* feat: add Linear integration — agentic control plane with tools + LinearBot + AgentSession webhooks
- Add linear_tools.py with 9 GraphQL tools (search, create, update issues, comments, cycles)
- Add LinearBot adapter with HMAC-SHA256 webhook verification and AgentSession handling
- Add Linear platform to bot registry, CLI commands, and gateway integration
- Support both LINEAR_OAUTH_TOKEN (OAuth) and LINEAR_API_KEY (personal) authentication
- Include example configurations (YAML and Python) for zero-code and programmatic usage
- Follow protocol-driven architecture: tools in core SDK, bot implementation in wrapper
- Zero import-time cost via lazy loading, full BotProtocol compliance
Closes#1612🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
* fix: correct four bugs in Linear integration found during review
- _handle_agent_message: replace non-existent get_session() context
manager with correct _session_mgr.chat() call (matches Slack/Telegram
pattern in _session.py)
- _gql_query: fix aiohttp timeout — bare int 30 → ClientTimeout(total=30)
- bot_linear CLI: fix web_provider= → web_search_provider= to match
BotCapabilities dataclass field (same as all other bot commands)
- bot_linear CLI: add `or []` guards for tools/skills/knowledge_sources
to prevent None being passed where list is expected (matches all other
bot commands)
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/645d14d2-c605-41bf-b83a-839209e7e3b9
Co-authored-by: MervinPraison <[email protected]>
* fix: resolve 3 blocking Linear integration bugs
- Fix BotMessage constructor field names (id->message_id, text->content)
- Fix OAuth Bearer token handling in both tools and bot implementations
- Fix send_message signature to match BotProtocol specification
All fixes verified against the original bug reproduction cases.
Co-authored-by: Mervin Praison <[email protected]>
* refactor: relocate Linear tools to praisonai-tools (canonical home)
Linear GraphQL wrappers don't belong in the protocol-first core SDK
(per AGENTS.md §4.1). They duplicated an already-shipped LinearTool in
MervinPraison/PraisonAI-Tools and pulled third-party SaaS HTTP plumbing
into praisonaiagents/tools/.
This commit:
- Removes praisonaiagents/tools/linear_tools.py (the new file)
- Reverts the 9 TOOL_MAPPINGS additions and the 3 lookup-list entries
- Leaves LinearBot in praisonai/bots/linear.py unchanged (correct location:
wrapper-side webhook adapter)
The full Linear tool surface (search/get/create/update/comment/list cycles/
list states/list teams) is being landed in MervinPraison/PraisonAI-Tools#31
with OAuth Bearer support and 36 unit tests. Users get it via:
from praisonai_tools import LinearTool
praisonai-tools is already a runtime dep of praisonai (pyproject.toml:102),
so end-user UX is unchanged.
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: praison <[email protected]>
- Fix test_managed_agent_compute_provider_errors to expect DeprecationWarning instead of ValueError
- Add 3-layer skip guards to all 4 runtime example scripts for clean exit without credentials
- Preserve backward compatibility while implementing the HostedAgent/LocalAgent architectural split
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
* fix: ManagedAgent(provider=) overload conflates hosted-runtime vs LLM-routing — propose HostedAgent / LocalAgent split (fixes#1549)
- Create new HostedAgent class for hosted runtimes (Anthropic managed infrastructure)
- Create new LocalAgent class for local loops with optional cloud compute
- Update ManagedAgent factory with deprecation warnings for LLM routing overload
- Add proper error handling for compute provider misuse
- Maintain full backward compatibility with all existing imports
- Update examples to demonstrate new clear semantics
- Add comprehensive tests for new backend semantics
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
* examples: update managed-agents provider examples to use new HostedAgent/LocalAgent classes
- Create new canonical examples demonstrating HostedAgent vs LocalAgent usage
- Update existing examples to use clear semantic distinctions
- Add runtime_hosted_anthropic.py for true managed runtime usage
- Add runtime_local_*.py examples for local execution with different LLMs
- Update all_providers.py to use LocalAgent with compute backends
- Update local_basic.py to use LocalAgent semantics
- Add comprehensive test suite for backend semantics
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
* fix: resolve P1 backward compatibility and routing issues
- Fix ManagedAgent compute provider routing: maintain backward compatibility
for e2b/modal/etc by routing to LocalManagedAgent with deprecation warning
instead of ValueError (fixes hard breaking change)
- Fix LocalAgent provider preservation: preserve provider value for LLM routing
to maintain _resolve_model() prefix behavior (ollama/, gemini/)
- Fix spurious deprecation warnings: auto-detected provider=local no longer
triggers warnings for users who never passed provider=
- Remove unused os import from hosted_agent.py
- Improve error messages with provider-specific guidance
- Fix test fragility with exact warning counts and identity checks
Addresses all P1 issues identified by Greptile and CodeRabbit reviewers.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Updated the motion graphics agent factory example with detailed steps
for creating a title-card animation, including necessary function
calls and content requirements. Added a new installation command
to the README for easier setup.
Introduced several Python scripts demonstrating motion graphics rendering
and GitTools safety features. Includes examples for basic rendering,
Git repository validation, and agent factories. These enhancements aim
to provide a comprehensive toolkit for creating and managing motion
graphics projects efficiently.
