fix: remove unused pytest import in test_hardcoded_secrets.py

Co-Authored-By: João <joao@crewai.com>
chore: update tool specifications
2026-05-24 18:38:09 +00:00 · 2026-03-26 20:08:59 +00:00 · 2026-03-26 20:04:21 +00:00 · 2026-03-26 20:02:16 +00:00 · 2026-03-27 03:54:10 +08:00 · 2026-03-27 03:36:56 +08:00
31 changed files with 2784 additions and 58 deletions
--- a/.github/workflows/docs-broken-links.yml
+++ b/.github/workflows/docs-broken-links.yml
@@ -23,7 +23,7 @@ jobs:
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
-          node-version: "latest"
+          node-version: "22"

      - name: Install Mintlify CLI
        run: npm i -g mintlify
--- a/docs/ar/changelog.mdx
+++ b/docs/ar/changelog.mdx
@@ -4,6 +4,50 @@ description: "تحديثات المنتج والتحسينات وإصلاحات
 icon: "clock"
 mode: "wide"
 ---
+<Update label="27 مارس 2026">
+  ## v1.13.0a1
+
+  [عرض الإصدار على GitHub](https://github.com/crewAIInc/crewAI/releases/tag/1.13.0a1)
+
+  ## ما الذي تغير
+
+  ### إصلاحات الأخطاء
+  - إصلاح الروابط المعطلة في سير العمل الوثائقي عن طريق تثبيت Node على LTS 22
+  - مسح ذاكرة التخزين المؤقت لـ uv للحزم المنشورة حديثًا في الإصدار المؤسسي
+
+  ### الوثائق
+  - إضافة مصفوفة شاملة لأذونات RBAC ودليل النشر
+  - تحديث سجل التغييرات والإصدار للإصدار v1.12.2
+
+  ## المساهمون
+
+  @greysonlalonde, @iris-clawd, @joaomdmoura
+
+</Update>
+
+<Update label="25 مارس 2026">
+  ## v1.12.2
+
+  [عرض الإصدار على GitHub](https://github.com/crewAIInc/crewAI/releases/tag/1.12.2)
+
+  ## ما الذي تغير
+
+  ### الميزات
+  - إضافة مرحلة إصدار المؤسسات إلى إصدار أدوات المطورين
+
+  ### إصلاحات الأخطاء
+  - الحفاظ على قيمة إرجاع الطريقة كإخراج تدفق لـ @human_feedback مع emit
+
+  ### الوثائق
+  - تحديث سجل التغييرات والإصدار لـ v1.12.1
+  - مراجعة سياسة الأمان وتعليمات الإبلاغ
+
+  ## المساهمون
+
+  @alex-clawd, @greysonlalonde, @joaomdmoura, @theCyberTech
+
+</Update>
+
 <Update label="25 مارس 2026">
  ## v1.12.1

--- a/docs/docs.json
+++ b/docs/docs.json
--- a/docs/en/changelog.mdx
+++ b/docs/en/changelog.mdx
@@ -4,6 +4,50 @@ description: "Product updates, improvements, and bug fixes for CrewAI"
 icon: "clock"
 mode: "wide"
 ---
+<Update label="Mar 27, 2026">
+  ## v1.13.0a1
+
+  [View release on GitHub](https://github.com/crewAIInc/crewAI/releases/tag/1.13.0a1)
+
+  ## What's Changed
+
+  ### Bug Fixes
+  - Fix broken links in documentation workflow by pinning Node to LTS 22
+  - Bust the uv cache for freshly published packages in enterprise release
+
+  ### Documentation
+  - Add comprehensive RBAC permissions matrix and deployment guide
+  - Update changelog and version for v1.12.2
+
+  ## Contributors
+
+  @greysonlalonde, @iris-clawd, @joaomdmoura
+
+</Update>
+
+<Update label="Mar 25, 2026">
+  ## v1.12.2
+
+  [View release on GitHub](https://github.com/crewAIInc/crewAI/releases/tag/1.12.2)
+
+  ## What's Changed
+
+  ### Features
+  - Add enterprise release phase to devtools release
+
+  ### Bug Fixes
+  - Preserve method return value as flow output for @human_feedback with emit
+
+  ### Documentation
+  - Update changelog and version for v1.12.1
+  - Revise security policy and reporting instructions
+
+  ## Contributors
+
+  @alex-clawd, @greysonlalonde, @joaomdmoura, @theCyberTech
+
+</Update>
+
 <Update label="Mar 25, 2026">
  ## v1.12.1

--- a/docs/en/enterprise/features/rbac.mdx
+++ b/docs/en/enterprise/features/rbac.mdx
@@ -7,11 +7,13 @@ mode: "wide"

 ## Overview

-RBAC in CrewAI AMP enables secure, scalable access management through a combination of organization‑level roles and automation‑level visibility controls.
+RBAC in CrewAI AMP enables secure, scalable access management through two layers:
+
+1. **Feature permissions** — control what each role can do across the platform (manage, read, or no access)
+2. **Entity-level permissions** — fine-grained access on individual automations, environment variables, LLM connections, and Git repositories

 <Frame>
  <img src="/images/enterprise/users_and_roles.png" alt="RBAC overview in CrewAI AMP" />
-
 </Frame>

 ## Users and Roles
@@ -39,6 +41,13 @@ You can configure users and roles in Settings → Roles.
  </Step>
 </Steps>

+### Predefined Roles
+
+| Role       | Description                                                                 |
+| :--------- | :-------------------------------------------------------------------------- |
+| **Owner**  | Full access to all features and settings. Cannot be restricted.             |
+| **Member** | Read access to most features, manage access to Studio projects. Cannot modify organization or default settings. |
+
 ### Configuration summary

 | Area                  | Where to configure                 | Options                                 |
@@ -46,23 +55,80 @@ You can configure users and roles in Settings → Roles.
 | Users & Roles         | Settings → Roles                   | Predefined: Owner, Member; Custom roles |
 | Automation visibility | Automation → Settings → Visibility | Private; Whitelist users/roles          |

-## Automation‑level Access Control
+---

-In addition to organization‑wide roles, CrewAI Automations support fine‑grained visibility settings that let you restrict access to specific automations by user or role.
+## Feature Permissions Matrix

-This is useful for:
+Every role has a permission level for each feature area. The three levels are:
+
+- **Manage** — full read/write access (create, edit, delete)
+- **Read** — view-only access
+- **No access** — feature is hidden/inaccessible
+
+| Feature                   | Owner   | Member (default) | Description                                                     |
+| :------------------------ | :------ | :--------------- | :-------------------------------------------------------------- |
+| `usage_dashboards`        | Manage  | Read             | View usage metrics and analytics                                |
+| `crews_dashboards`        | Manage  | Read             | View deployment dashboards, access automation details           |
+| `invitations`             | Manage  | Read             | Invite new members to the organization                          |
+| `training_ui`             | Manage  | Read             | Access training/fine-tuning interfaces                          |
+| `tools`                   | Manage  | Read             | Create and manage tools                                         |
+| `agents`                  | Manage  | Read             | Create and manage agents                                        |
+| `environment_variables`   | Manage  | Read             | Create and manage environment variables                         |
+| `llm_connections`         | Manage  | Read             | Configure LLM provider connections                              |
+| `default_settings`        | Manage  | No access        | Modify organization-wide default settings                       |
+| `organization_settings`   | Manage  | No access        | Manage billing, plans, and organization configuration           |
+| `studio_projects`         | Manage  | Manage           | Create and edit projects in Studio                              |
+
+<Tip>
+  When creating a custom role, you can set each feature independently to **Manage**, **Read**, or **No access** to match your team's needs.
+</Tip>
+
+---
+
+## Deploying from GitHub or Zip
+
+One of the most common RBAC questions is: _"What permissions does a team member need to deploy?"_
+
+### Deploy from GitHub
+
+To deploy an automation from a GitHub repository, a user needs:
+
+1. **`crews_dashboards`**: at least `Read` — required to access the automations dashboard where deployments are created
+2. **Git repository access** (if entity-level RBAC for Git repositories is enabled): the user's role must be granted access to the specific Git repository via entity-level permissions
+3. **`studio_projects`: `Manage`** — if building the crew in Studio before deploying
+
+### Deploy from Zip
+
+To deploy an automation from a Zip file upload, a user needs:
+
+1. **`crews_dashboards`**: at least `Read` — required to access the automations dashboard
+2. **Zip deployments enabled**: the organization must not have disabled zip deployments in organization settings
+
+### Quick Reference: Minimum Permissions for Deployment
+
+| Action               | Required feature permissions          | Additional requirements                          |
+| :------------------- | :------------------------------------ | :----------------------------------------------- |
+| Deploy from GitHub   | `crews_dashboards: Read`              | Git repo entity access (if Git RBAC is enabled)  |
+| Deploy from Zip      | `crews_dashboards: Read`              | Zip deployments must be enabled at the org level |
+| Build in Studio      | `studio_projects: Manage`             | —                                                |
+| Configure LLM keys   | `llm_connections: Manage`             | —                                                |
+| Set environment vars  | `environment_variables: Manage`       | Entity-level access (if entity RBAC is enabled)  |
+
+---
+
+## Automation‑level Access Control (Entity Permissions)
+
+In addition to organization‑wide roles, CrewAI supports fine‑grained entity-level permissions that restrict access to individual resources.
+
+### Automation Visibility
+
+Automations support visibility settings that restrict access by user or role. This is useful for:

 - Keeping sensitive or experimental automations private
 - Managing visibility across large teams or external collaborators
 - Testing automations in isolated contexts

-Deployments can be configured as private, meaning only whitelisted users and roles will be able to:
-
- View the deployment
- Run it or interact with its API
- Access its logs, metrics, and settings
-
-The organization owner always has access, regardless of visibility settings.
+Deployments can be configured as private, meaning only whitelisted users and roles will be able to interact with them.

 You can configure automation‑level access control in Automation → Settings → Visibility tab.

@@ -99,9 +165,92 @@ You can configure automation‑level access control in Automation → Settings

 <Frame>
  <img src="/images/enterprise/visibility.png" alt="Automation Visibility settings in CrewAI AMP" />
-
 </Frame>

+### Deployment Permission Types
+
+When granting entity-level access to a specific automation, you can assign these permission types:
+
+| Permission           | What it allows                                      |
+| :------------------- | :-------------------------------------------------- |
+| `run`                | Execute the automation and use its API               |
+| `traces`             | View execution traces and logs                       |
+| `manage_settings`    | Edit, redeploy, rollback, or delete the automation   |
+| `human_in_the_loop`  | Respond to human-in-the-loop (HITL) requests         |
+| `full_access`        | All of the above                                     |
+
+### Entity-level RBAC for Other Resources
+
+When entity-level RBAC is enabled, access to these resources can also be controlled per user or role:
+
+| Resource               | Controlled by                    | Description                                           |
+| :--------------------- | :------------------------------- | :---------------------------------------------------- |
+| Environment variables  | Entity RBAC feature flag         | Restrict which roles/users can view or manage specific env vars |
+| LLM connections        | Entity RBAC feature flag         | Restrict access to specific LLM provider configurations |
+| Git repositories       | Git repositories RBAC org setting | Restrict which roles/users can access specific connected repos |
+
+---
+
+## Common Role Patterns
+
+While CrewAI ships with Owner and Member roles, most teams benefit from creating custom roles. Here are common patterns:
+
+### Developer Role
+
+A role for team members who build and deploy automations but don't manage organization settings.
+
+| Feature                   | Permission |
+| :------------------------ | :--------- |
+| `usage_dashboards`        | Read       |
+| `crews_dashboards`        | Manage     |
+| `invitations`             | Read       |
+| `training_ui`             | Read       |
+| `tools`                   | Manage     |
+| `agents`                  | Manage     |
+| `environment_variables`   | Manage     |
+| `llm_connections`         | Read       |
+| `default_settings`        | No access  |
+| `organization_settings`   | No access  |
+| `studio_projects`         | Manage     |
+
+### Viewer / Stakeholder Role
+
+A role for non-technical stakeholders who need to monitor automations and view results.
+
+| Feature                   | Permission |
+| :------------------------ | :--------- |
+| `usage_dashboards`        | Read       |
+| `crews_dashboards`        | Read       |
+| `invitations`             | No access  |
+| `training_ui`             | Read       |
+| `tools`                   | Read       |
+| `agents`                  | Read       |
+| `environment_variables`   | No access  |
+| `llm_connections`         | No access  |
+| `default_settings`        | No access  |
+| `organization_settings`   | No access  |
+| `studio_projects`         | Read       |
+
+### Ops / Platform Admin Role
+
+A role for platform operators who manage infrastructure settings but may not build agents.
+
+| Feature                   | Permission |
+| :------------------------ | :--------- |
+| `usage_dashboards`        | Manage     |
+| `crews_dashboards`        | Manage     |
+| `invitations`             | Manage     |
+| `training_ui`             | Read       |
+| `tools`                   | Read       |
+| `agents`                  | Read       |
+| `environment_variables`   | Manage     |
+| `llm_connections`         | Manage     |
+| `default_settings`        | Manage     |
+| `organization_settings`   | Read       |
+| `studio_projects`         | Read       |
+
+---
+
 <Card title="Need Help?" icon="headset" href="mailto:support@crewai.com">
  Contact our support team for assistance with RBAC questions.
 </Card>
--- a/docs/ko/changelog.mdx
+++ b/docs/ko/changelog.mdx
@@ -4,6 +4,50 @@ description: "CrewAI의 제품 업데이트, 개선 사항 및 버그 수정"
 icon: "clock"
 mode: "wide"
 ---
+<Update label="2026년 3월 27일">
+  ## v1.13.0a1
+
+  [GitHub 릴리스 보기](https://github.com/crewAIInc/crewAI/releases/tag/1.13.0a1)
+
+  ## 변경 사항
+
+  ### 버그 수정
+  - Node를 LTS 22로 고정하여 문서 작업 흐름의 끊어진 링크 수정
+  - 기업 릴리스에서 새로 게시된 패키지의 uv 캐시 초기화
+
+  ### 문서
+  - 포괄적인 RBAC 권한 매트릭스 및 배포 가이드 추가
+  - v1.12.2에 대한 변경 로그 및 버전 업데이트
+
+  ## 기여자
+
+  @greysonlalonde, @iris-clawd, @joaomdmoura
+
+</Update>
+
+<Update label="2026년 3월 25일">
+  ## v1.12.2
+
+  [GitHub 릴리스 보기](https://github.com/crewAIInc/crewAI/releases/tag/1.12.2)
+
+  ## 변경 사항
+
+  ### 기능
+  - devtools 릴리스에 기업 릴리스 단계 추가
+
+  ### 버그 수정
+  - @human_feedback과 함께 emit을 사용할 때 메서드 반환 값을 흐름 출력으로 유지
+
+  ### 문서
+  - v1.12.1에 대한 변경 로그 및 버전 업데이트
+  - 보안 정책 및 보고 지침 수정
+
+  ## 기여자
+
+  @alex-clawd, @greysonlalonde, @joaomdmoura, @theCyberTech
+
+</Update>
+
 <Update label="2026년 3월 25일">
  ## v1.12.1

--- a/docs/pt-BR/changelog.mdx
+++ b/docs/pt-BR/changelog.mdx
@@ -4,6 +4,50 @@ description: "Atualizações de produto, melhorias e correções do CrewAI"
 icon: "clock"
 mode: "wide"
 ---
+<Update label="27 mar 2026">
+  ## v1.13.0a1
+
+  [Ver release no GitHub](https://github.com/crewAIInc/crewAI/releases/tag/1.13.0a1)
+
+  ## O que Mudou
+
+  ### Correções de Bugs
+  - Corrigir links quebrados no fluxo de documentação fixando o Node na LTS 22
+  - Limpar o cache uv para pacotes recém-publicados na versão empresarial
+
+  ### Documentação
+  - Adicionar uma matriz abrangente de permissões RBAC e guia de implantação
+  - Atualizar o changelog e a versão para v1.12.2
+
+  ## Contributors
+
+  @greysonlalonde, @iris-clawd, @joaomdmoura
+
+</Update>
+
+<Update label="25 mar 2026">
+  ## v1.12.2
+
+  [Ver release no GitHub](https://github.com/crewAIInc/crewAI/releases/tag/1.12.2)
+
+  ## O que Mudou
+
+  ### Recursos
+  - Adicionar fase de lançamento empresarial ao lançamento do devtools
+
+  ### Correções de Bugs
+  - Preservar o valor de retorno do método como saída de fluxo para @human_feedback com emit
+
+  ### Documentação
+  - Atualizar changelog e versão para v1.12.1
+  - Revisar política de segurança e instruções de relatório
+
+  ## Contributors
+
+  @alex-clawd, @greysonlalonde, @joaomdmoura, @theCyberTech
+
+</Update>
+
 <Update label="25 mar 2026">
  ## v1.12.1

