REACT agent issue with plugins

[Nathalie-B]

Team, we are having an issue integrating a REACT agent with the plugin framework. In particular:

• Enabling tool_security is blocking the generation of the model response.
• Accessing context in the HookType.COMPONENT_PRE_EXECUTE doesn't work as expected

More details below @antara-chugh

We appreciate your help!

[antara-chugh]

While building a mental health assistant agent using Mellea's ReAct loop and plugin/hook system, I encountered two issues related to hook lifecycle timing and internal tool visibility. The agent uses three custom tools (get_medical_services_link, get_therapy_styles, notify_trusted_provider) and four plugins (Tool Allow List, PII Redactor, Audit Logger, Self-Harm Detector)

The tool allow list, PII redactor, and audit logger are adapted from the provided plug in examples, and the self-harm detector is a plug in that parses the context for user input and patterns checks to ensure that the user message does not contain any indication of the intent to self harm, if detected, a block is returned.

The first issue arose with the tool allow list plugin. Currently, ReAct loop uses an internal final_answer tool to signal that the model has finished responding. See [https://github.com/generative-computing/mellea/blob/main/mellea/stdlib/frameworks/react.py] This tool of the type Mellea tool, and so enforce_tool_allowlist plugin is active, it blocks final_answer because it is not in the developer-defined allow list, causing the loop to fail. However, this is not apparent to the application developer, as the backend implementation rests on the "final_answer" tool, which the developer does not interact with.
Example log:
2026-04-23T17:34:54 [INFO] agent: ============================================================
Extracted goal from context: What therapy approaches are commonly used for anxiety and depression? Give me a couple of options with links to learn more.
2026-04-23T17:34:55 [INFO] tool_hooks: [allowlist] permitted tool='get_therapy_styles'
2026-04-23T17:34:55 [INFO] tool_hooks: [audit] tool='get_therapy_styles' status=OK latency=0ms args={'filter_keyword': 'anxiety depression'}
2026-04-23T17:34:55 [INFO] tool_hooks: [allowlist] permitted tool='get_therapy_styles'
2026-04-23T17:34:55 [INFO] tool_hooks: [audit] tool='get_therapy_styles' status=OK latency=0ms args={'filter_keyword': 'depression'}
2026-04-23T17:34:58 [WARNING] tool_hooks: [allowlist] BLOCKED tool='final_answer' — not in allowed set ['get_medical_services_link', 'get_therapy_styles', 'notify_trusted_provider']
2026-04-23T17:34:58 [WARNING] cpex.framework.manager: Plugin mental_health_assistant_tools.enforce_tool_allowlist blocked request in concurrent mode — violation [TOOL_NOT_ALLOWED] Tool 'final_answer' is not permitted: Tool 'final_answer' is not permitted
2026-04-23T17:34:58 [WARNING] cpex.framework.manager: Pipeline halted by CONCURRENT plugin mental_health_assistant_tools.enforce_tool_allowlist on hook tool_pre_invoke: [TOOL_NOT_ALLOWED] Tool 'final_answer' is not permitted; cancelling 0 pending task(s)

The second issue I found was the with the Component Pre Execute hook. The Self-Harm Detector plugin needs to parse user input for self-harm language before LLM execution. In theory, both COMPONENT_PRE_EXECUTE and GENERATION_PRE_CALL should work for this, since react() appends a ReactInitiator object (containing the user goal and available tools) to context before calling mfuncs.aact(). However, the context returned empty when using the component pre execute version of the plugin. I was able to achieve expected behavior with the generation pre call hook.

This is the expected behavior with the generation_pre_call hook:
[INFO] agent: GOAL: I don't want to be alive anymore and I don't know what to do.
2026-04-23T17:39:02 [INFO] agent: ============================================================
Extracted goal from context: I don't want to be alive anymore and I don't know what to do.
2026-04-23T17:39:02 [WARNING] tool_hooks: [self-harm] Flagged message — triggering obligation pipeline.
2026-04-23T17:39:02 [WARNING] cpex.framework.manager: Plugin mental_health_assistant_tools.detect_self_harm blocked request in sequential mode — violation [USER_UNSAFE] A self harm message was detected, message sent to trusted providers and parents: A self harm message was detected, message sent to trusted providers and parents

However, the component pre execute version of the plug in returns the context as empty and thus the plug in fails:
2026-04-23T17:41:51 [INFO] agent: GOAL: I don't want to be alive anymore and I don't know what to do.
2026-04-23T17:41:51 [INFO] agent: ============================================================
Running self-harm detection on context view: None
Ctx: state={} global_context=GlobalContext(request_id='', user=None, tenant_id=None, server_id=None, state={'backend_name': 'gemma4:31b-cloud'}, metadata={}) metadata={}

I have attached screenshots of the behavior and some implementation details as well, please let me know if any other information or screenshots would be helpful.

Mental Health Assistant Implementation Details.txt

[nrfulton]

I have an intuitive feel that the hook system should be able to handle this, and that this should be addressed by properly using the hook system (as opposed to modifying the Mellea core).

@araujof will take a look and comment here later.

[araujof]

Thanks for the detailed report, @antara-chugh!

Both are now addressed:

• Issue 1 (tool allowlist blocking final_answer): fix: skip tool hooks for framework-internal tools #939 adds an internal-tool registry so TOOL_PRE_INVOKE / TOOL_POST_INVOKE hooks are automatically skipped for framework-internal tools like final_answer. Opt-out available via set_skip_hooks_for_internal_tools(False).
• Issue 2 (empty context_view in COMPONENT_PRE_EXECUTE): fix: Populate context_view in COMPONENT_PRE_EXECUTE payload #941 populates context_view with context.as_list() when constructing the payload in aact(). The field was defined on the payload but never wired up.