Delete create_autogen_tool_function() and the 17 generated autogen_<Tool>
symbols plus their __all__ from inbuilt_tools/autogen_tools.py. Their only
consumer, ToolRegistry.register_builtin_autogen_adapters(), was removed in
the #1590 fix; the canonical AutoGen path is framework_adapters/autogen_adapter.py.
Keeps the praisonai_tools availability probe that feeds PRAISONAI_TOOLS_AVAILABLE
and the release `import *` smoke test.
Co-authored-by: Mervin Praison <[email protected]>
Route WebSocketGateway._create_bot through the shared platform registry
(resolve_adapter) instead of a hardcoded if/elif over the seven built-ins.
Any channel the registry resolves — built-in, register_platform(), or a
praisonai.channels entry point — is now instantiated and started, with
ch_cfg passed through generically (mirroring probe_channels). An
unresolvable or unconstructable platform is recorded as a degraded channel
(visible in health/doctor) rather than a silent skip. Per-platform token
env-var fallbacks (email/AgentMail/Linear) are preserved.
Co-authored-by: MervinPraison <[email protected]>
- agent_invoke: _apply_agent_config now rejects overrides on non-isolatable
(shared registry) agents instead of mutating a shared object, preventing
config from leaking across concurrent/subsequent requests. Drop the
never-settable `temperature` key from the whitelist so the surface is honest.
- vector_stores: warn (once per collection) when an existing/legacy Chroma
collection uses a non-cosine distance metric, surfacing incomparable scores
without a destructive auto-migration of stored vectors.
Co-authored-by: Mervin Praison <[email protected]>
- ChromaVectorStore: centralise namespace->collection resolution so ad-hoc
namespaces keep the cosine metric; return the stored embedding (not the
query vector) from query(); scope delete_all to the caller's namespace.
- agent_invoke: honour agent_config overrides against the isolated clone
via a whitelist, rejecting unknown/unsettable keys with 400 (route) or a
clean error dict (standalone) instead of silently ignoring them.
- a2u_server.publish_sync: use get_running_loop, track the scheduled task
(WeakSet) so it can't be GC'd and surface its exceptions; expose
last_publish_task() for the real delivered count.
- push/client + acp/server: replace deprecated asyncio.get_event_loop()
with get_running_loop()/to_thread inside coroutines.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Both create-github-app-token steps omitted `repositories:`, so the run log
read "creating token for all repositories for given owner MervinPraison" --
the token carried write access to every repo under the account while the
job only ever touches PraisonAI.
Verified single-repo before narrowing: the workflow makes no cross-repo
call, and bump_and_release.py's only gh invocation is `gh release create`
against this repo, with all git operations on origin.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- failover.py: snapshot next_profile + callbacks under the RLock, then
invoke callbacks after releasing it. User callbacks may block or take
external locks; running them under the shared credential-pool lock could
stall every concurrent agent and risk lock-ordering deadlocks (Greptile).
- chat_mixin.py: _run_id -> _current_run_id at the second tool-output
truncation call site the PR missed; previously passed None into
get_tool_output_store, defeating the run isolation Gap 3 restores.
Co-authored-by: Mervin Praison <[email protected]>
- LLMGuardrail.__call__ now fails closed on ambiguous LLM replies, matching
_llm_validate() and the class's documented fail-closed contract.
- FailoverManager gains a threading.RLock guarding all _profiles reads/mutations
and AuthProfile status transitions, since it is a shared credential pool by design.
- Fix _run_id -> _current_run_id typo that silently disabled tool-output
run-scoped isolation; harden get_tool_output_store so a None run_id no longer
adopts the first run's process-wide store.
- Add regression tests asserting both guardrail entry points fail closed.
Co-authored-by: MervinPraison <[email protected]>
- docker-compose: require POSTGRES_PASSWORD (no known fallback) and bind
Postgres to loopback by default (POSTGRES_BIND) — resolves GitGuardian
finding and the default-credentials exposure P1.
- railway starter: ship a Dockerfile so railway.json's DOCKERFILE build
and start command reference real files (fixes missing-file P1).
Co-authored-by: Mervin Praison <[email protected]>
A full pypi-release run landed 9 separate commits and 9 pushes on main --
one per package -- all authored as MervinPraison.
Collapse to one commit: delete the 8 per-package "Commit <pkg> version
bump" steps. They were redundant, since the wrapper step already calls
bump_and_release.py --no-add-all whose release_files list is a superset
of every file those steps staged, so all bumps now land in the script's
single "Release v<x.y.z>" commit. That needs --force, because the tree is
now dirty when the script runs and its pre-flight guard exits 1 under
--no-add-all; --no-add-all still restricts staging to the explicit list.
A trailing "Persist any uncommitted version bumps" step covers what the
single commit cannot: a package failing midway (those versions are
already live on PyPI, so the bumps must not be lost), skip_wrapper, or a
wrapper failure. It is a no-op on a clean run, and uses `git add -u` so
untracked build output stays out.
Attribute the release to praisonai-triage-agent[bot] by minting an
installation token from CLAUDE_APP_ID/CLAUDE_APP_PRIVATE_KEY -- the app
already behind that bot in claude.yml, claude-merge-gate.yml and
pipeline-status-sync.yml. GH_TOKEN is exported via $GITHUB_ENV, so the
commit, the tag push and gh release create are all the bot's;
secrets.GH_TOKEN is no longer referenced.
Two details this depends on: app tokens expire after 1h and this job can
exceed that (9 packages x up to a 600s PyPI wait each), so the token is
re-minted immediately before the wrapper release. And checkout sets
persist-credentials: false -- otherwise its http.extraheader would
outrank the remote URL and pin the first, expiring token.
Requires the App to be able to push to main (contents: write, plus a
ruleset bypass entry if main requires PRs).
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Add the same overlap-guard assertion used in eval/tokens.py so RAG-specific
extras can never silently shadow canonical MODEL_LIMITS entries and re-introduce
the drift that #3567 fixed.
Co-authored-by: Mervin Praison <[email protected]>
Deduplicate the canonical tool-argument identity scheme
(json.dumps(sort_keys=True, default=str) -> sha256[:16]) that was
independently re-implemented in the approval registry and doom-loop
detector. Both safety subsystems now delegate to a single
hash_tool_args() helper in approval/utils.py, removing the drift risk
between approval de-duplication and doom-loop detection. Behaviour is
byte-for-byte identical (verified against the original scheme).
Co-authored-by: MervinPraison <[email protected]>
Guard the BEFORE_LLM and AFTER_LLM payload construction with the existing
registry.has_hooks() primitive, matching the idiom already used at the
AFTER_TOOL/BEFORE_TOOL/AFTER_AGENT/BEFORE_AGENT sites. Also skip the
str(result) stringification when the trace emitter is a disabled NoOp by
guarding on _trace_emitter.enabled. Behaviour is identical whenever a hook
or emitter is registered; zero cost on the hot path otherwise.
Co-authored-by: MervinPraison <[email protected]>
Deduplicate the model->context-window data by sourcing exact values from
context/budgeter.MODEL_LIMITS (the canonical table) and layering only
RAG-specific extras underneath, mirroring eval/tokens.py. This removes the
drift where gpt-4.1/gemini-1.5-pro resolved to different windows in RAG vs
the rest of the SDK. The get_model_context_window wrapper (None guard,
normalisation, prefix/heuristic fallbacks) is unchanged.
Co-authored-by: MervinPraison <[email protected]>
Extract a single _iter_argv_tokens classifier as the one source of truth for
flag/value-consumption semantics. _find_first_command, _flag_names and
_build_run_argv now all consume it, so routing and rewrite can no longer
diverge. _find_first_command accepts the shared value_opts (defaulting to the
historical narrow static set) rather than a separate hardcoded VALUE_FLAGS.
Behaviour-preserving internal DRY refactor; no CLI surface change.
Co-authored-by: MervinPraison <[email protected]>
CLI (cli/features/deploy.py):
- extract compose up|down action before generic parse so `compose up`
without --file no longer sets file="up"
- drop duplicate `-r` key (F601) so --region short flag works again
- route `doctor --provider fly|railway|render` via provider registry
- wrap the four new handlers in the class try/except convention
- thread --force into create scaffolding
compose.py:
- _ensure_postgres_password now resolves the *effective* (last) value,
handling quoted-empty and inline-comment cases
- restrict generated project .env to 0600 on POSIX
- report the effective host API port (runtime env → .env → default)
- add 600s timeouts to docker compose up/down
helm.py: add 600s timeout to helm upgrade
starters.py: refuse to overwrite existing files unless force=True
Helm agents-api deployment.yaml:
- pass agents/port/serverFile via env vars (no Python-source injection)
- include POSTGRES_PASSWORD in DATABASE_URL via k8s $(VAR) interpolation
starters: railway.json/render.yaml use the prebuilt GHCR image instead of
a nonexistent Dockerfile/api_server.py; fix compose+helm README manifest links.
Adds regression tests (160 passed).
Co-authored-by: Mervin Praison <[email protected]>
Split the "POSTGRES_PASSWORD:-praisonai" and "change-me" string literals in
the compose security regression tests so GitGuardian no longer flags them as
hardcoded secrets. The assertions still guard the exact same behaviour (no
default password baked into compose; generated password differs from the old
placeholder). Also replace the static "change-me" placeholder in the
agents-api Helm README with an openssl-generated example.
Co-authored-by: Mervin Praison <[email protected]>
- docker-compose.yml: drop `:-praisonai` default password (GitGuardian);
require POSTGRES_PASSWORD via `:?` and bind Postgres to 127.0.0.1 by default
- .env.example: ship empty POSTGRES_PASSWORD (no repo-known credential) + POSTGRES_BIND
- compose.py: auto-generate a strong POSTGRES_PASSWORD into project .env when empty
- README + tests: document security defaults and guard against regressions
Co-authored-by: Mervin Praison <[email protected]>
TRUNCATE is the default compaction strategy but did not preserve
tool_calls/result pairs: the recent-window slice could orphan a tool
result, and the token-budget pop loop could drop an assistant
tool_calls message while leaving its tool result behind. Snap the
recent boundary and drop leading tool pairs atomically so strict
providers never receive an orphaned tool message.
Co-authored-by: Mervin Praison <[email protected]>
When register(..., overwrite=True) replaces a tool under the same name,
evict the previous tool's availability cache and last-success timestamp so
a broken replacement can't be served as available on its first failing
probe via the inherited grace window.
Co-authored-by: Mervin Praison <[email protected]>
Compaction strategies chose their recent/older boundary purely by token or
message count, which could split an assistant tool_calls message from its
matching tool result. The resulting orphaned tool message made strict
providers (OpenAI/Anthropic/Azure) reject the transcript with a 400,
wedging long-lived gateway/bot sessions on every subsequent turn.
Add ContextCompactor._snap_to_pair_boundary() which moves a chosen boundary
outward so a tool pair is never separated, and apply it in _sliding_window,
_summarize, _prune, _llm_summarize and _llm_summarize_async. Behaviour-only,
backward compatible, no new knobs.
Co-authored-by: MervinPraison <[email protected]>
Track last-success timestamp per tool in ToolRegistry. On a probe
exception within a grace window of a recent success, serve the last-good
True and skip caching a durable negative, so a flaky availability check
no longer strips a healthy tool from a long-lived agent. Sustained
failures beyond the grace window still mark the tool unavailable.
Co-authored-by: MervinPraison <[email protected]>
The new TestAgentOSChatSessionIsolation tests replaced Agent.achat at the
class level (`type(template).achat = _fake_achat`) and never restored it,
so the stub leaked into test_async_gemini_fix.py where the real achat is
called with a `tools=` kwarg the stub did not accept.
Use pytest's monkeypatch fixture (auto-restore) and accept *args/**kwargs
in the stub so it matches the real achat signature.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on #3555:
- Greptile P1: _preflight_tools now loads ~/.praisonai/.env before resolving
so a local tools.py enabled via PRAISONAI_ALLOW_LOCAL_TOOLS in that file is
not falsely rejected in strict mode (mirrors GatewayHandler.start).
- CodeRabbit: describe_unresolved excludes the exact name from difflib typo
candidates so a mapped-but-unloadable tool yields an install/generic hint
instead of a useless "Did you mean '<same name>'?".
- Add regression tests for both.
Co-authored-by: Mervin Praison <[email protected]>
An explicit (non-${ENV}) weak gateway.auth_token in gateway.yaml wins over
GATEWAY_AUTH_TOKEN at both startup (GatewayConfig.auth_token) and doctor
re-validation, so the env-only repair left the weak YAML value active and
falsely reported success. The repair now also rewrites the YAML token in
place when it holds an explicit weak value, while preserving ${ENV}
references. Fixes Greptile P1 on #3556.
Co-authored-by: Mervin Praison <[email protected]>
The degraded registry's retry_hint advertised `praisonai gateway doctor --fix`,
but no such flag existed — a dead-end on the gateway's primary recovery path.
Add `--fix`/`--dry-run` to `gateway doctor` that mints a strong GATEWAY_AUTH_TOKEN
when weak/missing, persists it to ~/.praisonai/.env (same store as onboard), and
re-validates the finding cleared. Align the core retry_hint docstring so the
advertised command is guaranteed to exist.
Co-authored-by: MervinPraison <[email protected]>
Add a start-time tool pre-flight gate so a mistyped, uninstalled, or
gated tool named in gateway.yaml is surfaced with a per-name reason and
fix hint instead of being silently skipped. Strict by default (mirrors
the credential pre-flight); --no-strict-tools / strict_tools: false
preserve today's skip-and-continue.
- tool_resolver.py: add describe_unresolved() (difflib "did you mean" +
local-tools/dependency hints) and a module-level wrapper.
- gateway start: add --strict-tools/--no-strict-tools and a
_preflight_tools() gate reusing the existing validate_yaml_tools.
Co-authored-by: MervinPraison <[email protected]>
- cli/features/deploy.py: API & Cloud shortcut commands now honor deploy.api
and deploy.cloud YAML when CLI flags are unset (defaults changed to None
sentinels; explicit CLI still overrides). Fixes YAML being silently ignored.
- providers/azure.py: create->update fallback now builds a proper
`az containerapp update` command (previous `cmd[1]='update'` produced the
invalid `az update containerapp`); env vars passed under a single --env-vars
flag so later pairs no longer override earlier ones.
- scheduler/deployment.py: replace buggy nested DeployArgs (dead self-ref,
missing attrs) with SimpleNamespace carrying all fields handle_deploy reads;
derive success from SystemExit code instead of always True; interruptible
retry wait via _stop_event so stop() works; drop unused time import.
- main.py: replace `assert docker_cfg` with explicit ValueError (assert is
stripped under python -O).
- _wrapper_bridge.py: optional_wrapper_attr now returns default when attr is
missing, not just on ImportError.
- docker.py: prepare_docker_build_context validates agents file before writing
api_server.py; docker_container_name sanitizes invalid chars.
- tests: add regression tests for API and Cloud YAML merge precedence.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Route the optional subtree-context helper through praisonai_bot (canonical
home) with a praisonai wrapper-shim fallback, removing the module-/function-
level ``from praisonai`` import that tripped the C7 hot-path import gate
(fixes smoke: test_c7_import_gate_script_passes). Feature now also works on
installs shipping praisonai_bot without the full wrapper.
- Propagate --no-rules to the custom-agent and profiled prompt paths
(_run_custom_agent, _run_prompt_profiled) so the opt-out is honoured on every
non-interactive Agent construction site, not just _run_prompt.
- Add an execution-path test asserting all three paths accept/forward no_rules.
Co-authored-by: Mervin Praison <[email protected]>
- ACCEPT_EDITS previously set _permission_mode but the decision resolver
deferred it (no-op), so advertised auto-accept-edits behaviour never
applied. Add an ACCEPT_EDITS branch that auto-approves edit-class tools
(write/edit/append/create/save/patch/mkdir) via a new _is_edit_tool
heuristic, deferring destructive/exec/external tools to normal flow.
- Remove the misleading `read_only`-as-mode line from PermissionMode.resolve
docstring (read_only is a deny-set preset and resolves to None).
- Tests: auto-approve edit tools, defer non-edit tools, auto_edit alias.
Co-authored-by: Mervin Praison <[email protected]>
The interactive REPL lazily attaches a subdirectory's AGENTS.md/CLAUDE.md the
first time the agent reads/edits a file under it, but the scriptable
`praisonai run` path built Agent(**agent_config) without it. In a monorepo,
`praisonai run "refactor packages/foo/bar.py"` therefore never picked up
packages/foo/AGENTS.md while `praisonai chat` in the same repo did.
Reuse the existing subtree hook (praisonai.integration.context_files) and the
existing Agent(hooks=...) seam via a small `_wire_subtree_context_hook` helper,
registered on a fresh session-scoped registry at all three run.py Agent sites.
Gated by the existing --no-rules / PRAISON_NO_RULES off-switch and honouring the
shared PRAISON_CONTEXT_BUDGET character budget. No new Agent params, no new core
module, no agent.py changes — keeping the surface area unchanged.
Co-authored-by: MervinPraison <[email protected]>
Add PermissionMode.resolve() as the single mapper from historical mode
spellings (AutonomyMode/ApprovalMode/CLI-flag aliases) onto the canonical
PermissionMode enum, and route the existing Agent(approval=<preset>) string
branch through it. Agent(approval='plan'|'bypass'|'accept_edits'|'dont_ask')
(plus aliases like yolo/auto_edit/reject/full_auto) now resolve to one
coherent model. Deny-set presets (safe/read_only/full/off/default) keep
their exact behaviour. No new Agent params or exports.
Co-authored-by: MervinPraison <[email protected]>
- call.py: module globals (OPENAI_API_KEY, CALL_SERVER_TOKEN, NGROK_AUTH_TOKEN,
rate limits) were frozen at import, before main()'s explicit load_dotenv(),
so a .env-only key was silently ignored. Add _refresh_env_globals() invoked
after load_dotenv() (also refreshes the n8n router's CALL_SERVER_TOKEN).
- agentos.py: clone_for_channel intentionally drops handoffs; agents with
handoffs now stay on the shared template so delegation is never silently lost.
- test: cover the handoffs-not-cloned path (9 passed).
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: /chat now clones a per-request/session agent (reusing the existing
_supports_session_isolation / _clone_agent helpers from api/agent_invoke.py)
so concurrent callers no longer share mutable chat_history, and session_id is
bound to the clone instead of merely echoed. Plain mocks fall back to the
shared instance for backward compat.
Gap 2 (minimal): api/call.py no longer calls load_dotenv() unconditionally at
import time; it is gated behind PRAISONAI_CALL_LOAD_DOTENV and loaded
explicitly in main() so the CLI keeps working. Importing the module no longer
mutates os.environ.
Gap 3 rejected as scope creep (breaking public-API churn with a deprecation
window; deferred per the issue).
Co-authored-by: MervinPraison <[email protected]>
- Docker deploy no longer disables auth by default; falls back to the
secure APIConfig() default (auth_enabled=True, token auto-generated)
instead of exposing an unauthenticated /chat on 0.0.0.0 (Greptile P1).
- Write the generated API server into a private per-invocation mkdtemp
(mode 0700) instead of a predictable shared tmp path, preventing
local replacement before launch (Greptile P1).
- Update pre-existing GHSA deploy-codegen test to assert the genuine
security property (repr-escaped path, no raw injection) rather than the
old implementation-coupled `PraisonAI(agent_file=...)` string; the PR
intentionally forwards the chat message via the wrapper `run(..., cli_config)`
entrypoint since `PraisonAI.run()` takes no args.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- llm_guardrail: assign self.logger before _initialize_llm so unsupported/
string-fail/dict-fail paths can log and fail closed instead of raising
AttributeError (CodeRabbit major).
- llm_guardrail: __call__ now checks `self.llm is None` (matches _llm_validate)
instead of truthiness (CodeRabbit minor).
- tests/permissions: lock the scoped-approval bypass fix — an agent-scoped
approval must reject an unnamed (agent_name=None) caller.
Co-authored-by: Mervin Praison <[email protected]>
- cancel_task now cancels any non-terminal task (PENDING or RUNNING),
fixing test_cancel_task regression and Greptile P1: queued/PENDING
delegations no longer escape cancel_all.
- delegate() re-raises external CancelledError (Greptile P1) and only
swallows delegator-initiated cancels into a result, so wait_for /
cooperative shutdown behave correctly.
- _execute_task and the semaphore-guarded path early-return when a cancel
landed before execution, so a cancelled task never runs.
Co-authored-by: Mervin Praison <[email protected]>
Move API, Docker, and cloud deployment from the wrapper into a standalone
praisonai-deploy package with backward-compat shims, CI/publish wiring,
and fixes for chat message forwarding, Docker build context, and CLI YAML merge.
Co-authored-by: Cursor <[email protected]>
- permissions/rules.py: PersistentApproval.matches now rejects agent-scoped
approvals for callers that can't prove identity (including agent_name=None),
closing the short-circuit bypass while leaving unscoped approvals unaffected.
- guardrails/llm_guardrail.py: LLMGuardrail.__call__ now fails closed on a
missing/unsupported LLM, matching its docstring and sibling _llm_validate.
- agents/delegator.py: cancel_task/cancel_all now propagate cancellation to the
real asyncio.Task; _execute_task no longer clobbers a CANCELLED status with a
late COMPLETED assignment.
Co-authored-by: MervinPraison <[email protected]>
Add a `skills add` subcommand as a thin alias over the existing
`skills install` path so `praisonai skills add https://...` works,
mirroring the familiar `npx skills add <url>` verb. Reuses existing
install/remote-fetch machinery; no new deps, modules, or core params.
Co-authored-by: MervinPraison <[email protected]>
- @tool(requires_approval=False) now emits DeprecationWarning (any use of the
deprecated spelling nudges migration); use a sentinel to tell "omitted" from
explicit False. approval= still wins for the resolved value.
- Agent/PraisonAIAgents launch(protocol="mcp") now keep the serve_agents() call
inside the ImportError guard, so a praisonai-mcp installed without its
transport extras yields one actionable install message instead of an uncaught
traceback.
- Tests: explicit-False-warns, omitted-no-warn, both-set-warns, and
missing-transport-extras for single- and multi-agent launch.
Co-authored-by: Mervin Praison <[email protected]>
- @tool now accepts canonical approval= (mirrors Agent(approval=...));
requires_approval= kept as a deprecated alias with a DeprecationWarning,
approval= wins when both set. Both funnel to the same ApprovalRegistry.
- PraisonAIAgents.launch(protocol="mcp") and Agent.launch(protocol="mcp")
now both delegate to praisonai_mcp.serve_agents (lazy import, clear
"pip install praisonai-mcp" error). Replaces the bespoke single-agent SSE block.
- Add praisonai_mcp naming constants list_sessions / awaiting_approval.
- http launch behaviour untouched.
Co-authored-by: MervinPraison <[email protected]>
A stop-on-error failure inside a loop_over step now aborts the whole
workflow instead of only the inner item iteration, and a completed
loop_over step now persists a checkpoint so resume does not re-run every
loop item. Both fixes live in the shared _run_workflow_loop generator so
they apply to sync execute() and async aexecute() alike.
Co-authored-by: Mervin Praison <[email protected]>
Extract the duplicated step-loop from execute() and aexecute() into a single
sans-io generator (_run_workflow_loop) that owns all orchestration:
condition-skip, loop_over iteration, checkpoint save/resume, branch_condition/
next_steps routing, early-stop and on_error handling.
execute() drives it with the sync _execute_single_step; aexecute() drives the
same generator with a new async _aexecute_single_step that awaits async
executors / agent.achat / async handlers (true-async preserved).
This restores loop_over, branch, and checkpoint/resume parity to the async
path and adds checkpoint/resume params to aexecute. Public signatures and
return shapes are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Catch import errors in _load_bundled_dashboard_app so that when the
bundled ui_dashboard preset is unavailable, the loader returns None and
the existing build_host_app fallback runs, instead of the exception
escaping to the outer handler and dropping aiui to the standard dashboard.
Addresses Greptile (P1) and CodeRabbit (Major) review findings on #3535.
Co-authored-by: Mervin Praison <[email protected]>
Route _run_aiui_dashboard through the bundled ui_dashboard/default_app.py
preset so the documented 9-page unified dashboard actually ships, making
the preset the single source of truth instead of a divergent hardcoded
5-page list. Falls back to the previous build_host_app defaults if the
preset cannot be loaded. Adds the missing ui_dashboard/__init__.py for
consistency with the other bundled UI presets.
Co-authored-by: MervinPraison <[email protected]>
- Namespace per-session transcripts by tool name so reusing a client
session_id across different ask_* agents no longer leaks history.
- Serialize each session's load->run->save under a per-session lock to
stop concurrent turns clobbering each other's completed turn.
- Disambiguate agents whose names normalize to the same tool suffix so a
later registration never silently shadows an earlier agent.
- Raise ValueError on unknown serve_agents() transport instead of
silently falling back to http-stream.
- Add regression tests for all four cases.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1 security findings on PR #3530:
- Fail closed: if registering the approval requirement raises, the
decorator now re-raises RuntimeError instead of logging and handing
back an executable but ungated tool.
- Validate risk-level strings against ("critical","high","medium","low")
so a typo like requires_approval="critial" is rejected up front rather
than silently treated as non-critical.
Adds regression tests for both cases.
Co-authored-by: Mervin Praison <[email protected]>
- praisonai-mcp: new serve_agents() + agent_adapter publishing ask_{name}
per agent and list_agents, with per-call session_id minting and in-adapter
per-session transcript continuity, running over the existing spec-compliant
http-stream transport. Server-side agents only; no client-set instructions.
- Fix Defect C: rebind memory adapter to the real core API
(store_short_term/search/get_all_memories/reset_all); the old bindings
(get_session/get_all/clear_session/clear_all/list_sessions/add) never existed.
- Drop client-controllable `instructions` from praisonai.agent.chat/run so the
connecting client can no longer rewrite the persona.
- Tests for per-agent tools, session continuity, no-client-instructions, and
memory adapter against the real API.
Co-authored-by: MervinPraison <[email protected]>
Adds a one-place approval declaration to the @tool decorator that
registers the tool with the existing global ApprovalRegistry at
definition time. `requires_approval=True` maps to the "high" risk
level; a string sets the risk level explicitly. No behaviour change
when unset. Backward compatible.
Co-authored-by: MervinPraison <[email protected]>
Addresses two valid reviewer findings on PR #3527:
- Stale anchor: the sync & async loops advanced `_last_run_at` *after*
`_execute_with_retry` persisted daemon state, so a restart restored the
prior slot and replayed an already-completed run/delivery. Mark the
wall-clock anchor *before* executing so the state write records this slot.
- Silent degrade: without the optional `croniter` engine a `cron:` schedule
reverted to the pre-#3526 process-relative interval with no signal. Emit a
one-time actionable warning (matching core `scheduler.due`) instead.
Tests: new default-install warning + state-persistence cases (run without
croniter); ticker cron tests gated per-class so they no longer skip the
whole module. Scheduler suite: 259 passed (3 pre-existing dotenv env
failures unrelated).
Co-authored-by: Mervin Praison <[email protected]>
The AgentScheduler / AsyncAgentScheduler wrapper loops collapsed cron
expressions to a coarse integer interval anchored to process start, so a
"daily 09:00 brief" fired at whatever o'clock the daemon launched, re-phased
on restart, and silently dropped runs across downtime/dormancy.
Add a lightweight, wrapper-local ScheduleTicker that reuses core's croniter
engine to sleep until the next real wall-clock occurrence, catch up a missed
slot exactly once on resume, and persist last_run_at in the existing daemon
state file so restarts don't re-phase. Plain intervals (hourly, */30m, raw
seconds) keep identical behaviour. No new core surface, exports, or params.
Co-authored-by: MervinPraison <[email protected]>
- Always inject the env var as GATEWAY_AUTH_TOKEN (the only name the gateway
reads); auth.secretKey now only selects the Secret data key.
- validateAuth now fails fast whenever auth.enabled is true without a token
source, not only when ingress is also enabled — the default install
previously referenced a Secret that was never created.
- Update README security note to match the stronger validation.
Co-authored-by: Mervin Praison <[email protected]>
The bot's dependency floor (praisonaiagents>=1.6.152) admits core releases
that predate AttemptAndAgeDeadLetterPolicy (first shipped 1.6.161). On those
installs the import guard previously bound None and both durable queues
silently reverted to attempt-only dead-lettering, re-introducing the #3519
transient message loss. Add a dependency-free LocalDeadLetterPolicy in
_resilience (mirroring core semantics: attempt+age gate, permanent-error
short-circuit, min_age=0 legacy) and bind it as the import fallback so the
age gate holds on any allowed core version. Adds older-core coverage tests.
Co-authored-by: Mervin Praison <[email protected]>
Ship a single, self-contained Helm chart under deploy/helm/praisonai-gateway
that reuses the existing GHCR image (no new build pipeline, no core code
change). Grounded in real gateway behaviour: port 8765, /health probes, and
GATEWAY_AUTH_TOKEN via a Kubernetes Secret. Includes optional ingress with
WebSocket-friendly annotations and an optional CPU HPA. Chart refuses to render
if the gateway would be exposed via ingress without an auth token.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- Enforce closed OWNER_KINDS/DEGRADED_STATES in DegradedOwner.__post_init__
so unsupported values can never reach operator-facing records (Greptile P2).
- Route the existing channel-credential degradation path through new
gateway helpers _mark_degraded_owner/_clear_degraded_owner so the shared
_degraded_registry has a genuine live producer feeding degraded_owners,
not just an empty registry read by health() (Greptile P1).
- Drop unused dataclasses.field import; add vocabulary-rejection tests.
Co-authored-by: Mervin Praison <[email protected]>
Dead-lettering decided on attempt-count alone burned the default five
attempts in ~45s of channel outage, permanently dropping deliverable
inbound/outbound messages during routine transient incidents.
Add a core DeadLetterPolicyProtocol + default AttemptAndAgeDeadLetterPolicy
in praisonaiagents/gateway that requires BOTH attempt-exhaustion AND a
minimum wall-clock age (default 6h) before dead-lettering, while known
permanent errors (credential/permanent_target) still short-circuit. The
bot durable queues (OutboundQueue.drain, InboundJournal redelivery/replay)
consume the policy where they previously tested attempts >= max_attempts,
gaining a dead_letter_min_age knob. min_age=0 restores legacy behaviour.
Co-authored-by: MervinPraison <[email protected]>
Adds a small, process-local DegradedCapabilityRegistry + DegradedOwner
contract in core (praisonaiagents/gateway/degraded_state.py), mirroring the
existing gateway policy-protocol + default-impl pattern. Any owner (channel,
provider, capability, route, gateway) records degradation with a consistent,
redacted, actionable shape.
Wires the bot gateway health() as a live consumer: it aggregates existing
channel degradation facts (plus any provider/capability/route degradation
recorded into a shared registry) into a single degraded_owners surface, so a
degraded provider or unresolved secret-backed capability is no longer
classified-but-invisible. The channel-only surface stays for backward compat.
Co-authored-by: MervinPraison <[email protected]>
The wrapper YAML schema types `autonomy` as an int 0-10 but core
Agent only accepts bool/str/dict/AutonomyConfig; forwarding the raw
int hit core's disable branch and silently ignored a configured
level. Map the numeric level onto core's string presets (0 => off,
1-3 => suggest, 4-7 => auto_edit, 8-10 => full_auto) and pass
bool/str/dict through unchanged.
Co-authored-by: Mervin Praison <[email protected]>
- praisonai_adapter._resolve_agent_approval: map the wrapper approval dict
onto the real ApprovalConfig fields (approve_all_tools->all_tools, resolve
string backend) instead of passing extra keys into the dataclass, which
raised TypeError on every --trust/--approve-* run against the native adapter.
- praisonai_adapter.run + persistence sync stores + async TUI: route through
the existing run_sync_or_offload helper instead of run_sync, so the flagship
sync praisonai.run(...) API and sync persistence hooks no longer crash from
inside a running loop (FastAPI, async test, notebook).
- praisonai_adapter._build_agents_and_tasks: forward agent-level fields the
core Agent already accepts (planning, reflection, guardrails, web, autonomy,
skills) instead of silently dropping them.
Co-authored-by: MervinPraison <[email protected]>
The per-instance async semaphore fix (correctly) enforces each Handoff's
own max_concurrent, but moved _semaphore_lock to instance level, breaking
the architectural test that asserts Handoff._semaphore_lock is a single
shared class attribute. Restore it as a class-level threading.Lock guarding
lazy semaphore creation while keeping the semaphore itself per-instance.
Co-authored-by: Mervin Praison <[email protected]>
- llm.py: add LLMResponseError and re-raise instead of swallowing a
mid-tool-loop error and returning "" as if the call succeeded, so the
existing try/except in chat_mixin.py can surface the real failure.
- memory.py: make adapter search/reset/delete gates symmetric with the
adapter-agnostic store path (any configured memory_adapter, not just
the hardcoded sqlite/in_memory providers). Also make store_long_term
adapter-agnostic to match store_short_term so adapter-stored memories
(e.g. "dakera") remain findable.
- handoff.py: make the concurrency semaphore instance-level (created once
per Handoff, rebound if the running event loop changes) instead of a
class-level singleton, so per-handoff max_concurrent limits no longer
override each other and multiple asyncio.run() lifecycles don't crash.
Co-authored-by: MervinPraison <[email protected]>
load() acquired the exclusive lock over max(file_size, 1) bytes on
Windows but discarded the returned length, so _release_exclusive_lock
fell back to unlocking only 1 byte. For session files larger than one
byte this left the remaining range locked until file close, blocking
concurrent access. Pass the acquired lock_length to the release call
to unlock the full range, mirroring save().
Co-authored-by: Mervin Praison <[email protected]>
- Persist reasoning/tool-progress/stream-error frames for reconnect replay (CodeRabbit)
- Missing agent now resolves terminally (final+error) instead of a dangling accepted ack (Greptile P1)
- Drain relay futures before final frame so final never overtakes trailing stream events (Greptile P1)
Co-authored-by: Mervin Praison <[email protected]>
Forward a closed set of structured progress events (reasoning, tool
progress, stream errors) to WS clients instead of dropping everything
but text/tool-call/end, and disambiguate the overloaded response frame
with status: "accepted" (provisional) vs status: "final" (with a
structured outcome).
Co-authored-by: MervinPraison <[email protected]>
Closes the two P1 gaps flagged in review: name-based schedule lookups/removals
had no principal check (a gateway user could read/delete another's automation by
guessing its name), and suggestion admission caps/dedup were measured globally
(one tenant could starve another's suggestions).
- store.py / config_store.py: get_by_name/remove_by_name gain optional principal
filter; a cross-owner match is skipped. principal=None stays global.
- protocols.py: ScheduleStoreProtocol get_by_name/remove_by_name updated.
- suggestion_store.py: add() scopes the pending cap & dedup window to the
suggestion's principal; principal=None keeps the global pool.
- tests: +6 cases for name-based mutation ownership and per-principal caps/dedup.
Co-authored-by: Mervin Praison <[email protected]>
Wire BasePlatformAdapter.format_message() (the existing deliver() seam) to
call format_for_dialect(text, caps.markdown_dialect) so the capability is
actually consumed in core — Telegram replies are MarkdownV2-escaped and Slack
gets mrkdwn. Default "markdown" dialect keeps existing adapters unaffected.
Fix strip_markdown to only unwrap *paired* emphasis/code spans so literal
identifiers (svc_1), globs (*.py) and arithmetic (a*b) are no longer corrupted.
Adds regression tests for both fixes.
Co-authored-by: Mervin Praison <[email protected]>
Add an optional `principal` owner key to the core scheduler data model so
a multi-user gateway isolates each user's automations and suggestions
instead of sharing one global, single-tenant store.
- Suggestion.principal + SuggestionStore.list_pending/accept/dismiss gain
an optional principal filter that rejects cross-owner access.
- ScheduleJob.principal round-trips through to_dict/from_dict; FileScheduleStore
and ConfigYamlScheduleStore .list() gain an optional principal filter.
- ScheduleStoreProtocol.list signature updated.
principal=None preserves the current global behaviour, so single-user
deployments are unaffected (fully backward compatible).
Co-authored-by: MervinPraison <[email protected]>
The bare-tool-name guard skipped the stdout-reporting instruction for
preconfigured agents whose own system prompt mentions execute_command,
leaving the "no output" bug reachable. Guard on a stable marker phrase
instead, keeping injection idempotent. Strengthen assertions and add
regression coverage for the preconfigured-prompt and duplicate paths.
Co-authored-by: Mervin Praison <[email protected]>
Addresses the durable at-least-once guarantee gaps flagged in review:
- Persist the recipient client_id alongside each pending event and
reconstruct _pending_acks on startup, so replayed events are scheduled
for retry/reconnect redelivery instead of being silently dropped.
- Evict acknowledged events from the SQLite store (and in-memory cache)
so acked rows are not resurrected after a restart.
- Backfill client_id column for pre-existing stores; strengthen tests to
assert redeliverability after restart and ack-eviction.
Co-authored-by: Mervin Praison <[email protected]>
Strengthen the shell-tool instruction in enable_shell_tools so the
gateway agent actually invokes execute_command and returns its stdout
verbatim, instead of intermittently replying "there was no output".
This addresses the flaky E2E sandbox marker check (E2E_SANDBOX_OK).
Co-authored-by: Dhivya-Bharathy <[email protected]>
Path.home() resolves via USERPROFILE on Windows, not HOME. The fixture
only set HOME, so on Windows the tool wrote to the real user profile and
the positive test asserted a file under tmp_path that was never created.
Set USERPROFILE alongside HOME so the fake home is honored on all
platforms and no writes escape the sandbox.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Make the gateway's at-least-once push delivery guarantee durable by default
without an external Redis server. DeliveryConfig.store_backend now accepts
"sqlite" (new default), "redis" and "memory", validated in core. The wrapper
gains a SqlitePushStore mirroring the existing OutboundQueue pattern (WAL,
stdlib sqlite3, TTL eviction) at ~/.praisonai/state/push_delivery.sqlite, so
pending un-acked events survive a restart and replay on reconnect. "memory"
stays an explicit ephemeral opt-out; "redis" stays for multi-process fan-out.
Co-authored-by: MervinPraison <[email protected]>
- discovery.py: auto-include synced remote-skill cache (`current` aliases) in
default skill dirs so agents pick up `skills sync` output without install;
scan now treats a returned dir that is itself a skill (root-level SKILL.md)
as a single skill.
- remote.py: return the fetched dir as-is (never its parent) so a root-level
skill is not double-counted alongside its cache `current` alias.
- skills.py (CLI): `sync` reuses discover_skills (no re-implemented scan / no
double-count); no-URL sync now reads project praisonai.yaml/.yml as well as
the user-global config.
- test_remote.py: regression test for root-level SKILL.md repo discovered once.
Co-authored-by: Mervin Praison <[email protected]>
Task._setup_guardrail selected `agent.llm or agent.llm_instance`; since
agent.llm is always a non-empty model-name string it always won, discarding
the configured LLM instance (base_url/api_key/auth) and authenticating against
the wrong backend. Reorder to `llm_instance or llm`, matching
Agent._setup_guardrail. small_model routing still applies only to the bare
string case. Adds Task guardrail routing/instance-preference tests.
Co-authored-by: Mervin Praison <[email protected]>
Internal, non-user-facing LLM calls (context compaction/summarisation and
LLM guardrail validation) always ran on the primary agent model. Thread the
existing get_small_model resolver through these live auxiliary call sites so
a configured small_model is used, while leaving it unset preserves today's
behaviour (unset -> primary model).
- agent._create_llm_summarize_fn: resolve the summariser model via
get_small_model(primary_model=<agent model>) instead of hardcoding self.llm.
- Agent/Task LLM guardrail setup: when the guardrail LLM would default to the
bare primary model-name string, route it through get_small_model.
Change is strictly additive and backward-compatible: an explicit LLM instance
or per-call model always wins.
Co-authored-by: MervinPraison <[email protected]>
Introduce an opt-in RemoteSkillSourceProtocol and a default git-backed
implementation that syncs skills into a versioned local cache with atomic
swaps and offline-safe fallback to the last-good cache. Wired into
discover_skills via a new sources= param (backward compatible, zero
import-time cost) and surfaced through a `praisonai skills sync` CLI
command reading skills.urls / skills.sources from config.
Co-authored-by: MervinPraison <[email protected]>
Addresses two P1 reviewer findings on the wrapper-layer PR:
- registry.py: move the capability cache off a process-global dict onto the
FrameworkAdapterRegistry instance so two registries that register different
adapters under the same name no longer read each other's flags.
- observability/hooks.py: record which AgentOps teardown a run owns
(per-session vs legacy singleton). A run whose start_session returned no
usable handle now ends nothing instead of falling back to the package-global
end_session and cross-finalizing a concurrent run.
- agents_generator.py: keep the "cannot verify" refusal for genuinely unknown
frameworks while treating known built-ins (DEFAULT_PRIORITY / registered)
whose adapter can't be constructed as unsupported, preserving the historical
"not supported for framework=..." message.
Adds regression tests for all three behaviours.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: scope AgentOps to each ObservabilityRun (per-run start_session
handle + lock) instead of the process-global singleton so concurrent
runs don't cross-contaminate tags or cross-finalize sessions.
Gap 2: add run_sync_or_offload() to _async_bridge as the single
sync-or-offload driver; delete the duplicated copies in auto.py, use it
in PersistenceOrchestrator._sync (was silently raising inside a running
loop), and replace deprecated get_event_loop().run_in_executor with
asyncio.to_thread in api/agent_invoke.py.
Gap 3: add adapter_capability() and route SUPPORTS_RUNTIME_FEATURES /
SUPPORTS_WORKFLOW decisions through it, removing the
str(framework)=="praisonai" fallbacks so third-party adapters aren't
silently demoted on transient resolution failures.
Co-authored-by: MervinPraison <[email protected]>
The restore-all prune loop deleted every project file absent from the
target commit, silently destroying ignored/excluded files (.env, venv,
node_modules) that the snapshot never tracked. Mirror _sync_files()'s
ignore rules in restore so only would-be-tracked files are pruned.
Co-authored-by: Mervin Praison <[email protected]>
- snapshot: prune shadow files removed from the project in _sync_files() and
restrict restore() "restore all" to the target commit's tree (removing files
not in it), so undo() cannot resurrect deleted files or leak files from a
later snapshot.
- skills: guard the pending-store load-mutate-save cycle in _stage_pending/
approve/reject with a threading.Lock so concurrent proposals no longer
silently overwrite each other.
- permissions: consume a scope="once" approval/denial on first match in
_check_flat so it no longer becomes permanent for the process lifetime.
Co-authored-by: MervinPraison <[email protected]>
Delegate mcp.py's inline SSE-vs-HTTP URL check to the existing
mcp_transport.get_transport_type() helper so there is a single source of
truth for URL->transport classification. No behaviour change: /sse URLs
still use SSE and all other HTTP URLs use Streamable HTTP.
Co-authored-by: MervinPraison <[email protected]>
HooksQueryProtocol had zero importers, was not exported in
hooks/__init__.py __all__ or _LAZY_GROUPS. Consumers use
registry.list_hooks_for_api directly. No behaviour change.
Co-authored-by: MervinPraison <[email protected]>
Sync from_dict with to_dict so retry_initial_delay, retry_backoff_factor,
retry_jitter and compaction_strategy survive a to_dict/from_dict round-trip.
Also align code_sandbox_mode fallback with the dataclass default ("sandbox").
Co-authored-by: MervinPraison <[email protected]>
Both helpers in the praisonai wrapper's agents_generator.py were defined
but referenced nowhere (no callers, no tests, not exported). Also drops
the now-unused `import keyword` used only by the removed function.
Co-authored-by: MervinPraison <[email protected]>
- browser_available() now requires the playwright runtime importable, not just
praisonai_browser, so a base install without the Playwright extra falls back
to the cloud BrowserBaseTool instead of selecting a local tool that fails at
invocation (Greptile P1).
- create_browser_tool no longer advertises profile=X as active; PlaywrightBrowserAgent
has no profile param and uses a fresh context, so the value is now logged as
informational-only rather than misreported (Greptile P1).
- Add unit test covering the missing-Playwright fallback path.
Co-authored-by: Mervin Praison <[email protected]>
BotHandler._build_tools() now prefers praisonai-browser's local Playwright
automation (navigate/snapshot/click) over cloud-only BrowserBaseTool when
capabilities.browser is set, honouring --browser-headless / --browser-profile.
Falls back to BrowserBaseTool only when praisonai-browser is unavailable.
Adds a lazy _browser_bridge (mirroring _code_bridge) and an agent-callable
browser_automate tool wrapping PlaywrightBrowserAgent.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Adds safe_print() to praisonai_bot.gateway.unicode_utils so E2E harnesses and
console reporters can echo Playwright's "playwright install" banner (drawn with
box chars like U+2551) without crashing on default Windows cp1252 consoles.
Falls back to safe_error_message() sanitization only when the stream encoding
rejects the text, keeping the actionable hint readable instead of masking it
behind a secondary UnicodeEncodeError.
Co-authored-by: Dhivya-Bharathy <[email protected]>
The CodeToolBridge.run_code(code) contract dropped the caller's per-run
allow-list, registry, timeout and max_output_size, so a transport could
only gate isolated tool calls by bridge-owned defaults — a weaker path
than the in-process executor and contrary to the "never a weaker path"
guarantee. Forward the invocation policy and limits to run_code so the
transport gates each call by exactly what the caller authorised.
- CodeToolBridge.run_code now takes allowed_tools/registry/timeout/
max_output_size as keyword-only params (new protocol, no external
implementers — fully backward compatible for existing callers).
- execute_code_with_tools forwards the invocation context to the bridge.
- Tests: recording bridge now uses only forwarded policy; added coverage
for policy/limit propagation and forwarded-allow-list enforcement.
Co-authored-by: Mervin Praison <[email protected]>
Add a transport-agnostic CodeToolBridge protocol and parent-side
serve_tool_call helper in core, plus a backward-compatible bridge=
option on execute_code_with_tools. When a bridge is supplied, code runs
under isolation and reaches tools over the bridge (same allow-list +
approval gate); omitting it preserves today's in-process behaviour.
Concrete per-backend transports remain a follow-up in the sandbox layer;
core only defines the contract to stay lightweight.
Co-authored-by: MervinPraison <[email protected]>
Address three P1 gaps in the gateway cancellation/timeout work:
- Timeout was unreachable: add per_turn_timeout to the bot GatewayServerSchema
(extra="forbid" was rejecting it) and stamp it onto self.config in
start_with_config so the documented YAML knob actually takes effect.
- Turn isolation: pass the InterruptController per-turn as the entry point's
cancel_token instead of mutating the shared agent.interrupt_controller, so
overlapping sessions on one Agent instance no longer interrupt each other.
Legacy agents without a cancel_token kwarg fall back to the shared attribute.
- Cancellation honesty: interrupt cooperatively first and wait a bounded grace
window (_ABORT_GRACE_SECONDS) for the turn — including a sync agent.chat in a
worker thread that cannot be force-killed — to unwind before the serial
session queue advances; hard task.cancel() only as a fallback.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Empty-string targets were skipped by the `if target` truthiness check,
retaining the silent fallback/misroute this validation prevents. Skip
only None (omitted) so every supplied string target is validated.
Co-authored-by: Mervin Praison <[email protected]>
Wire per-turn abort + timeout into the gateway so a runaway turn can no
longer wedge the serial per-session queue:
- Advertise the `abort` method (+ `message_abort` event) in the hello
capability handshake instead of the "abort not implemented" placeholder.
- Handle `abort`/`message_abort` WS frames and a portable `/stop` chat
command; both drive the existing InterruptController and cancel the
driving asyncio task via a new `_active_turns` registry.
- Run each turn under an optional `gateway.per_turn_timeout` (YAML/config
knob, 0 = disabled) via `_drive_turn`, normalising cancelled/timed-out
turns to a typed terminal message instead of leaving them hanging.
Reuses core's InterruptController (already checked by the agent run loop)
and `agent.interrupt_controller`; no new agent params.
Co-authored-by: MervinPraison <[email protected]>
Cross-check every channel's routes/routing targets (including default) and
bindings.agent against the declared agents: map in the canonical schema
validator. A typo now fails fast at load time (and in gateway doctor, which
loads via this schema) with the channel, bad target, and closest valid agent
id — instead of a silent logger.warning + misroute. Only enforced when
agents: is declared, so single-bot configs stay backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
A run with session_id now routes to the stateful per-session agent
(_get_session_agent), not _get_agent. The test only stubbed _get_agent,
so it built a real Agent with no LLM backing and start() returned ''.
Stub the session builder too so the event fan-out contract is exercised
without a live LLM.
Co-authored-by: Mervin Praison <[email protected]>
Fixes Greptile P1: a value-taking run option whose separated value begins
with a dash (e.g. `--session -abc`, `--output -json`) was mis-classified by
`_flag_names` as an unsupported flag, diverting an otherwise fully
run-supported prompt to the legacy engine and losing session continuity,
--output modes, the credential gate and permissions.
`_flag_names` now accepts the `value_opts` set and skips the token consumed
by a value-taking option (with `--opt=value` handled inline). `_looks_like_
bare_prompt` passes `run`'s value-taking options in, and short-circuits the
no-dash case before the (potentially heavy) run-option introspection.
Co-authored-by: Mervin Praison <[email protected]>
Address 3 P1 review issues on the stateful warm-runtime session path:
- Attach id no longer replaces session identity: `run.py` passes the
persistence/conversation id as `session_id` and the `--attach` label as a
distinct `event_id`. A `--no-save --attach <id>` run streams events to the
attach id but stays on the isolated anonymous path (no persistence).
- Model override rebuilds the session agent: the per-session warm agent is now
keyed by the resolved model, so a later turn with a different model no longer
silently runs the previous provider/model.
- Continuity-wiring failure is not cached: when session-store wiring fails, the
turn runs one-shot but the unwired agent is not retained, so a later turn
retries wiring instead of permanently serving an uncoupled agent.
Wrapper-only (praisonai-code); no core SDK changes, no new Agent params, no new
deps. Adds tests for model override, continuity-failure, and event/session id
separation; updates the attach mock to accept `event_id`.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1 findings on the interruptible-turn wrapper:
- Primary prompt-toolkit path now requests cooperative cancellation on
Ctrl-C when a turn is in flight (previously only reset the input
buffer), and clears any stale request at the start of each background
turn so a fresh turn is not immediately interrupted.
- _execute_prompt_interruptible refuses to start a new turn (and to clear
the shared controller) while a prior abandoned worker is still alive,
preventing the abandoned turn from being un-cancelled and resuming
against the warm session.
- Added test_abandoned_worker_blocks_new_turn.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The CLI router treated any -/-- flag as a signal to fall back to the legacy
argparse engine, so common cases like `praisonai "fix the bug" --model gpt-4o`,
`--continue`, or `--output json` silently bypassed the modern `run` engine and
lost session continuity, --output modes, the credential gate and permissions.
_looks_like_bare_prompt now derives the run-supported option names by
introspecting the run command's Click parameters and routes a bare prompt to
`run` when every flag present is one run accepts; genuinely legacy-only flags
(and .yaml/.yml workflows) still fall back to legacy, now with a one-line
notice so the fallback is never silent. _build_run_argv reconstructs the
prompt + flags into a single `run "<prompt>" <flags>` invocation.
Co-authored-by: MervinPraison <[email protected]>
The warm runtime was a cold-start cache only: every /run cleared history
and --continue/--session runs bypassed the warm path, paying cold-start
each turn. Add a per-session warm agent registry keyed by session id that
rehydrates history once (via the existing apply_cli_session_continuity
wiring) and retains it across turns, while the anonymous path stays
isolated. Relax runtime_eligible so --continue/--session route to the warm
stateful path (fork/isolated/thinking/tool runs stay in-process).
Co-authored-by: MervinPraison <[email protected]>
Attach the core InterruptController to the interactive agent and run each
turn in a worker thread so the main thread stays responsive. Ctrl-C during
a turn now requests cooperative cancellation; the core chat loop honours it
at the next step boundary, returns partial output, and keeps the warm agent
and session intact. Wrapper-only change reusing the existing core primitive.
Co-authored-by: MervinPraison <[email protected]>
- write_file compute bridge: replace heredoc with base64-decoded stdin so
content can no longer terminate the heredoc early (silent truncation) or
inject host commands.
- LocalCompute._install_packages: validate pip specifiers against the strict
allowlist and shlex.quote each token before host execution.
- LocalManagedAgent._ensure_agent: pass api_key/base_url directly to the inner
Agent instead of os.environ.setdefault, preventing process-wide credential
pollution and subprocess env leakage across tenants.
Co-authored-by: MervinPraison <[email protected]>
Do not clear task._execution_context inside _build_execution_context.
The run_task/arun_task retry loops re-enter this helper on guardrail /
completion failures; clearing stripped the upstream output and validation
feedback the retry needs (Greptile P1). The Process engine already owns
this field's lifecycle (re-set before each yield, reset to None before
selecting the next task), so no cross-task leak.
