Accept TS/JS issues on PraisonAI, route fixes to praisonai-js via Claude
STEP 3-ALT, block direct src/praisonai-ts/ PRs unless sync from praisonai-js,
and document routing in CONTRIBUTING, bug template, and SECURITY.
Co-authored-by: Cursor <[email protected]>
The version the desktop release is cut from. v4.7.1 predates the whole
Windows and Linux effort, so attaching those builds to it would have claimed
that release shipped something it did not contain.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
A review of the fixes themselves, which is where new bugs get introduced.
**A stale tab really could cancel someone else's run.** The engine refuses to
stop a run other than the one asked for -- and the Stop button never sent the
id, so the guard could not fire and the three server tests covering it were
testing a request the product does not make. Reproduced end to end: tab A's
Stop cancelled the run tab B had started. The button names its run now.
**The CSP test caught none of seven CSP-breaking changes, including a straight
revert of the fix it exists to protect.** It matched a *variable* name against
an element id -- `stopBtn` against `id="stopBtn"`, which does not exist; the id
is `stop` -- so it silently compared nothing. It now resolves bindings to
elements before judging a line, and covers the four other ways the policy can
be broken: a style attribute in any casing or quoting, `setAttribute('style')`,
a `<style>` built at runtime, and `style=` concatenated into innerHTML. Ten
mutations, ten caught, including both directions of the original bug.
The rule it enforces is also broader than before. Hiding with an inline style
and revealing with a class leaves the element hidden from the second turn on,
just as the reverse leaves it hidden forever -- so for an element the markup
hides with a class, any `.style.display` assignment is a defect regardless of
the value.
**A whole test file ran nowhere.** `stream-pacing.test.ts` is TypeScript and
matched neither npm glob, so its eight tests -- including the positive control
for logic `ui/index.html` justifies by saying it was "ported verbatim from the
tested one" -- never executed. The skip-count assertion could not see it
either: nothing skips when nothing runs. That is the same failure the workflow
comment claims to prevent.
**Windows CI could not go green** on a clippy error in a `#[cfg(windows)]`
block, invisible from any other platform, and three tests errored in setUp on
`os.getpgid` -- which does not exist on Windows -- in the class that exists to
prove the Windows path works.
Secrets, three ways a report of success was untrue:
* A delete returned `or` of the two stores, so an unwritable fallback meant the
plaintext survived, `get` served it, and the user was told the key was gone.
* A key the primary could not accept went to the fallback while the primary
kept the old one -- and `get` reads the primary first, so the app went on
using the previous key after a successful save.
* `FileSecretStore._read` swallowed every error, so one unreadable read meant
"empty" and the next write destroyed the other secrets. The DPAPI store's
docstring names this exact hazard; this one had been left with it.
And: `macos-14` began deprecation on 2026-07-06 with brownouts that fail jobs
now, and it was the only Apple-silicon leg, so the arm64 DMG was on its way to
disappearing -- there is a test listing retired images now, because this is the
second runner to expire mid-branch. `x11_threads` declared dlsym's argument as
`*const i8`, which does not compile on ARM Linux where `c_char` is unsigned.
The two Tauri window configs must agree, and nothing checked. The log-tail
comment described dropping a seek-truncated first line that nothing dropped.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The CI matrix found this on its third run, and it is the same defect this
branch already fixed once on POSIX -- still fully present on Windows, reported
as a success. Every stop-related test failed there, and one of them says it
plainly:
'RAN-TO-COMPLETION' unexpectedly found in the log
: the run was reported cancelled but ran to the end anyway
_terminate_group sent CTRL_BREAK_EVENT. That event is delivered through a
console, and the trainer is spawned with CREATE_NO_WINDOW precisely so that it
has none -- so send_signal returned successfully, nothing died, and the
`except OSError: proc.terminate()` fallback never ran because there was no
error. The user pressed Stop, the UI said cancelled, and the fine-tune carried
on to completion holding the GPU.
It kills the process tree with `taskkill /T /F` now, which is what killpg
achieves on POSIX. /T is the part that matters: without it the trainer dies and
whatever it spawned keeps the card.
The test that was supposed to cover this asserted `proc.signals or
proc.terminated` -- "something was signalled". CTRL_BREAK_EVENT satisfied that
perfectly while the process ran on. This is the third time in this branch that
a test asserted an attempt rather than an effect, so it now asserts which pid
was killed, that the command carries /T and /F, that a failed taskkill still
escalates, and that a process which already exited is not killed again.
The tree kill is a module-level function so all of this runs from any platform.
The branch that only executes on the machine nobody tests on is exactly the
branch that was wrong.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
My own regression from two commits ago, found by looking rather than by a test.
Capping the run history meant making it a bounded deque, and the insertion was
left as `insert(0, run)`. On a *full* bounded deque that raises
IndexError("deque already at its maximum size") -- so the run after the cap
would not start, and every run after that would fail the same way, on an app
that is meant to stay open for days. `appendleft` evicts from the far end,
which is the oldest run, which is what the cap is for.
The tests now reach the cap rather than stopping short of it. Both things that
go wrong here only go wrong when the deque is full: the insertion raising, and
eviction taking the newest run instead of the oldest. Neither is observable
below the limit, which is why a test that stops at three runs proves nothing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Second round from the same matrix. Linux went green; Windows did not.
**The whole training route suite failed on Windows for a quoting reason.**
The test helper built `PRAISONAI_TRAIN_CMD` with `shlex.quote`, which escapes
an inner `'` as the concatenation `'"'"'`. POSIX reassembles that into one
token; Windows rules split it into seven. Every script in the suite prints
something, so every one of them contains a quote, and the trainer was launched
with a shattered command line -- the run never reached "running" and nine tests
timed out waiting for it. The body goes through a file now: a path has no
newlines and no quotes, so both rule sets agree about it. (`split_command`
itself is right; a Windows user would quote the Windows way.)
**The lockfile was not the bytes it says it writes.** `write_text` translates
"\n" to "\r\n" on Windows, so the file differed by platform. The Rust parser
trims each line and coped, but a lockfile whose bytes depend on the host is a
difference waiting to matter -- and the encode is the only conversion that
should be happening in a function documented as "always as UTF-8". It writes
bytes now.
The rest were test-only, and all the same mistake: `str(Path("/a/b"))` is
`\a\b` on Windows, and comparing a `PurePosixPath` to a `WindowsPath` fails
even when both name the same location. They compare `.as_posix()` now.
Also made the generated script filename a content hash rather than `hash()`,
which is salted per process and could have had two bodies collide on one file.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The CI added in the previous commit did its job on its first run: the engine
suite failed on Linux and Windows, and the Rust suite failed on Windows, while
all three passed on macOS -- the only platform any of this had ever run on.
Every failure is in the tests, not the product, and every one is the same
mistake in a different costume: asserting something about the *host* rather
than about the behaviour under test.
* Two Rust tests compared a whole PATH string against a hardcoded expectation
containing forward slashes. `PathBuf::join` writes a backslash when the tests
themselves run on Windows, so `C:/data/venv\Scripts` did not match
`C:/data/venv/Scripts`. The subject is the separator *between* entries, so
they now split on it and check the parts -- which is what the comment above
them always claimed they were doing.
* Four Python tests compared `str(Path(...))` against a POSIX string, which is
backslash-separated on Windows. They compare paths to paths now.
* The C-locale harness passed its statement through `python -c`. Python decodes
that argument with the filesystem encoding -- ASCII with surrogateescape
under LC_ALL=C on Linux -- so a test whose whole point was a non-ASCII path
died on unpaired surrogates before reaching the code under test. It goes
through a file now: source files are read as UTF-8 regardless of locale.
* The same harness captured the child's output with a bare `text=True`, which
decodes using the *parent's* encoding. On a Windows runner a test about UTF-8
handling was reading its own result back through cp1252 and failing on the
round trip rather than on anything the engine did.
* One test asked FileSecretStore to write to "/nonexistent/nope" and expected
failure. A Windows runner can create that at the drive root, so the store
succeeded and the assertion was backwards. It now puts a file where a
directory is needed, which fails everywhere.
None of this was reachable from a Mac, which is the entire argument for the
matrix.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
An adversarial review pointed out that nothing in .github referenced
praisonai-desktop. Every suite in it -- engine, shell and UI -- existed and was
never executed by anything except a person running it by hand.
The UI suite could not even be installed. jsdom was undeclared, so it ran only
on machines that happened to have one somewhere further up the tree, at
whatever version that happened to be. Pinning it surfaced the consequence
immediately: 16 tests fail on jsdom 25 and pass on 30. They had been passing
against a version nobody chose.
The workflow runs the engine tests on all three platforms, which is the point
of the portability suite; the Rust tests and clippy on all three; and the UI
tests on Linux. Clippy is included because it was already failing -- a
redundant closure in supervisor.rs -- which is exactly the sort of thing a gate
catches and a person does not.
The lifecycle suite is excluded by name rather than left to skip. It drives
real conversations against a live engine and a real model, neither of which
exists on a runner, so it would have skipped all thirteen of its tests and
exited 0. The remaining 128 run with the skip count asserted to be zero,
because a suite that skips everything looks exactly like a suite that passed.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Three of these are in the "user cancels" and "user watches a long run" paths,
which are the two things this feature exists to do.
**Opening the Training tab on a run older than ~20 minutes showed nothing, and
pinned a core doing it.** The SSE handler answered a gap by resyncing at
cursor=-1 -- which makes the next since() compute a gap again, because every
ring that has ever evicted satisfies `0 < oldest`. The `continue` then skipped
both the sleep and the terminal check, so it spun at ~13,000 resync frames per
second, delivered zero log events, and went on spinning after the run had
finished. A tqdm refresh emits two events, so a real fine-tune passes the 4000
-event ring in about twenty minutes. It now resumes at the oldest event still
held and falls through to deliver it.
**Pressing Stop before the trainer process existed cancelled nothing.** start()
returns as soon as the supervisor thread is created, so between the HTTP reply
and Popen returning, run._proc is None and stop() had nothing to signal. It
recorded STOPPING and _supervise then overwrote it with RUNNING: the user got
{"ok": true} and a "stopping" pill, and the fine-tune ran to completion and
reported "done" -- holding the GPU it was told to release. The state is now
settled under the run's lock, and a stop that arrived first terminates the
process on arrival.
**One trailing slash let a stale tab kill the live run.** The route was matched
by string, and rsplit("/") on "/train/stop/<stale-id>/" yields "", which is
falsy -- so the guard that exists to stop exactly this was skipped. The same
matching treated "/train/stopXXXX" as the stop route and read "?force=1" as
part of the run id, refusing a legitimate stop. The path is parsed now.
Also:
* Two runs could share a directory, overwriting each other's config.yaml and
interleaving into one train.log. Ids differing only in case are one directory
on macOS and Windows; and the generated id had one-second resolution, so two
runs started in the same second collided -- which the new check caught
immediately. Ids are settled before anything is created, so a refused run no
longer clobbers the config of the run it collided with.
* A method that could never work failed after the model download rather than
before it. GRPO needs reward functions this form cannot supply, so it is now
refused in milliseconds with a message saying to use the CLI. Column
requirements depend on the dataset and are still the trainer's to check, so
every method hint now names the columns it needs instead of leaving the user
to discover them an hour in.
* _last_meaningful_line read the whole log to keep forty lines from the end --
at the exact moment a run fails, and a tqdm bar writes a line per refresh. It
reads the last 64KB now.
* An unwritable runs directory raised PermissionError past the handler, so the
connection dropped with no response and the UI reported "could not reach the
engine", sending the user after the wrong problem.
* A malformed ?cursor= was an unhandled ValueError that dropped the connection.
* run.metrics and Trainer.history grew without limit in a process meant to stay
open for days.
Converting those two to bounded deques broke /train/runs and /train/status,
because a deque cannot be sliced -- caught by the existing route tests, which
is what they are for.
Tests: 49 + 23 + 6 Python, 134 UI. New coverage for replaying a run that has
outlived its buffer, every stop-route shape, the pending-stop window, run-id
collisions, and the method preflight. All five fixes were mutation-tested.
Two notes on the tests themselves. The pending-stop case cannot be reached
through HTTP -- two round trips are slower than a spawn -- so it is tested
where it is deterministic, by delaying the spawn. And its first version asserted
only that the final state was "cancelled", which a version that never signals
the process also satisfies while the job runs to the end; it now asserts the
process died and the script's completion marker never reached the log.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Found while fixing the same class of defect on the cross-platform branch.
Configuring a CSP makes Tauri stamp a nonce on the page's <style> tag, and a
nonce in a source list voids 'unsafe-inline' for that directive -- so every
style="" attribute in the document stops applying. The heading above the run
history would have lost its spacing the moment the two branches met, silently.
A class instead. The other inline styles on this branch are pre-existing and
are handled in the cross-platform work, along with the test that would have
caught this one.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Three ship-blockers, one security bug, one claim of mine that was simply wrong.
**The CSP I added broke the app, and I said it would not.** Configuring any CSP
makes Tauri stamp a nonce on the page's <style> tag and a hash on its inline
<script> at build time -- and a nonce or hash in a source list *voids*
'unsafe-inline' for that directive. So the moment a CSP existed, every
style="" attribute in the document stopped applying: a permanently visible red
Stop button, a raw file-input widget, and every tool-output block expanded, on
first launch. Nothing errors; it just looks broken. Those five attributes are
now classes. Setting .style from JavaScript is CSSOM and was never affected --
but `el.style.display=''` to reveal an element now restores the class default,
which is `display:none`, so those three call sites toggle the class instead.
**The Linux tray took the whole app down.** `tray::build(...)?` in setup, and
on Linux the tray goes through libappindicator, which is dlopen'd at first use
and *panics* if neither library is present -- not catchable, since we build
with panic=abort. Because it is dlopen'd there is no DT_NEEDED entry, so
dpkg-shlibdeps could not generate the dependency either: the package installed
cleanly and then did nothing when clicked. The tray is now non-fatal and the
library is declared explicitly, along with curl, which the uv bootstrap runs
and minimal images omit.
**The macOS overlay silently deleted the window geometry.** Tauri merges
tauri.macos.conf.json with RFC 7386, whose rule for arrays is replacement, not
element-wise merge. An overlay carrying only the two macOS keys replaced the
whole `windows` array: title, width, height and both minimums vanished, so the
app became an 800x600 "Tauri App" that could be dragged down to nothing. The
overlay now repeats the full object.
**Deleting an API key reported success while the key kept working.** Once a
secret had been written to both stores -- keyring unavailable, then available
again -- a delete that short-circuited on the first success left the other copy
behind, and the read path served it. The plaintext stayed on disk. A delete now
reaches every store, and a successful write clears the fallback so a superseded
key is not left readable.
Everything else, briefly:
* macos-13 was retired on 2025-12-04, so the Intel leg would never have
scheduled -- and the completeness check would then have failed every release,
forever, correctly. Now macos-15-intel.
* `cargo install tauri-cli ... || true` swallowed a real failure and the next
step died complaining about an unrelated missing command. It also behaved
differently per leg, since Windows defaults to pwsh where `true` is not a
command.
* Two spawn sites had no console suppression -- including the engine itself, so
a black console window sat beside the app for the entire session on Windows.
There is now a lint over every spawn site, which is honest about being a lint:
a Windows creation flag has no observable effect here, but "did anyone forget
to call it" is exactly what regressed.
* One undecodable byte silently ended the engine's log reader for the rest of
the session. `lines().map_while(Result::ok)` *stops* on the first
Err(InvalidData) rather than skipping it, and Python encodes redirected
streams with the locale code page on Windows. If it arrived before the port
announcement, startup failed 30 seconds later blaming a timeout.
* The engine spawn had no process group on Unix, so SIGTERM reached the engine
and nothing it had started -- with the training tab, a fine-tune would have
kept a GPU after quit.
* `XInitThreads` is now called first in main(). GTK never calls it, several
threads drive X anyway, and the failure is `_exit(1)` with no message.
* Empty environment variables were treated as set on the Rust side only, so
`XDG_DATA_HOME=""` made the shell look for the lockfile in the working
directory while the engine wrote it under the home directory -- "no lock,
spawn" on every launch.
* The uv installer's exit code was taken as proof it installed something;
`powershell -Command "irm ... | iex"` can exit 0 having done nothing.
* Three write-then-rename sites -- transcripts, MCP config, settings -- did not
use the retry helper whose own docstring names their failure case.
* A leftover temp file kept its old permissions, so a secret could be written
world-readable before the chmod that follows the rename. O_EXCL now.
* A DPAPI blob that would not decrypt read as empty and was then overwritten,
destroying every other secret in it.
* The tray used macOS template rendering and Cmd accelerators everywhere:
a black-on-black icon, and a menu advertising Win+Q, which Windows takes.
* "Copy data folder path" reproduced the default instead of asking the engine,
so it handed the user a path the app was not using whenever it was
overridden. /health now reports it.
Tests: 35 engine, 123 Rust, 141 UI. New: a CSP guard (there was none -- no test
in the suite sets a CSP header, which is why this shipped), a lossy-reader
suite, spawn-site hygiene with a positive control, and secret-deletion tests
that failed before the fix.
Two of my own new tests were wrong in the usual way. One asserted a repair
button *existed* without clicking it, so replacing its handler with an empty
function changed nothing. The other's comment-stripper only checked line
prefixes, so a continuation line inside a block comment -- this file's own
explanation of the bug -- was reported as an instance of it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The macOS release workflow shipped first. Adding the other two was not a matter
of adding runners: the bundle targets were macOS-only, so a Windows or Linux
build produced zero artifacts and still exited zero. That is fixed in the
config change; this wires the pipeline to it.
Four legs now: macOS on both architectures, Windows NSIS, Linux .deb. NSIS
rather than MSI because MSI can only be built on Windows, needs an optional
Windows feature, and installs to Program Files behind a UAC prompt; NSIS
installs per-user with no administrator password. .deb only -- no RPM, no
AppImage. AppImage needs libfuse2, which Ubuntu 24.04 removed, and renders a
blank window on some Wayland and Mesa combinations; a .deb that works beats an
AppImage that half does.
Two decisions that look arbitrary and are not:
* The Linux leg pins ubuntu-22.04. glibc is forward-compatible only, so the
build host sets the *oldest* distribution the package can start on. Building
on 24.04 would emit a .deb that refuses to launch on 22.04 or Debian 12 with
a GLIBC_2.38 error no runtime flag can fix. That image begins deprecation on
2026-09-17 and retires 2027-04-17; the comment says to move to a debian:12
container rather than bump the runner, so the floor stays our decision.
* libappindicator3-dev, not the ayatana package the Tauri docs suggest. The
.deb's generated Depends: follows whichever the binary linked against, so
mixing them between builds produces packages that disagree about their own
dependencies.
A `verify` job now fails the release if any platform is missing an asset. A
release that quietly ships three platforms instead of four is worse than one
that fails, because nobody notices -- which is how v4.7.1 went out with zero
assets in the first place.
The install doc covers all four downloads, and says plainly what each platform
does about an unsigned build: Gatekeeper's misleading "damaged" message and the
right-click-Open, SmartScreen's hidden Run anyway, and `apt install ./file.deb`
rather than dpkg so dependencies resolve.
Guarded by tests, because these three files must agree and none of them fails
loudly when they do not: the workflow matrix, the config's bundle targets, and
the filenames the install doc tells people to download. 9 tests, 11/11
mutations caught -- including dropping a platform, swapping the appindicator
package, bumping the Linux runner, and removing the Windows icon.
One of those tests was weak on the first attempt: it grepped the whole file for
`exit 1`, which appears in the verify job too, so it passed with the
artifact step's guard removed. It is now scoped to that step.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The bundle targets were `["app", "dmg"]`. Both are macOS-only bundle types, so
a Windows or Linux build produced *zero artifacts* and still exited zero --
the failure mode is a green build with nothing in it. Added nsis and deb.
`titleBarStyle: "Overlay"` and `hiddenTitle` are macOS-only keys, silently
ignored elsewhere, which left a native title bar sitting on top of the CSS one.
They now live in tauri.macos.conf.json, which Tauri merges per platform.
`csp: null` disabled the content security policy entirely. It is now explicit,
and allows exactly what this app needs: loopback to the engine, which is how
the webview talks to Python at all.
On the UI side the page now reads which platform it is on and adapts three
things that were macOS facts written as layout constants:
* 5.2rem of left padding for the traffic lights. Windows and Linux put their
window controls top-*right*, so this was dead space on the left and an
overlap with the toolbar on the right.
* `⌘N`, `⌘K`, `⌘,` labels. The keydown handler already accepted Ctrl, so the
shortcuts worked -- the hints just named a key those keyboards do not have.
They now come from one place, so a new shortcut cannot be added with a
hardcoded modifier that is wrong on two platforms out of three.
* "into your Library folder", and a Copy button that copied
`~/Library/Application Support/PraisonAI` on machines where no such path
exists. Windows gets %APPDATA%, which pastes straight into Explorer.
Detection is layered -- userAgentData, then navigator.platform, then the user
agent string -- because the last is the easiest to be wrong about: a webview
reporting only "(darwin)" matched none of the names and fell through to Linux
on a Mac. That was caught by a test, not by reasoning.
Two test defects fixed along the way, both of which had been passing while
proving nothing:
* `first-run.test.mjs` asserted the lede contains "Library". That passed only
because this suite has only ever run on macOS; on the Linux runner this
release needs, it would fail on correct behaviour -- and anyone fixing the
copy would have "broken CI" for doing the right thing. It now asserts the
copy names *a* place, whichever platform is reading it.
* The new platform tests originally passed jsdom's `userAgent` option, which
is silently ignored, so all three cases ran against jsdom's own agent and
were really testing one platform three times. The navigator properties are
now defined directly. A second version read `body.textContent` -- which
includes the inline script's source -- and "found" macOS copy on Windows
inside the source of the very branch that avoids it.
Also generated icons/icon.ico: without it tauri-build does not warn, it
refuses to compile for Windows at all.
Tests: 6 new platform tests, 7/7 mutations caught. Full suite 124 passing, and
verified still passing with the page forced to report Linux.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The crate always compiled for all three platforms -- there is exactly one
`#[cfg]` in it -- so nothing ever failed loudly. Every defect here is a runtime
one: the app starts and then cannot find its own engine.
Platform is now a value rather than a `cfg`. Every path and process decision
that differs goes through a function taking one, because `#[cfg(windows)]`
makes the Windows branches invisible to a suite that only ever runs on macOS,
and invisible branches are how the code nobody runs comes to be wrong.
What was broken:
* `HOME` was the only home lookup. It is normally unset on Windows -- that is
`USERPROFILE` -- so provisioning returned "no home directory" and the
orphan-reclaim path never ran at all.
* Every interpreter candidate ended in `bin/python3`. A Windows venv keeps its
interpreter in `Scripts\python.exe`, so all of them failed `is_file()` and
the app reported "no usable Python found" immediately after successfully
provisioning one.
* The uv bootstrap ran `/usr/bin/curl` piped into `/bin/sh`. Neither exists on
Windows, so first-run provisioning was simply dead; and pinning curl's
absolute path breaks Linux images where it lives elsewhere. There is now a
PowerShell installer for Windows, and curl is found by name.
* `/bin/kill` was spawned unconditionally to reap an orphan, and the call site
discards the result -- so on Windows, deciding to kill an orphan killed
nothing, which is the exact bug reclaim.rs exists to prevent.
* `/bin/ps -o lstart=` was the only start-time source, so every pid on Windows
read as "no such process", every live engine looked dead, and a second one
started beside it on every launch. Windows now reads the creation stamp from
kernel32.
* site-packages was derived as `lib/python3.X/site-packages`. Windows is
`Lib\site-packages` with no version segment -- and the caller's only check is
that the path sits under the venv root, so the wrong path passed the guard
while pointing at nothing, which is worse than failing.
* `spawn_env` joined PATH with `:` and used `bin`. Windows is `;` and
`Scripts`; one wrong separator makes the entire PATH a single unusable entry.
The shell and the engine must also agree on two things or they fail silently
and permanently: the data directory, and the hash that identifies a running
process. Both are now asserted from both sides -- reclaim.rs and
test_portability.py carry the identical fixture table, so if either hashing
implementation drifts, both suites fail rather than the two quietly disagreeing
and starting an engine per launch forever.
The PowerShell installer deliberately avoids `-WindowStyle Hidden` with
`-ExecutionPolicy Bypass`: that pair is a known malware detection signature and
gets installers flagged. The console is suppressed with a creation flag, which
is not a behavioural signal. `UV_NO_MODIFY_PATH` is set on every platform,
because an app should not rewrite the user's shell profiles to install its own
dependency.
Also generated the icon set. `icons/icon.ico` was missing, and tauri-build does
not warn about that -- it refuses to compile for Windows at all.
Verified rather than assumed: `cargo check --target x86_64-pc-windows-msvc
--all-targets` passes, so the FFI and the CommandExt code that macOS never
compiles is at least type-checked. Linux cannot be checked from here because
libdbus-sys needs system headers that only exist on Linux; CI covers it. 116
tests pass on the host.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Six independent macOS assumptions. Two of them kill the engine outright on
Windows; one makes settings unsavable on Windows *and* Linux.
The signal registration was the worst, because of where it failed rather than
how. `for sig in (SIGTERM, SIGINT, SIGHUP)` builds the tuple before the loop
body, so SIGHUP is dereferenced outside the try that was meant to tolerate a
missing signal -- and Windows has no SIGHUP. It raised AttributeError, which
that except clause would not have caught anyway. It happened *after* the port
was announced and the lockfile written, so the shell adopted an engine that
was already dead and every request looked like a network fault. Signals are
now looked up one name at a time.
Secrets went to the macOS keychain via the `security` binary, which does not
exist elsewhere: the write reported failure, POST /settings raised with no
handler, and load_settings reported the key as unset forever. The app was
permanently unauthenticated on both other platforms with no visible cause.
There is now a store per platform -- keychain, DPAPI, libsecret -- each backed
by a 0600 file, because a machine with no keyring daemon (headless, container,
locked login keyring) must still be able to save a key. A secret is never
written into settings.json, which is the file people paste into issues.
The data directory was `~/Library/Application Support` everywhere. On Windows
that is not merely unconventional: it is excluded from roaming profiles and
from most backup tooling, so a user's entire history silently fails to follow
them to a new machine. Now %APPDATA% and $XDG_DATA_HOME respectively.
Three quieter ones. The lockfile was written in the locale encoding while the
Rust side reads it as strict UTF-8 and maps invalid bytes to "absent" -- and
absent means spawn, so a non-ASCII home directory would have produced a second
engine beside the live one on every launch. `read_file` decoded user files in
the locale encoding with errors replaced, handing the model plausible mojibake
it would reason over confidently. And SO_REUSEADDR, correct on POSIX, means
"another process may bind this address while I am listening" on Windows --
on unauthenticated loopback carrying API keys.
Also: the recycled-pid fingerprint shelled out to `ps` and returned 0 on
Windows, and 0 is the "could not tell" value, so every recycled pid compared
equal and an unrelated process would be adopted as the engine.
GetProcessTimes gives a real creation stamp.
One incident worth recording. Verifying this live wrote a test key into my own
macOS keychain, because PRAISONAI_DESKTOP_HOME isolates the data directory but
not the system keyring, which is shared per user. KEYCHAIN_SERVICE is now
overridable so a test cannot reach the real one. Asking for isolation should
isolate everything.
Tests: 27, all mutation-checked -- 13/13 mutations of these guarantees are
caught. Four of those tests were rewritten after the first versions survived
their mutations: the XDG test compared a path to itself (its "custom" value
was the default), the two encoding tests could not fail on a UTF-8 Mac and now
run under LC_ALL=C in a child process, and the permission test asserted the
final mode, which passes even when the file is created 0644 and chmodded
afterwards -- leaving a window where any local process can read the key.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The desktop app could talk to a model but not make one, while praisonai-train
sat behind it doing exactly that. This wires the two together.
A training run is a subsystem rather than a route. The engine is a
ThreadingHTTPServer where every request is a turn that starts, streams and
ends -- right for chat, wrong for something that runs for hours, must survive
the window closing, and has to resume after a reconnect.
Three decisions, each taken because the alternative was worse:
* One run at a time. Two fine-tunes on one GPU do not co-exist; they OOM.
Starting a second returns 409 naming the run that is already going, rather
than queueing, which would imply a scheduler nobody asked for.
* Progress is a replayable ring buffer, not a stream. Reconnecting reads from
a cursor, so a closed lid loses nothing; if history was evicted the client
is told to resync rather than handed a log with a hole in it.
* The subprocess owns the truth. Status comes from the process and its log,
never from what the client last heard, so a client that missed the ending
still learns how it ended.
Three defects the tests found while being written, all of which would have
shipped:
* The event cursor was derived from len(events). Once eviction begins the
length stops growing, every later event is handed the same cursor, and
since() returns nothing forever -- a live run whose UI silently stops
updating. It is now a standalone counter.
* run_id came from the client and became a directory name. The engine listens
on loopback with no auth by design, so any local process could have posted
`../../../Library/LaunchAgents/x`. Now allowlisted.
* Stopping a run signalled the process group without checking whose group it
was. The mutation that removes start_new_session proves the hazard is real:
it makes the test runner kill itself. The engine now refuses to signal its
own group.
Portable from the start, since Windows and Linux builds are next: the pipe is
decoded as UTF-8 rather than the locale encoding (cp1252 turns unsloth's
banner into mojibake, and five of its bytes raise inside the reader loop,
freezing the log while the run continues); PRAISONAI_TRAIN_CMD is split with
Windows rules on Windows, where POSIX splitting eats every backslash in an
interpreter path; the child gets CREATE_NEW_PROCESS_GROUP there, because
CPython accepts start_new_session on Windows and then ignores it; and run ids
reject reserved device names, which an alphanumeric allowlist cannot see.
Tests: 42 engine unit tests, 10 end-to-end tests against a real spawned
engine, 16 UI tests driving the real page in a DOM. All 9 mutations of the
engine's guarantees are caught, and all 7 of the UI's. The existing desktop
suite stays green at 134.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Releases carried no assets at all. v4.7.1 shipped zero, so a Mac user had
nothing to download and no path to the app that exists in this repo.
On a published release (or by hand against an existing tag) this builds a .dmg
on macos-14 and macos-13 and uploads both:
PraisonAI-<version>-macos-apple-silicon.dmg
PraisonAI-<version>-macos-intel.dmg
Two per release rather than one universal binary, because Tauri does not
produce a universal build and a wrong-arch download fails at LAUNCH rather than
at install -- which is a worse place to discover it.
The build fails loudly when no .dmg is produced instead of uploading nothing.
An empty asset list is exactly the state this workflow exists to fix, and a
silent no-op would recreate it while looking green.
Unsigned, deliberately: signing needs a Developer ID in repository secrets, and
shipping an unsigned build people can right-click-open beats shipping none.
INSTALL-macOS.md says so plainly rather than letting Gatekeeper say it -- its
message for an unsigned app is "PraisonAI is damaged and can't be opened",
which is both alarming and untrue. The guide covers which architecture to pick,
the right-click-Open path, the xattr fallback, what the first-run provisioning
does and where it puts things, and how to remove it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt on current main after #4367, #4368 and #4370 merged.
An adversarial audit ran 16 mutations against this suite. EIGHT survived all
408 tests, and every survivor was covered only by
src = inspect.getsource(some_function)
assert "the_thing_i_want" in src
which passes whether or not the code does anything: the string is still in the
file when the branch around it is disabled.
The worst case was a test holding a COPY of the logic it tested.
test_response_masking.py defined _auto_use_mask() mirroring train_model's
`auto` expression, so reverting the real line to the pre-fix `supports_mask`
alone left the whole suite green -- the single defect that PR existed to fix
was undetectable by its own test file. The expression is now
resolve_mask_setting() and the test calls it; that mutation now fails.
The guard caps source-text assertions, bans reimplementing tested logic, and
asserts the extracted helpers stay importable -- each of resolve_mask_setting,
decide_masking, resolve_response_markers, is_out_of_memory, rewards.require and
rewards.resolve_all exists because a source-text test failed to catch a bug,
and inlining one silently returns its test to proving nothing.
The cap is a ratchet, not a ban: ordering constraints are genuinely structural.
It tripped twice on rebases while this PR waited, which is the point. Both
times the new assertion turned out to be convertible and was converted rather
than waved through: _launch_script RETURNS its command, and the PEFT forwarding
list is data, now the module constant PEFT_PASSTHROUGH.
Two things the guard got wrong first, both found by running the regression
rather than reading it: it matched the COMMENT explaining the removed copy, so
it now tokenises and drops comments and strings; and joining tokens with spaces
turned `inspect.getsource` into `inspect . getsource`, so the count missed
every occurrence.
483 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Each of these is a keyword unsloth already accepts and this package never
passed. Nothing failed when they were missing -- the run just did something
narrower than the user asked for.
QUANTS: 12 of unsloth's 24 were refused by this validator before unsloth was
ever asked -- q3_k_l, q4_k_s, q5_k_s, f32 and the aliases are all legal
upstream. The IQ family (11 imatrix quants) was unreachable entirely, which is
how a 30B model fits on a laptop. Now 35 accepted, read out of unsloth's own
save.py rather than hand-picked, with a test that fails when the two drift.
MODEL ACCESS: hf_token, trust_remote_code and revision were unreachable, so a
gated repo (Llama, Gemma) worked only through an environment variable, a
custom-code model not at all, and a multi-day run could not pin a revision --
the tag moves and the run is no longer reproducible.
PEFT SELECTORS: the target-module list was hardcoded to seven names.
finetune_last_n_layers (the cheap-run recipe), target_parameters (required to
LoRA MoE experts), layers_to_transform, layers_pattern and init_lora_weights
are all forwarded now.
OFFLINE MERGE: save_pretrained_merged was never called, so the only way to get
merged weights was to PUSH them -- needing a Hub account, a token and a
network. `merged_save_dir` writes them to a directory.
vLLM: fast_inference was never passed, so GRPO always ran the slow HF-generate
rollout path.
28 tests. Five mutations, all killed.
One of them could not be expressed at first, because the test helper
REIMPLEMENTED the assembly it was checking -- in the very change that bans
reimplementing tested logic. It is now model_access_kwargs() and the test calls
it; deleting the token forwarding fails.
480 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
A `git stash --include-untracked` during merge-conflict repair swallowed the
whole untracked praisonai-desktop tree and it was never restored. It surfaced
only because a UI audit described settings as inert that had been fixed days
earlier -- true of the tree on disk, not of the work. Recovered from
stash@{0}^3.
What it contains, all previously reported and none of it on main:
- The eleven dead settings wired to real behaviour, each proven by a test swept
across at least two values.
- Text size scales the whole interface rather than only the chat, with every
fixed-pixel dimension converted to rem and a test that fails on any
dimensional px over 3px.
- The transcript and the composer share one column. They were ~240px apart
because an auto margin on a flex item's cross axis overrides `stretch`.
- In-app confirmation dialogs. window.confirm returns false immediately in a
WKWebView without showing anything, so every guard written as
`if (!confirm(...)) return;` cancelled -- which had silently broken deleting
a conversation outright.
- data-tauri-drag-region plus core:window:allow-start-dragging, without which
the titlebar could not move the window: -webkit-app-region is a Chromium
feature WKWebView does not implement.
- Accessibility: landmarks, a live region for streamed answers, accessible
names on icon-only controls, a focus-trapping dialog, aria-current on rows.
- Real app and menubar icons from the PraisonAI mark. A macOS template image is
drawn from its alpha channel alone, so the previous one rendered as a solid
block.
- First-run provisioning with staged progress, message versions with a
`< 1/2 >` picker, and orphan reclamation through the lockfile the Rust side
had always specified and nothing wrote.
118 JS tests across 11 suites, 90 Rust tests, all passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Three agents audited the eleven PRs that just merged. Every defect below passed
the suite that shipped it.
FIVE IN THE CODE
1. --dry-run showed one config and a different one trained. Forwarding
--dataset/--model -- which I added as "belt and braces" -- puts the legacy
dispatcher on its regeneration branch (praison_ai.py:676), where
generate_config() runs with every tuning parameter None and rewrites
config.yaml from defaults: lora_r 64 -> 16, epochs 5 -> 1, method dpo -> sft,
and huggingface_save false -> TRUE with hf_model_name defaulted to a third
party's repository.
2. cpt silently lost embedding_learning_rate, the one value it exists to set.
__dataclass_fields__ is inherited, so on a plain __init__ subclass it resolves
to the parent's fields and the drop-unknown filter deleted the value 45 lines
after setting it -- along with max_seq_length and packing.
3. remote start could never train: it passed config.yaml as the dataset
positional. Two positionals meant exit 2 before the GPU was touched.
4. Remote command injection and path traversal. --run-id 'x;touch /tmp/pwned'
executed, because the far half of an scp target is expanded by a shell there.
fetch ../../../../etc/passwd passed the existence gate and copied the file
back. Both quoted and validated now.
5. hf_private failed open: 'private', 'y', 'enabled', 5 all published the
repository.
FIVE AT THE BOUNDARY
6. llm overwrote ./config.yaml with no backup, and had already destroyed a
hand-written one in this repo's working tree.
7. praisonai train exposed 6 of 15 commands and no remote group, because the
integrated CLI imports cli/commands/train.py while the siblings register via
cli/app.py.
8. tests/unit/data/ -- 96 tests -- was collected by no workflow at all.
9. The suite needed 3.11 while pyproject declares >=3.10.
10. pip install "praisonai-train[llm]" produced an llm command that died at
argument parsing; nothing declared the praisonai wrapper it imports.
44 tests. Ten mutations, all killed -- four only after fixing the test first: a
fake class with **kwargs returned early, two called a validator the code path
no longer had to use, and one matched the comment explaining the fix rather
than the configuration. That last shape has now appeared three times.
452 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt again on current main, which moved when four sibling PRs merged.
The last of unsloth's training methods. It rewrites every trl.trainer.*_trainer
module generically (rl.py:4235-4248), so all three work through it. GRPO was
the blocker for the rest, because it needs reward functions and a YAML config
can only carry a string.
DECISION, stated because it is the one thing I could not derive: reward
functions are named by dotted import path, `module:function`.
method: grpo
reward_funcs:
- myproject.rewards:length_penalty
num_generations: 8
A registry populated by decorator would mean the config can only name functions
from a module something else already imported. Inline Python in YAML is a
code-execution surface in a file people paste from the internet. An import path
is the only one of the three resolvable before anything runs -- which is why
rewards resolve before the model loads, so a typo costs five seconds rather
than a multi-gigabyte load. If you would rather have a registry, the change is
contained to rewards.py.
A missing module and a missing attribute are told apart, since one is a
PYTHONPATH problem and the other a typo; the attribute error lists the
callables that are there. Every broken path is reported at once. GRPO takes
prompts only, since it generates its own completions.
394 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt again on current main, which moved when #4361/#4362/#4364/#4365 merged.
praisonai-train checkpoints
praisonai-train infer -d lora_model "Summarise this release."
checkpoints: after an interrupted run there was no way to find what was saved
without `ls`. Matches checkpoint-<n> exactly, so a directory called
checkpoint-final is not reported as step 0, and sorts numerically.
infer: TrainModel.inference() existed with no caller anywhere in the package.
serve --benchmark measures tokens per second without showing a token.
Streamed, with usable defaults rather than the dead inference()'s
temperature=1.5 / max_new_tokens=64.
Named infer, not generate: generate is already dataset generation, and a second
command of that name silently replaces one with the other.
Also one line: dataset_num_proc defaults to None rather than 1, so unsloth's
memory-aware sizing is not overridden into a single process.
386 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt on current main; the previous branch carried eight unrelated commits.
The `models` command now lives in its own module rather than alongside the
post-training commands, so this change does not depend on them.
model_name was free text with no validation anywhere. A typo was caught by
Hugging Face -- after the CLI accepted it, after the environment was built,
sometimes after a partial download. And nothing told a new user which models
work: config.yaml offers exactly one example, from the Llama-3.1 era.
praisonai-train models
praisonai-train models gemma
praisonai-train models --json
The catalog is read from unsloth's mapper at runtime, not vendored: it carries
246 distinct 4-bit repos and is updated every release, so a copy here would be
stale the day it shipped. CURATED is the fallback for when unsloth is absent --
the CLI is importable without the training extra -- and the starting point for
someone who has not chosen yet.
An unknown model warns rather than refusing, because unsloth loads plenty it
does not map. Suggestions match the repo name, not the full id, so an upstream
id surfaces the unsloth mirror. The catalog includes mapper values as well as
keys, since a 16-bit mirror appears only as a value and naming one would
otherwise be reported as unknown.
335 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt on current main; the previous branch carried nine unrelated commits.
Two ways to end up with an environment that looks fine and cannot train.
Version floors were pip metadata only. pyproject declares torch>=2.6.0 and the
rest, but nothing checked at runtime -- and pip is routinely bypassed:
--no-deps, a hand-built conda env, setup_conda_env.sh pinning its own torch.
The failure then arrived as whatever traceback the mismatched package happened
to raise, several imports deep. A test asserts the floors match pyproject
exactly: lower lets a broken environment through, higher refuses one pip would
have built.
The CUDA pin ignored the hardware. Every Linux host got pytorch-cuda=12.4
regardless. On AMD or Blackwell that builds a working-LOOKING environment that
fails at the first kernel; on a CPU host it installs a CUDA build that can
never run. There is a probe now -- nvidia-smi, then /proc/driver/nvidia/gpus
for a host with the driver but not the tool, then rocminfo -- and the pin lives
in one place instead of four copies across two branches.
A CPU-only Linux host is told plainly that training will refuse, since
trainer.py raises on a missing GPU. A prerelease of the required version counts
as satisfying the floor, because refusing 2.6.0rc1 blocks people testing
upstream and unsloth's own checks are release-level.
338 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt on current main; the previous branch carried four unrelated commits.
A raw-text corpus could not load. A dataset with only a `text` column fell
through to the Alpaca branch, formatted every row to "", and died with "All
examples formatted to empty text" — an error blaming the dataset for a shape
the formatter did not handle. Domain and language adaptation could not run.
And the embeddings got the wrong learning rate. modules_to_save was exposed, so
a user could make embed_tokens/lm_head trainable, but the trainer was plain
SFTTrainer, which has no embedding_learning_rate. They trained at the adapters'
rate — the recipe unsloth ships UnslothTrainer to avoid.
method: cpt
modules_to_save: [embed_tokens, lm_head]
embedding_learning_rate: 2e-5 # defaults to learning_rate / 10
Raw text passes through with no tokenizer call; ShareGPT and Alpaca still win
over a stray `text` column; cpt is formatted like SFT rather than taking the
preference passthrough. The empty-dataset error now names the three shapes and
prints the columns the dataset actually had.
326 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt on current main; the previous branch was cut from its predecessor and
carried five unrelated commits.
`praisonai-train llm` took three flags to `unsloth train`'s thirty-eight, and
was the one command that would not accept --config though export and serve
both do. Eleven flags now, plus --config and --dry-run.
Two fixes on top of the original branch, both from problems main surfaced:
train_llm is called directly as a plain function, not only through Click --
main's own tests do it. Unfilled Typer parameters then arrive as OptionInfo
objects and Path(config) raises TypeError. They are unwrapped to their declared
defaults first.
The dataset and model reach argv as well as the resolved config.yaml. The
config path alone is the better mechanism, since the legacy dispatcher drops
every flag it does not declare -- but an earlier incident had the dataset
dropped entirely and the run trained on a public Alpaca mirror, discovered
after the GPU time. Passing both means neither path can lose it, and main's
regression test for that incident keeps passing.
330 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Rebuilt on current main. The previous branch was cut from its predecessor
rather than from main, so it carried three unrelated commits and conflicted
once those merged. This is the change on its own.
praisonai_train/remote/runner.py was never in the repo. It was untracked —
present in a working tree, absent from git — so the CLI wired to a module that
did not exist and every command raised ModuleNotFoundError. That is what the 7
CI failures were, and the runner here is the one the triage agent wrote to fix
it: stdlib only, no new dependency for a feature most users never touch.
The tests did not catch it because every one of them replaces `_runner` with a
fake. A fake is the right tool for the CLI's behaviour and the wrong tool for
"does the thing I am faking exist" — so there are now three tests that import
the real module, check it has the six methods the CLI calls, and assert it
pulls in nothing outside the standard library. Removing the module fails ten
tests where it used to pass fourteen.
praisonai-train remote preflight gpubox
praisonai-train remote start gpubox -c config.yaml -d data/train.jsonl
praisonai-train remote tail gpubox run-1787...
praisonai-train remote fetch gpubox run-1787... lora_model -o ./out
praisonai-train remote stop gpubox run-1787...
start prints the run id and the stop command before it streams, so a Ctrl-C
during --follow does not leave a job running with no handle. A preflight
failure and a refused start both exit non-zero. stop reports when nothing was
running rather than claiming success.
319 tests passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Two runtime bugs flagged in review:
- load_datasets() called logger.warning but the module never defines a
logger, so any dataset with processing_func set raised NameError and
aborted the run. Switched to print(), matching every other warning in
this module.
- Response-only masking (train_on_responses_only) rewrites SFT label
tensors; it is meaningless for DPO/ORPO/KTO, whose trainers build labels
from chosen/rejected pairs. The decision ran before method was read and
applied unconditionally, so an enabled masking setting could corrupt a
preference run. Gated the whole masking block on method == "sft".
Co-authored-by: Mervin Praison <[email protected]>
Two things the tool told the user that were not true.
OOM. torch.cuda.OutOfMemoryError subclasses RuntimeError, so the CLI's
catch-all flattened it into one ERROR line carrying torch's raw allocator dump.
It is the most common fine-tuning failure and the one where a first-time user
has no idea which number to change. The handler now classifies it and prints an
ordered remedy — sequence length first, smaller model last — matching the
ordering unsloth validated in its own backend
(studio/backend/core/training/worker.py:4834-4845). A test asserts every knob
the remedy names is actually accepted by the config, so the advice cannot drift
from the schema.
README. Two quickstart commands did not exist as written:
praisonai-train data from-trials ... # there is no `data` sub-app
praisonai-train llm --dataset ... # dataset is positional
The second is the exact shape of an incident this code already carries a
comment about (cli/commands/train.py:65-68): a dataset passed the wrong way was
silently dropped and the run trained on the default corpus, discovered only
after the GPU time was spent. A reader who "fixes" --dataset by dropping the
flag walks straight into it.
A test now parses every `praisonai-train <sub>` in the README and asserts it is
a registered command, so the docs cannot drift from the CLI again.
While writing the tests I deleted a branch I had just added: a separate
type(exc).__name__ == "OutOfMemoryError" check was redundant with the
"outofmemoryerror" text marker, since the class name is folded into the
searched text. No mutation could distinguish it from its absence, which is the
definition of code a test cannot cover.
12 tests. Mutations killed: the remedy never printed, the marker dropped, and
each README command reverted. Full suite 265 passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
In `assistant_only_loss: auto` (the documented default), use_mask was keyed
off TRL's `_supports_assistant_mask()` alone. Every unsloth template lacks
`{% generation %}`, so that returned False, use_mask became False, and
decide_masking short-circuited to full-sequence loss before the turn-marker
route was ever considered -- the exact defect this PR set out to fix. Auto now
enables masking when EITHER route is usable and lets decide_masking pick.
Adds regression tests covering the auto-normalization coupled with route
selection, the gap that let the bug survive.
Co-authored-by: Mervin Praison <[email protected]>
Resolves three P1 issues from review on PR #4357:
- Vision pushes (train_vision.py, upload_vision.py) now wrap push_to_hub
in the shared hf_push_errors context manager, so a 401/403 becomes the
same actionable advice the LLM path gives instead of a raw traceback.
- hub_push_kwargs default coercion is now string-aware: vision callers
that omit `flag` read hf_private: "false"/"0"/"no" as public instead of
bool("false") == True keeping the repo private against the user's wish.
- Legacy single-element quantization_method lists are normalized back into
config in both validate_config and for_export, so the GGUF exporter
(which re-reads self.config) receives the method string, not a list.
- train_vision.save_model_merged now uses the guarded clean_local_repo_dir
instead of an unguarded rmtree that could delete a namespaced repo path.
Co-authored-by: Mervin Praison <[email protected]>
Every instruction-tuning run was training on the prompt as well as the answer.
`assistant_only_loss` is TRL's mask and it needs `{% generation %}` in the chat
template. None of unsloth's 43 templates contain it — grep -c "generation %}"
unsloth/chat_templates.py returns 0. So `assistant_only_loss: auto`, the
documented default, resolved to False for every template a user can actually
select. There was no error; the run summary printed "Loss mask: full sequence"
as though that were the intended outcome.
Unsloth's own answer is train_on_responses_only(trainer, instruction_part,
response_part) (chat_templates.py:58-87), which masks by locating literal turn
markers and works on any template. It is applied to the built trainer rather
than through the config, because it rewrites label tensors on the tokenised
dataset.
That needs the two markers, which vary by family, so this adds a table for
llama-3, chatml, gemma, mistral, phi and zephyr, and a resolver that falls back
to the model name when no chat_template is set. Unknown models resolve to None
rather than a guess: masking on the wrong markers finds no boundary and trains
on nothing, which is worse than not masking.
Two things worth review:
- Writing the resolver's tests found a real bug in it. Every unsloth model is
"unsloth/<name>", and "unsloth" is itself a template key, so scanning the
full repo id sent every one of them to the chatml markers — including Gemma
and Llama models whose markers are different. It now matches the repo name,
not the org.
- The summary line now names which route masked. "assistant replies only" hid
the distinction between two mechanisms with very different coverage, and the
unmasked case now says what it costs: "full sequence (training on prompts
too)".
decide_masking() is separate from train_model so the routing can be tested
directly. The first version of that test read train_model's source for the
string "train_on_responses_only" and passed with the calling branch disabled —
the same shape of weak test that let the original defect survive.
18 tests. Five mutations, four killed: removing the fallback route, matching
the org prefix again, making two markers identical, and forcing masking on.
The survivor is collapsing the two routes into one truthiness check, which is
covered by the label test rather than the router. Full suite 253 passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
process_dataset applied the SFT formatter unconditionally, collapsing every row
to a single "text" column before the preference column check ran -- so a
correctly shaped DPO/ORPO/KTO dataset lost the very columns its trainer needs and
was rejected before trainer construction, making all three new methods
unreachable. Skip SFT text-formatting for preference methods so prompt/chosen/
rejected (and prompt/completion/label) survive intact.
Also fixes an undefined `logger` in load_datasets that raised NameError whenever
dataset.processing_func was set; switched to print to match the module.
Adds regression tests covering both the preference bypass and the unchanged SFT
path.
Co-authored-by: Mervin Praison <[email protected]>
Every model this tool uploaded became a PUBLIC repository. `private` was never
passed to push_to_hub_merged or push_to_hub_gguf in any of the three places
that push — train/llm/trainer.py, train_vision.py and upload_vision.py. Unsloth
accepts the flag (save.py:2654, create_huggingface_repo(private=...)); nothing
here forwarded it. A model fine-tuned on private data was published the moment
training finished, silently.
The default is now private. Publishing is one click in the Hub UI; unpublishing
something that has already been crawled is not. Set hf_private: false to
publish.
The same duplication hid two more defects, both in upload_vision.py, both
already solved in its LLM twin:
- No error handling at all, so a rejected token surfaced as a raw
HfHubHTTPError traceback. The LLM copy has translated 401 and 403 into
actionable messages for a while.
- An unguarded rmtree: it deleted config["hf_model_name"] whenever a directory
of that name existed, with no check that the value was a local path rather
than a Hub repo id. A bare name like "mymodel" deleted ./mymodel.
All three now share praisonai_train/_hub.py, so the next fix lands in one place
instead of one of three. save_method, commit_message and tags are forwarded
too — previously save_method was hardcoded to merged_16bit at all three sites.
Found by an agent diffing unsloth's save.py against these files.
14 tests. The privacy default is asserted directly, the YAML "false" string is
covered (without the trainer's coercion it is truthy and would keep the repo
private against the user's wish), and a test asserts no push site still uses a
bare token as its only kwarg — the signature of the original defect.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The DPO/ORPO/KTO support in the previous commit could never have worked on a
real corpus, and the tests did not catch it because they exercised the column
check in isolation rather than through process_dataset.
process_dataset ends with
dataset.map(format_func, remove_columns=dataset.column_names)
which collapses every row to a single `text` column for SFT. Applied to a
preference dataset that destroys prompt/chosen/rejected before the trainer ever
sees them, so every DPO run would have died with
method 'dpo' needs the column(s) ['prompt', 'chosen', 'rejected']
and the dataset has ['text']
— an error message that blames the user's file for something this code did to
it moments earlier.
Non-SFT methods now return the dataset with its columns intact, after the
shuffle that the SFT path would also have applied. Found by an agent reading
unsloth's rl_replacements.py against this file; the preference trainers there
read those columns by name (rl_replacements.py:163-201, :850-931).
Two tests, both asserting order rather than outcome: the method guard must
appear before the flattening call and must return rather than warn, and the SFT
path must still flatten. Removing the guard fails the first.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Unsloth patches TRL's DPO, ORPO and KTO trainers alongside SFT — they are
named in the list of trainers it rewrites at unsloth/__init__.py:1438-1443.
praisonai-train could only ever construct an SFTTrainer, so a dataset of
chosen/rejected pairs had nowhere to go and the whole preference-tuning half
of the backing library was unreachable.
method: dpo # or orpo, kto; sft remains the default
beta: 0.1
max_prompt_length: 1024
TRAINING_METHODS is a registry: each entry names the TRL trainer and config
class, the columns the dataset must provide, and whether the method needs a
frozen reference model. Adding a method is one entry.
Three things worth calling out:
- ORPO declares needs_ref_model: False. It folds the reference into its loss,
so holding a second frozen model would double VRAM for nothing.
- DPO and KTO pass ref_model=None, which means "use the frozen base weights".
With a PEFT adapter that is exactly right and avoids a second full model.
- The dataset's columns are checked before the run starts. TRL's own failure
for a wrongly-shaped preference dataset surfaces inside the collator —
minutes in, after the model is loaded and quantised, and phrased in terms
of tensors rather than the file the user pointed at.
The TRL imports are individual and lazy, so a TRL too old to provide one
trainer can still run the others rather than failing at import; a method whose
classes are absent raises a message naming what to upgrade.
resolve_method() is separate from validate_config() so the method surface can
be tested without a CUDA import.
19 new tests. Five mutations, all killed: accepting an unknown method, dropping
case normalisation, disabling the column check, giving ORPO a reference model,
and having validate_config skip the check. Full suite 233 passing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Extract byte-identical prep and finalize logic from the sync
_execute_single_step and async _aexecute_single_step into three private
helpers (_prepare_step_context, _build_step_action, _finalize_step_result),
so both variants share a single source of truth. Genuine async seams
(handler-coroutine await, achat executor branch, retry-loop await) remain
per-variant. Pure behaviour-preserving extraction; no public API change.
Co-authored-by: MervinPraison <[email protected]>
Delete unreferenced 680-line EnhancedTemplateGenerator module that is
never imported, wired into the CLI, or exported. The canonical, wired
generator remains standardise/templates.py::TemplateGenerator.
Co-authored-by: MervinPraison <[email protected]>
The regression test for #4229 eagerly constructed Agent(memory=preset) for
every advertised preset, which initialised live memory adapters (Mem0/MongoDB)
and failed CI without API keys or running services. Assert resolver correctness
instead, matching resolver-only test patterns elsewhere.
Co-authored-by: MervinPraison <[email protected]>
- ui/index.html: handle approval_request SSE events with an inline
Allow/Always/Deny card that POSTs /approve/{id}. Without this, the default
approval_mode:ask stalled every gated file/URL tool for the full 300s
timeout because the shipped UI never resolved the decision.
- engine/server.py: _apply_env now removes OPENAI_API_KEY / OPENAI_API_BASE
when a value is cleared, instead of skipping it — clearing a key or base_url
no longer leaves the deleted credential/endpoint active for later turns.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
A Tauri shell supervising a Python engine on loopback. The streaming path is
kept off the IPC bridge: the webview reads SSE from 127.0.0.1 directly, which
is what jan, unsloth studio, ollama and hermes all independently converged on.
src-tauri/ Rust core, pure and I/O-injected so every decision is testable
without a Mac, a certificate, a network or an installed Python:
venv_resolve one function owns both interpreter and
site-packages, catching the silent case where
3.13.2 and 3.13.7 share a path and nothing raises
verify half-installed is Stale, not Ready
health a server answering failures with HTTP 200 cannot
be trusted by status code alone
readiness log phrasing is upstream and versioned, so it is
a tested pure function
adopt five gates before reusing an orphan; a recycled
PID is never killed
lockfile absent and corrupt get different answers
port_announce an announced port is a claim until probed
engine/ stdlib-only HTTP + SSE: streaming, cancellation, sessions,
persistence, tool approval carrying call_id, attachments, search,
settings, MCP config, fork, projects, keychain-backed secrets
ui/ single-file frontend. Named ui/ rather than dist/ because it is
hand-authored source, not build output -- and the repo's .gitignore
excludes dist, which would have silently dropped the entire
interface from the commit.
Tests: 62 Rust, 8 pacing, 11 DOM click tests dispatching real MouseEvents.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The verbose-callers migration accidentally dropped the broad `except Exception`
branch (added in 2eacdcf79) that degrades an installed-but-uninitializable
memory backend to FileMemory. Without it, a registered backend that raises a
non-ImportError during init (mem0 missing credentials, MongoDB unreachable)
hard-crashes Agent construction. Restored to honour the fallback contract.
Co-authored-by: Mervin Praison <[email protected]>
yaml_loader.py documents verbose: true in its example agents.yaml, reads it,
and passes it to Agent() unconditionally with a default of False. Agent has no
verbose parameter, so every scheduled YAML agent raises TypeError on
construction -- whether or not the key appears in the YAML.
Verbosity now goes through output=, which is where it was consolidated.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Verbosity was consolidated into output=, but two shipped call sites inside
praisonaiagents were left behind and raise TypeError on construction:
compaction/memory_flush.py the pre-compaction agent could never be built
tools/delegation_tools.py every delegate_task call
Agent's rejection of unknown kwargs is deliberate and is left intact. What was
missing was guidance: verbose is accepted by six sibling classes, and Agent has
no verbosity parameter among its 41, so the answer is not discoverable from the
signature. The error now names output= as the destination.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The shared BotSessionManager._profile_namespace field was rewritten by every
routing handler, so overlapping turns for different tenants could recompute a
storage key from another tenant's profile after an await point — reading or
persisting one tenant's transcript into another's namespace (flagged by
CodeRabbit and Greptile).
Bind the resolved profile turn-locally in a per-task ContextVar inside chat()
(consumed from per-agent/instance staging and reset in finally), and propagate
that context into the load/save executor threads. Concurrent routed turns now
keep isolated namespaces and an unscoped route always fails closed.
Adds an overlapping-turns regression test.
Co-authored-by: Mervin Praison <[email protected]>
The gateway resolved RouteMatch.profile but never consumed it, so per-route
tenant isolation was inert and failed open — every route on a process shared
one memory store. Wire the resolved profile through the routing handlers onto
the session's storage key so memory/session state is namespaced per tenant,
and stays unscoped (fail-closed) when a route names no profile.
Co-authored-by: MervinPraison <[email protected]>
The lockstep extraction only recognised double-quoted literal msg_type
comparisons, so a dispatcher branch written enum-only (as ping/pong already
are, e.g. `msg_type == EventType.X.value`) would drift past it — the exact
silent registry/dispatcher divergence the test exists to catch.
Resolve every `EventType.<NAME>.value` operand through the enum to its wire
value, treat operands within one `in (...)` branch as aliases for a single
dispatch path (so the abort/MESSAGE_ABORT branch stays one method, not a
spurious `message_abort`), and add a positive control asserting the
enum-derived branch resolution still works.
Co-authored-by: Mervin Praison <[email protected]>
Providers send a tool-call id once and omit it on later argument chunks.
The DELTA_TOOL_CALL/TOOL_CALL_END branches minted a fresh UUID per chunk,
orphaning arguments from the invocation the client assembles. Track the
active tool call in EventBuffer and fall back to it. Also drop the
truthiness guard on these branches so a TOOL_CALL_END with an empty
tool_call payload closes the call instead of raising.
Co-authored-by: Mervin Praison <[email protected]>
Reuse the original request messages (system prompt, output constraints,
memory context) for the post-tool follow-up instead of chat_history alone,
which dropped the system turn. Bracket the follow-up answer with
REQUEST_START/LAST_TOKEN/STREAM_END so consumers see telemetry for the
answer, not just the tool-call round. Strengthen the regression test to
assert the sentinel flows through the streamed answer, proving the tool
branch ran.
Co-authored-by: Mervin Praison <[email protected]>
The streaming path collected tool calls, executed them, appended the results
to chat history -- and then ended. It never asked the model for the final
answer, so start(stream=True) yielded nothing while the identical
non-streaming call answered normally.
There was no error. The caller received an empty generator and could not
distinguish 'the model had nothing to say' from 'the answer was never
requested'.
The follow-up completion carries no tools, so the model answers from the
results it already has rather than calling another tool, which also bounds
the turn to a single round.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
resolve_required_scope() fails closed to ADMIN for anything it does not know,
which is the right default -- but four of the six message types the dispatcher
handles were unregistered, so switching the resolver on would have demanded
ADMIN for the connection handshake and locked out every client.
hello, join and leave are READ; abort is WRITE, since aborting a turn mutates
it exactly as sending one does.
Adds a lockstep test pinning the dispatcher's message types against the
registry, in the style that catches a runtime-only permission failure no
behavioural test can see.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The AG-UI adapter handled DELTA_TEXT, TOOL_CALL_START and TOOL_CALL_RESULT
and ended with a bare `return []`. StreamEventType has sixteen members, so
thirteen were discarded with no error and no log.
ERROR, RETRY, MODEL_FALLBACK and STREAM_UNAVAILABLE were among them: a
mid-stream provider failure produced a run that ended cleanly having never
told the client anything went wrong.
Every type now has an explicit disposition -- mapped, or listed in
NOT_WIRE_VISIBLE -- and an undeclared type raises rather than vanishing, so
adding a seventeenth member fails a test instead of dropping a frame in
production.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
CI test-core (subdirs) failed on test_every_advertised_preset_resolves with
"Mem0 API Key not provided" because the mem0 package is installed in that job
but no MEM0_API_KEY is set. Agent(memory="mem0") already promised a graceful
"Falling back to FileMemory" for missing optional dependencies (ImportError),
but an installed-yet-uninitialisable SaaS backend raised ValueError, which was
uncaught and crashed construction. Broaden the string-preset branch to honour
the same fallback contract for runtime init failures.
Pre-existing, unrelated to PR #4340 (gateway durability); no Agent params added.
Co-authored-by: Mervin Praison <[email protected]>
Address two valid review findings on the durability-degradation surface:
- Recovery clears degradation: a successful durable SqliteIdempotencyStore
build now clears any prior `durability:idempotency` degraded fact, so a
same-process rebuild (config hot-reload) that restores durability no longer
leaves health()/`gateway status` permanently reporting non-durable operation.
Mirrors the existing session-store recovery-clear path.
- Redacted operator-facing reasons: the idempotency and session fallback paths
no longer interpolate the raw store-init exception (which can embed backend
filesystem paths) into the degraded-owner `reason`. The raw exception stays in
the log only; the reported reason is an operator-safe, redacted string —
matching the documented contract on record_durability_degraded.
Tests: add recovery-clears-degradation test and a redaction assertion.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Gateway durable state was opt-in and lost silently. Now:
- build_idempotency_store is durable by default (SQLite when a state dir is
available); "memory" stays an explicit opt-in for tests/ephemeral runs.
- Gateway server default idempotency backend is durable when none configured.
- Session/idempotency store-init failures record a durability-degraded fact
(owner_kind="gateway", owner_id="durability:<component>") instead of a silent
logger.warning, reusing the existing DegradedCapabilityRegistry — no new core
protocol or Agent params.
- health() merges durability facts; `gateway status` prints a Degraded: section
with a redacted reason and a `fix:` hint so operators see non-durable runs.
Co-authored-by: MervinPraison <[email protected]>
- rules clear: constrain deletion to workspace-scoped CLI-created rules; no
longer unlinks discovered AGENTS.md/CLAUDE.md/PRAISON.md, global, git-root or
nested subdir rules (Greptile P1).
- context_files remote fetch: pin each connection to a validated public IP and
re-validate at connect time, closing the DNS-rebinding TOCTOU window while
preserving Host/SNI; _allow_local_urls opt-in bypasses pinning (Greptile P1).
- tests: add regressions for clear-scope preservation and rebind refusal.
Co-authored-by: Mervin Praison <[email protected]>
On a standalone `pip install praisonai-code` the subtree instruction hook,
`--instructions` resolution, and the `rules` command silently degraded because
their implementations were reachable only via the optional `praisonai_bot` /
`praisonai` wrapper packages.
- Add a resident, dependency-free `praisonai_code/integration/context_files.py`
(stdlib + `praisonaiagents.hooks` only) so subtree AGENTS.md loading and
`--instructions` glob/URL resolution work without the optional packages.
- Wire `run.py::_wire_subtree_context_hook` to fall back to the resident helper
after the optional bot/wrapper copies, removing the silent no-op.
- Give `rules list/add/clear` a native implementation backed by core
`praisonaiagents.memory.RulesManager`, delegating to the wrapper bridge only
when core is genuinely unavailable.
- Add standalone regression tests that block the optional packages.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 races flagged by Greptile on PR #4336:
- executor.submit: reserve the admission slot synchronously (create+register
task before any await) so concurrent submits can no longer slip past the
max_queued ceiling. The QUEUED persist moves to the head of _execute_job
(before the concurrency semaphore), preserving the store-reflects-QUEUED
contract without a check-then-await race.
- router.submit_job: on JobQueueFull after save_if_absent persisted the job,
delete the stranded record so its idempotency key is freed and status/SSE
don't hang while /result returns 409. Cleanup is best-effort and never masks
the 503.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: JobExecutor now keeps a list of progress callbacks per job and
fans out to all of them, so concurrent SSE viewers of the same run each
receive updates; unregister removes only the given callback.
Gap 2: JobExecutor.submit rejects with JobQueueFull once max_queued
(default max_concurrent*10) is reached; the router maps this to a 503 +
Retry-After so floods get honest backpressure instead of unbounded task
growth.
Gap 3: AsyncAgentScheduler gains from_blueprint via a shared
build_from_blueprint helper in _base_scheduler; blueprint resolution now
lives in one place for both sync and async schedulers, and the async
variant dispatches via astart so it never blocks the event loop.
Co-authored-by: MervinPraison <[email protected]>
- chat_mixin: before_model/wrap_model_call mutations to temperature/tools now
flow into the retry core (were silently ignored)
- chat_mixin: after_model mutations on non-string responses are preserved via
_unwrap_model_response (previously raw object bypassed hook edits)
- chat_mixin: achat() now routes through the model middleware manager (was
bypassing before/after/wrap_model_call); sync chain bridged via executor
without nesting event loops, retry core extracted to
_achat_completion_with_retry_core
- knowledge: URL ingestion now captures bare string document ids (MongoDB)
Addresses CodeRabbit/Greptile review findings on PR #4334.
Co-authored-by: Mervin Praison <[email protected]>
- Task(skip_on_failure=True)/on_error="continue" now let a dependent task
run in degraded mode instead of being force-failed when an upstream
dependency fails, across every cascade path (agents async/sequential and
process sequential/asequential).
- Agent(hooks=[before_model/after_model/wrap_model_call]) now fire: model
calls route through MiddlewareManager.execute_model_call via a new
_get_model_middleware_manager, mirroring the existing tool-hook wiring.
- Knowledge.add() now ingests URL inputs (as its docstring documents) via
MarkItDown extraction instead of raising NotImplementedError.
Co-authored-by: Mervin Praison <[email protected]>
web_search and other tools declared in praisonaiagents' TOOL_MAPPINGS
resolve to None when their optional dependencies aren't installed. After
switching to ToolResolver.resolve(), these were incorrectly flagged as
'Unknown tool' errors, breaking test_agents_yaml_valid_fields_no_warnings.
Consult TOOL_MAPPINGS so such tools produce an install warning instead of
a hard error, while genuinely unknown tools still error.
Co-authored-by: Mervin Praison <[email protected]>
ConfigValidator._validate_tools called a non-existent resolve_tool()
method on the ToolResolver instance, raising AttributeError that was
swallowed by the broad except, downgrading every tool reference to a
generic warning. Unknown/misspelled tools were never reported as errors.
Use the actual instance method resolve(), which returns None on miss.
Co-authored-by: MervinPraison <[email protected]>
Address CodeRabbit review: _get_legacy_verbs() returned an empty set on
oracle import failure, which let implemented verbs (e.g. `thinking status`)
fall through to the bare-prompt rule and be forwarded to the modern `run`
engine as a paid LLM prompt — the exact #4327 regression the guard prevents.
Now fails closed via a static _LEGACY_VERBS_FALLBACK mirror, logs a warning,
and does not cache the fallback (so recovery is possible). Adds tests for the
fail-closed path, end-to-end routing under discovery failure, and a drift
assertion keeping the fallback in sync with the authoritative oracle.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Since 82f55c97b the unified dispatcher treated any first token that is not a
registered Typer command as free text and forwarded it to the modern `run`
engine, billing 29 implemented legacy verbs (thinking, install, persistence,
audio, …) to /v1/responses at ~2.5k tokens with exit 0.
Extract the legacy dispatcher's authoritative verb list into a reusable
LEGACY_SPECIAL_COMMANDS constant and have the unified dispatcher consult that
same oracle: an implemented legacy verb routes to legacy (its handler) before
the bare-prompt/LLM path. containers and vector-stores are withheld pending
#4322 so routing does not promote a fabricated success.
Co-authored-by: MervinPraison <[email protected]>
The `search` command was advertised in --help and registered as a real Typer
command, but was missing from get_command_names()'s routing oracle. This caused
`praisonai search "..."` to be misclassified as a bare prompt and billed as an
LLM call, contradicting its "no LLM generation" help text.
Adds `search` to the routed set and a parity regression test guaranteeing every
advertised command is also routed (guards the #2191 drift guarantee).
Co-authored-by: MervinPraison <[email protected]>
backends was added to _LAZY_COMMANDS but never mapped in COMMAND_CATEGORIES,
leaving test_every_registered_command_has_a_category failing and the command
without an explicit --help panel. Map it to Advanced.
Co-authored-by: Mervin Praison <[email protected]>
Vector store file ops now call the real litellm public API
(vector_store_file_create/list/delete) instead of the never-existent
create_vector_store_file names, and no longer swallow AttributeError into
fabricated success. Delete defaults to False, not True.
search() uses the shipped duckduckgo_tools.internet_search symbol (was the
nonexistent duckduckgo_search) and surfaces backend errors instead of a
permanent empty-but-successful result.
containers/container_files have no backend, so container_create and the
container file read/write/list functions now raise NotImplementedError
rather than inventing container IDs or returning empty results. CLI and MCP
adapters already wrap these in except Exception, so failures surface cleanly.
Co-authored-by: MervinPraison <[email protected]>
get_command set rich_help_panel but never command.name. typer_get_command
yields "" for a Typer(help=...) declared without name=, and collapses a
single-command app to that command's own name — so --help rendered 77/98
commands with a blank name and 3 with a wrong (untypeable) name. Pin
command.name to the registry key (the true typeable name) in get_command.
Co-authored-by: MervinPraison <[email protected]>
- _chunk.py: only re-wrap truly pure single-fence chunks in enforce_hard_cap;
mixed fence+prose or multi-fence chunks are hard-split as plain text so prose
is never rendered as code (Greptile P1).
- telegram.py: measure and chunk in the platform's declared UTF-16 unit so
emoji-heavy replies cannot exceed Telegram's 4096 UTF-16 cap (Greptile P1).
- tests: mixed-fence non-corruption + UTF-16 length coverage.
Co-authored-by: Mervin Praison <[email protected]>
Part 1: split_media_from_output stripped every blank line from every
Telegram/Slack reply, destroying load-bearing separators, paragraph
breaks and clean chunk boundaries. Now only excess blank runs left by
removed MEDIA lines are collapsed; single blank-line separators survive.
Part 2: chunk_message emits an over-cap code fence by design and no
caller re-checked the platform cap, so a pure/oversized fence raised
"message too long" and lost the whole reply. New enforce_hard_cap()
splits any over-cap chunk (re-balancing ``` on split fences) and is
applied in every _send_long_message (telegram/slack/discord).
Fixed together so restoring blank lines cannot regress fence delivery.
Co-authored-by: MervinPraison <[email protected]>
- Remove the dead /sethome registry entry: it was published to every
adapter's menu but implemented on none, so drop the false advertisement.
- Telegram: on a slash-command miss, dispatch the raw text to the agent
instead of ending silently, matching the Slack reference and the code's
own docstring.
- Discord: remove the bare terminal return in the on_message command block
so an unknown/unimplemented slash command falls through to agent dispatch
(like Slack) rather than a silent no-op.
- _session.reset()/reset_all(): clear _model_overrides so /new actually
remedies a bad or unavailable /model instead of every later turn failing
silently at the provider.
Co-authored-by: MervinPraison <[email protected]>
Address final-review findings on #4316:
- _export_qc_cfg no longer force-zeroes script thresholds when a caller sets
script_range/script_drop/script_flag, so a documented
qc_cfg={"script_range": [...]} re-enables the target-script check for other
languages instead of silently passing wrong-script rows. English default
(thresholds=0) is unchanged when no script key is given.
- Add test for the script_range-only re-enable path (kept for Latin, dropped
for Tamil).
- README: validate's atomic --out write is shared with generate/dedup, and
document that any script key re-enables the export QC check.
Co-authored-by: Mervin Praison <[email protected]>
Explicitly chain the translated typer.Exit from the caught SystemExit to
resolve Ruff B904 and preserve the original traceback.
Co-authored-by: Mervin Praison <[email protected]>
The legacy dispatcher's `if args.command:` chain had no `train` case, so
`praisonai-train llm <dataset>` fell through to the bare-prompt handler and
forwarded the literal word "train" to an LLM as a chat prompt — the real
training block was never reached and no trainer subprocess launched.
- Add a `train` guard in main()'s command chain so it reaches the dedicated
training block (which reads args.dataset/args.model and dispatches
praisonai_train.train.llm.trainer).
- Propagate a non-zero SystemExit from the router in train_llm so missing-dep
failures no longer exit 0 (CI gating on $? now sees them); clean exits still
return 0.
- Add a regression test that drives the real router (asserts the trainer is
dispatched and handle_direct_prompt is never called) plus exit-code tests.
Co-authored-by: MervinPraison <[email protected]>
- from-trials --qc: default export QC config disables the Tamil script-purity
check, since agent trajectories are English by construction (kept dedup,
boilerplate/refusal, length, diversity). qc_cfg still re-enables it.
- Surface the actual QC drop reasons: ExportSummary gains skipped_qc/qc_drops so
no row vanishes unaccounted, and from-trials names the reasons on the zero-row
error instead of guessing.
- validate: reuse the in-module tempfile+os.replace helpers (mirrors dedup/
generate) with a zero-kept guard, so an --out that aliases the input is never
truncated and a zero-kept run exits non-zero leaving any existing file intact.
- Document the Tamil script_range default in README and validate --help.
Co-authored-by: MervinPraison <[email protected]>
- server.py: extension-engine termination now uses the per-session agent's
max_steps (forwarded via start_session) instead of the server default, so
`browser run --max-steps` actually bounds the run (Greptile P1).
- browser.py: playwright/hybrid engines now warn when CDP-only options
(--vision/--screenshots/--record-video/--max-retries/--no-record) are set
rather than silently discarding them; corrected the run --help "Features"
block to state these require --engine cdp specifically (Greptile P1).
Co-authored-by: Mervin Praison <[email protected]>
- knowledge.query: forward `limit` to Knowledge.search (was dropped)
- a2a.send: forward `task_id` via kwargs (was discarded)
- realtime.send: map message to `data` with real event_type (was passed as event_type)
- add regression tests for the three semantic bindings
Co-authored-by: Mervin Praison <[email protected]>
- Send max_steps in start_session wire frames on the extension path
(server.py already reads it, so this was a pure missing-field fix)
- Pass record_video=record_video to run_cdp_only in _run_alternative_engine
so --record-video on cdp actually records instead of only billing gpt-4o
- Warn when engine-only options (--vision/--screenshots/--record-video/
--max-retries/--headless/--extension/--no-record) are set on the default
extension engine, instead of silently discarding them
- Clarify --url is context-only on the extension path and show max steps
- Fix run --help "Features" caveat and add --engine to screenshots example
Co-authored-by: MervinPraison <[email protected]>
A CDP click/type/clear_input on a selector matching nothing returned success
unconditionally, so run()'s retry loop broke on first success and --max-retries
plus all fallback-selector strategies never fired. The injected JS now returns
whether the element was found and a miss yields success=False with an error,
making the existing alternative-selector retry strategies reachable.
Co-authored-by: MervinPraison <[email protected]>
Coerce unknown deploy keys to str before sorted()/join() so a non-string
YAML key raises a clean ValueError instead of TypeError, and guard that
the deploy section is a mapping. Adds regression tests.
Co-authored-by: Mervin Praison <[email protected]>
status() and destroy() previously fell back to the ambient az
subscription when subscription_id was unset, risking wrong-subscription
inspection/deletion. Both now return their structured failure result
before issuing any az command, mirroring deploy()'s guard.
Also fixes test_azure_provider_deploy_failure to supply a
subscription_id so it reaches subprocess.run, and adds no-subscription
tests for status() and destroy().
