deepagents 0.2.1rc1__tar.gz → 0.2.1rc2__tar.gz

{deepagents-0.2.1rc1/src/deepagents.egg-info → deepagents-0.2.1rc2}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: deepagents
-Version: 0.2.1rc1
+Version: 0.2.1rc2
 Summary: General purpose 'deep agent' with sub-agent spawning, todo list capabilities, and mock file system. Built on LangGraph.
 License: MIT
 Requires-Python: <4.0,>=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: langchain-anthropic<2.0.0,>=1.0.0
-Requires-Dist: langchain<2.0.0,>=1.0.0
+Requires-Dist: langchain<2.0.0,>=1.0.2
 Requires-Dist: langchain-core<2.0.0,>=1.0.0
 Requires-Dist: wcmatch
 Provides-Extra: dev

{deepagents-0.2.1rc1 → deepagents-0.2.1rc2}/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "deepagents"
-version = "0.2.1rc1"
+version = "0.2.1rc2"
 description = "General purpose 'deep agent' with sub-agent spawning, todo list capabilities, and mock file system. Built on LangGraph."
 readme = "README.md"
 license = { text = "MIT" }
 requires-python = ">=3.11,<4.0"
 dependencies = [
     "langchain-anthropic>=1.0.0,<2.0.0",
-    "langchain>=1.0.0,<2.0.0",
+    "langchain>=1.0.2,<2.0.0",
     "langchain-core>=1.0.0,<2.0.0",
     "wcmatch"
 ]

{deepagents-0.2.1rc1 → deepagents-0.2.1rc2}/src/deepagents/backends/utils.py

@@ -37,6 +37,15 @@ class GrepMatch(TypedDict):
     text: str
 
 
+def sanitize_tool_call_id(tool_call_id: str) -> str:
+    """Sanitize tool_call_id to prevent path traversal and separator issues. 
+    
+    Replaces dangerous characters (., /, \) with underscores.
+    """
+    sanitized = tool_call_id.replace(".", "_").replace("/", "_").replace("\\", "_")
+    return sanitized
+
+
 def format_content_with_line_numbers(
     content: str | list[str],
     start_line: int = 1,

{deepagents-0.2.1rc1 → deepagents-0.2.1rc2}/src/deepagents/middleware/filesystem.py

@@ -24,11 +24,11 @@ from typing_extensions import TypedDict
 from deepagents.backends.protocol import BackendProtocol, BackendFactory, WriteResult, EditResult
 from deepagents.backends import StateBackend
 from deepagents.backends.utils import (
-    create_file_data,
     update_file_data,
     format_content_with_line_numbers,
     format_grep_matches,
     truncate_if_too_long,
+    sanitize_tool_call_id,
 )
 
 EMPTY_CONTENT_WARNING = "System reminder: File exists but has empty contents"
@@ -227,6 +227,15 @@ All file paths must start with a /.
 
 
 def _get_backend(backend: BACKEND_TYPES, runtime: ToolRuntime) -> BackendProtocol:
+    """Get the resolved backend instance from backend or factory.
+
+    Args:
+        backend: Backend instance or factory function.
+        runtime: The tool runtime context.
+
+    Returns:
+        Resolved backend instance.
+    """
     if callable(backend):
         return backend(runtime)
     return backend
@@ -532,6 +541,19 @@ class FilesystemMiddleware(AgentMiddleware):
 
         self.tools = _get_filesystem_tools(self.backend, custom_tool_descriptions)
 
+    def _get_backend(self, runtime: ToolRuntime) -> BackendProtocol:
+        """Get the resolved backend instance from backend or factory.
+
+        Args:
+            runtime: The tool runtime context.
+
+        Returns:
+            Resolved backend instance.
+        """
+        if callable(self.backend):
+            return self.backend(runtime)
+        return self.backend
+
     def wrap_model_call(
         self,
         request: ModelRequest,
@@ -568,54 +590,70 @@ class FilesystemMiddleware(AgentMiddleware):
             request.system_prompt = request.system_prompt + "\n\n" + self.system_prompt if request.system_prompt else self.system_prompt
         return await handler(request)
 
