@librechat/agents 4.0.2 → 4.0.3

package/dist/types/protection/providerText.d.ts

@@ -0,0 +1,77 @@
+export declare const PROVIDER_TEXT_PROTECTION_VERSION = 1;
+export type ProviderTextProtectionErrorCode = 'blocked' | 'unavailable' | 'timeout' | 'overflow' | 'cancelled' | 'unsupported' | 'incompatible';
+export type ProviderTextProtectionResult = {
+    readonly version: 1;
+    readonly ok: true;
+    readonly value: {
+        readonly content: string;
+        readonly replacements: number;
+        readonly categories: readonly {
+            readonly category: string;
+            readonly count: number;
+        }[];
+    };
+} | {
+    readonly version: 1;
+    readonly ok: false;
+    readonly error: {
+        readonly code: ProviderTextProtectionErrorCode;
+    };
+};
+/** Trusted host adapter. Classification must reject code, JSON and ambiguous text. */
+export interface ProviderTextProtection {
+    readonly version: 1;
+    readonly timeoutMs: number;
+    readonly maxAttemptBytes: number;
+    /** Shared across all attempts using this policy, including child graphs. */
+    readonly maxBufferedBytes: number;
+    readonly classify: (content: string) => 'prose' | 'unsupported';
+    readonly inspect: (input: {
+        readonly version: 1;
+        readonly content: string;
+        readonly target: {
+            readonly source: 'message';
+            readonly field: 'text';
+            readonly provenance: 'model';
+        };
+        readonly signal: AbortSignal;
+    }) => ProviderTextProtectionResult | Promise<ProviderTextProtectionResult>;
+}
+export declare class ProviderTextProtectionError extends Error {
+    readonly code: ProviderTextProtectionErrorCode;
+    constructor(code: ProviderTextProtectionErrorCode);
+}
+/** Internal control flow, never a host policy decision or public capability. */
+export declare function createProviderTextRestartCancellation(): ProviderTextProtectionError;
+export declare function isProviderTextRestartCancellation(error: unknown): boolean;
+/** Provider smoothing must stay lazy while the release boundary owns raw text. */
+export declare function isProtectedProviderTextSignal(signal?: AbortSignal): boolean;
+export declare function validateProviderTextProtection(policy: ProviderTextProtection): void;
+/** A lease stays charged while a cancellation-ignoring producer/handler still owns raw text. */
+export declare class ProviderTextAttempt {
+    private readonly policy;
+    private readonly parent?;
+    private readonly controller;
+    private readonly budget;
+    private readonly deadline;
+    private bytes;
+    private textLength;
+    private readonly fragments;
+    private readonly pending;
+    private readonly timer;
+    private readonly abort;
+    private finished;
+    constructor(policy: ProviderTextProtection, parent?: AbortSignal | undefined);
+    get signal(): AbortSignal;
+    check(): void;
+    private charge;
+    append(text: string, cumulativeReplay?: boolean): void;
+    /** Compare buffered fragments without allocating an uncharged joined copy. */
+    private hasCandidatePrefix;
+    matchesText(text: string): boolean;
+    retain(bytes: number): void;
+    observeChunk(): void;
+    wait<T>(work: Promise<T>): Promise<T>;
+    release(): Promise<string>;
+    finish(): void;
+}

package/dist/types/protection/providerTextInput.d.ts

@@ -0,0 +1,3 @@
+/** Internal provenance for the SDK's pure instruction transform, not a host capability. */
+export declare function markProviderTextInput<T extends object>(input: T): T;
+export declare function isProviderTextInput(input: object): boolean;

package/dist/types/run.d.ts

@@ -21,6 +21,7 @@ export declare class Run<_T extends t.BaseGraphState> {
     private subagentUsageSink?;
     private preemption?;
     private maxStopContinuations;
+    private providerTextProtection?;
     private streamLimits?;
     private subagentTasks?;
     private subagentContext?;