Co-authored-by: Mervin Praison <[email protected]>
27 of 85 advertised praisonai-mcp tools could not succeed for any input:
their adapters called core/wrapper APIs that don't exist or have different
signatures, failing at attribute lookup or argument binding before any I/O.
24 returned isError:false and 9 reported an installed module as "not available".
Rebindings against real core:
- knowledge.*: query->search, list->get_all, stats->get_corpus_stats,
clear->reset, add(source) (dropped nonexistent source_type)
- hooks.*: get_default_registry().list_hooks() (was get_hook_manager)
- session.*: get_default_session_store() (was SessionManager)
- tools.*: list_tools/get_tool (was get_available_tools/get_tool_info/search_tools)
- eval.*: AccuracyEvaluator/PerformanceEvaluator (was AccuracyEval/PerformanceEval)
- workflow.run/run_file: AgentsGenerator(..., config_list=[])
- workflow.auto: AutoGenerator(topic, pattern).generate()
- audio.transcribe(audio=), audio.speech(text=), guardrails.check(content=),
ocr(document=), a2a.send(target_agent=), containers.file_read/write(path=),
skills.load(skill_name=), realtime.send(event_type=)
- resources: memory/sessions -> session store, knowledge/sources -> get_all
_handle_tools_call now sets isError:true when a handler returns an
"Error: ..." string, matching the convention already used for adapters
that raise.
Tests bind against real core (not hand-written fakes), so a future core
rename the adapter doesn't track fails here.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Bring DockerSandbox policy validation to parity with SubprocessSandbox
where it is semantically meaningful for a container:
- Enforce allowed_paths (opt-in) alongside blocked_paths, so a path
outside configured roots is refused before dispatch.
- Route run_command through the shared build_argv helper so a shell=True
payload is split by policy_scan_parts and its paths are scanned,
instead of walking an opaque `sh -c "..."` argv.
Deliberately does NOT copy SubprocessSandbox's allow_subprocess shell
block: Docker always dispatches via `sh -c` inside the container, which
is the isolation boundary that clause approximates on the host. Applying
it would refuse every command and defeat the backend rather than harden
it.
Adds regression tests for allowed_paths (in/out) and shell-payload path
scanning. All host-side + Docker filesystem tests pass.
Co-authored-by: Mervin Praison <[email protected]>
A misspelled field/section key in agents.yaml was silently discarded by
pydantic's default extra='ignore', so `deploy validate` reported valid while
deploying with defaults (e.g. a typo in cluster_name deploying to a new ECS
cluster). Set extra='forbid' on the deploy input models, reject unknown
top-level deploy sections in schema validation, surface cluster_name in the
human-readable validate output, and make the docker `push: true` path reach the
existing "no registry" error instead of silently skipping the push.
Co-authored-by: MervinPraison <[email protected]>
Azure Container Apps deployments read subscription_id only to echo it in
plan(); it was never passed to az, so every resource was created/destroyed in
the ambient default subscription. Mirror the GCP provider:
- append `--subscription {subscription_id}` to all six az invocations across
deploy/status/destroy/doctor via a _subscription_args() helper
- fail fast in deploy() when subscription_id is unset (matches GCP's project_id
guard)
- check_azure_cli() now compares the ambient subscription against the configured
one and warns on mismatch
Co-authored-by: MervinPraison <[email protected]>
DockerSandbox accepted a SecurityPolicy and enforced none of it, so moving
to the tier documented as stronger silently dropped every command-level
control. Mirror the tested SubprocessSandbox enforcement:
- Validate commands against blocked_commands / allowed_commands / blocked_paths
in run_command before dispatch.
- Truncate host-side communicate() output to max_output_size in run_command
and execute, so a runaway print in the container cannot exhaust the host
process.
Co-authored-by: MervinPraison <[email protected]>
Extends the OpenAI-native /stop fix to every synchronous same-run
re-dispatch that previously dropped the token, closing the Greptile P1
"nested completions drop cancellation":
- reflection + regeneration _chat_completion calls (chat_mixin.py)
- internal recursive redispatches: context-compression retry,
model fallback, retryable-error backoff (chat_mixin.py)
- guardrail-retry regeneration via _apply_guardrail_with_retry
(agent.py + its sync call sites in chat_mixin.py)
All hops just forward the existing cancel_token param (defaults None),
so behaviour is unchanged when no token is set. No new Agent params,
modules, or exports.
Co-authored-by: MervinPraison <[email protected]>
The default (non-custom) LLM path dropped the cancel token: chat_mixin
threaded llm_kwargs['cancel_token'] only inside the custom-LLM branch,
while the OpenAI-native else branch called _chat_completion(...) which
had no cancel_token parameter. The token never reached OpenAIClient,
so the between-iteration cancel checks were never armed and /stop
reported success while remaining tool calls kept executing.
Thread cancel_token symmetrically through the four sync hops that
already existed: _chat_completion -> _chat_completion_with_retry ->
_execute_unified_chat_completion -> _unified_dispatcher.chat_completion,
matching the custom-LLM branch. Defaults to None so no caller behaviour
changes.
Co-authored-by: MervinPraison <[email protected]>
The async idempotency veto only scanned self.tools, so a task-scoped tool
supplied via tools_override (and never registered on the agent) missed its
restart_safe=False / idempotent=False declaration and was retried, duplicating
its side effect. _tool_declares_not_idempotent now accepts the effective
tools_override set (searched first, mirroring _execute_tool_async_impl
resolution) while defaulting to None for the unchanged sync call sites.
Also tightens the test helper to catch only the expected RuntimeError /
ToolExecutionError instead of a blanket Exception, and adds an override-only
regression test.
Co-authored-by: Mervin Praison <[email protected]>
Adapter-backed get_all_memories() returned records keyed by `memory_type`
(SQLite) or `type` (in-memory), diverging from the legacy path's `type`
field and breaking callers that read record["type"]. Normalize adapter
results to always populate `type` while retaining adapter-specific keys.
Strengthen regression tests: assert both colliding tiers are erased on
untyped deletion, and assert the public `type` field is present on
adapter-backed records.
Co-authored-by: Mervin Praison <[email protected]>
_execute_tool_async_with_retry never consulted the idempotency
declaration, so achat()/astart() re-ran an effectful tool marked
restart_safe=False up to max_attempts times. Add the same veto the
sync loops use (tool_execution.py:884 and :2115) plus an async test.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer findings on PR #4296:
- Data-loss guard (CodeRabbit): derive WarmSession.flushed from a per-key
_flushed marker set only after a completed store write, not from
_store presence. A caught/partial persist now leaves the cache unflushed
so the pressure sweep never evicts the only current copy. Marker cleared
in _save_history (pre-write), _soft_evict, and reap_stale.
- Nested cgroup (CodeRabbit): resolve the process's own cgroup path from
/proc/self/cgroup and probe its v2/v1 memory limit first, falling back to
the filesystem root so a nested container's lower ceiling is honoured.
- Tests: add failed-persist skip and nested-cgroup coverage (15 total pass;
core planner 16 and gateway session suites still green).
Co-authored-by: Mervin Praison <[email protected]>
get_all_memories() selected from legacy short_mem/long_mem tables that no
adapter creates, so it swallowed OperationalError and returned [] for every
provider. Delegate to the active adapter, mirroring delete_short_term/
reset_short_term.
delete_memory(id) with no memory_type short-circuited on the first tier that
reported a hit. Since the SQLite adapter gives each tier its own AUTOINCREMENT
sequence, ids collide across tiers, so it erased an unrelated short-term row
and left the caller's target in place while reporting success. Delete from
both tiers instead of short-circuiting.
Co-authored-by: MervinPraison <[email protected]>
The core planner plan_pressure_evictions() plus the WarmSession /
MemoryPressureProtocol contracts had no runtime consumer, so an
always-on multi-session gateway had no way to reclaim warm-cache memory
under pressure and climbed to OOM.
This adds the missing wrapper-side enactor and a concrete reader:
- BotSessionManager.warm_sessions(): snapshots warm caches as core
WarmSession facts (LRU last_activity, in_flight, flushed).
- BotSessionManager.sweep_under_pressure(): reads the real cgroup budget/
RSS, calls the core planner, and soft-evicts the coldest rebuildable
caches LRU-first, re-sampling RSS to shed the minimum. No-op without a
cgroup limit, preserving today's behaviour.
- BotSessionManager._soft_evict(): drops only the in-memory history; the
durable store copy remains and is rebuilt on the next turn (lossless).
- Per-turn in-flight tracking so a live turn's cache is never evicted.
- gateway/memory_pressure.py CgroupMemoryPressure: stdlib-only concrete
MemoryPressureProtocol (cgroup v2 memory.high/max, v1 fallback,
/proc/self/status RssAnon), degrading to no-op when unreadable.
Flushed (store-backed) caches only are evicted; in-flight and unflushed
caches are always skipped. Backward-compatible: no eviction unless the
gateway calls sweep_under_pressure on its periodic tick.
Co-authored-by: MervinPraison <[email protected]>
Closes two P1 gaps in the ack scope gate (Greptile #4293):
- Gateway-hosted Telegram handler acked on `_ack.enabled` alone, bypassing
ack_scope so ambient group chatter still got a ⏳ reaction. Now routes
through should_ack_message like the standalone adapter.
- Slack classified a thread reply (no fresh @mention, mention_required off)
as ambient, silently dropping its ack. thread_ts now counts as engaging
the bot so the reply is acked under group-mentions.
Adds 3 TestAckScopeGating cases for the gateway wiring and Slack thread
classification.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile P1 findings on PR #4292:
- GatewayApprovalBackend now threads authorized_reviewers into register(),
so per-request reviewer custody is actually bound on the production path
(previously silently dropped, leaving every request unbound).
- _resolve_operator_identity prefers a non-secret X-Operator-Id header before
the shared-token digest, so a proxy/SSO layer can distinguish individual
operators sharing a gateway token in the audit trail.
Adds a regression test asserting the backend binds custody end-to-end.
Co-authored-by: Mervin Praison <[email protected]>
Add a closed AckScope (off | direct | group-mentions | group-all | all)
to AckReactor with a should_ack()/should_ack_message() gate, and a
BotConfig.ack_scope key (default group-mentions). Adapter call sites
(telegram/discord/slack/whatsapp/signal/linear) now derive direct/mention/
ambient context from the existing BotMessage and only ack messages the
scope covers, instead of reacting to every non-command message.
Co-authored-by: Mervin Praison <[email protected]>
The gateway resolve boundary now captures the resolving principal on the
durable audit trail (ApprovalDecision.approver) and allow-always grant,
replacing the constant "gateway"/"gateway:human" attribution. Resolution
gains an optional resolver id, threaded from the authenticated HTTP request
context (derived as a non-secret hash handle of the operator token).
An approval may optionally be bound to a set of authorized reviewers;
resolve() rejects a resolver not in that set (re-inserting the request so an
authorised reviewer can still resolve it) while preserving first-answer-wins
via the atomic pop. The binding is durable across restarts. Core
ApprovalRequest gains an optional authorized_reviewers field (the only core
touch). All defaults keep today's behaviour.
Co-authored-by: Mervin Praison <[email protected]>
The Signal poll loop refreshed inbound-liveness on every successful poll
batch, including successfully-empty ones. A silently half-open transport
returns [] forever without raising, so this kept health.last_activity
fresh and defeated the existing evaluate_channel_health STALE_SOCKET seam,
leaving a "deaf" channel reported HEALTHY with no operator signal.
Only note inbound activity when the bridge actually delivered an envelope,
so a stalled poll loop becomes detectable through the existing health seam
(no new module, API surface, or config knob).
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1s on AsyncMongoDBStateStore:
- async_hdel now returns only the count of fields actually present and
removed (StateStore contract "Returns count deleted"), matching the
Firestore/DynamoDB document-store backends instead of over-reporting.
- async_hset/async_hdel treat fields as opaque top-level keys via a
$mergeObjects pipeline / read-compute-write, so a dotted field like
"a.b" round-trips through hget/hgetall/hdel instead of being coerced
into a nested MongoDB path.
Co-authored-by: Mervin Praison <[email protected]>
- AsyncMongoDBStateStore: implement the 7 missing StateStore abstract
methods (keys, ttl, expire, hget, hset, hgetall, hdel) plus async twins
so the class is instantiable and every async_mongodb/motor/mongodb_async
factory alias boots instead of raising TypeError.
- db/adapter.py: rename the 6 async state-store call sites from the
non-existent aset/aget to async_set/async_get so async persistence hooks
take the native coroutine path instead of silently falling back to sync.
- agents_generator.safe_format: delegate to core
BaseFrameworkAdapter._format_template (single source of truth) so wrapper
and core cannot drift; fixes latent TypeError on non-string (None) input.
Co-authored-by: MervinPraison <[email protected]>
Closes the Greptile/CodeRabbit approval-clone coverage gap: the prior test
only inspected the original agent's private _approval_config and never
constructed a clone. Add a clone round-trip test asserting the served clone
reconstructs the same approval config and enforced _perm_deny set, plus a
negative test that a plain agent and its clone stay policy-free.
Co-authored-by: Mervin Praison <[email protected]>
clone_for_channel() rebuilds the agent from getattr(self, '_guardrails_config',
None) and getattr(self, '_approval_config', None), but neither attribute was
ever assigned to the instance -- both were locals inside __init__. The getattr
therefore always returned None and every served clone (one per gateway channel,
one per HTTP invocation) ran with no output guardrail and lost its approval
policy. Persist both resolved values on the instance so the clone can read them.
Co-authored-by: MervinPraison <[email protected]>
Regression from #4257: `_tool_declares_not_idempotent` fell back to the
shared `MUTATING_TOOLS` name registry, silently dropping the retry from
any *undeclared* tool that happened to share a name with an entry
(`write_file`, `store_memory`, `mkdir`...). Key on the explicit
declaration only, and consult the process-global registry the way
`_is_tool_idempotent` already does when `allow_global_tools` is set.
Co-authored-by: MervinPraison <[email protected]>
- Return False for non-dict verdicts (e.g. [], "allow", null) to avoid
AttributeError and preserve fail-closed behavior (CodeRabbit)
- Set ToolResponse.result to the denial message since the agent tool
executor returns result and discards error, so denials reach the model
instead of a null result (Greptile)
- Add non-object JSON regression test; update block test assertion
Co-authored-by: Mervin Praison <[email protected]>
- Re-add Python-style single-quoted list support via ast.literal_eval
(safe literal-only eval), fixing a regression where ['a','b'] collapsed
into a single loop item.
- Anchor JSONDecoder.raw_decode with the idx argument instead of slicing
text[start:] to avoid per-bracket copies.
- Cap decode attempts (and keep the 1M-char guard) so deeply nested
bracket input can no longer cause O(n^2) parsing time or a crash
(RecursionError now caught alongside JSONDecodeError).
- Add regression tests for single-quoted lists and adversarial input.
Co-authored-by: Mervin Praison <[email protected]>
Adds an optional, provider-neutral example that gates command-bearing
tools through HOL Guard at the existing wrap_tool_call boundary. The
policy is fail-closed: the wrapped tool only runs on an explicit allow
verdict; block/unknown/malformed/timeout/CLI-failure short-circuit with
zero downstream execution. Includes a regression test suite proving a
denied command never reaches the tool executor.
Co-authored-by: kantorcodes <[email protected]>
Delete the unused ServerRegistry class and _get_default_server_registry()
helper. These were never wired into the live launch path; server state
lives in module-level dicts in execution_mixin.py, torn down by
cleanup_launch_registration(). Also update the now-stale comment that
referenced the removed class.
Co-authored-by: MervinPraison <[email protected]>
- reject import payloads newer than PORTABLE_VERSION (reported, not applied)
- persist imported sessions verbatim via _save_imported_session (bypass
destination retention/active_window so a valid larger export is not truncated)
- copy metadata before clearing live fields so the caller payload is not mutated
- write CLI exports to a temp file + atomic os.replace (never corrupt an
existing backup on failure; nonzero exit on error)
- add tests for the above
Co-authored-by: Mervin Praison <[email protected]>
- Reject non-finite/non-increasing bucket bounds before storing (prevents
render_prometheus() failures)
- Raise ValueError on conflicting bucket layouts for an existing metric name
instead of silently ignoring later overrides
- Reject caller-supplied reserved 'le' label to avoid duplicate le samples
- Fix snapshot() to emit name_count{labels}/name_sum{labels} matching the
Prometheus renderer
- Rename _HistData sum param to avoid shadowing builtin (ruff A002)
- Add tests for bucket conflicts, le rejection, validation, and label ordering
Co-authored-by: Mervin Praison <[email protected]>
Extend the session-store contract with a store-agnostic portability surface so
a gateway operator can back up, move, or restore live conversation state:
- core: add PortableSessionStoreProtocol + ImportReport to session.protocols
- core: implement export_session / export_all / import_sessions on
DefaultSessionStore (SqliteSessionStore inherits it), reusing the existing
SessionData.to_dict/from_dict shape. Export is lineage-aware; import is
hardened (size cap, duplicate guard, malformed-record skip) and resets live
routing/activity fields so restored state is inert until re-bound.
- core: export the new symbols from session/__init__.py
- wrapper: add `praisonai gateway sessions export/import` CLI + preflight
helpers over the gateway's own default store.
Co-authored-by: MervinPraison <[email protected]>
Add a dependency-free histogram metric type to GatewayMetrics so the
gateway /metrics endpoint exposes latency distributions (buckets, _sum,
_count) for SLOs and slow-turn diagnosis, alongside the existing
counters and gauges.
- observe(name, seconds, buckets=..., labels=...) records durations
- timer(name, ...) context manager times its body and records it
- render_prometheus() emits _bucket/+Inf/_sum/_count histogram lines
- snapshot() includes a "histograms" section
- default buckets cover sub-second to multi-second turns
Co-authored-by: MervinPraison <[email protected]>
Address two P1 review findings on the gateway saturation telemetry:
- LoopWatchdog: anchor the lag clock to the oldest still-unacked probe so a
stall spanning several probe intervals is no longer understated (each fresh
probe was overwriting the send-time). The ack consumes the anchor so the
next probe re-anchors from a caught-up loop.
- OutboundQueue.try_depth_snapshot(): non-blocking (pending, dead_letter)
counts that yield None when the writer lock is contended, and wire
_compute_pressure() to reuse last-known depths instead of blocking. Health
and /metrics run on the event loop and must never wait on the outbox lock.
Adds regression tests for the anchoring invariant and the non-blocking snapshot.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Mervin Praison <[email protected]>
The always-on gateway enforces back-pressure (admission ceiling + fair
wait-queue, durable outbox/DLQ, event-loop wedge watchdog) but exposed no
saturation telemetry — health() reported liveness only, so the first signal
of overload was dropped work.
Core (praisonaiagents) owns the shape + a pure classifier, mirroring the
ReloadStatus precedent:
- HealthPressure frozen dataclass + deterministic evaluate_pressure() helper
- LoopWatchdog now reads back its continuously-measured scheduling lag
(last_lag_ms), the same signal the wedge check already uses
Wrapper (praisonai_bot) reads facts already in hand and fills the block:
- health() gains a "pressure" block; /metrics gains admission/backlog/lag gauges
- OutboundQueue.dead_letter_count() surfaces the permanent-failure tier
Additive observability only — no new config keys, no new endpoint.
Co-authored-by: MervinPraison <[email protected]>
Save the prior tool_call/llm_content callbacks and restore them on cleanup
under the core callbacks lock with an identity check, instead of blindly
overwriting and deleting the process-global slots. This mirrors
praisonaiagents' own register/restore pattern so another in-process
consumer that owns these slots keeps receiving events after a TUI turn.
Addresses Greptile P1 (global callback ownership lost).
Co-authored-by: Mervin Praison <[email protected]>
The default interactive TUI (async_tui.py) only registered the tool_call
display callback, so intermediate assistant text was rendered as a single
whole-response append after the worker thread joined. Register the core
llm_content callback (already emitted per LLM step) to push narrative into a
live assistant message as the turn progresses, and reuse that streamed
message as the finalised turn to avoid a duplicate append. Read-only review
turns keep their single-summary behaviour. No new core surface; wrapper-only.
Co-authored-by: Mervin Praison <[email protected]>
- api/call.py: the lazy-import refactor dropped the ``request: Request`` /
``websocket: WebSocket`` annotations, so FastAPI treated ``request`` as a
required query param and 422'd the ``/`` route. Stamp the real classes onto
the handlers in _register_routes (build time, where fastapi is already
imported) — import stays cheap, route injection restored.
- cli/_shim.py: skip ``None`` placeholders in the eager walk_packages loop so a
known-absent submodule can't poison the old dotted path before _AliasFinder
resolves it lazily (mirrors the existing guard in the first pass).
- test_wrapper_layer_regression.py: force PRAISONAI_ALLOW_LOOP_BLOCKING empty
around the strict assertion so an ambient opt-in can't mask the RuntimeError.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The lazy-by-default shim in cli/_shim.py broke module identity across the
old/new dotted paths (guarantee #1 in its own docstring): importing the
old name first (e.g. `from praisonai.mcp_server.cli import ...`, as the
tests do) re-entered _AliasFinder and double-loaded the moved file,
yielding two distinct module objects. That made mock.patch("<old.path>")
target a different object than the running code (imported via the new
name), causing the test-core (cli/subdirs) and smoke CI failures.
Restore eager pre-registration as the DEFAULT (it was already lightweight:
optional heavy submodules that fail import are logged and left for lazy
resolution). Keep an explicit opt-out via PRAISONAI_SHIM_LAZY=1 for
callers that don't rely on cross-path module identity.
Also make api/call._load_local_tools() idempotent (clear before repopulate)
so repeated build_call_app(load_local_tools=True) builds no longer
accumulate duplicate tool definitions in the shared registry (greptile).
Co-authored-by: MervinPraison <[email protected]>
Three lightweight, backward-compatible wrapper fixes:
1. cli/_shim.py: gate the eager walk_packages pre-import behind
PRAISONAI_SHIM_EAGER (lazy by default via _AliasFinder) and log
previously-swallowed submodule ImportErrors instead of silently
skipping them.
2. api/call.py: make heavy deps (fastapi, twilio, uvicorn, pyngrok,
websockets, rich) lazy-imported; build the FastAPI app via a
build_call_app() factory plus a lazy module __getattr__ for `app`;
move the import-time tools.py filesystem scan + user-code execution
into a server-entry-point path so importing the module has no side
effects.
3. _async_bridge.run_sync_or_offload: refuse to block a running event
loop by default (opt-in via PRAISONAI_ALLOW_LOOP_BLOCKING), steering
async callers to arun_sync_or_offload; PraisonAIAdapter.run uses
run_sync on the plain-sync path and raises a clear error from a
running loop.
Updated the corresponding wrapper regression test to the new strict
contract.
Co-authored-by: MervinPraison <[email protected]>
The sync workflow() path (lines 1502/1504) is duplicated code, edited
independently from aworkflow(). The existing suite drove only aworkflow(),
so a whitespace regression in the sync branch would leave it green.
Adds _run_sync driver + parametrized sync retry/control tests. Verified
they fail without .strip() and pass with it.
Co-authored-by: Mervin Praison <[email protected]>
Decision task verdicts were routed via result.raw.lower() and pydantic.decision.lower() at eight sites without strip(). Raw model text routinely carries a trailing newline, so the condition lookup missed and a miss was treated as exit-condition-met: the workflow finished silently with the rejected output (no retry, no validation feedback, no error). This adds strip() at all eight sites so a padded verdict routes exactly like a clean one, matching validate_decision_string which already lowers and strips.
Co-authored-by: MervinPraison <[email protected]>
The retry veto only read the raw `idempotent` attribute, missing the public
`restart_safe=False` contract used by @tool (FunctionTool) and BaseTool. Such
effectful tools remained retryable in both loops, duplicating side effects.
Fall back to `restart_safe` when `idempotent` is unset; add regression tests
for @tool and BaseTool declarations.
Co-authored-by: Mervin Praison <[email protected]>
A tool declaring idempotent=False was still re-driven up to max_attempts
times by both retry loops, duplicating side effects (send a second email,
charge twice). Both loops now veto the retry when a tool *explicitly*
declares itself non-idempotent, via a new tri-state helper
_tool_declares_not_idempotent that keys on the explicit declaration only,
leaving undeclared/declared-safe tools' retry behaviour unchanged.
Co-authored-by: MervinPraison <[email protected]>
- _extract_llm_response_content now inspects message.refusal (carried
independently of finish_reason) and warns without logging refusal text
- async chat_history test now asserts result == "" and an empty assistant
message, closing gaps flagged in review
Co-authored-by: Mervin Praison <[email protected]>
The streaming auto-detect block in _chat_completion caught every
non-LLMError exception and fell back to a non-streaming retry. Tool
failures during the streaming attempt were therefore run again by the
fallback, executing the tool twice and potentially masking the original
typed failure. Re-raise ToolExecutionError before the generic fallback,
mirroring the guard in the main completion block.
Also tighten the regression tests to assert the failing tool actually
executed (the tool executor retries a failing tool, so every attempt is
verified to target the same recipient).
Co-authored-by: Mervin Praison <[email protected]>
_extract_llm_response_content ended in return str(response), reached whenever
a well-formed response carried no content and no tool_calls (content filter,
refusal, or finish_reason=length with zero output tokens). achat() used this,
so the user's answer became the raw ChatCompletion repr, persisted into
chat_history and replayed to the model.
Now a cleanly-parsed-but-empty message returns "" (matching the sync path),
logging a warning when finish_reason is unexpected. str(response) is reserved
for genuinely unparseable responses where the repr is a diagnostic.
Co-authored-by: MervinPraison <[email protected]>
Prefix the unused _agent() tuple element with an underscore to satisfy
Ruff RUF059, as flagged in review.
Co-authored-by: MervinPraison <[email protected]>
The sync reflection handler incremented the retry counter and continued
unconditionally on a parse error, so a persistently unparseable reflection
(e.g. an OpenAI structured-output refusal where message.parsed is None)
looped forever at two LLM calls a turn and chat() never returned. Mirror the
async bound at chat_mixin.py so the loop stops at max_reflect and returns the
un-reflected answer.
Co-authored-by: MervinPraison <[email protected]>
Add an explicit `except ToolExecutionError: raise` guard before the blanket
`except Exception` in `_chat_completion`, mirroring the existing
`BudgetExceededError` escape hatch. Previously a `ToolExecutionError` raised by
the sync tool executor was caught by position and re-labelled as `LLMError`,
causing chat() to return None, the tool's message to be fed to the LLM error
classifier (so a tool error resembling a rate limit re-drove the model with no
tool result), and confident answers generated with no tool result.
Co-authored-by: MervinPraison <[email protected]>
- Resolve RLIMIT_* via getattr so POSIX platforms missing a constant skip
that cap instead of raising AttributeError before subprocess launch
- Add RLIMIT_CPU (CPU-seconds from timeout) so CPU-bound sandbox code is
stopped by the kernel rather than only the wall-clock timeout
- Check cancel token before AND after rate-limiter acquire in both sync
chat() and async achat() backend branches, so pre-cancelled requests do
not block on the limiter or consume capacity
Co-authored-by: Mervin Praison <[email protected]>
The overflow pointer advertises read_file/grep on the spilled artifact, but
those tools reject out-of-workspace paths. When PRAISONAI_TOOL_OUTPUT_DIR is
unset, spill into a workspace-local .praisonai_tool_output dir so the omitted
output stays retrievable (fixes Greptile P1 on #4247).
Co-authored-by: Mervin Praison <[email protected]>
- Rewrite success path now surfaces the "Applied N changes" receipt that
sg writes to stderr, instead of reporting the failure value
"No changes made" after a real, destructive rewrite.
- Confine path/rule_file to the workspace via path_safety.resolve_within_root.
- Add a `--` argv terminator so a dash-leading path is never parsed as a flag.
- Bound search/rewrite/scan output via _output_overflow.bounded_with_pointer.
Co-authored-by: MervinPraison <[email protected]>
1. Sandbox ResourceLimits (memory/CPU/process/fd/disk caps) are now applied
via setrlimit in a POSIX preexec_fn in _execute_code_sandboxed, instead of
only honouring the wall-clock timeout. Non-POSIX platforms log a warning.
2. Sync chat()'s managed-backend branch now applies the rate limiter and
cooperative cancellation check before delegating, matching achat().
3. _format_tools_for_litellm now imports the canonical GEMINI_INTERNAL_TOOLS
constant instead of a hand-duplicated set.
Co-authored-by: Mervin Praison <[email protected]>
The malformed-JSON cases in test_tool_call_parsing encoded the old buggy
behaviour (args -> {}), which silently ran tools with wrong arguments and
reported success. Defect 1 of #4241 replaces {} with a distinct
_TOOL_ARGUMENTS_PARSE_FAILED sentinel. Update the test to assert the
sentinel (not weaken it) so it keeps guarding that malformed args are
surfaced as retryable errors instead of dispatched.
Co-authored-by: Mervin Praison <[email protected]>
The new sanitise tests embedded realistic secret-shaped literals (Stripe
sk_live_/sk_test_ keys, an AWS-style secret value) as fixtures, which
GitGuardian flagged as hardcoded secrets and blocked CI. Construct those
fixtures by concatenation at runtime so no scannable secret literal lives
in source, while the redaction regexes are still exercised against a
matching string. No change to what the tests assert.
Co-authored-by: Mervin Praison <[email protected]>
The hard-limit check and failure-path fallback in _apply_context_management
counted only message-history tokens. A large system prompt or tool schema
could push the request over the model window while the history alone stayed
under 95%, so truncation was skipped and an over-limit request was sent.
Both paths now add system-prompt + tool-schema tokens via a new
_estimate_request_overhead_tokens helper, and the emergency target reserves
that overhead so the whole request lands near 80% of the window. Adds
regression tests covering the fallback with an oversized system prompt.
Addresses CodeRabbit and Greptile review on PR #4242.
Co-authored-by: Mervin Praison <[email protected]>
os.replace(tmp, out_path) clobbers a symlink itself, leaving its target
holding the stale corpus. Resolve the final-path symlink to its real
target before creating the temp file and replacing, so generate/dedup
update the file consumers read through the link. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Defect #1: a truncated/invalid tool-call argument string no longer executes
the tool with {} and reports success. _parse_tool_call_arguments now returns a
distinct sentinel on JSON parse failure (kept separate from {} = "no args"),
and every tool-execution site emits a retryable tool-error message instead of
dispatching. Covers sync/async, streaming, batched and Responses-API paths.
Defect #2: a temperature configured via Agent(llm={'temperature': ...}) now
actually reaches the request. Public entry points default temperature to None
and _build_completion_params resolves it from self.temperature once; chat/achat
and the internal completion helpers default to None so the configured value is
no longer overridden by a hardcoded 1.0. Unset temperature is omitted so the
provider default applies rather than sending an explicit None.
Co-authored-by: MervinPraison <[email protected]>
- eval/grader.py + judge.py: passing now requires a parsed numeric SCORE
(score_parsed), so a reasoning-only response can no longer fabricate a
passing 5.0 against a low threshold. Multi-line REASONING is captured.
- crawl4ai_tools.py: crawl_many preserves input->output positional order for
mixed safe/blocked batches instead of hoisting blocked entries to the front.
- gateway.py: _force_kill_process polls until the PID is confirmed gone before
returning True, so the PID lock is not released while a process may survive.
- test_grader.py: assert fail-closed (1.0) for an unparseable score.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on #4236:
- Route direct RuntimeConfig(runtime=...) through resolve_runtime so a
preferred_runtime typo raises instead of silently dropping capabilities.
- resolve_runtime returns a normalised copy of a RuntimeConfig instead of
mutating the caller's object.
- canonical_runtime_name passes the full alias set to the error builder so a
close typo (e.g. "reducd") suggests the matched alias.
- Rename knowledge_qdrant.py -> knowledge_chroma.py (now demonstrates Chroma)
and restore qdrant_wow.py as a genuine Qdrant adapter example that skips
cleanly, matching filenames to content.
- Add tests: no-mutation, typo suggestion, Agent-level normalisation + typo.
Co-authored-by: Mervin Praison <[email protected]>
mkstemp creates the temp file 0600 and os.replace would make that the
final mode, stripping group/other read that a plain open(..., "w") would
grant via umask and locking shared-corpus consumers out. Restore the
destination's existing mode when overwriting, else 0666 & ~umask.
Applies to both generate and dedup; adds two regression tests.
Co-authored-by: Mervin Praison <[email protected]>
- run --continue: restore chat history by position instead of a content-based
filter, so repeated turns (e.g. a bare "yes" confirmation) are no longer
silently dropped; _auto_save_last_index tracks the full restored length.
- session share / export redaction: mask sk_live_/sk_test_ Stripe keys, anchor
the key=value rule on keys that *contain* a secret word (AWS_SECRET_ACCESS_KEY,
STRIPE_SECRET_KEY), and mask secret values whole so a value containing '/' is
not half-masked by the path regex.
- session share now defaults --redact-level to strict, since it publishes a
transcript for wider distribution.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer findings on #4234 (issue #4228):
- agent.py: use `is None` (not falsiness) so an explicit empty permissions
policy (`permissions={}`) owns denial instead of inheriting default denials.
- tool_execution.py: normalize argument keys (strip trailing '=') before
build_permission_target so a malformed `command=` kwarg cannot evade a
scoped deny that only normalizes after the gate.
- tool_execution.py: re-run the deny gate against `decision.modified_args` in
both sync and async paths so an approval backend cannot rewrite allowed args
into a denied command; BYPASS still opts out.
- tests: add regression coverage for all three.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Covers the #4227 failure mode directly (member propagation, not just the
container field) per CodeRabbit review, without a live LLM call.
Co-authored-by: Mervin Praison <[email protected]>
ContextManager built one union kwargs dict and passed it to every optimizer,
but only SmartOptimizer accepted that signature. The other six raised
TypeError, which chat_mixin swallowed with a blanket except, disabling context
management entirely — including the emergency hard-limit truncation.
- get_optimizer now filters kwargs to each optimizer's constructor signature
(single choke point; fixes all six strategies without touching call sites).
- chat_mixin._apply_context_management falls back to emergency truncation on
failure instead of returning the unchanged, over-budget history.
- Add regression tests covering every strategy.
Co-authored-by: MervinPraison <[email protected]>
Four HIGH-severity silent-data-loss bugs in praisonai-train:
- train llm <dataset>: forward the path as --dataset (the option the train
branch reads) instead of a bare positional the legacy dispatcher drops,
which silently trained on yahma/alpaca-cleaned.
- generate: write to a temp file and os.replace only when rows are produced
(mirrors dedup), so an all-failures run no longer truncates an existing
corpus to zero bytes.
- Ollama export: dedent the Modelfile TEMPLATE so continuation lines sit at
column 0 and the served prompt format matches the trained one.
- agent training: a genuine agent failure now re-raises instead of being
captured as "Error: ..." output, graded as training data, and reported as
success with exit 0.
Adds regression tests for all four.
Co-authored-by: MervinPraison <[email protected]>
The scheduler monitor's total-deadline watchdog was a no-op for
Connection: close responses. http.client.getresponse() calls close()
for close-delimited replies, nulling connection.sock, so when the
watchdog fired on exactly the responses that can hang forever there was
no socket left to shut down. A page dripping one byte per socket window
stalled the whole sequential scheduler tick while holding its lease.
Retain a separate raw-socket handle the close() path does not clear and
fall back to it in _abort_connection; clear it after each probe so the
fd is not held past the (per-probe) connection.
Co-authored-by: MervinPraison <[email protected]>
- #4195: grader.py/judge.py now parse markdown-bolded labels and fail closed
(score 1.0) instead of fabricating a mid-range 5.0 that could pass a threshold
- #4192: gateway stop distinguishes PermissionError from a dead process and
keeps a live cross-uid holder's lock
- #4196: telemetry re-entrancy guard uses a ContextVar so concurrent executions
on one agent are counted independently
- #4189: crawl4ai_tools now validates every URL entry point via is_safe_http_url,
and mentions.py re-validates each redirect hop instead of only the first
Co-authored-by: MervinPraison <[email protected]>
(a) The code generator advertised a hardcoded memory capability list that
still named removed backends (redis/postgres/qdrant), so generated agent
code raised before the API. Derive supports_presets/supports_url_schemes
from the live resolver registries (MEMORY_PRESETS, MEMORY_URL_SCHEMES) so
the generator can never teach a dead value. Update the four shipped
examples that crashed at the config boundary to use shipped backends.
(b) runtime= stored any string verbatim, silently dropping nine of twelve
capabilities on a typo. Normalise through canonical_runtime_name() so
spelling variants (NATIVE, " native ", Native) all map to the native
matrix, and raise on a close typo (nativ -> "Did you mean native?").
A genuinely unknown plugin runtime name is still accepted and falls back
to the reduced harness via the runtime registry, not a closed literal.
Co-authored-by: MervinPraison <[email protected]>
(a) The ApprovalConfig and dict approval branches left _perm_deny at its
empty init value, making a config object a WEAKER posture than passing
nothing (ApprovalConfig(timeout=30) silently dropped all 8 default
denials). They now fall back to the env-driven default deny set when no
declarative permissions policy is supplied, so configuring approval never
removes the default denials. PRAISONAI_TOOL_SAFETY=off still fully bypasses.
(b) The PermissionManager deny gate only asked with the tool *name*, so
argument-level deny rules (e.g. bash:rm *) never fired. _check_permission_manager_deny
now also builds the argument-scoped target via build_permission_target and
checks it, so an argument-scoped rule can narrow an allowed shell tool.
Name-level rules keep their all-or-nothing behaviour.
Co-authored-by: MervinPraison <[email protected]>
Three closed defects still reproduced on main, each shielded by a test that
passed on the broken behaviour.
1. Agent.as_tool() returned a success string without running the sub-agent.
ContextPolicy.NONE discards history, so no prompt was ever derived. The
generated tool now advertises a `task` parameter and passes it verbatim as
the sub-agent's prompt.
2. `--type openai-compat` was refused though listed as registered. The endpoint
registry loads under both `praisonai_code.*` and the `praisonai.cli.features`
shim namespace; the relative `from ..._wrapper_bridge` resolved to the
non-existent `praisonai._wrapper_bridge` under the shim. Made it absolute.
3. `from praisonaiagents import db` (and `obs`) yielded a non-callable module,
because a real submodule shadows the package `__getattr__`. The submodules
now swap their `__class__` to a callable ModuleType subclass that proxies to
the lazy singleton, so `db(...)`/`obs(...)` and `db.PraisonDB` both work.
Tests: added a behavioural as_tool test asserting the sub-agent call, a
resolve() assertion under the shim namespace, an obs-callable test, and removed
the bug-detecting workaround from the db test so its assertion can fail without
the fix. Each new test was confirmed to fail against the unfixed tree.
