With custom configs, the actual model name and provider the gateway
actually runs are different from what are requested. This reconciles
clientside tracing.
## Problem
`StructuredTool` cannot be dumped to JSON:
```python
@tool
def write_file(file_path: str, content: str) -> str:
"""Write content to the given path."""
return "ok"
write_file.model_dump(mode="json")
# PydanticSerializationError: Unable to serialize unknown type:
# <class 'pydantic._internal._model_construction.ModelMetaclass'>
```
`args_schema` holds a Pydantic model class, and `func` / `coroutine`
hold callables. None of them have a JSON form. Python-mode
`model_dump()` works; only the JSON modes raise.
This also costs tracing performance. The [LangSmith
SDK](https://github.com/langchain-ai/langsmith-sdk/blob/main/python/langsmith/_internal/_serde.py)
catches the error, dumps again in Python mode, and then sends every
class and function left in the result through its own `default` hook.
## Change
A `PlainSerializer(..., when_used="json-unless-none")` on the three
fields.
- `args_schema` dumps as its own JSON schema: `model_json_schema()` for
a Pydantic v2 class, `schema()` for a v1 one. A dict schema passes
through unchanged. A schema holding an arbitrary type has no JSON schema
at all, so it falls back to its repr instead of raising.
- `func` and `coroutine` dump as strings.
- Python-mode dumps are unchanged — still the live schema class and
callables.
- `exclude` / `include` / `exclude_none` keep working.
- Attached with `Annotated`, not `@field_serializer`. A field has only
one serializer slot, so `@field_serializer` would break any subclass
that declares its own serializer for the same field.
- Schema generation is cached per class. Pydantic does not memoize it,
and tracing would pay for it on every run.
## Result
The dump is JSON-native, and the schema it carries has the same shape a
dict `args_schema` already has, so it validates back into a working
tool.
Measured on the 8 filesystem tools of a deepagents agent, dumped through
the LangSmith serializer:
| | master | this PR |
|---|---|---|
| time per dump | 0.119 ms | **0.025 ms** |
| payload | 7,706 B | 12,213 B |
| objects reaching the SDK's `default` hook | 32 | 8 |
The payload grows because `args_schema` now carries the real schema
instead of `"<class ...>"`. Only the tool itself still enters the
`default` hook; the class and functions inside it no longer do. Without
the per-class cache the same dump takes 1.10 ms, so the cache is what
makes this a win rather than a regression.
## Why not on `BaseTool`
`args_schema` is declared there as well, so `Tool` and custom subclasses
hit the same error. But an `Annotated` serializer only applies where the
field is declared, and `StructuredTool` redeclares `args_schema` — it
would not inherit one from `BaseTool`.
## Tests
In `libs/core/tests/unit_tests/test_tools.py`: JSON round trip, Python
mode unchanged, dump options respected, dict `args_schema` preserved,
Pydantic v1 schema class, arbitrary-type fallback, and a subclass
declaring its own serializers for the same fields.
Closes#39568
Related: #33999
> [!WARNING]
> This PR expands the surface area for arbitrary code execution during
tool setup. Detecting injected arguments now requires calling
`typing.get_type_hints`, which *evaluates* string annotations (e.g.
those created by `from __future__ import annotations` or quoted forward
references) as Python expressions. As with existing type-hint resolution
paths, wrapped tool callables must be trusted application code — never
point `StructuredTool` at a callable whose module or annotations come
from an untrusted source.
Tools with a custom `args_schema` could drop injected arguments such as
`ToolRuntime` when the wrapped function's module uses postponed
annotations. The injected value was removed during input validation, so
an otherwise valid tool call failed at invocation.
---
`StructuredTool` now resolves annotations with
`typing.get_type_hints(..., include_extras=True)` before identifying
injected parameters. If an unrelated forward reference prevents
resolving the complete signature, each string annotation is resolved
independently so resolvable injected arguments are still preserved.
Callable wrappers resolve annotations from the source of their effective
signature, honoring `__wrapped__` and `__signature__`, while other
callable objects use their `__call__` method. `functools.partial`
callables retain their effective signature so already-bound injected
arguments remain excluded.
<details>
<summary><b>Before/after:</b> injected arg dropped under <code>from
__future__ import annotations</code></summary>
With postponed annotations, every annotation is stored as a plain
string. Previously `_injected_args_keys` read the raw `signature()`
annotations, so `runtime` was never recognized as injected and was
stripped during `args_schema` validation:
```python
from __future__ import annotations # all annotations become strings
from pydantic import BaseModel
from langchain_core.tools import tool, ToolRuntime
class InputSchema(BaseModel):
query: str
@tool(args_schema=InputSchema)
def my_tool(query: str, runtime: ToolRuntime) -> str:
"""Echo the query."""
return query
```
| | Behavior |
|---|---|
| **Before** | `runtime` not detected as injected → removed during
validation → tool call fails at invocation |
| **After** | `runtime` detected via `get_type_hints` → survives
validation and is injected at invocation; hidden from the model-facing
schema |
</details>
<details>
<summary><b>Before/after:</b> one unresolvable annotation disabling
injection for the whole signature</summary>
`get_type_hints` resolves *all* annotations at once and raises on the
first failure. A single unresolvable forward reference — even on an
unrelated parameter — previously meant *no* hints were available, so the
resolvable injected arg was dropped too:
```python
@tool(args_schema=InputSchema)
def my_tool(
query: "SomeTypeThatDoesNotExist", # unresolvable forward reference
runtime: "ToolRuntime", # resolvable injected arg
) -> str:
"""Echo the query."""
return query
```
| | Behavior |
|---|---|
| **Before** | `get_type_hints` raises on `query` → all hints discarded
→ `runtime` not detected as injected |
| **After** | each annotation is retried independently → `query` falls
back to its raw string (not injected), `runtime` still resolves and is
injected |
</details>
<details>
<summary><b>Before/after:</b> callable objects and wrappers</summary>
For non-function callables, the annotations now come from the source of
the *effective* signature: `__call__` for callable objects, and the
wrapped function for wrappers (`__wrapped__` / `__signature__`):
```python
class MyCallableTool:
def __call__(self, query: str, runtime: ToolRuntime) -> str:
return query
tool = StructuredTool.from_function(
func=MyCallableTool(),
name="my_tool",
description="Echo the query.",
args_schema=InputSchema,
)
```
| | Behavior |
|---|---|
| **Before** | annotations read from the wrong callable (or left as
unresolved strings) → `runtime` dropped |
| **After** | annotations resolved from `__call__` / the unwrapped
function → `runtime` injected correctly |
</details>
<details>
<summary><b>Unchanged:</b> <code>functools.partial</code> with an
already-bound injected arg</summary>
A `partial` that already binds an injected argument keeps its effective
signature — the bound parameter is absent, so nothing is re-injected
over it:
```python
from functools import partial
def fn(x: int, runtime: ToolRuntime, y: int) -> int:
return x + y
tool = StructuredTool.from_function(
func=partial(fn, 1, bound_runtime),
name="fn",
description="Add two numbers.",
args_schema=InputSchema,
)
```
**Before & after:** `runtime` is already bound by the `partial` →
excluded from the signature → the bound value is used as-is
</details>
Co-authored-by: Soban Shankar
<165470467+Soban-2004@users.noreply.github.com>
fixes#39099
We currently allow forward refs in pydantic v2 schemas upon creation:
```python
class Container(BaseModel):
rows: list["Row"] = [] # "Row" is declared below, after the tool is decorated
@tool
def my_tool(container: Container):
"""A tool whose schema depends on a forward reference that is not resolvable yet."""
return "ok"
class Row(BaseModel):
name: str
```
When it comes time to introspect the tool schema (notably in
`count_tokens_approximately` and `convert_to_openai_tool`), we rely on
[signature
introspection](https://github.com/langchain-ai/langchain/blob/943dd700ef7c33e3f1f21d3e280c9c249b88259c/libs/core/langchain_core/tools/base.py#L1654-L1661)
to extract the tool's input schema. If that contains invalid forward
references, there's no schema fields to extract which results in an
empty dict:
<details>
<summary>Invalid forward reference MRE</summary>
```python
from __future__ import annotations
import inspect
from pydantic import BaseModel, Field
from pydantic.errors import PydanticUndefinedAnnotation
from langchain_core.tools.base import get_all_basemodel_annotations
from langchain_core.utils.pydantic import _create_subset_model, model_json_schema
class Container(BaseModel):
"""A model with a nested forward reference that can never resolve."""
rows: list["UndefinedRow"] = Field(default_factory=list)
def main() -> None:
"""Print the field-selection inputs and their zero-field subset result."""
selected_annotations = get_all_basemodel_annotations(Container)
subset_schema = _create_subset_model(
"ContainerSubset",
Container,
list(selected_annotations),
fn_description=Container.__doc__,
)
print(f"Pydantic complete: {Container.__pydantic_complete__}")
print(f"Pydantic fields: {list(Container.model_fields)}")
print(f"inspect.signature: {inspect.signature(Container)}")
print(f"Fields selected by get_all_basemodel_annotations: {selected_annotations}")
print(f"Subset properties: {model_json_schema(subset_schema)['properties']}")
if __name__ == "__main__":
main()
```
```output
Pydantic complete: False
Pydantic fields: ['rows']
inspect.signature: (**data: 'Any') -> 'None'
Fields selected by get_all_basemodel_annotations: {}
Subset properties: {}
```
</details>
<details>
<summary>Valid forward reference MRE</summary>
```python
from __future__ import annotations
import inspect
from pydantic import BaseModel, Field
from pydantic.errors import PydanticUndefinedAnnotation
from langchain_core.tools.base import get_all_basemodel_annotations
from langchain_core.utils.pydantic import _create_subset_model, model_json_schema
class Container(BaseModel):
"""A model with a nested forward reference that can never resolve."""
rows: list["UndefinedRow"] = Field(default_factory=list)
class UndefinedRow(BaseModel):
name: str = Field()
def main() -> None:
"""Print the field-selection inputs and their zero-field subset result."""