--- a/lib/crewai-files/src/crewai_files/init.py
+++ b/lib/crewai-files/src/crewai_files/init.py
@@ -152,4 +152,4 @@ __all__ = [
    "wrap_file_source",
 ]

-__version__ = "1.12.1"
+__version__ = "1.13.0a1"
--- a/lib/crewai-tools/pyproject.toml
+++ b/lib/crewai-tools/pyproject.toml
@@ -11,7 +11,7 @@ dependencies = [
    "pytube~=15.0.0",
    "requests~=2.32.5",
    "docker~=7.1.0",
-    "crewai==1.12.1",
+    "crewai==1.13.0a1",
    "tiktoken~=0.8.0",
    "beautifulsoup4~=4.13.4",
    "python-docx~=1.2.0",
--- a/lib/crewai-tools/src/crewai_tools/init.py
+++ b/lib/crewai-tools/src/crewai_tools/init.py
@@ -309,4 +309,4 @@ __all__ = [
    "ZapierActionTools",
 ]

-__version__ = "1.12.1"
+__version__ = "1.13.0a1"
--- a/lib/crewai-tools/src/crewai_tools/tools/invoke_crewai_automation_tool/invoke_crewai_automation_tool.py
+++ b/lib/crewai-tools/src/crewai_tools/tools/invoke_crewai_automation_tool/invoke_crewai_automation_tool.py
@@ -25,7 +25,7 @@ class InvokeCrewAIAutomationTool(BaseTool):
        Basic usage:
        >>> tool = InvokeCrewAIAutomationTool(
        ...     crew_api_url="https://api.example.com",
-        ...     crew_bearer_token="your_token",
+        ...     crew_bearer_token=os.environ["CREWAI_BEARER_TOKEN"],
        ...     crew_name="My Crew",
        ...     crew_description="Description of what the crew does",
        ... )
@@ -39,7 +39,7 @@ class InvokeCrewAIAutomationTool(BaseTool):
        ... }
        >>> tool = InvokeCrewAIAutomationTool(
        ...     crew_api_url="https://api.example.com",
-        ...     crew_bearer_token="your_token",
+        ...     crew_bearer_token=os.environ["CREWAI_BEARER_TOKEN"],
        ...     crew_name="My Crew",
        ...     crew_description="Description of what the crew does",
        ...     crew_inputs=custom_inputs,
@@ -49,7 +49,7 @@ class InvokeCrewAIAutomationTool(BaseTool):
        >>> tools = [
        ...     InvokeCrewAIAutomationTool(
        ...         crew_api_url="https://canary-crew-[...].crewai.com",
-        ...         crew_bearer_token="[Your token: abcdef012345]",
+        ...         crew_bearer_token=os.environ["CREWAI_BEARER_TOKEN"],
        ...         crew_name="State of AI Report",
        ...         crew_description="Retrieves a report on state of AI for a given year.",
        ...         crew_inputs={
--- a/lib/crewai-tools/src/crewai_tools/tools/multion_tool/example.py
+++ b/lib/crewai-tools/src/crewai_tools/tools/multion_tool/example.py
@@ -4,9 +4,10 @@ from crewai import Agent, Crew, Task
 from multion_tool import MultiOnTool  # type: ignore[import-not-found]


-os.environ["OPENAI_API_KEY"] = "Your Key"
+if not os.environ.get("OPENAI_API_KEY"):
+    raise ValueError("Please set the OPENAI_API_KEY environment variable")

-multion_browse_tool = MultiOnTool(api_key="Your Key")
+multion_browse_tool = MultiOnTool(api_key=os.environ.get("MULTION_API_KEY", ""))

 # Create a new agent
 Browser = Agent(
--- a/lib/crewai-tools/tool.specs.json
+++ b/lib/crewai-tools/tool.specs.json
@@ -10317,7 +10317,7 @@
            "type": "object"
          }
        },
-        "description": "A CrewAI tool for invoking external crew/flows APIs.\n\nThis tool provides CrewAI Platform API integration with external crew services, supporting:\n- Dynamic input schema configuration\n- Automatic polling for task completion\n- Bearer token authentication\n- Comprehensive error handling\n\nExample:\n    Basic usage:\n    >>> tool = InvokeCrewAIAutomationTool(\n    ...     crew_api_url=\"https://api.example.com\",\n    ...     crew_bearer_token=\"your_token\",\n    ...     crew_name=\"My Crew\",\n    ...     crew_description=\"Description of what the crew does\",\n    ... )\n\n    With custom inputs:\n    >>> custom_inputs = {\n    ...     \"param1\": Field(..., description=\"Description of param1\"),\n    ...     \"param2\": Field(\n    ...         default=\"default_value\", description=\"Description of param2\"\n    ...     ),\n    ... }\n    >>> tool = InvokeCrewAIAutomationTool(\n    ...     crew_api_url=\"https://api.example.com\",\n    ...     crew_bearer_token=\"your_token\",\n    ...     crew_name=\"My Crew\",\n    ...     crew_description=\"Description of what the crew does\",\n    ...     crew_inputs=custom_inputs,\n    ... )\n\nExample:\n    >>> tools = [\n    ...     InvokeCrewAIAutomationTool(\n    ...         crew_api_url=\"https://canary-crew-[...].crewai.com\",\n    ...         crew_bearer_token=\"[Your token: abcdef012345]\",\n    ...         crew_name=\"State of AI Report\",\n    ...         crew_description=\"Retrieves a report on state of AI for a given year.\",\n    ...         crew_inputs={\n    ...             \"year\": Field(\n    ...                 ..., description=\"Year to retrieve the report for (integer)\"\n    ...             )\n    ...         },\n    ...     )\n    ... ]",
+        "description": "A CrewAI tool for invoking external crew/flows APIs.\n\nThis tool provides CrewAI Platform API integration with external crew services, supporting:\n- Dynamic input schema configuration\n- Automatic polling for task completion\n- Bearer token authentication\n- Comprehensive error handling\n\nExample:\n    Basic usage:\n    >>> tool = InvokeCrewAIAutomationTool(\n    ...     crew_api_url=\"https://api.example.com\",\n    ...     crew_bearer_token=os.environ[\"CREWAI_BEARER_TOKEN\"],\n    ...     crew_name=\"My Crew\",\n    ...     crew_description=\"Description of what the crew does\",\n    ... )\n\n    With custom inputs:\n    >>> custom_inputs = {\n    ...     \"param1\": Field(..., description=\"Description of param1\"),\n    ...     \"param2\": Field(\n    ...         default=\"default_value\", description=\"Description of param2\"\n    ...     ),\n    ... }\n    >>> tool = InvokeCrewAIAutomationTool(\n    ...     crew_api_url=\"https://api.example.com\",\n    ...     crew_bearer_token=os.environ[\"CREWAI_BEARER_TOKEN\"],\n    ...     crew_name=\"My Crew\",\n    ...     crew_description=\"Description of what the crew does\",\n    ...     crew_inputs=custom_inputs,\n    ... )\n\nExample:\n    >>> tools = [\n    ...     InvokeCrewAIAutomationTool(\n    ...         crew_api_url=\"https://canary-crew-[...].crewai.com\",\n    ...         crew_bearer_token=os.environ[\"CREWAI_BEARER_TOKEN\"],\n    ...         crew_name=\"State of AI Report\",\n    ...         crew_description=\"Retrieves a report on state of AI for a given year.\",\n    ...         crew_inputs={\n    ...             \"year\": Field(\n    ...                 ..., description=\"Year to retrieve the report for (integer)\"\n    ...             )\n    ...         },\n    ...     )\n    ... ]",
        "properties": {
          "crew_api_url": {
            "title": "Crew Api Url",
--- a/lib/crewai/pyproject.toml
+++ b/lib/crewai/pyproject.toml
@@ -54,7 +54,7 @@ Repository = "https://github.com/crewAIInc/crewAI"