-    def _intercept_large_tool_result(self, tool_result: ToolMessage | Command) -> ToolMessage | Command:
+    def _process_large_message(
+        self,
+        message: ToolMessage,
+        resolved_backend: BackendProtocol,
+    ) -> tuple[ToolMessage, dict[str, FileData] | None]:
+        content = message.content
+        if not isinstance(content, str) or len(content) <= 4 * self.tool_token_limit_before_evict:
+            return message, None
+
+        sanitized_id = sanitize_tool_call_id(message.tool_call_id)
+        file_path = f"/large_tool_results/{sanitized_id}"
+        result = resolved_backend.write(file_path, content)
+        if result.error:
+            return message, None
+        content_sample = format_content_with_line_numbers(content.splitlines()[:10], start_line=1)
+        processed_message = ToolMessage(
+            TOO_LARGE_TOOL_MSG.format(
+                tool_call_id=message.tool_call_id,
+                file_path=file_path,
+                content_sample=content_sample,
+            ),
+            tool_call_id=message.tool_call_id,
+        )
+        return processed_message, result.files_update
+
+    def _intercept_large_tool_result(self, tool_result: ToolMessage | Command, runtime: ToolRuntime) -> ToolMessage | Command:
         if isinstance(tool_result, ToolMessage) and isinstance(tool_result.content, str):
-            content = tool_result.content
-            if self.tool_token_limit_before_evict and len(content) > 4 * self.tool_token_limit_before_evict:
-                file_path = f"/large_tool_results/{tool_result.tool_call_id}"
-                file_data = create_file_data(content)
-                state_update = {
-                    "messages": [
-                        ToolMessage(
-                            TOO_LARGE_TOOL_MSG.format(
-                                tool_call_id=tool_result.tool_call_id,
-                                file_path=file_path,
-                                content_sample=format_content_with_line_numbers(file_data["content"][:10], start_line=1),
-                            ),
-                            tool_call_id=tool_result.tool_call_id,
-                        )
-                    ],
-                    "files": {file_path: file_data},
-                }
-                return Command(update=state_update)
+            if not (self.tool_token_limit_before_evict and
+                    len(tool_result.content) > 4 * self.tool_token_limit_before_evict):
+                return tool_result
+            resolved_backend = self._get_backend(runtime)
+            processed_message, files_update = self._process_large_message(
+                tool_result,
+                resolved_backend,
+            )
+            return (Command(update={
+                "files": files_update,
+                "messages": [processed_message],
+            }) if files_update is not None else processed_message)
+
         elif isinstance(tool_result, Command):
             update = tool_result.update
             if update is None:
                 return tool_result
-            message_updates = update.get("messages", [])
-            file_updates = update.get("files", {})
-
-            edited_message_updates = []
-            for message in message_updates:
-                if self.tool_token_limit_before_evict and isinstance(message, ToolMessage) and isinstance(message.content, str):
-                    content = message.content
-                    if len(content) > 4 * self.tool_token_limit_before_evict:
-                        file_path = f"/large_tool_results/{message.tool_call_id}"
-                        file_data = create_file_data(content)
-                        edited_message_updates.append(
-                            ToolMessage(
-                                TOO_LARGE_TOOL_MSG.format(
-                                    tool_call_id=message.tool_call_id,
-                                    file_path=file_path,
-                                    content_sample=format_content_with_line_numbers(file_data["content"][:10], start_line=1),
-                                ),
-                                tool_call_id=message.tool_call_id,
-                            )
-                        )
-                        file_updates[file_path] = file_data
-                        continue
-                edited_message_updates.append(message)
-            return Command(update={**update, "messages": edited_message_updates, "files": file_updates})
+            command_messages = update.get("messages", [])
+            accumulated_file_updates = dict(update.get("files", {}))
+            resolved_backend = self._get_backend(runtime)
+            processed_messages = []
+            for message in command_messages:
+                if not (self.tool_token_limit_before_evict and
+                        isinstance(message, ToolMessage) and
+                        isinstance(message.content, str) and
+                        len(message.content) > 4 * self.tool_token_limit_before_evict):
+                    processed_messages.append(message)
+                    continue
+                processed_message, files_update = self._process_large_message(
+                    message,
+                    resolved_backend,
+                )
+                processed_messages.append(processed_message)
+                if files_update is not None:
+                    accumulated_file_updates.update(files_update)
+            return Command(update={**update, "messages": processed_messages, "files": accumulated_file_updates})
+
         return tool_result
 
     def wrap_tool_call(
@@ -636,7 +674,7 @@ class FilesystemMiddleware(AgentMiddleware):
             return handler(request)
 
         tool_result = handler(request)
-        return self._intercept_large_tool_result(tool_result)
+        return self._intercept_large_tool_result(tool_result, request.runtime)
 
     async def awrap_tool_call(
         self,
@@ -656,4 +694,4 @@ class FilesystemMiddleware(AgentMiddleware):
             return await handler(request)
 
         tool_result = await handler(request)
-        return self._intercept_large_tool_result(tool_result)
+        return self._intercept_large_tool_result(tool_result, request.runtime)