package/dist/types/tools/BashExecutor.d.ts

@@ -11,6 +11,8 @@ export declare const BashExecutionToolSchema: {
             readonly properties?: Record<string, t.JsonSchemaType>;
             readonly required?: string[];
             readonly description?: string;
+            readonly pattern?: string;
+            readonly maxLength?: number;
             readonly additionalProperties?: boolean | t.JsonSchemaType;
         };
         readonly command: {
@@ -89,6 +91,8 @@ export declare const BashExecutionToolDefinition: {
                 readonly properties?: Record<string, t.JsonSchemaType>;
                 readonly required?: string[];
                 readonly description?: string;
+                readonly pattern?: string;
+                readonly maxLength?: number;
                 readonly additionalProperties?: boolean | t.JsonSchemaType;
             };
             readonly command: {

package/dist/types/tools/CodeExecutor.d.ts

@@ -23,6 +23,8 @@ export declare const CodeExecutionToolSchema: {
             readonly properties?: Record<string, t.JsonSchemaType>;
             readonly required?: string[];
             readonly description?: string;
+            readonly pattern?: string;
+            readonly maxLength?: number;
             readonly additionalProperties?: boolean | t.JsonSchemaType;
         };
         readonly lang: {
@@ -107,6 +109,8 @@ export declare const CodeExecutionToolDefinition: {
                 readonly properties?: Record<string, t.JsonSchemaType>;
                 readonly required?: string[];
                 readonly description?: string;
+                readonly pattern?: string;
+                readonly maxLength?: number;
                 readonly additionalProperties?: boolean | t.JsonSchemaType;
             };
             readonly lang: {

package/dist/types/tools/ReadFile.d.ts

@@ -11,6 +11,8 @@ export declare const ReadFileToolSchema: {
             readonly properties?: Record<string, import("..").JsonSchemaType>;
             readonly required?: string[];
             readonly description?: string;
+            readonly pattern?: string;
+            readonly maxLength?: number;
             readonly additionalProperties?: boolean | import("..").JsonSchemaType;
         };
         readonly path: {
@@ -33,6 +35,8 @@ export declare const ReadFileToolDefinition: {
                 readonly properties?: Record<string, import("..").JsonSchemaType>;
                 readonly required?: string[];
                 readonly description?: string;
+                readonly pattern?: string;
+                readonly maxLength?: number;
                 readonly additionalProperties?: boolean | import("..").JsonSchemaType;
             };
             readonly path: {

package/dist/types/tools/SkillTool.d.ts

@@ -16,6 +16,8 @@ export declare const SkillToolSchema: {
             readonly properties?: Record<string, import("..").JsonSchemaType>;
             readonly required?: string[];
             readonly description?: string;
+            readonly pattern?: string;
+            readonly maxLength?: number;
             readonly additionalProperties?: boolean | import("..").JsonSchemaType;
         };
         readonly skillName: {
@@ -42,6 +44,8 @@ export declare const SkillToolDefinition: {
                 readonly properties?: Record<string, import("..").JsonSchemaType>;
                 readonly required?: string[];
                 readonly description?: string;
+                readonly pattern?: string;
+                readonly maxLength?: number;
                 readonly additionalProperties?: boolean | import("..").JsonSchemaType;
             };
             readonly skillName: {

package/dist/types/tools/SubagentTool.d.ts

@@ -13,6 +13,8 @@ export declare const SubagentToolSchema: {
             readonly properties?: Record<string, JsonSchemaType>;
             readonly required?: string[];
             readonly description?: string;
+            readonly pattern?: string;
+            readonly maxLength?: number;
             readonly additionalProperties?: boolean | JsonSchemaType;
         };
         readonly description: {

package/dist/types/tools/ToolSearch.d.ts

@@ -13,6 +13,8 @@ export declare const ToolSearchToolSchema: {
             readonly properties?: Record<string, t.JsonSchemaType>;
             readonly required?: string[];
             readonly description?: string;
+            readonly pattern?: string;
+            readonly maxLength?: number;
             readonly additionalProperties?: boolean | t.JsonSchemaType;
         };
         readonly query: {
@@ -64,6 +66,8 @@ export declare const ToolSearchToolDefinition: {
                 readonly properties?: Record<string, t.JsonSchemaType>;
                 readonly required?: string[];
                 readonly description?: string;
+                readonly pattern?: string;
+                readonly maxLength?: number;
                 readonly additionalProperties?: boolean | t.JsonSchemaType;
             };
             readonly query: {

package/dist/types/tools/search/schema.d.ts

@@ -43,6 +43,8 @@ export declare const WebSearchToolSchema: {
             readonly properties?: Record<string, import("../..").JsonSchemaType>;
             readonly required?: string[];
             readonly description?: string;
+            readonly pattern?: string;
+            readonly maxLength?: number;
             readonly additionalProperties?: boolean | import("../..").JsonSchemaType;
         };
         readonly query: {
@@ -88,6 +90,8 @@ export declare const WebSearchToolDefinition: {
                 readonly properties?: Record<string, import("../..").JsonSchemaType>;
                 readonly required?: string[];
                 readonly description?: string;
+                readonly pattern?: string;
+                readonly maxLength?: number;
                 readonly additionalProperties?: boolean | import("../..").JsonSchemaType;
             };
             readonly query: {

package/dist/types/tools/subagent/SubagentExecutionRegistry.d.ts

@@ -44,6 +44,8 @@ export type SubagentInvocationBinding = Readonly<{
     description: string;
     subagentType: string;
     configId?: string;
+    /** Value-free identity of the call's validated host arguments. */
+    hostArgsDigest?: string;
 }>;
 export type SubagentSettlementBinding = Readonly<{
     definitionAuthority: 'provisional' | 'effective';

package/dist/types/tools/subagent/SubagentExecutor.d.ts

@@ -1,9 +1,9 @@
 import { BaseMessage } from '@langchain/core/messages';
 import type { RunnableConfig } from '@langchain/core/runnables';
 import type { ToolCall } from '@langchain/core/messages/tool';
-import type { MultiAgentGraphState, HumanInTheLoopConfig, StandardGraphInput, ExecutableSubagentConfigEntry, SubagentExecutionContext, SubagentContextAdapter, SubagentContextResult, SubagentTaskConfig, SubagentTaskRuntime, SubagentUsageSink, TokenCounter } from '@/types';
+import type { MultiAgentGraphState, HumanInTheLoopConfig, StandardGraphInput, ExecutableSubagentConfigEntry, SubagentExecutionContext, SubagentContextAdapter, SubagentContextResult, SubagentTaskConfig, SubagentTaskRuntime, SubagentHostArgs, SubagentUsageSink, TokenCounter } from '@/types';
+import type { SubagentResolutionPhase, SubagentResolutionCause, SubagentHostArgumentFailure, SubagentResolutionFailureHandler } from './diagnostics';
 import type { SubagentResumeManifest, SettledSubagentToolOutput } from './SubagentReplay';
-import type { SubagentResolutionPhase, SubagentResolutionCause, SubagentResolutionFailureHandler } from './diagnostics';
 import type { GraphFactory } from '@/graphs/graphFactory';
 import type { StandardGraph } from '@/graphs/Graph';
 import { HookRegistry } from '@/hooks';
@@ -71,6 +71,11 @@ export type SubagentExecuteParams = {
     taskRuntime?: SubagentTaskRuntime;
     /** Host-restored child transcript for a fresh continuation run. @internal */
     initialMessages?: BaseMessage[];
+    /**
+     * Values for the selected subagent's declared `hostArgs`. Checked against
+     * the declaration before an execution opens, then bound to it.
+     */
+    hostArgs?: SubagentHostArgs;
 };
 export type SubagentExecuteResult = SubagentContextResult & {
     /** Tagged internal failure; foreground callers retain the legacy content. */
@@ -79,6 +84,7 @@ export type SubagentExecuteResult = SubagentContextResult & {
     resolutionFailure?: {
         phase: SubagentResolutionPhase;
         cause: SubagentResolutionCause;
+        hostArgument?: SubagentHostArgumentFailure;
     };
     /** Completed child work whose host projection must be retried without re-execution. */
     retryableDelivery?: true;
@@ -120,6 +126,7 @@ export type SubagentExecutorOptions = {
      * graph's own resolved limits; without this the child would silently
      * revert to the defaults.
      */
+    providerTextProtection?: StandardGraphInput['providerTextProtection'];
     streamLimits?: StandardGraphInput['streamLimits'];
     humanInTheLoop?: HumanInTheLoopConfig;
     /** Shared durable saver used to recover outer tool lifecycle results before
@@ -187,6 +194,7 @@ export declare class SubagentExecutor {
     private readonly executionContext;
     private readonly langfuse?;
     private readonly tokenCounter?;
+    private readonly providerTextProtection?;
     private readonly streamLimits?;
     private readonly humanInTheLoop?;
     private readonly checkpointer?;