 [project.optional-dependencies]
 tools = [
-    "crewai-tools==1.12.1",
+    "crewai-tools==1.13.0a1",
 ]
 embeddings = [
    "tiktoken~=0.8.0"
--- a/lib/crewai/src/crewai/init.py
+++ b/lib/crewai/src/crewai/init.py
@@ -42,7 +42,7 @@ def _suppress_pydantic_deprecation_warnings() -> None:

 _suppress_pydantic_deprecation_warnings()

-__version__ = "1.12.1"
+__version__ = "1.13.0a1"
 _telemetry_submitted = False


--- a/lib/crewai/src/crewai/cli/create_flow.py
+++ b/lib/crewai/src/crewai/cli/create_flow.py
@@ -28,9 +28,9 @@ def create_flow(name: str) -> None:
    (project_root / "src" / folder_name / "tools").mkdir(parents=True)
    (project_root / "tests").mkdir(exist_ok=True)

-    # Create .env file
+    # Create .env file with placeholder
    with open(project_root / ".env", "w") as file:
-        file.write("OPENAI_API_KEY=YOUR_API_KEY")
+        file.write("OPENAI_API_KEY=\n")

    package_dir = Path(__file__).parent
    templates_dir = package_dir / "templates" / "flow"
--- a/lib/crewai/src/crewai/cli/templates/crew/pyproject.toml
+++ b/lib/crewai/src/crewai/cli/templates/crew/pyproject.toml
@@ -5,7 +5,7 @@ description = "{{name}} using crewAI"
 authors = [{ name = "Your Name", email = "you@example.com" }]
 requires-python = ">=3.10,<3.14"
 dependencies = [
-    "crewai[tools]==1.12.1"
+    "crewai[tools]==1.13.0a1"
 ]

 [project.scripts]
--- a/lib/crewai/src/crewai/cli/templates/flow/pyproject.toml
+++ b/lib/crewai/src/crewai/cli/templates/flow/pyproject.toml
@@ -5,7 +5,7 @@ description = "{{name}} using crewAI"
 authors = [{ name = "Your Name", email = "you@example.com" }]
 requires-python = ">=3.10,<3.14"
 dependencies = [
-    "crewai[tools]==1.12.1"
+    "crewai[tools]==1.13.0a1"
 ]

 [project.scripts]
--- a/lib/crewai/src/crewai/cli/templates/tool/pyproject.toml
+++ b/lib/crewai/src/crewai/cli/templates/tool/pyproject.toml
@@ -5,7 +5,7 @@ description = "Power up your crews with {{folder_name}}"
 readme = "README.md"
 requires-python = ">=3.10,<3.14"
 dependencies = [
-    "crewai[tools]==1.12.1"
+    "crewai[tools]==1.13.0a1"
 ]

 [tool.crewai]
--- a/lib/crewai/src/crewai/flow/flow.py
+++ b/lib/crewai/src/crewai/flow/flow.py
@@ -883,6 +883,9 @@ class Flow(Generic[T], metaclass=FlowMeta):
        self.human_feedback_history: list[HumanFeedbackResult] = []
        self.last_human_feedback: HumanFeedbackResult | None = None
        self._pending_feedback_context: PendingFeedbackContext | None = None
+        # Per-method stash for real @human_feedback output (keyed by method name)
+        # Used to decouple routing outcome from method return value when emit is set
+        self._human_feedback_method_outputs: dict[str, Any] = {}
        self.suppress_flow_events: bool = suppress_flow_events

        # User input history (for self.ask())
@@ -2290,6 +2293,17 @@ class Flow(Generic[T], metaclass=FlowMeta):
                result = await result

            self._method_outputs.append(result)
+
+            # For @human_feedback methods with emit, the result is the collapsed outcome
+            # (e.g., "approved") used for routing. But we want the actual method output
+            # to be the stored result (for final flow output). Replace the last entry
+            # if a stashed output exists. Dict-based stash is concurrency-safe and
+            # handles None return values (presence in dict = stashed, not value).
+            if method_name in self._human_feedback_method_outputs:
+                self._method_outputs[-1] = self._human_feedback_method_outputs.pop(
+                    method_name
+                )
+
            self._method_execution_counts[method_name] = (
                self._method_execution_counts.get(method_name, 0) + 1
            )
--- a/lib/crewai/src/crewai/flow/human_feedback.py
+++ b/lib/crewai/src/crewai/flow/human_feedback.py
@@ -591,6 +591,13 @@ def human_feedback(
                ):
                    _distill_and_store_lessons(self, method_output, raw_feedback)

+                # Stash the real method output for final flow result when emit is set
+                # (result is the collapsed outcome string for routing, but we want to
+                # preserve the actual method output as the flow's final result)
+                # Uses per-method dict for concurrency safety and to handle None returns
+                if emit:
+                    self._human_feedback_method_outputs[func.__name__] = method_output
+
                return result

            wrapper: Any = async_wrapper
@@ -615,6 +622,13 @@ def human_feedback(
                ):
                    _distill_and_store_lessons(self, method_output, raw_feedback)

+                # Stash the real method output for final flow result when emit is set
+                # (result is the collapsed outcome string for routing, but we want to
+                # preserve the actual method output as the flow's final result)
+                # Uses per-method dict for concurrency safety and to handle None returns
+                if emit:
+                    self._human_feedback_method_outputs[func.__name__] = method_output
+
                return result

            wrapper = sync_wrapper
--- a/lib/crewai/src/crewai/llms/providers/openai_compatible/completion.py
+++ b/lib/crewai/src/crewai/llms/providers/openai_compatible/completion.py
@@ -59,21 +59,21 @@ OPENAI_COMPATIBLE_PROVIDERS: dict[str, ProviderConfig] = {
        api_key_env="OLLAMA_API_KEY",
        base_url_env="OLLAMA_HOST",
        api_key_required=False,
-        default_api_key="ollama",
+        default_api_key=os.getenv("OLLAMA_DEFAULT_API_KEY", "ollama"),
    ),
    "ollama_chat": ProviderConfig(
        base_url="http://localhost:11434/v1",
        api_key_env="OLLAMA_API_KEY",
        base_url_env="OLLAMA_HOST",
        api_key_required=False,
-        default_api_key="ollama",
+        default_api_key=os.getenv("OLLAMA_DEFAULT_API_KEY", "ollama"),
    ),
    "hosted_vllm": ProviderConfig(
        base_url="http://localhost:8000/v1",
        api_key_env="VLLM_API_KEY",
        base_url_env="VLLM_BASE_URL",
        api_key_required=False,
-        default_api_key="dummy",
+        default_api_key=os.getenv("VLLM_DEFAULT_API_KEY", "no-key-required"),
    ),
    "cerebras": ProviderConfig(
        base_url="https://api.cerebras.ai/v1",
--- a/lib/crewai/src/crewai/rag/embeddings/factory.py
+++ b/lib/crewai/src/crewai/rag/embeddings/factory.py
@@ -363,11 +363,11 @@ def build_embedder(spec):  # type: ignore[no-untyped-def]
        # From dictionary specification
        embedder = build_embedder({
            "provider": "openai",
-            "config": {"api_key": "sk-..."}
+            "config": {"api_key": os.environ["OPENAI_API_KEY"]}
        })

        # From provider instance
-        provider = OpenAIProvider(api_key="sk-...")
+        provider = OpenAIProvider(api_key=os.environ["OPENAI_API_KEY"])
        embedder = build_embedder(provider)
    """
    if isinstance(spec, BaseEmbeddingsProvider):
--- a/lib/crewai/src/crewai/rag/embeddings/providers/google/genai_vertex_embedding.py
+++ b/lib/crewai/src/crewai/rag/embeddings/providers/google/genai_vertex_embedding.py
@@ -45,9 +45,9 @@ class GoogleGenAIVertexEmbeddingFunction(EmbeddingFunction[Documents]):
            model_name="gemini-embedding-001"
        )

-        # Using API key (new SDK only)
+        # Using API key from environment variable (new SDK only)
        embedder = GoogleGenAIVertexEmbeddingFunction(
-            api_key="your-api-key",
+            api_key=os.environ["GOOGLE_API_KEY"],
            model_name="gemini-embedding-001"
        )
    """
--- a/lib/crewai/src/crewai/rag/embeddings/providers/google/vertex.py
+++ b/lib/crewai/src/crewai/rag/embeddings/providers/google/vertex.py
@@ -49,9 +49,9 @@ class VertexAIProvider(BaseEmbeddingsProvider[GoogleGenAIVertexEmbeddingFunction
            model_name="gemini-embedding-001"
        )