{deepagents-0.2.1rc1 → deepagents-0.2.1rc2}/src/deepagents/middleware/patch_tool_calls.py

@@ -3,9 +3,9 @@
 from typing import Any
 
 from langchain.agents.middleware import AgentMiddleware, AgentState
-from langchain_core.messages import RemoveMessage, ToolMessage
-from langgraph.graph.message import REMOVE_ALL_MESSAGES
+from langchain_core.messages import ToolMessage
 from langgraph.runtime import Runtime
+from langgraph.types import Overwrite
 
 
 class PatchToolCallsMiddleware(AgentMiddleware):
@@ -41,4 +41,4 @@ class PatchToolCallsMiddleware(AgentMiddleware):
                             )
                         )
 
-        return {"messages": [RemoveMessage(id=REMOVE_ALL_MESSAGES), *patched_messages]}
+        return {"messages": Overwrite(patched_messages)}

{deepagents-0.2.1rc1 → deepagents-0.2.1rc2/src/deepagents.egg-info}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: deepagents
-Version: 0.2.1rc1
+Version: 0.2.1rc2
 Summary: General purpose 'deep agent' with sub-agent spawning, todo list capabilities, and mock file system. Built on LangGraph.
 License: MIT
 Requires-Python: <4.0,>=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: langchain-anthropic<2.0.0,>=1.0.0
-Requires-Dist: langchain<2.0.0,>=1.0.0
+Requires-Dist: langchain<2.0.0,>=1.0.2
 Requires-Dist: langchain-core<2.0.0,>=1.0.0
 Requires-Dist: wcmatch
 Provides-Extra: dev

{deepagents-0.2.1rc1 → deepagents-0.2.1rc2}/src/deepagents.egg-info/requires.txt

@@ -1,5 +1,5 @@
 langchain-anthropic<2.0.0,>=1.0.0
-langchain<2.0.0,>=1.0.0
+langchain<2.0.0,>=1.0.2
 langchain-core<2.0.0,>=1.0.0
 wcmatch
 

{deepagents-0.2.1rc1 → deepagents-0.2.1rc2}/tests/test_middleware.py

@@ -8,7 +8,7 @@ from langchain_core.messages import (
     ToolCall,
     ToolMessage,
 )
-from langgraph.graph.message import add_messages
+from langgraph.types import Overwrite
 from langgraph.store.memory import InMemoryStore
 
 from deepagents.middleware.filesystem import (
@@ -824,6 +824,113 @@ class TestFilesystemMiddleware:
         assert lines[1].count("m") == 2000
         assert "     4\tline4" in lines[2]
 