package/dist/types/tools/subagent/SubagentReplay.d.ts

@@ -1,8 +1,8 @@
 import type { ToolCall, ToolMessage } from '@langchain/core/messages/tool';
 import type { RunnableConfig } from '@langchain/core/runnables';
+import type { FadingTier, FadingTiers, RunStepResumeState, ToolSessionContext } from '@/types';
 import type { ToolOutputReferenceState } from '@/tools/toolOutputReferences';
 import type { ToolApprovalReplaySnapshot } from '@/hooks';
-import type { FadingTier, FadingTiers, RunStepResumeState, ToolSessionContext } from '@/types';
 export declare const SUBAGENT_RESUME_MANIFEST_CONFIG_KEY = "__librechat_subagent_resume_manifest";
 export declare const SUBAGENT_RESUME_ATTEMPT_CONFIG_KEY = "__librechat_subagent_resume_attempt";
 export declare const SUBAGENT_PARENT_BATCH_CONFIG_KEY = "__librechat_subagent_parent_batch";
@@ -56,6 +56,8 @@ export interface SubagentResumeExecution {
     subagentType?: string;
     /** Lazy child revision bound when this execution first resolved. */
     configId?: string;
+    /** SHA-256 identity of the host arguments bound to this execution; never the values. */
+    hostArgsDigest?: string;
     approvalExecutionScope: string;
     checkpoints: SubagentCheckpointReference[];
     graphState: SubagentGraphResumeState;

