AWS Bedrock ValidationException: Assistant message contains both tool_calls and content

[ThePlenkov]

When using cagent with AWS Bedrock via LiteLLM proxy, cagent generates assistant messages with both tool_calls AND content in the same turn, violating Anthropic/AWS Bedrock API protocol. This causes ValidationException: The number of toolResult blocks exceeds the number of toolUse blocks. Related to #1544. Full details and reproduction case available upon request.

[ThePlenkov]

Closing to recreate with sanitized technical details only

[Pnkcaht]

ok, no problem

[ThePlenkov]

Full Technical Details with Reproduction Case

Environment

• cagent version: Latest (via Docker)
• OS: Windows (PowerShell/WSL2)
• Provider: AWS Bedrock via LiteLLM proxy
• Model: haiku (Claude Haiku)
• Setup: Multi-agent coordinator with scout/coder/sage subagents

---

The Problem

When cagent delegates tasks to subagents using transfer_task, it generates an assistant message that contains BOTH tool_calls AND content in the same turn. This violates the Anthropic/AWS Bedrock API protocol specification.

Complete Error Message

error receiving from stream: POST "http://localhost:4000/chat/completions":
503 Service Unavailable {"message":"litellm.ServiceUnavailableError:
litellm.MidStreamFallbackError: litellm.APIConnectionError:
APIConnectionError: OpenAIException - Stream generation failed:
ProviderException: (400, \"AWS client error encountered: <class
'botocore.errorfactory.ValidationException'>: An error occurred
(ValidationException) when calling the ConverseStream operation (reached max
retries: 0): The number of toolResult blocks at messages.5.content exceeds
the number of toolUse blocks of previous turn.\", {'Error': {'Message': 'The
number of toolResult blocks at messages.5.content exceeds the number of
toolUse blocks of previous turn.', 'Code': 'ValidationException'},
'ResponseMetadata': {'RequestId': 'e995edb3-e175-45a6-9198-097ebb0d9f3e',
'HTTPStatusCode': 400...

---

The Protocol Violation (Message Index 5)

Here's the exact malformed message from the payload:

{
  "role": "assistant",
  "content": "I apologize, but I'm unable to retrieve the Jira ticket FSINN-2011 at this time. The issue appears to be:\n\n1. **Authentication Required**: The Jira URL (https://booking.atlassian.net/browse/FSINN-2011) requires authentication credentials to access\n2. **REST API Access**: The Jira REST API endpoint also requires authentication\n\n**To complete this task, I would need:**\n- Valid Jira credentials or an API token for booking.atlassian.net\n- Or access to the `acli` CLI tool (as mentioned in my instructions) which would handle authentication automatically\n\n**My recommendations:**\n1. If you have access to the Jira ticket directly, you could provide me with the ticket details\n2. Alternatively, if you have the `acli` command-line tool available, that should be preferred for Jira access according to my instructions\n3. You could share a screenshot or export of the ticket\n\nWould you like to:\n- Provide the ticket details directly?\n- Use an alternative method to access the ticket?\n- Or would you prefer I try a different approach?",
  "tool_calls": [
    {
      "id": "tooluse_lraYVOoZsAP3xowlfubQix",
      "type": "function",
      "function": {
        "name": "transfer_task",
        "arguments": "{\"agent\": \"scout\", \"task\": \"Retrieve and review ticket FSINN-2011 from Jira at https://booking.atlassian.net/browse/FSINN-2011. Provide a summary of what was implemented, the changes made, and the current status.\", \"expected_output\": \"Summary of FSINN-2011 ticket including: ticket description, changes/diff implemented, current status, and any key discussion points or findings\"}"
      }
    },
    {
      "id": "tooluse_xSJCdrlYpRkusNYhAdpJLo",
      "type": "function",
      "function": {
        "name": "transfer_task",
        "arguments": "{\"agent\": \"coder\", \"task\": \"Review the GitLab project at https://gitlab.com/theplenkov/gitlab-matrix-input and analyze how it demonstrates that using inputs + parallel matrix directly is possible and working. Provide a technical breakdown of the implementation approach and key insights.\", \"expected_output\": \"Detailed technical analysis of the gitlab-matrix-input project showing: 1) How inputs are used with parallel matrix, 2) Key configuration/code snippets, 3) Why this approach works, 4) Any limitations or considerations\"}"
      }
    }
  ]
}