Container.model_rebuild()
selected_annotations = get_all_basemodel_annotations(Container)
subset_schema = _create_subset_model(
"ContainerSubset",
Container,
list(selected_annotations),
fn_description=Container.__doc__,
)
print(f"Pydantic complete: {Container.__pydantic_complete__}")
print(f"Pydantic fields: {list(Container.model_fields)}")
print(f"inspect.signature: {inspect.signature(Container)}")
print(f"Fields selected by get_all_basemodel_annotations: {selected_annotations}")
print(f"Subset properties: {model_json_schema(subset_schema)['properties']}")
if __name__ == "__main__":
main()
```
```output
Pydantic complete: True
Pydantic fields: ['rows']
inspect.signature: (*, rows: list[__main__.UndefinedRow] = <factory>) -> None
Fields selected by get_all_basemodel_annotations: {'rows': list[__main__.UndefinedRow]}
Subset properties: {'rows': {'items': {'$ref': '#/$defs/UndefinedRow'}, 'title': 'Rows', 'type': 'array'}}
```
</details>
---
The fix is to
* at introspection time, resolve forward references using
`.model_rebuild()` that raises a pydantic exception if forward
references cant be resolved
* i'm also widening a pydantic utility to use a type guard instead of
having to use bool + cast
I'm intentionally not rebuilding pydantic v1 schemas in the same way
since
* forward references are specified by explicitly passing names into
`update_forward_refs`
* pydantic v1 is old news
Runnable snapshots currently embed the exact `langchain-core` version,
forcing unrelated snapshot rewrites during every release. Normalize only
the current `VERSION` to a stable placeholder before comparison, so
missing or stale version metadata still fails.
Made by [Open
SWE](https://openswe.vercel.app/agents/bfd72574-359e-544e-dbf5-78f8bae3636a)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
This PR sends gateway metadata information (if present in the client
response) as metadata for the llm invocation.
Requires changes corresponding changes in the ChatModel implementations
(e.g., ChatOpenAI) so gateway metadata is picked up from the gateway
response headers.
---------
Signed-off-by: Eugene Yurtsev <eugene@langchain.dev>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: eyurtsev <3205522+eyurtsev@users.noreply.github.com>
Closes#38064, #35259, #38850
`merge_dicts`, `merge_lists`, and `AddableDict` all guessed at merge
semantics for streaming chunks in ways that silently corrupted data
instead of failing loudly:
- `merge_dicts` fell into the `int` branch for differing `bool` values
(since `bool` subclasses `int`) and summed them, turning `True + False`
into `1`. It now raises `TypeError`, consistent with other unmergeable
types.
- `merge_lists` used `"index" in e_left` on untyped list elements; when
an element was a plain `str` containing the literal substring `"index"`,
it then subscripted the string and raised an unrelated `TypeError`. It
now checks `isinstance(e_left, dict)` first.
- `AddableDict.__add__`/`__radd__` silently discarded the left-hand
value on any `TypeError` from `chunk[key] + other[key]`. They now
re-raise a `TypeError` naming the key and both types.
### Release note
`merge_dicts` now raises `TypeError` for differing boolean values at the
same key instead of silently summing them to an `int`; `AddableDict`
addition now raises `TypeError` on type-incompatible keys instead of
silently dropping data; `merge_lists` no longer misidentifies non-dict
elements as index-keyed.
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Closes#38713
Fixes `Runnable.as_tool()` advertising `TypedDict` inputs under a
synthetic `root` key.
When a runnable's `input_schema` is a `RootModel` (e.g. compiled
`StateGraph`s), the tool schema is now built from the runnable's type
hints instead, keeping the advertised schema consistent with the flat
input the runnable actually expects.
---------
Co-authored-by: shusnapx <ashu.kumarexam@gmail.com>
Fixed a resource leak in the `astream_events` and `astream_log`
streaming tracers: when constructed from synchronous code on Python
3.14+, an internally created event loop was never closed, causing a
`ResourceWarning: unclosed event loop` to be emitted at
garbage-collection time (and intermittent failures of warning-sensitive
tests such as `test_chat_prompt_template_variable_names`). The loop is
now closed when the handler is garbage collected.
Credential-bearing model kwargs can be sanitized by an integration's
`_get_invocation_params`, but streaming callbacks also received the
original kwargs through `options`. This could expose remote MCP
credentials to callback handlers and persisted LangSmith traces even
when `invocation_params` was redacted.
Streaming and v3 streaming-event callbacks now construct `options` from
the integration-sanitized invocation parameters while the model
invocation continues to receive the original values. Sync and async
regression coverage verifies both callback redaction and provider
propagation.
## Release note
Streaming chat-model callbacks no longer receive unsanitized invocation
options when an integration redacts sensitive parameters.
This contribution was prepared with AI-agent assistance.
Co-authored-by: jkennedyvz <jkennedyvz@users.noreply.github.com>
