chore: update codeql config paths to new folders

* chore: update codeql config paths to new folders

* tests: use threading.Condition for event check

---------

Co-authored-by: Lorenze Jay <63378463+lorenzejay@users.noreply.github.com>

.github/codeql/codeql-config.yml

@@ -2,20 +2,27 @@ name: "CodeQL Config"
 
 paths-ignore:
   # Ignore template files - these are boilerplate code that shouldn't be analyzed
-  - "src/crewai/cli/templates/**"
+  - "lib/crewai/src/crewai/cli/templates/**"
   # Ignore test cassettes - these are test fixtures/recordings
-  - "tests/cassettes/**"
+  - "lib/crewai/tests/cassettes/**"
+  - "lib/crewai-tools/tests/cassettes/**"
   # Ignore cache and build artifacts
   - ".cache/**"
   # Ignore documentation build artifacts
   - "docs/.cache/**"
-  
+  # Ignore experimental code
+  - "lib/crewai/src/crewai/experimental/a2a/**"
+
 paths:
-  # Include all Python source code
+  # Include all Python source code from workspace packages
-  - "src/**"
+  - "lib/crewai/src/**"
-  # Include tests (but exclude cassettes)
+  - "lib/crewai-tools/src/**"
-  - "tests/**"
+  - "lib/devtools/src/**"
+  # Include tests (but exclude cassettes via paths-ignore)
+  - "lib/crewai/tests/**"
+  - "lib/crewai-tools/tests/**"
+  - "lib/devtools/tests/**"
 
 # Configure specific queries or packs if needed
 # queries:
-#   - uses: security-and-quality
+#   - uses: security-and-quality

lib/crewai/tests/agents/test_agent.py

@@ -186,17 +186,24 @@ def test_agent_execution_with_tools():
         expected_output="The result of the multiplication.",
     )
     received_events = []
-    event_received = threading.Event()
+    condition = threading.Condition()
+    event_handled = False
 
     @crewai_event_bus.on(ToolUsageFinishedEvent)
     def handle_tool_end(source, event):
+        nonlocal event_handled
         received_events.append(event)
-        event_received.set()
+        with condition:
+            event_handled = True
+            condition.notify()
 
     output = agent.execute_task(task)
     assert output == "The result of the multiplication is 12."
 
-    assert event_received.wait(timeout=5), "Timeout waiting for tool usage event"
+    with condition:
+        if not event_handled:
+            condition.wait(timeout=5)
+    assert event_handled, "Timeout waiting for tool usage event"
     assert len(received_events) == 1
     assert isinstance(received_events[0], ToolUsageFinishedEvent)
     assert received_events[0].tool_name == "multiplier"
@@ -288,12 +295,16 @@ def test_cache_hitting():
         'multiplier-{"first_number": 12, "second_number": 3}': 36,
     }
     received_events = []
-    event_received = threading.Event()
+    condition = threading.Condition()
+    event_handled = False
 
     @crewai_event_bus.on(ToolUsageFinishedEvent)
     def handle_tool_end(source, event):
+        nonlocal event_handled
         received_events.append(event)
-        event_received.set()
+        with condition:
+            event_handled = True
+            condition.notify()
 
     with (
         patch.object(CacheHandler, "read") as read,
@@ -309,7 +320,10 @@ def test_cache_hitting():
         read.assert_called_with(
             tool="multiplier", input='{"first_number": 2, "second_number": 6}'
         )
-        assert event_received.wait(timeout=5), "Timeout waiting for tool usage event"
+        with condition:
+            if not event_handled:
+                condition.wait(timeout=5)
+        assert event_handled, "Timeout waiting for tool usage event"
         assert len(received_events) == 1
         assert isinstance(received_events[0], ToolUsageFinishedEvent)
         assert received_events[0].from_cache

lib/crewai/tests/cassettes/test_agent_with_knowledge_sources_extensive_role.yaml

@@ -987,4 +987,103 @@ interactions:
     status:
       code: 200
       message: OK
+- request:
+    body: '{"trace_id": "51f9439f-9497-420c-a908-4e33f01ffdfc", "execution_type":
+      "crew", "user_identifier": null, "execution_context": {"crew_fingerprint": null,
+      "crew_name": "crew", "flow_name": null, "crewai_version": "1.0.0", "privacy_level":
+      "standard"}, "execution_metadata": {"expected_duration_estimate": 300, "agent_count":
+      0, "task_count": 0, "flow_method_count": 0, "execution_started_at": "2025-10-21T18:21:13.954835+00:00"},
+      "ephemeral_trace_id": "51f9439f-9497-420c-a908-4e33f01ffdfc"}'
+    headers:
+      Accept:
+      - '*/*'
+      Accept-Encoding:
+      - gzip, deflate, zstd
+      Connection:
+      - keep-alive
+      Content-Length:
+      - '488'
+      Content-Type:
+      - application/json
+      User-Agent:
+      - CrewAI-CLI/1.0.0
+      X-Crewai-Version:
+      - 1.0.0
+    method: POST
+    uri: https://app.crewai.com/crewai_plus/api/v1/tracing/ephemeral/batches
+  response:
+    body:
+      string: '{"id":"432de345-a45a-4a02-9259-2ed30a72a9c3","ephemeral_trace_id":"51f9439f-9497-420c-a908-4e33f01ffdfc","execution_type":"crew","crew_name":"crew","flow_name":null,"status":"running","duration_ms":null,"crewai_version":"1.0.0","total_events":0,"execution_context":{"crew_fingerprint":null,"crew_name":"crew","flow_name":null,"crewai_version":"1.0.0","privacy_level":"standard"},"created_at":"2025-10-21T18:21:14.911Z","updated_at":"2025-10-21T18:21:14.911Z","access_code":"TRACE-da9003bc8b","user_identifier":null}'
+    headers:
+      Connection:
+      - keep-alive
+      Content-Length:
+      - '515'
+      Content-Type:
+      - application/json; charset=utf-8
+      Date:
+      - Tue, 21 Oct 2025 18:21:14 GMT
+      cache-control:
+      - no-store
+      content-security-policy:
+      - 'default-src ''self'' *.app.crewai.com app.crewai.com; script-src ''self''
+        ''unsafe-inline'' *.app.crewai.com app.crewai.com https://cdn.jsdelivr.net/npm/apexcharts
+        https://www.gstatic.com https://run.pstmn.io https://apis.google.com https://apis.google.com/js/api.js
+        https://accounts.google.com https://accounts.google.com/gsi/client https://cdnjs.cloudflare.com/ajax/libs/normalize/8.0.1/normalize.min.css.map
+        https://*.google.com https://docs.google.com https://slides.google.com https://js.hs-scripts.com
+        https://js.sentry-cdn.com https://browser.sentry-cdn.com https://www.googletagmanager.com
+        https://js-na1.hs-scripts.com https://js.hubspot.com http://js-na1.hs-scripts.com
+        https://bat.bing.com https://cdn.amplitude.com https://cdn.segment.com https://d1d3n03t5zntha.cloudfront.net/
+        https://descriptusercontent.com https://edge.fullstory.com https://googleads.g.doubleclick.net
+        https://js.hs-analytics.net https://js.hs-banner.com https://js.hsadspixel.net
+        https://js.hscollectedforms.net https://js.usemessages.com https://snap.licdn.com
+        https://static.cloudflareinsights.com https://static.reo.dev https://www.google-analytics.com
+        https://share.descript.com/; style-src ''self'' ''unsafe-inline'' *.app.crewai.com
+        app.crewai.com https://cdn.jsdelivr.net/npm/apexcharts; img-src ''self'' data:
+        *.app.crewai.com app.crewai.com https://zeus.tools.crewai.com https://dashboard.tools.crewai.com
+        https://cdn.jsdelivr.net https://forms.hsforms.com https://track.hubspot.com
+        https://px.ads.linkedin.com https://px4.ads.linkedin.com https://www.google.com
+        https://www.google.com.br; font-src ''self'' data: *.app.crewai.com app.crewai.com;
+        connect-src ''self'' *.app.crewai.com app.crewai.com https://zeus.tools.crewai.com
+        https://connect.useparagon.com/ https://zeus.useparagon.com/* https://*.useparagon.com/*
+        https://run.pstmn.io https://connect.tools.crewai.com/ https://*.sentry.io
+        https://www.google-analytics.com https://edge.fullstory.com https://rs.fullstory.com
+        https://api.hubspot.com https://forms.hscollectedforms.net https://api.hubapi.com
+        https://px.ads.linkedin.com https://px4.ads.linkedin.com https://google.com/pagead/form-data/16713662509
+        https://google.com/ccm/form-data/16713662509 https://www.google.com/ccm/collect
+        https://worker-actionkit.tools.crewai.com https://api.reo.dev; frame-src ''self''
+        *.app.crewai.com app.crewai.com https://connect.useparagon.com/ https://zeus.tools.crewai.com
+        https://zeus.useparagon.com/* https://connect.tools.crewai.com/ https://docs.google.com
+        https://drive.google.com https://slides.google.com https://accounts.google.com
+        https://*.google.com https://app.hubspot.com/ https://td.doubleclick.net https://www.googletagmanager.com/
+        https://www.youtube.com https://share.descript.com'
+      etag:
+      - W/"f377829f71702a4e2096c862a7d4c75e"
+      expires:
+      - '0'
+      permissions-policy:
+      - camera=(), microphone=(self), geolocation=()
+      pragma:
+      - no-cache
+      referrer-policy:
+      - strict-origin-when-cross-origin
+      strict-transport-security:
+      - max-age=63072000; includeSubDomains
+      vary:
+      - Accept
+      x-content-type-options:
+      - nosniff
+      x-frame-options:
+      - SAMEORIGIN
+      x-permitted-cross-domain-policies:
+      - none
+      x-request-id:
+      - b91de61f-e9cf-4748-8346-a7e7a3e43558
+      x-runtime:
+      - '0.674115'
+      x-xss-protection:
+      - 1; mode=block
+    status:
+      code: 201
+      message: Created
 version: 1