package/dist/types/tools/subagent/diagnostics.d.ts

@@ -1,14 +1,33 @@
+import type { SubagentHostArgs } from '@/types/graph';
 import { SubagentSettlementBindingError, SubagentDefinitionBindingError, SubagentInvocationBindingError, SubagentExecutionInvalidatedError } from './SubagentExecutionRegistry';
 import { describeCodeApiError } from '@/tools/diagnostics';
 /** Which step of child start-up failed: execution identity, then host config resolution. */
 export type SubagentResolutionPhase = 'identity' | 'config';
-declare const SUBAGENT_ERROR_TYPES: readonly [readonly ["SubagentExecutionInvalidatedError", typeof SubagentExecutionInvalidatedError], readonly ["SubagentDefinitionBindingError", typeof SubagentDefinitionBindingError], readonly ["SubagentInvocationBindingError", typeof SubagentInvocationBindingError], readonly ["SubagentSettlementBindingError", typeof SubagentSettlementBindingError]];
+/** Why a host resolver refused a declared host argument value. */
+export type SubagentHostArgumentRejection = 'unavailable' | 'not_allowed';
+/**
+ * Thrown by a lazy resolver to refuse one declared host argument value. The
+ * parent model receives a fixed message naming the argument; the value and
+ * any error text stay private.
+ */
+export declare class SubagentHostArgumentError extends Error {
+    readonly argument: string;
+    readonly rejection: SubagentHostArgumentRejection;
+    constructor(argument: string, rejection: SubagentHostArgumentRejection);
+}
+/** Safe host-argument refusal retained across the detached delivery boundary. */
+export type SubagentHostArgumentFailure = {
+    argument: string;
+    rejection: SubagentHostArgumentRejection;
+};
+declare const SUBAGENT_ERROR_TYPES: readonly [readonly ["SubagentHostArgumentError", typeof SubagentHostArgumentError], readonly ["SubagentExecutionInvalidatedError", typeof SubagentExecutionInvalidatedError], readonly ["SubagentDefinitionBindingError", typeof SubagentDefinitionBindingError], readonly ["SubagentInvocationBindingError", typeof SubagentInvocationBindingError], readonly ["SubagentSettlementBindingError", typeof SubagentSettlementBindingError]];
 type SubagentErrorLabel = (typeof SUBAGENT_ERROR_TYPES)[number][0] | ReturnType<typeof describeCodeApiError>['type'];
 declare const SUBAGENT_RESOLUTION_MESSAGES: {
     readonly workspace_unavailable: "Subagent error: Workspace unavailable. Retry later or choose another workspace.";
     readonly agent_unavailable: "Subagent error: Agent not found or not accessible.";
     readonly model_unavailable: "Subagent error: Model or provider unavailable.";
     readonly configuration_changed: "Subagent error: Subagent configuration changed. Start a new execution.";
+    readonly host_argument_rejected: "Subagent error: A requested subagent argument is not available. Omit it to let the host choose, or pass a different value.";
     readonly unknown: "Subagent error: Unable to initialize the selected subagent.";
 };
 /** Host classifications accepted at the public failure boundary. */
@@ -34,11 +53,16 @@ export type SubagentResolutionDiagnostic = {
 /** The original error is private. Return a classification, never error text. */
 export type SubagentResolutionFailureHandler = (detail: Readonly<SubagentResolutionDiagnostic>, error: unknown) => SubagentResolutionCause | void;
 export declare function getSubagentResolutionFailureMessage(cause: SubagentResolutionCause): SubagentResolutionDiagnostic['message'];
+/** Returns a resolver's typed host-argument refusal when its name is safe to show. */
+export declare function getSubagentHostArgumentFailure(error: unknown, suppliedHostArgs: SubagentHostArgs | undefined): SubagentHostArgumentFailure | undefined;
+/** Model-facing message for a refused host argument. */
+export declare function getSubagentHostArgumentFailureMessage(failure: SubagentHostArgumentFailure): string;
 /** Safe typed failure retained when detached execution crosses the host boundary. */
 export declare class SubagentResolutionError extends Error {
     readonly phase: SubagentResolutionPhase;
     readonly resolutionCause: SubagentResolutionCause;
-    constructor(phase: SubagentResolutionPhase, cause: SubagentResolutionCause);
+    readonly hostArgument?: SubagentHostArgumentFailure;
+    constructor(phase: SubagentResolutionPhase, cause: SubagentResolutionCause, hostArgument?: SubagentHostArgumentFailure);
 }
-export declare function logSubagentResolutionFailure(phase: SubagentResolutionPhase, subagentType: string, signal: AbortSignal, error: unknown, context?: SubagentResolutionContext, onResolutionFailure?: SubagentResolutionFailureHandler): SubagentResolutionDiagnostic;
+export declare function logSubagentResolutionFailure(phase: SubagentResolutionPhase, subagentType: string, signal: AbortSignal, error: unknown, context?: SubagentResolutionContext, onResolutionFailure?: SubagentResolutionFailureHandler, suppliedHostArgs?: SubagentHostArgs): SubagentResolutionDiagnostic;
 export {};

package/dist/types/tools/subagent/hostArgs.d.ts

@@ -0,0 +1,57 @@
+import type { SubagentHostArgs, SubagentHostArgSpec, SubagentHostArgSpecs } from '@/types/graph';
+import type { JsonSchemaType } from '@/types/tools';
+/** Bounds on host-declared subagent call arguments and their values. */
+export declare const SUBAGENT_HOST_ARG_LIMITS: Readonly<{
+    argsPerSubagent: 8;
+    distinctArgs: 16;
+    enumValues: 64;
+    mergedEnumValues: 256;
+    valueLength: 256;
+    descriptionLength: 1024;
+}>;
+/** Any subagent entry that may declare host arguments. */
+export type SubagentHostArgDeclaration = {
+    type: string;
+    hostArgs?: SubagentHostArgSpecs;
+};
+export type SubagentHostArgsResult = {
+    ok: true;
+    hostArgs?: SubagentHostArgs;
+} | {
+    ok: false;
+    message: string;
+};
+type HostArgEntry = readonly [string, SubagentHostArgSpec];
+/** A name a host may declare: lowercase snake case, not a built-in subagent argument. */
+export declare function isSubagentHostArgName(name: string): boolean;
+/**
+ * Returns a subagent's validated host argument declarations in declaration
+ * order. Throws on a malformed or oversized declaration.
+ */
+export declare function getSubagentHostArgSpecs(config: SubagentHostArgDeclaration): readonly HostArgEntry[];
+/** Every host argument name declared by at least one subagent. */
+export declare function collectSubagentHostArgNames(configs: readonly SubagentHostArgDeclaration[]): ReadonlySet<string>;
+/**
+ * Builds one optional tool property per declared host argument plus a
+ * per-type summary of the values each subagent accepts. The first
+ * declaration's description wins; enums are unioned across subagents.
+ */
+export declare function buildSubagentHostArgProperties(configs: readonly SubagentHostArgDeclaration[]): {
+    properties: Record<string, JsonSchemaType>;
+    summaries: ReadonlyMap<string, string>;
+};
+/**
+ * Reads the declared host argument properties from raw tool input. Missing,
+ * null, and blank values count as omitted; other non-string values are
+ * rejected rather than coerced.
+ */
+export declare function pickSubagentHostArgInput(input: object, names: ReadonlySet<string>): SubagentHostArgsResult;
+/**
+ * Checks call values against the selected subagent's declarations and
+ * returns them frozen in canonical key order. Rejects arguments the selected
+ * subagent does not declare, including ones declared by a sibling.
+ */
+export declare function resolveSubagentHostArgs(config: SubagentHostArgDeclaration, hostArgs: SubagentHostArgs | undefined): SubagentHostArgsResult;
+/** Opaque, value-free identity of a call's host arguments for replay records. */
+export declare function getSubagentHostArgsDigest(hostArgs: SubagentHostArgs | undefined): string | undefined;
+export {};

