseContext.replayBatchKey == null || settledBatchResults == null) return;
+			settledBatchResults.set(directReplayKey(call, baseContext.replayCallPositions?.get(call) ?? batchIndices[position]), result);
+			this.settledDirectResultsByBatch.set(baseContext.replayBatchKey, settledBatchResults);
+		};
 		const restoreResult = (call, result) => {
 			baseContext.additionalContextsSink?.push(...result.additionalContexts);
+			const turn = result.turn;
+			if (turn != null) this.recordToolUsageTurn(call.name, turn, call.id);
+			const refMeta = (0, _langchain_core_messages.isBaseMessage)(result.output) ? result.output.additional_kwargs : void 0;
+			if (refMeta?._refKey != null && result.referenceContent != null) {
+				this.toolOutputRegistry?.set(baseContext.batchScopeId, refMeta._refKey, result.referenceContent);
+				if ((0, _langchain_core_messages.isBaseMessage)(result.output)) result = {
+					...result,
+					output: new _langchain_core_messages.ToolMessage({
+						...result.output,
+						additional_kwargs: {
+							...result.output.additional_kwargs,
+							_refScope: baseContext.batchScopeId
+						}
+					})
+				};
+			}
 			if (call.id != null && result.resolvedArgs != null && baseContext.resolvedArgsByCallId != null) baseContext.resolvedArgsByCallId.set(call.id, result.resolvedArgs);
 			return result;
 		};
 		const runOne = async (call, position) => {
-			const cachedResult = typeof call.id === "string" ? settledBatchResults?.get(call.id) : void 0;
-			if (cachedResult != null) return restoreResult(call, cachedResult);
+			const cachedResult = settledBatchResults?.get(directReplayKey(call, baseContext.replayCallPositions?.get(call) ?? batchIndices[position]));
+			if (cachedResult != null) {
+				if (cachedResult.proposal.name !== call.name || !require_eagerEventExecution.recordArgsEqual(cachedResult.proposal.args, call.args)) throw new Error("Cannot change an already completed tool call during approval replay");
+				return restoreResult(call, cachedResult);
+			}
 			const additionalContexts = [];
 			const output = await this.runDirectToolWithLifecycleHooks(call, config, {
 				...baseContext,
@@ -1677,14 +1812,32 @@ var ToolNode = class extends require_run.RunnableCallable {
 				additionalContextsSink: additionalContexts
 			});
 			const resolvedArgs = call.id == null ? void 0 : baseContext.resolvedArgsByCallId?.get(call.id);
-			return restoreResult(call, {
+			const result = {
+				proposal: structuredClone({
+					name: call.name,
+					args: call.args
+				}),
+				turn: call.id == null ? void 0 : this.toolCallTurns.get(call.id) ?? this.directPathTurns.get(call.id),
 				output,
 				additionalContexts,
 				...resolvedArgs == null ? {} : { resolvedArgs }
-			});
+			};
+			const refMeta = (0, _langchain_core_messages.isBaseMessage)(output) ? output.additional_kwargs : void 0;
+			if (refMeta?._refKey != null) result.referenceContent = this.toolOutputRegistry?.get(refMeta._refScope, refMeta._refKey);
+			cacheResult(call, position, result);
+			return restoreResult(call, result);
 		};
 		const interrupting = this.interruptingToolNames;
-		if (!(interrupting != null && directCalls.some((call) => interrupting.has(call.name)))) return (await Promise.all(directCalls.map((call, i) => runOne(call, i)))).map((result) => result.output);
+		if (!(interrupting != null && directCalls.some((call) => interrupting.has(call.name)))) {
+			const results = await Promise.allSettled(directCalls.map((call, i) => runOne(call, i)));
