@librechat/agents 3.9.6 → 3.9.8

package/src/langfuse.ts

@@ -1,7 +1,11 @@
 import { tool } from '@langchain/core/tools';
 import { CallbackHandler } from '@langfuse/langchain';
 import { LangfuseOtelContextKeys } from '@langfuse/core';
-import { AIMessage, AIMessageChunk } from '@langchain/core/messages';
+import {
+  AIMessage,
+  HumanMessage,
+  AIMessageChunk,
+} from '@langchain/core/messages';
 import { isGraphInterrupt, isParentCommand } from '@langchain/langgraph';
 import { context as otelContext, trace as otelTrace } from '@opentelemetry/api';
 import {
@@ -67,6 +71,13 @@ const GRAPH_INTERRUPT_TOOL_OUTPUT = JSON.stringify(
 
 export type LangfuseTraceMetadata = Record<string, string>;
 export type LangfuseTraceAttributes = Record<string, string | number | boolean>;
+
+/**
+ * What a label call's Langfuse generation records in place of the prompt the
+ * model received and the text it returned, when the model saw evidence the
+ * tool-output redaction policy keeps out of traces.
+ */
+export type LangfuseGenerationMask = { input: string; output: string };
 type LangfuseMetadata = NonNullable<t.LangfuseConfig['metadata']>;
 type LangfuseConfigTraceAttributes = NonNullable<
   t.LangfuseConfig['librechatTraceAttributes']
@@ -310,6 +321,7 @@ class ScopedLangfuseCallbackHandler extends CallbackHandler {
   private readonly identity: HandlerIdentity;
   private readonly toolOutputTracing?: ResolvedLangfuseToolOutputTracingConfig;
   private readonly trackedRunIds = new Set<string>();
+  private generationMask?: LangfuseGenerationMask;
   private deferredRootStarted = false;
   private deferredRootOutcome:
     | {
@@ -607,12 +619,56 @@ class ScopedLangfuseCallbackHandler extends CallbackHandler {
   ): ReturnType<CallbackHandler['handleChainEnd']> {
     const [output, runId, parentRunId] = args;
     if (runId === this.deferredRootRunId && parentRunId == null) {
-      this.deferredRootOutcome = { type: 'end', output };
+      this.deferredRootOutcome = {
+        type: 'end',
+        output: this.maskOutputs(output),
+      };
       return Promise.resolve();
     }
+    args[0] = this.maskOutputs(output);
     return super.handleChainEnd(...args);
   }
 
+  /** Keeps usage and response metadata so cost tracking survives the mask. */
+  private maskGenerations(output: LLMResult): LLMResult {
+    const mask = this.generationMask;
+    if (mask == null) {
+      return output;
+    }
+    return {
+      ...output,
+      generations: output.generations.map((generations) =>
+        generations.map((generation) => {
+          if (!('message' in generation) || generation.message == null) {
+            return { ...generation, text: mask.output };
+          }
+          const message = generation.message as AIMessage;
+          return {
+            ...generation,
+            text: mask.output,
+            message: new AIMessage({
+              content: mask.output,
+              usage_metadata: message.usage_metadata,
+              response_metadata: message.response_metadata,
+            }),
+          };
+        })
+      ),
+    };
+  }
+
+  private maskOutputs(
+    output: Parameters<CallbackHandler['handleChainEnd']>[0]
+  ): Parameters<CallbackHandler['handleChainEnd']>[0] {
+    const mask = this.generationMask;
+    return mask == null ? output : { output: mask.output };
+  }
+
+  /** Records `mask` for every model call and chain result this handler traces. */
+  maskGeneration(mask: LangfuseGenerationMask): void {
+    this.generationMask = mask;
+  }
+
   async finishDeferredRoot(): Promise<void> {
     const runId = this.deferredRootRunId;
     const outcome = this.deferredRootOutcome;
@@ -650,6 +706,13 @@ class ScopedLangfuseCallbackHandler extends CallbackHandler {
   override handleChatModelStart(
     ...args: Parameters<CallbackHandler['handleChatModelStart']>
   ): ReturnType<CallbackHandler['handleChatModelStart']> {
+    const mask = this.generationMask;
+    if (mask != null) {
+      args[1] = args[1].map((messages) => [
+        ...messages.filter((message) => message.getType() === 'system'),
+        new HumanMessage(mask.input),
+      ]);
+    }
     return this.withRuntimeContext(
       () => super.handleChatModelStart(...args),
       this.startsDetachedRun(args[2], args[3]),
@@ -660,6 +723,10 @@ class ScopedLangfuseCallbackHandler extends CallbackHandler {
   override handleLLMStart(
     ...args: Parameters<CallbackHandler['handleLLMStart']>
   ): ReturnType<CallbackHandler['handleLLMStart']> {
+    const mask = this.generationMask;
+    if (mask != null) {
+      args[1] = args[1].map(() => mask.input);
+    }
     return this.withRuntimeContext(
       () => super.handleLLMStart(...args),
       this.startsDetachedRun(args[2], args[3]),
@@ -673,7 +740,7 @@ class ScopedLangfuseCallbackHandler extends CallbackHandler {
     parentRunId?: string
   ): Promise<void> {
     return super.handleLLMEnd(
-      normalizeBedrockUsageForLangfuse(output),
+      this.maskGenerations(normalizeBedrockUsageForLangfuse(output)),
       runId,
       parentRunId
     );
@@ -937,6 +1004,36 @@ export function createLegacyLangfuseHandler(
   return new ScopedLangfuseCallbackHandler(params);
 }
 