package/dist/types/tools/subagent/index.d.ts

@@ -2,5 +2,6 @@ export { DEFAULT_SUBAGENT_DESCRIPTION, SubagentExecutor, filterSubagentResult, f
 export type { SubagentExecuteParams, SubagentExecuteResult, SubagentExecutorOptions, ChildGraphFactory, } from './SubagentExecutor';
 export { InMemorySubagentTaskStore } from './InMemorySubagentTaskStore';
 export type { InMemorySubagentTaskStoreOptions } from './InMemorySubagentTaskStore';
-export { SubagentResolutionError, getSubagentResolutionFailureMessage, } from './diagnostics';
-export type { SubagentResolutionPhase, SubagentResolutionCause, SubagentResolutionContext, SubagentResolutionDiagnostic, SubagentResolutionFailureHandler, } from './diagnostics';
+export { SubagentResolutionError, SubagentHostArgumentError, getSubagentResolutionFailureMessage, getSubagentHostArgumentFailureMessage, } from './diagnostics';
+export { SUBAGENT_HOST_ARG_LIMITS, buildSubagentHostArgProperties, resolveSubagentHostArgs, } from './hostArgs';
+export type { SubagentHostArgumentFailure, SubagentHostArgumentRejection, SubagentResolutionPhase, SubagentResolutionCause, SubagentResolutionContext, SubagentResolutionDiagnostic, SubagentResolutionFailureHandler, } from './diagnostics';