-        # New model with API key
+        # New model with API key (from environment variable)
        provider = VertexAIProvider(
-            api_key="your-api-key",
+            api_key=os.environ["GOOGLE_API_KEY"],
            model_name="gemini-embedding-001"
        )
    """
--- a/lib/crewai/tests/llms/openai_compatible/test_openai_compatible.py
+++ b/lib/crewai/tests/llms/openai_compatible/test_openai_compatible.py
@@ -79,7 +79,7 @@ class TestProviderRegistry:
        assert config.base_url == "http://localhost:8000/v1"
        assert config.api_key_env == "VLLM_API_KEY"
        assert config.api_key_required is False
-        assert config.default_api_key == "dummy"
+        assert config.default_api_key == "no-key-required"

    def test_cerebras_config(self):
        """Test Cerebras provider configuration."""
--- a/lib/crewai/tests/security/test_hardcoded_secrets.py
+++ b/lib/crewai/tests/security/test_hardcoded_secrets.py
@@ -0,0 +1,184 @@
+"""Tests to detect and prevent hardcoded secrets in the codebase.
+
+These tests scan source files for patterns that look like hardcoded secrets
+(API keys, tokens, passwords) to prevent accidental credential leaks.
+"""
+
+import os
+import re
+import tempfile
+from pathlib import Path
+from unittest.mock import patch
+
+from crewai.cli.create_flow import create_flow
+from crewai.llms.providers.openai_compatible.completion import (
+    OPENAI_COMPATIBLE_PROVIDERS,
+)
+
+# Root of the workspace
+WORKSPACE_ROOT = Path(__file__).resolve().parents[4]
+CREWAI_SRC = WORKSPACE_ROOT / "lib" / "crewai" / "src"
+CREWAI_TOOLS_SRC = WORKSPACE_ROOT / "lib" / "crewai-tools" / "src"
+
+# Patterns that indicate hardcoded secrets in source code (not docs/tests)
+SECRET_PATTERNS = [
+    # Actual API key formats
+    re.compile(r'''["']sk-proj-[a-zA-Z0-9_-]{20,}["']'''),
+    re.compile(r'''["']sk-ant-api[a-zA-Z0-9_-]{20,}["']'''),
+    re.compile(r'''["']ghp_[a-zA-Z0-9]{36}["']'''),
+    re.compile(r'''["']gho_[a-zA-Z0-9]{36}["']'''),
+    re.compile(r'''["']xox[bpas]-[a-zA-Z0-9-]{10,}["']'''),
+    re.compile(r'''["']AKIA[A-Z0-9]{16}["']'''),
+    # os.environ assignment with hardcoded non-empty value
+    re.compile(r'''os\.environ\[["'][A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)["']\]\s*=\s*["'][^"']+["']'''),
+]
+
+# Files/directories to skip (tests, docs, examples patterns in docstrings are OK)
+SKIP_DIRS = {
+    "tests",
+    "test",
+    "__pycache__",
+    ".git",
+    "cassettes",
+    "node_modules",
+    ".venv",
+}
+
+
+def _get_python_source_files(root: Path) -> list[Path]:
+    """Get all Python source files, excluding test directories."""
+    files = []
+    for path in root.rglob("*.py"):
+        parts = set(path.parts)
+        if parts & SKIP_DIRS:
+            continue
+        files.append(path)
+    return files
+
+
+class TestNoHardcodedSecrets:
+    """Test that source code does not contain hardcoded secrets."""
+
+    def test_no_real_api_keys_in_source(self):
+        """Verify no real API key patterns exist in source code."""
+        violations = []
+
+        for src_root in [CREWAI_SRC, CREWAI_TOOLS_SRC]:
+            if not src_root.exists():
+                continue
+            for filepath in _get_python_source_files(src_root):
+                content = filepath.read_text(errors="ignore")
+                for pattern in SECRET_PATTERNS:
+                    for match in pattern.finditer(content):
+                        # Get the line number
+                        line_num = content[: match.start()].count("\n") + 1
+                        violations.append(
+                            f"{filepath.relative_to(WORKSPACE_ROOT)}:{line_num}: {match.group()}"
+                        )
+
+        assert not violations, (
+            f"Found {len(violations)} potential hardcoded secret(s):\n"
+            + "\n".join(violations)
+        )
+
+    def test_no_env_assignment_with_hardcoded_keys(self):
+        """Verify no os.environ['KEY'] = 'hardcoded-value' patterns in source (non-test) code."""
+        pattern = re.compile(
+            r'''os\.environ\[["'](\w*(?:KEY|TOKEN|SECRET|PASSWORD)\w*)["']\]\s*=\s*["']([^"']+)["']'''
+        )
+        # Config flags that are not secrets
+        ALLOWED_ENV_ASSIGNMENTS = {
+            "TOKENIZERS_PARALLELISM",
+        }
+
+        violations = []
+        for src_root in [CREWAI_SRC, CREWAI_TOOLS_SRC]:
+            if not src_root.exists():
+                continue
+            for filepath in _get_python_source_files(src_root):
+                content = filepath.read_text(errors="ignore")
+                for match in pattern.finditer(content):
+                    env_var_name = match.group(1)
+                    if env_var_name in ALLOWED_ENV_ASSIGNMENTS:
+                        continue
+                    line_num = content[: match.start()].count("\n") + 1
+                    violations.append(
+                        f"{filepath.relative_to(WORKSPACE_ROOT)}:{line_num}: "
+                        f"os.environ['{match.group(1)}'] = '{match.group(2)}'"
+                    )
+
+        assert not violations, (
+            f"Found {len(violations)} hardcoded environment variable assignment(s):\n"
+            + "\n".join(violations)
+            + "\n\nUse os.environ.get() or read from .env files instead."
+        )
+
+
+class TestCreateFlowEnvFile:
+    """Test that create_flow generates .env files without hardcoded secret values."""
+
+    def test_create_flow_env_file_has_no_hardcoded_api_key(self):
+        """Verify create_flow does not write a hardcoded API key value."""
+        with tempfile.TemporaryDirectory() as temp_dir:
+            original_cwd = os.getcwd()
+            try:
+                os.chdir(temp_dir)
+                create_flow("test_flow")
+
+                env_file = Path(temp_dir) / "test_flow" / ".env"
+                assert env_file.exists(), ".env file should be created"
+
+                content = env_file.read_text()
+                assert "YOUR_API_KEY" not in content, (
+                    ".env should not contain hardcoded placeholder 'YOUR_API_KEY'"
+                )
+                # The key name should be present but without a hardcoded value
+                assert "OPENAI_API_KEY" in content, (
+                    ".env should contain the OPENAI_API_KEY variable name"
+                )
+            finally:
+                os.chdir(original_cwd)
+
+
+class TestProviderDefaultApiKeys:
+    """Test that provider default API keys use environment variable lookups."""
+
+    def test_ollama_default_api_key_from_env(self):
+        """Verify Ollama default API key can be overridden via environment variable."""
+        with patch.dict(os.environ, {"OLLAMA_DEFAULT_API_KEY": "custom-ollama-key"}, clear=False):
+            # Re-import to pick up new env var - but since module-level dict is already
+            # evaluated, we test the env var pattern is used in the config
+            config = OPENAI_COMPATIBLE_PROVIDERS["ollama"]
+            # The default_api_key should be set (either from env or fallback)
+            assert config.default_api_key is not None
+
+    def test_vllm_default_api_key_not_dummy(self):
+        """Verify hosted_vllm default API key is not the literal string 'dummy'."""
+        config = OPENAI_COMPATIBLE_PROVIDERS["hosted_vllm"]
+        assert config.default_api_key != "dummy", (
+            "hosted_vllm should not use 'dummy' as a hardcoded default API key"
+        )
+        assert config.default_api_key is not None
+
+    def test_ollama_default_api_key_fallback(self):
+        """Verify Ollama uses 'ollama' as fallback when env var is not set."""
+        # When OLLAMA_DEFAULT_API_KEY is not set, should fall back to "ollama"
+        env = os.environ.copy()
+        env.pop("OLLAMA_DEFAULT_API_KEY", None)
+        with patch.dict(os.environ, env, clear=True):
+            # The config was already created at module load time, so we check
+            # the current value
+            config = OPENAI_COMPATIBLE_PROVIDERS["ollama"]
+            assert config.default_api_key is not None
+
+    def test_all_providers_have_valid_config(self):
+        """Verify all providers have properly configured API key settings."""
+        for provider_name, config in OPENAI_COMPATIBLE_PROVIDERS.items():
+            assert config.api_key_env, (
+                f"Provider '{provider_name}' must have api_key_env configured"
+            )
+            if not config.api_key_required:
+                assert config.default_api_key is not None, (
+                    f"Provider '{provider_name}' with api_key_required=False "
+                    "must have a default_api_key"
+                )
--- a/lib/crewai/tests/test_human_feedback_decorator.py
+++ b/lib/crewai/tests/test_human_feedback_decorator.py
@@ -246,7 +246,7 @@ class TestHumanFeedbackExecution:
    @patch("builtins.input", return_value="")
    @patch("builtins.print")
    def test_empty_feedback_with_default_outcome(self, mock_print, mock_input):
-        """Test empty feedback uses default_outcome."""
+        """Test empty feedback uses default_outcome for routing, but flow returns method output."""

        class TestFlow(Flow):
            @start()
@@ -264,14 +264,16 @@ class TestHumanFeedbackExecution:
        with patch.object(flow, "_request_human_feedback", return_value=""):
            result = flow.kickoff()

-        assert result == "needs_work"
+        # Flow result is the method's return value, NOT the collapsed outcome
+        assert result == "Content"
        assert flow.last_human_feedback is not None
+        # But the outcome is still correctly set for routing purposes
        assert flow.last_human_feedback.outcome == "needs_work"

    @patch("builtins.input", return_value="Approved!")
    @patch("builtins.print")
    def test_feedback_collapsing(self, mock_print, mock_input):
-        """Test that feedback is collapsed to an outcome."""
+        """Test that feedback is collapsed to an outcome for routing, but flow returns method output."""

        class TestFlow(Flow):
            @start()
@@ -291,8 +293,10 @@ class TestHumanFeedbackExecution:
        ):
            result = flow.kickoff()

-        assert result == "approved"
+        # Flow result is the method's return value, NOT the collapsed outcome
+        assert result == "Content"
        assert flow.last_human_feedback is not None
+        # But the outcome is still correctly set for routing purposes
        assert flow.last_human_feedback.outcome == "approved"


@@ -591,3 +595,162 @@ class TestHumanFeedbackLearn:
        assert config.learn is True
        # llm defaults to "gpt-4o-mini" at the function level
        assert config.llm == "gpt-4o-mini"
+
+
+class TestHumanFeedbackFinalOutputPreservation:
+    """Tests for preserving method return value as flow's final output when @human_feedback with emit is terminal.
+
+    This addresses the bug where the flow's final output was the collapsed outcome string (e.g., 'approved')
+    instead of the method's actual return value when a @human_feedback method with emit is the final method.
+    """
+
+    @patch("builtins.input", return_value="Looks good!")
+    @patch("builtins.print")
+    def test_final_output_is_method_return_not_collapsed_outcome(
+        self, mock_print, mock_input
+    ):
+        """When @human_feedback with emit is the final method, flow output is the method's return value."""
+
+        class FinalHumanFeedbackFlow(Flow):
+            @start()
+            @human_feedback(
+                message="Review this content:",
+                emit=["approved", "rejected"],
+                llm="gpt-4o-mini",
+            )
+            def generate_and_review(self):
+                # This dict should be the final output, NOT the string 'approved'
+                return {"title": "My Article", "content": "Article content here", "status": "ready"}
+
+        flow = FinalHumanFeedbackFlow()
+
+        with (
+            patch.object(flow, "_request_human_feedback", return_value="Looks great, approved!"),
+            patch.object(flow, "_collapse_to_outcome", return_value="approved"),
+        ):
+            result = flow.kickoff()
+
+        # The final output should be the actual method return value, not the collapsed outcome
+        assert isinstance(result, dict), f"Expected dict, got {type(result).__name__}: {result}"
+        assert result == {"title": "My Article", "content": "Article content here", "status": "ready"}
+        # But the outcome should still be tracked in last_human_feedback
+        assert flow.last_human_feedback is not None
+        assert flow.last_human_feedback.outcome == "approved"
+
+    @patch("builtins.input", return_value="approved")
+    @patch("builtins.print")
+    def test_routing_still_works_with_downstream_listener(self, mock_print, mock_input):
+        """When @human_feedback has a downstream listener, routing still triggers the listener."""
+        publish_called = []
+
+        class RoutingFlow(Flow):
+            @start()
+            @human_feedback(
+                message="Review:",
+                emit=["approved", "rejected"],
+                llm="gpt-4o-mini",
+            )
+            def review(self):
+                return {"content": "original content"}
+
+            @listen("approved")
+            def publish(self):
+                publish_called.append(True)
+                return {"published": True, "timestamp": "2024-01-01"}
+
+        flow = RoutingFlow()
+
+        with (
+            patch.object(flow, "_request_human_feedback", return_value="LGTM"),
+            patch.object(flow, "_collapse_to_outcome", return_value="approved"),
+        ):
+            result = flow.kickoff()
+
+        # The downstream listener should have been triggered
+        assert len(publish_called) == 1, "publish() should have been called"
+        # The final output should be from the listener, not the human_feedback method
+        assert result == {"published": True, "timestamp": "2024-01-01"}
+
+    @patch("builtins.input", return_value="")
+    @patch("builtins.print")
+    @pytest.mark.asyncio
+    async def test_async_human_feedback_final_output_preserved(self, mock_print, mock_input):
+        """Async @human_feedback methods also preserve the real return value."""
+
+        class AsyncFinalFlow(Flow):
+            @start()
+            @human_feedback(
+                message="Review async content:",
+                emit=["approved", "rejected"],
+                llm="gpt-4o-mini",
+                default_outcome="approved",
+            )
+            async def async_generate(self):
+                return {"async_data": "value", "computed": 42}
+
+        flow = AsyncFinalFlow()
+
+        with (
+            patch.object(flow, "_request_human_feedback", return_value=""),
+        ):
+            result = await flow.kickoff_async()
+
+        # The final output should be the dict, not "approved"
+        assert isinstance(result, dict), f"Expected dict, got {type(result).__name__}: {result}"
+        assert result == {"async_data": "value", "computed": 42}
+        assert flow.last_human_feedback.outcome == "approved"
+
+    @patch("builtins.input", return_value="feedback")
+    @patch("builtins.print")
+    def test_method_outputs_contains_real_output(self, mock_print, mock_input):
+        """The _method_outputs list should contain the real method output, not the collapsed outcome."""
+
+        class OutputTrackingFlow(Flow):
+            @start()
+            @human_feedback(
+                message="Review:",
+                emit=["approved", "rejected"],
+                llm="gpt-4o-mini",
+            )
+            def generate(self):
+                return {"data": "real output"}
+
+        flow = OutputTrackingFlow()
+
+        with (
+            patch.object(flow, "_request_human_feedback", return_value="approved"),
+            patch.object(flow, "_collapse_to_outcome", return_value="approved"),
+        ):
+            flow.kickoff()
+
+        # _method_outputs should contain the real output
+        assert len(flow._method_outputs) == 1
+        assert flow._method_outputs[0] == {"data": "real output"}
+
+    @patch("builtins.input", return_value="looks good")
+    @patch("builtins.print")
+    def test_none_return_value_is_preserved(self, mock_print, mock_input):
+        """A method returning None should preserve None as flow output, not the outcome string."""
+
+        class NoneReturnFlow(Flow):
+            @start()
+            @human_feedback(
+                message="Review:",
+                emit=["approved", "rejected"],
+                llm="gpt-4o-mini",
+            )
+            def process(self):
+                # Method does work but returns None (implicit)
+                pass
+
+        flow = NoneReturnFlow()
+
+        with (
+            patch.object(flow, "_request_human_feedback", return_value=""),
+            patch.object(flow, "_collapse_to_outcome", return_value="approved"),
+        ):
+            result = flow.kickoff()
+
+        # Final output should be None (the method's real return), not "approved"
+        assert result is None, f"Expected None, got {result!r}"
+        assert flow.last_human_feedback.outcome == "approved"
--- a/lib/crewai/tests/test_human_feedback_integration.py
+++ b/lib/crewai/tests/test_human_feedback_integration.py
@@ -708,7 +708,7 @@ class TestEdgeCases:
    @patch("builtins.input", return_value="")
    @patch("builtins.print")
    def test_empty_feedback_first_outcome_fallback(self, mock_print, mock_input):
-        """Test that empty feedback without default uses first outcome."""
+        """Test that empty feedback without default uses first outcome for routing, but returns method output."""

        class FallbackFlow(Flow):
            @start()
@@ -726,12 +726,15 @@ class TestEdgeCases:
        with patch.object(flow, "_request_human_feedback", return_value=""):
            result = flow.kickoff()

-        assert result == "first"  # Falls back to first outcome
+        # Flow result is the method's return value, NOT the collapsed outcome
+        assert result == "content"
+        # But outcome is still set to first for routing purposes
+        assert flow.last_human_feedback.outcome == "first"

    @patch("builtins.input", return_value="whitespace only   ")
    @patch("builtins.print")
    def test_whitespace_only_feedback_treated_as_empty(self, mock_print, mock_input):
-        """Test that whitespace-only feedback is treated as empty."""
+        """Test that whitespace-only feedback is treated as empty for routing, but returns method output."""

        class WhitespaceFlow(Flow):
            @start()
@@ -749,7 +752,10 @@ class TestEdgeCases:
        with patch.object(flow, "_request_human_feedback", return_value="   "):
            result = flow.kickoff()

-        assert result == "reject"  # Uses default because feedback is empty after strip
+        # Flow result is the method's return value, NOT the collapsed outcome
+        assert result == "content"
+        # But outcome is set to default because feedback is empty after strip
+        assert flow.last_human_feedback.outcome == "reject"

    @patch("builtins.input", return_value="feedback")
    @patch("builtins.print")
--- a/lib/devtools/src/crewai_devtools/init.py
+++ b/lib/devtools/src/crewai_devtools/init.py
@@ -1,3 +1,3 @@
 """CrewAI development tools."""

-__version__ = "1.12.1"
+__version__ = "1.13.0a1"
--- a/lib/devtools/src/crewai_devtools/cli.py
+++ b/lib/devtools/src/crewai_devtools/cli.py
@@ -156,6 +156,33 @@ def update_version_in_file(file_path: Path, new_version: str) -> bool:
    return False


+def update_pyproject_version(file_path: Path, new_version: str) -> bool:
+    """Update the [project] version field in a pyproject.toml file.
+
+    Args:
+        file_path: Path to pyproject.toml file.
+        new_version: New version string.
+
+    Returns:
+        True if version was updated, False otherwise.
+    """
+    if not file_path.exists():
+        return False
+
+    content = file_path.read_text()
+    new_content = re.sub(
+        r'^(version\s*=\s*")[^"]+(")',
+        rf"\g<1>{new_version}\2",
+        content,
+        count=1,
+        flags=re.MULTILINE,
+    )
+    if new_content != content:
+        file_path.write_text(new_content)
+        return True
+    return False
+
+
 _DEFAULT_WORKSPACE_PACKAGES: Final[list[str]] = [
    "crewai",
    "crewai-tools",
@@ -1045,10 +1072,84 @@ def _update_enterprise_crewai_dep(pyproject_path: Path, version: str) -> bool:
    return False


+_DEPLOYMENT_TEST_REPO: Final[str] = "crewAIInc/crew_deployment_test"
+
 _PYPI_POLL_INTERVAL: Final[int] = 15
 _PYPI_POLL_TIMEOUT: Final[int] = 600


+def _update_deployment_test_repo(version: str, is_prerelease: bool) -> None:
+    """Update the deployment test repo to pin the new crewai version.
+
+    Clones the repo, updates the crewai[tools] pin in pyproject.toml,
+    regenerates the lockfile, commits, and pushes directly to main.
+
+    Args:
+        version: New crewai version string.
+        is_prerelease: Whether this is a pre-release version.
+    """
+    console.print(
+        f"\n[bold cyan]Updating {_DEPLOYMENT_TEST_REPO} to {version}[/bold cyan]"
+    )
+
+    with tempfile.TemporaryDirectory() as tmp:
+        repo_dir = Path(tmp) / "crew_deployment_test"
+        run_command(["gh", "repo", "clone", _DEPLOYMENT_TEST_REPO, str(repo_dir)])
+        console.print(f"[green]✓[/green] Cloned {_DEPLOYMENT_TEST_REPO}")
+
+        pyproject = repo_dir / "pyproject.toml"
+        content = pyproject.read_text()
+        new_content = re.sub(
+            r'"crewai\[tools\]==[^"]+"',
+            f'"crewai[tools]=={version}"',
+            content,
+        )
+        if new_content == content:
+            console.print(
+                "[yellow]Warning:[/yellow] No crewai[tools] pin found to update"
+            )
+            return
+        pyproject.write_text(new_content)
+        console.print(f"[green]✓[/green] Updated crewai[tools] pin to {version}")
+
+        lock_cmd = [
+            "uv",
+            "lock",
+            "--refresh-package",
+            "crewai",
+            "--refresh-package",
+            "crewai-tools",
+        ]
+        if is_prerelease:
+            lock_cmd.append("--prerelease=allow")
+
+        max_retries = 10
+        for attempt in range(1, max_retries + 1):
+            try:
+                run_command(lock_cmd, cwd=repo_dir)
+                break
+            except subprocess.CalledProcessError:
+                if attempt == max_retries:
+                    console.print(
+                        f"[red]Error:[/red] uv lock failed after {max_retries} attempts"
+                    )
+                    raise
+                console.print(
+                    f"[yellow]uv lock failed (attempt {attempt}/{max_retries}),"
+                    f" retrying in {_PYPI_POLL_INTERVAL}s...[/yellow]"
+                )
+                time.sleep(_PYPI_POLL_INTERVAL)
+        console.print("[green]✓[/green] Lockfile updated")
+
+        run_command(["git", "add", "pyproject.toml", "uv.lock"], cwd=repo_dir)
+        run_command(
+            ["git", "commit", "-m", f"chore: bump crewai to {version}"],
+            cwd=repo_dir,
+        )
+        run_command(["git", "push"], cwd=repo_dir)
+        console.print(f"[green]✓[/green] Pushed to {_DEPLOYMENT_TEST_REPO}")
+
+
 def _wait_for_pypi(package: str, version: str) -> None:
    """Poll PyPI until a specific package version is available.

@@ -1141,6 +1242,11 @@ def _release_enterprise(version: str, is_prerelease: bool, dry_run: bool) -> Non

            pyproject = pkg_dir / "pyproject.toml"
            if pyproject.exists():
+                if update_pyproject_version(pyproject, version):
+                    console.print(
+                        f"[green]✓[/green] Updated version in: "
+                        f"{pyproject.relative_to(repo_dir)}"
+                    )
                if update_pyproject_dependencies(
                    pyproject, version, extra_packages=list(_ENTERPRISE_EXTRA_PACKAGES)
                ):
@@ -1159,7 +1265,35 @@ def _release_enterprise(version: str, is_prerelease: bool, dry_run: bool) -> Non
        _wait_for_pypi("crewai", version)

        console.print("\nSyncing workspace...")
-        run_command(["uv", "sync"], cwd=repo_dir)
+        sync_cmd = [
+            "uv",
+            "sync",
+            "--refresh-package",
+            "crewai",
+            "--refresh-package",
+            "crewai-tools",
+            "--refresh-package",
+            "crewai-files",
+        ]
+        if is_prerelease:
+            sync_cmd.append("--prerelease=allow")
+
+        max_retries = 10
+        for attempt in range(1, max_retries + 1):
+            try:
+                run_command(sync_cmd, cwd=repo_dir)
+                break
+            except subprocess.CalledProcessError:
+                if attempt == max_retries:
+                    console.print(
+                        f"[red]Error:[/red] uv sync failed after {max_retries} attempts"
+                    )
+                    raise
+                console.print(
+                    f"[yellow]uv sync failed (attempt {attempt}/{max_retries}),"
+                    f" retrying in {_PYPI_POLL_INTERVAL}s...[/yellow]"
+                )
+                time.sleep(_PYPI_POLL_INTERVAL)
        console.print("[green]✓[/green] Workspace synced")

        # --- branch, commit, push, PR ---
@@ -1175,7 +1309,7 @@ def _release_enterprise(version: str, is_prerelease: bool, dry_run: bool) -> Non
        run_command(["git", "push", "-u", "origin", branch_name], cwd=repo_dir)
        console.print("[green]✓[/green] Branch pushed")

-        run_command(
+        pr_url = run_command(
            [
                "gh",
                "pr",
@@ -1192,6 +1326,7 @@ def _release_enterprise(version: str, is_prerelease: bool, dry_run: bool) -> Non
            cwd=repo_dir,
        )
        console.print("[green]✓[/green] Enterprise bump PR created")
+        console.print(f"[cyan]PR URL:[/cyan] {pr_url}")

        _poll_pr_until_merged(branch_name, "enterprise bump PR", repo=enterprise_repo)

@@ -1558,7 +1693,18 @@ def tag(dry_run: bool, no_edit: bool) -> None:
    is_flag=True,
    help="Skip the enterprise release phase",
 )
-def release(version: str, dry_run: bool, no_edit: bool, skip_enterprise: bool) -> None:
+@click.option(
+    "--skip-to-enterprise",
+    is_flag=True,
+    help="Skip phases 1 & 2, run only the enterprise release phase",
+)
+def release(
+    version: str,
+    dry_run: bool,
+    no_edit: bool,
+    skip_enterprise: bool,
+    skip_to_enterprise: bool,
+) -> None:
    """Full release: bump versions, tag, and publish a GitHub release.

    Combines bump and tag into a single workflow. Creates a version bump PR,
@@ -1571,11 +1717,19 @@ def release(version: str, dry_run: bool, no_edit: bool, skip_enterprise: bool) -
        dry_run: Show what would be done without making changes.
        no_edit: Skip editing release notes.
        skip_enterprise: Skip the enterprise release phase.
+        skip_to_enterprise: Skip phases 1 & 2, run only the enterprise release phase.
    """
    try:
        check_gh_installed()

-        if not skip_enterprise:
+        if skip_enterprise and skip_to_enterprise:
+            console.print(
+                "[red]Error:[/red] Cannot use both --skip-enterprise "
+                "and --skip-to-enterprise"
+            )
+            sys.exit(1)
+
+        if not skip_enterprise or skip_to_enterprise:
            missing: list[str] = []
            if not _ENTERPRISE_REPO:
                missing.append("ENTERPRISE_REPO")
@@ -1594,6 +1748,15 @@ def release(version: str, dry_run: bool, no_edit: bool, skip_enterprise: bool) -
        cwd = Path.cwd()
        lib_dir = cwd / "lib"

+        is_prerelease = _is_prerelease(version)
+
+        if skip_to_enterprise:
+            _release_enterprise(version, is_prerelease, dry_run)
+            console.print(
+                f"\n[green]✓[/green] Enterprise release [bold]{version}[/bold] complete!"
+            )
+            return
+
        if not dry_run:
            console.print("Checking git status...")
            check_git_clean()
@@ -1687,7 +1850,8 @@ def release(version: str, dry_run: bool, no_edit: bool, skip_enterprise: bool) -

        if not dry_run:
            _create_tag_and_release(tag_name, release_notes, is_prerelease)
-            _trigger_pypi_publish(tag_name, wait=not skip_enterprise)
+            _trigger_pypi_publish(tag_name, wait=True)
+            _update_deployment_test_repo(version, is_prerelease)

        if not skip_enterprise:
            _release_enterprise(version, is_prerelease, dry_run)
Author	SHA1	Message	Date
Devin AI	9a27669c55	fix: remove unused pytest import in test_hardcoded_secrets.py Co-Authored-By: João <joao@crewai.com>	2026-03-26 20:08:59 +00:00
github-actions[bot]	067cecf844	chore: update tool specifications	2026-03-26 20:04:21 +00:00
Devin AI	0994b57634	fix: remove hardcoded secrets from source code (issue #5124 ) - Replace hardcoded 'YOUR_API_KEY' in create_flow.py with empty placeholder - Replace hardcoded os.environ assignments in multion_tool example with os.environ.get() - Replace hardcoded default_api_key values in OpenAI-compatible providers with os.getenv() lookups - Replace hardcoded API keys in docstring examples with os.environ[] references - Replace hardcoded bearer tokens in invoke_crewai_automation_tool docstrings - Add test suite for hardcoded secrets detection (test_hardcoded_secrets.py) - Update existing test assertions for new default_api_key values Co-Authored-By: João <joao@crewai.com>	2026-03-26 20:02:16 +00:00
Greyson LaLonde	5bec000b21	feat: auto-update deployment test repo during release After PyPI publish, clones crewAIInc/crew_deployment_test, bumps the crewai[tools] pin to the new version, regenerates uv.lock, and pushes to main. Includes retry logic for CDN propagation delays.	2026-03-27 03:54:10 +08:00
Greyson LaLonde	2965384907	feat: improve enterprise release resilience and UX - Add --skip-to-enterprise flag to resume just Phase 3 after a failure - Add --prerelease=allow to uv sync for alpha/beta/rc versions - Retry uv sync up to 10 times to handle PyPI CDN propagation delay - Update pyproject.toml [project] version field (fixes apps/api version) - Print PR URL after creating enterprise bump PR	2026-03-27 03:36:56 +08:00
Greyson LaLonde	032ef06ef6	docs: update changelog and version for v1.13.0a1	2026-03-27 03:07:26 +08:00
Greyson LaLonde	0ce9567cfc	feat: bump versions to 1.13.0a1	2026-03-27 03:00:29 +08:00
Greyson LaLonde	d7252bfee7	fix: pin Node to LTS 22 in docs broken links workflow Mintlify doesn't support Node 25+, and `node-version: latest` was pulling 25.8.2 causing the workflow to fail.	2026-03-27 02:36:11 +08:00
Greyson LaLonde	10fc3796bb	fix: bust uv cache for freshly published packages in enterprise release	2026-03-27 02:21:31 +08:00
iris-clawd	52249683a7	docs: comprehensive RBAC permissions matrix and deployment guide (#5112 ) - Add full feature permissions matrix (11 features × permission levels) - Document Owner vs Member default permissions - Add deployment guide: what permissions are needed to deploy from GitHub or Zip - Document entity-level permissions (deployment permission types: run, traces, manage_settings, HITL, full_access) - Document entity RBAC for env vars, LLM connections, and Git repositories - Add common role patterns: Developer, Viewer/Stakeholder, Ops/Platform Admin - Add quick-reference table for minimum deployment permissions Addresses user feedback that RBAC was too restrictive and unclear: members didn't know which permissions to configure for a developer profile.	2026-03-26 12:30:17 -04:00
João Moura	6193e082e1	docs: update changelog and version for v1.12.2 (#5103 ) Some checks failed CodeQL Advanced / Analyze (actions) (push) Has been cancelled Details CodeQL Advanced / Analyze (python) (push) Has been cancelled Details Check Documentation Broken Links / Check broken links (push) Has been cancelled Details	2026-03-26 03:54:26 -03:00
João Moura	33f33c6fcc	feat: bump versions to 1.12.2 (#5101 )	2026-03-26 03:33:10 -03:00
alex-clawd	74976b157d	fix: preserve method return value as flow output for @human_feedback with emit (#5099 ) * fix: preserve method return value as flow output for @human_feedback with emit When a @human_feedback decorated method with emit= is the final method in a flow (no downstream listeners triggered), the flow's final output was incorrectly set to the collapsed outcome string (e.g., 'approved') instead of the method's actual return value (e.g., a state dict). Root cause: _process_feedback() returns the collapsed_outcome string when emit is set, and this string was being stored as the method's result in _method_outputs. The fix: 1. In human_feedback.py: After _process_feedback, stash the real method_output on the flow instance as _human_feedback_method_output when emit is set. 2. In flow.py: After appending a method result to _method_outputs, check if _human_feedback_method_output is set. If so, replace the last entry with the stashed real output and clear the stash. This ensures: - Routing still works correctly (collapsed outcome used for @listen matching) - The flow's final result is the actual method return value - If downstream listeners execute, their results become the final output Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style: ruff format flow.py * fix: use per-method dict stash for concurrency safety and None returns Addresses review comments: - Replace single flow-level slot with dict keyed by method name, safe under concurrent @human_feedback+emit execution - Dict key presence (not value) indicates stashed output, correctly preserving None return values - Added test for None return value preservation --------- Co-authored-by: Joao Moura <joao@crewai.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-03-26 03:28:17 -03:00