+/**
+ * Label calls send the model every piece of evidence. When the redacted copy
+ * differs, the trace records that copy and hides the reply, which may restate
+ * what was redacted. A no-op for any callback other than a label handler.
+ */
+export function maskRedactedLabelGeneration(
+  handler: unknown,
+  {
+    modelPrompt,
+    tracedPrompt,
+    redaction,
+  }: {
+    modelPrompt: string;
+    tracedPrompt: string;
+    redaction?: ResolvedLangfuseToolOutputTracingConfig;
+  }
+): void {
+  if (
+    !(handler instanceof ScopedLangfuseCallbackHandler) ||
+    redaction == null ||
+    tracedPrompt === modelPrompt
+  ) {
+    return;
+  }
+  handler.maskGeneration({
+    input: tracedPrompt === '' ? redaction.redactionText : tracedPrompt,
+    output: redaction.redactionText,
+  });
+}
+
 export function createLangfuseHandler({
   langfuse,
   userId,

package/src/run.ts

@@ -37,21 +37,22 @@ import {
   DEFAULT_MAX_STOP_CONTINUATIONS,
   DEFAULT_RECURSION_LIMIT,
 } from '@/common';
-import {
-  ACTIVITY_PHASE_LABEL_PROMPT,
-  ACTIVITY_LABEL_PROMPT,
-  buildActivityLabelPrompt,
-  buildActivityPhaseLabelPrompt,
-  normalizeActivityPhaseLabel,
-} from '@/prompts/activityLabel';
 import {
   createLangfuseTraceMetadata,
   createLangfuseHandler,
+  maskRedactedLabelGeneration,
   disposeLangfuseHandler,
   getLangfuseTraceName,
   isLangfuseCallbackHandler,
   withLangfuseAttributes,
 } from '@/langfuse';
+import {
+  ACTIVITY_PHASE_LABEL_PROMPT,
+  ACTIVITY_LABEL_PROMPT,
+  buildActivityLabelPrompt,
+  buildActivityPhaseLabelPrompt,
+  normalizeActivityPhaseLabel,
+} from '@/prompts/activityLabel';
 import {
   requireValidSubagentResumeManifest,
   SUBAGENT_RESUME_ATTEMPT_CONFIG_KEY,
@@ -203,6 +204,7 @@ const CUSTOM_GRAPH_EVENTS = new Set<string>([
   GraphEvents.ON_RUN_STEP_DELTA,
   GraphEvents.ON_RUN_STEP_COMPLETED,
   GraphEvents.ON_RUN_STEP_CLOSED,
+  GraphEvents.ON_TOOL_CALLS_DISPATCHED,
   GraphEvents.ON_MESSAGE_DELTA,
   GraphEvents.ON_REASONING_DELTA,
   GraphEvents.ON_TOOL_EXECUTE,
@@ -1094,6 +1096,7 @@ export class Run<_T extends t.BaseGraphState> {
               | t.RunStep
               | t.RunStepDeltaEvent
               | t.RunStepClosedEvent
+              | t.ToolCallsDispatchedEvent
               | t.MessageDeltaEvent
               | t.ReasoningDeltaEvent
               | { result: t.ToolEndEvent },
@@ -2663,22 +2666,21 @@ export class Run<_T extends t.BaseGraphState> {
         };
       }
     }
-    /** An active redaction policy suppresses free-form reasoning/intent, so
-     *  a reasoning-only block has nothing describable left — skip the model
-     *  call rather than paying for a label built from the prompt alone. */
-    const freeFormSuppressed =
-      redaction != null &&
-      (redaction.enabled === false || redaction.redactedToolNames.size > 0);
-    if (entries.length === 0 && freeFormSuppressed) {
-      return {};
-    }
-    const userPrompt = buildActivityLabelPrompt({
+    const labelEvidence = {
       entries,
       charLimit,
       thinkingExcerpts,
       lastAssistantText:
         lastAssistantPhase === 'final_answer' ? undefined : lastAssistantText,
       previousLabels,
+    };
+    const userPrompt = buildActivityLabelPrompt(labelEvidence);
+    maskRedactedLabelGeneration(labelLangfuseHandler, {
+      modelPrompt: userPrompt,
+      tracedPrompt:
+        redaction == null
+          ? userPrompt
+          : buildActivityLabelPrompt({ ...labelEvidence, redaction }),
       redaction,
     });
 