This is WRONG! The assistant message contains:

• ✅ 2 tool calls (tooluse_lraYVOoZsAP3xowlfubQix and tooluse_xSJCdrlYpRkusNYhAdpJLo)
• ❌ A long text response explaining inability to retrieve Jira ticket

---

What Happens Next

Immediately after this malformed message, two tool results come back:

{
  "role": "tool",
  "content": "I apologize, but I'm unable to retrieve the Jira ticket...",
  "tool_call_id": "tooluse_lraYVOoZsAP3xowlfubQix"
}

{
  "role": "tool",
  "content": "# Technical Analysis: GitLab Matrix Input Project...",
  "tool_call_id": "tooluse_xSJCdrlYpRkusNYhAdpJLo"
}

But AWS Bedrock rejects this because it sees:

• Message 5 has 2 tool_calls + content
• Then 2 tool_results arrive
• But Bedrock already counted the content as a response, so it thinks there are MORE tool results than tool calls

---

Correct Protocol (What Should Happen)

Turn 1 - Assistant makes tool calls:

{
  "role": "assistant",
  "tool_calls": [
    {"id": "tooluse_lraYVOoZsAP3xowlfubQix", ...},
    {"id": "tooluse_xSJCdrlYpRkusNYhAdpJLo", ...}
  ]
  // NO "content" field at all!
}

Turn 2 - Tool results come back:

{"role": "tool", "content": "...", "tool_call_id": "tooluse_lraYVOoZsAP3xowlfubQix"}
{"role": "tool", "content": "...", "tool_call_id": "tooluse_xSJCdrlYpRkusNYhAdpJLo"}

Turn 3 - Assistant responds with analysis:

{
  "role": "assistant",
  "content": "I apologize, but I'm unable to retrieve the Jira ticket..."
  // NO tool_calls here
}

---

Root Cause Analysis

Looking at the system prompts in the payload, cagent has:

"You are a multi-agent system... If another agent is better for answering 
the question according to its description, call `transfer_task` function 
to transfer the question to that agent using the agent's ID. When transferring, 
do not generate any text other than the function call."

However, cagent is IGNORING this instruction and generating text ("I apologize, but I'm unable to retrieve...") alongside the transfer_task calls.

This suggests the issue is in:

1. How cagent constructs the messages array for the API
2. The subagent response handler that generates premature responses
3. Possibly the streaming response builder

---

Why This Only Affects AWS Bedrock

• OpenAI: More lenient, may accept messages with both fields
• Anthropic Direct API: Strict validation but different error handling
• AWS Bedrock (Anthropic): STRICTEST validation - immediately rejects protocol violations

---

Reproduction Steps

1. Set up cagent with AWS Bedrock via LiteLLM proxy
2. Configure multi-agent system with coordinator + subagents
3. Give coordinator a task that requires delegating to 2+ subagents
4. Observe coordinator tries to respond AND delegate simultaneously
5. AWS Bedrock rejects with ValidationException

---

Suggested Fix Location

The bug is likely in the code that:

1. Handles transfer_task function calls
2. Constructs assistant messages for the LLM API
3. Manages conversation history during multi-agent delegation

Fix needed: Ensure when tool_calls are present, content field is either:

• Omitted entirely (preferred)
• Set to empty string
• Never contains actual text response

---

Impact

• AWS Bedrock users cannot use multi-agent features
• Any transfer_task usage fails immediately
• Forces users to use less strict providers (OpenAI, etc.)
• Blocks enterprise adoption for AWS-based deployments

---

Workaround (Temporary)

Users can add middleware before LiteLLM:

def sanitize_for_bedrock(messages):
    sanitized = []
    for msg in messages:
        if msg.get('role') == 'assistant':
            if msg.get('tool_calls') and msg.get('content'):
                # Tool calls ONLY - remove content
                sanitized.append({
                    'role': 'assistant',
                    'tool_calls': msg['tool_calls']
                })
                # Content will come in next assistant turn after tool results
            else:
                sanitized.append(msg)
        else:
            sanitized.append(msg)
    return sanitized

---

Full Payload Available

I have the complete request payload (17KB JSON) showing:

• All messages in the conversation
• System prompts
• Tool definitions
• The exact malformed message structure

Happy to provide this if needed for debugging.

Related

• Subagent tool_calls not handled when using LiteLLM proxy #1544 - Similar tool_calls handling issue with LiteLLM proxy