Co-authored-by: Mervin Praison <[email protected]>
- mcp.py: wrap session.call_tool/read_resource/get_prompt in asyncio.wait_for
so a hung server fails one request without wedging the runner loop forever
- agents.py: fold task._execution_context (inter-task context + validation
feedback built by Process._build_task_context) into the prompt builder, and
clear it after consumption so it doesn't leak into later runs
- workflows.py: track future->idx map in parallel loop so error attribution
survives exceptions instead of using an unbound/stale idx
Co-authored-by: MervinPraison <[email protected]>
The legacy async tool loop in _achat_completion fired BEFORE_TOOL/AFTER_TOOL
inline and then again inside execute_tool_async, double-firing hooks when
registered and building hook inputs (os.getcwd/time.time) with no consumer
when none are. Rely on the single guarded dispatch in execute_tool_async,
which already handles blocking, arg mutation and after-context aggregation.
Co-authored-by: Mervin Praison <[email protected]>
The --entrypoints option was documented and parsed into use_entrypoints
but never wired to any discovery behavior. Removed the dead flag and
updated the docstring to reflect the actual --include-only interface.
Co-authored-by: Mervin Praison <[email protected]>
action_discover now reads built-in/external/registered/local from the
canonical ToolResolver.list_available_sources() in a single authoritative
walk, matching the resolver-first pattern already used by _get_builtin_tools
and templates/tools_doctor.py. The original praisonai_tools + TOOL_MAPPINGS
scan is preserved as an explicit offline fallback (_legacy_manual_scan) for
environments without praisonai-code. --include/--entrypoints flags and
grouped output are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Downstream _execute_tool_async_impl matched only on __name__ and called
func(**args) directly, so a BrowserBaseTool-style BaseTool instance
(resolved by .name in dispatch) returned "not found" / never ran. Mirror
the robust sync resolution (BaseTool.name, FunctionTool .name alias, class
name) and invoke func.run() for BaseTool instances.
Also fix the short-circuiting `or` chain in async dispatch so an aliased
.name that differs from __name__ resolves instead of being dropped.
Adds regression tests exercising the real (unmocked) execute_tool_async
for a BaseTool instance and an aliased callable name.
Fixes#3450
Co-authored-by: Mervin Praison <[email protected]>
Address CodeRabbit review: when neither the monorepo praisonai-mcp sibling
nor an installed praisonai_mcp.mcp_server is available, the C12 shim cannot
resolve. Convert the resulting bare ModuleNotFoundError collection error into
a clean module-level pytest.skip. Guard find_spec against ModuleNotFoundError/
ValueError for an absent/broken parent, mirroring praisonai._bootstrap.
Co-authored-by: Mervin Praison <[email protected]>
Bot --browser wired BrowserBaseTool (a BaseTool instance without
__name__), causing async tool dispatch to raise
'BrowserBaseTool' object has no attribute '__name__'. Harden the
lookup in _achat_completion to resolve by __name__, .name, or class
name so all BaseTool subclasses dispatch safely, and drop the ad-hoc
__name__ monkey-patch in bots_cli.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- Guard Unix-only ``resource`` import so _admission.py loads on Windows;
sampler self-disables gracefully when unavailable (Greptile P1 #1).
- Wire ``max_rss_mb`` through BotOS + gateway.yaml via a single-knob
build_memory_pressure_policy() so the feature has a live production
consumer instead of a dormant param (Greptile P1 #3).
- Surface max_rss_mb in admission stats; document resource-only soft-queue
degradation honestly rather than silently misleading (Greptile P1 #2).
- Correct MemoryPressurePolicy docstring to reference the real config key.
- Add tests: Windows-safe sampler, single-knob policy, BotOS wiring, stats.
Co-authored-by: Mervin Praison <[email protected]>
Move the new continuable param to the end of schedule_add() so the
pre-existing 9th positional slot still binds accept_suggestion, avoiding
a silent behaviour change for positional callers (Greptile P1).
Co-authored-by: Mervin Praison <[email protected]>
A transient DLQ-init failure no longer latches _outbound_resilience_ready,
so a later delivery re-attempts initialization once storage recovers,
instead of permanently degrading to retry-only and silently dropping
permanently-failed replies. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Runtime exception messages could contain non-cp1252 characters that
would re-trigger UnicodeEncodeError on Windows consoles when printed.
Wrap exception interpolation in ascii() for all 7 failure messages.
Co-authored-by: Mervin Praison <[email protected]>
A delivered automated brief now seeds a resumable session so the user's
reply in the same chat resumes the job's conversation with full context,
instead of landing as a contextless new turn.
- core: add declarable DeliveryTarget.continuable field (opt-out only,
round-tripped in to_dict/from_dict) as the 3-way surface contract
- wrapper: gateway _deliver_scheduled_result seeds the reply session via
the existing mirror_to_session path when continuable
- tool/CLI: thread continuable through schedule_add + a --no-continuable
flag for fire-and-forget notices
Co-authored-by: MervinPraison <[email protected]>
Gateway admission was concurrency/CPU-scaled only and blind to memory, so a
burst of concurrent turns on a small always-on host drives RSS up until the
OOM killer fires — observed only post-mortem. This adds a resource-pressure
policy that queues under soft RSS pressure and sheds under hard pressure,
reusing the existing admission seam.
Core (praisonaiagents/gateway): ResourceSample, ResourcePressurePolicyProtocol
and a stdlib-first MemoryPressurePolicy (pure decision, no heavy imports),
sitting beside the concurrency / rate-limit / scale-to-zero policy family.
Wrapper (praisonai_bot/bots/_admission.py): a lightweight _RssSampler
(psutil-optional, resource.getrusage fallback, self-disables on unsupported
platforms) and AdmissionGate(resource_policy=...) wiring that folds the
resource decision into admit() by escalating to the more restrictive outcome.
Co-authored-by: MervinPraison <[email protected]>
Mirror the durable inbound journal on the outbound side: when no
outbound DLQ path is configured, default to the canonical per-platform
store (~/.praisonai/state/<platform>/outbound_dlq.sqlite) so a
permanently-failed or exhausted reply is parked (auditable + replayable)
instead of silently dropped. Escape hatch: outbound_resilience.enabled=false.
Co-authored-by: MervinPraison <[email protected]>
The wrapper permits a range of praisonaiagents versions (>=1.6.152), but
_attach_gateway_runtime imported GatewayRuntimeSeams/GatewayAdapterContractError
unconditionally — symbols only present in current core. On an older-but-allowed
core that import raised ImportError on every start()/probe()/health() (Greptile
P1). Guard the import and fall back to the pre-contract duck-typed splices so
those installs keep wiring identity resolution, delivery routing, admission
control, and cross-platform turn locking. The no-seams path now returns before
any import, staying a pure no-op independent of core version.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Classify loopback numerically via ipaddress so 127.0.0.2,
127.255.255.255, and expanded IPv6 ::1 keep the snappy loopback drain
instead of the 15s production window. Addresses Greptile review feedback.
Co-authored-by: Mervin Praison <[email protected]>
- classify_reload now rejects empty channel names (channels., channels..enabled)
and falls through to the fail-safe FULL restart instead of restarting channel ""
- wrapper _build_reload_plan gracefully degrades to full restart if an older
supported praisonaiagents lacks classify_reload, instead of crashing the reload
- add regression tests for malformed channel paths
Co-authored-by: Mervin Praison <[email protected]>
The unset (None) reliability posture now resolves to a backpressured
deployment — bounded admission ceiling + fair wait queue + graceful drain —
instead of the old no-admission one. It is bind-aware: a non-loopback bind
(a real deployment) resolves to the full production window, loopback keeps a
snappy 5s drain. reliability="off" opts back into today's immediate-teardown
behaviour; explicit reliability="default" keeps the legacy no-ceiling posture.
Co-authored-by: MervinPraison <[email protected]>
Add a pure, side-effect-free ReloadScope/classify_reload registry to the
core SDK so hot-appliable vs channel-scoped vs agents vs full-restart is
classified identically by every runtime, instead of being duplicated
ad-hoc in the wrapper. The wrapper's _build_reload_plan now delegates to
core, keeping the existing scoped per-channel restart behaviour while the
contract "grows" in the authoritative layer. Backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback on PR #3437:
- Greptile P1: the published editor schema was stricter than the runtime.
generate_agents_schema() now relaxes AgentConfig (drops required
role/goal/backstory, which the runtime auto-fills or maps from
'instructions') and allows list-form roles/agents (runtime _list_to_dict),
so editors no longer flag valid, executable YAML. The strict YAMLConfig used
by ConfigValidator is unchanged.
- Greptile P2: replace the silent `except Exception: pass` around the
yaml-language-server header write with a debug log so a dropped directive is
diagnosable.
- Regenerate agents.schema.json; add a runtime-parity guard test.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Legacy-only sessions now honour --sanitise instead of returning a raw
verbatim transcript, closing a secret-leak gap.
- Enforce --redact-level contract: validate against REDACT_LEVELS (standard|
strict), reject typos at the CLI, and give strict a real effect (masks
bearer tokens and PEM private-key blocks).
- Path matcher now covers single-segment POSIX (/tmp), C:/ Windows, and UNC
(\\server\share) paths; the cwd is masked as a stable path placeholder so it
is no longer half-masked as a secret leaving a dangling suffix.
- Add tests for single-segment/UNC paths, cwd suffix, strict mode, invalid
level, and exported REDACT_LEVELS.
Co-authored-by: Mervin Praison <[email protected]>
Derive a JSON Schema from YAMLConfig (generate_agents_schema), publish it as
a committed agents.schema.json artefact, expose it via `praisonai validate
schema --agents/--output`, and prepend a `# yaml-language-server: $schema=`
header when auto.py scaffolds agents.yaml so editors give autocomplete /
inline validation out of the box. Authoring-time only; runtime parsing and
execution are unchanged (a leading YAML comment is ignored by safe_load).
Co-authored-by: MervinPraison <[email protected]>
Address CodeRabbit review on MCP test conftest:
- Check the shim's required praisonai_mcp.mcp_server submodule instead of only
the top-level package, so a partial/incompatible install can't pass the guard
while collection still fails.
- Emit a pytest_report_header when MCP tests are skipped so contributors see why
and how to install praisonai-mcp.
Co-authored-by: Mervin Praison <[email protected]>
Playwright's "playwright install" banner uses box-drawing frame characters
(U+2551 etc.). On Windows cp1252 consoles these could clutter the sanitized
error text with '?' placeholders, obscuring the actionable hint. Map the
common frame characters to spaces in safe_error_message's symbol table so the
hint stays readable while remaining ASCII-safe.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add a lightweight, deterministic redactor so `praisonai session export
<id> --sanitise` (alias `--sanitize`) replaces secrets, absolute paths,
the working directory, and embedded file contents with stable
`[redacted:<category>:<n>]` placeholders. Default export is unchanged.
- new redact.py helper with stable placeholder map (stdlib only)
- wire redact/redact_level through export_session (Python: redact=True)
- wire --sanitise/--sanitize + --redact-level CLI flags, default off
- unit tests over a seeded secret, absolute path, and stable placeholders
Co-authored-by: MervinPraison <[email protected]>
Add tests/unit/mcp/conftest.py that restores the monorepo dev layout via
ensure_praisonai_mcp() and uses collect_ignore_glob to skip the directory
when praisonai_mcp is neither installed nor present as a sibling checkout,
turning a ModuleNotFoundError collection error into a clean no-op.
Co-authored-by: Dhivya-Bharathy <[email protected]>
The basic smoke script crashed with UnicodeEncodeError on Windows
default consoles (cp1252) because print() statements embedded emoji
(U+1F9EA, U+2705, U+274C, U+1F389) that cannot be encoded to stdout.
Replace all emoji with ASCII status tags ([TEST], [OK], [FAIL]) so the
script runs on any terminal encoding without decoration loss.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Addresses CodeRabbit nitpick: add praisonai.yml / legacy praison.yml
discovery tests and a precedence test asserting canonical praisonai.yaml
wins over legacy praison.yaml when both are present.
Co-authored-by: Mervin Praison <[email protected]>
The praisonai-code resolver only searched for `praison.yaml` at the
project root, which is inconsistent with the agents SDK loader
(`praisonaiagents/config/loader.py`) that uses the canonical
`praisonai.yaml`. Add `praisonai.yaml`/`praisonai.yml` as the primary
project-root names while retaining `praison.yaml`/`praison.yml` for
backward compatibility, and update the docstring reference. Adds
regression tests covering both the canonical and legacy names.
Co-authored-by: Leebana <[email protected]>
CapabilityValidator cached the MCP server snapshot once, so servers that
connected after the first validation stayed invisible under STRICT
enforcement. Read the process-level registry live each call (cheap
set-copy under lock); tool cache is unchanged. (#3307)
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: port loop-task pre-expansion from workflow() into aworkflow() so
async workflows with a CSV-driven loop start task expand per-row instead
of running once.
Gap 2: guard the per-turn _turn_tools_used buffer with the same
AsyncSafeState lock that protects chat_history, routing all sites through
_reset/_record/_drain helpers so concurrent chat()/achat() turns on one
Agent no longer corrupt hook/self-improve tool data. Backward-compatible
_turn_tools_used property retained.
Gap 3: track namespaced MCP server names in a process-level registry
(MCP.list_active_server_names(), populated in with_tool_prefix) and read
it from CapabilityValidator._get_available_servers so MCP-server-gated
skills can pass STRICT validation instead of always failing closed.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
parallel_handoffs runs children via asyncio.gather, which copies the
context per task. A copied ContextVar binding still references the same
parent list object, so when parallel_handoffs runs inside a non-empty
parent handoff chain, sibling tasks mutated a shared list and corrupted
cycle/depth tracking. Rebind each task's chain to a fresh per-task copy
at _run_one entry so siblings are fully isolated.
Co-authored-by: Mervin Praison <[email protected]>
- memory_mixin: append per-instance uuid suffix to default session_id so
same-named agents can no longer collide and bleed chat history
- handoff: replace threading.local() with contextvars.ContextVar so handoff
chain/depth is isolated per asyncio.Task under parallel_handoffs
- hooks/runner: add HookRunner.execute_async alias so async retry-with-backoff
no longer crashes with AttributeError
Co-authored-by: MervinPraison <[email protected]>
Address reviewer-flagged concurrency gaps in the scheduler + template cache:
- TemplateCache locks are now process-wide (class-level, keyed by path) so two
independent instances over the same dir coordinate; get() reads under the
per-key lock so it never observes the intermediate two-rename window; put()/
invalidate() take root+key locks and clear() takes the root lock, so a
concurrent clear() can no longer rmtree a half-written entry. put() stages
into a reserved .staging subdir (same fs, atomic os.replace) that clear()
skips, eliminating the put-vs-clear FileNotFoundError.
- AsyncAgentScheduler.start() no longer reports a successful start (and no
longer spins up a background task) when the immediate run trips the budget
brake (e.g. max_cost=0), matching the actually-stopped state.
Verified: 4 writer/clearer + 2 reader concurrency smoke test -> 0 races;
zero-budget start returns False with no task; 335 scheduler+template tests pass.
Co-authored-by: Mervin Praison <[email protected]>
- Async scheduler now honours the intentional-silence marker on delivery
(shared _should_suppress_delivery on _BaseAgentScheduler); removes the
duplicate budget guard, replacing both with a single _budget_exceeded()
helper that treats max_cost=0 as a real zero budget.
- TemplateCache.put()/invalidate() now stage into a sibling temp dir and
atomically os.replace() under a per-key lock, so concurrent readers never
observe a half-populated or mid-rmtree cache entry (multi-agent/interprocess).
- Scheduled agents.yaml tools now resolve through the canonical ToolResolver
(same path as `praisonai run`), instead of dropping everything but a
hardcoded search_tool — keeping CLI/YAML/Python behaviour identical.
Co-authored-by: MervinPraison <[email protected]>
- agents.py: _build_execution_context gains skip_memory_init; aexecute_task
passes True so a failed initialize_memory_async() no longer falls through
to the synchronous initialize_memory() on the event-loop thread.
- execution_mixin.py: reset app.openapi_schema after registering a shared-port
route so later launch() calls appear in /openapi.json and /docs.
Co-authored-by: Mervin Praison <[email protected]>
- Agent.launch(): register every path (not only first per port) and move the
keep-alive loop outside _server_lock so a second agent on a shared port is
no longer silently dropped and the process-wide lock isn't held forever.
- aexecute_task(): initialize memory via initialize_memory_async() to avoid
blocking the shared event loop on synchronous Memory() construction.
- MongoDBMemoryAdapter: factor embedding logic into shared _store/_search
helpers so short-term memory also gets/uses embeddings when
use_vector_search=True, matching the long-term tier.
Co-authored-by: MervinPraison <[email protected]>
These modules log exclusively via get_logger and never reference the
logging. namespace; the standalone import logging is dead code left over
from the get_logger migration. Removed it only where logging. is never
referenced (111 files); files that genuinely use logging. are untouched.
Co-authored-by: MervinPraison <[email protected]>
Delete two unreachable modules under context/fast/ that are never
imported, exported, or referenced anywhere in the SDK, tests, examples,
or docs:
- indexer/file_watcher.py (FileWatcher, IncrementalIndexer, ...)
- search_strategy.py (SearchStrategy, SearchState, SearchPhase)
Grep confirms only the definition sites matched; no importers exist.
Live FastContext path (fast_context, search_backends, parallel_executor,
indexer/file_indexer, symbol_indexer) is unchanged. No __init__.py edits
needed since neither module is exported.
Co-authored-by: Mervin Praison <[email protected]>
The registry.py copy of get_available_integrations() was unreferenced dead
code duplicating the canonical base.py implementation. The public symbol is
exported from integrations/__init__.py and lazily resolved via
_unified_registry.py, which binds to the base.py version. No importer, no
__all__ entry, and no internal caller referenced the registry.py copy.
Co-authored-by: MervinPraison <[email protected]>
Address three P1 review findings on the prompt-cache-stability contract:
- Wire GatewayMetrics into per-bot sessions via a new _stamp_metrics splice
(mirrors _stamp_admission_gate/_stamp_identity_resolver), called from both
start_channels and hot-reload, so prompt_cache_invalidations_total actually
increments in production instead of staying zero.
- Clear _prefix_sig in every session-clear path (_clear_session_data,
reap_stale, reset_all) so a reopened session establishes a fresh baseline
instead of emitting a false PROMPT_PREFIX_INVALIDATED against the old one.
- Fingerprint the full provider-visible tool schema (name + description +
parameters for dict tools, name + docstring for callables) instead of only
tool names, so a same-name schema edit is detected. Best-effort; never raises.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Core (praisonaiagents): new advisory HookEvent.PROMPT_PREFIX_INVALIDATED
and a pure prompt_prefix_signature(agent) that fingerprints only the
cache-relevant prefix (model + sorted tool names + system-prompt fp),
excluding volatile per-turn data. Kept out of agent.py to avoid bloat.
Wrapper/bot: BotSessionManager computes the signature after its per-turn
tool/model swaps, meters drift via an optional prompt_cache_invalidations_total
GatewayMetrics counter, and fires the advisory hook so silent provider
prompt-cache misses on long-lived conversations become auditable.
Co-authored-by: MervinPraison <[email protected]>
When team.astart() raises during a YAML/AgentTeam `--output stream-json`
run, the adapter now emits a terminal run.error event (best-effort,
without masking the original exception) before detaching the bridge,
matching the single-agent path's contract so consumers can distinguish
a failed run from an incomplete/still-running one. Fixes greptile P1.
Co-authored-by: Mervin Praison <[email protected]>
AgentTeam now exposes a lazy aggregate stream_emitter that fans in member
agents' StreamEventEmitter events, tagging each with the emitting agent's
agent_id. The PraisonAI adapter attaches the CLI stream-json bridge to this
team emitter around team.astart(), so `--output stream-json` on a YAML/team
run emits the same per-agent, per-step NDJSON stream as single-agent runs.
Both paths are zero-overhead no-ops outside structured output mode.
Co-authored-by: MervinPraison <[email protected]>
The event-loop liveness watchdog flags were only registered on the legacy
argparse parser in cli/features/gateway.py, which the real
`praisonai gateway start` Typer entrypoint (cli/commands/gateway.py) never
uses — so `--watchdog` / `--watchdog-timeout` were rejected at the primary
opt-in surface. Add both options to the Typer command and forward them to
GatewayHandler.start using the same None-means-fall-back-to-YAML convention
as the other store_true flags. `restart` already replays them via the
persisted start-flags. Adds 3 CLI-surface tests.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
Arm the existing core LoopWatchdog (#3385) around the gateway serving loop
so a frozen event loop dumps all-thread stacks and hard-exits with the
restart exit code, letting systemd/launchd/Docker relaunch the process.
Opt-in via gateway.watchdog YAML block and --watchdog/--watchdog-timeout
CLI flags; zero cost when disabled. No systemd unit change needed since it
reuses GATEWAY_RESTART_EXIT_CODE (75).
Co-authored-by: MervinPraison <[email protected]>
- Make add_message/_modify_session_locked run the whole read-modify-write
inside a single BEGIN IMMEDIATE transaction so concurrent gateway
processes cannot lose appends (the process-local RLock alone did not
serialize across processes). Fixes Greptile P1 lost-update.
- Import legacy per-session JSON transcripts once when the SQLite store
first opens beside them, so upgrading to the sqlite default preserves
durable/resumable history. Fixes Greptile P1 legacy-invisibility.
- Wire the YAML session.store key through MultiChannelGatewayConfig.from_dict
so store: file|sqlite is actually honoured.
- Add concurrent-writer and legacy-migration tests.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two P1 review findings on the RunOutcome terminal-outcome contract:
- Nested operation timeouts no longer misreported as run-budget hard_timeout.
RunOutcome.from_exception no longer promotes a bare asyncio.TimeoutError to
hard_timeout; the run-level budget is now the sole authoritative source of
hard_timeout, enforced explicitly in _astart_with_outcome via a task+wait so
only our own budget expiry maps to hard_timeout (inner TimeoutErrors -> failed).
- External asyncio.CancelledError is re-raised instead of being swallowed into a
benign RunOutcome, so cooperative cancellation / host shutdown is honoured.
Updates tests accordingly and adds coverage for nested-timeout->failed and
external-cancellation-propagates.
Co-authored-by: Mervin Praison <[email protected]>
Implement SqliteTranscriptStore(DefaultSessionStore) storing session
transcripts as one row per session in a WAL SQLite DB (concurrent readers,
transactional single-row writes, indexed lookups) instead of per-session JSON
files under a cross-process FileLock. It overrides only the persistence
primitives, inheriting all retention/compaction, message API, search scoring,
bookends and lineage-dedup logic unchanged.
Directory scans (list/search/gateway routing) are replaced with indexed
SELECTs. The gateway now defaults to this store when persistence is enabled,
selectable via a new `session.store` config key (`sqlite` | `file`).
Co-authored-by: MervinPraison <[email protected]>
Adds a small, closed RunOutcome result type in core plus an opt-in
return_outcome=True on run()/astart() so long-running hosts (gateways/bots)
can decide delivery/retry/DLQ from one field instead of inferring the
terminal state from exception identity. Distinguishes
completed|hard_timeout|cancelled|aborted|failed. String return unchanged.
Co-authored-by: MervinPraison <[email protected]>
Core save/restore_session_state only persist team._state, not per-agent
chat_history, so resumed/forked YAML team runs did not actually continue
the prior conversation (Greptile P1). Add wrapper-only capture/rehydrate
helpers that stash each agent's chat_history into team state on save and
re-inject it on restore — parity with the single-agent path, no core
change and no new Agent/AgentTeam params.
Also replace the source-text arun test with a behavioral call-order test
and add roundtrip/no-duplicate coverage for the chat-history helpers.
Co-authored-by: Mervin Praison <[email protected]>
Route YAML/team runs through the same --continue/--session/--fork/--no-save
continuity the single-agent prompt path uses, via existing core APIs.
- praisonai_adapter.arun(): resolve resume_session/auto_save from cli_config,
force-enable shared memory when a session is active, restore_session_state
before astart() and save_session_state after (save never fails a run).
- praison_ai._extract_cli_config_for_yaml(): thread resume_session/auto_save
into cli_config for `run agents.yaml`.
Wrapper-only; no new params/deps/core changes. Adds regression tests.
Co-authored-by: MervinPraison <[email protected]>
Address final-review P1s on #3401:
- Composite readers (AutoReader/DirectoryReader/GlobReader) now idempotently
wire the default readers into the core registry on first load(), so they no
longer silently return [] when register_default_adapters() was never called.
Keeps imports side-effect free (wrapper does heavy wiring at call time).
- _ensure_sibling() guards importlib.util.find_spec against ImportError/
ValueError from a discoverable-but-broken installed sibling, falling back to
the monorepo checkout instead of crashing.
Co-authored-by: Mervin Praison <[email protected]>
- Remove import-time auto-registration in adapters/{retrievers,rerankers,
readers}.py so importing them no longer mutates core-SDK singletons;
add idempotent, thread-safe register_default_adapters() single edge
(mirrors vector_stores.py policy).
- Make aretrieve()/arerank() genuinely async via asyncio.to_thread so the
blocking provider call no longer freezes the caller's event loop.
- Collapse the six copy-pasted ensure_praisonai_* functions in
_bootstrap.py into one _ensure_sibling() helper + table, fixing the
sys.path double-insert race with a lock.
Co-authored-by: MervinPraison <[email protected]>
Update _load_project_config docstring to reflect that home is now
excluded from project config discovery, and add two regression tests
covering the home-directory walk-up boundary.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1s on MTP fast-inference PR:
- export gguf now produces a LOCAL .gguf (needed by serve/--mtp-draft) and
only additionally pushes to the Hub when --hf is given (was Hub-only).
- find_llama_binary no longer returns a differently-named executable when
LLAMA_CPP_BIN points at one binary and a sibling is requested; falls through
to PATH / raises instead of launching e.g. llama-cli with server flags.
- Ollama disk preflight only enforces the 1.5x requirement when the source
size is known; skips (no false-positive block) for Hub-backed FROM.
Adds 6 tests (binary-lookup mismatch cases, gguf local/push dispatch,
unknown-source disk skip); full praisonai-train unit suite 118 passed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Remove three module-level helpers that were never referenced anywhere in
the monorepo and were not part of the public API (no __all__, absent from
config/__init__.py and the top-level lazy-import map):
- parse_url_to_config
- is_numeric_string
- make_array_error
All exported/used helpers remain untouched.
Co-authored-by: MervinPraison <[email protected]>
Move the module-level `from pathlib import Path` into each
`ensure_praisonai_*` monorepo-dev fallback branch. Path is only ever
referenced after the `import praisonai_<pkg>` early-return fails, so the
installed-wheel hot path no longer pays pathlib's ~8.7ms cold-import cost.
Behaviour is byte-for-byte identical.
Co-authored-by: MervinPraison <[email protected]>
Addresses two correctness gaps in the crash-recovery labelling (PR #3388):
- CodeRabbit: hand recovery_annotator its own fresh payload copy and only
adopt a dict result, so a mutate-then-raise no longer leaks a half-labelled
payload; validate non-dict returns.
- Greptile P1: keep a crash-recovered entry in the 'recovered' state on a
transient re-send failure (mark_failed keep_recovered) so the duplicate
label survives the retry instead of being demoted to 'failed' and dropped.
Adds 3 regression tests (mutation-then-raise fallback, non-dict return,
sticky-recovered retry). All 69 outbox/delivery/reconcile tests pass.
Co-authored-by: Mervin Praison <[email protected]>
- disarm racing an in-flight wedge no longer triggers os._exit (re-check
_stop before the destructive exit) so a deliberate disarm never causes a
supervisor restart (Greptile P1)
- reject NaN/inf probe_interval_s to avoid a dead watchdog worker or a
hung shutdown via Event.wait/Thread.join (Greptile P2)
- add tests for both cases
Co-authored-by: Mervin Praison <[email protected]>
Add an optional recovery_annotator hook to OutboundQueue.drain, applied only
on the unreconciled 'recovered' branch, so a mid-send-crash message re-sent
at-least-once can be visibly marked as a possible duplicate instead of being
re-delivered silently. DurableDelivery gains a backward-compatible
mark_recovered flag (off by default) that prefixes recovered string replies
via _annotate_recovered_payload, threaded through setup_durable_delivery.
Co-authored-by: MervinPraison <[email protected]>
Add a pure-stdlib, fail-open LoopWatchdog primitive to core
(praisonaiagents.gateway) that runs on a dedicated OS thread, probes the
asyncio loop via call_soon_threadsafe, and after N missed probes dumps
all-thread stacks (faulthandler) and hands the process back to the
supervisor via os._exit(EX_TEMPFAIL). Opt-in and fail-open by design.
Co-authored-by: MervinPraison <[email protected]>
Passive-recorded group messages now land on the same shared per_chat
group key that a subsequent addressed turn reads from, so under
session_scope="per_chat" the bot can actually see the preceding
conversation (Greptile P1 / CodeRabbit Major). record_passive() threads
chat_id/thread_id/account routing and appends directly under a per-key
threading lock instead of the cross-thread mirror bridge, which would
dead-lock when called inline on the inbound handler's own event loop.
Strengthened the observe test to assert routing is threaded and added a
real BotSessionManager per_chat persistence test proving the passive
entry is visible under the group key and does not leak into the sender's
per_user history.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1s on the restart-continuation path:
- boot scan requested an explicit large limit so interrupted turns beyond
the store's 50-session default window are no longer silently skipped
- channel_target now falls back to the persisted client_id when it encodes
a channel:target origin, so the field is a live consumer of existing
state rather than dead code for sessions the setter never touched
Adds tests for client_id-derived origin and >50-session scan coverage.
Co-authored-by: Mervin Praison <[email protected]>
A malformed gateway.drain_timeout / gateway.reload_drain_timeout in a
hot-reload edit made _coerce_timeout() return None, which was assigned
unconditionally and silently cleared a previously-configured live drain
window. Distinguish malformed (keep live value via _KEEP sentinel) from
explicit disable (None/absent -> None). Update/extend tests accordingly.
Co-authored-by: Mervin Praison <[email protected]>
On boot, before serving traffic, scan persisted sessions for an in-flight
turn (is_executing / non-empty pending_inbox) lost to a restart. For
channel-originated sessions, deliver an exactly-once "interrupted — resuming"
notice via the existing durable delivery router (idempotency keyed on
(session_id, event_cursor)) and re-drive the turn when the agent is still
registered — independent of any client reconnect.
Reuses the existing durable session store + delivery router rather than
adding new core protocol machinery, keeping the change lightweight and
backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
Add a core HOT_APPLIABLE_KEYS registry + SupportsHotReload protocol in
praisonaiagents/gateway/config.py declaring the closed set of config paths
safe to apply in place. The bot gateway now classifies those paths as HOT in
_build_reload_plan (unknown keys still fall back to a restart plan — fail-safe)
and implements apply_hot_reload to mutate live state (logging level, drain /
reload_drain timeouts) without restarting channels or agents. Applied paths are
already reflected in the existing reload status/health.
Co-authored-by: MervinPraison <[email protected]>
Under the observe policy, group messages that do not mention the bot are
recorded into the session transcript as passive user context (no agent run)
so the bot has memory of the conversation when it is next addressed.
Reuses the existing thread-safe mirror append path via a new
BotSessionManager.record_passive() instead of adding a new core enum /
classifier, keeping the surface area minimal.
Co-authored-by: MervinPraison <[email protected]>
- Reject path-separator/traversal agent names (validate_agent_name) so
writes stay inside .praisonai/agents/ (Greptile Security P1).
- Post-write validation now re-parses the exact file written instead of a
precedence lookup, and warns when a higher-precedence definition shadows
the name so the reported `run --agent` step is never misleading (P1).
- Add tests for traversal rejection and global/project shadow warning.
Co-authored-by: Mervin Praison <[email protected]>
Add a `create` command beside `list`/`show` on the agent Typer app that
authors a valid, permission-scoped .praisonai/agents/<name>.md from a one-line
description. Interactive prompts plus a scriptable
--describe/--model/--permission/--global/--yes form. Permission presets reuse
the existing `mode` shorthands (MODE_RULES) so authored agents round-trip
losslessly through CustomDefinitionsDiscovery and inherit the runtime's
permission grammar. System-prompt drafting reuses the plain Agent path proven
by `init --generate`, degrading to an editable stub on any failure.
Co-authored-by: MervinPraison <[email protected]>
- _shim.py: skip None placeholders in sys.modules when pre-aliasing the
moved subtree so an unloaded optional module can't poison the old dotted
name (import old.sub -> "None in sys.modules"); _AliasFinder still resolves
it on demand.
- codex_cli.py: use an _UNSET sentinel in _build_command so an explicit
output_file=None disables the instance default and parses stdout, instead
of silently falling back to self.output_file (execute_with_schema).
Co-authored-by: Mervin Praison <[email protected]>
Restores eager subtree pre-registration in _shim._register_submodules. The
lazy-only variant broke module identity: a combined `from praisonai.mcp_server.cli
import X` imported the parent shim, then resolved `.cli` through _AliasFinder,
whose nested import_module re-entered mid-import under the import lock and
double-loaded the moved file — producing duplicate classes and breaking the
15 mcp/doctor CI tests that patch the shim path.
Also make the forced-format integration helpers (gemini stream/execute_with_stats,
codex stream, cursor stream) pop caller-supplied override keys before threading
the forced value, matching claude_code.py, so callers can't trigger a duplicate-
keyword TypeError (greptile P2).
Co-authored-by: Mervin Praison <[email protected]>
Address 4 P1 review findings in eval/trials.py:
- Isolation: rebind clone.chat_history to a fresh list and give the clone its
own system-prompt cache so per-attempt state resets never mutate/evict the
caller's live agent state.
- Scorer safety: a raising EvalCase.verify (and any scorer path) is now
recorded as a failed TrialScore instead of propagating through gather and
aborting the whole report.
- Timeout: run attempts on a dedicated ThreadPoolExecutor shut down with
wait=False so a wedged agent call cannot block run_trials past the timeout;
documented that a leaked worker thread cannot be force-killed.
- Duplicate case names: merge/extend attempts (with re-numbered indices)
instead of overwriting, so no attempts are silently discarded.
Add 4 regression tests covering each fix.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address three P1 issues in the trials→SFT exporter:
- --all (only_passed=False) now retains unscored attempts instead of
dropping them in _classify.
- Alpaca conversion no longer drops the user prompt when a system message
is present; system→instruction, all user turns→input.
- Score-only pass detection compares against the report's pass_threshold/
threshold/min_score when present, falling back to score>0 only otherwise.
Co-authored-by: Mervin Praison <[email protected]>
- session/hierarchy.py: mirror base loader contract so a transient OSError on
an existing file re-raises (instead of swallowing IOError and returning an
empty session), letting _modify_session_locked abort the write and preserve
history. Malformed JSON still starts fresh.
- approval/registry.py + agent/tool_execution.py: add per-call `force` to
approve_sync/approve_async so a PermissionManager `ask` rule gates only the
current call without mutating shared registry state, fixing the leak where an
unnamed agent's rule registered globally and gated other agents.
Co-authored-by: Mervin Praison <[email protected]>
Bridge verification to data generation: take a serialised trials report
(K scored attempts per case with captured trajectories), keep the passing
attempts via rejection sampling, and write them as a ShareGPT dataset the
existing trainer consumes unchanged. Adds export_trials() + ExportSummary,
provenance sidecar ({path}.meta.json), and a `from-trials` CLI command
beside generate/dedup/validate. Report is duck-typed over JSON (the contract
with the sibling core trials engine) so there's no hard dependency on unlanded
core code. Pure stdlib, additive, confined to the data namespace.
Co-authored-by: MervinPraison <[email protected]>
Gap 1: replace threading.local() handoff-chain storage with contextvars.ContextVar so concurrent asyncio handoffs no longer share one chain and corrupt each other's cycle/depth checks.
Gap 2: distinguish a transient OS read error from no-file/corrupt-JSON in the session store so a momentary read failure aborts the write (returns False) instead of silently overwriting real history with an empty session.
Gap 3: scope ApprovalRegistry tool-requirement state per agent so a per-agent PermissionManager ask rule no longer leaks an approval gate onto unrelated agents in the same process. Global registration (DEFAULT_DANGEROUS_TOOLS) is unaffected.
Co-authored-by: MervinPraison <[email protected]>
- Accept cached `huggingface-cli login` (get_token) in preflight, not just HF_TOKEN env (Greptile P1)
- Gate the hard CUDA check on train enabled so publish/export-only (train: false) validates on CPU (CodeRabbit Major)
- Resolve Ollama readiness endpoint from OLLAMA_HOST instead of hardcoded 127.0.0.1:11434 (Greptile P1)
- Translate `ollama create` failure into a clean RuntimeError and catch CalledProcessError in main()/export (CodeRabbit)
- Close serve_err TemporaryFile deterministically (CodeRabbit)
- Fix "Free up free space" typo (CodeRabbit)
- Guard non-mapping YAML config and require --model-dir to be a directory in export (CodeRabbit)
- Validate quantization_method in for_export too (CodeRabbit)
- Add tests for cached-login, train:false CPU, OLLAMA_HOST, and ollama-create failure
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Make praisonai-train usable by a non-developer: replace raw tracebacks with
clean actionable errors, validate the config up front, and harden the
Ollama/GGUF/HF export paths against the exact failures hit in practice.
trainer.py:
- main() wraps construction + run(); ValueError/RuntimeError print as a single
"ERROR: <msg>" line and exit 1 (no traceback); KeyboardInterrupt exits cleanly.
- validate_config() preflight (fails fast BEFORE model/GPU load): no-CUDA GPU,
missing HF_TOKEN when publishing, <10GB free disk, invalid quantization_method.
- check_gpu() guarded so it no longer crashes raw on a CPU-only box.
- Unknown-key warning now collects all keys and suggests the closest known key
(difflib) in one clear block.
- Silent-behavior NOTES: num_samples head-N-before-shuffle, split_type
validation/test contamination into training, and the max_steps=2800 default.
- HF push (merged/gguf) translates HfHubHTTPError 401/403 into actionable
messages; rmtree guarded so a namespaced repo id ("user/model") is never
treated as a local path to delete.
- Template fixes: warn when no known chat template matches, drop the broken empty
DeepSeek stop tokens, and never emit an empty PARAMETER stop line.
- for_export() classmethod to build an export-only trainer (no dataset needed).
_ollama.py:
- create_and_push_ollama_model() accepts optional quantization (--quantize),
disk pre-check on the OLLAMA_MODELS volume, and translates push 401/403 into a
message pointing at ~/.ollama/id_ed25519.pub + ollama.com/settings/keys.
- ensure_ollama_running() waits 15s, probes GET /api/version, and surfaces serve
stderr in the timeout message.
cli/commands/train.py:
- New `export <ollama|gguf|hf>` command to publish an already-trained model
without re-running training.
tests: tests/unit/train/test_robustness.py (14 tests, all deps stubbed).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add build_openai_tool_dict to mcp_schema_utils.py and delegate from the
three transport tool classes (HTTPStreamMCPTool, SSEMCPTool,
WebSocketMCPTool). Output dicts, including the __praisonai_deferrable__
marker, are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Replace flat len(text)//4 offline fallback in ContextCompactor.estimate_tokens
with the canonical estimate_tokens_heuristic from context.tokens, mirroring
context/aggregator.py. This removes duplicate logic and fixes under-counting
of non-ASCII (CJK/dense-script) text on the offline path.
Co-authored-by: MervinPraison <[email protected]>
Move wrapper-package discovery out of the Tier 2 ui.py CLI into the lazy
_wrapper_bridge via a new wrapper_package_path() helper, per ARCHITECTURE.md
§2 cross-tier boundary. Preserves preset resolution and the None fallback
(install hint) when the wrapper is absent.
Co-authored-by: Mervin Praison <[email protected]>
The UI loader was extracted to praisonai_code but resolved the bundled
default_app.py path via __file__-relative arithmetic anchored in
praisonai_code, which has no ui_* directories. The five bundled UI presets
ship in the praisonai wrapper package. Resolve the path against the installed
wrapper via importlib.util.find_spec("praisonai"), falling back to a clear
'pip install "praisonai[ui]"' hint when the wrapper is absent.
Co-authored-by: MervinPraison <[email protected]>
The executor context manager called shutdown(wait=True) on __exit__, which
re-blocked on a coroutine still hung past PRAISONAI_RUN_SYNC_TIMEOUT — defeating
the timeout (Greptile P1). Manage the pool explicitly and shutdown(wait=False)
in finally so a timed-out tool call returns immediately.
Co-authored-by: Mervin Praison <[email protected]>
The wrapper copy of agent_tools.py had drifted from the canonical
praisonai_code copy (missing the ACP cwd forwarding fix), and the two
resolved via different import spellings. Collapse the wrapper copy to a
thin re-export of the canonical praisonai_code implementation so both
import styles resolve to a single owner.
Reconcile the canonical module-local _run_sync bridge to keep the union
of both historical guarantees: running-loop safety (offload to a worker
thread) AND a timeout, without adding a wrapper dependency (C7 gate).
Co-authored-by: MervinPraison <[email protected]>
Address Greptile P1 review findings on PR #3358:
- _remove_worktree now returns a reason string when `git worktree remove`
fails (nonzero exit or exception) instead of silently returning None.
The caller keeps the tracking entry and records a preservation comment,
preventing orphaned worktrees/branches with dropped tracking.
- create_task persists the resolved top-level repo_path into task metadata
so the repo linkage that drove the worktree auto-upgrade is retained
between create and dispatch (an explicit metadata.repo_path still wins).
Adds tests for failed/exception removal tracking and repo_path persistence.
Co-authored-by: Mervin Praison <[email protected]>
Refinement 1: repo-linked tasks auto-upgrade workspace_kind to "worktree" at
create_task time (linkage-based, not content-inspecting). Explicit
workspace_kind and auto_worktree=false are respected. Derived branch
kanban/<task_id> is persisted for the dispatcher to consume.
Refinement 2: _remove_worktree is lossless by default — refuse to delete a
worktree that is dirty or has commits not in base; preserve it and record a
worktree_preserved comment. Removal with outstanding work is an explicit
force operation only.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two P1 review issues on the workspace-binding change:
- Resolve the UnifiedSession once (before workspace binding + tool load) and
pass it into _bind_resume_workspace, eliminating a second independent
last-session lookup that could race a concurrent CLI process and bind tools
to a different directory than the loaded conversation.
- When a resumed session's saved workspace no longer exists, pin
PRAISONAI_WORKSPACE to cwd instead of leaving it unset, so a stray legacy
PRAISON_WORKSPACE cannot leak through the tool loader and contradict the
"using current directory" warning.
Adds regressions for cwd-pinning over the legacy var and for
provided-session-without-relookup; updates the existing fallback test.
Co-authored-by: Mervin Praison <[email protected]>
Bot/gateway file tools resolve against a per-session Workspace attached to
the agent after construction, but the FileSnapshot backing Agent.undo was
created rooted at os.getcwd() — so /undo tracked the wrong directory.
Add Agent.set_snapshot_root() (core, parameter-only) and call it from the
bot smart-defaults after attaching the workspace so change tracking follows
the tools. Deliberately minimal: the per-turn workspace swap (bug 3) and
policy worktrees (blocked on #3354's WorktreeService) are out of scope here.
Co-authored-by: MervinPraison <[email protected]>
The `praisonai code --workspace` flag was dead: it wrote PRAISONAI_WORKSPACE
but ToolConfig.from_env read PRAISON_WORKSPACE, and _load_interactive_tools
unconditionally overrode config.workspace with os.getcwd(). Fix the env-name
mismatch (honour both, prefer canonical PRAISONAI_) and resolve the workspace
as PRAISONAI_WORKSPACE -> PRAISON_WORKSPACE -> cwd instead of hardcoding cwd.
Also bind resumed sessions to their directory: --continue/--session now reads
back the persisted UnifiedSession.workspace and roots the tools there, warning
and falling back to cwd when that directory is gone.
Scope kept minimal per AGENTS.md: no new WorktreeService — worktree isolation
already exists via core GitWorktreeAdapter (wired into `praisonai run`), so a
parallel wrapper service would duplicate it.
Co-authored-by: MervinPraison <[email protected]>
The gateway status command now passes the additive deep flag to
handler.status(); update the assertion to match the new backward-
compatible default.
Co-authored-by: Mervin Praison <[email protected]>
- Only attach GATEWAY_AUTH_TOKEN over loopback or HTTPS; never over remote
plaintext HTTP in preflight probes and version-skew check
- Slack @mention: use hook-returned content verbatim so an intentionally
emptied/redacted message is not silently restored to raw event text
- Inbound metrics: track whether a baseline pre-existed so the first check
against pre-existing traffic reports "baseline established" instead of a
false "no inbound"
Co-authored-by: Mervin Praison <[email protected]>
Extend gateway test/status with --check-runtime, --check-inbound, and
--check-duplicates; add sessions list/show, enriched /health, metrics
delta, doctor deep checks, and Slack @mention liveness fixes so operators
can prove live delivery and detect competing gateways.
Addresses the Greptile finding that reconnect() restarts the same bot
instance still holding the rejected token. On wake from the parked
credential state the supervisor now opportunistically calls an optional,
duck-typed refresh_credentials() hook so an out-of-band credential repair
(e.g. a rotated env var) driving a bare reconnect() self-heals without a
full restart. No-op for bots without the hook (env-var tokens are already
re-resolved by start()/hot-reload). Best-effort: a failing hook cannot
wedge supervision.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address two P1 review findings on the gateway restart-replay change:
- Only persist the start-flags artefact AFTER startup validation passes
(import/config/agent-file), just before the gateway binds, so a failed or
rejected start on the same host:port no longer clobbers the running
gateway's saved posture.
- restart --drain-timeout now defaults to None; an omitted flag replays the
persisted drain window (and falls back to 10s only when none is persisted)
instead of silently forcing a fixed 10s and shortening production drains.
An explicit value still wins for both the OLD-process drain and the relaunch.
Adds 3 regression tests covering omitted/explicit drain replay and the
no-persisted-value fallback.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Direct (non-service) `gateway restart` silently dropped the runtime flags
the process was started with (--openai-api, --reliability,
--max-concurrent-runs, ...), reverting production settings to defaults.
`start` now persists the non-None runtime flags to
~/.praisonai/gateway.start.<host>.<port>.json (keyed by bind host:port,
matching the PID lock), and `restart` loads and replays them so the
relaunch faithfully reproduces the running gateway. Explicit restart flags
(config / agents / drain-timeout) still win over persisted values.
Co-authored-by: MervinPraison <[email protected]>
Classify runtime 401/403 (and platform text equivalents like invalid_auth/
token_revoked) as a distinct CREDENTIAL_UNAVAILABLE outcome instead of a
generic FAILED. On a runtime credential rejection the supervisor now parks in a
named, redacted degraded state (reusing the boot-time "credential unavailable"
surface from #3159 in health()), stops hammering the invalid token, and
auto-recovers on reconnect/hot-reload without a full process restart.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 review findings on praisonai init --generate:
- Streaming stringified: _generate_agents_md used agent.start(), which
auto-enables streaming in a TTY and returns a generator whose repr was
written to AGENTS.md. Switch to agent.run() (always silent, returns str).
- Global mode wrote ~/AGENTS.md: with --global, base.parent is $HOME so the
agent scanned home and wrote home-tailored rules outside the repo. Resolve
the AGENTS.md target from git root / cwd independently of --global.
Add tests: --global still writes AGENTS.md to the repo root (not home), and
_generate_agents_md calls run() (not start()) returning the string body.
Co-authored-by: Mervin Praison <[email protected]>
Addresses the two Greptile P1 findings on #3346 so the non-zero-on-failure
contract holds across every reachable run path:
- _run_from_file: add `except typer.Exit: raise` so the deliberate failure
exit is not recaught by the broad handler (fixes duplicate reporting).
- _try_attach_runtime: classify the warm-runtime result and report failure so
an empty result exits non-zero instead of silently succeeding.
- _run_prompt_profiled / _run_from_file_profiled: apply the same failure
contract after the profiling report so profiled runs honour it too.
Adds a regression test for the warm-runtime attach path.
Co-authored-by: Mervin Praison <[email protected]>
Adds an opt-in `--generate` flag to `praisonai init` that runs a short,
read-only analysis agent (reusing the existing Agent runtime) to produce a
concise, repository-tailored AGENTS.md at the repo root. Feeds the agent a
cheap pre-scan (top-level tree, detected manifests, README head) to bound cost.
Non-destructive: respects --force, never overwrites an existing AGENTS.md, and
degrades gracefully to the static scaffold when no provider credential is
present or generation fails. The output lands where rules_manager already
discovers it on the next run.
Co-authored-by: Mervin Praison <[email protected]>
praisonai run reported success and exited 0 regardless of whether the
agent produced a result. Wire the existing run result (None/empty ==
failure) through the CLI: emit ok=<success> to the event bridge, a
machine-readable {"status": "failed"} object under --output json, an
actionable remediation, and raise typer.Exit(1) on failure — mirroring
the existing arg-error exit convention. Successful runs are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
The running-loop fallback in _structured_completion/_run_coro_sync spawned a
bare threading.Thread, which does not inherit contextvars. run_sync() inside it
therefore resolved via _default_bridge() -> empty _bridge_var -> shared _BG,
bypassing an active scoped_bridge() and leaking the fallback onto the global
loop. Run the worker under contextvars.copy_context() so both paths resolve the
same AsyncBridge (scoped override, else shared default), preserving per-session
loop isolation.
Co-authored-by: Mervin Praison <[email protected]>
- auto.py: runner threads in _structured_completion and _run_coro_sync now
dispatch to the shared AsyncBridge via run_sync() instead of asyncio.run(),
reusing one process-wide loop/thread and per-loop connection pools.
- auto.py: _completion_impl preserves the original LiteLLM exception and
chains it into the OpenAI fallback failure (raise ... from) so users see
both provider tracebacks instead of only the masking OpenAI one.
- registry.py: _validate_adapter treats a **kwargs catch-all as satisfying
the protocol keywords and also validates arun, unblocking third-party
entry-point adapters that forward **kwargs.
Co-authored-by: MervinPraison <[email protected]>
Embed turn prerequisite errors into the JSON payload instead of printing a
trailing plain-text line, so --json consumers get a single valid document.
Also drop dead critical-tool branch in is_already_approved.
Co-authored-by: Mervin Praison <[email protected]>
1. Circuit breakers: register weakref.finalize at breaker creation so the
process-global registry entry is removed when the Agent is GC'd, closing
the CPython id-reuse window where a new agent could inherit a stale OPEN
breaker. No longer relies on close()/aclose() being called. Uses a
staticmethod callback so the finalizer does not keep the agent alive.
2. Global tool-registry fallback: gate the @tool registry lookup in
execute_tool() behind ToolConfig(allow_global_tools=True) (default False).
By default an agent is scoped strictly to its declared tools=[...] and
cannot execute an @tool-decorated callable it was never given. Plugin-host
style dynamic dispatch can opt in via tool_config.
3. Sync run_task(): re-raise on fail_on_callback_error / fail_on_memory_error,
mirroring arun_task() so the documented fail-fast flags behave identically
on the sync and async surfaces.
Co-authored-by: MervinPraison <[email protected]>
Extract shared probe/shell/turn logic to praisonai_bot.gateway.preflight,
add praisonai gateway test orchestrator, doctor bots shell/probe checks,
fix doctor --json single-document output, and per-channel turn probe gate.
Critical tools honour mark_approved via the approval registry, shell enable
syncs AutoApproveBackend to the registry, @mentions run routing handlers,
and gateway doctor gains an offline --turn probe for inbound simulation.
Addresses two Greptile P1 findings on the allow_shell opt-in:
1. Routed agents lose shell tools: _inject_routing_handler swapped in a raw
agent from self._agents, stripping execute_command applied to the default
channel clone. Re-apply enable_shell_tools to the routed agent (cloned once
per channel+agent so non-shell channels never gain the shell tool).
2. Manual approval retained auto-approval (security): with auto_approve_shell
false and no Slack approval channel, a pre-existing AutoApproveBackend was
left installed, silently auto-approving shell. Now fail-closed with a
deny-by-default backend that rejects shell commands.
Adds tests for both fail-closed approval paths.
Co-authored-by: Mervin Praison <[email protected]>
- Fix missing approval_webhook_url becoming the literal string "None"
which bypassed WebhookApproval's ValueError guard; now falls through
to platform/gateway approval instead of building a broken backend
- Add fail-closed approval_mode validator (channel|gateway|http|webhook)
so config typos are rejected at load time, matching other enum fields
- Add regression tests for webhook-mode with and without a URL
Co-authored-by: Mervin Praison <[email protected]>
Extend allow_shell to route human-in-the-loop approvals through platform
backends (Slack/Telegram/Discord) plus gateway, HTTP, and webhook modes,
with gateway fallback for channels without native wiring.
Address reviewer feedback on the CLI_BACKEND_EXECUTE hook path:
- Security: redact prompt/system argv values (redact_command) at the
payload serialization boundary and in the plugin bridge, so prompts and
system instructions do not leak into downstream log sinks. The live
in-memory command field is preserved for programmatic consumers.
- Observability: emit the hook on failure too (extracted
_emit_cli_backend_hook helper) so subprocess startup errors and timeouts
remain traceable via error=<message>, instead of only on success.
- Tests: cover redaction (serialization + plugin bridge) and failure-path
hook emission.
Co-authored-by: Mervin Praison <[email protected]>
Log subprocess command and confirm PraisonAI skips LLM HTTP when cli_backend delegates a turn.
Enable with PRAISONAI_CLI_BACKEND_DEBUG=1 or LOGLEVEL=DEBUG.