+    def test_intercept_short_toolmessage(self):
+        """Test that small ToolMessages pass through unchanged."""
+        middleware = FilesystemMiddleware(tool_token_limit_before_evict=1000)
+        state = FilesystemState(messages=[], files={})
+        runtime = ToolRuntime(state=state, context=None, tool_call_id="test_123", store=None, stream_writer=lambda _: None, config={})
+
+        small_content = "x" * 1000
+        tool_message = ToolMessage(content=small_content, tool_call_id="test_123")
+        result = middleware._intercept_large_tool_result(tool_message, runtime)
+
+        assert result == tool_message
+
+    def test_intercept_long_toolmessage(self):
+        """Test that large ToolMessages are intercepted and saved to filesystem."""
+        from langgraph.types import Command
+
+        middleware = FilesystemMiddleware(tool_token_limit_before_evict=1000)
+        state = FilesystemState(messages=[], files={})
+        runtime = ToolRuntime(state=state, context=None, tool_call_id="test_123", store=None, stream_writer=lambda _: None, config={})
+
+        large_content = "x" * 5000
+        tool_message = ToolMessage(content=large_content, tool_call_id="test_123")
+        result = middleware._intercept_large_tool_result(tool_message, runtime)
+
+        assert isinstance(result, Command)
+        assert "/large_tool_results/test_123" in result.update["files"]
+        assert "Tool result too large" in result.update["messages"][0].content
+
+    def test_intercept_command_with_short_toolmessage(self):
+        """Test that Commands with small messages pass through unchanged."""
+        from langgraph.types import Command
+
+        middleware = FilesystemMiddleware(tool_token_limit_before_evict=1000)
+        state = FilesystemState(messages=[], files={})
+        runtime = ToolRuntime(state=state, context=None, tool_call_id="test_123", store=None, stream_writer=lambda _: None, config={})
+
+        small_content = "x" * 1000
+        tool_message = ToolMessage(content=small_content, tool_call_id="test_123")
+        command = Command(update={"messages": [tool_message], "files": {}})
+        result = middleware._intercept_large_tool_result(command, runtime)
+
+        assert isinstance(result, Command)
+        assert result.update["messages"][0].content == small_content
+
+    def test_intercept_command_with_long_toolmessage(self):
+        """Test that Commands with large messages are intercepted."""
+        from langgraph.types import Command
+
+        middleware = FilesystemMiddleware(tool_token_limit_before_evict=1000)
+        state = FilesystemState(messages=[], files={})
+        runtime = ToolRuntime(state=state, context=None, tool_call_id="test_123", store=None, stream_writer=lambda _: None, config={})
+
+        large_content = "y" * 5000
+        tool_message = ToolMessage(content=large_content, tool_call_id="test_123")
+        command = Command(update={"messages": [tool_message], "files": {}})
+        result = middleware._intercept_large_tool_result(command, runtime)
+
+        assert isinstance(result, Command)
+        assert "/large_tool_results/test_123" in result.update["files"]
+        assert "Tool result too large" in result.update["messages"][0].content
+
+    def test_intercept_command_with_files_and_long_toolmessage(self):
+        """Test that file updates are properly merged with existing files and other keys preserved."""
+        from langgraph.types import Command
+
+        middleware = FilesystemMiddleware(tool_token_limit_before_evict=1000)
+        state = FilesystemState(messages=[], files={})
+        runtime = ToolRuntime(state=state, context=None, tool_call_id="test_123", store=None, stream_writer=lambda _: None, config={})
+
+        large_content = "z" * 5000
+        tool_message = ToolMessage(content=large_content, tool_call_id="test_123")
+        existing_file = FileData(content=["existing"], created_at="2021-01-01", modified_at="2021-01-01")
+        command = Command(update={
+            "messages": [tool_message],
+            "files": {"/existing.txt": existing_file},
+            "custom_key": "custom_value"
+        })
+        result = middleware._intercept_large_tool_result(command, runtime)
+
+        assert isinstance(result, Command)
+        assert "/existing.txt" in result.update["files"]
+        assert "/large_tool_results/test_123" in result.update["files"]
+        assert result.update["custom_key"] == "custom_value"
+
+    def test_sanitize_tool_call_id(self):
+        """Test that tool_call_id is sanitized to prevent path traversal."""
+        from deepagents.backends.utils import sanitize_tool_call_id
+
+        assert sanitize_tool_call_id("call_123") == "call_123"
+        assert sanitize_tool_call_id("call/123") == "call_123"
+        assert sanitize_tool_call_id("test.id") == "test_id"
+
+    def test_intercept_sanitizes_tool_call_id(self):
+        """Test that tool_call_id with dangerous characters is sanitized in file path."""
+        from langgraph.types import Command
+
+        middleware = FilesystemMiddleware(tool_token_limit_before_evict=1000)
+        state = FilesystemState(messages=[], files={})
+        runtime = ToolRuntime(state=state, context=None, tool_call_id="test_123", store=None, stream_writer=lambda _: None, config={})
+
+        large_content = "x" * 5000
+        tool_message = ToolMessage(content=large_content, tool_call_id="test/call.id")
+        result = middleware._intercept_large_tool_result(tool_message, runtime)
+
+        assert isinstance(result, Command)
+        assert "/large_tool_results/test_call_id" in result.update["files"]
+
 