@@ -2983,17 +2985,25 @@ export class Run<_T extends t.BaseGraphState> {
         reasoningContext?.langfuse
       )
       : undefined;
-    const userPrompt = buildReasoningLabelPrompt({
+    const reasoningEvidence = {
       visibleReasoning,
       status,
       charLimit,
       previousLabel,
-      redaction,
-    });
+    };
+    const userPrompt = buildReasoningLabelPrompt(reasoningEvidence);
     if (userPrompt === '') {
       await disposeLangfuseHandler(reasoningLangfuseHandler);
       return {};
     }
+    maskRedactedLabelGeneration(reasoningLangfuseHandler, {
+      modelPrompt: userPrompt,
+      tracedPrompt:
+        redaction == null
+          ? userPrompt
+          : buildReasoningLabelPrompt({ ...reasoningEvidence, redaction }),
+      redaction,
+    });
 
     const model = initializeModel({
       provider,
@@ -3180,13 +3190,13 @@ export class Run<_T extends t.BaseGraphState> {
       };
     }
 
-    const userPrompt = buildActivityPhaseLabelPrompt({
+    const phaseEvidence = {
       activities,
       totalActivityCount,
       charLimit,
       assistantContext,
-      redaction,
-    });
+    };
+    const userPrompt = buildActivityPhaseLabelPrompt(phaseEvidence);
     if (userPrompt === '') {
       return {};
     }
@@ -3305,6 +3315,14 @@ export class Run<_T extends t.BaseGraphState> {
         traceName: phaseParentSpanContext == null ? phaseTraceName : undefined,
       });
     }
+    maskRedactedLabelGeneration(phaseLangfuseHandler, {
+      modelPrompt: userPrompt,
+      tracedPrompt:
+        redaction == null
+          ? userPrompt
+          : buildActivityPhaseLabelPrompt({ ...phaseEvidence, redaction }),
+      redaction,
+    });
     if (phaseLangfuseHandler != null) {
       phaseChainOptions.callbacks = appendCallbacks(
         phaseChainOptions.callbacks,

package/src/stream.ts

@@ -55,13 +55,13 @@ import {
   calculateMaxToolResultChars,
   truncateToolResultContent,
 } from '@/utils/truncation';
+import { createToolCallsDispatchedEvent, safeDispatchCustomEvent } from '@/utils/events';
 import { resolveToolOutcome, outcomeFieldsFromResult } from '@/tools/intentArg';
-import { formatToolErrorContent } from '@/tools/toolErrorContent';
 import { snapshotValidatedModelChunk } from '@/graphs/acceptedModelResponse';
 import { TOOL_OUTPUT_REF_PATTERN } from '@/tools/toolOutputReferences';
+import { formatToolErrorContent } from '@/tools/toolErrorContent';
 import { PreparedSubagentError } from '@/tools/preparedSubagents';
 import { isReasoningContentBlock } from '@/messages/core';
-import { safeDispatchCustomEvent } from '@/utils/events';
 import { composeAbortSignals } from '@/utils/misc';
 import { isGoogleLike } from '@/utils/llm';
 import { getMessageId } from '@/messages';
@@ -871,6 +871,13 @@ function startEagerToolExecutions(args: {
       reject,
     };
 