+			this.throwIfBreakerTripped(config);
+			const failed = results.find((result) => result.status === "rejected" && !(0, _langchain_langgraph.isGraphInterrupt)(result.reason)) ?? results.find((result) => result.status === "rejected");
+			if (failed?.status === "rejected") throw failed.reason;
+			return results.map((result) => {
+				if (result.status === "rejected") throw result.reason;
+				return result.value.output;
+			});
+		}
 		const outputs = new Array(directCalls.length);
 		const interruptingPositions = [];
 		const regularPositions = [];
@@ -1705,12 +1858,6 @@ var ToolNode = class extends require_run.RunnableCallable {
 			}
 			const position = interruptingPositions[i];
 			outputs[position] = result.value.output;
-			const callId = directCalls[position].id;
-			if (baseContext.replayBatchKey != null && typeof callId === "string" && callId !== "") {
-				const batchResults = this.settledInterruptingResults.get(baseContext.replayBatchKey) ?? /* @__PURE__ */ new Map();
-				batchResults.set(callId, result.value);
-				this.settledInterruptingResults.set(baseContext.replayBatchKey, batchResults);
-			}
 		}
 		if (hasInterruptingError) {
 			if ((0, _langchain_langgraph.isGraphInterrupt)(interruptingError)) {
@@ -1752,7 +1899,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 		const outputs = [...toolMessages, ...injected];
 		return Array.isArray(input) ? outputs : { messages: outputs };
 	}
-	async run(input, config) {
+	async run(input, config, referenceReplay = {}) {
 		const breakerSignal = this.getBreakerSignal?.();
 		const composedSignal = require_misc.composeAbortSignals(config.signal, breakerSignal);
 		const batchRunScope = this.getRunScope?.();
@@ -1768,10 +1915,11 @@ var ToolNode = class extends require_run.RunnableCallable {
 		this.toolCallTurns.clear();
 		const resolvedArgsByCallId = /* @__PURE__ */ new Map();
 		const errorOwnership = createToolErrorOwnership();
-		const incomingRunId = config.configurable?.run_id;
-		const incomingThreadId = config.configurable?.thread_id;
-		const batchScopeId = incomingRunId ?? `\0anon-${this.anonBatchCounter++}`;
-		const turn = this.toolOutputRegistry?.nextTurn(batchScopeId) ?? 0;
+		const batchScopeId = config.configurable?.run_id ?? `\0anon-${this.anonBatchCounter++}`;
+		const resumedReferenceState = referenceReplay.state;
+		const replayInputSnapshot = resumedReferenceState == null ? void 0 : this.toolOutputRegistry?.resumeBatch(batchScopeId, resumedReferenceState);
+		referenceReplay.state = resumedReferenceState ?? this.toolOutputRegistry?.snapshotState(batchScopeId);
+		const turn = resumedReferenceState?.turnCounter ?? this.toolOutputRegistry?.nextTurn(batchScopeId) ?? 0;
 		let outputs;
 		let replayBatchKey;
 		let promotedAiMessage;
@@ -1781,17 +1929,19 @@ var ToolNode = class extends require_run.RunnableCallable {
 			if (this.eventDrivenMode && !isLocalTool) return this.executeViaEvent([input.lg_tool_call], config, input, {
 				batchIndices: [0],
 				turn,
-				batchScopeId
+				batchScopeId,
+				preBatchSnapshot: replayInputSnapshot
 			});
 			const directAdditionalContexts = [];
 			const { lg_tool_call: _sendToolCall, ...sendState } = input;
 			const sendMessages = sendState.messages;
 			const sendAssistantBatch = Array.isArray(sendMessages) ? findAssistantBatch(sendMessages) : void 0;
-			const sendReplayBatchKey = sendAssistantBatch == null ? void 0 : getAssistantBatchReplayKey(sendAssistantBatch, incomingRunId, incomingThreadId);
