* fix: Agent Skills gaps - approval scoping, progressive disclosure, observability, budget, safer defaults (fixes#1478)
Implements all 6 gaps identified in the Agent Skills architecture review:
G-A (CRITICAL): Fixed approval scoping bug where skills with allowed-tools
accidentally granted AutoApprove for ALL tools to an agent. Now uses
per-tool auto-approval registry for precise scoping.
G-B: Added SkillActivationProtocol for progressive disclosure, enabling
Claude Code-style skill activation where only descriptions are shown
initially with full bodies loaded on demand.
G-C: Added SkillDiscoveredEvent and SkillActivatedEvent for observability
and telemetry integration to track skill usage patterns.
G-D: Added SkillPromptBudget to prevent unbounded system-prompt growth
with large skill libraries. Supports multiple budgeting strategies.
G-E: Made run_skill_script safer by default - now only enabled when
explicitly requested via PRAISONAI_ENABLE_SKILL_TOOLS=1 or when a skill
declares it in allowed-tools.
G-F: Added tool_from_skill() adapter in wrapper for users who want
'skill = tool' ergonomics with existing tool registries.
All changes are backward compatible and follow protocol-driven architecture.
Import time remains <20ms. Comprehensive tests included.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
* fix: address critical architecture and security issues identified in code review
- Fix CRITICAL approval scoping security leak where unnamed agents could create global auto-approvals
- Fix budget strategy application to sort skills before count truncation for correct alpha ordering
- Fix character count estimation to include XML tags, escaping, and location fields for accuracy
- Fix skill-to-tool adapter to properly handle arguments and set metadata during decoration
- Fix type annotations for optional parameters
- Improve error handling with per-tool logging to prevent silent failures
Co-authored-by: Mervin Praison <[email protected]>
* fix: align PR #1481 tests with design + repair corrupted gateway/server.py
- tests/unit/skills/test_approval_scoping: drop mock-patch of local import;
match explicit per-agent-only scope for auto_approve_tool.
- tests/unit/skills/test_budget: expected default strategy='fifo' (impl).
- capabilities/skills.tool_from_skill: set __name__/__qualname__/__doc__
on inner function before @tool decoration so schema + introspection see
the final identity.
- tests/unit/test_tool_from_skill: rewrite mock-based tests to patch the
real load_skill in praisonaiagents.skills (monkeypatch) and simulate
ImportError via builtins.__import__ blocker.
- gateway/server.py: strip 84 lines of duplicated/corrupted try/finally
blocks after run() (pre-existing SyntaxError masked by stale .pyc).
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
* refactor: Move PushClient and transports from core SDK to wrapper (fixes#1482)
- Move PushClient (388 LOC) from core to praisonai/push/client.py
- Move WebSocketTransport and PollingTransport from core to praisonai/push/transports.py
- Extract PushTransportProtocol to core praisonaiagents/push/protocols.py
- Convert core push/__init__.py to lazy re-export shim following gateway pattern
- Maintain backward compatibility for all import paths
- Core SDK now has only protocols and lightweight utilities (<80 LOC per file)
- Heavy implementations correctly moved to wrapper package
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: MervinPraison <[email protected]>
* fix: add backward compatibility shims and optimize lazy loading
- Add client.py and transports.py shims to maintain backward compatibility
for existing imports like 'from praisonaiagents.push.client import PushClient'
- Sort __all__ alphabetically in wrapper package (Ruff RUF022 compliance)
- Optimize lazy loading by hoisting importlib and simplifying mapping
- Fixes critical issue where tests/unit/test_push_client.py:8 would break
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
* feat: implement self-improving agent loop foundation
Adds core capabilities for agents to learn and persist knowledge as skills:
Core SDK (praisonaiagents):
- Add SkillMutatorProtocol for agent-managed skill CRUD operations
- Extend LearnConfig with nudge_interval, propose_skills fields
- Add _maybe_emit_nudge() method for periodic knowledge persistence prompts
- Wire improvements auto-extraction in LearnManager.process_conversation()
Wrapper (praisonai):
- Create skill_manage tool for agent skill management
- Implement BasicSkillMutator with safe propose/approve workflow
- Add integration test demonstrating end-to-end self-improving loop
This enables the core self-improving claim: agents can learn procedures
and persist them as skills for reuse across sessions.
Fixes#1471🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
* security: fix path traversal vulnerabilities and broken approve flow
- Add comprehensive path validation to prevent directory traversal attacks
- Fix broken propose/approve workflow for non-create actions
- Add proper validation for all skill name parameters
- Fix integration test to use isolated storage instead of global state
- Fix performance issue: lazy initialization of skill mutator
- Ensure edit action properly stages proposals instead of creating {name}_edit
Security improvements:
- Validate file_path parameters in write_file, remove_file, patch
- Reject dangerous patterns: .., /, \, ~
- Use resolved path checks to prevent escape attempts
- Add name validation to all CRUD operations
Fixes issues identified in Copilot security review.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
* fix: wire nudge mechanism + remove scope-creep doc
- Wire _maybe_emit_nudge() into post-turn flow in tool_execution.py
(both sync and async paths). Previously defined but never invoked,
so LearnConfig(nudge_interval>0) had no effect.
- Nudge is appended to chat_history as a system message so it is
visible on the next LLM call. Zero overhead when nudge_interval=0.
- Remove root-level SELF_IMPROVING_AGENT_FEATURES.md (scope creep;
not requested by issue #1471).
* update
* fix: address security and performance issues in push notification system
- SECURITY: Move auth tokens from URL query params to Authorization headers
- PERFORMANCE: Make receive loop non-blocking for ACKs and callbacks
- ERROR HANDLING: Add HTTP status checks in polling transport
- ERROR HANDLING: Use robust URL parsing for WebSocket to HTTP conversion
- ERROR HANDLING: Fail fast when sending on disconnected transport
- CODE QUALITY: Remove duplicate test file content
Addresses issues identified by Gemini, CodeRabbit, and Copilot reviewers.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Claude <[email protected]>
Resolves#1473: (1) Lazy telemetry defaults — no more disk I/O or env mutation at import time, (2) Deferred async primitives — asyncio.Event/Lock created lazily inside event loop context (eliminates 'different loop' RuntimeError), (3) Unified scheduler — new scheduler/shared.py with ScheduleParser/backoff_delay/safe_call, used by both sync and async schedulers. Backoff is now 30s initial, exponential to 300s cap with 10%% jitter — consistent across both schedulers. 113 scheduler/async unit tests pass locally.
Architecture gaps resolved per #1465: (1) async bridge consolidation via run_sync across 6 persistence files, (2) removed mutable shared state in ClaudeCodeIntegration, (3) double-checked locking in db/adapter.py, integrations/registry.py, tool_resolver.py. Restored class-level _availability_cache (fixes regression in TestAvailabilityCache) with thread-safe lock. All 17 base integration tests pass locally.
Changed the default host for the claw command from "0.0.0.0" to "127.0.0.1" to improve security by binding to loopback only. Added a warning for users opting to expose the dashboard on a LAN without built-in authentication. Updated version to 1.6.20 in pyproject.toml and uv.lock.
- Bump version to 1.6.19 in pyproject.toml and uv.lock
- Enhance `install.sh` to always prompt for bot onboarding with clearer messaging
- Update integration test to reflect changes in bot onboarding prompt visibility and logic
- Updated bot command to resolve configuration paths from environment variables.
- Added new path utility functions for clarity and maintainability.
- Updated version to 1.6.16 for package consistency.
- Enhanced help messages for commands to reflect new default path behavior.
Updated the motion graphics agent factory example with detailed steps
for creating a title-card animation, including necessary function
calls and content requirements. Added a new installation command
to the README for easier setup.
Added functionality to read and persist the GATEWAY_AUTH_TOKEN across daemon restarts. This ensures the dashboard link remains consistent, improving user experience. Updated version to 1.6.15 and made necessary adjustments to related files.
Introduced several Python scripts demonstrating motion graphics rendering
and GitTools safety features. Includes examples for basic rendering,
Git repository validation, and agent factories. These enhancements aim
to provide a comprehensive toolkit for creating and managing motion
graphics projects efficiently.
- Incremented version to 1.6.13 in pyproject.toml and uv.lock.
- Modified _generate_bot_yaml function to support both single and multi-agent configurations.
- Updated launchd, systemd, and Windows daemon scripts to use gateway start instead of bot start for better compatibility with multi-bot setups.
- onboard: refuse to install daemon when no token was captured for
the selected platforms (previously it installed a broken service
that would crash-loop). Lists missing platforms and tells the user
to rerun onboard with credentials.
- onboard: daemon-install default flipped to YES when tokens are
present (matches hermes UX; previously default NO left bots
offline by default).
- onboard: final panel now references 'praisonai gateway status'
(real command) instead of 'praisonai bot status' (doesn't exist).
- doctor: resolve praisonaiagents version via importlib.metadata
(the package does not expose __version__), so the check no longer
reports 'praisonaiagents unknown installed'.
- pyproject: add aiui to [bot] and [all] so the chat dashboard is
available immediately after onboarding a messaging bot.
- onboard: every setting (token, extra env vars, allowlist, home
channel) now shows the existing (masked) value and lets the user
update or keep it, mirroring hermes-agent setup.
- onboard: support 'clear' keyword on allowlist prompt to restore
open access.
- _save_env_vars: None as a value now deletes the key from
~/.praisonai/.env (previously empty strings were silently skipped).
- Bumps praisonaiagents to 1.6.11.
Updated the version in `pyproject.toml` and `uv.lock` to 1.6.10.
Modified dependencies in `pyproject.toml` for clarity and to include
new libraries necessary for core agent functionality. Fixed file
handling in the SetupHandler and improved path resolution in tests.
Added checks for missing required arguments in the setup command tests.
* feat: wire up bot onboarding + gateway daemon install + Windows support
Wire existing OnboardWizard (254 lines) to CLI and extend gateway commands
for cross-platform daemon management. Adds Windows Scheduled Task support.
New Commands:
- praisonai onboard - messaging bot setup wizard
- praisonai gateway install/uninstall/logs - daemon management
- praisonai bot install-daemon - convenience alias
Platform Support:
- Linux systemd user units
- macOS LaunchAgent
- Windows Scheduled Tasks (with Startup folder fallback)
Enhanced install.sh:
- Offers bot onboarding after LLM setup
- Detects existing messaging tokens
- Respects NO_ONBOARD flag
Fixes#1454🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
* fix: stabilize onboarding and daemon CLI paths
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/56b7de0e-b6b5-4139-a3fd-d3a47e5d7ce7
Co-authored-by: MervinPraison <[email protected]>
* fix: harden daemon command wiring and test hooks
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/56b7de0e-b6b5-4139-a3fd-d3a47e5d7ce7
Co-authored-by: MervinPraison <[email protected]>
* feat(onboard): telegram security + .env persistence + password-hidden input
Brings bot onboarding to parity with hermes/openclaw reference CLIs:
- Persist tokens + allowlist + home channel atomically to ~/.praisonai/.env
(chmod 600, tmp-then-rename). No more ephemeral os.environ-only state.
- Password-hidden token input via Rich password prompt (rich path) and
getpass (plain fallback). Tokens no longer echo to terminal.
- Per-platform ALLOWED_USERS allowlist prompt with security warning when
skipped (anyone who finds the bot can use it).
- Per-platform HOME_CHANNEL prompt for proactive/cron delivery, defaulting
to first allowed user ID.
- Platform-specific user-ID discovery hints (@userinfobot for Telegram,
Developer Mode for Discord, member ID for Slack, E.164 for WhatsApp).
- bot.yaml now references ${..._ALLOWED_USERS} and ${..._HOME_CHANNEL}
for every channel, keeping secrets out of the yaml file.
Also fixes:
- gateway.py: print_warn() -> print_warning() (correct method name on
OutputController). Prevents AttributeError on daemon status/install/logs.
- test_onboard_command.py: patch the actual source of run_onboard
(features.onboard) since the commands module imports it lazily.
Refs #1454
Co-authored-by: MervinPraison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: onboard-enhance <[email protected]>
- Fix TypeError when sessions have updated_at=None by using 'or' operator
- Add regression test for None updated_at values in session store
- Ensures sessions with None updated_at sort last (as intended)
Fixes#1445
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
* fix(langextract): bridge ContextTraceEmitter so real agent events flow into sink
Problem
-------
The merged langextract integration (#1412, PR #1413) wired LangextractSink
to get_default_emitter()/ActionEvent only. That pipeline has just two
producers in the entire core SDK (RouterAgent token usage, PlanningAgent
plan_created), so a typical single-agent run with '--observe langextract'
or 'praisonai langextract render <yaml>' produced an empty HTML file.
The base agent runtime (chat_mixin, tool_execution, unified_execution_mixin)
actually emits rich lifecycle events via ContextTraceEmitter /
ContextTraceSinkProtocol in praisonaiagents.trace.context_events.
Fix (wrapper-only, zero core changes)
-------------------------------------
- observability/langextract.py: add _ContextToActionBridge adapter that
forwards ContextEvent -> ActionEvent (agent_start, tool_call_start/end,
llm_response->OUTPUT, agent_end). Expose LangextractSink.context_sink().
- cli/app.py: _setup_langextract_observability now also installs a
ContextTraceEmitter wired to the bridge.
- cli/commands/langextract.py: 'render' command does the same wiring for
the duration of the workflow run.
- tests: add 3 regression tests covering the bridge and setup path.
Incidental fix
--------------
agents_generator.py:1112 had a local 'import os' inside an 'if
acp/lsp enabled' block that shadowed the module-level import and caused
UnboundLocalError at line 1179 for any YAML run with acp/lsp disabled.
Removed the redundant local import.
Verification
------------
- 19/19 langextract unit tests pass (16 existing + 3 new).
- Real agentic e2e: Agent.start() with --observe langextract now produces
non-empty trace.html (3036 B) + trace.jsonl (1356 B) with agent_run and
final_output extractions.
- 'praisonai langextract render simple.yaml' end-to-end now produces
render.html and render.jsonl; previously printed 'Trace was not rendered'.
* test(langextract): make context-emitter setup test deterministic
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/cec32ee8-0573-405f-86d1-6a28fb51b609
Co-authored-by: MervinPraison <[email protected]>
* test(langextract): cover setup behavior with and without optional dependency
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/cec32ee8-0573-405f-86d1-6a28fb51b609
Co-authored-by: MervinPraison <[email protected]>
* fix(langextract): improve error handling, test reliability, and reduce code duplication
- Add LangextractSink.bridge_context_events() helper method to centralize context emitter setup
- Fix silent exception swallowing in langextract render command - now properly reports bridge failures
- Add proper skipif guard for optional dependency tests
- Use callback pattern for clean separation of CLI concerns
Co-authored-by: Mervin Praison <[email protected]>
* test(langextract): remove skipif referencing undefined _langextract_available helper
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
* feat: consolidate tool alias mappings into single source of truth (fixes#1431)
- Create shared _tool_aliases.py with canonical TOOL_ALIAS_MAP
- Remove duplicate TOOL_MAPPING from managed_agents.py
- Remove duplicate TOOL_ALIAS_MAP from managed_local.py
- Resolve mapping conflicts: grep->search_file, web_fetch->web_fetch, edit->apply_diff
- Add comprehensive unit tests for alias consistency
- Ensure backward compatibility for existing callers
Co-authored-by: MervinPraison <[email protected]>
* test: enhance backward compatibility test for web_search alias
Add web_search to test inputs to ensure the alias mapping
from web_search -> search_web is properly tested, addressing
reviewer feedback from Copilot.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
* test: fix double-praisonai import paths in tool alias tests
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Validated locally: all 3 fixes work with real CLIs (gemini returns response with flash-lite default, codex works outside git repos, cursor surfaces auth errors clearly instead of silent empty). Closes#1415.
* fix: --n8n flag Docker networking and endpoint issues (fixes#1406)
- Add Docker-aware URL generation using host.docker.internal on macOS/Windows
- Fix HTTP Request nodes to use /agents endpoint instead of non-existent /agents/{id}
- Add helpful Docker networking tips in CLI and initialization
- Update CLI help text to mention Docker networking gotchas
Co-authored-by: MervinPraison <[email protected]>
* test: add n8n CLI coverage and sanitize generated agent id
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/dfc8acb0-ac39-4d91-b930-586894119671
Co-authored-by: MervinPraison <[email protected]>
* fix: harden n8n agent id generation and add focused CLI tests
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/dfc8acb0-ac39-4d91-b930-586894119671
Co-authored-by: MervinPraison <[email protected]>
* fix: address critical n8n reviewer feedback
- Fix API endpoint from POST /agents to POST /agents/{agent_id}/invoke to match actual API
- Add port parameter to _default_api_url to respect CLI --port flag
- Require N8N_DOCKER=1 env var for Docker detection to prevent false positives
- Update API URL when n8n_url changes in execute() method
- Use json.dumps for proper JavaScript string escaping in n8n expressions
- Update CLI help text to clarify Docker platform requirements (macOS/Windows only)
- Add URL path normalization with rstrip('/') for consistency
Addresses reviewer feedback from CodeRabbit, Gemini, and Copilot regarding
Docker detection logic, API contract compliance, and configuration handling.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
* fix: n8n converter - fix missing connections, remove read-only fields, use httpRequest node type (fixes#1404)
- Fix Bug 1: Add missing agent-to-agent connections via _build_sequential_connections()
- Fix Bug 2: Remove read-only fields (updatedAt, tags, staticData, etc.) from n8n API payload
- Fix Bug 3: Change from chainLlm to httpRequest node type pointing to PraisonAI API
- All fixes tested with 2-agent workflow successfully
Co-authored-by: MervinPraison <[email protected]>
* fix: align n8n tests and reverse converter with httpRequest nodes
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/37dde90a-1f27-4635-ac13-b564202f6f93
Co-authored-by: MervinPraison <[email protected]>
* fix: normalize n8n agent id sanitization and reverse parsing
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/37dde90a-1f27-4635-ac13-b564202f6f93
Co-authored-by: MervinPraison <[email protected]>
* fix: normalize n8n agent id sanitization and reverse parsing
- Fix API field names: use 'message' instead of 'query' for request body
- Fix API response field: use 'result' instead of 'response' for chaining
- Fix API URL path: use '/api/v1/agents/{id}/invoke' format
- Filter workflow output to only n8n Public API allowed fields
- Update reverse converter to recognize httpRequest nodes with PraisonAI API pattern
- Update tests to match new API structure and field filtering
- Remove redundant sequential connection logic
Addresses reviewer feedback from Gemini, CodeRabbit, and Copilot
Co-Authored-By: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Updated the flow export command to utilize `click` for output format selection, improving consistency with other commands. Bumped version to 1.6.6 in `pyproject.toml` and `uv.lock`.
- Fix P0: Wire UnifiedExecutionMixin into Agent class inheritance (Gap 1 now functional)
- Fix P0: Fix deadlock bug in _run_async_in_sync_context using dedicated thread with new event loop
- Fix P0: Fix ImportError by correcting tool_execution import path and using self.execute_tool_async
- Fix P0: Add llm_instance fallback to llm attribute for default Agent constructor paths
- Fix P1: Replace asyncio.coroutine with AsyncMock in tests for Python 3.11+ compatibility
- Fix P1: Yield REQUEST_START event in streaming protocol instead of only emitting to stream_emitter
- Fix P2: Use Optional[str] type annotations instead of implicit str = None
- Fix P2: Remove rate limit errors from recoverable patterns (non-streaming fallback won't help)
- Fix P2: Remove placeholder bug reference URL in AnthropicStreamingAdapter
All three architectural gaps are now fully functional:
- Gap 1: Sync/async duplication eliminated via unified async-first execution core
- Gap 2: Parallel tool execution working with proper ExecutionConfig integration
- Gap 3: Streaming protocol with provider-specific adapters and observable fallback
Co-authored-by: Mervin Praison <[email protected]>
- Add parallel_tool_calls field to ExecutionConfig dataclass
- Update Agent class to consolidate parameter per architecture guidelines
- Add deprecation warning for standalone parallel_tool_calls parameter
- Maintain backward compatibility with fallback logic
- Update chat_mixin.py to use getattr() for safe attribute access
- Fix missing parallel_tool_calls in async get_response_async path
- Update tests to use new ExecutionConfig(parallel_tool_calls=True) pattern
Follows AGENTS.md Section 5.3 parameter consolidation pattern:
'False=disabled, True=defaults, Config=custom'
This addresses architectural concerns about Agent class bloat while
maintaining full backward compatibility.
Co-authored-by: Mervin Praison <[email protected]>
- Add graceful fallback for missing FastAPI/Pydantic dependencies
- Fix Field import to use lambda fallback when Pydantic not available
- Add FASTAPI_AVAILABLE flag to conditionally define models and router
- Improve error handling and module loading robustness
- Add AgentInvokeAPI with FastAPI router for n8n → PraisonAI direction
- POST /api/v1/agents/{agent_id}/invoke endpoint for workflow invocation
- Support for both sync and async agents with session management
- Agent registry for programmatic agent registration
- Comprehensive error handling and validation with Pydantic models
- Integration with existing FastAPI app in api/call.py
- Complete unit tests with FastAPI TestClient
- Full bidirectional integration example with interactive demo
- Follows AGENTS.md architecture guidelines (API in wrapper package)
Co-authored-by: MervinPraison <[email protected]>
- Added SSHSandbox for remote server execution via SSH with asyncssh
- Added ModalSandbox for serverless GPU execution on Modal platform
- Added DaytonaSandbox for cloud development environment execution
- Updated sandbox __init__.py with lazy loading for new backends
- Added optional dependencies: [ssh], [modal], [daytona] in pyproject.toml
- Created comprehensive unit tests for all new sandbox backends
- Added examples/python/sandbox_remote.py with usage demonstrations
- All backends implement complete SandboxProtocol interface
- Follows protocol-driven architecture with implementations in wrapper package
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
- Import GatewayEventType from protocols to fix EventType ambiguity
- Update PlatformWorkspaceContext constructor to require workspace_id
- Fix workspace context assertions to parse JSON response format
- Handle empty description case returning JSON payload instead of None
- Remove model/tools assertions from agent config test (not in schema)
- Use proper UUID generation for test workspace IDs
Addresses architectural gaps identified in Issue #1392, specifically Gap 2:
LLM Tool Calls Execute Sequentially - No Parallelism for Batched Tool Calls.
Changes:
- Add ToolCallExecutor protocol with sequential/parallel implementations
- Add Agent(parallel_tool_calls=True) flag with backward compatibility (default False)
- Update llm.py get_response() and get_response_stream() to use ToolCallExecutor
- Update Agent.chat() to pass parallel_tool_calls setting to LLM
- Add comprehensive tests demonstrating ~3x latency improvement for parallel execution
Benefits:
- When LLM returns multiple tool calls, they execute concurrently instead of sequentially
- Respects existing per-tool timeout infrastructure
- Thread-safe with bounded workers (default 5)
- Zero regression risk (opt-in feature, default preserves current behavior)
- Result ordering matches input order
Test results show 2.98x speedup for 3 concurrent tool calls vs sequential execution.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <[email protected]>
- Add directory validation for --path parameter (prevents NotADirectoryError)
- Fix --limit 0 behavior to show zero results instead of forcing one
- Resolve examples_path to absolute to fix relative_to() errors
Addresses CodeRabbit and Copilot review feedback.
Co-authored-by: Mervin Praison <[email protected]>
- Fix hardcoded localhost → use dynamic hostname for remote access
- Implement proper process management to prevent orphaned processes
- Add signal handlers with cleanup and restoration
- Fix CLI routing for flow/dashboard commands in main.py
- Move FastAPI imports inside function to reduce startup overhead
- Change default host to 127.0.0.1 (secure by default)
- Add service startup verification with 15s timeout
- Rename command from 'unified' to 'dashboard' (no conflicts found)
- Forward host parameter to child services for consistency
- Improve error handling with clear install instructions
Addresses all reviewer feedback from CodeRabbit, Gemini, and Copilot.
Co-authored-by: Mervin Praison <[email protected]>
- Fix hardcoded localhost for remote access compatibility
- Implement proper process cleanup to prevent orphaned processes
- Add flow and unified commands to special_commands CLI router
- Add lazy imports with error handling for optional dependencies
- Improve error handling with proper HTTP status codes
- Add centralized port configuration and process tracking
- Remove static file writing, serve HTML from memory
- Add debug logging and troubleshooting support
Addresses reviewer feedback from Gemini, CodeRabbit, and Copilot.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
This commit addresses the top 3 architectural violations against the stated philosophy:
1. FIXED: Dual LLM execution paths (DRY violation)
- Removed three-branch fork in chat_mixin.py
- Unified all LLM providers through single protocol-driven dispatcher
- Eliminated duplicate logic between LiteLLM and OpenAI paths
- Enhanced unified dispatcher to handle all parameters from legacy paths
2. FIXED: Eager loading of subsystems (performance violation)
- Converted memory/__init__.py to lazy loading using __getattr__
- Moved heavy imports (FileMemory, RulesManager, DocsManager, MCPConfig) to lazy loading
- Agent(instructions='hi') no longer loads unused subsystems at import time
3. IMPROVED: Agent mixin architecture
- Unified dispatcher now protocol-driven rather than inheritance-based
- Lazy loading reduces mixin impact when features aren't used
- Foundation for future protocol composition improvements
Addresses violations of:
- DRY principle: Single LLM execution path eliminates duplication
- Protocol-driven core: Unified dispatcher follows protocol pattern
- Lazy imports: Memory subsystems load only when used
- Performance-first: No import-time overhead for unused features
Aligns with AGENTS.md philosophy:
'Protocols/hooks in core, heavy impl in wrapper/tools'
'Lazy imports, optional deps, no heavy module-level work'
'DRY · Protocol-driven core · No perf impact'
Fixes#1382
Co-authored-by: MervinPraison <[email protected]>
- Add missing copy and time imports to top of workflows.py (Gemini/Copilot)
- Fix handoff chain reset at workflow start to prevent false positives (Copilot)
- Fix session key duplication in session.py agent keys (Copilot)
- Move ToolExecutionError import to top of tool_execution.py (Gemini)
- Remove commented dead code in session.py cleanup (Gemini)
Co-authored-by: Mervin Praison <[email protected]>
Added support for an extended agent card through callbacks.
Implemented new methods for task listing and push notification configuration.
Enhanced task handling to support immediate return configurations,
allowing for background processing of tasks.
Refactored multiple agent-related functions to incorporate these features,
resulting in significant improvements to the A2A functionality.
- Fix undefined response_format variable in async unified dispatch path
- Fix message slicing bug that drops first user message when no system prompt
- Fix thread safety issues in IndexRegistry singleton with proper class-level lock
- Fix thread safety in memory registry using @lru_cache for atomic singleton
- All critical P0/P1 issues from reviewers now resolved
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Fix checkpoint pruning logic reversal (use newest-last semantics)
- Add CHECKPOINTS_PRUNED event type to replace ERROR for normal operations
- Fix ThreadPoolExecutor timeout bypass with explicit executor lifecycle
- Unify AsyncSafeState to use single thread lock across sync/async contexts
- Fix agent cleanup to target actual live clients (llm_instance, openai_client)
- Sync memory fallback logic across async/structured STM entry points
- Move contextvars import to module level for better performance
Addresses critical concurrency, security, and data integrity issues.
Co-authored-by: Mervin Praison <[email protected]>
Implements unified dashboard combining Flow Builder, Claw Dashboard, and Chat UI
at localhost:3000. Users can now access all PraisonAI visual interfaces from
one place:
- Flow Visual Builder (port 7860) - Create agents and workflows visually
- Claw Dashboard (port 8082) - Full featured dashboard with Telegram/Discord bots
- Clean Chat UI (port 8081) - Simple chat interface
New command: praisonai unified
- Single entry point at localhost:3000
- On-demand service launching
- Real-time service status monitoring
- Responsive iframe-based interface
Fixes#1369
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- Add PlatformWorkspaceContext class implementing WorkspaceContextProtocol
- Provides workspace context and agent config via database queries
- Scopes agent queries to workspace for security
- Returns None for missing workspace/agent as per spec
- Export PlatformWorkspaceContext from services module
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Added new authentication and authorization features for PraisonAI Agents.
This includes the implementation of `AuthIdentity`, `AuthBackendProtocol`, and related schemas.
The new API routes and services facilitate session management, role checks,
and workspace context provision for enhanced security and user identity management.
The issue was caused by a local variable 'backend' in the memory configuration
processing that was shadowing the 'backend' parameter from the Agent constructor.
When memory=True was passed to the Agent, the memory backend string (e.g., 'file')
was incorrectly assigned to self.backend instead of the external managed backend.
This caused a RuntimeError: Backend str does not support execute() method when
the Agent tried to delegate to what it thought was a managed backend but was
actually a string.
Changes:
- Rename local variable from 'backend' to 'memory_backend' to avoid shadowing
- Preserves the original backend parameter functionality
- Fixes the issue where memory=True would break external backend delegation
Fixes#1371
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Implemented a concurrency registry to control concurrent task execution
for agents, allowing users to set limits per agent name. Also added message
sink protocols for managing sequenced task execution messages, enabling
replay of agent outputs and tool calls.
New files include:
- agent/concurrency.py
- task/message_sink.py
Updated the task module to include the new protocols in exports.
Total changes across 13 files with 1099 insertions.
- Add global --observe flag to CLI with PRAISONAI_OBSERVE env var support
- Wire observability automatically into Langflow Agent and Agents components
- Update langfuse_example.py to use current TraceSinkProtocol API
- Graceful degradation when Langfuse not installed
Enables users to run:
- praisonai run workflow.yaml --observe langfuse
- PRAISONAI_OBSERVE=langfuse praisonai flow
Fixes#1364 (Phase 1)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
- Fix IndexRegistry singleton broken in knowledge/index.py (P0)
- Fix sync/async unified dispatch default inconsistency
- Fix message slicing logic that drops first user message
- Add thread safety to all singleton patterns with double-checked locking
- Enhance Ollama adapter to handle both dict and list-shaped tool payloads
Addresses feedback from Greptile, Gemini, CodeRabbit, and Copilot reviewers.
Fixes remaining critical issues in architectural gap PR.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Added multiple examples demonstrating the creation and management of agents,
environments, sessions, and custom tools in the managed agents architecture.
This comprehensive set of examples now includes functionalities such as
tool selection, disabling tools, and updating agent configurations, providing
users with clear guidance on utilizing the framework effectively.
Gap 1: Enable unified LLM dispatch by default
- Changed _use_unified_llm_dispatch default from False to True
- Removed dead if False: code block in chat_mixin.py:583-607
- Eliminates triple execution paths for better sync/async feature parity
Gap 2: Extend provider adapter protocol for complete dispatch replacement
- Added 6 new methods to LLMProviderAdapterProtocol: parse_tool_calls,
should_skip_streaming_with_tools, recover_tool_calls_from_text,
inject_cache_control, extract_reasoning_tokens
- Implemented Ollama-specific tool recovery and Gemini streaming skip logic
- Foundation to replace 24+ hardcoded provider checks with adapter calls
Gap 3: Replace singletons with instance-based registries
- Converted IndexRegistry from __new__ singleton to normal class with default()
- Replaced module-level _memory_registry with get_default_memory_registry()
- Added ServerRegistry class to replace global _server_* dicts in agent.py
- Enables multi-agent safe execution and independent registries per agent
Fixes#1362
Co-authored-by: MervinPraison <[email protected]>
- Add backend delegation logic to run(), start(), and chat() methods
- Delegate to external managed agent backend when available
- Fallback to local execution when no backend is configured
- Handle both streaming and non-streaming execution modes
- Add comprehensive test coverage for delegation functionality
- Fix remaining P1 architectural issue from PR reviews
This completes the hybrid execution feature for external managed agent backends.
Co-authored-by: Mervin Praison <[email protected]>
Fixes ArtiPACKED vulnerability (GHSA-3959-6v5q-45q2) where GitHub tokens
were being persisted in .git/config and could leak through artifacts.
- Added persist-credentials: false to 25+ workflow files
- Fixed duplicate with blocks in claude.yml and build-image.yml
- Fixed .github/actions/claude-issue-triage-action/action.yml
Addresses three critical issues identified in code review:
1. CRITICAL: Fix exception path to always emit JSON to stdout
- Previously only printed warning to stderr on exception
- Now emits fallback JSON to maintain tooling reliability
2. HIGH: Capture final_agent metrics when --final-agent used
- Previously only captured original agent metrics
- Now intelligently selects final_agent when available
3. MEDIUM: Move json import to module top per PEP 8
- Moved import json from inline to module level
- Removed redundant inline import sys
Fixes ensure --metrics-json flag maintains reliability contract
for downstream tooling like Terminal-Bench.
Co-authored-by: Mervin Praison <[email protected]>
- Add missing asyncio import to prevent NameError
- Fix asyncio.wait_for with async generator using deadline-based timeout
- Add exception chaining to preserve original traceback context
- Ensures stream() method now works without TypeError
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
- Fix authentication header: use x-api-key instead of Authorization Bearer
- Fix session cache bug: store session_id instead of session_key
- Fix SSE parsing: use readline() for proper line-by-line processing
- Add timeout enforcement to async operations
- Persist API key when loaded from environment variables
- Make AnthropicManagedProvider inherit from ManagedBackendProtocol
- Add regression tests for session caching and API key persistence
Addresses P0 issues identified by reviewers (Greptile, CodeRabbit, Copilot, Gemini)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Mervin Praison <[email protected]>
- Implement ManagedAgentIntegration class in praisonai/integrations/
- Add support for Anthropic Managed Agents API
- Add backend parameter to Agent class for hybrid execution
- Zero new dependencies (uses existing aiohttp)
- Follow existing BaseCLIIntegration pattern
- Include comprehensive tests
Fixes#1358
Co-authored-by: MervinPraison <[email protected]>
- Add --metrics-json command-line flag to enable JSON cost output
- Output structured metrics including cost_usd, tokens_in, tokens_out, model, request_count
- Enables programmatic cost tracking for Terminal-Bench and other tools
- Uses existing MetricsHandler for data extraction
- Fixes CLI cost tracking gap identified in issue #1356🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: MervinPraison <[email protected]>
Added `praisonai_wrapper_agent.py` for a CLI-based agent approach.
Updated `README.md` to include integration details for both external
and wrapper agents, and added examples for usage. Enhanced `job.yaml`
with configuration options for the wrapper agent. Minor updates
to existing files to improve clarity and maintainability.
Added support for custom git author information from environment variables
in the CLI. Updated version to 1.5.143 in project files. Adjusted
git commit commands to include the author if provided.
Added tracing instructions for Langfuse and updated the default user
name and email settings in CheckpointConfig and FileSnapshot to fetch
from environment variables. Bumped version to 1.5.142.
- Added Langfuse tracing documentation to README.
- Introduced user_name and user_email parameters in CheckpointService and FileSnapshot classes for custom Git configuration.
- Updated relevant methods to utilize new parameters for better user identification in commits.
- Added a new image for Langfuse tracing under .github/images.
- Add __enter__/__exit__ context manager support to AsyncSafeState for backward compatibility
- Add chat_history property setter to prevent AttributeError on assignments
- Fix validate_output to call _llm_validate instead of non-existent validate method
- Update all _memory references to _memory_instance in AsyncMemoryMixin
- Replace deprecated asyncio.get_event_loop() with get_running_loop()
Fixes critical runtime errors that would break core Agent functionality.
All changes maintain backward compatibility and follow AGENTS.md principles.
Co-authored-by: Mervin Praison <[email protected]>
- Add __enter__/__exit__ context manager support to AsyncSafeState for backward compatibility
- Add chat_history property setter to prevent AttributeError on assignments
- Fix memory attribute references throughout AsyncMemoryMixin (_memory → _memory_instance)
- Fix LLMGuardrail.validate_output to use _llm_validate instead of non-existent validate method
- Move GuardrailChain implementation out of protocols.py for cleaner separation
- Update deprecated asyncio.get_event_loop() to asyncio.get_running_loop()
All changes maintain backward compatibility and align with AGENTS.md principles.
Co-authored-by: Mervin Praison <[email protected]>
- Changed repository reference for install.sh from praisonai-package to MervinPraison/PraisonAI.
- Improved sync mechanism to only copy files if there are changes, ensuring the latest version is served.
- Added references to official resources and documentation in the security audit workflow.
- Included guidelines for creating security advisories and reporting vulnerabilities.
- Gap 1: Add AsyncSafeState dual-lock abstraction for async/sync agent state protection
- Gap 2: Add GuardrailProtocol with fail-closed error handling for production safety
- Gap 3: Add AsyncMemoryMixin for async-safe memory operations without event loop blocking
Fixes core async/concurrency issues, improves guardrails safety model, and enables
proper async memory operations as outlined in issue analysis.
Co-authored-by: MervinPraison <[email protected]>
Enhance `bump_and_release.py` and `release.py` scripts to add specific
release files instead of all changes. Introduced a check for
uncommitted changes with informative error messages. This reduces the
risk of accidental changes during the release process.
Refactor instructions for issue analysts and software engineers to
enhance clarity. Details include requiring issue number discovery via
local environment and simplifying commit and PR messaging to remove
explicit issue number references.
- Add asyncio queue inbox to GatewaySession for concurrency
- Intercept and enqueue messages while session is executing
- Resolve GatewaySession stepper background worker thread processing
- Implement RecipeBotAdapter to bridge declarative recipes to conversational agents
- Register support for --recipe flag in bot start commands
- Refactor 'praisonai serve recipe' to boot WebSocketGateway instead
* security: Fix CORS Configuration Vulnerabilities (CWE-942) - Replace wildcard origins
- Replace allow_origins=['*'] with secure environment-based configurations
- Update browser server to use BROWSER_CORS_ORIGINS env var with localhost defaults
- Update jobs server to use JOBS_CORS_ORIGINS env var with localhost defaults
- Update example API to use API_CORS_ORIGINS env var with localhost defaults
- Remove wildcard defaults from ServerConfig, GatewayConfig, and AppConfig
- Add secure localhost defaults to MCP server transport
- Update tests and documentation to reflect secure defaults
- Restrict CORS methods and headers to essential ones only
Fixes#1321 - Addresses 3 instances of CWE-942 vulnerabilities
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: Address 3 CORS bugs found in review - chrome-extension regex, http_stream headers, server.py methods/headers
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/b76a2075-da18-4ad5-82e8-79fc09457529
Co-authored-by: MervinPraison <[email protected]>
* security: Fix remaining CORS vulnerabilities (CWE-942)
- Add environment-based CORS defaults (empty for production)
- Validate env vars to reject wildcard origins (*)
- Add missing Idempotency-Key header to jobs CORS
- Unify WebSocket and HTTP CORS origin validation
- Make http_stream transport environment-aware
Fixes all critical security issues identified by code reviewers:
- Production no longer allows localhost by default
- Environment variables cannot bypass security with *
- WebSocket uses same origin validation as CORS middleware
- Jobs API properly supports Idempotency-Key header
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Updated action and workflow files to use consistent input variable references.
This includes changes to environment variable handling for better clarity
and maintainability, enhancing code quality and reducing potential errors.
* fix(security): replace insecure MD5 with SHA-256 and disable debug mode
Replace all 29 instances of hashlib.md5() with hashlib.sha256() across
22 files. MD5 is cryptographically broken (CWE-328) and should not be
used for hashing, even for non-security purposes like cache keys and
content fingerprints.
Also disable debug=True in api.py (CWE-489) to prevent information
leakage in production deployments.
Vulnerabilities fixed:
- 28x CWE-328: Use of Weak Hash (MD5 → SHA-256)
- 1x CWE-489: Active Debug Code (debug=True → debug=False)
Detected by semgrep (p/owasp-top-ten, p/python).
Verified by re-scan: 66 findings → 37 remaining (29 fixed).
Remaining findings (require manual review):
- 14x shell injection (subprocess with user input)
- 10x subprocess shell=True
- 3x wildcard CORS
- 5x tainted env args in subprocess
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address review feedback on MD5→SHA-256 migration
Fixes raised by Gemini Code Assist, Qodo, and CodeRabbit:
1. templates/security.py: algorithm="md5" now raises ValueError
instead of silently returning SHA-256 digest
2. recipe/security.py: CycloneDX serialNumber now uses uuid5()
for RFC 4122 compliant UUID format (was 64-char hexdigest)
3. agent/agent.py: backward-compatible session ID — checks for
legacy MD5-based session file on disk before using new SHA-256 ID
4. snapshot/snapshot.py: backward-compatible shadow repo path —
adopts legacy MD5-based directory if it exists on disk
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Michael Winczuk <[email protected]>
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
Updated unit and integration tests for better readability and maintainability.
Replaced repetitive subprocess calls with a dedicated `run_doctor` function in
the doctor CLI tests, and improved error handling in the handoff error tests.
Removed unnecessary test cases and cleaned up assertions for clarity.
Total changes: 57 insertions, 151 deletions across 10 files.
Replaced the old use cases section with a more detailed table outlining specific applications of AI agents across various industries, enhancing clarity and usability for readers.
- Remove unreachable dead code (issues list never populated)
- Fix misleading warning message to distinguish channel vs global warnings
- Improve exception handling: ValueError for config errors (FAIL) vs runtime errors (ERROR)
- Make bot checks accessible via CLI by:
- Converting to registry-based @register_check decorators
- Adding bot_checks to register_all_checks()
- Adding 'bots' subcommand to CLI actions and category mapping
Co-authored-by: Mervin Praison <[email protected]>
- Add check_bot_security() function to bot_checks.py doctor module
- Validates allowlist/blocklist configuration across channels
- Warns about overly permissive group policies (respond_all vs mention_only)
- Checks for PRAISONAI_GATEWAY_SECRET to ensure pairing persistence
- Provides actionable remediation guidance for secure configurations
- Integrates with existing doctor framework for 'praisonai doctor --category bots'
This implements the 'doctor-style check' component requested in issue #1313
for auditing risky bot security configurations before production deployment.
Fixes#1313🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Moved the highlighted section from the middle to the bottom of the README for better visibility. Adjusted image and quote formatting to maintain clarity and consistency.
Improved installation instructions for SDK, CLI, Dashboard, and Builders
with example commands. Added new visual elements for better engagement.
Removed redundant elements to streamline content.
Revise main description to emphasize hiring autonomous AI agents.
Condense sections for quick paths and performance, improving the overall flow.
Remove outdated use cases and provide a more engaging introduction to PraisonAI.
- Add Awaitable import and update TaskExecutorProtocol return type for async compatibility
- Add error handling for missing executor agents with clear remediation message
- Fix variable substitution to include team-level variables for async/sync consistency
- Remove unused Union import (already done in previous commit)
Addresses valid reviewer feedback from CodeRabbit, Qodo, Copilot, and Gemini.
Co-authored-by: Mervin Praison <[email protected]>
- Remove duplicate adapters.py file to eliminate multiple sources of truth
- Replace runtime class mutation with composition-based unified dispatch for safety
- Fix missing tool execution parameters in unified sync mode
- Preserve hooks and post-processing flow in unified paths to maintain observability
- Fix duplicate verbose kwarg crash in LiteLLMAdapter
- Fix protocol violations in sync wrappers (no asyncio.run in library internals)
- Fix message extraction logic to prevent prompt duplication
- Make OpenAIAdapter sync delegate to async as required by protocol
- Improve test suite with proper sync/async parity and performance regression tests
- Add comprehensive real agentic test as required by AGENTS.md
All critical issues from reviewers addressed while maintaining backward compatibility.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Implemented automatic discovery and loading of protocol-driven plugins
via pip in the `PluginManager`. The new method `discover_entry_points`
fetches entry points from the `praisonai.plugins` group, loads callable
plugins, and registers them. Updated version number to 1.5.117.
- Remove unused Union import from protocols.py
- Update _build_execution_context() to return ExecutionContext dataclass
- Update _process_task_result() to accept ExecutionContext and return TaskResult
- Fix execute_task/aexecute_task to use attribute access on ExecutionContext
- Remove trailing whitespace in protocols.py
Addresses reviewer feedback from Qodo, Gemini, CodeRabbit, and Copilot
regarding protocol usage consistency and type safety.
Co-authored-by: Mervin Praison <[email protected]>
This commit addresses Issue #1304 by consolidating the dual execution paths
in the LLM layer (LiteLLM vs OpenAI) into a single async-first protocol-driven
architecture, eliminating DRY violations and maintenance burden.
Key changes:
- Added UnifiedLLMDispatcher with provider adapter pattern
- Created LiteLLMAdapter and OpenAIAdapter for protocol conformance
- Enhanced agent chat logic with opt-in unified dispatch
- Maintained full backward compatibility (existing code unchanged)
- Established protocol-driven foundation for future provider additions
Benefits:
✅ Single async chat completion implementation
✅ Sync methods as thin wrappers around async
✅ Protocol-driven provider selection
✅ Elimination of dual execution paths
✅ All existing functionality preserved
Files added:
- praisonaiagents/llm/unified_adapters.py (protocol adapters)
- praisonaiagents/agent/unified_chat_mixin.py (unified implementation)
- test_unified_llm.py (verification tests)
Files modified:
- praisonaiagents/llm/__init__.py (updated exports)
- praisonaiagents/agent/chat_mixin.py (added unified dispatch option)
The unified dispatch is opt-in via _use_unified_llm_dispatch flag, ensuring
zero impact on existing deployments while enabling clean migration path.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
- Fix GeminiAdapter tool names to match GEMINI_INTERNAL_TOOLS constants
- Fix OllamaAdapter threshold to match LLM.OLLAMA_SUMMARY_ITERATION_THRESHOLD = 1
- Extract generic AdapterRegistry[T] base class to eliminate DRY violation
- Add debug logging to registry exception handling (no longer silent)
- Move InMemoryAdapter from __init__.py to its own in_memory_adapter.py module
- Add 38 unit tests covering all new adapter and registry code paths"
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/0fc360e2-23ac-43a1-8a56-50dd4686feb1
Co-authored-by: MervinPraison <[email protected]>
Shows how to replace scattered provider dispatch in llm.py with clean adapters:
- DefaultAdapter: Base implementation with sensible fallbacks
- OllamaAdapter: Replaces OLLAMA_SUMMARY_ITERATION_THRESHOLD logic
- AnthropicAdapter: Handles Claude prompt caching capabilities
- GeminiAdapter: Handles gemini_internal_tools formatting
- get_provider_adapter(): Replaces model.startswith() branching
This demonstrates the systematic approach for Gap 2 - extracting the 40+
provider branches from core into clean, testable adapters.
Co-authored-by: MervinPraison <[email protected]>
- Fix entry points never discovered in main flow (plugins.enable now calls discover_entry_points)
- Fix fragile entry_points fallback using robust try/except pattern from ToolRegistry
- Fix non-deterministic tests by mocking importlib.metadata properly
- Fix overbroad import monkeypatch to only affect importlib.metadata
- Add thread safety with proper _lock usage in register() and discover_entry_points()
- Add positive test case for successful entry point loading and registration
All reviewer feedback from Qodo, Gemini, CodeRabbit addressed.
Co-authored-by: Mervin Praison <[email protected]>
- Fix HandoffConfig.max_concurrent default from 3 to 5 per issue requirements
- Fix deadlock bug: parallel_handoffs() now treats max_concurrent<=0 as unlimited
- Fix BaseException handling to prevent non-HandoffResult objects in return list
- Export parallel_handoffs in package __init__.py for public API access
- Remove broken documentation URL from deprecation warning
- Wire allow_parallel flag to control parallel_handoffs() behavior
- Fix unused variable warning by prefixing with underscore
These changes address all critical bugs and API inconsistencies identified
by code reviewers while maintaining backward compatibility.
Co-authored-by: Mervin Praison <[email protected]>
- Fix threading.Lock used with async with in Process class (issue #1289)
* Replace sync lock creation with lazy async lock initialization
* Prevents runtime AttributeError in aworkflow method
- Improve thread safety in AsyncPostgres lazy lock initialization
* Add double-checked locking pattern to prevent race conditions
* Ensures only one asyncio.Lock instance created across coroutines
- Remove redundant asyncio import in async_postgres.py
- Improve exception chaining for better error diagnostics
Addresses critical issues raised by Gemini, Qodo, CodeRabbit reviewers.
Co-authored-by: Mervin Praison <[email protected]>
- Add discover_entry_points() method to PluginManager for automatic plugin discovery
- Support pip-installed plugins via 'praisonaiagents.plugins' entry_points group
- Compatible with Python 3.8+ using importlib.metadata
- Graceful error handling for missing dependencies
- Added comprehensive unit tests for entry_points discovery
- Enables external plugin packages like PraisonAI-Plugins to be auto-discovered
Fixes#1293
Co-authored-by: Mervin Praison <[email protected]>
Addresses Gap 2 from issue #1289:
1. Replace asyncio.Lock() with threading.Lock() in Process.__init__() - asyncio.Lock in sync constructor fails outside event loop
2. Add async lock protection to async postgres store init() to prevent race conditions creating duplicate connection pools
3. Fix memory state store _maybe_save() race condition where multiple threads could trigger overlapping saves
4. Verified existing thread safety in global error_logs, callbacks already properly protected with locks
5. Verified MemoryMixin already has proper thread safety with _history_lock
These changes ensure multi-agent safety by eliminating race conditions and thread safety issues that could corrupt state or cause crashes when running multiple agents concurrently.
Co-authored-by: Mervin Praison <[email protected]>
Refactor tests for `LangfuseSinkEmit` to use agent spans with a consistent
identifier format. Update assertions to reflect changes in method
validations for agent classes in `TestApiMdGenerator`. Adjusted several
mock object usages for improved clarity and consistency across tests.
Root cause of issue #1283 failure:
1. git config was local, not --global, so identity failed in cloned repos
2. External repos (PraisonAIDocs) were cloned with bare https (no auth)
3. Claude tried to push to main instead of a feature branch
Fix:
- Use --global git config for identity across all repos
- Add STEP 3-ALT with explicit cross-repo workflow using gh repo clone
- gh repo clone auto-configures auth token for push
- Add PraisonAI-Plugins and PraisonAIDocs to routing table
- Explicit instructions to never use bare git clone https://
- Resolve merge conflicts with main branch
- Fix getattr sandbox inconsistency by removing getattr from blocked AST calls
- Combine dangerous patterns from both branches for comprehensive protection
- Allow _safe_getattr implementation to work properly in sandbox mode
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <[email protected]>
- Fix ModelNotAvailableError to properly pass provider/model to base exception
- Fix RateLimitError type annotation (Optional[str] instead of str = None)
- Fix ContextLengthExceededError to accept and pass provider/model parameters
- Add async aretrieve method to RetrievalStrategyProtocol for async I/O support
- Add missing newline at end of protocols.py file
Addresses review feedback from code reviewers.
Co-authored-by: Mervin Praison <[email protected]>
Moved test agents and tools to a dedicated fixtures directory. Updated test scripts to reference the new file paths. Removed obsolete test agent and tool files. Improved instructions for running tests.
Explicitly tells Claude to clone and open PRs in MervinPraison/PraisonAI-Tools
when a request is for an external tool, integration, or community extension.
- Improved `get_agent_ledger` method in `ledger.py` by adding validation
for `agent_id` to raise a `ValueError` if it is empty.
- Updated `_get_output_path` in `monitor.py` to include detailed path
sanitization steps and added checks to prevent path traversal attacks.
- Refined agent name sanitation and fallback techniques to ensure unique
naming.
- Incremented version number to `1.5.114` in `pyproject.toml` and
`uv.lock`.
After rebase, commit 72e477f added runtime support for:
- context str/dict -> restore to type hint
- autonomy str -> restore to type hint
- approval dict -> restore to type hint
- learn str -> restore to type hint
templates str remains removed (resolve() with no presets returns None).
Updated all docstrings to document actual supported types including new forms.
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/e371c8e1-a816-4fb2-8eb8-a18242daa2de
Co-authored-by: MervinPraison <[email protected]>
- Add missing 'from starlette.routing import Mount' import
- Mount was used on line 1046 but not imported
- Fixes NameError when launching agents in MCP mode
🤖 Generated with Claude Code
Co-authored-by: MervinPraison <[email protected]>
- Add string preset handling in _init_autonomy() for autonomy='full_auto' etc.
- Add str/dict support in context_manager property for context='summarize' etc.
- Add dict-to-ApprovalConfig conversion for approval={'backend': ..., 'all_tools': True}
- Add string mode handling in learn parameter for learn='agentic' etc.
- Fix AUTONOMY_PRESETS to use 'level' field (not 'mode') per AutonomyConfig
Resolves type hint/implementation mismatches identified by code reviewers.
All new type hints now have proper runtime support.
Co-authored-by: Mervin Praison <[email protected]>
- Remove _global_hooks, enable_observability(), disable_observability(), and get_hooks()
- Observability is now strictly per-agent/per-pipeline to comply with AGENTS.md Rule 4.5
- Agent class already correctly uses per-instance ObservabilityHooks() when observe=True
- Eliminates shared mutable state between agents for multi-agent safety
Addresses critical architecture gap identified in PR #1277 final review.
Co-authored-by: Mervin Praison <[email protected]>
* fix(ci): integrate Claude final review directly into auto-pr-comment workflow to bypass action_required approval gate
* fix(ci): address review issues in auto-pr-comment workflow
- Fix template injection: use env vars + process.env instead of inline ${{ }} in JS
- Add timeout-minutes: 15 to polling jobs (prevent runaway Actions minutes)
- Add issues: write permission to all Claude-trigger jobs
- Restore claude-after-gemini job lost when chain-claude-after-copilot.yml was deleted
- DRY: extract polling constants and trigger login list to workflow-level env vars
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/0ff67a7f-85be-4e2e-a16f-f3f48ebfefb5
Co-authored-by: MervinPraison <[email protected]>
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
* fix: remove global logging monkey-patch from memory.py
Remove logging.Logger.trace monkey-patch that violated protocol-driven
architecture by modifying global state at import time. The trace
functionality remains available locally within the memory module.
This addresses one architectural violation from issue #1262 while
maintaining backward compatibility and keeping changes minimal.
Co-authored-by: Mervin Praison <[email protected]>
* fix: replace logger.trace() with logger.log(TRACE_LEVEL) after removing monkey-patch
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/56f044b6-1424-4985-b09b-afe047dadd8b
Co-authored-by: MervinPraison <[email protected]>
---------
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
- Add _safe_extractall() to reject absolute paths, '..' traversal, and path escape in tar archives
- Validate name/version from manifest BEFORE any filesystem operation in LocalRegistry.publish
- Add path confinement check ensuring resolved recipe_dir stays under recipes_path
- Validate URL path params in RegistryServer publish endpoint (early 400 rejection)
- Replace vulnerable tar.extractall() calls in both LocalRegistry and HttpRegistry
- Bump version to 4.5.113
Please analyze the request and provide helpful assistance. You have access to repository tools and can help with:
- Code analysis and implementation
- GitHub workflows and automation
- Pull request reviews and feedback
- Issue resolution and bug fixes
- Documentation updates
- Testing and deployment
Please analyze the request and provide helpful assistance.
CRITICAL INSTRUCTION: If your task involves modifying codebase files to add a feature or fix a bug:
1. ALWAYS create a new git branch appropriately named (e.g. \`feature/issue-<number>\`).
2. MANDATORY: Before writing any code, you MUST carefully read "src/praisonai-agents/AGENTS.md" to understand this repository's extremely specific Architecture, Protocol-First design rules, and Agent-Centric Philosophy.
3. Make your necessary code changes honoring the rules in AGENTS.md.
4. Commit your changes and push the branch to the remote repository.
5. Use the GitHub CLI (\`gh pr create --title "..." --body "Fixes #<number>"\`) to open a Pull Request containing your work.
MANDATORY: Before writing any code, you MUST carefully read "src/praisonai-agents/AGENTS.md" to understand this repository's extremely specific Architecture, Protocol-First design rules, and Agent-Centric Philosophy.
Before implementing anything, answer these questions:
- CORE vs WRAPPER vs TOOLS ROUTING:
1. Core SDK (praisonaiagents/): Only core protocols, base classes, decorators. No heavy implementations.
2. Wrapper (praisonai/): CLI, heavy implementations, optional dependencies.
3. Tools (PraisonAI-Tools): Specific integrations, external tools (e.g. SurrealDB, Slack), and community extensions MUST go to the `MervinPraison/PraisonAI-Tools` repository. If the feature is a tool, clone `https://github.com/MervinPraison/PraisonAI-Tools`, implement it there, and create the PR using `gh pr create -R MervinPraison/PraisonAI-Tools`.
- Does it duplicate existing functionality? Check if Agent already supports this via existing params (reflection, planning, tools, hooks, memory).
- Does it inherit from Agent properly? New agent types MUST inherit Agent, not wrap it with composition.
- Does it add new dependencies? Only optional deps allowed, must be lazy-imported.
- Will agent.py grow larger? If the change adds >50 lines to agent.py, find a way to extract instead.
- Is there a name collision with existing exports in __init__.py?
If ANY of these conceptual checks fail (excluding routing), add a comment to the issue explaining why and close it. Do NOT create a PR.
STEP 3 — IMPLEMENT:
- Create a new git branch appropriately named (e.g. \`feature/issue-<number>\`)
- Follow protocol-driven design: protocols in core SDK, heavy implementations in wrapper
goal:"Read the GitHub issue, understand the required changes, and map the problem to the local codebase"
backstory:"You are an expert software analyst who reads bug reports and feature requests. You excel at taking a problem description and finding exactly which files in the codebase need to be modified. Your primary job is discovery and planning."
tools:
- "execute_command"
software_engineer:
role:"Autonomous Software Engineer"
goal:"Implement required code changes on a branch, run tests, commit, and push"
backstory:"You are a senior software engineer. You always branch first, implement changes using shell commands, verify with git diff, run tests, then commit and push. You never create a Pull Request unless the issue body explicitly requests one."
tools:
- "execute_command"
- "github_create_branch"
- "github_commit_and_push"
- "github_create_pull_request"
steps:
- name:Analyze Issue
agent:issue_analyst
action:>
Thoroughly analyze the issue and the repository. Follow these steps in order.
First, set up git identity: execute_command 'git config user.name PraisonAI' then
execute_command 'git config user.email [email protected]'. Do NOT pass cwd.
Second, read the issue: execute_command 'cat .github/triage-context.md'. Do NOT pass cwd.
goal:"Identify security vulnerabilities, authentication issues, input validation problems, and unsafe code practices in the PR changes"
backstory:"You are a cybersecurity expert specializing in code analysis. You have extensive experience in identifying common security flaws like injection attacks, authentication bypasses, exposed secrets, and unsafe data handling patterns."
tools:
- "execute_command"
performance_reviewer:
role:"Performance Code Reviewer"
goal:"Analyze code changes for performance implications, identify bottlenecks, inefficient algorithms, and resource usage issues"
backstory:"You are a performance optimization specialist with deep knowledge of algorithm efficiency, memory management, and system performance. You excel at spotting code that could cause performance degradation."
tools:
- "execute_command"
maintainability_reviewer:
role:"Code Quality & Maintainability Reviewer"
goal:"Evaluate code structure, readability, documentation, naming conventions, and adherence to best practices"
backstory:"You are a software engineering expert focused on code quality and maintainability. You ensure code follows established patterns, is well-documented, and will be easy for future developers to understand and modify."
tools:
- "execute_command"
lead_reviewer:
role:"Lead Technical Reviewer"
goal:"Synthesize all review feedback, make final recommendations, and post comprehensive review comments to the GitHub PR"
backstory:"You are a senior technical lead responsible for final review decisions. You coordinate input from security, performance, and maintainability reviewers to provide balanced, actionable feedback to the development team."
tools:
- "execute_command"
steps:
- name:security_analysis
agent:security_reviewer
action:|
Analyze the PR diff for security issues:
1. Extract PR details: `echo "$PR_DATA"`
2. Get changed files: `echo "$CHANGED_FILES"`
3. Review full diff: `gh pr diff ${PR_NUMBER}`
4. Look for:
- Hardcoded secrets, API keys, passwords
- SQL injection vulnerabilities
- XSS vulnerabilities
- Authentication/authorization bypasses
- Unsafe file operations
- Command injection risks
- Missing input validation
- Exposed sensitive data
5. Document findings with file paths and line numbers
expected_output:"Detailed security analysis report with specific vulnerabilities found, severity levels, and remediation suggestions"
- name:performance_analysis
agent:performance_reviewer
action:|
Analyze the PR diff for performance issues:
1. Review algorithm complexity changes
2. Check for inefficient database queries
3. Identify memory leaks or excessive allocations
4. Look for hot-path regressions
5. Check for blocking I/O operations
6. Analyze module-level imports that could slow startup
7. Review caching implementations
8. Check for recursive operations without termination
9. Document performance concerns with impact estimates
expected_output:"Performance analysis report highlighting bottlenecks, efficiency concerns, and optimization recommendations"
- name:maintainability_analysis
agent:maintainability_reviewer
action:|
Analyze the PR diff for code quality and maintainability:
1. Check naming conventions consistency
2. Evaluate code structure and organization
3. Review documentation completeness
4. Check for DRY violations
5. Analyze error handling patterns
6. Review test coverage for changes
7. Check adherence to repository coding standards
8. Evaluate API design consistency
9. Look for technical debt introduction
expected_output:"Code quality analysis with specific recommendations for improving maintainability and readability"
- name:final_review
agent:lead_reviewer
action:|
Synthesize all reviews and post final comprehensive feedback:
1. Collect input from security, performance, and maintainability reviews
2. Prioritize findings by severity (Critical, High, Medium, Low)
3. Create structured review comment using this format:
## 📋 Review Summary
[2-3 sentence overview and assessment]
## 🔍 General Feedback
[Overall patterns and observations]
## 🎯 Specific Feedback
### 🔴 Critical (if any)
[Security vulnerabilities, breaking changes, major bugs]
body: '@copilot Do a thorough review of this PR. Read ALL existing reviewer comments above from Qodo, Coderabbit, and Gemini first — incorporate their findings.\n\nReview areas:\n1. **Bloat check**: Are changes minimal and focused? Any unnecessary code or scope creep?\n2. **Security**: Any hardcoded secrets, unsafe eval/exec, missing input validation?\n3. **Performance**: Any module-level heavy imports? Hot-path regressions?\n4. **Tests**: Are tests included? Do they cover the changes adequately?\n5. **Backward compat**: Any public API changes without deprecation?\n6. **Code quality**: DRY violations, naming conventions, error handling?\n7. **Address reviewer feedback**: If Qodo, Coderabbit, or Gemini flagged valid issues, include them in your review\n8. Suggest specific improvements with code examples where possible'
body: '@copilot Do a thorough review of this PR. Read ALL existing reviewer comments above first.\n\nReview areas:\n1. **Bloat check**: Are changes minimal and focused?\n2. **Security**: Any hardcoded secrets, unsafe eval/exec, missing input validation?\n3. **Performance**: Any module-level heavy imports? Hot-path regressions?\n4. **Tests**: Are tests included? Do they cover the changes adequately?\n5. **Backward compat**: Any public API changes without deprecation?\n6. **Code quality**: DRY violations, naming conventions, error handling?\n7. Suggest specific improvements with code examples where possible'
const claudeBody = '@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. ' + reviewSummary + '.\n\n' +
body: '@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n\n**Phase 2: FIX Valid Issues**\n4. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n5. Push all code fixes directly to THIS branch (do NOT create a new PR)\n6. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n7. If all issues are resolved, approve the PR / close the Issue\n8. If blocking issues remain, request changes / leave clear action items'
body: '@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n\n**Phase 2: FIX Valid Issues**\n4. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n5. Push all code fixes directly to THIS branch (do NOT create a new PR)\n6. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n7. If all issues are resolved, approve the PR / close the Issue\n8. If blocking issues remain, request changes / leave clear action items'
body: '@claude You are the Lead Engineer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL analysis and reviews above carefully (Gemini, CodeRabbit, Qodo, Copilot, etc).\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n\n**Phase 2: FIX Valid Issues**\n4. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n5. Push all code fixes directly to THIS branch (do NOT create a new PR)\n6. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n7. If all issues are resolved, approve the PR / close the Issue\n8. If blocking issues remain, request changes / leave clear action items'
body: '@claude You are the FINAL architecture reviewer. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n\n**Phase 2: FIX Valid Issues**\n4. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n5. Push all code fixes directly to THIS branch (do NOT create a new PR)\n6. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n7. If all issues are resolved, approve the PR / close the Issue\n8. If blocking issues remain, request changes / leave clear action items'
})
# Trigger Claude after Gemini finishes on an Issue or PR
body: '@claude You are the Lead Engineer. Read ALL analysis and reviews above carefully (Gemini, CodeRabbit, Qodo, Copilot, etc).\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n\n**Phase 2: FIX Valid Issues**\n4. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n5. Push all code fixes directly to THIS branch (do NOT create a new PR)\n6. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n7. If all issues are resolved, approve the PR / close the Issue\n8. If blocking issues remain, request changes / leave clear action items'
${{ steps.check_fork.outputs.is_fork == 'true' && 'CRITICAL: THIS IS A PULL REQUEST FROM A FORK. YOU DO NOT HAVE PUSH PERMISSIONS TO THIS REPOSITORY. ONLY READ FILES, VALIDATE CODE, AND PROVIDE YOUR COMMENTS/FEEDBACK DIRECTLY IN THIS PR VIA COMMENTS. DO NOT ATTEMPT TO PUSH OR CREATE PULL REQUESTS.\n\n' || 'NOTE: The branch is under MervinPraison/PraisonAI (not a fork). You are able to make modifications and push directly to this branch.\n\n' }}
You are working on the PraisonAI SDK. Follow AGENTS.md strictly.
When work must happen in a different repository, follow these steps EXACTLY. Do NOT attempt to use `cd`, as directory state is not preserved. Use `git -C` for all commands.
- For SDK changes: cd src/praisonai-agents && PYTHONPATH=. python -m pytest tests/ -x -q --timeout=30
- For docs changes: verify files exist and are valid markdown/MDX
- Ensure no regressions
STEP 5 — CREATE PR:
- Commit with descriptive message, push, and create PR using `gh pr create`
CRITICAL: You MUST create the PR automatically using `gh pr create`. Do NOT just provide a link.
- For external repos, use `gh pr create -R MervinPraison/<REPO_NAME>`
CRITICAL: You MUST create the PR automatically using `gh pr create`. Do NOT just provide a link or say "manual push required".
NOTE: If you worked on an external repo, the wrapper action will report "No commits" for the main repo at the end. This is expected, do not worry about it.
PraisonAI 🦞 — Automate and solve complex challenges with AI agent teams that plan, research, code, and deliver results to Telegram, Discord, and WhatsApp — running 24/7. A low-code, production-ready multi-agent framework with handoffs, guardrails, memory, RAG, and 100+ LLM providers, built around simplicity, customisation, and effective human-agent collaboration.
PraisonAI 🦞 — **Hire a 24/7 AI Workforce.** Stop writing boilerplate and start shipping autonomous agents that research, plan, and execute tasks across your apps. From one agent to an entire organization, deployed in 5 lines of code.
PraisonAI is built for speed, with agent instantiation in under 4μs. This reduces overhead, improves responsiveness, and helps multi-agent systems scale efficiently in real-world production workloads.
| Performance Metric | PraisonAI |
|--------------------|-----------|
| Avg Instantiation Time | **3.77 μs** |
---
## 🎯 Use Cases
AI agents solving real-world problems across industries:
@@ -104,9 +87,44 @@ AI agents solving real-world problems across industries:
---
## Supported Providers
## 🚀 Meet your first Agent (Under 1 Minute)
PraisonAI supports 100+ LLM providers through seamless integration:
1. Install the lightweight core SDK:
```bash
pip install praisonaiagents
exportOPENAI_API_KEY="your-api-key"
```
2. Run your first autonomous agent:
```python
frompraisonaiagentsimportAgent
# Give your agent a goal, and watch it work.
agent=Agent(instructions="You are a senior data analyst.")
agent.start("Analyze the top 3 tech trends of 2026 and format as a markdown table.")
```
---
## 🌌 The PraisonAI Ecosystem
Start simple with the core SDK, or expand to full visual builders and dashboards when you're ready.
***Core SDK (`praisonaiagents`)**: For pure Python development. `pip install praisonaiagents`
| AI Commit Messages | [Docs](https://docs.praison.ai/docs/cli/commit) | [📖](https://docs.praison.ai/docs/cli/commit) |
| @Mentions in Prompts | [Docs](https://docs.praison.ai/docs/cli/mentions) | [📖](https://docs.praison.ai/docs/cli/mentions) |
@@ -774,6 +729,20 @@ const agent = new Agent({ instructions: 'You are a helpful AI assistant' });
agent.start('Write a movie script about a robot in Mars');
```
---
## ⚡ Performance
PraisonAI is built for speed, with agent instantiation in under 4μs. This reduces overhead, improves responsiveness, and helps multi-agent systems scale efficiently in real-world production workloads.
| Performance Metric | PraisonAI |
|--------------------|-----------|
| Avg Instantiation Time | **3.77 μs** |
---
---
## ⭐ Star History
@@ -782,6 +751,19 @@ agent.start('Write a movie script about a robot in Mars');
"Verify pandas and express are installed: run 'python3 -c \"import pandas; print(pandas.__version__)\"' and 'node -e \"console.log(require.resolve('express'))\"'",
"Verify pandas and express are installed: run python3 -c 'import pandas; print(pandas.__version__)' and node -e 'console.log(require.resolve(\"express\"))'",
stream=True,
)
# 17. Limited networking — restrict container to specific hosts
print("\n[17] Limited networking...")
limited_net_managed=ManagedAgent(
config=ManagedConfig(
name="Restricted Network Agent",
model="claude-haiku-4-5",
system="You are a helpful assistant with restricted network access.",
result=mcp_agent.start("Use the deepwiki MCP to read the wiki page for the anthropics/anthropic-cookbook github repo and give a one sentence summary",stream=True)
This directory contains examples for integrating PraisonAI Agents with **Terminal-Bench 2.0** via the **Harbor framework** for AI agent benchmarking.
## Overview
[Terminal-Bench 2.0](https://tbench.ai) is a Stanford/Laude Institute benchmark that has become the gold standard for evaluating AI coding agents in real terminal environments. The [Harbor framework](https://harborframework.com) is the official evaluation harness that abstracts container lifecycle, parallelization, and cloud providers.
## Integration Types
### 1. External Agent (Direct Agent Class)
- **File**: `praisonai_external_agent.py`
- **Purpose**: External agent that uses direct `Agent()` class instantiation
- **Usage**: Run with `--agent-import-path` flag
- **Approach**: Uses `praisonaiagents.Agent` directly with `execute_command` tool
### 2. Wrapper Agent (CLI-Based)
- **File**: `praisonai_wrapper_agent.py`
- **Purpose**: Uses `praisonai "TASK"` CLI pattern instead of direct Agent class
- **Usage**: Run with `--agent-import-path examples.terminal_bench.praisonai_wrapper_agent:PraisonAIWrapperAgent`
- **Approach**: Installs `praisonai` CLI inside container and runs tasks via subprocess
- **Best for**: Users who prefer CLI-style interface matching standard `praisonai` usage
verification_prompt=f"Verify this solution works correctly:\n\nOriginal task: {instruction}\n\nSolution: {execution_result}\n\nRun tests to confirm it works."
Loaded 100 of 623 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.