Gemini backend forwarded --resume on every turn including the first,
which would fail resuming a non-existent session. Gate on
CliSessionBinding.is_resume for parity with codex/grok/claude.
Co-authored-by: Mervin Praison <[email protected]>
Codex backend never forwarded the session id to `codex exec`, so
multi-turn conversations lost context (Greptile P1). Now forwards
`resume <session_id>` on resume turns. Gate both codex and grok
session forwarding on CliSessionBinding.is_resume so the first turn
does not attempt to resume a non-existent session.
Co-authored-by: Mervin Praison <[email protected]>
- Isolate ANTHROPIC_TOKEN/CLAUDE_CODE_OAUTH_TOKEN env in the expiring-token
test so the Keychain read-only path is deterministically exercised (was
leaking a real CI OAuth token and returning the wrong access token).
- Assert both anthropic-beta policy changes: fine-grained-tool-streaming is
present and the unsupported context-1m long-context beta stays absent
(per CodeRabbit review).
Co-authored-by: Mervin Praison <[email protected]>
PraisonAI read Keychain OAuth tokens but refreshed without persisting back,
rotating refresh tokens and breaking Claude CLI and other tools on the same
machine. Use read-only credential resolution, skip LLM auth refresh for
claude-code, fix invalid_request_error misclassification, and drop the
context-1m beta header unsupported on many subscriptions.
The async retry loop emitted RETRY events via the sync emit() path, so
consumers registered through the public add_async_callback() API passed
has_callbacks but never received the event. Add an async-aware
_aemit_retry_stream_event helper (using emit_async) and share event
construction via _build_retry_stream_event. Adds tests for the async-only
callback path and the no-callback no-op case.
Co-authored-by: Mervin Praison <[email protected]>
Add StreamEventType.RETRY emitted alongside the existing ON_RETRY hook (guarded by has_callbacks for zero-overhead) in both sync and async retry loops, carrying attempt/max_attempts/delay/reason in metadata. Map it to a canonical run.retry NDJSON event in the CLI stream-json bridge so consumers get a live 'retrying in Ns (attempt k/N)' signal. Non-JSON/silent modes stay silent.
Co-authored-by: Mervin Praison <[email protected]>
A TypeError/ValueError raised inside a successfully-bound tool (domain
validation) no longer receives a misleading required/optional parameter
hint. The hint is now gated on inspect.signature().bind() confirming the
failure is an argument-binding error, so runtime errors surface their
real message and the model fixes the value, not the parameter names.
Co-authored-by: Mervin Praison <[email protected]>
Adds a zero-overhead resilience layer to the core agent tool-dispatch path.
When a tool call cannot be resolved, the runtime now:
1. Self-repairs case/separator drift (e.g. WebSearch/web-search -> web_search)
against the agent's active tools and executes if a unique match exists.
2. Otherwise returns a model-readable error naming the nearest valid tool
(fuzzy) and listing the available tools so the model can self-correct.
3. On an argument-binding failure, echoes the tool's required/optional params.
No new public API or Agent params; stays on the existing dispatch path.
Co-authored-by: MervinPraison <[email protected]>
- Security: refuse non-localhost bind without --api-key/PRAISONAI_SERVE_API_KEY,
mirroring jobs/server.py; enforce the resolved key unconditionally.
- Performance: cache one AgentsGenerator per app via FastAPI lifespan (built at
startup, closed on shutdown) instead of rebuilding YAML parse + framework
resolution + a 32-worker pool per request; falls back to praisonai.arun if
caching fails.
- Correctness: /agents and /agents/{name} now run the same cached generator, so
identical YAML gets identical lowering (ToolResolver, tool_timeout, approval,
guardrails, retry). Removed the hand-rolled PraisonAgent registration that
silently dropped those safety fields.
Co-authored-by: Mervin Praison <[email protected]>
Remove 13 knowledge.db binaries plus managed_ids.json, blog_post.md,
tutorial.md, token_metrics_export.json, market_research_results.json that
were accidentally committed (PR notes explicitly say not to commit local
artifacts). Add .gitignore rules to prevent recurrence.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #3321:
- Core neutralize_untrusted_text now also collapses U+2028/U+2029/U+0085,
which render as line breaks but bypassed the ASCII control filter.
- Bot _attribute() fallback (core helper unavailable / version skew) now
mirrors the sanitiser: collapses all newline-like separators, strips
control chars, and bounds length.
- Added tests for Unicode separators (core + bot) and the fallback path.
Co-authored-by: Mervin Praison <[email protected]>
Add a core, pure-stdlib helper neutralize_untrusted_text() in
praisonaiagents.session.context and apply it by default to the
third-party-controlled sender display name before it is interpolated into
the [{sender}] attribution prefix. Newlines/CR are collapsed, control chars
stripped and length is bounded, so a hostile name can no longer masquerade
as a fake system directive the model re-reads every turn. Well-behaved names
render byte-identically. On by default, no new config knobs.
Co-authored-by: Mervin Praison <[email protected]>
Addresses greptile P1: CapabilityValidator cached the first _get_available_servers()
snapshot, so a skill validated before its MCP server registered via with_tool_prefix()
stayed permanently UNAVAILABLE under STRICT even after the server connected. The MCP
registry read is a cheap set copy, so query it live and drop the dead _server_cache
field (issue #3307).
Co-authored-by: Mervin Praison <[email protected]>
The durable-reference encoding for long interactive reply/select values only
took effect when a shared store was explicitly passed in tests; every
production renderer/registry used the no-store default and fell back to the
unrecoverable hash. This shares one InMemoryCallbackPayloadStore between the
Telegram render side (render_presentation -> adapt_presentation) and the inbound
registry so long values round-trip losslessly past the 64-byte callback cap.
- create_registry(store=): thread an optional store into the InteractiveRegistry
- TelegramPresentationRenderer.render(callback_store=): pass store to adapt
- TelegramBot: construct one shared store, inject into registry + render
- add regression test asserting production render+dispatch round-trip
Co-authored-by: Mervin Praison <[email protected]>
- POST /agents/{agent_name} now dispatches to the requested registered agent
and returns 404 for an unknown name, instead of silently running the whole
YAML workflow (fixes named-agent regression flagged in review).
- Both routes build a lightweight per-request AgentsGenerator that borrows the
cached generator's shared adapter, tool-timeout pool and resolver while owning
its own cli_config, so concurrent requests overlap without a run-length lock.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two P1 review findings on the tool self-repair path:
- Fold the bind-failure parameter schema into the error string so it survives
conversion to ToolExecutionError (which keeps only the message) and reaches
the model.
- Expand MCP instances into their contained tools via a shared
_iter_active_named_tools() helper so MCP tool names participate in
case/separator repair and appear in the corrective inventory instead of an
empty/opaque container.
Adds 3 tests (public-path param hint, MCP inventory, MCP name repair).
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on the prompt-injection defence:
- Greptile P1 (security): the bot's _attribute() fallback (taken when the
core helper import fails on an older praisonaiagents still allowed by the
>=1.6.152 range) only replaced CR/LF, leaking control chars and oversized
display names into every shared-chat prompt. It now mirrors the core
helper: collapse newlines, strip control chars, collapse whitespace and
length-bound to 240 — byte-identical to neutralize_untrusted_text.
- Greptile P2: neutralize_untrusted_text with max_chars<=3 returned the
3-char "..." string, exceeding the advertised bound. Small bounds now
truncate hard so len(out) <= max_chars always holds.
- Tests: add small-bounds regression (core) and a fallback-path hostile-name
regression that forces the helper import to fail (bot).
Co-authored-by: Mervin Praison <[email protected]>
An unquoted bare prompt (praisonai build a weather agent) arrives as
multiple argv tokens, but the modern `run` command takes a single
positional target. Join the flag-free tokens into one argument so the
whole prompt reaches `run` intact instead of Typer rejecting the extra
positionals. Addresses Greptile P1 (multi-token prompt).
Also adds a regression test pinning that flagless operational commands
(serve/call/realtime/debug/lsp/diag) stay Typer commands and are never
misrouted to `run` as prompts (Greptile P1 #2 was a false positive).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Interactive reply/select values that exceed a channel's callback byte-cap
(e.g. Telegram's 64-byte limit) were hashed with no way to recover the
original value, so long option values (URLs, file paths, free-text) made
menus silently non-functional. This generalises the durable-reference
pattern already used by approvals to ordinary interactive callbacks.
- Add CallbackPayloadStoreProtocol (peer of ApprovalStoreProtocol) plus a
bounded, zero-dependency InMemoryCallbackPayloadStore default in core.
- Encoders persist an overflowing value under a short reference and emit
reply:@<ref> / select:<action_id>:@<ref>; inline values are unchanged.
- InteractiveRegistry(store=...) resolves @<ref> back to the exact value on
dispatch, preserving the select action_id prefix, and fails closed on an
unknown/expired reference. Without a store the prior hash behaviour is kept.
Additive and backward compatible: adapt_presentation gains an optional
callback_store kwarg; registry gains an optional store arg.
Co-authored-by: MervinPraison <[email protected]>
Gap 1: Port sync workflow()'s loop-task pre-expansion into aworkflow() so
async CSV-driven loop start tasks run per-row instead of once.
Gap 2: Guard the per-turn tool buffer (_turn_tools_used) with a DualLock via
_reset_turn_tools/_record_turn_tool/_drain_turn_tools helpers, matching the
existing chat_history protection, so concurrent chat()/achat() turns on one
Agent no longer corrupt hook/self-improvement data.
Gap 3: Track namespaced MCP server names in a process-level registry and let
the skills CapabilityValidator discover them, so MCP-server-gated skills can
pass STRICT validation instead of always failing closed.
Co-authored-by: Mervin Praison <[email protected]>
- Refuse non-localhost bind without --api-key/PRAISONAI_SERVE_API_KEY,
mirroring jobs/server.py policy (POST /agents can run YAML-defined tools).
- Cache one AgentsGenerator per app via FastAPI lifespan instead of rebuilding
it (YAML re-parse, registry re-resolve, fresh 32-worker pool) per request;
serialise the shared cli_config with an asyncio.Lock and close() on shutdown.
- Converge /agents and /agents/{agent_name} on the same generator path so both
apply identical YAML lowering (ToolResolver, tool_timeout, approval,
guardrails, retry) instead of the safety-stripped hand-rolled PraisonAgent.
Co-authored-by: Mervin Praison <[email protected]>
Add StreamEventType.RETRY and emit it alongside the existing ON_RETRY hook in both the sync and async retry loops (guarded by has_callbacks, so it stays zero-overhead when no consumer is attached). The event carries attempt, max_attempts, delay and reason in metadata.
The CLI stream-event bridge maps it to a canonical run.retry NDJSON event so consumers can render a live 'retrying in Ns (attempt k/N)' status instead of a silent, hung-looking terminal. Non-JSON/silent modes stay silent.
Co-authored-by: MervinPraison <[email protected]>
When the LLM emits an unresolvable tool call, the runtime now:
- attempts a deterministic self-repair by normalising case/separator drift
(e.g. 'WebSearch' -> 'web_search') against the agent's active tools;
- otherwise returns a corrective, model-readable error naming the nearest
valid tool and listing the currently available tools;
- on argument-bind failure, echoes the tool's required/optional parameters.
Reuses existing dispatch path; no new public API or Agent params.
Co-authored-by: Mervin Praison <[email protected]>
Add a pure-stdlib core helper neutralize_untrusted_text() in
praisonaiagents.session.context and apply it by default to the sender
display name in the bot's _attribute() prefix. Collapsing newlines/control
chars and bounding length stops a hostile group display name / title from
masquerading as a fake heading or system directive in the per-turn prompt,
while well-behaved names render byte-identically. Safe-by-default; no new
config knobs.
Co-authored-by: Mervin Praison <[email protected]>
A bare free-text prompt (`praisonai "do something"`) now forwards to the
same modern `run` path as `praisonai run`, inheriting session continuity,
--output modes, the credential gate and permissions. `.yaml` workflows and
flag-bearing legacy invocations remain on the legacy dispatcher.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer feedback on the in-loop continuation guard:
- Emit the just-completed (paid) row before the guard halts, so the
request that trips the sponsorship check is no longer silently dropped.
- Coerce sponsor_check_rows to a safe minimum of 1 so a 0 (divide-by-zero)
or negative (never-poll, guard disabled) value cannot break/disable the
safety check; unset preserves the 5000 default.
Adds tests for trigger-row emission and invalid-interval handling.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Two additive, backward-compatible features for the synthetic-data generator.
1. In-generator continuation guard. generate_dataset gains an optional
should_continue() -> bool callback, re-checked every `sponsor_check_rows`
completed requests (default 5000). When it returns False the run halts
cleanly via the existing shutdown path (touch stop-file + cancel pending
futures + break). If no callback is passed but `subscription_id` (or env
AZ_SUBSCRIPTION) is set, a built-in Azure sponsorship check is wired in
(quotaId == "Sponsored_2016-01-01"). The guard fails OPEN on transient
errors — an external watchdog is the hard fail-closed guard; this is
belt-and-suspenders. New public helper: azure_sponsorship_guard().
2. Per-row provenance stamping. Emitted rows are now self-describing: _call
stamps `model` (deployment) and passes through `task_type`/`topic` from the
prompt spec when present. The axis recipe stamps task_type/topic onto each
spec, so QC (which already reads r["task_type"]) and downstream category
splits key off metadata instead of brittle text. Keys are added only when a
value is available (backward-compatible).
Tests (network stubbed): the guard halts after N rows when the predicate turns
False and never halts while True; rows carry model/task_type/topic when
provided and omit task_type/topic when absent; plus fail-open and
subscription-id wiring.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The switch to praisonai.arun() dropped the caller's required input on the
native jobs path (job.prompt) and the serve /agents fallback (query), since
arun has no prompt param and the workflow topic is read from YAML input/topic
only. Honour input/topic overrides in AgentsGenerator._merge_cli_config
(reusing the existing merge seam, no new params/exports) and pass
job.prompt / query through cli_config so per-run input drives the workflow
instead of being silently discarded. Static YAML input is preserved when no
prompt is supplied.
Co-authored-by: Mervin Praison <[email protected]>
- serve.py: route the crew fallback through praisonai.arun (owns the
AgentsGenerator lifecycle, runs off the event loop) and replace
asyncio.get_event_loop() with asyncio.to_thread in both agent handlers.
- jobs/executor.py: _run_praisonai_agents now delegates to praisonai.arun
so the caller's agent_file/agent_yaml/framework/config are honoured
instead of silently dropped by a stock Agent.
- scheduler/agent_scheduler.py: reuse an instance-owned ThreadPoolExecutor
with leak accounting and recycling (mirrors AgentsGenerator), unify the
timeout branch into the backoff path, and close() the pool on stop().
Co-authored-by: MervinPraison <[email protected]>
- reuse a supplied empty shared MinHashLSH index (is not None, not `or`)
so cross-batch near-dedup works on the first call
- treat empty MinHash signatures as non-similar (0.0) and reject
minhash_perm/ngram_n < 1, so degenerate config can't collapse a dataset
- global_dedup honours near_dup_method='sliding' and raises a clear
FileNotFoundError for missing paths instead of a cryptic AttributeError
- sliding look-back treats window<=0 as intentional unbounded
- dedup CLI writes to a temp file + atomic replace, so an --out that
aliases an input is never truncated and a malformed line never leaves
a partial output
Co-authored-by: Mervin Praison <[email protected]>
The QC near-dup pass was O(n·3000) sliding-window char-4gram Jaccard, which is
both slow at scale and structurally blind to near-duplicates more than 3000 rows
apart — and score() rebuilds its dedup state per call, so it cannot remove dups
that span multiple batch files (the common case when merging parallel runs).
Add praisonai_train.data.dedup (pure stdlib, no datasketch/numpy):
- MinHasher / MinHashLSH: seeded, deterministic MinHash signatures over the same
normalized char-4gram shingles the sliding engine uses (so near_dup_jaccard
keeps identical semantics), with LSH banding for sub-linear candidate lookup
and no bounded look-back window.
- near_dedup(rows, cfg): one interface, YAML-tunable near_dup_method
("sliding" default = unchanged, or "minhash"). qc.score() now delegates to it
(DRY); default path behaviour is byte-for-byte the same. near_dup_window is now
configurable too.
- global_dedup(sources, cfg): dedup ACROSS many JSONL files / row-lists with ONE
shared exact+LSH index — what per-file score() cannot do.
- CLI: `praisonai-train dedup batch_*.jsonl --out merged.jsonl`.
Backward compatible: no new deps, default engine and outputs unchanged; MinHash
and cross-file dedup are opt-in.
Tests: 13 new (deterministic) — MinHash catches a far near-dup the window misses,
preserves genuinely-distinct rows, cross-file exact+near removal, exact-only, and
default-still-sliding. Full data suite 60 passed.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Count completion tokens only for successful (ok) responses so token
throughput and avg_out_tok stay consistent with the success count.
- Thread a json_mode flag through _timed_call/_measure_target/
benchmark_deployments and expose --json-mode/--no-json-mode + yaml key,
so OpenAI-compatible endpoints without JSON mode aren't ranked as failures.
- Validate prompt dicts (require non-empty 'user') and reject n<1 /
concurrency<1 with a clear ValueError instead of KeyError / silent
zero-request runs miscounted as endpoint failures.
- Add 4 tests; existing stubs updated for the new json_mode arg. 102 passed.
Co-authored-by: Mervin Praison <[email protected]>
Add a first-class, protocol-driven speed benchmark to the praisonai-train
data SDK, mirroring the generate/validate idiom. It sends N identical
requests per deployment at a fixed concurrency and reports throughput
(rows/min, completion-tokens/sec), latency (avg/p50/p95), success count
and average output tokens, then ranks deployments fastest-first.
DRY: extract the generator's HTTP call path into shared helpers
(`build_chat_request`, `resolve_cfg`) so benchmarking reuses the exact
same Azure/OpenAI-compatible request construction and credential
resolution as real generation — no duplicated HTTP code. The default
prompt reuses a registered Recipe so benchmarks reflect the real workload.