package/dist/types/types/graph.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderTextProtection } from '@/protection/providerText';
 import type { BaseMessage, AIMessageChunk, SystemMessage, UsageMetadata } from '@langchain/core/messages';
 import type { BindToolsInput } from '@langchain/core/language_models/chat_models';
 import type { START, StateGraph, StateGraphArgs } from '@langchain/langgraph';
@@ -287,6 +288,7 @@ export type ModelEndData = (StreamEventData & {
 }) | undefined;
 export type GraphTools = GenericTool[] | BindToolsInput[] | GoogleAIToolType[];
 export type StandardGraphInput = {
+    providerTextProtection?: ProviderTextProtection;
     runId?: string;
     signal?: AbortSignal;
     agents: AgentInputs[];
@@ -436,6 +438,26 @@ export interface SubagentResolveConfigurable {
     user?: Readonly<SubagentResolveUserContext>;
     user_id?: string;
 }
+/**
+ * Optional string argument a host lets the parent model pass on a subagent
+ * call, such as where the child should run. The SDK checks the declared shape
+ * before resolution; the host still authorizes the value in its resolver.
+ */
+export interface SubagentHostArgSpec {
+    /** Model-facing explanation of the argument and when to pass it. */
+    description: string;
+    /**
+     * Values this subagent accepts. Omit to accept a bounded free-form string,
+     * whose format the resolver must check.
+     */
+    enum?: readonly string[];
+    /** Maximum length of a free-form value (at most 256). */
+    maxLength?: number;
+}
+/** Host argument declarations keyed by tool-call property name. */
+export type SubagentHostArgSpecs = Readonly<Record<string, SubagentHostArgSpec>>;
+/** Validated host argument values from one subagent call. */
+export type SubagentHostArgs = Readonly<Record<string, string>>;
 /** Runtime context supplied when a host lazily resolves a selected subagent. */
 export interface SubagentResolveContext {
     /** Stable subagent identity selected by the model. */
@@ -454,6 +476,13 @@ export interface SubagentResolveContext {
     signal: AbortSignal;
     /** Stable, sanitized host context from the parent tool invocation. */
     configurable?: Readonly<SubagentResolveConfigurable>;
+    /**
+     * Values the parent passed for this subagent's declared `hostArgs`, already
+     * checked against the declaration. Omitted when the call passed none. Bound
+     * to the execution: a reconstruction with different values is rejected
+     * before the resolver runs.
+     */
+    hostArgs?: SubagentHostArgs;
 }
 /** Host contract for resolving a selected subagent's full graph inputs. */
 export type SubagentAgentInputsResolver = (context: SubagentResolveContext) => Promise<AgentInputs>;
@@ -480,6 +509,12 @@ export interface SubagentConfig extends SubagentConfigBase {
      * `(context.executionId, context.descriptor.configId)`.
      */
     resolveAgentInputs?: SubagentAgentInputsResolver;
+    /**
+     * Optional per-call arguments the parent model may pass for this subagent,
+     * delivered to `resolveAgentInputs` as `context.hostArgs`. Only lazy
+     * configs accept them. Declaring none leaves the tool schema unchanged.
+     */
+    hostArgs?: SubagentHostArgSpecs;
     /** When true, reuse the parent's AgentInputs (context isolation without separate config). */
     self?: boolean;
 }
@@ -494,6 +529,7 @@ export interface GraphSubagentConfig extends SubagentConfigBase {
     kind: 'graph';
     configId?: never;
     resolveAgentInputs?: never;
+    hostArgs?: never;
     allowNested?: false;
     agents: AgentInputs[];
     /**

package/dist/types/types/run.d.ts

@@ -24,8 +24,9 @@ export type LegacyGraphConfig = BaseGraphConfig & {
 } & Omit<g.StandardGraphInput, 
 /** `streamLimits` is excluded because legacy graphs receive limits only
  * via the top-level `RunConfig.streamLimits`; accepting the field here
- * would type-check but be silently ignored by `createLegacyGraph`. */
-'provider' | 'clientOptions' | 'agents' | 'streamLimits'> & Omit<g.AgentInputs, 'provider' | 'clientOptions' | 'agentId'>;
+ * would type-check but be silently ignored by `createLegacyGraph`.
+ * Required provider-text protection also belongs only to RunConfig. */
+'provider' | 'clientOptions' | 'agents' | 'streamLimits' | 'providerTextProtection'> & Omit<g.AgentInputs, 'provider' | 'clientOptions' | 'agentId'>;
 export type SupervisedGraphConfig = BaseGraphConfig & {
     type: 'supervised';
     /** Enable supervised router; when false, fall back to standard loop */
@@ -317,6 +318,7 @@ export type RunConfig = {
      * tool-call argument byte cap is ON by default, the per-turn event cap is
      * opt-in. See {@link StreamLimits}.
      */
+    providerTextProtection?: g.StandardGraphInput['providerTextProtection'];
     streamLimits?: StreamLimits;
     returnContent?: boolean;
     tokenCounter?: TokenCounter;