 @pytest.mark.requires("langchain_openai")
 class TestSubagentMiddleware:
@@ -867,13 +974,14 @@ class TestPatchToolCallsMiddleware:
         middleware = PatchToolCallsMiddleware()
         state_update = middleware.before_agent({"messages": input_messages}, None)
         assert state_update is not None
-        assert len(state_update["messages"]) == 3
-        assert state_update["messages"][0].type == "remove"
-        assert state_update["messages"][1].type == "system"
-        assert state_update["messages"][1].content == "You are a helpful assistant."
-        assert state_update["messages"][2].type == "human"
-        assert state_update["messages"][2].content == "Hello, how are you?"
-        assert state_update["messages"][2].id == "2"
+        assert isinstance(state_update["messages"], Overwrite)
+        patched_messages = state_update["messages"].value
+        assert len(patched_messages) == 2
+        assert patched_messages[0].type == "system"
+        assert patched_messages[0].content == "You are a helpful assistant."
+        assert patched_messages[1].type == "human"
+        assert patched_messages[1].content == "Hello, how are you?"
+        assert patched_messages[1].id == "2"
 
     def test_missing_tool_call(self) -> None:
         input_messages = [
@@ -889,24 +997,23 @@ class TestPatchToolCallsMiddleware:
         middleware = PatchToolCallsMiddleware()
         state_update = middleware.before_agent({"messages": input_messages}, None)
         assert state_update is not None
-        assert len(state_update["messages"]) == 6
-        assert state_update["messages"][0].type == "remove"
-        assert state_update["messages"][1] == input_messages[0]
-        assert state_update["messages"][2] == input_messages[1]
-        assert state_update["messages"][3] == input_messages[2]
-        assert state_update["messages"][4].type == "tool"
-        assert state_update["messages"][4].tool_call_id == "123"
-        assert state_update["messages"][4].name == "get_events_for_days"
-        assert state_update["messages"][5] == input_messages[3]
-        updated_messages = add_messages(input_messages, state_update["messages"])
-        assert len(updated_messages) == 5
-        assert updated_messages[0] == input_messages[0]
-        assert updated_messages[1] == input_messages[1]
-        assert updated_messages[2] == input_messages[2]
-        assert updated_messages[3].type == "tool"
-        assert updated_messages[3].tool_call_id == "123"
-        assert updated_messages[3].name == "get_events_for_days"
-        assert updated_messages[4] == input_messages[3]
+        assert isinstance(state_update["messages"], Overwrite)
+        patched_messages = state_update["messages"].value
+        assert len(patched_messages) == 5
+        assert patched_messages[0].type == "system"
+        assert patched_messages[0].content == "You are a helpful assistant."
+        assert patched_messages[1].type == "human"
+        assert patched_messages[1].content == "Hello, how are you?"
+        assert patched_messages[2].type == "ai"
+        assert len(patched_messages[2].tool_calls) == 1
+        assert patched_messages[2].tool_calls[0]["id"] == "123"
+        assert patched_messages[2].tool_calls[0]["name"] == "get_events_for_days"
+        assert patched_messages[2].tool_calls[0]["args"] == {"date_str": "2025-01-01"}
+        assert patched_messages[3].type == "tool"
+        assert patched_messages[3].name == "get_events_for_days"
+        assert patched_messages[3].tool_call_id == "123"
+        assert patched_messages[4].type == "human"
+        assert patched_messages[4].content == "What is the weather in Tokyo?"
 
     def test_no_missing_tool_calls(self) -> None:
         input_messages = [
@@ -923,12 +1030,22 @@ class TestPatchToolCallsMiddleware:
         middleware = PatchToolCallsMiddleware()
         state_update = middleware.before_agent({"messages": input_messages}, None)
         assert state_update is not None
-        assert len(state_update["messages"]) == 6
-        assert state_update["messages"][0].type == "remove"
-        assert state_update["messages"][1:] == input_messages
-        updated_messages = add_messages(input_messages, state_update["messages"])
-        assert len(updated_messages) == 5
-        assert updated_messages == input_messages
+        assert isinstance(state_update["messages"], Overwrite)
+        patched_messages = state_update["messages"].value
+        assert len(patched_messages) == 5
+        assert patched_messages[0].type == "system"
+        assert patched_messages[0].content == "You are a helpful assistant."
+        assert patched_messages[1].type == "human"
+        assert patched_messages[1].content == "Hello, how are you?"
+        assert patched_messages[2].type == "ai"
+        assert len(patched_messages[2].tool_calls) == 1
+        assert patched_messages[2].tool_calls[0]["id"] == "123"
+        assert patched_messages[2].tool_calls[0]["name"] == "get_events_for_days"
+        assert patched_messages[2].tool_calls[0]["args"] == {"date_str": "2025-01-01"}
+        assert patched_messages[3].type == "tool"
+        assert patched_messages[3].tool_call_id == "123"
+        assert patched_messages[4].type == "human"
+        assert patched_messages[4].content == "What is the weather in Tokyo?"
 
