@@ -42,6 +42,7 @@ import {
   STREAM_LIMIT_EPOCH_KEY,
   StreamLimitExceededError,
 } from '@/llm/streamLimits';
+import { ProviderTextProtectionError } from '@/protection/providerText';
 import { GraphEvents, Providers, StepTypes } from '@/common';
 import * as eagerArgs from '@/tools/eagerEventExecution';
 import { ChatModelStreamHandler } from '@/stream';
@@ -664,14 +665,13 @@ describe('eager args divergence (LibreChat#14371)', () => {
     expect(toolExecuteCalls).toHaveLength(0);
   });
 
-  it('does not prestart eager tools when the breaker trips during tool-call handling', async () => {
+  it.each([
+    { label: 'stream limit', trip: new StreamLimitExceededError({ kind: 'tool_call_args', limit: 10, observed: 11, toolName: 'db_query' }) },
+    { label: 'blocked', trip: new ProviderTextProtectionError('blocked') },
+    { label: 'timeout', trip: new ProviderTextProtectionError('timeout') },
+    { label: 'cancelled', trip: new ProviderTextProtectionError('cancelled') },
+  ])('does not prestart eager tools after an awaited $label trip', async ({ trip }) => {
     const graph = createGraph();
-    const trip = new StreamLimitExceededError({
-      kind: 'tool_call_args',
-      limit: 10,
-      observed: 11,
-      toolName: 'db_query',
-    });
     const originalDispatch = graph.dispatchRunStep;
     graph.dispatchRunStep = (async (
       stepKey: string,
@@ -712,6 +712,70 @@ describe('eager args divergence (LibreChat#14371)', () => {
     expect(toolExecuteCalls).toHaveLength(0);
   });
 
+  it.each(['blocked', 'timeout'] as const)('stops streamed seals when protection trips during awaited publication (%s)', async (code) => {
+    const graph = createGraph();
+    const trip = new ProviderTextProtectionError(code);
+    const originalDispatch = graph.dispatchRunStep.bind(graph);
+    graph.dispatchRunStep = async (key, details, metadata): Promise<string> => {
+      const id = await originalDispatch(key, details, metadata);
+      graph.breakerAbort.abort(trip);
+      return id;
+    };
+    const { toolExecuteCalls } = installToolExecuteResponder();
+    const chunk = new AIMessageChunk({ content: '', tool_call_chunks: [{ index: 0, id: 'sealed-call', name: 'db_query', args: '{"sql":"SELECT 1;"}' }], response_metadata: {
+      [STREAMED_TOOL_CALL_ADAPTER_METADATA_KEY]: BEDROCK_CONVERSE_STREAMED_TOOL_CALL_ADAPTER,
+      [STREAMED_TOOL_CALL_SEAL_METADATA_KEY]: { kind: 'single', index: 0 },
+    } });
+    chunk.tool_calls = [];
+    await expect(new ChatModelStreamHandler().handle(GraphEvents.CHAT_MODEL_STREAM, { chunk }, { langgraph_node: 'agent' }, graph)).rejects.toBe(trip);
+    expect(toolExecuteCalls).toHaveLength(0);
+    expect(graph.eagerEventToolExecutions.size).toBe(0);
+    expect(graph.eagerEventToolCallChunks.size).toBe(1);
+  });
+
+  it('drops already queued stream events after a protection trip', async () => {
+    const graph = createGraph();
+    const trip = new ProviderTextProtectionError('blocked');
+    graph.breakerAbort.abort(trip);
+    const { toolExecuteCalls } = installToolExecuteResponder();
+    await expect(new ChatModelStreamHandler().handle(GraphEvents.CHAT_MODEL_STREAM, {
+      chunk: new AIMessageChunk({ content: '', tool_calls: [{ id: 'queued-call', name: 'db_query', args: { sql: 'SELECT 1;' }, type: 'tool_call' }], response_metadata: { finish_reason: 'tool_calls' } }),
+    }, { langgraph_node: 'agent' }, graph)).rejects.toBe(trip);
+    expect(graph.dispatchRunStep).not.toHaveBeenCalled();
+    expect(toolExecuteCalls).toHaveLength(0);
+  });
+
+  it.each([
+    { signalSource: 'constructor', shape: 'parsed' },
+    { signalSource: 'constructor', shape: 'seal' },
+    { signalSource: 'call', shape: 'parsed' },
+    { signalSource: 'call', shape: 'seal' },
+  ])('honors inherited $signalSource trips after awaited $shape handling', async ({ signalSource, shape }) => {
+    const parent = new AbortController();
+    const graph = createGraph(signalSource === 'constructor' ? { signal: parent.signal } : {});
+    if (signalSource === 'call') graph.config = { ...graph.config, signal: parent.signal };
+    const trip = new ProviderTextProtectionError('blocked');
+    const originalDispatch = graph.dispatchRunStep.bind(graph);
+    graph.dispatchRunStep = async (key, details, metadata): Promise<string> => {
+      const id = await originalDispatch(key, details, metadata);
+      parent.abort(trip);
+      graph.config = { ...graph.config, signal: new AbortController().signal };
+      return id;
+    };
+    const { toolExecuteCalls } = installToolExecuteResponder();
+    const chunk = shape === 'parsed'
+      ? new AIMessageChunk({ content: '', tool_calls: [{ id: 'inherited-call', name: 'db_query', args: { sql: 'SELECT 1;' }, type: 'tool_call' }], response_metadata: { finish_reason: 'tool_calls' } })
+      : new AIMessageChunk({ content: '', tool_call_chunks: [{ index: 0, id: 'inherited-call', name: 'db_query', args: '{"sql":"SELECT 1;"}' }], response_metadata: {
+        [STREAMED_TOOL_CALL_ADAPTER_METADATA_KEY]: BEDROCK_CONVERSE_STREAMED_TOOL_CALL_ADAPTER,
+        [STREAMED_TOOL_CALL_SEAL_METADATA_KEY]: { kind: 'single', index: 0 },
+      } });
+    if (shape === 'seal') chunk.tool_calls = [];
+    await expect(new ChatModelStreamHandler().handle(GraphEvents.CHAT_MODEL_STREAM, { chunk }, { langgraph_node: 'agent' }, graph)).rejects.toBe(trip);
+    expect(graph.breakerAbort.signal.aborted).toBe(false);
+    expect(toolExecuteCalls).toHaveLength(0);
+    expect(graph.eagerEventToolExecutions.size).toBe(0);
+  });
+
   it('sends a breaker-composed abort signal with eager prestart requests', async () => {
     const graph = createGraph();
     const { toolExecuteCalls } = installToolExecuteResponder();
 
@@ -58,6 +58,7 @@ import {
 import { isTokenCounterCacheCompatible } from '@/llm/tokenCounterCacheCompatibility';
 import { snapshotCompactionSemanticIndex } from '@/summarization/semanticIndex';
 import { createExactTokenCountCache } from '@/llm/contextPressureMeter';
+import { markProviderTextInput } from '@/protection/providerTextInput';
 import { buildSummaryCarrierText } from '@/summarization/shared';
 import { createSchemaOnlyTools } from '@/tools/schema';
 import { apportionTokenCounts } from '@/utils/tokens';
@@ -960,7 +961,7 @@ export class AgentContext {
         : 0;
     }
 
-    return RunnableLambda.from((messages: BaseMessage[]) => {
+    return markProviderTextInput(RunnableLambda.from((messages: BaseMessage[]) => {
       const prefix: BaseMessage[] = systemMessage ? [systemMessage] : [];
 
       // Build the non-system portion (summary + conversation), then apply
@@ -998,7 +999,7 @@ export class AgentContext {
         );
       }
       return [...prefix, ...body];
-    }).withConfig({ runName: 'prompt' });
+    })).withConfig({ runName: 'prompt' });
   }
 
   private buildSummaryHumanMessage(
 
@@ -131,6 +131,10 @@ import {
   resolveLangfuseConfig,
   resolveToolOutputTracingConfig,
 } from '@/langfuseConfig';
+import {
+  ProviderTextProtectionError,
+  validateProviderTextProtection,
+} from '@/protection/providerText';
 import {
   annotateMessagesForLLM,
   ToolOutputReferenceRegistry,
@@ -1378,6 +1382,8 @@ export class StandardGraph extends Graph<t.BaseGraphState, t.GraphNode> {
    * these on every streamed chunk event.
    */
   streamLimits: ResolvedStreamLimits;
+  /** Default-off mandatory provider prose release. */
+  providerTextProtection?: t.StandardGraphInput['providerTextProtection'];
   /**
    * Cumulative streamed argument bytes per in-flight tool call, keyed by
    * generation key + chunk index (see `resolveGenerationKey`). Per-run
@@ -1423,25 +1429,27 @@ export class StandardGraph extends Graph<t.BaseGraphState, t.GraphNode> {
    * attempt lease; spans resets on purpose. */
   activeStreamLimitGenerations?: Set<string>;
 