+    if (graph.config != null) {
+      void safeDispatchCustomEvent(
+        GraphEvents.ON_TOOL_CALLS_DISPATCHED,
+        createToolCallsDispatchedEvent(graph.config, batchRequest.toolCalls),
+        graph.config
+      );
+    }
     void safeDispatchCustomEvent(
       GraphEvents.ON_TOOL_EXECUTE,
       batchRequest,
@@ -980,7 +987,7 @@ async function dispatchEagerToolCompletions(args: {
               progress: 1,
               ...(outcome != null && { outcome }),
             } as t.ProcessedToolCall,
-            completed_at: Date.now(),
+            completed_at: result.received_at ?? Date.now(),
           },
         },
         graph.config
@@ -1701,6 +1708,7 @@ export class ChatModelStreamHandler implements t.EventHandler {
     // Callback delivery can beat the producer's iterator. Validate before
     // accounting, run steps, or eager dispatch reads raw tool descriptors.
     chunk = snapshotValidatedModelChunk(chunk as AIMessageChunk);
+    const observedAt = Date.now();
 
     /**
      * Enforced before every content-specific early return below
@@ -1923,6 +1931,7 @@ export class ChatModelStreamHandler implements t.EventHandler {
         stepKey,
         toolCallChunks: chunk.tool_call_chunks,
         metadata,
+        observedAt,
       });
       if (canStreamEager) {
         if (runScopeInvalidated()) {

package/src/tools/ToolNode.ts

@@ -129,10 +129,11 @@ import {
   resolveLocalExecutionTools,
 } from '@/tools/local';
 import { stripCodeSessionFileSummary } from '@/tools/CodeSessionFileSummary';
-import { formatToolErrorContent } from '@/tools/toolErrorContent';
 import { Constants, GraphEvents, CODE_EXECUTION_TOOLS } from '@/common';
+import { formatToolErrorContent } from '@/tools/toolErrorContent';
 import { PreparedSubagentError } from '@/tools/preparedSubagents';
 import { attachRunStepResumeState } from '@/tools/runStepResume';
+import { isBackgroundDenyMode } from '@/types/hitl';
 
 function stripToolApprovalReviewConfig(
   configurable: Record<string, unknown> | undefined
@@ -169,7 +170,7 @@ function stripHostExecutionConfig(
 }
 import { convertInjectedMessages } from '@/messages/injected';
 import { stampSyntheticProviderMessage } from '@/messages/provenance';
-import { safeDispatchCustomEvent } from '@/utils/events';
+import { createToolCallsDispatchedEvent, safeDispatchCustomEvent } from '@/utils/events';
 import { RunnableCallable, composeAbortSignals } from '@/utils';
 import {
   executeHooks,
@@ -1671,6 +1672,15 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
     };
     this.throwIfBreakerTripped(config);
     config.signal?.throwIfAborted();
+    if (call.id != null && call.id !== '') {
+      void safeDispatchCustomEvent(
+        GraphEvents.ON_TOOL_CALLS_DISPATCHED,
+        createToolCallsDispatchedEvent(config, [
+          { id: call.id, name: call.name, stepId: this.toolCallStepIds?.get(call.id) },
+        ]),
+        config
+      );
+    }
     return tool.invoke(invokeParams, runtime);
   }
 
@@ -1949,6 +1959,8 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
           // they dispatch — including HITL gates on `write_file` / `edit_file`.
           hookContext: {
             registry: this.hookRegistry,
+            failClosedOnHookError:
+              isBackgroundDenyMode(this.humanInTheLoop),
             runId: (config.configurable?.run_id as string | undefined) ?? '',
             threadId: config.configurable?.thread_id as string | undefined,
             agentId: this.agentId,
@@ -2541,11 +2553,18 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
             onceReplayKey: approvalReplayKey,
             onceReplaySessionId: approvalReplaySessionId,
           }).catch((): AggregatedHookResult | undefined =>
-            approvalReviewEvidence == null
+            approvalReviewEvidence == null &&
+            !isBackgroundDenyMode(this.humanInTheLoop)
               ? undefined
               : {
                 decision: 'deny',
-                reason: 'Approval policy could not be evaluated on resume',
+                reason:
+                  isBackgroundDenyMode(this.humanInTheLoop)
+                    ? 'Approval policy could not be evaluated'
+                    : 'Approval policy could not be evaluated on resume',
+                ...(isBackgroundDenyMode(this.humanInTheLoop)
+                  ? { hasHookFailures: true }
+                  : {}),
                 additionalContexts: [],
                 injectedMessages: [],
                 errors: [],
@@ -2582,6 +2601,26 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
           };
         }
 
+        if (
+          preResult.hasHookFailures === true &&
+          isBackgroundDenyMode(this.humanInTheLoop)
+        ) {
+          return persistOutput(
+            this.blockDirectCall({
+              call,
+              resolvedArgs,
+              reason: this.backgroundApprovalReason(
+                call.name,
+                'Approval policy could not be evaluated'
+              ),
+              hookRegistry,
+              runId,
+              threadId,
+            }),
+            effectiveCall.args as Record<string, unknown>
+          );
+        }
+
         if (preResult.decision === 'deny') {
           return persistOutput(
             this.blockDirectCall({
@@ -2621,12 +2660,14 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
 
         if (preResult.decision === 'ask' || reviewedApproval != null) {
           if (this.humanInTheLoop?.enabled !== true) {
-            // Fail-closed: no HITL UI configured, so we can't actually
-            // ask. Logged once via the existing helper.
-            const reason = this.resolveAskDecisionForDirectTool(
-              preResult.reason,
-              call.name
-            );
+            // Fail closed when there is no foreground approval channel.
+            const reason =
+              isBackgroundDenyMode(this.humanInTheLoop)
+                ? this.backgroundApprovalReason(call.name, preResult.reason)
+                : this.resolveAskDecisionForDirectTool(
+                  preResult.reason,
+                  call.name
+                );
             return persistOutput(
               this.blockDirectCall({
                 call,
@@ -3008,6 +3049,13 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
    * LangGraph `interrupt()` instead — see `runDirectToolWithLifecycleHooks`.
    */
   private askDirectWarningEmitted = false;
+  private backgroundApprovalReason(toolName: string, reason?: string): string {
+    return (
+      `Approval required for "${toolName}"; unavailable in a background subagent. ` +
+      `Ask the parent to run it in the foreground.${reason == null ? '' : ` Reason: ${reason}`}`
+    );
+  }
+
   private resolveAskDecisionForDirectTool(
     reason: string | undefined,
     toolName: string
@@ -3626,7 +3674,11 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
                 matchQuery: entry.call.name,
                 onceReplayKey: approvalReplayKey,
                 onceReplaySessionId: approvalReplaySessionId,
-              }).catch((): AggregatedHookResult => HOOK_FALLBACK);
+              }).catch((): AggregatedHookResult =>
+                isBackgroundDenyMode(this.humanInTheLoop)
+                  ? { ...HOOK_FALLBACK, hasHookFailures: true }
+                  : HOOK_FALLBACK
+              );
             })
           );
 
@@ -3793,6 +3845,20 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
           batchAdditionalContexts.push(ctx);
         }
 
+        if (
+          hookResult.hasHookFailures === true &&
+          isBackgroundDenyMode(this.humanInTheLoop)
+        ) {
+          blockEntry(
+            entry,
+            this.backgroundApprovalReason(
+              entry.call.name,
+              'Approval policy could not be evaluated'
+            )
+          );
+          continue;
+        }
+
         if (hookResult.decision === 'deny') {
           blockEntry(entry, hookResult.reason ?? 'Blocked by hook');
           continue;
@@ -3810,7 +3876,15 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
            * JSDoc for the full rationale and the migration plan.
            */
           if (this.humanInTheLoop?.enabled !== true) {
-            blockEntry(entry, hookResult.reason ?? 'Blocked by hook');
+            blockEntry(
+              entry,
+              isBackgroundDenyMode(this.humanInTheLoop)
+                ? this.backgroundApprovalReason(
+                  entry.call.name,
+                  hookResult.reason
+                )
+                : (hookResult.reason ?? 'Blocked by hook')
+            );
             continue;
           }
           /**
@@ -4269,7 +4343,9 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
       const dispatchRequestById = new Map(
         dispatchRequests.map((request) => [request.id, request])
       );
+      const receivedAtById = new Map<string, number>();
       const onResult = (result: t.ToolExecuteResult): void => {
+        const receivedAt = Date.now();
         /** Runtime-honest widening: hosts may omit the id despite the
          * field type. */
         const resultToolCallId = result.toolCallId as string | undefined;
@@ -4284,8 +4360,9 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
           return;
         }
         earlyCompletionDispatchedIds.add(result.toolCallId);
+        receivedAtById.set(result.toolCallId, receivedAt);
         earlyCompletionDispatches.push(
-          this.dispatchEarlyToolCompletion(result, request, config).then(
+          this.dispatchEarlyToolCompletion({ ...result, received_at: receivedAt }, request, config).then(
             (dispatched) => {
               if (!dispatched) {
                 earlyCompletionDispatchedIds.delete(result.toolCallId);
@@ -4337,6 +4414,12 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
                   | undefined,
               signal: config.signal,
               resolve: (results): void => {
+                const receivedAt = Date.now();
+                for (const result of results) {
+                  if (dispatchRequestById.has(result.toolCallId)) {
+                    receivedAtById.set(result.toolCallId, result.received_at ?? receivedAt);
+                  }
+                }
                 resultSettled = true;
                 settledResults = results;
                 maybeResolve();
@@ -4345,6 +4428,11 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
               ...(canEmitEarlyCompletions && { onResult }),
             };
 