package/dist/types/types/tools.d.ts

@@ -502,6 +502,8 @@ export type JsonSchemaType = {
     properties?: Record<string, JsonSchemaType>;
     required?: string[];
     description?: string;
+    pattern?: string;
+    maxLength?: number;
     additionalProperties?: boolean | JsonSchemaType;
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@librechat/agents",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "reova": {
     "enabled": true,
     "endpoint": "https://telemetry.reo.dev/data"
@@ -329,7 +329,7 @@
     "uuid": "^11.1.1"
   },
   "peerDependencies": {
-    "@anthropic-ai/sandbox-runtime": "^0.0.67"
+    "@anthropic-ai/sandbox-runtime": "^0.0.78"
   },
   "peerDependenciesMeta": {
     "@anthropic-ai/sandbox-runtime": {
@@ -337,7 +337,7 @@
     }
   },
   "devDependencies": {
-    "@anthropic-ai/sandbox-runtime": "^0.0.67",
+    "@anthropic-ai/sandbox-runtime": "0.0.78",
     "@anthropic-ai/vertex-sdk": "^0.12.0",
     "@eslint/js": "^10.0.1",
     "@langchain/langgraph-checkpoint-mongodb": "^1.4.1",
@@ -360,7 +360,7 @@
     "mongodb-memory-server-core": "^11.2.0",
     "prettier": "^3.6.2",
     "ts-jest": "^29.4.12",
-    "tsc-alias": "^1.8.10",
+    "tsc-alias": "^1.9.7",
     "tsdown": "^0.22.2",
     "tslib": "^2.6.3",
     "tsx": "^4.23.12",

package/src/agents/AgentContext.ts

@@ -58,6 +58,7 @@ import {
 import { isTokenCounterCacheCompatible } from '@/llm/tokenCounterCacheCompatibility';
 import { snapshotCompactionSemanticIndex } from '@/summarization/semanticIndex';
 import { createExactTokenCountCache } from '@/llm/contextPressureMeter';
+import { markProviderTextInput } from '@/protection/providerTextInput';
 import { buildSummaryCarrierText } from '@/summarization/shared';
 import { createSchemaOnlyTools } from '@/tools/schema';
 import { apportionTokenCounts } from '@/utils/tokens';
@@ -960,7 +961,7 @@ export class AgentContext {
         : 0;
     }
 
-    return RunnableLambda.from((messages: BaseMessage[]) => {
+    return markProviderTextInput(RunnableLambda.from((messages: BaseMessage[]) => {
       const prefix: BaseMessage[] = systemMessage ? [systemMessage] : [];
 
       // Build the non-system portion (summary + conversation), then apply
@@ -998,7 +999,7 @@ export class AgentContext {
         );
       }
       return [...prefix, ...body];
-    }).withConfig({ runName: 'prompt' });
+    })).withConfig({ runName: 'prompt' });
   }
 
   private buildSummaryHumanMessage(

package/src/decisions/structuredChat.ts

@@ -6,7 +6,9 @@ import type {
   DecisionResult,
   DecisionRequest,
 } from './types';
+import type { DecisionOutputMethod } from './structuredOutput';
 import { DecisionError, isDecisionObject, readDecisionUsage } from './types';
+import { withDecisionStructuredOutput } from './structuredOutput';
 import { failureForStatus, retryAfterMs } from './transport';
 import { validateDecisionQuestions } from './questions';
 import { DECISION_PROMPT_PREFIX } from './traceMarker';
@@ -86,8 +88,8 @@ export interface StructuredChatDecisionModelOptions {
   model: BaseChatModel;
   modelId: string;
   providerId?: string;
-  /** Verified OpenAI strict modes or Anthropic strict tool calling; other adapters fail closed. */
-  method: 'jsonSchema' | 'functionCalling';
+  /** Verified OpenAI/Azure strict modes or Anthropic strict tools; other paths fail closed. */
+  method: DecisionOutputMethod;
   timeoutMs?: number;
   maxQuestions?: number;
   onAnswered?: (label: string, ms: number) => void;
@@ -299,19 +301,11 @@ export function createStructuredChatDecisionModel(
           }
           let structured: ReturnType<typeof model.withStructuredOutput>;
           try {
-            const adapter = model._llmType();
-            if (
-              adapter !== 'openai' &&
-              (adapter !== 'anthropic' || method !== 'functionCalling')
-            ) {
-              throw new Error('unverified strict decision model adapter');
-            }
-            structured = model.withStructuredOutput(decisionSchema(entries), {
-              name: 'DecideQuestions',
-              method,
-              strict: true,
-              includeRaw: true,
-            });
+            structured = withDecisionStructuredOutput(
+              model,
+              decisionSchema(entries),
+              method
+            );
           } catch {
             throw new DecisionError(
               'unsupported_mode',