-  /** The stream-limit error behind an already-fired breaker, whether this
+  /** The safety error behind an already-fired breaker, whether this
    * graph's own controller tripped or a parent run's breaker arrived through
    * the composed constructor signal (child graphs own separate controllers).
    * Providers can translate either abort into a generic error, and recovery
    * paths must not run in that state. */
   protected resolveTrippedBreakerReason(
     breakerSignal: AbortSignal = this.breakerAbort.signal
-  ): StreamLimitExceededError | PreparedSubagentError | undefined {
+  ): StreamLimitExceededError | PreparedSubagentError | ProviderTextProtectionError | undefined {
     if (
       breakerSignal.aborted &&
       (breakerSignal.reason instanceof StreamLimitExceededError ||
-        breakerSignal.reason instanceof PreparedSubagentError)
+        breakerSignal.reason instanceof PreparedSubagentError ||
+        breakerSignal.reason instanceof ProviderTextProtectionError)
     ) {
       return breakerSignal.reason;
     }
     if (
       this.signal?.aborted === true &&
       (this.signal.reason instanceof StreamLimitExceededError ||
-        this.signal.reason instanceof PreparedSubagentError)
+        this.signal.reason instanceof PreparedSubagentError ||
+        this.signal.reason instanceof ProviderTextProtectionError)
     ) {
       return this.signal.reason;
     }
@@ -1551,6 +1559,7 @@ export class StandardGraph extends Graph<t.BaseGraphState, t.GraphNode> {
       onSubagentResolutionFailure,
       preemption,
       streamLimits,
+      providerTextProtection,
       toolExecution,
       clientDelegatedToolNames,
     }: t.StandardGraphInput,
@@ -1580,6 +1589,9 @@ export class StandardGraph extends Graph<t.BaseGraphState, t.GraphNode> {
     this.onSubagentResolutionFailure = onSubagentResolutionFailure;
     this.preemption = preemption;
     this.streamLimits = resolveStreamLimits(streamLimits);
+    if (providerTextProtection != null)
+      validateProviderTextProtection(providerTextProtection);
+    this.providerTextProtection = providerTextProtection;
     this.toolExecution = toolExecution;
     if (clientDelegatedToolNames != null && clientDelegatedToolNames.length > 0) {
       if (agents.length !== 1) {
@@ -4404,7 +4416,11 @@ export class StandardGraph extends Graph<t.BaseGraphState, t.GraphNode> {
          * succeeding fallback would resolve a run the public contract says
          * must reject. Rethrow before any recovery path.
          */
-        if (primaryError instanceof InvalidModelToolCallError) {
+        if (
+          primaryError instanceof InvalidModelToolCallError ||
+          primaryError instanceof ProviderTextProtectionError
+        ) {
+          if (primaryError instanceof ProviderTextProtectionError) attemptBreaker.abort(primaryError);
           throw primaryError;
         }
         if (
@@ -4747,7 +4763,11 @@ export class StandardGraph extends Graph<t.BaseGraphState, t.GraphNode> {
               })
           );
         } catch (fallbackError) {
-          if (fallbackError instanceof InvalidModelToolCallError) {
+          if (
+            fallbackError instanceof InvalidModelToolCallError ||
+            fallbackError instanceof ProviderTextProtectionError
+          ) {
+            if (fallbackError instanceof ProviderTextProtectionError) attemptBreaker.abort(fallbackError);
             throw fallbackError;
           }
           if (
@@ -5347,6 +5367,7 @@ export class StandardGraph extends Graph<t.BaseGraphState, t.GraphNode> {
           subagentContext: this.subagentContext,
           onResolutionFailure: this.onSubagentResolutionFailure,
           streamLimits: this.streamLimits,
+          providerTextProtection: this.providerTextProtection,
           humanInTheLoop: this.humanInTheLoop,
           checkpointer: this.compileOptions?.checkpointer,
           maxDepth: effectiveSubagentDepth,
 
@@ -1,6 +1,7 @@
 import { describe, it, expect, jest } from '@jest/globals';
 import type { RunnableConfig } from '@langchain/core/runnables';
 import type * as t from '@/types';
+import { ProviderTextProtectionError } from '@/protection/providerText';
 import { StreamLimitExceededError } from '@/llm/streamLimits';
 import { StandardGraph } from '../Graph';
 import { Providers } from '@/common';
@@ -261,6 +262,15 @@ describe('run breaker lifecycle', () => {
     ).rejects.toBe(trip);
   });
 
+  it.each(['own', 'parent'])('rejects model entry after a protection trip in the %s breaker', async (scope) => {
+    const controller = new AbortController();
+    const trip = new ProviderTextProtectionError('blocked');
+    const graph = new StandardGraph({ runId: 'protection-entry', agents: [makeAgent('agent')], signal: scope === 'parent' ? controller.signal : undefined });
+    if (scope === 'own') graph.breakerAbort.abort(trip);
+    else controller.abort(trip);
+    await expect(graph.createCallModel('agent')({ messages: [] } as t.AgentSubgraphState, {})).rejects.toBe(trip);
+  });
+
   it('lets a model node proceed past entry when the breaker is live', async () => {
     const graph = makeGraph();
     const node = graph.createCallModel('agent');
 
@@ -121,3 +121,10 @@ export type {
 } from './llm/streamLimits';
 export * from './decisions';
 export * from './rerank';
+
+export { PROVIDER_TEXT_PROTECTION_VERSION, ProviderTextProtectionError } from './protection/providerText';
+export type {
+  ProviderTextProtection,
+  ProviderTextProtectionResult,
+  ProviderTextProtectionErrorCode,
+} from './protection/providerText';