
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
@cloudbase/agent-adapter-langgraph
Advanced tools
将 LangGraph 工作流转换为符合 AG-UI 协议 的 Agent。
npm install @cloudbase/agent-adapter-langgraph
import { run } from "@cloudbase/agent-server";
import { StateGraph, START, END } from "@langchain/langgraph";
import { ClientStateAnnotation, LanggraphAgent } from "@cloudbase/agent-adapter-langgraph";
// 创建 LangGraph 工作流
const workflow = new StateGraph(ClientStateAnnotation)
.addNode("chat_node", chatNode)
.addEdge(START, "chat_node")
.addEdge("chat_node", END);
const compiledWorkflow = workflow.compile();
// 部署为 HTTP 服务
run({
createAgent: () => ({
agent: new LanggraphAgent({ compiledWorkflow }),
}),
port: 9000,
});
将编译后的 LangGraph 工作流转换为 AG-UI 兼容的 Agent。
type LanggraphAgentConfig = AgentConfig & {
compiledWorkflow: CompiledStateGraph; // 编译后的 LangGraph 工作流
logger?: Logger; // 可选,日志实例
};
const agent = new LanggraphAgent(config);
AgentConfig:来自 AG-UI 协议Logger:日志接口,详见 @cloudbase/agent-server 文档创建 LangGraph 工作流时使用的状态定义,已包含 AG-UI 需要的字段:
messages:消息历史client.tools:客户端传来的工具列表const workflow = new StateGraph(ClientStateAnnotation)
.addNode("chat_node", chatNode)
// ...
AG-UI 支持客户端工具(Client Tools):客户端定义工具,Agent 调用后由客户端执行并返回结果。
适用场景:
import { ClientState } from "@cloudbase/agent-adapter-langgraph";
async function chatNode(state: ClientState) {
const model = new ChatOpenAI({ model: "gpt-4o" });
// 合并服务端工具和客户端工具
const modelWithTools = model.bindTools([
...serverTools, // 服务端定义的工具
...(state.client?.tools || []) // 客户端传来的工具
]);
const response = await modelWithTools.invoke([...state.messages]);
return { messages: [response] };
}
当 Agent 调用工具时,需要判断是服务端执行还是交给客户端:
const serverToolNames = new Set(serverTools.map(t => t.name));
function shouldContinue(state: ClientState): "tools" | "end" {
const lastMessage = state.messages.at(-1) as AIMessage;
if (lastMessage.tool_calls?.length) {
// 如果是服务端工具,继续执行
const hasServerTool = lastMessage.tool_calls.some(
tc => serverToolNames.has(tc.name)
);
if (hasServerTool) return "tools";
}
// 客户端工具或无工具调用,结束并返回给客户端
return "end";
}
@langchain/langgraph:LangGraph 框架@langchain/core:LangChain 核心工具📚 完整文档请参阅 云开发 Agent 开发指南
FAQs
LangGraph adapter for AG-Kit agents
The npm package @cloudbase/agent-adapter-langgraph receives a total of 63 weekly downloads. As such, @cloudbase/agent-adapter-langgraph popularity was classified as not popular.
We found that @cloudbase/agent-adapter-langgraph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.