+            void safeDispatchCustomEvent(
+              GraphEvents.ON_TOOL_CALLS_DISPATCHED,
+              createToolCallsDispatchedEvent(config, dispatchRequests),
+              config
+            );
             void safeDispatchCustomEvent(
               GraphEvents.ON_TOOL_EXECUTE,
               batchRequest,
@@ -4630,7 +4718,8 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
             request?.turn,
             resolveToolOutcome(request?.args, outcomeFieldsFromResult(result), {
               isError: result.status === 'error',
-            })
+            }),
+            receivedAtById.get(result.toolCallId) ?? result.received_at
           );
         }
 
@@ -4932,7 +5021,8 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
     output: string,
     config: RunnableConfig,
     turn?: number,
-    outcome?: string
+    outcome?: string,
+    receivedAt?: number
   ): Promise<boolean> {
     const stepId = this.toolCallStepIds?.get(toolCallId) ?? '';
     if (!stepId) {
@@ -4959,7 +5049,7 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
             progress: 1,
             ...(outcome != null && { outcome }),
           } as t.ProcessedToolCall,
-          completed_at: Date.now(),
+          completed_at: receivedAt ?? Date.now(),
         },
       },
       config
@@ -4999,7 +5089,8 @@ export class ToolNode<T = any> extends RunnableCallable<T, T> {
       request.turn,
       resolveToolOutcome(request.args, outcomeFieldsFromResult(result), {
         isError: result.status === 'error',
-      })
+      }),
+      result.received_at
     );
   }
 

package/src/tools/handlers.ts

@@ -26,11 +26,13 @@ export async function handleToolCallChunks({
   stepKey,
   toolCallChunks,
   metadata,
+  observedAt = Date.now(),
 }: {
   graph: StandardGraph | MultiAgentGraph;
   stepKey: string;
   toolCallChunks: ToolCallChunk[];
   metadata?: Record<string, unknown>;
+  observedAt?: number;
 }): Promise<void> {
   let prevStepId: string;
   let prevRunStep: t.RunStep | undefined;
@@ -124,7 +126,8 @@ export async function handleToolCallChunks({
       type: StepTypes.TOOL_CALLS,
       tool_calls: toolCallChunks,
     },
-    metadata
+    metadata,
+    observedAt
   );
 }
 

package/src/tools/local/LocalProgrammaticToolCalling.ts

@@ -225,6 +225,15 @@ export async function applyPreToolUseHooksForBridge(
     sessionId: hookContext.runId,
     matchQuery: toolName,
   }).catch(() => undefined);
+  if (
+    hookContext.failClosedOnHookError === true &&
+    (result == null || result.hasHookFailures === true)
+  ) {
+    return {
+      input: toolInput,
+      denyReason: `Approval policy could not be evaluated for "${toolName}" in a background subagent. Ask the parent to run it in the foreground.`,
+    };
+  }
   if (result == null) {
     return { input: toolInput };
   }
@@ -236,10 +245,13 @@ export async function applyPreToolUseHooksForBridge(
     return {
       input: nextInput,
       denyReason:
-        result.reason ??
-        (result.decision === 'ask'
-          ? `Tool "${toolName}" requires human approval; bridge cannot raise an interrupt — denying.`
-          : `Tool "${toolName}" denied by PreToolUse hook.`),
+        result.decision === 'ask' &&
+        hookContext.failClosedOnHookError === true
+          ? `Approval required for "${toolName}"; unavailable in a background subagent. Ask the parent to run it in the foreground.${result.reason == null ? '' : ` Reason: ${result.reason}`}`
+          : (result.reason ??
+            (result.decision === 'ask'
+              ? `Tool "${toolName}" requires human approval; bridge cannot raise an interrupt — denying.`
+              : `Tool "${toolName}" denied by PreToolUse hook.`)),
     };
   }
   return { input: nextInput };