     def test_two_missing_tool_calls(self) -> None:
         input_messages = [
@@ -950,34 +1067,33 @@ class TestPatchToolCallsMiddleware:
         middleware = PatchToolCallsMiddleware()
         state_update = middleware.before_agent({"messages": input_messages}, None)
         assert state_update is not None
-        assert len(state_update["messages"]) == 9
-        assert state_update["messages"][0].type == "remove"
-        assert state_update["messages"][1] == input_messages[0]
-        assert state_update["messages"][2] == input_messages[1]
-        assert state_update["messages"][3] == input_messages[2]
-        assert state_update["messages"][4].type == "tool"
-        assert state_update["messages"][4].tool_call_id == "123"
-        assert state_update["messages"][4].name == "get_events_for_days"
-        assert state_update["messages"][5] == input_messages[3]
-        assert state_update["messages"][6] == input_messages[4]
-        assert state_update["messages"][7].type == "tool"
-        assert state_update["messages"][7].tool_call_id == "456"
-        assert state_update["messages"][7].name == "get_events_for_days"
-        assert state_update["messages"][8] == input_messages[5]
-        updated_messages = add_messages(input_messages, state_update["messages"])
-        assert len(updated_messages) == 8
-        assert updated_messages[0] == input_messages[0]
-        assert updated_messages[1] == input_messages[1]
-        assert updated_messages[2] == input_messages[2]
-        assert updated_messages[3].type == "tool"
-        assert updated_messages[3].tool_call_id == "123"
-        assert updated_messages[3].name == "get_events_for_days"
-        assert updated_messages[4] == input_messages[3]
-        assert updated_messages[5] == input_messages[4]
-        assert updated_messages[6].type == "tool"
-        assert updated_messages[6].tool_call_id == "456"
-        assert updated_messages[6].name == "get_events_for_days"
-        assert updated_messages[7] == input_messages[5]
+        assert isinstance(state_update["messages"], Overwrite)
+        patched_messages = state_update["messages"].value
+        assert len(patched_messages) == 8
+        assert patched_messages[0].type == "system"
+        assert patched_messages[0].content == "You are a helpful assistant."
+        assert patched_messages[1].type == "human"
+        assert patched_messages[1].content == "Hello, how are you?"
+        assert patched_messages[2].type == "ai"
+        assert len(patched_messages[2].tool_calls) == 1
+        assert patched_messages[2].tool_calls[0]["id"] == "123"
+        assert patched_messages[2].tool_calls[0]["name"] == "get_events_for_days"
+        assert patched_messages[2].tool_calls[0]["args"] == {"date_str": "2025-01-01"}
+        assert patched_messages[3].type == "tool"
+        assert patched_messages[3].name == "get_events_for_days"
+        assert patched_messages[3].tool_call_id == "123"
+        assert patched_messages[4].type == "human"
+        assert patched_messages[4].content == "What is the weather in Tokyo?"
+        assert patched_messages[5].type == "ai"
+        assert len(patched_messages[5].tool_calls) == 1
+        assert patched_messages[5].tool_calls[0]["id"] == "456"
+        assert patched_messages[5].tool_calls[0]["name"] == "get_events_for_days"
+        assert patched_messages[5].tool_calls[0]["args"] == {"date_str": "2025-01-01"}
+        assert patched_messages[6].type == "tool"
+        assert patched_messages[6].name == "get_events_for_days"
+        assert patched_messages[6].tool_call_id == "456"
+        assert patched_messages[7].type == "human"
+        assert patched_messages[7].content == "What is the weather in Tokyo?"
 
 
 class TestTruncation: