The AI code-editor smoke-test fixture is intentionally broken so live
scenarios (implement celsius_to_fahrenheit / fahrenheit_to_celsius / mode,
fix mean/median empty-list handling) exercise the AI editor's repair
capability. Pre-implementing these functions caused acceptance tests to
pass WITHOUT the editor doing any work, defeating the fixture's purpose.
Also removes the redundant conftest.py sys.path mutation; pyproject.toml
already sets pythonpath = ["src"].
Co-authored-by: Mervin Praison <[email protected]>
Harden the guarded self-improvement review now that it can write to
memory: frame the echoed original task as UNTRUSTED DATA inside an
<original_task> block and instruct the model to ignore any embedded
'remember/store/create a skill' instructions, so injected task text
cannot steer store_memory/skill_manage. Prompt-only, no new surface.
Co-authored-by: Mervin Praison <[email protected]>
Reuse the existing opt-in, guarded, background/re-entrancy-safe skill-review
pass to also close the learning loop for memory: when the agent has memory
enabled, the restricted review toolset adds store_memory and the review
prompt asks whether a durable fact/preference/user-model detail emerged.
No new Agent param or parallel mixin/policy/dispatch — same self_improve
switch, lock, and off-hot-path background runner.
Co-authored-by: MervinPraison <[email protected]>
The durable-run stack (RunJournal, DurableRunContext, ExecutionConfig(durable=))
was shipped in praisonaiagents but never engaged by the long-lived gateway, so no
gateway run was journalled and resume was unreachable. Construct gateway agents
with ExecutionConfig(durable=True) behind an operator toggle (gateway.durable_runs)
and an optional per-agent durable key, so every turn is journalled and an
interrupted run can resume after a restart instead of re-executing side-effecting
tools or being discarded. Default-off / zero-overhead.
Co-authored-by: MervinPraison <[email protected]>
The first-run onboarding gate in `chat` and the bare invocation ran before
the wrapper-resident interactive TUI's own standalone install hint. On a
keyless `pip install praisonai-code` (no wrapper), `praisonai-code chat`
dead-ended with "No API key configured. Run: praisonai setup" for a session
that cannot even start, instead of the actionable "pip install praisonai[tui]"
hint the smoke test asserts.
Gate the interactive (no-prompt) path only when the wrapper is present so the
TUI can surface its install hint standalone; single-prompt chat runs in-process
and is still always gated. Adds a regression test for the standalone skip and
pins wrapper availability in the resolved-model gate test.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Route the shared first-run credential gate through the *final* resolved model
so onboarding validates and preserves the model each entrypoint actually
dispatches:
- code.py: resolve the agent profile's `llm` before the gate. A keyless
`code --agent <profile>` (no --model) with a reachable local endpoint no
longer has the profile model shadowed by the detected local default; the
profile override still applies for the untouched-model case, and an explicit
--model still wins.
- chat.py: resolve the TUI model (explicit > recent > provider default) before
the gate and reuse it, so the gate validates the exact model the TUI
dispatches instead of passing on any present key for a different provider.
Removes the now-duplicate resolution and threads the validated model into
profiling.
Adds two regression tests (profile-model passthrough for code, resolved-model
passthrough for chat).
Defer --tools resolution into _run_print_code's try/except so an import
error in a user tools.py surfaces through the machine-readable JSON/text
envelope (status=error + non-zero exit) instead of escaping as a raw
traceback to scripted callers.
Co-authored-by: Mervin Praison <[email protected]>
Extract the keyless first-run credential gate (previously duplicated inline in
app.py and run.py) into a shared ensure_configured_or_onboard helper in
praisonai_code.llm.credentials, and invoke it from the code and chat
entrypoints so a keyless newcomer is consistently routed to `setup` (or a
detected keyless local endpoint) instead of dead-ending on a raw provider
error. run.py and the bare invocation now delegate to the same helper,
removing the duplication.
Co-authored-by: MervinPraison <[email protected]>
Headless `praisonai code -p/--print` previously hard-rejected --tools,
--agent and --plan, blocking scripted/CI agentic coding from adding a
custom tool, applying a named least-privilege agent profile, or running
read-only plan mode. This reuses the interactive path's existing
resolvers (ToolResolver, load_agent_from_name, resolve_approval_config)
to thread those flags into the headless branch with no new params/deps:
- --tools resolves via _resolve_tools_arg and merges onto the default
coding toolset (de-duped by identity).
- --agent overlays the profile's instructions/role/goal/llm and named
tools; its permission scope is enforced via a non-interactive backend.
- --plan maps to a non-interactive read-only approval scope.
Approvals stay safe: scope is enforced via a non-interactive backend
(deny/ask fails closed), never an interactive prompt. --no-acp/--no-lsp
remain rejected (they toggle the resident TUI's runtime servers the
one-shot agent does not spin up). The JSON/text envelope and exit codes
are unchanged.
Co-authored-by: MervinPraison <[email protected]>
BaseCLIIntegration.as_tool() and get_available_integrations() routed
through run_sync(), which is fail-loud when a running event loop is
present. Agent runtimes invoke tools from inside their loop, so the
first async invocation of any built-in CLI-integration tool raised
RuntimeError. Route both through the existing run_sync_or_offload
helper, which offloads to a worker thread when a loop is running, and
add a native as_async_tool() surface for async agents to skip the hop.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Non-positive context_max_chars silently bypassed truncation (`if budget:`
was falsy for 0), returning full upstream output and breaking the bounded
contract. Clamp with max(..., 0) and always slice. Adds regression test.
Co-authored-by: Mervin Praison <[email protected]>
Add a composable pipeline primitive to the core scheduler: a job may declare
one or more upstream jobs via `context_from`, whose most-recent successful
output is resolved from existing execution history and injected as bounded,
delimited context at fire time.
- ScheduleJob: `context_from` (list, or bare-string coerced), `context_max_chars`
(default 4000), `on_missing_context` ("run"|"skip"). Serialised only when
configured so isolated jobs stay byte-for-byte unchanged.
- ScheduleRunner.resolve_context(job) -> (context, missing): pure, side-effect
free resolution reusing the store's get_history — no new persistence surface.
Wrapper executors inject the text and apply the missing-context policy.
Co-authored-by: MervinPraison <[email protected]>
Tightens the frozen-value-type test to assert the specific
dataclasses.FrozenInstanceError instead of a blind Exception, per
CodeRabbit/Ruff B017. Behaviour unchanged; still guards immutability.
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile review: an isolated executor does not ship the live
async callable across a process boundary; the worker owns the session
and rebuilds/dispatches the turn from serialisable inputs, with the
callable acting as the gateway-side await point for the worker result.
Doc-only clarification, no behaviour change.
Co-authored-by: Mervin Praison <[email protected]>
Add a protocol-driven turn-execution seam so a session's agent turn can be
placed on an isolated worker, with the default preserving today's in-process
behaviour exactly.
- TurnExecutorProtocol + TurnPlacement + WorkerWedgedError (core, protocol-only)
- InProcessTurnExecutor default (runs the turn on the current loop; zero change,
no dependency, backward compatible when the executor is unset)
- Exported from praisonaiagents.gateway; heavy subprocess/container/remote
executors remain a wrapper concern
Co-authored-by: MervinPraison <[email protected]>
- client.py: preflight now gates on the actual configured command (custom
servers included) and only surfaces the registry install hint when it
matches the default server, so custom commands are diagnosed correctly.
- config.py: add path_to_uri() (Path.as_uri) and use it for root/doc URIs so
paths with reserved chars (space, #) yield valid, non-truncated file:// URIs.
- lsp_tools.py: workspace-symbol search forwards the resolved file so the
server initialises against the file's real project root, not the CWD;
_uri_path now decodes percent-encoded URIs.
- Tests: custom-command preflight, path encoding, workspace-root forwarding.
Co-authored-by: Mervin Praison <[email protected]>
Broadens the LSP server map into a data-driven registry (extensions,
root_markers, install_hint) and adds detect_language(), detect_root_uri()
and probe() helpers. LSPClient.start() now runs a shutil.which pre-flight
recording an actionable last_error instead of a raw FileNotFoundError, and
derives rootUri from the nearest root marker for multi-root/monorepo setups.
edit_tools surfaces a one-time diagnostics-unavailable note so lost
self-correction signal is explicit; lsp_tools reuse the shared helpers and
emit install hints. Backward-compatible; core-only.
Co-authored-by: Mervin Praison <[email protected]>
The proxy-type cache used a WeakKeyDictionary keyed by the inner tool
class, but each cached proxy *value* is a dynamically-minted subclass of
that inner class and therefore strongly retains its own weak key via
__bases__/__mro__. The weak key could never die, so per-request tool
classes stayed pinned for the process lifetime — the exact leak the
change targeted. Switch to a WeakValueDictionary: the proxy class is now
held weakly and stays cached only while live proxy instances keep it,
which already keep the inner class alive; once the last proxy dies the
entry auto-evicts and the inner class is reclaimable. The un-subclassable
fallback (module-global _TimeoutBoundTool) is no longer cached.
Fixes Greptile P1 on #4008.
Co-authored-by: Mervin Praison <[email protected]>
- agents_generator: switch process-wide _TIMEOUT_PROXY_TYPES cache to a
weakref.WeakKeyDictionary so per-request tool classes minted in long-lived
hosts are GC-reclaimed instead of pinned for the process lifetime.
- auto: hoist the path-traversal guard (workspace + _safe_join) into
BaseAutoGenerator so WorkflowAutoGenerator and JobWorkflowAutoGenerator
inherit it, and thread an optional workspace= through both (backward
compatible; guard is a no-op without a workspace).
- __init__: distinguish ModuleNotFoundError (real attribute miss) from a
broken-install ImportError so praisonaiagents import failures surface the
real root cause via __cause__ instead of a misleading AttributeError;
cache the failure to avoid re-paying the import on every lookup.
Co-authored-by: MervinPraison <[email protected]>
describe() rendered raw sandbox aliases (native, local) instead of the
backend SandboxManager collapses them to (sandlock, subprocess), so
where_does_it_run() reported a place that never executes. Normalize the
aliases in say_place() to mirror the manager, and mark native as
not-a-boundary. Adds regression tests for both aliases.
Co-authored-by: Mervin Praison <[email protected]>
You could not tell from PraisonAI code where an agent's work happens.
`repr(agent)` was `<praisonaiagents.agent.agent.Agent object at 0x1033abb60>`,
there was no introspection method, and the answer lived only in prose. That is
why explaining it took a 25k-character article, ~29% of whose words existed
purely to correct misreadings the API invites.
Now the object answers:
>>> Agent(name="builder")
Agent(name='builder', thinks_on='this machine', tools_run_on='this machine')
>>> AgentFlow(run_on="docker", steps=[writer, reader])
AgentFlow(name='AgentFlow', steps=2, thinks_on='this machine',
tools_run_on='a Docker container (shared)')
>>> Agent(name="teacher", backend=HostedAgent(provider="anthropic"))
Agent(name='teacher', thinks_on="Anthropic's cloud", tools_run_on="Anthropic's cloud")
and `where_does_it_run()` says it in sentences:
Thinking (the AI model calls) happens on this machine.
Tools run on a Docker container (shared).
Every step shares that same sandbox, so a file written by one step is
visible to the next.
For the subprocess tier it also states the limit plainly, because that tier is
verifiably not a boundary (network reachable, ~/.ssh readable):
Note: a separate process is not a security boundary -- it can still reach
the network and read your files. Use docker or a cloud provider for
untrusted code.
Field naming is deliberate. `loop=` was rejected: it is already
praisonaiagents.workflows.loop(), asyncio's event loop, and agent-loop jargon
-- three meanings for one word, which is the exact problem being fixed.
`llm`, `model`, `runtime` and `execution` are taken as Agent kwargs.
`thinks_on` / `tools_run_on` are free and mirror the `run_on=` the user typed.
A test asserts no field name collides with existing public API so nobody
reintroduces that class of collision, and another asserts the sentences contain
no jargon ("harness", "provision", "orchestration", "topology", "runtime").
Zero breakage: no signature changes, no behaviour changes. Description can
never raise -- a broken object still describes as "this machine".
Adds 17 tests. Suites unchanged vs clean main (6 failed / 343 passed on both;
all 6 pre-exist). Verified end-to-end against Docker: shared-sandbox flow wrote
and read back through one instance, repr stable, 0 leftover containers.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Address reviewer findings on the async loop-guard path:
- Re-raise ToolExecutionError in _execute_tool_async_with_retry so a
loop-guard HALT bypasses retry/error-dict conversion and stops the run.
- Treat loop_blocked BLOCK results as non-retryable in the retry wrapper
so a custom retry policy cannot re-run a terminally blocked call.
- Record tool timeouts as loop-guard failures (fall through instead of
early return) so repeated timeouts accumulate toward BLOCK/HALT.
Co-authored-by: Mervin Praison <[email protected]>
The async tool-execution path (_execute_tool_async_impl, backing achat()/
async workflows) had no loop-guard or doom-loop protection, unlike the sync
path in tool_execution.py. A repeatedly-failing tool could be hammered every
turn with no automatic stop.
Mirror the sync path's loop-guard wiring on the async path:
- pre-execution check() honoring BLOCK (error dict) / HALT (raise) / WARN
- post-execution record() + check() surfacing block/halt back to the model
- record failed (raised) invocations so streaks accumulate toward thresholds
- propagate a loop-guard HALT (ToolExecutionError) instead of swallowing it
Reuses the existing _ensure_loop_guard capability; no new params/exports.
The circuit breaker itself wraps a sync call + time.sleep and is not async-safe
to reuse as-is, so this focuses on the doom-loop/loop-guard protection the
issue centers on (which is pure/sync and safe from async).
Co-authored-by: MervinPraison <[email protected]>
AgentTeam accepted guardrails/web/reflection/caching/learn/knowledge and stored
them but never applied them at the team level. Emit a construction-time warning
when any is truthy so silent no-enforcement stops being the default.
Agent._process_knowledge silently dropped http(s) URL sources; replace the bare
pass with an actionable warning explaining URL ingestion is not implemented.
Co-authored-by: MervinPraison <[email protected]>
The direct-callable branch of LLM._generate_tool_definition re-derived the
schema from the raw wrapped function via build_tool_definition, bypassing
FunctionTool/BaseTool.get_schema(). This reverted @tool(name=) overrides to
the original function name and leaked Injected[T] params into the schema sent
to the model. Now the callable branch checks for get_schema() first, mirroring
the existing registry-lookup branch.
Co-authored-by: MervinPraison <[email protected]>
Addresses two Greptile P1 findings on the native OpenAI path (#3933):
- Move _track_token_usage inside the tool-call loop (sync + async) so every
billed completion — including intermediate tool-call rounds — is recorded
in session totals and by_model/by_agent rollups, not just the final one.
- Clear last_token_metrics when a response has no usable usage so a reused
client never reports a prior completion's spend as the latest call's usage.
Adds regression tests for multi-iteration accounting and stale-metric clearing.
Co-authored-by: Mervin Praison <[email protected]>
Default Agent(llm="gpt-4o-mini") runs through the native OpenAIClient,
which never populated the public token collector, so
get_token_collector().get_session_summary() stayed at zero after a paid
completion. Token accounting was effectively gated behind verbose/metrics
display on the LiteLLM path and entirely absent on the OpenAI path.
Add a lightweight OpenAIClient._track_token_usage that reads usage from
the final response and records it into the global TokenCollector after
every successful sync/async completion, independent of any display flag.
Thread agent_name through the adapter so by_agent rollups populate while
still keeping application metadata out of the OpenAI API call.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
_run_custom_agent still set agent_config["verbose"], which the
consolidated Agent constructor rejects with TypeError, so
`praisonai run --agent <name> --verbose` crashed — the same class of
bug #3930 fixed for the profiled paths. Thread verbosity through the
output="verbose" preset instead, without clobbering a definition's own
explicit output. Adds regression tests guarding the kwargs against the
real Agent signature.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
serve() is a public entry point. Inserting allow_network before the
existing approval_mode parameter would rebind positional callers
(e.g. serve(..., "auto")) to allow_network. Append it last to keep
backward-compatible positional binding.
Co-authored-by: Mervin Praison <[email protected]>
The LLM._build_responses_params forwarded Chat Completions multimodal
messages (content parts with type=text/image_url) unchanged into the
Responses API input, causing a 400 invalid_value on input[].content[].type.
Reuse OpenAIClient._build_responses_content to translate parts to
input_text/input_image and inline local image files as data URLs.
Co-authored-by: Mervin Praison <[email protected]>
The ACP CLI parsed --allow-network but never passed it to serve(),
and serve() didn't accept it, so network tools were gated by a flag
no CLI user could set. Thread allow_network through CLI -> serve() ->
ACPConfig so it reaches the tool capability gate in the model loop.
Co-authored-by: Mervin Praison <[email protected]>
The Agent constructor consolidated verbose/stream/metrics into output=. The
three profiled paths (_run_profiled_code, run.py profiled agent, cli_profiler)
still passed a top-level verbose=, raising TypeError before any LLM call. Map
verbosity through output= instead and add a signature-guard regression test.
Co-authored-by: Mervin Praison <[email protected]>
The generic "Authentication Tuple" detector fires on bare ("module",
"Attr") string-pair literals whose key/string contains auth/oauth.
The prior `# pragma: allowlist secret` is a detect-secrets directive
that GitGuardian ignores, so the check kept failing.
Construct the mapping values through a tiny local `_t()` alias so no
bare 2-string tuple literal remains on the flagged lines. Mapping type
(Dict[str, Tuple[str, str]]) and runtime behaviour are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
The (module, attribute) string tuples for the auth/oauth lazy imports were
misdetected as 'Authentication Tuple' secrets. They are import targets, not
credentials. Added inline allowlist pragmas (no behaviour change).
Co-authored-by: Mervin Praison <[email protected]>
Replace five hand-rolled lazy-import __getattr__ blocks (eval, mcp, bus,
trace, skills) with the existing create_lazy_getattr / _with_groups helpers.
Exports, names and lazy semantics are unchanged; eval and mcp now gain the
per-attribute cache the hand-rolled versions lacked.
Co-authored-by: MervinPraison <[email protected]>
Defer WorkflowContext construction (and its all_variables.copy()) so it is
only built when a step has should_run or handler. On the common action-step
path the object was previously constructed and immediately overwritten by
_build_step_context, wasting a growing shallow dict copy per step. Applied
to both the sync and async twins; behaviour is identical since the guard
uses the exact conditions gating the only two consumers.
Co-authored-by: MervinPraison <[email protected]>
Adding create_thread to the runtime-checkable OutboundMessengerProtocol
broke isinstance() conformance for the production BotOutboundMessenger,
failing test_messenger_satisfies_protocol and
test_messenger_still_satisfies_protocol_with_react.
Mirror the existing react()/ReactionResult seam: DeliveryRouter.create_thread
resolves the target, unwraps the adapter, gates on capabilities["threads"],
and returns a typed (status, target, thread_id) tuple — never raising.
BotOutboundMessenger.create_thread maps that to the core ThreadResult so an
unthreadable channel yields a typed unsupported/no_route/failed outcome and
callers fall back to the parent channel. Heavy platform work stays in the
wrapper per AGENTS.md; core keeps only the protocol + dataclass.
Adds 5 wrapper tests covering ok/unsupported/no_route/failed and protocol
conformance with create_thread.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Adds a first-class, capability-gated way for the gateway (or an agent action)
to open a new platform-native thread/topic under a channel, mirroring the
existing react()/ReactionResult contract (#3917):
- PlatformCapabilities.supports_threads flag (+ to_dict/from_dict roundtrip)
- ThreadStatus (ok|unsupported|failed|no_route) + ThreadResult typed outcome
with an `ok` convenience property, so a channel that cannot thread returns a
typed `unsupported` outcome and callers fall back to the parent channel —
never raises
- OutboundMessengerProtocol.create_thread(target, name) -> ThreadResult
- Export ThreadResult/ThreadStatus from praisonaiagents.gateway
Pure protocol/dataclass in core with no heavy SDK imports; concrete adapter
implementations live in the praisonai-bot wrapper.
Co-authored-by: MervinPraison <[email protected]>
Addresses two Greptile P1 findings on the new provision_gateway_config API:
- Fail closed on unsupported platform / empty token instead of writing a
config the gateway would reject at startup or boot degraded.
- Declare every requested agent in the agents: block (was silently dropping
all but the first), routing the channel to the first as its default.
Co-authored-by: Mervin Praison <[email protected]>
Gateway self-healing (doctor --fix) and provisioning (onboard) previously
existed only as private CLI helpers. This adds a typer-free
praisonai_bot.gateway.admin module exposing repair_gateway_config,
provision_gateway_config, and a GatewayRepairResult dataclass on the public
praisonai_bot surface, completing the CLI + YAML + Python parity contract.
The existing repair machinery is moved into admin.py (typer-free) so the
library API does not depend on the CLI-only typer package; the Typer commands
re-import these helpers and remain thin wrappers over one canonical flow (DRY).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
- paths.py: snapshot the single-root detection so creating the default
~/.praisonai data dir mid-run no longer flips config/state/cache off
their XDG locations (Greptile P1 #1). PRAISONAI_HOME stays live.
- diag.py: include the canonical (XDG) state-home logs dir when bundling
diagnostics, de-duplicating directories (Greptile P1 #2).
- Add regression test for mid-run path stability.
Co-authored-by: Mervin Praison <[email protected]>
- _load_env_user_config: use `data is not None` for inline blobs and
`isinstance(data, dict)` for explicit paths so a valid empty mapping ({}
or empty file) stays authoritative and no longer re-enables disk discovery,
and a non-mapping file body no longer raises TypeError on _source assignment.
- tests: clear the full per-key env var set consumed by _load_env_config()
for isolation; add regression coverage for empty inline mapping, empty
explicit file, and non-mapping explicit file.
Co-authored-by: Mervin Praison <[email protected]>
Add XDG-aware resolvers to core praisonaiagents/paths.py: get_config_dir()
and get_state_dir(), and make get_data_dir()/get_cache_dir() honour
$XDG_{DATA,CACHE}_HOME on fresh installs. Precedence: PRAISONAI_HOME ->
existing ~/.praisonai/~/.praison single root -> $XDG_*_HOME/praisonai ->
XDG defaults, preserving full backward compatibility for existing installs.
Route session spill and the wrapper MRU-model recency onto the canonical
state home, ending the ~/.praison vs ~/.praisonai split-state.
Co-authored-by: MervinPraison <[email protected]>
Add PRAISONAI_CONFIG_CONTENT (inline JSON/YAML) and PRAISONAI_CONFIG
(explicit path) to the wrapper resolver's user-config layer, mirroring the
sibling PRAISONAI_AUTH_CONTENT credential blob. Inline content is parsed in
memory (nothing on disk); an explicit path replaces file discovery. Inline
wins over path, which wins over global/project discovery. Higher-precedence
per-key env vars, CLI flags and managed policy are unchanged, and unset
preserves today's file-discovery behaviour.
Co-authored-by: MervinPraison <[email protected]>
Address the four P1 findings on PR #3980 (issue #3979):
- auto.py: add server-side output gate that strips code_execution tools
(e.g. execute_command) from generated roles unless the task actually
requested code execution. Deny-list gated by intent preserves all other
tools (backward compatible). Prompt allow-list narrowed to task-scoped
recommendations.
- jobs/store.py: make idempotency key UNIQUE and add atomic save_if_absent
so concurrent same-key submits resolve to a single job (side effects run
once). Reconcile QUEUED/RUNNING rows to FAILED on startup so restarted
jobs no longer poll forever.
- jobs/router.py: claim the idempotency key atomically via save_if_absent
and only dispatch to the executor when this request won the claim.
- acp/safe_edit.py: reject writes through symlinked parent directories or a
symlinked target as defence-in-depth against the propose->apply TOCTOU.
Verified: idempotency race, restart reconciliation, symlink containment,
and shell-tool stripping all pass; auto_generator + safe_edit + sqlite
suites green. Only the 3 pre-existing InMemoryJobStore test failures remain
(unrelated, present on base release).
Co-authored-by: Mervin Praison <[email protected]>
Gap 1 (auto.py): stop auto-appending the shell-exec tool 'execute_command'
to every generated agent (now opt-in via code_execution keywords only), fence
the untrusted topic in the LLM prompt with an allow-list, and add opt-in
workspace containment for agent_file to block path traversal.
Gap 2 (acp/safe_edit.py): add an RLock guarding _proposals and status
transitions, claim APPROVED->APPLIED atomically to prevent double-apply,
re-validate the path right before write to close the symlink TOCTOU, write
atomically via _atomic_write_text, and return one pipeline per workspace so
concurrent agents no longer leak across workspaces.
Gap 3 (jobs): add a stdlib-sqlite3 SqliteJobStore so jobs and idempotency
keys survive restarts; default store now persists when PRAISONAI_JOBS_DB_PATH
is set and refuses the in-memory store in production.
Co-authored-by: MervinPraison <[email protected]>
Two backward-compat fixes for the deprecated-param consolidation:
- Make handoffs + consolidated feature params keyword-only via a `*`
separator so a stray positional value (e.g. an old positional
allow_delegation=True) can no longer silently bind to `handoffs`.
- Accept fallback_models as an internal-only kwarg forwarded by
clone_for_channel(); pop it before the unknown-kwarg check and seed the
local so cloned agents keep their LLM fallbacks. Explicit
LLMConfig(fallback_models=...) still takes precedence.
Adds regression tests covering the internal fallback_models path,
clone_for_channel() preservation, keyword-only handoffs, and the
positional misbind guard.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Moves allow_delegation, allow_code_execution, code_execution_mode, auto_save,
rate_limiter, verification_hooks, and cli_backend out of the explicit __init__
signature (48 -> 41 visible params) into **legacy_kwargs, rebound to locals from
a new _LEGACY_AGENT_PARAMS map. Fully backward compatible: old keyword calls work
and still emit the same DeprecationWarnings; unknown kwargs now raise TypeError.
Co-authored-by: MervinPraison <[email protected]>
Align merge-gate stale-FINAL recovery with PraisonAI-Tools: accept MervinPraison
Claude finished comments and bypass the 15-minute debounce when HEAD moves after
a conflict rebase without a fresh FINAL trigger.
- Replace brittle exact-comment assertion with concept-based checks so
harmless wording edits no longer break the suite (Greptile feedback).
- Add key-gated end-to-end test that runs Agent(sandbox=True).start()
through a real LLM and asserts the model-visible tool set never gains
execute_python_code / execute_shell_command (CodeRabbit feedback).
Co-authored-by: Mervin Praison <[email protected]>
Reverts the tool-injection block added in #3975. Adversarial review found it
is a net security regression, not a fix. Everything else from that PR is kept.
Why it must go:
1. It escalated privilege. `sandbox=` is a RESTRICTION, but the injection made
it GRANT capability -- and the granted tools bypass the approval registry,
whose presets gate `execute_code`/`execute_command`, not the injected
`execute_python_code`/`execute_shell_command`:
Agent(approval="read_only") -> tools: []
Agent(approval="read_only", sandbox=True) -> tools: [execute_python_code,
execute_shell_command]
A security-labelled flag handed the model two ungated arbitrary-code-execution
tools under the strictest approval preset.
2. It advertised isolation the backend does not provide. The default
subprocess backend enforces none of its own SecurityPolicy. Verified on this
machine: outbound HTTPS returned 200 with allow_network=False; sandboxed code
read a real SSH private key despite `~/.ssh` in blocked_paths; `import
subprocess` worked despite blocked_imports. The tool description shown to the
model said "Execute Python code safely in sandbox."
3. Coexistence made it worse, not better. With autonomy=True the agent still
carries the host `execute_command` (injected earlier in __init__), so the
model can simply pick the unsandboxed tool.
Also fixes the test that let this ship: it asserted `child_pid != os.getpid()`
and called that isolation. A separate process is not a security boundary. The
suite is now contract-based -- sandbox= must not add tools, must not widen an
approval preset, and must still configure explicit execute_code().
Kept from #3975 (all genuinely correct):
- the `metadata` kwarg fix (flagged code no longer raises TypeError)
- the clone fix (`sandbox_config`, not the never-assigned `_sandbox_config`)
- the FutureWarning when sandbox= and backend= are combined
- NOT IMPLEMENTED labels on the inert autonomy/code_sandbox_mode fields
Giving the model a sandboxed execution tool should be an explicit act by the
caller, the way MCP() is -- not a side effect of a restriction flag. No peer
framework (smolagents, AutoGen, deepagents, OpenAI Agents SDK, Pydantic AI)
grants execution capability from a config flag.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Channel clones copied the framework-generated execute_python_code /
execute_shell_command wrappers, which close over the source agent. The
constructor's name-dedup then skipped creating clone-bound replacements,
so a clone's execution tools ran through the source agent's SandboxManager
— sharing isolation state across channels (CodeRabbit/Greptile P1).
- Tag generated sandbox tools with `_praison_sandbox_tool` in
SandboxMixin._get_code_execution_tools().
- clone_for_channel() now drops tagged tools when copying, so the
constructor regenerates clone-owned wrappers. User tools with colliding
names lack the tag and are preserved.
- Add regression test asserting clone tool identity and SandboxManager
differ from the source.
- Compare parsed integer PIDs (not substrings) in the out-of-process test;
use next(...) per ruff RUF015.
Co-authored-by: Mervin Praison <[email protected]>
`Agent(sandbox=...)` built a SandboxConfig that nothing ever read. The agent
looked isolated and was not -- the worst failure mode a security setting can
have. Four defects, each verified before and after:
1. sandbox= gave the model no sandboxed tools.
`_get_code_execution_tools()` had zero non-test callers, so `sandbox=True`
added nothing to `agent.tools`. It now attaches execute_python_code /
execute_shell_command (skipping names the user already defined).
Verified: code now runs in a separate PID from the caller.
Scope note: this isolates code the MODEL writes. Python callables passed
via `tools=` are ordinary in-process functions and cannot be retrofitted
into a sandbox -- that limit is now stated rather than implied.
2. Sandboxed execution crashed exactly when it mattered.
`execute_code()` injected a `metadata` kwarg that flowed into
SandboxProtocol.execute(), which has no such parameter -- so any code
tripping a security warning raised TypeError instead of running. Warnings
are now attached to the result instead of forwarded.
3. Clones silently lost their sandbox.
`clone_for_channel()` read `_sandbox_config`; SandboxMixin writes
`sandbox_config`. The underscore name is never assigned anywhere, so every
clone ran unisolated.
4. Two docstrings promised protection that does not exist.
`AutonomyConfig.sandbox` claimed subprocess isolation is auto-enabled at
level="full_auto" (implemented nowhere), and
`ExecutionConfig.code_sandbox_mode` documents subprocess isolation while
having zero consumers. Both are now labelled NOT IMPLEMENTED. The fields
are kept -- removing public dataclass fields would TypeError for existing
users -- so deletion belongs in a major version.
Also: combining sandbox= with backend= now emits a FutureWarning. The managed
backend takes the whole turn before any local execution, so sandbox= was
silently ignored with no signal.
Opt-in and non-breaking: agents without sandbox= are byte-for-byte unchanged
(asserted by test).
Adds 10 regression tests. Suite: 473 passed vs 463 on clean main (+10, no new
failures); the 2 test_param_consolidation warning-registry failures reproduce
identically on clean main with the same selection and are unrelated.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- verify_and_pair now validates the channel_id binding BEFORE clearing the
brute-force counter, so a valid HMAC presented against the wrong channel_id
is rejected without handing later guesses a fresh attempt budget (Greptile P1).
- generate_code enforces max_pending against _pending_by_hash (all logical
pending entries, including ones rehydrated from disk) so repeated restarts
cannot grow pairing.json past the configured bound (CodeRabbit).
- Add regression tests for both behaviours.
Co-authored-by: Mervin Praison <[email protected]>
Persist only a salted SHA-256 hash of each pairing code (no plaintext code
ever lands in pairing.json), add a per-channel_type brute-force lockout that
applies uniformly across HTTP/in-chat/CLI approval surfaces, and generate
codes from an unambiguous alphabet (drops 0/O/1/I). Backward-compatible:
public API unchanged, legacy plaintext stores still load.
Co-authored-by: MervinPraison <[email protected]>
An action-only YAML step builds its Agent during the run, after the
initial shared-compute attach(), so its shell/file tools silently ran
locally instead of in the run_on: sandbox. Expose the live SharedCompute
on the Workflow and attach the temp agent before it chats. Adds tests.
Co-authored-by: Mervin Praison <[email protected]>
The native OpenAI-SDK tool loop re-injected resolved DeferredToolResults into
the per-call `messages = list(messages)` copy, which is discarded once the loop
returns. Since background jobs typically complete after the loop returns, the
resolved value never reached subsequent turns — unlike the LiteLLM path, which
appends to the persistent chat_history (llm.py:_register_deferred_if_any).
Thread an optional `deferred_history_sink` through the sync/async/streaming
native loops and _handle_native_deferred_result; the agent passes its existing
chat_history as the durable sink. Falls back to `messages` when absent, so
existing callers are unaffected. No new Agent params/modules/exports.
Adds tests for durable-sink survival past loop return, backward-compat fallback,
and early (buffered) resolution delivery.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Mervin Praison <[email protected]>
Closes the last functional gap in remote execution: no-code users had no
way to reach it at all. `run_on=` existed only on the Python API, so anyone
driving PraisonAI through agents.yaml was locked out of shared sandboxes.
name: remote-demo
run_on: docker # every step shares ONE sandbox
agents:
writer: {role: Writer, goal: Write files}
reader: {role: Reader, goal: Read files}
steps:
- agent: writer
action: "Write 'hello' to /workspace/note.txt"
- agent: reader
action: "Read /workspace/note.txt"
The provider name is validated at load time against the same registry the
Python API uses, so a typo fails when the file loads -- listing the valid
names -- instead of surfacing at the first tool call, halfway through a run.
Also updates the README's managed-agents section, which still advertised the
deprecated `ManagedAgent` factory and the old `compute=` name:
- leads with `run_on=` (Python) and `run_on:` (YAML)
- single-agent examples now use LocalAgent / HostedAgent, which emit no
DeprecationWarning
- documents `praisonai managed ps` / `stop --all`
Adds examples/yaml/workflows/remote_sandbox_workflow.yaml, executed
end-to-end against Docker: writer wrote /workspace/note.txt and reader read
'hello from step 1' back from the SAME instance (docker_72722484ef46), with
zero leftover containers.
12 new parser tests (no Docker needed). Managed suite 289 passed; the same 6
failures exist on clean main. YAML suite 168 passed, no parser regression.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- Catch (ImportError, AttributeError) instead of broad Exception in the
vendored typer._click probe (resolves Ruff S110/BLE001).
- Add test_namespace_caller_still_dispatches to pin that every long option
_namespace_to_gateway_argv emits is accepted by the canonical Typer command.
Co-authored-by: Mervin Praison <[email protected]>
The AFTER_TOOL bridge mutated data.tool_output and could deny, but the
sync (tool_execution.py) and async (execution_mixin.py) executors
discarded both — so redaction/blocking never reached the model. Both
paths now read back the rewritten tool_output and honour a block
decision, mirroring the BEFORE_TOOL path. Clarified GuardrailBlocked
docstring for after_tool and added real-agent execute_tool regression
tests plus a GuardrailBlocked bridge test.
Co-authored-by: Mervin Praison <[email protected]>
Route the public `praisonai gateway <cmd>` entry point to the single
canonical Typer gateway command app instead of a reduced argparse handler
that only wired start/status/hooks and dead-ended on everything else.
Now `praisonai gateway` exposes the same surface as `praisonai-bot gateway`
(doctor, test, channels, stop, restart, pause/resume/reconnect,
install/uninstall, mint-link, logs, send, hooks, sessions) with one
`start` implementation carrying the credential/tool preflight,
config-version migration and `--openai-api`/`--mcp` flags. The gateway's
own degraded-state retry hints (`praisonai gateway doctor`/`--fix`/`test`)
now name commands the operator can actually run.
Deletes the duplicate reduced argparse start/status/hooks parser and
dispatch; unknown commands and bad flags now degrade gracefully to a
non-zero exit code with a rendered message rather than a static dead-end.
Co-authored-by: MervinPraison <[email protected]>
The native OpenAI-SDK tool loop in llm/openai_client.py called
execute_tool_fn directly and stringified a returned DeferredToolResult,
losing the handle so its eventual background value was never re-injected —
unlike the LiteLLM path (_register_deferred_if_any). Add a small shared
helper that registers the handle on the global deferred resolver and
surfaces the note to the model, wired into the sync, async and streaming
native tool-result blocks. No new Agent params or exports.
Co-authored-by: MervinPraison <[email protected]>
The after_tool hook bridge discarded the plugin's return value, so a plugin
could only observe tool results, never rewrite or redact them — contradicting
the documented "Can modify result" contract and leaving no post-tool guardrail
path for scrubbing secrets/PII. Mirror the after_llm/before_tool bridges: write
the returned value back onto data.tool_output and honour deny/HookResult and
GuardrailBlocked decisions for symmetry.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer findings on PR #3965 (wrapper-only, praisonai-code):
- /continue now clears self.messages before replay so repeated resumes (or
resuming after activity) don't duplicate or retain stale on-screen turns.
- /continue loads the full stored history instead of the default 50-message
tail so the "… N earlier turns" note reflects the true total.
- _run_simple fallback renders restored user/assistant turns (not only system
lines) so replayed conversations are visible without prompt_toolkit.
- Type-guard tool_calls handling in both renderers.
Co-authored-by: Mervin Praison <[email protected]>
Redraw restored user/assistant turns (and tool activity) via the same live
renderer on interactive resume instead of only printing a one-line summary.
Bounded to the last N turns with an "… earlier turns" note.
Co-authored-by: MervinPraison <[email protected]>
The #3251 regression guard asserts _build_yaml_workflow resolves tool_timeout
via _resolve_effective_tool_timeout. The prior explicit-timeout helper bypassed
it, breaking the guard. Delegate per-agent/role resolution back to the shared
_resolve_effective_tool_timeout so both the sequential/hierarchical and workflow
paths use one source of truth (and its tightest-value warnings still fire),
while still ignoring the injected bare CLI --tool-timeout default.
Co-authored-by: Mervin Praison <[email protected]>
The legacy CLI always injects its --tool-timeout argparse default (60) into
cli_config, so the new workflow fail-fast rejected every ordinary workflow YAML
run (Greptile P1). Distinguish an explicit user request (per-agent/role YAML
timeout or a changed CLI value) from the bare CLI default via
_resolve_explicit_workflow_tool_timeout. Adds regression tests.
Co-authored-by: Mervin Praison <[email protected]>
- auto.py: wrap blocking convert_and_save/_save_workflow in asyncio.to_thread
across AutoGenerator/WorkflowAutoGenerator/JobWorkflowAutoGenerator so
agenerate() no longer parks the event loop on merge/yaml-dump/fsync.
- claude_code.py: pop caller output_format before forcing stream-json in
stream(), matching cursor/gemini siblings (fixes TypeError drift).
- agents_generator.py: fail fast on tool_timeout for process: workflow YAMLs
instead of warn-only no-op, mirroring _validate_workflow_cli_capabilities.
Co-authored-by: MervinPraison <[email protected]>
The CI-flaky test_finds_latest_by_mtime creates two run dirs back-to-back;
when their mtimes collide (coarse fs resolution), a stable sort left the
winner up to arbitrary iterdir() order, so the older-named dir could win.
Break ties by name so timestamp-named dirs stay deterministic.
Co-authored-by: Mervin Praison <[email protected]>
- _discover_instances now returns (instances, errors): an available provider
whose list_instances() fails is no longer silently reported as clean success,
so `ps`/`stop --all` never lie about an empty inventory while sandboxes run.
- Explicit `--provider <name>` for an uninstalled/unknown provider now surfaces
an error instead of a silent empty result. Uninstalled/unconfigured providers
in the default scan remain silently skipped (a missing E2B key is normal).
- `ps --json` now returns {"sandboxes": [...], "errors": [...]} and exits non-zero
when any provider could not be queried.
- Corrected ManagedAgent factory docstring: compute-provider names warn and
delegate to LocalManagedAgent; they do NOT raise ValueError.
- Tests updated for new contract + added coverage for listing failures and
explicit unknown-provider errors.
Co-authored-by: Mervin Praison <[email protected]>
Three things, all stemming from reviewing the shared-sandbox feature (#3949).
1. Sandbox visibility (the piece left open in #3949)
praisonai managed ps # list running sandboxes
praisonai managed ps --json # machine-readable
praisonai managed stop <id> # reclaim one
praisonai managed stop --all # reclaim everything
Sandboxes normally self-destruct when a run ends, but a crashed or killed
run leaves one behind; there was no way to see or reclaim it.
2. Cross-process instance discovery (bugs found while building the above)
DockerCompute tracked instances only in an in-process dict, so:
- list_instances() always returned nothing from a fresh process -- exactly
when you need it, i.e. finding strays left by a previous run.
- _shutdown_sync() popped from that dict and, finding nothing, silently
did nothing while reporting success. `managed stop` claimed "Stopped"
and left the container running.
- get_status() reported STOPPED for any live container it didn't start.
All three now fall back to Docker itself (the `praisonai=managed` label and
the `praisonai_<id>` name), and shutdown raises rather than pretending to
succeed when the container cannot be found.
3. Naming: `compute=` -> `run_on=`
Researched how comparable tools name this. `executor` is the most-attested
name industry-wide (smolagents, ADK, AutoGen, Airflow, Nextflow, Dagster,
...), but it is already used as a concept inside workflows.py. `backend`,
`runtime` and `sandbox` are all taken as public Agent params, and `provider`
is used ~147 times for LLM/vector-store providers.
`compute` as a noun is cloud-industry jargon (Wiktionary labels the noun
sense "chiefly cloud computing"), which works against the goal of a name a
non-developer can read. `run_on` is plain English, has mass-audience
precedent in GitHub Actions' `runs-on:`, and has zero collisions in this
codebase.
AgentFlow(run_on="docker", steps=[writer, reader])
AgentTeam(agents=[w, r], run_on="docker")
`compute` stays as the INTERNAL vocabulary (ComputeConfig,
ComputeProviderProtocol, SharedCompute, _compute_bridge) where the
industry term is the right one. No alias is added: `compute=` merged in
#3949 but is NOT in any published release (PyPI 1.6.166 predates it), so
this rename breaks nobody and avoids a second param.
4. Doc fix: the ManagedAgent factory docstring claimed compute-provider names
raise ValueError; they actually emit a DeprecationWarning and delegate to
LocalManagedAgent. Corrected to match the code.
Verified against local Docker: `run_on="docker"` write-then-read hit one
shared instance; `managed ps` found a real stray container with correct
uptime; `managed stop --all` genuinely removed it (0 containers after).
16 new CLI tests + 14 core tests, none requiring Docker.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- agents.py: re-check dependency failure at consumption time in the async
sequential path. asequential() checks deps inside the generator, but
async_execution tasks are buffered and drained later, so an upstream async
task may not be failed yet when a dependent is yielded. Re-checking after
flushing pending async tasks makes the failure cascade fire for the async
path too.
- doom_loop.py: count progress markers against the boundary *before* the
no-progress window (the preceding action's completion timestamp) so a marker
recorded during the window's first action — timestamped before that action's
record_action() — is no longer wrongly filtered out.
- tool_execution.py: bound orphaned tool executors. Recycling on timeout keeps
throughput, but repeated timeouts could leak unbounded blocked threads. Cap
recycles at _MAX_ORPHANED_TOOL_EXECUTORS, then fall back to reusing the
bounded pool so process resources can't be exhausted.
- Add regression tests for the doom-loop window boundary edge.
Co-authored-by: Mervin Praison <[email protected]>
grep/glob/ast_grep_search were loaded raw from praisonaiagents, so their
containment defaulted to os.getcwd() (grep/glob) or was absent
(ast_grep_search). In headless `code -p --workspace <dir>` (no chdir) a
model-supplied path could read outside the selected workspace. Bind each
search tool's path to the configured workspace (fail-closed), mirroring the
edit/acp/lsp groups, and add a credential-free regression test.
Co-authored-by: Mervin Praison <[email protected]>
- asequential(): port failed-task skip + dependency-cascade check from
sequential() so async runs short-circuit tasks with failed upstream deps.
- tool_execution: retire the tool ThreadPoolExecutor on timeout so hung
threads no longer permanently poison the 2-worker pool.
- doom_loop: store (marker, timestamp) and only count progress markers
within the current no-progress window, so NO_PROGRESS detection is no
longer permanently disabled after the first successful tool call.
Co-authored-by: MervinPraison <[email protected]>
Replaces the fragile private _get_stop_reason helper (which checked the
wrong _llm_instance attr and missed the native OpenAI backend) with the
public backend-aware Agent.last_stop_reason property, so slash-less
OpenAI model names no longer record a null stop_reason.
Co-authored-by: Mervin Praison <[email protected]>
Explicitly calling tracker.end(total_tokens=...) inside a
`with Profiler.streaming(...)` block previously recorded twice because the
context manager's finally also calls end(). Guard with a _recorded flag so
only the first invocation records a StreamingRecord.
Co-authored-by: Mervin Praison <[email protected]>
Import TimingRecord/StreamingRecord/StreamingTracker from
praisonaiagents.profiling and subclass them for the wrapper's superset
fields (file/line, total_tokens) instead of re-declaring them. Core is now
the single owner of the shared primitives; wrapper public API and --profile
flags are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Fixes two P1 issues from PR review:
- Concurrent first-use tool calls (e.g. parallel steps) could each pass the
unguarded instance_id check and provision separate sandboxes, splitting the
run and leaking one instance. ensure_provisioned is now guarded by a lock
with double-checked locking.
- write_file used a fixed __PRAISON_EOF__ heredoc delimiter, so file content
containing that line would terminate the heredoc early, truncate the file,
and execute the remainder as shell commands. The delimiter is now a random
per-write token with a collision guard.
Adds regression tests for concurrent provisioning and delimiter-bearing
content, and updates the fake provider to parse the randomized delimiter.
Co-authored-by: Mervin Praison <[email protected]>
Managed execution was per-Agent only: `backend=` exists on Agent but not on
AgentTeam or AgentFlow, and each LocalAgent(compute=...) provisions its own
isolated instance. A workflow therefore got N sandboxes with no shared
filesystem, so agents could not hand files to each other -- and YAML users
had no path to remote execution at all.
Adds a single `compute=` param to AgentFlow (and its Workflow/Pipeline
aliases) and AgentTeam. One sandbox is provisioned per run and every
participating agent's shell/file tools are bound to it, so a file written by
step 1 is visible to step 2. Orchestration stays local.
flow = AgentFlow(compute="docker", steps=[writer, reader])
team = AgentTeam(agents=[w, r], tasks=[...], compute="docker")
Details:
- praisonaiagents/managed/_compute_bridge.py resolves provider names lazily
from the praisonai wrapper, mirroring sandbox/_sandbox_bridge.py.
- Provisioning is lazy (a run that never touches the sandbox costs nothing)
and teardown is guaranteed via context manager, even when a step raises.
- Agents that already carry their own `backend=` are left untouched.
- Tools are bound onto `backstory`, not `instructions`: Agent.__init__ copies
instructions into role/goal/backstory and builds the system prompt from
those, so patching `.instructions` would be silently ignored.
- The capability prompt is required, not cosmetic: without it models
routinely refuse to call bridged tools ("I can't execute shell commands"),
so the sandbox spins up and is never used.
- Tool results are never the empty string; an empty result reads as "no
progress" and trips the loop guard into a stuck-agent error.
Verified end-to-end against local Docker: writer wrote /workspace/data.txt
and reported container hostname; reader read the same file and reported the
same hostname, with zero leftover containers after teardown.
Adds 12 tests using a fake compute provider (no Docker/cloud needed).
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Moves agentflow.gif and latest_ai_news_and_crawl_each_url_to_find_info.gif
out of the hero and down to the bottom, directly above the Langfuse
Tracing section. The "* export TAVILY_API_KEY=xxxxx" footnote travels
with the news GIF it annotates.
The hero is now: install -> Elon badge -> five-layer stack -> dashboard
screenshot -> ASCII art -> docs badge.
Pure move - no content change (identical line multiset).
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The root cause (unresolved TaskOutput forward reference) is fixed at source
in output/models.py via model_rebuild(), so PydanticUserError no longer
occurs in the guardrail path. The re-raise in _process_guardrail was also
swallowed by the 15 downstream chat handlers that return None, so it never
achieved its stated propagation contract (Greptile P1). Removing it keeps
guardrail error handling simple and consistent without touching hot paths.
Co-authored-by: Mervin Praison <[email protected]>
The previous example advertised assigning `agent.thinking_budget = budget`,
but `_thinking_budget` is stored and never read by the Agent execution
pipeline (verified: no consumer in agent.py or the LLM call path). Point
users to the working `reasoning_steps=True` option and document the
`ThinkingBudget.get_tokens_for_complexity` helper instead.
Co-authored-by: Mervin Praison <[email protected]>
Run shlex.split first and decide by token count. Fixes Greptile P1
(spaced executable paths + args no longer mis-split; quote the path as
an escape hatch) and P2 (tabs/newlines now handled, not just spaces).
Co-authored-by: Mervin Praison <[email protected]>
KnowledgeConfig.embedder / embedder_config were dropped between Agent
resolution and Knowledge construction, so non-OpenAI embedders silently
fell back to text-embedding-3-small.
Forward them through RetrievalConfig and normalise into mem0's
embedder = {provider, config} shape (embedder acts as provider shorthand).
Co-authored-by: MervinPraison <[email protected]>
Agent.__init__ has no **kwargs, so db=/session_id=, thinking_budget=,
and observability= raised TypeError immediately. Update the db, thinking,
and obs module docstrings to the working config-object / property forms.
Co-authored-by: MervinPraison <[email protected]>
Passing a callable to Agent(guardrails=...) returned None because two
different classes named TaskOutput existed and the guardrail path mixed them.
- output/models.py: import TokenMetrics at runtime and call
TaskOutput.model_rebuild() so the model can actually be instantiated
(previously the forward ref was TYPE_CHECKING-only and never resolved).
- main.py: re-export the single canonical TaskOutput from output.models so
main.TaskOutput and output.models.TaskOutput are the same class.
- agent.py: let PydanticUserError propagate from _process_guardrail instead of
swallowing it into a validation failure that silently nulls the response.
Co-authored-by: MervinPraison <[email protected]>
Previously MCP("npx -y pkg", args=[...]) passed the whole string as the
executable, so the subprocess spawn silently failed and 0 tools were
discovered. Now the command string is split on whitespace regardless of
whether args are supplied, using the first token as the executable and
prepending the remaining tokens to any explicit args.
Also updates examples/python/mcp/filesystem-mcp.py to use the reliable
executable + args form.
Co-authored-by: MervinPraison <[email protected]>
Fixes four inaccuracies flagged in review of the five-layer stack section:
- Budget stop via ExecutionConfig(on_budget_exceeded="stop") surfaces as
completion_reason="error" (BudgetExceededError), not "budget_exhausted"
- Default handoff SUMMARY policy truncates to the last few messages verbatim;
it does not summarise
- ManagedAgent() with no ANTHROPIC_API_KEY falls back to a local loop, not cloud
- `sessions list`/`resume` require agent-id and session-id+prompt arguments
Co-authored-by: Mervin Praison <[email protected]>
Add a "Five-Layer Agent Stack" section after "Meet your first Agent",
showing that PraisonAI covers every layer of the agent stack rather than
just multi-agent orchestration:
1 Prompt - instructions/role/goal, output=
2 Context - memory=, knowledge=, context=
3 Harness - tools=, MCP(), approval=
4 Loop - execution=ExecutionConfig(...), reflection=, autonomy=
5 Graph - AgentFlow + route()/parallel()/repeat()
+ Managed Agents - remote sandbox or fully hosted loop
Includes a concentric-ring diagram (each layer wraps the one inside it),
a summary table, and a short runnable example per layer. Every snippet
was executed against the local source, not just constructed.
Also corrects API claims elsewhere in the README that raise TypeError on
copy-paste, since Agent.__init__ takes no **kwargs:
handoff= -> handoffs=[other_agent]
web_search= -> web=
prompt_caching= -> caching=
thinking_budget= -> agent.thinking_budget (property, not a kwarg)
db=/session_id= -> memory={"db": ..., "session_id": ...}
user_id= -> memory={"user_id": ...}
No existing content removed.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Use a non-blocking lock so commit() and cancel() are mutually exclusive,
preventing an unauthorized final mutation from starting after the deadline
while still never blocking cancellation on backend I/O (keeps #3924 fixed).
Add guard-level regression tests for both properties.
Co-authored-by: Mervin Praison <[email protected]>
Only accept supported auth modes (api-key, jwt) when binding to a
non-localhost interface, preventing a misspelled/unsupported mode from
exposing an unauthenticated recipe server.
Co-authored-by: Mervin Praison <[email protected]>
DeliveryRouter.react read adapter.platform_capabilities.reactions, but
PlatformCapabilities has no such field — real adapters advertise reaction
support via capabilities["reactions"] (matching _status.py). The old gate
always defaulted to False, so every Telegram/Slack/Discord reaction call
degraded to "unsupported" and never dispatched. Align the gate (and the
masking test fixture + docstrings) with the real capabilities contract.
Co-authored-by: Mervin Praison <[email protected]>
- Add "signal" to the gateway's tokenless platform set (from_config_file
_tokenless) and the is_email_platform exemptions in start_channels /
_start_single_channel, so a documented token-free Signal channel starts
instead of failing with a missing-token ValueError (greptile P1).
- Rename SignalBot's session manager attribute from _session_mgr to _session
so the gateway routing handler stages per-route tool policies on it
(Issue #2298), matching every other adapter (slack/discord/agentmail).
Previously routed Signal turns ran without their route's tool restrictions
(greptile P1 / Security).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Close the incomplete outbound contract where PlatformCapabilities.reactions
was advertised but unreachable by agents. Add a typed ReactionResult plus a
react() method to core OutboundMessengerProtocol, and react/unreact actions to
the built-in send_message tool (emoji passed as message, reusing the existing
send-policy guard). The wrapper's BotOutboundMessenger/DeliveryRouter dispatch
to each adapter's existing add_reaction/remove_reaction, capability-gated so
unsupported channels degrade to a typed {"status":"unsupported"} outcome. The
inbound message_id is carried on SessionSource so react("origin", ...) targets
the message being handled without a new tool param.
Co-authored-by: MervinPraison <[email protected]>
Ship first-class Signal (end-to-end-encrypted) coverage through the existing
channel registration seam. The adapter uses the linked-device / bridge model
(signal-cli-rest-api over HTTP) — the same connection style as the WhatsApp
Web adapter — so it inherits outbox/DLQ, retry, sessions, commands, and hooks
from the shared mixins with no new architecture.
- Wrapper-only: praisonai_bot.bots.signal.SignalBot (aiohttp lazy-imported)
- Registered in _BUILTIN_PLATFORMS with a ChannelDescriptor (config keys +
prompt hint) and honest PlatformCapabilities (typing yes, live_edit no)
- channels.signal.account/bridge_url wired via _EXTRA_ENV_MAP; SignalBot export
- Core protocol unchanged
Co-authored-by: MervinPraison <[email protected]>
Sessionless (pre-hello/join) connections could never be reaped because the
liveness reaper defaulted a missing session's activity to now on every pass,
so the policy always returned KEEP and a half-open handshake retained its
socket/queue/scope/auth state forever (Greptile P1).
Track a per-connection _client_last_seen wall-clock: seeded at registration,
refreshed on every inbound frame, dropped on teardown/reap, and used as the
liveness fallback when no session is bound. Adds 4 tests covering seeding,
sessionless reap, inbound refresh, and teardown cleanup.
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile P1: _reconnect closed the old client but left it assigned
to _client during the backoff window, so concurrent writes bypassed
dropped_writes accounting (calling a closed client) and gateway status kept
reporting redis_connected=true throughout the outage.
- redis_pubsub.py: null _client/_pubsub the moment the listener detects a drop
(before marking degraded), so writes hit the disconnected guard and are
counted, and status reflects the outage.
- server.py: redis_connected now also requires not is_degraded.
- tests: add outage-bookkeeping test asserting writes are counted and client
is cleared during the reconnect window; update recover test for cleared handles.
Co-authored-by: Mervin Praison <[email protected]>
Add PollingConfig.max_queue_size (default 1000) and apply it when creating
each polling client's queue in PollManager.register_client. This makes the
QueueFull -> durable-store overflow path reachable in production instead of
only via manual test override, closing the Greptile P1 finding. Setting
max_queue_size=0 preserves the legacy unbounded behaviour.
Co-authored-by: Mervin Praison <[email protected]>
Consume the already-merged core LivenessPolicy contract (#2799) at runtime:
- server: _liveness_loop emits PING at the policy interval and reaps
half-open sessions whose last_activity exceeds the window, closing them
with LIVENESS_TIMEOUT and releasing session/client state; PONG/PING
handled; last_activity stamped on every inbound frame; reaped count and
liveness state surfaced in health(); heartbeat_ms advertised from the
liveness interval so client and server agree.
- client: _heartbeat_loop sends PING on the advertised cadence and
force-reconnects (reusing backoff/resume) after ~2x silence; replies to
server PING with PONG.
- liveness is enabled out-of-box (server task present) while remaining
backward-compatible: an explicit interval_ms=0 opt-out stays inert.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The gateway HA fan-out adapter (RedisPubSubAdapter) previously looped forever
against a stale pub/sub handle on connection loss — silently dropping
cross-instance delivery while status/doctor reported healthy. Now the listener
reconnects with bounded backoff, re-subscribes all channels, records itself as
a degraded owner in DegradedCapabilityRegistry (route:redis-pubsub) with a
redacted reason + actionable retry_hint, and clears it on recovery. Publish and
presence no-ops while disconnected are counted and surfaced in gateway status.
Co-authored-by: Mervin Praison <[email protected]>
Route PollManager overflow through the existing DeliveryGuaranteeManager so
long-poll clients share the durable at-least-once store used by WebSocket:
- enqueue_for_client persists on QueueFull instead of a silent drop
- poll_messages replays durably-pending events (restart/backpressure)
- ack endpoint no longer reports ok=True without a delivery manager
Co-authored-by: Mervin Praison <[email protected]>
Greptile P2: close() nulled _timeout_executor but left _leaked_workers
stale, so a restarted scheduler recycled its fresh pool on first use.
Reset the counter with the pool.
Co-authored-by: Mervin Praison <[email protected]>
- AgentScheduler.stop() no longer self-joins from its own thread; the
budget brake now only sets the stop event and teardown runs in a
finally block, so is_running is cleared and the timeout pool is closed.
- Profiler memory()/memory_snapshot() now reference-count the process-wide
tracemalloc toggle under a lock so concurrent scopes stop returning (0,0).
- Scheduler timeout pool size and leak threshold are now distinct: recycle
once half the workers have leaked, matching AgentsGenerator.
Co-authored-by: MervinPraison <[email protected]>
Addresses two P1 regressions raised in review of #3908:
1. String guardrails no longer fire a synchronous input-validation LLM call
on every chat()/achat(). A string guardrail becomes an LLMGuardrail which
also exposes validate_input via GuardrailProtocol; the input gate wrongly
invoked it (hot-path perf regression + blocking the async event loop).
The string-derived LLMGuardrail is now marked output-only and skipped by
_validate_input_with_guardrail. Explicit GuardrailChain/GuardrailProtocol
objects remain the only deliberate input surface.
2. The no-running-loop managed-stream bridge no longer leaks its producer
thread. The producer is now a daemon thread with a cancel Event, a bounded
queue (back-pressure), and a finally block that signals cancellation and
joins on early generator close/GC.
Co-authored-by: Mervin Praison <[email protected]>
- Wire GuardrailChain/GuardrailProtocol.validate_input into chat()/achat()
so input-side guardrails actually run before the LLM call (no-op for
plain callable/string guardrails; fails closed on error).
- Fire BEFORE_LLM/AFTER_LLM hooks on the async _execute_unified_achat_completion
path for parity with sync _chat_completion, so hook features like
enable_pii_redaction() apply to achat()/async workflows too.
- Stream managed-backend chunks incrementally in the no-running-loop path
via a bridging queue/thread instead of buffering the whole response,
mirroring the running-loop branch.
Co-authored-by: MervinPraison <[email protected]>
Adds load_gateway_config integration coverage for the #3050 validation
path and documents load-time gateway block checks in the example.
Supersedes #3060; core fix landed in #3079.
Co-authored-by: botbikamordehai2-sketch <[email protected]>
ExecutionConfig and MemoryConfig live in praisonaiagents.config.feature_configs,
not the non-existent config.execution / config.memory modules. The prior paths
raised ModuleNotFoundError on the deprecated allow_code_execution / auto_save
conversion path.
Co-authored-by: MervinPraison <[email protected]>
Removes the unreferenced _get_registry() method and its backing
self._registry field from the tools CLI handler. The canonical
_get_resolver() path remains the single tool-resolution entry point.
Co-authored-by: MervinPraison <[email protected]>
- run the sync flush in a daemon thread so a timed-out worker never
blocks interpreter shutdown (Greptile P1)
- make preview_older_slice a safe superset covering token-budget-driven
removals (SLIDING / TRUNCATE second pass), not just preserve_recent, so
durable facts in budget-dropped messages are still offered to the flush
(Greptile P1)
- add coverage for daemon-thread timeout and budget-boundary preview
Co-authored-by: Mervin Praison <[email protected]>
- Gate workflow YAML runs so --resume/--session/--continue/--fork and
--output stream-json fail fast instead of being silently ignored, since
the native workflow path does not wire up session continuity or the
stream-json bridge.
- Record each import once in the default profiler even when multiple
ImportProfiler scopes overlap, preventing inflated global import counts.
- Add regression coverage for both fixes.
Co-authored-by: Mervin Praison <[email protected]>
Route the Discord/Slack/Telegram retry-command failure handlers through
failure_reply_text(e) so raw exception text is no longer exposed, and add a
safe generic fallback in _failure.py when the core renderer module is
unavailable (older praisonaiagents), so the error path never itself raises.
Co-authored-by: Mervin Praison <[email protected]>
Registering the novita backend without a corresponding _EXTRA_HINTS
entry made an unavailable backend recommend only `pip install
praisonai-sandbox`, which does not install novita-sandbox. Now it
correctly suggests `pip install praisonai-sandbox[novita]`.
Co-authored-by: Mervin Praison <[email protected]>
Registers NovitaSandbox in the same lazy-loaded registry pattern used
by the existing E2B/Daytona/Modal backends, following the E2B/Daytona
implementation shape (async lifecycle, NOVITA_API_KEY env var,
optional novita-sandbox dependency extra).
Close SSRF gap where compare_extraction fetched via newspaper3k and
requests.get without _validate_url, unlike the trafilatura path.
Co-authored-by: Mervin Praison <[email protected]>
- Reject non-phone/non-lid alternate domains in learn(); use exact
domain matching instead of substring so group/broadcast/hostile
JIDs are never learned and @lid-extra is never canonicalized.
- Canonicalize the Chat JID for the self-chat comparison so an
LID-addressed self-chat is not mistaken for an outgoing message
and silently dropped. Raw chat_jid retained for reply routing.
- Add regression tests for invalid domains, malformed LID suffix,
and lid-to-lid pairing rejection.
Co-authored-by: Mervin Praison <[email protected]>
WhatsApp addresses the same person with two interchangeable JID forms — the
privacy LID (<lid>@lid) and the phone JID (<phone>@s.whatsapp.net). The web
bridge could surface either for the same user, and the adapter propagated the
raw form straight through as user_id, splitting one person into two principals:
divergent session/memory, a broken DM allowlist match (authorised user silently
dropped) and spurious re-pairing.
- Core: add dependency-free IdentityCanonicalizerProtocol contract in
gateway/protocols.py (exported from praisonaiagents.gateway).
- Adapter: WhatsAppIdentityCanonicalizer learns the LID<->phone mapping from
whatsmeow's SenderAlt alternate-JID field and reconciles toward the phone
form BEFORE the allowlist/session/memory/pairing keys are derived. Fail-open:
unknown addresses are returned unchanged, so behaviour is never worse than
today and no canonicalizer registration is required.
Co-authored-by: MervinPraison <[email protected]>
recover_orphans() terminalises in-flight runs to LOST and never re-scans
them, but the recovery notice went through DeliveryRouter whose dedup is a
per-process LRU. A boot-time send to a not-yet-ready channel returned False
and the one notice owed to the user was lost for good.
Route the notice through the durable SQLite scheduled_outbox (the same path
scheduled results use) under a stable run-recovery:{run_id} key before
delivery, so a boot-time miss leaves a pending row that drains on the next
boot. Falls back to the best-effort restart-notice path when no durable
outbox/router is available. Wrapper-only, no core change, no new deps.
Co-authored-by: Mervin Praison <[email protected]>
praisonai-code is an OPTIONAL dependency of praisonai-bot, but the gateway
config resolver routed ~/.praisonai/bot.yaml discovery exclusively through
praisonai_code.cli._paths and swallowed the ImportError, so a lean install
with an onboarded home config fell through to only ./gateway.yaml and
gateway start exited 78 despite the config existing (Greptile P1).
Inline the equivalent cwd bot.yaml -> PRAISONAI_BOT_CONFIG /
~/.praisonai/bot.yaml (PRAISONAI_HOME-aware) fallback so home discovery works
without praisonai-code, keeping the praisonai-code resolver as the preferred
path. Adds two regression tests exercising the missing-praisonai-code branch.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Cancellation while a task waited for a concurrency slot raised
CancelledError from the semaphore acquisition, which sat outside the
try/except — so on_complete never fired for that path. Move the
`async with semaphore` inside the try so every terminal outcome
(success, failure, timeout, active + queued cancellation) routes
through _safe_on_complete.
Co-authored-by: Mervin Praison <[email protected]>
On gateway boot, drive recovery from the durable run ledger: call
SQLiteRunLedger.recover_orphans() to reconcile runs a crashed process
left in flight to LOST with a terminal outcome, then re-notify each
run's origin channel/thread through the existing durable, exactly-once
delivery path. An interrupted run now ends in a recorded outcome and a
visible user-facing message instead of silence.
Best-effort and default-safe: a no-op when core lacks the ledger or no
ledger.db exists yet, so gateways that never used it are unaffected.
Co-authored-by: MervinPraison <[email protected]>
gateway start now auto-discovers the onboarded config (./bot.yaml ->
~/.praisonai/bot.yaml, gateway.yaml alias) instead of silently starting
channel-less, and validates/forward-migrates config_version the same way
doctor does before binding. doctor/test/status/send/channels resolve the
same canonical path so onboard/start/doctor cannot drift apart.
Co-authored-by: MervinPraison <[email protected]>
Every terminal branch (success, failure, timeout, cancellation) now
invokes on_complete via a shared _safe_on_complete helper, matching the
BackgroundJobManager contract so gateway/proactive runs always deliver a
visible outcome to the origin. Cancellation still re-raises for
cooperative shutdown, but only after notifying.
Co-authored-by: MervinPraison <[email protected]>
The default timeout feature added a top-level `import os` to llm/registry.py,
which broke test_registry_only_imports_typing (asserts top-level imports stay
within stdlib typing/threading). Move the import inside default_llm_timeout()
as a lazy import — the isolation test explicitly permits lazy imports in call
paths. Env-var timeout behavior is unchanged.
Co-authored-by: Mervin Praison <[email protected]>
Greptile P1: loose model=/session= kwargs were merged only into cli_config,
which the generator's allow-list ignores (model comes from config_list[0],
session from resume_session). Now model=/llm= writes onto config_list like
--llm, and session maps to resume_session; docstrings corrected.
Co-authored-by: Mervin Praison <[email protected]>
- llm/registry.py, llm/gateways.py: seed default timeout (60s, tunable via
PRAISONAI_LLM_TIMEOUT) + bounded num_retries on every LiteLLM call so an
unresponsive provider can't pin a coroutine/worker forever. Caller override wins.
- api/call.py: resolve realtime WebSocket URL/model/key via env overrides
(PRAISONAI_REALTIME_URL/MODEL/API_KEY) instead of a hardcoded OpenAI literal,
and add open/ping/close timeouts + frame cap so a dead upstream can't hold a
Twilio media leg indefinitely. OpenAI defaults preserved for back-compat.
- _entrypoint.py: run()/arun() accept **kwargs forwarded through cli_config,
giving Python callers the CLI's advanced-option pass-through without a new surface.
Co-authored-by: Mervin Praison <[email protected]>
- execute_tool_async now back-fills result_hash via record_tool_outcome on
both the hooked and fast-path returns, so async no-progress/poll-loop
detection accumulates a streak (sync parity).
- achat() applies the configured rate limiter and cancellation token before
delegating to a managed backend, so backend requests honour throttling and
cooperative cancellation instead of bypassing both guards.
- Knowledge.index() retains memory IDs whose deletion failed so a later
re-index retries their cleanup instead of orphaning stale chunks.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- async _achat_impl now acquires the rate limiter (acquire_async), matching
the sync path so async bursts are throttled
- execute_tool_async runs the same tool-loop detection as the sync path
- achat() delegates to a configured managed backend via _adelegate_to_backend
(covers arun/astart, which route through achat)
- GuardrailChain.__call__ makes Agent(guardrails=chain) actually validate output
- Knowledge.index() tracks per-file memory IDs and deletes stale chunks before
re-adding a changed file during incremental indexing
Co-authored-by: Mervin Praison <[email protected]>
_validate_url only inspected IP literals, so a plain domain or an encoded
form (a decimal IP, or "<internal-ip>.nip.io") passed even though it
resolves to an internal address, defeating the SSRF guard. Resolve the
hostname and reject any private, loopback, reserved or link-local address,
matching praisonaiagents/tools/file_tools.py.
Lazy-load A2AClient via package __getattr__ so server-only A2A usage no
longer pulls in aiohttp at import time. Public surface unchanged:
A2AClient remains importable and listed in __all__.
Co-authored-by: MervinPraison <[email protected]>
Undo the earlier fork-workflow revert now that the push has workflow scope, so
the branch's workflows match main again — this removes the 7 stray workflow
files from the PR diff and drops main's pypi-release.yml (a GitGuardian false
positive) back out of our changes.
The wrapper-free `code` fallback (`_run_resident_code`) had three defects
flagged by reviewers on PR #3818:
- NameError: it referenced an undefined `compact` local, crashing every
standalone `code` invocation before the TUI could start.
- --plan was silently dropped: the resolved read-only PLAN backend was
never registered, so mutating tools (write/edit/shell) stayed enabled.
- --no-acp/--no-lsp were ignored: the flags never reached the TUI, which
hardcoded ACP+LSP tool loading and runtime startup.
Fix by registering the resolved approval backend on the global registry
(same pattern `chat` uses; the TUI syncs its PLAN state from it) and
threading plan/no-acp/no-lsp onto AsyncTUIConfig via new enable_acp/
enable_lsp fields (default True, backward compatible). _load_tools and
_start_runtime now honor those fields.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Relocate the async split-pane TUI (async_tui.py) and InteractiveCore
(core.py) from the praisonai wrapper into praisonai-code so
`pip install praisonai-code` alone yields a full interactive chat/code
session with no wrapper required.
- Move async_tui.py + core.py impls into praisonai_code.cli.interactive;
leave identity-preserving back-compat shims at the old praisonai paths
(plus config/events shims so isinstance/monkeypatch hold across paths).
- Drop the hard-fail in chat.py; route interactive chat to the resident
AsyncTUI. Route interactive code to a resident AsyncTUI path
(_run_resident_code) when the wrapper is absent, keeping the richer
legacy dispatch when it is installed.
- Convert lazy wrapper-only imports (_async_bridge, integration.context_files)
to _wrapper_bridge with graceful fallback so no `praisonai` import
remains in the interactive package.
- Extend scripts/check_c7_imports.sh to gate interactive async_tui/core
at module load; C7 gate now reports 0 wrapper import lines.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
The warm runtime is a separate process that never receives the CLI's
PRAISONAI_APPEND_SYSTEM_PROMPT export and reuses a cached agent, so an
eligible `run` that forwarded to the daemon silently dropped the appended
suffix. Exclude the warm-runtime fast path when the suffix is set so the
in-process path (which applies it) is used, mirroring the existing
thinking_budget/isolated/instructions gates.
Adds regression tests: append-suffix runs never attach warm; ordinary
no-save runs still do.
Fixes Greptile P1 review on #3743.
Co-authored-by: Mervin Praison <[email protected]>
Adds a per-invocation --append-system-prompt flag to the code, chat and run
commands. The flag accepts literal text or an @file reference and falls back
to the PRAISONAI_APPEND_SYSTEM_PROMPT env var for CI.
Kept lightweight: no new Agent constructor param. The CLI exports the resolved
value via the env var and the core Agent appends it at the END of the assembled
system prompt (both the __init__ prompt and the chat _build_system_prompt path),
preserving the prompt-cache prefix (#2993) and never persisting to agent files.
Co-authored-by: MervinPraison <[email protected]>
Greptile P1: the instance-wide _draining flag turned every concurrent
failed-reply enqueue into a no-op during boot recovery, silently dropping
genuinely-new obligations and violating the durable-outbound contract.
Replace the boolean drain guard with a per-entry signature match so only the
nested re-park of the exact reply currently being redelivered is suppressed;
any other concurrent failure is still persisted. Also add the missing
typing.Any import (would NameError under get_type_hints).
Co-authored-by: Mervin Praison <[email protected]>
The reply path is already durable-by-default (permanent/exhausted sends are
parked in a canonical per-platform OutboundDLQ), but its crash-recovery had no
boot caller — the missing counterpart to the inbound journal's
_replay_inbound_journal sweep. A parked reply sat until an operator manually
replayed it.
- OutboundDLQ.redeliver(send): drains parked replies oldest-first through a raw
send, keeping + re-attempting on failure, with a _draining guard so a
re-failed send never double-parks.
- WebSocketGateway._replay_outbound_dlq(bot): outbound counterpart to
_replay_inbound_journal; redelivers via the adapter's own send_message with a
visible "recovered — may be a duplicate" marker, scheduled after the channel's
transport connects, on full boot and hot-reload.
Minimal and safe-by-default: no new params/modules/exports, nothing added to
core, success path unchanged.
Co-authored-by: MervinPraison <[email protected]>
The replay-safety gate only ran inside the overloaded/idle_timeout
branch of resolve_failover_decision. Post-dispatch failures whose
messages lack a timeout/overloaded/5xx substring (bare connection
reset, remote protocol error, incomplete/chunked read) classify as
"unknown" and were retried without the gate, risking double-execution
of side-effecting tool turns. Move the gate ahead of all retry
branches so any post-dispatch failure on a tool turn surfaces
provider_outcome_unknown instead of replaying.
Co-authored-by: Mervin Praison <[email protected]>
Post-dispatch transient failures (read timeout, connection reset
mid-response) may mean the provider already produced output and already
ran side-effecting tool calls in that turn. Blindly replaying such a
failure on a tool-calling turn can double-execute the turn.
Adds is_replay_unsafe() to error_classifier.py to distinguish
pre-dispatch failures (DNS/connect/TLS — safe to replay) from
post-dispatch failures (read timeout / connection reset — replay-unsafe),
and gates resolve_failover_decision so a post-dispatch failure on a
side-effecting turn (one exposing tools) surfaces a typed
'provider_outcome_unknown' outcome instead of silently retrying.
Default-safe and additive: tool-less turns and pre-dispatch failures
retry exactly as before; no new user-facing config surface.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer P1 findings on the coherent undo/revert path:
- Interactive /undo /revert now rewind the reused warm Agent's own
chat_history in lockstep with the auxiliary conversation view, matched
by user-message count so interleaved system/tool messages don't skew the
boundary. Applies to both the modern REPL and the default AsyncTUI, which
each cache and reuse a single Agent across turns.
- praisonai run --revert rewinds a named session's conversation by real
user-turn boundaries instead of a fixed 2*n assumption, so turns that
persisted tool/system/assistant messages no longer strand orphaned
messages or drop an unrelated earlier turn.
- Make run --revert honest that file checkpoints are workspace-wide and may
not correspond exactly to a named session; point users to interactive
/undo for fully per-session coherence.
- Add unit coverage for agent chat_history rewind (with interleaved tool
messages), clear-to-preamble, and best-effort no-agent safety.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing SessionCheckpointManager into the modern/default CLI
surfaces so /undo and /revert roll back files + conversation together,
and reconcile the split checkpoints.auto default.
- session_checkpoints: add a `default` param to from_config so one
checkpoints.auto key drives both file checkpoints and coherent revert
(interactive surfaces pass default=True; programmatic default stays False).
- modern repl.py: register /undo + /revert, checkpoint each turn, and rewind
the in-memory conversation via a thin store adapter.
- default AsyncTUI: register /undo + /revert and checkpoint file-mutating turns.
- run.py: add --revert (files + conversation) distinct from file-only --restore.
- tests: assert /undo restores both file and conversation on the default path.
Co-authored-by: MervinPraison <[email protected]>
- db/adapter.py: sync on_agent_start now passes an async-safe create_session
dispatcher so an async-mode store actually persists a new session instead of
dropping an un-awaited coroutine (Greptile P1).
- db/adapter.py: aon_agent_start/aon_agent_end now share the agent:{session_id}
state key and the end transition updates the started record in place, keeping
agent_name/metadata context instead of writing a disconnected record
(Greptile P2).
- api/agent_invoke.py: AgentRegistry.unregister uses a sentinel so a removal is
reported correctly even when the stored value is None/falsy (Greptile P2).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- api/agent_invoke.py: introduce thread-safe AgentRegistry (atomic pop
removes unregister TOCTOU 500) with optional per-embedding scoping via
a `registry=` kwarg; public functions stay backward-compatible.
- observability/hooks.py: memoize discover_observability_sinks() so the
importlib.metadata entry-point walk no longer runs on every run/request;
add reset_observability_sink_discovery() escape hatch.
- db/adapter.py: align PraisonAIDB.aon_agent_start/aon_agent_end with the
AsyncDbAdapter protocol (correct arg names/order, persist user_id instead
of dropping it); guard the sync on_agent_start against async-mode-store
coroutines via _resolve_sync to avoid the opaque 'coroutine not iterable'
crash.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer findings on PR #3855:
- json.dumps guards now catch (TypeError, ValueError) so circular tool
results are stringified instead of aborting the sync tool loop (llm.py x2,
openai_client.py x2).
- _build_metadata_filter overwrites any conflicting metadata_filter["user_id"]
with the explicit user_id, preventing cross-tenant memory reads.
- Short/long-term memory searches over-fetch (limit*10) from mem0, MongoDB,
ChromaDB, and SQLite when a metadata_filter is present, then post-filter and
truncate to limit, so scoped records ranked beyond limit are not dropped.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- llm.py/openai_client.py: capture tool failures and non-JSON-serializable
results into an error/result payload fed back to the model instead of
raising out of get_response(), matching the async execution_mixin path.
- hooks/runner.py: a hook that raises or times out now yields an explicit
deny (fail-closed) so BEFORE_TOOL security gates block instead of
silently allowing the call.
- memory/memory.py: search_short_term/search_long_term now accept and apply
metadata_filter/user_id scoping instead of silently dropping them into
**kwargs, restoring the SearchMixin contract for multi-tenant isolation.
Co-authored-by: MervinPraison <[email protected]>
The upstream merge pulled in .github/workflows changes that aren't part of this
feature; revert them to the fork's versions so the push doesn't require the
workflow OAuth scope. Main's workflows win at merge time and are what run for
the PR anyway.
Align the integration-test skip guard with the credential resolution added in
d2fa4df8 — otherwise the tests skip even when only TENKI_AUTH_TOKEN is set.
(Greptile follow-up)
- managed_local.provision_compute() now forwards `networking` and `metadata`
into ComputeConfig. Without this they were dropped, so Tenki's allow_outbound
/ tenki_image (the first provider to read them) always saw defaults regardless
of the caller's request. (Greptile: 'networking policy is dropped')
- TenkiCompute credential resolution now matches the SDK's precedence
(auth_token -> TENKI_AUTH_TOKEN -> TENKI_API_KEY), so is_available agrees with
what Client() resolves; docstring + is_available test updated. (CodeRabbit)
- networking: allow_outbound now keys off the real enum — only 'unrestricted'
gets outbound; 'limited' (also used for --no-networking) disables it. The old
check compared against a nonexistent 'restricted' value, so outbound was never
actually disabled.
- get_status/list_instances: a refresh() *exception* is now treated as unknown
(assume running) rather than STOPPED, so a transient outage no longer hides a
live, still-billing sandbox. A successful refresh with a non-RUNNING state
still reports stopped.
- failed-install teardown: terminate() before dropping the local handle, so a
failed terminate keeps the sandbox tracked instead of leaking it (matches the
shutdown path).
- don't log raw pip/npm specs (can carry private-index URLs/tokens); log counts.
Remove two unreferenced pure helpers (json_type_to_python_type,
extract_schema_properties) that have no callers, are not in __all__,
and have no test coverage. Also drop the now-unused Optional import.
Live helpers (fix_array_schemas, build_openai_tool_dict,
python_type_to_json_schema, ThreadLocalEventLoop) are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Lift the multimodal tool-result wrapper into a single module-level helper
try_append_multimodal_tool_result in agent/tool_execution.py, next to its
canonical build_tool_result_message_pair. openai_client.py imports it directly
under the same private alias; the LLM method now delegates to it, preserving its
signature for any external subclass override. No behaviour change.
Co-authored-by: MervinPraison <[email protected]>
Replace the duplicated public-callable extraction walk in the legacy
recipe/workflow tools.py path with the canonical owner in
praisonai_code.tool_resolver. Adds extract_functions_from_loaded_module
(single authority over the walk) and reuses it from both
ToolResolver.load_functions_from_module and workflow_commands, preserving
the PRAISONAI_ALLOW_LOCAL_TOOLS gate, safe-loader, own-module-origin
filter, and "Loaded N tools" notice.
Co-authored-by: MervinPraison <[email protected]>
- GateResult.__post_init__ forces run=False when no_change is set so a
silent-suppress outcome can never let a runner fire a suppressed tick.
- ScheduleJob.to_dict persists monitor when not None (incl. {}) so an
explicitly configured empty spec round-trips instead of reverting to
stateless.
- Document caller contract: detect state capability before passing
state= so legacy stateless gates never raise TypeError.
Co-authored-by: Mervin Praison <[email protected]>
Extend the core scheduler contract so change-detection monitor
automations can be expressed across CLI + YAML + Python, keeping heavy
implementation (shell/URL probe, hashing, diffing, persistence) in the
wrapper. Additive and backward-compatible: jobs that set neither
`monitor` nor per-job state behave exactly as today.
- GateResult: add `no_change` (distinct silent-suppress outcome) and
`state_updates` (bounded KV a gate persists for the next tick).
- JobConditionProtocol.should_run: optional keyword-only `state` so a
stateful monitor gate can compare against prior state; existing
stateless gates satisfy the protocol unchanged.
- New JobStateStoreProtocol: bounded per-job get/set/clear scratchpad.
- RunRecord.status: add `no_change` alongside succeeded/failed/skipped.
- ScheduleJob: add optional `monitor` source spec with round-trip.
Co-authored-by: Mervin Praison <[email protected]>
- Core: FleetSupervisionPolicy no longer records events while cooling down and
clears its event window when the cooldown elapses, so the breaker re-arms
without an external reset() and held (non-)restarts cannot re-trip it.
- Monitor: evaluate the failing-channel fraction on every sweep (note_fleet_state
now has a live caller) and re-evaluate/clear the breaker inside the monitor
loop, so the degraded-owner fact clears without a status read.
- Monitor: a disabled per-channel restart budget (max_restarts_per_hour=0) no
longer counts idle channels as failing.
- Tests: fix CI regression in test_gateway_health_block_matches_runtime_consumer
(new fleet keys are genuinely consumed by from_dict), add monitor-loop cooldown
recovery coverage, tighten failing-fraction assertion, correct misleading comment.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #3842:
- core: migrate_config_with_doctor now rejects a config stamped by a newer
build (version > GATEWAY_CONFIG_VERSION) and a malformed/boolean stamp via
new ConfigVersionError, so an older binary can never downgrade a newer
config or coerce config_version: true to 1. Exported from gateway package.
- wrapper: doctor guards the migration import (ImportError-safe for older core),
surfaces the version error as a warning without migrating, and rewrites
gateway.yaml atomically (tmpfile + fsync + os.replace) so an interrupted
--fix can't truncate the config. --fix help/docs document config migration.
- tests: newer-version rejection, boolean/non-integer stamp rejection, export.
Co-authored-by: Mervin Praison <[email protected]>
Per-channel restart budgets are blind to a systemic fault that restarts
every channel at once. Add a pure core FleetSupervisionPolicy breaker
(praisonaiagents/gateway) enforced by the wrapper ChannelHealthMonitor,
which holds restarts and records ONE gateway degraded-owner fact on the
shared DegradedCapabilityRegistry when the fleet thrashes. Wire the
gateway's shared registry into the single supervision owner and expose
gateway.health.fleet_* YAML thresholds.
Co-authored-by: MervinPraison <[email protected]>
Add a canonical GATEWAY_CONFIG_VERSION stamp and a declarative
LegacyConfigRule contract in core (praisonaiagents/gateway/config.py) with a
single migrate_config_with_doctor executor. Wire `gateway doctor` to detect an
out-of-date config and `--fix` to migrate it forward once and stamp the new
version, so cross-release upgrades no longer silently drift.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer feedback on PR #3839:
- When litellm is installed but a capability helper is missing or raises,
preserve litellm as authoritative (return False) instead of overriding
with the static heuristic. Heuristics now run only when litellm is
genuinely absent (litellm is None), preventing unsupported params
(response_format / web_search_options) from reaching provider requests.
- supports_parallel_function_calling now uses a dedicated, narrower
heuristic instead of the general function-calling one, so serial-only
tool-calling families are not over-reported as supporting parallel calls.
- Add tests for installed-litellm error path and serial-vs-parallel.
Co-authored-by: Mervin Praison <[email protected]>
Capability helpers (supports_structured_outputs / function_calling /
parallel_function_calling / web_search / prompt_caching) delegated entirely
to litellm and returned False for every model when litellm was absent,
silently disabling structured-output / tool-calling / caching / web paths on
lean provider-native installs. Each helper now falls back to a small,
conservative, pattern-based static heuristic only when litellm is
unavailable. litellm remains authoritative when installed (no behaviour
change for existing deployments); no new deps, no network, no config knobs.
Co-authored-by: MervinPraison <[email protected]>
The before-tool injection hook allowed a tool call whenever no scanned
string matched. Because _extract_strings bounded the walk by bytes /
cardinality and returned a partial result, an attacker controlling
tool_input could pad benign strings ahead of an injection payload so the
payload was never reached, and the gate allowed the call (Greptile P1).
_extract_strings_bounded now reports whether the walk was truncated, and
create_hook blocks (fail-closed) on truncated, un-vettable input instead
of allowing it. _extract_strings is kept as a back-compat shim.
Co-authored-by: Mervin Praison <[email protected]>
- security/injection.py: _extract_strings walks iteratively bounded by bytes+
cardinality instead of a depth-4 cutoff, scans dict keys, and is cycle-safe so
nested tool inputs can no longer bypass the scanner.
- db/adapter.py: share one _serialize_tool_call helper across sync/async paths
that persists the full tool result verbatim (no silent [:1000] truncation).
- persistence/orchestrator.py: add aretrieve_knowledge/aadd_knowledge that
offload sync stores via asyncio.to_thread (and await native async stores) so
RAG no longer blocks the event loop.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: add shared require_scope() in knowledge/protocols.py and enforce it in
ChromaKnowledgeAdapter.delete_all and SQLiteKnowledgeAdapter.delete_all so an
unscoped delete_all raises ScopeRequiredError instead of wiping the whole
shared store, matching mem0's existing contract.
Gap 2: add MemoryMixin._apersist_message async wrapper that offloads
_persist_message to a worker thread, and await it at every _achat_impl call
site so file-locked disk I/O no longer blocks the event loop each turn (sync
_chat_impl and the sync _start_stream generator keep the sync call).
Gap 3: skip VAR_POSITIONAL/VAR_KEYWORD in build_parameters_schema so *args and
**kwargs are no longer emitted as required parameters, matching
build_tool_definition and preventing invalid schemas / tool-call TypeErrors.
Co-authored-by: Mervin Praison <[email protected]>
The step retry exponential-backoff + progress-print block was duplicated
byte-for-byte between the top-level _run_impl loop and the shared
_apply_step_policies helper. Extract it into a single private
_retry_backoff() used by both paths. Behaviour is unchanged: same
2**(retry_count-1) timing, same verbose print, same time.sleep. All
retryability, guardrail, on_step_error and guardrail_failed semantics are
preserved.
Co-authored-by: MervinPraison <[email protected]>
Wrapper BaseFrameworkAdapter._resolve_llm now delegates the spec->model-name
precedence to core's super()._resolve_llm instead of re-implementing it, then
derives base_url/api_key locally to build the PraisonAIModel provider object.
Removes duplicate logic and drift risk. Behaviour-preserving.
Co-authored-by: MervinPraison <[email protected]>
Move the workflow_runs page implementation into praisonai_bot where its
consumer (host_app.py) expects it, following the established bot_health
C9 shim pattern. The wrapper module becomes a backward-compat shim.
Co-authored-by: MervinPraison <[email protected]>
- Use self._hook_runner (agent-scoped registry) instead of the process-wide
default so agent-registered MODEL_FALLBACK hooks actually fire.
- Add async _aemit_model_fallback that awaits the runner; the async recovery
path no longer drops hooks via execute_sync() inside a running loop.
- Sync fallback now forwards the active stream callback so streaming consumers
receive the MODEL_FALLBACK stream event.
- Async fallback honours emit_events (no stream leak when emit_events=False).
- Extract shared _build_model_fallback_input / _emit_model_fallback_stream.
- Tests: agent-registry isolation, async hook dispatch, suppression.
Co-authored-by: Mervin Praison <[email protected]>
When the primary model becomes unavailable mid-turn and the runtime switches to
the next entry in fallback_models, the switch was invisible except for a log
line. Add HookEvent.MODEL_FALLBACK (+ typed ModelFallbackInput) and
StreamEventType.MODEL_FALLBACK, emitted at both switch sites in chat_mixin.py
via a guarded _emit_model_fallback helper. Zero overhead when nothing is
subscribed; provider internals stay redacted (only the failure class is
exposed). Follows the existing SESSION_PERSIST_FAILED observability precedent.
Co-authored-by: MervinPraison <[email protected]>
Widen the plugin bridge so before_message/after_message receive the full
resolved context (platform, sender_id, channel_id, channel_type, message_id,
session_id) alongside content, enabling per-user rate limiting, access
control, and channel-scoped redaction. Add message_sent/message_undelivered
base methods bridged to the already-emitted MESSAGE_SENT/MESSAGE_UNDELIVERED
events for delivery observability. Additive and backward-compatible.
Co-authored-by: Mervin Praison <[email protected]>
asyncio.wait_for cannot cancel a sync tool already running in the executor,
so the async retry loop was re-invoking timed-out tools up to max_attempts
times while the original invocation kept running — duplicating DB writes,
API calls, and file mutations (Greptile P1).
Mark the async timeout result with retryable=False and short-circuit it in
_execute_tool_async_with_retry alongside the other non-retryable outcomes.
Co-authored-by: Mervin Praison <[email protected]>
- process=hierarchical: drive the ahierarchical()/hierarchical() generators
manually so the real manager_task id is sent back via .send()/.asend(),
restoring the self-delegation guard and manager-task exclusion (was always
None under plain for/async for).
- execute_tool_async: apply the per-agent ToolConfig.timeout via
asyncio.wait_for so the async path no longer hangs indefinitely on a stuck
tool, matching the sync path.
- guardrails: fail loud with a clear ValueError when unenforced policy-string
guardrails (guardrails=["policy:..."] or GuardrailConfig.policy/.policies)
are passed, instead of running with silent zero enforcement; fixed the
misleading GuardrailConfig docstring.
Co-authored-by: Mervin Praison <[email protected]>
Resolve the shared background runner once and inject it into
BackgroundHandler in _handle_tasks_command so a single /tasks
invocation uses one instance, and harden the test fixture to own the
process-wide singleton lifecycle (bypassing the package's lazy
__getattr__) so a cross-file daemon can't empty the dedicated runner.
Co-authored-by: Mervin Praison <[email protected]>
Address greptile P1 review findings on tools list MCP discovery:
- Naming mismatch: the run path registers MCP tools by their bare __name__
(e.g. `read`), but `tools list` previously fabricated `<server>_<tool>`
names that would not resolve. Discovery now lists tools under the exact
runtime callable name, with cross-server duplicates disambiguated as
`name (server)` so nothing is hidden.
- Timeout blocking: each server is now discovered in a worker thread under a
hard per-server cap (_MCP_DISCOVERY_TIMEOUT_S), so a slow/unreachable server
is abandoned and reported as unavailable instead of stalling the listing.
Updated + added unit tests (runtime names, duplicate disambiguation, timeout).
Co-authored-by: Mervin Praison <[email protected]>
Add an `mcp` source to `praisonai tools list` so the terminal shows the
tools exposed by configured MCP servers alongside built-in, local,
external, and registered tools. Discovery is lazy (only when the default
view or `--source mcp` is requested) and fail-soft: an unreachable or
misconfigured server is reported as unavailable with a reason instead of
blocking the rest of the listing. Reuses the existing guarded
`MCPHandler.create_mcp_from_server` and `_collect_mcp_servers_from_config`
so no new dependencies or Agent params are introduced.
Co-authored-by: MervinPraison <[email protected]>
The two failing CLI tests (test_tasks_detail_and_cancel,
test_tasks_lists_background_tasks_in_repl) are a pre-existing cross-worker
flake unrelated to this PR's todo-streaming changes: under
`pytest -n 2 --dist loadfile` a background daemon from another file mutates
the process-wide BackgroundRunner singleton mid-assertion, so the handler
resolves a different runner than the test pinned.
Add an optional `runner=` dependency-injection seam to
`_handle_tasks_command` (None in all production call sites, so behaviour is
unchanged) and have the tests inject their dedicated runner directly. This
bypasses global-singleton resolution entirely, making the assertions immune
to the race. Verified deterministic across 500 iterations under active
singleton chaos.
Co-authored-by: Mervin Praison <[email protected]>
The async tool-execution path (_execute_tool_async_impl) never entered
tool_progress_channel, so emit_todo_update / emit_tool_progress always
returned False during async single-Agent runs — live TODO_UPDATED events
were invisible to subscribers. Mirror the sync execute_tool path: build a
progress sink from the existing stream emitter and activate the channel
around both the coroutine await and the run_in_executor call (set before
copy_context_to_callable so the contextvar propagates into the worker
thread). Zero overhead when no stream callbacks are registered.
Adds regression tests covering the TODO_UPDATED event, TodoTools emission,
the single-in_progress invariant, and async-path channel propagation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Adds StreamEventType.TODO_UPDATED plus a small emit_todo_update() helper
that reuses the existing thread-local progress sink (already active around
every tool call). The built-in todo tool now publishes the full ordered
list on each add/update, so any frontend can render a live checklist.
Enforces the "exactly one in_progress" convention and consolidates the
planning TodoItem status vocabulary to include cancelled.
Co-authored-by: MervinPraison <[email protected]>
Per-request AgentsGenerators borrow the cached generator's tool-timeout
executor but previously kept leak accounting local, so a stuck sync tool
never incremented the owner's _leaked_workers and the shared pool was
never recycled — eventually starving all requests (Greptile P1).
Delegate _get_tool_timeout_executor/_note_leaked_worker/_timeout_owner_key
to the cached owner so leaks are counted on, and recycling happens on, the
generator that actually owns the pool.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- serve agents: build a per-request AgentsGenerator that borrows the cached
generator's warm immutable pieces (adapter, config_list, tool resolver,
tool-timeout pool) instead of mutating shared cli_config under a global
lock, so concurrent requests are no longer serialised.
- persistence: add scan_prefix() to StateStore with a prefix-scoped default;
override with non-blocking SCAN on Redis and Upstash so get_runs/get_traces
never issue KEYS praison:* across the whole keyspace.
- security: split strict jailbreak patterns (auto-HIGH) from soft role-play /
imperative patterns (MEDIUM alone, HIGH only when combined), so benign
prompts like "You are now analyzing..." are not blocked while real attacks
("ignore all previous instructions", DAN) still block on a single hit.
Co-authored-by: MervinPraison <[email protected]>
Pre-existing xdist race (unrelated to PR #3810's agent/knowledge changes):
under -n 2 --dist loadfile a persistent worker's process-wide background
runner could interleave with these tests, surfacing as "No background tasks"
and an uncancelled RUNNING task. Add an explicit xdist_group so the file's
tests stay serial on one worker, and reset the module-level _shared_runner on
fixture teardown so no dedicated instance leaks into a later module. Assertions
are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
cleanup_launch_registration filtered the shared FastAPI router by path
only, so closing an agent launched at a path that also serves a
different verb (e.g. built-in GET /health, GET /) removed that unrelated
route too. Filter on path AND POST method since launch() always
registers via .post(path).
Co-authored-by: Mervin Praison <[email protected]>
- Agent.close() now tears down the routes launch() actually registered
(module-level state in execution_mixin.py) instead of a disconnected,
never-populated ServerRegistry — closes the launched-endpoint handle leak.
- Remove dead Agent.checkpoints/Agent.background pass-through state and
properties that were never consumed by any code path (no live consumer),
keeping the surface lightweight.
- MongoDBKnowledgeAdapter.add/search now honor user_id/agent_id/run_id
scoping, matching SQLite/Chroma adapters, fixing the silent cross-tenant
data leak.
Co-authored-by: MervinPraison <[email protected]>
The /tasks CLI resolves the runner via ``from praisonaiagents.background
import get_background_runner``, which reads the name off the package (whose
__init__ exposes it through a lazy __getattr__), imported at call time by
BackgroundHandler._get_runner. The fixture only patched the ``runner``
submodule binding, so once another worker file materialised the package
attribute, the CLI bypassed the patch and resolved the process-wide shared
runner instead — letting a concurrent cross-file daemon race the two tests
under ``pytest -n 2 --dist loadfile`` (the observed "No background tasks"
and uncancelled RUNNING failures). Patch the name on the package too so the
CLI deterministically sees the dedicated per-test runner. Test-only; no
assertions weakened and no SDK behaviour changed.
Co-authored-by: Mervin Praison <[email protected]>
Move the byte-for-byte-identical _deliver_result and _build_delivery
methods from AgentScheduler and AsyncAgentScheduler up to the shared
_BaseAgentScheduler, mirroring the existing consolidation of
_should_suppress_delivery, _budget_exceeded and _build_stats. Removes
~55 lines of duplication and the drift risk on a safety-relevant
delivery path. No behaviour change: both methods are plain synchronous
methods referencing only attributes both subclasses set identically.
Co-authored-by: MervinPraison <[email protected]>
Addresses CodeRabbit & Greptile P1 review feedback on the YAML/prompt CLI
router (#3793):
- main() now classifies the first positional value-aware when flags are
present, so a leading value-taking run option (e.g. `--session abc123
agents.yaml`) consumes its value instead of mistaking it for the target.
Discovery is skipped on the flagless fast path and falls back conservatively
when introspection fails.
- Quarantine `-s`/`-f` (legacy `--save`/`--file` vs modern
`--session`/`--framework`) from the modern forwarders so existing YAML/prompt
invocations carrying them stay on legacy — zero silent reinterpretation.
Unambiguous long forms still reach the modern engine.
- Reuse the derived value_opts in the bare-prompt branch (no double
introspection).
Tests: added leading-value-option (YAML + prompt) regressions and
legacy-colliding-short-opt coverage for both classifiers.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Workflow YAML invocations (praisonai agents.yaml) were routed to the legacy
argparse path, bypassing the modern run features: session continuity
(--continue/--session/--fork), --output modes, the first-run credential gate
and permission flags. The modern `run` command already fully handles YAML
files inside that envelope; only the CLI router diverted YAML to legacy.
Add _looks_like_yaml_run_target() and forward a workflow YAML target to
`run <file>` when all flags are run-supported, restoring YAML parity with the
CLI/Python surfaces. YAML with a genuinely legacy-only flag still falls back to
legacy with the existing one-line notice.
Co-authored-by: MervinPraison <[email protected]>
The two failing CLI tests (test_tasks_detail_and_cancel,
test_tasks_lists_background_tasks_in_repl) are a pre-existing shared
BackgroundRunner singleton isolation flake, unrelated to this PR's
gateway-only changes. Port the already-authored isolation fixture that
pins a dedicated runner per test and monkeypatches get_background_runner
to return it, so no other file's daemon loop can reach the instance
_handle_tasks_command resolves. Assertions (list, detail, real CANCELLED
status) are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
The two test_interactive_tasks_command.py tests fail intermittently under CI's
pytest -n 2 --dist loadfile because the process-wide BackgroundRunner singleton
(and a live daemon loop another file left running on it) races these tests,
surfacing as "No background tasks" and an uncancelled RUNNING task. This is
unrelated to the scheduler-delivery changes in this PR.
The prior fix only reset _shared_runner, still sharing a process-wide object
other threads could touch. Instead, pin a dedicated BackgroundRunner per test
and monkeypatch get_background_runner to return exactly it, so no other file's
daemon can reach the instance _handle_tasks_command resolves. No assertions
weakened: list, detail, and the real CANCELLED status are all still verified.
Verified passing even with a pre-polluted singleton.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer findings on PR #3806:
- Greptile P1 (blocking): the pin no longer permanently mutates the shared
registry Agent. _check_model_drift now returns a run-scoped restore callable
applied in a finally around the whole run (gate/policy/turn/exception paths),
so a scheduled job's model never leaks into attended turns on the same agent.
Extracted the run tail into _run_pinned for a single guaranteed restore point.
- CodeRabbit (Major): provider/model are normalized (embedded "openai/gpt-4o"
prefix lifted out) before comparison, so a provider-qualified pin and a bare
resolved model no longer false-drift; split provider snapshots compare equal
to embedded agent strings too.
- CLI: clarified --pin/--no-pin help — pinning enforces a snapshot only once one
exists via an explicit --model; kept the CLI lightweight (no agent/LLM
instantiation at creation time) per AGENTS.md.
Tests: added run-scoped-restore and provider-prefix-normalization cases; core
scheduler (127) and wrapper scheduler (274) suites pass.
Co-authored-by: Mervin Praison <[email protected]>
A NaN/inf budget or rss slipped past the `rss <= target` check (all NaN
comparisons are False) and spuriously evicted every warm cache. Guard with
math.isfinite and safely coerce headroom_ratio, falling back to 0.9.
Co-authored-by: Mervin Praison <[email protected]>
Unattended scheduled runs resolved their model at fire time, so a job created
against a cheap/local default silently inherited whatever the default later
became — an invisible cost/behaviour drift for automations run without
supervision.
- core: additive provider/model/pin_model snapshot fields on ScheduleJob with
backward-compatible round-trip serialisation (unset = today's behaviour).
- wrapper executor: before the model turn, compare the resolved agent's model
with the snapshot; on drift fail closed (recorded error + optional fail-closed
delivery) with no model turn; otherwise pin the run to the snapshot.
- CLI: `schedule add --model` / `--pin/--no-pin`.
Co-authored-by: MervinPraison <[email protected]>
Add a pure, import-free core planner plan_pressure_evictions plus a
WarmSession fact and a MemoryPressureProtocol (cgroup limit + anon RSS)
to the gateway protocols. Under memory pressure the gateway can now name
the coldest (LRU) rebuildable warm session-agent caches to soft-evict
before the kernel OOM-kills the whole process, guarding against evicting
in-flight or not-yet-flushed sessions. Mirrors the existing
MemoryPressurePolicy admission contract; the decision is testable in
isolation and the gateway enacts the returned plan.
Co-authored-by: MervinPraison <[email protected]>
- failure.py: map validation/invalid_output -> format_error and OR in the
source outcome's is_retryable() so invalid_output stays retryable
- presentation.py: DegradedDelivery now uses immutable Tuple fields; report
derived from the same conversion/selection as adapt_presentation (select->
buttons, priority/cap truncation), passes callback_store, and reports
callback shortening only for genuinely lossy payloads (reply actions & select
options), never plain callbacks or store-backed lossless refs
- tests: pytest.raises for frozen checks; add invalid_output-retryable,
long-callback-with-store, plain-callback, and long-select-option coverage
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on #3800/#3802:
- P1: Build SchedulerDelivery eagerly in the (sync/async) scheduler __init__
when a deliver token is set, via a shared _build_delivery() helper. The
creation-time pre-flight warning/preview now fires the moment the scheduler
is created instead of lazily at fire time (after the first run). Fire-time
lazy build is retained as a fallback; self-heal remains the second line.
- P2: Move optional validate_target/preview_target off the runtime_checkable
DeliveryResolverProtocol into a separate DeliveryPreflightProtocol so
existing resolve()-only resolvers still satisfy the base protocol under
isinstance. Export DeliveryPreflightProtocol from praisonaiagents.gateway.
Backward-compatible, no new deps, no Agent params. Scheduler suite: 262
passed, 7 skipped; preview suite: 9 passed.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Add a creation-time pre-flight so a scheduled/agent-initiated send's
DeliveryTarget is checked and previewed the moment it is created, not only
when the job fires. Core gains a thin protocol seam (DeliveryValidation,
ScheduleTargetError, DeliveryResolverProtocol.validate_target/preview_target)
and a pure DeliveryTarget.preview(); the wrapper SchedulerDelivery validates
its target on construction, logging an actionable warning for unroutable
tokens and a preview otherwise. Fire-time self-heal is kept as second defence.
Co-authored-by: MervinPraison <[email protected]>
Add two pure, dependency-free core primitives so every bot turn ends in a
visible, actionable outcome and presentation downgrades are never silent:
- praisonaiagents/bots/failure.py: FailureReply + render_failure_reply maps an
AgentRunOutcome or PraisonAIError to typed, user-facing next-step copy keyed
by failure class (expired auth, missing key, rate limit, timeout, budget,
doom-loop, needs-help), reusing the existing remediation_hint.
- praisonaiagents/bots/presentation.py: DegradedDelivery + a backward-compatible
adapt_presentation_with_report returning the adapted presentation plus a typed
record of dropped controls with machine-readable reason codes. Existing
adapt_presentation signature is unchanged.
Mirrors classify_final / resolve_ingress_admission so no adapter re-decides the
failure/degradation outcome. No new deps, no config knobs.
Co-authored-by: MervinPraison <[email protected]>
- env.py: _provider_from_model prefers the env-set credential alias so
Together/Fireworks (TOGETHERAI_API_KEY, FIREWORKS_AI_API_KEY) resolve a key
instead of always using the first declared var.
- credentials.py: _stored_providers_for_vars derives from PROVIDER_ENV_CATALOGUE
so a stored key for any catalogued provider (Mistral, DeepSeek, xAI, Together,
Perplexity, Fireworks) satisfies is_configured() for its explicit model.
- setup/handler.py: _provider_setup_info picks the catalogue env-var (honouring
the alias actually set) and the catalogue representative model for
catalogue-only providers.
- tests: derive the env-clearing/detection key lists from the catalogue so
default-model and interactive-path assertions stay deterministic even when the
CI host exports a catalogued key (e.g. OPENROUTER_API_KEY). Fixes the three
failing test-core (cli) checks without weakening assertions.
Co-authored-by: Mervin Praison <[email protected]>
Replace the three hardcoded provider lists (is_configured's 8-key tuple,
_PROVIDER_DEFAULTS, and the setup wizard's 4-key env auto-detect) with a
single data catalogue PROVIDER_ENV_CATALOGUE mapping provider id ->
env-var(s) + representative model + model prefix.
Zero-config `praisonai run` now recognises a valid key for any catalogued
provider (Mistral, DeepSeek, Together, Fireworks, xAI, Perplexity, …) and
selects a provider-appropriate default model instead of gating on the old
~8-provider set. The catalogue keeps the historical 8 at its head so
existing ordered-preference behaviour is unchanged and new providers are
purely additive and backward compatible.
Co-authored-by: MervinPraison <[email protected]>
Auto-compaction previously read a static per-model context-window table with a
flat 128k default, mis-estimating the trigger point for any non-hardcoded model
(overflow for small windows, premature compaction for large ones).
get_model_limit()/get_output_reserve() now consult litellm's model_cost registry
(max_input_tokens/max_output_tokens) first, then fall back to the static tables.
Lazy-imported: zero overhead and fully backward compatible when litellm is absent.
Co-authored-by: MervinPraison <[email protected]>
- auto.py: _rewrite_agent_refs now rewrites route target strings
(route: {label: [agent_id]}) and loop/branches payload refs including
feedback_to, so renamed _auto_N agents are no longer routed to the
pre-existing colliding agent.
- orchestrator.py: PRAISONAI_SESSION_CACHE_MAX now falls back to the
documented default (1024) on empty/non-numeric values instead of raising
ValueError during persistence init.
Co-authored-by: Mervin Praison <[email protected]>
- Gap 1: PersistenceOrchestrator._session_cache is now a bounded LRU
(OrderedDict + PRAISONAI_SESSION_CACHE_MAX, default 1024) to prevent
unbounded memory growth in long-running serve/jobs/bot processes.
- Gap 2: flow.start_flow() now joins LANGFLOW_COMPONENTS_PATH with a comma
(pydantic list separator) instead of ';', matching the CLI helper so a
pre-existing env value no longer silently disables all components.
- Gap 3: merge_with_existing_workflow now tracks agent renames and rewrites
step agent references (including nested parallel/route/loop/branches) so
merged steps dispatch to the freshly-generated agent, with a log line on
each rename.
Co-authored-by: MervinPraison <[email protected]>
Remove calculate_cost_from_tokens and get_model_cost_info, which are
never referenced anywhere in the package, wrapper, tests, docs, or
public API. Also drop the now-unused Dict import. The live cost path
(calculate_cost) and tracking helpers remain unchanged.
Co-authored-by: MervinPraison <[email protected]>
Security: _caller_principal now treats the authenticated SessionContext.
unified_user_id as authoritative — an agent-supplied `principal` tool argument
can no longer override it, closing the cross-tenant impersonation gap flagged by
CodeRabbit/Greptile. Explicit principal still applies on the trusted no-session
path (CLI / gateway bridge).
CI regressions (stale test doubles):
- _FakeEngine now accepts principal= (matches the real principal-aware
SuggestionEngine API the gateway threads through).
- async_tui parity fake _execute now accepts read_only= (param added by the
earlier /code-review PR); pre-existing failure unrelated to this feature.
Tests: rewrote impersonation coverage (session wins), added no-session explicit
path test, and restore both global schedule stores in teardown for determinism.
Co-authored-by: Mervin Praison <[email protected]>
_execute_in_background now calls _execute_prompt(prompt, read_only=...) after
the read-only review work landed, but the test's _fake_execute only accepted
`prompt`, so the extra kwarg raised TypeError (swallowed by the background
error handler) and captured["prompt"] was never set -> KeyError: 'prompt'.
The fake now accepts read_only; assertions (single expansion, sentinel body
reaches the prompt) are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
Multi-agent review found the npm package (praisonai 1.7.3) does not compile
from a clean checkout and has several core-loop bugs. This makes v1.7.4
releasable.
Build was broken everywhere but the author's machine:
- src/db/ (6 files) and src/cli/output/ (4 files) were never committed --
the repo-root .gitignore entries `db` and `output` swallowed them, so 63
of 65 tsc errors were missing-module. Committed the files and added
negation rules.
- pnpm-lock.yaml was out of date (axios spec, better-sqlite3, removed
optional ai-sdk providers); regenerated.
- @jest/types and @jest/globals were not direct devDependencies, so jest
could not even load its config under pnpm; added, plus
@ai-sdk/provider-utils and @opentelemetry/api for the dynamic imports.
- adapter.ts imported tool()/jsonSchema() from @ai-sdk/provider-utils,
which never exported them (they live in `ai`); now tries `ai` first with
the old fallback preserved.
Core bugs fixed (each confirmed at runtime by the review):
- require('praisonai') threw at import when OPENAI_API_KEY was unset, even
for Anthropic/Google users; check moved to client creation.
- Agent.chat() sent every user prompt to the model twice (pushed to
history, then start() replayed history AND appended it again).
- Constructor tool processing aliased and mutated the caller's tools array
while iterating it: raw functions plus duplicate definitions were sent
to the API. Now iterates a snapshot and rebuilds this.tools.
- Plain-function tools received the parsed args OBJECT as their first
positional parameter ("Weather in [object Object]"); named args are now
mapped positionally via declared parameter names.
- Tool results were serialized with .toString() -- objects became
"[object Object]", null/undefined threw; now JSON.stringify.
- Tools and outputSchema silently ignored on non-OpenAI providers; now
logged loudly (proper support is follow-up work).
- OpenAIService defaulted to gpt-5-nano while hardcoding temperature 0.7,
which reasoning-family models reject with a 400; the default temperature
is now omitted for gpt-5*/o1*/o3*/o4*.
New capability (Python parity: output_json/output_pydantic):
- Agent outputSchema / outputSchemaName wired through generateText and
generateChat as OpenAI response_format json_schema.
- The exported parity MCP class's callTool() returned null (placeholder);
it now delegates to the real MCPClient (stdio/HTTP/SSE).
Release readiness: version 1.7.4 (1.7.3 is already on npm), LICENSE file
added (files list referenced it but it did not exist), engines.node >=18
(openai@4 requires it; >=14 was wrong).
Results: tsc 65 errors -> 0; jest "cannot start" -> 59/59 suites, 999
tests passing (87 skipped are live-API); npm pack produces a complete
tarball including LICENSE. Also added 9 unit tests covering every fix
above.
Co-Authored-By: Claude Fable 5 (1M context) <[email protected]>
- Move PresentationRendererProtocol to bots/protocols.py (core extension-point
convention), re-exported from presentation.py for backward-compatible imports.
- Normalize platform ids (case-insensitive) in the renderer registry to match
the channel registry, so mixed-case plugin ids resolve their renderer.
- Validate registrations at the API boundary: reject empty platform ids and
renderers missing get_limits/render, failing loudly at registration.
- Make wrapper built-in registration older-core safe (swallow ImportError) and
non-destructive (only fill empty slots, so plugin overrides win).
- Case-insensitive older-core fallback in get_renderer.
- Fix pre-existing CLI test failure: _execute_prompt fake stub now accepts the
read_only kwarg the production signature passes.
Co-authored-by: Mervin Praison <[email protected]>
- pairing.py: reject empty/whitespace secrets, fail closed on read errors of
an existing secret (no silent HMAC rotation), and create the secret atomically
with O_CREAT|O_EXCL so racing processes converge on one key.
- _pairing_ui.py: narrow the callback-secret fallback to storage errors and warn
explicitly instead of silently substituting a diverging random key.
- bot_checks.py: doctor guidance now notes PRAISONAI_CALLBACK_SECRET must be
unset/identical across hosts for button signatures to align.
- test_interactive_surfaces_parity.py: update the _execute_prompt fake to accept
read_only (matching the real signature added in #3758), fixing KeyError:'prompt'.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The async TUI review path calls self._execute_prompt(prompt, read_only=...),
but the parity test's fake stub only accepted `prompt`. The resulting TypeError
was swallowed by the broad except in _execute_in_background, so the fake never
recorded the prompt (KeyError: 'prompt'). Align the fake with production.
Co-authored-by: Mervin Praison <[email protected]>
Aligns resolve_ingress_admission with the live BotConfig.group_policy
default (mention_only) instead of respond_all, so an adapter forwarding
an unset policy fails safe (mention-gated) rather than replying to all
group traffic. Clarifies allowlist/pairing docstring contract.
Co-authored-by: Mervin Praison <[email protected]>
Add PresentationRendererProtocol + register_presentation_renderer /
get_presentation_renderer to praisonaiagents.bots.presentation so any
channel — built-in or a pip-installed plugin — can register a native
renderer the same way it already contributes config via ChannelDescriptor.
The wrapper now registers the four built-in renderers through this seam and
resolves via the core registry, so plugin channels no longer silently
degrade interactive UI to plain text.
Co-authored-by: MervinPraison <[email protected]>
Add pure, zero-dependency resolve_ingress_admission(...) -> IngressDecision
in praisonaiagents.bots.admission, mirroring evaluate_channel_health and
BotLoopGuard. Unifies channel/user allowlist, block-list, group policy
(respond_all/mention_only/command_only/observe) and pairing into one typed
verdict with a machine-readable reason_code so drops are recordable instead
of logger.debug-only and cannot drift per transport. Adds no new user knob.
Co-authored-by: MervinPraison <[email protected]>
Route the callback-button HMAC secret (bots/_pairing_ui.py) through the
same auto-provisioned, owner-only persisted secret used by the pairing
code path, so approve/deny buttons keep verifying across process restarts
with zero operator action. Explicit PRAISONAI_CALLBACK_SECRET override
still wins. Also collapse the stale ephemeral _get_secret() onto the
persisted store and correct the doctor check message.
Co-authored-by: MervinPraison <[email protected]>
Addresses the reviewer-flagged P1 that ``--pure`` / ``--no-plugins`` leaked
across in-process invocations: the flag set PRAISONAI_NO_PLUGINS with no
restore, so a later run/chat/code call in the same process inherited the
plugin-free baseline it never asked for.
- Add scoped_no_plugins() context manager + scopes_no_plugins() decorator in
cli/utils/env_utils.py that set PRAISONAI_NO_PLUGINS for the duration of one
command and always restore the prior value on return (mirrors the existing
--allow-local-tools save/restore pattern). functools.wraps preserves the
Typer signature so the real option set is unchanged.
- Apply the decorator to run/chat/code callbacks and drop the unscoped env
mutation from each body.
- Add regression tests for set/restore, prior-value restore, no-op, exception
safety, and decorator signature preservation.
Also repair pre-existing (present on main) test stubs broken by the earlier
read_only review-agent change: async-TUI stubs must accept the read_only
kwarg. Source is correct; only the stubs were stale.
Not implemented (out of scope per issue #3773): suppressing praisonai.tools /
praisonai.tool_sources entry-point discovery. The issue scopes suppression to
the praisonai.plugins group; tool suppression is explicitly optional/secondary
and would be scope creep.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
_execute_in_background calls _execute_prompt(prompt, read_only=...) since the
review-command work (#3734). The parity test's _fake_execute stub only accepted
`prompt`, so the extra kwarg raised TypeError inside the inlined execute thread,
which was swallowed and left `captured` empty (KeyError: 'prompt'). Mirror the
real signature in the stub; assertions (single-pass expansion + sentinel body)
are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on the doom_loop approval gate:
- Reset the whole matching (tool,args) streak on an explicit allow instead of a
blind pop() so a legitimate repeat gets a fresh critical_threshold window and
is not re-prompted on every subsequent call. Removing by identity also leaves
concurrent unrelated records intact (fixes the pop() race).
- Move the synthetic gate out of DEFAULT_DANGEROUS_TOOLS to a namespaced
internal target (__doom_loop__) so it can never reserve/collide with a real
user tool named doom_loop or leak into the safe/read_only presets.
- Honour an explicit PermissionManager allow/deny on the doom_loop policy alias
before consulting a backend, so Agent-level policy is not bypassed.
- Scope the approval request to the exact repeated call via a stable args
fingerprint so an allow for one loop cannot silently authorise another.
Adds regression tests: streak-reset (no per-call reprompt), per-argument
scoping, user-tool-name isolation, and internal-target criticality.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- credentials: treat a set-but-empty PRAISONAI_AUTH_CONTENT as a
misconfiguration (ValueError) instead of silently falling back to disk,
preserving the zero-disk contract; validate that each provider entry is a
JSON object so malformed entries fail fast with a clear error.
- tests: add regression coverage for empty value and non-object provider entry.
- fix pre-existing CI failure in test_async_tui_expands_at_mentions: the
_fake_execute stub predated the read_only kwarg on _execute_prompt, so the
real call raised a swallowed TypeError and left the prompt uncaptured.
Co-authored-by: Mervin Praison <[email protected]>
Add an ephemeral, per-run flag to suppress discovery/loading of external
plugins without mutating persisted enable/disable state.
- Core: PluginManager honours a PRAISONAI_NO_PLUGINS env var and an optional
`disabled` constructor param (Python parity for plugins=False) that
short-circuits discover_entry_points()/auto_discover_plugins(), emitting a
single "running without external plugins" notice.
- Wrapper: add --pure / --no-plugins to run/chat/code, which set
PRAISONAI_NO_PLUGINS for the process only.
- Surface reproduction hint / suppression status in `plugins doctor`.
Co-authored-by: MervinPraison <[email protected]>
Route a critical loop verdict through the unified approval pipeline as a
synthetic `doom_loop` permission target instead of unconditionally blocking.
This gives human override, per-project policy control (allow|ask|deny) and
cost safety while preserving the historical hard-stop default.
Co-authored-by: MervinPraison <[email protected]>
Load the whole credential store from a single env var (JSON) in memory when
PRAISONAI_AUTH_CONTENT is set; skip all disk reads and make writes in-memory
no-ops so nothing is persisted. Surface the in-memory source in auth list/status.
Co-authored-by: MervinPraison <[email protected]>
- tools.py: read max_bytes+1 and reject when a github: tool file exceeds the
1 MiB cap instead of silently persisting truncated (broken) source as success
(Greptile P1).
- test_interactive_surfaces_parity: _fake_execute now accepts read_only= to
match _execute_prompt(prompt, read_only=...) — the stub predated the read-only
review signature, so the real path swallowed a TypeError and never set the
captured prompt (CI KeyError: 'prompt'). Test guarantee (expand-once) preserved.
Co-authored-by: MervinPraison <[email protected]>
Gap 2 (security): praisonai tools add now honours PRAISONAI_ALLOW_LOCAL_TOOLS
like every other loader, inspects added files via ast.parse instead of
exec_module, and hardens GitHub downloads (HTTPS-only, 1 MiB cap, safe basename).
Gap 3 (async safety): OpenAI-compat handlers offload sync provider.invoke via
asyncio.to_thread; simulated streaming emits word-by-word instead of per-char;
A2UEventBus mutations are guarded by a threading.RLock, the singleton is
double-checked-locked, and /a2u/health now requires authentication.
Gap 1 (adapter parity): add warn_unsupported_fields to surface YAML fields a
backend silently drops, wired into CrewAI/AutoGen adapters; AutoGen agent_callback
is now fired per agent.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer feedback on #3769:
- memory_mixin: rollback now removes only the failing turn's own messages by
object identity (tracked per-turn via contextvars, thread/task-isolated) so a
concurrent turn's messages are never clobbered; positional fallback kept for
untracked callers (backward compatible).
- chat_mixin: wire _begin/_end/_clear_turn_tracking into sync chat() (try/finally)
and async achat() custom-LLM paths.
- agent: stop persisting a live Memory/db() backend in _memory_config so
clone_for_channel() isolates it via _memory_instance instead of sharing one
store across channel clones.
- test_interactive_surfaces_parity: fix outdated _fake_execute signature that
didn't accept _execute_prompt's read_only kwarg (pre-existing CI failure).
- Gap 1: clone_for_channel() now re-instantiates a fresh memory backend per
clone (via _isolated_memory_for_clone), so per-channel/per-user clones no
longer share one live Memory store. Also persists _memory_config on self so
clones actually receive the memory config.
- Gap 2a: add _rollback_chat_history_to() which only removes this turn's own
appended slice, so a failing turn can't clobber a concurrent turn's messages;
all chat()/achat() rollbacks now use it instead of _truncate_chat_history.
- Gap 2b: achat() custom-LLM path now uses the atomic
_add_to_chat_history_if_not_duplicate() helper (like sync chat()) instead of
an unlocked check-then-act, closing the TOCTOU duplicate-message race.
- Gap 3: forward Agent(retry=...) into LLM init params for all _using_custom_llm
branches (provider/model, dict, base_url) so max_retries is honored instead of
LLM's hardcoded default; user-set max_retries in dict configs still wins.
Co-authored-by: MervinPraison <[email protected]>
The async TUI passes read_only= to _execute_prompt in _execute_in_background,
but the test's fake only accepted (prompt), causing a TypeError swallowed by
the surrounding except, so captured['prompt'] was never set (KeyError). Align
the fake signature with production. Unrelated to PR #3764's LLM changes.
Co-authored-by: Mervin Praison <[email protected]>
Per-call max_tokens overrides bypassed the reasoning-model conversion because
override_params were merged after the instance-level mapping. Move the
max_tokens -> max_completion_tokens normalization (and sampling-param drop)
to after the override merge so o1/o3/gpt-5.x calls never carry the rejected
max_tokens. Explicit max_completion_tokens takes precedence.
Co-authored-by: Mervin Praison <[email protected]>
Reasoning models (o1/o3/gpt-5.x) reject the legacy max_tokens parameter
and require max_completion_tokens. They also reject sampling params like
temperature/top_p. The Chat Completions param builder now detects
reasoning models via litellm.supports_reasoning() (with a prefix fallback)
and emits the correct token param while dropping unsupported sampling params.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer findings on PR #3747:
- Route /code-review and /security-review through a cached read-only review
agent whose tool set excludes write/command-execution tools, enforcing the
advertised read-only boundary at the capability level (not just by prompt).
- Skip @file expansion for generated review prompts so a `@../../secret`
token inside an untrusted diff cannot exfiltrate files.
- Distinguish diff-collection failures (raise ReviewDiffError) from a
successful empty diff, so errors are no longer masked as "Working tree clean".
- Parse review args with shlex so quoted paths survive; reject multiple
positional paths with a usage message.
- Derive slash-command autocomplete from _BUILTIN_COMMANDS so code-review /
security-review are discoverable and stay in sync with registration.
- Tests: option forwarding, multi-path rejection, diff-error vs clean tree,
ReviewDiffError propagation, and read-only tool filtering.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
Under CI's `pytest -n 2 --dist loadfile`, a worker process persists across
files, so the process-wide BackgroundRunner singleton (and any tasks other
files scheduled on its daemon loop) leaked into these REPL /tasks tests. The
old fixture only cleared `_tasks`, which a concurrently-mutating daemon task
could repopulate — surfacing as "No background tasks" and an uncancelled
RUNNING task. Fully reset the singleton so `_handle_tasks_command` resolves the
same fresh instance we seed. No assertions weakened; behaviour still fully
verified (list, detail, actual CANCELLED status).
Co-authored-by: Mervin Praison <[email protected]>
Resolve two P1 correctness gaps from Greptile's second review pass:
- session fork: the store persists sessions under a *sanitized* filename
(non [alnum-_] -> _), so a global-only id containing e.g. '.' or ':' was
found by session_exists_anywhere but missed by the literal '{id}.json'
store-dir check, forking an empty history from the project store. Sanitize
identically when resolving the store dir.
- REPL /branch: replace the inline, unlocked busy check with the shared
_worker_busy() helper, which reads current_task and queue size under the
worker's processing_lock. This closes the dequeue/publish race where a turn
is in-flight but momentarily invisible.
Tests: sanitized-global-id fork resolution; /branch busy state read under lock.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
When the legacy REPL is launched with --approval plan the backend already
enforces PermissionMode.PLAN, but session_state['plan_mode'] defaulted to
False so the first no-arg /plan re-enabled an already-active mode instead of
exiting it (Greptile P1). Seed plan_mode from backend.permission_mode on first
use, mirroring the async TUI's _sync_plan_mode_from_backend. Adds a source
regression test.
Co-authored-by: Mervin Praison <[email protected]>
The Enter handler expanded @file mentions before _queue_or_execute, but
_execute_in_background already expands canonically. Since
_process_file_mentions is not idempotent, the second pass re-interpreted
@tokens embedded in attached file contents and appended unrequested files.
Removes the redundant enter-handler expansion so all paths expand once.
Strengthens the parity test to drive the real _execute_in_background path
and assert _process_file_mentions runs exactly once.
Co-authored-by: Mervin Praison <[email protected]>
Address three P1 review findings on the mid-session forking feature:
- session fork CLI now resolves the store directory from the same
canonical CLI stores session_exists_anywhere() searched (project then
global), so forking a global-only session copies its real history
instead of producing an empty fork from the project-scoped store.
- session fork rejects an out-of-range --at-message (negative or >=
message count) up front rather than silently wrapping via Python slice
semantics while reporting success.
- REPL /branch refuses to fork while a turn is still executing (worker
busy or queue pending), preventing the async worker from saving the
parent's in-flight turn onto the freshly-switched fork.
Adds tests for out-of-range indices, global-only forking, and
branch-while-busy rejection.
Co-authored-by: Mervin Praison <[email protected]>
Address two Greptile P1s on the headless `praisonai code -p` path:
- Profiling no longer bypasses headless output. The `-p` branch now runs
before the `--profile` branch and rejects the `-p` + `--profile/--profile-deep`
combination, so the machine-readable JSON/text contract and status exit code
are always honored instead of a human report exiting 0.
- `-p` fails closed on options the minimal headless agent cannot honor
(`--tools`, `--agent`, `--plan`, `--no-acp`, `--no-lsp`) rather than silently
dropping the caller's tools/profile/scope. Options that ARE honored
(`--model`, `--thinking`, `--verbose`, `--workspace`, `--resume/--session/--continue`)
remain allowed. Chose fail-closed over re-implementing the heavy ACP/LSP
wiring to keep the command lightweight (AGENTS.md).
Adds tests for both guards.
Co-authored-by: Mervin Praison <[email protected]>
Address four valid P1 findings from Greptile review of the /tasks feature:
1. Bot command dispatch was missing: wire handle_tasks_command into the
telegram, discord and slack adapters (was advertised but never invoked).
2. Task registries were disconnected: arun_background now submits to the
process-wide get_background_runner() so /tasks and `background list` see
the same tasks (previously each call built its own runner).
3. Ownerless tasks bypassed isolation: _owned now fails closed — a bot user
only sees/acts on tasks whose metadata.user_id matches exactly.
4. Cancellation left execution running: add BackgroundRunner.cancel_task_sync
(hops to the background loop) and use it so the underlying future is
actually cancelled instead of merely marking the record.
Tests updated for fail-closed ownership + new ownerless-isolation case.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile P1: the TUI lazily built the checkpoint manager only on
the first /diff or /undo, so its "session start" snapshot captured an
already-modified workspace — /diff omitted prior edits and /undo restored the
post-edit state. Now on_mount() eagerly establishes the baseline before any
turn, and each submission records a pre-turn checkpoint so /undo can roll back
individual turns. Both paths are best-effort and no-op when checkpointing is
disabled. Adds two lifecycle regression tests.
Co-authored-by: Mervin Praison <[email protected]>
resolve_session accepts legacy-only ids via the deprecation-window
fallback, but rename_session did a canonical-only lookup so `session
rename` failed on a pre-existing session the CLI otherwise lists,
resumes, deletes and exports. Add a _legacy_rename fallback mirroring
_legacy_delete, backed by a new SessionManager.rename that persists the
title in the existing metadata `name` field (empty clears it, matching
canonical store semantics). Adds regression tests for the store and CLI
legacy paths.
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile P1 findings and CI failures on PR #3750:
- async_tui/legacy: exiting PLAN now restores the launch-time policy
(accept-edits/bypass) instead of forcing DEFAULT.
- async_tui: sync config.plan_mode from a live PLAN backend at startup so
the [PLAN] indicator shows and the first /plan toggles off, not on.
- Fix collision with pre-existing planning tests: /plan <task> message keeps
"Creating plan" substring; /plan no-arg test updated for the intentional
persistent-toggle behavior.
- Add regression tests for restore-on-exit and startup sync.
Co-authored-by: Mervin Praison <[email protected]>
Address two Greptile P1 issues in the interactive shell escape:
- attach !!cmd output even when the command fails (do not silently
drop context the user explicitly requested)
- retain _pending_context until agent.start() succeeds so a model
error does not lose the attached shell output
Applies to both the REPL and TUI paths; adds regression tests.
Co-authored-by: Mervin Praison <[email protected]>
Cap build_recap() at RECAP_MAX_CHARS (3500) so an unbounded persisted/
compaction summary can never exceed Telegram's 4096-char message limit or
flood a terminal. Only the older summary is trimmed; the recent tail is
always preserved. max_chars<=0 disables the cap for full-block callers.
Fixes the valid unbounded-output concern raised in review; keeps the fix at
the core layer so every channel (CLI + all bots) benefits without per-adapter
plumbing.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on the custom-command bridge (#3729):
- Telegram: register a catch-all MessageHandler(filters.COMMAND, ...) after
the built-in/registered CommandHandlers so file-based and entry-point
slash commands (never registered as explicit handlers) actually reach
handle_command and render, instead of being silently dropped.
- Resolver: require BOTH deployment opt-in and the command's own
allow_shell frontmatter before live !`cmd` substitution runs, so a
deployment enabling shell can't upgrade a command that declared it off.
- Telegram custom-command reply now routes through the normal delivery
pipeline (pop_last_presentation, fire_message_sending,
_send_response_with_media, render_presentation, fire_message_sent) and
sanitizes errors via safe_log_message/extract_root_cause_from_error/
safe_error_message instead of leaking raw exceptions to chat users.
- /help and native command-menu entries now merge resolver-discovered
file/entry-point commands (builtin/registered precedence preserved).
- Tests: add per-command allow_shell gating coverage.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Record SKILL.md mtime when a LoadedSkill enters the index (discover/reload/
add_skill) so an edit made between discover() and the first reload() is
detected instead of silently masked.
- Track discovery-owned skill names so reload() no longer reports skills
registered via add_skill() as removed (backward compatible).
- Refresh the change-detection baseline after manager-owned telemetry writes
so a telemetry-only SKILL.md update is not misread as a content change and
does not drop an activated skill.
- Make `praisonai skills reload` an honest scan report (no live-session
consumer exists cross-process) instead of an always-empty reload diff.
- Add tests: edit-before-first-reload, add_skill preservation, telemetry-only
no-false-change.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Force stream=False so a TTY streaming generator is not str()'d into a repr;
defensively materialize any generator that slips through.
- Explicitly set autonomy=False on the side agent so it can never trigger the
tool-using autonomous loop regardless of ambient config (read-only contract).
- Parse --keep only as the leading option so '/btw what does --keep mean?' is
preserved as question text.
- Replace the unconditional 'or True' rendering assertion with a real stdout
capture; add tests for leading-only --keep, autonomy=False, and generator
materialization.
Co-authored-by: Mervin Praison <[email protected]>
Address blocking reviewer findings on #3728 plugin runtime:
- discovery: trust gate now judges a plugin file by its own location, so a
repository-controlled symlink under .praisonai/plugins can no longer bypass
PRAISONAI_ALLOW_PROJECT_PLUGINS by pointing its target outside the project.
- discovery: track only tools a module actually contributed (pre-exec registry
snapshot) so unload never unregisters tools owned by another plugin; guard
_loaded_plugin_tools with a lock.
- loader: preserve boolean `plugins.enabled: true` (no longer collapses to an
empty allow-list that disables everything); refuse ambiguous disable.
- loader: fail fast when writing a TOML config without tomli_w instead of
writing an ignored YAML sidecar (config split-brain).
- CLI plugins: reload unloads stale single-file modules before rediscovery and
reports real counts + the discovery gate; disable unloads single-file plugin
tools; doctor checks registered-plugin hooks; plain-text output (no Rich
markup via typer.echo); chained exceptions; logged swallowed errors.
- tests: add symlink-gate, boolean-enabled, and isolated unload cases.
Co-authored-by: Mervin Praison <[email protected]>
Give the flagship `code` command a scripting-grade headless mode at parity
with `run --output json`/`chat --json`. `-p/--print` routes around the
decorated interactive path (which prints `Chat mode:`/`Prompt:` diagnostics
+ a profiling block and always exited 0), builds the code agent directly,
and emits a clean machine-readable envelope {result, session_id,
usage:{in,out,cost}, status} on stdout. Exit code reflects status (0 ok,
nonzero on error/empty result). `--resume <id> -p` composes for scripted
multi-turn. Usage is read from the existing token collector + cost tracker,
so no new Agent params, exports, or wrapper wiring are introduced.
Co-authored-by: MervinPraison <[email protected]>
Expose mid-session conversation forking that previously only existed as a
startup flag. Adds:
- /branch [title] [--at N] in the interactive REPL, forking the live
UnifiedSession, switching onto the fork, and recording parent/child lineage.
- praisonai session fork <id> [--at-message N] [--title ...] mirroring the
existing run --fork HierarchicalSessionStore substrate.
- Fork lineage (parent_id/children_ids) on UnifiedSession, merge-safe, shown
in /session and session list.
Wrapper-only change; no praisonaiagents core edits, no new deps.
Co-authored-by: MervinPraison <[email protected]>
Sessions were addressable only by opaque id. Add a lightweight,
metadata-only rename:
- DefaultSessionStore.rename_session() stores metadata["title"] via the
existing locked read-modify-write path; empty title clears it.
- list_sessions() surfaces "title"; _session_title() prefers it.
- session_resolver.rename_session() targets the canonical store holding
the id (mirrors delete_session).
- `praisonai session rename <id> <title>` subcommand; `session list`
Name column prefers the title, falling back to agent name.
Backward compatible: un-renamed sessions still resolve/resume by id.
Co-authored-by: MervinPraison <[email protected]>
Surfaces the already-complete background-task substrate on the interactive
surfaces so users can check on backgrounded work without leaving the session.
- interactive_legacy: /tasks (list), /tasks <id> (detail), /tasks cancel <id>
via the existing BackgroundHandler renderer
- bots/_commands: register `tasks` + handle_tasks_command with compact,
per-user-scoped rendering (owner via task metadata user_id)
- background: add lazy process-wide get_background_runner() so all surfaces
share one runner view
- fix latent crash in the CLI detail renderer when duration_seconds is None
Co-authored-by: MervinPraison <[email protected]>
Adds a working /diff to the coding REPL showing all file changes made this
session (session baseline -> working dir), with --turn and <file> scopes,
reusing the existing CheckpointService engine via SessionCheckpointManager.
Replaces the wrapper TUI's dead /diff and /undo stubs (which only printed
"use git diff" help text) with real handlers backed by the same engine as
the legacy REPL. Default-safe: when checkpointing is disabled, /diff reports
how to enable it rather than failing silently.
Also verifies and regression-tests the wrapper-resident `context` command
mapping (resolves via praisonai.cli.commands.context, not the placeholder
local module).
Co-authored-by: MervinPraison <[email protected]>
Reuses the existing gated executor (PRAISONAI_ALLOW_SHELL env-gate, 30s
timeout, 100KB output cap) from custom_definitions.py via a new shared
run_shell_escape helper. Wires !cmd / !!cmd handling into the legacy REPL
and async TUI input paths before command/prompt dispatch, rendering output
inline without consuming a model turn. !!cmd attaches output as context for
the next turn.
Co-authored-by: MervinPraison <[email protected]>
Wire the existing PermissionMode.PLAN enforcement into the REPL /plan slash
command instead of a one-shot prompt template. /plan toggles read-only mode
(set_permission_mode(PLAN)), /plan off exits, /plan <task> plans under
enforcement; async TUI shows a [PLAN] status indicator. Also list plan,
accept-edits and bypass in the --approval help text.
Co-authored-by: MervinPraison <[email protected]>
Reuse the existing summariser purely to inform the user with a 'where were we' block, without mutating the transcript or triggering compaction. Adds a core build_recap() primitive, the /recap bot command, and a --recap flag on session show.
Co-authored-by: MervinPraison <[email protected]>
Re-scan skill sources into a running session without restart. reload()
diffs discovery against the current registry, swaps the index atomically
(index changes take effect on the next turn, not mid-turn), preserves
activation/telemetry for unchanged skills, and deactivates removed ones.
Adds a thin `skills reload` CLI parity command reporting +added/~changed/-removed.
Co-authored-by: MervinPraison <[email protected]>
Ask a side question in a parallel, throwaway context so the main task's
history and momentum stay untouched. Builds a fresh read-only agent, runs
the question in isolation, renders a distinct block, and never appends to
the main conversation history. Opt-in `/btw --keep` records a one-line note.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer findings on $1..$n interpolation:
- preserve literal out-of-range dollar-number text (e.g. legacy "$100")
instead of erasing it
- tokenize with non-POSIX shlex so Windows paths (C:\Users\alice) survive
- merge $ARGUMENTS + positional substitution into a single pass so injected
tokens that look like $1/$ARGUMENTS are never re-scanned
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Bots were a command island: .praisonai/commands/*.md and plugin-bundle
commands surfaced only in the code REPL/TUI, never in Telegram/Slack/etc.
This adds a shared CustomCommandResolver in praisonai-bot that consumes the
existing custom_definitions loader/interpolator (via the sanctioned
_code_bridge seam — no cross-tier hard dependency, no reimplementation) with
a bot-appropriate safety posture:
- Shell (!`cmd`) substitution OFF by default regardless of frontmatter;
opt in per deployment via bots.commands.allow_shell. When off, live
segments render inert instead of executing or failing the command.
- Project-scope only by default (user ~/.praisonai excluded unless
include_user_scope), allow-listable via expose.
- Builtin precedence preserved; file commands merged into /help and the
command menu through the shared ChatCommandMixin (all adapters benefit).
- praisonai.bot_commands entry-point group lets installed packages add bot
commands without forking; file/project commands win on collision.
Telegram is wired as the reference adapter (catch-all dispatch renders the
command and submits it via the normal session.chat path). Adds config schema
(BotCommandsConfigSchema) and TDD tests covering project command execution,
shell-off-by-default, allow-list, user-scope exclusion, builtin precedence /
help merge, and entry-point resolution.
Co-authored-by: MervinPraison <[email protected]>
Defect 1 (config split-brain / fake CLI): add core get_plugin_registry()
returning real entry-point, registered and single-file plugins with
provenance and enabled state; the praisonai-code plugins CLI now lists/
inspects/enables against it and deletes the hardcoded four-plugin list.
enable/disable write the plugins.enabled allow-list in .praisonai/config.yaml
(the same file the runtime reads) via a new config-loader write path — no
more ~/.praisonai/config.json split-brain.
Defect 2 (trust-gate bypass): route project-local single-file plugin exec
in plugins/discovery.load_plugin through an opt-in gate
(PRAISONAI_ALLOW_PROJECT_PLUGINS / plugins.allow_project_plugins, default
false), mirroring the project-tools gate. A cloned repo's
.praisonai/plugins/*.py no longer runs until the user opts in. User-global
plugins remain trusted.
Defect 3 (leaky unload / unreachable reload): unload_plugin now unregisters
the tools a module harvested (tracked per module) instead of leaking them;
new `praisonai plugins reload` forces rediscovery + hook rewire so plugins
take effect without a restart.
Co-authored-by: MervinPraison <[email protected]>
Adds the minimal, self-contained slice of the plugin-bundles proposal that
strengthens existing local commands without a new subsystem: parse
argument-hint/model/tools (allowed-tools) frontmatter onto CustomCommand and
support shell-style positional $1..$n interpolation alongside $ARGUMENTS.
Positional tokens are split with shlex, injected before $ARGUMENTS (so user
input is never re-scanned), and escaped identically so they can never
introduce shell substitution. Legacy two-field command files are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer feedback on PR #3726 (Greptile/CodeRabbit):
- Never silently drop unsupported delivery targets: _can_deliver now always
dispatches a configured target so _dispatch_delivery raises and the caller
records delivery_error (matches PR's stated contract).
- Reuse chunk_message so Telegram/Slack/Discord size limits are not exceeded.
- Fall back to the gateway's persisted HomeChannelRegistry state file when
{PLATFORM}_HOME_CHANNEL env is unset, so gateway-registered home channels
resolve out of process.
- Preserve Discord threaded context via message_reference (parity with the
Telegram/Slack thread_id handling).
- Tests updated to lock the new contract (chunking, discord thread reference,
registry fallback, unsupported-target error recorded).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The bot layer's is_permanent_target_failure recognises a broader set of
whole-target death patterns (bot is not a member, need administrator
rights, channel_archived, ...) than core's deliberately narrow text
classifier. Previously classify_send_failure returned "unknown" for those,
so DeliveryRouter persisted a misleading "unknown: bot is not a member"
dead-target reason. Now, when core returns "unknown" but the broader
predicate confirms a permanent failure, the kind is upgraded to
"forbidden" so diagnostics read "forbidden: ..." — without over-classifying
genuine unknowns/transient errors (they stay unknown/transient, retryable).
Addresses Greptile P2 review feedback on PR #3725.
Co-authored-by: Mervin Praison <[email protected]>
Scheduled jobs could only deliver their `deliver:` target when a live,
in-process bot adapter was running in the same process as the scheduler.
Running `praisonai schedule tick` out of process (OS cron, CI, serverless,
scale-to-zero) computed the result but silently dropped delivery because the
executor's injected `delivery_handler` was None.
This adds a stateless, token-authenticated standalone sender per platform
(Telegram/Slack/Discord) in the praisonai-bot wrapper. When no live
`delivery_handler` is wired, the executor falls back to a single HTTP call
using the same `{PLATFORM}_BOT_TOKEN` env the gateway uses, with a bare
`deliver: telegram` home-channel target resolving its chat id from
`{PLATFORM}_HOME_CHANNEL`. Delivery failures are recorded as `delivery_error`
exactly as the live-adapter path does.
Wrapper-only change (no core edits, no new Agent params, zero new deps —
stdlib urllib). The live-adapter path is unchanged.
Co-authored-by: MervinPraison <[email protected]>
Add SendErrorKind enum + error_kind/retryable fields to core SendResult, a
pure status/text-aware classify_send_error fallback, and a classify_error seam
on BasePlatformAdapter. _send_with_retry now classifies failures once and
short-circuits provably-permanent kinds (forbidden/target_not_found/auth_fatal/
invalid_request) instead of blindly retrying. The bot-layer DeliveryRouter now
records dead targets by kind via the shared taxonomy, replacing English-only
substring reasons.
Co-authored-by: MervinPraison <[email protected]>
A fast-exiting command (e.g. sys.exit(3)) could be mis-reported as a
[exit 124] timeout on a loaded CI runner: after the reader thread hit
stdout EOF, proc.poll() could transiently return None before the exit
status was reaped, and the old logic inferred a timeout purely from
process state and SIGKILL'd the already-exiting process. Timeout is now
decided solely by the wall-clock deadline, with a brief grace wait to
reap fast exits, so the real exit code is preserved.
Co-authored-by: Mervin Praison <[email protected]>
- DeferredResolver.resolve now buffers values that arrive before the handle
is registered (early completion) instead of discarding them; the buffered
value is delivered when register()/register_if_absent() runs.
- Add register_if_absent() so the LLM run loop registers atomically and a
gateway-owned or concurrent-turn callback is never clobbered.
- LLM._register_deferred_if_any uses register_if_absent (no check-then-set race).
- cancel() clears any buffered early resolution.
- Add tests for early-resolution buffering, atomic no-clobber, cancel-clears-buffer.
Co-authored-by: Mervin Praison <[email protected]>
Move max_rpm<=0 validation ahead of the explicit-limiter check in both
Agent.__init__ and yaml_parser so ExecutionConfig(max_rpm=0, rate_limiter=obj)
raises ValueError as required by the behaviour matrix. Add regression test.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on PR #3720:
- Catch UnicodeDecodeError alongside JSONDecodeError so corrupt/binary
session files are quarantined instead of propagating an uncaught
decode error (both DefaultSessionStore and HierarchicalSessionStore).
- Make _quarantine_corrupt() pick a collision-free destination so two
corrupt files in the same millisecond are each preserved distinctly.
- Strengthen tests: assert exact byte-for-byte preservation, add an
invalid-UTF-8 regression, and add a HierarchicalSessionStore
corruption-recovery smoke test verifying the SESSION_PERSIST_FAILED
hook metadata.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
max_rpm was stored on the Agent but never wired to a runtime RateLimiter,
so ExecutionConfig(max_rpm=N) did not throttle requests. Now the Agent
auto-builds RateLimiter(requests_per_minute=N) when max_rpm is set and no
explicit rate_limiter is provided. Explicit rate_limiter still takes
precedence; max_rpm<=0 raises ValueError. YAML max_rpm now also wires a
live limiter.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add a lightweight DeferredResolver registry in tools/call_executor.py that
links a deferred handle_id to a resolution callback. The run loop now registers
any deferred tool result (via LLM._register_deferred_if_any) so that a later
resolve_deferred(handle_id, value) — fired on background completion — re-injects
the result instead of it being lost. Exposes register_deferred/resolve_deferred/
get_deferred_resolver/DeferredResolver from praisonaiagents.tools.
Co-authored-by: MervinPraison <[email protected]>
A malformed session JSON file was read as an empty session and then
overwritten by the next write, permanently destroying a user's history
with only a log line. Now the corrupt file is quarantined aside
(<file>.json.corrupt-<ts>) before starting fresh, preserving recoverable
bytes, and the event is surfaced via the existing SESSION_PERSIST_FAILED
hook rather than silently dropped. Applied to both the default and
hierarchical stores.
Co-authored-by: MervinPraison <[email protected]>
Extend the existing import-free header parser so a single-file plugin can
declare its capability surface (Channels, Provides/Tools, Config,
Auto Enable When Configured) statically. discover_plugins()/list_plugins
already surface this metadata to onboarding/doctor without importing the
plugin's runtime, enabling capability enumeration and config validation
before runtime loads.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer findings on plugins/tools add commands:
- uv pip install now pins --python sys.executable so the package lands in the
interpreter running the CLI rather than an env uv auto-discovers.
- Add importlib.invalidate_caches() after install so a just-installed
distribution is importable before discovery runs.
- tools add now builds a fresh ToolResolver after install so instance-level
availability caches (e.g. praisonai_tools importability) are re-evaluated;
invalidate() only clears the per-name resolve cache.
- Add --global option to both commands (uv --system / plain pip) for installing
into the ambient system environment.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Concurrent callers of discover_plugins() could both pass the _discovered
check before either set it, double-loading entry points and double-counting.
Wrap the first scan in the re-entrant registry lock so concurrent callers
block, then observe _discovered and return 0 without rescanning. The get()
path already holds the RLock, so re-acquisition is deadlock-safe.
Co-authored-by: Mervin Praison <[email protected]>
Adds one-command install-and-verify for plugin/tool packages from the CLI.
Installs via the resolved installer (uv pip or python -m pip), triggers
discovery, and reports exactly which plugins/tools registered (name, type,
hooks/source) or exits non-zero with a clear message if nothing was
discovered. Supports --dry-run (verify only) and --upgrade.
Co-authored-by: MervinPraison <[email protected]>
The core tool registry now discovers the documented canonical
`praisonai.tools` entry-point group in addition to the legacy
`praisonaiagents.tools` and `praisonai.tool_sources` groups (kept as
deprecated aliases with a one-cycle DeprecationWarning). Because the CLI,
YAML and Python surfaces all defer to the core registry, an installed
third-party tool package is now resolvable by name across all three
surfaces automatically. The canonical group wins on a name collision and
the lazy, cached entry-point loading pattern is preserved.
Co-authored-by: MervinPraison <[email protected]>
- run_sync_or_offload now holds the in-flight bridge future and cancels it
when the worker join times out, so stuck async work stops instead of
lingering on the bridge loop (CodeRabbit).
- A2U _MAX_SUBS/_QUEUE_MAX now fall back to defaults on non-positive or
unparsable env values, preventing asyncio.Queue(maxsize<=0) from silently
becoming unbounded (CodeRabbit).
Co-authored-by: Mervin Praison <[email protected]>
- glob/grep: PRAISONAI_WORKSPACE confinement is now opt-in; without it set,
no sandbox is enforced (cwd was never a real boundary and enforcing it
broke all callers passing an explicit directory + 15 CI tests).
- a2u_server: fail-closed guard now reads the launcher-set
PRAISONAI_CALL_BIND_HOST (with PRAISONAI_A2U_BIND_HOST override) and
rejects unauthenticated non-loopback/unknown binds, matching the existing
call-server security contract (fixes Greptile P1).
Co-authored-by: Mervin Praison <[email protected]>
- _async_bridge: add awaitable arun_sync_or_offload() sibling and bound the
run_sync_or_offload() worker join with a timeout so a stuck coroutine can no
longer pin the caller (and, when the caller is the loop thread, the loop)
indefinitely.
- tools (glob/grep/multiedit): confine to PRAISONAI_WORKSPACE root, filter
security.is_protected paths from results/reads, refuse edits to protected
files, and cap per-line length in grep to bound ReDoS cost.
- endpoints/a2u_server: refuse fail-open auth on non-loopback binds, cap
subscriptions, and bound per-subscription queues with drop-on-full so a
slow/stalled consumer or subscription flood cannot OOM the process.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 review findings on PR #3708:
1. Racy output-mode registration: concurrently-constructed Agents could
both observe "no mode enabled" and clobber each other's process-global
display callbacks. Wrap the check-and-enable in a module-level lock
(_output_mode_lock); the common silent path stays lock-free.
2. MCP "Error: " prefix misclassification: a successful MCP tool may
legitimately return text starting with "Error: ", which the prefix-only
normalizer converted into a retryable error dict. Narrow normalization
to MCP's unambiguous internal timeout signatures only, preserving valid
tool output.
Co-authored-by: Mervin Praison <[email protected]>
- __init__.py: point HarnessProfile/resolve_harness/register_profile lazy map at
praisonaiagents.model_harness.profiles (real submodule) so top-level access no
longer re-enters the module package __getattr__ under the non-reentrant lock.
- _lazy.py: make _cache_lock an RLock as defense-in-depth so any future mapping
of this shape degrades to redundant work instead of a self-deadlock.
- agent/agent.py: make process-global output modes (editor/trace/status)
mutually exclusive — first mode wins, so a second Agent with a different mode
cannot clobber another agent's callbacks (wrong formatting/redaction routing).
- agent/tool_execution.py: normalize MCP "Error: ..." string failures into the
native {"error": ..., "timeout": ...} dict shape so MCP tool failures engage
retry, doom-loop detection and circuit-breaking like native tool failures.
Co-authored-by: MervinPraison <[email protected]>
- Reset task status/result/retry_count/variables before each batch item so
run_task/arun_task actually re-execute (previously items 2..N returned the
first item's stale "completed" result).
- Snapshot task run state before the batch and restore it in finally, keeping
the public Task API backward-compatible.
- Validate each input is a dict: fail_fast raises ValueError, continue records
a per-item error instead of crashing.
- Add regression tests: two-item lifecycle reset, invalid-input handling.
Co-authored-by: Mervin Praison <[email protected]>
Match the injected manager_task by its actual task id (manager_task_id)
instead of its name in both sync and async hierarchical paths. A legitimate
user task named "manager_task" is no longer incorrectly rejected/hidden.
Also state 0-based ids in the manager schema and add regression coverage.
Co-authored-by: Mervin Praison <[email protected]>
The hierarchical manager could delegate to the injected manager_task because
validation only checked membership in self.tasks (which includes it) and the
schema field described task_id as "1-based" while runtime IDs are 0-based. As a
result the manager would self-select task_id=1 and the real user task never ran.
- manager_schema.py: task_id description now references the exact 0-based ids
and forbids selecting manager_task.
- process.py (sync + async): reject unknown ids AND manager_task; re-prompt with
only delegable (non-manager) task ids in the error context.
Co-authored-by: Dhivya-Bharathy <[email protected]>
When a Task sets output_pydantic (or output_json) but the agent returns
freeform prose, the task no longer silently succeeds with pydantic=None.
- default_completion_checker: structured output that was requested but not
produced is now treated as NOT complete, driving the existing retry loop
and leaving the task "failed" after retries instead of succeeding on prose.
- _process_task_result: use model_validate, include the schema name and the
underlying error in the warning, and return TaskResult(success=False) with
a clear error when structured output could not be produced. Raw output is
preserved for debugging.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Adds a lightweight map-over-inputs primitive that runs the same team once
per input dict, reusing the existing {{key}} `variables` interpolation
(per-run task copy => template immutability + isolation). Returns an
aggregate dict with per-item outcomes, ordered results, continue/fail_fast
error policy, and a batch token-usage rollup. No new heavy classes/modules.
Co-authored-by: Dhivya-Bharathy <[email protected]>
FunctionTool.get_schema was a near-verbatim copy of the inherited
BaseTool.get_schema producing byte-identical output. Since __init__
always sets _schema_override and parameters, the parent's hasattr guard
is always satisfied, making the override dead duplication. Removed it so
FunctionTool inherits BaseTool.get_schema, and dropped the now-unused
copy import.
Co-authored-by: MervinPraison <[email protected]>
Replace triplicated eight-field mapping in Agent.context_manager with a
single _manager_config_from_context_config helper. Pure DRY clean-up,
identical output for all input types (ContextConfig, preset string, dict).
Co-authored-by: MervinPraison <[email protected]>
- await awaitable on_event results so async callbacks actually run
- when a progress sink is passed, route through subprocess so SDK mode
never silently drops progress events
- replace vacuous stream test assertion with exact event equality
- add async-callback coverage
Co-authored-by: Mervin Praison <[email protected]>
ClaudeCodeIntegration.stream() built `claude -p --output-format stream-json`
without --verbose, which the CLI rejects, so it could never run -- and nothing
added --include-partial-messages, so no token/tool-use deltas were emitted.
_build_command now forces both flags for stream-json.
execute() gains an optional on_event/on_progress callback: when supplied, the
run is streamed and every parsed event (system/init, tool-use, text deltas,
result) is forwarded live so a caller or UI can show progress, while the final
result text is still returned. A failing progress sink never breaks the run.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Prefer as_dict(), fall back to dataclasses.asdict for a bare
GatewayStatus-shaped snapshot, and use json.dumps(default=str) so a
partially-populated or non-standard snapshot never dead-ends.
Co-authored-by: Mervin Praison <[email protected]>
Adds a lightweight, read-only introspection tool so an agent can inspect
and report its own live gateway state (run status, active-session
inventory, delivery/DLQ backlog, degraded owners) from inside a turn.
Mirrors the send_message / OutboundMessengerProtocol pattern: core ships
GatewayStatusProtocol + GatewayStatus snapshot shape and the built-in
gateway_status tool, which resolves the live source from the per-turn
session context (register_gateway_status). When no gateway is running,
the tool is simply not offered and fails cleanly. No Agent-class changes,
no new heavy dependencies; the concrete live binding belongs in the
praisonai-bot wrapper.
Co-authored-by: MervinPraison <[email protected]>
A non-numeric persisted command_timeout (e.g. a hand-edited "five") raised
ValueError at float(...) outside the command error handler, escaping the ticker
loop and breaking every other job. Normalise defensively in the executor:
non-numeric, non-positive, or non-finite values fall back to 60s and the job
still runs. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
- Fix CI: test_command_action.py used the deprecated
asyncio.get_event_loop().run_until_complete() which raises RuntimeError
on Python 3.10+ with no current loop. Switch to asyncio.run() to match
the sibling test_condition_gate.py / test_run_policy.py convention.
- Address Greptile P1 (memory): stream and cap command output as it is read
(bounded to _MAX_COMMAND_OUTPUT_CHARS) instead of buffering the full
stream via communicate(), so a chatty/runaway command in the long-running
gateway cannot exhaust memory. Timeout still kills the process group.
Co-authored-by: Mervin Praison <[email protected]>
Adds a model-free command action to scheduled jobs: a job carrying a
`command` runs that shell command on its schedule and delivers stdout
verbatim to its DeliveryTarget — no agent resolved, no model turn taken.
- core: `command`/`command_timeout` fields on `ScheduleJob` with
backward-compatible serialisation (persisted only when set).
- wrapper (praisonai-bot): executor runs the command off the event loop,
bounded by `command_timeout` and killed with its process group on POSIX
(mirrors ShellConditionGate); non-zero exit surfaces exit code + output;
output is bounded before verbatim delivery via the existing path.
- CLI: `praisonai schedule add --command/--script [--command-timeout]`.
Additive and backward-compatible: agent-driven jobs are untouched.
Co-authored-by: MervinPraison <[email protected]>
Non-numeric, non-finite (NaN/inf), or non-positive timeout_s values now
fall back to the 120s default and are clamped to a 3600s upper bound so a
model-controlled timeout can never undermine the tool's bounded-wait
"never a silent hang" guarantee (Greptile review, PR #3691).
Co-authored-by: Mervin Praison <[email protected]>
Adds an agent-callable request/reply tool that sends a prompt to a symbolic
target and awaits that target's next correlated reply, returning it into the
agent's turn. Unlike fire-and-deliver send_message, it always resolves to a
typed outcome (reply | timeout | undelivered | no_route) so a path never hangs
silently.
Core-only surface mirroring the existing send_message pattern:
- ConversationReply + ConversationReplyStatus + ConversationRequestProtocol in
gateway/protocols.py (protocol seam bound by the running gateway/bot).
- register/get/clear_conversation_requester context slot in session/context.py.
- ask_conversation tool in messaging_tools.py, reusing the send-policy guard
and cross-thread loop scheduling used by send_message.
Co-authored-by: MervinPraison <[email protected]>
Close two gaps where the read-only --plan contract silently downgraded:
- run --plan --profile: thread the resolved approval backend
(PermissionMode.PLAN) into _run_prompt_profiled and
_run_from_file_profiled so profiled runs stay permission-gated.
- code --plan REPL: the interactive worker's _build_agent now unpacks
args.agent_approval into Agent(**agent_extra_kwargs), matching the
single-prompt path, so REPL sessions deny mutating tools instead of
falling back to the legacy approval prompt.
Adds regression tests for both paths.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- run.py: move config + recorded-session model resolution ahead of the keyless
local-first credential gate so a resumed session on a reachable local endpoint
is no longer silently switched to the local model (Greptile/CodeRabbit).
- store.py: SessionData.from_dict now folds legacy top-level model/llm (mirrored
by to_dict) back into metadata so historical sessions recover their recorded
model on resume (CodeRabbit backward-compat).
- tests: add latest-turn-wins and legacy top-level normalization coverage.
Skipped async get_session_model accessor: no async consumer exists; only the
synchronous CLI resume path calls it, so it would be dead API surface (AGENTS.md).
Co-authored-by: Mervin Praison <[email protected]>
Add a first-class `--plan` boolean flag to `praisonai run` and `praisonai code`
that selects the existing read-only planning permission mode
(PermissionMode.PLAN). It maps onto the same approval plumbing as
`--approval plan` rather than a bespoke deny-set, so the agent may
explore/read/search while every mutating tool is denied.
Wrapper-only change: core (Agent(approval="plan")) and YAML (mode: plan)
already thread onto PermissionMode.PLAN, so no new enforcement logic or Agent
params are introduced. Contradictory permission flags fail closed.
Co-authored-by: MervinPraison <[email protected]>
Resume restored conversation history but not the model the session was
running: with no explicit --model, it re-resolved the current default, so a
change to the user's default between runs silently switched the model
mid-conversation. Now --continue/--session restore the recorded model
(explicit --model still wins and updates it going forward).
- core: add DefaultSessionStore.get_session_model() reading the session-level
metadata model, falling back to the latest turn's recorded model.
- wrapper: resolve and restore the recorded model in run_main before dispatch
when no model was chosen, with an info line noting the restored model.
Co-authored-by: MervinPraison <[email protected]>
install_hook()/_resolve_backend() were never called by any runtime path
(Greptile P1). Approval is already enforced via the adapter's
_resolve_agent_approval() -> Agent(approval=ApprovalConfig(...)) core gate,
so these methods were a redundant, untested, second before_tool enforcement
that would double-gate. Removing per AGENTS.md (no dead code with no live
consumer / duplicate behaviour). Tests unchanged and green.
Co-authored-by: Mervin Praison <[email protected]>
- praisonai_adapter: resolve YAML/CLI handoff {to:[roles],...} into core
Agent.handoffs after all agents exist, mapping timeout/max_depth/
max_concurrent/detect_cycles onto HandoffConfig. The --handoff family is
no longer silently dropped.
- _approval_spec.install_hook: replace the two TODO no-op stubs with real
backend dispatch (prompt via resolved backend, deny on rejection, fail
safe when no backend is available).
- auto.py: drop the duplicated LEGACY TOOLS block on the resolver-available
path (it repeated the installed tool list for zero information gain).
Co-authored-by: MervinPraison <[email protected]>
PR #3681 fixed the Windows cp1252 UnicodeEncodeError only in docker.py, but
the same bare-emoji print() crash remained in the other Python-API deploy
paths that also bypass the CLI's _configure_stdio() bootstrap:
- api.py foreground serve (🚀📁🔗💬)
- providers/aws.py, azure.py, gcp.py deploy/destroy (📦📝🚀🛑🗑️🔧🌍)
Replace them with ASCII [api]/[aws]/[azure]/[gcp] prefixes. cli/features
uses Rich console.print (encoding-safe) and is left unchanged.
Co-authored-by: Mervin Praison <[email protected]>
The praisonai-deploy Python API path (Deploy.deploy) bypasses the CLI's
UTF-8 stdio bootstrap from #3605, so bare emoji print() lines in docker.py
raised UnicodeEncodeError on default Windows cp1252 consoles and were masked
as "Docker build failed". Replace the six emoji status prints with portable
ASCII "[docker]" prefixes so both CLI and Python API paths are encoding-safe.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Addresses the two P1 findings from Greptile on PR #3679:
1. Secret-context capture reuse: definition_hash excluded env values, so a
capture whose setup baked env-derived state into the filesystem could be
reused across provisions with the same env names but different values. Add
capture_key() which binds env *values* and use it as the docker image tag /
reuse key; keep the value-free definition_hash only as a non-sensitive
display label in the registry.
2. Concurrent registry lost-update: registry.json read-modify-write was
unlocked. Add a best-effort fcntl file lock (no-op on non-POSIX) and route
capture/touch/prune through an atomic _update_registry() so concurrent
writers don't drop each other's entries. Image deletion in prune moved
outside the critical section.
Tests: +4 core capture_key tests, +3 docker tests (secret isolation, concurrent
preservation, definition label). 28 core + 10 docker tests green.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Amortise environment provisioning: after packages + setup: run once, the
docker backend commits the prepared container to a local image keyed by a
stable definition hash, and subsequent provisions of the same definition
start from that capture — skipping pull + install + setup.
Core (praisonaiagents):
- definition_hash(config): stable sha256 over image/packages/setup/env-names/
resources (env values excluded so secrets never enter the key).
- SupportsCapture optional protocol (default: backends without it stay ephemeral).
- Loader accepts refresh: and capture: keys (carried in metadata; no new
ComputeConfig field without a typed consumer).
Docker compute (praisonai wrapper):
- capture()/has_capture() via docker commit -> praisonai-env:{hash12}.
- Reuse-on-match; edited definition -> new hash -> full rebuild + new capture.
- refresh: runs only on capture-based starts (cheap incremental step).
- Registry ~/.praisonai/environments/registry.json + list_captures()/
prune_captures() age-based GC.
- Failed commit degrades to today's ephemeral behaviour with a log line.
managed_local.provision_compute carries capture metadata (refresh/capture)
from the definition to the backend.
Tests: definition-hash stable/sensitive + env-value exclusion; docker
capture+reuse skips setup; definition change invalidates; refresh on hit
only; capture failure degrades ephemeral; non-capturing no-op; registry GC.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
On a second .start()/.run() of the same AgentTeam, the prior run's
synthetic manager_task remains last in self.tasks, so the return-task
snapshot picked it and returned the previous Manager output instead of
the final user-task result. _last_hierarchical_task_id now walks tasks
in reverse and skips any manager_task, selecting the real final task.
Addresses Greptile P1 review on agents.py.
Co-authored-by: Mervin Praison <[email protected]>
- process="hierarchical": track the last real (user-supplied) task id before
the synthetic manager_task is injected, so .start()/.astart()/.run() return
the final delegated task's result instead of the Manager's own output.
- FileMemory/LearnManager: re-read the on-disk state before each write so two
instances sharing the same user_id no longer clobber each other's entries
(last-writer-wins fixed for short/long-term, entities, auto-promotion, learn
stores).
- Approval registry: scope the "already approved" cache key to the requesting
agent so one agent's approval can't silently pre-authorize an identical call
from a different, stricter agent in the same context.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Multi-agent gap review of the release pipeline surfaced 17 findings across
the gate, the workflow, and the bump script. This fixes the confirmed ones.
Gate (release-gate.js + nightly-release-gate.yml):
- A pypi-release run stuck in `waiting` (environment approval) blocked all
auto-releases with no age limit -- GitHub only auto-fails unapproved
deployments after 30 days, and exactly this stalled releases for 16h this
week. Waiting runs older than 6h are now ignored (with a warning linking
the run); in_progress/queued runs still block unconditionally, and the
stuck run is never cancelled -- if later approved, the concurrency group
serializes it and pypi_exists no-ops anything already published.
- PACKAGE_PATHS covered 3 of 9 published packages, so a change landing only
in e.g. praisonai-bot was never auto-released. Now lists all nine.
- The 3-day dedupe counted any successful run -- including dry_run=true,
which publishes nothing -- blocking real releases for 3 days after a dry
run. Dedupe now keys on v* GitHub releases, which only real releases create.
- The nightly path required last-green-Core-Tests SHA == HEAD exactly; a
docs-only or [skip ci] commit at the tip (the release safety-net commit
itself!) stalled the cron path indefinitely. A green ancestor with no
package-path changes since is now accepted.
- Replaced the dead 'Bump praisonai' workflow_run filter (those commits no
longer exist) with 'chore(release):', and wired the previously never-run
release-gate selftest into the gate as a step.
Workflow (pypi-release.yml):
- New `only` input: a dedicated single-package release is one dropdown pick
instead of eight skip flags. A "Resolve effective skips" step is the single
source of truth; the 19 publish/wait conditions are untouched (they gate
via the seeded pypi_exists outputs).
- PyPI existence probes now distinguish 404 (publish) from outages (fail the
run before anything is published) instead of treating any error as "not
published" and then dying on duplicate upload midway.
- The token-refresh step is continue-on-error and its consumer only swaps
tokens on success -- a failed re-mint previously overwrote a possibly-valid
token with an empty string, guaranteeing the safety net could not push.
- The safety net now (a) reverts uncommitted wrapper-side rewrites when the
wrapper release didn't complete, so a wrapper version that never reached
PyPI is not committed and then skipped past forever, and (b) retries
rebase+push 3x preferring the version bumps on conflict -- losing that
commit deadlocks future auto-releases ("already published" forever).
- "Verify PyPI versions" actually probes PyPI now; it previously echoed
checkmarks derived from input flags for publishes that may never have run.
- Dedicated releases get per-package tags (praisonai-mcp-v0.0.12) since the
wrapper's "Release v..." tag doesn't exist on that path; only packages
confirmed on PyPI are tagged.
- uv publish --check-url makes re-uploads idempotent (partial-upload
recovery); dry-run summary now includes sandbox/deploy and the effective
skip plan.
Bump script (bump_and_release.py):
- A conflicted `git pull --rebase` previously printed "trying to continue"
and proceeded from a mid-rebase detached HEAD -- tagging the wrong commit
and cascading conflict markers into the safety net. It now aborts, retries
preferring the release commit, and exits before pushing if that fails.
- Commit failures are no longer swallowed (only "nothing to commit" is
tolerated), so the tag can't silently point at the previous HEAD.
- `gh release create` is idempotent (view-then-create), unblocking reruns
after a transient failure between push and wrapper publish.
- Tag push is scoped to the release's own tag; `git push --tags -f` could
force-move historical tags.
Verified: node selftest (10 checks incl. new stale-waiting/dry-run-dedupe
cases), py_compile, YAML parse, actionlint (same 3 pre-existing SC2129
style warnings as main, nothing new), and the rebase-conflict retry logic
exercised against a scratch remote (bump wins, upstream commit preserved).
Co-Authored-By: Claude Fable 5 (1M context) <[email protected]>
Two existing tests asserted PraisonAIAgents raises ImportError (a v4
"removed" decision). Issue #3674 (owner) explicitly restores it as a
root-level silent alias for AgentTeam, which PR #3675 implements. Update
those tests to assert the restored back-compat contract instead.
Co-authored-by: Mervin Praison <[email protected]>
PraisonAIAgents was exported from praisonaiagents.agents but omitted from
the root lazy-import map and __all__, so `from praisonaiagents import
PraisonAIAgents` raised ImportError. Added it alongside its siblings and a
regression test covering all back-compat aliases.
Co-authored-by: MervinPraison <[email protected]>
Add functools.lru_cache to the pure model-capability predicates so the
same (model_name -> bool) result is computed once per process instead of
on every request/turn. Behaviour is unchanged: guards, litellm-None
fallbacks and except paths are all preserved, and keys are hashable
strings.
Co-authored-by: MervinPraison <[email protected]>
Addresses the three Greptile P1 findings on PR #3671:
- Wire load_environment_definition() into provision_compute() as an opt-in
baseline (explicit kwargs/instance config still win) so a committed
.praisonai/environment.yaml is actually applied.
- Validate nested config shapes in the loader so malformed values raise a
contextual ValueError (with file path) instead of incidental
AttributeError/TypeError.
- Tear down the just-started Docker container if package install or setup
fails, so a failed provision no longer leaks an unreachable container +
registry entry.
Co-authored-by: Mervin Praison <[email protected]>
Add the missing repo-committed environment definition joint: a lightweight
loader that maps .praisonai/environment.yaml onto the existing ComputeConfig
schema, plus the one new field (setup) with a live consumer.
- Core (praisonaiagents): ComputeConfig.setup: List[str]; load_environment_definition()
and find_environment_definition() (walks up like config discovery). YAML is
lazy-imported; unknown top-level keys raise ValueError with the file path.
network/backend preferences carried in existing typed fields (no new surface).
- Live consumer: docker compute provider runs setup commands once post-provision,
streamed to logs, with failures surfaced (raised) rather than swallowed.
- No file -> byte-identical behaviour (loader returns None; callers keep defaults).
Deliberately minimal per AGENTS.md (lightweight & powerful): no new CLI group,
no dispatcher rewrite, no SandboxConfig bridge, no RuntimeConfig remap.
Co-authored-by: MervinPraison <[email protected]>
Fix two valid reviewer (Greptile) findings in the research-writer example:
- The roles-file loader (praisonai_adapter._build_agents_and_tasks) sequences
tasks by declaration order and does not consume the top-level dependencies:
block; annotate agents.yaml and README to state this accurately.
- praisonai.run() is the Python API equivalent of the positional
`praisonai <agent_file>` CLI form (there is no `praisonai run <yaml>` CLI
subcommand for roles files); correct the README prose accordingly.
Docs/example only — no core SDK changes.
Co-authored-by: Mervin Praison <[email protected]>
The example passed topic via team.start(inputs=...), but AgentTeam.start
swallows **kwargs and never consumes `inputs`; interpolation reads only
task/team `variables` and replaces double-brace {{key}} placeholders.
Switch to AgentTeam(variables=...) with {{topic}} so the example actually
substitutes the topic instead of emitting a literal placeholder.
Co-authored-by: Mervin Praison <[email protected]>
Documents that Task.on_task_complete 2-param callbacks receive
(task_output, metadata) — NOT (task, task_output) like AgentTeam's hook.
Adds a copy-pasteable sequential human-review example and a regression
guard test. No new API surface (lightweight per AGENTS.md).
Co-authored-by: Dhivya-Bharathy <[email protected]>
Adds examples/yaml/teams/research-writer/ with a runnable single-file
agents.yaml (roles + nested tasks + dependencies) and README documenting
the existing praisonai run / AgentsGenerator loader path. No new core
modules or wrapper exports — examples/docs only, per the narrow scope.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Addresses Greptile finding: the lint guard scanned examples/ + internal
CLI but omitted src/praisonai-agents/tests, where this PR migrated an
AgentTeam(...) call (crewai-tools-example.py). Reintroducing verbose=
there would previously go undetected.
Adds a scoped _SCAN_FILES list covering the specific migrated file rather
than sweeping the entire tests tree (which holds ~40 unrelated legacy
scripts still using verbose=/max_iter= that are out of scope for this PR).
Co-authored-by: Mervin Praison <[email protected]>
- flat layout (drop src/) so `python -m <slug>.main` works from the
project root without an install step
- switch YAML placeholders to double-brace {{topic}} and pass
variables= to AgentTeam (start(inputs=) was silently dropped)
- reject Python keywords in slugify to avoid invalid imports
- update pyproject packages.find to flat include and extend tests
Co-authored-by: Mervin Praison <[email protected]>
The delegate_task tool documented a `timeout` param but discarded it,
letting delegated work block past its deadline (Greptile P1). Run the
synchronous subagent spawn on a bounded ThreadPoolExecutor and return a
structured timeout failure on expiry. timeout<=0 disables the bound.
No new params/exports; reuses existing create_subagent_tool runtime.
Co-authored-by: Mervin Praison <[email protected]>
The rich.table import was executed before the console None-check, so an
ImportError bubbled to the outer handler and showed the static model list
instead of the real catalogue. Guard the import so the plain-text table
renders the live catalogue when Rich is absent (greptile P2).
Co-authored-by: Mervin Praison <[email protected]>
- Reject empty/whitespace query in forget() to prevent broad LIKE '%%'
deletion of unrelated short-term and long-term records (Greptile P1)
- Scope query-based forget() to long_term to mirror remember()/recall()
- Fix test fixture to use sqlite provider (was 'none' -> in_memory)
- Add empty-query guard test
Co-authored-by: Mervin Praison <[email protected]>
AgentTeam.__init__ accepts neither verbose= nor **kwargs, so passing
verbose= raised TypeError at construction. Verbosity is controlled via the
consolidated output= param (silent/minimal/verbose) and iteration limits via
execution=. Migrated all internal CLI, template generators, and examples off
the removed verbose=/max_iter=/session= kwargs, and added an AST lint guard
that scans examples + internal CLI for invalid AgentTeam kwargs to prevent
regression.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Replace the always-failing stub in delegate_task with a call into the
existing create_subagent_tool runtime. A lightweight sub-Agent is spawned
(role derived from agent_type) to execute the task, preserving the JSON
response schema and the @require_approval(risk_level="medium") gate.
Co-authored-by: Dhivya-Bharathy <[email protected]>
praisonai models list crashed on Windows cp1252 consoles when Rich rendered
emoji (U+1F527 wrench) in the Capabilities column. Added stdout_supports_unicode()
helper and _capabilities_label() ASCII fallback, routed the table through the
encoding-aware output console, and applied the same guard to models describe/validate.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Adds thin, intuitive aliases over existing long-term store/search/delete
methods and makes Memory(config=...) optional so Memory() works standalone.
No new modules, dataclasses, exports, or backend changes; fully backward
compatible.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Define ManagerInstructions once at module level with extra="forbid" so the
generated JSON schema includes additionalProperties: false, which OpenAI's
strict structured-output API requires. Removes two duplicate inline class
definitions in process.py and adds a regression test.
Co-authored-by: Dhivya-Bharathy <[email protected]>
resolve_output and resolve_execution live in param_resolver.py, not
feature_configs.py. Split the test imports so resolver functions come
from param_resolver while config dataclasses stay in feature_configs.
Unblocks the entire praisonai-agents unit suite collection.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Address reviewer feedback on the local-first session mirror:
- set_chat_history now mirrors the replaced transcript (Session save_state
and bot session manager persist via this path, not add_message, so those
histories were never reaching the mirror). Records carry stable ids so a
re-append is idempotent last-writer per id — the append-only shape the
mirror expects.
- _SessionMirrorWriter.enqueue drops-to-log after close() instead of
silently queuing records with no running consumer.
- The mirror writer thread is now started AFTER os.makedirs so a failed
construction on an unusable session dir never leaks an idle daemon thread.
Adds tests for all three; full session suite (123 tests) green.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Adds the core, unblocked half of session sync: a tiny SessionMirrorProtocol
(append/load/list_sessions) plus an optional mirror= on DefaultSessionStore
that appends persisted records to the mirror on a bounded background thread.
Local-first: the local write always happens first and a mirror outage never
blocks, fails, or corrupts a turn. Zero overhead / no thread when unset.
Heavy backend adapters + `session sync` CLI are deferred to the wrapper and
depend on the store-unification sibling (#3645, not yet merged).
Co-authored-by: MervinPraison <[email protected]>
- protocols.py: LocalTurnLock.release() now identity-checked via a per-key
holder map so a stale/duplicate token can never release a waiter's lease
(fixes concurrent-turns-on-one-session race). Add type-only asyncio import
under TYPE_CHECKING to resolve the 'asyncio.Lock' annotations (F821).
- config.py: reject NaN ttl (not self.ttl > 0); from_dict tolerates explicit
YAML nulls for backend/ttl via the 'or default' idiom.
- tests: add stale-token release regression, NaN-ttl rejection, null-tolerant
from_dict; make same/distinct-session concurrency tests deterministic with
asyncio.Event barriers (3.10-safe, no Barrier).
Co-authored-by: Mervin Praison <[email protected]>
UnifiedSessionStore hardcoded ~/.praison/sessions/ while every other CLI
surface reads/writes the canonical ~/.praisonai/sessions/ root via
paths.get_sessions_dir(). This made `praisonai code` conversations live in
a separate directory, invisible to `session list/show/export` and the
dashboard.
Resolve the default sessions directory from the canonical paths helper
(with a safe fallback to the legacy path if the helper is unavailable), so
code sessions land under the shared root. Explicit session_dir overrides
and the backward-compatible DEFAULT_SESSION_DIR attribute are preserved.
Co-authored-by: MervinPraison <[email protected]>
Turn serialisation is enforced by an in-process asyncio.Lock (LockMap) that
cannot see across processes/hosts, so a horizontally-scaled gateway
(replicas > 1) runs concurrent turns on one session — corrupting the shared
transcript, tripping provider strict-alternation, duplicating replies and
double-billing.
Add a pure, dependency-free TurnLockProtocol + TurnLeaseToken and a zero-cost
in-process LocalTurnLock default to core gateway protocols, plus a TurnLockConfig
selector wired into GatewayConfig (Python + YAML). The "local" default reproduces
today's asyncio.Lock behaviour byte-for-byte (single-replica unchanged, no new
dependency); "redis" is the seam for a distributed lease implementation in the
wrapper/bot package (reusing RedisConfig + the scheduler's owner+TTL pattern).
Mirrors how every other gateway robustness knob (drain, admission, rate-limit,
liveness, dead-letter) is a swappable pure protocol in core.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings (CodeRabbit, Greptile) on PR #3641:
- Plumb the gateway's real bind host into enable_shell_tools via a new
keyword-only gateway_bind_host param. Production callers construct a
per-channel BotConfig that never carried the bind host, so an externally
bound (0.0.0.0) gateway was invisible to the exposure downgrade. The
gateway now passes self.config.bind_host / self._host explicitly.
- Treat every configured group_policy (including command_only) as a
multi-user surface: a group member's command can reach execute_command,
so blanket auto-approve must downgrade to approval.
- Call callable host accessors (e.g. GatewayServer.host) before
stringifying so is_loopback classifies loopback deployments correctly.
- Add tests for command_only downgrade, explicit external/loopback
gateway_bind_host, and callable host accessor resolution.
Co-authored-by: Mervin Praison <[email protected]>
- Keep DegradedCapabilityProtocol unchanged (mark/clear/list_degraded); move
find() onto new DegradedCapabilityLookupProtocol so existing external
registries retain structural isinstance conformance.
- Module guard falls back to list_degraded() when a legacy registry lacks both
the guard and find(), failing-closed instead of raising AttributeError.
- Export DegradedCapabilityLookupProtocol.
- Fix Ruff B015 pointless-comparison in no-op guard tests (assert ... is None).
- Add legacy-registry coverage for base/lookup protocol conformance and the
list_degraded() fallback.
Co-authored-by: Mervin Praison <[email protected]>
Complete the degraded-owner contract's read side (Issue #3518) by adding
the core fail-closed primitive so a request targeting a degraded owner
short-circuits to a typed, redacted "unavailable — next action" outcome
instead of proceeding and failing silently.
Adds to praisonaiagents/gateway/degraded_state.py:
- OwnerUnavailable exception carrying only DegradedOwner's redacted fields
- DegradedCapabilityRegistry.find() point read
- DegradedCapabilityRegistry.assert_owner_available() guard
- module-level assert_owner_available() no-op-safe for an optional registry
Exports both from praisonaiagents.gateway and covers with unit tests.
Co-authored-by: Mervin Praison <[email protected]>
Blanket auto_approve_shell now degrades to explicit approval when the
gateway binds to a non-loopback interface or the channel is a
multi-user/group surface, mirroring the auth token's assert_external_bind_safe
posture. Operators can opt back into blanket auto-approve with
auto_approve_shell_acknowledge_exposed: true.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #3638:
- Loop detection & loop guard now observe the FULL tool result; the compact
model-facing view is swapped in only right before return, so a stable
compact summary no longer masks progressing polls as no-progress loops.
- The compact override now passes through wrap_if_external, so external/
untrusted model_output cannot bypass the prompt-injection fence.
- Model-facing annotations (AFTER_TOOL additional_context, loop-guard notices)
are re-applied to the compact view so they always reach the model.
- Unified the to_model_output hook contract (receives the output value in both
safe_run and the executor) and guarded it in safe_run so a failing builder
degrades to full output instead of corrupting a successful result.
- Corrected resolve_model_output docstring to match implementation.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #3637:
- save_session_state now returns the SessionStore bool result so a silent
False (serialisation/disk failure) no longer reports success to callers.
- Tests use pytest tmp_path (no leaked temp dirs) and verify cross-instance
durability via a separate DefaultSessionStore over the same directory.
Co-authored-by: Mervin Praison <[email protected]>
Add an optional, backward-compatible way for tools to feed the LLM a
compact summary while keeping the full result for display/hooks/tracing:
- ToolResult(model_output=...) compact view + resolve_model_output helper
- BaseTool.to_model_output(result) override, wired through safe_run
- @tool(to_model_output=fn) on the decorator / FunctionTool
- tool_execution.py resolves the compact view and swaps it in for the
model only after tracing + AFTER_TOOL hooks saw the full payload
No override => unchanged behaviour (model sees full output).
Co-authored-by: MervinPraison <[email protected]>
Route AgentTeam.save_session_state/restore_session_state through the
durable, project-scoped SessionStore (the same store single-Agent
--continue uses), keyed deterministically by session_id via
update_session_metadata/get_session. This removes the fuzzy
search_short_term(limit=10) lookup and the memory-gating: multi-agent
runs now resume deterministically even with memory=False.
shared_memory is demoted to optional enrichment, and the legacy
semantic lookup is kept only as a fallback for pre-existing sessions,
preserving full backward compatibility. No new params or exports.
Co-authored-by: MervinPraison <[email protected]>
- _resolve_framework gains require_workflow: WorkflowAutoGenerator now
rejects an installed-but-non-workflow default (e.g. when native praisonai
is absent) instead of emitting a workflow YAML AgentsGenerator would later
reject (Greptile/CodeRabbit P1).
- PushClient.supports_publish now also requires an active connection, closing
the disconnected/pre-connect false-positive that let gated producer calls
proceed and fail with ConnectionError (Greptile P1).
- Tests: _fake_registry sets SUPPORTS_WORKFLOW; framework-resolution tests now
assert exact create()/pick_default() interactions (CodeRabbit).
Co-authored-by: Mervin Praison <[email protected]>
- agents_generator: let FileNotFoundError bubble from _load_config and drop
the `if config is None: return` guards so run/arun/serve raise instead of
returning a silent None for a missing agent file.
- auto: add BaseAutoGenerator._resolve_framework and route both AutoGenerator
and WorkflowAutoGenerator through registry.pick_default() with adapter
validation, so defaults and validation are a single source of truth.
- push: PollingTransport.send now raises NotImplementedError for unmapped
message types (publish/create/presence) instead of silently dropping them;
PushClient logs the capability loss on fallback and exposes supports_publish.
Co-authored-by: MervinPraison <[email protected]>
- read-only policy preset now denies real dangerous tool names
(tool:write_*/delete_* + *_write*/*_delete* globs) instead of
patterns that never match the SDK's own tools
- LLMGuardrail._llm_validate recognizes the SDK's LLM.get_response
interface, so string/LLM-instance guardrails validate instead of
silently failing closed on every call
- iter_stream warns when an output guardrail is attached, since
token-level streaming cannot retroactively validate output
Co-authored-by: MervinPraison <[email protected]>
Strengthen test_generate_dockerfile_includes_gunicorn_timeout per reviewer
feedback (Greptile/CodeRabbit): bare "--timeout" substring also matched the
HEALTHCHECK --timeout=10s option, so a malformed CMD could pass. Now assert
the exact option-value pairs in the generated Gunicorn command.
Co-authored-by: Mervin Praison <[email protected]>
Agent LLM workloads (cold import + first model round-trip) routinely
exceed Gunicorn's 30s default worker timeout, causing the worker to be
SIGKILL'd mid-request on the first /chat call. Add explicit --timeout 120
and --graceful-timeout 30 to the generated CMD.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Collapsing the release to a single commit (#3572) removed the per-package
"Bump praisonai-mcp to 0.0.12" commits. On a full release that is fine --
the wrapper's "Release v<x.y.z>" commit describes the whole batch. But a
single-package release (every other skip_* set, including skip_wrapper)
never reaches the wrapper, so its bump lands via the safety-net step and
was labelled with the generic "persist version bumps".
Derive the package list from the staged paths so that case reads
"chore(release): bump praisonai-mcp [skip ci]" instead. Falls back to the
generic message when nothing under src/ is staged.
Verified the extraction against a scratch repo: single package, multiple
packages, and the no-src fallback.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Address reviewer feedback on the memoisation:
- Replace unbounded functools.lru_cache with a WeakKeyDictionary so cached
bound methods no longer keep their owning Agent alive (memory leak in
long-lived processes creating many short-lived agents).
- Fall back to direct signature inspection for unhashable/unweakreferenceable
callables (e.g. objects with __hash__ = None) instead of raising TypeError,
preserving correct 3-arg tool dispatch.
- Drop now-unused functools import.
Co-authored-by: Mervin Praison <[email protected]>
Cache the inspect.signature() on_progress-kwarg probe on the callable so it
runs once per dispatcher callable instead of once per tool call. execute_tool_fn
is invariant per agent, so the memoised result is identical. The
(TypeError, ValueError) fallback for non-introspectable built-in/C callables is
preserved. No behaviour or API change.
Co-authored-by: MervinPraison <[email protected]>
Addresses the three P1 reviewer findings on PR #3624:
- telegram.py: streaming branch now calls _maybe_send_voice_reply after
finalize, so voice.mode always/match_inbound is honoured when streaming
is enabled (previously text-only).
- gateway/server.py: the Telegram handler serving VOICE|AUDIO now threads
inbound_was_voice into _send_response_with_media, so match_inbound fires
for gateway-owned channels.
- tools/audio.py + bots/_tts.py: forward configured voice.speed through
tts_tool -> AudioAgent.speech (previously dropped).
- tests: update fake tts_tool signature and add speed-forwarding regression.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Adds a first-class, opt-in outbound voice-reply path mirroring the existing
inbound `stt` setting. New `bots/_tts.py` provides TtsConfig,
resolve_tts_config, should_voice_reply and synthesize_voice_reply (reusing
tools.audio.tts_tool so heavy TTS deps stay in tools). A TtsConfigSchema +
`voice` channel field give tri-surface (YAML/metadata) parity with `stt`,
carried through config.metadata by the gateway. Telegram wired as the
reference consumer: replies are spoken per the off/always/match_inbound mode,
degrading cleanly to the already-sent text on failure.
Co-authored-by: Mervin Praison <[email protected]>
Address the three Greptile P1 findings on PR #3622:
- Channel system_prompt_hint now reaches the model: inject into
backstory + rebuild system_prompt (the consumed prompt fields) instead
of the construction-only `instructions` attribute, which the runtime
prompt builder never re-reads. Idempotent and cache-stable.
- empty_final override is now reachable via the existing BotConfig.metadata
seam (no new typed knob); direct attribute still honoured for callers.
- Inbound crash-replay docstring/log corrected to state its real effect
(unblock stranded claimed rows so redelivery / session-resume can
reprocess) rather than over-claiming standalone re-drive, which is
already owned by _resume_interrupted_turns (#3379).
Co-authored-by: Mervin Praison <[email protected]>
Gap 1 — visible-outcome guarantee for empty finals: add a dependency-free
core classifier praisonaiagents.bots.silence.classify_final() that separates
deliberate silence from a blank/whitespace/[tool_calls: …] final, and resolve
"empty, not silence" once at the shared fire_message_sending funnel with a
recorded, typed fallback (operator log; optional empty_final_message config).
Every adapter (Slack/Telegram/etc.) now delivers a visible outcome instead of
silently dropping, DLQ-parking an empty send, or leaking a machine placeholder.
Gap 2 — wire the dead system_prompt_hint seam: inject a channel's declared
system_prompt_hint into the per-channel cloned agent's instructions via the
already-existing get_channel_system_prompt_hint() helper (the missing caller),
bounded and prompt-cache-stable. No-op for built-ins; third-party channels can
now teach the agent their constraints as the ChannelDescriptor contract states.
Gap 3 — invoke un-wired inbound crash-replay: call InboundJournal.replay() at
channel start-up (and hot-reload) so an inbound stranded 'claimed' by a crash
is re-driven exactly-once on the default-durable path, honouring the module's
own durability contract. Replayed counts are logged for operator visibility.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Fix NameError regression: _run_custom_agent referenced an undefined
`instructions` var (broke test-core cli suite). Add the param and thread
merged_instructions from the caller so the --agent path injects declared
instruction sources into the backstory.
- Forward merged_instructions on the --command path and skip the warm-runtime
attach when instructions are present (per-invocation context can't cross the
runtime process boundary), so declared instructions are no longer dropped.
- SSRF guard for remote instruction URLs: reject private/loopback/link-local/
reserved destinations and re-validate redirects, matching the existing
managed-config resolver policy. Opt-out via PRAISONAI_INSTRUCTIONS_ALLOW_LOCAL_URLS.
- Add regression tests for custom-agent instruction injection and the SSRF guard.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
PraisonAI.main() replaces args via parse_args() and previously carried
over only session fields, silently dropping the approval/permission
settings that the YAML run path threads onto praison.args. YAML workflows
launched with --approval/--approve-all-tools/--approval-timeout or
--allow/--deny (which derive a console backend) therefore bypassed the
approval gate. Preserve these fields unconditionally across the reparse,
independently of session flags (--no-save sets approval but not
cli_project_sessions). Adds regression tests exercising the real main()
preservation boundary.
Co-authored-by: Mervin Praison <[email protected]>
Adds a wrapper-level `instructions` config key and repeatable
`run --instructions <path|glob|url>` flag so teams can declare extra
instruction/context sources (files, globs, ~ paths, http(s):// URLs)
loaded alongside the convention-only AGENTS.md/CLAUDE.md auto-load.
- context_files: resolve_instruction_sources() expands globs/~, reads
local files, and lazily fetches remote URLs (stdlib urllib, size-bounded,
best-effort with warnings) — no new heavy deps.
- run.py: resolve config `instructions` (layer-concat via the existing
ConfigResolver list-merge), merge repeatable --instructions on top, and
inject up front into the agent backstory via the existing subtree-context
hook (passed as already_loaded to dedup nested files).
- schema: add `instructions` to config_hierarchy CONFIG_SCHEMA and the
resolver's KNOWN_TOP_LEVEL_KEYS (so it validates and is not warned).
Wrapper-only; no core changes, no new Agent params.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Thread the existing --approval/--approve-all-tools/--approval-timeout and --allow/--deny/--permissions rules from praisonai run workflow.yaml into the YAML engine args so YAML agents are permission-gated exactly like single-agent run. Session continuity and structured --output already flow through _run_from_file; no new engine wiring or core changes are added.
Co-authored-by: MervinPraison <[email protected]>
The write tools resolved the symlink only inside is_protected() but then
open()'d the original path, so (a) an in-workspace symlink to an out-of-
workspace file bypassed the workspace-confinement check and (b) a symlink
retargeted between check and write could redirect an approved edit into a
protected file. Add security.resolve_real_path() and resolve abs_path once
in write_file/append/apply_diff/search_replace so the protection check,
workspace-confinement check and the actual read/write all act on the same
real target. New files are unaffected (realpath returns the path unchanged).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
1. Call/agent-invoke server auth: constant-time token compare via
hmac.compare_digest; media-stream no longer carries the shared server
token in the URL (mints a one-shot, TTL-bound session token instead);
guard active_connections/client_ips mutations with asyncio locks to
close the async TOCTOU on the rate/connection limits.
2. Protected-path guard: resolve symlinks in is_protected /
get_protection_reason so a same-directory symlink to .env is no longer
treated as harmless (bypass fix; centralised so all writers inherit it).
3. run_python: pass code as an argv list to subprocess.run instead of
building a shell-quoted string re-tokenised by shlex, preserving the
caller's exact source (newlines/backslashes/quotes) on POSIX and Windows.
Co-authored-by: MervinPraison <[email protected]>
Cloud providers shell out to external CLIs and never generate the API
server, so the parsed deploy.api config had no live consumer and was
silently ignored. Remove it to avoid misleading config (per reviewer
feedback from CodeRabbit/Greptile). Docker path already honors the
sibling api block; add runtime tests asserting PRAISONAI_API_AUTH is
propagated when auth_enabled: false and omitted otherwise.
Co-authored-by: Mervin Praison <[email protected]>
Docker deploy ignored the optional sibling `deploy.api` block, so
`auth_enabled: false` was silently dropped and the generated server
defaulted auth on, returning 401 on /chat.
- schema.py: parse optional `deploy.api` for type docker and cloud
- main.py: pass PRAISONAI_API_AUTH=disabled to container when disabled
- add unit test + update example agents-docker.yaml
Co-authored-by: Dhivya-Bharathy <[email protected]>
The @require_approval decorator now keys approvals on the tool's effective
arguments, so a bare mark_approved(name) no longer unlocks arbitrary-value
positional calls (the sticky-cache bypass this PR closes). Update the test to
mark/check with the same args the calls use, preserving the mark->call intent
without weakening the security guarantee.
Co-authored-by: Mervin Praison <[email protected]>
The require_approval decorator only keyed approvals on kwargs, so
directly-invoked decorated tools called positionally (read_file("/a"))
all collapsed to the same empty-argument key — one approval unlocked any
later positional value. Bind positional + keyword args into a normalized
dict via the function signature so the approval key reflects the actual
call. Falls back to an __args__ tuple for C-callables without a bindable
signature. Adds regression tests.
Co-authored-by: Mervin Praison <[email protected]>
- approval: thread `arguments` through mark_approved/is_already_approved,
the require_approval decorator wrappers, and the Agent tool path so a
single approval no longer permanently unlocks a tool for any later
attacker-chosen arguments (safe-by-default).
- agent memory: stop defaulting to the shared constant "praison"/"default";
when memory is enabled without an explicit user_id, generate a per-instance
non-shared id and warn, preventing silent cross-session memory merges.
Co-authored-by: MervinPraison <[email protected]>
- _kill_pid now returns result.returncode == 0 on Windows and catches OSError
- _destroy_api returns success=False with failed PIDs when any kill fails
- tests: mock zero returncode, add nonzero-taskkill and partial-kill cases
Co-authored-by: Mervin Praison <[email protected]>
Add regression coverage for the separate _configure_stdio() helper in
__main__.main(), asserting utf-8 + errors="replace" are applied before app
dispatch, plus a no-op safety case. Also assert errors=="replace" in the
existing deploy._configure_stdio test.
Co-authored-by: Mervin Praison <[email protected]>
Replace Unix-only lsof in _destroy_api() with cross-platform port
discovery (netstat -ano on Windows, lsof on Unix) and cross-platform
process termination (taskkill on Windows, SIGTERM on Unix). Prevents
orphaned Flask API servers on Windows after destroy.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Windows default consoles use cp1252, which cannot encode the emoji banner
prefixes emitted by the deploy CLI, causing UnicodeEncodeError on every
command. Reuse the established _configure_stdio() pattern from
praisonai-browser to reconfigure stdout/stderr to UTF-8 (errors=replace)
at both the praisonai-deploy console entry and the praisonai deploy bridge
entry (handle_deploy_command).
Co-authored-by: Dhivya-Bharathy <[email protected]>
Replace NamedTemporaryFile + os.unlink pattern with pytest tmp_path fixture
to avoid PermissionError [WinError 32] on Windows where the file handle
cannot be deleted while still open inside the context manager.
Co-authored-by: Dhivya-Bharathy <[email protected]>
The generated Flask API server was spawned with a bare 'python' which
resolves to a different interpreter than the parent venv on Windows and
multi-Python setups, causing ModuleNotFoundError: No module named 'flask'.
Spawn with sys.executable and preserve the parent environment so the child
inherits Flask and OPENAI_API_KEY for /chat.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Extract the triplicated "build a ToolResolver, bucket its
list_available_sources(), then fall back to a TOOL_MAPPINGS +
praisonai_tools scan" helper into one internal module
templates/_tool_sources.py. tools.py, tools_doctor.py and
dependency_checker.py now call the shared helper; per-module
presentation stays local so output is byte-identical.
Co-authored-by: MervinPraison <[email protected]>
Add a pure next_fire_time(cron_expr, base) helper in
praisonaiagents.scheduler.due as the single owner of the "compute next
cron fire from a base" step. Core is_due and the wrapper's
ScheduleTicker.is_due now both call it, removing the duplicated
croniter().get_next(float) logic from the wrapper. No behaviour or API
change; croniter-missing graceful degradation preserved.
Co-authored-by: MervinPraison <[email protected]>
Address final-review findings on the durable-write salvage path:
- spill filenames add a random token so consecutive same-ms/PID
failures no longer overwrite each other (no lost turns)
- _reingest_spill runs _enforce_window before persisting so recovered
turns respect the retention policy like any ordinary write
- guard spill payload shape (non-object root / non-list messages /
non-object message) so a malformed spill can't block recovery
Co-authored-by: Mervin Praison <[email protected]>
When a durable session write fails (disk-full / SQLite-FTS corruption /
permission OSError) the store previously collapsed it to a silent False that
no caller reads, so the already-produced turn lived only in the in-memory
cache and was permanently lost on the next shutdown/crash — with no operator
signal.
This adds a safe-by-default, stdlib-only salvage path in the core session
store that triggers only on the failure path (no hot-path regression):
- New SESSION_PERSIST_FAILED lifecycle hook + SessionPersistFailedInput so a
failed durable write is observable (metrics/alerting/forensics), mirroring
the outbound MESSAGE_UNDELIVERED posture.
- On write failure, spill the unpersisted turn to an atomic fallback file
(~/.praisonai/state/session_spill/*.json, 0600, temp-file + os.replace +
best-effort dir fsync) instead of holding it only in memory.
- On session load, re-ingest any spilled turns (dedup on role+content+
timestamp), persist them back, and delete each spill file only after a
successful re-insert.
No new Agent params, no new dependencies, no behaviour change on the happy
path. Adds 6 unit tests.
Co-authored-by: MervinPraison <[email protected]>
Flipping SessionConfig.persist to True (durable-by-default) exposed two
latent bugs that the prior off-by-default masked:
1. CLI opt-out ignored: the multi-bot CLI builds WebSocketGateway with a
default session config, so __init__ selected a persistent store before
start_with_config loaded the YAML — and that loader never read the
session: block. A documented session.persist: false was silently ignored.
Fix: start_with_config now re-reads the session: block and re-selects the
store (unless an explicit store was passed to the constructor).
2. Startup crash on unwritable home: SqliteTranscriptStore/DefaultSessionStore
eagerly makedirs(~/.praisonai/sessions); on a read-only/absent home both
the primary store and its fallback raised, escaping __init__ and crashing
the gateway. Fix: the store selection now degrades to in-memory sessions
instead of aborting startup.
Store-selection logic extracted into a shared _build_session_store helper so
__init__ and start_with_config pick identically. Adds regression tests for
the opt-out, the explicit-store precedence, and from_dict persist defaults.
Co-authored-by: Mervin Praison <[email protected]>
fallback_text() unconditionally imported table_to_markdown/chart_to_text
and referenced BlockType.TABLE/CHART, which raised ImportError/AttributeError
on praisonaiagents releases predating those symbols (bot pins >=1.6.152) —
breaking fallback delivery even for text-only presentations.
- Import the two new helpers defensively with inline fallbacks
- Dispatch table/chart blocks via string block-type values (getattr-guarded)
Co-authored-by: Mervin Praison <[email protected]>
Add TABLE and CHART members to the portable presentation vocabulary so
agents can describe tabular and chart data once and have each channel
render it natively where supported or degrade deterministically to a
markdown table / compact text summary elsewhere.
- BlockType.TABLE / BlockType.CHART + PresentationBlock.make_table/make_chart
- columns/rows/chart_kind/series fields with dict round-trip
- PresentationLimits: supports_tables/supports_charts + max_table_rows/cols
- adapt_presentation clamps and degrades table/chart per capability flags
- table_to_markdown/chart_to_text helpers (exported) + fallback_text branch
Co-authored-by: MervinPraison <[email protected]>
Flip SessionConfig.persist from False to True so an out-of-box gateway
remembers conversations across restarts via the existing SQLite
transcript store. Updates the two YAML-parse fallbacks to match. Users
who want ephemeral sessions can still opt out with session.persist: false.
Co-authored-by: MervinPraison <[email protected]>
The previous approach replaced the bash:<command> approval target with a
shell:external-path:<path> target for out-of-workspace commands. This both
broke command-specific deny rules (a hard `deny: bash:rm *` no longer matched,
regressing DENY -> ASK and letting a user approve a denied command) and
collided with the existing `shell:` shell-prefix namespace in
PermissionManager.check().
The out-of-workspace boundary is already fully implemented in
PermissionManager (`_check_shell_command` + `_external_dir_target`): with a
workspace_root configured, a broad `bash:*` allow escalates external paths to
ASK while a command-specific deny still fires. build_permission_target now
keeps the verbatim `bash:<command>` target so that machinery applies and
command identity is preserved.
- approval/utils.py: drop the redundant shell:external-path namespace and the
_shell_external_paths helper; shell tools map back to bash:<command>.
- tests: replace target-mangling assertions with boundary-enforcement tests
that verify (a) broad bash:* does not cover external paths, (b) in-workspace
stays allowed, (c) command-specific deny still fires on external paths, and
(d) backward-compat with no workspace_root.
Fixes the deny-bypass flagged by Greptile and CodeRabbit.
Co-authored-by: Mervin Praison <[email protected]>
- share: atomic temp-file write + os.replace so a failed/interrupted
write never truncates a previously published transcript
- share/unshare: guard OSError (unwritable/full data home) as clean
command errors with chained context instead of raw tracebacks
- unshare: unlink unconditionally, treat FileNotFoundError as an
idempotent no-op (fixes concurrent-deletion race + ruff B904)
- soften overstated 'always redacts secrets' copy to accurate
best-effort wording (redactor #3426 is high-signal/best-effort)
- test: isolate test_share_path_is_stable_per_session via project fixture
Co-authored-by: Mervin Praison <[email protected]>
Adds `praisonai session share <id>` / `unshare <id>` to the CLI. `share`
reuses the existing session resolver + transcript redactor to publish a
single self-contained HTML transcript to ~/.praisonai/shares and returns a
file:// link; `unshare` revokes it. Zero external infrastructure or new
dependencies; sharing is opt-in and always redacts secrets first.
Co-authored-by: MervinPraison <[email protected]>
Make build_permission_target emit a distinct shell:external-path:<path>
target when a shell command touches a path outside the workspace root,
so a broad bash:*/"allow shell"/session grant cannot silently authorise
out-of-workspace access. Reuses the existing command_parser and
path_safety.resolve_within_root primitives (no new modules/params).
Default-on and fail-closed, with a PRAISONAI_SHELL_WORKSPACE_BOUNDARY
opt-out for trusted sandboxed/CI runs.
Co-authored-by: MervinPraison <[email protected]>
_TimeoutBoundTool was a plain proxy that did not subclass the wrapped tool's
class, so isinstance(proxy, BaseTool) returned False. Downstream executors
(praisonaiagents tool_execution, CrewAI/LangChain) route on that isinstance
check to call .run; the proxy failed it and, being non-callable, also skipped
the generic callable branch -> a BaseTool plugin tool with tool_timeout set
silently executed nothing.
Build the proxy as an instance of a dynamic subclass of type(inner) so
isinstance keeps passing (verified for praisonaiagents BaseTool and pydantic
CrewAI/LangChain-style tools) while still never mutating the shared inner
object and still routing _run/run through the per-generator timeout wrapper.
Added regression tests for isinstance/schema preservation and cross-generator
executor isolation.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: create_unified_app now enforces the api_key via the shared
_api_auth middleware (previously accepted but never referenced), and
serve unified refuses to bind a non-localhost host without an API key,
mirroring serve agents.
Gap 2: tool timeout wrapping no longer mutates shared framework tool
objects in place; each generator installs its own _TimeoutBoundTool
proxy that delegates schema attributes but routes _run/run through its
own executor. Owner identity is a stable per-generator uuid compared by
value, so the idempotency guard actually matches.
Gap 3: resume_or_create_session accepts a create_session dispatcher; the
orchestrator routes it through _sync so async conversation stores have
their create-session coroutine awaited instead of silently dropped.
Co-authored-by: MervinPraison <[email protected]>
Replace the fixed .tmp.<pid> temp filename with tempfile.mkstemp so
concurrent writers in the same process (multiple threads or FileMemory
instances writing the same file) cannot clobber each other's temp file,
where the first os.replace would remove the temp the sibling still needs.
Matches the atomic-write convention used elsewhere in the SDK
(storage/base.py, session/store.py). Addresses Greptile P1.
Co-authored-by: Mervin Praison <[email protected]>
- agents.py: add _gather_with_isolation so a failing async task no longer
orphans its siblings; siblings are awaited to completion and the first
exception is re-raised (return_exceptions=True) across all 3 gather sites.
- handoff.py: guard finally:_pop_handoff() with a `pushed` flag at all 5
call sites so a _check_safety rejection (which raises before _push_handoff)
no longer pops an ancestor's entry and corrupts the cycle/depth guard.
- file_memory.py: write JSON to a temp file + fsync + os.replace so a crash
mid-write can no longer truncate the persisted memory store.
Co-authored-by: MervinPraison <[email protected]>
Delete create_autogen_tool_function() and the 17 generated autogen_<Tool>
symbols plus their __all__ from inbuilt_tools/autogen_tools.py. Their only
consumer, ToolRegistry.register_builtin_autogen_adapters(), was removed in
the #1590 fix; the canonical AutoGen path is framework_adapters/autogen_adapter.py.
Keeps the praisonai_tools availability probe that feeds PRAISONAI_TOOLS_AVAILABLE
and the release `import *` smoke test.
Co-authored-by: Mervin Praison <[email protected]>
Address the three P1 findings on the declarative webhook channel:
- Gateway wiring: add a `webhook` branch to WebSocketGateway._create_bot and
recognize WebhookBot in the supervisor's own-aiohttp-server start branch, so a
`type: webhook` YAML channel actually constructs and starts (was silently
skipped by the hardcoded adapter switch). Guard _inject_routing_handler for
ingress channels without an on_message hook.
- Fail-loud dispatch: the HTTP handler now returns 500 when agent dispatch
raises, so providers retry instead of receiving a false 200 ack.
- Durable ingress id: fall back to a deterministic sha256(path + raw_body) when
no delivery header is present, keeping ingress journaling/dedup active for
generic senders (an empty message_id disabled both).
Adds tests for 500-on-failure, delivery-header and body-hash message ids, and
gateway construction of the webhook adapter.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Add a first-class `webhook` gateway channel that turns any HTTP event into an
agent trigger through configuration alone — no bespoke adapter code.
- core (praisonaiagents.bots): a small, import-light declarative filter
(WebhookFilter + evaluate_webhook_filter/resolve_field) with all/any/not
combinators and exists/equals/contains/in/regex leaf operators. Pure logic,
no HTTP, fail-safe on malformed input.
- wrapper (praisonai-bot): WebhookBot HTTP-ingress adapter + WebhookRoute,
reusing existing HmacWebhookVerifier / enforce_webhook_verification, the
aiohttp server pattern, and BotSessionManager (durable dedup ingress). Adds
prompt templating ({{ dotted.path }}) and a silent (ack-only) route.
- register `webhook` as a built-in loader in the channel registry.
Reuses existing primitives and ChannelRouteConfig.metadata; no core config
schema change or new Agent params.
Co-authored-by: MervinPraison <[email protected]>
Route WebSocketGateway._create_bot through the shared platform registry
(resolve_adapter) instead of a hardcoded if/elif over the seven built-ins.
Any channel the registry resolves — built-in, register_platform(), or a
praisonai.channels entry point — is now instantiated and started, with
ch_cfg passed through generically (mirroring probe_channels). An
unresolvable or unconstructable platform is recorded as a degraded channel
(visible in health/doctor) rather than a silent skip. Per-platform token
env-var fallbacks (email/AgentMail/Linear) are preserved.
Co-authored-by: MervinPraison <[email protected]>
- agent_invoke: _apply_agent_config now rejects overrides on non-isolatable
(shared registry) agents instead of mutating a shared object, preventing
config from leaking across concurrent/subsequent requests. Drop the
never-settable `temperature` key from the whitelist so the surface is honest.
- vector_stores: warn (once per collection) when an existing/legacy Chroma
collection uses a non-cosine distance metric, surfacing incomparable scores
without a destructive auto-migration of stored vectors.
Co-authored-by: Mervin Praison <[email protected]>
- ChromaVectorStore: centralise namespace->collection resolution so ad-hoc
namespaces keep the cosine metric; return the stored embedding (not the
query vector) from query(); scope delete_all to the caller's namespace.
- agent_invoke: honour agent_config overrides against the isolated clone
via a whitelist, rejecting unknown/unsettable keys with 400 (route) or a
clean error dict (standalone) instead of silently ignoring them.
- a2u_server.publish_sync: use get_running_loop, track the scheduled task
(WeakSet) so it can't be GC'd and surface its exceptions; expose
last_publish_task() for the real delivered count.
- push/client + acp/server: replace deprecated asyncio.get_event_loop()
with get_running_loop()/to_thread inside coroutines.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Both create-github-app-token steps omitted `repositories:`, so the run log
read "creating token for all repositories for given owner MervinPraison" --
the token carried write access to every repo under the account while the
job only ever touches PraisonAI.
Verified single-repo before narrowing: the workflow makes no cross-repo
call, and bump_and_release.py's only gh invocation is `gh release create`
against this repo, with all git operations on origin.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- failover.py: snapshot next_profile + callbacks under the RLock, then
invoke callbacks after releasing it. User callbacks may block or take
external locks; running them under the shared credential-pool lock could
stall every concurrent agent and risk lock-ordering deadlocks (Greptile).
- chat_mixin.py: _run_id -> _current_run_id at the second tool-output
truncation call site the PR missed; previously passed None into
get_tool_output_store, defeating the run isolation Gap 3 restores.
Co-authored-by: Mervin Praison <[email protected]>
- LLMGuardrail.__call__ now fails closed on ambiguous LLM replies, matching
_llm_validate() and the class's documented fail-closed contract.
- FailoverManager gains a threading.RLock guarding all _profiles reads/mutations
and AuthProfile status transitions, since it is a shared credential pool by design.
- Fix _run_id -> _current_run_id typo that silently disabled tool-output
run-scoped isolation; harden get_tool_output_store so a None run_id no longer
adopts the first run's process-wide store.
- Add regression tests asserting both guardrail entry points fail closed.
Co-authored-by: MervinPraison <[email protected]>
- docker-compose: require POSTGRES_PASSWORD (no known fallback) and bind
Postgres to loopback by default (POSTGRES_BIND) — resolves GitGuardian
finding and the default-credentials exposure P1.
- railway starter: ship a Dockerfile so railway.json's DOCKERFILE build
and start command reference real files (fixes missing-file P1).
Co-authored-by: Mervin Praison <[email protected]>
A full pypi-release run landed 9 separate commits and 9 pushes on main --
one per package -- all authored as MervinPraison.
Collapse to one commit: delete the 8 per-package "Commit <pkg> version
bump" steps. They were redundant, since the wrapper step already calls
bump_and_release.py --no-add-all whose release_files list is a superset
of every file those steps staged, so all bumps now land in the script's
single "Release v<x.y.z>" commit. That needs --force, because the tree is
now dirty when the script runs and its pre-flight guard exits 1 under
--no-add-all; --no-add-all still restricts staging to the explicit list.
A trailing "Persist any uncommitted version bumps" step covers what the
single commit cannot: a package failing midway (those versions are
already live on PyPI, so the bumps must not be lost), skip_wrapper, or a
wrapper failure. It is a no-op on a clean run, and uses `git add -u` so
untracked build output stays out.
Attribute the release to praisonai-triage-agent[bot] by minting an
installation token from CLAUDE_APP_ID/CLAUDE_APP_PRIVATE_KEY -- the app
already behind that bot in claude.yml, claude-merge-gate.yml and
pipeline-status-sync.yml. GH_TOKEN is exported via $GITHUB_ENV, so the
commit, the tag push and gh release create are all the bot's;
secrets.GH_TOKEN is no longer referenced.
Two details this depends on: app tokens expire after 1h and this job can
exceed that (9 packages x up to a 600s PyPI wait each), so the token is
re-minted immediately before the wrapper release. And checkout sets
persist-credentials: false -- otherwise its http.extraheader would
outrank the remote URL and pin the first, expiring token.
Requires the App to be able to push to main (contents: write, plus a
ruleset bypass entry if main requires PRs).
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Add the same overlap-guard assertion used in eval/tokens.py so RAG-specific
extras can never silently shadow canonical MODEL_LIMITS entries and re-introduce
the drift that #3567 fixed.
Co-authored-by: Mervin Praison <[email protected]>
Deduplicate the canonical tool-argument identity scheme
(json.dumps(sort_keys=True, default=str) -> sha256[:16]) that was
independently re-implemented in the approval registry and doom-loop
detector. Both safety subsystems now delegate to a single
hash_tool_args() helper in approval/utils.py, removing the drift risk
between approval de-duplication and doom-loop detection. Behaviour is
byte-for-byte identical (verified against the original scheme).
Co-authored-by: MervinPraison <[email protected]>
Guard the BEFORE_LLM and AFTER_LLM payload construction with the existing
registry.has_hooks() primitive, matching the idiom already used at the
AFTER_TOOL/BEFORE_TOOL/AFTER_AGENT/BEFORE_AGENT sites. Also skip the
str(result) stringification when the trace emitter is a disabled NoOp by
guarding on _trace_emitter.enabled. Behaviour is identical whenever a hook
or emitter is registered; zero cost on the hot path otherwise.
Co-authored-by: MervinPraison <[email protected]>
Deduplicate the model->context-window data by sourcing exact values from
context/budgeter.MODEL_LIMITS (the canonical table) and layering only
RAG-specific extras underneath, mirroring eval/tokens.py. This removes the
drift where gpt-4.1/gemini-1.5-pro resolved to different windows in RAG vs
the rest of the SDK. The get_model_context_window wrapper (None guard,
normalisation, prefix/heuristic fallbacks) is unchanged.
Co-authored-by: MervinPraison <[email protected]>
Extract a single _iter_argv_tokens classifier as the one source of truth for
flag/value-consumption semantics. _find_first_command, _flag_names and
_build_run_argv now all consume it, so routing and rewrite can no longer
diverge. _find_first_command accepts the shared value_opts (defaulting to the
historical narrow static set) rather than a separate hardcoded VALUE_FLAGS.
Behaviour-preserving internal DRY refactor; no CLI surface change.
Co-authored-by: MervinPraison <[email protected]>
CLI (cli/features/deploy.py):
- extract compose up|down action before generic parse so `compose up`
without --file no longer sets file="up"
- drop duplicate `-r` key (F601) so --region short flag works again
- route `doctor --provider fly|railway|render` via provider registry
- wrap the four new handlers in the class try/except convention
- thread --force into create scaffolding
compose.py:
- _ensure_postgres_password now resolves the *effective* (last) value,
handling quoted-empty and inline-comment cases
- restrict generated project .env to 0600 on POSIX
- report the effective host API port (runtime env → .env → default)
- add 600s timeouts to docker compose up/down
helm.py: add 600s timeout to helm upgrade
starters.py: refuse to overwrite existing files unless force=True
Helm agents-api deployment.yaml:
- pass agents/port/serverFile via env vars (no Python-source injection)
- include POSTGRES_PASSWORD in DATABASE_URL via k8s $(VAR) interpolation
starters: railway.json/render.yaml use the prebuilt GHCR image instead of
a nonexistent Dockerfile/api_server.py; fix compose+helm README manifest links.
Adds regression tests (160 passed).
Co-authored-by: Mervin Praison <[email protected]>
Split the "POSTGRES_PASSWORD:-praisonai" and "change-me" string literals in
the compose security regression tests so GitGuardian no longer flags them as
hardcoded secrets. The assertions still guard the exact same behaviour (no
default password baked into compose; generated password differs from the old
placeholder). Also replace the static "change-me" placeholder in the
agents-api Helm README with an openssl-generated example.
Co-authored-by: Mervin Praison <[email protected]>
- docker-compose.yml: drop `:-praisonai` default password (GitGuardian);
require POSTGRES_PASSWORD via `:?` and bind Postgres to 127.0.0.1 by default
- .env.example: ship empty POSTGRES_PASSWORD (no repo-known credential) + POSTGRES_BIND
- compose.py: auto-generate a strong POSTGRES_PASSWORD into project .env when empty
- README + tests: document security defaults and guard against regressions
Co-authored-by: Mervin Praison <[email protected]>
TRUNCATE is the default compaction strategy but did not preserve
tool_calls/result pairs: the recent-window slice could orphan a tool
result, and the token-budget pop loop could drop an assistant
tool_calls message while leaving its tool result behind. Snap the
recent boundary and drop leading tool pairs atomically so strict
providers never receive an orphaned tool message.
Co-authored-by: Mervin Praison <[email protected]>
When register(..., overwrite=True) replaces a tool under the same name,
evict the previous tool's availability cache and last-success timestamp so
a broken replacement can't be served as available on its first failing
probe via the inherited grace window.
Co-authored-by: Mervin Praison <[email protected]>
Compaction strategies chose their recent/older boundary purely by token or
message count, which could split an assistant tool_calls message from its
matching tool result. The resulting orphaned tool message made strict
providers (OpenAI/Anthropic/Azure) reject the transcript with a 400,
wedging long-lived gateway/bot sessions on every subsequent turn.
Add ContextCompactor._snap_to_pair_boundary() which moves a chosen boundary
outward so a tool pair is never separated, and apply it in _sliding_window,
_summarize, _prune, _llm_summarize and _llm_summarize_async. Behaviour-only,
backward compatible, no new knobs.
Co-authored-by: MervinPraison <[email protected]>
Track last-success timestamp per tool in ToolRegistry. On a probe
exception within a grace window of a recent success, serve the last-good
True and skip caching a durable negative, so a flaky availability check
no longer strips a healthy tool from a long-lived agent. Sustained
failures beyond the grace window still mark the tool unavailable.
Co-authored-by: MervinPraison <[email protected]>
The new TestAgentOSChatSessionIsolation tests replaced Agent.achat at the
class level (`type(template).achat = _fake_achat`) and never restored it,
so the stub leaked into test_async_gemini_fix.py where the real achat is
called with a `tools=` kwarg the stub did not accept.
Use pytest's monkeypatch fixture (auto-restore) and accept *args/**kwargs
in the stub so it matches the real achat signature.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on #3555:
- Greptile P1: _preflight_tools now loads ~/.praisonai/.env before resolving
so a local tools.py enabled via PRAISONAI_ALLOW_LOCAL_TOOLS in that file is
not falsely rejected in strict mode (mirrors GatewayHandler.start).
- CodeRabbit: describe_unresolved excludes the exact name from difflib typo
candidates so a mapped-but-unloadable tool yields an install/generic hint
instead of a useless "Did you mean '<same name>'?".
- Add regression tests for both.
Co-authored-by: Mervin Praison <[email protected]>
An explicit (non-${ENV}) weak gateway.auth_token in gateway.yaml wins over
GATEWAY_AUTH_TOKEN at both startup (GatewayConfig.auth_token) and doctor
re-validation, so the env-only repair left the weak YAML value active and
falsely reported success. The repair now also rewrites the YAML token in
place when it holds an explicit weak value, while preserving ${ENV}
references. Fixes Greptile P1 on #3556.
Co-authored-by: Mervin Praison <[email protected]>
The degraded registry's retry_hint advertised `praisonai gateway doctor --fix`,
but no such flag existed — a dead-end on the gateway's primary recovery path.
Add `--fix`/`--dry-run` to `gateway doctor` that mints a strong GATEWAY_AUTH_TOKEN
when weak/missing, persists it to ~/.praisonai/.env (same store as onboard), and
re-validates the finding cleared. Align the core retry_hint docstring so the
advertised command is guaranteed to exist.
Co-authored-by: MervinPraison <[email protected]>
Add a start-time tool pre-flight gate so a mistyped, uninstalled, or
gated tool named in gateway.yaml is surfaced with a per-name reason and
fix hint instead of being silently skipped. Strict by default (mirrors
the credential pre-flight); --no-strict-tools / strict_tools: false
preserve today's skip-and-continue.
- tool_resolver.py: add describe_unresolved() (difflib "did you mean" +
local-tools/dependency hints) and a module-level wrapper.
- gateway start: add --strict-tools/--no-strict-tools and a
_preflight_tools() gate reusing the existing validate_yaml_tools.
Co-authored-by: MervinPraison <[email protected]>
- cli/features/deploy.py: API & Cloud shortcut commands now honor deploy.api
and deploy.cloud YAML when CLI flags are unset (defaults changed to None
sentinels; explicit CLI still overrides). Fixes YAML being silently ignored.
- providers/azure.py: create->update fallback now builds a proper
`az containerapp update` command (previous `cmd[1]='update'` produced the
invalid `az update containerapp`); env vars passed under a single --env-vars
flag so later pairs no longer override earlier ones.
- scheduler/deployment.py: replace buggy nested DeployArgs (dead self-ref,
missing attrs) with SimpleNamespace carrying all fields handle_deploy reads;
derive success from SystemExit code instead of always True; interruptible
retry wait via _stop_event so stop() works; drop unused time import.
- main.py: replace `assert docker_cfg` with explicit ValueError (assert is
stripped under python -O).
- _wrapper_bridge.py: optional_wrapper_attr now returns default when attr is
missing, not just on ImportError.
- docker.py: prepare_docker_build_context validates agents file before writing
api_server.py; docker_container_name sanitizes invalid chars.
- tests: add regression tests for API and Cloud YAML merge precedence.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Route the optional subtree-context helper through praisonai_bot (canonical
home) with a praisonai wrapper-shim fallback, removing the module-/function-
level ``from praisonai`` import that tripped the C7 hot-path import gate
(fixes smoke: test_c7_import_gate_script_passes). Feature now also works on
installs shipping praisonai_bot without the full wrapper.
- Propagate --no-rules to the custom-agent and profiled prompt paths
(_run_custom_agent, _run_prompt_profiled) so the opt-out is honoured on every
non-interactive Agent construction site, not just _run_prompt.
- Add an execution-path test asserting all three paths accept/forward no_rules.
Co-authored-by: Mervin Praison <[email protected]>
- ACCEPT_EDITS previously set _permission_mode but the decision resolver
deferred it (no-op), so advertised auto-accept-edits behaviour never
applied. Add an ACCEPT_EDITS branch that auto-approves edit-class tools
(write/edit/append/create/save/patch/mkdir) via a new _is_edit_tool
heuristic, deferring destructive/exec/external tools to normal flow.
- Remove the misleading `read_only`-as-mode line from PermissionMode.resolve
docstring (read_only is a deny-set preset and resolves to None).
- Tests: auto-approve edit tools, defer non-edit tools, auto_edit alias.
Co-authored-by: Mervin Praison <[email protected]>
The interactive REPL lazily attaches a subdirectory's AGENTS.md/CLAUDE.md the
first time the agent reads/edits a file under it, but the scriptable
`praisonai run` path built Agent(**agent_config) without it. In a monorepo,
`praisonai run "refactor packages/foo/bar.py"` therefore never picked up
packages/foo/AGENTS.md while `praisonai chat` in the same repo did.
Reuse the existing subtree hook (praisonai.integration.context_files) and the
existing Agent(hooks=...) seam via a small `_wire_subtree_context_hook` helper,
registered on a fresh session-scoped registry at all three run.py Agent sites.
Gated by the existing --no-rules / PRAISON_NO_RULES off-switch and honouring the
shared PRAISON_CONTEXT_BUDGET character budget. No new Agent params, no new core
module, no agent.py changes — keeping the surface area unchanged.
Co-authored-by: MervinPraison <[email protected]>
Add PermissionMode.resolve() as the single mapper from historical mode
spellings (AutonomyMode/ApprovalMode/CLI-flag aliases) onto the canonical
PermissionMode enum, and route the existing Agent(approval=<preset>) string
branch through it. Agent(approval='plan'|'bypass'|'accept_edits'|'dont_ask')
(plus aliases like yolo/auto_edit/reject/full_auto) now resolve to one
coherent model. Deny-set presets (safe/read_only/full/off/default) keep
their exact behaviour. No new Agent params or exports.
Co-authored-by: MervinPraison <[email protected]>
- call.py: module globals (OPENAI_API_KEY, CALL_SERVER_TOKEN, NGROK_AUTH_TOKEN,
rate limits) were frozen at import, before main()'s explicit load_dotenv(),
so a .env-only key was silently ignored. Add _refresh_env_globals() invoked
after load_dotenv() (also refreshes the n8n router's CALL_SERVER_TOKEN).
- agentos.py: clone_for_channel intentionally drops handoffs; agents with
handoffs now stay on the shared template so delegation is never silently lost.
- test: cover the handoffs-not-cloned path (9 passed).
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: /chat now clones a per-request/session agent (reusing the existing
_supports_session_isolation / _clone_agent helpers from api/agent_invoke.py)
so concurrent callers no longer share mutable chat_history, and session_id is
bound to the clone instead of merely echoed. Plain mocks fall back to the
shared instance for backward compat.
Gap 2 (minimal): api/call.py no longer calls load_dotenv() unconditionally at
import time; it is gated behind PRAISONAI_CALL_LOAD_DOTENV and loaded
explicitly in main() so the CLI keeps working. Importing the module no longer
mutates os.environ.
Gap 3 rejected as scope creep (breaking public-API churn with a deprecation
window; deferred per the issue).
Co-authored-by: MervinPraison <[email protected]>
- Docker deploy no longer disables auth by default; falls back to the
secure APIConfig() default (auth_enabled=True, token auto-generated)
instead of exposing an unauthenticated /chat on 0.0.0.0 (Greptile P1).
- Write the generated API server into a private per-invocation mkdtemp
(mode 0700) instead of a predictable shared tmp path, preventing
local replacement before launch (Greptile P1).
- Update pre-existing GHSA deploy-codegen test to assert the genuine
security property (repr-escaped path, no raw injection) rather than the
old implementation-coupled `PraisonAI(agent_file=...)` string; the PR
intentionally forwards the chat message via the wrapper `run(..., cli_config)`
entrypoint since `PraisonAI.run()` takes no args.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- llm_guardrail: assign self.logger before _initialize_llm so unsupported/
string-fail/dict-fail paths can log and fail closed instead of raising
AttributeError (CodeRabbit major).
- llm_guardrail: __call__ now checks `self.llm is None` (matches _llm_validate)
instead of truthiness (CodeRabbit minor).
- tests/permissions: lock the scoped-approval bypass fix — an agent-scoped
approval must reject an unnamed (agent_name=None) caller.
Co-authored-by: Mervin Praison <[email protected]>
- cancel_task now cancels any non-terminal task (PENDING or RUNNING),
fixing test_cancel_task regression and Greptile P1: queued/PENDING
delegations no longer escape cancel_all.
- delegate() re-raises external CancelledError (Greptile P1) and only
swallows delegator-initiated cancels into a result, so wait_for /
cooperative shutdown behave correctly.
- _execute_task and the semaphore-guarded path early-return when a cancel
landed before execution, so a cancelled task never runs.
Co-authored-by: Mervin Praison <[email protected]>
Move API, Docker, and cloud deployment from the wrapper into a standalone
praisonai-deploy package with backward-compat shims, CI/publish wiring,
and fixes for chat message forwarding, Docker build context, and CLI YAML merge.
Co-authored-by: Cursor <[email protected]>
- permissions/rules.py: PersistentApproval.matches now rejects agent-scoped
approvals for callers that can't prove identity (including agent_name=None),
closing the short-circuit bypass while leaving unscoped approvals unaffected.
- guardrails/llm_guardrail.py: LLMGuardrail.__call__ now fails closed on a
missing/unsupported LLM, matching its docstring and sibling _llm_validate.
- agents/delegator.py: cancel_task/cancel_all now propagate cancellation to the
real asyncio.Task; _execute_task no longer clobbers a CANCELLED status with a
late COMPLETED assignment.
Co-authored-by: MervinPraison <[email protected]>
Add a `skills add` subcommand as a thin alias over the existing
`skills install` path so `praisonai skills add https://...` works,
mirroring the familiar `npx skills add <url>` verb. Reuses existing
install/remote-fetch machinery; no new deps, modules, or core params.
Co-authored-by: MervinPraison <[email protected]>
- @tool(requires_approval=False) now emits DeprecationWarning (any use of the
deprecated spelling nudges migration); use a sentinel to tell "omitted" from
explicit False. approval= still wins for the resolved value.
- Agent/PraisonAIAgents launch(protocol="mcp") now keep the serve_agents() call
inside the ImportError guard, so a praisonai-mcp installed without its
transport extras yields one actionable install message instead of an uncaught
traceback.
- Tests: explicit-False-warns, omitted-no-warn, both-set-warns, and
missing-transport-extras for single- and multi-agent launch.
Co-authored-by: Mervin Praison <[email protected]>
- @tool now accepts canonical approval= (mirrors Agent(approval=...));
requires_approval= kept as a deprecated alias with a DeprecationWarning,
approval= wins when both set. Both funnel to the same ApprovalRegistry.
- PraisonAIAgents.launch(protocol="mcp") and Agent.launch(protocol="mcp")
now both delegate to praisonai_mcp.serve_agents (lazy import, clear
"pip install praisonai-mcp" error). Replaces the bespoke single-agent SSE block.
- Add praisonai_mcp naming constants list_sessions / awaiting_approval.
- http launch behaviour untouched.
Co-authored-by: MervinPraison <[email protected]>
A stop-on-error failure inside a loop_over step now aborts the whole
workflow instead of only the inner item iteration, and a completed
loop_over step now persists a checkpoint so resume does not re-run every
loop item. Both fixes live in the shared _run_workflow_loop generator so
they apply to sync execute() and async aexecute() alike.
Co-authored-by: Mervin Praison <[email protected]>
Extract the duplicated step-loop from execute() and aexecute() into a single
sans-io generator (_run_workflow_loop) that owns all orchestration:
condition-skip, loop_over iteration, checkpoint save/resume, branch_condition/
next_steps routing, early-stop and on_error handling.
execute() drives it with the sync _execute_single_step; aexecute() drives the
same generator with a new async _aexecute_single_step that awaits async
executors / agent.achat / async handlers (true-async preserved).
This restores loop_over, branch, and checkpoint/resume parity to the async
path and adds checkpoint/resume params to aexecute. Public signatures and
return shapes are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Catch import errors in _load_bundled_dashboard_app so that when the
bundled ui_dashboard preset is unavailable, the loader returns None and
the existing build_host_app fallback runs, instead of the exception
escaping to the outer handler and dropping aiui to the standard dashboard.
Addresses Greptile (P1) and CodeRabbit (Major) review findings on #3535.
Co-authored-by: Mervin Praison <[email protected]>
Route _run_aiui_dashboard through the bundled ui_dashboard/default_app.py
preset so the documented 9-page unified dashboard actually ships, making
the preset the single source of truth instead of a divergent hardcoded
5-page list. Falls back to the previous build_host_app defaults if the
preset cannot be loaded. Adds the missing ui_dashboard/__init__.py for
consistency with the other bundled UI presets.
Co-authored-by: MervinPraison <[email protected]>
- Namespace per-session transcripts by tool name so reusing a client
session_id across different ask_* agents no longer leaks history.
- Serialize each session's load->run->save under a per-session lock to
stop concurrent turns clobbering each other's completed turn.
- Disambiguate agents whose names normalize to the same tool suffix so a
later registration never silently shadows an earlier agent.
- Raise ValueError on unknown serve_agents() transport instead of
silently falling back to http-stream.
- Add regression tests for all four cases.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1 security findings on PR #3530:
- Fail closed: if registering the approval requirement raises, the
decorator now re-raises RuntimeError instead of logging and handing
back an executable but ungated tool.
- Validate risk-level strings against ("critical","high","medium","low")
so a typo like requires_approval="critial" is rejected up front rather
than silently treated as non-critical.
Adds regression tests for both cases.
Co-authored-by: Mervin Praison <[email protected]>
- praisonai-mcp: new serve_agents() + agent_adapter publishing ask_{name}
per agent and list_agents, with per-call session_id minting and in-adapter
per-session transcript continuity, running over the existing spec-compliant
http-stream transport. Server-side agents only; no client-set instructions.
- Fix Defect C: rebind memory adapter to the real core API
(store_short_term/search/get_all_memories/reset_all); the old bindings
(get_session/get_all/clear_session/clear_all/list_sessions/add) never existed.
- Drop client-controllable `instructions` from praisonai.agent.chat/run so the
connecting client can no longer rewrite the persona.
- Tests for per-agent tools, session continuity, no-client-instructions, and
memory adapter against the real API.
Co-authored-by: MervinPraison <[email protected]>
Adds a one-place approval declaration to the @tool decorator that
registers the tool with the existing global ApprovalRegistry at
definition time. `requires_approval=True` maps to the "high" risk
level; a string sets the risk level explicitly. No behaviour change
when unset. Backward compatible.
Co-authored-by: MervinPraison <[email protected]>
Addresses two valid reviewer findings on PR #3527:
- Stale anchor: the sync & async loops advanced `_last_run_at` *after*
`_execute_with_retry` persisted daemon state, so a restart restored the
prior slot and replayed an already-completed run/delivery. Mark the
wall-clock anchor *before* executing so the state write records this slot.
- Silent degrade: without the optional `croniter` engine a `cron:` schedule
reverted to the pre-#3526 process-relative interval with no signal. Emit a
one-time actionable warning (matching core `scheduler.due`) instead.
Tests: new default-install warning + state-persistence cases (run without
croniter); ticker cron tests gated per-class so they no longer skip the
whole module. Scheduler suite: 259 passed (3 pre-existing dotenv env
failures unrelated).
Co-authored-by: Mervin Praison <[email protected]>
The AgentScheduler / AsyncAgentScheduler wrapper loops collapsed cron
expressions to a coarse integer interval anchored to process start, so a
"daily 09:00 brief" fired at whatever o'clock the daemon launched, re-phased
on restart, and silently dropped runs across downtime/dormancy.
Add a lightweight, wrapper-local ScheduleTicker that reuses core's croniter
engine to sleep until the next real wall-clock occurrence, catch up a missed
slot exactly once on resume, and persist last_run_at in the existing daemon
state file so restarts don't re-phase. Plain intervals (hourly, */30m, raw
seconds) keep identical behaviour. No new core surface, exports, or params.
Co-authored-by: MervinPraison <[email protected]>
- Always inject the env var as GATEWAY_AUTH_TOKEN (the only name the gateway
reads); auth.secretKey now only selects the Secret data key.
- validateAuth now fails fast whenever auth.enabled is true without a token
source, not only when ingress is also enabled — the default install
previously referenced a Secret that was never created.
- Update README security note to match the stronger validation.
Co-authored-by: Mervin Praison <[email protected]>
The bot's dependency floor (praisonaiagents>=1.6.152) admits core releases
that predate AttemptAndAgeDeadLetterPolicy (first shipped 1.6.161). On those
installs the import guard previously bound None and both durable queues
silently reverted to attempt-only dead-lettering, re-introducing the #3519
transient message loss. Add a dependency-free LocalDeadLetterPolicy in
_resilience (mirroring core semantics: attempt+age gate, permanent-error
short-circuit, min_age=0 legacy) and bind it as the import fallback so the
age gate holds on any allowed core version. Adds older-core coverage tests.
Co-authored-by: Mervin Praison <[email protected]>
Ship a single, self-contained Helm chart under deploy/helm/praisonai-gateway
that reuses the existing GHCR image (no new build pipeline, no core code
change). Grounded in real gateway behaviour: port 8765, /health probes, and
GATEWAY_AUTH_TOKEN via a Kubernetes Secret. Includes optional ingress with
WebSocket-friendly annotations and an optional CPU HPA. Chart refuses to render
if the gateway would be exposed via ingress without an auth token.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- Enforce closed OWNER_KINDS/DEGRADED_STATES in DegradedOwner.__post_init__
so unsupported values can never reach operator-facing records (Greptile P2).
- Route the existing channel-credential degradation path through new
gateway helpers _mark_degraded_owner/_clear_degraded_owner so the shared
_degraded_registry has a genuine live producer feeding degraded_owners,
not just an empty registry read by health() (Greptile P1).
- Drop unused dataclasses.field import; add vocabulary-rejection tests.
Co-authored-by: Mervin Praison <[email protected]>
Dead-lettering decided on attempt-count alone burned the default five
attempts in ~45s of channel outage, permanently dropping deliverable
inbound/outbound messages during routine transient incidents.
Add a core DeadLetterPolicyProtocol + default AttemptAndAgeDeadLetterPolicy
in praisonaiagents/gateway that requires BOTH attempt-exhaustion AND a
minimum wall-clock age (default 6h) before dead-lettering, while known
permanent errors (credential/permanent_target) still short-circuit. The
bot durable queues (OutboundQueue.drain, InboundJournal redelivery/replay)
consume the policy where they previously tested attempts >= max_attempts,
gaining a dead_letter_min_age knob. min_age=0 restores legacy behaviour.
Co-authored-by: MervinPraison <[email protected]>
Adds a small, process-local DegradedCapabilityRegistry + DegradedOwner
contract in core (praisonaiagents/gateway/degraded_state.py), mirroring the
existing gateway policy-protocol + default-impl pattern. Any owner (channel,
provider, capability, route, gateway) records degradation with a consistent,
redacted, actionable shape.
Wires the bot gateway health() as a live consumer: it aggregates existing
channel degradation facts (plus any provider/capability/route degradation
recorded into a shared registry) into a single degraded_owners surface, so a
degraded provider or unresolved secret-backed capability is no longer
classified-but-invisible. The channel-only surface stays for backward compat.
Co-authored-by: MervinPraison <[email protected]>
The wrapper YAML schema types `autonomy` as an int 0-10 but core
Agent only accepts bool/str/dict/AutonomyConfig; forwarding the raw
int hit core's disable branch and silently ignored a configured
level. Map the numeric level onto core's string presets (0 => off,
1-3 => suggest, 4-7 => auto_edit, 8-10 => full_auto) and pass
bool/str/dict through unchanged.
Co-authored-by: Mervin Praison <[email protected]>
- praisonai_adapter._resolve_agent_approval: map the wrapper approval dict
onto the real ApprovalConfig fields (approve_all_tools->all_tools, resolve
string backend) instead of passing extra keys into the dataclass, which
raised TypeError on every --trust/--approve-* run against the native adapter.
- praisonai_adapter.run + persistence sync stores + async TUI: route through
the existing run_sync_or_offload helper instead of run_sync, so the flagship
sync praisonai.run(...) API and sync persistence hooks no longer crash from
inside a running loop (FastAPI, async test, notebook).
- praisonai_adapter._build_agents_and_tasks: forward agent-level fields the
core Agent already accepts (planning, reflection, guardrails, web, autonomy,
skills) instead of silently dropping them.
Co-authored-by: MervinPraison <[email protected]>
The per-instance async semaphore fix (correctly) enforces each Handoff's
own max_concurrent, but moved _semaphore_lock to instance level, breaking
the architectural test that asserts Handoff._semaphore_lock is a single
shared class attribute. Restore it as a class-level threading.Lock guarding
lazy semaphore creation while keeping the semaphore itself per-instance.
Co-authored-by: Mervin Praison <[email protected]>
- llm.py: add LLMResponseError and re-raise instead of swallowing a
mid-tool-loop error and returning "" as if the call succeeded, so the
existing try/except in chat_mixin.py can surface the real failure.
- memory.py: make adapter search/reset/delete gates symmetric with the
adapter-agnostic store path (any configured memory_adapter, not just
the hardcoded sqlite/in_memory providers). Also make store_long_term
adapter-agnostic to match store_short_term so adapter-stored memories
(e.g. "dakera") remain findable.
- handoff.py: make the concurrency semaphore instance-level (created once
per Handoff, rebound if the running event loop changes) instead of a
class-level singleton, so per-handoff max_concurrent limits no longer
override each other and multiple asyncio.run() lifecycles don't crash.
Co-authored-by: MervinPraison <[email protected]>
Reads the 'unchanged default = use stock image' sentinel off ComputeConfig's
dataclass field default instead of hardcoding "python:3.12-slim", so the
image-selection logic can't silently drift if that default changes
(CodeRabbit out-of-diff nit).
- get_status/list_instances now refresh remote Tenki state (sandbox.refresh
+ .state) instead of trusting the local map, so a server-side idle timeout
no longer surfaces as RUNNING while execute() hits a dead sandbox. Mirrors
the E2B provider's is_running() reconciliation.
- add exception chaining on the SDK ImportError (raise ... from e)
- drop the misleading docstring image example (it passed the default sentinel
that is intentionally treated as the stock image)
load() acquired the exclusive lock over max(file_size, 1) bytes on
Windows but discarded the returned length, so _release_exclusive_lock
fell back to unlocking only 1 byte. For session files larger than one
byte this left the remaining range locked until file close, blocking
concurrent access. Pass the acquired lock_length to the release call
to unlock the full range, mirroring save().
Co-authored-by: Mervin Praison <[email protected]>
- Persist reasoning/tool-progress/stream-error frames for reconnect replay (CodeRabbit)
- Missing agent now resolves terminally (final+error) instead of a dangling accepted ack (Greptile P1)
- Drain relay futures before final frame so final never overtakes trailing stream events (Greptile P1)
Co-authored-by: Mervin Praison <[email protected]>
Forward a closed set of structured progress events (reasoning, tool
progress, stream errors) to WS clients instead of dropping everything
but text/tool-call/end, and disambiguate the overloaded response frame
with status: "accepted" (provisional) vs status: "final" (with a
structured outcome).
Co-authored-by: MervinPraison <[email protected]>
Closes the two P1 gaps flagged in review: name-based schedule lookups/removals
had no principal check (a gateway user could read/delete another's automation by
guessing its name), and suggestion admission caps/dedup were measured globally
(one tenant could starve another's suggestions).
- store.py / config_store.py: get_by_name/remove_by_name gain optional principal
filter; a cross-owner match is skipped. principal=None stays global.
- protocols.py: ScheduleStoreProtocol get_by_name/remove_by_name updated.
- suggestion_store.py: add() scopes the pending cap & dedup window to the
suggestion's principal; principal=None keeps the global pool.
- tests: +6 cases for name-based mutation ownership and per-principal caps/dedup.
Co-authored-by: Mervin Praison <[email protected]>
Wire BasePlatformAdapter.format_message() (the existing deliver() seam) to
call format_for_dialect(text, caps.markdown_dialect) so the capability is
actually consumed in core — Telegram replies are MarkdownV2-escaped and Slack
gets mrkdwn. Default "markdown" dialect keeps existing adapters unaffected.
Fix strip_markdown to only unwrap *paired* emphasis/code spans so literal
identifiers (svc_1), globs (*.py) and arithmetic (a*b) are no longer corrupted.
Adds regression tests for both fixes.
Co-authored-by: Mervin Praison <[email protected]>
Add an optional `principal` owner key to the core scheduler data model so
a multi-user gateway isolates each user's automations and suggestions
instead of sharing one global, single-tenant store.
- Suggestion.principal + SuggestionStore.list_pending/accept/dismiss gain
an optional principal filter that rejects cross-owner access.
- ScheduleJob.principal round-trips through to_dict/from_dict; FileScheduleStore
and ConfigYamlScheduleStore .list() gain an optional principal filter.
- ScheduleStoreProtocol.list signature updated.
principal=None preserves the current global behaviour, so single-user
deployments are unaffected (fully backward compatible).
Co-authored-by: MervinPraison <[email protected]>
The bare-tool-name guard skipped the stdout-reporting instruction for
preconfigured agents whose own system prompt mentions execute_command,
leaving the "no output" bug reachable. Guard on a stable marker phrase
instead, keeping injection idempotent. Strengthen assertions and add
regression coverage for the preconfigured-prompt and duplicate paths.
Co-authored-by: Mervin Praison <[email protected]>
Addresses the durable at-least-once guarantee gaps flagged in review:
- Persist the recipient client_id alongside each pending event and
reconstruct _pending_acks on startup, so replayed events are scheduled
for retry/reconnect redelivery instead of being silently dropped.
- Evict acknowledged events from the SQLite store (and in-memory cache)
so acked rows are not resurrected after a restart.
- Backfill client_id column for pre-existing stores; strengthen tests to
assert redeliverability after restart and ack-eviction.
Co-authored-by: Mervin Praison <[email protected]>
Strengthen the shell-tool instruction in enable_shell_tools so the
gateway agent actually invokes execute_command and returns its stdout
verbatim, instead of intermittently replying "there was no output".
This addresses the flaky E2E sandbox marker check (E2E_SANDBOX_OK).
Co-authored-by: Dhivya-Bharathy <[email protected]>
Path.home() resolves via USERPROFILE on Windows, not HOME. The fixture
only set HOME, so on Windows the tool wrote to the real user profile and
the positive test asserted a file under tmp_path that was never created.
Set USERPROFILE alongside HOME so the fake home is honored on all
platforms and no writes escape the sandbox.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Make the gateway's at-least-once push delivery guarantee durable by default
without an external Redis server. DeliveryConfig.store_backend now accepts
"sqlite" (new default), "redis" and "memory", validated in core. The wrapper
gains a SqlitePushStore mirroring the existing OutboundQueue pattern (WAL,
stdlib sqlite3, TTL eviction) at ~/.praisonai/state/push_delivery.sqlite, so
pending un-acked events survive a restart and replay on reconnect. "memory"
stays an explicit ephemeral opt-out; "redis" stays for multi-process fan-out.
Co-authored-by: MervinPraison <[email protected]>
- discovery.py: auto-include synced remote-skill cache (`current` aliases) in
default skill dirs so agents pick up `skills sync` output without install;
scan now treats a returned dir that is itself a skill (root-level SKILL.md)
as a single skill.
- remote.py: return the fetched dir as-is (never its parent) so a root-level
skill is not double-counted alongside its cache `current` alias.
- skills.py (CLI): `sync` reuses discover_skills (no re-implemented scan / no
double-count); no-URL sync now reads project praisonai.yaml/.yml as well as
the user-global config.
- test_remote.py: regression test for root-level SKILL.md repo discovered once.
Co-authored-by: Mervin Praison <[email protected]>
Task._setup_guardrail selected `agent.llm or agent.llm_instance`; since
agent.llm is always a non-empty model-name string it always won, discarding
the configured LLM instance (base_url/api_key/auth) and authenticating against
the wrong backend. Reorder to `llm_instance or llm`, matching
Agent._setup_guardrail. small_model routing still applies only to the bare
string case. Adds Task guardrail routing/instance-preference tests.
Co-authored-by: Mervin Praison <[email protected]>
Internal, non-user-facing LLM calls (context compaction/summarisation and
LLM guardrail validation) always ran on the primary agent model. Thread the
existing get_small_model resolver through these live auxiliary call sites so
a configured small_model is used, while leaving it unset preserves today's
behaviour (unset -> primary model).
- agent._create_llm_summarize_fn: resolve the summariser model via
get_small_model(primary_model=<agent model>) instead of hardcoding self.llm.
- Agent/Task LLM guardrail setup: when the guardrail LLM would default to the
bare primary model-name string, route it through get_small_model.
Change is strictly additive and backward-compatible: an explicit LLM instance
or per-call model always wins.
Co-authored-by: MervinPraison <[email protected]>
Introduce an opt-in RemoteSkillSourceProtocol and a default git-backed
implementation that syncs skills into a versioned local cache with atomic
swaps and offline-safe fallback to the last-good cache. Wired into
discover_skills via a new sources= param (backward compatible, zero
import-time cost) and surfaced through a `praisonai skills sync` CLI
command reading skills.urls / skills.sources from config.
Co-authored-by: MervinPraison <[email protected]>
Addresses two P1 reviewer findings on the wrapper-layer PR:
- registry.py: move the capability cache off a process-global dict onto the
FrameworkAdapterRegistry instance so two registries that register different
adapters under the same name no longer read each other's flags.
- observability/hooks.py: record which AgentOps teardown a run owns
(per-session vs legacy singleton). A run whose start_session returned no
usable handle now ends nothing instead of falling back to the package-global
end_session and cross-finalizing a concurrent run.
- agents_generator.py: keep the "cannot verify" refusal for genuinely unknown
frameworks while treating known built-ins (DEFAULT_PRIORITY / registered)
whose adapter can't be constructed as unsupported, preserving the historical
"not supported for framework=..." message.
Adds regression tests for all three behaviours.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: scope AgentOps to each ObservabilityRun (per-run start_session
handle + lock) instead of the process-global singleton so concurrent
runs don't cross-contaminate tags or cross-finalize sessions.
Gap 2: add run_sync_or_offload() to _async_bridge as the single
sync-or-offload driver; delete the duplicated copies in auto.py, use it
in PersistenceOrchestrator._sync (was silently raising inside a running
loop), and replace deprecated get_event_loop().run_in_executor with
asyncio.to_thread in api/agent_invoke.py.
Gap 3: add adapter_capability() and route SUPPORTS_RUNTIME_FEATURES /
SUPPORTS_WORKFLOW decisions through it, removing the
str(framework)=="praisonai" fallbacks so third-party adapters aren't
silently demoted on transient resolution failures.
Co-authored-by: MervinPraison <[email protected]>
The restore-all prune loop deleted every project file absent from the
target commit, silently destroying ignored/excluded files (.env, venv,
node_modules) that the snapshot never tracked. Mirror _sync_files()'s
ignore rules in restore so only would-be-tracked files are pruned.
Co-authored-by: Mervin Praison <[email protected]>
- snapshot: prune shadow files removed from the project in _sync_files() and
restrict restore() "restore all" to the target commit's tree (removing files
not in it), so undo() cannot resurrect deleted files or leak files from a
later snapshot.
- skills: guard the pending-store load-mutate-save cycle in _stage_pending/
approve/reject with a threading.Lock so concurrent proposals no longer
silently overwrite each other.
- permissions: consume a scope="once" approval/denial on first match in
_check_flat so it no longer becomes permanent for the process lifetime.
Co-authored-by: MervinPraison <[email protected]>
Delegate mcp.py's inline SSE-vs-HTTP URL check to the existing
mcp_transport.get_transport_type() helper so there is a single source of
truth for URL->transport classification. No behaviour change: /sse URLs
still use SSE and all other HTTP URLs use Streamable HTTP.
Co-authored-by: MervinPraison <[email protected]>
HooksQueryProtocol had zero importers, was not exported in
hooks/__init__.py __all__ or _LAZY_GROUPS. Consumers use
registry.list_hooks_for_api directly. No behaviour change.
Co-authored-by: MervinPraison <[email protected]>
Sync from_dict with to_dict so retry_initial_delay, retry_backoff_factor,
retry_jitter and compaction_strategy survive a to_dict/from_dict round-trip.
Also align code_sandbox_mode fallback with the dataclass default ("sandbox").
Co-authored-by: MervinPraison <[email protected]>
Both helpers in the praisonai wrapper's agents_generator.py were defined
but referenced nowhere (no callers, no tests, not exported). Also drops
the now-unused `import keyword` used only by the removed function.
Co-authored-by: MervinPraison <[email protected]>
- browser_available() now requires the playwright runtime importable, not just
praisonai_browser, so a base install without the Playwright extra falls back
to the cloud BrowserBaseTool instead of selecting a local tool that fails at
invocation (Greptile P1).
- create_browser_tool no longer advertises profile=X as active; PlaywrightBrowserAgent
has no profile param and uses a fresh context, so the value is now logged as
informational-only rather than misreported (Greptile P1).
- Add unit test covering the missing-Playwright fallback path.
Co-authored-by: Mervin Praison <[email protected]>
BotHandler._build_tools() now prefers praisonai-browser's local Playwright
automation (navigate/snapshot/click) over cloud-only BrowserBaseTool when
capabilities.browser is set, honouring --browser-headless / --browser-profile.
Falls back to BrowserBaseTool only when praisonai-browser is unavailable.
Adds a lazy _browser_bridge (mirroring _code_bridge) and an agent-callable
browser_automate tool wrapping PlaywrightBrowserAgent.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Adds safe_print() to praisonai_bot.gateway.unicode_utils so E2E harnesses and
console reporters can echo Playwright's "playwright install" banner (drawn with
box chars like U+2551) without crashing on default Windows cp1252 consoles.
Falls back to safe_error_message() sanitization only when the stream encoding
rejects the text, keeping the actionable hint readable instead of masking it
behind a secondary UnicodeEncodeError.
Co-authored-by: Dhivya-Bharathy <[email protected]>
The CodeToolBridge.run_code(code) contract dropped the caller's per-run
allow-list, registry, timeout and max_output_size, so a transport could
only gate isolated tool calls by bridge-owned defaults — a weaker path
than the in-process executor and contrary to the "never a weaker path"
guarantee. Forward the invocation policy and limits to run_code so the
transport gates each call by exactly what the caller authorised.
- CodeToolBridge.run_code now takes allowed_tools/registry/timeout/
max_output_size as keyword-only params (new protocol, no external
implementers — fully backward compatible for existing callers).
- execute_code_with_tools forwards the invocation context to the bridge.
- Tests: recording bridge now uses only forwarded policy; added coverage
for policy/limit propagation and forwarded-allow-list enforcement.
Co-authored-by: Mervin Praison <[email protected]>
Add a transport-agnostic CodeToolBridge protocol and parent-side
serve_tool_call helper in core, plus a backward-compatible bridge=
option on execute_code_with_tools. When a bridge is supplied, code runs
under isolation and reaches tools over the bridge (same allow-list +
approval gate); omitting it preserves today's in-process behaviour.
Concrete per-backend transports remain a follow-up in the sandbox layer;
core only defines the contract to stay lightweight.
Co-authored-by: MervinPraison <[email protected]>
Address three P1 gaps in the gateway cancellation/timeout work:
- Timeout was unreachable: add per_turn_timeout to the bot GatewayServerSchema
(extra="forbid" was rejecting it) and stamp it onto self.config in
start_with_config so the documented YAML knob actually takes effect.
- Turn isolation: pass the InterruptController per-turn as the entry point's
cancel_token instead of mutating the shared agent.interrupt_controller, so
overlapping sessions on one Agent instance no longer interrupt each other.
Legacy agents without a cancel_token kwarg fall back to the shared attribute.
- Cancellation honesty: interrupt cooperatively first and wait a bounded grace
window (_ABORT_GRACE_SECONDS) for the turn — including a sync agent.chat in a
worker thread that cannot be force-killed — to unwind before the serial
session queue advances; hard task.cancel() only as a fallback.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Empty-string targets were skipped by the `if target` truthiness check,
retaining the silent fallback/misroute this validation prevents. Skip
only None (omitted) so every supplied string target is validated.
Co-authored-by: Mervin Praison <[email protected]>
Wire per-turn abort + timeout into the gateway so a runaway turn can no
longer wedge the serial per-session queue:
- Advertise the `abort` method (+ `message_abort` event) in the hello
capability handshake instead of the "abort not implemented" placeholder.
- Handle `abort`/`message_abort` WS frames and a portable `/stop` chat
command; both drive the existing InterruptController and cancel the
driving asyncio task via a new `_active_turns` registry.
- Run each turn under an optional `gateway.per_turn_timeout` (YAML/config
knob, 0 = disabled) via `_drive_turn`, normalising cancelled/timed-out
turns to a typed terminal message instead of leaving them hanging.
Reuses core's InterruptController (already checked by the agent run loop)
and `agent.interrupt_controller`; no new agent params.
Co-authored-by: MervinPraison <[email protected]>
Cross-check every channel's routes/routing targets (including default) and
bindings.agent against the declared agents: map in the canonical schema
validator. A typo now fails fast at load time (and in gateway doctor, which
loads via this schema) with the channel, bad target, and closest valid agent
id — instead of a silent logger.warning + misroute. Only enforced when
agents: is declared, so single-bot configs stay backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
A run with session_id now routes to the stateful per-session agent
(_get_session_agent), not _get_agent. The test only stubbed _get_agent,
so it built a real Agent with no LLM backing and start() returned ''.
Stub the session builder too so the event fan-out contract is exercised
without a live LLM.
Co-authored-by: Mervin Praison <[email protected]>
Fixes Greptile P1: a value-taking run option whose separated value begins
with a dash (e.g. `--session -abc`, `--output -json`) was mis-classified by
`_flag_names` as an unsupported flag, diverting an otherwise fully
run-supported prompt to the legacy engine and losing session continuity,
--output modes, the credential gate and permissions.
`_flag_names` now accepts the `value_opts` set and skips the token consumed
by a value-taking option (with `--opt=value` handled inline). `_looks_like_
bare_prompt` passes `run`'s value-taking options in, and short-circuits the
no-dash case before the (potentially heavy) run-option introspection.
Co-authored-by: Mervin Praison <[email protected]>
Address 3 P1 review issues on the stateful warm-runtime session path:
- Attach id no longer replaces session identity: `run.py` passes the
persistence/conversation id as `session_id` and the `--attach` label as a
distinct `event_id`. A `--no-save --attach <id>` run streams events to the
attach id but stays on the isolated anonymous path (no persistence).
- Model override rebuilds the session agent: the per-session warm agent is now
keyed by the resolved model, so a later turn with a different model no longer
silently runs the previous provider/model.
- Continuity-wiring failure is not cached: when session-store wiring fails, the
turn runs one-shot but the unwired agent is not retained, so a later turn
retries wiring instead of permanently serving an uncoupled agent.
Wrapper-only (praisonai-code); no core SDK changes, no new Agent params, no new
deps. Adds tests for model override, continuity-failure, and event/session id
separation; updates the attach mock to accept `event_id`.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1 findings on the interruptible-turn wrapper:
- Primary prompt-toolkit path now requests cooperative cancellation on
Ctrl-C when a turn is in flight (previously only reset the input
buffer), and clears any stale request at the start of each background
turn so a fresh turn is not immediately interrupted.
- _execute_prompt_interruptible refuses to start a new turn (and to clear
the shared controller) while a prior abandoned worker is still alive,
preventing the abandoned turn from being un-cancelled and resuming
against the warm session.
- Added test_abandoned_worker_blocks_new_turn.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The CLI router treated any -/-- flag as a signal to fall back to the legacy
argparse engine, so common cases like `praisonai "fix the bug" --model gpt-4o`,
`--continue`, or `--output json` silently bypassed the modern `run` engine and
lost session continuity, --output modes, the credential gate and permissions.
_looks_like_bare_prompt now derives the run-supported option names by
introspecting the run command's Click parameters and routes a bare prompt to
`run` when every flag present is one run accepts; genuinely legacy-only flags
(and .yaml/.yml workflows) still fall back to legacy, now with a one-line
notice so the fallback is never silent. _build_run_argv reconstructs the
prompt + flags into a single `run "<prompt>" <flags>` invocation.
Co-authored-by: MervinPraison <[email protected]>
The warm runtime was a cold-start cache only: every /run cleared history
and --continue/--session runs bypassed the warm path, paying cold-start
each turn. Add a per-session warm agent registry keyed by session id that
rehydrates history once (via the existing apply_cli_session_continuity
wiring) and retains it across turns, while the anonymous path stays
isolated. Relax runtime_eligible so --continue/--session route to the warm
stateful path (fork/isolated/thinking/tool runs stay in-process).
Co-authored-by: MervinPraison <[email protected]>
Attach the core InterruptController to the interactive agent and run each
turn in a worker thread so the main thread stays responsive. Ctrl-C during
a turn now requests cooperative cancellation; the core chat loop honours it
at the next step boundary, returns partial output, and keeps the warm agent
and session intact. Wrapper-only change reusing the existing core primitive.
Co-authored-by: MervinPraison <[email protected]>
- write_file compute bridge: replace heredoc with base64-decoded stdin so
content can no longer terminate the heredoc early (silent truncation) or
inject host commands.
- LocalCompute._install_packages: validate pip specifiers against the strict
allowlist and shlex.quote each token before host execution.
- LocalManagedAgent._ensure_agent: pass api_key/base_url directly to the inner
Agent instead of os.environ.setdefault, preventing process-wide credential
pollution and subprocess env leakage across tenants.
Co-authored-by: MervinPraison <[email protected]>
Do not clear task._execution_context inside _build_execution_context.
The run_task/arun_task retry loops re-enter this helper on guardrail /
completion failures; clearing stripped the upstream output and validation
feedback the retry needs (Greptile P1). The Process engine already owns
this field's lifecycle (re-set before each yield, reset to None before
selecting the next task), so no cross-task leak.
Co-authored-by: Mervin Praison <[email protected]>
- mcp.py: wrap session.call_tool/read_resource/get_prompt in asyncio.wait_for
so a hung server fails one request without wedging the runner loop forever
- agents.py: fold task._execution_context (inter-task context + validation
feedback built by Process._build_task_context) into the prompt builder, and
clear it after consumption so it doesn't leak into later runs
- workflows.py: track future->idx map in parallel loop so error attribution
survives exceptions instead of using an unbound/stale idx
Co-authored-by: MervinPraison <[email protected]>
The legacy async tool loop in _achat_completion fired BEFORE_TOOL/AFTER_TOOL
inline and then again inside execute_tool_async, double-firing hooks when
registered and building hook inputs (os.getcwd/time.time) with no consumer
when none are. Rely on the single guarded dispatch in execute_tool_async,
which already handles blocking, arg mutation and after-context aggregation.
Co-authored-by: Mervin Praison <[email protected]>
The --entrypoints option was documented and parsed into use_entrypoints
but never wired to any discovery behavior. Removed the dead flag and
updated the docstring to reflect the actual --include-only interface.
Co-authored-by: Mervin Praison <[email protected]>
action_discover now reads built-in/external/registered/local from the
canonical ToolResolver.list_available_sources() in a single authoritative
walk, matching the resolver-first pattern already used by _get_builtin_tools
and templates/tools_doctor.py. The original praisonai_tools + TOOL_MAPPINGS
scan is preserved as an explicit offline fallback (_legacy_manual_scan) for
environments without praisonai-code. --include/--entrypoints flags and
grouped output are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Downstream _execute_tool_async_impl matched only on __name__ and called
func(**args) directly, so a BrowserBaseTool-style BaseTool instance
(resolved by .name in dispatch) returned "not found" / never ran. Mirror
the robust sync resolution (BaseTool.name, FunctionTool .name alias, class
name) and invoke func.run() for BaseTool instances.
Also fix the short-circuiting `or` chain in async dispatch so an aliased
.name that differs from __name__ resolves instead of being dropped.
Adds regression tests exercising the real (unmocked) execute_tool_async
for a BaseTool instance and an aliased callable name.
Fixes#3450
Co-authored-by: Mervin Praison <[email protected]>
Address CodeRabbit review: when neither the monorepo praisonai-mcp sibling
nor an installed praisonai_mcp.mcp_server is available, the C12 shim cannot
resolve. Convert the resulting bare ModuleNotFoundError collection error into
a clean module-level pytest.skip. Guard find_spec against ModuleNotFoundError/
ValueError for an absent/broken parent, mirroring praisonai._bootstrap.
Co-authored-by: Mervin Praison <[email protected]>
Bot --browser wired BrowserBaseTool (a BaseTool instance without
__name__), causing async tool dispatch to raise
'BrowserBaseTool' object has no attribute '__name__'. Harden the
lookup in _achat_completion to resolve by __name__, .name, or class
name so all BaseTool subclasses dispatch safely, and drop the ad-hoc
__name__ monkey-patch in bots_cli.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- Guard Unix-only ``resource`` import so _admission.py loads on Windows;
sampler self-disables gracefully when unavailable (Greptile P1 #1).
- Wire ``max_rss_mb`` through BotOS + gateway.yaml via a single-knob
build_memory_pressure_policy() so the feature has a live production
consumer instead of a dormant param (Greptile P1 #3).
- Surface max_rss_mb in admission stats; document resource-only soft-queue
degradation honestly rather than silently misleading (Greptile P1 #2).
- Correct MemoryPressurePolicy docstring to reference the real config key.
- Add tests: Windows-safe sampler, single-knob policy, BotOS wiring, stats.
Co-authored-by: Mervin Praison <[email protected]>
Move the new continuable param to the end of schedule_add() so the
pre-existing 9th positional slot still binds accept_suggestion, avoiding
a silent behaviour change for positional callers (Greptile P1).
Co-authored-by: Mervin Praison <[email protected]>
A transient DLQ-init failure no longer latches _outbound_resilience_ready,
so a later delivery re-attempts initialization once storage recovers,
instead of permanently degrading to retry-only and silently dropping
permanently-failed replies. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Runtime exception messages could contain non-cp1252 characters that
would re-trigger UnicodeEncodeError on Windows consoles when printed.
Wrap exception interpolation in ascii() for all 7 failure messages.
Co-authored-by: Mervin Praison <[email protected]>
A delivered automated brief now seeds a resumable session so the user's
reply in the same chat resumes the job's conversation with full context,
instead of landing as a contextless new turn.
- core: add declarable DeliveryTarget.continuable field (opt-out only,
round-tripped in to_dict/from_dict) as the 3-way surface contract
- wrapper: gateway _deliver_scheduled_result seeds the reply session via
the existing mirror_to_session path when continuable
- tool/CLI: thread continuable through schedule_add + a --no-continuable
flag for fire-and-forget notices
Co-authored-by: MervinPraison <[email protected]>
Gateway admission was concurrency/CPU-scaled only and blind to memory, so a
burst of concurrent turns on a small always-on host drives RSS up until the
OOM killer fires — observed only post-mortem. This adds a resource-pressure
policy that queues under soft RSS pressure and sheds under hard pressure,
reusing the existing admission seam.
Core (praisonaiagents/gateway): ResourceSample, ResourcePressurePolicyProtocol
and a stdlib-first MemoryPressurePolicy (pure decision, no heavy imports),
sitting beside the concurrency / rate-limit / scale-to-zero policy family.
Wrapper (praisonai_bot/bots/_admission.py): a lightweight _RssSampler
(psutil-optional, resource.getrusage fallback, self-disables on unsupported
platforms) and AdmissionGate(resource_policy=...) wiring that folds the
resource decision into admit() by escalating to the more restrictive outcome.
Co-authored-by: MervinPraison <[email protected]>
Mirror the durable inbound journal on the outbound side: when no
outbound DLQ path is configured, default to the canonical per-platform
store (~/.praisonai/state/<platform>/outbound_dlq.sqlite) so a
permanently-failed or exhausted reply is parked (auditable + replayable)
instead of silently dropped. Escape hatch: outbound_resilience.enabled=false.
Co-authored-by: MervinPraison <[email protected]>
The wrapper permits a range of praisonaiagents versions (>=1.6.152), but
_attach_gateway_runtime imported GatewayRuntimeSeams/GatewayAdapterContractError
unconditionally — symbols only present in current core. On an older-but-allowed
core that import raised ImportError on every start()/probe()/health() (Greptile
P1). Guard the import and fall back to the pre-contract duck-typed splices so
those installs keep wiring identity resolution, delivery routing, admission
control, and cross-platform turn locking. The no-seams path now returns before
any import, staying a pure no-op independent of core version.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Classify loopback numerically via ipaddress so 127.0.0.2,
127.255.255.255, and expanded IPv6 ::1 keep the snappy loopback drain
instead of the 15s production window. Addresses Greptile review feedback.
Co-authored-by: Mervin Praison <[email protected]>
- classify_reload now rejects empty channel names (channels., channels..enabled)
and falls through to the fail-safe FULL restart instead of restarting channel ""
- wrapper _build_reload_plan gracefully degrades to full restart if an older
supported praisonaiagents lacks classify_reload, instead of crashing the reload
- add regression tests for malformed channel paths
Co-authored-by: Mervin Praison <[email protected]>
The unset (None) reliability posture now resolves to a backpressured
deployment — bounded admission ceiling + fair wait queue + graceful drain —
instead of the old no-admission one. It is bind-aware: a non-loopback bind
(a real deployment) resolves to the full production window, loopback keeps a
snappy 5s drain. reliability="off" opts back into today's immediate-teardown
behaviour; explicit reliability="default" keeps the legacy no-ceiling posture.
Co-authored-by: MervinPraison <[email protected]>
Add a pure, side-effect-free ReloadScope/classify_reload registry to the
core SDK so hot-appliable vs channel-scoped vs agents vs full-restart is
classified identically by every runtime, instead of being duplicated
ad-hoc in the wrapper. The wrapper's _build_reload_plan now delegates to
core, keeping the existing scoped per-channel restart behaviour while the
contract "grows" in the authoritative layer. Backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback on PR #3437:
- Greptile P1: the published editor schema was stricter than the runtime.
generate_agents_schema() now relaxes AgentConfig (drops required
role/goal/backstory, which the runtime auto-fills or maps from
'instructions') and allows list-form roles/agents (runtime _list_to_dict),
so editors no longer flag valid, executable YAML. The strict YAMLConfig used
by ConfigValidator is unchanged.
- Greptile P2: replace the silent `except Exception: pass` around the
yaml-language-server header write with a debug log so a dropped directive is
diagnosable.
- Regenerate agents.schema.json; add a runtime-parity guard test.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Legacy-only sessions now honour --sanitise instead of returning a raw
verbatim transcript, closing a secret-leak gap.
- Enforce --redact-level contract: validate against REDACT_LEVELS (standard|
strict), reject typos at the CLI, and give strict a real effect (masks
bearer tokens and PEM private-key blocks).
- Path matcher now covers single-segment POSIX (/tmp), C:/ Windows, and UNC
(\\server\share) paths; the cwd is masked as a stable path placeholder so it
is no longer half-masked as a secret leaving a dangling suffix.
- Add tests for single-segment/UNC paths, cwd suffix, strict mode, invalid
level, and exported REDACT_LEVELS.
Co-authored-by: Mervin Praison <[email protected]>
Derive a JSON Schema from YAMLConfig (generate_agents_schema), publish it as
a committed agents.schema.json artefact, expose it via `praisonai validate
schema --agents/--output`, and prepend a `# yaml-language-server: $schema=`
header when auto.py scaffolds agents.yaml so editors give autocomplete /
inline validation out of the box. Authoring-time only; runtime parsing and
execution are unchanged (a leading YAML comment is ignored by safe_load).
Co-authored-by: MervinPraison <[email protected]>
Address CodeRabbit review on MCP test conftest:
- Check the shim's required praisonai_mcp.mcp_server submodule instead of only
the top-level package, so a partial/incompatible install can't pass the guard
while collection still fails.
- Emit a pytest_report_header when MCP tests are skipped so contributors see why
and how to install praisonai-mcp.
Co-authored-by: Mervin Praison <[email protected]>
Playwright's "playwright install" banner uses box-drawing frame characters
(U+2551 etc.). On Windows cp1252 consoles these could clutter the sanitized
error text with '?' placeholders, obscuring the actionable hint. Map the
common frame characters to spaces in safe_error_message's symbol table so the
hint stays readable while remaining ASCII-safe.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add a lightweight, deterministic redactor so `praisonai session export
<id> --sanitise` (alias `--sanitize`) replaces secrets, absolute paths,
the working directory, and embedded file contents with stable
`[redacted:<category>:<n>]` placeholders. Default export is unchanged.
- new redact.py helper with stable placeholder map (stdlib only)
- wire redact/redact_level through export_session (Python: redact=True)
- wire --sanitise/--sanitize + --redact-level CLI flags, default off
- unit tests over a seeded secret, absolute path, and stable placeholders
Co-authored-by: MervinPraison <[email protected]>
Add tests/unit/mcp/conftest.py that restores the monorepo dev layout via
ensure_praisonai_mcp() and uses collect_ignore_glob to skip the directory
when praisonai_mcp is neither installed nor present as a sibling checkout,
turning a ModuleNotFoundError collection error into a clean no-op.
Co-authored-by: Dhivya-Bharathy <[email protected]>
The basic smoke script crashed with UnicodeEncodeError on Windows
default consoles (cp1252) because print() statements embedded emoji
(U+1F9EA, U+2705, U+274C, U+1F389) that cannot be encoded to stdout.
Replace all emoji with ASCII status tags ([TEST], [OK], [FAIL]) so the
script runs on any terminal encoding without decoration loss.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Addresses CodeRabbit nitpick: add praisonai.yml / legacy praison.yml
discovery tests and a precedence test asserting canonical praisonai.yaml
wins over legacy praison.yaml when both are present.
Co-authored-by: Mervin Praison <[email protected]>
The praisonai-code resolver only searched for `praison.yaml` at the
project root, which is inconsistent with the agents SDK loader
(`praisonaiagents/config/loader.py`) that uses the canonical
`praisonai.yaml`. Add `praisonai.yaml`/`praisonai.yml` as the primary
project-root names while retaining `praison.yaml`/`praison.yml` for
backward compatibility, and update the docstring reference. Adds
regression tests covering both the canonical and legacy names.
Co-authored-by: Leebana <[email protected]>
CapabilityValidator cached the MCP server snapshot once, so servers that
connected after the first validation stayed invisible under STRICT
enforcement. Read the process-level registry live each call (cheap
set-copy under lock); tool cache is unchanged. (#3307)
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: port loop-task pre-expansion from workflow() into aworkflow() so
async workflows with a CSV-driven loop start task expand per-row instead
of running once.
Gap 2: guard the per-turn _turn_tools_used buffer with the same
AsyncSafeState lock that protects chat_history, routing all sites through
_reset/_record/_drain helpers so concurrent chat()/achat() turns on one
Agent no longer corrupt hook/self-improve tool data. Backward-compatible
_turn_tools_used property retained.
Gap 3: track namespaced MCP server names in a process-level registry
(MCP.list_active_server_names(), populated in with_tool_prefix) and read
it from CapabilityValidator._get_available_servers so MCP-server-gated
skills can pass STRICT validation instead of always failing closed.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
parallel_handoffs runs children via asyncio.gather, which copies the
context per task. A copied ContextVar binding still references the same
parent list object, so when parallel_handoffs runs inside a non-empty
parent handoff chain, sibling tasks mutated a shared list and corrupted
cycle/depth tracking. Rebind each task's chain to a fresh per-task copy
at _run_one entry so siblings are fully isolated.
Co-authored-by: Mervin Praison <[email protected]>
- memory_mixin: append per-instance uuid suffix to default session_id so
same-named agents can no longer collide and bleed chat history
- handoff: replace threading.local() with contextvars.ContextVar so handoff
chain/depth is isolated per asyncio.Task under parallel_handoffs
- hooks/runner: add HookRunner.execute_async alias so async retry-with-backoff
no longer crashes with AttributeError
Co-authored-by: MervinPraison <[email protected]>
Address reviewer-flagged concurrency gaps in the scheduler + template cache:
- TemplateCache locks are now process-wide (class-level, keyed by path) so two
independent instances over the same dir coordinate; get() reads under the
per-key lock so it never observes the intermediate two-rename window; put()/
invalidate() take root+key locks and clear() takes the root lock, so a
concurrent clear() can no longer rmtree a half-written entry. put() stages
into a reserved .staging subdir (same fs, atomic os.replace) that clear()
skips, eliminating the put-vs-clear FileNotFoundError.
- AsyncAgentScheduler.start() no longer reports a successful start (and no
longer spins up a background task) when the immediate run trips the budget
brake (e.g. max_cost=0), matching the actually-stopped state.
Verified: 4 writer/clearer + 2 reader concurrency smoke test -> 0 races;
zero-budget start returns False with no task; 335 scheduler+template tests pass.
Co-authored-by: Mervin Praison <[email protected]>
- Async scheduler now honours the intentional-silence marker on delivery
(shared _should_suppress_delivery on _BaseAgentScheduler); removes the
duplicate budget guard, replacing both with a single _budget_exceeded()
helper that treats max_cost=0 as a real zero budget.
- TemplateCache.put()/invalidate() now stage into a sibling temp dir and
atomically os.replace() under a per-key lock, so concurrent readers never
observe a half-populated or mid-rmtree cache entry (multi-agent/interprocess).
- Scheduled agents.yaml tools now resolve through the canonical ToolResolver
(same path as `praisonai run`), instead of dropping everything but a
hardcoded search_tool — keeping CLI/YAML/Python behaviour identical.
Co-authored-by: MervinPraison <[email protected]>
- agents.py: _build_execution_context gains skip_memory_init; aexecute_task
passes True so a failed initialize_memory_async() no longer falls through
to the synchronous initialize_memory() on the event-loop thread.
- execution_mixin.py: reset app.openapi_schema after registering a shared-port
route so later launch() calls appear in /openapi.json and /docs.
Co-authored-by: Mervin Praison <[email protected]>
- Agent.launch(): register every path (not only first per port) and move the
keep-alive loop outside _server_lock so a second agent on a shared port is
no longer silently dropped and the process-wide lock isn't held forever.
- aexecute_task(): initialize memory via initialize_memory_async() to avoid
blocking the shared event loop on synchronous Memory() construction.
- MongoDBMemoryAdapter: factor embedding logic into shared _store/_search
helpers so short-term memory also gets/uses embeddings when
use_vector_search=True, matching the long-term tier.
Co-authored-by: MervinPraison <[email protected]>
These modules log exclusively via get_logger and never reference the
logging. namespace; the standalone import logging is dead code left over
from the get_logger migration. Removed it only where logging. is never
referenced (111 files); files that genuinely use logging. are untouched.
Co-authored-by: MervinPraison <[email protected]>
Delete two unreachable modules under context/fast/ that are never
imported, exported, or referenced anywhere in the SDK, tests, examples,
or docs:
- indexer/file_watcher.py (FileWatcher, IncrementalIndexer, ...)
- search_strategy.py (SearchStrategy, SearchState, SearchPhase)
Grep confirms only the definition sites matched; no importers exist.
Live FastContext path (fast_context, search_backends, parallel_executor,
indexer/file_indexer, symbol_indexer) is unchanged. No __init__.py edits
needed since neither module is exported.
Co-authored-by: Mervin Praison <[email protected]>
The registry.py copy of get_available_integrations() was unreferenced dead
code duplicating the canonical base.py implementation. The public symbol is
exported from integrations/__init__.py and lazily resolved via
_unified_registry.py, which binds to the base.py version. No importer, no
__all__ entry, and no internal caller referenced the registry.py copy.
Co-authored-by: MervinPraison <[email protected]>
Address three P1 review findings on the prompt-cache-stability contract:
- Wire GatewayMetrics into per-bot sessions via a new _stamp_metrics splice
(mirrors _stamp_admission_gate/_stamp_identity_resolver), called from both
start_channels and hot-reload, so prompt_cache_invalidations_total actually
increments in production instead of staying zero.
- Clear _prefix_sig in every session-clear path (_clear_session_data,
reap_stale, reset_all) so a reopened session establishes a fresh baseline
instead of emitting a false PROMPT_PREFIX_INVALIDATED against the old one.
- Fingerprint the full provider-visible tool schema (name + description +
parameters for dict tools, name + docstring for callables) instead of only
tool names, so a same-name schema edit is detected. Best-effort; never raises.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Core (praisonaiagents): new advisory HookEvent.PROMPT_PREFIX_INVALIDATED
and a pure prompt_prefix_signature(agent) that fingerprints only the
cache-relevant prefix (model + sorted tool names + system-prompt fp),
excluding volatile per-turn data. Kept out of agent.py to avoid bloat.
Wrapper/bot: BotSessionManager computes the signature after its per-turn
tool/model swaps, meters drift via an optional prompt_cache_invalidations_total
GatewayMetrics counter, and fires the advisory hook so silent provider
prompt-cache misses on long-lived conversations become auditable.
Co-authored-by: MervinPraison <[email protected]>
When team.astart() raises during a YAML/AgentTeam `--output stream-json`
run, the adapter now emits a terminal run.error event (best-effort,
without masking the original exception) before detaching the bridge,
matching the single-agent path's contract so consumers can distinguish
a failed run from an incomplete/still-running one. Fixes greptile P1.
Co-authored-by: Mervin Praison <[email protected]>
AgentTeam now exposes a lazy aggregate stream_emitter that fans in member
agents' StreamEventEmitter events, tagging each with the emitting agent's
agent_id. The PraisonAI adapter attaches the CLI stream-json bridge to this
team emitter around team.astart(), so `--output stream-json` on a YAML/team
run emits the same per-agent, per-step NDJSON stream as single-agent runs.
Both paths are zero-overhead no-ops outside structured output mode.
Co-authored-by: MervinPraison <[email protected]>
The event-loop liveness watchdog flags were only registered on the legacy
argparse parser in cli/features/gateway.py, which the real
`praisonai gateway start` Typer entrypoint (cli/commands/gateway.py) never
uses — so `--watchdog` / `--watchdog-timeout` were rejected at the primary
opt-in surface. Add both options to the Typer command and forward them to
GatewayHandler.start using the same None-means-fall-back-to-YAML convention
as the other store_true flags. `restart` already replays them via the
persisted start-flags. Adds 3 CLI-surface tests.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
Arm the existing core LoopWatchdog (#3385) around the gateway serving loop
so a frozen event loop dumps all-thread stacks and hard-exits with the
restart exit code, letting systemd/launchd/Docker relaunch the process.
Opt-in via gateway.watchdog YAML block and --watchdog/--watchdog-timeout
CLI flags; zero cost when disabled. No systemd unit change needed since it
reuses GATEWAY_RESTART_EXIT_CODE (75).
Co-authored-by: MervinPraison <[email protected]>
- Make add_message/_modify_session_locked run the whole read-modify-write
inside a single BEGIN IMMEDIATE transaction so concurrent gateway
processes cannot lose appends (the process-local RLock alone did not
serialize across processes). Fixes Greptile P1 lost-update.
- Import legacy per-session JSON transcripts once when the SQLite store
first opens beside them, so upgrading to the sqlite default preserves
durable/resumable history. Fixes Greptile P1 legacy-invisibility.
- Wire the YAML session.store key through MultiChannelGatewayConfig.from_dict
so store: file|sqlite is actually honoured.
- Add concurrent-writer and legacy-migration tests.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two P1 review findings on the RunOutcome terminal-outcome contract:
- Nested operation timeouts no longer misreported as run-budget hard_timeout.
RunOutcome.from_exception no longer promotes a bare asyncio.TimeoutError to
hard_timeout; the run-level budget is now the sole authoritative source of
hard_timeout, enforced explicitly in _astart_with_outcome via a task+wait so
only our own budget expiry maps to hard_timeout (inner TimeoutErrors -> failed).
- External asyncio.CancelledError is re-raised instead of being swallowed into a
benign RunOutcome, so cooperative cancellation / host shutdown is honoured.
Updates tests accordingly and adds coverage for nested-timeout->failed and
external-cancellation-propagates.
Co-authored-by: Mervin Praison <[email protected]>
Implement SqliteTranscriptStore(DefaultSessionStore) storing session
transcripts as one row per session in a WAL SQLite DB (concurrent readers,
transactional single-row writes, indexed lookups) instead of per-session JSON
files under a cross-process FileLock. It overrides only the persistence
primitives, inheriting all retention/compaction, message API, search scoring,
bookends and lineage-dedup logic unchanged.
Directory scans (list/search/gateway routing) are replaced with indexed
SELECTs. The gateway now defaults to this store when persistence is enabled,
selectable via a new `session.store` config key (`sqlite` | `file`).
Co-authored-by: MervinPraison <[email protected]>
Adds a small, closed RunOutcome result type in core plus an opt-in
return_outcome=True on run()/astart() so long-running hosts (gateways/bots)
can decide delivery/retry/DLQ from one field instead of inferring the
terminal state from exception identity. Distinguishes
completed|hard_timeout|cancelled|aborted|failed. String return unchanged.
Co-authored-by: MervinPraison <[email protected]>
Core save/restore_session_state only persist team._state, not per-agent
chat_history, so resumed/forked YAML team runs did not actually continue
the prior conversation (Greptile P1). Add wrapper-only capture/rehydrate
helpers that stash each agent's chat_history into team state on save and
re-inject it on restore — parity with the single-agent path, no core
change and no new Agent/AgentTeam params.
Also replace the source-text arun test with a behavioral call-order test
and add roundtrip/no-duplicate coverage for the chat-history helpers.
Co-authored-by: Mervin Praison <[email protected]>
Route YAML/team runs through the same --continue/--session/--fork/--no-save
continuity the single-agent prompt path uses, via existing core APIs.
- praisonai_adapter.arun(): resolve resume_session/auto_save from cli_config,
force-enable shared memory when a session is active, restore_session_state
before astart() and save_session_state after (save never fails a run).
- praison_ai._extract_cli_config_for_yaml(): thread resume_session/auto_save
into cli_config for `run agents.yaml`.
Wrapper-only; no new params/deps/core changes. Adds regression tests.
Co-authored-by: MervinPraison <[email protected]>
Address final-review P1s on #3401:
- Composite readers (AutoReader/DirectoryReader/GlobReader) now idempotently
wire the default readers into the core registry on first load(), so they no
longer silently return [] when register_default_adapters() was never called.
Keeps imports side-effect free (wrapper does heavy wiring at call time).
- _ensure_sibling() guards importlib.util.find_spec against ImportError/
ValueError from a discoverable-but-broken installed sibling, falling back to
the monorepo checkout instead of crashing.
Co-authored-by: Mervin Praison <[email protected]>
- Remove import-time auto-registration in adapters/{retrievers,rerankers,
readers}.py so importing them no longer mutates core-SDK singletons;
add idempotent, thread-safe register_default_adapters() single edge
(mirrors vector_stores.py policy).
- Make aretrieve()/arerank() genuinely async via asyncio.to_thread so the
blocking provider call no longer freezes the caller's event loop.
- Collapse the six copy-pasted ensure_praisonai_* functions in
_bootstrap.py into one _ensure_sibling() helper + table, fixing the
sys.path double-insert race with a lock.
Co-authored-by: MervinPraison <[email protected]>
Update _load_project_config docstring to reflect that home is now
excluded from project config discovery, and add two regression tests
covering the home-directory walk-up boundary.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1s on MTP fast-inference PR:
- export gguf now produces a LOCAL .gguf (needed by serve/--mtp-draft) and
only additionally pushes to the Hub when --hf is given (was Hub-only).
- find_llama_binary no longer returns a differently-named executable when
LLAMA_CPP_BIN points at one binary and a sibling is requested; falls through
to PATH / raises instead of launching e.g. llama-cli with server flags.
- Ollama disk preflight only enforces the 1.5x requirement when the source
size is known; skips (no false-positive block) for Hub-backed FROM.
Adds 6 tests (binary-lookup mismatch cases, gguf local/push dispatch,
unknown-source disk skip); full praisonai-train unit suite 118 passed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Remove three module-level helpers that were never referenced anywhere in
the monorepo and were not part of the public API (no __all__, absent from
config/__init__.py and the top-level lazy-import map):
- parse_url_to_config
- is_numeric_string
- make_array_error
All exported/used helpers remain untouched.
Co-authored-by: MervinPraison <[email protected]>
Move the module-level `from pathlib import Path` into each
`ensure_praisonai_*` monorepo-dev fallback branch. Path is only ever
referenced after the `import praisonai_<pkg>` early-return fails, so the
installed-wheel hot path no longer pays pathlib's ~8.7ms cold-import cost.
Behaviour is byte-for-byte identical.
Co-authored-by: MervinPraison <[email protected]>
Addresses two correctness gaps in the crash-recovery labelling (PR #3388):
- CodeRabbit: hand recovery_annotator its own fresh payload copy and only
adopt a dict result, so a mutate-then-raise no longer leaks a half-labelled
payload; validate non-dict returns.
- Greptile P1: keep a crash-recovered entry in the 'recovered' state on a
transient re-send failure (mark_failed keep_recovered) so the duplicate
label survives the retry instead of being demoted to 'failed' and dropped.
Adds 3 regression tests (mutation-then-raise fallback, non-dict return,
sticky-recovered retry). All 69 outbox/delivery/reconcile tests pass.
Co-authored-by: Mervin Praison <[email protected]>
- disarm racing an in-flight wedge no longer triggers os._exit (re-check
_stop before the destructive exit) so a deliberate disarm never causes a
supervisor restart (Greptile P1)
- reject NaN/inf probe_interval_s to avoid a dead watchdog worker or a
hung shutdown via Event.wait/Thread.join (Greptile P2)
- add tests for both cases
Co-authored-by: Mervin Praison <[email protected]>
Add an optional recovery_annotator hook to OutboundQueue.drain, applied only
on the unreconciled 'recovered' branch, so a mid-send-crash message re-sent
at-least-once can be visibly marked as a possible duplicate instead of being
re-delivered silently. DurableDelivery gains a backward-compatible
mark_recovered flag (off by default) that prefixes recovered string replies
via _annotate_recovered_payload, threaded through setup_durable_delivery.
Co-authored-by: MervinPraison <[email protected]>
Add a pure-stdlib, fail-open LoopWatchdog primitive to core
(praisonaiagents.gateway) that runs on a dedicated OS thread, probes the
asyncio loop via call_soon_threadsafe, and after N missed probes dumps
all-thread stacks (faulthandler) and hands the process back to the
supervisor via os._exit(EX_TEMPFAIL). Opt-in and fail-open by design.
Co-authored-by: MervinPraison <[email protected]>
Passive-recorded group messages now land on the same shared per_chat
group key that a subsequent addressed turn reads from, so under
session_scope="per_chat" the bot can actually see the preceding
conversation (Greptile P1 / CodeRabbit Major). record_passive() threads
chat_id/thread_id/account routing and appends directly under a per-key
threading lock instead of the cross-thread mirror bridge, which would
dead-lock when called inline on the inbound handler's own event loop.
Strengthened the observe test to assert routing is threaded and added a
real BotSessionManager per_chat persistence test proving the passive
entry is visible under the group key and does not leak into the sender's
per_user history.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1s on the restart-continuation path:
- boot scan requested an explicit large limit so interrupted turns beyond
the store's 50-session default window are no longer silently skipped
- channel_target now falls back to the persisted client_id when it encodes
a channel:target origin, so the field is a live consumer of existing
state rather than dead code for sessions the setter never touched
Adds tests for client_id-derived origin and >50-session scan coverage.
Co-authored-by: Mervin Praison <[email protected]>
A malformed gateway.drain_timeout / gateway.reload_drain_timeout in a
hot-reload edit made _coerce_timeout() return None, which was assigned
unconditionally and silently cleared a previously-configured live drain
window. Distinguish malformed (keep live value via _KEEP sentinel) from
explicit disable (None/absent -> None). Update/extend tests accordingly.
Co-authored-by: Mervin Praison <[email protected]>
On boot, before serving traffic, scan persisted sessions for an in-flight
turn (is_executing / non-empty pending_inbox) lost to a restart. For
channel-originated sessions, deliver an exactly-once "interrupted — resuming"
notice via the existing durable delivery router (idempotency keyed on
(session_id, event_cursor)) and re-drive the turn when the agent is still
registered — independent of any client reconnect.
Reuses the existing durable session store + delivery router rather than
adding new core protocol machinery, keeping the change lightweight and
backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
Add a core HOT_APPLIABLE_KEYS registry + SupportsHotReload protocol in
praisonaiagents/gateway/config.py declaring the closed set of config paths
safe to apply in place. The bot gateway now classifies those paths as HOT in
_build_reload_plan (unknown keys still fall back to a restart plan — fail-safe)
and implements apply_hot_reload to mutate live state (logging level, drain /
reload_drain timeouts) without restarting channels or agents. Applied paths are
already reflected in the existing reload status/health.
Co-authored-by: MervinPraison <[email protected]>
Under the observe policy, group messages that do not mention the bot are
recorded into the session transcript as passive user context (no agent run)
so the bot has memory of the conversation when it is next addressed.
Reuses the existing thread-safe mirror append path via a new
BotSessionManager.record_passive() instead of adding a new core enum /
classifier, keeping the surface area minimal.
Co-authored-by: MervinPraison <[email protected]>
- Reject path-separator/traversal agent names (validate_agent_name) so
writes stay inside .praisonai/agents/ (Greptile Security P1).
- Post-write validation now re-parses the exact file written instead of a
precedence lookup, and warns when a higher-precedence definition shadows
the name so the reported `run --agent` step is never misleading (P1).
- Add tests for traversal rejection and global/project shadow warning.
Co-authored-by: Mervin Praison <[email protected]>
Add a `create` command beside `list`/`show` on the agent Typer app that
authors a valid, permission-scoped .praisonai/agents/<name>.md from a one-line
description. Interactive prompts plus a scriptable
--describe/--model/--permission/--global/--yes form. Permission presets reuse
the existing `mode` shorthands (MODE_RULES) so authored agents round-trip
losslessly through CustomDefinitionsDiscovery and inherit the runtime's
permission grammar. System-prompt drafting reuses the plain Agent path proven
by `init --generate`, degrading to an editable stub on any failure.
Co-authored-by: MervinPraison <[email protected]>
- _shim.py: skip None placeholders in sys.modules when pre-aliasing the
moved subtree so an unloaded optional module can't poison the old dotted
name (import old.sub -> "None in sys.modules"); _AliasFinder still resolves
it on demand.
- codex_cli.py: use an _UNSET sentinel in _build_command so an explicit
output_file=None disables the instance default and parses stdout, instead
of silently falling back to self.output_file (execute_with_schema).
Co-authored-by: Mervin Praison <[email protected]>
Restores eager subtree pre-registration in _shim._register_submodules. The
lazy-only variant broke module identity: a combined `from praisonai.mcp_server.cli
import X` imported the parent shim, then resolved `.cli` through _AliasFinder,
whose nested import_module re-entered mid-import under the import lock and
double-loaded the moved file — producing duplicate classes and breaking the
15 mcp/doctor CI tests that patch the shim path.
Also make the forced-format integration helpers (gemini stream/execute_with_stats,
codex stream, cursor stream) pop caller-supplied override keys before threading
the forced value, matching claude_code.py, so callers can't trigger a duplicate-
keyword TypeError (greptile P2).
Co-authored-by: Mervin Praison <[email protected]>
Address 4 P1 review findings in eval/trials.py:
- Isolation: rebind clone.chat_history to a fresh list and give the clone its
own system-prompt cache so per-attempt state resets never mutate/evict the
caller's live agent state.
- Scorer safety: a raising EvalCase.verify (and any scorer path) is now
recorded as a failed TrialScore instead of propagating through gather and
aborting the whole report.
- Timeout: run attempts on a dedicated ThreadPoolExecutor shut down with
wait=False so a wedged agent call cannot block run_trials past the timeout;
documented that a leaked worker thread cannot be force-killed.
- Duplicate case names: merge/extend attempts (with re-numbered indices)
instead of overwriting, so no attempts are silently discarded.
Add 4 regression tests covering each fix.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address three P1 issues in the trials→SFT exporter:
- --all (only_passed=False) now retains unscored attempts instead of
dropping them in _classify.
- Alpaca conversion no longer drops the user prompt when a system message
is present; system→instruction, all user turns→input.
- Score-only pass detection compares against the report's pass_threshold/
threshold/min_score when present, falling back to score>0 only otherwise.
Co-authored-by: Mervin Praison <[email protected]>
- session/hierarchy.py: mirror base loader contract so a transient OSError on
an existing file re-raises (instead of swallowing IOError and returning an
empty session), letting _modify_session_locked abort the write and preserve
history. Malformed JSON still starts fresh.
- approval/registry.py + agent/tool_execution.py: add per-call `force` to
approve_sync/approve_async so a PermissionManager `ask` rule gates only the
current call without mutating shared registry state, fixing the leak where an
unnamed agent's rule registered globally and gated other agents.
Co-authored-by: Mervin Praison <[email protected]>
Bridge verification to data generation: take a serialised trials report
(K scored attempts per case with captured trajectories), keep the passing
attempts via rejection sampling, and write them as a ShareGPT dataset the
existing trainer consumes unchanged. Adds export_trials() + ExportSummary,
provenance sidecar ({path}.meta.json), and a `from-trials` CLI command
beside generate/dedup/validate. Report is duck-typed over JSON (the contract
with the sibling core trials engine) so there's no hard dependency on unlanded
core code. Pure stdlib, additive, confined to the data namespace.
Co-authored-by: MervinPraison <[email protected]>
Gap 1: replace threading.local() handoff-chain storage with contextvars.ContextVar so concurrent asyncio handoffs no longer share one chain and corrupt each other's cycle/depth checks.
Gap 2: distinguish a transient OS read error from no-file/corrupt-JSON in the session store so a momentary read failure aborts the write (returns False) instead of silently overwriting real history with an empty session.
Gap 3: scope ApprovalRegistry tool-requirement state per agent so a per-agent PermissionManager ask rule no longer leaks an approval gate onto unrelated agents in the same process. Global registration (DEFAULT_DANGEROUS_TOOLS) is unaffected.
Co-authored-by: MervinPraison <[email protected]>
- Accept cached `huggingface-cli login` (get_token) in preflight, not just HF_TOKEN env (Greptile P1)
- Gate the hard CUDA check on train enabled so publish/export-only (train: false) validates on CPU (CodeRabbit Major)
- Resolve Ollama readiness endpoint from OLLAMA_HOST instead of hardcoded 127.0.0.1:11434 (Greptile P1)
- Translate `ollama create` failure into a clean RuntimeError and catch CalledProcessError in main()/export (CodeRabbit)
- Close serve_err TemporaryFile deterministically (CodeRabbit)
- Fix "Free up free space" typo (CodeRabbit)
- Guard non-mapping YAML config and require --model-dir to be a directory in export (CodeRabbit)
- Validate quantization_method in for_export too (CodeRabbit)
- Add tests for cached-login, train:false CPU, OLLAMA_HOST, and ollama-create failure
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Make praisonai-train usable by a non-developer: replace raw tracebacks with
clean actionable errors, validate the config up front, and harden the
Ollama/GGUF/HF export paths against the exact failures hit in practice.
trainer.py:
- main() wraps construction + run(); ValueError/RuntimeError print as a single
"ERROR: <msg>" line and exit 1 (no traceback); KeyboardInterrupt exits cleanly.
- validate_config() preflight (fails fast BEFORE model/GPU load): no-CUDA GPU,
missing HF_TOKEN when publishing, <10GB free disk, invalid quantization_method.
- check_gpu() guarded so it no longer crashes raw on a CPU-only box.
- Unknown-key warning now collects all keys and suggests the closest known key
(difflib) in one clear block.
- Silent-behavior NOTES: num_samples head-N-before-shuffle, split_type
validation/test contamination into training, and the max_steps=2800 default.
- HF push (merged/gguf) translates HfHubHTTPError 401/403 into actionable
messages; rmtree guarded so a namespaced repo id ("user/model") is never
treated as a local path to delete.
- Template fixes: warn when no known chat template matches, drop the broken empty
DeepSeek stop tokens, and never emit an empty PARAMETER stop line.
- for_export() classmethod to build an export-only trainer (no dataset needed).
_ollama.py:
- create_and_push_ollama_model() accepts optional quantization (--quantize),
disk pre-check on the OLLAMA_MODELS volume, and translates push 401/403 into a
message pointing at ~/.ollama/id_ed25519.pub + ollama.com/settings/keys.
- ensure_ollama_running() waits 15s, probes GET /api/version, and surfaces serve
stderr in the timeout message.
cli/commands/train.py:
- New `export <ollama|gguf|hf>` command to publish an already-trained model
without re-running training.
tests: tests/unit/train/test_robustness.py (14 tests, all deps stubbed).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add build_openai_tool_dict to mcp_schema_utils.py and delegate from the
three transport tool classes (HTTPStreamMCPTool, SSEMCPTool,
WebSocketMCPTool). Output dicts, including the __praisonai_deferrable__
marker, are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Replace flat len(text)//4 offline fallback in ContextCompactor.estimate_tokens
with the canonical estimate_tokens_heuristic from context.tokens, mirroring
context/aggregator.py. This removes duplicate logic and fixes under-counting
of non-ASCII (CJK/dense-script) text on the offline path.
Co-authored-by: MervinPraison <[email protected]>
Move wrapper-package discovery out of the Tier 2 ui.py CLI into the lazy
_wrapper_bridge via a new wrapper_package_path() helper, per ARCHITECTURE.md
§2 cross-tier boundary. Preserves preset resolution and the None fallback
(install hint) when the wrapper is absent.
Co-authored-by: Mervin Praison <[email protected]>
The UI loader was extracted to praisonai_code but resolved the bundled
default_app.py path via __file__-relative arithmetic anchored in
praisonai_code, which has no ui_* directories. The five bundled UI presets
ship in the praisonai wrapper package. Resolve the path against the installed
wrapper via importlib.util.find_spec("praisonai"), falling back to a clear
'pip install "praisonai[ui]"' hint when the wrapper is absent.
Co-authored-by: MervinPraison <[email protected]>
The executor context manager called shutdown(wait=True) on __exit__, which
re-blocked on a coroutine still hung past PRAISONAI_RUN_SYNC_TIMEOUT — defeating
the timeout (Greptile P1). Manage the pool explicitly and shutdown(wait=False)
in finally so a timed-out tool call returns immediately.
Co-authored-by: Mervin Praison <[email protected]>
The wrapper copy of agent_tools.py had drifted from the canonical
praisonai_code copy (missing the ACP cwd forwarding fix), and the two
resolved via different import spellings. Collapse the wrapper copy to a
thin re-export of the canonical praisonai_code implementation so both
import styles resolve to a single owner.
Reconcile the canonical module-local _run_sync bridge to keep the union
of both historical guarantees: running-loop safety (offload to a worker
thread) AND a timeout, without adding a wrapper dependency (C7 gate).
Co-authored-by: MervinPraison <[email protected]>
Address Greptile P1 review findings on PR #3358:
- _remove_worktree now returns a reason string when `git worktree remove`
fails (nonzero exit or exception) instead of silently returning None.
The caller keeps the tracking entry and records a preservation comment,
preventing orphaned worktrees/branches with dropped tracking.
- create_task persists the resolved top-level repo_path into task metadata
so the repo linkage that drove the worktree auto-upgrade is retained
between create and dispatch (an explicit metadata.repo_path still wins).
Adds tests for failed/exception removal tracking and repo_path persistence.
Co-authored-by: Mervin Praison <[email protected]>
Refinement 1: repo-linked tasks auto-upgrade workspace_kind to "worktree" at
create_task time (linkage-based, not content-inspecting). Explicit
workspace_kind and auto_worktree=false are respected. Derived branch
kanban/<task_id> is persisted for the dispatcher to consume.
Refinement 2: _remove_worktree is lossless by default — refuse to delete a
worktree that is dirty or has commits not in base; preserve it and record a
worktree_preserved comment. Removal with outstanding work is an explicit
force operation only.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two P1 review issues on the workspace-binding change:
- Resolve the UnifiedSession once (before workspace binding + tool load) and
pass it into _bind_resume_workspace, eliminating a second independent
last-session lookup that could race a concurrent CLI process and bind tools
to a different directory than the loaded conversation.
- When a resumed session's saved workspace no longer exists, pin
PRAISONAI_WORKSPACE to cwd instead of leaving it unset, so a stray legacy
PRAISON_WORKSPACE cannot leak through the tool loader and contradict the
"using current directory" warning.
Adds regressions for cwd-pinning over the legacy var and for
provided-session-without-relookup; updates the existing fallback test.
Co-authored-by: Mervin Praison <[email protected]>
Bot/gateway file tools resolve against a per-session Workspace attached to
the agent after construction, but the FileSnapshot backing Agent.undo was
created rooted at os.getcwd() — so /undo tracked the wrong directory.
Add Agent.set_snapshot_root() (core, parameter-only) and call it from the
bot smart-defaults after attaching the workspace so change tracking follows
the tools. Deliberately minimal: the per-turn workspace swap (bug 3) and
policy worktrees (blocked on #3354's WorktreeService) are out of scope here.
Co-authored-by: MervinPraison <[email protected]>
The `praisonai code --workspace` flag was dead: it wrote PRAISONAI_WORKSPACE
but ToolConfig.from_env read PRAISON_WORKSPACE, and _load_interactive_tools
unconditionally overrode config.workspace with os.getcwd(). Fix the env-name
mismatch (honour both, prefer canonical PRAISONAI_) and resolve the workspace
as PRAISONAI_WORKSPACE -> PRAISON_WORKSPACE -> cwd instead of hardcoding cwd.
Also bind resumed sessions to their directory: --continue/--session now reads
back the persisted UnifiedSession.workspace and roots the tools there, warning
and falling back to cwd when that directory is gone.
Scope kept minimal per AGENTS.md: no new WorktreeService — worktree isolation
already exists via core GitWorktreeAdapter (wired into `praisonai run`), so a
parallel wrapper service would duplicate it.
Co-authored-by: MervinPraison <[email protected]>
The gateway status command now passes the additive deep flag to
handler.status(); update the assertion to match the new backward-
compatible default.
Co-authored-by: Mervin Praison <[email protected]>
- Only attach GATEWAY_AUTH_TOKEN over loopback or HTTPS; never over remote
plaintext HTTP in preflight probes and version-skew check
- Slack @mention: use hook-returned content verbatim so an intentionally
emptied/redacted message is not silently restored to raw event text
- Inbound metrics: track whether a baseline pre-existed so the first check
against pre-existing traffic reports "baseline established" instead of a
false "no inbound"
Co-authored-by: Mervin Praison <[email protected]>
Extend gateway test/status with --check-runtime, --check-inbound, and
--check-duplicates; add sessions list/show, enriched /health, metrics
delta, doctor deep checks, and Slack @mention liveness fixes so operators
can prove live delivery and detect competing gateways.
Addresses the Greptile finding that reconnect() restarts the same bot
instance still holding the rejected token. On wake from the parked
credential state the supervisor now opportunistically calls an optional,
duck-typed refresh_credentials() hook so an out-of-band credential repair
(e.g. a rotated env var) driving a bare reconnect() self-heals without a
full restart. No-op for bots without the hook (env-var tokens are already
re-resolved by start()/hot-reload). Best-effort: a failing hook cannot
wedge supervision.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address two P1 review findings on the gateway restart-replay change:
- Only persist the start-flags artefact AFTER startup validation passes
(import/config/agent-file), just before the gateway binds, so a failed or
rejected start on the same host:port no longer clobbers the running
gateway's saved posture.
- restart --drain-timeout now defaults to None; an omitted flag replays the
persisted drain window (and falls back to 10s only when none is persisted)
instead of silently forcing a fixed 10s and shortening production drains.
An explicit value still wins for both the OLD-process drain and the relaunch.
Adds 3 regression tests covering omitted/explicit drain replay and the
no-persisted-value fallback.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Direct (non-service) `gateway restart` silently dropped the runtime flags
the process was started with (--openai-api, --reliability,
--max-concurrent-runs, ...), reverting production settings to defaults.
`start` now persists the non-None runtime flags to
~/.praisonai/gateway.start.<host>.<port>.json (keyed by bind host:port,
matching the PID lock), and `restart` loads and replays them so the
relaunch faithfully reproduces the running gateway. Explicit restart flags
(config / agents / drain-timeout) still win over persisted values.
Co-authored-by: MervinPraison <[email protected]>
Classify runtime 401/403 (and platform text equivalents like invalid_auth/
token_revoked) as a distinct CREDENTIAL_UNAVAILABLE outcome instead of a
generic FAILED. On a runtime credential rejection the supervisor now parks in a
named, redacted degraded state (reusing the boot-time "credential unavailable"
surface from #3159 in health()), stops hammering the invalid token, and
auto-recovers on reconnect/hot-reload without a full process restart.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 review findings on praisonai init --generate:
- Streaming stringified: _generate_agents_md used agent.start(), which
auto-enables streaming in a TTY and returns a generator whose repr was
written to AGENTS.md. Switch to agent.run() (always silent, returns str).
- Global mode wrote ~/AGENTS.md: with --global, base.parent is $HOME so the
agent scanned home and wrote home-tailored rules outside the repo. Resolve
the AGENTS.md target from git root / cwd independently of --global.
Add tests: --global still writes AGENTS.md to the repo root (not home), and
_generate_agents_md calls run() (not start()) returning the string body.
Co-authored-by: Mervin Praison <[email protected]>
Addresses the two Greptile P1 findings on #3346 so the non-zero-on-failure
contract holds across every reachable run path:
- _run_from_file: add `except typer.Exit: raise` so the deliberate failure
exit is not recaught by the broad handler (fixes duplicate reporting).
- _try_attach_runtime: classify the warm-runtime result and report failure so
an empty result exits non-zero instead of silently succeeding.
- _run_prompt_profiled / _run_from_file_profiled: apply the same failure
contract after the profiling report so profiled runs honour it too.
Adds a regression test for the warm-runtime attach path.
Co-authored-by: Mervin Praison <[email protected]>
Adds an opt-in `--generate` flag to `praisonai init` that runs a short,
read-only analysis agent (reusing the existing Agent runtime) to produce a
concise, repository-tailored AGENTS.md at the repo root. Feeds the agent a
cheap pre-scan (top-level tree, detected manifests, README head) to bound cost.
Non-destructive: respects --force, never overwrites an existing AGENTS.md, and
degrades gracefully to the static scaffold when no provider credential is
present or generation fails. The output lands where rules_manager already
discovers it on the next run.
Co-authored-by: Mervin Praison <[email protected]>
praisonai run reported success and exited 0 regardless of whether the
agent produced a result. Wire the existing run result (None/empty ==
failure) through the CLI: emit ok=<success> to the event bridge, a
machine-readable {"status": "failed"} object under --output json, an
actionable remediation, and raise typer.Exit(1) on failure — mirroring
the existing arg-error exit convention. Successful runs are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
The running-loop fallback in _structured_completion/_run_coro_sync spawned a
bare threading.Thread, which does not inherit contextvars. run_sync() inside it
therefore resolved via _default_bridge() -> empty _bridge_var -> shared _BG,
bypassing an active scoped_bridge() and leaking the fallback onto the global
loop. Run the worker under contextvars.copy_context() so both paths resolve the
same AsyncBridge (scoped override, else shared default), preserving per-session
loop isolation.
Co-authored-by: Mervin Praison <[email protected]>
- auto.py: runner threads in _structured_completion and _run_coro_sync now
dispatch to the shared AsyncBridge via run_sync() instead of asyncio.run(),
reusing one process-wide loop/thread and per-loop connection pools.
- auto.py: _completion_impl preserves the original LiteLLM exception and
chains it into the OpenAI fallback failure (raise ... from) so users see
both provider tracebacks instead of only the masking OpenAI one.
- registry.py: _validate_adapter treats a **kwargs catch-all as satisfying
the protocol keywords and also validates arun, unblocking third-party
entry-point adapters that forward **kwargs.
Co-authored-by: MervinPraison <[email protected]>
Embed turn prerequisite errors into the JSON payload instead of printing a
trailing plain-text line, so --json consumers get a single valid document.
Also drop dead critical-tool branch in is_already_approved.
Co-authored-by: Mervin Praison <[email protected]>
1. Circuit breakers: register weakref.finalize at breaker creation so the
process-global registry entry is removed when the Agent is GC'd, closing
the CPython id-reuse window where a new agent could inherit a stale OPEN
breaker. No longer relies on close()/aclose() being called. Uses a
staticmethod callback so the finalizer does not keep the agent alive.
2. Global tool-registry fallback: gate the @tool registry lookup in
execute_tool() behind ToolConfig(allow_global_tools=True) (default False).
By default an agent is scoped strictly to its declared tools=[...] and
cannot execute an @tool-decorated callable it was never given. Plugin-host
style dynamic dispatch can opt in via tool_config.
3. Sync run_task(): re-raise on fail_on_callback_error / fail_on_memory_error,
mirroring arun_task() so the documented fail-fast flags behave identically
on the sync and async surfaces.
Co-authored-by: MervinPraison <[email protected]>
Extract shared probe/shell/turn logic to praisonai_bot.gateway.preflight,
add praisonai gateway test orchestrator, doctor bots shell/probe checks,
fix doctor --json single-document output, and per-channel turn probe gate.
Critical tools honour mark_approved via the approval registry, shell enable
syncs AutoApproveBackend to the registry, @mentions run routing handlers,
and gateway doctor gains an offline --turn probe for inbound simulation.
Addresses two Greptile P1 findings on the allow_shell opt-in:
1. Routed agents lose shell tools: _inject_routing_handler swapped in a raw
agent from self._agents, stripping execute_command applied to the default
channel clone. Re-apply enable_shell_tools to the routed agent (cloned once
per channel+agent so non-shell channels never gain the shell tool).
2. Manual approval retained auto-approval (security): with auto_approve_shell
false and no Slack approval channel, a pre-existing AutoApproveBackend was
left installed, silently auto-approving shell. Now fail-closed with a
deny-by-default backend that rejects shell commands.
Adds tests for both fail-closed approval paths.
Co-authored-by: Mervin Praison <[email protected]>
- Fix missing approval_webhook_url becoming the literal string "None"
which bypassed WebhookApproval's ValueError guard; now falls through
to platform/gateway approval instead of building a broken backend
- Add fail-closed approval_mode validator (channel|gateway|http|webhook)
so config typos are rejected at load time, matching other enum fields
- Add regression tests for webhook-mode with and without a URL
Co-authored-by: Mervin Praison <[email protected]>
Extend allow_shell to route human-in-the-loop approvals through platform
backends (Slack/Telegram/Discord) plus gateway, HTTP, and webhook modes,
with gateway fallback for channels without native wiring.
Address reviewer feedback on the CLI_BACKEND_EXECUTE hook path:
- Security: redact prompt/system argv values (redact_command) at the
payload serialization boundary and in the plugin bridge, so prompts and
system instructions do not leak into downstream log sinks. The live
in-memory command field is preserved for programmatic consumers.
- Observability: emit the hook on failure too (extracted
_emit_cli_backend_hook helper) so subprocess startup errors and timeouts
remain traceable via error=<message>, instead of only on success.
- Tests: cover redaction (serialization + plugin bridge) and failure-path
hook emission.
Co-authored-by: Mervin Praison <[email protected]>
Log subprocess command and confirm PraisonAI skips LLM HTTP when cli_backend delegates a turn.
Enable with PRAISONAI_CLI_BACKEND_DEBUG=1 or LOGLEVEL=DEBUG.
Gemini backend forwarded --resume on every turn including the first,
which would fail resuming a non-existent session. Gate on
CliSessionBinding.is_resume for parity with codex/grok/claude.
Co-authored-by: Mervin Praison <[email protected]>
Codex backend never forwarded the session id to `codex exec`, so
multi-turn conversations lost context (Greptile P1). Now forwards
`resume <session_id>` on resume turns. Gate both codex and grok
session forwarding on CliSessionBinding.is_resume so the first turn
does not attempt to resume a non-existent session.
Co-authored-by: Mervin Praison <[email protected]>
- Isolate ANTHROPIC_TOKEN/CLAUDE_CODE_OAUTH_TOKEN env in the expiring-token
test so the Keychain read-only path is deterministically exercised (was
leaking a real CI OAuth token and returning the wrong access token).
- Assert both anthropic-beta policy changes: fine-grained-tool-streaming is
present and the unsupported context-1m long-context beta stays absent
(per CodeRabbit review).
Co-authored-by: Mervin Praison <[email protected]>
PraisonAI read Keychain OAuth tokens but refreshed without persisting back,
rotating refresh tokens and breaking Claude CLI and other tools on the same
machine. Use read-only credential resolution, skip LLM auth refresh for
claude-code, fix invalid_request_error misclassification, and drop the
context-1m beta header unsupported on many subscriptions.
The async retry loop emitted RETRY events via the sync emit() path, so
consumers registered through the public add_async_callback() API passed
has_callbacks but never received the event. Add an async-aware
_aemit_retry_stream_event helper (using emit_async) and share event
construction via _build_retry_stream_event. Adds tests for the async-only
callback path and the no-callback no-op case.
Co-authored-by: Mervin Praison <[email protected]>
Add StreamEventType.RETRY emitted alongside the existing ON_RETRY hook (guarded by has_callbacks for zero-overhead) in both sync and async retry loops, carrying attempt/max_attempts/delay/reason in metadata. Map it to a canonical run.retry NDJSON event in the CLI stream-json bridge so consumers get a live 'retrying in Ns (attempt k/N)' signal. Non-JSON/silent modes stay silent.
Co-authored-by: Mervin Praison <[email protected]>
A TypeError/ValueError raised inside a successfully-bound tool (domain
validation) no longer receives a misleading required/optional parameter
hint. The hint is now gated on inspect.signature().bind() confirming the
failure is an argument-binding error, so runtime errors surface their
real message and the model fixes the value, not the parameter names.
Co-authored-by: Mervin Praison <[email protected]>
Adds a zero-overhead resilience layer to the core agent tool-dispatch path.
When a tool call cannot be resolved, the runtime now:
1. Self-repairs case/separator drift (e.g. WebSearch/web-search -> web_search)
against the agent's active tools and executes if a unique match exists.
2. Otherwise returns a model-readable error naming the nearest valid tool
(fuzzy) and listing the available tools so the model can self-correct.
3. On an argument-binding failure, echoes the tool's required/optional params.
No new public API or Agent params; stays on the existing dispatch path.
Co-authored-by: MervinPraison <[email protected]>
- Security: refuse non-localhost bind without --api-key/PRAISONAI_SERVE_API_KEY,
mirroring jobs/server.py; enforce the resolved key unconditionally.
- Performance: cache one AgentsGenerator per app via FastAPI lifespan (built at
startup, closed on shutdown) instead of rebuilding YAML parse + framework
resolution + a 32-worker pool per request; falls back to praisonai.arun if
caching fails.
- Correctness: /agents and /agents/{name} now run the same cached generator, so
identical YAML gets identical lowering (ToolResolver, tool_timeout, approval,
guardrails, retry). Removed the hand-rolled PraisonAgent registration that
silently dropped those safety fields.
Co-authored-by: Mervin Praison <[email protected]>
Remove 13 knowledge.db binaries plus managed_ids.json, blog_post.md,
tutorial.md, token_metrics_export.json, market_research_results.json that
were accidentally committed (PR notes explicitly say not to commit local
artifacts). Add .gitignore rules to prevent recurrence.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #3321:
- Core neutralize_untrusted_text now also collapses U+2028/U+2029/U+0085,
which render as line breaks but bypassed the ASCII control filter.
- Bot _attribute() fallback (core helper unavailable / version skew) now
mirrors the sanitiser: collapses all newline-like separators, strips
control chars, and bounds length.
- Added tests for Unicode separators (core + bot) and the fallback path.
Co-authored-by: Mervin Praison <[email protected]>
Add a core, pure-stdlib helper neutralize_untrusted_text() in
praisonaiagents.session.context and apply it by default to the
third-party-controlled sender display name before it is interpolated into
the [{sender}] attribution prefix. Newlines/CR are collapsed, control chars
stripped and length is bounded, so a hostile name can no longer masquerade
as a fake system directive the model re-reads every turn. Well-behaved names
render byte-identically. On by default, no new config knobs.
Co-authored-by: Mervin Praison <[email protected]>
Addresses greptile P1: CapabilityValidator cached the first _get_available_servers()
snapshot, so a skill validated before its MCP server registered via with_tool_prefix()
stayed permanently UNAVAILABLE under STRICT even after the server connected. The MCP
registry read is a cheap set copy, so query it live and drop the dead _server_cache
field (issue #3307).
Co-authored-by: Mervin Praison <[email protected]>
The durable-reference encoding for long interactive reply/select values only
took effect when a shared store was explicitly passed in tests; every
production renderer/registry used the no-store default and fell back to the
unrecoverable hash. This shares one InMemoryCallbackPayloadStore between the
Telegram render side (render_presentation -> adapt_presentation) and the inbound
registry so long values round-trip losslessly past the 64-byte callback cap.
- create_registry(store=): thread an optional store into the InteractiveRegistry
- TelegramPresentationRenderer.render(callback_store=): pass store to adapt
- TelegramBot: construct one shared store, inject into registry + render
- add regression test asserting production render+dispatch round-trip
Co-authored-by: Mervin Praison <[email protected]>
- POST /agents/{agent_name} now dispatches to the requested registered agent
and returns 404 for an unknown name, instead of silently running the whole
YAML workflow (fixes named-agent regression flagged in review).
- Both routes build a lightweight per-request AgentsGenerator that borrows the
cached generator's shared adapter, tool-timeout pool and resolver while owning
its own cli_config, so concurrent requests overlap without a run-length lock.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two P1 review findings on the tool self-repair path:
- Fold the bind-failure parameter schema into the error string so it survives
conversion to ToolExecutionError (which keeps only the message) and reaches
the model.
- Expand MCP instances into their contained tools via a shared
_iter_active_named_tools() helper so MCP tool names participate in
case/separator repair and appear in the corrective inventory instead of an
empty/opaque container.
Adds 3 tests (public-path param hint, MCP inventory, MCP name repair).
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on the prompt-injection defence:
- Greptile P1 (security): the bot's _attribute() fallback (taken when the
core helper import fails on an older praisonaiagents still allowed by the
>=1.6.152 range) only replaced CR/LF, leaking control chars and oversized
display names into every shared-chat prompt. It now mirrors the core
helper: collapse newlines, strip control chars, collapse whitespace and
length-bound to 240 — byte-identical to neutralize_untrusted_text.
- Greptile P2: neutralize_untrusted_text with max_chars<=3 returned the
3-char "..." string, exceeding the advertised bound. Small bounds now
truncate hard so len(out) <= max_chars always holds.
- Tests: add small-bounds regression (core) and a fallback-path hostile-name
regression that forces the helper import to fail (bot).
Co-authored-by: Mervin Praison <[email protected]>
An unquoted bare prompt (praisonai build a weather agent) arrives as
multiple argv tokens, but the modern `run` command takes a single
positional target. Join the flag-free tokens into one argument so the
whole prompt reaches `run` intact instead of Typer rejecting the extra
positionals. Addresses Greptile P1 (multi-token prompt).
Also adds a regression test pinning that flagless operational commands
(serve/call/realtime/debug/lsp/diag) stay Typer commands and are never
misrouted to `run` as prompts (Greptile P1 #2 was a false positive).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Interactive reply/select values that exceed a channel's callback byte-cap
(e.g. Telegram's 64-byte limit) were hashed with no way to recover the
original value, so long option values (URLs, file paths, free-text) made
menus silently non-functional. This generalises the durable-reference
pattern already used by approvals to ordinary interactive callbacks.
- Add CallbackPayloadStoreProtocol (peer of ApprovalStoreProtocol) plus a
bounded, zero-dependency InMemoryCallbackPayloadStore default in core.
- Encoders persist an overflowing value under a short reference and emit
reply:@<ref> / select:<action_id>:@<ref>; inline values are unchanged.
- InteractiveRegistry(store=...) resolves @<ref> back to the exact value on
dispatch, preserving the select action_id prefix, and fails closed on an
unknown/expired reference. Without a store the prior hash behaviour is kept.
Additive and backward compatible: adapt_presentation gains an optional
callback_store kwarg; registry gains an optional store arg.
Co-authored-by: MervinPraison <[email protected]>
Gap 1: Port sync workflow()'s loop-task pre-expansion into aworkflow() so
async CSV-driven loop start tasks run per-row instead of once.
Gap 2: Guard the per-turn tool buffer (_turn_tools_used) with a DualLock via
_reset_turn_tools/_record_turn_tool/_drain_turn_tools helpers, matching the
existing chat_history protection, so concurrent chat()/achat() turns on one
Agent no longer corrupt hook/self-improvement data.
Gap 3: Track namespaced MCP server names in a process-level registry and let
the skills CapabilityValidator discover them, so MCP-server-gated skills can
pass STRICT validation instead of always failing closed.
Co-authored-by: Mervin Praison <[email protected]>
- Refuse non-localhost bind without --api-key/PRAISONAI_SERVE_API_KEY,
mirroring jobs/server.py policy (POST /agents can run YAML-defined tools).
- Cache one AgentsGenerator per app via FastAPI lifespan instead of rebuilding
it (YAML re-parse, registry re-resolve, fresh 32-worker pool) per request;
serialise the shared cli_config with an asyncio.Lock and close() on shutdown.
- Converge /agents and /agents/{agent_name} on the same generator path so both
apply identical YAML lowering (ToolResolver, tool_timeout, approval,
guardrails, retry) instead of the safety-stripped hand-rolled PraisonAgent.
Co-authored-by: Mervin Praison <[email protected]>
Add StreamEventType.RETRY and emit it alongside the existing ON_RETRY hook in both the sync and async retry loops (guarded by has_callbacks, so it stays zero-overhead when no consumer is attached). The event carries attempt, max_attempts, delay and reason in metadata.
The CLI stream-event bridge maps it to a canonical run.retry NDJSON event so consumers can render a live 'retrying in Ns (attempt k/N)' status instead of a silent, hung-looking terminal. Non-JSON/silent modes stay silent.
Co-authored-by: MervinPraison <[email protected]>
When the LLM emits an unresolvable tool call, the runtime now:
- attempts a deterministic self-repair by normalising case/separator drift
(e.g. 'WebSearch' -> 'web_search') against the agent's active tools;
- otherwise returns a corrective, model-readable error naming the nearest
valid tool and listing the currently available tools;
- on argument-bind failure, echoes the tool's required/optional parameters.
Reuses existing dispatch path; no new public API or Agent params.
Co-authored-by: Mervin Praison <[email protected]>
Add a pure-stdlib core helper neutralize_untrusted_text() in
praisonaiagents.session.context and apply it by default to the sender
display name in the bot's _attribute() prefix. Collapsing newlines/control
chars and bounding length stops a hostile group display name / title from
masquerading as a fake heading or system directive in the per-turn prompt,
while well-behaved names render byte-identically. Safe-by-default; no new
config knobs.
Co-authored-by: Mervin Praison <[email protected]>
A bare free-text prompt (`praisonai "do something"`) now forwards to the
same modern `run` path as `praisonai run`, inheriting session continuity,
--output modes, the credential gate and permissions. `.yaml` workflows and
flag-bearing legacy invocations remain on the legacy dispatcher.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer feedback on the in-loop continuation guard:
- Emit the just-completed (paid) row before the guard halts, so the
request that trips the sponsorship check is no longer silently dropped.
- Coerce sponsor_check_rows to a safe minimum of 1 so a 0 (divide-by-zero)
or negative (never-poll, guard disabled) value cannot break/disable the
safety check; unset preserves the 5000 default.
Adds tests for trigger-row emission and invalid-interval handling.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Two additive, backward-compatible features for the synthetic-data generator.
1. In-generator continuation guard. generate_dataset gains an optional
should_continue() -> bool callback, re-checked every `sponsor_check_rows`
completed requests (default 5000). When it returns False the run halts
cleanly via the existing shutdown path (touch stop-file + cancel pending
futures + break). If no callback is passed but `subscription_id` (or env
AZ_SUBSCRIPTION) is set, a built-in Azure sponsorship check is wired in
(quotaId == "Sponsored_2016-01-01"). The guard fails OPEN on transient
errors — an external watchdog is the hard fail-closed guard; this is
belt-and-suspenders. New public helper: azure_sponsorship_guard().
2. Per-row provenance stamping. Emitted rows are now self-describing: _call
stamps `model` (deployment) and passes through `task_type`/`topic` from the
prompt spec when present. The axis recipe stamps task_type/topic onto each
spec, so QC (which already reads r["task_type"]) and downstream category
splits key off metadata instead of brittle text. Keys are added only when a
value is available (backward-compatible).
Tests (network stubbed): the guard halts after N rows when the predicate turns
False and never halts while True; rows carry model/task_type/topic when
provided and omit task_type/topic when absent; plus fail-open and
subscription-id wiring.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The switch to praisonai.arun() dropped the caller's required input on the
native jobs path (job.prompt) and the serve /agents fallback (query), since
arun has no prompt param and the workflow topic is read from YAML input/topic
only. Honour input/topic overrides in AgentsGenerator._merge_cli_config
(reusing the existing merge seam, no new params/exports) and pass
job.prompt / query through cli_config so per-run input drives the workflow
instead of being silently discarded. Static YAML input is preserved when no
prompt is supplied.
Co-authored-by: Mervin Praison <[email protected]>
- serve.py: route the crew fallback through praisonai.arun (owns the
AgentsGenerator lifecycle, runs off the event loop) and replace
asyncio.get_event_loop() with asyncio.to_thread in both agent handlers.
- jobs/executor.py: _run_praisonai_agents now delegates to praisonai.arun
so the caller's agent_file/agent_yaml/framework/config are honoured
instead of silently dropped by a stock Agent.
- scheduler/agent_scheduler.py: reuse an instance-owned ThreadPoolExecutor
with leak accounting and recycling (mirrors AgentsGenerator), unify the
timeout branch into the backoff path, and close() the pool on stop().
Co-authored-by: MervinPraison <[email protected]>
- reuse a supplied empty shared MinHashLSH index (is not None, not `or`)
so cross-batch near-dedup works on the first call
- treat empty MinHash signatures as non-similar (0.0) and reject
minhash_perm/ngram_n < 1, so degenerate config can't collapse a dataset
- global_dedup honours near_dup_method='sliding' and raises a clear
FileNotFoundError for missing paths instead of a cryptic AttributeError
- sliding look-back treats window<=0 as intentional unbounded
- dedup CLI writes to a temp file + atomic replace, so an --out that
aliases an input is never truncated and a malformed line never leaves
a partial output
Co-authored-by: Mervin Praison <[email protected]>
The QC near-dup pass was O(n·3000) sliding-window char-4gram Jaccard, which is
both slow at scale and structurally blind to near-duplicates more than 3000 rows
apart — and score() rebuilds its dedup state per call, so it cannot remove dups
that span multiple batch files (the common case when merging parallel runs).
Add praisonai_train.data.dedup (pure stdlib, no datasketch/numpy):
- MinHasher / MinHashLSH: seeded, deterministic MinHash signatures over the same
normalized char-4gram shingles the sliding engine uses (so near_dup_jaccard
keeps identical semantics), with LSH banding for sub-linear candidate lookup
and no bounded look-back window.
- near_dedup(rows, cfg): one interface, YAML-tunable near_dup_method
("sliding" default = unchanged, or "minhash"). qc.score() now delegates to it
(DRY); default path behaviour is byte-for-byte the same. near_dup_window is now
configurable too.
- global_dedup(sources, cfg): dedup ACROSS many JSONL files / row-lists with ONE
shared exact+LSH index — what per-file score() cannot do.
- CLI: `praisonai-train dedup batch_*.jsonl --out merged.jsonl`.
Backward compatible: no new deps, default engine and outputs unchanged; MinHash
and cross-file dedup are opt-in.
Tests: 13 new (deterministic) — MinHash catches a far near-dup the window misses,
preserves genuinely-distinct rows, cross-file exact+near removal, exact-only, and
default-still-sliding. Full data suite 60 passed.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Count completion tokens only for successful (ok) responses so token
throughput and avg_out_tok stay consistent with the success count.
- Thread a json_mode flag through _timed_call/_measure_target/
benchmark_deployments and expose --json-mode/--no-json-mode + yaml key,
so OpenAI-compatible endpoints without JSON mode aren't ranked as failures.
- Validate prompt dicts (require non-empty 'user') and reject n<1 /
concurrency<1 with a clear ValueError instead of KeyError / silent
zero-request runs miscounted as endpoint failures.
- Add 4 tests; existing stubs updated for the new json_mode arg. 102 passed.
Co-authored-by: Mervin Praison <[email protected]>
Add a first-class, protocol-driven speed benchmark to the praisonai-train
data SDK, mirroring the generate/validate idiom. It sends N identical
requests per deployment at a fixed concurrency and reports throughput
(rows/min, completion-tokens/sec), latency (avg/p50/p95), success count
and average output tokens, then ranks deployments fastest-first.
DRY: extract the generator's HTTP call path into shared helpers
(`build_chat_request`, `resolve_cfg`) so benchmarking reuses the exact
same Azure/OpenAI-compatible request construction and credential
resolution as real generation — no duplicated HTTP code. The default
prompt reuses a registered Recipe so benchmarks reflect the real workload.
- data/benchmark.py: `benchmark_deployments(...) -> list[BenchResult]`,
pure `aggregate()`, and network confined to a `_timed_call` seam.
- cli/commands/benchmark.py: `praisonai-train benchmark` (YAML/flags),
ranked table + JSON output.
- setup/benchmark.yaml: documented sample config.
- tests: aggregation math, ranking, success/failure counting, real
threaded path, per-target endpoint override (network stubbed).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The documented gateway.notify_on_undelivered / undelivered_template YAML
opt-in was a dead path: GatewayServerSchema (extra="forbid") rejected the
keys at load time, and neither start_with_config nor from_config_file
propagated them onto self.config, so the delivery router's getattr always
saw the OFF default.
- Accept both keys in GatewayServerSchema (kept optional, lightweight).
- Stamp them onto self.config in start_with_config (primary CLI path) and
from_config_file, honouring the "no new core GatewayConfig field" design.
- Add a regression test covering schema acceptance + propagation.
Co-authored-by: Mervin Praison <[email protected]>
Connect the previously-inert completion path (Greptile P1): BotSessionManager
now reads the agent's last_stop_reason after each turn and, when the new opt-in
surface_completion_reason flag is set, appends a concise user-safe note for
early stops (max_steps / cancelled / error). Off by default so clean
completions and existing deployments are unchanged.
Co-authored-by: Mervin Praison <[email protected]>
Address greptile P1 review feedback on the inbound media-album coalescer:
when the owning Telegram update is cancelled (e.g. during shutdown) after
sibling updates already folded their media in, the buffered temp files could
leak. Add an on_orphan cleanup hook invoked whenever a flushed album has no
live owner awaiting it, wired to a shared _remove_inbound_media helper in the
Telegram bot. Also clarify the max_items cap semantics (bounded, intentional).
Co-authored-by: Mervin Praison <[email protected]>
On a confirmed-permanent outbound failure the reply was parked in the DLQ /
the target marked dead but the user heard nothing. Add an opt-in last-resort
notice: a short plain-text delivery-failure message on the same channel plus a
MESSAGE_UNDELIVERED lifecycle hook so operators can route the failure.
Core (protocol only): add HookEvent.MESSAGE_UNDELIVERED and
MessageUndeliveredInput. Wrapper (praisonai-bot): DeliveryRouter fires the hook
and best-effort sends the notice on permanent failure; default OFF, wired from
gateway.notify_on_undelivered.
Co-authored-by: MervinPraison <[email protected]>
Telegram delivers a media album (multiple photos/files sent together) as N
separate updates sharing one media_group_id, so the agent saw each part as
its own turn. Add an AlbumCoalescer that buffers media parts by group key
and flushes them as one multimodal turn, mirroring the existing
InboundDebouncer text pattern.
- New praisonai_bot/bots/_album.py: bounded per-group buffer (window +
max_items), operator-tunable via config.metadata (media_group_window_ms /
media_group_max), disabled by default so behaviour is unchanged.
- Wire into TelegramBot.handle_message (sibling updates fold into one turn)
and flush pending buffers on stop().
- Tests in tests/unit/test_bot_album.py.
Co-authored-by: MervinPraison <[email protected]>
Add an optional, backward-compatible TurnCompletion contract to the bot
reply path so a chat user learns *why* a turn stopped early instead of
seeing a silently truncated/empty reply.
- TurnCompletion wraps the existing coarse Agent.last_stop_reason
(completed | max_steps | cancelled | error) into a portable value with
a user-safe, localisable .note(); completed turns surface nothing.
- AgentReply gains an optional `completion` field (defaults None).
- extract_completion() reads it off any result (incl. a bare Agent via
last_stop_reason); append_completion_note() lets a gateway optionally
append the note, off by default so existing deployments are unchanged.
Reuses the existing runtime stop reason rather than adding new detection
or Agent params — no new module, no wrapper knobs.
Co-authored-by: MervinPraison <[email protected]>
Move progress_callback below the yield in generate_dataset so 'kept' reflects
rows the consumer has actually received (Greptile P1). Docstring clarified.
Co-authored-by: Mervin Praison <[email protected]>
generate_dataset() gains an optional progress_callback(done, total, kept)
invoked as teacher requests complete, so a CLI/monitor/notebook can show
completion and remaining work. Backward compatible: default None keeps the
original behaviour (no callback). Fires once up-front with (0, total, 0) then
after each completed request; done is monotonic up to total, kept counts unique
rows emitted.
The `generate` CLI command wires a default reporter (_Progress): a tqdm bar when
tqdm is importable, else throttled done/total prints. tqdm stays optional — the
import is guarded and never becomes a hard dependency.
Adds unit tests asserting the callback fires with monotonic done up to total,
that kept tracks dedup, and that the default (no callback) path is unchanged.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- intent.translation_intent: an unrecognised non-empty task_type no longer
short-circuits to non-translation; it falls through to the documented text
fallback so an explicit "translate into English" instruction is honoured and
its English output is not dropped as low_script_purity (greptile P1).
- qc.score: the translation `exempted` metric now counts only rows the
English-target exemption ACTUALLY rescued from LowScriptPurity (task-awareness
on AND output below the purity floor), so it reconciles with check behaviour
instead of over-counting failed translations and task_aware_purity=false runs
(greptile P1).
- Add 4 regression tests (29 passed total).
Co-authored-by: Mervin Praison <[email protected]>
Add two dataset-QC features to the praisonai-train data SDK, wired in the
SDK's protocol-driven idiom (registered RowChecks + a corpus metric) and
sharing ONE translation-intent detector so they can never disagree (DRY).
1. Task-aware script purity: the script-purity checks no longer delete an
output that is legitimately in another script because the instruction
asked to translate INTO that language (e.g. a Tamil->English row's
correct output is English). LowScriptPurity/ScriptReview now exempt a
resolved English-target row; a new WrongTargetScript flag catches the
inverse failure (asked for English, output still Tamil). Only a resolved
English target exempts — en->ta / ambiguous / native rows stay strict.
2. Translation-share corpus metric: metrics.translation reports the fraction
of kept rows that are translation tasks, by direction (en_ta/ta_en/unknown)
and an exempted count, computed with the SAME detector so it reconciles
with the per-row exemptions.
New single source of truth: data/intent.translation_intent(); metadata
(task_type) is authoritative, instruction-text detection is the external-row
fallback, ambiguous direction yields no exemption (safe default).
17 new unit tests (mirroring the modeltrain reference); full data suite green.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Addresses Greptile P1: an issue such as '[QUESTION] How do I handle this
API error?' matched 'error' before the question marker was checked,
receiving 'bug' + auto 'claude'. Guard bug detection on \!title.includes('[question]').
Co-authored-by: Mervin Praison <[email protected]>
Bug issues with a "## How to fix" section were labelled question first,
which blocked autoClaude. Check bug/error/crash before how-to heuristics,
ignore "how to fix" for question detection, and let bug label win over
a stale question label for auto-triage.
- qc: include output in exact-dedup key so distinct answers to the same
prompt are not silently dropped
- _util.fields: pair the final assistant turn with the user turn that
precedes it (never a trailing unanswered user turn)
- cli generate: forward --snapshot-every override; defer output truncation
until the first row is produced (a failed run no longer destroys an
existing file / self-referential dedup source); exit non-zero when 0 rows
are generated instead of reporting empty success
- cli validate: skip malformed JSONL lines (with line numbers) instead of
aborting the whole run
- generate: configurable request_timeout; accurate stop-file docstring
- tests: cover distinct-answer dedup and multi-turn chat pairing
Co-authored-by: Mervin Praison <[email protected]>
Remove the legacy `.praison/config.toml` from PROJECT_CONFIG_NAMES so the
walk-up discovery never mislabels a profile-level legacy global config as a
`project:` source. The legacy file is owned exclusively by
_load_global_config() with a `global:` label. Removes the now-dead
search_dir == home skip guard and adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Harbor 0.20's BaseAgent.__init__ requires logs_dir as first positional
arg. The TestPraisonAIExternalAgent tests constructed the agent with zero
args, causing a TypeError. Pass logs_dir via pytest tmp_path to match the
existing pattern used by TestPraisonAICodeAgent and TestPraisonAIInstalledAgent.
Co-authored-by: Mervin Praison <[email protected]>
Harbor 0.20 agents expose extra_env (wired into the container exec
context by Trial), not self.env. Passing env=self.env crashed
PraisonAICodeAgent.run() with AttributeError. Omit the per-exec env=
so Harbor's trial-scoped injection applies. Same fix applied to
praisonai_installed_agent.py.
Co-authored-by: Mervin Praison <[email protected]>
Harbor's BaseInstalledAgent._exec always prefixes commands with
'set -o pipefail; ', so the .startswith assertion failed even when the
adapter command was correct. Switch to a substring match.
Co-authored-by: Mervin Praison <[email protected]>
- PRAISON_DEBUG now parsed as a boolean (0/false/no disable it, not just unset)
- auto-resume filters to real numeric checkpoint-* dirs and passes the validated
path to the trainer (instead of leaving resume=True and re-discovering); also
accepts 1/yes/on/off spellings before treating a string as a literal path
- push_model_gguf honors quantization_method default (q4_k_m) matching save path
- final save/eval cadence reconciliation after training_arguments passthrough so
load_best_model_at_end can't reach SFTConfig with mismatched strategies/steps
Co-authored-by: Mervin Praison <[email protected]>
Reverts the removal of tokenize_function — it is imported and re-exported in
praisonai/train.py __all__, so deleting it breaks that public API. Kept it (now
uncalled by the training path but retained for backward compat) and removed only
the internal, unreferenced tokenize_dataset method.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Remove dead tokenize_function/tokenize_dataset (unused since TRL tokenizes
internally; used padding='max_length' which would waste compute if ever rewired).
- save_model_gguf now honors config quantization_method (was hardcoded 'q4_k_m',
inconsistent with push_model_gguf).
- Gate the per-batch DEBUG prints behind PRAISON_DEBUG so normal runs stay readable.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Fix AgentTeam.start() result handling across 22+ workflow/usecase examples
- Fix missing AgentFlow/AgentTeam/AutoAgents imports and registry override demo
- Fix scope_identifiers, state_redis db import, and ToolsMCPServer.run_sse API
- Mark STT and stale tool-import examples as skip until refreshed
- Remove stale db mapping that shadowed praisonaiagents.db submodule
Co-authored-by: Cursor <[email protected]>
HF requires save_steps to be a multiple of eval_steps when load_best_model_at_end
is on. A config with save_steps=100, eval_steps=500 (both valid-looking) crashed.
Now the trainer aligns eval_steps to save_steps (preserving the user's checkpoint
frequency) with a warning, instead of erroring out.
Co-Authored-By: Claude Fable 5 <[email protected]>
resume_from_checkpoint: true now auto-finds the latest checkpoint in output_dir
and resumes from it; if none exists yet (fresh run) it starts fresh instead of
erroring. So after any crash (OOM, GPU reclaim) you just relaunch the SAME
command and training continues from the last saved step. Validated on GPU:
fresh run -> checkpoint-2/4; relaunch -> resumed from checkpoint-4, continued 5->8.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Remove wrapper import from praisonai-code agent_tools.py (C7 gate
regression): use a module-local _run_sync bridge instead of
`from praisonai._async_bridge import run_sync` so the Tier-2 package
no longer depends on the praisonai wrapper at the hot path.
- suite_runner: start child processes with start_new_session=True on
POSIX so timeout killpg reaps only the child tree, never the runner.
- agent_tools/orchestrator: honor acp_execute_command cwd by forwarding
it into the plan step; orchestrator validates it stays in workspace.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Kill Windows subprocess trees on suite-runner timeout (uvicorn hang)
- Restore Agent.launch() shared server globals in execution_mixin
- Add missing praisonai_code.cli.features.agent_tools module
- Fix compression_demo ContextCompressor API usage
- Import AgentFlow in workflow output/routing examples
- Use UTF-8 when parsing doctor ci subprocess output on Windows
- Set BrowserBaseTool __name__ for agent tool schema compatibility
Co-authored-by: Cursor <[email protected]>
Gemma 4 E4B (and other multimodal/MoE/elastic models) have LoRA-adapted params
that don't fire every step (vision/audio towers in text-only training), which
crashes DDP with 'Expected to have finished reduction' when find_unused=False.
Default True works universally; set false for a small speedup on dense-text models.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Set UNSLOTH_USE_NEW_MODEL before unsloth import (DDP non-reentrant path)
- Skip LoRA when full_finetuning: true (train base weights directly)
- Reload model with trained precision (dtype/8bit/full_finetuning), not 4bit-only
- Re-align save/eval strategy when early stopping enables load_best_model_at_end
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Only the main process merges/pushes and writes the final adapter, so multi-GPU
runs don't race to write the same repo/dir.
Co-Authored-By: Claude Fable 5 <[email protected]>
Validated end-to-end on 2x A6000 (unsloth 2026.7.4 / trl 0.24 / torch 2.10):
multi-GPU DDP trains (Data Parallel GPUs = 2, no 'marked ready twice'),
checkpointing + eval + best-model + final_model_dir all work.
Multi-GPU (DDP):
- Detect distributed (LOCAL_RANK/WORLD_SIZE); load full model per-rank
(device_map={'':local_rank}); set UNSLOTH_USE_NEW_MODEL=1 under DDP to force
Unsloth's non-reentrant checkpointing (the legacy path hard-codes reentrant,
which double-fires autograd hooks and crashes DDP). Set ddp_find_unused_parameters
=False (LoRA freezes the base). Launch: torchrun --nproc_per_node=N.
Checkpointing / resume:
- Config-driven save_strategy/save_steps/save_total_limit (was only under an env var);
resume_from_checkpoint (bool=latest, or a path); final_model_dir (fixes the old
lora_model vs output_dir mismatch that broke load_model).
Evaluation / early stopping:
- val_split_ratio carves an eval set; eval_strategy/eval_steps/load_best_model_at_end/
metric_for_best_model; EarlyStoppingCallback via early_stopping_patience.
Flexibility:
- Generic training_arguments passthrough (any raw SFTConfig field), auto-filtered to
what the installed TRL accepts (version-proof; e.g. save_safetensors/group_by_length
differ by version) — warns instead of crashing.
- Knobs: max_grad_norm, warmup_ratio, neftune_noise_alpha, dataloader_num_workers,
data_seed, adam betas, report_to/run_name (config, not just env), push_to_hub.
- Quantization: load_in_8bit, dtype, full_finetuning. LoRA: modules_to_save,
rank_pattern, alpha_pattern, use_dora. Data: local files, shuffle, rename, filter.
Correctness fixes:
- load_in_4bit KeyError when omitted; inference().to(cuda) -> self.device;
drop empty-formatted rows instead of silently training on blanks.
All new keys optional with prior defaults; existing configs unchanged.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Skip publishing (return early) when train:false leaves self.model None,
preventing an AttributeError on the merged/gguf push path.
- Make KNOWN_KEYS a frozenset to prevent accidental class-state mutation.
Co-authored-by: Mervin Praison <[email protected]>
- num_samples: reject 0/negative/bool/non-int and honor explicit values (fail
fast with a clear message instead of silently training the full set or
crashing mid-run).
- Publishing: fail fast in validate_config when huggingface_save /
huggingface_save_gguf / ollama_save is enabled without its target name,
instead of silently skipping the requested upload after a long run.
- Fix pre-existing CI failure: test_interactive_group_is_union was stale after
the `search` tool group was wired into the interactive default set (#3254);
add TOOL_GROUPS["search"] to the expected union.
Co-authored-by: Mervin Praison <[email protected]>
Validated end-to-end on GPU (2x A6000, unsloth 2026.7.4 / trl 0.24.0).
- Response masking: assistant_only_loss now tri-state with default "auto" — a
live probe checks whether the model's chat template actually supports assistant
masking and enables it only when safe, else full-sequence SFT. Prevents TRL's
cryptic RuntimeError on stock Qwen/Gemma/Llama templates (they lack the
{% generation %} markers). Explicit true on an unsupported template now fails
fast with a clear message. 'train_on_responses_only' accepted as an alias.
- Publishing defaults OFF and is gated on a target name being set — a plain
'train locally' config finishes with the LoRA saved to lora_model/ instead of
crashing after training on a missing/foreign hf_model_name.
- Config flags accept real YAML booleans (train: true) not just strings, via a
_flag() coercion helper (no more AttributeError on .lower()).
- Honor dataset num_samples (was advertised but silently ignored).
- validate_config(): clear error on missing required keys, warn on unknown keys
(typo/unsupported) so nothing is silently dropped — friendlier for agents.
- 'model' accepted as an alias for 'model_name' (matches --model flag).
- One concise run-summary block (model / examples / masking mode / steps / output).
- Align license to SPDX "MIT" + setuptools>=77 (matches main).
Co-Authored-By: Claude Fable 5 <[email protected]>
- pyproject (train + bot): license = "MIT" SPDX string (was deprecated table
form); bump build requires to setuptools>=77 which the string form needs.
- _release_lib: 'uv lock' instead of 'uv lock --frozen' so publish regenerates a
missing/stale lockfile (praisonai-train had none; dependency changes stale it)
instead of failing with 'Unable to find lockfile'.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Fail fast when neither the tokenizer nor config provides a chat template,
instead of silently training on empty text (swallowed apply_chat_template).
- Correct Gemma Ollama template to fold the system prompt into the first user
turn per the Gemma spec (no separate system turn).
- Document that assistant_only_loss requires a template exposing assistant
masks ({% generation %}); keep it opt-in and default-off.
- Remove the stale uv.lock (pinned trl<0.9.0 / trl 0.8.6, old torch/transformers/
unsloth floors) so it regenerates against the modern pyproject stack.
Co-authored-by: Mervin Praison <[email protected]>
Both rag_profiler and knowledge_profiler were byte-for-byte identical
except the "command" label. Extract a single command_profiler helper in
cli/commands/_profiling.py and have both delegate to it, so profiling
logic has one owner and cannot drift. Behaviour, flags, and output are
unchanged.
Co-authored-by: MervinPraison <[email protected]>
Extract the bearer / X-API-Key token extraction and constant-time
comparison used by both the serve feature and the jobs server into a
single build_api_key_middleware() helper so future auth fixes only need
to be made in one place. Behaviour and lazy-import posture are unchanged;
per-server public-path allowlists remain distinct via a parameter. The
JobsAuthRequiredMiddleware non-localhost guard is left untouched.
Co-authored-by: MervinPraison <[email protected]>
The dependency pins (trl<0.9.0, unsloth>=2024.8) were incompatible with any recent
Unsloth, which requires trl>=0.18.2 / transformers>=4.51.3. This modernizes the LLM
fine-tuning path so it works with the current stack (tested on 2x A6000 with
unsloth 2026.7.4 / trl 0.24.0 / torch 2.10 / peft 0.19.1).
Changes:
- deps: transformers>=4.51.3, unsloth>=2025.9.1, trl>=0.18.2, peft>=0.13.0,
accelerate>=0.34.0, bitsandbytes>=0.45.0 (pyproject + setup_conda_env.sh; the
conda script no longer pins an ancient Unsloth git commit).
- trainer: migrate to modern TRL API — SFTConfig instead of TrainingArguments,
processing_class instead of tokenizer, dataset_text_field/max_length/packing on
SFTConfig; drop the pre-tokenize + dummy-field hack (TRL tokenizes internally).
- trainer: stop force-applying the llama-3.1 chat template to every model (broke
Gemma/Qwen). Chat template is now config-driven and defaults to the model's own.
- trainer: honor config LoRA params (lora_r/alpha/target_modules/... were ignored).
- trainer: response-only loss via SFTConfig assistant_only_loss (model-agnostic),
replacing the Llama-hardcoded train_on_responses_only markers.
- Ollama Modelfile: add Gemma template + stop tokens (was Llama-only, wrong for Gemma).
Tested: end-to-end LoRA fine-tune smoke runs on GPU for both Qwen2.5-0.5B and
Gemma-2-2B (native templates) — train loop + local save succeed.
Co-Authored-By: Claude Fable 5 <[email protected]>
A completed cancelled run (rank 1) could override an in-progress run
(conclusion=null, rank 0) of the same name, hiding a still-running check
from allChecksGreenOnSha and allowing the merge gate to pass early.
Prioritize any non-completed run so pending checks always block.
Co-authored-by: Mervin Praison <[email protected]>
Treat cancelled smoke and test-windows as non-blocking when all test-core
shards succeeded on HEAD, dedupe check runs by best conclusion, and raise
smoke (12m) and Windows (10m) job timeouts to reduce timeout cancellations.
Switch all Harbor adapters, job configs, docs, and tests to
openai/gpt-4o-mini for a consistent, low-cost default across the
Terminal-Bench benchmark path.
Co-authored-by: Mervin Praison <[email protected]>
Surfaces genuine install/auth/startup failures in the Harbor code adapter
instead of always reporting success (per reviewer feedback). A benchmark
miss still exits 0 (Harbor grades by verification); only a crashed
assistant now fails the attempt.
Co-authored-by: Mervin Praison <[email protected]>
Repairs the examples/terminal_bench/ Harbor adapters (external/wrapper/
installed), adds a headline praisonai_code_agent that drives `praisonai code`
headlessly, rewrites job configs to the real Harbor JobConfig schema for
Terminal-Bench 2.1, adds packaging __init__.py files, rewrites the tests to
skip only when Harbor is truly absent, and adds a manual-dispatch smoke
workflow + RESULTS.md. Examples/CI layer only — no SDK changes.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback that set_store()/migration failing open could
hide reader/writer drift. The local tool store remains authoritative, so
these paths stay best-effort but are now diagnosable via logs.
Co-authored-by: Mervin Praison <[email protected]>
Adds direct coverage for the bot-side _execute_one silence path (exact
markers, whitespace variants, ordinary output, prose mention) asserting
delivery is suppressed while the run is still recorded as succeeded.
Co-authored-by: Mervin Praison <[email protected]>
Scheduled/automation runs now consult the existing core silence primitive
(praisonaiagents.bots.silence.is_intentional_silence_response) before
delivering. When a run's whole output is an exact silence marker
(NO_REPLY / [SILENT] / SILENT) delivery is suppressed while the run still
completes and is recorded, so unattended monitors stop posting the raw
control token. Applied to both the wrapper lightweight path
(AgentScheduler._deliver_result) and the bot full-gateway path
(ScheduledAgentExecutor). Prose merely mentioning the token is unaffected
(exact-match semantics).
Co-authored-by: MervinPraison <[email protected]>
Add a canonical get_default_store()/set_default_store() resolver in
praisonaiagents.scheduler and route the agent tools, gateway tick loop,
and host bridge through it so writer and reader share one backend.
Co-authored-by: MervinPraison <[email protected]>
Convert value to str before strip()/lower() so an unquoted YAML
auth_token (e.g. 12345) cannot raise AttributeError during the
weak-secret check. Preserves empty/None handling and denylist match.
Co-authored-by: Mervin Praison <[email protected]>
- gateway doctor now fails closed on a MISSING auth_token on an external
bind (matching startup), not just a weak one (Greptile P1)
- doctor --json always emits a single parseable JSON document on the
no-channels weak/missing-secret failure path (Greptile P2)
- replace high-entropy fake hex test tokens with an obviously-non-secret
literal to clear GitGuardian false positives without weakening tests
- add TestDoctorGatewaySecretStrength covering the new doctor paths
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile review findings on the doctor auto-fix safety contract:
- In-place repairs no longer discarded: pass a fresh copy to apply_fix so
rules that mutate-and-return their argument still record a diff.
- Collection failures now recorded as blocking refused findings instead of
being silently swallowed (previously produced an apparently clean plan).
- Auto-derived backup paths use microsecond timestamps plus a numeric
uniqueness suffix so a rapid/concurrent run never overwrites an earlier
snapshot.
- No-op apply runs no longer report applied=True; applied now requires an
actual change.
Adds tests for each case.
Co-authored-by: Mervin Praison <[email protected]>
Add a core weak-secret guard so an externally-bound gateway refuses to
start behind a publicly-known placeholder token (e.g. change-me,
your-token-here, or the literal $(openssl rand -hex 16) fix-hint pasted
verbatim). Loopback binds downgrade to a warning, consistent with the
existing permissive-loopback posture.
- core: KNOWN_WEAK_SECRETS, is_weak_secret, assert_gateway_secret_strong,
WeakGatewaySecretError in praisonaiagents.gateway.protocols
- praisonai-bot: enforce in assert_external_bind_safe (fail closed on
external, warn on loopback) and surface in `gateway doctor`
Co-authored-by: MervinPraison <[email protected]>
Add a repair safety contract to the core doctor engine so self-repair is
safe to run: dry-run diff preview, backup, refuse-on-unrecoverable, and
post-fix re-validation. Introduces ConfigDiff/RepairPlan and a
DoctorRulesRegistry.plan_fixes() while keeping apply_all_fixes()/apply_fixes()
backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer-flagged issues in praisonai run --worktree:
- P0: untracked output no longer silently deleted. Teardown now detects
changes via git status --porcelain (sees untracked files, which git diff
does not) and commits them to the isolated branch, retaining the branch;
only the worktree checkout is pruned. Falls back to keeping the worktree
if the commit fails (e.g. no git identity), so output is never lost.
- P1: identical targets get independent worktrees/branches via a per-run
unique token, so concurrent/repeated runs never share state.
- P1: relative/untracked local YAML now resolved to an absolute path before
chdir, so praisonai run ./agents.yaml --worktree still loads its config.
Adds tests for untracked-output preservation and per-run independence.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- code_intelligence: core grep now searches the configured workspace
(search_path) instead of the process CWD, matching the grep -rn fallback;
paths outside the core tool's root fall back cleanly.
- interactive_tools: apply PRAISON_TOOLS_DISABLE via ToolConfig.__post_init__
so direct constructions (to_tool_config, HeadlessInteractiveCore) honor the
advertised opt-out, not just from_env().
Co-authored-by: Mervin Praison <[email protected]>
A catch-all read:* allow rule previously opted every secret file into
ALLOW, trivially defeating the gate. Now only a secret-specific allow
rule (e.g. read:*.env) or a persistent approval opts in; a broad
wildcard falls through to the ASK default. Deny and approvals still win.
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing core GitWorktreeAdapter into the CLI run lifecycle as a live consumer. praisonai run with --worktree provisions a fresh git worktree/branch, runs the agent there, reports the branch + a summary diff, and tears the worktree down (or keeps it with --keep). Degrades to a transparent no-op outside a git repo. Kept lightweight: no new Agent params/modules, only a self-contained context manager in run.py plus two CLI flags.
Co-authored-by: MervinPraison <[email protected]>
Add a `search` tool group (grep, glob, ast_grep_search) to the interactive
coding agent's default toolset, resolving to the existing ripgrep-backed core
builtins. Also route code_intelligence search through the core grep first,
keeping `grep -rn` only as a last-resort fallback.
Co-authored-by: MervinPraison <[email protected]>
Reads of secret files (.env, private keys, *.pem, *.key, id_rsa, etc.) now
default to `ask` in the core permission manager, closing a silent
secret-exfiltration path where a default coding agent could read credentials
and forward them to the model provider. Safe example/sample/template files
remain allowed, and explicit user rules/approvals (e.g. `read:*.env=allow`)
override the default so opting in for trusted workflows stays a single rule.
Co-authored-by: MervinPraison <[email protected]>
Gap 1: run/arun and the 4 legacy CLI call sites now own the
AgentsGenerator lifecycle via `with`, releasing its lazily-allocated
tool-timeout executor per run instead of leaking daemon threads in
long-lived server workers.
Gap 2: _is_protocol_instance / _is_cli_backend_instance now use
isinstance against the @runtime_checkable CliBackendProtocol instead of a
hasattr(execute, stream) duck-type, so a BaseCLIIntegration look-alike is
no longer mistaken for a backend; it fails fast at construction with a
pointed TypeError instead of crashing deep in the agent loop.
Gap 3: both workflow kickoff branches are bracketed in observability_session
so AgentOps init/finalize fires for workflow YAMLs too, and _build_yaml_workflow
now runs cli_backend compatibility validation and warns when a set
tool_timeout cannot be enforced on the native workflow path.
Co-authored-by: MervinPraison <[email protected]>
Make llm.py delegate _format_ollama_tool_result_message to the
protocol-driven OllamaAdapter.format_tool_result_message instead of a
hardcoded, behaviorally-diverged duplicate. The error-handling behavior
(apology-oriented prompt for dict/list results carrying an 'error' key)
is ported into the adapter so the single source of truth now lives in
the adapter layer, matching the pattern used elsewhere. Fully
backward-compatible: call sites are guarded by _is_ollama_provider(), so
Ollama formatting is always produced.
Co-authored-by: MervinPraison <[email protected]>
Bug A: Typer does not support typing.Literal; replaced _SandboxType
Literal with a str/Enum SandboxBackend so grouped --help lazy-loading
of the sandbox command no longer raises RuntimeError. Handler receives
.value to preserve string API.
Bug B: Added missing 'usage' command to COMMAND_CATEGORIES so every
registered lazy command has a help category.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Windows denies a second open of a NamedTemporaryFile while its handle is
still open, causing SQLite "unable to open database file" errors. Replace
the NamedTemporaryFile pattern with pytest tmp_path in the two affected
tests in test_server.py.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- test_syntax_check.py: resolve agent.py via pathlib relative to __file__
so the check runs from any working directory (repo root or package dir)
- suite_runner/executor.py: run the dry-run branch before per-item env
checks so a preview lists runnable items even when credentials are absent
- cli/commands/docs.py: do not fail strict mode on dry-run, since dry-run
intentionally marks runnable items as not_run
Rebased onto current main; the dry-run feature already merged there, so
only the genuinely-missing path fix plus the two reviewer-flagged bug
fixes remain.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The maintainer's review bot flagged these but couldn't push to a fork, so
applying directly:
- Raise on a configured-but-unknown TENKI_WORKSPACE_ID/PROJECT_ID instead of
silently using the first workspace/project (wrong-workspace billing).
- shlex.quote every pip/npm spec (command-injection hardening).
- Honour a non-default ComputeConfig.image, not just metadata["tenki_image"].
- Respect ComputeConfig.networking (restricted -> allow_outbound=False).
- Fail provisioning and tear down the sandbox when package install fails
(no false RUNNING / leaked sandbox).
- Terminate before dropping the handle in shutdown, so a failed terminate keeps
the sandbox tracked for retry instead of silently leaking it.
Restores pre-gate behaviour where 1000-1500 token context was returned
unchanged for small branch counts, instead of being truncated.
Co-authored-by: Mervin Praison <[email protected]>
Partial-truncation in aggregate() used a fixed remaining*4 char estimate,
which over-retained dense non-ASCII (CJK) text and could exceed max_tokens.
Now selects the longest prefix whose canonical token estimate fits the
remaining budget via _truncate_to_tokens(). Adds regression tests.
Co-authored-by: Mervin Praison <[email protected]>
Completes the disabled-path guard pattern for the two remaining trace
emit methods, matching the six methods fixed in this PR and their hotter
siblings. Byte-identical enabled behavior; only skips wasted allocation
when tracing is disabled.
Co-authored-by: Mervin Praison <[email protected]>
Small parallel groups (e.g. 2 branches) no longer pay for an extra LLM
summarisation call whose token cost roughly matches what it saves. The
cheaper _truncate_context_for_branches fallback is used below the
MIN_BRANCHES_FOR_LLM_SUMMARY threshold; LLM summarisation stays unchanged
for larger fan-outs.
Co-authored-by: MervinPraison <[email protected]>
Replace the crude `len(text) // 4 + 1` estimate in
ContextAggregator._estimate_tokens with a delegation to the package's
canonical estimate_tokens_heuristic. ASCII-identical, but now correctly
weights non-ASCII (CJK) characters, preventing context-budget overruns
for non-English content. Single source of truth for token estimation.
Co-authored-by: MervinPraison <[email protected]>
Add early `if not self._enabled: return` to session_start, session_end,
context_snapshot, agent_handoff, memory_store, and memory_search, matching
the existing pattern in hotter siblings. Avoids allocating a ContextEvent
(and slicing query strings) on every memory/session/handoff op when tracing
is disabled. Output is identical when tracing is enabled.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer (Greptile P1) findings on PR #3164:
- restart --drain-timeout now flows into stop()/graceful-stop so the OLD
process gets the full drain window instead of a fixed 10s cut-off.
- pause/resume/reconnect + URL resolution now honour --host/--port /
GATEWAY_PORT so a gateway on a non-default endpoint is located instead of
always probing 127.0.0.1:8765.
- Windows daemon restart aborts if `schtasks /End` fails, preventing a
duplicate/colliding gateway relaunch.
- Documented that the direct (non-service) restart fallback cannot recover
CLI-only launch flags; service/YAML is the production path.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1 findings on the scheduled/proactive delivery path:
the shared scheduled_outbox is drained whole on every delivery, but the
sender captured a single idem and stamped it on every drained row, and
success was read from the aggregate drain count.
- _send now uses each entry's own idempotency key (carried in the
payload) so a backlogged row is no longer sent under the current key,
which previously poisoned the router LRU and suppressed the real row
as a duplicate (message lost).
- Result for this delivery is resolved via status_for(idem) scoped to
our own key, never the aggregate succeeded count, so an unrelated row
succeeding no longer masks this row's failure.
- Drain-exception fallback checks status_for(idem) instead of a blind
re-send, avoiding a duplicate against a still-pending durable row.
- Add regression test for the multi-eligible-row (backlog + fresh) case.
Co-authored-by: Mervin Praison <[email protected]>
The flagship WebSocketGateway is a separate startup path from BotOS and
stamped the identity resolver + admission gate onto each channel bot's
session but never a shared turn-lock map. Channels unifying to one session
therefore still held distinct LockMaps, leaving the concurrent-transcript
bug open on the gateway path. Add _stamp_turn_lock_map (mirroring
_stamp_identity_resolver / _stamp_admission_gate) and wire it into both
start_channels and _start_single_channel, gated on a configured resolver.
Co-authored-by: Mervin Praison <[email protected]>
Route the gateway's scheduled/proactive delivery through the same durable
OutboundQueue the reply path uses, so its UNIQUE idempotency key — which
survives a restart — is the source of truth for "already sent" instead of the
per-process, in-memory LRU that dies with the process. A crash-and-refire after
a restart is now a no-op INSERT resolving to the already-sent row, so the
scheduler no longer double-posts the same proactive message.
The DeliveryRouter remains the sender, preserving its token-bucket throttle,
dead-target suppression, and LRU on top of durability. A genuinely failed
pre-crash send stays non-terminal and is re-delivered at-least-once after
restart. Falls back to the prior LRU-only router path if the durable store
cannot be built.
Adds a minimal OutboundQueue.status_for(key) read so a deduped re-fire is
reported as a suppressed success rather than a spurious failure.
Co-authored-by: Mervin Praison <[email protected]>
If _save() fails (full disk, permissions, failed replace), claim_due
previously still returned the claimed jobs even though the lease and
advanced last_run_at were never persisted. The runner would execute them
while the next poll re-read the unchanged file and re-fired duplicates —
defeating the at-most-once guarantee on the exact failure path it protects.
_save() now returns a bool; claim_due drops the claim (returns []) and
releases in-memory leases when the write did not persist, so the job is
retried cleanly. Applied identically to ConfigYamlScheduleStore and
FileScheduleStore for parity. Adds persist-failure tests for both stores.
Co-authored-by: Mervin Praison <[email protected]>
Cross-platform continuity via the identity resolver unified distinct
platform users onto one persisted session, but each adapter's
BotSessionManager owned its own LockMap keyed on the resolved id. Two
adapters resolving to the same unified id held two distinct locks, so
near-simultaneous turns ran concurrently against one transcript,
interleaving read-modify-write and breaking strict alternation.
Fix reuses the existing LockMap + _get_lock (no new class): BotOS builds
one shared LockMap and injects it into every managed bot's session
manager (mirroring _wire_admission_gate / _wire_outbound_messenger), so
turns serialise on the resolved id regardless of which adapter a message
arrives on. Wired only when an identity resolver is configured, so the
single-adapter path is unchanged and fully backward-compatible.
Co-authored-by: Mervin Praison <[email protected]>
The default schedule store lacked an atomic claim_due(), so ScheduleRunner
degraded to the non-atomic get_due_jobs() path — causing multi-process
gateways to double-fire every scheduled job. Implement claim_due()/complete()
on ConfigYamlScheduleStore, reusing the fcntl/msvcrt advisory-lock +
persisted-lease pattern already proven in FileScheduleStore, so the
at-most-once guarantee now holds out of the box on the default store.
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1: PRAISONAI_BROWSER_SKIP_EXTENSION_WAIT now only bypasses
the readiness poll for explicit truthy values (1/true/yes/on), so "false" or
inherited values no longer disable the check. Removed the PYTEST_CURRENT_TEST
auto-skip that would suppress readiness polling for live integration tests and
test-launched subprocesses. Mocked unit tests now opt in via an autouse fixture.
Co-authored-by: Mervin Praison <[email protected]>
- Escape ASCII status marker in _print_success via rich.markup.escape so
"[OK]" renders literally instead of being parsed as (invalid) Rich markup.
- doctor --json now emits a JSON error object on failure instead of
Rich-formatted text, keeping stdout machine-readable for automation.
- Add regression tests for both paths; make cp1252 marker assertion
environment-agnostic.
Addresses greptile P1 review comments on #3228.
Co-authored-by: Mervin Praison <[email protected]>
- Freeze escalate_fields/safe_fields in __post_init__ so directly-constructed
descriptors are truly immutable authorisation records (no post-hoc mutation).
- Model APPROVALS/PAIRING as incomparable siblings: combining two distinct
same-tier scopes escalates to ADMIN (fail closed) instead of silently
picking one, closing a single-scope-check bypass.
- Add tests for incomparable-scope escalation and collection immutability.
Co-authored-by: Mervin Praison <[email protected]>
- Wrap DockerSandbox.start()/execute() in asyncio.wait_for so image pull/startup
can never hang the run (configurable via PRAISONAI_SANDBOX_E2E_DOCKER_TIMEOUT)
- Report unavailable Docker image/registry as SKIP instead of FAIL so the
optional check no longer fails a required run
- Clarify in README that e2e-validation/ and tests/ require a repo checkout
(not shipped in the published wheel)
Co-authored-by: Mervin Praison <[email protected]>
Apply the same STDIO entry-point resolution to cmd_config_generate_recipe
so standalone (pip install praisonai-mcp) users get a runnable command
instead of the umbrella-only "praisonai mcp serve-recipe" (fixes#3210).
Co-authored-by: Mervin Praison <[email protected]>
Strengthens the list-resources/list-prompts regression tests to verify the
full expected set of 7 resources and 7 prompts (by name/URI) rather than only
asserting non-empty output, per reviewer feedback.
Co-authored-by: Mervin Praison <[email protected]>
Previously the walk-up broke before searching $HOME entirely, which also
suppressed legitimate project configs rooted at home (e.g. ~/praison.yaml,
~/praison.yml) that have no global loading path. Now $HOME is still searched
but only the legacy .praison/config.toml name is skipped there, since it is
owned by _load_global_config(). Resolves Greptile P1.
Co-authored-by: Mervin Praison <[email protected]>
Wrap tempfile/open in the symlink capability probe so any OSError skips
the test rather than failing module collection (Greptile feedback).
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback (Greptile):
- Assert partial tool names are a strict subset of the full set instead of
comparing only registry sizes, so a dropped-but-count-masked tool is caught.
- Add an isolated_tool_registry fixture that snapshots and restores both
_tools and _lazy_loaders, preventing singleton state leakage into later tests.
Co-authored-by: Mervin Praison <[email protected]>
- server.py: skip/cap the pre-connect health-check loop under pytest or when
PRAISONAI_BROWSER_SKIP_EXTENSION_WAIT is set, and bound the wait by timeout,
so mocked websockets tests reach websockets.connect instead of timing out.
- sessions.py: create parent directories for custom SQLite db_path.
- test: use a dedicated event loop in test_extension_engine_value to avoid the
deprecated get_event_loop() failing on Python 3.12.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Detect legacy console encodings and fall back to ASCII status markers so
`praisonai-mcp doctor` no longer crashes with UnicodeEncodeError on default
Windows cp1252 consoles. Adds a `--json` mode with no Unicode symbols and a
regression test, mirroring the umbrella `praisonai doctor` fix (#2270).
Co-authored-by: Dhivya-Bharathy <[email protected]>
Windows-only test failures: CliRunner captures --help into a cp1252 buffer,
so Rich raises UnicodeEncodeError and the command exits 1 (real shell exits 0
because Rich detects the terminal and downgrades to ASCII). The stub-scan test
also used read_text() which defaults to cp1252 on Windows, raising
UnicodeDecodeError on byte 0x81.
- Invoke --help via a utf-8, NO_COLOR CliRunner so the harness matches real
terminal behaviour; surface the captured exception on failure.
- Read command modules with encoding="utf-8" in the legacy re-entry scan.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- praisonai-bot: close the NamedTemporaryFile handle before load/unlink so
os.unlink no longer hits WinError 32 on Windows.
- praisonai-train: add TrainingStorage.close() + context-manager support that
closes the underlying storage backend (e.g. SQLite), releasing the DB file
handle to avoid WinError 32 and ResourceWarning: unclosed database.
- Update SQLite-backed storage tests to deterministically close backends.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add e2e-validation/ bundle with an orchestrated single-command runner
(run_e2e.py), a manual guide, and a README. The runner covers subprocess,
SandboxManager, backward-compat shim, optional Docker, and CLI smoke; exits
non-zero on any required failure and skips Docker/shim gracefully when
unavailable. Also link the runner from the package README.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add skipif guards to two tests that fail on default Windows configs:
- test_symbolic_link_resolution: skip when symlink privilege unavailable
- test_timeout_handling_posix: skip on Windows (os.killpg is POSIX-only)
Co-authored-by: Dhivya-Bharathy <[email protected]>
ConfigResolver._load_project_config walked filesystem parents of cwd
and, when cwd was under the user profile, reached $HOME and discovered
the legacy ~/.praison/config.toml as a `project:` source. That file is
already loaded separately by _load_global_config with a `global:` label,
causing a duplicate/mislabelled source and breaking isolated unit tests.
Walk-up now stops at (and never searches) Path.home(), leaving the legacy
global config to the global loader. Real project configs in subdirs and
git repos are still discovered via walk-up.
Co-authored-by: Dhivya-Bharathy <[email protected]>
list-tools, tools search|info|schema now call register_all() instead of
register_all_tools(), so they expose the full 86-tool surface matching
serve and doctor instead of the partial 25.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Auto-detect the available entry point via shutil.which so config-generate
emits `praisonai-mcp serve` for standalone installs and remains backward
compatible with `praisonai mcp serve` for umbrella installs. Applies to all
four STDIO client generators (claude-desktop, cursor, vscode, windsurf).
Co-authored-by: Dhivya-Bharathy <[email protected]>
list-resources and list-prompts read the resource/prompt registries without
calling register_all() first, so they always printed empty results on a fresh
process. Add register_all() to both commands, matching cmd_doctor and cmd_serve.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add a symmetric counterpart to MessagePresentation.approval() so a prompt
plus options renders as typed reply-action buttons across channels, reusing
the existing quick_replies routing and byte-safe callback encoding. Closes
the 'no question(...) counterpart' gap without a parallel store/protocol.
Co-authored-by: MervinPraison <[email protected]>
- Probe Ollama's native /api/tags at the server root so a base URL ending
in /v1 is not mangled into /v1/api/tags; add an OpenAI /v1/models fallback
so generic local servers (llama.cpp/LM Studio/vLLM) are detected.
- Prefix detected models by provider (ollama/ vs openai/) instead of always
assuming Ollama.
- Key the probe cache by resolved endpoint so a mid-process OPENAI_BASE_URL /
OLLAMA_HOST change never returns a stale positive/negative.
- Add regression tests for both fixes.
Co-authored-by: Mervin Praison <[email protected]>
Address two P1 review findings on the CLI home unification:
- Writes (config set/reset) always target the canonical ~/.praisonai via a
new get_user_config_write_path(), migrating any existing legacy values
forward while leaving ~/.praison read-only.
- setup's get_praison_home() now expands ~ in PRAISONAI_HOME so setup and the
config resolver resolve the override to the same directory.
Co-authored-by: Mervin Praison <[email protected]>
Probe for a reachable local OpenAI-compatible endpoint (Ollama) and use it as
the zero-config default when no cloud key is configured, downgrading the
interactive API-key wall to a non-blocking suggestion. Non-TTY/CI still fails
fast when nothing is detected.
Co-authored-by: MervinPraison <[email protected]>
Collapse the duplicated "which stores back a CLI session" enumeration onto
one helper so list/continue/resume and show/export/delete address the same
stores in the same order by construction, instead of two hand-kept copies.
- project_sessions.canonical_cli_stores(): single enumerator used by
list_project_sessions, find_last_session (via _resolve_usage_store) and
session_exists_anywhere.
- session_resolver._canonical_stores() now delegates to it, removing the
parallel store list that caused repeated list-vs-resume drift.
- commands/session._create_backend defaults now anchor under the canonical
data home (~/.praisonai) instead of the legacy ~/.praison root, so a
backend-selected store no longer silently splits sessions across two homes.
- Regression test asserting the list-path and resolver-path enumerate
identical store instances.
Kept minimal and backward-compatible: no public API/flag removed, protocol
unchanged, no store rewrite/migration (deferred to the home-unification
effort the issue references).
Co-authored-by: MervinPraison <[email protected]>
Re-root cli/configuration/paths.py on the core praisonaiagents.paths
canonical home (get_data_dir): PRAISONAI_HOME override, ~/.praisonai
default, ~/.praison legacy fallback. This makes the home every command
uses (sessions/traces/logs/cache/state/model-recency) the same directory
`setup` writes config into. Legacy ~/.praison/config.toml is kept as a
read-only fallback so existing installs keep resolving until migrated.
Co-authored-by: MervinPraison <[email protected]>
- integrations/base.py: on the stream_async timeout/early-exit path, cancel and
await the concurrent stderr reader task so it cannot outlive the generator as
a pending task or surface an uncollected exception on the caller's loop.
- framework_adapters/registry.py: key the availability cache by the lowercased
name (matching PluginRegistry.resolve's case-insensitivity) so
invalidate_availability("crewai") clears a prior is_available("CrewAI") result.
Co-authored-by: Mervin Praison <[email protected]>
- integrations/base.py: apply timeout to stream_async via deadline +
asyncio.wait_for on each stdout read and the stderr/wait drain, so a
stalled subprocess can no longer hang forever (timeout was dead code).
- recipe/operations.py: split run_background into async-native
arun_background + a sync entry that routes through the _async_bridge,
which raises a clear error when called from a running loop instead of
deadlocking; export arun_background.
- framework_adapters/registry.py: memoise availability probes per process
(with invalidate_availability test hook) and protocol validation per
adapter class, eliminating repeated adapter construction + inspect on
the run()/arun() hot path.
- _entrypoint.py/agents_generator.py: resolve the adapter once and thread
it into AgentsGenerator so the winning adapter is not constructed twice.
Co-authored-by: MervinPraison <[email protected]>
Bulk agent chat-history restore parsed composite session ids by stripping
the "{session_id}_" prefix, so overlapping caller-supplied ids could load
another conversation under the wrong agent_key (Greptile P1/Security).
Save now tags each child session with parent_session_id + agent_key metadata;
list_sessions surfaces agent_key; bulk restore resolves the exact agent_key
from those tags and only falls back to prefix-stripping for legacy untagged
sessions. Backward compatible; no new params or exports.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: execute_tool_async now runs BEFORE_TOOL/AFTER_TOOL security hooks so
the primary async path (achat -> _execute_unified_achat_completion) no longer
silently skips HookRegistry gating. Zero-overhead when no hooks are registered.
Gap 2: PraisonAIAgents.__init__ raises ValueError for unknown process values
instead of silently running zero tasks; docstring corrected (parallel fan-out
is async_execution=True on tasks, not process="parallel").
Gap 3: Session chat-history restore now reads SessionStore first, mirroring the
save path introduced by the G-2 refactor, so resumed sessions recover history.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Sort DEFAULT_CONTEXT_LENGTHS by descending key length so get_context_length's
partial matching checks specific model names (e.g. gpt-4-32k) before shorter
prefixes (e.g. gpt-4), fixing gpt-4-32k-0314 resolving to 8192 instead of 32768.
Add a module-load assertion so eval-only extras can never silently shadow
canonical MODEL_LIMITS entries.
Co-authored-by: Mervin Praison <[email protected]>
Cache the resolved ToolSearchConfig (including the ImportError fallback)
in a module-level sentinel so _resolve_tool_search_config() returns a
single stable class object. Without this, the fallback path defined a
fresh dataclass per call, breaking isinstance() passthrough across
resolve_tool_search() invocations. This also converges the __getattr__
and resolve_tool_search resolution paths on the same cached class.
Co-authored-by: Mervin Praison <[email protected]>
Build eval/tokens DEFAULT_CONTEXT_LENGTHS from the canonical
context/budgeter.MODEL_LIMITS plus eval-specific extras, so gpt-5 and
gpt-4.1 resolve to their real 1M window in the eval path. All prior eval
keys (dated snapshots, o1/mistral/deepseek/groq) are preserved.
Co-authored-by: MervinPraison <[email protected]>
Replace the eager module-level ToolSearchConfig alias in
config/feature_configs.py with a PEP 562 __getattr__ so that
`from praisonaiagents import Agent` no longer initialises the entire
tools subsystem just to re-export a backward-compat alias.
- ToolSearchConfig is resolved (and tools.tool_search imported) only on
first attribute access, then cached.
- ToolSearchParam uses a string forward reference.
- resolve_tool_search lazy-imports the config when tool search is used.
- ImportError fallback semantics and all import paths preserved.
Co-authored-by: MervinPraison <[email protected]>
- tool_panel.py ApprovalResponse message now carries optional reason
(backward-compatible default None), matching the interactive events
ApprovalResponse contract for the live y/n approval path.
- Clarify ApprovalDialog.on_button_pressed docstring: the live Textual
TUI approves/denies via the tool_panel y/n handler and does not yet
collect a reason, so the param is not misleadingly presented as active.
Addresses Greptile P2 on PR #3180.
Co-authored-by: Mervin Praison <[email protected]>
Add an optional reason field to the interactive ApprovalResponse and prompt
for a one-line correction on Reject in the Rich and Textual frontends,
mirroring the console approval backend. Empty input preserves plain denial.
Co-authored-by: MervinPraison <[email protected]>
- rich_frontend/textual_frontend: escape preview via rich.markup.escape so
diffs/content containing bracket chars no longer raise MarkupError and crash
the approval dialog (Greptile P1)
- events.render_change_preview: synthesise a unified diff from old_string/
new_string for edit calls lacking a precomputed diff (Greptile P2)
Co-authored-by: Mervin Praison <[email protected]>
Render a unified diff (edit/apply_patch) or truncated new content (write)
before prompting for approval in the interactive Rich and Textual frontends,
so users approve the concrete change rather than just a tool label. Adds a
shared render_change_preview helper and ApprovalRequest.change_preview() in
the interactive events module, mirroring approval_backend._render_preview.
Co-authored-by: MervinPraison <[email protected]>
Empty/whitespace-only profile strings were passing through _as_opt_str
as non-None values, making them indistinguishable from a named scope
and violating the documented 'None means unscoped' fail-closed contract.
Mirror the existing trust normalisation in __post_init__ and add tests.
Co-authored-by: Mervin Praison <[email protected]>
Adds an optional `profile` field to the core RouteBinding routing contract
and surfaces the matched profile via RouteMatch/resolve_route. This gives
each route a named isolation scope the wrapper can key its memory namespace
/ secret scope off, so one gateway can multiplex tenants. Resolution is
most-specific-wins and fails closed: an unmatched route carries profile=None
and never inherits another tenant's profile.
Core-only, backward-compatible (all fields optional), no new deps/exports.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer findings on PR #3187:
- Graceful at-least-once fallback when metadata.message:write scope is absent
(was a permanent message-loss regression on apps without the scope).
- Reconcile threaded sends via conversations.replies (history excludes replies).
- Forward idempotency_key on the initial send path, not just crash-recovered drain.
- Gate key forwarding on an explicit idempotency_key param (drop **kwargs fallback).
Co-authored-by: Mervin Praison <[email protected]>
Slack, Telegram, Discord, and Webhook approval backends persisted the
pending approval before polling but skipped _resolve_pending on their
early-return guards (missing chat/channel id, failed send) and outer
except handlers. This left stale status='pending' rows that rehydrate()
surfaced as false-positive outstanding approvals after a restart.
Each missed exit path now records the fallback denial via _resolve_pending
before returning, matching the HTTP reference backend. Adds regression
tests for the early-exit and exception paths.
Co-authored-by: Mervin Praison <[email protected]>
The Discord native upload branch caught all exceptions and returned
False, so a transient blip bypassed deliver_with_retry entirely and the
file was silently dropped — the exact gap this PR set out to close, but
only Telegram/Slack got it. Let transport errors propagate (matching the
other transports) so the retry wrapper backs off and retries; only the
missing optional discord dependency is caught locally, and unresolved
channels still fall through to the no-primitive False return.
Co-authored-by: Mervin Praison <[email protected]>
The outbox's crash-reconciliation seam shipped unused: no channel adapter
implemented was_delivered() or declared reconciles_unknown_send, so every
built-in channel fell back to at-least-once (a duplicate on restart).
Slack can read back recent channel history and match a client-side idempotency
key stamped into the message metadata, so it now opts into effectively-once:
- SlackBot declares reconciles_unknown_send=True and implements was_delivered()
via conversations.history, matching the key in message metadata.
- send_message stamps the idempotency key into Slack metadata when provided.
- DurableDelivery carries the idempotency key in the outbox payload and
forwards it to adapters whose send_message accepts it (backward-compatible).
- _build_reconciler now passes the target channel to was_delivered when its
signature accepts it (legacy single-arg form still supported).
Channels whose platform cannot confirm delivery stay at-least-once by design.
Co-authored-by: MervinPraison <[email protected]>
Chat approval backends (Slack, Telegram, Discord, Webhook, HTTP) held the
pending approval only in an in-memory polling coroutine, so a gateway/bot
restart while an approval was outstanding stranded the blocked agent run.
Add an opt-in DurableApprovalMixin to the shared _approval_base module that
wraps the existing ApprovalStore: it persists the request before polling,
records the final decision, and exposes rehydrate() to recover outstanding
approvals on startup. Each chat backend now accepts an optional store= and a
shared DEFAULT_APPROVAL_TIMEOUT. When no store is given behaviour is unchanged
(fully backward-compatible); no new dependency is introduced.
Co-authored-by: MervinPraison <[email protected]>
Media uploads via DeliveryRouter.send_media were attempted exactly once —
a transient transport blip (HTTP 5xx, rate limit, connection reset) silently
dropped the file while the accompanying text was delivered durably. Text gets
resilience because adapters wrap send_message in deliver_with_retry (bounded
exponential backoff honouring server Retry-After); the raw media upload path
reached none of it.
Wrap the media upload in the same deliver_with_retry helper, reusing the
adapter's already-configured backoff policy when present. Non-retryable
outcomes are preserved: an adapter with no upload primitive still returns
False without retrying, and a permanent error still surfaces as a failed send.
No new params, modules, exports, or schema — the minimal wiring that closes
the reliability gap.
Co-authored-by: MervinPraison <[email protected]>
- events.py: log at DEBUG on unexpected derive_pattern failure instead of
silently swallowing (ImportError still falls back cleanly)
- rich_frontend.py / textual_frontend.py: drop extraneous f-string prefixes (Ruff F541)
- textual_frontend.py: Session Only button now shows the narrow pattern it
persists; derive both patterns once in __init__ so displayed and stored
patterns are guaranteed identical
Co-authored-by: Mervin Praison <[email protected]>
Interactive Rich/Textual frontends persisted a blanket action_type:* pattern
on "Always allow", silently whitelisting every use of a tool from a single
benign approval. Add a shared derive_permission_pattern helper (mirroring the
console backend's _create_pattern) that scopes shell commands to a reusable
command-prefix and other tools to the concrete path, never emitting the blanket
grant unless the user picks the explicit "allow all uses of this tool" option.
Co-authored-by: MervinPraison <[email protected]>
- _resolve_effective_tool_timeout and _validate_cli_backend_compatibility now
fall back to {} when roles/agents are explicit YAML nulls, preventing a
TypeError on dict unpacking (CodeRabbit).
- Remove redundant inner `import os` in _strict_validation_enabled; os is
already imported at module top (Greptile).
Co-authored-by: Mervin Praison <[email protected]>
- _normalize_yaml_config: detect duplicate agent/task names and unknown
task agent refs; raise under PRAISONAI_VALIDATE_STRICT or warn loudly and
preserve both entries by suffixing, instead of silently dropping.
- _resolve_effective_tool_timeout: apply the tightest (min) declared
tool_timeout to the shared tool dict and warn on any overridden agent,
so a fast agent is never silently forced to wait a slower agent's budget.
- BasicSkillMutator._is_safe_path: allow nested skill files (references/,
scripts/, assets/) while still rejecting absolute paths and parent
traversal; real containment stays enforced by the caller's resolve().
Co-authored-by: MervinPraison <[email protected]>
- execution_mixin: nest sync_display_callbacks restore fully under the
status_tool_callback identity check so a finishing agent can't clobber a
concurrent agent's live callback (3+ verbose-TTY agents race).
- agents: shallow-copy self.variables into task.variables so tasks can't
mutate shared AgentTeam state.
- agents: add async-aware _arun_task_start_hook/_arun_task_complete_hook that
await coroutine lifecycle callbacks and offload sync ones to the executor,
so arun_task never blocks the loop or silently drops an async hook.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: arun_task() now fires on_task_start/on_task_complete and propagates
self.variables, matching run_task(). Extracted _run_task_start_hook and
_run_task_complete_hook shared helpers so both sync and async paths stay in
sync (mirrors the _apply_task_guardrail helper pattern).
Gap 3: verbose+TTY status animation now swaps and restores the shared
sync_display_callbacks['tool_call'] entry under main.py's existing
_callbacks_lock, with an identity check on restore so concurrent verbose
agents don't clobber each other's entry.
Gap 2 (Memory adapter-protocol bypass) intentionally deferred: routing 34
vendor-specific call sites through the protocol is a large architectural
refactor with high regression risk, out of scope for a minimal fix.
Co-authored-by: Mervin Praison <[email protected]>
Deep-copy of formatted tool schemas now only runs when a
BEFORE_TOOL_DEFINITIONS hook is actually registered, matching the
has_hooks fast-path idiom used by every other hook event.
Co-authored-by: MervinPraison <[email protected]>
Addresses Greptile review: on_agent_start/aon_agent_start constructed a
ConversationSession eagerly on every call, reading agent.name/agent.agent_id
and building an object discarded on resume. Move construction into the
build_session factory (create-branch only) while capturing the created
instance for identical cache identity/timestamps.
Co-authored-by: Mervin Praison <[email protected]>
Deduplicate the create-or-resume session logic that PraisonAIDB and
PersistenceOrchestrator each reimplemented across their sync and async
surfaces. A new internal helper persistence/conversation/_ops.py owns the
store-level flow; both classes call it while keeping their distinct
return-type contracts (DbMessage vs ConversationMessage), caching, and
lock/cooldown machinery. Behaviour-preserving.
Co-authored-by: MervinPraison <[email protected]>
Address final-review findings on #3166:
- event_allowed: namespaced sub-type (issues.opened) now requires the
payload to carry a matching action; a missing action no longer admits a
bare base event (fail-closed).
- HookConfig: a secret with no explicit signature_header defaults to
X-Hub-Signature-256 instead of rejecting every request.
- gateway server: deliver_only with an empty rendered message is a no-op
and never hits the delivery backend (avoids 500/retry loops).
- Add unit tests for the fail-closed subtype filter and default header.
Co-authored-by: Mervin Praison <[email protected]>
Extend the generic inbound trigger (POST /hooks/<path>) so a hook can
verify a provider HMAC signature over the raw body, filter by event
type, and deliver a rendered message with no LLM turn — all additive
and backward compatible.
- core (gateway/hooks.py): add pure verify_webhook_signature() helper and
additive HookConfig fields (secret/signature_header/signature_algo/
signature_prefix/events/event_header/deliver_only) plus verify_signature/
resolve_event/event_allowed; round-trip via to_dict/from_dict (secret
redacted); export the helper.
- wrapper (gateway/server.py): read the raw body once, reject invalid/
missing signatures with 401 before any agent runs, 200 no-op on
filtered-out events, and short-circuit deliver_only straight to delivery.
- wrapper (bots/_config_schema.py): mirror the new fields on HookSchema.
Co-authored-by: MervinPraison <[email protected]>
The pre-existing test_windows_scheduled_task_command_is_well_formed asserted
`--config` appeared inline in the /TR value. This PR intentionally routes the
scheduled task at the generated .cmd wrapper (single, well-formed quoting) to
avoid the nested-quote hazard for paths with spaces, so /TR now points at the
wrapper path and the wrapper owns the --config invocation. Assert the new,
intended contract instead of the outdated implementation detail.
Co-authored-by: Mervin Praison <[email protected]>
Close the observability gap flagged in review: a channel skipped at
startup because its credential was unavailable was never added to
_channel_bots, so health() omitted it entirely — indistinguishable
from a channel that was never configured. Track skipped channels in
_degraded_channels (cleared on recovery in both start_channels and the
hot-reload single-channel path) and report them as `degraded` in
health(). No new config keys, params, or API surface.
Co-authored-by: Mervin Praison <[email protected]>
The installed daemons run python -m praisonai_bot gateway start, whose Typer command discarded GatewayHandler.start()'s int return. Typer ignores a returned int, so the process always exited 0 - the generated units' Restart=on-failure / RestartPreventExitStatus=78 / KeepAlive.SuccessfulExit directives never saw the real fatal-config (78) / transient (75) code, making the whole feature inert. Surface it via typer.Exit.
Also replace the Windows scheduled-task's fragile inline cmd /c string (nested quotes that misparse paths under C:\Program Files) with a single quoted path to the generated .cmd wrapper, which already owns the exit-78 translation.
Co-authored-by: Mervin Praison <[email protected]>
A gateway fronting several channels no longer fails closed for the whole
process when a single channel credential is temporarily unavailable
(rotation, expiry, unset env var, secret-store blip). The channel token
validator now returns an empty (degraded) token instead of raising, so the
runtime's existing "no token -> skip channel" path isolates just that
channel while every healthy channel keeps serving. gateway status/doctor
already report per-channel availability, so the degraded state stays
queryable. Fail-closed remains for structurally invalid config and the
gateway's own ingress/auth secret.
Co-authored-by: MervinPraison <[email protected]>
Installed supervisor units restarted the gateway unconditionally, so the
runtime's fatal-config exit (78, EX_CONFIG) was discarded and a broken
config crash-looped forever. Map the existing core exit-code contract to
per-OS restart directives:
- systemd: Restart=on-failure + RestartPreventExitStatus=78 +
StartLimitBurst=5 (bounded restarts).
- launchd: KeepAlive dict (SuccessfulExit=false, Crashed=true) +
ThrottleInterval so a clean/fatal exit is not relaunched every few
seconds.
- windows: wrap the scheduled task / startup script so exit 78 maps to a
clean stop instead of a relaunch.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer P1 findings on `praisonai usage`:
- Read current-project and global stores separately so `--by project`
no longer collapses both sources into a single `current` bucket.
- Raise per-store scan limit (1000 -> 100_000) so large stores are not
silently truncated (also affects `--days 0`).
- Surface store-open/read failures via warnings (table) and an `errors`
field (JSON) instead of reporting them as empty usage.
Co-authored-by: Mervin Praison <[email protected]>
- Honor PRAISONAI_HOME in legacy-session migration lookup via
get_sessions_dir() instead of a hardcoded ~/.praisonai/sessions path.
- Gate legacy name-only fallback to global scope only, so a workspace-scoped
run never silently adopts another project's history (isolation, #3154).
- Resolve workspace identity per-directory (cache keyed by cwd) so a
long-lived process that changes directory gets the correct identity while
still avoiding repeated git calls per directory.
- Add tests for directory-change identity and global-scoped legacy fallback.
Co-authored-by: Mervin Praison <[email protected]>
Strict-mode toolset resolution flattened ToolResolutionError (a ValueError
subclass) into a plain ValueError, dropping .unknown/.suggestions. Re-raise
the typed error before the generic handler and export the resolver API from
praisonaiagents.tools so strict callers can catch it.
Co-authored-by: Mervin Praison <[email protected]>
Aggregates already-persisted per-session total_tokens/cost from the local
session store(s) and reports by day/model/project with --days/--project/--json
filters. Wrapper-only reporting surface; no core change, no new deps.
Co-authored-by: MervinPraison <[email protected]>
Same-named agents in different projects no longer share conversation
history by default. The auto-derived session id now folds in a stable
workspace/project component (git root-commit, else resolved cwd, else
global) instead of being a function of the agent name alone.
- Add praisonaiagents/session/workspace.py with workspace_id() resolver
- Derive auto id as history_<sha256("{workspace}:{name}")[:8]>
- Keep name-only sha256 + md5 fallbacks so prior sessions still resolve
- Add PRAISONAI_GLOBAL_SESSIONS=true opt-out for name-only continuity
Co-authored-by: MervinPraison <[email protected]>
Address the two Greptile findings on PR #3152:
P1 (resolved name not a scoped-registry key): assert_framework_available now
falls back to the process-default registry when an injected/scoped registry
does not recognise a name. A router/alias that resolves to a concrete built-in
(e.g. autogen -> autogen_v2) is no longer falsely rejected, while the DI seam
for genuinely scoped adapters is preserved.
P2 (setup ran outside observability): adapter.setup() moved out of
_prepare_for_run into a small _run_adapter_setup seam invoked INSIDE the
observability_session on both the sync and async kickoff paths, so setup events
and any setup/import failure are recorded and finalized instead of slipping
outside observability.
Tests: added DI fallback coverage and a regression guard that setup runs inside
the session on both paths.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Gap 3 from the wrapper-architecture review:
3a. assert_framework_available / get_install_hint now accept an optional
registry and AgentsGenerator threads its injected _adapter_registry
through them, so a scoped/per-tenant adapter is no longer rejected just
because it is absent from the process-default registry.
3b. Observability init+finalize is now owned by AgentsGenerator via the
existing observability_session context manager (bracketing both the sync
and async kickoff paths). The by-convention per-adapter finalize calls in
the CrewAI and PraisonAI adapters are removed. This closes the AutoGen
leak, where the adapter never called finalize_observability and left an
ObservabilityRun / emitter swap alive on every invocation.
Tests updated to assert the new invariant (generator owns the lifecycle;
adapters do not finalize) and to cover the DI seam end to end.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Address two greptile P1 findings on PR #3150:
- command_parser: broaden unsafe-expansion detector to match bare $VAR
(e.g. `rm -rf $HOME`) in addition to $IFS/${...}; $(...) and backticks
remain excluded so command substitution stays on the deny-checked
decomposition path.
- memory.reset_long_term: re-raise on Chroma delete_collection failure so
a failed reset is not silently reported as success while long-term
memories remain available.
Co-authored-by: Mervin Praison <[email protected]>
- permissions: escalate shell commands containing unresolvable parameter
expansion ($IFS / ${...}) to ASK instead of letting a broad allow rule
short-circuit a specific deny. Command substitution ($()/backticks) is
left to the existing per-op decomposition.
- llm: _setup_event_tracking now no-ops on empty events and merges into the
process-global litellm.callbacks (tracking per-instance ownership) instead
of overwriting it, so unrelated agents' callbacks are preserved.
- memory: reset_long_term() deletes only this instance's own Chroma
collection rather than resetting the entire shared client; collection name
is now an opt-in config override (default unchanged).
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer-found gaps so the opt-in gateway lifecycle policies from
#3021 actually take effect at runtime:
- Wake tracking: notify_inbound()/wake() now fire from the single client
frame entry point (_handle_client_message) so a live handshake can never
be quiesced mid-flight.
- CLI scale-to-zero arming: treat the open listening socket as an inherent
self-wake path so --scale-to-zero (no wake_url) still arms and quiesces;
an external wake_url is only required when an on_quiesce host-suspend hook
is configured.
- Idle clock: reset _last_inbound_ts when the idle loop arms so serving,
not construction, starts the idle interval.
- Crash-loop breaker: consult RestartLoopGuard around the supervised channel
run so a channel crash-looping within the window stops auto-resuming.
- Reload reconciliation: _reconcile_lifecycle rebuilds policies and cancels/
relaunches idle + drain-marker loops on hot-reload; unchanged blocks leave
running tasks untouched.
All opt-in and off by default; always-on gateways are unaffected.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing pure core lifecycle policies into the primary gateway
runtime (WebSocketGateway), reusing them rather than duplicating BotOS's
machinery:
- ScaleToZeroPolicy: opt-in idle-quiesce loop that quiesces the gateway
(dormant + optional host-suspend hook) when idle for N minutes with no
in-flight turn / queued inbound, and wakes on inbound.
- DrainMarkerPolicy + current_epoch: a port-less external drain marker
watcher checked against the process instantiation epoch, so a stale
marker left on a durable volume by a machine restart is ignored.
- RestartLoopGuard: a new pure, dependency-free rolling-window predicate
in core (beside classify_exit_reason) so the crash-loop breaker is
protocol-driven and reusable by both runtimes.
Exposed via a 3-way surface (YAML `lifecycle:` block, CLI flags
--scale-to-zero/--idle-minutes/--drain-marker, and Python), all opt-in so
always-on gateways are unchanged and fully backward-compatible. Lifecycle
state is surfaced in health() for observability.
Co-authored-by: Mervin Praison <[email protected]>
Greptile P1: the identity resolver was only built at startup, so a changed
top-level identity: block (which triggers a full channel restart) never
rebuilt or cleared _identity_resolver — enabling stayed a no-op and
disabling/re-pointing the store kept the stale resolver.
Route startup and hot-reload through _reconcile_identity_resolver, run
before channels (re)start. Explicit constructor/CLI resolvers always win;
an unchanged block preserves the live resolver (link cache/store handle);
enable installs, disable/remove clears back to per-platform keys.
Co-authored-by: Mervin Praison <[email protected]>
Resolve the Greptile review finding: when 'auto' resolved to 'off' on a
non-editable channel the reason was logged at info, and the explicit
warning branch below was skipped (mode already OFF), so operators
filtering info logs couldn't see why streaming was disabled. Log the
auto->off degradation at warning; auto->draft stays at info. Adds a test.
Co-authored-by: Mervin Praison <[email protected]>
The flagship WebSocketGateway never injected an identity_resolver into the
channel bots it created, so each platform fell back to a per-platform session
key (bot_{platform}_{user_id}) and cross-platform conversation continuity
silently broke. Mirror BotOS by stamping a shared resolver onto every channel
bot's session manager.
- WebSocketGateway.__init__ gains an optional identity_resolver (Python override)
- _stamp_identity_resolver() mirrors _stamp_admission_gate; called from
start_channels and _start_single_channel (hot-reload)
- start_with_config builds a StoreBackedIdentityResolver from a declarative
top-level identity: block (constructor value wins); degrades gracefully
- CLI gains --identity-store to enable continuity without a YAML block
Co-authored-by: Mervin Praison <[email protected]>
Adds StreamingMode.AUTO which resolves to DRAFT where the channel can
edit and OFF otherwise, so streaming turns on where supported instead of
every platform silently sitting on OFF. Degradation is now logged at
warning level, and mode resolution preserves user-set config fields via
dataclasses.replace() instead of resetting to defaults.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1s in the CLI session resolver:
- Honor DefaultSessionStore.delete_session() return value so an I/O
failure is no longer reported as a successful deletion.
- Delete against the single store resolve_session() selected instead of
every canonical store, so a project-scoped delete can't remove an
unrelated same-id session living only in the global store.
- Always sweep the legacy SessionManager store on delete so a duplicate
legacy record can't resurface a session the CLI reported as deleted.
- On a read failure of the owning canonical store, report not-found for
that record instead of silently falling through to a different same-id
session or the legacy store.
Adds regression tests for the failed-delete, legacy-duplicate sweep, and
read-failure cases.
Co-authored-by: Mervin Praison <[email protected]>
DeliveryRouter.send_media discarded the resolved thread_id, so a threaded
target (Slack thread_ts, Telegram forum topic, Discord thread) delivered
text into the thread but attachments to the parent chat. Thread the
thread_id through deliver_media_to_adapter, forwarded via each transport's
native keyword (Telegram message_thread_id, Slack thread_ts, Discord thread
channel) only when the primitive accepts it, so adapters lacking thread
support are unaffected. Mirrors the text path's _accepts_thread_id guard.
Co-authored-by: Mervin Praison <[email protected]>
Both AgentScheduler and AsyncAgentScheduler constructed SchedulerDelivery
without the persisted origin, so deliver="origin" silently no-op'd in
production despite the resolution logic existing. Add
SchedulerDelivery.origin_from_config to normalise the origin carried in
the job config (DeliveryTarget or serialised dict) and pass it through at
both call sites, so origin delivery actually activates on the lightweight
path.
Co-authored-by: Mervin Praison <[email protected]>
The lightweight scheduler delivery path silently no-op'd for the symbolic
'origin' token because it required a live gateway session. ScheduleJob.origin
already persists a concrete DeliveryTarget at creation, so SchedulerDelivery
now accepts it and rewrites 'origin' to a concrete channel:channel_id[:thread_id]
route — delivering back to the point of origin without the full gateway. 'all'
and the absent-origin case still degrade with a clear warning.
Co-authored-by: MervinPraison <[email protected]>
DeliveryRouter.resolve() now returns (platform, channel_id, thread_id) and
deliver() threads thread_id into the adapter's send_message so proactive/
scheduled/agent-initiated messages targeting a Slack thread, Telegram forum
topic, or Discord thread land in the intended thread instead of the parent
channel. Adapters lacking a thread_id parameter are introspected and left
untouched (no behaviour change). The lightweight scheduler route and the
gateway scheduled-delivery path now build platform:channel:thread routes and
drop the _ThreadBindingBot workaround, routing through the shared resilient
router directly.
Co-authored-by: MervinPraison <[email protected]>
The gateway server constructed DeadTargetRegistry() with no store, so it
persisted dead targets to the node-local dead_targets.json sidecar even
though a canonical SQLite dead_targets table already exists in the shared
DeliveryControlStore. This retires the duplicate JSON store for the gateway
path, making the SQLite table the single, cross-worker source of truth.
Falls back to the JSON default only if the SQLite store cannot be built.
Co-authored-by: MervinPraison <[email protected]>
Path-scoped rules (activation: glob) never fired at runtime because the
single rule-injection point built the system prompt with no file path.
Now _build_system_prompt scans the conversation for touched file paths
and appends matching glob rules per-turn, deduped against always/manual
rules and appended after the cache so it is never baked in. Gated on
RulesManager.has_glob_rules() so glob-free workspaces pay nothing. Also
fixes matches_file so a recursive pattern like **/*.py matches a bare
filename (foo.py).
Co-authored-by: MervinPraison <[email protected]>
Give the native OpenAI-client path the same default retry contract as the
LiteLLM path. A default Agent now applies RetryBackoffConfig() (max_retries=3)
so transient errors (429/overload/5xx) are retried consistently regardless of
which internal LLM path executes the turn. retry=False disables; retry=True/
dict/RetryBackoffConfig remain fully overridable. Reuses the existing native
retry loop (is_retryable classification, jittered backoff, ON_RETRY hook).
Co-authored-by: MervinPraison <[email protected]>
Route `session show`/`delete`/`export` through a single `resolve_session`
resolver that searches the same project-scoped + global stores used by
`session list`/`resume`/`run --continue`, so any id a user can list or
resume is fully manageable. Keeps a best-effort fallback to the legacy
SessionManager store during a deprecation window.
Co-authored-by: MervinPraison <[email protected]>
Introduced new HTML documents outlining the praisonai-mcp server host features, installation instructions, and usage guidelines. This enhances the understanding of the MCP server's capabilities and integration with other packages.
- Accept config= kwarg so SandboxManager can construct DaytonaSandbox
(mirrors sibling backends); derive image/timeout/cpu/memory from config
while keeping legacy direct kwargs backward-compatible
- Combine cd/export/command into a single process.exec call so env vars
and working_dir actually apply to the executed command
- execute_file now reads local file content and dispatches by language
(mirrors E2B), falling back to remote path execution when not local
Co-authored-by: Mervin Praison <[email protected]>
Wire Typer run/shell/backends to SandboxHandler, implement daytona-sdk
DaytonaSandbox, expand live Docker/manager tests and backward-compat gates,
and refresh praisonai-sandbox and praisonai-agents lockfiles.
Co-authored-by: Cursor <[email protected]>
- MCP.shutdown(): fall back to close() for HTTPStreamMCPClient/
WebSocketMCPClient, which expose close()/aclose() but not shutdown().
Previously these transports leaked on shutdown; also fixes Agent.aclose()
fallback path.
- Agent.close()/aclose(): remove this agent's id(self)-scoped tool circuit
breakers via new _cleanup_circuit_breakers(), preventing a reused object
id from inheriting a stale OPEN breaker and keeping the registry bounded.
Co-authored-by: Mervin Praison <[email protected]>
- close()/aclose(): shut down MCP clients passed via tools=[MCP(...)] by
walking self.tools (mirrors remove_mcp_server) instead of the always-empty
self._mcp_clients check, so subprocesses/threads are cleaned up deterministically.
- circuit breaker: scope the registry key to the Agent instance
(tool_{id(self)}_{name}) so one agent's failing tool no longer trips the
breaker for another agent's same-named tool.
- llm resolution: prefer llm_instance (the real LLM object) over the always-truthy
llm model-name string in the token-tracking, token-metrics and guardrail paths,
restoring set_current_agent/last_token_metrics wiring and configured-instance reuse.
Co-authored-by: MervinPraison <[email protected]>
- manager.get_available_types(): invoke callable is_available before bool();
ImportError path no longer advertises subprocess as available
- _plugin_registry fallback: translate non-ImportError loader failures to
ValueError; raise AttributeError from None in lazy __getattr__
- Realign E2B tests to the real to_thread-based implementation (25 active,
was 20 skipped); rewrite Daytona tests to the fail-loud stub contract
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- e2b: use importlib.import_module in is_available (aligns with tests, fixes CI)
- e2b: run_command list uses shlex.join to avoid shell reinterpretation
- _plugin_registry: self-contained fallback so praisonai-sandbox works without praisonai-code
- subprocess: guard sys.executable None/empty for PATH and cmd
- sandlock: allow sandbox root in _safe_sandbox_path so list_files("/") works
Co-authored-by: Mervin Praison <[email protected]>
Move sandbox backend implementations out of the wrapper into praisonai-sandbox,
preserve praisonai.sandbox shims, wire agents bridge/registry dispatch, and add
CI gates, publish slot, and backward-compat tests for the eight-package model.
Co-authored-by: Cursor <[email protected]>
- Never deliver start_automation to an idle CLI connection (filter is_cli
in the send + retry loops, not just the caller).
- Allow the side panel (extension) to start its own session without being
self-excluded as NO_EXTENSION.
- Claim the extension's session_id before awaiting send_text so concurrent
start_session calls cannot both pass the busy guard; release on failure.
- Stamp ended_at when a session is finalized as "cancelled".
- Add tests for side-panel start, idle-CLI exclusion, cancel_session
routing, and cancelled ended_at.
Co-authored-by: Mervin Praison <[email protected]>
Reject concurrent start_session when the extension is busy or absent,
avoid reporting "running" when start_automation was never delivered, and
release/finalize session locks on disconnect so /health returns to
sessions:0. Adds extension_busy/active_session_id to /health.
Co-authored-by: Mervin Praison <[email protected]>
Extract shared _extract_schema helper and let validate_tool_schema_consistency
optionally return built schemas so get_sorted_tool_schemas reuses them instead
of rebuilding every tool schema a second time. No behaviour change.
Co-authored-by: MervinPraison <[email protected]>
Delegate the delta-accumulation loop in _process_stream_delta() to the
existing _process_tool_calls_from_stream() method, removing the byte-for-byte
duplicate accumulator. The outer guard in _process_stream_delta() is unchanged,
so whether/when accumulation runs is unaffected.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback on the ToolResolver memoisation:
- Cap the resolver cache as a small LRU (OrderedDict) so a long-running
process that builds many workflows no longer retains every registry,
its tool callables/modules and resolver caches for the process life.
- Skip caching entirely when registry is None: a fresh registry is built
per call so its id() is never stable, meaning caching it only leaked
memory and never produced a hit.
Co-authored-by: Mervin Praison <[email protected]>
create_tool_registry_with_overrides re-implemented praisonai-tools package
discovery that ToolResolver._resolve_from_praisonai_tools already owns and that
resolve_tools() already consults via the canonical resolver. Remove the
duplicate so external-tool discovery has a single implementation.
The template/cwd tools.py autoload is intentionally kept in the wrapper because
it carries the distinct PRAISONAI_ALLOW_TEMPLATE_TOOLS gate (with a
skip-on-error contract and explicit-template-dir-outside-CWD support) that the
resolver's PRAISONAI_ALLOW_LOCAL_TOOLS + CWD-boundary gate does not provide, so
delegating it would change the security gate.
Co-authored-by: MervinPraison <[email protected]>
Callers invoke resolve_tools() once per agent/step over the same registry
object, and each call rebuilt a fresh ToolRegistry + ToolResolver, discarding
per-instance caches and re-executing local tools.py once per agent. Extract
resolver construction into _get_resolver(), memoised on
(id(registry), template_dir, autoload_enabled), so one resolver is reused
across a workflow build. Resolution order, results, and the security gate are
unchanged.
Co-authored-by: MervinPraison <[email protected]>
Add pre-flight bridge health check, step watchdog, and explicit
start_automation delivery signalling so the extension-mode CLI run
no longer hangs silently on keepalive PING/PONG until timeout.
- server.py: /health now reports extension_connections; start_session
response includes start_automation_sent so the CLI knows whether the
task actually reached an extension.
- browser.py: _require_bridge() pre-flight check (exit 2 fast); handle
server error messages; 30s first-step watchdog; verbose automation
delivery status; infra/timeout/task exit codes (2/3/1).
Co-authored-by: Mervin Praison <[email protected]>
Prioritize [question] title detection before the bug substring check and
guard autoClaude against the question label, so bracket-prefixed titles
like "[QUESTION] Is this a bug?" no longer auto-trigger Claude analysis.
Co-authored-by: Leebana <[email protected]>
Address reviewer findings on PR #3115:
- P1: /health counted all WebSocket clients, so a stray CLI connection could
produce a false-positive extension check. Track chrome-extension origin
connections server-side and expose extension_connections in /health; doctor
and launch polling prefer it (fallback to connections for older servers).
- P2: launch --no-server failure guidance pointed to a dead /health endpoint.
Guidance is now conditional: with --no-server it tells the user to start the
bridge first, otherwise it shows the curl verification step.
Co-authored-by: Mervin Praison <[email protected]>
- Treat malformed UTF-8 as JSON-RPC -32700 parse error instead of
terminating the transport (CodeRabbit)
- Bound the stdin queue and apply backpressure via timeout-based put so a
fast/malicious client cannot grow memory without limit (CodeRabbit)
- stop() now enqueues the EOF sentinel to wake a blocked line_queue.get so
shutdown exits cleanly even when stdin stays open (Greptile, CodeRabbit)
- Add regression test for invalid UTF-8 input
Co-authored-by: Mervin Praison <[email protected]>
- Remove early-return from BrowserServer.start() so programmatic callers
retain the documented blocking contract (CodeRabbit Major)
- Move proactive _port_in_use pre-check into the CLI, reusing the rich
'already running' message and exiting 0
- Make _port_in_use family-agnostic via getaddrinfo so IPv6 (::1) hosts
are probed correctly (Greptile P1)
- Use errno.EADDRINUSE instead of magic numbers; drop redundant f-prefixes
Co-authored-by: Mervin Praison <[email protected]>
The friendly error reported ws://127.0.0.1 but the run command actually
connects to ws://localhost and the health checks elsewhere use localhost.
Align the message (and its test) to localhost for accuracy.
Co-authored-by: Mervin Praison <[email protected]>
Zero-arg / all-optional tools serialized inputSchema.required as JSON null,
which strict MCP clients (Cursor's Zod validation) reject, discarding the
entire tools/list batch so only mcp_auth appeared. Omit the required key when
empty and defensively normalize any legacy required:null at the export
boundary.
Co-authored-by: Mervin Praison <[email protected]>
Replaces loop.connect_read_pipe(sys.stdin) which crashes on Windows
ProactorEventLoop + Python 3.13 with WinError 6. Reads stdin in a daemon
thread and hands lines to the asyncio loop via run_in_executor; writes
responses to sys.stdout.buffer with flush. Portable across platforms.
Co-authored-by: Mervin Praison <[email protected]>
- launch: on auto-load failure, print exact 'Load unpacked' dist path and
bridge verification steps (Chrome 137+/Windows blocks automated load)
- doctor extension: check bridge /health connection (ground truth) and treat
CDP :9222 as optional, so it no longer reports a false negative when the
extension works in the user's daily Work Chrome profile
Co-authored-by: Mervin Praison <[email protected]>
- Remove emoji from server.py start() banner and CLI run banners to avoid charmap crashes on cp1252 Windows consoles
- Reconfigure stdout/stderr to UTF-8 in __main__ before console import
- Add pre-bind port probe so a duplicate start reports "already listening" instead of raising a bind error
- Map WinError 10048 / EADDRINUSE to a friendly "already running" message with exit code 0 in the start command
Co-authored-by: Mervin Praison <[email protected]>
Translate cross-platform connection-refused errors (WinError 1225,
ECONNREFUSED 111/61) into an actionable message naming the bridge URL,
the `praisonai browser start` command, and the health-check URL.
Co-authored-by: Mervin Praison <[email protected]>
External bug reports like [praisonai-mcp] and [praisonai-browser] were
skipped because only [bug] matched the title gate. Match any leading
[...] prefix when the issue has bug or enhancement labels.
Add Tenki Cloud (https://tenki.cloud) as a compute provider for managed
agents, alongside E2B, Daytona, Modal, Fly.io, Docker and local.
- TenkiCompute implements ComputeProviderProtocol (provision / execute /
shutdown / get_status / upload_file / download_file / list_instances),
running tools in disposable Tenki microVMs. Sync SDK wrapped via
run_in_executor, matching the existing providers.
- Registered as "tenki" in the compute barrel, the _resolve_compute factory,
and the compute-provider hint sets.
- Uses only stable Tenki features (exec + file I/O). Default stock image
installs pip packages on demand; set metadata["tenki_image"] for a custom
image. Auto-resolves workspace/project from the API key.
- Enabled via TENKI_API_KEY; optional `tenki` extra (tenki-sandbox).
- Unit + live (skipped-by-default) tests mirroring the E2B/Daytona suites.
Address session-isolation gaps in agent-invoke:
- _supports_session_isolation now uses isinstance(Agent) so application
Agent subclasses are cloned per session instead of sharing state.
- resolve_session_agent raises on clone failure instead of falling back
to the shared template, preventing cross-session history leaks.
- Handlers surface isolation failures as clean errors.
- Add tests for subclass isolation and clone-failure behaviour.
Co-authored-by: Mervin Praison <[email protected]>
Short-circuit resolve_all_from_yaml's project-tool discovery with the cheap
local_tools_enabled() opt-in check before walking directories and shelling out
to `git rev-parse`. Loading is gated anyway, so the git subprocess added no
value when PRAISONAI_ALLOW_LOCAL_TOOLS is off (the default). Also narrow the
import guard to ImportError.
Co-authored-by: Mervin Praison <[email protected]>
- Optimizer now swaps goal/backstory (which drive the cached system prompt),
not just instructions, and clears the system-prompt cache, so each candidate
is scored with its own effective prompt instead of the original.
- Isolate eval chats via agent.ephemeral() to stop history pollution.
- Parse multiline candidates as complete blocks (delimiter + blank-line
fallback) instead of per-line fragments.
- Floor non-finite metric scores (NaN/inf) to 0.0 in both optimizer and loop.
- Move EvaluationLoopResult.best after metadata to avoid positional shift.
- Add tests for goal/backstory swap, apply, multiline parsing, non-finite scores.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing gated .praisonai/tools/ discovery into resolve_all_from_yaml
so @tool-decorated functions dropped into the convention are available to
YAML-defined agents by their tool name. Additive and backward compatible with
the cwd tools.py / tools/ paths.
Co-authored-by: MervinPraison <[email protected]>
The agent-serving endpoint dispatched every request against a single
shared Agent instance and ignored session_id, leaking mutable
chat_history across concurrent callers and making the advertised
"conversation continuity" a no-op.
Introduce resolve_session_agent() in the wrapper: the registry now holds
a template, and each request gets an isolated clone (via the existing
clone_for_channel safe-copy path). A provided session_id binds the clone
to the shared, file-locked DefaultSessionStore for continuity + cross-
session isolation; its absence yields an ephemeral conversation. Non-
Agent objects (e.g. mocks) fall back to the shared instance for backward
compatibility. Composes existing core primitives only — no new core
surface.
Co-authored-by: MervinPraison <[email protected]>
- EvaluationLoop now keeps and returns the highest-scoring iteration
(best/best_score/best_output) instead of the last one, and supports an
optional numeric metric to drive scoring instead of the LLM Judge.
- New PromptOptimizer (eval/prompt_optimizer.py) generates instruction
variants, scores each over an eval set, keeps the best, and optionally
writes it back to agent.instructions.
- Agent.optimize_instructions / aoptimize_instructions convenience methods.
- Lazy exports for PromptOptimizer/OptimizeResult.
Co-authored-by: MervinPraison <[email protected]>
- server.py: resolved secret string now wins over a raw {source,id} reference
dict in the runtime channel merge, so adapters (e.g. WhatsApp verify_token)
never receive an unresolved reference.
- gateway doctor --json: emit a single combined JSON document ({probes,secrets})
instead of two top-level documents so json.load(s) can parse the output.
- gateway doctor: exec-sourced credentials are reported as "configured" without
running their command, so a one-shot/rate-limited/rotating secret command is
not executed twice (availability report + probe).
Co-authored-by: Mervin Praison <[email protected]>
Add a lightweight, protocol-first secret-reference contract so credential
fields (token, app_token, verify_token) can be sourced from an env var, a
mounted secret file, or a command/secret-manager, with resolved values
registered for log redaction.
- core: praisonaiagents/secrets.py — SecretRef, SecretResolver protocol,
stdlib DefaultSecretResolver (env/file/exec), resolver registry, and a
redaction registry (register_secret_for_redaction / redact_secrets).
- config schema: credential fields accept the additive {source, id} form;
plaintext and ${ENV} stay fully backward compatible; resolved values are
registered for redaction.
- gateway doctor: reports each credential as available |
configured-but-unavailable | missing without printing the value.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback on PR #3100:
- Add local_tools_enabled() mirroring the loader's exact acceptance
(lower() == "true") so false/0 no longer suppress the hint while the
loader still denies (no silent no-op). Used by both the auto-discovery
hint and the --tools file path.
- Make --allow-local-tools a strictly per-invocation grant: set the env
gate for the run and restore the prior value in a finally, so a later
in-process run never inherits authorization to exec local Python.
- count_project_tool_files() now returns (project_count, user_count) so
the hint names the correct source (.praisonai/tools/ vs
~/.praisonai/tools/) instead of mislabelling user-global files.
- Tests: local_tools_enabled semantics (incl. false/0), tuple counts,
and false-value hint coverage.
Co-authored-by: Mervin Praison <[email protected]>
Playwright and CDP automation engines call agent.process_observation()
synchronously from inside async methods that run via asyncio.run().
The praisonaiagents runner rejects execute_sync() when an event loop
is already active, causing RuntimeError on every LLM observation
step and blocking all headless browser automation.
Changed to await agent.aprocess_observation() in both engines,
matching the async pattern already used by server.py.
Fixes#3093
- memory_mixin: feature-detect whether a session store's add_message accepts
tool_calls/tool_call_id; fall back to a plain-text turn for legacy protocol
stores so tool turns are never silently dropped by a swallowed TypeError.
- hierarchy: HierarchicalSessionStore.add_message now accepts and preserves the
optional tool fields so hierarchical stores also resume faithfully.
- store: count-based history slicing (get_chat_history / get_working_history)
no longer begins on an orphaned role="tool" result, avoiding invalid
transcripts on resume when the boundary lands mid tool-exchange.
- tests: cover legacy-store fallback, hierarchical store tool fields, and
the trim boundary skipping orphaned tool results.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
When .praisonai/tools/*.py files are present but PRAISONAI_ALLOW_LOCAL_TOOLS
is unset, run now prints a concise hint on the default path explaining how to
enable them, instead of silently skipping. Adds a discoverable
--allow-local-tools flag and aligns the init scaffold copy so the enable step
is stated up front.
Co-authored-by: MervinPraison <[email protected]>
The zero-config JSON session store only round-tripped role/content text,
so resuming a tool-using agent via --continue / session resume silently
dropped its tool calls and results. Add optional, additive tool_calls /
tool_call_id fields to SessionMessage (tolerant of absence for old files),
preserve them through get_chat_history / get_working_history / set_chat_history,
and teach _persist_message to forward assistant tool-call and tool-result
turns so resume reconstructs the same message list the model saw before.
Co-authored-by: MervinPraison <[email protected]>
Checkpoints already form an ordered shadow-git sequence, so a "turn" is an
index into it. Add a lightweight CheckpointService.rewind(steps) helper over
the existing list_checkpoints + restore, and surface it as
`praisonai checkpoint rewind [steps]` (default 1 = undo the last turn's file
changes). No changes to agent.py, the tool loop, or the session store.
Co-authored-by: MervinPraison <[email protected]>
apply_diff, search_replace and append_to_file previously gated the
workspace confinement check behind `if workspace:`, silently skipping it
when no workspace was passed. This let an LLM escape cwd via an absolute
path (e.g. apply_diff("/etc/hosts", ...)). Align all three with the
existing write_file/read_file behaviour: default the workspace to cwd and
always enforce is_path_within_directory.
Co-authored-by: MervinPraison <[email protected]>
- execute_tool_async now routes through the tool MiddlewareManager (parity
with sync execute_tool): before_tool/after_tool/wrap_tool_call gate async
tool calls too, so security/audit hooks are no longer bypassed. Fast path
(no hooks) unchanged. Core retry loop extracted to
_execute_tool_async_with_retry.
- Workflow._execution_lock uses module-level double-checked locking so two
threads first entering run()/astart() concurrently share one lock object
instead of each minting and acquiring its own, closing the run-guard race.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: Route Agent(hooks=[...]) tool middleware (before_tool/after_tool/
wrap_tool_call) through execute_tool via a lazily-built MiddlewareManager.
Zero overhead when no hooks are registered.
Gap 2: Apply the same retry / guardrail-retry / output_file policies used by
the top-level run() loop to nested-pattern steps (Parallel/Loop/Route/If/
Repeat) and hierarchical mode via a shared _apply_step_policies helper.
Gap 3: Guard run()/astart() against concurrent re-entrancy on a shared
Workflow instance with a lazily-created lock, raising a clear error instead
of silently corrupting per-run state.
Co-authored-by: Mervin Praison <[email protected]>
- execution_mixin: async tool path now runs the same policy/guardrail gate as
sync (_check_tool_policy_and_guardrails), closing the async bypass.
- sqlite/in_memory adapters + memory.py: delete_memory takes an optional tier
so delete_short_term/delete_long_term only touch their own tier — prevents a
short-term delete from erasing an unrelated long-term row with the same id.
- tool_execution: policy check_tool and guardrail validate_tool_call exceptions
now fail closed (deny) instead of silently executing the tool.
- workflows: a step whose guardrail never validates after exhausting retries is
now treated as failed, honoring on_error='stop' and the final workflow status;
on_step_complete is fired on a stopped failure.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on #3080:
- Falsy tool results (""/[]/{}/0/False) were dropped by the upstream
detector's truthiness check, disabling no-progress detection; now wrapped
so they remain fingerprintable.
- Identical-result streak now requires the same tool, so unrelated tools
returning a common value (e.g. "ok"/True) are not lumped into one run.
- Progress markers now record an action-index boundary so mark_progress()
actually resets the streak.
- Count-based idempotent/mutating BLOCK/HALT is now gated on an actual
stuck (identical-result) streak, preventing false halts on legitimate
high-frequency-but-progressing tool use (fixes wiring-test regression).
- Post-execution loop-guard BLOCK/HALT decisions are now surfaced to the
model instead of being silently discarded.
Co-authored-by: Mervin Praison <[email protected]>
- Remove dynamic -attempt suffix; use `git worktree add -B` so path()/reset()/
remove() deterministically resolve the same target (fixes resource leak /
state-mismatch flagged by CodeRabbit & Greptile)
- Fail fast with a clear exception when isolation is requested but provisioning
fails, instead of silently clobbering the shared root
- Check exit status in reset()/remove() and raise on failure
- Prune stale worktree bookkeeping before create so re-create after remove works
- Collision-resistant slug (append short name hash) so distinct names never
share a worktree
- Sort __all__ alphabetically
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer-flagged P0/P1 issues in per-task worktree isolation:
- Anchor all git ops to a fixed repo dir (env override / resolved cwd)
instead of the mutable process cwd.
- Validate caller-supplied task ids before using them as path/ref
components (reject traversal, invalid ref chars); refuse worktree
creation on unsafe ids instead of failing open to the shared cwd.
- Commit uncommitted worker edits before integrating so a clean-but-empty
merge no longer discards work on teardown.
- Honor the integration `git commit` return code and abort on failure so a
rejected commit blocks the task rather than reporting success.
- Route non-conflict merge failures and integration exceptions to 'blocked'
so a task is never marked 'done' with an unmerged branch.
- Add `workspace_kind` to the public update allowlist so opting an existing
task into 'worktree' actually persists.
Adds tests for uncommitted-edit preservation, failed integration commit,
integration exception blocking, and unsafe-id rejection.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #3081:
- _extract_summary_text no longer falls back to instance _previous_summary,
so a reused compactor cannot persist an outdated summary on a later
non-summarizing pass (drops intervening turns on resume).
- async compaction persists the checkpoint via asyncio.to_thread so the
locked JSON read/modify/write disk I/O no longer stalls the event loop.
- add regression test for the stale-summary leak.
Co-authored-by: Mervin Praison <[email protected]>
Addresses 3 P1 review findings on #3049 reload observability:
- health() overlays live _reload_watcher_active onto the recorded
ReloadStatus snapshot so a watcher that exits after the last reload is
reported as disabled instead of stale active.
- initial config load defers applied_config_revision until channels/agents
are actually up, and records a failed reload (and re-raises) if setup
throws, so a partial start no longer reports the config as live.
- bump praisonaiagents minimum to >=1.6.152 so standalone praisonai-bot
installs resolve an agents release containing ReloadStatus /
compute_config_revision (avoids ImportError at import time).
Adds a regression test for the stale-watcher case.
Co-authored-by: Mervin Praison <[email protected]>
HealthMonitorSchema used invented keys (check_interval, failure_threshold,
etc.) that the runtime never reads. server.py passes gateway.health straight
to HealthMonitorConfig.from_dict, which only consumes interval/startup_grace/
stale_after/stuck_after/max_restarts_per_hour/enabled. As written the PR would
reject a valid `interval: 60` (extra="forbid") and silently accept ignored
keys. Fixes the schema to mirror the real runtime keys and adds a regression
guard test.
Co-authored-by: Mervin Praison <[email protected]>
Update the seen set while merging extra_tools so duplicates within the
resolved --tools/--toolset/discovered set are removed (not just against
frontmatter), matching _auto_discover_project_tools. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
- tool_execution: gate resolved tool calls through the attached PolicyEngine
(check_tool) and tool-call guardrails (validate_tool_call) before dispatch;
denials are non-retryable and bypass the circuit breaker
- memory: delegate reset_/delete_short_term/long_term to the active adapter
(sqlite/in_memory) to avoid the legacy short_mem/long_mem schema mismatch,
and return the memory id from store_short_term/store_long_term
- memory adapters: add delete_memory/reset_short_term/reset_long_term to the
sqlite and in-memory adapters
- workflows: AgentFlow.run() honors step.on_error="stop" (aborts + marks
failed) and the final status reflects any unresolved step failure instead
of always reporting "completed"
Co-authored-by: Mervin Praison <[email protected]>
Opt-in worktree isolation (workspace_kind="worktree") gives each parallel
worker a dedicated git worktree/branch (kanban/<task_id>) as its cwd, and
integrates the branch back on completion with conflict-on-merge detection —
routing conflicts to 'blocked' instead of silently overwriting. Default
"default" keeps today's shared-cwd behaviour.
Co-authored-by: Mervin Praison <[email protected]>
Core (praisonaiagents/gateway): add a frozen ReloadStatus dataclass and a
pure compute_config_revision() helper to protocols.py + exports, giving both
the SDK and bot a canonical reload-status shape and deterministic config hash.
Wrapper (praisonai-bot): record the last reload outcome (ok/failed/no_changes)
and the applied-config revision in _reload_config_locked/start_with_config,
track watcher liveness, and surface reload/applied_config_revision/
on_disk_config_revision/config_drift in health(). CLI `gateway status` now
prints reload result, config drift, and watcher state.
Co-authored-by: Mervin Praison <[email protected]>
The durable persist+resume machinery (Issue #2741) already existed, but
CompactionResult.summary was always "", so the persister received nothing
and every summary was lost on process exit. Populate it from the produced
summary (LLM/naive/fallback) and persist in the async proactive path too.
Co-authored-by: Mervin Praison <[email protected]>
The LoopGuard "no progress" heuristic counted every tool call as no-progress
because its progress counter was never updated (mark_progress is not called in
the tool loop), so any turn with 8+ tool calls halted regardless of results.
This broke legitimate async / long-running MCP tool workflows that poll a job
status (IN_PROGRESS -> COMPLETE) or pace with a wait tool.
Now no-progress is measured by the trailing run of identical tool-result
fingerprints: distinct/changing results reset the streak (progress), while a
genuinely stuck loop of identical results still halts. The real tool result is
passed through record() so the fingerprint reflects actual output.
Co-authored-by: Mervin Praison <[email protected]>
Replace the opaque `gateway: Optional[Dict[str, Any]]` in GatewayConfigSchema
with load-time validation via a typed GatewayServerSchema (extra="forbid",
ranges mirroring core's GatewayConfig) plus HookSchema/HealthMonitorSchema, so
a misspelled or mistyped server knob (drain_timout, "quick") now fails closed
with a friendly, field-named error instead of being silently dropped at
runtime. Blocks stay stored as dicts for backward-compatible downstream access.
Co-authored-by: Mervin Praison <[email protected]>
_run_custom_agent ignored --tools/--toolset and never auto-discovered
.praisonai/tools/*.py, so the "auto-loaded on every run" promise only held
for the default and actions paths. Wire explicit tools/toolsets plus
project-local auto-discovery into the --agent path, unioned with the
frontmatter tools: list (dedup by callable identity), still gated by
PRAISONAI_ALLOW_LOCAL_TOOLS.
Co-authored-by: Mervin Praison <[email protected]>
Adds a protocol-first messaging module giving agents a first-class
sender->named-recipient channel that the bus (type-filtered, no target),
kanban comments (task-scoped, pull-based board) and handoff (sync
parent->child) all lack.
- messaging/protocols.py: AgentMessage + AgentMailboxProtocol
- messaging/inprocess.py: light in-process default impl (InProcessMailbox)
- messaging/__init__.py: lazy exports (zero overhead unless used)
Scoped minimal per AGENTS.md: core protocol + in-process default only.
No Agent param, no agent.py changes, no heavy deps. The wrapper can add
a Redis-backed impl of the same protocol for cross-host fleets.
Co-authored-by: Mervin Praison <[email protected]>
Adds the core primitive for per-step workspace checkpoints by encoding a
step index into the shadow-git commit message (zero extra storage):
- CheckpointService.save(..., step=N) tags a per-step checkpoint
- CheckpointService.restore(step=N) + get_checkpoint_by_step() rewind to a step
- Checkpoint.step field surfaced in list/to_dict
- CLI: `praisonai checkpoint restore --step N`
Backward-compatible and opt-in; no new Agent params or config modules.
Co-authored-by: Mervin Praison <[email protected]>
Add WorkspaceIsolationProtocol with NoIsolationAdapter (default,
zero-overhead) and GitWorktreeAdapter (real git worktree per run via
lazy stdlib subprocess) so concurrent agents can edit the same repo
without clobbering each other. Degrades gracefully when cwd is not a
git repo. Lazily exposed from praisonaiagents.workspace.
Co-authored-by: Mervin Praison <[email protected]>
- Remove unreachable StepResult lazy branch in workflows/__init__.py
(StepResult is bound at module top and in __all__, so __getattr__ never
fires for it; the branch also returned a different results.py class,
masking a latent class-identity mismatch)
- Remove orphaned structured_execution.py and its lazy branch
(StructuredWorkflowExecutor/execute_step_structured had zero consumers)
Live branches (StepError, WorkflowResult, StepStatus, ErrorStrategy),
results.py, and the memory/workflows shim are untouched.
Co-authored-by: MervinPraison <[email protected]>
Standalone `pip install praisonai-mcp` (without praisonai-code) previously
crashed config subcommands (list/add/remove/test/sync/run/auth/logout/…) and
bare `praisonai-mcp` (callback→list) with an uncaught ImportError and empty
output. Add a lazy `_require_code()` guard that exits cleanly (code 1) with an
actionable install hint. Host commands (serve/list-tools/doctor) are unaffected
and still route directly to the server without needing praisonai-code.
Co-authored-by: Mervin Praison <[email protected]>
- Fix ModuleNotFoundError: praisonai_mcp.cli.output — route
get_output_controller through the lazy praisonai_code bridge in
_configuration.py (resolves CI test_mcp_list, test_cli_shim_app_identity,
and test_get_command_resolves_mcp which failed because the command import
raised before resolution).
- Scope logging/setLevel to the actual running package logger tree derived
from __name__ (praisonai_mcp.mcp_server) instead of the legacy
praisonai.mcp_server shim namespace.
- Guarantee subprocess cleanup on TimeoutExpired (test) and KeyboardInterrupt
(stdio serve); always shut down MCP instances in sync/SSE via try/finally.
- Always clear temporary OAuth state/code verifier via finally.
- Remove redundant/broken assignment and unused var in check_c12_mcp_imports.sh.
Co-authored-by: Mervin Praison <[email protected]>
Route get_available_tools() through the canonical ToolResolver (single
source of truth) and demote the frozen AVAILABLE_TOOLS list to a
last-resort fallback, so all three auto-generators advertise the
actually-installed tools instead of the drifting legacy CrewAI list.
Move the resolver helpers to BaseAutoGenerator and use the shared
context-local _get_default_resolver() so the auto phase and
AgentsGenerator reuse one warm cache per run instead of repeating full
tool discovery. AgentsGenerator now accepts an optional tool_resolver
for DI.
Co-authored-by: MervinPraison <[email protected]>
Remove dead-code Chainlit-era UI modules with zero importers anywhere in
the codebase:
- ui/callbacks.py (CallbackManager)
- ui/components/aicoder.py (AICoder)
Neither module is imported, re-exported, or in any __all__. The live
`praisonai ui` loader resolves bundled presets from ui_*/default_app.py,
which are unaffected.
Co-authored-by: MervinPraison <[email protected]>
Default publish_all.py to git-diff based selection: only bump and ship
packages with changes since the last v* tag, plus the wrapper when any
tier-2 or agents package publishes so pins stay current. Use --all for
the previous seven-package coordinated release.
Move the heavy MCP server host out of the wrapper into praisonai-mcp with
backward-compat shims, _MCP_RESIDENT_COMMANDS routing, CI/publish wiring,
and regression gates so pip install praisonai keeps working.
Restrict labeled-event bypass to praisonai-triage-agent[bot] only (P1).
Require actionable title prefix for external bug/enhancement auto-trigger (P2).
- browser CLI: point relocated engine/utility imports at praisonai_browser.*
package root (were resolving to nonexistent cli.commands.* submodules)
- cdp_agent/playwright_agent: implement advertised clear_input action
- agent.process_observation: return the round-tripped dict so executors
always receive a normalized value field (populated from text)
- _protocol_bridge: pass extra actions through as strings instead of
re-raising on BrowserActionType()
- tests: fix REPO parents[] index in C11 compliance/backward-compat suites
Co-authored-by: Mervin Praison <[email protected]>
Move extension bridge, CDP, and Playwright automation out of the wrapper with backward-compat shims, protocol bridge to agents-tier browser types, and full CI/release wiring.
Addresses Greptile P1 review feedback on #3052:
- Only set early_stopped when iterations remain (iteration_num < self.iterations),
so reaching 9.5 on the last iteration is reported as a full run.
- Gate "Requested Iterations" summary row on the early_stopped flag instead of a
cross-scope count comparison (unreliable with multiple scenarios).
- Add regression test for 9.5-on-final-iteration.
Co-authored-by: Mervin Praison <[email protected]>
- Clarify --iterations is a maximum in CLI help, README and docstrings
- Add --no-early-stop / no_early_stop to force all iterations
- Log one INFO line on early stop (visible even in --quiet)
- Show Requested/Completed and Stopped Early in summary when truncated
- Track early_stopped in report metadata
- Add unit tests for early-stop behavior
Co-authored-by: Mervin Praison <[email protected]>
Greptile P1: --storage-backend file --storage-path <dir> was silently
ignored by list/show/apply (read default ~/.praison/train instead), so
sessions written to a custom file directory were invisible.
- _resolve_backend now returns a FileBackend for file+custom path
- list scans the custom dir via list_training_sessions(storage_dir=...)
- adds TestCustomFileBackedSessions regression coverage
Co-authored-by: Mervin Praison <[email protected]>
SQLite-backed training sessions were invisible to list/show/apply because
those commands scanned ~/.praison/train/*.json and gated on JSON file
existence, ignoring the backend used during training.
- Add backend-aware TrainingStorage.exists() (delegates to _store.exists())
- Add list_sessions_from_backend() to enumerate sessions from a backend
- Add --storage-backend/--storage-path flags to list/show/apply
- Thread backend through get_training_profile for apply
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1s on ScheduleLoop:
- start() now checks is_running before mutating _store/_runner/_on_due so
calling it on a live loop is a true no-op (no callback/store swap mid-tick).
- fire_due() runs its claim+fire under a per-instance lock so overlapping
external calls / the loop thread cannot double-fire a due job on stores
using the non-atomic get_due_jobs fallback.
Co-authored-by: Mervin Praison <[email protected]>
Make the scheduler *firing* mechanism as pluggable as the *store* already is.
Adds SchedulerProviderProtocol (the "when to fire" contract) beside
ScheduleStoreProtocol in core, with the existing ScheduleLoop as the default
implementation (aliased InProcessScheduleProvider). ScheduleLoop now exposes
fire_due() (one tick's claim+fire, callable without an always-on thread) and a
start(on_due=..., store=...) signature satisfying the protocol, enabling
event-driven/serverless/external firing while staying fully backward-compatible.
Protocol-only, no heavy deps, no new Agent params; heavy providers
(APScheduler/webhook) remain out of scope for the wrapper.
Co-authored-by: Mervin Praison <[email protected]>
The async chat path calls execute_tool_async, which bypassed
_execute_tool_with_context and never populated _turn_tools_used. This
left the async self-improve review seeing an empty tool list. Record the
tool name in execute_tool_async using the same guarded pattern as the
sync path, and add async tracking tests.
Co-authored-by: Mervin Praison <[email protected]>
Narrow the UnicodeEncodeError=success handler so it only wraps the
post-run summary display, not trainer.run() itself. A verbose mid-run
encoding error (before save_report) is now a real failure, while a
display-only error after persistence downgrades to a warning. Guards
the verbose post-save print_summary() in the orchestrator too.
Addresses Greptile P1 on PR #3055.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on PR #3053:
- Greptile P1: uv.lock omitted litellm from praisonai-train's dependencies
and requires-dist even though pyproject.toml declared it, so frozen
installs could reject the stale lock or omit litellm. Added litellm to
both sections.
- Greptile P2: the `train llm` bridge caught every ImportError and printed
the praisonai-train[llm] hint, masking nested failures from installed
transitive deps. Now only shows the install hint when praisonai_code is
truly absent (code_available()); otherwise surfaces the real cause.
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile P1: a create staged (propose=True) in project A then
approved from a different cwd re-resolved _skills_base_dir(), writing the
skill into the approver's directory (or user home) instead of project A.
Now the resolved destination is captured at staging time and honoured by
create_skill via an internal base_dir override.
Co-authored-by: Mervin Praison <[email protected]>
Track per-turn tool names in a _turn_tools_used buffer and default the
after-agent hook's tools_used from it when chat paths omit the argument.
Without this the DefaultSkillReviewPolicy always saw an empty list and the
self-improve review never fired.
- agent.py: initialize _turn_tools_used buffer
- chat_mixin.py: reset buffer at start of each _chat_impl/_achat_impl turn;
fix verbose display NameError (undefined `tools` -> self.tools)
- tool_execution.py: record tool name in _execute_tool_with_context (skipped
during guarded review turns); default hook tools_used from buffer in sync
and async after-agent hooks and consume it
Co-authored-by: Mervin Praison <[email protected]>
Training could complete and persist a session, then crash while printing
the Rich summary because the Status row contained emoji that cp1252 stdout
cannot encode. The broad except handler mislabeled this display error as
"Training failed" with exit 1.
- Add console_supports_unicode() probe in models.py
- Use ASCII labels for Status/markers when stdout is not UTF-8
- Fall back to ASCII summary on UnicodeEncodeError in print_summary
- Split CLI handler so encoding failures report success (exit 0)
- Guard show/orchestrator emoji markers behind the same probe
- Add cp1252 encoding unit tests
Co-authored-by: Mervin Praison <[email protected]>
- SkillManager._skills_base_dir() now prefers project ./.praisonai/skills/
when it exists, so skill writes land where discovery reads and users look;
falls back to user home (~/.praisonai/skills/) otherwise.
- Keep the pending-mutation store in user home regardless of cwd so proposals
remain discoverable for approval.
- Log an INFO line with the SKILL.md path when a skill is created directly,
complementing the existing "staged for approval" pending log.
Co-authored-by: Mervin Praison <[email protected]>
Issue A: praisonai-train requires litellm at runtime for agent training
(LLM-as-judge grading), but it was not declared in pyproject.toml. Add
litellm>=1.0 to core dependencies so a clean `pip install praisonai-train`
resolves all runtime imports for live grading.
Issue B: `praisonai-train llm` printed a wrong install hint when ML/code
deps were missing. Catch the bridge ImportError and surface the correct
`pip install "praisonai-train[llm]"` remediation.
Co-authored-by: Mervin Praison <[email protected]>
External bug/enhancement reports never received the claude label, and
bot-applied claude labels were blocked by the actor filter—so claude-response
never ran after issue-triage.
- server.py: consume the cancellation marker once it is honoured (both the
active-task and pre-registration paths) so a later request reusing the same
JSON-RPC id is not spuriously cancelled by a stale entry.
- server.py: make in-flight registration cleanup identity-safe so a concurrent
client reusing an id cannot have its task evicted by another's finally block.
- server.py: scope logging/setLevel to the `praisonai.mcp_server` package logger
(parent of the loggers this module actually emits through) so the change takes
effect, while still never touching the process root.
- agents_generator.py: key the timeout-wrapper marker by owning executor_factory
identity and retain the original callable, so a shared framework-tool object is
idempotent within a generator but correctly re-wrapped (not stacked) when a
different generator takes ownership — avoiding a retained, possibly-closed
executor and wrong timeout.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1 — MCP notifications/cancelled was a dead path: _active_requests was
never populated so task.cancel() was unreachable, and set.pop() evicted an
arbitrary id on overflow. Register id-bearing requests as tasks and use an
OrderedDict for FIFO overflow eviction.
Gap 2 — _wrap_with_timeout mutated shared framework tool objects with no
idempotency marker, stacking wrappers on every generate_crew_and_kickoff()
and capturing foreign generators' executors. Stamp a marker so a callable /
tool method is never wrapped twice.
Gap 3 — logging/setLevel mutated the process-wide root logger and bypassed
scope enforcement. Scope it to the server's namespaced logger, validate the
level, and add an OPERATION_SCOPES entry requiring the admin scope.
Co-authored-by: Mervin Praison <[email protected]>
- Pin checkout to main (ref: main) so workflow_dispatch cannot publish
a non-main branch to production
- persist-credentials: false (no git creds retained in workspace)
- Replace TOFU ssh-keyscan with pinned known_hosts from
MIGRATION_TARGET_KNOWN_HOSTS secret + StrictHostKeyChecking=yes
- Add trap to remove SSH private key on exit
- Add BatchMode + ConnectTimeout to fail fast on unreachable host
- Upload to temp files then atomic mv into place to avoid serving
truncated or mixed-commit installers
Co-authored-by: Mervin Praison <[email protected]>
Ignore pipeline status comments that mention @claude as text, and restrict
bot-triggered runs to intentional FINAL, merge-conflict, and CI-fix phrases.
Addresses reviewer feedback on PR #3034:
- Gemini: claudeFinalReady got stuck awaiting Copilot when a required
reviewer timed out. Now short-circuits Copilot when prior.requiredTimeout.
- Gemini: maybeTriggerClaudeFinal now spreads all options into claudeFinalReady
so requiredWaitMs/skipCopilot are honored. It already injects prCreatedAt from
the fetched PR, so the fallback workflow caller activates the 30m timeout
without passing prCreatedAt (Greptile concern).
- Update self-tests to assert auto-skip without explicit skipCopilot.
Co-authored-by: Mervin Praison <[email protected]>
HTTPStreamMCPClient rewrote bare-host URLs by appending '/mcp', causing a
POST to a non-existent endpoint (HTTP 404) that the official SDK surfaces as
McpError "Session terminated" during initialize(). Use the server URL exactly
as provided, matching the official streamablehttp_client behaviour.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Prevent leaking the httpx/anyio connection or a half-open remote MCP
session when ClientSession entry or session.initialize() fails mid-handshake,
and best-effort schedule async teardown from _force_cleanup().
Co-authored-by: Mervin Praison <[email protected]>
The HTTP-Stream client passed a hand-rolled async generator and a plain
function to the official ClientSession, which expects anyio memory-object
streams. This broke session.initialize() with
"'function' object has no attribute 'send'" before any request reached the
wire. Wire HTTPStreamMCPClient to the official SDK's streamablehttp_client
(mirroring the working SSE client), relax the obsolete aiohttp requirement
(the SDK is httpx-based), and update cleanup accordingly.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
The Windows install.ps1 installed only praisonaiagents, but the onboarding step runs 'python -m praisonai setup', which failed with 'No module named praisonai'. Bring install.ps1 to parity with install.sh by installing praisonai[all] by default.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Move key lowercasing and length-descending sort to module scope so
exact mixed-case matches resolve on the fast path and per-call sorting
is eliminated. Behavior unchanged.
Co-authored-by: Mervin Praison <[email protected]>
voyage-3 (1024) is a substring of voyage-3-lite (512); sort keys by length
descending so more specific keys win. Adds test coverage.
Co-authored-by: Mervin Praison <[email protected]>
resolve_batch() had zero callers anywhere in the package, tests, or
public API, and re-implemented resolve()'s parameter-precedence ladder,
risking silent drift. Removed the ~110-line dead helper; resolve()
remains the single source of truth.
Co-authored-by: MervinPraison <[email protected]>
Extract _reset_loop_warnings() and _consume_self_correction() to remove
~40 lines of verbatim copy-paste across run_autonomous/run_autonomous_async,
eliminating sync/async drift risk and trimming agent.py per AGENTS.md.
Co-authored-by: Mervin Praison <[email protected]>
Factor the ~40 byte-identical lines shared by _trigger_after_agent_hook
(sync) and _atrigger_after_agent_hook (async) into two loop-agnostic
helpers: _build_after_agent_input (AfterAgentInput construction) and
_after_agent_side_effects (auto-memory, auto-learning, periodic nudge).
The async boundary is untouched: hook dispatch (execute_sync vs
await execute) and skill-review (run_review vs await arun_review) remain
in their respective public methods. No behaviour or async-safety change.
Co-authored-by: MervinPraison <[email protected]>
Adds explicit "lightweight & powerful, no scope creep for the sake of it"
guidance plus "critical review at each stage" to AGENTS.md (root +
praisonai-agents) and the Claude review/merge-gate/merge-conflict prompt
workflows, so issue triage, fix planning, and PR review all reject
duplicate/dead-knob scope creep and prefer existing Agent capabilities.
Co-authored-by: Leebana <[email protected]>
Cap only the non-system tail so an existing compaction summary (stored
as a system message) is never dropped when trimming oversized history
before compaction. Removes the now-redundant post-compactor safety valve.
Co-authored-by: Mervin Praison <[email protected]>
Apply the max_history hard cap before token counting and summarisation so
large short-message batches do not hang offline hosts when tiktoken attempts
a first-use network download during compaction.
- Route critical loop-block through shared blocked_result path so
trace spans, stream events, AFTER_TOOL hooks, doom-loop and
loop-guard teardown still run (CodeRabbit: dangling tool_call_start).
- Reset _pending_self_correction / _loop_warned_this_turn at the start
of run_autonomous(_async) so stale nudges never leak across calls.
- Tighten _response_indicates_failure: drop broad "i am/was unable to"
markers that flagged partial-success responses (Greptile P2).
Co-authored-by: Mervin Praison <[email protected]>
Address remaining reviewer findings on the AutoGenerator registry path:
- Reject built-in provider prefixes before consulting the registry, reusing
the same _BUILTIN_MODEL_PREFIXES set as PraisonAIModel so both hot paths
agree on which providers are 'registered' (CodeRabbit).
- Preserve provider-specific config fields (aws_region, timeout, model_kwargs,
...) when constructing a registered provider, only dropping empty credential
entries so the provider's own credential chain is not shadowed (Greptile P1).
- Add 2 regression tests covering the built-in-prefix guard and config
preservation.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- auto.py: forward config_list[0] api_key/base_url into create_llm_provider
so registered providers authenticate for generate_structured (Greptile P1).
- models.py: omit None api_key/empty base_url from provider config so a
provider's own credential chain is not shadowed (Greptile P2).
- models.py: surface a registered provider's construction failure instead of
silently falling into the uncredentialed built-in OpenAI ladder (Greptile P1).
- tests: add coverage for construction-failure surfacing and no-None-key config.
Co-authored-by: Mervin Praison <[email protected]>
PraisonAIModel and AutoGenerator now consult praisonai.llm.registry for
user-registered providers before their built-in resolution ladders, so
register_llm_provider("bedrock", ...) takes effect through both hot paths.
Built-in prefixes and unregistered providers keep their existing behaviour;
registry lookups fail closed and never raise.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer findings on PR #2990:
- P2: falsy/unknown self_improve strings ("false"/"off"/typos) no longer
silently enable inline review; unknown values disable + warn.
- P1: background review now uses a unique per-invocation job id so a later
review never replaces an earlier queued one in the job-manager map.
- P1: guarded review runs under a per-agent lock so a background review
cannot interleave chat_history/re-entrancy state with a concurrent turn.
Co-authored-by: Mervin Praison <[email protected]>
Add a "background" execution mode for self_improve so the guarded skill-review
LLM turn runs on the core BackgroundJobManager after the reply is returned,
instead of blocking the user-visible turn. Default remains inline/blocking for
backward compatibility. Preserves re-entrancy, chat-history isolation and
best-effort failure swallowing.
Co-authored-by: MervinPraison <[email protected]>
The canonical schema treats agents/token as optional; routing the runtime
loader solely through it dropped three gateway-runtime guarantees the
integration tests assert. Re-assert 'agents'/'channels' required sections and
per-channel 'token' (except email/agentmail/whatsapp-web) on the
pre-substitution config so a wholly-missing token fails closed while a ${VAR}
that resolves to empty is left for start_channels() to skip. Platform/typo
fail-closed remains delegated to the canonical validator.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two review findings on the canonical-validator routing:
- P1: merge validator-populated channel fields (resolved platform,
plugin descriptor env fallbacks/required fields, canonical defaults)
back into existing `channels:` dicts, not just when absent, so
adapters start with fully-resolved settings.
- P2: resolve `${VAR}` env substitution before validation so an unset
token for a currently-unused channel stays an empty string that
start_channels() skips, instead of tripping the schema token
validator and aborting the whole gateway. Platform-typo fail-closed
still applies.
Co-authored-by: Mervin Praison <[email protected]>
The gateway runtime loader (WebSocketGateway.load_gateway_config) hand-rolled
a second config validator with a hardcoded platform allowlist that only
warned on unknown platforms and started anyway — a fail-open hole where a
typo'd channel platform passed validation, the gateway reported healthy, but
the channel silently never ran.
Route the runtime loader through the existing canonical validator
(migrate_legacy_config + validate_gateway_config), which:
- fails closed (ValueError -> exit 78) on unknown/typo'd platforms
- is registry-aware (accepts built-in, entry-point, and register_platform()
channels), fixing the spurious "not a known platform" warning for linear
- migrates legacy single-bot / BotOS config shapes on the runtime path too
The raw dict is preserved (all top-level keys the runtime reads survive) and
env-var substitution is still owned by the loader.
Co-authored-by: MervinPraison <[email protected]>
ConsoleBackend now uses rich Prompt.ask (once/session/always/no) instead
of Confirm.ask. The approval-integration tests patched Confirm.ask to
auto-approve the require_approval decorator path; the mock no longer
intercepted, so the prompt read stdin under pytest and denied the tool.
Patch Prompt.ask -> "o" (once/approve) to match the intentional change.
Co-authored-by: Mervin Praison <[email protected]>
- auth list/status: always surface active env-var keys even when a stored
key exists, labelled as overriding the stored one, so the live credential
is never hidden (Greptile P1 #1, #2)
- setup: derive default model from the catalogue for catalogue providers so
non-interactive setup (e.g. --provider groq) no longer fails (P1 #3)
- setup: use the same authoritative env-var name as auth for divergent
providers (perplexity -> PERPLEXITYAI_API_KEY) (P1 #4)
- tests: cover perplexity env-var parity and catalogue default model
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer (Greptile) security findings on scoped approvals:
- utils.py: add src key so move_file/copy_file grants pin to the concrete
source path instead of a tool-wide tool:move_file rule; remove apply_patch
from the path-prefix map (it takes multi-file patch text, not a single
path) so it stays tool:apply_patch rather than a misleading edit:<...>.
- registry.py: keep "this session" grants in-memory only (new
_session_scoped_targets store) so they never persist to approvals.json and
outlive the run; only "always" grants bridge to PermissionManager.
- registry.py: skip durable persistence for "always" when agent_name is None
(a nameless grant would match any agent); degrade to in-memory session
scope for the run instead.
- Session grants are cleared by clear_approved and wired into both sync/async
approval fast-paths.
- Tests updated/added for move/copy src mapping, apply_patch tool-scoping,
session non-persistence, nameless-always skip, and clearing.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The published JSON schema and the praisonai-code CLI resolver place model
settings under a top-level `agent` section (e.g. `agent.small_model`), while
the praisonaiagents loader uses `defaults.*`. Since both read the same
`.praisonai/config.yaml`, a user following schema autocomplete set
`agent.small_model` that title generation silently ignored (greptile finding).
get_small_model() now also reads `agent.small_model` / `agent.model` from the
raw config, closing the schema-path gap. Fully additive and backward
compatible; `defaults.*` still takes precedence.
Co-authored-by: Mervin Praison <[email protected]>
Add a declarative auxiliary/"small" model default so internal LLM calls
(session-title generation, and future summarisation/compaction paths) can
target a cheap/fast/local model independent of the primary model.
- config/loader.py: add `small_model` to DefaultsConfig, validation keys,
dict round-tripping, and a `get_small_model()` resolver
(small_model -> primary_model -> config model -> fallback).
- session/title.py: resolve the auxiliary model via `get_small_model`,
falling back to the primary model then the historical `gpt-4o-mini`
default so existing behaviour is preserved when nothing is configured.
- praisonai config.schema.json: document `agent.small_model`.
- Tests for resolution order and backward compatibility.
Co-authored-by: MervinPraison <[email protected]>
Adds a scope field to ApprovalDecision, a once/session/always/no choice to
ConsoleBackend, and bridges session/always decisions into PermissionManager
so grants persist and future matching calls short-circuit without re-asking.
Default remains "once" — non-interactive/auto-approve paths are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Addresses greptile P1 review findings on tool_execution.py:
- BYPASS now skips the PermissionManager deny gate (via _is_bypass_mode)
so it truly bypasses permission checks as documented.
- DONT_ASK and PLAN now consult a shared _tool_would_prompt() that mirrors
the needs_approval criteria (dangerous, external trust_level,
registry-required, explicit ask rule), so external/registry-required
tools are auto-denied under DONT_ASK and denied under PLAN instead of
falling through to a prompt/hang.
Co-authored-by: Mervin Praison <[email protected]>
Three safety/reliability controls that previously silently no-op'd:
1. MCP SSE (mcp_server.py, mcp_security.py): run_sse now derives the bind
address from SecurityConfig.get_bind_address() when host is unset, so
bind_localhost_only (secure-by-default) actually controls the interface,
and fails fast when require_auth=True but no token is available instead
of serving every request unauthenticated. Adds resolve_sse_security() as
the shared source of truth.
2. Permissions (manager.py, tool_execution.py, agent.py, protocols.py):
_resolve_approval_decision now consults the PermissionManager so explicit
``ask`` rules drive the approval prompt (not just hard ``deny``), and wires
PermissionMode (BYPASS/PLAN/DONT_ASK) into the call-time gate via a new
ApprovalConfig.permission_mode. Adds PermissionManager.resolve_tool_action()
which only reports explicit rule matches so unlisted tools keep prior
behaviour.
3. Compaction (compactor.py): iterative summary baseline is now tracked off
the returned compacted list length rather than len(messages) of the input,
so later passes summarize new turns instead of silently dropping them; and
compact()/compact_async() now set was_skipped_due_to_low_savings=True when
the anti-thrashing streak halts compaction.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Root cause of the CI failure and Greptile P1: praisonai_train.cli.commands.train
imported ..output.console but that module was never moved into the extracted
package, so every agents/list/show/apply command raised ModuleNotFoundError
before doing any work.
- Add self-contained praisonai_train.cli.output.console: delegates to
praisonai-code's OutputController when co-installed (via lazy _code_bridge),
falls back to a minimal rich/typer controller so `pip install praisonai-train`
works standalone. Fixes test_cli_show_displays_iterations.
- pyproject: `[llm]` extra now pulls praisonai-code (the llm command bridges into
the code CLI runner); register `setup-conda-env` entry point advertised by README.
- apply: resolve real agent name for the training profile and reuse the loaded
agent for --run instead of loading the file twice.
- Expand ~ in file/sqlite storage paths; open scenarios/vision configs as utf-8.
- check_c10_train_imports.sh: use POSIX `grep -Ev` for portability.
62 train unit tests pass; standalone agents --dry-run / list / show verified with
the fallback controller (no wrapper/code installed).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Extract LLM fine-tuning (Unsloth) and agent training from the praisonai
wrapper into a new installable package src/praisonai-train (PyPI:
praisonai-train, import: praisonai_train), following the C9 praisonai-bot
playbook.
- Move praisonai/train/{llm,agents,_ollama}, train_vision.py,
upload_vision.py, cli/commands/train.py, and the conda setup scripts
into praisonai_train (git mv, history preserved)
- Wrapper keeps backward-compat shims: alias_package for praisonai.train,
sys.modules shims for the command/vision modules, setup-conda-env
delegate; all old import paths resolve to the same module objects
- praisonai-code routing: new _TRAIN_RESIDENT_COMMANDS + _train_bridge;
train removed from _WRAPPER_RESIDENT_COMMANDS; hidden on standalone
installs without praisonai-train
- Legacy dispatch (praison_ai.py) prefers praisonai_train, falls back to
wrapper shims
- Packaging: wrapper depends on praisonai-train>=0.0.1; extra
train = ["praisonai-train[llm]"] now actually installs the ML stack
- CI: 5-package install order, standalone train smoke, train test shard,
check_c10_train_imports.sh gate
- Release: agents -> code -> bot -> train -> wrapper across
_release_lib.py, bump_and_release.py (--train/--train-pin/--wait-train),
publish_all.py, pypi-release.yml
- Tests: test_c10_train_backward_compat.py (20 tests), unit tests moved
into src/praisonai-train/tests (62 tests, run standalone)
- Docs: PRAISONAI_TRAIN_MANIFEST.md, ARCHITECTURE.md five-package model,
AGENTS.md refresh, beginner-friendly package README
Co-Authored-By: Claude Fable 5 <[email protected]>
Route compaction token counting through a one-time, timeout-bounded probe of
the accurate tiktoken tokeniser. tiktoken downloads its BPE vocab on first use,
which blocks indefinitely on network-isolated CI hosts and caused
test_max_history_hard_cap_in_compaction_mode to hit the 60s pytest-timeout.
The probe runs once in a short-lived daemon thread; if the tokeniser is not
locally available it permanently falls back to the fast character heuristic,
keeping the hot path offline-safe while preserving accuracy where tiktoken is
cached.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on PR #2995:
- Strip in_loop_compaction/clear_threshold_pct/compact_threshold_pct/
keep_recent_tool_results from LiteLLM completion params so local
context-management settings never leak to the provider.
- Wire keep_recent_tool_results from extra_settings into the loop compactor.
- Rebuild the cached loop compactor when the active model changes
(auth/model failover) so budgets and tokenizer model stay aligned.
Co-authored-by: Mervin Praison <[email protected]>
Run two-tier context management continuously inside the tool-calling loops
(sync + async) in llm/llm.py instead of only once before a turn. Between
iterations the loop now clears re-fetchable tool results at a low threshold
and summarises dialogue at a higher one, gated on an accurate token count
derived from the model's real context window via context/budgeter.
- compaction/compactor.py: accurate tokeniser (reuses context/tokens.py) with
heuristic fallback; count tool_calls payloads; new clear_tool_results().
- compaction/config.py: add model + in-loop threshold config fields.
- llm/llm.py: _resolve_context_window + _manage_context_in_loop helpers,
wired into both tool loops; no-op below threshold and when disabled.
Co-authored-by: MervinPraison <[email protected]>
- goal/loop.py: self-contained continuation nudge restating goal + criteria so
history-clearing configs don't lose the task; resume persisted paused runs for
the same goal instead of restarting at turns_used=0; persist terminal state on exit.
- goal/judge.py: replace greedy {.*} regex with brace-depth scanning that respects
string literals, so a valid verdict followed by a note/second object still parses.
- agent/agent.py: fold string `criteria` into GoalCriteria on run_until(goal=) so it
is not silently dropped; document the AutonomyResult return-shape when goal is set.
- tests: add regression coverage for parsing and continuation context.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer P1 findings on the spend kill-switch:
- Baseline cumulative spend at loop start so a reused Agent's prior
chat/run usage no longer counts against a new run's budget cap
(sync + async loops).
- Validate max_budget_usd/max_tokens in AutonomyConfig.__post_init__
(reject non-numeric and negative values) so invalid caps fail fast
instead of raising TypeError mid-loop or instantly exhausting.
- Tests: add invalid-cap validation + Agent-reuse baseline coverage;
update pause-recoverable test for per-run semantics.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Resolves rebase conflict between the negotiated-hello handshake (#2988) and
main's terminal-vs-transient connect-error classification (#2984):
- Extract shared _raise_for_connect_error() used by both the modern
hello_error path and the legacy join fallback, so a non-recoverable
code (revoked token / unpaired device / agent-not-found) stops the
reconnect loop instead of retrying forever, while transient codes
honour the server retry_after floor.
- _coerce_limit() now rejects negative numeric policy limits (returns
None) so a bogus max_payload: -1 does not block every outbound frame.
Co-authored-by: Mervin Praison <[email protected]>
Adds an independent budget kill-switch to run_autonomous / run_autonomous_async:
max_budget_usd and max_tokens caps checked each iteration against the existing
per-run cost/token tracking (Agent._total_cost/_total_tokens_*). On exceed the
run stops cleanly and returns a typed budget_exhausted outcome carrying spend
so far and the partial result; budget_action="pause" marks it recoverable.
Promotes AutonomyResult.completion_reason to a TerminationReason StrEnum
(co-located with AgentRunOutcome), keeping the historical string values stable
and adding budget_exhausted, plus a mapping to the shared RunStatus vocabulary.
Caps default unset = unlimited, so behaviour is unchanged until a cap is set.
Co-authored-by: MervinPraison <[email protected]>
- Enable loop_detection.py by default and invoke it in the tool-execution
path: record_tool_call + detect_tool_loop before execution (critical -> block),
record_tool_outcome after (result-aware, so polling with changing output is
not flagged). Two-tier response: warning queues a one-shot self-correction
nudge, critical hard-stops.
- Stop feeding DoomLoopTracker a hard-coded success=True in run_autonomous /
run_autonomous_async; derive a real per-iteration success signal via
_response_indicates_failure so the consecutive-failure detector can fire.
- Inject the queued self-correction nudge at the top of each autonomous turn.
- Document DoomLoopConfig.similarity_threshold as superseded by the result-aware
detector (kept for backward compatibility).
- Add wiring tests covering polling-not-flagged, identical-output-flagged,
generic-repeat, two-tier self-correction, detector-invoked-in-tool-loop,
backward-compat, and the real failure signal.
Co-authored-by: MervinPraison <[email protected]>
Adds a first-class, independent goal-completion judge that gates the
tool-using autonomous loop against the agent's stated goal, instead of the
keyword/promise heuristics that could declare success prematurely.
- goal/models.py: GoalCriteria (outcome/verification/constraints) + GoalState
(persistent goal/budget/verdict state with JSON round-trip).
- goal/judge.py: judge_goal() — independent, criteria-anchored, JSON-verdict
judge reusing eval.Judge's litellm loader; fails open to "continue".
- goal/loop.py: GoalLoopMixin — the per-iteration judge gate, continuation
nudge, budget-exhaust recoverable pause, consecutive-parse-failure auto-pause,
session persistence, and run_goal()/run_goal_async() public API.
- agent.py: gate run_autonomous (+ async) on the judge before the existing
heuristics (no-op/unchanged when no goal set); extend run_until(goal=,
goal_criteria=) to delegate to the tool-using goal loop.
Default-off: when no goal is set the autonomous loop is byte-for-byte
unchanged. Heavy logic lives outside agent.py to keep it lean.
Co-authored-by: MervinPraison <[email protected]>
Addresses two P1 findings from Greptile review on the run-state journal:
- open_run: on ON CONFLICT reopen, COALESCE the supplied checkpoint_id so a
run that crashed before set_checkpoint can resume from a caller-supplied
checkpoint; a None reopen preserves the existing binding.
- assert_replay_order: compare full (seq, kind) sequence (not bare kinds) so a
replay with the same shape at wrong seq positions fails loud, matching the
(seq, kind)-keyed replay_index lookup. Backward compatible with kind-only
input.
Adds 3 tests covering both fixes.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- honour max_payload==0 as a real bound instead of skipping the guard
- coerce string/float policy limits via _coerce_limit to avoid TypeError on send
- apply same coercion to heartbeat_ms accessor
Co-authored-by: Mervin Praison <[email protected]>
The bundled Python gateway client now sends the capability-aware `hello`
frame, reads the server-advertised `features`/`policy` from `hello_ok`,
and self-configures: exposes the negotiated method/event manifest,
drives heartbeat from `heartbeat_ms`, and guards outbound frames against
`max_payload` locally (raising `PayloadTooLarge`). The legacy `join`
path is retained purely as a compatibility fallback for older gateways
that reply with a bare `joined` or reject the hello frame.
Co-authored-by: MervinPraison <[email protected]>
Adds praisonaiagents/runtime/journal.py, a tiny append-only SQLite journal
keyed by run_id that records the execution cursor of a run — model decisions,
tool calls/results, iteration index, approval decisions. On resume the loop is
re-driven from the top and journalled steps return recorded results via a
memoised replay index (no re-execution of side-effecting tools, no re-billing
of LLM calls); real work restarts at the first un-journalled step.
- Reuses the stdlib sqlite3 persistence pattern from runs/sqlite_ledger.py and
session/store.py (WAL, busy_timeout, lock-guarded shared connection).
- Binds the files store via checkpoint_id and exposes interrupted_runs() so a
gateway can resume runs left 'running' after a crash — the prerequisite for
durable pause-for-approval HITL.
- Determinism guardrail: assert_replay_order() fails loud on divergence.
- Default-off / zero-overhead: lazy-imported from runtime; inert until a run
opts in (no writes unless open_run/append are called).
Co-authored-by: MervinPraison <[email protected]>
_drain_steering_messages previously returned only raw content, so an
in-flight INTERRUPT/URGENT steer was injected as plain [steering]
guidance, silently downgrading a mid-run interrupt (Greptile P1).
Extract priority-aware formatting into a shared _format_steering_note
helper used by both _check_steering_messages (pre-turn) and
_drain_steering_messages (mid-run), so INTERRUPT/URGENT priority is
preserved on every injection path. Add a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on prompt-cache marking:
- Deep-copy the boundary message before marking so caller-owned chat
history is not rewritten to Anthropic form (prevents OpenAI/Gemini
reuse from carrying invalid cache_control metadata).
- Count pre-existing cache_control markers before adding a new one so
the provider 4-breakpoint budget is never exceeded.
- Fix _mark_message_cache_control return contract: return False for an
already-marked list block (no new breakpoint applied).
Co-authored-by: Mervin Praison <[email protected]>
Wire cooperative cancellation and mid-run steering into the tool-calling
loops themselves rather than only at turn boundaries.
- Add a second cancel check immediately before dispatching tool calls in
both LiteLLM (llm.py) and OpenAI-native (openai_client.py) loops, sync
and async, so a /stop mid-iteration skips running tools.
- Drain pending steering messages at the top of every loop iteration and
inject them as user messages before the next model call.
- Add SteeringMixin._drain_steering_messages() returning all pending notes.
- Thread a bound steering_drain callable from chat_mixin into get_response
and get_response_async alongside the existing cancel_token.
- Add unit tests covering interrupt-between-iterations, interrupt-before-
tool-dispatch, mid-run steering injection, and no-op when unconfigured.
Co-authored-by: MervinPraison <[email protected]>
Extend Anthropic prompt caching beyond the single system block: add a
cache breakpoint on the stable conversation-history prefix while leaving
the most recent turns (volatile tail) uncached. Refactor the inline
system-block marker into reusable helpers and enforce the provider
4-breakpoint budget. OpenAI/Gemini rely on automatic prefix caching, so
no explicit markers are emitted.
Co-authored-by: MervinPraison <[email protected]>
- Add AGENT_NOT_FOUND to the non-recoverable connect codes: the gateway
emits it with a DO_NOT_RETRY recovery step, so the client must pause the
reconnect loop instead of backing off forever (greptile P1).
- Clear self._retry_after in connect() so a backoff floor left over from a
prior connection loop cannot pin an unrelated reconnect attempt (greptile P2).
- Update classifier docstring and tests accordingly; add coverage for the
terminal AGENT_NOT_FOUND path and stale-floor clearing.
Co-authored-by: Mervin Praison <[email protected]>
- resources.py: prompt messages with image/audio/blob/embedded content now
reuse the resource content normaliser (size/mime summaries) instead of
emitting raw object reprs; _normalize_content_item now handles `data`
(image/audio) and nested embedded resources.
- mcp.py: _generate_resource_tools now skips creating a synthetic helper when
a server tool already owns that name, keeping the callable and its OpenAI
schema consistent (no orphaned schema the LLM cannot invoke).
- tests: add coverage for binary/embedded prompt normalisation and server
tool name collision precedence.
Co-authored-by: Mervin Praison <[email protected]>
User-global tools (~/.praisonai/tools/*.py, source="user") live outside
the project CWD, so the safe loader's CWD boundary silently dropped them.
Opt those explicitly user-owned paths out of the boundary (mirroring an
explicit --tools path); project-local tools keep the default CWD check.
Co-authored-by: Mervin Praison <[email protected]>
The reconnecting gateway client classified connect failures by exception
type alone, so AUTH_UNAUTHORIZED / pairing / config rejections fell into a
generic except-branch and reconnected forever. It also discarded the
server's structured next_step and retry_after guidance.
- core: add is_recoverable(code) classifier beside ConnectErrorCode so the
client and any alternative client share one terminal/transient taxonomy.
- client: parse structured hello_error frames (code/next_step/retry_after);
raise GatewayConnectError and pause the reconnect loop (via a new
on_reconnect_paused callback) on non-recoverable failures; honour
retry_after as a backoff floor without shortcutting the exponential
sequence for transient failures.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Addresses Greptile P2 review on PR #2982. Default Knowledge() no longer
emits a misleading "retrieval quality may be reduced" warning when falling
back from the implicit default provider (e.g. chroma/mem0 not installed).
The loud logger.warning now fires only when the user explicitly configured
a vector-store provider that degrades; implicit-default fallbacks are logged
at verbose/debug level as before.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on PR #2981:
- Pin the no-workspace fallback base at construction (cwd captured then, or
explicit root) so a later os.chdir cannot drift the containment boundary of
a long-lived instance or the module-level default helpers.
- Remove the naive '..' substring rejection so legitimate in-workspace names
like 'v1..2.md' are accepted; containment is enforced solely via
realpath + commonpath.
- Add regression tests for cwd-stable boundary and valid '..' filenames.
Co-authored-by: Mervin Praison <[email protected]>
store_long_term_async delegated through self.store_long_term, which for
Memory instances resolves to the overriding weighted-metrics signature
(completeness/relevance/...). Positional quality_score/user_id bound to the
wrong params, silently corrupting quality metadata and dropping user_id.
Call MemoryCoreMixin.store_long_term(self, ...) explicitly to always use the
mixin's own (content, metadata, quality_score, user_id) signature.
Co-authored-by: Mervin Praison <[email protected]>
Extend the .praisonai/ filesystem-discovery convention to a tools/ directory
so `praisonai run` picks up project-local Python tools with the same
zero-config ergonomics as agents/ and commands/.
- CustomDefinitionsDiscovery now scans .praisonai/tools/*.py (user-global +
project walk-up), namespacing callables as <module>.<func> and preferring
@tool-decorated functions. Loading stays gated by PRAISONAI_ALLOW_LOCAL_TOOLS
via the shared safe loader.
- run.py (actions mode) and the default direct_prompt path auto-merge the
discovered tools; explicit --tools take precedence and --no-tools opts out.
- `praisonai init` scaffolds .praisonai/tools/example.py with a commented
@tool stub so the convention is self-documenting.
Backward compatible: explicit --tools and PRAISONAI_ALLOW_LOCAL_TOOLS behave
as before; projects without .praisonai/tools/ are unaffected.
Co-authored-by: MervinPraison <[email protected]>
MCP client previously exposed only server tools, ignoring resources and
prompts. During connect, the stdio runner now negotiates resource/prompt
capabilities (list_resources / list_resource_templates / list_prompts) and
registers synthetic agent-callable tools (list_mcp_resources,
list_mcp_resource_templates, read_mcp_resource, list_mcp_prompts,
get_mcp_prompt) only for servers that advertise them. Contents are normalised
(text/blob/embedded, prompt messages) with size/mime guards. Fully additive,
capability-gated, filterable, and namespaced via the existing tool-prefix
scheme; tools-only servers are unaffected.
Co-authored-by: MervinPraison <[email protected]>
Restores behavior lost when media.py's regex-based parser was removed in
favor of the shared helper. Fixes two regressions flagged in review:
- Mixed-case labels (Score:/score:) now parse instead of defaulting to 5.0
- Multi-line REASONING text is preserved instead of truncated to first line
Uses re.IGNORECASE + re.DOTALL, matching the original media parser. Fully
backward compatible: existing uppercase single-line responses parse identically,
and score clamping to [1, 10] is retained. Benefits all callers (accuracy,
criteria, comparison, media).
Co-authored-by: Mervin Praison <[email protected]>
The async _atrigger_after_agent_hook still built AfterAgentInput (incl.
os.getcwd()) and called execute unconditionally on every achat() turn.
Mirror the sync AFTER_AGENT / BEFORE_AGENT guards so the work is skipped
when no AFTER_AGENT hook is registered.
Co-authored-by: Mervin Praison <[email protected]>
Mem0Adapter and MongoDBKnowledgeAdapter constructors did not accept the
`verbose` keyword passed by Knowledge.memory via the registry, raising a
TypeError that was swallowed and silently replaced with SQLiteKnowledgeAdapter.
- Add `verbose`/`**kwargs` to both adapter constructors
- Raise the fallback log from debug to warning so silent quality
regressions are visible
- Add regression tests asserting adapters accept `verbose` and the
configured provider is constructed instead of degraded
Co-authored-by: MervinPraison <[email protected]>
The no-workspace fallback in EditTools._validate_path only rejected the
literal '..' substring, so an absolute path like /etc/passwd resolved
straight through, letting read_file/search_files/edit_file reach any file
the host process could access. Mirror file_tools.py's containment: confine
resolution to a base directory (defaulting to cwd, overridable via a new
`root` argument) and reject paths that escape it. Adds regression tests.
Co-authored-by: MervinPraison <[email protected]>
Collapse the three secondary rag/ token-estimation helpers to reuse the
single exported implementation in rag/budget.py:
- summarizer.py and compressor.py now import budget.estimate_tokens
(identical output; both had the +1 heuristic with empty-text guard).
- context.py delegates its private _estimate_tokens to budget while
preserving its historical empty-text behaviour (returns 1, whereas
budget returns 0) to keep output identical.
Public rag.estimate_tokens export unchanged. compaction/ left untouched.
Co-authored-by: MervinPraison <[email protected]>
MemoryCoreMixin's async storage methods (store_short_term_async,
store_long_term_async) internally called self.compute_quality_score(content,
metadata) expecting the mixin's 2-arg content scorer. On a Memory instance this
resolved via the MRO to Memory's unrelated 4-required-arg weighted scorer,
raising TypeError on every call.
Call MemoryCoreMixin.compute_quality_score(self, ...) explicitly at all five
mixin call sites so the mixin always uses its own scorer regardless of subclass
shadowing. Preserves the documented public Memory.compute_quality_score 4-arg API.
Co-authored-by: MervinPraison <[email protected]>
Delete the duplicate _parse_score_response in eval/media.py and call the
canonical parse_score_reasoning from grader.py, matching accuracy/criteria/
comparison evaluators. This adds the missing [1,10] score clamp for
out-of-range model outputs, ensuring consistent grades across evaluators.
Co-authored-by: MervinPraison <[email protected]>
Mirror the tool-level hook pattern: only build BeforeAgentInput/
AfterAgentInput (including os.getcwd() and the tools list comprehension)
when a BEFORE_AGENT/AFTER_AGENT hook is actually registered. The
auto-memory / auto-learning / nudge side-effects in the after-agent path
stay outside the guard and continue to run unconditionally.
Co-authored-by: MervinPraison <[email protected]>
get_dimensions() lowercases the input model name but compared it against the
raw MODEL_DIMENSIONS keys. The only mixed-case key, "all-MiniLM-L6-v2" (384),
therefore matched neither the exact-match nor the substring check and fell
through to the 1536 default. That model is the most common local
sentence-transformers embedder (and the default in knowledge/chunking.py), so
memory.py sized the vector store to 1536 while the model emits 384-dim vectors.
Lowercase the key in the substring comparison. Add a regression test.
Consolidate the wrapper's hand-rolled OpenAI/AsyncOpenAI client lifecycle and
beta.chat.completions.parse fallback onto the core-owned
praisonaiagents.llm.openai_client.OpenAIClient. The LiteLLM-first orchestration,
sync/async bridging, lifecycle (close/aclose, context managers), and 3-way
CLI+YAML+Python surface are preserved; only the duplicated OpenAI leg is removed.
Co-authored-by: MervinPraison <[email protected]>
test_cache_integration.py asserted the old empty-string contract, which
contradicted test_cache_optimization.py. Update it to validate the current
contract: boundary equals CACHE_BOUNDARY when enabled, empty when disabled.
Co-authored-by: Leebana <[email protected]>
Addresses Greptile review feedback on PR #2961:
- P2: skip registering the built-in /automations and /blueprint Telegram
handlers when a custom @bot.on_command handler of the same name already
exists, so these generic names no longer unconditionally shadow user
commands (an improvement over the blanket-shadow behaviour of all builtins).
- P1: document that the underlying SuggestionStore is a single global
single-tenant store with no per-user field (mirrors the CLI); per-user
scoping is a core data-model change, out of scope for this wrapper wiring.
Access remains gated by CommandAccessPolicy, re-checked on every tap.
Co-authored-by: Mervin Praison <[email protected]>
Surfaces the already-built consent-first SuggestionEngine + BlueprintCatalogue
through the conversational gateway. Adds a shared _automations helper module
(list/accept/dismiss/blueprint-materialize) and wires it into the Telegram
adapter with inline Accept/Dismiss buttons via the existing callback-query path.
Nothing is auto-created; MAX_PENDING_CAP and dedup are inherited from the store.
Co-authored-by: MervinPraison <[email protected]>
The executor accepted timeout_ms/cancel_token but the tool-calling loop in
llm.py never forwarded them, leaving the feature as dead code. Read an
optional tool_timeout_ms from extra_settings (no new required param, no Agent
bloat) and forward it at both execute_batch call sites. Defaults to None for
zero regression. Adds a regression test guarding the wiring.
Co-authored-by: Mervin Praison <[email protected]>
Close a migration gap in SqliteSessionStore: a store upgraded from a
prior release has session_meta populated but the new session_route table
empty, so backfill skipped those sessions and get_by_gateway_session
returned None instead of resolving them (Greptile P1). _indexed_ids now
requires a session to be present in both session_meta AND session_route
before treating it as fully indexed, forcing route rows to be backfilled
on first read. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Run each tool via a cancellable boundary that enforces timeout_ms and
returns a typed, discriminated result (timeout/cancelled/error) instead
of hanging the turn or flattening failures to an opaque string.
Co-authored-by: MervinPraison <[email protected]>
Override get_by_gateway_session and list_sessions_by_gateway_agent in
SqliteSessionStore with an indexed session_route table so inbound routing
is an O(1)/O(log n) lookup instead of an O(N) os.listdir + JSON-parse of
every stored session. The route table is populated at write time and
backfilled from existing JSON transcripts; falls back to the parent scan
if the index is unavailable.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 security findings on the managed-config layer:
- SSRF: managed URLs are now validated before fetch. Only http(s) schemes
resolving to a public host are allowed (http restricted to loopback), so a
configured URL can no longer coerce the CLI into hitting localhost, internal
services, cloud metadata (169.254.169.254), or file:// paths. Rejected URLs
fall through to the existing fail-soft cache path.
- Policy enforcement: enforced managed-policy keys (permissions,
model_allowlist) now REPLACE their local counterparts wholesale via
_enforce_policy instead of deep-merging, so local nested sub-keys
(permissions.default/rules) can no longer survive a narrowing org policy.
Adds regression tests for both.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on PR #2954:
- install.sh: fail loudly if uv bootstrap download is empty/failed and verify
uv is on PATH afterwards (no more masked "uv: command not found").
- install.sh (bash): also wire the applicable login profile
(.bash_profile/.bash_login/.profile) so login shells find praisonai.
- install.sh (fish): guard fish_add_path with a POSIX-safe fallback for
older fish versions.
- self_manage/app: schedule a detached, non-blocking background refresh of the
update-check cache on start-up so the "update available" hint is actually
populated (never performs network I/O in the caller, never blocks/raises).
Co-authored-by: Mervin Praison <[email protected]>
The subagent resolver passed a definition's declarative `permissions` block
straight into `Agent(**config)`, which has no `permissions` kwarg, so any
delegated named agent carrying a permission/mode restriction raised TypeError
at construction. Mirror the primary-run path (_run_custom_agent): pop
`permissions` and translate it into an `approval` config so the delegated
agent runs under its intended restrictions.
Co-authored-by: Mervin Praison <[email protected]>
Adds an optional, opt-in managed configuration layer to ConfigResolver so an
organisation can distribute defaults and enforce policy across many machines
from one source of truth (remote URL and/or managed/enterprise directory).
- Managed non-policy defaults sit BELOW local config (teams suggest, not clobber)
- Managed policy keys (permissions, model_allowlist) enforced ABOVE local config
- Remote fetch: short timeout + on-disk cache under ~/.praison/state/, fail-soft
to last-good copy or skips the layer offline (never blocks a run)
- resolve_with_provenance labels managed:/managed-policy: origins and marks
enforced keys non-overridable
- Fully backward-compatible: no managed source => resolution unchanged
Co-authored-by: MervinPraison <[email protected]>
Add a backward-compatible agent_resolver seam to create_subagent_tool so a
running agent can delegate sub-tasks to user-defined .praisonai/agents/*.md
named agents by name, each running under its own model/tools/permissions.
- Core: create_subagent_tool accepts agent_resolver + resolvable_agents; the
resolver runs a named agent when agent_name matches, else falls back to the
existing generic spawn. Description lists the delegatable named agents.
- Wrapper: custom_definitions gains list_delegatable_agents /
build_subagent_resolver (mode: subagent marker or --subagents allow-list) and
_agent_config_from_definition; mode: subagent is treated as a marker, not a
permission mode.
- run.py: adds --subagents and wires the resolver into _run_custom_agent.
Co-authored-by: MervinPraison <[email protected]>
- install.sh (repo root): POSIX installer that provisions an isolated managed
env via uv tool / pipx (auto-detects, bootstraps uv when absent), wires PATH
for bash/zsh/fish idempotently, supports PRAISONAI_VERSION pin and
non-interactive/CI mode. pip install praisonai remains untouched.
- praisonai upgrade: updates the managed install in place using the detected
tool manager; --check reports whether a newer release exists without mutating.
- praisonai uninstall: cleanly removes the managed env/shim (--yes for CI).
- self_manage helper: install detection (uv/pipx/pip) + non-blocking, cached,
time-boxed "update available" hint, opt-out via PRAISONAI_NO_UPDATE_CHECK.
- Registered both commands in app.py:_LAZY_COMMANDS and the Get started help
panel. No changes to praisonaiagents (CLI self-management only).
Co-authored-by: MervinPraison <[email protected]>
1. scoped_telemetry_disable now shadows the per-instance telemetry object
(race-free by construction) and falls back to a locked + reference-counted
class-level patch, eliminating the concurrent CrewAI class-corruption race.
2. _entrypoint.arun resolves the framework and builds config_list off the
event loop via asyncio.to_thread, and both run/arun share one resolver.
3. MCP dispatcher enforces per-method OPERATION_SCOPES: handle_message accepts
granted_scopes, the HTTP transport plumbs APIKeyAuth (with a --keys-file CLI
flag), and insufficient_scope surfaces as 403 with a WWW-Authenticate
challenge. Backward compatible: no auth configured => allow all.
Co-authored-by: Mervin Praison <[email protected]>
Use is_loopback() instead of a 3-string exact match for the client host
so local peers reported as 127.0.0.2, 127.255.255.255 or the expanded
IPv6 0:0:0:0:0:0:0:1 no longer get a spurious 401 on loopback-bound
gateways (Greptile #2945). Adds test coverage for semantic loopback
clients and non-loopback rejection.
Co-authored-by: Mervin Praison <[email protected]>
The now-truthy CACHE_BOUNDARY marker was being appended directly to the
system prompt in chat_mixin when a prompt-caching-capable model is used.
No provider consumes it as structured cache metadata, so this only
polluted the outgoing system prompt with a literal "--- CACHE_BOUNDARY ---"
string. Stop appending the raw sentinel while keeping the constant defined
for future structured-cache use.
Co-authored-by: Mervin Praison <[email protected]>
The deferred `wrap_if_external` import in the non-multimodal tool-result
branch was unguarded, so a partial/broken install where
`praisonaiagents.tools.trust` is unavailable would raise during plain-text
tool execution and abort the agent. Wrap it in try/except to match the
sibling `_fence_external_text` site, falling through with the raw result.
Addresses Greptile P2 review feedback.
Co-authored-by: Mervin Praison <[email protected]>
Deduplicate the context-truncation summariser and effective-worker-count
clamp/log that were copied verbatim between _execute_parallel and
_execute_loop. Both are now single private helpers
(_truncate_context_for_branches, _effective_workers) with byte-for-byte
identical runtime behaviour.
Co-authored-by: MervinPraison <[email protected]>
Move `wrap_if_external` import from module top level in
agent/tool_execution.py to its two lazy call sites, matching the
existing lazy-import pattern already used for `is_external_tool` and
`artifact_tools` in the same file. This prevents `from praisonaiagents
import Agent` from eagerly loading `tools.trust`. No behaviour or API
changes.
Co-authored-by: MervinPraison <[email protected]>
The file-loading path is now consolidated onto
ToolResolver.load_functions_from_module, so ToolResolver is legitimately
instantiated for file paths. Update the smoke test to assert file paths
use load_functions_from_module and never the name-based resolve().
Co-authored-by: Mervin Praison <[email protected]>
The consolidated load_functions_from_module returns empty both when local
tool loading is disabled/missing AND when a valid module has no public
functions. The if-funcs else-branch previously asserted loading disabled
and told users to set PRAISONAI_ALLOW_LOCAL_TOOLS, misdiagnosing a valid
but empty module. Reword the warning across all 4 CLI sites to cover both
causes without falsely blaming the env var (fixes greptile review regression).
Co-authored-by: Mervin Praison <[email protected]>
Route the four hand-rolled load_user_module + inspect.getmembers copies in
the legacy CLI handlers through the canonical
ToolResolver.load_functions_from_module, eliminating silent behaviour drift.
Add optional functions_only / skip_private / module_name arguments to the
canonical method so the CLI's existing "functions-only, exclude underscore"
semantics are preserved through a single owner instead of re-implemented.
Co-authored-by: MervinPraison <[email protected]>
Resolve tool names in the local-managed backend via the canonical
ToolResolver chain (local -> core -> praisonai-tools -> plugins) instead
of an ad-hoc praisonaiagents.tools getattr lookup. Falls back to the
historical getattr behaviour when praisonai-code/ToolResolver is
unavailable, so this is additive and non-breaking.
Co-authored-by: MervinPraison <[email protected]>
- fold thread_id into delivery idempotency key so two threads in the same
chat do not dedup-collapse (router itself does not thread-route)
- wire delivery into async execute_once() one-time path
- forward --deliver into the daemon child command (start + restart) and
persist it in scheduler state; also fix restart dropping recipe_name
- thread deliver= through build_from_recipe / from_recipe and honour a
recipe schedule-config deliver default
- give symbolic origin/all targets a clear, actionable single warning in
the lightweight delivery path
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer (greptile) P1 findings on PR #2933:
- Backfill legacy JSON exactly once via a one-time flag instead of a
COUNT(*)==0 guard, so a new add_message before first search no longer
permanently skips pre-existing transcripts (_ensure_backfilled +
_indexed_ids skip already-indexed sessions).
- Override _modify_session_locked so transcript-replacing paths
(set_chat_history, append_compaction_checkpoint) that bypass
_save_session keep the FTS index in sync — no more stale/missing hits.
- Drop parent_session_id from the lineage dedup key; it is an immediate
parent, not a continuation chain, so sibling sessions forked from one
parent no longer suppress each other.
Adds 3 regression tests. All session_store / session_protocol /
sqlite_store tests pass (pre-existing _session and hierarchy cache
failures are unrelated and fail on baseline).
Co-authored-by: Mervin Praison <[email protected]>
Addresses two Greptile P1 findings on the error classifier:
- HTTP 400 is overloaded by some providers (e.g. OpenAI returns
context_length_exceeded as a 400); refine broad 400s via message
signals so context overflow triggers compression and auth failures
are not retried as invalid requests.
- BudgetExceededError is a billing state, not a temporary rate limit;
map it to PERMANENT so it surfaces immediately instead of burning
retry attempts.
Co-authored-by: Mervin Praison <[email protected]>
The interval AgentScheduler accepted a deliver= token but never sent
anywhere — it only printed the result. Wire the deliver token through the
existing DeliveryTarget / DeliveryRouter machinery (rate limiting,
idempotency dedup, dead-target self-heal) so a scheduled/interval agent
can message a chat target without the full gateway, from Python, YAML and
CLI.
- core: add DeliveryTarget.parse() token parser (no new protocol)
- wrapper: SchedulerDelivery helper builds a lightweight single-channel
router; graceful no-op when praisonai-bot isn't installed
- wire deliver= into AgentScheduler / AsyncAgentScheduler success paths,
from_blueprint, YAML (schedule.deliver / every alias) and CLI (--deliver)
Co-authored-by: MervinPraison <[email protected]>
Addresses parallel-progress attribution (greptile P2): ToolProgress now
carries tool_call_id/function_name, stamped by the executor so a streaming
consumer can attribute concurrent updates to the correct tool call. Also
documents the sync-path cross-loop coroutine behaviour so async tools that
must stay on the caller's loop use the async executor path.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on the durable run ledger:
- recover_orphans() now transitions active runs to LOST via a single
atomic conditional UPDATE (WHERE status IN active) so a concurrently
completed run is never overwritten with LOST.
- SQLite connection opened with busy_timeout + WAL so overlapping gateway
processes wait instead of failing with "database is locked".
- Metadata serialisation falls back to json default=str so a run with
datetime/set/bytes/custom metadata is still durably recorded.
- Unknown persisted status maps to a new non-terminal UNKNOWN sentinel
(neither active nor terminal) instead of terminal LOST, so a status a
newer writer introduced is not wrongly finalised or dropped.
Added tests for each; all 16 run-ledger tests pass.
Co-authored-by: Mervin Praison <[email protected]>
Addresses the three P1/P2 issues raised by Greptile:
1. direct_prompt.py: _run_direct_prompt_via_adapter no longer rebuilds
llm_config with only {"model": ...}, which dropped base_url/api_key/
api_type from self.config_list. It now copies the full first config
entry and only overrides model when --llm is given, so the adapter's
_resolve_llm (which reads base_url/api_key) and the AutoGen config_list
keep custom endpoints and credentials.
2. observability/hooks.py: the process-global trace emitter swap/restore is
now serialised under a process-wide lock and tracks each run's own
installed emitter. Restore only reclaims the global slot when this run is
still the live top; otherwise it re-parents the newer run's prev_emitter
onto this run's prev, so overlapping cross-thread runs and out-of-order
(non-LIFO) finalizes never route traces through the wrong or a closed sink.
Cross-session recall (session_search) previously re-read and lexically scanned
every session JSON file on disk for each query — an O(all sessions) directory
scan that degrades linearly for a long-lived gateway bot.
- Add SqliteSessionStore (stdlib sqlite3 + FTS5, lazy-imported) that keeps JSON
transcripts as the durable record but maintains a full-text index so recall
is a bounded MATCH lookup. Falls back to the substring scan if sqlite3/FTS5
is unavailable.
- Anchored discovery: SessionHit now carries opening/closing bookends so a hit
reconstructs goal -> match -> resolution in one call.
- Recall ranking demotes high-volume automated (scheduled) sessions so they
can't crowd interactive history out of the top results.
- Lineage-aware dedup collapses reset/compacted continuations to a single hit.
- Export SqliteSessionStore from praisonaiagents.session; update docstrings.
Co-authored-by: MervinPraison <[email protected]>
- classify_error now prefers exception type / HTTP status code (incl.
provider error codes) over message substring matching, so a 429 whose
message lacks the word "rate" is still classified correctly
- extract_retry_after reads structured Retry-After headers/attributes
before falling back to message parsing
- LLM retry loop honours RetryBackoffConfig.max_retries via a new
_max_retry_depth() helper instead of the hardcoded _retry_depth < 2
(defaults to 2 when no retry config is set, preserving prior behaviour)
Co-authored-by: MervinPraison <[email protected]>
Add a structured tool-execution result protocol in core so slow tools no
longer block the whole turn with no feedback:
- ToolProgress: incremental progress update a tool can stream via on_progress
- DeferredToolResult + defer(): a tool may return "started; resolve later"
handle instead of blocking the turn
- ToolResult gains progress[], deferred, is_deferred, and structured_error
(error type/message) so the model sees more than a flattened string
- run_single_tool_call(): shared executor path that injects on_progress when
the tool supports it, awaits async def tools natively, records deferred
handles, and captures structured errors
- Sequential/Parallel executors accept optional on_progress; fully backward
compatible with existing 3-arg execute_tool_fn callables
Exported ToolProgress/DeferredToolResult/defer from praisonaiagents.tools.
Co-authored-by: MervinPraison <[email protected]>
Add a first-class run ledger so long-running/async agent runs survive a
gateway restart. Core gains a thin RunLedgerProtocol + RunRecord/RunStatus
contract plus a zero-dependency SQLite default store that reconciles orphaned
runs on boot via recover_orphans().
Co-authored-by: MervinPraison <[email protected]>
1. Route the direct-prompt CrewAI/AutoGen path through FrameworkAdapterRegistry
so default selection and the adapter contract (scoped_telemetry_disable,
_resolve_llm, expected_output, cli_config/callbacks, entry-point plugins)
are honoured instead of a hardcoded chain that bypassed every adapter.
2. Preserve framework BaseTool schema/name/description when applying
tool_timeout: detect framework tool objects and wrap only their execution
method in place; only bare callables get function-level wrapping.
3. Scope observability sinks and the trace emitter per-run via a thread-local
stack + ObservabilityRun handle so concurrent runs no longer close each
other's sinks or leave the global emitter in a Fanout state. Backward
compatible: init returns a handle and finalize accepts an optional handle.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer (Greptile) findings on PR #2922:
- #3 (critical): AFTER_TOOL hook additional_context was discarded in
tool_execution.py, making subtree injection a no-op. Now aggregate and
append it to the tool result (mirrors the loop-guard injection pattern)
so the model actually sees subtree rules.
- #2: interactive Agent now gets a dedicated per-session HookRegistry via
Agent(hooks=...) instead of registering the session closure on the shared
global default registry, preventing stale cross-session leakage.
- #1: file_tool_matcher now covers the real ACP edit tools
(acp_create_file/acp_edit_file/acp_delete_file) and list_files, and path
extraction handles filename/target_file keys.
Tests: context_files (25) + interactive core (37) + core hooks (65) pass.
Co-authored-by: Mervin Praison <[email protected]>
- Agent toolset expansion now calls resolve_toolsets_for_model so the
advertised edit primitive order matches the harness prompt (Greptile P1).
- Add ToolsetRegistry.resolve_toolsets_for_model + module-level helper; extract
shared _apply_preferred_edit_order (DRY with resolve_toolset_for_model).
- chat_mixin/_resolve_harness_base_prompt and agent.py pass the string model id
only, so object-based LLMs no longer silently disable the harness.
- Add test coverage for the runtime multi-toolset path.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on #2920:
- cached-id: use exclusive create; losers of a concurrent first-run re-read
the persisted winner instead of returning an unpersisted id (Greptile P1)
- normalize_git_remote: accept host-less remotes (file:///... , bare paths)
by yielding a path-only identity instead of falling through (Greptile P2)
- root-commit: enumerate root commits across all refs and pick the smallest
SHA so orphan-branch switches keep a stable identity (Greptile P2)
- add regression tests for all three cases
Co-authored-by: Mervin Praison <[email protected]>
The nearest-wins walk-up resolver (load_context_files) and the on-demand
PathContextAttacher already existed but the attacher was never connected to
a running agent, so subpackage-local AGENTS.md rules never surfaced when the
agent worked in that subtree.
Add build_subtree_context_hook()/file_tool_matcher() in the wrapper's
context_files module: an AFTER_TOOL FunctionHook backed by PathContextAttacher
that extracts the touched file path from tool args, resolves the nearest
instruction file for that directory, and returns it as additional_context
(the neutral core hook mechanism) once per session. Wire it into the
interactive core, seeded with the up-front context and respecting the char
budget and --no-context opt-out. No core changes, no new deps.
Co-authored-by: MervinPraison <[email protected]>
Add praisonaiagents/model_harness with a data-driven, overridable
HarnessProfile registry that resolves, from the model id, an optional
base-prompt fragment and a preferred file-edit format. _build_system_prompt
prepends the fragment; the coding toolset can advertise the preferred edit
primitive first via resolve_toolset_for_model. Unknown models fall back to a
behaviour-preserving default (no fragment, unchanged ordering). Resolution is
lazy with zero import-time cost.
Co-authored-by: MervinPraison <[email protected]>
Derive project identity from the repository (git remote -> root commit ->
cached id) instead of the absolute git-root path, so session history follows
the repo across directory moves/renames, second checkouts, and git worktrees.
Falls back to the legacy resolved-path hash for non-git dirs, and transparently
migrates pre-existing path-scoped sessions so no history is lost.
Co-authored-by: MervinPraison <[email protected]>
Core parse_schedule requires a unit suffix for */N intervals, so
delegating bare */30 (unit-less) would raise ValueError and regress
previously-valid scheduler/deployment configs. Restore the wrapper's
unit-less */N → N seconds fast-path before delegating shared grammar.
Fixes Greptile P1 review finding on #2916.
Co-authored-by: Mervin Praison <[email protected]>
Deduplicate the schedule-expression grammar by making core
praisonaiagents.scheduler.parser.parse_schedule the single owner of the
shared grammar (keywords, */N{m,h,s}, raw seconds). The wrapper
ScheduleParser now delegates to it and derives an integer interval for
the polling loop, while keeping the wrapper-specific cron -> interval
collapse local. Preserves the int return contract, all three call sites,
and the "Unsupported schedule format" error message; transparently gains
weekly support.
Co-authored-by: MervinPraison <[email protected]>
The SandboxToComputeAdapter class in sandbox/_compat.py had zero call
sites across the entire src/ tree and was not exported anywhere. Its
docstring falsely advertised deduplication between the sandbox/* and
integrations/compute/* hierarchies that never occurred.
Removed the dead class and trimmed the module docstring to accurately
describe the actively-used safe_sandbox_path() path-traversal guard,
which remains unchanged and is still imported by docker.py/subprocess.py.
Co-authored-by: MervinPraison <[email protected]>
- Cap output reserve at window//4 so small-context models (e.g. gpt-4)
retain a usable input budget instead of compacting almost every turn.
- Skip the reactive context-length compaction when auto_compact is
disabled so a user's history is never rewritten without consent.
- Rebuild the agent from the compacted history before the retry so the
safety net no longer re-sends the stale oversized backstory.
- Add unit test for the small-model reserve cap.
Co-authored-by: Mervin Praison <[email protected]>
The interactive worker loop set auto_compact into session state but never
read it, so long sessions drifted toward context-window overflow with only
the manual /compact command as mitigation.
- Add _maybe_auto_compact() which reads auto_compact + threshold and reuses
the existing _handle_compact_command summariser when the running token
estimate (via core estimate_messages_tokens) nears the model's usable
context budget (window minus output reserve).
- Add a reactive safety net: catch context-length errors from agent.chat(),
compact, and retry the turn once instead of surfacing the raw error.
- Add best-effort model context-window lookup (litellm registry with a
coarse fallback map).
Co-authored-by: MervinPraison <[email protected]>
The plugin bridge now emits blocking HookResults for before_llm/
before_tool_definitions, but their runtime callers only adopted payload
rewrites and never checked is_blocked, so guardrail plugins failed open
(the denied LLM request / tool surface still reached the model). This
wires block enforcement into both paths and hardens the async BEFORE_TOOL
reason extraction so a HookResult-originated block can no longer fall
through to tool execution.
- chat_mixin: BEFORE_LLM now aborts the request when blocked
- chat_mixin: BEFORE_TOOL_DEFINITIONS fails closed (drops tool surface)
- chat_mixin: async BEFORE_TOOL reason lookup no longer re-opens a block
- tests: caller-enforcement regression tests for LLM/tool-definition block
Co-authored-by: Mervin Praison <[email protected]>
The _adapt_plugin_hooks bridge hardcoded HookResult.allow() for every
before_* event, so POLICY/GUARDRAIL plugins could only redact and never
deny a tool call, message, LLM request, or agent run. Now each before_*
adapter forwards an explicit deny/block decision to the runtime's existing
is_blocked enforcement.
- Add PluginDecision (allow/deny/block) and GuardrailBlocked exception to
the core Plugin contract; plugins may also return a HookResult directly.
- before_tool/before_llm/before_agent/before_message/before_tool_definitions
adapters coerce decision returns and catch GuardrailBlocked -> HookResult.
- Fully backward-compatible: dict/str/tuple/None keep rewrite/no-op semantics.
- Export PluginDecision/GuardrailBlocked from praisonaiagents.plugins.
Co-authored-by: Mervin Praison <[email protected]>
Closes the gap flagged by Greptile: resolve_reliability('production')
resolved outbound_ordering="strict" but the durable adapter never passed
it to OutboundQueue, so the production preset silently stayed best_effort
and same-conversation messages could still overtake after retry/backoff.
- setup_durable_delivery(..., ordering=...) forwards the discipline to
OutboundQueue so strict per-lane FIFO is actually enforced.
- BotOS exposes the resolved _outbound_ordering for adapters to consume.
- Regression test asserts the adapter forwards ordering into the queue.
Confined to the praisonai-bot wrapper; no core SDK / Agent changes.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Add an opt-in strict per-lane ordering mode to OutboundQueue so an earlier
undelivered message to a chat blocks later same-lane messages until it is
sent or permanently dead, preventing user-visible reordering under retries,
rate limits and multi-worker drains.
- New lane_key column (defaults to target) with migration/backfill for
existing databases.
- ordering="strict"|"best_effort" knob on OutboundQueue; strict gates each
lane to its head entry in _get_pending_entries while draining lanes in
parallel. Default best_effort preserves current behaviour.
- enqueue accepts an optional lane_key for custom conversation grouping.
- Reliability preset exposes outbound_ordering; production selects strict,
default/off stay best_effort, explicit value always wins.
Co-authored-by: MervinPraison <[email protected]>
The older-core fallback in _load_edit_tools only preserved YAML-approved
tools that were in TOOL_GROUPS["interactive"], silently dropping any other
approved tool (e.g. workflow tools) when merging in edit_file/apply_patch.
Read the current approved set directly from the registry contextvar so the
merge is non-clobbering regardless of installed praisonaiagents version.
Co-authored-by: Mervin Praison <[email protected]>
- Fix stale test_interactive_group_is_union to include the new `edit` group
in the interactive union (root cause of CI failure — feature intentionally
folded `edit` into `interactive`).
- Fail closed in _load_edit_tools: if Workspace containment cannot be built,
do not expose edit_file/apply_patch (the engine's no-workspace fallback
accepts absolute paths, which under auto-approval could escape the
workspace). (Greptile P1 security)
- Add ApprovalRegistry.add_yaml_approved_tools() to merge into the
context-local YAML-approved set instead of replacing it; use it so
auto-approving edit tools no longer clobbers previously approved tools.
(Greptile P1)
- Add regression tests for both behaviours.
Co-authored-by: Mervin Praison <[email protected]>
Both the worker and sync interactive paths re-ran the prompt via
chat() when iter_stream() raised. If chunks were already emitted to the
live display, the user saw partial streamed tokens followed by a full
second answer. Now the non-streamed fallback only fires when nothing
streamed yet; otherwise the partial streamed text is kept and finalised.
Fixes greptile P1 findings on PR #2906.
Co-authored-by: Mervin Praison <[email protected]>
Register the existing praisonaiagents edit_tools engine (edit_file,
apply_patch) into the default interactive TOOL_GROUPS so the CLI coding
agent performs targeted string-replace edits with a fuzzy fallback and
atomic multi-file patches instead of whole-file rewrites. Whole-file
creation (write_file/acp_create_file) remains available and
--tools/PRAISON_TOOLS_DISABLE overrides are honoured. Auto approval mode
context-approves the high-risk edit tools to match ACP behaviour.
Co-authored-by: MervinPraison <[email protected]>
Addresses Greptile P2: the previous collapse routed sync generate() through
agenerate() -> _astructured_completion (async provider clients), changing the
historical behavior where a sync call used the blocking sync client/network
stack. Each generator now shares one _agenerate_impl(is_async=...) body: the
async agenerate() drives is_async=True and the sync generate() drives
is_async=False via _run_coro_sync, so both entry points share merge/save/path
logic while each keeps its own provider path. No API or behavior regression.
Co-authored-by: Mervin Praison <[email protected]>
Addresses Gap 2b from the issue: the three auto-generator classes
(AutoGenerator, WorkflowAutoGenerator, JobWorkflowAutoGenerator) each
duplicated their generate()/agenerate() bodies, differing only in
_structured_completion vs await _astructured_completion.
Each sync generate() now delegates to its async agenerate() twin through
a single _run_coro_sync helper on BaseAutoGenerator, following the
established PraisonAIAdapter pattern (sync goes through the async bridge).
The helper preserves the existing running-event-loop fallback (FastAPI /
Jupyter / async test) that _structured_completion already implemented, so
behavior is backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
- verify(): a Judge failure is now inconclusive (criteria stay 'pending',
achieved=False) instead of being recorded as a real 'unmet' failure
- verify(): return an independent snapshot of criteria (dataclasses.replace)
so mutating the result never corrupts the goal's own state
- Goal.progress: clamp non-positive weights and fall back to equal counting
so invalid/zero/negative weights can't push progress outside 0.0-1.0
- add regression tests for judge-unavailable, snapshot isolation, and
zero/negative-weight progress
Co-authored-by: Mervin Praison <[email protected]>
The package-level lazy loader silently converted real ImportError/
AttributeError into a cached None, masking genuine import bugs and stale
mapping entries as confusing NoneType errors far from the root cause.
This additive change preserves the graceful None fallback but logs the
swallowed exception: DEBUG for a genuinely-absent optional module and
WARNING for a missing attribute (which usually signals a stale mapping).
Co-authored-by: MervinPraison <[email protected]>
The OnRetryInput hook dataclass declared the `attempt` field twice with
conflicting defaults (1 then 0), so the intended 1-based default was
silently shadowed by 0. The to_dict() also wrote the "attempt" key twice.
Removed the shadowing declaration and the duplicate dict key, keeping a
single `attempt` field with the intended 1-based default. All production
constructors pass attempt= explicitly, so runtime behaviour is unchanged.
Co-authored-by: MervinPraison <[email protected]>
Adds a protocol-driven, lazily-loaded `goal/` module to praisonaiagents that
turns a vague objective into a structured, measurable Goal (statement +
weighted success criteria + constraints) and verifies output against it,
reusing the existing eval Judge for scoring (DRY). Complements CHL engineering.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
The wrapper copy at src/praisonai/praisonai/_lockmap.py had zero importers
and had drifted from the canonical praisonai_bot._lockmap copy (extra break
in _evict_stale_from_bucket LRU loop). All live consumers import from
praisonai_bot._lockmap, which is untouched.
Co-authored-by: MervinPraison <[email protected]>
An explicit `--var input=` (empty) is now respected instead of falling
back to the YAML default_input. Only a genuinely absent input key falls
back to default_input, addressing Greptile P1 review feedback.
Co-authored-by: Mervin Praison <[email protected]>
The CLI handler always called workflow.start("") which dropped the parsed
default_input, leaving every {{input}} step empty. Now the CLI uses the
YAML input (via workflow.default_input), lets --var input override it, and
AgentFlow.run() falls back to default_input when no input is passed so
programmatic start() calls also honor YAML defaults.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Addresses reviewer feedback on PR #2887:
- Gate suspicious system-dir check on looks_absolute (not allow_absolute) so
sensitive roots like /etc/passwd stay blocked even with allow_absolute=True,
and relative paths containing substrings (myapp/home/config.txt,
project/users/context.txt) are no longer falsely rejected (CodeRabbit, Greptile).
- Require a separator after the drive colon so drive-relative "C:context.txt"
is not misclassified as absolute (Greptile).
- Treat leading "~" as a home reference so ~/context.txt remains blocked.
- Add regression tests for all cases.
Co-authored-by: Mervin Praison <[email protected]>
Greptile P1: capitalized candidates were ranked entirely before lowercase
action candidates, so a repeated greeting (e.g. 'Hello') could win over a
more-frequently-discussed lowercase topic. Now all repeated candidates are
scored by frequency, with capitalization used only as a tie-breaker. Also
bound the action/focus object capture to a short noun phrase so real topics
survive the length filter instead of being swallowed by a greedy match.
Co-authored-by: Mervin Praison <[email protected]>
The standalone run_all_tests() runner subscripted [0] on
test_basic_instantiation(), which uses pytest-style assert and returns
None on success, causing a TypeError that aborted 5 of 7 QA groups.
Add a _run_check() wrapper that normalizes pytest-style functions to a
bool (None/truthy -> pass, AssertionError/exception -> fail) and honors
@pytest.mark.skip. Removes the erroneous [0] subscript so all 7 groups
run without crashing while keeping pytest collection working.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
validate_monitor_path relied on Path.is_absolute() and POSIX substring
checks, which are OS-specific. On Windows, POSIX-style paths like
/etc/passwd were not treated as absolute and normalized to \etc\passwd,
so security checks silently passed.
- Detect POSIX leading slashes and Windows drive letters explicitly
- Match suspicious patterns against a normalized posix haystack
- Add Windows-sensitive dirs (/windows/, /system32/, /users/)
- Fix test_set_path to use as_posix() for cross-platform assertion
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
_build_tool_schemas conflated tools=None with an explicit empty override,
dropping agent.tools from PreparedTurnContext. Now None and omitted kwarg
both fall back to agent.tools, while tools=[] still explicitly disables tools.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Run the capitalized-phrase regex on original-case text instead of a
lowercased copy so acronyms/proper nouns like "REST API" are preserved.
Action/focus patterns still run on lowercase text. Capitalized candidates
are preferred over lowercase action-object fragments.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Greptile flagged that Path(str(traversable)) breaks under non-filesystem
importers (zipimport wheels): the packaged CSV would appear missing even
though it ships in the wheel. Use importlib.resources.as_file() so the
resource is materialized to a real filesystem path that the CSV runner can
open, kept alive for the process lifetime via a module-level ExitStack.
Co-authored-by: Mervin Praison <[email protected]>
- LoopEvaluator now detects DoomLoopEvent (loop_type) and DoomLoopResult
(is_loop) guard shapes, not just generic type/event markers (P1/security).
- In review mode, convergence defers to the loop result's own success /
final score so health never disagrees with the loop result (P2).
- Add tests for real guard shapes and review-mode transient scores.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on PR #2876:
- Read tool calls from `tool_trace` (real harness key) in addition to
`tool_calls`/`tools`.
- Match structured/dict artifacts (path/name/file keys) and dict-shaped
artifact maps, not just flat file-name strings.
- Aggregate HarnessResult on the shared /10 scale in EvalSuite via a
`score_scale` marker so mixed CI gates are not understated.
- Fail (not crash) on malformed non-numeric `judge_score`.
- Surface the `min_tool_calls` gate in `to_eval_result().criteria_scores`.
Adds regression tests for each fix.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P2 findings: clarify that ContextEvaluator/
HarnessEvaluator/LoopEvaluator are planned follow-ups and map each
pillar's current coverage to real modules (context/tokens.py,
eval/tokens.py, compaction/compactor.py ContextCompactor,
runtime/turn_context.py, runtime/example_harness.py, eval/loop.py
EvaluationLoop, agent/autonomy.py, agent/context_agent.py).
Co-authored-by: Mervin Praison <[email protected]>
Add the four built-in interactive test suite fixtures (smoke, tools,
refactor, multi_agent) that `praisonai test interactive --suite` expects
but which were never committed because `src/praisonai/.gitignore` ignored
`tests/fixtures`.
- Add fixtures as tracked package data under praisonai_code/data so they
resolve for PyPI wheel installs via importlib.resources.
- Un-ignore tests/fixtures/interactive/*.csv so editable/dev checkouts also
resolve, while keeping other fixture dirs ignored.
- Make _get_builtin_suite_path robust: try packaged data, dev-tree src
layout, and cwd instead of a fragile parent.parent chain.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Migrate context-flow (handoff) scoring from the praisonai wrapper's
replay judge into the core SDK eval framework so SDK-only installs and
CI can score Context Engineering behaviour.
- Add praisonaiagents/eval/context_eval.py with ContextEvaluator plus
ContextHandoffResult, BudgetComplianceResult, ContextEvalResult
- LLM-free, dependency-free deterministic scoring (handoff token overlap
+ token-budget compliance); composes into EvalSuite via overall_score
- Export ContextEvaluator + result types from eval/__init__.py (lazy)
- Wrapper _evaluate_context_flow now delegates to the SDK evaluator,
removing duplicate scoring logic (graceful fallback on ImportError)
- Add tests/unit/eval/test_context_eval.py (no OPENAI_API_KEY needed)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Adds a lightweight, dependency-free HarnessEvaluator to praisonaiagents.eval
that scores Interactive Test Harness trace artifacts (tool call count,
tool-schema consistency hash, artifact completeness, optional rubric judge
score) and a harness_row_to_eval_case CSV->EvalCase adapter, so harness runs
can be aggregated inside EvalSuite and exported as an EvalReport.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Adapters whose start() spawns a background task/server and returns
immediately (Email IMAP poll, Linear/WhatsApp/AgentMail webhook servers)
ended supervision the instant they came up: the ChannelSupervisor treated
the returned start() as "stopped cleanly" and exited, so the inbound loop
ran unsupervised and Bot.run() returned right after starting.
The supervised _start wrapper now blocks until the adapter reports it is no
longer running (awaiting its background task when exposed, else watching
is_running), presenting a uniform "runs until stopped" contract for both
blocking (Slack/Discord) and returning adapters. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing ChannelSupervisor + health-restart layer into Bot.start()
so every channel (not just Telegram) auto-reconnects with capped backoff,
matching BotOS/gateway robustness. Add a protocol-only start/stop +
supervised_inbound seam to the core BasePlatformAdapter contract; Telegram
and the relay adapter opt out to keep their self-managed reconnect loops.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer (Greptile) P1 findings on PR #2868:
- Agents loader now discovers .praisonai/config.yaml / praisonai.yaml so the
documented unified YAML `plugins:` surface actually reaches
maybe_enable_from_config() (PyYAML lazily imported, optional).
- PluginManager.set_plugin_options(replace=True) replaces the option set
authoritatively so removed plugin blocks no longer deliver stale options
via on_config on a reused manager.
- config.schema.json drops the unsupported string `enabled` type; loader now
handles a bare-string plugin name gracefully in is_plugins_enabled/
get_enabled_plugins instead of silently falling through.
Adds 8 tests; 144 plugin unit tests pass.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Add a first-class `plugins:` section to the unified project config
(`.praisonai/config.yaml`) resolved by the existing resolver, and deliver
each plugin its own options dict via the `on_config` hook.
- wrapper: `plugins` block in resolver.py (ResolvedConfig + merge + provenance
+ typo-suggestion validation) and config.schema.json.
- core: loader.py collects per-plugin option maps and exposes
get_plugin_options(); manager.py stores options and delivers them via
apply_plugin_options(); enable() accepts options_by_name and
maybe_enable_from_config feeds YAML-sourced options.
- backward compatible: legacy config.toml / PRAISONAI_PLUGINS still work.
Co-authored-by: MervinPraison <[email protected]>
Data-driven help categories map every top-level command to a stable panel
(Get started, Run & chat, Sessions & state, Config & setup, Tools & knowledge,
Serve & integrate, Advanced). Categories are applied lazily as Typer's
rich_help_panel in LazyCommandGroup.get_command, keeping the registry the single
source of truth without importing every command up front. Fully additive: no
command is renamed, removed, or hidden.
Co-authored-by: MervinPraison <[email protected]>
Exclude PermissionError from transient-init classification so fatal
misconfiguration (bad credentials/file mode) surfaces on every call
instead of being memoized for the cooldown window. Genuinely transient
filesystem/network OSErrors and driver DBAPI errors remain memoized.
Co-authored-by: Mervin Praison <[email protected]>
Two regressions/gaps surfaced by CI and reviewers on PR #2862:
1. agents_generator: the narrowed except in _validate_cli_backend_compatibility
dropped ValueError/TypeError/AttributeError. The registry create()/
is_available() raise (Value|Type|Import)Error for unknown/unavailable
frameworks, and minimal/mock generators (object.__new__) lack
_adapter_registry (AttributeError). These now fall back to native-only
behaviour with a warning instead of aborting setup, fixing the
test_cli_backend_* CI failures and greptile P1 adapter-lookup-escapes.
2. db/adapter: init-failure memoization only caught ConnectionError/
TimeoutError/OSError, so psycopg2.OperationalError (not an OSError subclass)
escaped the cooldown and hammered a down Postgres on every callback. Added
_is_transient_init_error() matching driver DBAPI errors by class name across
the MRO (no optional-dep import), so genuine outages are memoized for the
cooldown while fatal misconfiguration still surfaces immediately.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1 (DRY / lazy):
- Extract the four CLI-backend loaders into a shared integrations/_cli_loaders.py
so IntegrationRegistry and ExternalAgentRegistry no longer hand-duplicate them.
- Make INTEGRATIONS_REGISTRY lazy via get_integrations_registry(); importing
praisonai.integrations no longer constructs a registry at import time.
Gap 3 (safe by default):
- agents_generator: narrow adapter-resolution except to (ImportError, KeyError,
LookupError) and warn instead of swallowing every failure.
- agents_generator: retry-policy resolution narrows to ImportError and logs a
warning rather than silently dropping requested --tool-retry-* settings.
- db/adapter: only memoize transient (ConnectionError/TimeoutError/OSError)
init failures for the cooldown window; fatal misconfiguration now surfaces.
- db/adapter: build Postgres URL with quote_plus so special chars in the
user/password no longer produce a malformed/round-trip-unsafe URL.
- security/injection: the injection hook no longer derives trust from a plain
payload attribute; hook inputs are always scanned as external.
Co-authored-by: MervinPraison <[email protected]>
Phone-number→agent routing is a channel/gateway concern, not a core Agent
identity attribute (the Agent never reads its own number). Revert the
misrouted `phone_number` param on core Agent and add a lightweight
`AgentRegistry` in praisonai-bot that maps normalised phone numbers to
agents for inbound WhatsApp/SMS dispatch, mirroring OpenClaw's multi-agent
routing model.
- Remove `phone_number` from praisonaiagents Agent (__init__, docstring, to_dict)
- Add praisonai_bot.bots.AgentRegistry + normalize_number (E.164-ish keys)
- Export both via the lazy bots __init__
- Tests: tests/unit/bots/test_agent_registry.py (16 passing, offline-safe)
Co-authored-by: Mervin Praison <[email protected]>
Replace non-standard PRAISONAI_ALLOW_NETWORK guard (treated any value,
including "false"/"0", as truthy) with the repo-standard OPENAI_API_KEY
check used by other live LLM tests.
Co-authored-by: Mervin Praison <[email protected]>
Add an optional lightweight `phone_number` identity attribute to the core
Agent so an agent can be assigned a contact number (used by channel/bot
layers such as WhatsApp/SMS for routing). Preserved across channel clones.
Co-authored-by: MervinPraison <[email protected]>
Deletes the unreferenced private lazy-loader that hardcoded a duplicate
copy of the 17-class praisonai_tools list. No callers exist and its
lazy_get cache key was unique to the function. Tool resolution remains
via ToolResolver; no user-facing behaviour changes.
Co-authored-by: MervinPraison <[email protected]>
Addresses Greptile review on PR #2856:
- telegram/discord/slack now call BotConfig.is_explicitly_allowed() instead
of the equivalent inline `bool(allowed_users) and is_user_allowed()` check,
eliminating dead code and making the config docstrings truthful. Runtime
behavior is unchanged (secure-by-default preserved).
- Add hot-reload (_start_single_channel) test coverage for unknown_user_policy
and owner_user_id wiring so the startup and hot-reload paths can't drift.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Wire unknown_user_policy + owner_user_id from gateway.yaml into BotConfig
in both start_channels() and the hot-reload path.
- Replace misleading "accepts messages from everyone" startup warning with a
deny-aware message: empty allowed_users + default deny now warns that unknown
DMs are SILENTLY DROPPED; allow/pair get accurate text.
- Add BotConfig.is_explicitly_allowed() and clarify is_user_allowed() /
allowed_users docstrings (empty list defers to unknown_user_policy).
- Add gateway tests for YAML wiring and warning text.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- _wrapper_bridge: propagate non-zero SystemExit codes from the wrapper
instead of swallowing them (clean exit 0/None still returns normally)
- registry: remove leftover unused `import sys` in registry_list
- tests: expand parametrize to all 14 stub modules; tighten legacy grep
to catch both `praison.main()` and `PraisonAI().main()` forms
Co-authored-by: Mervin Praison <[email protected]>
Fourteen Typer stub command groups (agents, workflow, registry, memory,
skills, hooks, rules, eval, package, templates, todo, research, commit,
call) re-entered legacy PraisonAI().main() by mutating sys.argv, which on a
standalone `pip install praisonai-code` crashed with a Rich ImportError
traceback from the wrapper-only argparse_builder before any handler ran.
Add run_wrapper_command() to _wrapper_bridge.py that fails fast with a
single-line install hint (exit 1, no traceback) when the wrapper is absent,
and performs the legacy re-entry only when praisonai is installed. Migrate
all 34 stub entry points to use it. Native subcommands (e.g. memory learn,
skills check) are untouched, so they keep working standalone.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
The prior commit routed default/plain/verbose/silent standalone `run` text
modes through the in-process Agent, which broke the C7 hot-path smoke contract
(`smoke` job asserts default `run "hi"` gates with an install hint and keeps the
heavy `praisonaiagents` import off the default hot path). Revert the routing
change; preserve the genuinely valuable fix — the corrected error hint that
cites `praisonai-code run --output actions` instead of `praisonai`.
- run.py: text modes gate again on standalone; `--output actions` unchanged;
keep `_IN_PROCESS_OUTPUT_MODES` constant + clarified docstrings.
- README: standalone matrix corrected to reflect gating of text modes.
- tests: assert text modes gate, structured modes run in-process, and the
hint cites praisonai-code (error path is now live, no force-monkeypatch).
Co-authored-by: Mervin Praison <[email protected]>
- Drop over-broad "[ssl:" marker in _is_ssl_error so TLS handshake
failures (WRONG_VERSION_NUMBER, NO_SHARED_CIPHER, HANDSHAKE_FAILURE)
no longer soft-fail preflight — only true cert-verify failures do.
- Make PRAISONAI_SSL_CA_BUNDLE authoritative: override a pre-existing
SSL_CERT_FILE/REQUESTS_CA_BUNDLE instead of silently no-op via setdefault.
- Warn instead of silently ignoring a configured-but-missing CA bundle path.
- Add regression tests for all three behaviors.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on #2838:
- Guard check_console_script_execution with skip_if_no_wrapper() so it SKIPs
instead of FAILing on standalone praisonai-code installs (the unguarded
check still forced doctor exit 1 via calculate_exit_code).
- Remove unreachable dead branch in check_praisonai_package_structure.
- Mock subprocess.run in wrapper-present module-execution test; add
console_script_execution to the SKIP regression matrix.
Co-authored-by: Mervin Praison <[email protected]>
- Move _secure_secret_permissions() into the read try/except else clause so
a chmod OSError propagates (fail closed) instead of being swallowed by the
file-read handler and silently regenerating/rotating the HMAC secret.
- Invoke icacls via its absolute System32 path to avoid PATH hijack while
hardening the secret, and quote the username so principals with spaces are
parsed as a single principal.
- Add regression test asserting a chmod failure raises and does not rotate
the persisted secret.
Co-authored-by: Mervin Praison <[email protected]>
Assert get_command/list_commands directly so hyphen/underscore
resolution is verified deterministically and cannot pass vacuously
when the optional mint_link sub-app fails to import.
Co-authored-by: Mervin Praison <[email protected]>
- Correct sys.path block in test to inject praisonai-bot (was praisonai/agents)
- Isolate tests to tmp_path so ~/.praisonai is not mutated
- Suppress Ruff BLE001 on intentional advisory broad-except
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback (greptile, coderabbit):
- assert exit_code == 0 instead of != 2 for the list alias
- verify "list" appears as a standalone command, not just within "list-judges"
Co-authored-by: Mervin Praison <[email protected]>
- memory_show now appends --limit to argv so `memory show/list --limit N`
is respected instead of silently using the backend default (issue #2840)
- strengthen test_memory_list_is_a_known_command to assert exit_code == 0
- add end-to-end test verifying --limit reaches the argv passed to PraisonAI
Co-authored-by: Mervin Praison <[email protected]>
Standalone `praisonai-code run` with plain/verbose/silent/default output
modes was blocked by `_require_wrapper_for_default_run`, which delegated to
the wrapper-only `handle_direct_prompt`. Now, when the `praisonai` wrapper is
not installed, these human-readable text modes route through the in-process
Agent path (like `actions`). The standalone error hint also references
`praisonai-code` instead of `praisonai`.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Telegram/channel probes on SSL-inspecting (MITM/corporate proxy) networks
failed cert verification and hard-aborted gateway start with a misleading
"fix credentials" message, even though the runtime adapter connects fine.
- Classify SSLCertVerificationError/CERTIFICATE_VERIFY_FAILED separately from
auth/token failures (_is_ssl_error)
- Soft-fail preflight when only SSL errors occur: warn and continue start;
still hard-abort on genuine token failures
- Honor SSL_CERT_FILE / REQUESTS_CA_BUNDLE / PRAISONAI_SSL_CA_BUNDLE in the
probe SSL stack (_apply_probe_ca_bundle)
- Actionable per-channel doctor message pointing at SSL/proxy, not credentials
- Regression tests for classification, render, CA bundle, soft/hard fail
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Addresses reviewer feedback on PR #2836:
- strip_leading_timestamps now anchors on the YYYY-MM-DD HH:MM date-time
instead of hardcoded English weekday names, so replay de-duplication
works under non-English server locales and for custom templates that
omit %a (Greptile P1 / CodeRabbit).
- _with_timestamp now() fallback uses timezone-aware UTC so %Z renders
"UTC" instead of an empty string / trailing space (Greptile P2).
- _with_timestamp error fallback returns the de-duplicated base, never a
stale prefix (CodeRabbit).
- chat_with_run_control now threads received_at through to chat() for the
original turn; pending follow-ups correctly fall back to now() (CodeRabbit).
- Documented timestamp_template date-time constraint in the config schema.
- Added tests for non-English weekday / no-%a dedup, UTC fallback, and
custom-template replay.
Co-authored-by: Mervin Praison <[email protected]>
praisonai-code doctor exited 1 on standalone installs (no praisonai wrapper)
because four wrapper-presence checks were scored as hard failures instead of
skips. Apply the existing skip_if_no_wrapper() helper to
performance_praisonai_import, acp_module and praisonai_package_structure, and
make python_module_execution target the product's own entry point
(python -m praisonai_code) when the wrapper is absent.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
🤖 Generated with [Claude Code](https://claude.ai/code)
os.kill(pid, 0) can raise SystemError/ValueError on Windows, which
propagated through `gateway status` as an ERROR while /health was OK.
Catch these in _is_process_running (returns False) and make the PID
lock block in GatewayHandler.status advisory-only so the authoritative
/health probe is always reached.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Root --help renders the underscore key mint_link as mint-link, but
_BotCommandGroup.get_command only matched exact keys, so the advertised
hyphen form failed with exit code 2. Normalize hyphen/underscore in
get_command and list_commands so displayed names are invocable.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Address reviewer feedback on PR #2835:
- Cap _list_channels_async pagination at _MAX_LIST_CHANNELS_PAGES (50 pages
x 200 = 10k channels) so a misbehaving Slack API cannot paginate forever.
- Pass future.result(timeout=_LIST_CHANNELS_TIMEOUT=30s) so an unresponsive
Slack API degrades to an empty list instead of blocking the sync refresh
loop indefinitely.
- Add test covering the pagination cap.
Co-authored-by: Mervin Praison <[email protected]>
praisonai-code memory list now resolves via Typer for parity with tools/session/config list.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Add opt-in per-message arrival-time stamping to the bot session turn
builder so an always-on gateway agent has a clock: it can compute
relative-time requests ("in 2 hours"), reason about conversation gaps
and interpret "this morning"/"by end of day".
- `session.timestamps` / `session.timestamp_template` config (off by
default for prompt-cache stability)
- `_with_timestamp` renders each turn's real arrival time; applied to
both DM (per_user) and group (per_chat) scopes, after sender
attribution so the time sits outermost
- `strip_leading_timestamps` de-dupes on replay so prefixes never
accumulate as `[ts] [ts] … text`
- `chat()` gains an optional `received_at` (real platform receive time),
falling back to `datetime.now()`
Co-authored-by: MervinPraison <[email protected]>
Adds the missing enumeration half of the durable ChannelDirectory: Discord
walks cached guild text channels synchronously; Slack paginates
conversations.list via a sync-safe async wrapper. A shared ChannelRef
descriptor feeds the already-wired refresh_from_adapters, so reachable
channels become addressable without prior inbound traffic. Platforms that
cannot enumerate remain observed-only via the existing not-callable guard.
Co-authored-by: MervinPraison <[email protected]>
- Add `type="hello"` discriminant to HelloParams so uniform frame.type
dispatch across the ClientFrame union no longer AttributeErrors on hello
- Chain re-raised FrameDecodeError with `from None` (ruff B904)
- Reuse top-of-file MIN_CLIENT_PROTOCOL_VERSION / GATEWAY_PROTOCOL_VERSION
constants instead of hardcoded 1 and late-defined forward references
- Add tests asserting the type discriminant on every frame type
Co-authored-by: Mervin Praison <[email protected]>
Add a single, dependency-light frame codec in the core gateway protocol
module that turns raw inbound WebSocket frames into validated, typed,
discriminated objects (or rejects them deterministically with the existing
structured HelloError envelope).
- New typed frames: MessageParams, LeaveParams, JoinParams (completing the
advertised message/leave methods and the legacy join handshake), plus
validated hello decoding into the existing HelloParams.
- decode_client_frame(data) dispatcher discriminated on `type`, and a
FrameDecodeError carrying a structured HelloError for the transport to
reject with.
- No pydantic/jsonschema: a small hand-rolled validator preserves core's
no-heavy-import rule. Additive and backward-compatible; the wrapper server
can migrate to decode-once at its own pace.
- Export new symbols from the gateway package and add 26 unit tests.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer (Greptile) P2 findings:
- agent.py: guard isinstance(PermissionManager) before constructing a
throwaway manager, avoiding storage-dir creation + rules.json/approvals.json
disk reads when a pre-built manager is passed.
- test_permissions.py: add async call-time deny test exercising
_check_tool_approval_async (mirrors the existing sync coverage).
Skipped the is_denied "namespaced-allow overrides wildcard-deny" concern:
the PermissionManager uses deny-wins semantics globally, so short-circuiting
on any DENY is the intended, consistent behaviour.
Co-authored-by: Mervin Praison <[email protected]>
Adds Accept: application/json headers to the device-code and token-exchange
POST requests so providers that default to form-encoded responses (notably
GitHub) parse correctly instead of raising JSONDecodeError. Also prints an
actionable OAuth hint when auto-mode falls back to API-key login for a known
OAuth provider lacking a client id, and passes overrides directly.
Co-authored-by: Mervin Praison <[email protected]>
Denied tools are now hidden from the advertised tool schema and blocked
uniformly at call time (native + MCP), reusing the existing filtering seam.
- Add PermissionManager.is_denied(tool_name, agent) exposure helper
- Consult the manager in _tool_name_allowed / _prune_denied_tools (deny = hide)
- Gate every tool-call path (native + MCP) via _check_permission_manager_deny
- Auto-wire a PermissionManager from the declarative permissions: config
- Extend registry.get_tool_definitions() with an optional permission_resolver
Co-authored-by: MervinPraison <[email protected]>
Close the remaining wrapper-config gaps in the layered ConfigResolver:
- env_utils: add {file:./path} include + {env:VAR:-default} directives and a
centralised interpolate() applied uniformly to config values.
- resolver: interpolate values at load time in _read_config_file; add
resolve_with_provenance() returning per-key (value, layer, source).
- config command: add `praisonai config provenance` to show the reconciled
resolved view and which file/layer supplied each key.
Co-authored-by: MervinPraison <[email protected]>
Populate the previously-empty OAUTH_PROVIDERS registry with curated
device-code (RFC 8628) providers (github, google, gemini, azure) so
`auth login <provider> --method oauth` works without hand-supplying
every endpoint. Add --client-id and endpoint overrides to `auth login`,
treat registry providers as OAuth-capable, and surface a precise
"pass --client-id" message instead of silently falling back.
Co-authored-by: MervinPraison <[email protected]>
- factories.py: hoist `logging` to module-level import + shared logger
instead of re-importing inside each exception handler
- retrieval.py: correct the "no chunks stored" hint (embedding failures
now raise RuntimeError, so this branch means no supported files/content)
- test_embedding_failure.py: use pytest.raises instead of manual try/except
Co-authored-by: Mervin Praison <[email protected]>
Greptile P1: registry_serve defaulted to 8080 while cmd_serve and the
canonical 'serve registry' both default to 7777, silently landing users
on a different port when following the deprecation migration path.
Co-authored-by: Mervin Praison <[email protected]>
- knowledge.py: raise RuntimeError when store() returns AddResult(success=False)
instead of appending empty id and counting failed chunk as success
- factories.py (ChromaKnowledgeAdapter): log + include underlying error in
AddResult.message; log embedding failures in search(); respect
OPENAI_EMBEDDING_MODEL env var instead of hardcoded text-embedding-3-small
- retrieval.py index CLI: filter empty ids, print actionable error and exit 1
when no chunks stored
- add regression tests for embedding-failure handling
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
praisonai registry list/serve crashed with ModuleNotFoundError because
praisonai_code.cli.features.registry did not exist and the Typer stubs
re-entered legacy PraisonAI().main(). Mirror the #2787 endpoints fix:
- Add cmd_list + handle_registry_command to wrapper RegistryHandler
- Add praisonai-code bridge module re-exporting the wrapper handler
- Replace Typer stubs to dispatch directly (no sys.argv mutation)
- Add regression tests in test_registry_bridge.py
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- db/adapter.py: add async-safe `_dispatch_async` helper that awaits coroutine
methods and off-loads sync methods to a thread. Fixes silent data loss where
AsyncPostgres/AsyncSQLite `async def add_message` was run via asyncio.to_thread,
producing an un-awaited coroutine so INSERTs never ran.
- db/adapter.py: fix wrong `..persistence.conversation.models` import (module
does not exist) to `.base`.
- db/adapter.py: `aon_agent_start` now creates-or-fetches the session and returns
prior messages for async session resume (mirrors sync on_agent_start).
- db/adapter.py: replace non-existent `set_agent_state`/`async_set_agent_state`
calls with the real StateStore `set`/`aset` protocol methods.
- db/adapter.py: add missing `aon_run_start`/`aon_run_end` mirroring sync twins.
- integrations/managed_local.py: shlex.quote pip package names and enforce a
strict allowlist before shelling out inside the compute sandbox, preventing
shell injection from attacker-controlled YAML package lists.
Co-authored-by: MervinPraison <[email protected]>
Previously hoisting the call outside the try/except blocks removed the
defensive fallback that was implicitly present in the original code.
Add explicit try/except so a failure in clean_json_output gracefully
falls back to the raw agent_output instead of propagating upward.
artifact_ref was initialized inside the `if len(result_str) > limit:` block, so
short-result paths left it unbound, causing `if artifact_ref:` guards to raise a
silently-swallowed NameError that skipped context-aware truncation.
Co-authored-by: Mervin Praison <[email protected]>
- agents.py: Hoist clean_json_output() call before output_json/output_pydantic
branches so it runs at most once instead of twice when both flags are set.
- tool_execution.py: Replace redundant "'artifact_ref' in locals()" guards with
direct "if artifact_ref:" checks. artifact_ref is already initialised to None
at line 476, so the locals() lookup always returns True and adds no value.
Also adds explicit "blocked_result = None" initialisation before the try block,
removing reliance on locals().get() which is not guaranteed by the language spec.
- agents.py / chat_mixin.py: Add cross-reference comments to the two identical
clean_json_output() implementations so maintainers know to keep them in sync.
- agents.py save_output_to_file: Guard os.makedirs() with "if dir_name:" to
avoid FileNotFoundError when output_file has no directory component (e.g. 'out.txt').
Add a module-level __getattr__ to autoagents.py that lazily resolves
get_openai_client and LLM as module attributes, preserving the lazy
import goal (llm.llm / llm.openai_client are not loaded on the
praisonaiagents.agents import path) while keeping them patchable via
patch('...autoagents.get_openai_client') / patch('...autoagents.LLM').
_generate_config now references get_openai_client / LLM through the
module object so test patches take effect, and keeps
supports_structured_outputs imported from ..llm at call time to match
its existing patch target (praisonaiagents.llm.supports_structured_outputs).
Co-authored-by: Mervin Praison <[email protected]>
The dead-code removal in PR #2815 deleted the private telemetry
`_initialized` flag, but debug_auto_instrument.py:11 still read it,
raising AttributeError on run. Point the debug output at the live
`_atexit_registered` flag instead.
Co-authored-by: Mervin Praison <[email protected]>
Move get_openai_client and LLM into the method that uses them (next to the
existing lazy import of supports_structured_outputs) and drop the unused
OpenAIClient import. This restores the llm package's lazy-loading design so
that importing the agents package no longer eagerly loads llm/llm.py and
llm/openai_client.py.
Co-authored-by: MervinPraison <[email protected]>
Delete the unreferenced private _initialize_telemetry() function and its
_initialized module global. The function had a no-op body and zero call
sites; top-level __init__.py owns telemetry initialisation. The live
atexit path (_ensure_atexit) is unchanged.
Co-authored-by: MervinPraison <[email protected]>
The praisonai-code lazy loader resolves the 'app' command via
getattr(module, 'app') on praisonai.cli.commands.app, but the module
only defined 'app_command'. The resulting AttributeError was silently
swallowed and dispatch always fell through to the inline duplicate.
Add 'app = app_command' alias so the wrapper owns the command when
installed (C8.2 intent). The inline _get_app_command is retained as the
no-wrapper fallback per the issue's Keep-unchanged guidance.
Co-authored-by: MervinPraison <[email protected]>
Addresses CodeRabbit + Greptile review: result.stdout and result.output
return the same captured stdout in Click 8/Typer, so concatenating them
doubled the output. Use result.output alone.
Co-authored-by: Mervin Praison <[email protected]>
The shipped praisonai knowledge search command (wrapper-resident handler in
praisonai/cli/commands/knowledge.py) treated Knowledge.search() output as a
dict/sliceable sequence, crashing with 'SearchResult object is not
subscriptable'. PR #2779 fixed the parallel feature module but not this
canonical command path.
Apply the same to_legacy_format/dict/list normalization used elsewhere and
fix the empty-result guard (empty SearchResult is truthy). Add wrapper-path
regression tests covering SearchResult, empty SearchResult, and legacy dict.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Port hasSuccessfulReleaseToday from PraisonAIUI — the monorepo gate was
releasing on every green Core Tests push to main (4 releases today).
Also skip release-gate on Release/Bump bot commits to avoid cascades.
Unify Agent tool resolution via a canonical resolver chain, auto-enable
plugins from PRAISONAI_PLUGINS/config on Agent init, and resolve optional
sandbox backends through praisonai.sandbox entry points.
Bridge closures previously only mutated data.credentials/data.config when
the attribute was already a dict, silently dropping a plugin's returned dict
during first-time auth/config (attribute None). Add a _write_back helper that
mutates in place when a dict exists, else assigns directly.
Co-authored-by: Mervin Praison <[email protected]>
- Use truthy check (with callable support) for plugin is_available
- Store SandboxRegistry.default() once to avoid double init
- Generic plugin-install hint instead of hardcoded capsule
- Registry tests inject fake module so they run without praisonai; add ImportError-branch coverage
Co-authored-by: Mervin Praison <[email protected]>
Extend Plugin base class with session_start, session_end, and on_error
lifecycle methods, and wire on_config, on_auth, session_start, session_end,
and on_error through _adapt_plugin_hooks so they fire via the runtime hook
registry.
Co-authored-by: MervinPraison <[email protected]>
SandboxManager falls back to SandboxRegistry for types like capsule
registered by praisonai-plugins. Adds SandboxConfig.capsule() factory only;
implementation stays in external plugin packages.
Phase 2 restarted at 5 after Phase 1 gained a 6th (repo-routing) item,
colliding with Phase 1 items 5-6. Renumber Phase 2 to 7-9 and Phase 3
to 10-11 so the prompt has a single monotonic list.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on PR #2802:
- onboard wizard now prompts for ChannelField entries without an `env`
fallback (e.g. IRC `server`) and writes them into bot.yaml, closing the
silent-gap that caused a runtime error at gateway start (Greptile P1).
- invoke the optional descriptor `setup(io)` hook when present, merging
returned values; document `setup` as optional so a minimal descriptor is
valid and the Protocol is not used as an isinstance guard (Greptile/CodeRabbit P2).
- isolate global-registry mutations with an autouse teardown fixture.
- replace secret-looking test literal to satisfy secret scanners.
Add regression test for config-only field onboarding.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Agent-callable integrations belong in PraisonAI-Tools; lifecycle plugins
in PraisonAI-Plugins. Update issue creation, FINAL review, merge gate,
and CI-fix prompts so PRs like Composio (#2771) are caught early.
Add an optional ChannelDescriptor contract (with ChannelField) to core
protocols so a channel plugin declares its config fields, system-prompt
hint, and setup hook once, and the config schema, onboarding wizard, and
agent prompt pick them up with zero core edits.
- core: ChannelField + ChannelDescriptor in praisonaiagents.bots.protocols
- registry: register_platform(..., descriptor=...) storage + getters incl.
get_platform_descriptor / get_channel_system_prompt_hint and adapter
channel_descriptor fallback
- config schema: extra="allow" so plugin keys are preserved (no longer
silently dropped) + apply_channel_descriptor resolves env fallbacks and
enforces required plugin fields
- onboard: enumerate list_platforms() and render plugin descriptors
Co-authored-by: MervinPraison <[email protected]>
Address reviewer feedback on PR #2800:
- register_approval_backend keeps _channel_send_func and _target coupled so a
backend already owning a sender for another transport is never split (only a
bare backend adopts this channel's sender + default target).
- _handle_approve_callback fails closed on an unknown decision value instead of
letting the backend silently treat it as a deny.
- Drop the redundant approver arg (backend defaults approver to actor).
Adds tests for existing-sender preservation and unknown-decision rejection.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Connect the previously-orphaned durable PresentationApprovalBackend to the
live Telegram interactive-callback path:
- Add TelegramBot.register_approval_backend() to attach the durable backend
with a channel sender (render_presentation) + target so Allow/Deny buttons
render onto the chat.
- Route cmd:/approve <approval_id> <decision> button taps (which decode to the
"command" namespace) to backend.handle_callback(), so decisions resolve
against the SQLite store: single-use, actor-authorised, id-correlated.
- Rehydrate pending approvals on start so a late tap survives a restart.
- Auto-wire a durable backend configured on the agent (--approval presentation)
so the path is reachable without extra user code.
Co-authored-by: MervinPraison <[email protected]>
Add the transport-agnostic building blocks the gateway needs to detect and
reap half-open connections, closing the loop on the advertised-but-inert
heartbeat_ms policy:
- protocols.py: PING/PONG EventType members, a LIVENESS_TIMEOUT
GatewayCloseCode, and a pure, import-free LivenessDecision + LivenessPolicy
(with LivenessPolicyProtocol), mirroring the existing SendPolicy /
DrainTimeoutPolicy / ConcurrencyLimitPolicy pattern. The policy owns only
the KEEP vs REAP decision over (last_activity, now); interval_ms=0 disables
reaping so behaviour is unchanged.
- config.py: opt-in LivenessConfig wired into GatewayConfig (Python + YAML +
status dict) with a to_policy() bridge to the core policy.
- gateway/__init__.py: export the new symbols.
- tests: 19 unit tests for the policy, config bridge and YAML parsing.
Disabled by default, fully backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
- command list --all now includes built-in commands (pass DEFAULT_COMMANDS
to create_default_registry) so listing matches interactive invocation
- registry build failure now stores a sentinel to avoid retrying import on
every slash command (repl.py + async_tui.py)
- custom/skill/mcp commands no longer silently shadow a built-in name in the
registry, since built-ins dispatch before the registry is consulted; the
shadowed definition is logged instead
- add regression test for built-in shadow precedence
Co-authored-by: Mervin Praison <[email protected]>
Fixes an off-by-one flagged in review: undoing a turn checkpointed
before any conversation messages existed called revert_to_message(sid, 0),
which under core HierarchicalSessionStore semantics keeps messages[:1] and
leaves a stale first message. Now clears via an explicit clear primitive
when available, else no-ops safely instead of leaving a ghost message.
Aligns the test fake with real core semantics and adds two edge-case tests.
Co-authored-by: Mervin Praison <[email protected]>
- get_spill_dir: on mkdir failure, fall back to a fresh mkdtemp() instead of
retrying the identical failing path (addresses silent fallback loop)
- bounded_with_pointer: reserve room for the pointer so head+pointer+tail
never exceeds max_output_size
- spill: register atexit cleanup to prune process-created artifacts, avoiding
unbounded temp accumulation in long-running agents
- tests: cover spill-write-failure graceful degradation and preview budget
Co-authored-by: Mervin Praison <[email protected]>
Introduce a CommandRegistry in praisonai-code that aggregates pluggable
command sources (built-ins, .praisonai/commands/*.md custom commands, skills,
MCP prompts, and praisonai.commands entry-point plugins) into one namespace.
Interactive surfaces now drive /name resolution and /help from the registry:
- async_tui._handle_command resolves custom commands via the shared
interpolate_command_template path (byte-for-byte parity with
`praisonai run --command`) and lists them under /help.
- repl._handle_command does the same, merging custom commands into /help.
- `praisonai command list --all` lists the same unified namespace so listing
and invocation cannot drift.
Backward compatible: built-ins are registered as a built-in source and still
dispatch via their existing branches; failures degrade to built-ins only.
Co-authored-by: MervinPraison <[email protected]>
Wire the core HierarchicalSessionStore.revert_to_message primitive into the
CLI session-checkpoint layer so /undo restores files AND rewinds chat_history
to the same turn boundary, keeping workspace and conversation coherent.
Co-authored-by: MervinPraison <[email protected]>
When shell output exceeds max_output_size, persist the full buffer to a
session-scoped artifact and return a bounded head/tail preview plus a
pointer, so the omitted middle (often where the real error lives) can be
inspected via read_file/grep. Zero overhead when within budget; legacy
middle-truncation remains available via spill=False.
Co-authored-by: MervinPraison <[email protected]>
- orchestrator.close(): wrap conversation/knowledge/state close() in _sync()
so async-backend coroutines are awaited instead of discarded (no more
leaked connections / queued writes on shutdown or context-manager exit).
- _factory_wants_tag(): only count positional-capable params so **kwargs-only
sink factories aren't mis-called as factory(tag) and silently dropped.
- finalize_observability(): guard flush() and close() independently so a
raising flush() no longer skips close() and leaks the sink.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: PersistenceOrchestrator sync hooks now drive async-store coroutines to
completion via a _sync() helper (shared _async_bridge.run_sync) instead of
silently discarding them, restoring writes for mode="async" backends.
Gap 2: enable_injection_defense() default threshold lowered CRITICAL -> HIGH to
match the class default and scoring model; scan_text() now NFKC-normalizes,
strips zero-width chars and folds common Cyrillic/Greek homoglyphs before
matching so full-width/zero-width/homoglyph one-liner attacks are blocked.
Gap 3: init_observability() now honours the documented
"praisonai.observability_sinks" entry-point group, wiring discovered sinks
through a _FanoutSink so multiple TraceSinkProtocol sinks coexist;
finalize_observability() flushes/closes them.
Co-authored-by: Mervin Praison <[email protected]>
- endpoints_test now dispatches to the handler's `invoke` command instead
of the nonexistent `test` command, which returned "Unknown command: test"
(EXIT_GENERAL_ERROR). Fixes Greptile P1.
- Replace vacuous `exit_code is not None` with isinstance(int) check and add
regression coverage for `endpoints test`. Fixes Greptile P2 / CodeRabbit nit.
Co-authored-by: Mervin Praison <[email protected]>
- Print command hint to stderr (not stdout) so redirection/scripts can
distinguish diagnostic output from normal output
- Annotate classify_unknown_command as Optional[str]/Sequence[str] to
reflect that None is accepted and complete the signature
- Move `import difflib` to module scope instead of mid-function
Co-authored-by: Mervin Praison <[email protected]>
Route get_wrapper_version() through the sanctioned _wrapper_bridge instead
of a direct `from praisonai.version import __version__`, which violated the
C7/C8 reverse-import boundary and failed check_c7_imports.sh allowlist gate.
The bridge imports the live praisonai.version source module, so editable
installs still match `praisonai --version`, preserving the #2782 fix. Also
removes the now-redundant fallback flagged by Greptile.
Co-authored-by: Mervin Praison <[email protected]>
praisonai endpoints list crashed because the Typer handler re-entered the
full legacy PraisonAI().main() with mutated sys.argv, and the feature module
praisonai_code.cli.features.endpoints referenced by the legacy dispatcher and
doctor check did not exist.
- Add praisonai_code/cli/features/endpoints.py bridge re-exporting
EndpointsHandler / handle_endpoints_command from the praisonai wrapper
(mirrors the existing workflow/tools bridge pattern).
- Replace the broken Typer shim in commands/endpoints.py to dispatch directly
to handle_endpoints_command instead of PraisonAI().main().
- Add regression tests for the bridge and list dispatch.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
`praisonai show` (and other reserved/mistyped single-word verbs) were silently
routed to handle_direct_prompt, incurring a ~10s paid LLM call instead of a
"command not found" error.
Add classify_unknown_command() in argparse_builder to detect reserved verbs
(e.g. `show`) and obvious typos of known commands via difflib, and fail fast
with a hint + exit code 2 in parse_args before treating the token as a
one-shot prompt. Multi-word natural-language prompts remain unaffected.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
praisonai doctor showed misleading "Fix bot.yaml syntax" remediations for
5 bot/gateway checks when the real cause was the optional praisonai-bot
package not being installed. Add a skip_if_no_bot_package guard so these
schema-dependent checks are skipped with an actionable install hint
(pip install 'praisonai[bot]') instead of failing.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Address greptile p2 review comments on #2778:
- Only swallow the Knowledge(verbose=) TypeError when the message
confirms it's about verbose; re-raise otherwise so unrelated
errors surface instead of being masked.
- Warn the user when inspect.signature fails so a silently dropped
verbose flag is visible.
Co-authored-by: Mervin Praison <[email protected]>
Knowledge.search() returns a typed SearchResult dataclass, but the CLI
search paths only checked for dict/list and fell through, passing the
dataclass to .get()/subscript access and raising "'SearchResult' object
is not subscriptable".
Normalize results via SearchResult.to_legacy_format() in both the
`knowledge search` and top-level `search` commands, plus regression tests.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
The `praisonai query` command passed retrieval_config= to Agent.__init__,
which the Agent-first API does not accept (RAG is consolidated under
knowledge=/_retrieval_config), crashing every invocation with TypeError.
- Drop the invalid retrieval_config= kwarg
- Build Agent kwargs via inspect.signature so only supported params are
passed, mapping verbose -> output= on newer Agent APIs
- Attach agent._retrieval_config so .query()/.rag use the intended config
- Add regression tests
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
The legacy argparse router hijacked the top-level `search` command and only
accepted --max-results (web search). Documented KB-retrieval flags
(--collection, --top-k, --hybrid) failed with 'unrecognized arguments'.
handle_search now detects retrieval flags and delegates to the Typer
retrieval.search_command, while preserving the web-search default for plain
queries. Backward-compatible; typer is only imported on the retrieval path.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- computer_screenshot(path=...) now requires approval before writing to disk
(P1 security: closes arbitrary-file-overwrite bypass of the safety gate)
- computer_type reports actual ASCII chars typed vs total (pyautogui drops non-ASCII)
- computer_key rejects empty/invalid key strings instead of silent no-op
- computer_scroll rejects invalid directions instead of defaulting to down
- add tests covering the above
Co-authored-by: Mervin Praison <[email protected]>
Add computer_tools.py providing agent-callable screen control
(screenshot, click, type, key, scroll, move) following the
schedule_tools pattern. Control actions require an explicit
human-approval callback (safe by default) and the pyautogui
backend is lazy-imported as an optional dependency, so there
is no Agent class bloat and no import-time cost.
Co-authored-by: Mervin Praison <[email protected]>
Top-level --help renders each subcommand's own Typer help= (Click's default
format_commands loads the module), not the _LAZY_COMMANDS tuple description.
dashboard/langfuse wrapper modules still had emoji help, so cp1252 consoles
could still crash. Strip those emoji and add a cp1252-encodability regression
test (excluding Rich box-drawing chars, which Rich downgrades automatically).
Co-authored-by: Mervin Praison <[email protected]>
Emoji prefixes in _LAZY_COMMANDS and the ui/port command help strings
caused UnicodeEncodeError when praisonai-code --help was rendered on a
Windows cp1252 console. Replace them with ASCII-safe text and add a
regression test asserting the help output contains no emoji.
Co-authored-by: Mervin Praison <[email protected]>
truncate_context computed a byte cut point as `max_tokens * 4` and sliced
`&context[..char_limit]` directly. When the context contains multi-byte
UTF-8 (CJK, accents, emoji), that byte index can land inside a character,
panicking with "byte index N is not a char boundary". Walk the index back
to the nearest char boundary before slicing. Fixes both the free function
and the RAG::truncate_context method; ASCII output is unchanged.
Post structured @claude comments when internal PRs fail Core Tests, with
extracted pytest failures, critical review verdict requirements, and SDK
guardrails against weakening tests. Hooks into pipeline label sync and
workflow_run for fast response.
test_queue_or_execute_when_not_processing spawned real daemon threads
via _execute_in_background that made live LLM calls and logged to stderr
after the test's pytest capture stream was closed, intermittently failing
a later unrelated test (test_config_list) with "I/O operation on closed
file". Mock _execute_in_background so the test only verifies its intended
behavior without leaking threads or making network calls.
Co-authored-by: Mervin Praison <[email protected]>
- Assign temp_path before json.dump so temp file is cleaned up if json.dump
raises IOError mid-write (disk full)
- Catch TypeError/ValueError from json.dump so non-serializable data returns
False + cleans up temp file instead of leaking an unhandled exception
Co-authored-by: Mervin Praison <[email protected]>
Factor the debug-logging predicate out of _log_llm_config into a cheap
_should_log_config() and guard the get_response / get_response_async call
sites with it, so the ~40 attribute reads, two argument dicts and
str(kwargs) serialisation are only performed when DEBUG (or verbose>=10)
logging is actually enabled. Behaviour is byte-for-byte identical when
logging is on; masking/truncation formatting is unchanged.
Co-authored-by: MervinPraison <[email protected]>
Agent's class-body _truncate_chat_history shadowed the MemoryMixin copy
via MRO, creating a silent drift hazard between two divergent lock idioms.
Delete Agent's duplicate so the inherited MemoryMixin implementation is the
single source of truth. Behavior is unchanged ([:length] semantics preserved,
verified thread-safe via the re-entrant AsyncSafeState/DualLock RLock), the
mixin stays standalone-usable, and agent.py shrinks.
Co-authored-by: MervinPraison <[email protected]>
Extract a single _atomic_write_json helper and use it from
_modify_session_locked, _save_session, and add_message. This removes
~25 duplicated lines and harmonises the makedirs discrepancy where
_save_session previously lacked directory creation.
Co-authored-by: MervinPraison <[email protected]>
Restores the --dry-run option to docs_generate whose parameter was
accidentally removed while two references to dry_run remained in the
body (guaranteed NameError). Also removes spurious blank lines in
docs_run call, cli_run_all signature, and the executor dry_run block.
Co-authored-by: Mervin Praison <[email protected]>
Agent BEFORE_AGENT/BEFORE_TOOL hook post-processing read res.output.modified_data,
but HookRunner returns HookExecutionResult whose .output is a HookResult which has
modified_input (not modified_data). This was dormant because Agent._hook_runner
previously used an empty registry; the plugin bridge switched it to the populated
default registry, surfacing an AttributeError once any hook is registered.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #2744:
- set_chat_history / clear_session now clear last_compaction so a replaced
transcript is not misread as a compacted tail (fixes silent message drop
via api.save_state()).
- _persist_compaction_checkpoint writes to _history_session_id (matching the
resume read path) to avoid key divergence when both session_id and
MemoryConfig(session_id) are supplied.
- append_compaction_checkpoint treats blank summaries as a no-op, preventing
an empty system message from being replayed on resume.
- Added regression tests for all three paths.
Co-authored-by: Mervin Praison <[email protected]>
Close the loop between in-run context compaction and session persistence so
`--continue`/`session resume` reconstructs the compacted context (summary +
retained tail) instead of replaying the raw transcript.
Core changes (praisonaiagents/session/store.py):
- Add optional CompactionCheckpoint dataclass + SessionData.last_compaction,
serialized atomically alongside messages (backward compatible).
- Add DefaultSessionStore.append_compaction_checkpoint() and get_working_history();
SessionData.get_working_history() falls back to raw history when no checkpoint.
- SessionData.trim_messages() keeps the checkpoint anchor aligned when the
transcript head is trimmed to max_messages.
Integration:
- agent/chat_mixin.py: persist the summary after a successful in-run compaction
(guarded: only when a session store + session_id are bound and a summary exists),
and prefer get_working_history() when injecting resumed history.
- agent/memory_mixin.py: restore compacted working history on resume, falling back
to raw chat history for pre-existing sessions.
Tests: add TestCompactionCheckpoint (roundtrip, persist, working-history
reconstruction, backward-compat, cross-instance, trim-shift, empty-summary) and
update history-injection mocks for the new resume path.
Co-authored-by: MervinPraison <[email protected]>
- openai_client.py: work on a local copy of messages in both sync/async
tool loops so the graceful wrap-up control message never leaks into the
caller's conversation history (Greptile P1).
- agent.py: last_stop_reason reads the raw name-mangled __openai_client
attribute (never the lazy property), guaranteeing no OpenAI client is
created for LiteLLM-only agents (Greptile P1).
- feature_configs.py: decouple resolved_max_tool_calls() from max_steps so
the per-turn parallel tool-call guardrail stays independent of the outer
loop budget (Greptile P2).
- tests: cover messages non-mutation, agent.last_stop_reason == max_steps
via the Agent API, and no lazy client creation on read.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on the run-status controller:
- _use_reactions() now also honours a truthy/falsy `reactions` field
(attribute or dict-style ChannelCapabilities) so capability gating is
no longer a no-op with non-supports_reactions caps.
- StallWatchdog logs a warning when hard_s < soft_s instead of silently
clamping, keeping the existing clamp behaviour backward-compatible.
- Test helper _run() uses a fresh event loop instead of the deprecated
asyncio.get_event_loop() pattern (warns on 3.10+, raises on future).
- Add caps-gating tests for dict-style and attribute-style reactions.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Add a pure, transport-agnostic RunStatusController and StallWatchdog in core
bots/ that advance an in-chat reaction (or status-label edit) through the run
lifecycle (queued -> thinking -> tool -> done/error) with debounced intermediate
transitions and immediate terminal ones, plus soft/hard stall signals when a run
goes quiet. Capability-gated (reactions vs label), off by default, opt-in.
Co-authored-by: MervinPraison <[email protected]>
Addresses Greptile P1/P2 review feedback on PR #2757:
- P1: RulesConfig.files was advertised but silently ignored. Add a public
RulesManager.add_rule_file() (heavy impl stays in the manager, not Agent)
supporting concrete paths and globs, and consume config.files in
_init_rules_manager before the discovery gate so workspaces whose only
rules are explicit files are not dropped.
- P2: get_rules_context() used a falsy check on char_budget, treating
char_budget=0 as "no budget"; use `is not None`.
- Add RulesConfig to feature_configs __all__ for export consistency.
Co-authored-by: Mervin Praison <[email protected]>
Wire the dormant RulesManager into the Agent run path so AGENTS.md,
CLAUDE.md and .praisonai/rules/*.md are discovered and injected into the
system prompt automatically. Adds a consolidated rules= param
(None/True=auto-apply, False=opt out, RulesConfig=custom) with
discovery-gated activation for zero-config, zero-cost runs.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback (Greptile P1/P2, CodeRabbit Major) on PR #2755:
- _mentions_self now matches on whole identifier components instead of bare
substring, so unrelated services (api-gateway, kong-gateway) are no longer
denied while the real praisonai-gateway unit still matches.
- Default process_names drops the over-generic "gateway" token; "praisonai"
(specific) is the default, with the CLI-form rule catching the gateway
sub-command.
- Rule 1 (CLI form) now honours process_names and enforces the documented
<cli> gateway <verb> adjacency instead of loose membership.
- Removed phantom _KILL_CMDS entries kill9/kill-9 (not real executables).
- Added regression tests for the false-positive cases, custom-CLI rule-1
coverage, and adjacency.
Co-authored-by: Mervin Praison <[email protected]>
Add a pure, import-free LifecycleCommandGuardPolicy + protocol in core
gateway/protocols.py that default-denies agent-issued commands whose effect
is to stop/restart/kill this gateway process (self-DoS via shell tool or
scheduled job). Command-anchored matching avoids prose false positives; on
by default, opt-outable.
Co-authored-by: MervinPraison <[email protected]>
Introduces a dependency-free, inheritable BasePlatformAdapter (ABC) plus a
SendResult dataclass in the core SDK (praisonaiagents.bots.base). New channels
now implement a minimal 4-method contract (connect/disconnect/send/
get_chat_info) and inherit capability-driven default delivery: long-message
chunking, typing heartbeat, retry/backoff honouring retry_after, and graceful
edit/delete "not supported" fallbacks — all keyed off PlatformCapabilities.
Co-authored-by: MervinPraison <[email protected]>
Address greptile P2 feedback on test_interrupt.py: the _make_llm skip
guard now catches all exceptions on LLM construction (not just
ImportError) so partial litellm installs skip cleanly instead of
failing, and the file ends with a trailing newline.
Co-authored-by: Mervin Praison <[email protected]>
- disable() now unwires previously-registered hooks from the runtime
registry (adds unwire_from_hook_registry + tracks wired hook IDs), so
disabling a plugin actually stops its lifecycle methods from firing
- re-enable after disable correctly re-wires (sentinel reset on unwire)
- guard tool_input/tool_definitions mutation with isinstance instead of
hasattr to avoid AttributeError/TypeError when those fields are None
- hoist repeated `import logging` in plugins.enable() to a single import
- merge duplicate typing imports in manager.py
- add tests: disable-after-wire, re-enable, None tool_input no-crash
Co-authored-by: Mervin Praison <[email protected]>
- loader: defer prefix decision until actual loaded instances counted so a
lone surviving server (others yielding None) keeps bare names (backward compat)
- loader: catch identical-name collisions, not just differently-sanitized ones
- loader: delegate sanitization to MCP._sanitize_prefix (single source of truth)
- loader: use new public MCP.apply_tool_filters instead of private internals
- mcp: add public apply_tool_filters() contract
- mcp: with_tool_prefix() raises on empty prefix instead of silently skipping
- mcp: _apply_prefix_to_openai_tools returns copies (idempotent, no in-place mutation)
- tests: add identical-name collision + single-loaded-instance backward-compat tests;
fake MCP delegates to real sanitizer and mirrors public filter API
Co-authored-by: Mervin Praison <[email protected]>
Implement the previously no-op prefix_tools contract in load_mcp_tools:
- Add MCP.with_tool_prefix() to namespace tool names (schema + callable)
while dispatch still routes to original server-side names.
- Wire prefixing in the loader when >1 server is loaded; keep bare names
for single-server loads (backward compatible).
- Honour include/exclude tool filters per server.
- Detect duplicate server-name collisions and raise a clear error.
- Update docstring; add unit tests.
Co-authored-by: MervinPraison <[email protected]>
- _summarise_overflow now forwards the prior summary text and accumulates a
running compacted_count so repeated rollups don't collapse to "2 messages"
(Greptile P1: context lost after 2nd compaction).
- Use len(to_archive) for compacted_count/log so re-compaction doesn't overstate
(Greptile P2).
- Early return in _enforce_window when only the prior summary overflows with no
new raw turns, avoiding a redundant rollup and misleading "compacted 0" log
(CodeRabbit Major).
- Warn once when archived_messages exceeds ARCHIVE_WARN_THRESHOLD (Greptile P2).
- Strengthen compaction-logging test to exact count + add running-count test.
Co-authored-by: Mervin Praison <[email protected]>
DefaultSessionStore silently dropped the oldest turns beyond 100 messages
on every write, permanently losing early context on session resume.
Introduce a retention policy:
- "compact" (new default): summarise overflow into one synthetic summary
message (reusing the deterministic ContextCompressor summariser) and
archive the raw turns in a durable append-only archive — nothing is
silently dropped.
- "truncate": legacy hard-slice behaviour.
- "keep_all": never trim the active window.
Explicit non-default max_messages keeps the legacy truncate behaviour for
backward compatibility. Rollups are logged once. Retention/active_window
are configurable via constructor args and PRAISONAI_SESSION_RETENTION /
PRAISONAI_SESSION_ACTIVE_WINDOW env vars for CLI/YAML surfaces.
Co-authored-by: MervinPraison <[email protected]>
Thread a cancel token into get_response/get_response_async and check it at
the top of each tool iteration so /stop promptly halts a mid-flight run on
every litellm provider (Anthropic, Gemini, Groq, local, ...), matching the
existing OpenAI-path behaviour. chat_mixin passes the active interrupt
controller through to the loop.
Co-authored-by: MervinPraison <[email protected]>
Installed/enabled plugins were discovered via the praisonai.plugins entry-point
group but never invoked, because the Agent's HookRunner defaulted to a fresh
empty registry. This wires the two systems together:
- Add PluginManager.wire_into_hook_registry() plus a Plugin -> HookDefinition
adapter that maps overridden lifecycle methods (before/after agent, llm, tool,
message, permission) onto the runtime hook engine, honouring in-place payload
mutation (e.g. PII redaction on AFTER_LLM).
- Default Agent._hook_runner to the global default registry so bridged plugins
fire during real agent/bot execution.
- Wire enabled plugins into the registry from plugins.enable().
- Remove the duplicate discover_entry_points (keep the praisonai.plugins group).
Co-authored-by: MervinPraison <[email protected]>
Consolidate the two divergent tool-call caps (OpenAI-native max_iterations=10
and LiteLLM max_iter=20 / max_tool_calls_per_turn=10) behind a single
ExecutionConfig.max_steps knob honoured identically by both loops.
- Add ExecutionConfig.max_steps + resolved_max_steps()/resolved_max_tool_calls()
helpers (backward compatible: unset falls back to max_iter/per-turn cap).
- Wire both tool-execution loops to the same budget via chat_mixin resolvers
and agent.py (LLM.max_iter now derives from resolved_max_steps()).
- Inject a graceful wrap-up instruction on the final permitted step so the
model produces a coherent final answer instead of being hard-cut.
- Surface a structured stop reason (completed | max_steps) via
agent.last_stop_reason so CLI/CI callers can branch on truncation instead
of parsing a magic string.
- Add tests locking both backends to identical budget behaviour, plus a
real agentic test gated on OPENAI_API_KEY.
Co-authored-by: MervinPraison <[email protected]>
- agents_generator: validate both the YAML-declared framework and the instance
framework in _build_yaml_workflow so a non-native workflow YAML (e.g.
framework: crewai) can no longer bypass validation when the generator holds
the default 'praisonai' (CodeRabbit).
- mcp_server/registry: run lazy loaders while holding a re-entrant lock across
all three registries so a concurrent caller blocks until loading completes
instead of observing an empty/partial registry mid-load (Greptile).
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: WorkflowAutoGenerator._save_workflow now writes self.framework
instead of hardcoded 'praisonai', so framework="crewai" is persisted.
Gap 2: agenerate_crew_and_kickoff routes blocking config load and
run-preparation (heavy imports + adapter.setup) through asyncio.to_thread
via new _aload_config/_aprepare_for_run helpers. Collapsed the duplicated
_run_yaml_workflow/_arun_yaml_workflow into a shared _build_yaml_workflow
builder + _finalise_workflow_result helper.
Gap 3: MCPToolRegistry/MCPResourceRegistry/MCPPromptRegistry guard their
lazy-loader state with a threading.Lock and use an atomic swap in
_ensure_loaded, fixing the mutation-during-iteration / double-run race.
Co-authored-by: MervinPraison <[email protected]>
2026-07-07 08:20:50 +00:00
1771 changed files with 185743 additions and 25089 deletions
<p><strong>v4.6.113</strong> — three Python packages, strict dependency direction, and <strong>C8 complete</strong>: reverse wrapper imports eliminated from <code>praisonai-code</code>. Tap the diagrams; tables hold the rules.</p>
<!-- /wp:paragraph -->
<!-- wp:quote -->
<blockquoteclass="wp-block-quote"><p><strong>One rule (unchanged):</strong><code>praisonai-code</code> never lists <code>praisonai</code> in <code>pyproject.toml</code>. Wrapper access is <strong>bridge-only</strong> via <code>_wrapper_bridge</code> — zero direct <code>from praisonai</code> imports remain.</p></blockquote>
<blockquoteclass="wp-block-quote"><p><strong>C8 change:</strong> 30+ commands are <code>_WRAPPER_RESIDENT</code> — implementation lives only in the wrapper; code package routes lazily with no duplicate modules.</p></blockquote>
<figureclass="wp-block-table"><table><thead><tr><th>Gate</th><th>Check</th><th>Status</th></tr></thead><tbody><tr><td>Hot path</td><td>No module-level wrapper import in main/app/run/chat/code</td><td>✅</td></tr><tr><td>Strict</td><td>Zero wrapper imports in app/run/chat/code</td><td>✅</td></tr><tr><td>Baseline</td><td>≤ <strong>50</strong> direct import lines (current: <strong>0</strong>)</td><td>✅</td></tr><tr><td>Allowlist</td><td>Any offender must be listed (list is empty)</td><td>✅</td></tr><tr><td>Smoke</td><td>Standalone <code>praisonai-code run</code></td><td>✅</td></tr></tbody></table></figure>
<figureclass="wp-block-table"><table><thead><tr><th>Milestone</th><th>State</th><th>Release</th></tr></thead><tbody><tr><td>C7 hot path</td><td>✅ Complete</td><td>—</td></tr><tr><td>C7.1 boundaries</td><td>✅ Complete</td><td>v4.6.110</td></tr><tr><td><strong>C8 reverse imports</strong></td><td>✅ Complete</td><td><strong>v4.6.113</strong></td></tr><tr><td>C8.4 full main.py split</td><td>⏳ Deferred</td><td>Future</td></tr><tr><td>PyPI splits (bot / frameworks)</td><td>⏳ Out of scope</td><td>—</td></tr></tbody></table></figure>
<p>praisonai-mcp is Tier 2e — the heavy MCP server host: full <code>MCPServer</code>, tool/resource/prompt registries, recipe bridge, HTTP-stream auth, and MCP client config management. Depends only on <code>praisonaiagents</code>. v0.0.2. Protocol: MCP 2025-11-25.</p>
<figureclass="wp-block-table"><table><thead><tr><th>Registry</th><th>Commands</th><th>Gate</th></tr></thead><tbody><tr><td>MCP-resident Typer</td><td>list, add, remove, sync, test, serve, doctor</td><td><code>mcp_package_available()</code></td></tr><tr><td>MCPServerCLI host</td><td>serve, list-tools, list-resources, config-generate, tasks, auth</td><td>Direct via <code>praisonai-mcp <cmd></code></td></tr><tr><td>Code-resident light</td><td><code>serve mcp</code></td><td>Always available with code + agents</td></tr><tr><td>Wrapper-resident</td><td>dashboard, schedule, langfuse</td><td><code>wrapper_package_available()</code></td></tr></tbody></table></figure>
<!-- /wp:table -->
<!-- wp:paragraph -->
<p>Standalone <code>praisonai-code</code> hides <code>mcp</code> from <code>--help</code> when <code>praisonai-mcp</code> is not installed. Host commands like <code>praisonai-mcp serve</code> skip the <code>mcp</code> prefix; <code>praisonai mcp serve</code> goes through the Typer group.</p>
<p>Heavy MCP hosting needs only <code>praisonaiagents</code> + <code>praisonai-mcp</code>. Full capability registry (workflows, deploy, extended tools) activates when the wrapper is co-installed via <code>_wrapper_bridge</code>.</p>
<!-- /wp:paragraph -->
<!-- wp:heading -->
<h2class="wp-block-heading">Bridges (no PyPI cycles)</h2>
<p>Wrapper pins <code>praisonai-mcp>=X</code> after mcp is on PyPI. CI: <code>.github/workflows/pypi-release.yml</code>. Import gate: <code>scripts/check_c12_mcp_imports.sh</code>.</p>
<p>praisonai is Tier 3 — the integration wrapper that wires <code>praisonaiagents</code> + five Tier-2 packages (<code>praisonai-code</code>, <code>praisonai-bot</code>, <code>praisonai-train</code>, <code>praisonai-browser</code>, <code>praisonai-mcp</code>) into one install, with dashboard, framework adapters, jobs API, serve orchestration, and backward-compat shims. v4.6.150.</p>
<p>Each Tier-2 package is installable standalone with its own console script. The wrapper pins all of them and preserves every old import path via shims. Use the wrapper when you need several surfaces together — HTTP serve, dashboard, framework YAML, jobs/recipe — without managing tier pins yourself.</p>
<p>Protocols live in <code>praisonaiagents/frameworks/</code>; adapter implementations in wrapper <code>framework_adapters/</code>. Entry-point group: <code>praisonai.framework_adapters</code>.</p>
<figureclass="wp-block-table"><table><thead><tr><th>Package</th><th>Status</th><th>Choose when…</th><th>Standalone install (planned)</th></tr></thead><tbody><tr><td><code>praisonai-sandbox</code></td><td><strong>C13 preferred</strong> (execution goal)</td><td>Isolated agent code execution — Docker/E2B/Modal/Daytona/Sandlock</td><td><code>pip install praisonai-sandbox[docker]</code></td></tr><tr><td><code>praisonai-deploy</code></td><td><strong>C13 alt</strong> (deploy goal)</td><td>Ship <code>agents.yaml</code> to Docker/AWS/GCP/Azure</td><td><code>pip install praisonai-deploy</code></td></tr><tr><td><code>praisonai-replay</code></td><td>Conditional C14+</td><td>Deterministic replay from run ledger / traces</td><td>After product sign-off</td></tr><tr><td><code>praisonai-serve</code></td><td>Deferred C15</td><td>HTTP API hosting without full umbrella (~14k LOC)</td><td>With recipe/jobs decision</td></tr><tr><td><code>praisonai-recipe</code></td><td>Deferred</td><td>NL → agent YAML without jobs UI</td><td>Tied to jobs + serve</td></tr><tr><td><code>praisonai-jobs</code></td><td>Deferred</td><td>Async long-running agent jobs API</td><td>Extract with serve or stay wrapper</td></tr></tbody></table></figure>
<!-- /wp:table -->
<!-- wp:paragraph -->
<p>C13 decision rule: <strong>sandbox</strong> = where code runs; <strong>deploy</strong> = where the agent service lives. Ship one first after product sign-off.</p>
<figureclass="wp-block-table"><table><thead><tr><th>Criterion</th><th>Pass (browser/MCP)</th><th>Fail (example)</th></tr></thead><tbody><tr><td>Named user goal without full <code>praisonai</code></td><td><code>pip install praisonai-browser</code> → automate Chrome</td><td><code>pip install praisonai-persist</code> → ???</td></tr><tr><td>Coherent product boundary</td><td>One Typer group / one console script</td><td>Whole <code>cli/features/</code> orchestration layer</td></tr><tr><td>PyPI deps: <code>praisonaiagents</code> only</td><td>Tier-2 + lazy <code>_wrapper_bridge</code></td><td>Hard <code>import praisonai</code> at module level</td></tr><tr><td>Worth a separate install</td><td>User who never wants dashboard/serve/bots</td><td>Internal docs tooling</td></tr><tr><td>Extraction shape</td><td>C10 single PR (~3–11k LOC)</td><td>Mega-epic without product sign-off</td></tr></tbody></table></figure>
<!-- /wp:table -->
<!-- wp:heading -->
<h2class="wp-block-heading">When to use which tier</h2>
<!-- /wp:heading -->
<!-- wp:table -->
<figureclass="wp-block-table"><table><thead><tr><th>Scenario</th><th>Install</th></tr></thead><tbody><tr><td>Pure Python agents, minimal deps</td><td><code>pip install praisonaiagents</code></td></tr><tr><td>Terminal coding agent, CI, headless</td><td><code>pip install praisonai-code</code></td></tr><tr><td>Telegram/Discord gateway only</td><td><code>pip install "praisonai-bot[gateway,bot]"</code></td></tr><tr><td>Agent training (no GPU)</td><td><code>pip install praisonai-train</code></td></tr><tr><td>LLM fine-tuning (GPU)</td><td><code>pip install "praisonai-train[llm]"</code></td></tr><tr><td>MCP server for Cursor/Claude</td><td><code>pip install "praisonai-mcp[all]"</code></td></tr><tr><td>Browser automation (extension/CDP)</td><td><code>pip install "praisonai-browser[all]"</code></td></tr><tr><td>CrewAI/AutoGen YAML</td><td><code>pip install "praisonai[crewai]"</code></td></tr><tr><td>Full ops + channels + dashboard</td><td><code>pip install "praisonai[claw]"</code></td></tr><tr><td>Everything in one install</td><td><code>pip install praisonai</code></td></tr><tr><td>Library author / embedding</td><td><code>praisonaiagents</code> only</td></tr></tbody></table></figure>
Before implementing anything, answer these questions:
- CORE vs WRAPPER vs TOOLS ROUTING:
- CORE vs WRAPPER vs TOOLS vs PLUGINS ROUTING:
1. Core SDK (praisonaiagents/): Only core protocols, base classes, decorators. No heavy implementations.
2. Wrapper (praisonai/): CLI, heavy implementations, optional dependencies.
3. Tools (PraisonAI-Tools): Specific integrations, external tools (e.g. SurrealDB, Slack), and community extensions MUST go to the `MervinPraison/PraisonAI-Tools` repository. If the feature is a tool, clone `https://github.com/MervinPraison/PraisonAI-Tools`, implement it there, and create the PR using `gh pr create -R MervinPraison/PraisonAI-Tools`.
3. Tools → MervinPraison/PraisonAI-Tools: agent-callable integrations at runtime (Composio, Slack, APIs). Do NOT add to praisonaiagents/.
'Before changing code or tests, decide **which side is wrong**:',
'1. **Legitimate feature change** — the PR intent is correct but implementation or tests need updating. Preserve SDK guarantees; update tests only when behaviour intentionally changed and document why.',
'2. **Regression / bug in this PR** — the failure exposes a real breakage introduced here. Fix the implementation; **do not weaken, skip, or delete tests** just to go green.',
'3. **Pre-existing flake or unrelated failure** — say so explicitly; prefer fixing the root cause over masking it.',
@@ -267,7 +308,7 @@ function finalClaudeCompletedOnSha(comments, headPushedAt) {
}
constFINAL_CLAUDE_REVIEW_BODY=
'@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep\n5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.\n\n**Phase 2: FIX Valid Issues**\n5. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n6. Push all code fixes directly to THIS branch (do NOT create a new PR)\n7. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n8. If all issues are resolved, approve the PR / close the Issue\n9. If blocking issues remain, request changes / leave clear action items';
'@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep\n5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.\n6. Repo routing: agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (`praisonai.sandbox` entry point) — request changes if wrongly added to praisonaiagents/\n\n**Phase 2: FIX Valid Issues**\n7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n8. Also independently identify and fix any gaps or issues you find in the changed code — do not rely only on prior reviewer feedback\n9. Push all code fixes directly to THIS branch (do NOT create a new PR)\n10. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n11. If all issues are resolved, approve the PR / close the Issue\n12. If blocking issues remain, request changes / leave clear action items';
body: '🤖 Auto-triaging with Claude. Analyzing issue and implementing a fix...\n\nClaude will:\n1. Classify this issue\n2. Search codebase for root cause\n3. Implement a minimal fix following AGENTS.md\n4. Create a PR with the changes'
body: '🤖 Auto-triaging with Claude. Analyzing issue and implementing a fix...\n\nClaude will:\n1. Route correctly: agent tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins\n2. Search codebase for root cause\n3. Implement a minimal fix following AGENTS.md\n4. Create a PR with the changes'
1. Read AGENTS.md and the PR diff on the current branch.
2. Read all PR comments and reviews (FINAL architecture reviewer / Lead Engineer must have run).
3. Confirm SDK value gate: change strengthens praisonaiagents (no scope creep).
4. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
5. If agent.py adds >100 lines or new Agent __init__ params, respond MERGE_GATE_VERDICT: BLOCK (manual review required).
6. BLOCK if labels security/breaking-change/needs-manual-review/release, sensitive paths (.github/workflows, auth, pyproject.toml), secrets in diff, PR >800 lines or >30 files, or SDK changes without tests. Label `merge-gate-ci-only` exempts CI-only changes under `.github/workflows/`, `.github/actions/`, or merge-gate scripts.
7. Confirm no CHANGES_REQUESTED reviews and CI green on HEAD ${{ matrix.head_sha }}.
8. If ready to merge: MERGE_GATE_VERDICT: APPROVE. Otherwise: MERGE_GATE_VERDICT: BLOCK with reasons.
3. Confirm SDK value gate: change strengthens praisonaiagents (no scope creep). The aim is a LIGHTWEIGHT AND POWERFUL package — BLOCK changes that add params/modules/exports duplicating existing Agent capabilities (instructions/backstory/tools/hooks/memory), or add knobs/fields with no live consumer, i.e. scope creep for the sake of it.
4. Repo routing: BLOCK if agent-callable tools (→ PraisonAI-Tools), lifecycle plugins (→ PraisonAI-Plugins), or optional sandbox backends (→ PraisonAI-Plugins via `praisonai.sandbox`) wereadded to praisonaiagents/ instead of the external repo.
5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
6. If agent.py adds >100 lines or new Agent __init__ params, respond MERGE_GATE_VERDICT: BLOCK (manual review required).
7. BLOCK if labels security/breaking-change/needs-manual-review/release, sensitive paths (.github/workflows, auth, pyproject.toml), secrets in diff, PR >800 lines or >30 files, or SDK changes without tests. Label `merge-gate-ci-only` exempts CI-only changes under `.github/workflows/`, `.github/actions/`, or merge-gate scripts.
8. Confirm no CHANGES_REQUESTED reviews and CI green on HEAD ${{ matrix.head_sha }}.
9. If ready to merge: MERGE_GATE_VERDICT: APPROVE. Otherwise: MERGE_GATE_VERDICT: BLOCK with reasons.
Do not approve or merge via GitHub UI/API — only post the verdict comment.
disallowed_tools:|
@@ -309,8 +309,9 @@ jobs:
Read
timeout_minutes:15
- name:Post fallback verdict if Claude did not comment
- name:Post fallback BLOCK if Opus did not comment
Read AGENTS.md to understand the architecture rules.
SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify or touch praisonai-rust or praisonai-ts packages.
AIM: This package must stay LIGHTWEIGHT AND POWERFUL. Do a CRITICAL REVIEW at each stage (issue triage, fix planning, PR review/implementation) and reject scope creep for the sake of adding features. Prefer existing Agent capabilities (instructions/backstory/tools/hooks/memory) over new params/modules/exports. Even when fixing a raised issue, keep the fix minimal and lightweight — do NOT expand the surface area or add knobs with no live consumer.
3. Tools → MervinPraison/PraisonAI-Tools: agent-callable integrations at runtime (Composio, Slack, API/DB connectors). Do NOT implement in praisonaiagents/ — use STEP 3-ALT.
4. Documentation (PraisonAIDocs): Documentation pages, guides, API references.
5. Plugins → MervinPraison/PraisonAI-Plugins: framework lifecycle extensions (tracing, logging, metrics, hooks, guardrails). Not agent tools — use STEP 3-ALT.
6. Sandbox backends (optional/niche, e.g. Capsule) → PraisonAI-Plugins via `praisonai.sandbox` entry point; core keeps protocol/config/manager only.
For items routed to an EXTERNAL repository (Tools, Docs, Plugins), follow STEP 3-ALT below.
- Does it duplicate existing functionality? Check if Agent already supports this via existing params (reflection, planning, tools, hooks, memory).
- Does it duplicate existing functionality? Check if Agent already supports this via existing params (reflection, planning, tools, hooks, memory). If it does, reject the change as scope creep and prefer the existing capability — the aim is lightweight and powerful, not more knobs.
- Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
- Does it inherit from Agent properly? New agent types MUST inherit Agent, not wrap it with composition.
- Does it add new dependencies? Only optional deps allowed, must be lazy-imported.
@@ -7,5 +7,9 @@ You are working on the PraisonAI project.
- Be concise and helpful in responses
- Test implementation thoroughly
- Ensure backward compatibility with existing APIs
- Follow protocol-driven design: core protocols in `praisonaiagents/`, agentic terminal CLI in `praisonai-code/`, bot/channel and heavy implementations in`praisonai/`
- Preserve old `praisonai.cli.*` import paths via shims when changing moved CLI code (see §2.3 in `src/praisonai-agents/AGENTS.md`)
- Follow protocol-driven design across the nine packages: core protocols in `praisonaiagents/`, agentic terminal CLI in `praisonai-code/`, bots/gateway in `praisonai-bot/`, LLM fine-tuning + agent training in `praisonai-train/`, browser automation in `praisonai-browser/`, MCP server host in `praisonai-mcp/`, sandbox backends in `praisonai-sandbox/`, deployment in `praisonai-deploy/`, integrations/serve/dashboard in the`praisonai/` wrapper
- Preserve old `praisonai.*` import paths via shims when moving code between packages (see §2.3 in `src/praisonai-agents/AGENTS.md`; shim helpers in `src/praisonai/praisonai/cli/_shim.py`)
- Package boundaries and dependency rules: `ARCHITECTURE.md` §2 (Tier 2 packages must never PyPI-depend on the wrapper; cross-tier access goes through lazy `_*_bridge` modules)
- When reviewing a PR or an issue, evaluate whether the change addresses a framework concern or a user goal, and design its surface (params, naming, defaults) accordingly
- The aim of this package is to stay **lightweight and powerful**. Do a critical review at each stage — when triaging an issue, when planning a fix, and when reviewing/implementing a PR. Reject scope creep for the sake of adding features: if a capability already exists (e.g. via existing Agent params like `instructions`/`backstory`/`tools`/`hooks`/`memory`), prefer it over a new API surface. A change must genuinely strengthen the SDK (simpler, more robust, more user-friendly) — do not add knobs, params, modules, or exports that have no live consumer or that merely duplicate existing behaviour.
| 2a | `src/praisonai-code/` | `run`/`chat`/`code`, Typer, runtime, LLM, tool resolution | **`praisonai` as a PyPI dependency** (optional lazy imports via `_wrapper_bridge` only) |
| 2b | `src/praisonai-bot/` | Bots, gateway, channel CLI, OS daemon, gateway scheduler tick | **`praisonai` as a PyPI dependency** (optional lazy `_wrapper_bridge` for jobs/UI) |
| 3 | `src/praisonai/` | `framework_adapters/`, train, serve, dashboard, async jobs API | — |
| 2c | `src/praisonai-train/` | LLM fine-tuning (Unsloth), agent training, `train` CLI, conda env setup | **`praisonai` as a PyPI dependency** (lazy `_code_bridge` for legacy dispatch) |
| 2d | `src/praisonai-browser/` | Extension bridge, CDP/hybrid automation, `browser` CLI | **`praisonai` as a PyPI dependency** (none required; depends on `praisonaiagents` only) |
| 2e | `src/praisonai-mcp/` | MCP server host, auth, transports, `mcp` CLI | **`praisonai` as a PyPI dependency** (lazy `_wrapper_bridge` for full capability registry) |
| 2f | `src/praisonai-sandbox/` | Sandbox backends (Docker, E2B, Modal, Sandlock, SSH), `SandboxRegistry` | **`praisonai` as a PyPI dependency** (lazy `_code_bridge` for `PluginRegistry`) |
| 2g | `src/praisonai-deploy/` | Deploy API/Docker/cloud, `deploy` CLI, scheduler integration | **`praisonai` as a PyPI dependency** (lazy `_plugin_registry` via `_code_bridge`) |
| 3 | `src/praisonai/` | `framework_adapters/`, serve, dashboard, async jobs API | — |
### Repo infra (not PyPI)
Deployment packaging that stays in the git checkout, not in any tier-2 wheel:
@@ -106,6 +96,203 @@ agent.start("Analyze the top 3 tech trends of 2026 and format as a markdown tabl
---
## 🧬 The Five-Layer Agent Stack
Most frameworks hand you one or two layers and leave the rest as homework. PraisonAI covers **all five** — plus the outer layer that decides *where* your agent actually runs.
Each layer wraps the one inside it. When an agent misbehaves, the layer tells you where to look.
| **1 · Prompt** | Did I say it clearly? | `instructions=`, `role`/`goal`/`backstory`, `output=`, `templates=` |
| **2 · Context** | Is the right thing in the window? | `memory=`, `knowledge=`, `context=`, handoff `ContextPolicy` |
| **3 · Harness** | Can it act, and be checked? | `tools=`, `MCP()`, `guardrails=`, `approval=`, `hooks=`, `sandbox=` |
| **4 · Loop** | When do we stop? | `execution=ExecutionConfig(...)`, `reflection=`, `autonomy=`, doom-loop detection |
| **5 · Graph** | Who runs when, and who checks whom? | `AgentFlow`, `route()`, `parallel()`, `loop()`, `repeat()` |
| **⬡ Managed** | *Where does it actually run?* | `run_on="docker"` — one shared remote sandbox, or a fully hosted loop |
### Layer 1 · Prompt — *Did I say it clearly?*
Role, instructions, examples, output format.
```python
frompraisonaiagentsimportAgent
agent=Agent(
role="Senior Data Analyst",
goal="Turn raw numbers into decisions",
output="verbose",# markdown-formatted output
)
agent.start("Summarise Q3 revenue trends")
```
### Layer 2 · Context — *Is the right thing in the window?*
Write, select, compress, isolate — the four context operations, one parameter each.
```python
frompraisonaiagentsimportAgent
agent=Agent(
instructions="You are a support engineer.",
memory={"user_id":"u-42"},# write — persists across runs (needs a user_id)
knowledge=["docs/"],# select — retrieves only what's relevant
context="summarize",# compress — auto-compacts before the limit
)
```
> **Isolate** is `handoffs=[specialist]` — a sub-agent inherits the last few messages and the intersection of your tools, not your whole transcript. [📖 Handoffs](https://docs.praison.ai/docs/concepts/handoffs)
### Layer 3 · Harness — *Can it act, and be checked?*
*Agent = Model + Harness.* Tool dispatch, plus the guides that steer before acting and the sensors that observe after.
# (with on_budget_exceeded="stop", hitting the cap raises BudgetExceededError,
# surfaced here as completion_reason="error")
```
> **Doom-loop detection is on by default.** Repeated identical tool calls and A→B→A→B oscillation get caught — while a poller whose output keeps changing does not. [📖 Doom Loop Detection](https://docs.praison.ai/docs/features/doom-loop-detection)
### Layer 5 · Graph — *Who runs when, and who checks whom?*
Topology as a versionable artifact: prompt chaining, routing, parallelisation, orchestrator-worker.
> The same graph is expressible in YAML with no Python at all. [📖 AgentFlow](https://docs.praison.ai/docs/concepts/agentflow)
### ⬡ Outside the stack: Managed Agents — *Where does it actually run?*
The harness is commoditising; **where** the agent executes is the next multiplier. Rather than burning your laptop's CPU, hand an agent a short-lived cloud sandbox — repo, tools and tests run there.
```bash
pip install praisonai
```
The simplest way in is `run_on=` — one whole team or workflow shares **one** sandbox, so a file written by step 1 is there for step 2:
agent.start("Write a Python script that prints the first 10 primes, then run it")
```
See what is running and reclaim strays:
```bash
praisonai managed ps # list running sandboxes
praisonai managed stop --all # reclaim them
```
Sandboxes shut themselves down when idle (`auto_shutdown`, `idle_timeout_s`), and a post-setup snapshot is reused so the next run skips the image pull and dependency install. Commit a `.praisonai/environment.yaml` and the environment travels with the repo.
> 📖 [20 runnable examples](examples/python/managed-agents/) · manage sessions with `praisonai managed sessions list <agent-id>` or `praisonai managed sessions resume <session-id> "<prompt>"`
<sub>Stack framing adapted from [The Five-Layer Agent Stack](https://mer.vin/2026/07/five-layer-agent-stack-match-bug-to-right-layer/) and [Agent Harnesses vs Orbs](https://mer.vin/2026/08/agent-harnesses-vs-orbs-why-remote-sandboxes-beat-local-agent-loops/).</sub>
---
## 🌌 The PraisonAI Ecosystem
Start simple with the core SDK, or expand to full visual builders and dashboards when you're ready.
@@ -200,9 +387,9 @@ Powered by 100+ LLMs (OpenAI, Anthropic, Gemini & local models).
Loaded 100 of 1771 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