- Add AgentInvokeAPI with FastAPI router for n8n → PraisonAI direction
- POST /api/v1/agents/{agent_id}/invoke endpoint for workflow invocation
- Support for both sync and async agents with session management
- Agent registry for programmatic agent registration
- Comprehensive error handling and validation with Pydantic models
- Integration with existing FastAPI app in api/call.py
- Complete unit tests with FastAPI TestClient
- Full bidirectional integration example with interactive demo
- Follows AGENTS.md architecture guidelines (API in wrapper package)
Co-authored-by: MervinPraison <[email protected]>
- Added SSHSandbox for remote server execution via SSH with asyncssh
- Added ModalSandbox for serverless GPU execution on Modal platform
- Added DaytonaSandbox for cloud development environment execution
- Updated sandbox __init__.py with lazy loading for new backends
- Added optional dependencies: [ssh], [modal], [daytona] in pyproject.toml
- Created comprehensive unit tests for all new sandbox backends
- Added examples/python/sandbox_remote.py with usage demonstrations
- All backends implement complete SandboxProtocol interface
- Follows protocol-driven architecture with implementations in wrapper package
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Added multiple examples demonstrating the creation and management of agents,
environments, sessions, and custom tools in the managed agents architecture.
This comprehensive set of examples now includes functionalities such as
tool selection, disabling tools, and updating agent configurations, providing
users with clear guidance on utilizing the framework effectively.
* security: Fix CORS Configuration Vulnerabilities (CWE-942) - Replace wildcard origins
- Replace allow_origins=['*'] with secure environment-based configurations
- Update browser server to use BROWSER_CORS_ORIGINS env var with localhost defaults
- Update jobs server to use JOBS_CORS_ORIGINS env var with localhost defaults
- Update example API to use API_CORS_ORIGINS env var with localhost defaults
- Remove wildcard defaults from ServerConfig, GatewayConfig, and AppConfig
- Add secure localhost defaults to MCP server transport
- Update tests and documentation to reflect secure defaults
- Restrict CORS methods and headers to essential ones only
Fixes#1321 - Addresses 3 instances of CWE-942 vulnerabilities
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: Address 3 CORS bugs found in review - chrome-extension regex, http_stream headers, server.py methods/headers
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/b76a2075-da18-4ad5-82e8-79fc09457529
Co-authored-by: MervinPraison <[email protected]>
* security: Fix remaining CORS vulnerabilities (CWE-942)
- Add environment-based CORS defaults (empty for production)
- Validate env vars to reject wildcard origins (*)
- Add missing Idempotency-Key header to jobs CORS
- Unify WebSocket and HTTP CORS origin validation
- Make http_stream transport environment-aware
Fixes all critical security issues identified by code reviewers:
- Production no longer allows localhost by default
- Environment variables cannot bypass security with *
- WebSocket uses same origin validation as CORS middleware
- Jobs API properly supports Idempotency-Key header
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
* fix(security): replace insecure MD5 with SHA-256 and disable debug mode
Replace all 29 instances of hashlib.md5() with hashlib.sha256() across
22 files. MD5 is cryptographically broken (CWE-328) and should not be
used for hashing, even for non-security purposes like cache keys and
content fingerprints.
Also disable debug=True in api.py (CWE-489) to prevent information
leakage in production deployments.
Vulnerabilities fixed:
- 28x CWE-328: Use of Weak Hash (MD5 → SHA-256)
- 1x CWE-489: Active Debug Code (debug=True → debug=False)
Detected by semgrep (p/owasp-top-ten, p/python).
Verified by re-scan: 66 findings → 37 remaining (29 fixed).
Remaining findings (require manual review):
- 14x shell injection (subprocess with user input)
- 10x subprocess shell=True
- 3x wildcard CORS
- 5x tainted env args in subprocess
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address review feedback on MD5→SHA-256 migration
Fixes raised by Gemini Code Assist, Qodo, and CodeRabbit:
1. templates/security.py: algorithm="md5" now raises ValueError
instead of silently returning SHA-256 digest
2. recipe/security.py: CycloneDX serialNumber now uses uuid5()
for RFC 4122 compliant UUID format (was 64-char hexdigest)
3. agent/agent.py: backward-compatible session ID — checks for
legacy MD5-based session file on disk before using new SHA-256 ID
4. snapshot/snapshot.py: backward-compatible shadow repo path —
adopts legacy MD5-based directory if it exists on disk
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Michael Winczuk <[email protected]>
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
- Introduced a new agent for cross-posting on multiple social media platforms with required environment variables.
- Added a video generation example using HeyGen and ElevenLabs, demonstrating autonomous video production.
- Created YAML workflow for sequential multi-agent processing in video generation.
- Updated several test files to accommodate new features and examples.
feat(bots): add email bot examples and functionalities
This commit introduces a new email bot feature, enabling agents to
interact through email via IMAP/SMTP. It includes example usage,
custom configurations, and a multi-platform approach, enhancing the
bot's usability in diverse environments.
```
- Remove `verbose` parameter from Agents() calls across all examples
- Remove `markdown` parameter from Agent() initialization
- Change `model` to `llm` in observability example
- Remove unused `kind` parameter from obs.span()
- Fix thinking_budget initialization to use property setter instead of constructor
- Add missing `instructions` parameter to routellm_example.py Agent
praison