- data/benchmark.py: `benchmark_deployments(...) -> list[BenchResult]`,
pure `aggregate()`, and network confined to a `_timed_call` seam.
- cli/commands/benchmark.py: `praisonai-train benchmark` (YAML/flags),
ranked table + JSON output.
- setup/benchmark.yaml: documented sample config.
- tests: aggregation math, ranking, success/failure counting, real
threaded path, per-target endpoint override (network stubbed).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The documented gateway.notify_on_undelivered / undelivered_template YAML
opt-in was a dead path: GatewayServerSchema (extra="forbid") rejected the
keys at load time, and neither start_with_config nor from_config_file
propagated them onto self.config, so the delivery router's getattr always
saw the OFF default.
- Accept both keys in GatewayServerSchema (kept optional, lightweight).
- Stamp them onto self.config in start_with_config (primary CLI path) and
from_config_file, honouring the "no new core GatewayConfig field" design.
- Add a regression test covering schema acceptance + propagation.
Co-authored-by: Mervin Praison <[email protected]>
Connect the previously-inert completion path (Greptile P1): BotSessionManager
now reads the agent's last_stop_reason after each turn and, when the new opt-in
surface_completion_reason flag is set, appends a concise user-safe note for
early stops (max_steps / cancelled / error). Off by default so clean
completions and existing deployments are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
Address greptile P1 review feedback on the inbound media-album coalescer:
when the owning Telegram update is cancelled (e.g. during shutdown) after
sibling updates already folded their media in, the buffered temp files could
leak. Add an on_orphan cleanup hook invoked whenever a flushed album has no
live owner awaiting it, wired to a shared _remove_inbound_media helper in the
Telegram bot. Also clarify the max_items cap semantics (bounded, intentional).
Co-authored-by: Mervin Praison <[email protected]>
On a confirmed-permanent outbound failure the reply was parked in the DLQ /
the target marked dead but the user heard nothing. Add an opt-in last-resort
notice: a short plain-text delivery-failure message on the same channel plus a
MESSAGE_UNDELIVERED lifecycle hook so operators can route the failure.
Core (protocol only): add HookEvent.MESSAGE_UNDELIVERED and
MessageUndeliveredInput. Wrapper (praisonai-bot): DeliveryRouter fires the hook
and best-effort sends the notice on permanent failure; default OFF, wired from
gateway.notify_on_undelivered.
Co-authored-by: MervinPraison <[email protected]>
Telegram delivers a media album (multiple photos/files sent together) as N
separate updates sharing one media_group_id, so the agent saw each part as
its own turn. Add an AlbumCoalescer that buffers media parts by group key
and flushes them as one multimodal turn, mirroring the existing
InboundDebouncer text pattern.
- New praisonai_bot/bots/_album.py: bounded per-group buffer (window +
max_items), operator-tunable via config.metadata (media_group_window_ms /
media_group_max), disabled by default so behaviour is unchanged.
- Wire into TelegramBot.handle_message (sibling updates fold into one turn)
and flush pending buffers on stop().
- Tests in tests/unit/test_bot_album.py.
Co-authored-by: MervinPraison <[email protected]>
Add an optional, backward-compatible TurnCompletion contract to the bot
reply path so a chat user learns *why* a turn stopped early instead of
seeing a silently truncated/empty reply.
- TurnCompletion wraps the existing coarse Agent.last_stop_reason
(completed | max_steps | cancelled | error) into a portable value with
a user-safe, localisable .note(); completed turns surface nothing.
- AgentReply gains an optional `completion` field (defaults None).
- extract_completion() reads it off any result (incl. a bare Agent via
last_stop_reason); append_completion_note() lets a gateway optionally
append the note, off by default so existing deployments are unchanged.
Reuses the existing runtime stop reason rather than adding new detection
or Agent params — no new module, no wrapper knobs.
Co-authored-by: MervinPraison <[email protected]>
Move progress_callback below the yield in generate_dataset so 'kept' reflects
rows the consumer has actually received (Greptile P1). Docstring clarified.
Co-authored-by: Mervin Praison <[email protected]>
generate_dataset() gains an optional progress_callback(done, total, kept)
invoked as teacher requests complete, so a CLI/monitor/notebook can show
completion and remaining work. Backward compatible: default None keeps the
original behaviour (no callback). Fires once up-front with (0, total, 0) then
after each completed request; done is monotonic up to total, kept counts unique
rows emitted.
The `generate` CLI command wires a default reporter (_Progress): a tqdm bar when
tqdm is importable, else throttled done/total prints. tqdm stays optional — the
import is guarded and never becomes a hard dependency.
Adds unit tests asserting the callback fires with monotonic done up to total,
that kept tracks dedup, and that the default (no callback) path is unchanged.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- intent.translation_intent: an unrecognised non-empty task_type no longer
short-circuits to non-translation; it falls through to the documented text
fallback so an explicit "translate into English" instruction is honoured and
its English output is not dropped as low_script_purity (greptile P1).
- qc.score: the translation `exempted` metric now counts only rows the
English-target exemption ACTUALLY rescued from LowScriptPurity (task-awareness
on AND output below the purity floor), so it reconciles with check behaviour
instead of over-counting failed translations and task_aware_purity=false runs
(greptile P1).
- Add 4 regression tests (29 passed total).
Co-authored-by: Mervin Praison <[email protected]>
Add two dataset-QC features to the praisonai-train data SDK, wired in the
SDK's protocol-driven idiom (registered RowChecks + a corpus metric) and
sharing ONE translation-intent detector so they can never disagree (DRY).
1. Task-aware script purity: the script-purity checks no longer delete an
output that is legitimately in another script because the instruction
asked to translate INTO that language (e.g. a Tamil->English row's
correct output is English). LowScriptPurity/ScriptReview now exempt a
resolved English-target row; a new WrongTargetScript flag catches the
inverse failure (asked for English, output still Tamil). Only a resolved
English target exempts — en->ta / ambiguous / native rows stay strict.
2. Translation-share corpus metric: metrics.translation reports the fraction
of kept rows that are translation tasks, by direction (en_ta/ta_en/unknown)
and an exempted count, computed with the SAME detector so it reconciles
with the per-row exemptions.
New single source of truth: data/intent.translation_intent(); metadata
(task_type) is authoritative, instruction-text detection is the external-row
fallback, ambiguous direction yields no exemption (safe default).
17 new unit tests (mirroring the modeltrain reference); full data suite green.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Addresses Greptile P1: an issue such as '[QUESTION] How do I handle this
API error?' matched 'error' before the question marker was checked,
receiving 'bug' + auto 'claude'. Guard bug detection on \!title.includes('[question]').
Co-authored-by: Mervin Praison <[email protected]>
Bug issues with a "## How to fix" section were labelled question first,
which blocked autoClaude. Check bug/error/crash before how-to heuristics,
ignore "how to fix" for question detection, and let bug label win over
a stale question label for auto-triage.
- qc: include output in exact-dedup key so distinct answers to the same
prompt are not silently dropped
- _util.fields: pair the final assistant turn with the user turn that
precedes it (never a trailing unanswered user turn)
- cli generate: forward --snapshot-every override; defer output truncation
until the first row is produced (a failed run no longer destroys an
existing file / self-referential dedup source); exit non-zero when 0 rows
are generated instead of reporting empty success
- cli validate: skip malformed JSONL lines (with line numbers) instead of
aborting the whole run
- generate: configurable request_timeout; accurate stop-file docstring
- tests: cover distinct-answer dedup and multi-turn chat pairing
Co-authored-by: Mervin Praison <[email protected]>
Remove the legacy `.praison/config.toml` from PROJECT_CONFIG_NAMES so the
walk-up discovery never mislabels a profile-level legacy global config as a
`project:` source. The legacy file is owned exclusively by
_load_global_config() with a `global:` label. Removes the now-dead
search_dir == home skip guard and adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Harbor 0.20's BaseAgent.__init__ requires logs_dir as first positional
arg. The TestPraisonAIExternalAgent tests constructed the agent with zero
args, causing a TypeError. Pass logs_dir via pytest tmp_path to match the
existing pattern used by TestPraisonAICodeAgent and TestPraisonAIInstalledAgent.
Co-authored-by: Mervin Praison <[email protected]>
Harbor 0.20 agents expose extra_env (wired into the container exec
context by Trial), not self.env. Passing env=self.env crashed
PraisonAICodeAgent.run() with AttributeError. Omit the per-exec env=
so Harbor's trial-scoped injection applies. Same fix applied to
praisonai_installed_agent.py.
Co-authored-by: Mervin Praison <[email protected]>
Harbor's BaseInstalledAgent._exec always prefixes commands with
'set -o pipefail; ', so the .startswith assertion failed even when the
adapter command was correct. Switch to a substring match.
Co-authored-by: Mervin Praison <[email protected]>
- PRAISON_DEBUG now parsed as a boolean (0/false/no disable it, not just unset)
- auto-resume filters to real numeric checkpoint-* dirs and passes the validated
path to the trainer (instead of leaving resume=True and re-discovering); also
accepts 1/yes/on/off spellings before treating a string as a literal path
- push_model_gguf honors quantization_method default (q4_k_m) matching save path
- final save/eval cadence reconciliation after training_arguments passthrough so
load_best_model_at_end can't reach SFTConfig with mismatched strategies/steps
Co-authored-by: Mervin Praison <[email protected]>
Reverts the removal of tokenize_function — it is imported and re-exported in
praisonai/train.py __all__, so deleting it breaks that public API. Kept it (now
uncalled by the training path but retained for backward compat) and removed only
the internal, unreferenced tokenize_dataset method.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Remove dead tokenize_function/tokenize_dataset (unused since TRL tokenizes
internally; used padding='max_length' which would waste compute if ever rewired).
- save_model_gguf now honors config quantization_method (was hardcoded 'q4_k_m',
inconsistent with push_model_gguf).
- Gate the per-batch DEBUG prints behind PRAISON_DEBUG so normal runs stay readable.
Co-Authored-By: Claude Fable 5 <[email protected]>
HF requires save_steps to be a multiple of eval_steps when load_best_model_at_end
is on. A config with save_steps=100, eval_steps=500 (both valid-looking) crashed.
Now the trainer aligns eval_steps to save_steps (preserving the user's checkpoint
frequency) with a warning, instead of erroring out.
Co-Authored-By: Claude Fable 5 <[email protected]>
resume_from_checkpoint: true now auto-finds the latest checkpoint in output_dir
and resumes from it; if none exists yet (fresh run) it starts fresh instead of
erroring. So after any crash (OOM, GPU reclaim) you just relaunch the SAME
command and training continues from the last saved step. Validated on GPU:
fresh run -> checkpoint-2/4; relaunch -> resumed from checkpoint-4, continued 5->8.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Remove wrapper import from praisonai-code agent_tools.py (C7 gate
regression): use a module-local _run_sync bridge instead of
`from praisonai._async_bridge import run_sync` so the Tier-2 package
no longer depends on the praisonai wrapper at the hot path.
- suite_runner: start child processes with start_new_session=True on
POSIX so timeout killpg reaps only the child tree, never the runner.
- agent_tools/orchestrator: honor acp_execute_command cwd by forwarding
it into the plan step; orchestrator validates it stays in workspace.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Gemma 4 E4B (and other multimodal/MoE/elastic models) have LoRA-adapted params
that don't fire every step (vision/audio towers in text-only training), which
crashes DDP with 'Expected to have finished reduction' when find_unused=False.
Default True works universally; set false for a small speedup on dense-text models.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Set UNSLOTH_USE_NEW_MODEL before unsloth import (DDP non-reentrant path)
- Skip LoRA when full_finetuning: true (train base weights directly)
- Reload model with trained precision (dtype/8bit/full_finetuning), not 4bit-only
- Re-align save/eval strategy when early stopping enables load_best_model_at_end
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Only the main process merges/pushes and writes the final adapter, so multi-GPU
runs don't race to write the same repo/dir.
Co-Authored-By: Claude Fable 5 <[email protected]>
Validated end-to-end on 2x A6000 (unsloth 2026.7.4 / trl 0.24 / torch 2.10):
multi-GPU DDP trains (Data Parallel GPUs = 2, no 'marked ready twice'),
checkpointing + eval + best-model + final_model_dir all work.
Multi-GPU (DDP):
- Detect distributed (LOCAL_RANK/WORLD_SIZE); load full model per-rank
(device_map={'':local_rank}); set UNSLOTH_USE_NEW_MODEL=1 under DDP to force
Unsloth's non-reentrant checkpointing (the legacy path hard-codes reentrant,
which double-fires autograd hooks and crashes DDP). Set ddp_find_unused_parameters
=False (LoRA freezes the base). Launch: torchrun --nproc_per_node=N.
Checkpointing / resume:
- Config-driven save_strategy/save_steps/save_total_limit (was only under an env var);
resume_from_checkpoint (bool=latest, or a path); final_model_dir (fixes the old
lora_model vs output_dir mismatch that broke load_model).
Evaluation / early stopping:
- val_split_ratio carves an eval set; eval_strategy/eval_steps/load_best_model_at_end/
metric_for_best_model; EarlyStoppingCallback via early_stopping_patience.
Flexibility:
- Generic training_arguments passthrough (any raw SFTConfig field), auto-filtered to
what the installed TRL accepts (version-proof; e.g. save_safetensors/group_by_length
differ by version) — warns instead of crashing.
- Knobs: max_grad_norm, warmup_ratio, neftune_noise_alpha, dataloader_num_workers,
data_seed, adam betas, report_to/run_name (config, not just env), push_to_hub.
- Quantization: load_in_8bit, dtype, full_finetuning. LoRA: modules_to_save,
rank_pattern, alpha_pattern, use_dora. Data: local files, shuffle, rename, filter.
Correctness fixes:
- load_in_4bit KeyError when omitted; inference().to(cuda) -> self.device;
drop empty-formatted rows instead of silently training on blanks.
All new keys optional with prior defaults; existing configs unchanged.
Co-Authored-By: Claude Fable 5 <[email protected]>
2026-07-22 06:12:38 +01:00
816 changed files with 49895 additions and 6684 deletions
@@ -7,9 +7,9 @@ You are working on the PraisonAI project.
- Be concise and helpful in responses
- Test implementation thoroughly
- Ensure backward compatibility with existing APIs
- Follow protocol-driven design across the eight packages: core protocols in `praisonaiagents/`, agentic terminal CLI in `praisonai-code/`, bots/gateway in `praisonai-bot/`, LLM fine-tuning + agent training in `praisonai-train/`, browser automation in `praisonai-browser/`, MCP server host in `praisonai-mcp/`, sandbox backends in `praisonai-sandbox/`, integrations/serve/dashboard in the `praisonai/` wrapper
- Follow protocol-driven design across the nine packages: core protocols in `praisonaiagents/`, agentic terminal CLI in `praisonai-code/`, bots/gateway in `praisonai-bot/`, LLM fine-tuning + agent training in `praisonai-train/`, browser automation in `praisonai-browser/`, MCP server host in `praisonai-mcp/`, sandbox backends in `praisonai-sandbox/`, deployment in `praisonai-deploy/`, integrations/serve/dashboard in the `praisonai/` wrapper
- Preserve old `praisonai.*` import paths via shims when moving code between packages (see §2.3 in `src/praisonai-agents/AGENTS.md`; shim helpers in `src/praisonai/praisonai/cli/_shim.py`)
- Package boundaries and dependency rules: `ARCHITECTURE.md` §2 (Tier 2 packages must never PyPI-depend on the wrapper; cross-tier access goes through lazy `_*_bridge` modules)
- When reviewing a PR or an issue, evaluate whether the change addresses a framework concern or a user goal, and design its surface (params, naming, defaults) accordingly
- The aim of this package is to stay **lightweight and powerful**. Do a critical review at each stage — when triaging an issue, when planning a fix, and when reviewing/implementing a PR. Reject scope creep for the sake of adding features: if a capability already exists (e.g. via existing Agent params like `instructions`/`backstory`/`tools`/`hooks`/`memory`), prefer it over a new API surface. A change must genuinely strengthen the SDK (simpler, more robust, more user-friendly) — do not add knobs, params, modules, or exports that have no live consumer or that merely duplicate existing behaviour.
| 2a | `src/praisonai-code/` | `run`/`chat`/`code`, Typer, runtime, LLM, tool resolution | **`praisonai` as a PyPI dependency** (optional lazy imports via `_wrapper_bridge` only) |
| 2b | `src/praisonai-bot/` | Bots, gateway, channel CLI, OS daemon, gateway scheduler tick | **`praisonai` as a PyPI dependency** (optional lazy `_wrapper_bridge` for jobs/UI) |
| 2c | `src/praisonai-train/` | LLM fine-tuning (Unsloth), agent training, `train` CLI, conda env setup | **`praisonai` as a PyPI dependency** (lazy `_code_bridge` for legacy dispatch) |
| 2d | `src/praisonai-browser/` | Extension bridge, CDP/hybrid automation, `browser` CLI | **`praisonai` as a PyPI dependency** (none required; depends on `praisonaiagents` only) |
| 2e | `src/praisonai-mcp/` | MCP server host, auth, transports, `mcp` CLI | **`praisonai` as a PyPI dependency** (lazy `_wrapper_bridge` for full capability registry) |
| 2f | `src/praisonai-sandbox/` | Sandbox backends (Docker, E2B, Modal, Sandlock, SSH), `SandboxRegistry` | **`praisonai` as a PyPI dependency** (lazy `_code_bridge` for `PluginRegistry`) |
| 2g | `src/praisonai-deploy/` | Deploy API/Docker/cloud, `deploy` CLI, scheduler integration | **`praisonai` as a PyPI dependency** (lazy `_plugin_registry` via `_code_bridge`) |
| 3 | `src/praisonai/` | `framework_adapters/`, serve, dashboard, async jobs API | — |
### Repo infra (not PyPI)
Deployment packaging that stays in the git checkout, not in any tier-2 wheel:
Loaded 100 of 816 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.