fix: add missing list/dict methods to LockedListProxy and LockedDictProxy

[lucasgomide]

We introduced a breaking change in 1.10.x when a Flow tries to access its state using .index (for example)

LockedListProxy and LockedDictProxy subclass list and dict but initialize the parent as empty (super().__init__()), delegating all access to an internal self._list / self._dict. However, several inherited methods were not overridden, causing them to silently operate on the empty parent instead of the real data.

Most critically, list.index() always raises ValueError because it searches the empty parent list. Other broken methods include count() (always returns 0), sort()/reverse() (no-ops), copy() (returns empty), and arithmetic operators (+, *).

All mutating operations acquire the lock; read-only operations delegate directly to the underlying collection, consistent with existing pattern.

---

Note

Medium Risk
Touches core flow state proxy behavior and locking for common container operations, which could subtly affect concurrency or operator semantics. Changes are narrowly scoped and covered by new unit tests for the previously broken methods.

Overview
Fixes broken container behavior in flow state proxies. LockedListProxy and LockedDictProxy now override additional list/dict methods and operators (e.g. index, count, sort/reverse, copy, +/*, and dict union |/|=) so they delegate to the underlying self._list/self._dict instead of the empty parent container.

Adds regression coverage. New tests in test_flow.py validate the corrected behavior (including in-place mutation operators not deadlocking and non-mutating operators returning new containers).

^{Written by Cursor Bugbot for commit 497400f. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

In-place operators return raw collection, breaking proxy identity

Medium Severity

__iadd__, __imul__, and __ior__ return the raw internal self._list/self._dict instead of self. After augmented assignment on a proxy reference (e.g., items = flow.state.items; items += [10]), the variable silently becomes a plain list/dict, losing all thread-safety guarantees from the lock. The primary flow.state.items += [10] path works only because StateProxy re-wraps on every access, but direct proxy holders lose protection.

Additional Locations (2)

• lib/crewai/src/crewai/flow/flow.py#L535-L539
• lib/crewai/src/crewai/flow/flow.py#L634-L638