Co-authored-by: MervinPraison <[email protected]>
The containers called resolve_model_alias (alias rule only) while the seven
media/specialist agents call resolve_model_name (alias rule + LLMConfig
unwrapping). AgentTeam/AgentFlow therefore pushed the raw LLMConfig into every
member via _apply_default_llm, and the member's chat() failed silently with
"'LLMConfig' object has no attribute 'lower'", returning None.
Switch both container sites to resolve_model_name and widen the regression
test's parametrize from UNWRAPPING to ALL.
Co-authored-by: MervinPraison <[email protected]>
Evict the 'Task' key from _lazy_cache before spawning threads so the
concurrent access hits the double-checked locking path in
_lazy.lazy_import instead of the unlocked cache fast path. Addresses
Greptile P2: prior test could read an already-cached attribute after
suite collection, letting concurrent first-load regressions go
undetected.
Co-authored-by: Mervin Praison <[email protected]>
Remove dead _lazy_cache_local threading.local and _get_lazy_cache()
helper from praisonaiagents/__init__.py. The runtime lazy-loader only
uses the plain _lazy_cache dict (guarded by the lock in _lazy.py);
the thread-local cache had no runtime consumer.
Repoint TestLazyCacheThreadSafety at the real lazy-loading path
(concurrent access of praisonaiagents.Task resolving to one cached
object) instead of the removed self-referential helper.
Co-authored-by: MervinPraison <[email protected]>
- AuthProfile.credential_id: stable, non-secret (hashed) identity keyed on
provider+api_key+base_url so coordinator benches track the credential, not
the local profile label. Prevents same-name collisions ("default") benching
unrelated keys and different names on the same key breaking propagation.
- mark_success: only clear the shared bench when it is not newer than the
cooldown being recovered from, so a stale in-flight success cannot clobber a
newer fleet-wide bench set by a concurrent failure.
- All three coordinator call sites now use credential_id consistently.
- Tests: add same-name-distinct-keys isolation, stale-success guard, and
own-bench clear coverage; update existing tests to key on credential_id.
Co-authored-by: Mervin Praison <[email protected]>
- state(): catch TypeError so a valid-JSON sentinel with a non-numeric `at`
(e.g. a list) still fails safe engaged instead of raising.
- engage(): commit via tempfile.mkstemp in the sentinel dir + fsync file and
parent dir, closing a predictable-tmp symlink pre-creation vector and making
an engaged brake durable across an abrupt crash; cleanup tmp on failure.
- bot GatewayServerSchema: declare `control` and `turn_lock` so the documented
`gateway.control` YAML block loads under extra="forbid".
- tests: drop hardcoded /tmp path (S108) and add structured-`at` fail-safe case.
Skipped (scope/lightweight mandate): async FileEmergencyStop variants (no live
async admission consumer yet; is_engaged is a fast local stat/read) and
agent.start() agentic tests (this PR ships the core contract + config only, no
admission wiring to exercise via the LLM).
Co-authored-by: Mervin Praison <[email protected]>
Adds a pure, dependency-free QuotaCoordinatorProtocol + QuotaCoordinatorConfig
and an in-memory LocalQuotaCoordinator in core (praisonaiagents/llm/quota.py).
FailoverManager now consults an optional coordinator so a credential benched
by any replica (429/auth/billing cooldown) is skipped by all replicas sharing
the same backend. Defaults to the local in-memory coordinator, so single-replica
/ no-backend deployments behave exactly as before with no new dependency and no
hot-path change. All coordinator calls are fail-open (never wedge failover) and
benches carry TTLs that self-expire.
Co-authored-by: MervinPraison <[email protected]>
Introduce a pure, dependency-free EmergencyStopProtocol in core gateway
plus a zero-cost NullEmergencyStop default and a durable, fail-safe
FileEmergencyStop sentinel. Wire an EmergencyStopConfig (gateway.control)
into GatewayConfig defaulting to backend "off" so behaviour is unchanged.
This is the shared contract every new-work admission seam can consult to
halt new runs while preserving in-flight ones; a corrupt/unreadable
sentinel fails safe (engaged).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
- Only genuine booleans count as a restart_safe declaration; malformed values
(e.g. the string "False") are treated as unsafe instead of coerced truthy.
- Empty tool names fail closed rather than falling through to the read-only
heuristic which returns True for "".
- Declaration lookup now compares canonicalised names so an explicit
restart_safe declaration survives execute_tool's case/separator repair.
Co-authored-by: Mervin Praison <[email protected]>
CodeRabbit: session.persist:true but a failed persistent-store init degrades
to in-memory (self._session_store is None). The old config-based default still
enabled ExecutionConfig(durable=True), journalling against no durable store.
Resolve the auto-default from the instantiated self._session_store instead;
explicit gateway.durable_runs still wins. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Add a `restart_safe` declaration to the tool contract (@tool / BaseTool /
FunctionTool) and honour it during durable resume. An in-flight tool call
(journalled tool_call with no tool_result at the crash) is now re-run only
when the tool resolves as restart-safe (explicit declaration, else the
read-only name heuristic); effectful/undeclared tools fail closed with a
typed NotSafelyResumable outcome instead of silently re-executing, removing
the duplicated-side-effect risk on crash recovery.
Co-authored-by: MervinPraison <[email protected]>
Auto-enable durable (journal-backed) gateway runs when a durable session
store is present (the default), so a restart mid-turn replays completed
model/tool steps instead of re-executing side-effecting tools or re-billing
the model. Zero-overhead escape hatches: explicit `gateway.durable_runs:
false` or `gateway.reliability: "off"`, and sessions with `persist: false`.
An explicit `durable_runs` and per-agent `durable` still win.
Co-authored-by: MervinPraison <[email protected]>
- firestore.hdel: count only fields actually present instead of len(fields)
- dynamodb.hset/hdel: migrate legacy JSON-string hashes into native map so
existing fields stay visible and legacy deletions are effective; count actual
- recipe/serve.py: drain SSE queue + stop event on consumer cancellation so the
producer worker thread unblocks instead of leaking the executor
Co-authored-by: Mervin Praison <[email protected]>
- integrations/base.py: reap the child in a finally block in execute_async
and execute_async_with_stderr so caller cancellation (CancelledError) no
longer leaks a running subprocess plus its stdout/stderr pipes.
- recipe/serve.py: route sync recipe.* calls through asyncio.to_thread and
bridge the sync run_stream generator to an asyncio.Queue on a worker
thread so a single recipe run no longer blocks the whole event loop.
- persistence/state/firestore.py: scope credentials to the client instead
of mutating process-wide os.environ, and use atomic field-level merge /
DELETE_FIELD for hset/hdel to avoid lost concurrent updates.
- persistence/state/dynamodb.py: use atomic UpdateExpression on a native
map attribute for hset/hdel to avoid non-atomic read-modify-write races.
Co-authored-by: MervinPraison <[email protected]>
- handoff.py: make seeded handoff context invocation-scoped via a
restore-on-exit context manager so target chat_history no longer leaks
across sequential/concurrent handoffs or grows unbounded (CodeRabbit/Greptile P1)
- handoff.py: exclude the exact message folded into the prompt (by index)
from seeded history instead of always dropping the final list item
- memory.py: get_context returns "" for empty/None query (no LIKE "%%"
unrestricted match) and propagates the effective user_id for user-scoped memories
- tool_execution.py: resolve explicit idempotent flag on process-global
registry tools before falling back to the shared name registries
Co-authored-by: Mervin Praison <[email protected]>
Bug #1 — retrieved memory never reached the prompt:
- build_context_for_task defaulted include_in_output to a DEBUG-only gate, so
Agent(memory=True) retrieved hits but returned "" under normal logging. Default
to True (the method's primary purpose is feeding memory into the prompt).
- Added Memory.get_context() so the non-cache path (get_memory_context) works;
previously only FileMemory had it, so hasattr(...) was always False.
Bug #2 — timed-out tool auto-retried while still running:
- future.cancel() is a no-op once a worker starts, so the tool body keeps running.
Added _is_tool_idempotent() and gated the _outer_timeout retry on it, reusing
the escalation loop_guard read-only/mutating registry plus an optional per-tool
`idempotent` flag. Mutating tools now surface the timeout once instead of
duplicating side effects.
Bug #3 — HandoffConfig context policy computed then discarded:
- _prepare_context() result was thrown away; the target only got the prompt string.
Added _seed_target_history() and threaded the filtered messages through
_execute_with_runtime_resolution(_async) for sync/async Handoff and TypedHandoff.
Co-authored-by: Mervin Praison <[email protected]>
- llm/llm.py: add response.reasoning_summary_text.delta branch to
_stream_responses_api_async so async streaming emits reasoning-summary
deltas, matching the sync path.
- _warning_patch.py: replace over-broad bare "Expected" substring with
precise "fields but got" so unrelated third-party/user warnings are no
longer swallowed process-wide.
Co-authored-by: MervinPraison <[email protected]>
Address the two P1 findings on the inbound webhook dedup durability change
(#4208):
- SQLite backend was unreachable: _get_hook_idem_store read a GatewayConfig
field that no config path populates. Capture hooks.idempotency.store_backend
in _apply_hooks_from_config (the only path that sees the raw hooks dict),
supporting both the mapping-shaped hooks.idempotency and a sibling
hooks_idempotency key, and rebuild the store on a hot-reload backend flip.
- In-flight claims survived a crash: a process exit between reserve and
record/release left a durable inflight row that deduplicated the provider's
post-restart retry for the full TTL. Add a bounded inflight lease; a stale
inflight reservation is reclaimed on reserve so the retry re-runs, while
recorded keys keep deduplicating until TTL.
Adds regression tests for config wiring (default/sqlite/sibling/hot-reload) and
crash reclaim (stale inflight reclaimed; recorded not reclaimed).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Add a core IdempotencyStoreProtocol (reserve/record/release) with a bounded
in-memory default, and a durable SQLite backend in praisonai-bot. The gateway's
inbound hook handler now delegates dedup to a swappable store selected via
hooks.idempotency.store_backend ("memory" default; "sqlite" for restart/
multi-replica durability), so a provider redelivery after a restart no longer
starts a duplicate agent run. Mirrors the existing ingress-journal/outbound-
queue durability.
Co-authored-by: MervinPraison <[email protected]>
Register MODEL_FALLBACK_STREAM, RETRY_STREAM, TODO_STREAM, and
TOOL_RESULT_STREAM in the streaming capability handshake and the
session-history allowlist so clients can discover these events and
so they receive a cursor for reconnect/resume replay (fixes gap
flagged by CodeRabbit/Greptile reviews on #4206).
Co-authored-by: Mervin Praison <[email protected]>
The WebSocket gateway relay dropped four StreamEventTypes the SDK already
emits (MODEL_FALLBACK, RETRY, TODO_UPDATED, TOOL_CALL_RESULT), causing live
clients to see an unexplained token-stream stall during fallback/backoff.
- Add additive EventType members (MODEL_FALLBACK_STREAM, RETRY_STREAM,
TODO_STREAM, TOOL_RESULT_STREAM) to gateway protocol enum
- Map the four events through the existing cross-thread relay send path,
carrying their existing metadata untouched
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The smoke job installs praisonai-mcp==0.0.15 as editable, but the wrapper's
`praisonai-mcp>=0.1.0` constraint then made pip fetch the stale PyPI wheel
praisonai_mcp-0.1.1 (no `cli` submodule), clobbering the editable install and
breaking `praisonai_mcp.cli` (test_mcp_list). Bumping the local package to
0.1.2 satisfies the constraint so the editable install is retained.
Co-authored-by: Mervin Praison <[email protected]>
- schedules_runner: pass timeout=None to run_sync_or_offload so long
scheduled agent/command runs are not cancelled by the bridge's default
300s timeout after ScheduleLoop has already claimed the occurrence
(would silently drop one-shot / long-interval work). Restores the prior
unbounded asyncio.run(...) behaviour. (Greptile P1)
- security/audit: close the file handle best-effort in the rotation
OSError branch before dropping the reference, so an fstat/close failure
cannot leak the descriptor. (Greptile P2)
Co-authored-by: Mervin Praison <[email protected]>
- scheduler on_trigger now uses run_sync_or_offload instead of asyncio.run,
so scheduled ticks share the async bridge / per-loop connection pools
- AuditLogHook reopens its handle when the log path is rotated (mv/rm),
preventing silent loss of audit records after logrotate
- LazyCache memoises every terminal loader failure (not just ImportError),
while letting KeyboardInterrupt/SystemExit propagate, avoiding hot-path
cache stampedes on broken optional deps
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer P1 findings on the Memory batch-commit path:
- Deadlock: commit_memory_batch no longer holds the non-reentrant
_write_lock while calling store_short_term/store_long_term (which
reacquire it). Writes now dispatch outside the lock.
- Atomicity/cancellation: both sync and async batch commits route each
write through _AtomicCommitGuard.commit(deadline=...) so cancelled or
past-deadline facts are skipped; acommit offloads blocking stores via
asyncio.to_thread instead of blocking the event loop.
- Path traversal: default sqlite/chroma store paths derive a
filesystem-safe suffix from user_id, rejecting separators/parent refs
and sanitizing other characters (bare stores keep legacy defaults).
Co-authored-by: Mervin Praison <[email protected]>
- Thread the per-agent mem_user_id into every Memory(...) construction path in
agent.py (string and dict forms) via config.setdefault, and scope the default
sqlite/chroma paths and collection_name by user_id in Memory so two agents in
one process no longer silently share one store. Bare stores keep legacy
defaults for backward compatibility.
- Add commit_memory_batch/acommit_memory_batch to the Memory class so the
pre-compaction fact flush durably commits extracted facts for
sqlite/chroma/mongodb/mem0 instead of raising and being swallowed.
- Propagate a nested on_error="stop" stop signal out of Parallel: _execute_parallel
now returns a stop flag, the nested dispatcher forwards it, and the top-level
loop halts like Route/Loop/Repeat/If. Keep parallel_outputs index-aligned with
the branch list on partial_ok failures.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: MervinPraison <[email protected]>
The URL monitor's response.read() bounded bytes and per-socket waits but
had no total deadline, so a slow drip-feed endpoint could keep the
synchronous read alive within each socket window and stall the sequential
scheduler tick, delaying other due jobs. Read the body in bounded chunks
and check an absolute deadline between reads so a slow response fails the
probe at the monitor timeout instead of blocking progress.
Co-authored-by: Mervin Praison <[email protected]>
The existing collision guard only ensured no two keys collapse to the same
canonical form. It did not catch a single non-canonical key (e.g. 'full-auto'),
which validation would accept but the direct dict.get(canonical_preset_key(...))
lookup would miss, silently falling back to the disabled default. Add an
invariant test enforcing key == canonical_preset_key(key) for all four
resolver preset dicts. (addresses Greptile review)
Co-authored-by: Mervin Praison <[email protected]>
Validation normalised strip().lower().replace('-','_') while the four
resolvers did a raw dict .get(), so blessed spellings like
autonomy='full-auto' or context='sliding-window' were accepted then
silently ran with the feature off.
Add canonical_preset_key() in parse_utils and route both the validator
and the context/autonomy/output/execution resolvers through it. Replace
the vacuous test_normalized_preset_accepted assertion with the
resolution checks its own comment described.
Co-authored-by: MervinPraison <[email protected]>
_maybe_deliver_failure only recorded the negative outcome, leaving
JobResult.delivered False even when the failure summary was delivered
successfully — so monitoring reported a delivered notification as
undelivered (Greptile P1 on PR #4198). Set result.delivered = True on
the success branch and add regression tests for both the delivered and
failed failure-summary paths.
Co-authored-by: Mervin Praison <[email protected]>
_deliver_scheduled_result returned None on every path, so the executor
treated 'the handler did not raise' as success — a routing failure was
recorded delivered=True with delivery_error=None next to a logged
'Failed to deliver'. Return a bool from the gateway handler, propagate it
through _dispatch_delivery, and key delivered/delivery_error off it at the
three executor call sites plus the failure-summary path.
Co-authored-by: MervinPraison <[email protected]>
Snapshot and restore the pre-existing module entry in the vendored-fallback
import helper so the forced standalone re-import cannot leak the fallback
PluginRegistry into later tests expecting the bridged canonical class.
Addresses CodeRabbit review on #4184.
Co-authored-by: Mervin Praison <[email protected]>
vendored fallback copies used when praisonai-sandbox / praisonai-deploy are
installed standalone did not get it. Apply the same guard so an installed
distribution can never replace a built-in loader via entry-point discovery.
Add a class-parametrised test that forces the standalone fallback import path,
proving each vendored copy is protected (the previous test only exercised the
canonical class through varied group-name strings).
Co-authored-by: MervinPraison <[email protected]>
EndpointProviderRegistry.default() caches a per-class singleton whose
entry-point discovery runs once at construction. cmd_invoke resolves
providers through that cache, so under the CI root shard (-n 2 --dist
loadfile) a singleton built by an earlier test on the same worker — before
this file publishes the `acme` plugin — never sees it, and invoke falls back
to the recipe HTTP path (assert http == [] => assert 2 == 0). Evict the
cached singletons in the `published` fixture before and after each case so
the plugin is rediscovered and no poisoned instance leaks forward.
Test-only change in the praisonai wrapper; no production or praisonai-agents
code touched. Strengthens isolation rather than weakening any assertion.
Co-authored-by: Mervin Praison <[email protected]>
Wrapping only chat() dropped all execution telemetry for start(stream=True)
(-> _start_stream) and backend-backed run()/start() (-> _delegate_to_backend),
neither of which funnels through chat(). Re-instrument run/start/chat behind a
per-agent re-entrancy flag so the outermost call records exactly one execution,
preserving single-count for run()->chat() while covering stream/backend paths.
Co-authored-by: Mervin Praison <[email protected]>
The full-suite CI failure (`assert 2 == 0`, "Unknown provider type: acme")
was a test-isolation bug: the CLI handler's cmd_invoke resolves
EndpointProviderRegistry via the `praisonai.cli.features._endpoint_registry`
shim namespace, a distinct class object from the `praisonai_code...` one the
test imports. Their default() singletons are cached independently, so an
earlier full-suite test that warmed the handler's cache left it stale and the
monkeypatched entry points never reached it. Reset the cached _default_instance
on both class objects so discovery re-runs under the patched entry points.
Unrelated to PR #4187's session-docs changes; fixes the pre-existing flake.
Co-authored-by: Mervin Praison <[email protected]>
- token_collector: total_tokens no longer double-counts cached/reasoning/audio
tokens (they are subsets of input/output, not additional buckets)
- cost_utils: replace loose substring matching with longest-key exact/prefix
match so gpt-4o-mini is no longer billed at gpt-4o rates (16.7x); strip
provider prefixes; exclude "default" from matching
- performance_monitor: consult shared telemetry state live so a later
disable_telemetry() actually stops the import-time global monitor
- telemetry.__init__: atexit handler no longer resurrects a shut-down/opted-out
telemetry instance at interpreter exit
- integration: instrument only chat()/execute_tool(); run()/start() delegate to
chat() so wrapping them double-counted executions and errors
- telemetry.flush: only zero counters after a successful send
Co-authored-by: MervinPraison <[email protected]>
- _execute_loop/route/repeat/if now return a `stop` flag so a nested
on_error="stop" step halts the enclosing workflow instead of only its
own pattern iteration. Both nested dispatch and top-level _run_impl
honor the propagated signal.
- Parallel fail_fast/fail_all no longer `raise ... from <str>` (which
raised TypeError and masked the real failure); the string branch error
is preserved in WorkflowStepError.errors and only real exceptions chain.
- Added regression tests: nested-stop halts outer workflow, and parallel
fail_fast reports failed without TypeError.
Co-authored-by: Mervin Praison <[email protected]>
Parse safety judge responses tolerantly (markdown bolding, bullets, case)
and fail closed when nothing usable is parsed. Previously a bolded field
label - the default output style of most models - matched nothing and the
verdict silently fell through to 10.0/10 SAFE, even on a detected severe
violation. An unparsed verdict is now treated as UNSAFE (1.0), matching the
existing exception handler in evaluate_safety.
Co-authored-by: MervinPraison <[email protected]>
- _is_process_running: treat PermissionError as running so a gateway owned
by another uid is not reported dead and its lock deleted, admitting a
second poller for the same bot token.
- Record a create_time fingerprint in the lock so a recycled PID cannot be
mistaken for the original gateway; verified before stop/refuse decisions.
- check_port_available: use net_connections with a connections() fallback and
a broad except so the port-collision diagnostic works on psutil 7 instead
of raising 'invalid attr name connections'.
Co-authored-by: MervinPraison <[email protected]>
Previously is_safe_http_url returned True for any allowlisted hostname before
resolving/classifying its addresses, so SEARXNG_URL_ALLOWLIST=169.254.169.254
could reach the cloud metadata endpoint. Now every address is classified and an
allowlisted host only bypasses the loopback class; private, link-local,
multicast and unspecified addresses stay blocked. Docstring corrected to match.
Co-authored-by: Mervin Praison <[email protected]>
Nested patterns (loop/parallel/when/route/repeat/if) routed failing steps
through _apply_step_policies, which folded f"Error: {e}" into the step output
and never consulted on_error. Wrapping a pipeline in any pattern therefore lost
failure detection: the run reported status="completed" and the next step
consumed the exception text as input.
_apply_step_policies now returns (output, step_error) instead of folding the
error into output. _execute_single_step_internal applies the same
on_error/status logic the top-level _run_impl already uses: it marks the run
failed, signals a stop when on_error="stop", and never hands the exception text
forward. Pattern executors honor the stop signal, and Parallel on_failure modes
fire again since the branch failure is now surfaced.
Co-authored-by: MervinPraison <[email protected]>
The shared is_safe_http_url unconditionally allowlisted loopback and
consulted it before the IP-class checks, re-opening web_crawl to
127.0.0.1/localhost/::1. Split the allowlist into an explicit per-caller
opt-in consulted after the IP checks. validate_searxng_url opts into
loopback (SearXNG is self-hosted); the crawler passes none.
Co-authored-by: MervinPraison <[email protected]>
The restored TOP_LEVEL_KWARG regex only balanced one level of parens, so
a top-level rejected kwarg after a two-level nested call
(Agent(memory=MemoryConfig(db=db(...)), session_id=...)) escaped the guard,
re-opening the #4178 regression (greptile). Replace the regex with a
depth-aware scanner that attributes each kwarg to its enclosing call at any
nesting depth, and skips string literals and comments so dict keys
(memory={"session_id": ...}) and comments (# session_id = resume) are not
false positives. Add regression tests for the nested-call, dict-key, comment
and prose cases.
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile's P2 finding on this PR plus one gap found reviewing the
diff independently.
- pattern-d-platform.md: the note added in the previous commit corrected the
platform agent roster path, but line 25 still listed it as /api/v1/agents,
which the same note defines as the unrelated endpoint served by
`praisonai serve agents`. A reader following the numbered list would have
integrated against the wrong service. Also softened "Three registries may
coexist" — a full install has more than three; the three listed are the ones
relevant to agent_id correlation.
- auth/__init__.py: the module docstring said implementations "live in the
platform package" without saying where that is, which is now ambiguous since
the package left this repository. Points at the separate repo and, more
usefully, states first that you can implement the protocols against your own
store. This matches the change made to protocols.py in the previous commit.
src/praisonai-agents/tests/unit/auth/ passes (33 tests).
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_014ZfTXTzdudKb4oswNSHpHw
praisonai-platform is extracted to MervinPraison/PraisonAI-Platform, with full
history carried over via git filter-repo.
Why it belongs outside this repo:
- Nothing here imports it. A grep for praisonai_platform across every .py
outside its own directory returns no hits, and no pyproject declares it.
- It is in no CI job. No workflow under .github/ references it — it is absent
from install-monorepo-packages and from pypi-release.yml, which enumerates the
nine tiered packages and notes it is near GitHub's 25-input cap.
- It is absent from ARCHITECTURE.md, which describes a nine-package tiered
model; the platform was a tenth, untiered package with no boundary manifest.
- Separate-repo is the ecosystem norm: PraisonAI-Tools, PraisonAI-Plugins,
PraisonAIUI and Agent-Recipes all live outside and consume praisonaiagents as
a plain versioned PyPI dependency. The platform already did exactly that, and
already carried its own uv.lock.
- Its releases were already documented as an independent semver line.
Changes here:
- Remove src/praisonai-platform/ (9,263 lines).
- SECURITY.md: drop the platform row from supported packages and point
vulnerability reports at the new repository's advisories.
- security-audit.md: the platform is no longer triaged, released or audited
from this runbook. Removes publish steps 13 and 15 and the two table rows so
an agent executing it cannot cd into a directory that no longer exists.
- auth/protocols.py: WorkspaceContextProtocol's example named
PlatformWorkspaceContext, a class no longer in this tree. Renamed to a
generic example and noted where the reference implementation lives. Core
keeps the protocol with no in-tree implementation, which is the documented
design — auth/__init__.py already states that implementations live in the
platform package, and the core tests use local mocks.
- pattern-d-platform.md: kept, since it documents an integration contract
rather than platform internals. Adds a pointer to the new repo and corrects
the agent roster path, which is /api/v1/workspaces/{id}/agents — /api/v1/agents
is a different endpoint served by `praisonai serve agents`.
src/praisonai-agents/tests/unit/auth/ passes (33 tests).
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_014ZfTXTzdudKb4oswNSHpHw
PR #4179 replaced the textual kwarg guard with an executing one but the
executor is blind to session/__init__.py (documented via an indented
docstring, zero python fences) and to README blocks excluded by
_is_self_contained. The surviving text check only covered _EXAMPLE_FILES,
so the original #4178 bug (a top-level Agent(session_id=...)) could be
reintroduced with the suite green.
- Restore test_docs_do_not_pass_rejected_kwargs_to_agent, widened to cover
DOCS as well as _EXAMPLE_FILES. TOP_LEVEL_KWARG matches only inside
Agent(, so prose mentioning session_id= is not a false positive.
- Add test proving an executor-only guard is blind to a fenceless file.
- Fix session README "Using with DB Adapter" block: import the callable
via `from praisonaiagents.db import db` instead of `from praisonaiagents
import db`, which yields the non-callable module and raised
TypeError: 'module' object is not callable whenever the wrapper was
importable (README.md#3 was green only via importorskip).
Co-authored-by: MervinPraison <[email protected]>
The deprecated entry-point group bypassed #4171's built-in guard because
_discover_legacy_entry_points ran first and called _add_loader
unconditionally. A plugin published under the legacy spelling could thus
replace a built-in, contradicting the docstring. Apply the same built-in
guard to the legacy path.
Co-authored-by: MervinPraison <[email protected]>
One helper resolves the llm=/model= pair everywhere: model= is canonical,
llm= is a deprecated alias, passing both raises TypeError, and LLMConfig is
unwrapped for classes that store a bare model name. Adds model= to CodeAgent,
RealtimeAgent, AgentTeam and AgentFlow.
Co-authored-by: MervinPraison <[email protected]>
The main (3.11) job dropped the plugin `aider` across every registry-backed
surface (fixture tests + entry-point discovery test). The base guard and
production code are correct; the failure is a test-isolation issue that only
surfaces under `pytest -n --dist loadfile` + coverage on CI:
- The entry-point discovery test patched `praisonai_code._registry.entry_points`
by dotted string. Under editable-install + coverage import tracing a
re-imported copy of that module can differ from the one the
`ExternalAgentRegistry` class actually discovers through, leaving the real
path unpatched and silently dropping `aider`. Patch `entry_points` on the
exact base module the class resolves via `__mro__`, and accept `group`
positionally or by keyword.
- The `registered_plugin` fixture now also clears and restores the per-class
`PluginRegistry.default()` cache so no sibling test file sharing the xdist
worker can shadow the registered plugin.
No assertions weakened: built-ins still win over colliding entry points,
plugins can still add new names, and every surface must still agree.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two blind spots greptile flagged in the executing session-doc guard:
- ImportError from our own packages (praisonaiagents/praisonai) now re-raises
instead of being swallowed by the optional-dependency skip, so a doc that
advertises a renamed/removed symbol fails the guard. Optional third-party
deps still skip.
- Blocks dropped by the self-contained filter are now asserted against a known
set of documentation idioms, so a typo/omitted import in an otherwise-complete
example fails a diagnostic test rather than vanishing from execution.
Co-authored-by: Mervin Praison <[email protected]>
The #4127 guard regexed the docs for four hard-coded kwarg names, so
renaming the fixed example's session_id= to sessionid= left it green while
the documented MemoryConfig call raised. Replace the text match with a
primary guard that extracts every ```python fence, keeps the AST
self-contained ones (used - bound - builtins == set()), and execs them with
Agent.start/chat stubbed and PRAISONAI_HOME isolated. It now fails on the
sessionid= reproduction with the exact TypeError, and catches the next
mistake too. Non-hermetic examples opt out via <!-- praisonai: skip=true -->
and wrapper-backed db examples are skipped when praisonai is absent.
Co-authored-by: MervinPraison <[email protected]>
The entry-point shadowing guard is added inside praisonai-code 0.0.64, but the
wrapper floor was praisonai-code>=0.0.64 — the same version number that shipped
without the guard. A pre-fix 0.0.64 install would satisfy >=0.0.64 yet lack the
protection, restoring the shadowing path once the wrapper's local guard was
removed. Bump praisonai-code to 0.0.65 and raise the wrapper floor so the
dependency constraint actually guarantees the fix is present.
Co-authored-by: Mervin Praison <[email protected]>
Add deterministic tests exercising the public execute_tool_async path
(not just the impl) to close the coverage gap CodeRabbit flagged:
- a tool-owned `retryable` field does not drive the async retry loop
(body runs exactly once, field preserved)
- the private `_praison_retryable` control key is not visible on the
async surfaced result
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Extract the tool function name before json.loads so callers (streaming
verbose warning, deferred-media path) report the actual tool name instead
of 'unknown function' on malformed arguments.
Co-authored-by: Mervin Praison <[email protected]>
Relocate praisonaiagents/runtime/example_harness.py (365-line, unreferenced
demonstration module) to examples/runtime/example_harness.py so it no longer
ships in the installed praisonaiagents wheel. Convert its relative imports to
absolute and correct the pre-existing broken TurnRuntimeProtocol import
(runtime.protocols, not runtime.turn_context) so the example runs standalone.
Update the AGENTS.md path reference. No public API or runtime module changes.
Co-authored-by: MervinPraison <[email protected]>
The primary --external-agent execution path (get_integration/execute) called
_catalog() which discarded the too-old-wrapper diagnostic and returned an empty
catalog, producing a misleading "Unknown integration" error on a version-skewed
install (Greptile P1). Add _require_catalog() that raises the upgrade guidance on
the execution path while listing surfaces (help/argparse/UI) keep degrading
quietly. execute() now catches RuntimeError to print the guidance cleanly.
Also fix test hygiene: restore the process-global root logger handlers via
monkeypatch instead of permanently clearing them (CodeRabbit).
Co-authored-by: Mervin Praison <[email protected]>
#4158 patched only ExternalAgentRegistry. The real hole was in the base
PluginRegistry: builtins are registered first and entry points second, so any
installed distribution declaring a built-in name silently replaced it across
all ten registries (openai, docker, aws, ...). Those loaders decide where user
code runs.
Record built-in names once and skip colliding entry points during discovery,
matching the existing BotPlatformRegistry precedent (DEBUG, not WARNING, since
packages legitimately re-declare their own builtins). Runtime register() still
overrides -- deliberate dependency injection. The now-redundant re-assertion in
ExternalAgentRegistry is removed.
Co-authored-by: MervinPraison <[email protected]>
Extract a private _extract_tool_call_name_and_args helper and reuse it in
the non-streaming, streaming, and deferred-media tool-calling paths. Each
call site keeps its own failure handling (tool-role reply vs. yield), so
behaviour is unchanged.
Co-authored-by: MervinPraison <[email protected]>
The retry machinery tagged its own verdict with an un-namespaced `retryable`
key, so a tool whose result legitimately contained `retryable` (common for
HTTP-API wrappers) had its body re-executed up to 3x and the internal verdict
leaked to the model. The sync outer loop separately escalated any returned
error dict of an uncovered type to retryable, re-running the tool body for a
decision it had already made.
- Rename the framework verdict to the private `_praison_retryable` key in the
async impl (exception + timeout branches) and the sync `_execute_tool_impl`
exception flatten, matching the `_outer_timeout` convention from #4133.
- Read and strip `_praison_retryable` in both retry loops so it never reaches
the model and cannot collide with a tool's own `retryable` field.
- Sync outer loop escalates only framework-produced transients
(`_outer_timeout`, `circuit_open`, or a flattened raised exception via
`_praison_retryable`, and only when the type is not already re-driven by the
inner loop). A plain returned error dict now runs exactly once.
- Update existing parity tests to the new key and add regression tests proving
a tool's own `retryable` field does not drive the loop and the verdict is not
visible to the model.
Co-authored-by: MervinPraison <[email protected]>
- list_external_agents() now derives from external_agent_catalog() so argparse
--help choices can never advertise a plugin the handler then rejects
- registry uses a module logger instead of the root logger (no basicConfig on
the embedding application)
- praisonai-code distinguishes an absent wrapper from a too-old wrapper: a
mixed-version install now reports "too old" instead of a silent empty catalog
Co-authored-by: MervinPraison <[email protected]>
The prefix filter in _mistyped_command_suggestions spared both extensions
(``tests`` for ``test``) and truncations (``deplo`` for ``deploy``) of a
command. Truncations are typos: sparing them forwarded the word to ``run``
and billed a mistaken LLM call per invocation. Drop the truncation half so
only extensions — plausible prompts — stay untouched.
Co-authored-by: MervinPraison <[email protected]>
After the bounded verify loop exhausts, nothing was persisted, so returning
True made the caller's 'history was lost' branch unreachable and printed a
misleading 'raced with a concurrent writer' warning. Return False and log the
real failure so the caller's existing warning fires.
Co-authored-by: MervinPraison <[email protected]>
If _EXAMPLE_ROOTS is renamed/moved the guard silently emitted no
parametrized cases, letting the Agent(session_id=)/db= regression it
protects against slip back in. Raise a clear collection error instead.
Co-authored-by: Mervin Praison <[email protected]>
Passing limit=None to migrate legacy transcripts (fixing #4160) turned an
already per-agent full-scan into a full-disk scan on every save: the save
loop over N agents re-enumerated every stored session N times, even once
migrated. Cache the scan result per Session keyed on the opt-in flag, since
legacy records are a frozen migration artefact never mutated by save or
restore. Addresses the P2 hot-path regression raised in PR review.
Co-authored-by: Mervin Praison <[email protected]>
Replace the fictional PostgresAdapter import in session/README.md with the
real db(database_url=...) shortcut under MemoryConfig, and move the top-level
db=/session_id= Agent kwargs into MemoryConfig across the db package
docstrings and the runnable redis example. Also align the session_dir default
path in the API reference (~/.praisonai/sessions).
Extend the doc-example guard to discover all Agent( examples under the db
package and examples/persistence, and assert none reference a class we do not
ship, closing the gap the previous two-file textual guard left open.
Co-authored-by: MervinPraison <[email protected]>
_legacy_agent_histories called list_sessions() with no argument, inheriting
its default limit=50 (sorted by updated_at desc). A legacy per-agent record is
by definition older than anything written after the upgrade, so any user who
touched 50 sessions since upgrading had their tagged sub-agent transcript
silently skipped on restore. Pass limit=None (with a TypeError fallback for
stores whose limit is not optional) so migration scans every stored session.
Co-authored-by: MervinPraison <[email protected]>
Re-assert built-in loaders after entry-point discovery so a third-party
distribution publishing a built-in name (e.g. "claude") can no longer
silently replace the shipped ClaudeCodeIntegration. Plugins may still add
new external agents. Adds a regression test.
Co-authored-by: MervinPraison <[email protected]>
- praisonai-code endpoint registry loaded openai-compat via a static
`from praisonai.endpoints...` import, tripping the C7 hot-path import gate
(smoke CI). Route it through the sanctioned _wrapper_bridge dynamic import so
the standalone package no longer statically imports the wrapper.
- Provider adapter routed --stream through invoke(stream=True), whose terminal
InvokeResult the CLI cannot render (Greptile P1). Consume
BaseProvider.invoke_stream() instead and print SSE-shaped events.
- Add a streaming test asserting --stream drives invoke_stream, not invoke.
Co-authored-by: Mervin Praison <[email protected]>
- praisonai-code external_agents handler now resolves the registry catalog
through _wrapper_bridge.optional_wrapper_attr instead of a direct
``from praisonai.integrations.registry import ...`` reverse import. This
restores the C7/C8 import boundary (the smoke `check_c7_imports.sh` gate)
and degrades to an empty catalog when the wrapper is absent so the handler
stays usable on a standalone praisonai-code install.
- external_agent_catalog() now skips any external agent whose entry point
raises a non-ValueError during load (Greptile P1), so one broken optional
plugin can no longer blank the catalog for argparse/CLI/UI surfaces.
Co-authored-by: MervinPraison <[email protected]>
Resolves two Greptile P1 issues on PR #4155:
- validate command accessed provider.value which crashes when the
provider is a registry plugin string; now handles both enum and str.
- sample YAML generation fell through to a hardcoded aws block for
plugin providers; now emits the requested provider name.
Co-authored-by: Mervin Praison <[email protected]>
_apply_default_llm reset _llm_instance but left the chat-mixin
_unified_dispatcher cached against the old model, so a used agent (team
default applied post-execution, or an AgentFlow re-run with a new llm)
kept calling the previous model. Drop the dispatcher too; add regression
tests for used and pinned agents.
Co-authored-by: MervinPraison <[email protected]>
Address the two P1 review findings on the retry consolidation:
- N² attempts: the outer loop re-escalated timeout/circuit_open results as
retryable even though the inner circuit-breaker loop already retries those
error types to exhaustion, restarting the whole inner budget on every outer
pass (up to max_attempts^2 tool-body runs on a persistently-timing-out MCP
tool). Route every error dict through one guard: only escalate error types
the inner loop does NOT retry. A genuine outer wall-clock timeout is tagged
(_outer_timeout) so it still earns its single outer retry pass.
- Backoff parity: translating ExecutionConfig into a RetryPolicy silently
dropped the delay cap from BackoffPolicy's 60s to RetryPolicy's 30s. Lift the
translated max_delay_ms back to 60s so existing ExecutionConfig users keep the
same delay ceiling.
Adds 5 tests: inner-retried timeout capped at max_attempts (not N^2),
non-inner-retried errors still get outer passes, and the 60s cap is preserved.
Co-authored-by: Mervin Praison <[email protected]>
Both endpoint-provider readers now scan the canonical
`praisonai.endpoint_providers` group, with `praisonai.endpoints.providers`
honoured as a deprecated alias (DeprecationWarning). Registers the orphaned
`openai-compat` provider, adapts BaseProvider subclasses into the CLI dispatch
shape, re-asserts CLI builtins so a plugin cannot hijack a shipped type, and
replaces the silent `_invoke_recipe` fallback for unknown `--type` with a
validation error. Declares the group in pyproject.toml and documents it.
Co-authored-by: MervinPraison <[email protected]>
Collapse the four hand-written copies of the external-agent list into a
single source of truth in the registry. Adds list_external_agents() and
external_agent_catalog() to praisonai.integrations.registry; the argparse
--external-agent choices, the praisonai_code CLI handler INTEGRATIONS, and
the UI EXTERNAL_AGENTS toggles now all read the registry. Presentation
metadata (display_label, install_hint) moves onto the integration classes.
Backward-compatible: INTEGRATIONS and EXTERNAL_AGENTS stay Mappings
supporting in / iteration / []. Built-in order and labels are unchanged on
a default install.
Co-authored-by: MervinPraison <[email protected]>
The CloudProvider enum could not be extended at runtime, so plugin
providers discovered/resolved via the praisonai.deploy.providers
entry-point group were rejected by validation. Widen CloudConfig.provider
to Union[CloudProvider, str] with a mode="before" validator that consults
the registry via coerce_cloud_provider. Built-ins keep enum identity and
byte-identical serialisation; plugins validate as normalised lowercase names.
Co-authored-by: MervinPraison <[email protected]>
The broad async exception handler flattened every raised exception into an
error dict with retryable = not isinstance(e, (ValueError, TypeError,
AttributeError)). A ToolExecutionError(is_retryable=False) is none of those,
so it was silently marked retryable=True and re-run up to max_attempts,
diverging from the sync path (tool_execution.py) which preserves an existing
ToolExecutionError's explicit verdict. Now the async path honours
e.is_retryable for ToolExecutionError and only applies the programming-error
rule to other exceptions.
Adds tests for terminal and retryable ToolExecutionError parity.
Co-authored-by: Mervin Praison <[email protected]>
IntegrationRegistry.__init__ reassigned self._loaders = {} right after
super().__init__() populated it from the entry-point group, discarding
every discovered third-party plugin. Remove the reassignment (builtins are
registered afterwards and still win on name clashes) and document the
entry-point group.
Co-authored-by: MervinPraison <[email protected]>
Presence of the vector_store.provider key (not its truthiness) now marks an
explicit choice, so an explicitly empty ("") or null (None) provider surfaces
the preset error instead of silently degrading to Mem0. Adds parametrized
regression coverage for both falsey values.
Co-authored-by: Mervin Praison <[email protected]>
The as_tool() Handoff conversion in _process_handoffs produces a closure
bound to the source agent (its chat_history/tools/memory). clone_for_channel()
shallow-copied that closure verbatim, so a channel clone would delegate using
the ORIGINAL agent's state, leaking one channel's context into another.
Tag the generated closure with its source Handoff and, during cloning, swap it
back so the clone's own _process_handoffs rebinds it to the clone -- mirroring
the existing _praison_sandbox_tool drop-and-regenerate pattern. Adds a clone
regression test asserting the clone's converted tool is bound to the clone, not
the origin.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
to_knowledge_config() emitted reranker.config.model without a provider.
mem0's RerankerConfig requires a provider and Knowledge._prepare_mem0_config
strips all but provider/config, so a provider-less rerank_model was silently
dropped. Derive the provider from a "provider/model" prefix (falling back to
the model string) so the requested reranker is instantiated.
Co-authored-by: Mervin Praison <[email protected]>
AgentTeam stored self.llm and nothing read it, so members silently kept
gpt-4o-mini. AgentFlow(llm=) only reached agents it built itself, never a
ready-made Agent step. Add Agent._apply_default_llm to adopt a container
default as a fill-in (agents that named their own model keep it), and call
it from both containers.
Co-authored-by: MervinPraison <[email protected]>
Agent(auth="claude-code") was silently billed to the API key because auth=
was dropped on the commonest construction branch (bare model name / no model)
and self.auth was never assigned, so clone_for_channel() always lost it.
- Land auth on the final else branch: bare-name + auth= now builds an LLM
instance that injects the resolved OAuth credentials.
- Assign self.auth so clone_for_channel() forwards it.
- Resolve the subscription provider eagerly at construction so an unknown or
unusable provider raises instead of silently downgrading to API-key billing.
- Default the model to the auth provider's vendor when no model is given.
- Inject subscription credentials in _build_responses_params too, mirroring
_build_completion_params.
- Add regression tests and wire the subscription-auth smoke tests into CI.
Co-authored-by: MervinPraison <[email protected]>
as_tool() returns a Handoff, and its own docstring passes the result into
tools=[...]. But tools= stores objects verbatim and only handoffs= ran
to_tool_function(), so an unconverted Handoff was invisible to both the LLM
tool schema and execute_tool(). Convert Handoff entries found in self.tools
inside _process_handoffs, the first point where the parent agent that
to_tool_function() needs actually exists.
Co-authored-by: MervinPraison <[email protected]>
MemoryConfig declared backends (redis/valkey/postgres) that had no adapter,
so requests were silently redirected to a local SQLite/JSON store, and
"sqlite" was overloaded (Agent built ChromaDB while Memory built SQLite).
- MemoryBackend enum now mirrors the registry (file + registered adapters)
- Unimplemented backends raise a clear error instead of substituting
- "sqlite" now builds SQLite on both Agent and Memory (no rag rewrite)
- Memory provider with no adapter fails loudly; deliberate fallbacks warn
- Drop redis/postgres presets and URL schemes that dropped host/credentials
- register_memory_adapter() remains the escape hatch for custom backends
Co-authored-by: MervinPraison <[email protected]>
Eight of KnowledgeConfig's ten fields never reached the internal config:
chunk_size, chunk_overlap, chunking_strategy, chunker, vector_store,
auto_retrieve, rerank_model and retrieval_threshold were read then dropped.
Also config={...} replaced the whole resolved dict, silently resetting
retrieval_k.
- agent.py: forward every declared field with the keys RetrievalConfig
reads (min_score, not threshold); config= now overrides instead of
replacing.
- feature_configs.py: ChunkingStrategy gains TOKEN/RECURSIVE, FIXED/PARAGRAPH
kept as aliases; declared chunking defaults aligned to the effective ones.
- chunking.py: normalize_chunker_type maps strategy names to real chunkers.
- knowledge.py: chunker reads from config instead of hardcoding recursive/512/50.
- retrieval_config.py: add rerank_model + chunking fields, round-trip them,
and emit a chunker block from to_knowledge_config.
Defaults unchanged so existing users are unaffected on upgrade.
Co-authored-by: MervinPraison <[email protected]>
ToolConfig(retry_policy=RetryPolicy(max_attempts=N)) now caps how many
times a tool body runs. Previously two nested loops consumed two
independent vocabularies (RetryPolicy vs ExecutionConfig) in different
units, so max_attempts was silently overridden by max_retry_limit,
running non-idempotent tools more times than configured.
The effective RetryPolicy is now the single budget; ExecutionConfig's
retries/seconds/fraction spelling is translated into it in one place
(_effective_tool_retry_policy). No behaviour change for users who do not
set retry_policy=.
Co-authored-by: MervinPraison <[email protected]>
An all-or-nothing all(isinstance(t, str)) gate silently left every
tool-name string unresolved as soon as one callable was present, so
tools=[my_tool, 'read_file'] dropped 'read_file'. Resolve per element
via a new resolve_tools_list() helper that passes non-strings through
untouched and reports/strict-checks unknown names exactly as the
all-strings path already does.
Co-authored-by: MervinPraison <[email protected]>
execute_tool_async caught a raised tool exception and returned an untyped
error dict; the caller re-classified it as "unknown", which no default
RetryPolicy.retry_on contains, so async always ran a failing tool exactly
once. Carry the retry verdict across the flattening (same rule as the sync
path: programming errors terminal, everything else retryable) and honour it
in the retry loop.
Co-authored-by: MervinPraison <[email protected]>
Knowledge.memory used provider_mapping.get(provider, "mem0"), silently
substituting Mem0 for any provider outside a hardcoded four-name list —
discarding every adapter registered via register_knowledge_adapter() and
swallowing typos. Match memory.py: keep the table for genuine legacy
aliases and pass everything else to the registry, raising a helpful
make_preset_error when an explicit provider is unknown.
Co-authored-by: MervinPraison <[email protected]>
Prompt caching is not applied automatically. LLM._explicit_cache_breakpoints()
gates Anthropic cache_control injection on prompt_caching being truthy, and
Agent defaults it to None. Document the correct spelling
caching=CachingConfig(prompt_caching=True).
Co-authored-by: Mervin Praison <[email protected]>
Resolves two P1 review findings on the closed-set preset validation:
- approval hyphen aliases (accept-edits, bypass-permissions, full-auto,
dont-ask, ...) were rejected by the new guard even though
PermissionMode.resolve accepts them (-/_ interchangeable). The validator
now normalizes hyphens too, restoring previously-valid construction.
- learn= used case-sensitive, non-stripped == comparisons, so a validated
value like "AGENTIC" or " agentic " fell through to else and SILENTLY
disabled learning. It now uses .strip().lower() like self_improve does.
- resolve()'s preset lookup and the approval deny-set lookup now normalize
whitespace/hyphens too, so every spelling the guard accepts also resolves
(previously " sliding_window "/"read-only" passed validation but the
deny-set lookup produced an EMPTY deny set — the exact read-only-sandbox
bypass this PR exists to prevent).
Adds regression tests for hyphen aliases, case/whitespace-normalized
presets (learn actually enabled), and the read-only deny-set security path.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Replace the single module-level identity pointer (_autocreated_store/
_autocreated_dir) with a per-instance marker attribute stamped on any store
this module auto-creates. A partial teardown that restores only
_default_store without restoring the out-of-band tracking variable could
otherwise misclassify a previously auto-created store as caller-injected and
pin it to a stale session directory (Greptile P1).
Also make the DEFAULT_SESSION_DIR __getattr__ hook honour an explicit module
override consistently via _resolve_default_session_dir(), and fix the
override test's leaky monkeypatch (the lazy __getattr__ made setattr restore
a computed value as a real global, leaking into later tests). Adds a
regression test for the restored-store scenario.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The session module's __init__.py and README.md documented
Agent(name=..., session_id=...), which Agent.__init__ rejects with TypeError.
session_id/user_id/db were consolidated into MemoryConfig, and prompt_caching
was never a parameter (caching is applied automatically per model capability).
Fixes the docs to the working spelling and adds a two-sided guard test.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 review findings on the sub-agent transcript relocation:
- Partial migration: legacy per-agent records were only consulted when the
parent held no current-format histories, so a second agent still living in
a tagged legacy record silently resumed empty. A new _merged_agent_histories
helper always layers legacy under current-format entries (current wins), used
by both single and bulk restore paths.
- Concurrent saves: _store_agent_history read the whole map outside the store
lock then replaced it, letting a concurrent writer under the same parent drop
another agent. It now re-reads the freshest map before each write and verifies
no other key regressed, retrying a bounded number of times.
Adds regression tests for partial-migration recovery and concurrent-save
preservation.
Co-authored-by: Mervin Praison <[email protected]>
The mistyped-command guard used difflib ratio >= 0.8 alone, which also
matches legitimate one-word prompts that are plurals or extensions of a
command word (`tests`->`test`, `runs`->`run`, `server`->`serve`). Those
wrongly exited 2 before reaching the bare-prompt path.
Drop prefix-related matches: an extension contains the command as a prefix
(or vice-versa) whereas a genuine typo (`deploi` vs `deploy`) does not, so
real prompts reach `run` while typos still exit 2 with a suggestion.
Co-authored-by: Mervin Praison <[email protected]>
Seven Agent(...) preset params (output, execution, context, autonomy,
approval, learn, self_improve) silently fell back to defaults on a typo'd
preset name. Worst case: approval="read_onl" produced an empty deny set,
allowing all 17 dangerous tools instead of the intended read-only sandbox.
Wire the existing make_preset_error helper to these params via a small
validate_preset_string() in parse_utils.py plus a compact
_PRESET_STRING_PARAMS table and _validate_preset_params() loop run at the
top of the consolidated-params block, before every fast path that could
swallow the value. Free-form string params (knowledge, guardrails, skills,
runtime, auth) are deliberately excluded.
Co-authored-by: MervinPraison <[email protected]>
An empty list/tuple resolved to None (no-op) on main, but the new
fail-loud guard rejected it with TypeError. Exempt empty collections
so an empty opt-in stays backward-compatible; genuinely unsupported
values still raise. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
ExecutionConfig.parallel_tool_calls now uses None as an internal "not set"
sentinel (normalised to bool in __post_init__) so Agent._merge_parallel_tool_calls
can tell an explicit False from an omitted default. A ToolConfig(parallel=True)
alongside an explicit ExecutionConfig(parallel_tool_calls=False) now raises
TypeError instead of silently enabling parallel tool calls (Greptile P1).
Co-authored-by: Mervin Praison <[email protected]>
Sub-agent transcripts were persisted as separate top-level sessions named
"{session_id}_{name}:{role}", whose sanitised path collided with real user
sessions of the same name (e.g. Session("chat") + Agent("support", "agent")
-> chat_support_agent.json). An ordinary close()/save_state() then silently
overwrote an unrelated user's conversation and could leak it back into the
agent on restore.
Move sub-agent histories into the parent session's own
metadata["agent_histories"][agent_key], removing the second namespace
entirely. Legacy tagged records migrate forward on save; untagged pre-tag
records are restored only behind PRAISONAI_SESSION_LEGACY_AGENT_KEYS=1
(ambiguous by construction) and are never deleted.
Co-authored-by: MervinPraison <[email protected]>
DEFAULT_SESSION_DIR was evaluated at module import time, freezing the
store root to whatever PRAISONAI_HOME resolved to during the first import.
Any later override -- a container exporting PRAISONAI_HOME after the
package was imported, or a test monkeypatching get_sessions_dir -- was
silently ignored, so the store read, wrote and deleted sessions in the
wrong directory.
- Resolve the directory live in DefaultSessionStore.__init__ via
_resolve_default_session_dir().
- Keep DEFAULT_SESSION_DIR readable/assignable via PEP 562 __getattr__.
- Rebuild the singleton when the resolved directory changes, while
never second-guessing a store a caller injected.
- Fix two repo tests that set the unread PRAISONAI_SESSIONS_DIR env var
and reset the wrong singleton attribute.
- Add tests/unit/session/test_session_store_dir_resolution.py.
Co-authored-by: MervinPraison <[email protected]>
Add behavioural coverage for require_approval's sync and async wrappers.
The existing approval suite only asserted registration metadata, so both
denial `raise PermissionError` lines could be deleted with the suite green.
New tests install a denying backend, call a decorated tool, and assert the
PermissionError plus that the wrapped body never ran (side-effect probe).
Positive controls, modified_args, fail-closed, and async-context cases
included.
Co-authored-by: MervinPraison <[email protected]>
The praisonai dispatcher only introspected the `run` subcommand's options,
never the root callback's global flags (`--output-format`/`-o`). As a result:
- `praisonai --output-format json version` misrouted to the legacy engine,
dropped `version`, sent `json` to an LLM, and exited 0.
- A typo'd verb like `praisonai deploi` fell through to the bare-prompt path,
was billed to an LLM, created a session, and exited 1.
Fix, entirely in the dispatcher:
1. Introspect the root callback and union with `run`'s options for argv
tokenisation, so `--output-format` routes correctly.
2. Hoist global-only flags ahead of `run` when synthesising a `run` call
(Click accepts group options only before the subcommand). Options declared
by both (`-o`, `-v`) stay with `run`, preserving existing semantics.
3. Add an unknown-subcommand guard: a lone positional that difflib rates a
close match (>= 0.8) to a registered command exits 2 with a suggestion,
guarded so genuine one-word prompts still work.
Co-authored-by: MervinPraison <[email protected]>
Agent(guardrails=<validator object>) previously fell past every dispatch
branch and was dropped with no exception or warning, so the agent ran with
zero enforcement. Adapt protocol-conforming guardrail objects (and lists of
them) into GuardrailChain, raise TypeError on unsupported values instead of
storing something that never runs, and wire _tool_call_guardrails so
validate_tool_call is no longer dead code.
Co-authored-by: MervinPraison <[email protected]>
ToolConfig.parallel is now a deprecated alias (None = unset) that feeds
ExecutionConfig.parallel_tool_calls, which every public entry point forwards
to the LLM. A bare ToolConfig() no longer silently disables an explicit
parallel_tool_calls=True, and conflicting explicit spellings raise TypeError.
Co-authored-by: MervinPraison <[email protected]>
Previously any --transport value other than exactly "stdio" fell through
to the SSE branch, so a typo (e.g. `stido`) or the advertised-but-
unimplemented `http-stream` silently started a listening socket instead
of a stdio pipe. Add explicit validation rejecting unknown/unimplemented
transports with exit code 2 before any branch can bind.
Co-authored-by: MervinPraison <[email protected]>
- Workflow YAMLs run through YAMLWorkflowParser, which has no cli_backend
wiring; the framework-level compatibility check passes for 'praisonai'
and the field was silently dropped, running the workflow on the native
LLM path. _build_yaml_workflow now fails fast with a clear error,
mirroring the existing tool_timeout and CLI-capability rejections.
- _chat_via_cli_backend: post-success hook emission and chat-history
bookkeeping failures are contained (logged) instead of being reported
as backend-execution failures, which invited callers to retry work the
external CLI already completed; the failure hook now receives the
backend's error result (with its audit metadata) instead of None.
- Tests: workflow-YAML rejection, post-execution containment, and
error-result metadata propagation.
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
The precise duplicate-add detection introduced in this PR classifies a
schedule add as successful only when the response contains the producer-owned
confirmation "Schedule '<name>' added". The pre-existing timezone-surface test
stubbed schedule_add with a generic "Schedule added" string lacking the job
name, so the new guard correctly treated it as a rejection and the CLI exited
non-zero. Update the stub to return the real success shape; the guard is
unchanged (test was stale, not the code).
Co-authored-by: Mervin Praison <[email protected]>
- schedule add: failure detected as absence of the producer-owned
success confirmation instead of substring matching, so a schedule
literally named 'Error monitor' no longer exits 1 on success
- --backend-timeout: nan/inf/-inf rejected before the job is created
(inf previously raised OverflowError AFTER the schedule was stored);
guard tolerates direct calls passing Typer OptionInfo defaults
- backend gate: go-path state_updates (cursor/watermark) now persist
only after the backend turn succeeds — a policy block, resolution
failure, timeout, or backend error no longer advances the cursor past
unprocessed work; skip-path persistence unchanged; regression test
- CLI session: result validated and resume state recorded BEFORE the
cancellable hook await, so cancellation during the hook cannot lose
is_resume for the next turn (and the lock is already released)
Cross-event-loop lock coordination (two OS threads sharing one Agent,
each with its own loop) is documented as out of scope: sharing an Agent
across threads is unsupported for the wider Agent state; the re-key
path preserves per-loop serialisation, which is the supported usage.
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
- CLI-backend session lock: asyncio.CancelledError bypasses 'except
Exception', which could leave the per-session lock held forever; a
dedicated handler now releases (guarded by a lock_held flag so a lock
re-acquired by a concurrent turn is never stolen) and re-raises. The
same flag guards the generic exception path.
- Backend pre-run gate now mirrors the native path's state handling:
persisted gate state is loaded, passed to state-aware gates, and
decision.state_updates persist on both skip and go — a backend
monitor job keeps its cursor/watermark across ticks.
- schedule add --backend-timeout: positive sub-millisecond values no
longer collapse to 0 (which the executor replaced with the 300s
default); rounded up to at least 1ms.
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
The defensive conflict check marked the run failed but returned before
_audit_output and _maybe_deliver_failure, unlike every other backend
failure path — audited deployments would lose the record and the owner
notification. Now consistent; regression test asserts the audit.
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
A duplicate-name add creates nothing and (post the job_created guard) mutates
nothing, but still printed success and exited 0 — misleading scripts/CI. Treat
the 'already exists'/'Error' responses as failures so a rejected add exits 1 in
both text and --json modes. Adds a regression test asserting no mutation + exit 1.
Co-authored-by: Mervin Praison <[email protected]>
- all backend-branch _audit_output calls now go through
asyncio.to_thread, matching the native-agent failure paths so slow
audit storage cannot block ticker/delivery coroutines
- 'cli_backend: null' in YAML behaves as unset (backward compatible);
the fail-closed error fires only for a non-null value that cannot
resolve
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
ef6bb47b started scrubbing secret ENV lines on capture via
container.commit(..., changes=scrub) -- a real docker-py kwarg -- but the
suite's _FakeContainer.commit() still took only (repository, tag). Every
capturing provision raised TypeError, fell back to ephemeral, and left
commit_log/list_captures empty: the IndexError and 0==N failures in CI.
Production code is correct; the fake had drifted from the API it mocks.
Widened the fake to the real signature so a successful commit stays a
successful commit.
Co-authored-by: Mervin Praison <[email protected]>
Addresses the remaining review findings:
- --command and --backend are mutually exclusive at the CLI; the
executor fails loudly on persisted jobs carrying both (defensive)
- backend jobs now evaluate the pre-run condition gate (skipped, no
subprocess when nothing to do; gate context appended to the prompt)
and pass the message through RunPolicy.scan_prompt when configured,
matching native-agent jobs
- CLI session establishment is serialised per session id with an
asyncio lock (cross-event-loop safe) so concurrent turns cannot
spawn two fresh CLI conversations for one session
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
Addresses the three review findings:
- schedule add: trusted post-add options apply only when this invocation
actually created the job — a duplicate-name rejection can no longer
reconfigure a live schedule
- YAML cli_backend that cannot resolve now raises with remediation
instead of silently running the native LLM path
- backend resolution/timeout/launch failures now write the durable
audit record before failure delivery (all three early-return sites)
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
Greptile P1: the retry loop still mutated self._current_profile on
rotation, and mark_failure/mark_success plus token-model attribution read
that shared pointer. Concurrent requests on one LLM instance could mark
the wrong profile failed/healthy or misattribute cost.
Rotation is now a call-local: _handle_retry_exception takes the active
profile in and returns the (possibly rotated) profile out; both retry
loops keep it in a local and use it for mark_failure/mark_success.
self._current_profile stays pinned to the initial profile. Token usage
is attributed from the serving model on the response (race-free), so the
now-unused _active_profile_values() is removed.
Co-authored-by: Mervin Praison <[email protected]>
Schedule a job that runs its message as one headless turn through a
registered coding-CLI backend (claude-code, codex-cli, gemini-cli,
grok-cli): new ScheduleJob.backend/backend_options fields, an executor
action that resolves backends lazily via the sanctioned _code_bridge
seam (bot never hard-depends on praisonai-code), and
'praisonai schedule add --backend/--backend-cwd/--backend-timeout'.
Output is bounded, failures flow through run records, audit and
failure delivery, and the pinned model is passed to the CLI.
Backend fixes shipped alongside, all previously silent:
- timeouts now return CliBackendResult(error=...) instead of escaping
as bare TimeoutError (all four backends)
- captured stderr reaches the error message (codex/gemini/grok)
- codex: 'exec resume <id>' subcommand order; TOML-safe instructions
escaping; -m model flag; -C honors cwd
- gemini/grok/claude: model flag + cwd threading
- CliSessionBinding.is_resume is now set on the second turn of a
session, activating the resume branches in all four backends
- YAML 'cli_backend:' resolves through _resolve_yaml_cli_backend into
the cli_backend kwarg instead of misrouting into the runtime
registry (shipped example now works)
- 'praisonai backends' registered as a Typer command (standalone
praisonai-code installs previously could not reach the legacy path)
Tests: 19 new (backend action + serialisation round-trip + fixes);
existing scheduler/backend suites verified unchanged vs main;
check_bot_code_imports gate passes.
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pwwvk68iPoNnGw6ov5Lpga
_switch_to_profile wrote the rotated profile's api_key/base_url/model
onto the shared LLM instance. With one instance serving concurrent
requests (asyncio.gather on a shared Agent, or a cached per-session
Agent), a failover rotation for request A changed the credentials and
model that request B read on its next completion build, silently
sending B's traffic to the wrong provider. Rotation is now a per-call
concern: the retry loop threads the active profile through request
kwargs, and instance attributes keep the initial profile values.
Token tracking follows the profile actually used for the call.
Closes#3613 (gap 2).
_release() called asyncio.run() directly, so GC on a thread already driving
an event loop raised RuntimeError before shutdown ran -- the instance leaked.
Bridge the loop the way SharedCompute._run_sync does (offload to a private
thread when a loop is live) so teardown survives either case.
DockerSandbox.execute() labelled its ephemeral --rm containers praisonai=managed,
the sole input to DockerCompute.list_instances(). Those praisonai-<uuid> names
then surfaced in `managed ps` but `managed stop` resolves praisonai_<id> and
could never reclaim them. Relabel as praisonai=sandbox-exec; the timeout kill
uses --name and is unaffected.
Adds a regression test proving _release reclaims when invoked on a live loop.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Both found by adversarial review, both pre-existing, both leaks.
A TIMED-OUT execution left its container running. The handler called
proc.kill(), which ends the docker CLI while the container it started
carries on. The container also had no --name, so it got a random Docker
name -- neither the timeout handler nor `praisonai managed ps` could
find it, and the user was left with something they could see in
`docker ps` and had no supported way to stop. It is named and labelled
now, and the timeout kills the container rather than the client.
The sibling run_command() path already did this, with the comment "Kill
the container, not just the client". execute() never got the same
treatment; the two paths have been quietly different ever since.
run_on= NEVER RECLAIMED ITS INSTANCE. ComputeManagedAgent defaults to
keep_alive=True, which is right -- an instance should survive between
turns -- but it registered no finalizer, so it also survived the process.
For docker that was a container per script; for e2b, modal, daytona,
tenki and flyio it is a billed cloud instance whose only other reaper is
the provider's own idle timer, and docker and flyio have none.
It now uses the same weakref.finalize treatment tools_placement uses for
agents, which covers collection and interpreter exit, and stands down
when the caller shuts down deliberately. The finalizer deliberately does
not close over the backend -- that would keep alive the very object whose
collection it waits for.
Verified from a confirmed-zero baseline: 0 containers after a timeout
(was 1), 0 after a run_on= script exits (was 1), and ordinary runs
unaffected.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Address two P1 review findings on the YAML adapter/drop-in feature:
- Trust gate bypass: project-local .praisonai/channels/*.py files were
classified by the plugins-scoped _is_project_local() (which checks
.praisonai/plugins), so they executed without PRAISONAI_ALLOW_PROJECT_PLUGINS.
Add _is_project_local_channel() scoped to the channels dir and gate on it.
- adapter field reaching constructor: the loader-only YAML `adapter:` import
ref was passed through into adapter_cls(**init_kwargs), raising TypeError for
adapters that don't accept an `adapter` kwarg. Skip it in the gateway
pass-through alongside platform/token.
Adds regression tests for project-local opt-in enforcement (blocked/allowed)
and the adapter-field exclusion.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Restores the CLI/YAML/Python 3-way surface for custom gateway channels:
- ChannelConfigSchema gains an optional `adapter:` dotted "module:Class"
import string; unregistered platforms are lazily imported, validated
against BasePlatformAdapter, and self-registered before startup.
- BotPlatformRegistry auto-discovers single-file adapters dropped into
./.praisonai/channels/ and ~/.praisonai/channels/, reusing the same
trust gate as single-file plugins.
Backward compatible: absent the adapter key and drop-in dir, resolution
behaves exactly as before.
Co-authored-by: MervinPraison <[email protected]>
The sandbox directory is mounted at /sandbox, so that is the path a user
sees from inside the container and the one they naturally reach for. But
the file API treats "/" as the sandbox root, so the container spelling
was joined onto the root a second time:
write_file("/sandbox/report.txt") -> True
cat /sandbox/report.txt -> No such file or directory
find /sandbox -name report.txt -> /sandbox/sandbox/report.txt
and the reverse direction failed too -- a file the container had just
written to /sandbox/out.txt was invisible to read_file("/sandbox/out.txt")
and absent from list_files("/sandbox"), while read_file("out.txt") found
it. Two spellings of one location, one of them silently wrong, and the
wrong one is the spelling the container itself shows you.
Both now resolve to the same file. Only the exact mount prefix is
stripped, so a genuine subdirectory called "sandbox" is not swallowed --
there is a test for that, because prefix-stripping is the kind of fix
that quietly breaks the case it was not thinking about.
Introduced by the mount added to make writes reach the container at all;
before that, /sandbox did not exist inside it, so nothing could be
addressed either way.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Three valid P1s from adversarial review:
- execute()'s _build_docker_command passed max_processes straight to
--pids-limit, so the default 10 killed the container before python
started (exit 125). Apply MIN_CONTAINER_PIDS floor, matching run_command().
- docker commit scrubbed only a fixed secret-name set. ComputeConfig.env is
public (.praisonai/environment.yaml), so an arbitrary custom secret was
baked into the persistent image. Scrub the union of the known set and the
config's own env names -- the values actually injected into the container.
- open_in_sandbox/makedirs_in_sandbox referenced os.O_DIRECTORY / O_NOFOLLOW
and dir_fd unconditionally, raising AttributeError on Windows. Gate the
openat walk behind a capability flag; fall back to the resolved-string
guard where openat is unavailable (Docker there runs a Linux VM, so no
host-shared dir exists to race).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Four defects found by adversarial review of the merged consolidation. The
first two are mine.
ESCAPE. The bind mount added so write_file() actually reaches the
container turned a harmless check-then-use into an exploitable race.
safe_sandbox_path() validates a path STRING; the caller then opens that
string -- two syscalls with a gap. Nothing but the host could write to
that directory before it was mounted. Afterwards, code inside the
container could swap a name between a regular file and a symlink:
for i in $(seq 1 6); do (while true; do
rm -f /sandbox/notes.txt; ln -s /etc/passwd /sandbox/notes.txt
rm -f /sandbox/notes.txt; : > /sandbox/notes.txt
done) & done
Measured before the fix: an escape to an arbitrary host file on write
attempt 375, and a host secret disclosed on read attempt 4. Arbitrary
host read and write, from code that where_does_it_run() calls "a Docker
container".
No amount of stricter string checking fixes this -- anything verified
before the open can be invalidated after it. So the file is never
re-opened by name: open_in_sandbox() walks the path one component at a
time against an open directory descriptor with O_NOFOLLOW at each step,
so a symlink substituted at any level fails the open rather than
redirecting it. Re-running the attack: host file untouched, secret not
disclosed, ordinary writes unaffected.
LEAK ON EVERY EXIT. tools_run_on= releases its sandbox from a weakref
finalizer, which usually runs as the process ends -- and by then
concurrent.futures has set its own atexit flag, so run_in_executor raises
"cannot schedule new futures after interpreter shutdown". The failure was
swallowed and logged as a successful release, so every run left a
container up while reporting it had cleaned up. Docker and Fly.io have no
idle reaper, so those were indefinite.
_offload() now falls back to calling inline when the executor is gone,
which is correct there: no event loop is left to starve. Unrelated
RuntimeErrors still propagate. DockerCompute was never converted to the
shared base in the earlier extraction, so it had the same bug in four
more places; it inherits now. Teardown reports failure instead of
claiming success, since a failed release means something is still
running -- or still billing.
SECRETS IN A COMMITTED IMAGE. `docker commit` preserves Config.Env, so
the model API keys forwarded into a container were baked into an image
that persists for days and is readable by anyone who can run `docker
inspect`. The capture exists to reuse installed packages, not the
credentials that happened to be present while installing them, so the
commit now scrubs them.
FORK BOMBS. run_command() accepted max_processes and ignored it while
the other execution path applied it. Docker's --pids-limit is per
container, so unlike RLIMIT_NPROC it means what it says -- but the
default of 10 was chosen for the rlimit world and kills the container
before the shell finishes starting. The cap has a floor a container can
live within; it still bounds a fork bomb, it just stops the bound from
being the bug.
Also drops `native` from the not-a-boundary list: it aliases sandlock,
which applies Landlock and seccomp, so the two spellings of one backend
were giving opposite security advice.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Seed the outbound carrier with provider headers first, then inject the
active trace context last so a fresh traceparent/tracestate always wins
over any stale provider-supplied values (Greptile review on #4103).
Co-authored-by: Mervin Praison <[email protected]>
Extend the dependency-free GatewayTraceHook seam so an exporter can continue
an upstream caller's distributed trace and propagate context downstream:
- stage() gains an optional parent_carrier (inbound traceparent/tracestate)
so a stage can be entered under an extracted parent span context.
- inject_context()/extract_carrier() no-op defaults let egress call sites
write the active traceparent and ingress boundaries continue a caller's
trace. Real extract/inject lives in the OTel exporter plugin.
NullGatewayTraceHook stays the zero-cost, OpenTelemetry-free default:
inject_context leaves the carrier untouched and extract_carrier returns None.
Additive and backward compatible.
Co-authored-by: Mervin Praison <[email protected]>
The error branch in _parse_tool_call_arguments (PR #4075, commit 991b2ff28)
intentionally reads the real tool name from tool_call["function"]["name"] so a
malformed/truncated arguments string is reported back to the model for the
correct tool instead of aborting the turn with a fabricated name. The stale
test still asserted the old "unknown_function" behaviour, causing a pre-existing
test-core failure unrelated to the docker-sandbox changes on this branch.
Update the assertion to the current contract and add a case proving the
"unknown_function" fallback still applies when no name is recoverable.
Co-authored-by: Mervin Praison <[email protected]>
run_in="docker" goes through execute(), which mounted only its own
script under /code -- so it could not see files write_file() wrote and
anything it created vanished with the container. Mount the sandbox dir
and run the script from there, matching run_command(). Adds a regression
test proving execute() reads a written file and its output persists.
Co-authored-by: Mervin Praison <[email protected]>
It said "backends extracted from the praisonai wrapper", which stopped
being the whole truth when the seven compute providers moved in. The
package now holds both shapes: eight sandboxes (one object IS one
environment) and seven compute providers (one object hands out many).
The distribution name stays. "sandbox" is imprecise for a package that
also contains fleet managers, but it is published, it appears in every
install hint and extra, and renaming a released package costs more than
the imprecision does. The precision lives in the subpackage instead:
praisonai_sandbox.compute is unambiguous about which shape you are
importing.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Two user-visible defects, found by comparing the two docker
implementations now that they sit in one package.
WRITES WENT NOWHERE. write_file() writes into a host temp directory, and
`docker run` never mounted it. So the write reported success, the file
landed outside the container, and reading it back failed:
write_file("/data.txt", ...) -> True
run_command("cat /data.txt") -> exit 1, No such file or directory
Nothing carried between commands either, since each one got a fresh --rm
container with no shared storage. The directory is now mounted at
/sandbox and commands run there by default, so a write is visible to the
next read and to the next command.
LISTING LEAKED THE HOST PATH. list_files() returned entries like
"/../../../../../../private/var/folders/.../praisonai_sandbox_xxx/a.txt".
On macOS the sandbox directory comes back as /var/folders/... while
os.walk reports /private/var/folders/... -- /var being a symlink -- so
the relative-path computation escaped upward and handed back the real
host location. Both sides are resolved before comparing now, and any
entry that still escapes the root is dropped rather than reported.
Isolation is unchanged and tested: the host filesystem stays invisible,
only the sandbox directory crosses.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The C13 sandbox import gate flags any `from praisonai` line in
praisonai_sandbox/. The moved compute providers still documented the
legacy `praisonai.integrations.compute.*` alias in their docstring
examples, tripping the gate and failing test-core, test-core (sandbox)
and smoke. Point every example at the canonical
`praisonai_sandbox.compute.*` path (the old path is now only an alias),
which both satisfies the gate and gives users the correct import.
Co-authored-by: Mervin Praison <[email protected]>
- praisonai-sandbox[all] now includes tenki and flyio, so a user who runs
`praisonai-sandbox[all]` and selects tools_run_on="tenki" gets the SDK
instead of a missing-dependency error (Greptile P1).
- _compute_bridge _EXTRA_HINTS now point at praisonai-sandbox[<vendor>] rather
than the heavy praisonai wrapper — the whole reason the providers moved
(58 vs 143 resolved packages) — and cover the previously-missing tenki hint.
Co-authored-by: Mervin Praison <[email protected]>
Reaching E2B through `tools_run_on=` required the praisonai wrapper: 20
hard dependencies and 8 sibling packages, including a browser package and
a Telegram bot, to run a command in a sandbox. The identical capability
through `run_in="e2b"` needed only praisonai-sandbox[e2b]. Measured, that
was 143 resolved packages against 58, for the same vendor.
The seven compute providers now live in praisonai_sandbox/compute/,
beside the sandbox backends they share a vendor with. That package was
already the right shape for this: four hard dependencies and one optional
extra per vendor, sitting directly above core. Nothing needed inventing --
the extras grid already existed and was already correct.
Verified with the wrapper made genuinely unimportable: providers resolve
and a real Docker container runs. That property now has a test, so the
providers cannot quietly drift back behind a dependency users should not
need.
Compatibility. The old modules alias the new ones through sys.modules
rather than re-exporting from them. A plain `from ... import X` shim
looks equivalent right up until someone monkeypatches a module-level name
through the old path -- the patch lands on the shim and the real module
never sees it, which is exactly what the wrapper's docker-capture tests
do. Aliasing keeps one shared module object, so every existing import,
attribute and patch keeps working.
tenki's SDK pin follows its implementation; flyio needs none, since it
speaks plain HTTP through aiohttp, which praisonaiagents already
requires.
This does not merge the two implementations of the four shared vendors.
That decision is still open, and it is now easier to make because the
pairs finally sit in the same distribution.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
When a provider's SDK was missing, the error told the user what to
install. Three of those instructions were wrong:
praisonai[e2b] did not exist
praisonai[docker] did not exist
praisonai[daytona] existed but was EMPTY -- installed nothing
pip warns about an unknown extra and then carries on succeeding, so the
user followed the official hint, waited for the install, and hit the
identical failure again. That is worse than no hint at all, because it
looks like it is helping.
The wrapper extras are now real and delegate to praisonai-sandbox, which
already pins every vendor SDK correctly, rather than standing up a second
grid of pins to drift against the first.
A test walks every hint, resolves the extra it names against the real
pyproject, and asserts it exists and is non-empty. The only reason this
survived is that nothing checked whether the advice was true.
Rebased onto main and rebuilt rather than merged: this branch and main
had both appended to test_provider_matrix.py, so a textual merge cut a
function in half. Main's copy is taken whole and the one test unique to
this branch re-applied on top.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Compute truncation before emit_run_result in the actions/custom-agent
paths so --output stream-json consumers never receive a contradictory
run.result {ok:true} ahead of the status:"truncated" outcome (exit 2).
Adds a regression test exercising the stream-bridge ordering.
Co-authored-by: Mervin Praison <[email protected]>
auth._PROVIDER_ENV_KEYS retained only each provider's first catalogue
env-var, so providers with multiple credential spellings (together:
TOGETHER_API_KEY/TOGETHERAI_API_KEY, fireworks: FIREWORKS_API_KEY/
FIREWORKS_AI_API_KEY) had their secondary alias dropped. The runtime
(env.py) already honours all aliases, so `auth list`/`status` reported
"not found" for a credential the runtime accepts — the exact drift this
PR set out to eliminate. Now the map keeps all aliases and auth prefers
whichever the user actually set. Adds parametrised coverage over every
multi-alias provider.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Denials now support optional free-text guidance surfaced back to the model
as a course-correction instead of a bare "User denied" dead-end.
- ApprovalDecision gains optional feedback field (backward-compatible).
- ConsoleBackend adds a [d] "deny & redirect" choice capturing one line
of guidance.
- Tool-loop denial handlers fold feedback into the tool result the model
sees next turn (reuses existing result path, no new subsystem).
- InteractiveCLIApprovalBackend now also sets decision.feedback.
Co-authored-by: MervinPraison <[email protected]>
A run that hits its max_iter/max_steps budget returns a non-empty
finalisation summary, which the CLI's _run_succeeded accepted as success —
masking incomplete work with exit 0 and status "success".
The core already records the terminal reason on the agent via
last_stop_reason ("max_steps" on truncation), so consult it on the
in-process run paths that hold the Agent object and report a distinct
tri-state outcome:
- new _run_was_truncated(agent): reads last_stop_reason (best-effort)
- new _report_run_truncated(output, result): preserves the summary text,
emits status "truncated" for --output json, prints a one-line stderr
notice for interactive users, and exits 2 (distinct from failure=1 and
completion=0)
Wired into the actions, custom-agent, and profiled-prompt paths. Genuine
completion and hard-failure paths are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Wire the two remaining parallel provider->env-var maps to the canonical
PROVIDER_ENV_CATALOGUE so key auto-detection, provider inference, and the
auth surface can no longer drift:
- model_resolver._provider_for_model() now resolves via the catalogue
(provider_for_model + env_vars_for_provider), covering openrouter,
mistral, deepseek, xai, together, fireworks, ... instead of returning
None. Keeps the historical eight-provider ladder as an offline fallback.
- auth._PROVIDER_ENV_KEYS is derived from the catalogue at import, with the
historical literal map retained as an offline fallback.
- Add parametrised drift tests asserting every catalogued provider is
resolvable by auth, model_resolver, and env first-run detection, so
future drift fails CI.
Co-authored-by: MervinPraison <[email protected]>
- audit.py: bind sensitive_keys to the built-in redactor via functools.partial
at construction so both default and custom redactors are always invoked with
a single argument, honouring the declared Callable[[Any], Any] contract.
Custom one-arg redactors no longer raise TypeError before _write runs.
- db_session_adapter.py: add per-session init lock so concurrent first access
calls the non-idempotent on_agent_start exactly once, preventing duplicate-key
races in SQL conversation stores. Init locks are cleaned up on delete_session.
Co-authored-by: Mervin Praison <[email protected]>
- security/audit.py: redact sensitive tool_input keys (api_key, token, etc.)
via a default denylist redactor; chmod the log file to 0o600.
- integrations/db_session_adapter.py: guard the four in-memory containers with
a threading.RLock (DB I/O stays outside the lock) to prevent dropped messages
and duplicated on_agent_start under concurrent multi-agent load.
- __init__.py: disambiguate ModuleNotFoundError on e.name so a broken transitive
dependency surfaces the real cause instead of a misleading "has no attribute".
Co-authored-by: MervinPraison <[email protected]>
Address two P1 review findings on the untrusted-request fencing:
- use_system_prompt=False bypass: add a self-describing inline notice
(request_payload_notice) prepended once outside the fence at each
ingress boundary (webhook render_prompt, hook render_template), so the
untrusted-data semantics travel with the payload even when the agent
never receives the system-prompt trust clause.
- deliver_only markup leak: resolve_message gains a fence flag; the
gateway deliver_only path calls it with fence=False so recipients of
direct channel deliveries never see literal fence tags.
Tests updated for the inline notice and unfenced deliver_only output.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer-flagged issues on the unified schedule management surface:
- schedule_update now clears last_run_at on cadence change so a new at:/every/
cron schedule is evaluated fresh (a previously-run job updated to at: was
treated as already-fired and never ran).
- CLI pause/resume/update/remove/delete mutate the exact record resolved by id
(via store.update/store.remove) instead of round-tripping through the
name-based tool, so duplicate names cannot cause the wrong job to change.
- schedule list --json emits a single valid JSON document ({store, daemon})
instead of mixing a JSON array with the daemon's human-readable table.
- schedule describe consults the canonical store first, so store-backed jobs
authored by schedule add can be inspected; falls back to the daemon.
Adds a regression test for the cadence-reset fix. Full scheduler suite passes.
Co-authored-by: Mervin Praison <[email protected]>
Address final-review findings on the unattended-run wiring:
- schedules_runner: on the canonical store, claim_due advances last_run_at at
claim time, so raising in on_trigger still consumed the occurrence. Only
start the poll loop when an executor was built; otherwise leave the loop
unstarted so no due job is claimed/consumed (P1: atomic claim consumes
failed occurrence).
- schedules_runner: drop the misleading "process-global registry" claim from
the resolver docstring — no such registry exists in host embedding; message
jobs are recorded failed (auditable) and command jobs run (P1: agent
resolution).
- gateway server: rebuild RunPolicy each tick from the current _loaded_config
so a hot-reloaded scheduler: block applies without a process restart
(P1: reloaded policy remains stale).
- test: replace the tautological on_trigger stub test with one that asserts
the real bridge does not start the loop when no executor is available.
Full scheduler unit suite: 307 passed, 8 skipped (no regressions).
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile P1 on PR #4088: resolve_launch_host() previously wrote the
process-wide PRAISONAI_LAUNCH_AUTH_TOKEN before the no-agents / missing-deps
guards, so a launch that never started a server could still flip global auth
and retroactively 401 an already-running endpoint. The bind guard now runs only
after both paths are committed to serving. A generated token is also reused for
the process lifetime so a later non-loopback launch cannot mint a fresh token
and lock out an endpoint already serving with the previous one.
Co-authored-by: Mervin Praison <[email protected]>
- run_stream() now records a terminal RecipeResult (success/failed/policy/
missing-deps/dry-run) via best-effort history, closing the streaming gap
- recipe runs: label the identifier column "Run ID" and align judge guidance,
since `recipe judge` consumes the run_id (the index has no trace_id)
- legacy praison_ai: use direct attribute access (removes Ruff B009)
- tests: add streaming-persistence coverage; legacy test now exercises the
wrapper-bridge resolution path the legacy branch actually uses
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer P1s in github_commit_and_push:
- Safety refusals now run BEFORE staging a commit, so a refused push leaves
pending changes intact and a retry can succeed.
- Existing local target branches are switched to with a plain checkout instead
of `checkout -B`, so their local-only commits are not discarded.
- Divergence (force-push) refusal is factored out and applied to every branch,
including agent-prefixed ones, and is never overridable.
Co-authored-by: Mervin Praison <[email protected]>
Defect 1: gateway now constructs a default RunPolicy (deliver-on-failure,
prompt scan, denied toolsets) with optional gateway.yaml `scheduler:` overrides,
so failed scheduled jobs notify the owner and unattended tool downscoping fires.
Defect 2: the host-app schedule bridge now executes due jobs via
ScheduledAgentExecutor; when no executor can be built it raises so ScheduleLoop
leaves the job due instead of silently absorbing it.
Defect 3: the BotOS scheduler path now enforces pin_model via the canonical
_check_model_drift before agent.chat — a drifted pinned job takes no model turn
and is recorded failed with the drift reason.
Co-authored-by: MervinPraison <[email protected]>
Wire the existing untrusted-content fencing at the HTTP ingestion boundary so
webhook/hook payloads arrive labeled as data, not instructions:
- Add reusable wrap_request_payload() + <external_request_payload> fence
constants to tools/trust.py (ingress counterpart to wrap_if_external).
- Extend the system trust clause to name the new fence.
- Fence payload-derived content in the webhook channel render_prompt: template
interpolations and the raw-body default are fenced; the no-prompt case gains a
fixed operator prefix so attacker text is never the sole instruction.
- Fence payload interpolations in the gateway hook resolve_message; operator
template text stays outside the fence.
Fence closers embedded in payloads are delimiter-escaped to prevent breakout.
Co-authored-by: MervinPraison <[email protected]>
Address CodeRabbit/Greptile feedback: the prompt-only regression test
previously never asserted that execution completed or that the agent
branch ran, so it could pass while the job stayed queued. Now records
the agent-branch call and asserts a 200 result of "agent-result".
Co-authored-by: Mervin Praison <[email protected]>
- Persist every RecipeResult via history.store_run at the end of recipe
core.run(); gated by PRAISONAI_RECIPE_HISTORY (default on), write
failures never fail the run (logged and ignored).
- Add `praisonai recipe runs [name] [--status] [--session] [--limit]`
to the Typer app, rendering recipe/version/status/when/session/trace-id
and delegating to history.list_runs.
- Fix the broken legacy import in praisonai-code by routing through the
wrapper bridge to the real praisonai.cli.features.recipe module.
- Add unit tests for persistence, env flag, safe write failure, status
filtering, registry independence, and clean handler import.
Co-authored-by: MervinPraison <[email protected]>
Agent.launch served an unauthenticated prompt-execution HTTP endpoint on
0.0.0.0, while Agents.launch enforced PRAISONAI_LAUNCH_AUTH_TOKEN. Factor the
request authoriser and a fail-closed bind guard into a shared
launch_security module and apply it to both paths:
- Agent.launch HTTP route now returns 401 without the bearer token.
- Both paths auto-generate and print a one-time token when bound to a
non-loopback host keyless (loopback keyless dev flow unchanged).
- Default host changed 0.0.0.0 -> 127.0.0.1 for both launch methods.
- Bearer compare is now constant-time.
Co-authored-by: MervinPraison <[email protected]>
Make store-backed jobs first-class in the CLI so what `schedule add`
writes is what `list`/`delete` and the new subcommands read.
- CLI: `list` now merges store jobs (labeled [store]) with daemon
schedulers; add `runs`, `pause`, `resume`, `update`, `remove` operating
on the ScheduleJob store; `delete` finds store jobs first; `add --once`.
- Agent tools: add `schedule_pause`, `schedule_resume`, `schedule_update`;
expose `once` on `schedule_add` (maps to delete_after_run). Registered
in TOOL_MAPPINGS for lazy string resolution.
Scope: kept to praisonaiagents + praisonai per AGENTS.md. `schedule tick`
requires the Tier-2 praisonai-bot executor and is intentionally not added.
Co-authored-by: MervinPraison <[email protected]>
Refuse autonomous pushes to the default/protected branch, foreign-author
branches, and diverged remotes (never force). Auto-create praisonai/ branch
when on default. Opt-in override via allow_unsafe_branch / env.
Co-authored-by: MervinPraison <[email protected]>
The runs API declared recipe_name/recipe_config on JobSubmitRequest and the
executor implemented the recipe branch, but the router never copied those
fields into the Job — so POST /api/v1/runs {"recipe_name": ...} silently ran
nothing recipe-related. Copy the fields through and add regression tests.
Co-authored-by: MervinPraison <[email protected]>
`docker` is implemented twice -- once as a compute provider, once as a
sandbox backend -- and the two defaults had drifted a minor version
apart. Same word, different container:
tools_run_on="docker" -> Python 3.12.14
run_in="docker" -> Python 3.11.16
Nobody decided that. Two independent implementations of one idea simply
diverged, and unifying the vocabulary made the divergence easier to reach
rather than harder, because both spellings now look like the same thing.
The sandbox side moves to python:3.12-slim to match, along with the CLI,
docs and examples that quoted the old default.
The parity test compares the values a caller actually gets --
SandboxConfig.docker().image against ComputeConfig().image. An earlier
version of it scanned the DockerCompute docstring, which meant it passed
while the defaults were genuinely 3.11 and 3.12 apart. A test that cannot
fail is worse than no test, because it is counted as coverage.
Rebased onto main and rebuilt rather than merged: this branch and main
had both appended to test_provider_matrix.py, and a textual merge cut a
function in half. Main's copy is taken whole and the one test unique to
this branch re-applied on top.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Addresses reviewer P1 findings on the async batch/window fixes:
- _depends_on_pending now also detects dependencies expressed via
task.previous_tasks (workflow next_tasks edges are stored as task names),
not only task.context, so a workflow successor is no longer queued in the
same async batch as its predecessor and forced to read an empty result.
- New _deps_failed method extends the failure cascade to the async_execution
path in both the sequential and workflow branches: after a same-batch flush,
an async dependent whose prerequisite failed is marked failed instead of
running with missing upstream context (previously only sync dependents were
guarded).
- TruncateOptimizer re-skips leading orphaned tool results after its
token-budget pop loop, which could otherwise drop an assistant tool_calls
message while retaining its role="tool" result and leave the trimmed
transcript starting on an orphan (Issue #3089).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
1. Guard the tool-call argument JSON parse in the non-streaming native
loops (openai_client.chat_completion_with_tools / achat_completion_with_tools)
so a malformed/truncated arguments string is reported back to the model
instead of aborting the whole agent turn, matching the streaming path.
Also read the real tool name from tool_call["function"]["name"] in
llm._parse_tool_call_arguments' error branch instead of the never-present
top-level "name" key.
2. Route DefaultSessionStore._enforce_window's window slice through the
existing _trim_preserving_tool_exchanges guard, and skip leading orphaned
role="tool" messages in the context TruncateOptimizer/SlidingWindowOptimizer,
so a persisted/optimized window never starts mid tool-exchange.
3. Split an async task batch on an intra-batch context dependency in
arun_all_tasks (sequential + workflow) so a dependent async task's context
is built after its same-batch dependency completes, not before.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The generic ComputeManagedAgent forwards image= through ComputeConfig.image,
which Docker/Daytona/Fly read but E2B (used metadata[e2b_template]) and Modal
(hardcoded debian_slim) ignored -- so run_on='e2b', image=... silently booted
the provider default. E2B now takes a non-default image as its template; Modal
builds it via from_registry. The default value leaves both unchanged. Adds
boundary conformance tests asserting the value each SDK actually receives.
Co-authored-by: Mervin Praison <[email protected]>
Every cloud SDK here is synchronous and ComputeProviderProtocol is async,
so each provider grew the same five methods whose entire body is "hand the
matching _*_sync call to a thread":
async def provision(self, config):
loop = asyncio.get_running_loop()
return await loop.run_in_executor(None, self._provision_sync, config)
Measured: provision, execute, shutdown, upload_file and download_file were
byte-identical across e2b, daytona, modal and tenki -- six identical pairs
per method, about 210 lines of the same four statements.
That was the largest genuinely duplicated block in the project, larger
than all four cross-stack vendor pairs combined. It stayed invisible
because it sits *within* one stack rather than between two, and the
attention had been on the cross-stack pairs, where the real overlap turns
out to be about 6%.
A vendor now implements only the _*_sync half it differs in. Anything a
provider genuinely does differently it overrides, because these are
ordinary methods -- flyio does exactly that, since it speaks HTTP through
aiohttp and is natively async rather than sync-wrapped.
Each unimplemented operation raises NotImplementedError naming the
provider, rather than silently returning a wrong answer.
Net -119 lines. Verified live: docker and modal both still provision and
execute, and the provider matrix passes for all thirteen places.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
`run_on="docker"` had its own 321-line managed backend while the other
seven places shared one generic implementation. The justification written
into that file -- it talks to the daemon directly and skips a
provisioning layer -- did not survive being checked.
It named its containers `praisonai-agent-<hex>`, while DockerCompute's
lookup expects `praisonai_<instance_id>`. So:
praisonai managed ps -> shows the container
praisonai managed stop -> ValueError: No docker container found
Listed but unreclaimable, which is the worst combination: the user can
see the thing they cannot stop. Routing through the provider fixes it by
construction, and 321 lines go with it.
Two gaps in the generic backend had to close first, both real:
- `image=` fell into **kwargs and was silently ignored, so asking for a
specific image quietly got the provider's default.
- the failure when a place is unavailable now names the place and
offers tools_run_on=, which needs no daemon.
The generated class is still called DockerManagedAgent -- make_loader
names each backend after its place -- but it is now a ComputeManagedAgent
subclass, so there is one code path for every runtime.
Also adds the conformance tests that would have caught this class of
problem: the four vendors implemented twice must agree on their
conventions. Docker-only parity is exactly what let Daytona drift into
asking for 1024 GiB of RAM.
Verified live: docker provisions, runs a whole agent loop, appears in
`managed ps`, and `managed stop` now reclaims it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
test_hosted_agent_only_accepts_anthropic encoded a pre-run_on= assumption
that modal/e2b were unavailable managed runtimes. The placement feature
intentionally registered them via the backend registry, so HostedAgent now
resolves them. Assert the guarantee that still holds — providers with no
registered backend (openai/gemini) raise a helpful ValueError — instead of
the stale one.
Co-authored-by: Mervin Praison <[email protected]>
Replace inspect.getsource() substring checks with behavioral tests that
mock the Daytona SDK and assert the actual value passed: memory converted
to GiB (2048MB->2, 512MB->1) and upload_file(src, dst) argument order.
Addresses Greptile p2: source inspection let equivalent regressions pass
and harmless refactors fail.
Co-authored-by: Mervin Praison <[email protected]>
Two live defects on the compute side of Daytona, both found by comparing
it against the sandbox side, which had already learned the conventions.
MEMORY UNITS. daytona_sdk documents Resources.memory as "Amount of memory
in GiB to allocate". The compute provider passed ComputeConfig.memory_mb
straight through, so the default configuration asked Daytona for 1024 GiB
of RAM. That is a provisioning failure, not a rounding error. The sandbox
implementation converts correctly and always has.
ARGUMENT ORDER. FileSystem.upload_file(src, dst) takes the content first
and the destination second. The compute side called
upload_file(remote_path, content), so an upload wrote the path into a
file named after the content. The sandbox side calls it correctly.
Neither is a typo in the ordinary sense: both are the same class of
failure, where one of two implementations of a single vendor learned a
convention and the other never did. Nothing compared them, so nothing
noticed. The wrapper's daytona tests only assert provider_name and that
the constructor exists -- nothing exercises provision() or upload.
Tests now assert both conventions on the compute side, because a shared
vendor name is not a shared understanding of that vendor.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The provisioning tests asserted an exact count of one. SharedCompute
provisions LAZILY, so a run that never touches a tool correctly
provisions nothing -- the exact count was asserting when provisioning
happened rather than the property that matters, and it flaked.
The guarantee is that a run never provisions MORE than one sandbox, and
that a three-row batch does not mean three. Verified the weaker assertion
still has teeth: mutating _needs_tools_scope to always open a scope fails
six tests including the batch one.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
An ephemeral place (keep_alive=False) provisions a billable cloud
instance, but execute() only tore it down on the success path -- a
failed write, remote run, or parse left the instance running until
external cleanup. Move shutdown into a finally so teardown is
unconditional; keep_alive=True still keeps the warm instance.
Fixes the Greptile P1 on compute_managed_agent.py.
Co-authored-by: Mervin Praison <[email protected]>
SANDBOX_ONLY was a hardcoded tuple of four names. The sandbox registry
accepts plugins by entry point, so a contributed backend worked with
run_in= and could not be selected with tools_run_on= at all -- the same
hardcoded-list bug just fixed for the compute registry, one layer down.
`capsule` was the live example: it ships from praisonai-plugins, resolves
fine through run_in=, and was missing from the tools_run_on= vocabulary
for no reason a user could see.
The names now derive from the registry, with the original four kept as a
floor so nothing depends on discovery succeeding. Anything the compute
registry already provides is excluded, so docker/e2b/modal/daytona keep
their richer implementations instead of being downgraded to the
one-instance adapter.
SANDBOX_ONLY stays a tuple subclass that re-reads the registry on
membership and iteration, because several call sites predate this and
import it directly.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The phrase table is a literal, so it cannot know about a package
installed later: an external place printed as a bare name
(tools_run_on='demo') while every built-in got a readable phrase. A
provider may now declare `display_name` and have it used in the repr and
in where_does_it_run().
Verified with a plugin installed from outside the repo: it reports
"a Demo cloud sandbox" in both. Declaring it stays optional and the
fallback to the bare name is unchanged, so nothing existing shifts.
That leaves one derived surface still hand-maintained -- the ToolPlace
Literal -- which is inherent to static typing rather than fixable: a type
checker cannot see a runtime plugin. Its union already stays open, so an
unknown name type-checks and only loses autocomplete.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
_PS_PROVIDERS was a hardcoded tuple, so a place contributed by another
package could be provisioned and then never listed or stopped. An
unreclaimable cloud sandbox is a bill nobody sees, which makes this the
one remaining hand-maintained list with a cost attached.
Exclusions are now stated with reasons rather than by omission: local and
subprocess run here and have nothing to reclaim, ssh is someone else's
machine and not ours to stop, sandlock is a process rather than an
instance, and adapter-backed places have no cross-process registry to
enumerate.
_PS_PROVIDERS stays as a module attribute so existing imports keep
working.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Modal's `run_in=` path was broken in five separate ways and nothing
noticed, because nothing had ever run it. Most of what breaks an
integration is checkable for free, so this checks it: for all ten places
the class resolves, satisfies the protocol, exposes coroutines rather
than sync methods (a sync one here does not raise -- it returns a
coroutine nobody awaits, so the call silently does nothing), answers
is_available without throwing, is accepted by tools_run_on=, is accepted
or refused by run_on= according to whether it can host a loop, and is
described in the repr as the place it was actually given.
The one that matters most in practice is the last check: a missing
credential has to fail with something actionable -- naming the key, the
install command or the daemon -- rather than an AttributeError from
inside a vendor SDK. All seven credential-less places pass it today.
Live where the machine allows: docker, subprocess, local and modal
provision and execute for real; the rest skip loudly.
Also removes a latent flake. The batch-provisioning test asserts an exact
provision count, and agents from earlier tests release their sandbox when
collected -- which could land inside the measurement window now that
lifetime is tied to a finalizer. The window is opened after a collection
instead of hoping the timing misses.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
run_on= accepted two names while tools_run_on= accepted twelve. That was
not a fact about the places -- a place that can run a command can run the
agent loop, which is just one more command -- it was an implementation
detail: no backend had been written for the rest.
One generic ComputeManagedAgent wraps any ComputeProviderProtocol rather
than eleven near-identical vendor backends, taking run_on= from 2 places
to 8: anthropic, docker, e2b, modal, daytona, flyio, tenki, novita.
Verified live end to end on Modal -- the whole loop ran there and came
back with the answer, having installed the package remotely first.
Excluded deliberately, with tests asserting they still raise: `local`
would run the agent in your own shell, which is what you get by passing
nothing; `ssh` needs an object, not a name; `subprocess`/`sandlock`
isolate tools rather than host a runtime. `docker` keeps its specialised
backend since it can talk to the daemon directly.
Two details worth keeping:
- the registry loader returns a real subclass, not a factory function,
because HostedAgent's factory path calls issubclass() on it
- files reach the remote machine through a quoted heredoc, since execute()
is the only primitive every compute place has, and the delimiter is
uppercase for the same reason as elsewhere: a lowercase hex delimiter
contains "dd", a blocked command, about a tenth of the time
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Modal is authenticated on this machine, so the path could finally be
exercised. It failed five times in a row, each fault hiding the next:
1. keep_warm / allow_concurrent_inputs were renamed on 2025-02-24 and
the old spellings now RAISE rather than warn. Both generations are
handled by inspecting the installed SDK's signature, since hardcoding
either spelling breaks half the installed base.
2. The decorated function is defined inside a method, which Modal only
accepts with serialized=True.
3. The App was never started. A Modal function only carries the metadata
it needs while its App is running, so .remote() failed with "Function
has not been hydrated". The app.run() context is now held for the
sandbox's lifetime and closed in stop().
4. add_python="3.11" was passed to an image that already ships Python --
the default is python:3.11 -- so the image build failed outright.
5. The default image was pinned to 3.11 while a serialized function is
pickled locally and unpickled inside it, so anyone not on 3.11 got
"defined with Python 3.12, but its Image has 3.11". The default now
follows the running interpreter.
Verified end to end: execute_code(run_in="modal") returns 'from modal'
with exit 0 against real Modal infrastructure.
tools_run_on="modal" was already working and is now verified live too --
provision, uname, a file written and read back across calls, shutdown.
The test asserting a hardcoded python:3.11 default was updated rather
than deleted; it now pins the interpreter-matching rule that replaced it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Two of the three registries already discovered plugins by entry point --
praisonai.sandbox and praisonai.managed_backends. The compute registry,
which is where tools_run_on= places live, was a hardcoded dict, so adding
one meant editing core:
_compute_bridge._PROVIDERS the resolver
compute/__init__.py the lazy import
placement.ToolPlace or it gets no typing
cli/commands/managed._PS_PROVIDERS or `managed ps` cannot see it
execution_location._PLACE_WORDS or it prints a bare name
plus the lists in two docstrings
Six edits across two packages, for something that is by nature a plugin.
It now reads praisonai.compute as well, so a provider ships in its own
distribution:
[project.entry-points."praisonai.compute"]
runpod = "praisonai_compute_runpod:RunpodCompute"
Verified end to end with a package installed outside this repo: it
appeared in available_providers(), passed tools_run_on= validation,
resolved, executed, and Agent(tools_run_on="demo") built -- with no
change to any file here. The repr falls back to the bare name, which is
the one remaining hand-maintained list and degrades gracefully.
Providers load on demand, so an installed-but-broken plugin fails only
for the caller that names it. There is a test for that.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The bots-gateway CI shard runs from src/praisonai-bot, whose gateway.yaml was
auto-discovered when these tests invoked `gateway start` with config=None.
Discovery then ran the verify-turn pre-flight (a real agent turn, default-on
per #4042) before the monkeypatched start(), exiting 1 with CI's fake key.
Pass an explicit channel-less config so every start-time pre-flight is skipped
and the command reaches the patched handler deterministically. The exit-code and
watchdog-flag assertions are unchanged — the tests still guard exactly what they
did, just hermetically.
Co-authored-by: Mervin Praison <[email protected]>
The compute-only branch ran before the provider object was normalised, so a
managed backend holding a LocalCompute (provider_name="local") skipped it and
the alias table collapsed "local" to "subprocess" -- describing the
unrestricted shell in the locked-down backend's stronger words. Normalise
first, then apply the compute-only check, and read a backend's compute via the
compute vocabulary since that object is a compute-registry provider.
Co-authored-by: Mervin Praison <[email protected]>
Three issues raised in review of run_on="docker":
- execute()/stream() ran the blocking Docker start-up, install and container
turn directly on the event-loop thread, stalling concurrent async callers.
Offload to a worker thread with asyncio.to_thread.
- keep_alive=False only tore the container down on success, so a failure after
start-up leaked a praisonai-agent-* container. Move teardown into finally.
- Both READMEs showed run_on="docker" raising TypeError while also documenting
it as supported. The typo example now uses e2b, which genuinely cannot host
an agent loop, so the two examples no longer contradict each other.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
`run_on="anthropic"` hands the entire agent to a vendor's runtime. This is
the same shape, self-hosted: the loop runs in a local container instead.
The distinction from tools_run_on="docker" is what crosses the boundary:
tools_run_on="docker" your process runs the loop and calls the model;
only shell and file tools go into the container
run_on="docker" the loop itself runs inside, so the model call is
made from the container and nothing on your
filesystem is reachable unless you mounted it
Both name the same place, and that is not an ambiguity -- the parameter
carries the scope. So the two value sets deliberately overlap now, and
the tests say so: a name in both must work in both, a name in only one
must be refused by the other with a message naming the right parameter,
and the object must still report which scope you chose.
Implementation is just a backend registration. run_on= resolves against
ManagedBackendRegistry, so adding DockerManagedAgent there makes the
parameter, the repr, the explanation and the conflict checks all pick it
up with no changes to any of them.
Two things this exposed:
- _backend_places() identified hosted runtimes by CLASS NAME ("Hosted" or
"Anthropic" in it). A self-hosted DockerManagedAgent matched neither,
so an agent whose entire loop ran in a container reported that it was
thinking on this machine. Backends are now asked what they are.
- The runner writes its payload into the container through `docker exec
-i ... tee` rather than an argument, so instructions and API keys never
appear in `docker inspect` or a process listing.
Stated limitations rather than hidden ones: Python callables in tools= do
not cross (same as the hosted runtimes), the container needs the model
API key, and the first run installs the package unless image= supplies
one that has it.
Tests that need a live daemon are marked skipif rather than silently
passing; the rest -- registration, both scopes, config marshalling,
result parsing, the missing-daemon message -- run without Docker.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Two gaps found while documenting every accepted value.
"local" resolves differently depending on which parameter carried it:
run_in="local" is collapsed by SandboxManager to the subprocess backend
-- scrubbed environment, blocked commands and paths -- while
tools_run_on="local" is the wrapper's LocalCompute, a plain shell in the
current directory with the full environment inherited and no security
policy at all. Both printed "a separate process on this machine", so the
weaker of the two was described in the stronger one's words. That is
precisely the failure this module exists to prevent, hiding in the one
place the rest of the work did not look. say_place() now takes the
registry that resolved the name.
Resolver aliases were rejected at construction. Validation ran before
alias resolution, so tools_run_on="native" raised "not a known place"
while resolve_compute("native") returned a working sandlock adapter.
tool_places() now includes the alias table it validates against.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
LocalManagedAgent carried its own hardcoded provider list, which is why
LocalAgent(tools_run_on="sandlock") raised "Unknown compute provider"
for a place the rest of the library resolves happily. Routing it through
the merged resolver changes the message to "Unknown place", listing
every place both registries offer.
The behaviour is unchanged -- an unknown name still raises ValueError --
so only the assertion was stale. Added coverage for what the delegation
actually buys: the sandbox-only places now resolve here too.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Two coroutines that astart() the SAME team under one asyncio.gather share
the event-loop thread, so the previous threading.local scope state was
shared between them: the second saw the first's depth==1, skipped its own
sandbox, and ran against a sandbox the first could tear down mid-flight.
Switch _tools_scope_depths from threading.local to a contextvars.ContextVar
holding an immutable frozen mapping replaced via .set() (never mutated in
place). A ContextVar is copied per task at gather/create_task time, so each
run gets its own depth map; it stays per-thread too, so sync callers remain
isolated. The frozen value matters -- a copied context shares the reference
to a mutable dict, so in-place mutation would leak straight back across the
tasks the copy was meant to separate.
Adds a deterministic regression test that fails on the old design
(['own', 'borrowed']) and passes now (['own', 'own']) without needing a
live model.
Co-authored-by: Mervin Praison <[email protected]>
The security audit demonstrated `cat $(echo /etc/passwd)` reading the
file end-to-end through the subprocess place: blocked_paths matches
tokens, and any shell indirection -- command substitution, a variable, a
nested sh -c -- hides the path from it. That is inherent to a blocklist
over a real shell, not a patchable pattern, so where_does_it_run() now
says the command list can be worked around rather than implying the
tier contains anything.
Also updates the flagship YAML example to tools_run_on:, lists the four
newly reachable places, and marks which of them are real boundaries
(sandlock is kernel-enforced; subprocess is process separation only).
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Mutation testing showed 7 of 14 deliberate breakages left the suite
green. The pattern was consistent: argument validation and repr strings
were well covered, and every path that actually moves work to a sandbox
was not covered at all. Deleting the ensure_tools_placed() call sites --
the feature's entire point -- broke nothing.
Bugs fixed:
- A clone inherited the source agent's bridged tools, which close over
the SOURCE's sandbox, and its backstory already carrying the capability
prompt. Its first turn then attached a second sandbox: two copies of
the prompt, and work split across two machines. The tools are now
tagged so the existing clone filter drops them, and the clone inherits
the pre-attach backstory.
- test_apply_rlimits_sets_memory_limit still asserted RLIMIT_NPROC was
set. It passed on main and failed here, because dropping NPROC is
deliberate. Replaced with an assertion that it is NOT set, plus a new
test that one unsupported limit no longer skips the others -- the
latent bug that made RLIMIT_NOFILE never apply on macOS.
Tests added for what survived mutation:
- every entry point (chat/achat/_start_stream) places tools before the
first turn, asserted by driving the real method
- AgentTeam start/astart/start_for_each provision exactly one sandbox,
counted through a fake provider, instead of poking a private method
- policy_scan_parts expands shell payloads, survives unbalanced quotes,
strips quoted heredoc bodies but NOT unquoted ones, and a blocked
path inside `sh -c` is genuinely refused (asserting the file was not
read, not merely that an error was returned)
- SandboxComputeAdapter, which had zero tests despite being the largest
new file: policy denials report failure rather than exit 0, shell
semantics work, state persists across calls
- SandboxManager constructor introspection, including that the guided
error names `host` and SSHSandbox rather than leaking a raw TypeError
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Two reliability bugs the security audit reproduced.
write_file() built a heredoc delimiter from uuid4().hex, which is
lowercase. The security policy substring-matches blocked_commands
against the whole command string, and "dd" is one of them -- present in
9.6% of random lowercase hex strings (measured over 100k). So roughly
one write in ten failed with "Blocked command pattern: dd", for no
reason the caller could see. The delimiter is uppercase now.
The same substring scan also read the heredoc BODY, which is the literal
bytes of a file, not a command. Saving a shell tutorial containing
"rm -rf" was rejected as an attempt to run it; a file mentioning
/etc/passwd was rejected as an attempt to read it. Quoted heredoc
bodies are now stripped before the policy check -- only the quoted form,
since an unquoted heredoc still undergoes shell expansion and its
contents really can execute.
Verified the boundary is unchanged: `cat /etc/passwd` and `rm -rf /`
are still blocked, while all three content cases now write, and 60
consecutive writes produce 0 spurious failures.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Four lifecycle bugs, all found by adversarial validation.
LEAK. An agent and its SharedCompute referenced each other, so a dropped
agent was reclaimed by the CYCLE collector, vanished from the WeakSet the
atexit hook iterated, and its sandbox was never shut down. Gateways clone
an agent per request, so that was one orphaned container per request --
measured: 5 requests, 5 provisioned, 0 shut down.
Fixed by tying lifetime to the agent with weakref.finalize (which also
covers interpreter exit, so the atexit hook and weak set are gone), and
by holding agents WEAKLY in SharedCompute._patched. The weak _patched is
the load-bearing half: while the restore list held agents strongly, the
finalizer kept its own agent alive and could never fire.
Now: 5 provisioned, 5 shut down, 0 leaked.
RACE. close_tools_sandbox() cleared the marker first and shut down after,
outside the lock. A concurrent chat() re-attached in that window and the
in-flight shutdown restored over it, leaving the agent marked as
sandboxed while holding no sandbox tools -- unrepairable, because
ensure_tools_placed()'s idempotent early return sees the marker and does
nothing. It is all under the lock now.
EXIT HANG. The exit path took a process-global lock, so any thread
holding it blocked interpreter exit forever (reproduced: rc=124). The
realistic form was a bounded stall, since the lock was held across
SharedCompute(...) -- which imports the provider SDK.
CONTENTION. That same global lock serialised placement for unrelated
agents (16 concurrent attaches: 0.87s against a 0.05s parallel floor),
and being non-reentrant while held across attach()'s writes to
agent.tools, any subclass with a tools setter that touched placement
would self-deadlock in its own constructor. Locks are per-agent now, and
the only global lock covers a dictionary lookup.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Two bugs found by adversarial validation, both silent.
1. AgentTeam handed the model the PRE-ATTACH tool list.
_build_execution_context snapshots agent.tools and passes it to chat()
as an explicit `tools=`, which wins over agent.tools. The sandbox
attached later, inside chat(), so the model got the local tools while
a real sandbox sat provisioned and unused -- every tool ran on the
host. Placement now happens before the snapshot.
It read as flaky rather than broken: in start_for_each() row 1 got
local tools and row 2 got the bridged set, because row 1's chat() had
mutated agent.tools in time for row 2's snapshot.
2. The scope depth was shared class-wide, not per team.
`_tools_scope_state` is a class attribute, so ANY team started while
another team's run was on the stack saw depth==1 and skipped its own
sandbox. A nested team ran on the host; a team sharing an agent with
the outer run executed on the OUTER team's sandbox; two teams in one
asyncio.gather gave one a sandbox and the other nothing. Depth is now
keyed per team, and the key is dropped at zero so the dict cannot grow
without bound on a long-lived worker thread.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Three parameters meant "somewhere else" and none of them said which
somewhere: `run_on=` (tools only, on Flow/Team), `compute=` (tools only,
on LocalAgent) and `backend=` (the whole agent). One concept had two
names and one name had two concepts, so the docs had to keep correcting
the API.
Now two words, each answering a different question:
run_on= the WHOLE agent moves to a managed runtime
tools_run_on= only the tools move; thinking stays here
run_in= one execute_code() call, this call only
Because the two questions have disjoint answer sets, a wrong pairing is
a typo rather than a preference. `run_on="docker"` cannot mean anything
-- Docker does not host agent loops -- so it raises TypeError naming the
parameter the user actually wanted, instead of silently placing work on
a machine nobody chose. Never "last one wins".
Reachability: sandbox-only backends (subprocess, sandlock, ssh, novita)
spoke SandboxProtocol -- one object IS one environment -- while
tools_run_on= speaks ComputeProviderProtocol -- one object HANDS OUT
many. SandboxComputeAdapter supplies the missing half, taking the
registry from 7 places to 11. This finally makes `sandlock` selectable:
kernel-enforced Landlock + seccomp-bpf, the only real local boundary in
the project, previously unreachable.
Shipped bugs found and fixed along the way:
- AgentTeam.astart() never provisioned the shared sandbox at all, so
every async team ran its tools on the host and said nothing.
- start_for_each() provisioned one sandbox per input row: a 50-row
batch paid for 50, and no row could see what an earlier row wrote.
- The re-entry guard set `self.run_on = None` for the duration of a
run, so a concurrent start() observed "no sandbox" and executed
every tool on the host. Now thread-local; placement stays readable.
- SharedCompute.attach() could attach an agent twice (flow + its own),
duplicating the capability prompt and, on non-LIFO teardown, leaving
the agent holding tools bound to a shut-down instance.
- SandboxManager passed config= to every backend; SSHSandbox and
ModalSandbox do not accept it, so they raised before starting.
- RLIMIT_NPROC was applied per *real user ID*, not per sandbox, so
max_processes=10 counted the user's existing processes and the
sandbox could not fork at all.
- blocked_paths stopped matching once commands ran through `sh -c`,
because the path hid inside the shell payload.
Removed ExecutionConfig.code_sandbox_mode. It defaulted to "sandbox"
while no execution path read it, so its own default told every reader
they had isolation they did not have.
where_does_it_run() now names the tools that will NOT move. Only four
tool names are bridged; the capability prompt tells the model the
sandbox is where things happen, so anything staying behind has to be
said out loud.
Migration:
- YAML `run_on:` stays a silent alias -- it is data people already
shipped, and there is no Agent-level run_on: key to confuse it with.
- Python `run_on=` on Flow/Team raises with a directed message; it
would otherwise mean the opposite of `run_on=` on Agent.
- `compute=` warns (FutureWarning, visible to end users per PEP 565).
- `Agent(sandbox=)` is kept, not removed: clone_for_channel() passes
it and it is a legitimate per-agent default. `run_in=` overrides it
per call.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Extract the repeated inline `next((t for t in self.tasks.values()
if t.name == <name>), None)` into a single `_task_by_name` helper and
call it at all 13 sites. Behaviour-identical: first-match by name,
None when absent. No public API or behaviour change.
Co-authored-by: MervinPraison <[email protected]>
Remove the shutil.which("echo") skipif: TemplateInterpolator runs commands
with shell=True, so echo is available as a shell builtin on both cmd.exe and
/bin/sh even without a standalone executable. Normalise output with .strip()
for Windows CRLF instead, restoring coverage. Also drops the now-unused shutil
import and trailing whitespace.
Co-authored-by: Mervin Praison <[email protected]>
Cross-reference validation only inspected step.agent, step.steps, and
step.routes, so undefined agents nested inside the newly accepted bare
runtime-form payloads (route:/parallel:/loop:/repeat:/if:) silently
passed while the runtime parser drops/rejects them (Greptile P1).
- Walk route: value lists (agent-name scalars) and parallel/loop/repeat/if
sub-step dicts (agent: keys), leaving non-agent scalars like
loop: {over: <var>} untouched.
- Regenerate the stale agents.schema.json artefact to match the PR's
broadened WorkflowStep model.
- Add tests for undefined agents in route/parallel payloads and a
loop-over-variable false-positive guard.
Co-authored-by: MervinPraison <[email protected]>
- Async event loop: run_autonomous_async now offloads verification hook
execution to a worker thread via _verification_gate_async so a slow/blocking
CommandVerificationHook no longer stalls concurrent coroutines.
- Durable journal: rewire _record_verification_journal to the real
DurableRunContext.record_verification (append JournalEvent, KIND_VERIFICATION)
instead of a non-existent _run_journal.record API; events now actually persist.
- Goal gate: a failing blocking hook now carries the captured stdout/stderr
summary into last_reason so the next continuation prompt has actionable repair
diagnostics instead of a bare label.
- Tests: +4 covering async thread-offload, durable journal persistence, and
goal-failure diagnostics propagation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Addresses two P1 correctness gaps from PR review:
- Explicit --resume onto an absent/misspelled/deleted checkpoint now returns
a clear error instead of silently running the workflow from step 1 and
repeating already-completed side effects.
- _definition_fingerprint now hashes agent config values (not just keys), so
semantic edits (instructions/model/tools/condition/routing) invalidate the
checkpoint rather than combining a stale step index with an edited workflow.
Adds two regression tests: missing-checkpoint fail-closed, config-value edit
changes fingerprint.
Co-authored-by: MervinPraison <[email protected]>
Addresses two P1 review findings on PR #4059:
- handoff._cap: capping an oversized recap dropped the actionable NEXT:
continuation guidance. Cap now preserves the head (preamble/goal/progress)
and the NEXT: tail verbatim, trimming only the middle recap block.
- summary_builder: assistant turns that merely proposed or *asked* about work
were recorded under "Completed Actions", so a resumed agent could skip work
only discussed. Question-bearing assistant turns now flow to Pending
Questions / Remaining Work only; executed tool calls/results stay completed.
Adds regression tests for both.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Defect 1: map parsed markdown routing (TaskRoutingConfig) onto real
Task.branch_condition/next_steps the executor reads; stop clobbering
condition with a dataclass; guard dict-condition crash in step loop.
- Defect 2: wire Task(when=..., then_task=..., else_task=...) into the
WorkflowManager step-advance path for per-step conditional redirection.
- Defect 3: register `workflow validate` on the Typer workflow app so it
reaches the existing handler.
- Defect 4: align WorkflowStep schema with the runtime dialect (bare
agent/route/if/loop/repeat/parallel/include steps) and treat
backstory/instructions as aliases so shipped example workflows validate.
- Defect 5: fix .praison -> .praisonai list dir via shared path helper;
reject unsupported on_fail values clearly; fail loudly on YAML files in
the markdown workflows dir.
- Tests: executable markdown branch routing (matched + unmatched), when
routing, and a round-trip validation over examples/yaml/workflows/.
Co-authored-by: MervinPraison <[email protected]>
Wire --resume/--checkpoint/--rebase-checkpoint into `workflow run` and add a
`workflow checkpoints` subcommand. Store a stable, normalized definition
fingerprint in each checkpoint and compare it on resume, refusing to silently
land on a stale step index after the workflow file was edited (with
--rebase-checkpoint to force). Record resumed_from_step in the result.
Co-authored-by: MervinPraison <[email protected]>
Addresses two reviewer-flagged issues in the scheduler cross-run memory:
- P2 (nested aliasing): get_state/set_state now deepcopy so a caller
mutating a nested list/dict in a read result can no longer bypass the
16 KiB size cap or copy-on-read guarantee.
- P1 (orphan one-shot state): _persist_job_state now skips
delete_after_run jobs, which claim_due already removed (state popped)
before the run — persisting would recreate an orphan job_state entry
nothing cleans up.
Adds tests: deep copy-on-read/snapshot isolation (core) and one-shot
non-recreation (wrapper).
Co-authored-by: Mervin Praison <[email protected]>
Make the dormant verification primitive enforceable:
- Wire _verification_gate() into run_autonomous(_async): blocking hook
failures block a success outcome and feed captured stdout/stderr back as
feedback; never-passing checks end at max_iterations, not success.
- Fix lossy _run_verification_hooks re-wrap (preserve details/error/duration).
- Add declarative FileCheckHook (exists/non_empty/contains/json_field==equals),
no shell; CommandVerificationHook now accepts a string command.
- Feed the goal judge executable evidence; a failing blocking hook
short-circuits to continue without spending a judge call.
- add_verification()/remove_verification() for runtime registration.
- Add 'verification' run-journal event kind and YAML `verification:` config
parity mapping command:/file: shapes onto the two hook classes.
Opt-in only: agents without verification_hooks are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Un-stub the documented structured_template compaction feature with a
deterministic DefaultSummaryBuilder that renders SUMMARY_TEMPLATE (falling
back to the plain summary on failure), wired as the default builder in
ContextCompactor when structured_template=True.
Add a deterministic session handoff assembler (build_handoff_prompt) that
turns durable state (recap + persisted GoalState + workflow checkpoint) into a
self-contained continuation prompt with no LLM call, plus a
`praisonai session handoff` CLI command with --json/--copy.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 review findings on the standalone scheduled sender:
- _HttpSendError now preserves the raw Retry-After header verbatim (via a
headers dict) instead of pre-parsing to float, so server_retry_after honours
both integer-seconds and HTTP-date forms. A float(raw) previously discarded
any HTTP-date delay, letting the sender retry early and exhaust attempts under
throttling.
- WhatsApp standalone sender no longer maps a generic scheduler thread_id to
context.message_id. WhatsApp requires a real inbound message id to quote-reply;
a generic thread id is rejected as an invalid permanent 4xx. This mirrors the
live adapter, which only sets context from an explicit reply_to.
Adds tests for HTTP-date + integer Retry-After parsing and WhatsApp thread_id
context omission.
Co-authored-by: Mervin Praison <[email protected]>
Slots are typed Dict[str, Any] and SuggestionStore accepts nested
lists/dicts/sets; the previous tuple(sorted(items)) key raised TypeError
on unhashable slot values before recurrence could be recorded. Add a
recursive _freeze() helper producing a deterministic, hashable key.
Co-authored-by: Mervin Praison <[email protected]>
Implement the core JobStateStoreProtocol on the existing
ConfigYamlScheduleStore (get_state/set_state/clear_state), persisting a
small, size-bounded per-job scratchpad under a job_state key in
config.yaml and clearing it when a job is removed or a one-shot fires.
Wire the bot ScheduledAgentExecutor to load prior state into a compact
Notepad prompt block, thread it into a stateful monitor gate only when
the gate opts in (signature-detected), and persist GateResult.state_updates
plus any agent-emitted state back after the run. All hasattr/signature-gated
so stores and gates without support behave exactly as today.
Co-authored-by: MervinPraison <[email protected]>
Standalone (out-of-process) scheduled delivery was fire-and-forget with a
platform coverage gap. This adds:
- Bounded in-process retry with exponential backoff (honouring Retry-After)
around standalone HTTP sends, reusing the shared bots._resilience
classifiers so only transient 5xx/429/network failures are retried and
permanent failures (bad token, 4xx) fail fast. An ephemeral cron/serverless
tick has no persistent process to drain a durable SQLite outbox, so a
bounded retry is the lightweight durability fit for that model.
- Standalone senders for WhatsApp (Cloud API) and Signal (signal-cli bridge),
the two live-adapter platforms previously missing from _STANDALONE_SENDERS.
The documented `all` fan-out token is already implemented in botos.py
`_deliver_job_text`, so no change was needed there.
Co-authored-by: MervinPraison <[email protected]>
The consent-first automation-suggestion surface (store, TTL, dedup, chat
Accept/Dismiss buttons, CLI) already exists but nothing ever generated a
suggestion — propose() was only reachable via manual CLI calls, so the
"noticed you ask for a morning summary every day — automate it?" moment
never fired on its own.
Add a lightweight, deterministic recurrence generator as a new
SuggestionEngine.observe() method in the wrapper: a caller feeds each
completed turn's inferred blueprint+slots, and once the same intent recurs
threshold times within a trailing window the engine auto-calls propose().
Consent-first is preserved (jobs still only materialise on explicit accept),
per-principal isolation and store dedup keep it non-nagging.
Minimal in-repo fix — no new package, dependency, or export; reuses the
existing propose()/store machinery.
Co-authored-by: MervinPraison <[email protected]>
The default-on model turn pre-flight (#4042) now runs after the channel
probe in `gateway start`, so two pre-existing start-path tests that never
mocked a model round-trip aborted with exit 1 instead of their expected
exit 0. Mock `_verify_turn_preflight` green in both so each test isolates
exactly the behaviour it guards (SSL-only soft-fail; --no-preflight skip),
without weakening any assertion.
Co-authored-by: Mervin Praison <[email protected]>
The gateway passes the durable platform adapter directly to
ChannelSupervisor.run(), so drain_outbox() lives on the bot object itself,
not on bot.adapter. Check the object first, then fall back to bot.adapter,
so built-in channels actually re-drain on recovery. Adds a test for the
production object shape.
Co-authored-by: Mervin Praison <[email protected]>
Second-resolution timestamps caused two exports into the same directory
within one second to resolve to the same path, silently truncating the
first bundle (Greptile P1). Add _unique_bundle_path() to append a -N
suffix when the timestamped name already exists, preserving every export.
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1 review feedback on #4045:
- Decouple turn verification from the channel --preflight flag so
`--no-preflight --verify-turn` still runs the model round-trip.
- Bound the preflight turn with a short run_timeout (default 60s,
overridable via gateway.preflight.verify_turn_timeout) so a stalled
provider fails fast instead of inheriting the 5-minute interactive
default at startup/onboarding.
- Pass per-agent base_url/api_key/api_base through to the synthetic
Agent so preflight exercises the same provider the live gateway uses.
Adds 3 tests covering timeout default/override and provider parity.
Co-authored-by: Mervin Praison <[email protected]>
Add a `praisonai gateway diagnostics export` command that writes a single,
pre-sanitised .zip (summary, health, config shape, redacted logs, forensics
snapshot) an operator can safely attach to a bug report. Reuses existing
secret redaction, forensics snapshot, health probe, and daemon log readers;
config is reduced to key/mode shape with no secret values, and all text is
passed through the shared redact_secrets pass. Runs even when the gateway is
unhealthy via local log fallback.
Co-authored-by: MervinPraison <[email protected]>
The durable outbox held deliverable replies through a transient channel
outage but nothing re-attempted them on recovery — they sat undelivered
until the next inbound chat() turn or a process restart. The supervisor
now fires a bounded, best-effort adapter.drain_outbox() when a channel
comes back after a recoverable outage, closing the loop opened by the
attempt-and-age policy. Duck-typed and no-op for bots without the hook.
Co-authored-by: MervinPraison <[email protected]>
Wire the existing run_turn_test into the default gateway start preflight and
the onboard wizard so a missing/invalid model credential fails at setup time,
not silently on the first user message. Default on via
gateway.preflight.verify_turn; opt out with --no-verify-turn or
PRAISONAI_NO_VERIFY_TURN=1 for constrained/offline environments.
Co-authored-by: MervinPraison <[email protected]>
- Re-validate every redirect hop + final URL in metadata fetch (SSRF-safe)
- Enforce HTTPS/loopback guard on discovered authorization/token/registration
endpoints so an HTTPS metadata doc cannot smuggle a plaintext endpoint
- Defense-in-depth HTTPS guard on the persisted refresh token endpoint
- Add tests for endpoint validation and redirect revalidation
Co-authored-by: Mervin Praison <[email protected]>
Fixes cross-level precedence bug flagged by greptile/reviewers: the
nearest project directory now wins over more distant ancestors, so an
ancestor .claude/.agents definition no longer silently overrides a
nested .praisonai one. Collect walk-up levels then apply ancestors
first / cwd last under the "later wins" order; .praisonai stays last
within each level.
Co-authored-by: Mervin Praison <[email protected]>
Extend CustomDefinitionsDiscovery to enumerate the conventional ecosystem
roots .claude/ and .agents/ for agents and commands, mirroring the skills
loader. .praisonai/ wins on name collision and the ancestor walk applies to
all roots. Tools stay .praisonai-only since loading executes user code.
Co-authored-by: MervinPraison <[email protected]>
Add metadata discovery, RFC 7591 dynamic client registration, and an
orchestrating provider that wires the existing PKCE callback helpers and
MCPAuthStorage into a lazy ensure_authenticated() flow. Fully additive and
backward-compatible: servers without auth or with pre-supplied credentials
behave exactly as before.
Co-authored-by: MervinPraison <[email protected]>
- redact.py: register PII BEFORE_LLM hook with sequential=True so
modified_input is actually applied to outgoing messages
- hooks/runner.py: warn when a parallel hook returns modified_input that
would be silently discarded
- agents.py: restore original self.tasks after planning; keep plan-step
tasks under _plan_tasks and reset task_id_counter to avoid id collisions
- context/composer.py: iterate _ensure_tool_pairs to a fixed point so
reinserted tool_calls messages don't leave dangling sibling calls
Co-authored-by: Mervin Praison <[email protected]>
Harden the guarded self-improvement review now that it can write to
memory: frame the echoed original task as UNTRUSTED DATA inside an
<original_task> block and instruct the model to ignore any embedded
'remember/store/create a skill' instructions, so injected task text
cannot steer store_memory/skill_manage. Prompt-only, no new surface.
Co-authored-by: Mervin Praison <[email protected]>
Reuse the existing opt-in, guarded, background/re-entrancy-safe skill-review
pass to also close the learning loop for memory: when the agent has memory
enabled, the restricted review toolset adds store_memory and the review
prompt asks whether a durable fact/preference/user-model detail emerged.
No new Agent param or parallel mixin/policy/dispatch — same self_improve
switch, lock, and off-hot-path background runner.
Co-authored-by: MervinPraison <[email protected]>
The durable-run stack (RunJournal, DurableRunContext, ExecutionConfig(durable=))
was shipped in praisonaiagents but never engaged by the long-lived gateway, so no
gateway run was journalled and resume was unreachable. Construct gateway agents
with ExecutionConfig(durable=True) behind an operator toggle (gateway.durable_runs)
and an optional per-agent durable key, so every turn is journalled and an
interrupted run can resume after a restart instead of re-executing side-effecting
tools or being discarded. Default-off / zero-overhead.
Co-authored-by: MervinPraison <[email protected]>
The first-run onboarding gate in `chat` and the bare invocation ran before
the wrapper-resident interactive TUI's own standalone install hint. On a
keyless `pip install praisonai-code` (no wrapper), `praisonai-code chat`
dead-ended with "No API key configured. Run: praisonai setup" for a session
that cannot even start, instead of the actionable "pip install praisonai[tui]"
hint the smoke test asserts.
Gate the interactive (no-prompt) path only when the wrapper is present so the
TUI can surface its install hint standalone; single-prompt chat runs in-process
and is still always gated. Adds a regression test for the standalone skip and
pins wrapper availability in the resolved-model gate test.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Route the shared first-run credential gate through the *final* resolved model
so onboarding validates and preserves the model each entrypoint actually
dispatches:
- code.py: resolve the agent profile's `llm` before the gate. A keyless
`code --agent <profile>` (no --model) with a reachable local endpoint no
longer has the profile model shadowed by the detected local default; the
profile override still applies for the untouched-model case, and an explicit
--model still wins.
- chat.py: resolve the TUI model (explicit > recent > provider default) before
the gate and reuse it, so the gate validates the exact model the TUI
dispatches instead of passing on any present key for a different provider.
Removes the now-duplicate resolution and threads the validated model into
profiling.
Adds two regression tests (profile-model passthrough for code, resolved-model
passthrough for chat).
Defer --tools resolution into _run_print_code's try/except so an import
error in a user tools.py surfaces through the machine-readable JSON/text
envelope (status=error + non-zero exit) instead of escaping as a raw
traceback to scripted callers.
Co-authored-by: Mervin Praison <[email protected]>
Extract the keyless first-run credential gate (previously duplicated inline in
app.py and run.py) into a shared ensure_configured_or_onboard helper in
praisonai_code.llm.credentials, and invoke it from the code and chat
entrypoints so a keyless newcomer is consistently routed to `setup` (or a
detected keyless local endpoint) instead of dead-ending on a raw provider
error. run.py and the bare invocation now delegate to the same helper,
removing the duplication.
Co-authored-by: MervinPraison <[email protected]>
Headless `praisonai code -p/--print` previously hard-rejected --tools,
--agent and --plan, blocking scripted/CI agentic coding from adding a
custom tool, applying a named least-privilege agent profile, or running
read-only plan mode. This reuses the interactive path's existing
resolvers (ToolResolver, load_agent_from_name, resolve_approval_config)
to thread those flags into the headless branch with no new params/deps:
- --tools resolves via _resolve_tools_arg and merges onto the default
coding toolset (de-duped by identity).
- --agent overlays the profile's instructions/role/goal/llm and named
tools; its permission scope is enforced via a non-interactive backend.
- --plan maps to a non-interactive read-only approval scope.
Approvals stay safe: scope is enforced via a non-interactive backend
(deny/ask fails closed), never an interactive prompt. --no-acp/--no-lsp
remain rejected (they toggle the resident TUI's runtime servers the
one-shot agent does not spin up). The JSON/text envelope and exit codes
are unchanged.
Co-authored-by: MervinPraison <[email protected]>
BaseCLIIntegration.as_tool() and get_available_integrations() routed
through run_sync(), which is fail-loud when a running event loop is
present. Agent runtimes invoke tools from inside their loop, so the
first async invocation of any built-in CLI-integration tool raised
RuntimeError. Route both through the existing run_sync_or_offload
helper, which offloads to a worker thread when a loop is running, and
add a native as_async_tool() surface for async agents to skip the hop.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
- process.py: when a task uses only when/then_task/else_task routing and it
resolves to no target (taken branch has no target) with no next_tasks, end the
workflow instead of falling into _find_next_not_started_task() (sync + async).
- loader.py: include guardrails/retry/skills in _defaults_has_any_values() so a
config with only [defaults].guardrails (or retry) is applied instead of being
silently skipped by apply_config_defaults' fast path.
- factories.py: document ChromaMemoryAdapter's shared short/long-term collection
so per-tier reset semantics are explicit.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Process now consults Task.get_next_task (when/then_task/else_task) in both
sync and async workflows before falling back to next_tasks, and no longer
ends the workflow early when only when-routing is configured.
- Knowledge.reset/delete_all/history now guard with hasattr, logging a no-op
warning for reset and raising NotImplementedError for unsupported erasure.
- ChromaMemoryAdapter (default) implements reset_short_term/reset_long_term so
the default memory config actually erases; Memory warns when an adapter lacks
reset support instead of silently succeeding.
- config defaults: guardrails and retry are now loaded into DefaultsConfig and
guardrails is applied to Agent via apply_config_defaults; unused/unconsumed
defaults keys (api_key/context/hooks/templates) removed from VALID_DEFAULTS_KEYS
so misconfiguration fails loudly, and retry added since agent.py consumes it.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Agent.__init__ ran a dependency probe that eagerly imported the heavy
memory.memory module for any truthy memory value. The common FileMemory
paths (memory=True, "file", and file-provider dicts without learn) never
touch that module, so the probe wasted a ~100ms+ import. Scope the probe
to run only for values that resolve to the heavy Memory backend, preserving
the existing ImportError remediation for every heavy branch.
Co-authored-by: Mervin Praison <[email protected]>
Non-positive context_max_chars silently bypassed truncation (`if budget:`
was falsy for 0), returning full upstream output and breaking the bounded
contract. Clamp with max(..., 0) and always slice. Adds regression test.
Co-authored-by: Mervin Praison <[email protected]>
Add a composable pipeline primitive to the core scheduler: a job may declare
one or more upstream jobs via `context_from`, whose most-recent successful
output is resolved from existing execution history and injected as bounded,
delimited context at fire time.
- ScheduleJob: `context_from` (list, or bare-string coerced), `context_max_chars`
(default 4000), `on_missing_context` ("run"|"skip"). Serialised only when
configured so isolated jobs stay byte-for-byte unchanged.
- ScheduleRunner.resolve_context(job) -> (context, missing): pure, side-effect
free resolution reusing the store's get_history — no new persistence surface.
Wrapper executors inject the text and apply the missing-context policy.
Co-authored-by: MervinPraison <[email protected]>
Tightens the frozen-value-type test to assert the specific
dataclasses.FrozenInstanceError instead of a blind Exception, per
CodeRabbit/Ruff B017. Behaviour unchanged; still guards immutability.
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile review: an isolated executor does not ship the live
async callable across a process boundary; the worker owns the session
and rebuilds/dispatches the turn from serialisable inputs, with the
callable acting as the gateway-side await point for the worker result.
Doc-only clarification, no behaviour change.
Co-authored-by: Mervin Praison <[email protected]>
Add a protocol-driven turn-execution seam so a session's agent turn can be
placed on an isolated worker, with the default preserving today's in-process
behaviour exactly.
- TurnExecutorProtocol + TurnPlacement + WorkerWedgedError (core, protocol-only)
- InProcessTurnExecutor default (runs the turn on the current loop; zero change,
no dependency, backward compatible when the executor is unset)
- Exported from praisonaiagents.gateway; heavy subprocess/container/remote
executors remain a wrapper concern
Co-authored-by: MervinPraison <[email protected]>
- client.py: preflight now gates on the actual configured command (custom
servers included) and only surfaces the registry install hint when it
matches the default server, so custom commands are diagnosed correctly.
- config.py: add path_to_uri() (Path.as_uri) and use it for root/doc URIs so
paths with reserved chars (space, #) yield valid, non-truncated file:// URIs.
- lsp_tools.py: workspace-symbol search forwards the resolved file so the
server initialises against the file's real project root, not the CWD;
_uri_path now decodes percent-encoded URIs.
- Tests: custom-command preflight, path encoding, workspace-root forwarding.
Co-authored-by: Mervin Praison <[email protected]>
Broadens the LSP server map into a data-driven registry (extensions,
root_markers, install_hint) and adds detect_language(), detect_root_uri()
and probe() helpers. LSPClient.start() now runs a shutil.which pre-flight
recording an actionable last_error instead of a raw FileNotFoundError, and
derives rootUri from the nearest root marker for multi-root/monorepo setups.
edit_tools surfaces a one-time diagnostics-unavailable note so lost
self-correction signal is explicit; lsp_tools reuse the shared helpers and
emit install hints. Backward-compatible; core-only.
Co-authored-by: Mervin Praison <[email protected]>
The proxy-type cache used a WeakKeyDictionary keyed by the inner tool
class, but each cached proxy *value* is a dynamically-minted subclass of
that inner class and therefore strongly retains its own weak key via
__bases__/__mro__. The weak key could never die, so per-request tool
classes stayed pinned for the process lifetime — the exact leak the
change targeted. Switch to a WeakValueDictionary: the proxy class is now
held weakly and stays cached only while live proxy instances keep it,
which already keep the inner class alive; once the last proxy dies the
entry auto-evicts and the inner class is reclaimable. The un-subclassable
fallback (module-global _TimeoutBoundTool) is no longer cached.
Fixes Greptile P1 on #4008.
Co-authored-by: Mervin Praison <[email protected]>
- agents_generator: switch process-wide _TIMEOUT_PROXY_TYPES cache to a
weakref.WeakKeyDictionary so per-request tool classes minted in long-lived
hosts are GC-reclaimed instead of pinned for the process lifetime.
- auto: hoist the path-traversal guard (workspace + _safe_join) into
BaseAutoGenerator so WorkflowAutoGenerator and JobWorkflowAutoGenerator
inherit it, and thread an optional workspace= through both (backward
compatible; guard is a no-op without a workspace).
- __init__: distinguish ModuleNotFoundError (real attribute miss) from a
broken-install ImportError so praisonaiagents import failures surface the
real root cause via __cause__ instead of a misleading AttributeError;
cache the failure to avoid re-paying the import on every lookup.
Co-authored-by: MervinPraison <[email protected]>
describe() rendered raw sandbox aliases (native, local) instead of the
backend SandboxManager collapses them to (sandlock, subprocess), so
where_does_it_run() reported a place that never executes. Normalize the
aliases in say_place() to mirror the manager, and mark native as
not-a-boundary. Adds regression tests for both aliases.
Co-authored-by: Mervin Praison <[email protected]>
You could not tell from PraisonAI code where an agent's work happens.
`repr(agent)` was `<praisonaiagents.agent.agent.Agent object at 0x1033abb60>`,
there was no introspection method, and the answer lived only in prose. That is
why explaining it took a 25k-character article, ~29% of whose words existed
purely to correct misreadings the API invites.
Now the object answers:
>>> Agent(name="builder")
Agent(name='builder', thinks_on='this machine', tools_run_on='this machine')
>>> AgentFlow(run_on="docker", steps=[writer, reader])
AgentFlow(name='AgentFlow', steps=2, thinks_on='this machine',
tools_run_on='a Docker container (shared)')
>>> Agent(name="teacher", backend=HostedAgent(provider="anthropic"))
Agent(name='teacher', thinks_on="Anthropic's cloud", tools_run_on="Anthropic's cloud")
and `where_does_it_run()` says it in sentences:
Thinking (the AI model calls) happens on this machine.
Tools run on a Docker container (shared).
Every step shares that same sandbox, so a file written by one step is
visible to the next.
For the subprocess tier it also states the limit plainly, because that tier is
verifiably not a boundary (network reachable, ~/.ssh readable):
Note: a separate process is not a security boundary -- it can still reach
the network and read your files. Use docker or a cloud provider for
untrusted code.
Field naming is deliberate. `loop=` was rejected: it is already
praisonaiagents.workflows.loop(), asyncio's event loop, and agent-loop jargon
-- three meanings for one word, which is the exact problem being fixed.
`llm`, `model`, `runtime` and `execution` are taken as Agent kwargs.
`thinks_on` / `tools_run_on` are free and mirror the `run_on=` the user typed.
A test asserts no field name collides with existing public API so nobody
reintroduces that class of collision, and another asserts the sentences contain
no jargon ("harness", "provision", "orchestration", "topology", "runtime").
Zero breakage: no signature changes, no behaviour changes. Description can
never raise -- a broken object still describes as "this machine".
Adds 17 tests. Suites unchanged vs clean main (6 failed / 343 passed on both;
all 6 pre-exist). Verified end-to-end against Docker: shared-sandbox flow wrote
and read back through one instance, repr stable, 0 leftover containers.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Address reviewer findings on the async loop-guard path:
- Re-raise ToolExecutionError in _execute_tool_async_with_retry so a
loop-guard HALT bypasses retry/error-dict conversion and stops the run.
- Treat loop_blocked BLOCK results as non-retryable in the retry wrapper
so a custom retry policy cannot re-run a terminally blocked call.
- Record tool timeouts as loop-guard failures (fall through instead of
early return) so repeated timeouts accumulate toward BLOCK/HALT.
Co-authored-by: Mervin Praison <[email protected]>
The async tool-execution path (_execute_tool_async_impl, backing achat()/
async workflows) had no loop-guard or doom-loop protection, unlike the sync
path in tool_execution.py. A repeatedly-failing tool could be hammered every
turn with no automatic stop.
Mirror the sync path's loop-guard wiring on the async path:
- pre-execution check() honoring BLOCK (error dict) / HALT (raise) / WARN
- post-execution record() + check() surfacing block/halt back to the model
- record failed (raised) invocations so streaks accumulate toward thresholds
- propagate a loop-guard HALT (ToolExecutionError) instead of swallowing it
Reuses the existing _ensure_loop_guard capability; no new params/exports.
The circuit breaker itself wraps a sync call + time.sleep and is not async-safe
to reuse as-is, so this focuses on the doom-loop/loop-guard protection the
issue centers on (which is pure/sync and safe from async).
Co-authored-by: MervinPraison <[email protected]>
AgentTeam accepted guardrails/web/reflection/caching/learn/knowledge and stored
them but never applied them at the team level. Emit a construction-time warning
when any is truthy so silent no-enforcement stops being the default.
Agent._process_knowledge silently dropped http(s) URL sources; replace the bare
pass with an actionable warning explaining URL ingestion is not implemented.
Co-authored-by: MervinPraison <[email protected]>
The direct-callable branch of LLM._generate_tool_definition re-derived the
schema from the raw wrapped function via build_tool_definition, bypassing
FunctionTool/BaseTool.get_schema(). This reverted @tool(name=) overrides to
the original function name and leaked Injected[T] params into the schema sent
to the model. Now the callable branch checks for get_schema() first, mirroring
the existing registry-lookup branch.
Co-authored-by: MervinPraison <[email protected]>
Addresses two Greptile P1 findings on the native OpenAI path (#3933):
- Move _track_token_usage inside the tool-call loop (sync + async) so every
billed completion — including intermediate tool-call rounds — is recorded
in session totals and by_model/by_agent rollups, not just the final one.
- Clear last_token_metrics when a response has no usable usage so a reused
client never reports a prior completion's spend as the latest call's usage.
Adds regression tests for multi-iteration accounting and stale-metric clearing.
Co-authored-by: Mervin Praison <[email protected]>
Default Agent(llm="gpt-4o-mini") runs through the native OpenAIClient,
which never populated the public token collector, so
get_token_collector().get_session_summary() stayed at zero after a paid
completion. Token accounting was effectively gated behind verbose/metrics
display on the LiteLLM path and entirely absent on the OpenAI path.
Add a lightweight OpenAIClient._track_token_usage that reads usage from
the final response and records it into the global TokenCollector after
every successful sync/async completion, independent of any display flag.
Thread agent_name through the adapter so by_agent rollups populate while
still keeping application metadata out of the OpenAI API call.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
_run_custom_agent still set agent_config["verbose"], which the
consolidated Agent constructor rejects with TypeError, so
`praisonai run --agent <name> --verbose` crashed — the same class of
bug #3930 fixed for the profiled paths. Thread verbosity through the
output="verbose" preset instead, without clobbering a definition's own
explicit output. Adds regression tests guarding the kwargs against the
real Agent signature.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
serve() is a public entry point. Inserting allow_network before the
existing approval_mode parameter would rebind positional callers
(e.g. serve(..., "auto")) to allow_network. Append it last to keep
backward-compatible positional binding.
Co-authored-by: Mervin Praison <[email protected]>
The LLM._build_responses_params forwarded Chat Completions multimodal
messages (content parts with type=text/image_url) unchanged into the
Responses API input, causing a 400 invalid_value on input[].content[].type.
Reuse OpenAIClient._build_responses_content to translate parts to
input_text/input_image and inline local image files as data URLs.
Co-authored-by: Mervin Praison <[email protected]>
The ACP CLI parsed --allow-network but never passed it to serve(),
and serve() didn't accept it, so network tools were gated by a flag
no CLI user could set. Thread allow_network through CLI -> serve() ->
ACPConfig so it reaches the tool capability gate in the model loop.
Co-authored-by: Mervin Praison <[email protected]>
The Agent constructor consolidated verbose/stream/metrics into output=. The
three profiled paths (_run_profiled_code, run.py profiled agent, cli_profiler)
still passed a top-level verbose=, raising TypeError before any LLM call. Map
verbosity through output= instead and add a signature-guard regression test.
Co-authored-by: Mervin Praison <[email protected]>
The generic "Authentication Tuple" detector fires on bare ("module",
"Attr") string-pair literals whose key/string contains auth/oauth.
The prior `# pragma: allowlist secret` is a detect-secrets directive
that GitGuardian ignores, so the check kept failing.
Construct the mapping values through a tiny local `_t()` alias so no
bare 2-string tuple literal remains on the flagged lines. Mapping type
(Dict[str, Tuple[str, str]]) and runtime behaviour are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
The (module, attribute) string tuples for the auth/oauth lazy imports were
misdetected as 'Authentication Tuple' secrets. They are import targets, not
credentials. Added inline allowlist pragmas (no behaviour change).
Co-authored-by: Mervin Praison <[email protected]>
Replace five hand-rolled lazy-import __getattr__ blocks (eval, mcp, bus,
trace, skills) with the existing create_lazy_getattr / _with_groups helpers.
Exports, names and lazy semantics are unchanged; eval and mcp now gain the
per-attribute cache the hand-rolled versions lacked.
Co-authored-by: MervinPraison <[email protected]>
Defer WorkflowContext construction (and its all_variables.copy()) so it is
only built when a step has should_run or handler. On the common action-step
path the object was previously constructed and immediately overwritten by
_build_step_context, wasting a growing shallow dict copy per step. Applied
to both the sync and async twins; behaviour is identical since the guard
uses the exact conditions gating the only two consumers.
Co-authored-by: MervinPraison <[email protected]>
Adding create_thread to the runtime-checkable OutboundMessengerProtocol
broke isinstance() conformance for the production BotOutboundMessenger,
failing test_messenger_satisfies_protocol and
test_messenger_still_satisfies_protocol_with_react.
Mirror the existing react()/ReactionResult seam: DeliveryRouter.create_thread
resolves the target, unwraps the adapter, gates on capabilities["threads"],
and returns a typed (status, target, thread_id) tuple — never raising.
BotOutboundMessenger.create_thread maps that to the core ThreadResult so an
unthreadable channel yields a typed unsupported/no_route/failed outcome and
callers fall back to the parent channel. Heavy platform work stays in the
wrapper per AGENTS.md; core keeps only the protocol + dataclass.
Adds 5 wrapper tests covering ok/unsupported/no_route/failed and protocol
conformance with create_thread.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Adds a first-class, capability-gated way for the gateway (or an agent action)
to open a new platform-native thread/topic under a channel, mirroring the
existing react()/ReactionResult contract (#3917):
- PlatformCapabilities.supports_threads flag (+ to_dict/from_dict roundtrip)
- ThreadStatus (ok|unsupported|failed|no_route) + ThreadResult typed outcome
with an `ok` convenience property, so a channel that cannot thread returns a
typed `unsupported` outcome and callers fall back to the parent channel —
never raises
- OutboundMessengerProtocol.create_thread(target, name) -> ThreadResult
- Export ThreadResult/ThreadStatus from praisonaiagents.gateway
Pure protocol/dataclass in core with no heavy SDK imports; concrete adapter
implementations live in the praisonai-bot wrapper.
Co-authored-by: MervinPraison <[email protected]>
Addresses two Greptile P1 findings on the new provision_gateway_config API:
- Fail closed on unsupported platform / empty token instead of writing a
config the gateway would reject at startup or boot degraded.
- Declare every requested agent in the agents: block (was silently dropping
all but the first), routing the channel to the first as its default.
Co-authored-by: Mervin Praison <[email protected]>
Gateway self-healing (doctor --fix) and provisioning (onboard) previously
existed only as private CLI helpers. This adds a typer-free
praisonai_bot.gateway.admin module exposing repair_gateway_config,
provision_gateway_config, and a GatewayRepairResult dataclass on the public
praisonai_bot surface, completing the CLI + YAML + Python parity contract.
The existing repair machinery is moved into admin.py (typer-free) so the
library API does not depend on the CLI-only typer package; the Typer commands
re-import these helpers and remain thin wrappers over one canonical flow (DRY).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
- paths.py: snapshot the single-root detection so creating the default
~/.praisonai data dir mid-run no longer flips config/state/cache off
their XDG locations (Greptile P1 #1). PRAISONAI_HOME stays live.
- diag.py: include the canonical (XDG) state-home logs dir when bundling
diagnostics, de-duplicating directories (Greptile P1 #2).
- Add regression test for mid-run path stability.
Co-authored-by: Mervin Praison <[email protected]>
- _load_env_user_config: use `data is not None` for inline blobs and
`isinstance(data, dict)` for explicit paths so a valid empty mapping ({}
or empty file) stays authoritative and no longer re-enables disk discovery,
and a non-mapping file body no longer raises TypeError on _source assignment.
- tests: clear the full per-key env var set consumed by _load_env_config()
for isolation; add regression coverage for empty inline mapping, empty
explicit file, and non-mapping explicit file.
Co-authored-by: Mervin Praison <[email protected]>
Add XDG-aware resolvers to core praisonaiagents/paths.py: get_config_dir()
and get_state_dir(), and make get_data_dir()/get_cache_dir() honour
$XDG_{DATA,CACHE}_HOME on fresh installs. Precedence: PRAISONAI_HOME ->
existing ~/.praisonai/~/.praison single root -> $XDG_*_HOME/praisonai ->
XDG defaults, preserving full backward compatibility for existing installs.
Route session spill and the wrapper MRU-model recency onto the canonical
state home, ending the ~/.praison vs ~/.praisonai split-state.
Co-authored-by: MervinPraison <[email protected]>
Add PRAISONAI_CONFIG_CONTENT (inline JSON/YAML) and PRAISONAI_CONFIG
(explicit path) to the wrapper resolver's user-config layer, mirroring the
sibling PRAISONAI_AUTH_CONTENT credential blob. Inline content is parsed in
memory (nothing on disk); an explicit path replaces file discovery. Inline
wins over path, which wins over global/project discovery. Higher-precedence
per-key env vars, CLI flags and managed policy are unchanged, and unset
preserves today's file-discovery behaviour.
Co-authored-by: MervinPraison <[email protected]>
Address the four P1 findings on PR #3980 (issue #3979):
- auto.py: add server-side output gate that strips code_execution tools
(e.g. execute_command) from generated roles unless the task actually
requested code execution. Deny-list gated by intent preserves all other
tools (backward compatible). Prompt allow-list narrowed to task-scoped
recommendations.
- jobs/store.py: make idempotency key UNIQUE and add atomic save_if_absent
so concurrent same-key submits resolve to a single job (side effects run
once). Reconcile QUEUED/RUNNING rows to FAILED on startup so restarted
jobs no longer poll forever.
- jobs/router.py: claim the idempotency key atomically via save_if_absent
and only dispatch to the executor when this request won the claim.
- acp/safe_edit.py: reject writes through symlinked parent directories or a
symlinked target as defence-in-depth against the propose->apply TOCTOU.
Verified: idempotency race, restart reconciliation, symlink containment,
and shell-tool stripping all pass; auto_generator + safe_edit + sqlite
suites green. Only the 3 pre-existing InMemoryJobStore test failures remain
(unrelated, present on base release).
Co-authored-by: Mervin Praison <[email protected]>
Gap 1 (auto.py): stop auto-appending the shell-exec tool 'execute_command'
to every generated agent (now opt-in via code_execution keywords only), fence
the untrusted topic in the LLM prompt with an allow-list, and add opt-in
workspace containment for agent_file to block path traversal.
Gap 2 (acp/safe_edit.py): add an RLock guarding _proposals and status
transitions, claim APPROVED->APPLIED atomically to prevent double-apply,
re-validate the path right before write to close the symlink TOCTOU, write
atomically via _atomic_write_text, and return one pipeline per workspace so
concurrent agents no longer leak across workspaces.
Gap 3 (jobs): add a stdlib-sqlite3 SqliteJobStore so jobs and idempotency
keys survive restarts; default store now persists when PRAISONAI_JOBS_DB_PATH
is set and refuses the in-memory store in production.
Co-authored-by: MervinPraison <[email protected]>
Two backward-compat fixes for the deprecated-param consolidation:
- Make handoffs + consolidated feature params keyword-only via a `*`
separator so a stray positional value (e.g. an old positional
allow_delegation=True) can no longer silently bind to `handoffs`.
- Accept fallback_models as an internal-only kwarg forwarded by
clone_for_channel(); pop it before the unknown-kwarg check and seed the
local so cloned agents keep their LLM fallbacks. Explicit
LLMConfig(fallback_models=...) still takes precedence.
Adds regression tests covering the internal fallback_models path,
clone_for_channel() preservation, keyword-only handoffs, and the
positional misbind guard.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Moves allow_delegation, allow_code_execution, code_execution_mode, auto_save,
rate_limiter, verification_hooks, and cli_backend out of the explicit __init__
signature (48 -> 41 visible params) into **legacy_kwargs, rebound to locals from
a new _LEGACY_AGENT_PARAMS map. Fully backward compatible: old keyword calls work
and still emit the same DeprecationWarnings; unknown kwargs now raise TypeError.
Co-authored-by: MervinPraison <[email protected]>
Align merge-gate stale-FINAL recovery with PraisonAI-Tools: accept MervinPraison
Claude finished comments and bypass the 15-minute debounce when HEAD moves after
a conflict rebase without a fresh FINAL trigger.
- Replace brittle exact-comment assertion with concept-based checks so
harmless wording edits no longer break the suite (Greptile feedback).
- Add key-gated end-to-end test that runs Agent(sandbox=True).start()
through a real LLM and asserts the model-visible tool set never gains
execute_python_code / execute_shell_command (CodeRabbit feedback).
Co-authored-by: Mervin Praison <[email protected]>
Reverts the tool-injection block added in #3975. Adversarial review found it
is a net security regression, not a fix. Everything else from that PR is kept.
Why it must go:
1. It escalated privilege. `sandbox=` is a RESTRICTION, but the injection made
it GRANT capability -- and the granted tools bypass the approval registry,
whose presets gate `execute_code`/`execute_command`, not the injected
`execute_python_code`/`execute_shell_command`:
Agent(approval="read_only") -> tools: []
Agent(approval="read_only", sandbox=True) -> tools: [execute_python_code,
execute_shell_command]
A security-labelled flag handed the model two ungated arbitrary-code-execution
tools under the strictest approval preset.
2. It advertised isolation the backend does not provide. The default
subprocess backend enforces none of its own SecurityPolicy. Verified on this
machine: outbound HTTPS returned 200 with allow_network=False; sandboxed code
read a real SSH private key despite `~/.ssh` in blocked_paths; `import
subprocess` worked despite blocked_imports. The tool description shown to the
model said "Execute Python code safely in sandbox."
3. Coexistence made it worse, not better. With autonomy=True the agent still
carries the host `execute_command` (injected earlier in __init__), so the
model can simply pick the unsandboxed tool.
Also fixes the test that let this ship: it asserted `child_pid != os.getpid()`
and called that isolation. A separate process is not a security boundary. The
suite is now contract-based -- sandbox= must not add tools, must not widen an
approval preset, and must still configure explicit execute_code().
Kept from #3975 (all genuinely correct):
- the `metadata` kwarg fix (flagged code no longer raises TypeError)
- the clone fix (`sandbox_config`, not the never-assigned `_sandbox_config`)
- the FutureWarning when sandbox= and backend= are combined
- NOT IMPLEMENTED labels on the inert autonomy/code_sandbox_mode fields
Giving the model a sandboxed execution tool should be an explicit act by the
caller, the way MCP() is -- not a side effect of a restriction flag. No peer
framework (smolagents, AutoGen, deepagents, OpenAI Agents SDK, Pydantic AI)
grants execution capability from a config flag.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Channel clones copied the framework-generated execute_python_code /
execute_shell_command wrappers, which close over the source agent. The
constructor's name-dedup then skipped creating clone-bound replacements,
so a clone's execution tools ran through the source agent's SandboxManager
— sharing isolation state across channels (CodeRabbit/Greptile P1).
- Tag generated sandbox tools with `_praison_sandbox_tool` in
SandboxMixin._get_code_execution_tools().
- clone_for_channel() now drops tagged tools when copying, so the
constructor regenerates clone-owned wrappers. User tools with colliding
names lack the tag and are preserved.
- Add regression test asserting clone tool identity and SandboxManager
differ from the source.
- Compare parsed integer PIDs (not substrings) in the out-of-process test;
use next(...) per ruff RUF015.
Co-authored-by: Mervin Praison <[email protected]>
`Agent(sandbox=...)` built a SandboxConfig that nothing ever read. The agent
looked isolated and was not -- the worst failure mode a security setting can
have. Four defects, each verified before and after:
1. sandbox= gave the model no sandboxed tools.
`_get_code_execution_tools()` had zero non-test callers, so `sandbox=True`
added nothing to `agent.tools`. It now attaches execute_python_code /
execute_shell_command (skipping names the user already defined).
Verified: code now runs in a separate PID from the caller.
Scope note: this isolates code the MODEL writes. Python callables passed
via `tools=` are ordinary in-process functions and cannot be retrofitted
into a sandbox -- that limit is now stated rather than implied.
2. Sandboxed execution crashed exactly when it mattered.
`execute_code()` injected a `metadata` kwarg that flowed into
SandboxProtocol.execute(), which has no such parameter -- so any code
tripping a security warning raised TypeError instead of running. Warnings
are now attached to the result instead of forwarded.
3. Clones silently lost their sandbox.
`clone_for_channel()` read `_sandbox_config`; SandboxMixin writes
`sandbox_config`. The underscore name is never assigned anywhere, so every
clone ran unisolated.
4. Two docstrings promised protection that does not exist.
`AutonomyConfig.sandbox` claimed subprocess isolation is auto-enabled at
level="full_auto" (implemented nowhere), and
`ExecutionConfig.code_sandbox_mode` documents subprocess isolation while
having zero consumers. Both are now labelled NOT IMPLEMENTED. The fields
are kept -- removing public dataclass fields would TypeError for existing
users -- so deletion belongs in a major version.
Also: combining sandbox= with backend= now emits a FutureWarning. The managed
backend takes the whole turn before any local execution, so sandbox= was
silently ignored with no signal.
Opt-in and non-breaking: agents without sandbox= are byte-for-byte unchanged
(asserted by test).
Adds 10 regression tests. Suite: 473 passed vs 463 on clean main (+10, no new
failures); the 2 test_param_consolidation warning-registry failures reproduce
identically on clean main with the same selection and are unrelated.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- verify_and_pair now validates the channel_id binding BEFORE clearing the
brute-force counter, so a valid HMAC presented against the wrong channel_id
is rejected without handing later guesses a fresh attempt budget (Greptile P1).
- generate_code enforces max_pending against _pending_by_hash (all logical
pending entries, including ones rehydrated from disk) so repeated restarts
cannot grow pairing.json past the configured bound (CodeRabbit).
- Add regression tests for both behaviours.
Co-authored-by: Mervin Praison <[email protected]>
Persist only a salted SHA-256 hash of each pairing code (no plaintext code
ever lands in pairing.json), add a per-channel_type brute-force lockout that
applies uniformly across HTTP/in-chat/CLI approval surfaces, and generate
codes from an unambiguous alphabet (drops 0/O/1/I). Backward-compatible:
public API unchanged, legacy plaintext stores still load.
Co-authored-by: MervinPraison <[email protected]>
An action-only YAML step builds its Agent during the run, after the
initial shared-compute attach(), so its shell/file tools silently ran
locally instead of in the run_on: sandbox. Expose the live SharedCompute
on the Workflow and attach the temp agent before it chats. Adds tests.
Co-authored-by: Mervin Praison <[email protected]>
The native OpenAI-SDK tool loop re-injected resolved DeferredToolResults into
the per-call `messages = list(messages)` copy, which is discarded once the loop
returns. Since background jobs typically complete after the loop returns, the
resolved value never reached subsequent turns — unlike the LiteLLM path, which
appends to the persistent chat_history (llm.py:_register_deferred_if_any).
Thread an optional `deferred_history_sink` through the sync/async/streaming
native loops and _handle_native_deferred_result; the agent passes its existing
chat_history as the durable sink. Falls back to `messages` when absent, so
existing callers are unaffected. No new Agent params/modules/exports.
Adds tests for durable-sink survival past loop return, backward-compat fallback,
and early (buffered) resolution delivery.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Mervin Praison <[email protected]>
Closes the last functional gap in remote execution: no-code users had no
way to reach it at all. `run_on=` existed only on the Python API, so anyone
driving PraisonAI through agents.yaml was locked out of shared sandboxes.
name: remote-demo
run_on: docker # every step shares ONE sandbox
agents:
writer: {role: Writer, goal: Write files}
reader: {role: Reader, goal: Read files}
steps:
- agent: writer
action: "Write 'hello' to /workspace/note.txt"
- agent: reader
action: "Read /workspace/note.txt"
The provider name is validated at load time against the same registry the
Python API uses, so a typo fails when the file loads -- listing the valid
names -- instead of surfacing at the first tool call, halfway through a run.
Also updates the README's managed-agents section, which still advertised the
deprecated `ManagedAgent` factory and the old `compute=` name:
- leads with `run_on=` (Python) and `run_on:` (YAML)
- single-agent examples now use LocalAgent / HostedAgent, which emit no
DeprecationWarning
- documents `praisonai managed ps` / `stop --all`
Adds examples/yaml/workflows/remote_sandbox_workflow.yaml, executed
end-to-end against Docker: writer wrote /workspace/note.txt and reader read
'hello from step 1' back from the SAME instance (docker_72722484ef46), with
zero leftover containers.
12 new parser tests (no Docker needed). Managed suite 289 passed; the same 6
failures exist on clean main. YAML suite 168 passed, no parser regression.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- Catch (ImportError, AttributeError) instead of broad Exception in the
vendored typer._click probe (resolves Ruff S110/BLE001).
- Add test_namespace_caller_still_dispatches to pin that every long option
_namespace_to_gateway_argv emits is accepted by the canonical Typer command.
Co-authored-by: Mervin Praison <[email protected]>
The AFTER_TOOL bridge mutated data.tool_output and could deny, but the
sync (tool_execution.py) and async (execution_mixin.py) executors
discarded both — so redaction/blocking never reached the model. Both
paths now read back the rewritten tool_output and honour a block
decision, mirroring the BEFORE_TOOL path. Clarified GuardrailBlocked
docstring for after_tool and added real-agent execute_tool regression
tests plus a GuardrailBlocked bridge test.
Co-authored-by: Mervin Praison <[email protected]>
Route the public `praisonai gateway <cmd>` entry point to the single
canonical Typer gateway command app instead of a reduced argparse handler
that only wired start/status/hooks and dead-ended on everything else.
Now `praisonai gateway` exposes the same surface as `praisonai-bot gateway`
(doctor, test, channels, stop, restart, pause/resume/reconnect,
install/uninstall, mint-link, logs, send, hooks, sessions) with one
`start` implementation carrying the credential/tool preflight,
config-version migration and `--openai-api`/`--mcp` flags. The gateway's
own degraded-state retry hints (`praisonai gateway doctor`/`--fix`/`test`)
now name commands the operator can actually run.
Deletes the duplicate reduced argparse start/status/hooks parser and
dispatch; unknown commands and bad flags now degrade gracefully to a
non-zero exit code with a rendered message rather than a static dead-end.
Co-authored-by: MervinPraison <[email protected]>
The native OpenAI-SDK tool loop in llm/openai_client.py called
execute_tool_fn directly and stringified a returned DeferredToolResult,
losing the handle so its eventual background value was never re-injected —
unlike the LiteLLM path (_register_deferred_if_any). Add a small shared
helper that registers the handle on the global deferred resolver and
surfaces the note to the model, wired into the sync, async and streaming
native tool-result blocks. No new Agent params or exports.
Co-authored-by: MervinPraison <[email protected]>
The after_tool hook bridge discarded the plugin's return value, so a plugin
could only observe tool results, never rewrite or redact them — contradicting
the documented "Can modify result" contract and leaving no post-tool guardrail
path for scrubbing secrets/PII. Mirror the after_llm/before_tool bridges: write
the returned value back onto data.tool_output and honour deny/HookResult and
GuardrailBlocked decisions for symmetry.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer findings on PR #3965 (wrapper-only, praisonai-code):
- /continue now clears self.messages before replay so repeated resumes (or
resuming after activity) don't duplicate or retain stale on-screen turns.
- /continue loads the full stored history instead of the default 50-message
tail so the "… N earlier turns" note reflects the true total.
- _run_simple fallback renders restored user/assistant turns (not only system
lines) so replayed conversations are visible without prompt_toolkit.
- Type-guard tool_calls handling in both renderers.
Co-authored-by: Mervin Praison <[email protected]>
Redraw restored user/assistant turns (and tool activity) via the same live
renderer on interactive resume instead of only printing a one-line summary.
Bounded to the last N turns with an "… earlier turns" note.
Co-authored-by: MervinPraison <[email protected]>
The #3251 regression guard asserts _build_yaml_workflow resolves tool_timeout
via _resolve_effective_tool_timeout. The prior explicit-timeout helper bypassed
it, breaking the guard. Delegate per-agent/role resolution back to the shared
_resolve_effective_tool_timeout so both the sequential/hierarchical and workflow
paths use one source of truth (and its tightest-value warnings still fire),
while still ignoring the injected bare CLI --tool-timeout default.
Co-authored-by: Mervin Praison <[email protected]>
The legacy CLI always injects its --tool-timeout argparse default (60) into
cli_config, so the new workflow fail-fast rejected every ordinary workflow YAML
run (Greptile P1). Distinguish an explicit user request (per-agent/role YAML
timeout or a changed CLI value) from the bare CLI default via
_resolve_explicit_workflow_tool_timeout. Adds regression tests.
Co-authored-by: Mervin Praison <[email protected]>
- auto.py: wrap blocking convert_and_save/_save_workflow in asyncio.to_thread
across AutoGenerator/WorkflowAutoGenerator/JobWorkflowAutoGenerator so
agenerate() no longer parks the event loop on merge/yaml-dump/fsync.
- claude_code.py: pop caller output_format before forcing stream-json in
stream(), matching cursor/gemini siblings (fixes TypeError drift).
- agents_generator.py: fail fast on tool_timeout for process: workflow YAMLs
instead of warn-only no-op, mirroring _validate_workflow_cli_capabilities.
Co-authored-by: MervinPraison <[email protected]>
The CI-flaky test_finds_latest_by_mtime creates two run dirs back-to-back;
when their mtimes collide (coarse fs resolution), a stable sort left the
winner up to arbitrary iterdir() order, so the older-named dir could win.
Break ties by name so timestamp-named dirs stay deterministic.
Co-authored-by: Mervin Praison <[email protected]>
- _discover_instances now returns (instances, errors): an available provider
whose list_instances() fails is no longer silently reported as clean success,
so `ps`/`stop --all` never lie about an empty inventory while sandboxes run.
- Explicit `--provider <name>` for an uninstalled/unknown provider now surfaces
an error instead of a silent empty result. Uninstalled/unconfigured providers
in the default scan remain silently skipped (a missing E2B key is normal).
- `ps --json` now returns {"sandboxes": [...], "errors": [...]} and exits non-zero
when any provider could not be queried.
- Corrected ManagedAgent factory docstring: compute-provider names warn and
delegate to LocalManagedAgent; they do NOT raise ValueError.
- Tests updated for new contract + added coverage for listing failures and
explicit unknown-provider errors.
Co-authored-by: Mervin Praison <[email protected]>
Three things, all stemming from reviewing the shared-sandbox feature (#3949).
1. Sandbox visibility (the piece left open in #3949)
praisonai managed ps # list running sandboxes
praisonai managed ps --json # machine-readable
praisonai managed stop <id> # reclaim one
praisonai managed stop --all # reclaim everything
Sandboxes normally self-destruct when a run ends, but a crashed or killed
run leaves one behind; there was no way to see or reclaim it.
2. Cross-process instance discovery (bugs found while building the above)
DockerCompute tracked instances only in an in-process dict, so:
- list_instances() always returned nothing from a fresh process -- exactly
when you need it, i.e. finding strays left by a previous run.
- _shutdown_sync() popped from that dict and, finding nothing, silently
did nothing while reporting success. `managed stop` claimed "Stopped"
and left the container running.
- get_status() reported STOPPED for any live container it didn't start.
All three now fall back to Docker itself (the `praisonai=managed` label and
the `praisonai_<id>` name), and shutdown raises rather than pretending to
succeed when the container cannot be found.
3. Naming: `compute=` -> `run_on=`
Researched how comparable tools name this. `executor` is the most-attested
name industry-wide (smolagents, ADK, AutoGen, Airflow, Nextflow, Dagster,
...), but it is already used as a concept inside workflows.py. `backend`,
`runtime` and `sandbox` are all taken as public Agent params, and `provider`
is used ~147 times for LLM/vector-store providers.
`compute` as a noun is cloud-industry jargon (Wiktionary labels the noun
sense "chiefly cloud computing"), which works against the goal of a name a
non-developer can read. `run_on` is plain English, has mass-audience
precedent in GitHub Actions' `runs-on:`, and has zero collisions in this
codebase.
AgentFlow(run_on="docker", steps=[writer, reader])
AgentTeam(agents=[w, r], run_on="docker")
`compute` stays as the INTERNAL vocabulary (ComputeConfig,
ComputeProviderProtocol, SharedCompute, _compute_bridge) where the
industry term is the right one. No alias is added: `compute=` merged in
#3949 but is NOT in any published release (PyPI 1.6.166 predates it), so
this rename breaks nobody and avoids a second param.
4. Doc fix: the ManagedAgent factory docstring claimed compute-provider names
raise ValueError; they actually emit a DeprecationWarning and delegate to
LocalManagedAgent. Corrected to match the code.
Verified against local Docker: `run_on="docker"` write-then-read hit one
shared instance; `managed ps` found a real stray container with correct
uptime; `managed stop --all` genuinely removed it (0 containers after).
16 new CLI tests + 14 core tests, none requiring Docker.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- agents.py: re-check dependency failure at consumption time in the async
sequential path. asequential() checks deps inside the generator, but
async_execution tasks are buffered and drained later, so an upstream async
task may not be failed yet when a dependent is yielded. Re-checking after
flushing pending async tasks makes the failure cascade fire for the async
path too.
- doom_loop.py: count progress markers against the boundary *before* the
no-progress window (the preceding action's completion timestamp) so a marker
recorded during the window's first action — timestamped before that action's
record_action() — is no longer wrongly filtered out.
- tool_execution.py: bound orphaned tool executors. Recycling on timeout keeps
throughput, but repeated timeouts could leak unbounded blocked threads. Cap
recycles at _MAX_ORPHANED_TOOL_EXECUTORS, then fall back to reusing the
bounded pool so process resources can't be exhausted.
- Add regression tests for the doom-loop window boundary edge.
Co-authored-by: Mervin Praison <[email protected]>
grep/glob/ast_grep_search were loaded raw from praisonaiagents, so their
containment defaulted to os.getcwd() (grep/glob) or was absent
(ast_grep_search). In headless `code -p --workspace <dir>` (no chdir) a
model-supplied path could read outside the selected workspace. Bind each
search tool's path to the configured workspace (fail-closed), mirroring the
edit/acp/lsp groups, and add a credential-free regression test.
Co-authored-by: Mervin Praison <[email protected]>
- asequential(): port failed-task skip + dependency-cascade check from
sequential() so async runs short-circuit tasks with failed upstream deps.
- tool_execution: retire the tool ThreadPoolExecutor on timeout so hung
threads no longer permanently poison the 2-worker pool.
- doom_loop: store (marker, timestamp) and only count progress markers
within the current no-progress window, so NO_PROGRESS detection is no
longer permanently disabled after the first successful tool call.
Co-authored-by: MervinPraison <[email protected]>
Replaces the fragile private _get_stop_reason helper (which checked the
wrong _llm_instance attr and missed the native OpenAI backend) with the
public backend-aware Agent.last_stop_reason property, so slash-less
OpenAI model names no longer record a null stop_reason.
Co-authored-by: Mervin Praison <[email protected]>
The root cause (unresolved TaskOutput forward reference) is fixed at source
in output/models.py via model_rebuild(), so PydanticUserError no longer
occurs in the guardrail path. The re-raise in _process_guardrail was also
swallowed by the 15 downstream chat handlers that return None, so it never
achieved its stated propagation contract (Greptile P1). Removing it keeps
guardrail error handling simple and consistent without touching hot paths.
Co-authored-by: Mervin Praison <[email protected]>
Run shlex.split first and decide by token count. Fixes Greptile P1
(spaced executable paths + args no longer mis-split; quote the path as
an escape hatch) and P2 (tabs/newlines now handled, not just spaces).
Co-authored-by: Mervin Praison <[email protected]>
Passing a callable to Agent(guardrails=...) returned None because two
different classes named TaskOutput existed and the guardrail path mixed them.
- output/models.py: import TokenMetrics at runtime and call
TaskOutput.model_rebuild() so the model can actually be instantiated
(previously the forward ref was TYPE_CHECKING-only and never resolved).
- main.py: re-export the single canonical TaskOutput from output.models so
main.TaskOutput and output.models.TaskOutput are the same class.
- agent.py: let PydanticUserError propagate from _process_guardrail instead of
swallowing it into a validation failure that silently nulls the response.
Co-authored-by: MervinPraison <[email protected]>
Previously MCP("npx -y pkg", args=[...]) passed the whole string as the
executable, so the subprocess spawn silently failed and 0 tools were
discovered. Now the command string is split on whitespace regardless of
whether args are supplied, using the first token as the executable and
prepending the remaining tokens to any explicit args.
Also updates examples/python/mcp/filesystem-mcp.py to use the reliable
executable + args form.
Co-authored-by: MervinPraison <[email protected]>
Document Evolink's OpenAI-compatible endpoint in the sample environment and add a provider example that uses the existing PraisonAI base_url/api_key configuration path. Cover the config wiring with an offline unit test so the integration stays regression-tested without live API calls.
2026-06-23 19:12:11 +08:00
759 changed files with 79427 additions and 16999 deletions
Explains Option B hub intake for PraisonAI TypeScript/JavaScript (npm praisonai):
accept TS issues on MervinPraison/PraisonAI, implement fixes in MervinPraison/praisonai-js,
sync to src/praisonai-ts/. Use when routing issues, implementing TS fixes, sync workflows,
merge-gate TS paths, or when the user mentions praisonai-js, praisonai-ts, npm SDK, or TS hub intake.
---
# praisonai-js hub intake (Option B)
## Model in one sentence
**Users file TypeScript issues on [PraisonAI](https://github.com/MervinPraison/PraisonAI); fixes land in [praisonai-js](https://github.com/MervinPraison/praisonai-js); the monorepo `src/praisonai-ts/` is a sync mirror only.**
Do **not** ask users to re-file on praisonai-js unless they opened a duplicate on the wrong repo.
- [ ] TypeScript / JavaScript (`npm install praisonai`) — fixes land in [praisonai-js](https://github.com/MervinPraison/praisonai-js); you can report here or there
- [ ] Cross-language / parity (file here on PraisonAI)
## Environment
- Provider (select one):
- [ ] Anthropic
@@ -14,6 +19,7 @@ assignees: ''
- [ ] AWS Bedrock
- [ ] Other: <!-- specify -->
- PraisonAI version: <!-- if known -->
- Node.js version (TS/JS only): <!-- e.g. 20.x -->
- Operating System: <!-- e.g. macOS 14.3, Windows 11, Ubuntu 22.04 -->
## Full Code
@@ -31,4 +37,4 @@ assignees: ''
<!-- What actually happened -->
## Additional Context
<!-- Add any other context about the problem here, such as screenshots, logs, etc. -->
<!-- Add any other context about the problem here, such as screenshots, logs, etc. -->
- TypeScript/JavaScript SDK → MervinPraison/praisonai-js: canonical npm repo. Do NOT edit src/praisonai-ts/ in this monorepo. Cross-link upstream issue in external PR body: Fixes MervinPraison/PraisonAI#N.
@@ -269,7 +308,7 @@ function finalClaudeCompletedOnSha(comments, headPushedAt) {
}
constFINAL_CLAUDE_REVIEW_BODY=
'@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep\n5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.\n6. Repo routing: agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (`praisonai.sandbox` entry point) — request changes if wrongly added to praisonaiagents/\n\n**Phase 2: FIX Valid Issues**\n7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n8. Also independently identify and fix any gaps or issues you find in the changed code — do not rely only on prior reviewer feedback\n9. Push all code fixes directly to THIS branch (do NOT create a new PR)\n10. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n11. If all issues are resolved, approve the PR / close the Issue\n12. If blocking issues remain, request changes / leave clear action items';
'@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify src/praisonai-rust or src/praisonai-ts in this repo — TypeScript SDK work belongs in MervinPraison/praisonai-js. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep\n5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.\n6. Repo routing: TypeScript/JavaScript SDK → praisonai-js (not src/praisonai-ts/ here); agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (`praisonai.sandbox` entry point) — request changes if wrongly added to praisonaiagents/\n\n**Phase 2: FIX Valid Issues**\n7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n8. Also independently identify and fix any gaps or issues you find in the changed code — do not rely only on prior reviewer feedback\n9. Push all code fixes directly to THIS branch (do NOT create a new PR)\n10. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n11. If all issues are resolved, approve the PR / close the Issue\n12. If blocking issues remain, request changes / leave clear action items';
body: '🤖 Auto-triaging with Claude. Analyzing issue and implementing a fix...\n\nClaude will:\n1. Route correctly: agent tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins\n2. Search codebase for root cause\n3. Implement a minimal fix following AGENTS.md\n4. Create a PR with the changes'
body: '🤖 Auto-triaging with Claude. Analyzing issue and implementing a fix...\n\nClaude will:\n1. Route correctly: TypeScript/JavaScript SDK → praisonai-js; agent tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins\n2. Search codebase for root cause\n3. Implement a minimal fix following AGENTS.md\n4. Create a PR with the changes (external repo PRs link back to this issue)'
1. Read AGENTS.md and the PR diff on the current branch.
2. Read all PR comments and reviews (FINAL architecture reviewer / Lead Engineer must have run).
3. Confirm SDK value gate: change strengthens praisonaiagents (no scope creep). The aim is a LIGHTWEIGHT AND POWERFUL package — BLOCK changes that add params/modules/exports duplicating existing Agent capabilities (instructions/backstory/tools/hooks/memory), or add knobs/fields with no live consumer, i.e. scope creep for the sake of it.
4. Repo routing: BLOCK if agent-callable tools (→ PraisonAI-Tools), lifecycle plugins (→ PraisonAI-Plugins), or optional sandbox backends (→ PraisonAI-Plugins via `praisonai.sandbox`) were added to praisonaiagents/ instead of the external repo.
4. Repo routing: BLOCK if TypeScript/JavaScript SDK changes in src/praisonai-ts/ (→ praisonai-js + sync workflow); agent-callable tools (→ PraisonAI-Tools); lifecycle plugins (→ PraisonAI-Plugins); or optional sandbox backends (→ PraisonAI-Plugins via `praisonai.sandbox`) were added to praisonaiagents/ instead of the external repo.
5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
6. If agent.py adds >100 lines or new Agent __init__ params, respond MERGE_GATE_VERDICT: BLOCK (manual review required).
7. BLOCK if labels security/breaking-change/needs-manual-review/release, sensitive paths (.github/workflows, auth, pyproject.toml), secrets in diff, PR >800 lines or >30 files, or SDK changes without tests. Label `merge-gate-ci-only` exempts CI-only changes under `.github/workflows/`, `.github/actions/`, or merge-gate scripts.
Read AGENTS.md to understand the architecture rules.
SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify or touch praisonai-rust or praisonai-ts packages.
SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or src/praisonai-ts in this repo — TypeScript/JavaScript SDK work belongs in MervinPraison/praisonai-js (STEP 3-ALT).
AIM: This package must stay LIGHTWEIGHT AND POWERFUL. Do a CRITICAL REVIEW at each stage (issue triage, fix planning, PR review/implementation) and reject scope creep for the sake of adding features. Prefer existing Agent capabilities (instructions/backstory/tools/hooks/memory) over new params/modules/exports. Even when fixing a raised issue, keep the fix minimal and lightweight — do NOT expand the surface area or add knobs with no live consumer.
4. Documentation (PraisonAIDocs): Documentation pages, guides, API references.
5. Plugins → MervinPraison/PraisonAI-Plugins: framework lifecycle extensions (tracing, logging, metrics, hooks, guardrails). Not agent tools — use STEP 3-ALT.
6. Sandbox backends (optional/niche, e.g. Capsule) → PraisonAI-Plugins via `praisonai.sandbox` entry point; core keeps protocol/config/manager only.
For items routed to an EXTERNAL repository (Tools, Docs, Plugins), follow STEP 3-ALT below.
7. TypeScript/JavaScript SDK → MervinPraison/praisonai-js: canonical npm SDK repo. Do NOT implement in src/praisonai-ts/ here — clone praisonai-js and use STEP 3-ALT. After merge there, run **Sync to PraisonAI Monorepo** workflow to update src/praisonai-ts/.
For items routed to an EXTERNAL repository (Tools, Docs, Plugins, praisonai-js), follow STEP 3-ALT below.
- Does it duplicate existing functionality? Check if Agent already supports this via existing params (reflection, planning, tools, hooks, memory). If it does, reject the change as scope creep and prefer the existing capability — the aim is lightweight and powerful, not more knobs.
- Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
- Does it inherit from Agent properly? New agent types MUST inherit Agent, not wrap it with composition.
@@ -318,7 +331,7 @@ jobs:
${{ steps.check_fork.outputs.is_pr == 'true' && (steps.check_fork.outputs.is_fork != 'true' || steps.check_fork.outputs.can_push_fork == 'true') && steps.check_fork.outputs.merge_state != 'DIRTY' && format('STEP 3 — IMPLEMENT ON EXISTING PR (branch: {0}, PR #{1}{2}):\n- DO NOT create a new branch or PR\n- git checkout {0}\n- Implement minimal, focused fixes from reviewer feedback\n- Follow protocol-driven design: protocols in core SDK, heavy implementations in wrapper\n- Keep changes small and backward-compatible\n- Commit: git add -A && git commit -m "fix: <description>"\n- Push: git push origin {0}\n- Comment a summary of exact files modified and what you skipped\n', steps.check_fork.outputs.pr_branch, steps.check_fork.outputs.pr_number, steps.check_fork.outputs.can_push_fork == 'true' && format(', fork: {0}', steps.check_fork.outputs.fork_repo) || '') || '' }}
${{ steps.check_fork.outputs.is_pr != 'true' && 'STEP 3 — IMPLEMENT (for changes in THIS repo — PraisonAI):\n- Create a fix branch: git checkout -b claude/issue-$ISSUE_NUMBER-$(date +%Y%m%d)\n- Implement a minimal, focused fix\n- Follow protocol-driven design: protocols in core SDK, heavy implementations in wrapper\n- Keep changes small and backward-compatible\n- Commit: git add -A && git commit -m "fix: <description> (fixes #$ISSUE_NUMBER)"\n- Push: git push origin claude/issue-$ISSUE_NUMBER-$(date +%Y%m%d)\nCRITICAL: After pushing, you MUST immediately run: gh pr create --title "fix: <title>" --body "Fixes #$ISSUE_NUMBER" --head claude/issue-$ISSUE_NUMBER-$(date +%Y%m%d)\nDo NOT stop after pushing. Do NOT say "manually create a PR". Always create the PR automatically.\n' || '' }}
When work must happen in a different repository, follow these steps EXACTLY. Do NOT attempt to use `cd`, as directory state is not preserved. Use `git -C` for all commands.
h) Comment on THIS PraisonAI issue with the external PR URL. For praisonai-js: note that after merge, a maintainer runs **Sync to PraisonAI Monorepo** on praisonai-js (Actions → sync workflow) to update src/praisonai-ts/.
STEP 4 — TEST:
- For SDK changes: cd src/praisonai-agents && PYTHONPATH=. python -m pytest tests/ -x -q --timeout=30
- For praisonai-js: cd /tmp/praisonai-js && npm install && npm run build && npm test
- For docs changes: verify files exist and are valid markdown/MDX
You do **not** need to re-file TypeScript issues on praisonai-js — report on PraisonAI and automation routes fixes to the canonical TS repo.
## Guidelines
- Follow existing code style
- Add tests for new features
- Update documentation as needed
- TypeScript changes: implement in [praisonai-js](https://github.com/MervinPraison/praisonai-js), then run **Sync to PraisonAI Monorepo** workflow to update `src/praisonai-ts/`
@@ -130,7 +130,7 @@ Each layer wraps the one inside it. When an agent misbehaves, the layer tells yo
| **3 · Harness** | Can it act, and be checked? | `tools=`, `MCP()`, `guardrails=`, `approval=`, `hooks=`, `sandbox=` |
| **4 · Loop** | When do we stop? | `execution=ExecutionConfig(...)`, `reflection=`, `autonomy=`, doom-loop detection |
| **5 · Graph** | Who runs when, and who checks whom? | `AgentFlow`, `route()`, `parallel()`, `loop()`, `repeat()` |
| **⬡ Managed** | *Where does it actually run?* | `backend=ManagedAgent(compute="e2b")` — remote sandbox, or a fully hosted loop |
| **⬡ Managed** | *Where does it actually run?* | `tools_run_on="docker"` — one shared sandbox for the tools, or `run_on="anthropic"` for the whole agent |
### Layer 1 · Prompt — *Did I say it clearly?*
@@ -195,7 +195,6 @@ from praisonaiagents import Agent, ExecutionConfig
reflection=True,# completion check — the agent grades its own answer
autonomy=True,# required to drive the loop with run_autonomous()
)
result=agent.run_autonomous("Refactor the auth module",max_iterations=5)
@@ -236,22 +235,85 @@ The harness is commoditising; **where** the agent executes is the next multiplie
pip install praisonai
```
The simplest way in is `tools_run_on=` — one whole team or workflow shares **one** sandbox, so a file written by step 1 is there for step 2. Thinking stays on your machine:
Sandboxes shut themselves down when idle (`auto_shutdown`, `idle_timeout_s`), and a post-setup snapshot is reused so the next run skips the image pull and dependency install. Commit a `.praisonai/environment.yaml` and the environment travels with the repo.
> 📖 [20 runnable examples](examples/python/managed-agents/) · manage sessions with `praisonai managed sessions list <agent-id>` or `praisonai managed sessions resume <session-id> "<prompt>"`
Report npm/TypeScript vulnerabilities on **PraisonAI** (hub intake) or [praisonai-js](https://github.com/MervinPraison/praisonai-js). Fixes land in praisonai-js first.
Report issues against the **specific package** where the vulnerability exists. A platform-only issue does not necessarily affect the core SDK, and vice versa.
Examples demonstrating the MCP Server v2 features per MCP Protocol Version 2025-11-25.
## Features Demonstrated
@@ -130,3 +157,19 @@ These examples comply with MCP Protocol Version 2025-11-25:
-`destructiveHint`: true
-`idempotentHint`: false
-`openWorldHint`: true
## Build Remote Agent (`gbr_pair.py`)
Pair a phone running [Build Remote Agent](https://grokbuildremote.com/) to a PraisonAI agent via MCP stdio `gbr-mcp` (protocol `gbr/1`). Requires `gbr-agent pair && gbr-agent run`. Phone is spectator. Never put mailbox keys in the example.
```bash
python gbr_pair.py
```
## What the phone sees
**Terminal windows** on this PC (machine-wide mailbox). Not headless OpenCode / CodeNomad sidecar / Electron. `:8788` in a sidecar is Bot API JSON, not a transcript.
Platform releases are **independent** of `praisonai` / `praisonaiagents` version numbers. A platform-only fix (e.g. `0.1.8`) does **not** require bumping the main SDK.
13.**praisonai-platform**advisories are handled in a different repository:
| `praisonai-platform` | Independent semver, **separate repository** | Not released from this repo — see [PraisonAI-Platform](https://github.com/MervinPraison/PraisonAI-Platform) |
Always set the advisory `patched_versions` to the **package that actually contains the fix**. Do not imply users must upgrade all packages when only one changed.
@@ -217,9 +215,11 @@ Close (or publish advisory with no code change only if already mitigated) when:
@@ -1074,7 +1074,7 @@ PraisonAI's reliability engineering rests on three pillars — **C**ontext, **H*
> **Evaluator status.** The `ContextEvaluator` / `HarnessEvaluator` / `LoopEvaluator` classes named in the rubric are **planned follow-ups** (PA-CHL-001–004), not yet in the repo. Until they land, the equivalent checks are covered by existing modules:
>
> - **Context** — `context/tokens.py` and `eval/tokens.py` (`estimate_tokens` / `count_tokens`) for budget; `compaction/compactor.py` (`ContextCompactor`) for compaction/retention.
> - **Harness** — `runtime/turn_context.py` for turn-context parity; `runtime/example_harness.py` and `tests/` for harness/artifact checks.
> - **Harness** — `runtime/turn_context.py` for turn-context parity; `examples/runtime/example_harness.py` and `tests/` for harness/artifact checks.
> - **Loop** — `eval/loop.py` (`EvaluationLoop`) and `agent/autonomy.py` for convergence and doom-loop guards.
>
> Keep terminology consistent with the `agent/context_agent.py` (`ContextAgent`) PRP methodology.
Loaded 100 of 759 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
