[Raja Gopal (Rajagopalhertzian)]

Summary

Fixes TODO in cache_handler.py to avoid shadowing Python's builtin input() function.

Changes

• Renames input parameter → tool_input in CacheHandler.add() and CacheHandler.read()
• Updates callers in tools_handler.py and agent_executor.py

Testing

• All wiring tests pass (11/12 in test_tool_cache_default.py)
• MyPy type checking passes
• Syntax validation passes

Addresses TODO comments in lib/crewai/src/crewai/agents/cache/cache_handler.py

---

Note

Medium Risk
The public CacheHandler signature changes, but other callers (e.g. native cache writes in agent_executor and paths in agent_utils/project utils) still pass input=, which would raise TypeError until aligned.

Overview
Renames the CacheHandler.add() and CacheHandler.read() keyword argument from input to tool_input so it no longer shadows Python’s builtin input(), and drops the related TODO notes in cache_handler.py.

Call sites in tools_handler.py and one agent_executor.py cache lookup are updated to pass tool_input=; behavior (cache keys still f"{tool}-{tool_input}") is unchanged.

^{Reviewed by Cursor Bugbot for commit 4ec4f5c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[strix-security]

Strix Security Review

To fix before merging (1)

• 🔵 MEDIUM Incomplete CacheHandler parameter rename breaks every remaining input= caller with TypeError — lib/crewai/src/crewai/agents/cache/cache_handler.py:20

PR summary: Renames the `input` argument to `tool_input` in `CacheHandler.add()`/`read()` so it no longer shadows Python's builtin, and updates the callers in `tools_handler.py` and `agent_executor.py`. Several other call sites in the same codebase were not updated.

Review summary

This PR is a cosmetic rename of the input parameter to tool_input on CacheHandler.add() and read() to stop shadowing the builtin, plus updates to the two call sites in tools_handler.py and agent_executor.py. The rename itself changes no security behavior — the cache key, its scope and its lifetime are byte-identical before and after. However, the change is incomplete: five production call sites in agent_utils.py, tool_usage.py, project/utils.py and the second cache.add inside agent_executor.py still pass the removed input= keyword, so every cached tool call now raises TypeError. In the native executor path the exception is swallowed by the broad tool-execution handler after the tool has already run, replacing the real output with an error string, incrementing the task's tool-error counter and telling the model the call failed — which can drive a retry that repeats a non-idempotent side effect. That is captured in "Incomplete CacheHandler parameter rename breaks every remaining input= caller with TypeError".

Ruled out (1)

• Can the shared, identity-less tool-cache key return another agent's or tenant's cached tool result?
  The PR leaves the key format byte-identical (`f"{tool}-{tool_input}"` with the same values), crew-level caching is opt-in and off by default with a per-crew in-memory handler that never crosses a process or tenant, and read keys sanitize the tool name so the '-' separator cannot alias.

_{Fixed the findings? re-run the review, or tag @strix-security in a PR comment to run a fresh review.}

_{Review 1 on this PR · 4ec4f5c · requested Nov 10 18:55 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[github-actions]

Thanks for the pull request.

First-time contributors need an associated open issue before we can review a PR.

1. Open an issue with a template, or pick an existing open one.
2. Open a new PR (or reopen this one) whose title or body mentions that issue, for example #123.

See the contributing guide.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 4ec4f5c. Configure here.}

[cursor]

Incomplete CacheHandler parameter rename

High Severity

Renaming CacheHandler.add/read from input to tool_input left several callers on the old keyword. Native cache writes, ReAct cache lookups, execute_native_tool_call in agent_utils.py, and project @memoize all pass input= and raise TypeError at runtime.

 

^{Reviewed by Cursor Bugbot for commit 4ec4f5c. Configure here.}

[strix-security]

Strix flagged a new security finding below. See the pinned summary comment for the full PR status.

[strix-security]

🔵 Incomplete CacheHandler parameter rename breaks every remaining input= caller with TypeError

Severity: MEDIUM · CWE-628

The pull request renames input to tool_input on CacheHandler.add()/read() but updates only two call sites. Five others still pass the removed input= keyword: agent_executor.py:2369 (cache.add), agent_utils.py:1653 (cache.read) and :1680 (cache.add), tool_usage.py:310/:567 (cache.read), and the memoization wrappers at project/utils.py:81/86/106/111. Since the new signatures accept no input keyword, each raises TypeError: got an unexpected keyword argument 'input' whenever caching is enabled (Crew(cache=True) or Agent(cache=True)). In agent_executor.py the broad tool-execution handler catches it, so the tool runs but its real result is replaced by an error message, the task tool-error counter is incremented, and the model may retry and duplicate a non-idempotent side effect. In agent_utils.py and project/utils.py the failing call sits outside the try and propagates, breaking the tool loop.

Prompt to fix with AI

This is a security vulnerability found during a code review.

Vulnerability: Incomplete `CacheHandler` parameter rename breaks every remaining `input=` caller with `TypeError`
Severity: MEDIUM
CWE: CWE-628

The pull request renames `input` to `tool_input` on `CacheHandler.add()`/`read()` but updates only two call sites. Five others still pass the removed `input=` keyword: `agent_executor.py:2369` (`cache.add`), `agent_utils.py:1653` (`cache.read`) and `:1680` (`cache.add`), `tool_usage.py:310`/`:567` (`cache.read`), and the memoization wrappers at `project/utils.py:81/86/106/111`. Since the new signatures accept no `input` keyword, each raises `TypeError: got an unexpected keyword argument 'input'` whenever caching is enabled (`Crew(cache=True)` or `Agent(cache=True)`). In `agent_executor.py` the broad tool-execution handler catches it, so the tool runs but its real result is replaced by an error message, the task tool-error counter is incremented, and the model may retry and duplicate a non-idempotent side effect. In `agent_utils.py` and `project/utils.py` the failing call sits outside the `try` and propagates, breaking the tool loop.

Location: lib/crewai/src/crewai/agents/cache/cache_handler.py:20-20
Context: renamed `input` to `tool_input` in `add` (root cause)
```
    def add(self, tool: str, tool_input: str, output: Any) -> None:
```

Location: lib/crewai/src/crewai/agents/cache/cache_handler.py:40-40
Context: renamed `input` to `tool_input` in `read` (root cause)
```
    def read(self, tool: str, tool_input: str) -> Any | None:
```

Location: lib/crewai/src/crewai/agents/agent_executor.py:2369-2369
Context: cache write still passes the removed `input` keyword
```
// Before:
                                tool=func_name, input=input_str, output=raw_result
// After:
                                tool=func_name, tool_input=input_str, output=raw_result
```

How to fix:
Update every remaining `CacheHandler` call site to pass the renamed `tool_input` keyword, and land the signature change and the caller updates in the same change. Add a regression test that exercises the cached native-tool path end to end so an incomplete rename is caught. If a staged migration is required, temporarily accept the legacy `input` keyword as an alias so caching cannot fail at runtime.

Please fix this vulnerability. If you propose a fix, make it concise and minimal.

_{React 👍 / 👎 to tune Strix for this repo. A repo collaborator (or the PR author) can resolve this thread to dismiss the finding.}

[strix-security]

renamed input to tool_input in read (root cause)