+			const sendReplayBatchKey = sendAssistantBatch == null || require_toolBatchReplay.getToolBatchReplayScope(config) == null ? void 0 : getAssistantBatchReplayKey(sendAssistantBatch, require_toolBatchReplay.getToolBatchReplayScope(config));
 			const sendOutput = await this.runDirectToolWithLifecycleHooks(input.lg_tool_call, config, {
 				batchIndex: 0,
 				turn,
 				batchScopeId,
+				preBatchSnapshot: replayInputSnapshot,
 				resolvedArgsByCallId,
 				errorOwnership,
 				additionalContextsSink: directAdditionalContexts,
@@ -1815,14 +1965,15 @@ var ToolNode = class extends require_run.RunnableCallable {
 			const assistantBatch = findAssistantBatch(messages);
 			if (assistantBatch == null) throw new Error("ToolNode only accepts AIMessages as input.");
 			const aiMessage = assistantBatch.message;
-			replayBatchKey = getAssistantBatchReplayKey(assistantBatch, incomingRunId, incomingThreadId);
+			replayBatchKey = require_toolBatchReplay.getToolBatchReplayScope(config) == null ? void 0 : getAssistantBatchReplayKey(assistantBatch, require_toolBatchReplay.getToolBatchReplayScope(config));
 			if (this.loadRuntimeTools) {
 				const { tools, toolMap } = this.loadRuntimeTools(aiMessage.tool_calls ?? []);
 				this.toolMap = toolMap ?? new Map(tools.map((tool) => [tool.name, tool]));
 				this.applyToolExecutionOverrides();
 			}
+			const replayCallPositions = new Map((aiMessage.tool_calls ?? []).map((call, i) => [call, i]));
 			const filteredCalls = aiMessage.tool_calls?.filter((call) => {
-				return (call.id == null || !toolMessageIds.has(call.id)) && !(call.id?.startsWith("srvtoolu_") ?? false);
+				return (call.id == null || call.id === "" || !toolMessageIds.has(call.id)) && !(call.id?.startsWith("srvtoolu_") ?? false);
 			}) ?? [];
 			const attributableInvalidCalls = !(!Array.isArray(input) && typeof aiMessage.id === "string" && aiMessage.id.length > 0) ? [] : (aiMessage.invalid_tool_calls ?? []).filter((call) => call.id != null && call.id !== "" && !toolMessageIds.has(call.id) && !call.id.startsWith("srvtoolu_"));
 			invalidCallResults = attributableInvalidCalls.map((call) => new _langchain_core_messages.ToolMessage({
@@ -1864,14 +2015,16 @@ var ToolNode = class extends require_run.RunnableCallable {
 				if (directEntries.length === 0 && invalidCallResults.length === 0) return this.executeViaEvent(filteredCalls, config, input, {
 					batchIndices: eventEntries.map((entry) => entry.batchIndex),
 					turn,
-					batchScopeId
+					batchScopeId,
+					preBatchSnapshot: replayInputSnapshot
 				});
 				const directCalls = directEntries.map((e) => e.call);
 				const directIndices = directEntries.map((e) => e.batchIndex);
 				const eventCalls = eventEntries.map((e) => e.call);
 				const eventIndices = eventEntries.map((e) => e.batchIndex);
+				const approvalScopeCallIds = new Set(filteredCalls.flatMap((call) => call.id == null ? [] : [call.id]));
 				const preResolvedEventArgs = /* @__PURE__ */ new Map();
-				const preBatchSnapshot = this.toolOutputRegistry?.snapshot(batchScopeId);
+				const preBatchSnapshot = replayInputSnapshot ?? this.toolOutputRegistry?.snapshot(batchScopeId);
 				if (preBatchSnapshot != null) {
 					for (const entry of eventEntries) if (entry.call.id != null) {
 						const { resolved, unresolved } = preBatchSnapshot.resolve(entry.call.args, { substituteIntentKey: this.toolDeclaresBusinessIntent(entry.call.name) });
@@ -1890,9 +2043,25 @@ var ToolNode = class extends require_run.RunnableCallable {
 					preBatchSnapshot,
