[subhashpolisetti]

Related issue

Fixes #8645

Summary

A checkpoint of a crew whose agents hold delegation tools could not be restored: the manager of every
hierarchical crew, or any agent given AgentTools(...).tools(). Crew.from_checkpoint raised a ValidationError
("This field is not to be set by the user") on the coworker agents' saved id.

The BaseTool validator rebuilt a serialized tool with model_validate(data) and dropped the validation context,
so the agents inside BaseAgentTool.agents never saw from_checkpoint. This passes the context through, and
resolves BaseAgentTool.agents with _resolve_agent, the same hook Task.agent and Crew.manager_agent use.

Only checkpoint restore passes a context, so validating tools anywhere else is unchanged, and the id guard still
rejects a user-set id everywhere outside restore. The restored tools are not what a resumed run delegates with:
_update_manager_tools still builds fresh ones from crew.agents per task.

Verification

• Tests added or updated for the changed behavior
• Relevant tests and quality checks pass locally

TestDelegationToolCheckpointRestore covers both paths: a hierarchical crew checkpointed after kickoff() and
resumed with kickoff(from_checkpoint=...) and akickoff(from_checkpoint=...), and an agent with
AgentTools(...).tools() round-tripped through RuntimeState. All three fail on main with the
may_not_set_field error and pass with the fix. test_user_set_coworker_id_still_rejected is a control: a
delegation tool validated without the checkpoint context still rejects a user-set coworker id, on main and with
the fix. The issue repro also restores, and a resumed kickoff() of a
two-task hierarchical crew completes the second task.

• lib/crewai/tests/: 6350 passed, 44 skipped (Python 3.13)
• test_checkpoint.py and tests/tools/agent_tools/ also pass on Python 3.10
• ruff check, ruff format, mypy clean

Additional context

#8596 and #8625 also edit _resolve_tool_dict (callback and Tool.func restore). Neither passes the
context through, so this is independent of both.

[strix-security]

Strix Security Review

Warning

This pull request has 1 commit after the last Strix review (b6d639a). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

✅ No open security findings.

PR summary: Fixes checkpoint restore for crews whose agents hold delegation tools (hierarchical managers and `AgentTools(...).tools()`): the `BaseTool` core-schema validator now forwards the pydantic validation context, and `BaseAgentTool.agents` resolves serialized agents via `_resolve_agent`, so the saved agent ids are no longer rejected as user-set during restore.

Review summary

The two changed source files only thread pydantic's validation context through a wrap validator (no_info_wrap_validator_function → with_info_wrap_validator_function, _resolve_tool_dict(value, info.context)) and apply the existing _resolve_agent hook to BaseAgentTool.agents, with the rest of the diff being tests. I traced the security-relevant controls that this path touches: the tool_type import allowlist in _resolve_tool_dict (_FIRST_PARTY_TOOL_PACKAGES plus the _trusted_deserialize() opt-in) is untouched and still rejects non-first-party tool types before import, and the id guards on Agent, Task and Crew still require an explicit from_checkpoint context key that is only supplied by the RuntimeState/Crew/Flow restore entry points, so nothing lets user-set ids through on ordinary validation or construction. Propagating the context only lets ids already present in a checkpoint payload be accepted one level deeper (inside nested agent/tool dictionaries), which is the intended restore behavior and grants no capability a checkpoint payload did not already have at the top level, while _update_manager_tools still builds fresh delegation tools for the resumed run. No vulnerabilities found in the changed code.

_{Review 1 on this PR · b6d639a · requested Oct 27 05:39 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}