fix: drop typer click_type in flow export (removed in typer 0.29)

Typer 0.29 no longer accepts Option(click_type=...), which broke CLI app
construction and the test-core/smoke jobs. Validate --format manually.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/praisonai/praisonai/cli/commands/flow.py

@@ -6,7 +6,6 @@ PraisonAI custom components (Agent, Agents, Task) pre-loaded.
 
 import typer
 
-import click
 
 app = typer.Typer(name="flow", help="Visual workflow builder (Langflow)")
 
@@ -263,7 +262,6 @@ def flow_export(
         "yaml",
         "--format",
         help="Output format (yaml, json)",
-        click_type=click.Choice(["yaml", "json"])
     ),
 ):
     """Export Langflow flow to YAML format.
@@ -276,6 +274,8 @@ def flow_export(
         praisonai flow export abc-123-def --output my_workflow.yaml
         praisonai flow export abc-123-def --format json
     """
+    if format not in ("yaml", "json"):
+        raise typer.BadParameter("must be 'yaml' or 'json'", param_hint="--format")
     from pathlib import Path
     from rich.console import Console
     

src/praisonai/praisonai/cli/features/templates.py

@@ -562,7 +562,7 @@ class TemplatesHandler:
             if template.requires and isinstance(template.requires, dict):
                 ts = template.requires.get("tools_sources", [])
                 if ts:
-                    tools_sources.extend(ts)
+                    tools_sources.extend(_gate_template_tools_sources(ts))
             # Add CLI --tools-source overrides
             if tools_sources_override:
                 tools_sources.extend(tools_sources_override)
@@ -1392,3 +1392,28 @@ def handle_templates_command(args: List[str]) -> int:
     """Handle templates command from main CLI."""
     handler = TemplatesHandler()
     return handler.handle(args)
+
+
+def _gate_template_tools_sources(sources):
+    """Drop template-declared local ``.py`` paths unless template tools are opted in.
+
+    A remote template (e.g. ``github:...``) can point ``tools_sources`` at its
+    own cached ``.py`` files; those load with the local-tools env gate skipped.
+    Apply the same ``PRAISONAI_ALLOW_TEMPLATE_TOOLS`` gate as ``tools.py``
+    autoload. Module names and explicit CLI ``--tools-source`` are unaffected.
+    """
+    from pathlib import Path
+    from praisonai.templates.tool_override import _autoload_tools_enabled
+
+    if _autoload_tools_enabled():
+        return list(sources)
+    allowed = []
+    for source in sources:
+        if isinstance(source, str) and Path(source).expanduser().exists():
+            print(
+                f"Warning: skipping template tools_source {source!r} "
+                "(set PRAISONAI_ALLOW_TEMPLATE_TOOLS=true to load template code)"
+            )
+            continue
+        allowed.append(source)
+    return allowed

src/praisonai/tests/unit/test_issue_6305_template_tools_gate.py

@@ -0,0 +1,17 @@
+"""Regression test for issue #6305: template tools_sources gate."""
+
+from pathlib import Path
+
+
+def test_template_tools_sources_local_paths_gated(tmp_path: Path, monkeypatch):
+    from praisonai.cli.features.templates import _gate_template_tools_sources
+
+    evil = tmp_path / "evil.py"
+    evil.write_text("def tool(): pass\n")
+    sources = [str(evil), "some_installed.module"]
+
+    monkeypatch.delenv("PRAISONAI_ALLOW_TEMPLATE_TOOLS", raising=False)
+    assert _gate_template_tools_sources(sources) == ["some_installed.module"]
+
+    monkeypatch.setenv("PRAISONAI_ALLOW_TEMPLATE_TOOLS", "true")
+    assert _gate_template_tools_sources(sources) == sources