 					additionalContextsSink: directAdditionalContexts,
 					replayBatchKey,
+					replayCallPositions,
+					approvalScopeCallIds,
 					runInput: input
 				}) : [];
-				if (directCalls.length > 0 && directOutputs.length > 0) await this.handleRunToolCompletions(directCalls, directOutputs, config, resolvedArgsByCallId, errorOwnership);
+				const settledDirectResults = replayBatchKey == null ? void 0 : this.settledDirectResultsByBatch.get(replayBatchKey);
+				const unhandledDirectCalls = [];
+				const unhandledDirectOutputs = [];
+				for (let i = 0; i < directCalls.length; i++) {
+					if ((settledDirectResults?.get(directReplayKey(directCalls[i], replayCallPositions.get(directCalls[i]))))?.completionHandled === true) continue;
+					unhandledDirectCalls.push(directCalls[i]);
+					unhandledDirectOutputs.push(directOutputs[i]);
+				}
+				if (unhandledDirectCalls.length > 0) {
+					await this.handleRunToolCompletions(unhandledDirectCalls, unhandledDirectOutputs, config, resolvedArgsByCallId, errorOwnership);
+					for (let i = 0; i < directCalls.length; i++) {
+						const settled = settledDirectResults?.get(directReplayKey(directCalls[i], replayCallPositions.get(directCalls[i])));
+						if (settled != null) settled.completionHandled = true;
+					}
+				}
 				const eventResult = eventCalls.length > 0 ? await this.dispatchToolEvents(eventCalls, config, {
 					batchIndices: eventIndices,
 					turn,
@@ -1919,8 +2088,9 @@ var ToolNode = class extends require_run.RunnableCallable {
 					...eventResult.injected
 				];
 			} else {
-				const preBatchSnapshot = this.toolOutputRegistry?.snapshot(batchScopeId);
+				const preBatchSnapshot = replayInputSnapshot ?? this.toolOutputRegistry?.snapshot(batchScopeId);
 				const directAdditionalContexts = [];
+				const approvalScopeCallIds = new Set(filteredCalls.flatMap((call) => call.id == null ? [] : [call.id]));
 				const toolOutputs = await this.runDirectBatchInterruptSafe(filteredCalls, filteredCalls.map((_call, i) => i), config, {
 					turn,
 					batchScopeId,
@@ -1929,6 +2099,8 @@ var ToolNode = class extends require_run.RunnableCallable {
 					preBatchSnapshot,
 					additionalContextsSink: directAdditionalContexts,
 					replayBatchKey,
+					replayCallPositions,
+					approvalScopeCallIds,
 					runInput: input
 				});
 				await this.handleRunToolCompletions(filteredCalls, toolOutputs, config, resolvedArgsByCallId, errorOwnership);
@@ -1957,7 +2129,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 			}
 		}
 		if (!outputs.some(_langchain_langgraph.isCommand)) {
-			if (replayBatchKey != null) this.settledInterruptingResults.delete(replayBatchKey);
+			if (replayBatchKey != null) this.settledDirectResultsByBatch.delete(replayBatchKey);
 			return Array.isArray(input) ? outputs : { messages: outputs };
 		}
 		if (promotedAiMessage != null) outputs = outputs.map((output) => (0, _langchain_langgraph.isCommand)(output) ? patchCommandUpdateForPromotedInvalidCalls(output, promotedAiMessage, invalidCallResults) : output);
@@ -2007,7 +2179,7 @@ var ToolNode = class extends require_run.RunnableCallable {
 			combinedOutputs.push(parallelCommand);
 		} else if (handoffCommands.length === 1) combinedOutputs.push(handoffCommands[0]);
 		if (parentCommand) combinedOutputs.push(parentCommand);
-		if (replayBatchKey != null) this.settledInterruptingResults.delete(replayBatchKey);
+		if (replayBatchKey != null) this.settledDirectResultsByBatch.delete(replayBatchKey);
 		return combinedOutputs;
 	}
 	isSendInput(input) {