Skip to content

release: 5.12.1 — crew import, Tools/Secrets helpers, six hardening fixes - #120

Merged
abhishekmishragithub merged 8 commits into
mainfrom
hardening-5.12.1
Sep 16, 2026
Merged

abhishekmishragithub merged 8 commits into
mainfrom
hardening-5.12.1

Conversation

@abhishekmishragithub

Copy link
Copy Markdown
Collaborator

Rolls up the reusable-tools helpers (#109) and crew import fix (#119, already on main) with six hand-written hardening fixes that could not merge from forks (CI does not run on fork PRs). Each fix is in a .fernignore hand-written area, so no regen is involved.

Hardening fixes (re-homed from #111-#118 with authorship preserved):

  • waves: serialize STT query params via the escape hatch; close the streaming-TTS socket on every exit path
  • helpers: keep a pagination zero in as_page; request timeout on the Atoms REST helpers
  • crew: task registry keyed by task not name; keep the call id when a parallel tool fails
  • crew: @function_tool bare form now type-checks via overloads (fixes the documented usage for callers)

Bumps to 5.12.1 (publish fires on merge to main). Verified locally: mypy 1.13.0 clean, ruff clean.

CaptainAni187 and others added 8 commits September 16, 2026 21:11
build_stt_stream_query coerced booleans and lists only for params it names,
so a knob given via additional_query_parameters reached the handshake as
"True" or as a Python list repr. The controller compares === "true", so the
knob silently did nothing. request_options["additional_query_parameters"]
bypassed the same coercion.

Key the coercion off the value's type instead of the param name, which
covers both paths and the unnamed knobs the escape hatch exists for.

(cherry picked from commit 4f53812)
synthesize and synthesize_streaming closed the socket only after the consume
loop ran to completion, so an error raised past the close and a consumer that
stopped reading early never reached it. start_streaming_session never closed at
all and the class exposed no way to do it by hand. A connect that timed out left
its half-open socket and run_forever thread behind too.

Close in a finally on all three generators, add a public close(), and close the
half-open socket before raising the connect timeout.

(cherry picked from commit 7be626d)
The total_count and total_pages candidates were chained with `or`, so a real 0
was skipped for the next candidate and an honestly empty page came back with
total_count None, which reads as "the server did not say". Pick the first
candidate that is not None instead, which is what the has_more line beside it
already did.

(cherry picked from commit 170213b)
requests applies no timeout of its own, so the 28 calls in Audience,
CallAnalytics, Campaign and KB wait forever on a half-open connection.
AgentTools, the fifth helper in the same package, already threads a
request_timeout through every call, so take the same keyword-only param
and default there.

(cherry picked from commit 92a8290)
Task names are not unique. CrewSession derives a handler task's name from the
session, the event and the handler function, so the same event firing twice while
the first handler still runs produces two live tasks with identical names.

Keyed by name, the second evicted the first from the registry, and then the first
task's done handler deleted the second entry by that shared name, so a running
task disappeared from current_tasks() entirely. Key by the task object instead,
and have the session log the names it gets from current_tasks() rather than
reaching into the registry's keys.

(cherry picked from commit 21199c1)
_execute_single already catches every Exception and returns a ToolResult carrying
the call's id, so the fallback in _execute_parallel only ever sees a BaseException.
It built that result with an empty tool_call_id and name, which reaches the model as
{"role": "tool", "tool_call_id": ""}: a tool message has to name the call it
answers, so the request is malformed rather than just uninformative. gather preserves
order, so pair each result with its own call.

CancelledError is the BaseException that actually turns up here. Re-raise it instead
of turning it into a result, so a cancelled turn stops rather than reporting a
fabricated answer for the call.

(cherry picked from commit a5d7ed7)
…te fake-ws list

The parallel-tool and TTS-lifecycle tests failed mypy: @function_tool used in
its documented bare form was rejected because the decorator only typed the
factory form, and the fake WebSocketApp class list had no annotation. Add
@overload signatures so bare and called forms both type-check (fixes the
documented usage for callers too), and annotate the class attribute.
@crim-app

crim-app Bot commented Sep 16, 2026

Copy link
Copy Markdown

crim doesn't review pull requests automatically here.

Comment crim review on this pull request whenever you want a review.

@CaptainAni187

Copy link
Copy Markdown

Thanks for landing these, and for turning #115 and #116 around the same day, both fixes make sense to me. Re-homing the branch so CI could run was a nice touch too.

Happy to pick up more whenever you have something in mind.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants