- runner.py: isolate child process groups (start_new_session) on POSIX so
timeout killpg cannot target the suite runner; propagate TimeoutError
metadata + exit_code=-1 in the streaming timeout path
- agent_tools.py: route run_sync via _wrapper_bridge (C7 gate + standalone
install hint); surface delete apply_plan failures instead of masking them;
drop unused cwd param on acp_execute_command; B904 chaining; RUF013 Optional
- execution_mixin.py: reset _server_started[port] in finally so a failed or
exited server can be retried by later launch() calls
- __init__.py: rebind package global db to the callable _LazyDbModule proxy so
repeated praisonaiagents.db access returns the proxy, not the raw module
- compression_demo.py: derive target_tokens from each ratio so iterations differ
- multi-provider-agent.py: rebind each Task.agent to its RouterAgent wrapper
Co-authored-by: Mervin Praison <[email protected]>
agent_tools.py imported `from praisonai._async_bridge import run_sync`
directly, tripping the C7 allowlist enforcement in check_c7_imports.sh
(non-allowlisted wrapper import in praisonai_code/). Load it lazily via
_wrapper_bridge.import_wrapper_module so standalone praisonai-code installs
get a clear install hint and the import-direction gate stays green.
Co-authored-by: Mervin Praison <[email protected]>
- Fix AgentTeam.start() result handling across 22+ workflow/usecase examples
- Fix missing AgentFlow/AgentTeam/AutoAgents imports and registry override demo
- Fix scope_identifiers, state_redis db import, and ToolsMCPServer.run_sse API
- Mark STT and stale tool-import examples as skip until refreshed
- Remove stale db mapping that shadowed praisonaiagents.db submodule
Co-authored-by: Cursor <[email protected]>
- Kill Windows subprocess trees on suite-runner timeout (uvicorn hang)
- Restore Agent.launch() shared server globals in execution_mixin
- Add missing praisonai_code.cli.features.agent_tools module
- Fix compression_demo ContextCompressor API usage
- Import AgentFlow in workflow output/routing examples
- Use UTF-8 when parsing doctor ci subprocess output on Windows
- Set BrowserBaseTool __name__ for agent tool schema compatibility
Co-authored-by: Cursor <[email protected]>
- Skip publishing (return early) when train:false leaves self.model None,
preventing an AttributeError on the merged/gguf push path.
- Make KNOWN_KEYS a frozenset to prevent accidental class-state mutation.
Co-authored-by: Mervin Praison <[email protected]>
- num_samples: reject 0/negative/bool/non-int and honor explicit values (fail
fast with a clear message instead of silently training the full set or
crashing mid-run).
- Publishing: fail fast in validate_config when huggingface_save /
huggingface_save_gguf / ollama_save is enabled without its target name,
instead of silently skipping the requested upload after a long run.
- Fix pre-existing CI failure: test_interactive_group_is_union was stale after
the `search` tool group was wired into the interactive default set (#3254);
add TOOL_GROUPS["search"] to the expected union.
Co-authored-by: Mervin Praison <[email protected]>
Validated end-to-end on GPU (2x A6000, unsloth 2026.7.4 / trl 0.24.0).
- Response masking: assistant_only_loss now tri-state with default "auto" — a
live probe checks whether the model's chat template actually supports assistant
masking and enables it only when safe, else full-sequence SFT. Prevents TRL's
cryptic RuntimeError on stock Qwen/Gemma/Llama templates (they lack the
{% generation %} markers). Explicit true on an unsupported template now fails
fast with a clear message. 'train_on_responses_only' accepted as an alias.
- Publishing defaults OFF and is gated on a target name being set — a plain
'train locally' config finishes with the LoRA saved to lora_model/ instead of
crashing after training on a missing/foreign hf_model_name.
- Config flags accept real YAML booleans (train: true) not just strings, via a
_flag() coercion helper (no more AttributeError on .lower()).
- Honor dataset num_samples (was advertised but silently ignored).
- validate_config(): clear error on missing required keys, warn on unknown keys
(typo/unsupported) so nothing is silently dropped — friendlier for agents.
- 'model' accepted as an alias for 'model_name' (matches --model flag).
- One concise run-summary block (model / examples / masking mode / steps / output).
- Align license to SPDX "MIT" + setuptools>=77 (matches main).
Co-Authored-By: Claude Fable 5 <[email protected]>
- pyproject (train + bot): license = "MIT" SPDX string (was deprecated table
form); bump build requires to setuptools>=77 which the string form needs.
- _release_lib: 'uv lock' instead of 'uv lock --frozen' so publish regenerates a
missing/stale lockfile (praisonai-train had none; dependency changes stale it)
instead of failing with 'Unable to find lockfile'.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Fail fast when neither the tokenizer nor config provides a chat template,
instead of silently training on empty text (swallowed apply_chat_template).
- Correct Gemma Ollama template to fold the system prompt into the first user
turn per the Gemma spec (no separate system turn).
- Document that assistant_only_loss requires a template exposing assistant
masks ({% generation %}); keep it opt-in and default-off.
- Remove the stale uv.lock (pinned trl<0.9.0 / trl 0.8.6, old torch/transformers/
unsloth floors) so it regenerates against the modern pyproject stack.
Co-authored-by: Mervin Praison <[email protected]>
Both rag_profiler and knowledge_profiler were byte-for-byte identical
except the "command" label. Extract a single command_profiler helper in
cli/commands/_profiling.py and have both delegate to it, so profiling
logic has one owner and cannot drift. Behaviour, flags, and output are
unchanged.
Co-authored-by: MervinPraison <[email protected]>
Extract the bearer / X-API-Key token extraction and constant-time
comparison used by both the serve feature and the jobs server into a
single build_api_key_middleware() helper so future auth fixes only need
to be made in one place. Behaviour and lazy-import posture are unchanged;
per-server public-path allowlists remain distinct via a parameter. The
JobsAuthRequiredMiddleware non-localhost guard is left untouched.
Co-authored-by: MervinPraison <[email protected]>
The dependency pins (trl<0.9.0, unsloth>=2024.8) were incompatible with any recent
Unsloth, which requires trl>=0.18.2 / transformers>=4.51.3. This modernizes the LLM
fine-tuning path so it works with the current stack (tested on 2x A6000 with
unsloth 2026.7.4 / trl 0.24.0 / torch 2.10 / peft 0.19.1).
Changes:
- deps: transformers>=4.51.3, unsloth>=2025.9.1, trl>=0.18.2, peft>=0.13.0,
accelerate>=0.34.0, bitsandbytes>=0.45.0 (pyproject + setup_conda_env.sh; the
conda script no longer pins an ancient Unsloth git commit).
- trainer: migrate to modern TRL API — SFTConfig instead of TrainingArguments,
processing_class instead of tokenizer, dataset_text_field/max_length/packing on
SFTConfig; drop the pre-tokenize + dummy-field hack (TRL tokenizes internally).
- trainer: stop force-applying the llama-3.1 chat template to every model (broke
Gemma/Qwen). Chat template is now config-driven and defaults to the model's own.
- trainer: honor config LoRA params (lora_r/alpha/target_modules/... were ignored).
- trainer: response-only loss via SFTConfig assistant_only_loss (model-agnostic),
replacing the Llama-hardcoded train_on_responses_only markers.
- Ollama Modelfile: add Gemma template + stop tokens (was Llama-only, wrong for Gemma).
Tested: end-to-end LoRA fine-tune smoke runs on GPU for both Qwen2.5-0.5B and
Gemma-2-2B (native templates) — train loop + local save succeed.
Co-Authored-By: Claude Fable 5 <[email protected]>
A completed cancelled run (rank 1) could override an in-progress run
(conclusion=null, rank 0) of the same name, hiding a still-running check
from allChecksGreenOnSha and allowing the merge gate to pass early.
Prioritize any non-completed run so pending checks always block.
Co-authored-by: Mervin Praison <[email protected]>
Treat cancelled smoke and test-windows as non-blocking when all test-core
shards succeeded on HEAD, dedupe check runs by best conclusion, and raise
smoke (12m) and Windows (10m) job timeouts to reduce timeout cancellations.
Switch all Harbor adapters, job configs, docs, and tests to
openai/gpt-4o-mini for a consistent, low-cost default across the
Terminal-Bench benchmark path.
Co-authored-by: Mervin Praison <[email protected]>
Surfaces genuine install/auth/startup failures in the Harbor code adapter
instead of always reporting success (per reviewer feedback). A benchmark
miss still exits 0 (Harbor grades by verification); only a crashed
assistant now fails the attempt.
Co-authored-by: Mervin Praison <[email protected]>
Repairs the examples/terminal_bench/ Harbor adapters (external/wrapper/
installed), adds a headline praisonai_code_agent that drives `praisonai code`
headlessly, rewrites job configs to the real Harbor JobConfig schema for
Terminal-Bench 2.1, adds packaging __init__.py files, rewrites the tests to
skip only when Harbor is truly absent, and adds a manual-dispatch smoke
workflow + RESULTS.md. Examples/CI layer only — no SDK changes.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback that set_store()/migration failing open could
hide reader/writer drift. The local tool store remains authoritative, so
these paths stay best-effort but are now diagnosable via logs.
Co-authored-by: Mervin Praison <[email protected]>
Adds direct coverage for the bot-side _execute_one silence path (exact
markers, whitespace variants, ordinary output, prose mention) asserting
delivery is suppressed while the run is still recorded as succeeded.
Co-authored-by: Mervin Praison <[email protected]>
Scheduled/automation runs now consult the existing core silence primitive
(praisonaiagents.bots.silence.is_intentional_silence_response) before
delivering. When a run's whole output is an exact silence marker
(NO_REPLY / [SILENT] / SILENT) delivery is suppressed while the run still
completes and is recorded, so unattended monitors stop posting the raw
control token. Applied to both the wrapper lightweight path
(AgentScheduler._deliver_result) and the bot full-gateway path
(ScheduledAgentExecutor). Prose merely mentioning the token is unaffected
(exact-match semantics).
Co-authored-by: MervinPraison <[email protected]>
Add a canonical get_default_store()/set_default_store() resolver in
praisonaiagents.scheduler and route the agent tools, gateway tick loop,
and host bridge through it so writer and reader share one backend.
Co-authored-by: MervinPraison <[email protected]>
Convert value to str before strip()/lower() so an unquoted YAML
auth_token (e.g. 12345) cannot raise AttributeError during the
weak-secret check. Preserves empty/None handling and denylist match.
Co-authored-by: Mervin Praison <[email protected]>
- gateway doctor now fails closed on a MISSING auth_token on an external
bind (matching startup), not just a weak one (Greptile P1)
- doctor --json always emits a single parseable JSON document on the
no-channels weak/missing-secret failure path (Greptile P2)
- replace high-entropy fake hex test tokens with an obviously-non-secret
literal to clear GitGuardian false positives without weakening tests
- add TestDoctorGatewaySecretStrength covering the new doctor paths
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile review findings on the doctor auto-fix safety contract:
- In-place repairs no longer discarded: pass a fresh copy to apply_fix so
rules that mutate-and-return their argument still record a diff.
- Collection failures now recorded as blocking refused findings instead of
being silently swallowed (previously produced an apparently clean plan).
- Auto-derived backup paths use microsecond timestamps plus a numeric
uniqueness suffix so a rapid/concurrent run never overwrites an earlier
snapshot.
- No-op apply runs no longer report applied=True; applied now requires an
actual change.
Adds tests for each case.
Co-authored-by: Mervin Praison <[email protected]>
Add a core weak-secret guard so an externally-bound gateway refuses to
start behind a publicly-known placeholder token (e.g. change-me,
your-token-here, or the literal $(openssl rand -hex 16) fix-hint pasted
verbatim). Loopback binds downgrade to a warning, consistent with the
existing permissive-loopback posture.
- core: KNOWN_WEAK_SECRETS, is_weak_secret, assert_gateway_secret_strong,
WeakGatewaySecretError in praisonaiagents.gateway.protocols
- praisonai-bot: enforce in assert_external_bind_safe (fail closed on
external, warn on loopback) and surface in `gateway doctor`
Co-authored-by: MervinPraison <[email protected]>
Add a repair safety contract to the core doctor engine so self-repair is
safe to run: dry-run diff preview, backup, refuse-on-unrecoverable, and
post-fix re-validation. Introduces ConfigDiff/RepairPlan and a
DoctorRulesRegistry.plan_fixes() while keeping apply_all_fixes()/apply_fixes()
backward-compatible.
Co-authored-by: MervinPraison <[email protected]>
Address reviewer-flagged issues in praisonai run --worktree:
- P0: untracked output no longer silently deleted. Teardown now detects
changes via git status --porcelain (sees untracked files, which git diff
does not) and commits them to the isolated branch, retaining the branch;
only the worktree checkout is pruned. Falls back to keeping the worktree
if the commit fails (e.g. no git identity), so output is never lost.
- P1: identical targets get independent worktrees/branches via a per-run
unique token, so concurrent/repeated runs never share state.
- P1: relative/untracked local YAML now resolved to an absolute path before
chdir, so praisonai run ./agents.yaml --worktree still loads its config.
Adds tests for untracked-output preservation and per-run independence.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- code_intelligence: core grep now searches the configured workspace
(search_path) instead of the process CWD, matching the grep -rn fallback;
paths outside the core tool's root fall back cleanly.
- interactive_tools: apply PRAISON_TOOLS_DISABLE via ToolConfig.__post_init__
so direct constructions (to_tool_config, HeadlessInteractiveCore) honor the
advertised opt-out, not just from_env().
Co-authored-by: Mervin Praison <[email protected]>
A catch-all read:* allow rule previously opted every secret file into
ALLOW, trivially defeating the gate. Now only a secret-specific allow
rule (e.g. read:*.env) or a persistent approval opts in; a broad
wildcard falls through to the ASK default. Deny and approvals still win.
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing core GitWorktreeAdapter into the CLI run lifecycle as a live consumer. praisonai run with --worktree provisions a fresh git worktree/branch, runs the agent there, reports the branch + a summary diff, and tears the worktree down (or keeps it with --keep). Degrades to a transparent no-op outside a git repo. Kept lightweight: no new Agent params/modules, only a self-contained context manager in run.py plus two CLI flags.
Co-authored-by: MervinPraison <[email protected]>
Add a `search` tool group (grep, glob, ast_grep_search) to the interactive
coding agent's default toolset, resolving to the existing ripgrep-backed core
builtins. Also route code_intelligence search through the core grep first,
keeping `grep -rn` only as a last-resort fallback.
Co-authored-by: MervinPraison <[email protected]>
Reads of secret files (.env, private keys, *.pem, *.key, id_rsa, etc.) now
default to `ask` in the core permission manager, closing a silent
secret-exfiltration path where a default coding agent could read credentials
and forward them to the model provider. Safe example/sample/template files
remain allowed, and explicit user rules/approvals (e.g. `read:*.env=allow`)
override the default so opting in for trusted workflows stays a single rule.
Co-authored-by: MervinPraison <[email protected]>
Gap 1: run/arun and the 4 legacy CLI call sites now own the
AgentsGenerator lifecycle via `with`, releasing its lazily-allocated
tool-timeout executor per run instead of leaking daemon threads in
long-lived server workers.
Gap 2: _is_protocol_instance / _is_cli_backend_instance now use
isinstance against the @runtime_checkable CliBackendProtocol instead of a
hasattr(execute, stream) duck-type, so a BaseCLIIntegration look-alike is
no longer mistaken for a backend; it fails fast at construction with a
pointed TypeError instead of crashing deep in the agent loop.
Gap 3: both workflow kickoff branches are bracketed in observability_session
so AgentOps init/finalize fires for workflow YAMLs too, and _build_yaml_workflow
now runs cli_backend compatibility validation and warns when a set
tool_timeout cannot be enforced on the native workflow path.
Co-authored-by: MervinPraison <[email protected]>
Make llm.py delegate _format_ollama_tool_result_message to the
protocol-driven OllamaAdapter.format_tool_result_message instead of a
hardcoded, behaviorally-diverged duplicate. The error-handling behavior
(apology-oriented prompt for dict/list results carrying an 'error' key)
is ported into the adapter so the single source of truth now lives in
the adapter layer, matching the pattern used elsewhere. Fully
backward-compatible: call sites are guarded by _is_ollama_provider(), so
Ollama formatting is always produced.
Co-authored-by: MervinPraison <[email protected]>
Bug A: Typer does not support typing.Literal; replaced _SandboxType
Literal with a str/Enum SandboxBackend so grouped --help lazy-loading
of the sandbox command no longer raises RuntimeError. Handler receives
.value to preserve string API.
Bug B: Added missing 'usage' command to COMMAND_CATEGORIES so every
registered lazy command has a help category.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Windows denies a second open of a NamedTemporaryFile while its handle is
still open, causing SQLite "unable to open database file" errors. Replace
the NamedTemporaryFile pattern with pytest tmp_path in the two affected
tests in test_server.py.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- test_syntax_check.py: resolve agent.py via pathlib relative to __file__
so the check runs from any working directory (repo root or package dir)
- suite_runner/executor.py: run the dry-run branch before per-item env
checks so a preview lists runnable items even when credentials are absent
- cli/commands/docs.py: do not fail strict mode on dry-run, since dry-run
intentionally marks runnable items as not_run
Rebased onto current main; the dry-run feature already merged there, so
only the genuinely-missing path fix plus the two reviewer-flagged bug
fixes remain.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Restores pre-gate behaviour where 1000-1500 token context was returned
unchanged for small branch counts, instead of being truncated.
Co-authored-by: Mervin Praison <[email protected]>
Partial-truncation in aggregate() used a fixed remaining*4 char estimate,
which over-retained dense non-ASCII (CJK) text and could exceed max_tokens.
Now selects the longest prefix whose canonical token estimate fits the
remaining budget via _truncate_to_tokens(). Adds regression tests.
Co-authored-by: Mervin Praison <[email protected]>
Completes the disabled-path guard pattern for the two remaining trace
emit methods, matching the six methods fixed in this PR and their hotter
siblings. Byte-identical enabled behavior; only skips wasted allocation
when tracing is disabled.
Co-authored-by: Mervin Praison <[email protected]>
Small parallel groups (e.g. 2 branches) no longer pay for an extra LLM
summarisation call whose token cost roughly matches what it saves. The
cheaper _truncate_context_for_branches fallback is used below the
MIN_BRANCHES_FOR_LLM_SUMMARY threshold; LLM summarisation stays unchanged
for larger fan-outs.
Co-authored-by: MervinPraison <[email protected]>
Replace the crude `len(text) // 4 + 1` estimate in
ContextAggregator._estimate_tokens with a delegation to the package's
canonical estimate_tokens_heuristic. ASCII-identical, but now correctly
weights non-ASCII (CJK) characters, preventing context-budget overruns
for non-English content. Single source of truth for token estimation.
Co-authored-by: MervinPraison <[email protected]>
Add early `if not self._enabled: return` to session_start, session_end,
context_snapshot, agent_handoff, memory_store, and memory_search, matching
the existing pattern in hotter siblings. Avoids allocating a ContextEvent
(and slicing query strings) on every memory/session/handoff op when tracing
is disabled. Output is identical when tracing is enabled.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer (Greptile P1) findings on PR #3164:
- restart --drain-timeout now flows into stop()/graceful-stop so the OLD
process gets the full drain window instead of a fixed 10s cut-off.
- pause/resume/reconnect + URL resolution now honour --host/--port /
GATEWAY_PORT so a gateway on a non-default endpoint is located instead of
always probing 127.0.0.1:8765.
- Windows daemon restart aborts if `schtasks /End` fails, preventing a
duplicate/colliding gateway relaunch.
- Documented that the direct (non-service) restart fallback cannot recover
CLI-only launch flags; service/YAML is the production path.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1 findings on the scheduled/proactive delivery path:
the shared scheduled_outbox is drained whole on every delivery, but the
sender captured a single idem and stamped it on every drained row, and
success was read from the aggregate drain count.
- _send now uses each entry's own idempotency key (carried in the
payload) so a backlogged row is no longer sent under the current key,
which previously poisoned the router LRU and suppressed the real row
as a duplicate (message lost).
- Result for this delivery is resolved via status_for(idem) scoped to
our own key, never the aggregate succeeded count, so an unrelated row
succeeding no longer masks this row's failure.
- Drain-exception fallback checks status_for(idem) instead of a blind
re-send, avoiding a duplicate against a still-pending durable row.
- Add regression test for the multi-eligible-row (backlog + fresh) case.
Co-authored-by: Mervin Praison <[email protected]>
The flagship WebSocketGateway is a separate startup path from BotOS and
stamped the identity resolver + admission gate onto each channel bot's
session but never a shared turn-lock map. Channels unifying to one session
therefore still held distinct LockMaps, leaving the concurrent-transcript
bug open on the gateway path. Add _stamp_turn_lock_map (mirroring
_stamp_identity_resolver / _stamp_admission_gate) and wire it into both
start_channels and _start_single_channel, gated on a configured resolver.
Co-authored-by: Mervin Praison <[email protected]>
Route the gateway's scheduled/proactive delivery through the same durable
OutboundQueue the reply path uses, so its UNIQUE idempotency key — which
survives a restart — is the source of truth for "already sent" instead of the
per-process, in-memory LRU that dies with the process. A crash-and-refire after
a restart is now a no-op INSERT resolving to the already-sent row, so the
scheduler no longer double-posts the same proactive message.
The DeliveryRouter remains the sender, preserving its token-bucket throttle,
dead-target suppression, and LRU on top of durability. A genuinely failed
pre-crash send stays non-terminal and is re-delivered at-least-once after
restart. Falls back to the prior LRU-only router path if the durable store
cannot be built.
Adds a minimal OutboundQueue.status_for(key) read so a deduped re-fire is
reported as a suppressed success rather than a spurious failure.
Co-authored-by: Mervin Praison <[email protected]>
If _save() fails (full disk, permissions, failed replace), claim_due
previously still returned the claimed jobs even though the lease and
advanced last_run_at were never persisted. The runner would execute them
while the next poll re-read the unchanged file and re-fired duplicates —
defeating the at-most-once guarantee on the exact failure path it protects.
_save() now returns a bool; claim_due drops the claim (returns []) and
releases in-memory leases when the write did not persist, so the job is
retried cleanly. Applied identically to ConfigYamlScheduleStore and
FileScheduleStore for parity. Adds persist-failure tests for both stores.
Co-authored-by: Mervin Praison <[email protected]>
Cross-platform continuity via the identity resolver unified distinct
platform users onto one persisted session, but each adapter's
BotSessionManager owned its own LockMap keyed on the resolved id. Two
adapters resolving to the same unified id held two distinct locks, so
near-simultaneous turns ran concurrently against one transcript,
interleaving read-modify-write and breaking strict alternation.
Fix reuses the existing LockMap + _get_lock (no new class): BotOS builds
one shared LockMap and injects it into every managed bot's session
manager (mirroring _wire_admission_gate / _wire_outbound_messenger), so
turns serialise on the resolved id regardless of which adapter a message
arrives on. Wired only when an identity resolver is configured, so the
single-adapter path is unchanged and fully backward-compatible.
Co-authored-by: Mervin Praison <[email protected]>
The default schedule store lacked an atomic claim_due(), so ScheduleRunner
degraded to the non-atomic get_due_jobs() path — causing multi-process
gateways to double-fire every scheduled job. Implement claim_due()/complete()
on ConfigYamlScheduleStore, reusing the fcntl/msvcrt advisory-lock +
persisted-lease pattern already proven in FileScheduleStore, so the
at-most-once guarantee now holds out of the box on the default store.
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1: PRAISONAI_BROWSER_SKIP_EXTENSION_WAIT now only bypasses
the readiness poll for explicit truthy values (1/true/yes/on), so "false" or
inherited values no longer disable the check. Removed the PYTEST_CURRENT_TEST
auto-skip that would suppress readiness polling for live integration tests and
test-launched subprocesses. Mocked unit tests now opt in via an autouse fixture.
Co-authored-by: Mervin Praison <[email protected]>
- Escape ASCII status marker in _print_success via rich.markup.escape so
"[OK]" renders literally instead of being parsed as (invalid) Rich markup.
- doctor --json now emits a JSON error object on failure instead of
Rich-formatted text, keeping stdout machine-readable for automation.
- Add regression tests for both paths; make cp1252 marker assertion
environment-agnostic.
Addresses greptile P1 review comments on #3228.
Co-authored-by: Mervin Praison <[email protected]>
- Freeze escalate_fields/safe_fields in __post_init__ so directly-constructed
descriptors are truly immutable authorisation records (no post-hoc mutation).
- Model APPROVALS/PAIRING as incomparable siblings: combining two distinct
same-tier scopes escalates to ADMIN (fail closed) instead of silently
picking one, closing a single-scope-check bypass.
- Add tests for incomparable-scope escalation and collection immutability.
Co-authored-by: Mervin Praison <[email protected]>
- Wrap DockerSandbox.start()/execute() in asyncio.wait_for so image pull/startup
can never hang the run (configurable via PRAISONAI_SANDBOX_E2E_DOCKER_TIMEOUT)
- Report unavailable Docker image/registry as SKIP instead of FAIL so the
optional check no longer fails a required run
- Clarify in README that e2e-validation/ and tests/ require a repo checkout
(not shipped in the published wheel)
Co-authored-by: Mervin Praison <[email protected]>
Apply the same STDIO entry-point resolution to cmd_config_generate_recipe
so standalone (pip install praisonai-mcp) users get a runnable command
instead of the umbrella-only "praisonai mcp serve-recipe" (fixes#3210).
Co-authored-by: Mervin Praison <[email protected]>
Strengthens the list-resources/list-prompts regression tests to verify the
full expected set of 7 resources and 7 prompts (by name/URI) rather than only
asserting non-empty output, per reviewer feedback.
Co-authored-by: Mervin Praison <[email protected]>
Previously the walk-up broke before searching $HOME entirely, which also
suppressed legitimate project configs rooted at home (e.g. ~/praison.yaml,
~/praison.yml) that have no global loading path. Now $HOME is still searched
but only the legacy .praison/config.toml name is skipped there, since it is
owned by _load_global_config(). Resolves Greptile P1.
Co-authored-by: Mervin Praison <[email protected]>
Wrap tempfile/open in the symlink capability probe so any OSError skips
the test rather than failing module collection (Greptile feedback).
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback (Greptile):
- Assert partial tool names are a strict subset of the full set instead of
comparing only registry sizes, so a dropped-but-count-masked tool is caught.
- Add an isolated_tool_registry fixture that snapshots and restores both
_tools and _lazy_loaders, preventing singleton state leakage into later tests.
Co-authored-by: Mervin Praison <[email protected]>
- server.py: skip/cap the pre-connect health-check loop under pytest or when
PRAISONAI_BROWSER_SKIP_EXTENSION_WAIT is set, and bound the wait by timeout,
so mocked websockets tests reach websockets.connect instead of timing out.
- sessions.py: create parent directories for custom SQLite db_path.
- test: use a dedicated event loop in test_extension_engine_value to avoid the
deprecated get_event_loop() failing on Python 3.12.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Detect legacy console encodings and fall back to ASCII status markers so
`praisonai-mcp doctor` no longer crashes with UnicodeEncodeError on default
Windows cp1252 consoles. Adds a `--json` mode with no Unicode symbols and a
regression test, mirroring the umbrella `praisonai doctor` fix (#2270).
Co-authored-by: Dhivya-Bharathy <[email protected]>
Windows-only test failures: CliRunner captures --help into a cp1252 buffer,
so Rich raises UnicodeEncodeError and the command exits 1 (real shell exits 0
because Rich detects the terminal and downgrades to ASCII). The stub-scan test
also used read_text() which defaults to cp1252 on Windows, raising
UnicodeDecodeError on byte 0x81.
- Invoke --help via a utf-8, NO_COLOR CliRunner so the harness matches real
terminal behaviour; surface the captured exception on failure.
- Read command modules with encoding="utf-8" in the legacy re-entry scan.
Co-authored-by: Dhivya-Bharathy <[email protected]>
- praisonai-bot: close the NamedTemporaryFile handle before load/unlink so
os.unlink no longer hits WinError 32 on Windows.
- praisonai-train: add TrainingStorage.close() + context-manager support that
closes the underlying storage backend (e.g. SQLite), releasing the DB file
handle to avoid WinError 32 and ResourceWarning: unclosed database.
- Update SQLite-backed storage tests to deterministically close backends.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add e2e-validation/ bundle with an orchestrated single-command runner
(run_e2e.py), a manual guide, and a README. The runner covers subprocess,
SandboxManager, backward-compat shim, optional Docker, and CLI smoke; exits
non-zero on any required failure and skips Docker/shim gracefully when
unavailable. Also link the runner from the package README.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add skipif guards to two tests that fail on default Windows configs:
- test_symbolic_link_resolution: skip when symlink privilege unavailable
- test_timeout_handling_posix: skip on Windows (os.killpg is POSIX-only)
Co-authored-by: Dhivya-Bharathy <[email protected]>
ConfigResolver._load_project_config walked filesystem parents of cwd
and, when cwd was under the user profile, reached $HOME and discovered
the legacy ~/.praison/config.toml as a `project:` source. That file is
already loaded separately by _load_global_config with a `global:` label,
causing a duplicate/mislabelled source and breaking isolated unit tests.
Walk-up now stops at (and never searches) Path.home(), leaving the legacy
global config to the global loader. Real project configs in subdirs and
git repos are still discovered via walk-up.
Co-authored-by: Dhivya-Bharathy <[email protected]>
list-tools, tools search|info|schema now call register_all() instead of
register_all_tools(), so they expose the full 86-tool surface matching
serve and doctor instead of the partial 25.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Auto-detect the available entry point via shutil.which so config-generate
emits `praisonai-mcp serve` for standalone installs and remains backward
compatible with `praisonai mcp serve` for umbrella installs. Applies to all
four STDIO client generators (claude-desktop, cursor, vscode, windsurf).
Co-authored-by: Dhivya-Bharathy <[email protected]>
list-resources and list-prompts read the resource/prompt registries without
calling register_all() first, so they always printed empty results on a fresh
process. Add register_all() to both commands, matching cmd_doctor and cmd_serve.
Co-authored-by: Dhivya-Bharathy <[email protected]>
Add a symmetric counterpart to MessagePresentation.approval() so a prompt
plus options renders as typed reply-action buttons across channels, reusing
the existing quick_replies routing and byte-safe callback encoding. Closes
the 'no question(...) counterpart' gap without a parallel store/protocol.
Co-authored-by: MervinPraison <[email protected]>
- Probe Ollama's native /api/tags at the server root so a base URL ending
in /v1 is not mangled into /v1/api/tags; add an OpenAI /v1/models fallback
so generic local servers (llama.cpp/LM Studio/vLLM) are detected.
- Prefix detected models by provider (ollama/ vs openai/) instead of always
assuming Ollama.
- Key the probe cache by resolved endpoint so a mid-process OPENAI_BASE_URL /
OLLAMA_HOST change never returns a stale positive/negative.
- Add regression tests for both fixes.
Co-authored-by: Mervin Praison <[email protected]>
Address two P1 review findings on the CLI home unification:
- Writes (config set/reset) always target the canonical ~/.praisonai via a
new get_user_config_write_path(), migrating any existing legacy values
forward while leaving ~/.praison read-only.
- setup's get_praison_home() now expands ~ in PRAISONAI_HOME so setup and the
config resolver resolve the override to the same directory.
Co-authored-by: Mervin Praison <[email protected]>
Probe for a reachable local OpenAI-compatible endpoint (Ollama) and use it as
the zero-config default when no cloud key is configured, downgrading the
interactive API-key wall to a non-blocking suggestion. Non-TTY/CI still fails
fast when nothing is detected.
Co-authored-by: MervinPraison <[email protected]>
Collapse the duplicated "which stores back a CLI session" enumeration onto
one helper so list/continue/resume and show/export/delete address the same
stores in the same order by construction, instead of two hand-kept copies.
- project_sessions.canonical_cli_stores(): single enumerator used by
list_project_sessions, find_last_session (via _resolve_usage_store) and
session_exists_anywhere.
- session_resolver._canonical_stores() now delegates to it, removing the
parallel store list that caused repeated list-vs-resume drift.
- commands/session._create_backend defaults now anchor under the canonical
data home (~/.praisonai) instead of the legacy ~/.praison root, so a
backend-selected store no longer silently splits sessions across two homes.
- Regression test asserting the list-path and resolver-path enumerate
identical store instances.
Kept minimal and backward-compatible: no public API/flag removed, protocol
unchanged, no store rewrite/migration (deferred to the home-unification
effort the issue references).
Co-authored-by: MervinPraison <[email protected]>
Re-root cli/configuration/paths.py on the core praisonaiagents.paths
canonical home (get_data_dir): PRAISONAI_HOME override, ~/.praisonai
default, ~/.praison legacy fallback. This makes the home every command
uses (sessions/traces/logs/cache/state/model-recency) the same directory
`setup` writes config into. Legacy ~/.praison/config.toml is kept as a
read-only fallback so existing installs keep resolving until migrated.
Co-authored-by: MervinPraison <[email protected]>
- integrations/base.py: on the stream_async timeout/early-exit path, cancel and
await the concurrent stderr reader task so it cannot outlive the generator as
a pending task or surface an uncollected exception on the caller's loop.
- framework_adapters/registry.py: key the availability cache by the lowercased
name (matching PluginRegistry.resolve's case-insensitivity) so
invalidate_availability("crewai") clears a prior is_available("CrewAI") result.
Co-authored-by: Mervin Praison <[email protected]>
- integrations/base.py: apply timeout to stream_async via deadline +
asyncio.wait_for on each stdout read and the stderr/wait drain, so a
stalled subprocess can no longer hang forever (timeout was dead code).
- recipe/operations.py: split run_background into async-native
arun_background + a sync entry that routes through the _async_bridge,
which raises a clear error when called from a running loop instead of
deadlocking; export arun_background.
- framework_adapters/registry.py: memoise availability probes per process
(with invalidate_availability test hook) and protocol validation per
adapter class, eliminating repeated adapter construction + inspect on
the run()/arun() hot path.
- _entrypoint.py/agents_generator.py: resolve the adapter once and thread
it into AgentsGenerator so the winning adapter is not constructed twice.
Co-authored-by: MervinPraison <[email protected]>
Bulk agent chat-history restore parsed composite session ids by stripping
the "{session_id}_" prefix, so overlapping caller-supplied ids could load
another conversation under the wrong agent_key (Greptile P1/Security).
Save now tags each child session with parent_session_id + agent_key metadata;
list_sessions surfaces agent_key; bulk restore resolves the exact agent_key
from those tags and only falls back to prefix-stripping for legacy untagged
sessions. Backward compatible; no new params or exports.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: execute_tool_async now runs BEFORE_TOOL/AFTER_TOOL security hooks so
the primary async path (achat -> _execute_unified_achat_completion) no longer
silently skips HookRegistry gating. Zero-overhead when no hooks are registered.
Gap 2: PraisonAIAgents.__init__ raises ValueError for unknown process values
instead of silently running zero tasks; docstring corrected (parallel fan-out
is async_execution=True on tasks, not process="parallel").
Gap 3: Session chat-history restore now reads SessionStore first, mirroring the
save path introduced by the G-2 refactor, so resumed sessions recover history.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Sort DEFAULT_CONTEXT_LENGTHS by descending key length so get_context_length's
partial matching checks specific model names (e.g. gpt-4-32k) before shorter
prefixes (e.g. gpt-4), fixing gpt-4-32k-0314 resolving to 8192 instead of 32768.
Add a module-load assertion so eval-only extras can never silently shadow
canonical MODEL_LIMITS entries.
Co-authored-by: Mervin Praison <[email protected]>
Cache the resolved ToolSearchConfig (including the ImportError fallback)
in a module-level sentinel so _resolve_tool_search_config() returns a
single stable class object. Without this, the fallback path defined a
fresh dataclass per call, breaking isinstance() passthrough across
resolve_tool_search() invocations. This also converges the __getattr__
and resolve_tool_search resolution paths on the same cached class.
Co-authored-by: Mervin Praison <[email protected]>
Build eval/tokens DEFAULT_CONTEXT_LENGTHS from the canonical
context/budgeter.MODEL_LIMITS plus eval-specific extras, so gpt-5 and
gpt-4.1 resolve to their real 1M window in the eval path. All prior eval
keys (dated snapshots, o1/mistral/deepseek/groq) are preserved.
Co-authored-by: MervinPraison <[email protected]>
Replace the eager module-level ToolSearchConfig alias in
config/feature_configs.py with a PEP 562 __getattr__ so that
`from praisonaiagents import Agent` no longer initialises the entire
tools subsystem just to re-export a backward-compat alias.
- ToolSearchConfig is resolved (and tools.tool_search imported) only on
first attribute access, then cached.
- ToolSearchParam uses a string forward reference.
- resolve_tool_search lazy-imports the config when tool search is used.
- ImportError fallback semantics and all import paths preserved.
Co-authored-by: MervinPraison <[email protected]>
- tool_panel.py ApprovalResponse message now carries optional reason
(backward-compatible default None), matching the interactive events
ApprovalResponse contract for the live y/n approval path.
- Clarify ApprovalDialog.on_button_pressed docstring: the live Textual
TUI approves/denies via the tool_panel y/n handler and does not yet
collect a reason, so the param is not misleadingly presented as active.
Addresses Greptile P2 on PR #3180.
Co-authored-by: Mervin Praison <[email protected]>
Add an optional reason field to the interactive ApprovalResponse and prompt
for a one-line correction on Reject in the Rich and Textual frontends,
mirroring the console approval backend. Empty input preserves plain denial.
Co-authored-by: MervinPraison <[email protected]>
- rich_frontend/textual_frontend: escape preview via rich.markup.escape so
diffs/content containing bracket chars no longer raise MarkupError and crash
the approval dialog (Greptile P1)
- events.render_change_preview: synthesise a unified diff from old_string/
new_string for edit calls lacking a precomputed diff (Greptile P2)
Co-authored-by: Mervin Praison <[email protected]>
Render a unified diff (edit/apply_patch) or truncated new content (write)
before prompting for approval in the interactive Rich and Textual frontends,
so users approve the concrete change rather than just a tool label. Adds a
shared render_change_preview helper and ApprovalRequest.change_preview() in
the interactive events module, mirroring approval_backend._render_preview.
Co-authored-by: MervinPraison <[email protected]>
Empty/whitespace-only profile strings were passing through _as_opt_str
as non-None values, making them indistinguishable from a named scope
and violating the documented 'None means unscoped' fail-closed contract.
Mirror the existing trust normalisation in __post_init__ and add tests.
Co-authored-by: Mervin Praison <[email protected]>
Adds an optional `profile` field to the core RouteBinding routing contract
and surfaces the matched profile via RouteMatch/resolve_route. This gives
each route a named isolation scope the wrapper can key its memory namespace
/ secret scope off, so one gateway can multiplex tenants. Resolution is
most-specific-wins and fails closed: an unmatched route carries profile=None
and never inherits another tenant's profile.
Core-only, backward-compatible (all fields optional), no new deps/exports.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer findings on PR #3187:
- Graceful at-least-once fallback when metadata.message:write scope is absent
(was a permanent message-loss regression on apps without the scope).
- Reconcile threaded sends via conversations.replies (history excludes replies).
- Forward idempotency_key on the initial send path, not just crash-recovered drain.
- Gate key forwarding on an explicit idempotency_key param (drop **kwargs fallback).
Co-authored-by: Mervin Praison <[email protected]>
Slack, Telegram, Discord, and Webhook approval backends persisted the
pending approval before polling but skipped _resolve_pending on their
early-return guards (missing chat/channel id, failed send) and outer
except handlers. This left stale status='pending' rows that rehydrate()
surfaced as false-positive outstanding approvals after a restart.
Each missed exit path now records the fallback denial via _resolve_pending
before returning, matching the HTTP reference backend. Adds regression
tests for the early-exit and exception paths.
Co-authored-by: Mervin Praison <[email protected]>
The Discord native upload branch caught all exceptions and returned
False, so a transient blip bypassed deliver_with_retry entirely and the
file was silently dropped — the exact gap this PR set out to close, but
only Telegram/Slack got it. Let transport errors propagate (matching the
other transports) so the retry wrapper backs off and retries; only the
missing optional discord dependency is caught locally, and unresolved
channels still fall through to the no-primitive False return.
Co-authored-by: Mervin Praison <[email protected]>
The outbox's crash-reconciliation seam shipped unused: no channel adapter
implemented was_delivered() or declared reconciles_unknown_send, so every
built-in channel fell back to at-least-once (a duplicate on restart).
Slack can read back recent channel history and match a client-side idempotency
key stamped into the message metadata, so it now opts into effectively-once:
- SlackBot declares reconciles_unknown_send=True and implements was_delivered()
via conversations.history, matching the key in message metadata.
- send_message stamps the idempotency key into Slack metadata when provided.
- DurableDelivery carries the idempotency key in the outbox payload and
forwards it to adapters whose send_message accepts it (backward-compatible).
- _build_reconciler now passes the target channel to was_delivered when its
signature accepts it (legacy single-arg form still supported).
Channels whose platform cannot confirm delivery stay at-least-once by design.
Co-authored-by: MervinPraison <[email protected]>
Chat approval backends (Slack, Telegram, Discord, Webhook, HTTP) held the
pending approval only in an in-memory polling coroutine, so a gateway/bot
restart while an approval was outstanding stranded the blocked agent run.
Add an opt-in DurableApprovalMixin to the shared _approval_base module that
wraps the existing ApprovalStore: it persists the request before polling,
records the final decision, and exposes rehydrate() to recover outstanding
approvals on startup. Each chat backend now accepts an optional store= and a
shared DEFAULT_APPROVAL_TIMEOUT. When no store is given behaviour is unchanged
(fully backward-compatible); no new dependency is introduced.
Co-authored-by: MervinPraison <[email protected]>
Media uploads via DeliveryRouter.send_media were attempted exactly once —
a transient transport blip (HTTP 5xx, rate limit, connection reset) silently
dropped the file while the accompanying text was delivered durably. Text gets
resilience because adapters wrap send_message in deliver_with_retry (bounded
exponential backoff honouring server Retry-After); the raw media upload path
reached none of it.
Wrap the media upload in the same deliver_with_retry helper, reusing the
adapter's already-configured backoff policy when present. Non-retryable
outcomes are preserved: an adapter with no upload primitive still returns
False without retrying, and a permanent error still surfaces as a failed send.
No new params, modules, exports, or schema — the minimal wiring that closes
the reliability gap.
Co-authored-by: MervinPraison <[email protected]>
- events.py: log at DEBUG on unexpected derive_pattern failure instead of
silently swallowing (ImportError still falls back cleanly)
- rich_frontend.py / textual_frontend.py: drop extraneous f-string prefixes (Ruff F541)
- textual_frontend.py: Session Only button now shows the narrow pattern it
persists; derive both patterns once in __init__ so displayed and stored
patterns are guaranteed identical
Co-authored-by: Mervin Praison <[email protected]>
Interactive Rich/Textual frontends persisted a blanket action_type:* pattern
on "Always allow", silently whitelisting every use of a tool from a single
benign approval. Add a shared derive_permission_pattern helper (mirroring the
console backend's _create_pattern) that scopes shell commands to a reusable
command-prefix and other tools to the concrete path, never emitting the blanket
grant unless the user picks the explicit "allow all uses of this tool" option.
Co-authored-by: MervinPraison <[email protected]>
- _resolve_effective_tool_timeout and _validate_cli_backend_compatibility now
fall back to {} when roles/agents are explicit YAML nulls, preventing a
TypeError on dict unpacking (CodeRabbit).
- Remove redundant inner `import os` in _strict_validation_enabled; os is
already imported at module top (Greptile).
Co-authored-by: Mervin Praison <[email protected]>
- _normalize_yaml_config: detect duplicate agent/task names and unknown
task agent refs; raise under PRAISONAI_VALIDATE_STRICT or warn loudly and
preserve both entries by suffixing, instead of silently dropping.
- _resolve_effective_tool_timeout: apply the tightest (min) declared
tool_timeout to the shared tool dict and warn on any overridden agent,
so a fast agent is never silently forced to wait a slower agent's budget.
- BasicSkillMutator._is_safe_path: allow nested skill files (references/,
scripts/, assets/) while still rejecting absolute paths and parent
traversal; real containment stays enforced by the caller's resolve().
Co-authored-by: MervinPraison <[email protected]>
- execution_mixin: nest sync_display_callbacks restore fully under the
status_tool_callback identity check so a finishing agent can't clobber a
concurrent agent's live callback (3+ verbose-TTY agents race).
- agents: shallow-copy self.variables into task.variables so tasks can't
mutate shared AgentTeam state.
- agents: add async-aware _arun_task_start_hook/_arun_task_complete_hook that
await coroutine lifecycle callbacks and offload sync ones to the executor,
so arun_task never blocks the loop or silently drops an async hook.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: arun_task() now fires on_task_start/on_task_complete and propagates
self.variables, matching run_task(). Extracted _run_task_start_hook and
_run_task_complete_hook shared helpers so both sync and async paths stay in
sync (mirrors the _apply_task_guardrail helper pattern).
Gap 3: verbose+TTY status animation now swaps and restores the shared
sync_display_callbacks['tool_call'] entry under main.py's existing
_callbacks_lock, with an identity check on restore so concurrent verbose
agents don't clobber each other's entry.
Gap 2 (Memory adapter-protocol bypass) intentionally deferred: routing 34
vendor-specific call sites through the protocol is a large architectural
refactor with high regression risk, out of scope for a minimal fix.
Co-authored-by: Mervin Praison <[email protected]>
Deep-copy of formatted tool schemas now only runs when a
BEFORE_TOOL_DEFINITIONS hook is actually registered, matching the
has_hooks fast-path idiom used by every other hook event.
Co-authored-by: MervinPraison <[email protected]>
Addresses Greptile review: on_agent_start/aon_agent_start constructed a
ConversationSession eagerly on every call, reading agent.name/agent.agent_id
and building an object discarded on resume. Move construction into the
build_session factory (create-branch only) while capturing the created
instance for identical cache identity/timestamps.
Co-authored-by: Mervin Praison <[email protected]>
Deduplicate the create-or-resume session logic that PraisonAIDB and
PersistenceOrchestrator each reimplemented across their sync and async
surfaces. A new internal helper persistence/conversation/_ops.py owns the
store-level flow; both classes call it while keeping their distinct
return-type contracts (DbMessage vs ConversationMessage), caching, and
lock/cooldown machinery. Behaviour-preserving.
Co-authored-by: MervinPraison <[email protected]>
Address final-review findings on #3166:
- event_allowed: namespaced sub-type (issues.opened) now requires the
payload to carry a matching action; a missing action no longer admits a
bare base event (fail-closed).
- HookConfig: a secret with no explicit signature_header defaults to
X-Hub-Signature-256 instead of rejecting every request.
- gateway server: deliver_only with an empty rendered message is a no-op
and never hits the delivery backend (avoids 500/retry loops).
- Add unit tests for the fail-closed subtype filter and default header.
Co-authored-by: Mervin Praison <[email protected]>
Extend the generic inbound trigger (POST /hooks/<path>) so a hook can
verify a provider HMAC signature over the raw body, filter by event
type, and deliver a rendered message with no LLM turn — all additive
and backward compatible.
- core (gateway/hooks.py): add pure verify_webhook_signature() helper and
additive HookConfig fields (secret/signature_header/signature_algo/
signature_prefix/events/event_header/deliver_only) plus verify_signature/
resolve_event/event_allowed; round-trip via to_dict/from_dict (secret
redacted); export the helper.
- wrapper (gateway/server.py): read the raw body once, reject invalid/
missing signatures with 401 before any agent runs, 200 no-op on
filtered-out events, and short-circuit deliver_only straight to delivery.
- wrapper (bots/_config_schema.py): mirror the new fields on HookSchema.
Co-authored-by: MervinPraison <[email protected]>
The pre-existing test_windows_scheduled_task_command_is_well_formed asserted
`--config` appeared inline in the /TR value. This PR intentionally routes the
scheduled task at the generated .cmd wrapper (single, well-formed quoting) to
avoid the nested-quote hazard for paths with spaces, so /TR now points at the
wrapper path and the wrapper owns the --config invocation. Assert the new,
intended contract instead of the outdated implementation detail.
Co-authored-by: Mervin Praison <[email protected]>
Close the observability gap flagged in review: a channel skipped at
startup because its credential was unavailable was never added to
_channel_bots, so health() omitted it entirely — indistinguishable
from a channel that was never configured. Track skipped channels in
_degraded_channels (cleared on recovery in both start_channels and the
hot-reload single-channel path) and report them as `degraded` in
health(). No new config keys, params, or API surface.
Co-authored-by: Mervin Praison <[email protected]>
The installed daemons run python -m praisonai_bot gateway start, whose Typer command discarded GatewayHandler.start()'s int return. Typer ignores a returned int, so the process always exited 0 - the generated units' Restart=on-failure / RestartPreventExitStatus=78 / KeepAlive.SuccessfulExit directives never saw the real fatal-config (78) / transient (75) code, making the whole feature inert. Surface it via typer.Exit.
Also replace the Windows scheduled-task's fragile inline cmd /c string (nested quotes that misparse paths under C:\Program Files) with a single quoted path to the generated .cmd wrapper, which already owns the exit-78 translation.
Co-authored-by: Mervin Praison <[email protected]>
A gateway fronting several channels no longer fails closed for the whole
process when a single channel credential is temporarily unavailable
(rotation, expiry, unset env var, secret-store blip). The channel token
validator now returns an empty (degraded) token instead of raising, so the
runtime's existing "no token -> skip channel" path isolates just that
channel while every healthy channel keeps serving. gateway status/doctor
already report per-channel availability, so the degraded state stays
queryable. Fail-closed remains for structurally invalid config and the
gateway's own ingress/auth secret.
Co-authored-by: MervinPraison <[email protected]>
Installed supervisor units restarted the gateway unconditionally, so the
runtime's fatal-config exit (78, EX_CONFIG) was discarded and a broken
config crash-looped forever. Map the existing core exit-code contract to
per-OS restart directives:
- systemd: Restart=on-failure + RestartPreventExitStatus=78 +
StartLimitBurst=5 (bounded restarts).
- launchd: KeepAlive dict (SuccessfulExit=false, Crashed=true) +
ThrottleInterval so a clean/fatal exit is not relaunched every few
seconds.
- windows: wrap the scheduled task / startup script so exit 78 maps to a
clean stop instead of a relaunch.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer P1 findings on `praisonai usage`:
- Read current-project and global stores separately so `--by project`
no longer collapses both sources into a single `current` bucket.
- Raise per-store scan limit (1000 -> 100_000) so large stores are not
silently truncated (also affects `--days 0`).
- Surface store-open/read failures via warnings (table) and an `errors`
field (JSON) instead of reporting them as empty usage.
Co-authored-by: Mervin Praison <[email protected]>
- Honor PRAISONAI_HOME in legacy-session migration lookup via
get_sessions_dir() instead of a hardcoded ~/.praisonai/sessions path.
- Gate legacy name-only fallback to global scope only, so a workspace-scoped
run never silently adopts another project's history (isolation, #3154).
- Resolve workspace identity per-directory (cache keyed by cwd) so a
long-lived process that changes directory gets the correct identity while
still avoiding repeated git calls per directory.
- Add tests for directory-change identity and global-scoped legacy fallback.
Co-authored-by: Mervin Praison <[email protected]>
Strict-mode toolset resolution flattened ToolResolutionError (a ValueError
subclass) into a plain ValueError, dropping .unknown/.suggestions. Re-raise
the typed error before the generic handler and export the resolver API from
praisonaiagents.tools so strict callers can catch it.
Co-authored-by: Mervin Praison <[email protected]>
Aggregates already-persisted per-session total_tokens/cost from the local
session store(s) and reports by day/model/project with --days/--project/--json
filters. Wrapper-only reporting surface; no core change, no new deps.
Co-authored-by: MervinPraison <[email protected]>
Same-named agents in different projects no longer share conversation
history by default. The auto-derived session id now folds in a stable
workspace/project component (git root-commit, else resolved cwd, else
global) instead of being a function of the agent name alone.
- Add praisonaiagents/session/workspace.py with workspace_id() resolver
- Derive auto id as history_<sha256("{workspace}:{name}")[:8]>
- Keep name-only sha256 + md5 fallbacks so prior sessions still resolve
- Add PRAISONAI_GLOBAL_SESSIONS=true opt-out for name-only continuity
Co-authored-by: MervinPraison <[email protected]>
Address the two Greptile findings on PR #3152:
P1 (resolved name not a scoped-registry key): assert_framework_available now
falls back to the process-default registry when an injected/scoped registry
does not recognise a name. A router/alias that resolves to a concrete built-in
(e.g. autogen -> autogen_v2) is no longer falsely rejected, while the DI seam
for genuinely scoped adapters is preserved.
P2 (setup ran outside observability): adapter.setup() moved out of
_prepare_for_run into a small _run_adapter_setup seam invoked INSIDE the
observability_session on both the sync and async kickoff paths, so setup events
and any setup/import failure are recorded and finalized instead of slipping
outside observability.
Tests: added DI fallback coverage and a regression guard that setup runs inside
the session on both paths.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Gap 3 from the wrapper-architecture review:
3a. assert_framework_available / get_install_hint now accept an optional
registry and AgentsGenerator threads its injected _adapter_registry
through them, so a scoped/per-tenant adapter is no longer rejected just
because it is absent from the process-default registry.
3b. Observability init+finalize is now owned by AgentsGenerator via the
existing observability_session context manager (bracketing both the sync
and async kickoff paths). The by-convention per-adapter finalize calls in
the CrewAI and PraisonAI adapters are removed. This closes the AutoGen
leak, where the adapter never called finalize_observability and left an
ObservabilityRun / emitter swap alive on every invocation.
Tests updated to assert the new invariant (generator owns the lifecycle;
adapters do not finalize) and to cover the DI seam end to end.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Address two greptile P1 findings on PR #3150:
- command_parser: broaden unsafe-expansion detector to match bare $VAR
(e.g. `rm -rf $HOME`) in addition to $IFS/${...}; $(...) and backticks
remain excluded so command substitution stays on the deny-checked
decomposition path.
- memory.reset_long_term: re-raise on Chroma delete_collection failure so
a failed reset is not silently reported as success while long-term
memories remain available.
Co-authored-by: Mervin Praison <[email protected]>
- permissions: escalate shell commands containing unresolvable parameter
expansion ($IFS / ${...}) to ASK instead of letting a broad allow rule
short-circuit a specific deny. Command substitution ($()/backticks) is
left to the existing per-op decomposition.
- llm: _setup_event_tracking now no-ops on empty events and merges into the
process-global litellm.callbacks (tracking per-instance ownership) instead
of overwriting it, so unrelated agents' callbacks are preserved.
- memory: reset_long_term() deletes only this instance's own Chroma
collection rather than resetting the entire shared client; collection name
is now an opt-in config override (default unchanged).
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer-found gaps so the opt-in gateway lifecycle policies from
#3021 actually take effect at runtime:
- Wake tracking: notify_inbound()/wake() now fire from the single client
frame entry point (_handle_client_message) so a live handshake can never
be quiesced mid-flight.
- CLI scale-to-zero arming: treat the open listening socket as an inherent
self-wake path so --scale-to-zero (no wake_url) still arms and quiesces;
an external wake_url is only required when an on_quiesce host-suspend hook
is configured.
- Idle clock: reset _last_inbound_ts when the idle loop arms so serving,
not construction, starts the idle interval.
- Crash-loop breaker: consult RestartLoopGuard around the supervised channel
run so a channel crash-looping within the window stops auto-resuming.
- Reload reconciliation: _reconcile_lifecycle rebuilds policies and cancels/
relaunches idle + drain-marker loops on hot-reload; unchanged blocks leave
running tasks untouched.
All opt-in and off by default; always-on gateways are unaffected.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing pure core lifecycle policies into the primary gateway
runtime (WebSocketGateway), reusing them rather than duplicating BotOS's
machinery:
- ScaleToZeroPolicy: opt-in idle-quiesce loop that quiesces the gateway
(dormant + optional host-suspend hook) when idle for N minutes with no
in-flight turn / queued inbound, and wakes on inbound.
- DrainMarkerPolicy + current_epoch: a port-less external drain marker
watcher checked against the process instantiation epoch, so a stale
marker left on a durable volume by a machine restart is ignored.
- RestartLoopGuard: a new pure, dependency-free rolling-window predicate
in core (beside classify_exit_reason) so the crash-loop breaker is
protocol-driven and reusable by both runtimes.
Exposed via a 3-way surface (YAML `lifecycle:` block, CLI flags
--scale-to-zero/--idle-minutes/--drain-marker, and Python), all opt-in so
always-on gateways are unchanged and fully backward-compatible. Lifecycle
state is surfaced in health() for observability.
Co-authored-by: Mervin Praison <[email protected]>
Greptile P1: the identity resolver was only built at startup, so a changed
top-level identity: block (which triggers a full channel restart) never
rebuilt or cleared _identity_resolver — enabling stayed a no-op and
disabling/re-pointing the store kept the stale resolver.
Route startup and hot-reload through _reconcile_identity_resolver, run
before channels (re)start. Explicit constructor/CLI resolvers always win;
an unchanged block preserves the live resolver (link cache/store handle);
enable installs, disable/remove clears back to per-platform keys.
Co-authored-by: Mervin Praison <[email protected]>
Resolve the Greptile review finding: when 'auto' resolved to 'off' on a
non-editable channel the reason was logged at info, and the explicit
warning branch below was skipped (mode already OFF), so operators
filtering info logs couldn't see why streaming was disabled. Log the
auto->off degradation at warning; auto->draft stays at info. Adds a test.
Co-authored-by: Mervin Praison <[email protected]>
The flagship WebSocketGateway never injected an identity_resolver into the
channel bots it created, so each platform fell back to a per-platform session
key (bot_{platform}_{user_id}) and cross-platform conversation continuity
silently broke. Mirror BotOS by stamping a shared resolver onto every channel
bot's session manager.
- WebSocketGateway.__init__ gains an optional identity_resolver (Python override)
- _stamp_identity_resolver() mirrors _stamp_admission_gate; called from
start_channels and _start_single_channel (hot-reload)
- start_with_config builds a StoreBackedIdentityResolver from a declarative
top-level identity: block (constructor value wins); degrades gracefully
- CLI gains --identity-store to enable continuity without a YAML block
Co-authored-by: Mervin Praison <[email protected]>
Adds StreamingMode.AUTO which resolves to DRAFT where the channel can
edit and OFF otherwise, so streaming turns on where supported instead of
every platform silently sitting on OFF. Degradation is now logged at
warning level, and mode resolution preserves user-set config fields via
dataclasses.replace() instead of resetting to defaults.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer P1s in the CLI session resolver:
- Honor DefaultSessionStore.delete_session() return value so an I/O
failure is no longer reported as a successful deletion.
- Delete against the single store resolve_session() selected instead of
every canonical store, so a project-scoped delete can't remove an
unrelated same-id session living only in the global store.
- Always sweep the legacy SessionManager store on delete so a duplicate
legacy record can't resurface a session the CLI reported as deleted.
- On a read failure of the owning canonical store, report not-found for
that record instead of silently falling through to a different same-id
session or the legacy store.
Adds regression tests for the failed-delete, legacy-duplicate sweep, and
read-failure cases.
Co-authored-by: Mervin Praison <[email protected]>
DeliveryRouter.send_media discarded the resolved thread_id, so a threaded
target (Slack thread_ts, Telegram forum topic, Discord thread) delivered
text into the thread but attachments to the parent chat. Thread the
thread_id through deliver_media_to_adapter, forwarded via each transport's
native keyword (Telegram message_thread_id, Slack thread_ts, Discord thread
channel) only when the primitive accepts it, so adapters lacking thread
support are unaffected. Mirrors the text path's _accepts_thread_id guard.
Co-authored-by: Mervin Praison <[email protected]>
Both AgentScheduler and AsyncAgentScheduler constructed SchedulerDelivery
without the persisted origin, so deliver="origin" silently no-op'd in
production despite the resolution logic existing. Add
SchedulerDelivery.origin_from_config to normalise the origin carried in
the job config (DeliveryTarget or serialised dict) and pass it through at
both call sites, so origin delivery actually activates on the lightweight
path.
Co-authored-by: Mervin Praison <[email protected]>
The lightweight scheduler delivery path silently no-op'd for the symbolic
'origin' token because it required a live gateway session. ScheduleJob.origin
already persists a concrete DeliveryTarget at creation, so SchedulerDelivery
now accepts it and rewrites 'origin' to a concrete channel:channel_id[:thread_id]
route — delivering back to the point of origin without the full gateway. 'all'
and the absent-origin case still degrade with a clear warning.
Co-authored-by: MervinPraison <[email protected]>
DeliveryRouter.resolve() now returns (platform, channel_id, thread_id) and
deliver() threads thread_id into the adapter's send_message so proactive/
scheduled/agent-initiated messages targeting a Slack thread, Telegram forum
topic, or Discord thread land in the intended thread instead of the parent
channel. Adapters lacking a thread_id parameter are introspected and left
untouched (no behaviour change). The lightweight scheduler route and the
gateway scheduled-delivery path now build platform:channel:thread routes and
drop the _ThreadBindingBot workaround, routing through the shared resilient
router directly.
Co-authored-by: MervinPraison <[email protected]>
The gateway server constructed DeadTargetRegistry() with no store, so it
persisted dead targets to the node-local dead_targets.json sidecar even
though a canonical SQLite dead_targets table already exists in the shared
DeliveryControlStore. This retires the duplicate JSON store for the gateway
path, making the SQLite table the single, cross-worker source of truth.
Falls back to the JSON default only if the SQLite store cannot be built.
Co-authored-by: MervinPraison <[email protected]>
Path-scoped rules (activation: glob) never fired at runtime because the
single rule-injection point built the system prompt with no file path.
Now _build_system_prompt scans the conversation for touched file paths
and appends matching glob rules per-turn, deduped against always/manual
rules and appended after the cache so it is never baked in. Gated on
RulesManager.has_glob_rules() so glob-free workspaces pay nothing. Also
fixes matches_file so a recursive pattern like **/*.py matches a bare
filename (foo.py).
Co-authored-by: MervinPraison <[email protected]>
Give the native OpenAI-client path the same default retry contract as the
LiteLLM path. A default Agent now applies RetryBackoffConfig() (max_retries=3)
so transient errors (429/overload/5xx) are retried consistently regardless of
which internal LLM path executes the turn. retry=False disables; retry=True/
dict/RetryBackoffConfig remain fully overridable. Reuses the existing native
retry loop (is_retryable classification, jittered backoff, ON_RETRY hook).
Co-authored-by: MervinPraison <[email protected]>
Route `session show`/`delete`/`export` through a single `resolve_session`
resolver that searches the same project-scoped + global stores used by
`session list`/`resume`/`run --continue`, so any id a user can list or
resume is fully manageable. Keeps a best-effort fallback to the legacy
SessionManager store during a deprecation window.
Co-authored-by: MervinPraison <[email protected]>
Introduced new HTML documents outlining the praisonai-mcp server host features, installation instructions, and usage guidelines. This enhances the understanding of the MCP server's capabilities and integration with other packages.
- Accept config= kwarg so SandboxManager can construct DaytonaSandbox
(mirrors sibling backends); derive image/timeout/cpu/memory from config
while keeping legacy direct kwargs backward-compatible
- Combine cd/export/command into a single process.exec call so env vars
and working_dir actually apply to the executed command
- execute_file now reads local file content and dispatches by language
(mirrors E2B), falling back to remote path execution when not local
Co-authored-by: Mervin Praison <[email protected]>
Wire Typer run/shell/backends to SandboxHandler, implement daytona-sdk
DaytonaSandbox, expand live Docker/manager tests and backward-compat gates,
and refresh praisonai-sandbox and praisonai-agents lockfiles.
Co-authored-by: Cursor <[email protected]>
- MCP.shutdown(): fall back to close() for HTTPStreamMCPClient/
WebSocketMCPClient, which expose close()/aclose() but not shutdown().
Previously these transports leaked on shutdown; also fixes Agent.aclose()
fallback path.
- Agent.close()/aclose(): remove this agent's id(self)-scoped tool circuit
breakers via new _cleanup_circuit_breakers(), preventing a reused object
id from inheriting a stale OPEN breaker and keeping the registry bounded.
Co-authored-by: Mervin Praison <[email protected]>
- close()/aclose(): shut down MCP clients passed via tools=[MCP(...)] by
walking self.tools (mirrors remove_mcp_server) instead of the always-empty
self._mcp_clients check, so subprocesses/threads are cleaned up deterministically.
- circuit breaker: scope the registry key to the Agent instance
(tool_{id(self)}_{name}) so one agent's failing tool no longer trips the
breaker for another agent's same-named tool.
- llm resolution: prefer llm_instance (the real LLM object) over the always-truthy
llm model-name string in the token-tracking, token-metrics and guardrail paths,
restoring set_current_agent/last_token_metrics wiring and configured-instance reuse.
Co-authored-by: MervinPraison <[email protected]>
- manager.get_available_types(): invoke callable is_available before bool();
ImportError path no longer advertises subprocess as available
- _plugin_registry fallback: translate non-ImportError loader failures to
ValueError; raise AttributeError from None in lazy __getattr__
- Realign E2B tests to the real to_thread-based implementation (25 active,
was 20 skipped); rewrite Daytona tests to the fail-loud stub contract
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- e2b: use importlib.import_module in is_available (aligns with tests, fixes CI)
- e2b: run_command list uses shlex.join to avoid shell reinterpretation
- _plugin_registry: self-contained fallback so praisonai-sandbox works without praisonai-code
- subprocess: guard sys.executable None/empty for PATH and cmd
- sandlock: allow sandbox root in _safe_sandbox_path so list_files("/") works
Co-authored-by: Mervin Praison <[email protected]>
Move sandbox backend implementations out of the wrapper into praisonai-sandbox,
preserve praisonai.sandbox shims, wire agents bridge/registry dispatch, and add
CI gates, publish slot, and backward-compat tests for the eight-package model.
Co-authored-by: Cursor <[email protected]>
- Never deliver start_automation to an idle CLI connection (filter is_cli
in the send + retry loops, not just the caller).
- Allow the side panel (extension) to start its own session without being
self-excluded as NO_EXTENSION.
- Claim the extension's session_id before awaiting send_text so concurrent
start_session calls cannot both pass the busy guard; release on failure.
- Stamp ended_at when a session is finalized as "cancelled".
- Add tests for side-panel start, idle-CLI exclusion, cancel_session
routing, and cancelled ended_at.
Co-authored-by: Mervin Praison <[email protected]>
Reject concurrent start_session when the extension is busy or absent,
avoid reporting "running" when start_automation was never delivered, and
release/finalize session locks on disconnect so /health returns to
sessions:0. Adds extension_busy/active_session_id to /health.
Co-authored-by: Mervin Praison <[email protected]>
Extract shared _extract_schema helper and let validate_tool_schema_consistency
optionally return built schemas so get_sorted_tool_schemas reuses them instead
of rebuilding every tool schema a second time. No behaviour change.
Co-authored-by: MervinPraison <[email protected]>
Delegate the delta-accumulation loop in _process_stream_delta() to the
existing _process_tool_calls_from_stream() method, removing the byte-for-byte
duplicate accumulator. The outer guard in _process_stream_delta() is unchanged,
so whether/when accumulation runs is unaffected.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback on the ToolResolver memoisation:
- Cap the resolver cache as a small LRU (OrderedDict) so a long-running
process that builds many workflows no longer retains every registry,
its tool callables/modules and resolver caches for the process life.
- Skip caching entirely when registry is None: a fresh registry is built
per call so its id() is never stable, meaning caching it only leaked
memory and never produced a hit.
Co-authored-by: Mervin Praison <[email protected]>
create_tool_registry_with_overrides re-implemented praisonai-tools package
discovery that ToolResolver._resolve_from_praisonai_tools already owns and that
resolve_tools() already consults via the canonical resolver. Remove the
duplicate so external-tool discovery has a single implementation.
The template/cwd tools.py autoload is intentionally kept in the wrapper because
it carries the distinct PRAISONAI_ALLOW_TEMPLATE_TOOLS gate (with a
skip-on-error contract and explicit-template-dir-outside-CWD support) that the
resolver's PRAISONAI_ALLOW_LOCAL_TOOLS + CWD-boundary gate does not provide, so
delegating it would change the security gate.
Co-authored-by: MervinPraison <[email protected]>
Callers invoke resolve_tools() once per agent/step over the same registry
object, and each call rebuilt a fresh ToolRegistry + ToolResolver, discarding
per-instance caches and re-executing local tools.py once per agent. Extract
resolver construction into _get_resolver(), memoised on
(id(registry), template_dir, autoload_enabled), so one resolver is reused
across a workflow build. Resolution order, results, and the security gate are
unchanged.
Co-authored-by: MervinPraison <[email protected]>
Add pre-flight bridge health check, step watchdog, and explicit
start_automation delivery signalling so the extension-mode CLI run
no longer hangs silently on keepalive PING/PONG until timeout.
- server.py: /health now reports extension_connections; start_session
response includes start_automation_sent so the CLI knows whether the
task actually reached an extension.
- browser.py: _require_bridge() pre-flight check (exit 2 fast); handle
server error messages; 30s first-step watchdog; verbose automation
delivery status; infra/timeout/task exit codes (2/3/1).
Co-authored-by: Mervin Praison <[email protected]>
Prioritize [question] title detection before the bug substring check and
guard autoClaude against the question label, so bracket-prefixed titles
like "[QUESTION] Is this a bug?" no longer auto-trigger Claude analysis.
Co-authored-by: Leebana <[email protected]>
Address reviewer findings on PR #3115:
- P1: /health counted all WebSocket clients, so a stray CLI connection could
produce a false-positive extension check. Track chrome-extension origin
connections server-side and expose extension_connections in /health; doctor
and launch polling prefer it (fallback to connections for older servers).
- P2: launch --no-server failure guidance pointed to a dead /health endpoint.
Guidance is now conditional: with --no-server it tells the user to start the
bridge first, otherwise it shows the curl verification step.
Co-authored-by: Mervin Praison <[email protected]>
- Treat malformed UTF-8 as JSON-RPC -32700 parse error instead of
terminating the transport (CodeRabbit)
- Bound the stdin queue and apply backpressure via timeout-based put so a
fast/malicious client cannot grow memory without limit (CodeRabbit)
- stop() now enqueues the EOF sentinel to wake a blocked line_queue.get so
shutdown exits cleanly even when stdin stays open (Greptile, CodeRabbit)
- Add regression test for invalid UTF-8 input
Co-authored-by: Mervin Praison <[email protected]>
- Remove early-return from BrowserServer.start() so programmatic callers
retain the documented blocking contract (CodeRabbit Major)
- Move proactive _port_in_use pre-check into the CLI, reusing the rich
'already running' message and exiting 0
- Make _port_in_use family-agnostic via getaddrinfo so IPv6 (::1) hosts
are probed correctly (Greptile P1)
- Use errno.EADDRINUSE instead of magic numbers; drop redundant f-prefixes
Co-authored-by: Mervin Praison <[email protected]>
The friendly error reported ws://127.0.0.1 but the run command actually
connects to ws://localhost and the health checks elsewhere use localhost.
Align the message (and its test) to localhost for accuracy.
Co-authored-by: Mervin Praison <[email protected]>
Zero-arg / all-optional tools serialized inputSchema.required as JSON null,
which strict MCP clients (Cursor's Zod validation) reject, discarding the
entire tools/list batch so only mcp_auth appeared. Omit the required key when
empty and defensively normalize any legacy required:null at the export
boundary.
Co-authored-by: Mervin Praison <[email protected]>
Replaces loop.connect_read_pipe(sys.stdin) which crashes on Windows
ProactorEventLoop + Python 3.13 with WinError 6. Reads stdin in a daemon
thread and hands lines to the asyncio loop via run_in_executor; writes
responses to sys.stdout.buffer with flush. Portable across platforms.
Co-authored-by: Mervin Praison <[email protected]>
- launch: on auto-load failure, print exact 'Load unpacked' dist path and
bridge verification steps (Chrome 137+/Windows blocks automated load)
- doctor extension: check bridge /health connection (ground truth) and treat
CDP :9222 as optional, so it no longer reports a false negative when the
extension works in the user's daily Work Chrome profile
Co-authored-by: Mervin Praison <[email protected]>
- Remove emoji from server.py start() banner and CLI run banners to avoid charmap crashes on cp1252 Windows consoles
- Reconfigure stdout/stderr to UTF-8 in __main__ before console import
- Add pre-bind port probe so a duplicate start reports "already listening" instead of raising a bind error
- Map WinError 10048 / EADDRINUSE to a friendly "already running" message with exit code 0 in the start command
Co-authored-by: Mervin Praison <[email protected]>
Translate cross-platform connection-refused errors (WinError 1225,
ECONNREFUSED 111/61) into an actionable message naming the bridge URL,
the `praisonai browser start` command, and the health-check URL.
Co-authored-by: Mervin Praison <[email protected]>
External bug reports like [praisonai-mcp] and [praisonai-browser] were
skipped because only [bug] matched the title gate. Match any leading
[...] prefix when the issue has bug or enhancement labels.
Address session-isolation gaps in agent-invoke:
- _supports_session_isolation now uses isinstance(Agent) so application
Agent subclasses are cloned per session instead of sharing state.
- resolve_session_agent raises on clone failure instead of falling back
to the shared template, preventing cross-session history leaks.
- Handlers surface isolation failures as clean errors.
- Add tests for subclass isolation and clone-failure behaviour.
Co-authored-by: Mervin Praison <[email protected]>
Short-circuit resolve_all_from_yaml's project-tool discovery with the cheap
local_tools_enabled() opt-in check before walking directories and shelling out
to `git rev-parse`. Loading is gated anyway, so the git subprocess added no
value when PRAISONAI_ALLOW_LOCAL_TOOLS is off (the default). Also narrow the
import guard to ImportError.
Co-authored-by: Mervin Praison <[email protected]>
- Optimizer now swaps goal/backstory (which drive the cached system prompt),
not just instructions, and clears the system-prompt cache, so each candidate
is scored with its own effective prompt instead of the original.
- Isolate eval chats via agent.ephemeral() to stop history pollution.
- Parse multiline candidates as complete blocks (delimiter + blank-line
fallback) instead of per-line fragments.
- Floor non-finite metric scores (NaN/inf) to 0.0 in both optimizer and loop.
- Move EvaluationLoopResult.best after metadata to avoid positional shift.
- Add tests for goal/backstory swap, apply, multiline parsing, non-finite scores.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Wire the existing gated .praisonai/tools/ discovery into resolve_all_from_yaml
so @tool-decorated functions dropped into the convention are available to
YAML-defined agents by their tool name. Additive and backward compatible with
the cwd tools.py / tools/ paths.
Co-authored-by: MervinPraison <[email protected]>
The agent-serving endpoint dispatched every request against a single
shared Agent instance and ignored session_id, leaking mutable
chat_history across concurrent callers and making the advertised
"conversation continuity" a no-op.
Introduce resolve_session_agent() in the wrapper: the registry now holds
a template, and each request gets an isolated clone (via the existing
clone_for_channel safe-copy path). A provided session_id binds the clone
to the shared, file-locked DefaultSessionStore for continuity + cross-
session isolation; its absence yields an ephemeral conversation. Non-
Agent objects (e.g. mocks) fall back to the shared instance for backward
compatibility. Composes existing core primitives only — no new core
surface.
Co-authored-by: MervinPraison <[email protected]>
- EvaluationLoop now keeps and returns the highest-scoring iteration
(best/best_score/best_output) instead of the last one, and supports an
optional numeric metric to drive scoring instead of the LLM Judge.
- New PromptOptimizer (eval/prompt_optimizer.py) generates instruction
variants, scores each over an eval set, keeps the best, and optionally
writes it back to agent.instructions.
- Agent.optimize_instructions / aoptimize_instructions convenience methods.
- Lazy exports for PromptOptimizer/OptimizeResult.
Co-authored-by: MervinPraison <[email protected]>
- server.py: resolved secret string now wins over a raw {source,id} reference
dict in the runtime channel merge, so adapters (e.g. WhatsApp verify_token)
never receive an unresolved reference.
- gateway doctor --json: emit a single combined JSON document ({probes,secrets})
instead of two top-level documents so json.load(s) can parse the output.
- gateway doctor: exec-sourced credentials are reported as "configured" without
running their command, so a one-shot/rate-limited/rotating secret command is
not executed twice (availability report + probe).
Co-authored-by: Mervin Praison <[email protected]>
Add a lightweight, protocol-first secret-reference contract so credential
fields (token, app_token, verify_token) can be sourced from an env var, a
mounted secret file, or a command/secret-manager, with resolved values
registered for log redaction.
- core: praisonaiagents/secrets.py — SecretRef, SecretResolver protocol,
stdlib DefaultSecretResolver (env/file/exec), resolver registry, and a
redaction registry (register_secret_for_redaction / redact_secrets).
- config schema: credential fields accept the additive {source, id} form;
plaintext and ${ENV} stay fully backward compatible; resolved values are
registered for redaction.
- gateway doctor: reports each credential as available |
configured-but-unavailable | missing without printing the value.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer feedback on PR #3100:
- Add local_tools_enabled() mirroring the loader's exact acceptance
(lower() == "true") so false/0 no longer suppress the hint while the
loader still denies (no silent no-op). Used by both the auto-discovery
hint and the --tools file path.
- Make --allow-local-tools a strictly per-invocation grant: set the env
gate for the run and restore the prior value in a finally, so a later
in-process run never inherits authorization to exec local Python.
- count_project_tool_files() now returns (project_count, user_count) so
the hint names the correct source (.praisonai/tools/ vs
~/.praisonai/tools/) instead of mislabelling user-global files.
- Tests: local_tools_enabled semantics (incl. false/0), tuple counts,
and false-value hint coverage.
Co-authored-by: Mervin Praison <[email protected]>
Playwright and CDP automation engines call agent.process_observation()
synchronously from inside async methods that run via asyncio.run().
The praisonaiagents runner rejects execute_sync() when an event loop
is already active, causing RuntimeError on every LLM observation
step and blocking all headless browser automation.
Changed to await agent.aprocess_observation() in both engines,
matching the async pattern already used by server.py.
Fixes#3093
- memory_mixin: feature-detect whether a session store's add_message accepts
tool_calls/tool_call_id; fall back to a plain-text turn for legacy protocol
stores so tool turns are never silently dropped by a swallowed TypeError.
- hierarchy: HierarchicalSessionStore.add_message now accepts and preserves the
optional tool fields so hierarchical stores also resume faithfully.
- store: count-based history slicing (get_chat_history / get_working_history)
no longer begins on an orphaned role="tool" result, avoiding invalid
transcripts on resume when the boundary lands mid tool-exchange.
- tests: cover legacy-store fallback, hierarchical store tool fields, and
the trim boundary skipping orphaned tool results.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
When .praisonai/tools/*.py files are present but PRAISONAI_ALLOW_LOCAL_TOOLS
is unset, run now prints a concise hint on the default path explaining how to
enable them, instead of silently skipping. Adds a discoverable
--allow-local-tools flag and aligns the init scaffold copy so the enable step
is stated up front.
Co-authored-by: MervinPraison <[email protected]>
The zero-config JSON session store only round-tripped role/content text,
so resuming a tool-using agent via --continue / session resume silently
dropped its tool calls and results. Add optional, additive tool_calls /
tool_call_id fields to SessionMessage (tolerant of absence for old files),
preserve them through get_chat_history / get_working_history / set_chat_history,
and teach _persist_message to forward assistant tool-call and tool-result
turns so resume reconstructs the same message list the model saw before.
Co-authored-by: MervinPraison <[email protected]>
Checkpoints already form an ordered shadow-git sequence, so a "turn" is an
index into it. Add a lightweight CheckpointService.rewind(steps) helper over
the existing list_checkpoints + restore, and surface it as
`praisonai checkpoint rewind [steps]` (default 1 = undo the last turn's file
changes). No changes to agent.py, the tool loop, or the session store.
Co-authored-by: MervinPraison <[email protected]>
apply_diff, search_replace and append_to_file previously gated the
workspace confinement check behind `if workspace:`, silently skipping it
when no workspace was passed. This let an LLM escape cwd via an absolute
path (e.g. apply_diff("/etc/hosts", ...)). Align all three with the
existing write_file/read_file behaviour: default the workspace to cwd and
always enforce is_path_within_directory.
Co-authored-by: MervinPraison <[email protected]>
- execute_tool_async now routes through the tool MiddlewareManager (parity
with sync execute_tool): before_tool/after_tool/wrap_tool_call gate async
tool calls too, so security/audit hooks are no longer bypassed. Fast path
(no hooks) unchanged. Core retry loop extracted to
_execute_tool_async_with_retry.
- Workflow._execution_lock uses module-level double-checked locking so two
threads first entering run()/astart() concurrently share one lock object
instead of each minting and acquiring its own, closing the run-guard race.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1: Route Agent(hooks=[...]) tool middleware (before_tool/after_tool/
wrap_tool_call) through execute_tool via a lazily-built MiddlewareManager.
Zero overhead when no hooks are registered.
Gap 2: Apply the same retry / guardrail-retry / output_file policies used by
the top-level run() loop to nested-pattern steps (Parallel/Loop/Route/If/
Repeat) and hierarchical mode via a shared _apply_step_policies helper.
Gap 3: Guard run()/astart() against concurrent re-entrancy on a shared
Workflow instance with a lazily-created lock, raising a clear error instead
of silently corrupting per-run state.
Co-authored-by: Mervin Praison <[email protected]>
- execution_mixin: async tool path now runs the same policy/guardrail gate as
sync (_check_tool_policy_and_guardrails), closing the async bypass.
- sqlite/in_memory adapters + memory.py: delete_memory takes an optional tier
so delete_short_term/delete_long_term only touch their own tier — prevents a
short-term delete from erasing an unrelated long-term row with the same id.
- tool_execution: policy check_tool and guardrail validate_tool_call exceptions
now fail closed (deny) instead of silently executing the tool.
- workflows: a step whose guardrail never validates after exhausting retries is
now treated as failed, honoring on_error='stop' and the final workflow status;
on_step_complete is fired on a stopped failure.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on #3080:
- Falsy tool results (""/[]/{}/0/False) were dropped by the upstream
detector's truthiness check, disabling no-progress detection; now wrapped
so they remain fingerprintable.
- Identical-result streak now requires the same tool, so unrelated tools
returning a common value (e.g. "ok"/True) are not lumped into one run.
- Progress markers now record an action-index boundary so mark_progress()
actually resets the streak.
- Count-based idempotent/mutating BLOCK/HALT is now gated on an actual
stuck (identical-result) streak, preventing false halts on legitimate
high-frequency-but-progressing tool use (fixes wiring-test regression).
- Post-execution loop-guard BLOCK/HALT decisions are now surfaced to the
model instead of being silently discarded.
Co-authored-by: Mervin Praison <[email protected]>
- Remove dynamic -attempt suffix; use `git worktree add -B` so path()/reset()/
remove() deterministically resolve the same target (fixes resource leak /
state-mismatch flagged by CodeRabbit & Greptile)
- Fail fast with a clear exception when isolation is requested but provisioning
fails, instead of silently clobbering the shared root
- Check exit status in reset()/remove() and raise on failure
- Prune stale worktree bookkeeping before create so re-create after remove works
- Collision-resistant slug (append short name hash) so distinct names never
share a worktree
- Sort __all__ alphabetically
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer-flagged P0/P1 issues in per-task worktree isolation:
- Anchor all git ops to a fixed repo dir (env override / resolved cwd)
instead of the mutable process cwd.
- Validate caller-supplied task ids before using them as path/ref
components (reject traversal, invalid ref chars); refuse worktree
creation on unsafe ids instead of failing open to the shared cwd.
- Commit uncommitted worker edits before integrating so a clean-but-empty
merge no longer discards work on teardown.
- Honor the integration `git commit` return code and abort on failure so a
rejected commit blocks the task rather than reporting success.
- Route non-conflict merge failures and integration exceptions to 'blocked'
so a task is never marked 'done' with an unmerged branch.
- Add `workspace_kind` to the public update allowlist so opting an existing
task into 'worktree' actually persists.
Adds tests for uncommitted-edit preservation, failed integration commit,
integration exception blocking, and unsafe-id rejection.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on PR #3081:
- _extract_summary_text no longer falls back to instance _previous_summary,
so a reused compactor cannot persist an outdated summary on a later
non-summarizing pass (drops intervening turns on resume).
- async compaction persists the checkpoint via asyncio.to_thread so the
locked JSON read/modify/write disk I/O no longer stalls the event loop.
- add regression test for the stale-summary leak.
Co-authored-by: Mervin Praison <[email protected]>
Addresses 3 P1 review findings on #3049 reload observability:
- health() overlays live _reload_watcher_active onto the recorded
ReloadStatus snapshot so a watcher that exits after the last reload is
reported as disabled instead of stale active.
- initial config load defers applied_config_revision until channels/agents
are actually up, and records a failed reload (and re-raises) if setup
throws, so a partial start no longer reports the config as live.
- bump praisonaiagents minimum to >=1.6.152 so standalone praisonai-bot
installs resolve an agents release containing ReloadStatus /
compute_config_revision (avoids ImportError at import time).
Adds a regression test for the stale-watcher case.
Co-authored-by: Mervin Praison <[email protected]>
HealthMonitorSchema used invented keys (check_interval, failure_threshold,
etc.) that the runtime never reads. server.py passes gateway.health straight
to HealthMonitorConfig.from_dict, which only consumes interval/startup_grace/
stale_after/stuck_after/max_restarts_per_hour/enabled. As written the PR would
reject a valid `interval: 60` (extra="forbid") and silently accept ignored
keys. Fixes the schema to mirror the real runtime keys and adds a regression
guard test.
Co-authored-by: Mervin Praison <[email protected]>
Update the seen set while merging extra_tools so duplicates within the
resolved --tools/--toolset/discovered set are removed (not just against
frontmatter), matching _auto_discover_project_tools. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
- tool_execution: gate resolved tool calls through the attached PolicyEngine
(check_tool) and tool-call guardrails (validate_tool_call) before dispatch;
denials are non-retryable and bypass the circuit breaker
- memory: delegate reset_/delete_short_term/long_term to the active adapter
(sqlite/in_memory) to avoid the legacy short_mem/long_mem schema mismatch,
and return the memory id from store_short_term/store_long_term
- memory adapters: add delete_memory/reset_short_term/reset_long_term to the
sqlite and in-memory adapters
- workflows: AgentFlow.run() honors step.on_error="stop" (aborts + marks
failed) and the final status reflects any unresolved step failure instead
of always reporting "completed"
Co-authored-by: Mervin Praison <[email protected]>
Opt-in worktree isolation (workspace_kind="worktree") gives each parallel
worker a dedicated git worktree/branch (kanban/<task_id>) as its cwd, and
integrates the branch back on completion with conflict-on-merge detection —
routing conflicts to 'blocked' instead of silently overwriting. Default
"default" keeps today's shared-cwd behaviour.
Co-authored-by: Mervin Praison <[email protected]>
Core (praisonaiagents/gateway): add a frozen ReloadStatus dataclass and a
pure compute_config_revision() helper to protocols.py + exports, giving both
the SDK and bot a canonical reload-status shape and deterministic config hash.
Wrapper (praisonai-bot): record the last reload outcome (ok/failed/no_changes)
and the applied-config revision in _reload_config_locked/start_with_config,
track watcher liveness, and surface reload/applied_config_revision/
on_disk_config_revision/config_drift in health(). CLI `gateway status` now
prints reload result, config drift, and watcher state.
Co-authored-by: Mervin Praison <[email protected]>
The durable persist+resume machinery (Issue #2741) already existed, but
CompactionResult.summary was always "", so the persister received nothing
and every summary was lost on process exit. Populate it from the produced
summary (LLM/naive/fallback) and persist in the async proactive path too.
Co-authored-by: Mervin Praison <[email protected]>
The LoopGuard "no progress" heuristic counted every tool call as no-progress
because its progress counter was never updated (mark_progress is not called in
the tool loop), so any turn with 8+ tool calls halted regardless of results.
This broke legitimate async / long-running MCP tool workflows that poll a job
status (IN_PROGRESS -> COMPLETE) or pace with a wait tool.
Now no-progress is measured by the trailing run of identical tool-result
fingerprints: distinct/changing results reset the streak (progress), while a
genuinely stuck loop of identical results still halts. The real tool result is
passed through record() so the fingerprint reflects actual output.
Co-authored-by: Mervin Praison <[email protected]>
Replace the opaque `gateway: Optional[Dict[str, Any]]` in GatewayConfigSchema
with load-time validation via a typed GatewayServerSchema (extra="forbid",
ranges mirroring core's GatewayConfig) plus HookSchema/HealthMonitorSchema, so
a misspelled or mistyped server knob (drain_timout, "quick") now fails closed
with a friendly, field-named error instead of being silently dropped at
runtime. Blocks stay stored as dicts for backward-compatible downstream access.
Co-authored-by: Mervin Praison <[email protected]>
_run_custom_agent ignored --tools/--toolset and never auto-discovered
.praisonai/tools/*.py, so the "auto-loaded on every run" promise only held
for the default and actions paths. Wire explicit tools/toolsets plus
project-local auto-discovery into the --agent path, unioned with the
frontmatter tools: list (dedup by callable identity), still gated by
PRAISONAI_ALLOW_LOCAL_TOOLS.
Co-authored-by: Mervin Praison <[email protected]>
Adds a protocol-first messaging module giving agents a first-class
sender->named-recipient channel that the bus (type-filtered, no target),
kanban comments (task-scoped, pull-based board) and handoff (sync
parent->child) all lack.
- messaging/protocols.py: AgentMessage + AgentMailboxProtocol
- messaging/inprocess.py: light in-process default impl (InProcessMailbox)
- messaging/__init__.py: lazy exports (zero overhead unless used)
Scoped minimal per AGENTS.md: core protocol + in-process default only.
No Agent param, no agent.py changes, no heavy deps. The wrapper can add
a Redis-backed impl of the same protocol for cross-host fleets.
Co-authored-by: Mervin Praison <[email protected]>
Adds the core primitive for per-step workspace checkpoints by encoding a
step index into the shadow-git commit message (zero extra storage):
- CheckpointService.save(..., step=N) tags a per-step checkpoint
- CheckpointService.restore(step=N) + get_checkpoint_by_step() rewind to a step
- Checkpoint.step field surfaced in list/to_dict
- CLI: `praisonai checkpoint restore --step N`
Backward-compatible and opt-in; no new Agent params or config modules.
Co-authored-by: Mervin Praison <[email protected]>
Add WorkspaceIsolationProtocol with NoIsolationAdapter (default,
zero-overhead) and GitWorktreeAdapter (real git worktree per run via
lazy stdlib subprocess) so concurrent agents can edit the same repo
without clobbering each other. Degrades gracefully when cwd is not a
git repo. Lazily exposed from praisonaiagents.workspace.
Co-authored-by: Mervin Praison <[email protected]>
- Remove unreachable StepResult lazy branch in workflows/__init__.py
(StepResult is bound at module top and in __all__, so __getattr__ never
fires for it; the branch also returned a different results.py class,
masking a latent class-identity mismatch)
- Remove orphaned structured_execution.py and its lazy branch
(StructuredWorkflowExecutor/execute_step_structured had zero consumers)
Live branches (StepError, WorkflowResult, StepStatus, ErrorStrategy),
results.py, and the memory/workflows shim are untouched.
Co-authored-by: MervinPraison <[email protected]>
Standalone `pip install praisonai-mcp` (without praisonai-code) previously
crashed config subcommands (list/add/remove/test/sync/run/auth/logout/…) and
bare `praisonai-mcp` (callback→list) with an uncaught ImportError and empty
output. Add a lazy `_require_code()` guard that exits cleanly (code 1) with an
actionable install hint. Host commands (serve/list-tools/doctor) are unaffected
and still route directly to the server without needing praisonai-code.
Co-authored-by: Mervin Praison <[email protected]>
- Fix ModuleNotFoundError: praisonai_mcp.cli.output — route
get_output_controller through the lazy praisonai_code bridge in
_configuration.py (resolves CI test_mcp_list, test_cli_shim_app_identity,
and test_get_command_resolves_mcp which failed because the command import
raised before resolution).
- Scope logging/setLevel to the actual running package logger tree derived
from __name__ (praisonai_mcp.mcp_server) instead of the legacy
praisonai.mcp_server shim namespace.
- Guarantee subprocess cleanup on TimeoutExpired (test) and KeyboardInterrupt
(stdio serve); always shut down MCP instances in sync/SSE via try/finally.
- Always clear temporary OAuth state/code verifier via finally.
- Remove redundant/broken assignment and unused var in check_c12_mcp_imports.sh.
Co-authored-by: Mervin Praison <[email protected]>
Route get_available_tools() through the canonical ToolResolver (single
source of truth) and demote the frozen AVAILABLE_TOOLS list to a
last-resort fallback, so all three auto-generators advertise the
actually-installed tools instead of the drifting legacy CrewAI list.
Move the resolver helpers to BaseAutoGenerator and use the shared
context-local _get_default_resolver() so the auto phase and
AgentsGenerator reuse one warm cache per run instead of repeating full
tool discovery. AgentsGenerator now accepts an optional tool_resolver
for DI.
Co-authored-by: MervinPraison <[email protected]>
Remove dead-code Chainlit-era UI modules with zero importers anywhere in
the codebase:
- ui/callbacks.py (CallbackManager)
- ui/components/aicoder.py (AICoder)
Neither module is imported, re-exported, or in any __all__. The live
`praisonai ui` loader resolves bundled presets from ui_*/default_app.py,
which are unaffected.
Co-authored-by: MervinPraison <[email protected]>
Default publish_all.py to git-diff based selection: only bump and ship
packages with changes since the last v* tag, plus the wrapper when any
tier-2 or agents package publishes so pins stay current. Use --all for
the previous seven-package coordinated release.
Move the heavy MCP server host out of the wrapper into praisonai-mcp with
backward-compat shims, _MCP_RESIDENT_COMMANDS routing, CI/publish wiring,
and regression gates so pip install praisonai keeps working.
Restrict labeled-event bypass to praisonai-triage-agent[bot] only (P1).
Require actionable title prefix for external bug/enhancement auto-trigger (P2).
- browser CLI: point relocated engine/utility imports at praisonai_browser.*
package root (were resolving to nonexistent cli.commands.* submodules)
- cdp_agent/playwright_agent: implement advertised clear_input action
- agent.process_observation: return the round-tripped dict so executors
always receive a normalized value field (populated from text)
- _protocol_bridge: pass extra actions through as strings instead of
re-raising on BrowserActionType()
- tests: fix REPO parents[] index in C11 compliance/backward-compat suites
Co-authored-by: Mervin Praison <[email protected]>
Move extension bridge, CDP, and Playwright automation out of the wrapper with backward-compat shims, protocol bridge to agents-tier browser types, and full CI/release wiring.
Addresses Greptile P1 review feedback on #3052:
- Only set early_stopped when iterations remain (iteration_num < self.iterations),
so reaching 9.5 on the last iteration is reported as a full run.
- Gate "Requested Iterations" summary row on the early_stopped flag instead of a
cross-scope count comparison (unreliable with multiple scenarios).
- Add regression test for 9.5-on-final-iteration.
Co-authored-by: Mervin Praison <[email protected]>
- Clarify --iterations is a maximum in CLI help, README and docstrings
- Add --no-early-stop / no_early_stop to force all iterations
- Log one INFO line on early stop (visible even in --quiet)
- Show Requested/Completed and Stopped Early in summary when truncated
- Track early_stopped in report metadata
- Add unit tests for early-stop behavior
Co-authored-by: Mervin Praison <[email protected]>
Greptile P1: --storage-backend file --storage-path <dir> was silently
ignored by list/show/apply (read default ~/.praison/train instead), so
sessions written to a custom file directory were invisible.
- _resolve_backend now returns a FileBackend for file+custom path
- list scans the custom dir via list_training_sessions(storage_dir=...)
- adds TestCustomFileBackedSessions regression coverage
Co-authored-by: Mervin Praison <[email protected]>
SQLite-backed training sessions were invisible to list/show/apply because
those commands scanned ~/.praison/train/*.json and gated on JSON file
existence, ignoring the backend used during training.
- Add backend-aware TrainingStorage.exists() (delegates to _store.exists())
- Add list_sessions_from_backend() to enumerate sessions from a backend
- Add --storage-backend/--storage-path flags to list/show/apply
- Thread backend through get_training_profile for apply
Co-authored-by: Mervin Praison <[email protected]>
Address Greptile P1s on ScheduleLoop:
- start() now checks is_running before mutating _store/_runner/_on_due so
calling it on a live loop is a true no-op (no callback/store swap mid-tick).
- fire_due() runs its claim+fire under a per-instance lock so overlapping
external calls / the loop thread cannot double-fire a due job on stores
using the non-atomic get_due_jobs fallback.
Co-authored-by: Mervin Praison <[email protected]>
Make the scheduler *firing* mechanism as pluggable as the *store* already is.
Adds SchedulerProviderProtocol (the "when to fire" contract) beside
ScheduleStoreProtocol in core, with the existing ScheduleLoop as the default
implementation (aliased InProcessScheduleProvider). ScheduleLoop now exposes
fire_due() (one tick's claim+fire, callable without an always-on thread) and a
start(on_due=..., store=...) signature satisfying the protocol, enabling
event-driven/serverless/external firing while staying fully backward-compatible.
Protocol-only, no heavy deps, no new Agent params; heavy providers
(APScheduler/webhook) remain out of scope for the wrapper.
Co-authored-by: Mervin Praison <[email protected]>
The async chat path calls execute_tool_async, which bypassed
_execute_tool_with_context and never populated _turn_tools_used. This
left the async self-improve review seeing an empty tool list. Record the
tool name in execute_tool_async using the same guarded pattern as the
sync path, and add async tracking tests.
Co-authored-by: Mervin Praison <[email protected]>
Narrow the UnicodeEncodeError=success handler so it only wraps the
post-run summary display, not trainer.run() itself. A verbose mid-run
encoding error (before save_report) is now a real failure, while a
display-only error after persistence downgrades to a warning. Guards
the verbose post-save print_summary() in the orchestrator too.
Addresses Greptile P1 on PR #3055.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on PR #3053:
- Greptile P1: uv.lock omitted litellm from praisonai-train's dependencies
and requires-dist even though pyproject.toml declared it, so frozen
installs could reject the stale lock or omit litellm. Added litellm to
both sections.
- Greptile P2: the `train llm` bridge caught every ImportError and printed
the praisonai-train[llm] hint, masking nested failures from installed
transitive deps. Now only shows the install hint when praisonai_code is
truly absent (code_available()); otherwise surfaces the real cause.
Co-authored-by: Mervin Praison <[email protected]>
Addresses Greptile P1: a create staged (propose=True) in project A then
approved from a different cwd re-resolved _skills_base_dir(), writing the
skill into the approver's directory (or user home) instead of project A.
Now the resolved destination is captured at staging time and honoured by
create_skill via an internal base_dir override.
Co-authored-by: Mervin Praison <[email protected]>
Track per-turn tool names in a _turn_tools_used buffer and default the
after-agent hook's tools_used from it when chat paths omit the argument.
Without this the DefaultSkillReviewPolicy always saw an empty list and the
self-improve review never fired.
- agent.py: initialize _turn_tools_used buffer
- chat_mixin.py: reset buffer at start of each _chat_impl/_achat_impl turn;
fix verbose display NameError (undefined `tools` -> self.tools)
- tool_execution.py: record tool name in _execute_tool_with_context (skipped
during guarded review turns); default hook tools_used from buffer in sync
and async after-agent hooks and consume it
Co-authored-by: Mervin Praison <[email protected]>
Training could complete and persist a session, then crash while printing
the Rich summary because the Status row contained emoji that cp1252 stdout
cannot encode. The broad except handler mislabeled this display error as
"Training failed" with exit 1.
- Add console_supports_unicode() probe in models.py
- Use ASCII labels for Status/markers when stdout is not UTF-8
- Fall back to ASCII summary on UnicodeEncodeError in print_summary
- Split CLI handler so encoding failures report success (exit 0)
- Guard show/orchestrator emoji markers behind the same probe
- Add cp1252 encoding unit tests
Co-authored-by: Mervin Praison <[email protected]>
- SkillManager._skills_base_dir() now prefers project ./.praisonai/skills/
when it exists, so skill writes land where discovery reads and users look;
falls back to user home (~/.praisonai/skills/) otherwise.
- Keep the pending-mutation store in user home regardless of cwd so proposals
remain discoverable for approval.
- Log an INFO line with the SKILL.md path when a skill is created directly,
complementing the existing "staged for approval" pending log.
Co-authored-by: Mervin Praison <[email protected]>
Issue A: praisonai-train requires litellm at runtime for agent training
(LLM-as-judge grading), but it was not declared in pyproject.toml. Add
litellm>=1.0 to core dependencies so a clean `pip install praisonai-train`
resolves all runtime imports for live grading.
Issue B: `praisonai-train llm` printed a wrong install hint when ML/code
deps were missing. Catch the bridge ImportError and surface the correct
`pip install "praisonai-train[llm]"` remediation.
Co-authored-by: Mervin Praison <[email protected]>
External bug/enhancement reports never received the claude label, and
bot-applied claude labels were blocked by the actor filter—so claude-response
never ran after issue-triage.
- server.py: consume the cancellation marker once it is honoured (both the
active-task and pre-registration paths) so a later request reusing the same
JSON-RPC id is not spuriously cancelled by a stale entry.
- server.py: make in-flight registration cleanup identity-safe so a concurrent
client reusing an id cannot have its task evicted by another's finally block.
- server.py: scope logging/setLevel to the `praisonai.mcp_server` package logger
(parent of the loggers this module actually emits through) so the change takes
effect, while still never touching the process root.
- agents_generator.py: key the timeout-wrapper marker by owning executor_factory
identity and retain the original callable, so a shared framework-tool object is
idempotent within a generator but correctly re-wrapped (not stacked) when a
different generator takes ownership — avoiding a retained, possibly-closed
executor and wrong timeout.
Co-authored-by: Mervin Praison <[email protected]>
Gap 1 — MCP notifications/cancelled was a dead path: _active_requests was
never populated so task.cancel() was unreachable, and set.pop() evicted an
arbitrary id on overflow. Register id-bearing requests as tasks and use an
OrderedDict for FIFO overflow eviction.
Gap 2 — _wrap_with_timeout mutated shared framework tool objects with no
idempotency marker, stacking wrappers on every generate_crew_and_kickoff()
and capturing foreign generators' executors. Stamp a marker so a callable /
tool method is never wrapped twice.
Gap 3 — logging/setLevel mutated the process-wide root logger and bypassed
scope enforcement. Scope it to the server's namespaced logger, validate the
level, and add an OPERATION_SCOPES entry requiring the admin scope.
Co-authored-by: Mervin Praison <[email protected]>
- Pin checkout to main (ref: main) so workflow_dispatch cannot publish
a non-main branch to production
- persist-credentials: false (no git creds retained in workspace)
- Replace TOFU ssh-keyscan with pinned known_hosts from
MIGRATION_TARGET_KNOWN_HOSTS secret + StrictHostKeyChecking=yes
- Add trap to remove SSH private key on exit
- Add BatchMode + ConnectTimeout to fail fast on unreachable host
- Upload to temp files then atomic mv into place to avoid serving
truncated or mixed-commit installers
Co-authored-by: Mervin Praison <[email protected]>
Ignore pipeline status comments that mention @claude as text, and restrict
bot-triggered runs to intentional FINAL, merge-conflict, and CI-fix phrases.
Addresses reviewer feedback on PR #3034:
- Gemini: claudeFinalReady got stuck awaiting Copilot when a required
reviewer timed out. Now short-circuits Copilot when prior.requiredTimeout.
- Gemini: maybeTriggerClaudeFinal now spreads all options into claudeFinalReady
so requiredWaitMs/skipCopilot are honored. It already injects prCreatedAt from
the fetched PR, so the fallback workflow caller activates the 30m timeout
without passing prCreatedAt (Greptile concern).
- Update self-tests to assert auto-skip without explicit skipCopilot.
Co-authored-by: Mervin Praison <[email protected]>
HTTPStreamMCPClient rewrote bare-host URLs by appending '/mcp', causing a
POST to a non-existent endpoint (HTTP 404) that the official SDK surfaces as
McpError "Session terminated" during initialize(). Use the server URL exactly
as provided, matching the official streamablehttp_client behaviour.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Prevent leaking the httpx/anyio connection or a half-open remote MCP
session when ClientSession entry or session.initialize() fails mid-handshake,
and best-effort schedule async teardown from _force_cleanup().
Co-authored-by: Mervin Praison <[email protected]>
The HTTP-Stream client passed a hand-rolled async generator and a plain
function to the official ClientSession, which expects anyio memory-object
streams. This broke session.initialize() with
"'function' object has no attribute 'send'" before any request reached the
wire. Wire HTTPStreamMCPClient to the official SDK's streamablehttp_client
(mirroring the working SSE client), relax the obsolete aiohttp requirement
(the SDK is httpx-based), and update cleanup accordingly.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
The Windows install.ps1 installed only praisonaiagents, but the onboarding step runs 'python -m praisonai setup', which failed with 'No module named praisonai'. Bring install.ps1 to parity with install.sh by installing praisonai[all] by default.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Move key lowercasing and length-descending sort to module scope so
exact mixed-case matches resolve on the fast path and per-call sorting
is eliminated. Behavior unchanged.
Co-authored-by: Mervin Praison <[email protected]>
voyage-3 (1024) is a substring of voyage-3-lite (512); sort keys by length
descending so more specific keys win. Adds test coverage.
Co-authored-by: Mervin Praison <[email protected]>
resolve_batch() had zero callers anywhere in the package, tests, or
public API, and re-implemented resolve()'s parameter-precedence ladder,
risking silent drift. Removed the ~110-line dead helper; resolve()
remains the single source of truth.
Co-authored-by: MervinPraison <[email protected]>
Extract _reset_loop_warnings() and _consume_self_correction() to remove
~40 lines of verbatim copy-paste across run_autonomous/run_autonomous_async,
eliminating sync/async drift risk and trimming agent.py per AGENTS.md.
Co-authored-by: Mervin Praison <[email protected]>
Factor the ~40 byte-identical lines shared by _trigger_after_agent_hook
(sync) and _atrigger_after_agent_hook (async) into two loop-agnostic
helpers: _build_after_agent_input (AfterAgentInput construction) and
_after_agent_side_effects (auto-memory, auto-learning, periodic nudge).
The async boundary is untouched: hook dispatch (execute_sync vs
await execute) and skill-review (run_review vs await arun_review) remain
in their respective public methods. No behaviour or async-safety change.
Co-authored-by: MervinPraison <[email protected]>
Adds explicit "lightweight & powerful, no scope creep for the sake of it"
guidance plus "critical review at each stage" to AGENTS.md (root +
praisonai-agents) and the Claude review/merge-gate/merge-conflict prompt
workflows, so issue triage, fix planning, and PR review all reject
duplicate/dead-knob scope creep and prefer existing Agent capabilities.
Co-authored-by: Leebana <[email protected]>
Cap only the non-system tail so an existing compaction summary (stored
as a system message) is never dropped when trimming oversized history
before compaction. Removes the now-redundant post-compactor safety valve.
Co-authored-by: Mervin Praison <[email protected]>
Apply the max_history hard cap before token counting and summarisation so
large short-message batches do not hang offline hosts when tiktoken attempts
a first-use network download during compaction.
- Route critical loop-block through shared blocked_result path so
trace spans, stream events, AFTER_TOOL hooks, doom-loop and
loop-guard teardown still run (CodeRabbit: dangling tool_call_start).
- Reset _pending_self_correction / _loop_warned_this_turn at the start
of run_autonomous(_async) so stale nudges never leak across calls.
- Tighten _response_indicates_failure: drop broad "i am/was unable to"
markers that flagged partial-success responses (Greptile P2).
Co-authored-by: Mervin Praison <[email protected]>
Address remaining reviewer findings on the AutoGenerator registry path:
- Reject built-in provider prefixes before consulting the registry, reusing
the same _BUILTIN_MODEL_PREFIXES set as PraisonAIModel so both hot paths
agree on which providers are 'registered' (CodeRabbit).
- Preserve provider-specific config fields (aws_region, timeout, model_kwargs,
...) when constructing a registered provider, only dropping empty credential
entries so the provider's own credential chain is not shadowed (Greptile P1).
- Add 2 regression tests covering the built-in-prefix guard and config
preservation.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- auto.py: forward config_list[0] api_key/base_url into create_llm_provider
so registered providers authenticate for generate_structured (Greptile P1).
- models.py: omit None api_key/empty base_url from provider config so a
provider's own credential chain is not shadowed (Greptile P2).
- models.py: surface a registered provider's construction failure instead of
silently falling into the uncredentialed built-in OpenAI ladder (Greptile P1).
- tests: add coverage for construction-failure surfacing and no-None-key config.
Co-authored-by: Mervin Praison <[email protected]>
PraisonAIModel and AutoGenerator now consult praisonai.llm.registry for
user-registered providers before their built-in resolution ladders, so
register_llm_provider("bedrock", ...) takes effect through both hot paths.
Built-in prefixes and unregistered providers keep their existing behaviour;
registry lookups fail closed and never raise.
Co-authored-by: MervinPraison <[email protected]>
Addresses reviewer findings on PR #2990:
- P2: falsy/unknown self_improve strings ("false"/"off"/typos) no longer
silently enable inline review; unknown values disable + warn.
- P1: background review now uses a unique per-invocation job id so a later
review never replaces an earlier queued one in the job-manager map.
- P1: guarded review runs under a per-agent lock so a background review
cannot interleave chat_history/re-entrancy state with a concurrent turn.
Co-authored-by: Mervin Praison <[email protected]>
Add a "background" execution mode for self_improve so the guarded skill-review
LLM turn runs on the core BackgroundJobManager after the reply is returned,
instead of blocking the user-visible turn. Default remains inline/blocking for
backward compatibility. Preserves re-entrancy, chat-history isolation and
best-effort failure swallowing.
Co-authored-by: MervinPraison <[email protected]>
The canonical schema treats agents/token as optional; routing the runtime
loader solely through it dropped three gateway-runtime guarantees the
integration tests assert. Re-assert 'agents'/'channels' required sections and
per-channel 'token' (except email/agentmail/whatsapp-web) on the
pre-substitution config so a wholly-missing token fails closed while a ${VAR}
that resolves to empty is left for start_channels() to skip. Platform/typo
fail-closed remains delegated to the canonical validator.
Co-authored-by: Mervin Praison <[email protected]>
Addresses two review findings on the canonical-validator routing:
- P1: merge validator-populated channel fields (resolved platform,
plugin descriptor env fallbacks/required fields, canonical defaults)
back into existing `channels:` dicts, not just when absent, so
adapters start with fully-resolved settings.
- P2: resolve `${VAR}` env substitution before validation so an unset
token for a currently-unused channel stays an empty string that
start_channels() skips, instead of tripping the schema token
validator and aborting the whole gateway. Platform-typo fail-closed
still applies.
Co-authored-by: Mervin Praison <[email protected]>
The gateway runtime loader (WebSocketGateway.load_gateway_config) hand-rolled
a second config validator with a hardcoded platform allowlist that only
warned on unknown platforms and started anyway — a fail-open hole where a
typo'd channel platform passed validation, the gateway reported healthy, but
the channel silently never ran.
Route the runtime loader through the existing canonical validator
(migrate_legacy_config + validate_gateway_config), which:
- fails closed (ValueError -> exit 78) on unknown/typo'd platforms
- is registry-aware (accepts built-in, entry-point, and register_platform()
channels), fixing the spurious "not a known platform" warning for linear
- migrates legacy single-bot / BotOS config shapes on the runtime path too
The raw dict is preserved (all top-level keys the runtime reads survive) and
env-var substitution is still owned by the loader.
Co-authored-by: MervinPraison <[email protected]>
ConsoleBackend now uses rich Prompt.ask (once/session/always/no) instead
of Confirm.ask. The approval-integration tests patched Confirm.ask to
auto-approve the require_approval decorator path; the mock no longer
intercepted, so the prompt read stdin under pytest and denied the tool.
Patch Prompt.ask -> "o" (once/approve) to match the intentional change.
Co-authored-by: Mervin Praison <[email protected]>
- auth list/status: always surface active env-var keys even when a stored
key exists, labelled as overriding the stored one, so the live credential
is never hidden (Greptile P1 #1, #2)
- setup: derive default model from the catalogue for catalogue providers so
non-interactive setup (e.g. --provider groq) no longer fails (P1 #3)
- setup: use the same authoritative env-var name as auth for divergent
providers (perplexity -> PERPLEXITYAI_API_KEY) (P1 #4)
- tests: cover perplexity env-var parity and catalogue default model
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer (Greptile) security findings on scoped approvals:
- utils.py: add src key so move_file/copy_file grants pin to the concrete
source path instead of a tool-wide tool:move_file rule; remove apply_patch
from the path-prefix map (it takes multi-file patch text, not a single
path) so it stays tool:apply_patch rather than a misleading edit:<...>.
- registry.py: keep "this session" grants in-memory only (new
_session_scoped_targets store) so they never persist to approvals.json and
outlive the run; only "always" grants bridge to PermissionManager.
- registry.py: skip durable persistence for "always" when agent_name is None
(a nameless grant would match any agent); degrade to in-memory session
scope for the run instead.
- Session grants are cleared by clear_approved and wired into both sync/async
approval fast-paths.
- Tests updated/added for move/copy src mapping, apply_patch tool-scoping,
session non-persistence, nameless-always skip, and clearing.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
The published JSON schema and the praisonai-code CLI resolver place model
settings under a top-level `agent` section (e.g. `agent.small_model`), while
the praisonaiagents loader uses `defaults.*`. Since both read the same
`.praisonai/config.yaml`, a user following schema autocomplete set
`agent.small_model` that title generation silently ignored (greptile finding).
get_small_model() now also reads `agent.small_model` / `agent.model` from the
raw config, closing the schema-path gap. Fully additive and backward
compatible; `defaults.*` still takes precedence.
Co-authored-by: Mervin Praison <[email protected]>
Add a declarative auxiliary/"small" model default so internal LLM calls
(session-title generation, and future summarisation/compaction paths) can
target a cheap/fast/local model independent of the primary model.
- config/loader.py: add `small_model` to DefaultsConfig, validation keys,
dict round-tripping, and a `get_small_model()` resolver
(small_model -> primary_model -> config model -> fallback).
- session/title.py: resolve the auxiliary model via `get_small_model`,
falling back to the primary model then the historical `gpt-4o-mini`
default so existing behaviour is preserved when nothing is configured.
- praisonai config.schema.json: document `agent.small_model`.
- Tests for resolution order and backward compatibility.
Co-authored-by: MervinPraison <[email protected]>
Adds a scope field to ApprovalDecision, a once/session/always/no choice to
ConsoleBackend, and bridges session/always decisions into PermissionManager
so grants persist and future matching calls short-circuit without re-asking.
Default remains "once" — non-interactive/auto-approve paths are unchanged.
Co-authored-by: MervinPraison <[email protected]>
Addresses greptile P1 review findings on tool_execution.py:
- BYPASS now skips the PermissionManager deny gate (via _is_bypass_mode)
so it truly bypasses permission checks as documented.
- DONT_ASK and PLAN now consult a shared _tool_would_prompt() that mirrors
the needs_approval criteria (dangerous, external trust_level,
registry-required, explicit ask rule), so external/registry-required
tools are auto-denied under DONT_ASK and denied under PLAN instead of
falling through to a prompt/hang.
Co-authored-by: Mervin Praison <[email protected]>
Three safety/reliability controls that previously silently no-op'd:
1. MCP SSE (mcp_server.py, mcp_security.py): run_sse now derives the bind
address from SecurityConfig.get_bind_address() when host is unset, so
bind_localhost_only (secure-by-default) actually controls the interface,
and fails fast when require_auth=True but no token is available instead
of serving every request unauthenticated. Adds resolve_sse_security() as
the shared source of truth.
2. Permissions (manager.py, tool_execution.py, agent.py, protocols.py):
_resolve_approval_decision now consults the PermissionManager so explicit
``ask`` rules drive the approval prompt (not just hard ``deny``), and wires
PermissionMode (BYPASS/PLAN/DONT_ASK) into the call-time gate via a new
ApprovalConfig.permission_mode. Adds PermissionManager.resolve_tool_action()
which only reports explicit rule matches so unlisted tools keep prior
behaviour.
3. Compaction (compactor.py): iterative summary baseline is now tracked off
the returned compacted list length rather than len(messages) of the input,
so later passes summarize new turns instead of silently dropping them; and
compact()/compact_async() now set was_skipped_due_to_low_savings=True when
the anti-thrashing streak halts compaction.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Root cause of the CI failure and Greptile P1: praisonai_train.cli.commands.train
imported ..output.console but that module was never moved into the extracted
package, so every agents/list/show/apply command raised ModuleNotFoundError
before doing any work.
- Add self-contained praisonai_train.cli.output.console: delegates to
praisonai-code's OutputController when co-installed (via lazy _code_bridge),
falls back to a minimal rich/typer controller so `pip install praisonai-train`
works standalone. Fixes test_cli_show_displays_iterations.
- pyproject: `[llm]` extra now pulls praisonai-code (the llm command bridges into
the code CLI runner); register `setup-conda-env` entry point advertised by README.
- apply: resolve real agent name for the training profile and reuse the loaded
agent for --run instead of loading the file twice.
- Expand ~ in file/sqlite storage paths; open scenarios/vision configs as utf-8.
- check_c10_train_imports.sh: use POSIX `grep -Ev` for portability.
62 train unit tests pass; standalone agents --dry-run / list / show verified with
the fallback controller (no wrapper/code installed).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Mervin Praison <[email protected]>
Extract LLM fine-tuning (Unsloth) and agent training from the praisonai
wrapper into a new installable package src/praisonai-train (PyPI:
praisonai-train, import: praisonai_train), following the C9 praisonai-bot
playbook.
- Move praisonai/train/{llm,agents,_ollama}, train_vision.py,
upload_vision.py, cli/commands/train.py, and the conda setup scripts
into praisonai_train (git mv, history preserved)
- Wrapper keeps backward-compat shims: alias_package for praisonai.train,
sys.modules shims for the command/vision modules, setup-conda-env
delegate; all old import paths resolve to the same module objects
- praisonai-code routing: new _TRAIN_RESIDENT_COMMANDS + _train_bridge;
train removed from _WRAPPER_RESIDENT_COMMANDS; hidden on standalone
installs without praisonai-train
- Legacy dispatch (praison_ai.py) prefers praisonai_train, falls back to
wrapper shims
- Packaging: wrapper depends on praisonai-train>=0.0.1; extra
train = ["praisonai-train[llm]"] now actually installs the ML stack
- CI: 5-package install order, standalone train smoke, train test shard,
check_c10_train_imports.sh gate
- Release: agents -> code -> bot -> train -> wrapper across
_release_lib.py, bump_and_release.py (--train/--train-pin/--wait-train),
publish_all.py, pypi-release.yml
- Tests: test_c10_train_backward_compat.py (20 tests), unit tests moved
into src/praisonai-train/tests (62 tests, run standalone)
- Docs: PRAISONAI_TRAIN_MANIFEST.md, ARCHITECTURE.md five-package model,
AGENTS.md refresh, beginner-friendly package README
Co-Authored-By: Claude Fable 5 <[email protected]>
Route compaction token counting through a one-time, timeout-bounded probe of
the accurate tiktoken tokeniser. tiktoken downloads its BPE vocab on first use,
which blocks indefinitely on network-isolated CI hosts and caused
test_max_history_hard_cap_in_compaction_mode to hit the 60s pytest-timeout.
The probe runs once in a short-lived daemon thread; if the tokeniser is not
locally available it permanently falls back to the fast character heuristic,
keeping the hot path offline-safe while preserving accuracy where tiktoken is
cached.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on PR #2995:
- Strip in_loop_compaction/clear_threshold_pct/compact_threshold_pct/
keep_recent_tool_results from LiteLLM completion params so local
context-management settings never leak to the provider.
- Wire keep_recent_tool_results from extra_settings into the loop compactor.
- Rebuild the cached loop compactor when the active model changes
(auth/model failover) so budgets and tokenizer model stay aligned.
Co-authored-by: Mervin Praison <[email protected]>
Run two-tier context management continuously inside the tool-calling loops
(sync + async) in llm/llm.py instead of only once before a turn. Between
iterations the loop now clears re-fetchable tool results at a low threshold
and summarises dialogue at a higher one, gated on an accurate token count
derived from the model's real context window via context/budgeter.
- compaction/compactor.py: accurate tokeniser (reuses context/tokens.py) with
heuristic fallback; count tool_calls payloads; new clear_tool_results().
- compaction/config.py: add model + in-loop threshold config fields.
- llm/llm.py: _resolve_context_window + _manage_context_in_loop helpers,
wired into both tool loops; no-op below threshold and when disabled.
Co-authored-by: MervinPraison <[email protected]>
- goal/loop.py: self-contained continuation nudge restating goal + criteria so
history-clearing configs don't lose the task; resume persisted paused runs for
the same goal instead of restarting at turns_used=0; persist terminal state on exit.
- goal/judge.py: replace greedy {.*} regex with brace-depth scanning that respects
string literals, so a valid verdict followed by a note/second object still parses.
- agent/agent.py: fold string `criteria` into GoalCriteria on run_until(goal=) so it
is not silently dropped; document the AutonomyResult return-shape when goal is set.
- tests: add regression coverage for parsing and continuation context.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer P1 findings on the spend kill-switch:
- Baseline cumulative spend at loop start so a reused Agent's prior
chat/run usage no longer counts against a new run's budget cap
(sync + async loops).
- Validate max_budget_usd/max_tokens in AutonomyConfig.__post_init__
(reject non-numeric and negative values) so invalid caps fail fast
instead of raising TypeError mid-loop or instantly exhausting.
- Tests: add invalid-cap validation + Agent-reuse baseline coverage;
update pause-recoverable test for per-run semantics.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
Resolves rebase conflict between the negotiated-hello handshake (#2988) and
main's terminal-vs-transient connect-error classification (#2984):
- Extract shared _raise_for_connect_error() used by both the modern
hello_error path and the legacy join fallback, so a non-recoverable
code (revoked token / unpaired device / agent-not-found) stops the
reconnect loop instead of retrying forever, while transient codes
honour the server retry_after floor.
- _coerce_limit() now rejects negative numeric policy limits (returns
None) so a bogus max_payload: -1 does not block every outbound frame.
Co-authored-by: Mervin Praison <[email protected]>
Adds an independent budget kill-switch to run_autonomous / run_autonomous_async:
max_budget_usd and max_tokens caps checked each iteration against the existing
per-run cost/token tracking (Agent._total_cost/_total_tokens_*). On exceed the
run stops cleanly and returns a typed budget_exhausted outcome carrying spend
so far and the partial result; budget_action="pause" marks it recoverable.
Promotes AutonomyResult.completion_reason to a TerminationReason StrEnum
(co-located with AgentRunOutcome), keeping the historical string values stable
and adding budget_exhausted, plus a mapping to the shared RunStatus vocabulary.
Caps default unset = unlimited, so behaviour is unchanged until a cap is set.
Co-authored-by: MervinPraison <[email protected]>
- Enable loop_detection.py by default and invoke it in the tool-execution
path: record_tool_call + detect_tool_loop before execution (critical -> block),
record_tool_outcome after (result-aware, so polling with changing output is
not flagged). Two-tier response: warning queues a one-shot self-correction
nudge, critical hard-stops.
- Stop feeding DoomLoopTracker a hard-coded success=True in run_autonomous /
run_autonomous_async; derive a real per-iteration success signal via
_response_indicates_failure so the consecutive-failure detector can fire.
- Inject the queued self-correction nudge at the top of each autonomous turn.
- Document DoomLoopConfig.similarity_threshold as superseded by the result-aware
detector (kept for backward compatibility).
- Add wiring tests covering polling-not-flagged, identical-output-flagged,
generic-repeat, two-tier self-correction, detector-invoked-in-tool-loop,
backward-compat, and the real failure signal.
Co-authored-by: MervinPraison <[email protected]>
Adds a first-class, independent goal-completion judge that gates the
tool-using autonomous loop against the agent's stated goal, instead of the
keyword/promise heuristics that could declare success prematurely.
- goal/models.py: GoalCriteria (outcome/verification/constraints) + GoalState
(persistent goal/budget/verdict state with JSON round-trip).
- goal/judge.py: judge_goal() — independent, criteria-anchored, JSON-verdict
judge reusing eval.Judge's litellm loader; fails open to "continue".
- goal/loop.py: GoalLoopMixin — the per-iteration judge gate, continuation
nudge, budget-exhaust recoverable pause, consecutive-parse-failure auto-pause,
session persistence, and run_goal()/run_goal_async() public API.
- agent.py: gate run_autonomous (+ async) on the judge before the existing
heuristics (no-op/unchanged when no goal set); extend run_until(goal=,
goal_criteria=) to delegate to the tool-using goal loop.
Default-off: when no goal is set the autonomous loop is byte-for-byte
unchanged. Heavy logic lives outside agent.py to keep it lean.
Co-authored-by: MervinPraison <[email protected]>
Addresses two P1 findings from Greptile review on the run-state journal:
- open_run: on ON CONFLICT reopen, COALESCE the supplied checkpoint_id so a
run that crashed before set_checkpoint can resume from a caller-supplied
checkpoint; a None reopen preserves the existing binding.
- assert_replay_order: compare full (seq, kind) sequence (not bare kinds) so a
replay with the same shape at wrong seq positions fails loud, matching the
(seq, kind)-keyed replay_index lookup. Backward compatible with kind-only
input.
Adds 3 tests covering both fixes.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- honour max_payload==0 as a real bound instead of skipping the guard
- coerce string/float policy limits via _coerce_limit to avoid TypeError on send
- apply same coercion to heartbeat_ms accessor
Co-authored-by: Mervin Praison <[email protected]>
The bundled Python gateway client now sends the capability-aware `hello`
frame, reads the server-advertised `features`/`policy` from `hello_ok`,
and self-configures: exposes the negotiated method/event manifest,
drives heartbeat from `heartbeat_ms`, and guards outbound frames against
`max_payload` locally (raising `PayloadTooLarge`). The legacy `join`
path is retained purely as a compatibility fallback for older gateways
that reply with a bare `joined` or reject the hello frame.
Co-authored-by: MervinPraison <[email protected]>
Adds praisonaiagents/runtime/journal.py, a tiny append-only SQLite journal
keyed by run_id that records the execution cursor of a run — model decisions,
tool calls/results, iteration index, approval decisions. On resume the loop is
re-driven from the top and journalled steps return recorded results via a
memoised replay index (no re-execution of side-effecting tools, no re-billing
of LLM calls); real work restarts at the first un-journalled step.
- Reuses the stdlib sqlite3 persistence pattern from runs/sqlite_ledger.py and
session/store.py (WAL, busy_timeout, lock-guarded shared connection).
- Binds the files store via checkpoint_id and exposes interrupted_runs() so a
gateway can resume runs left 'running' after a crash — the prerequisite for
durable pause-for-approval HITL.
- Determinism guardrail: assert_replay_order() fails loud on divergence.
- Default-off / zero-overhead: lazy-imported from runtime; inert until a run
opts in (no writes unless open_run/append are called).
Co-authored-by: MervinPraison <[email protected]>
_drain_steering_messages previously returned only raw content, so an
in-flight INTERRUPT/URGENT steer was injected as plain [steering]
guidance, silently downgrading a mid-run interrupt (Greptile P1).
Extract priority-aware formatting into a shared _format_steering_note
helper used by both _check_steering_messages (pre-turn) and
_drain_steering_messages (mid-run), so INTERRUPT/URGENT priority is
preserved on every injection path. Add a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer findings on prompt-cache marking:
- Deep-copy the boundary message before marking so caller-owned chat
history is not rewritten to Anthropic form (prevents OpenAI/Gemini
reuse from carrying invalid cache_control metadata).
- Count pre-existing cache_control markers before adding a new one so
the provider 4-breakpoint budget is never exceeded.
- Fix _mark_message_cache_control return contract: return False for an
already-marked list block (no new breakpoint applied).
Co-authored-by: Mervin Praison <[email protected]>
Wire cooperative cancellation and mid-run steering into the tool-calling
loops themselves rather than only at turn boundaries.
- Add a second cancel check immediately before dispatching tool calls in
both LiteLLM (llm.py) and OpenAI-native (openai_client.py) loops, sync
and async, so a /stop mid-iteration skips running tools.
- Drain pending steering messages at the top of every loop iteration and
inject them as user messages before the next model call.
- Add SteeringMixin._drain_steering_messages() returning all pending notes.
- Thread a bound steering_drain callable from chat_mixin into get_response
and get_response_async alongside the existing cancel_token.
- Add unit tests covering interrupt-between-iterations, interrupt-before-
tool-dispatch, mid-run steering injection, and no-op when unconfigured.
Co-authored-by: MervinPraison <[email protected]>
Extend Anthropic prompt caching beyond the single system block: add a
cache breakpoint on the stable conversation-history prefix while leaving
the most recent turns (volatile tail) uncached. Refactor the inline
system-block marker into reusable helpers and enforce the provider
4-breakpoint budget. OpenAI/Gemini rely on automatic prefix caching, so
no explicit markers are emitted.
Co-authored-by: MervinPraison <[email protected]>
- Add AGENT_NOT_FOUND to the non-recoverable connect codes: the gateway
emits it with a DO_NOT_RETRY recovery step, so the client must pause the
reconnect loop instead of backing off forever (greptile P1).
- Clear self._retry_after in connect() so a backoff floor left over from a
prior connection loop cannot pin an unrelated reconnect attempt (greptile P2).
- Update classifier docstring and tests accordingly; add coverage for the
terminal AGENT_NOT_FOUND path and stale-floor clearing.
Co-authored-by: Mervin Praison <[email protected]>
- resources.py: prompt messages with image/audio/blob/embedded content now
reuse the resource content normaliser (size/mime summaries) instead of
emitting raw object reprs; _normalize_content_item now handles `data`
(image/audio) and nested embedded resources.
- mcp.py: _generate_resource_tools now skips creating a synthetic helper when
a server tool already owns that name, keeping the callable and its OpenAI
schema consistent (no orphaned schema the LLM cannot invoke).
- tests: add coverage for binary/embedded prompt normalisation and server
tool name collision precedence.
Co-authored-by: Mervin Praison <[email protected]>
User-global tools (~/.praisonai/tools/*.py, source="user") live outside
the project CWD, so the safe loader's CWD boundary silently dropped them.
Opt those explicitly user-owned paths out of the boundary (mirroring an
explicit --tools path); project-local tools keep the default CWD check.
Co-authored-by: Mervin Praison <[email protected]>
The reconnecting gateway client classified connect failures by exception
type alone, so AUTH_UNAUTHORIZED / pairing / config rejections fell into a
generic except-branch and reconnected forever. It also discarded the
server's structured next_step and retry_after guidance.
- core: add is_recoverable(code) classifier beside ConnectErrorCode so the
client and any alternative client share one terminal/transient taxonomy.
- client: parse structured hello_error frames (code/next_step/retry_after);
raise GatewayConnectError and pause the reconnect loop (via a new
on_reconnect_paused callback) on non-recoverable failures; honour
retry_after as a backoff floor without shortcutting the exponential
sequence for transient failures.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Addresses Greptile P2 review on PR #2982. Default Knowledge() no longer
emits a misleading "retrieval quality may be reduced" warning when falling
back from the implicit default provider (e.g. chroma/mem0 not installed).
The loud logger.warning now fires only when the user explicitly configured
a vector-store provider that degrades; implicit-default fallbacks are logged
at verbose/debug level as before.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on PR #2981:
- Pin the no-workspace fallback base at construction (cwd captured then, or
explicit root) so a later os.chdir cannot drift the containment boundary of
a long-lived instance or the module-level default helpers.
- Remove the naive '..' substring rejection so legitimate in-workspace names
like 'v1..2.md' are accepted; containment is enforced solely via
realpath + commonpath.
- Add regression tests for cwd-stable boundary and valid '..' filenames.
Co-authored-by: Mervin Praison <[email protected]>
store_long_term_async delegated through self.store_long_term, which for
Memory instances resolves to the overriding weighted-metrics signature
(completeness/relevance/...). Positional quality_score/user_id bound to the
wrong params, silently corrupting quality metadata and dropping user_id.
Call MemoryCoreMixin.store_long_term(self, ...) explicitly to always use the
mixin's own (content, metadata, quality_score, user_id) signature.
Co-authored-by: Mervin Praison <[email protected]>
Extend the .praisonai/ filesystem-discovery convention to a tools/ directory
so `praisonai run` picks up project-local Python tools with the same
zero-config ergonomics as agents/ and commands/.
- CustomDefinitionsDiscovery now scans .praisonai/tools/*.py (user-global +
project walk-up), namespacing callables as <module>.<func> and preferring
@tool-decorated functions. Loading stays gated by PRAISONAI_ALLOW_LOCAL_TOOLS
via the shared safe loader.
- run.py (actions mode) and the default direct_prompt path auto-merge the
discovered tools; explicit --tools take precedence and --no-tools opts out.
- `praisonai init` scaffolds .praisonai/tools/example.py with a commented
@tool stub so the convention is self-documenting.
Backward compatible: explicit --tools and PRAISONAI_ALLOW_LOCAL_TOOLS behave
as before; projects without .praisonai/tools/ are unaffected.
Co-authored-by: MervinPraison <[email protected]>
MCP client previously exposed only server tools, ignoring resources and
prompts. During connect, the stdio runner now negotiates resource/prompt
capabilities (list_resources / list_resource_templates / list_prompts) and
registers synthetic agent-callable tools (list_mcp_resources,
list_mcp_resource_templates, read_mcp_resource, list_mcp_prompts,
get_mcp_prompt) only for servers that advertise them. Contents are normalised
(text/blob/embedded, prompt messages) with size/mime guards. Fully additive,
capability-gated, filterable, and namespaced via the existing tool-prefix
scheme; tools-only servers are unaffected.
Co-authored-by: MervinPraison <[email protected]>
Restores behavior lost when media.py's regex-based parser was removed in
favor of the shared helper. Fixes two regressions flagged in review:
- Mixed-case labels (Score:/score:) now parse instead of defaulting to 5.0
- Multi-line REASONING text is preserved instead of truncated to first line
Uses re.IGNORECASE + re.DOTALL, matching the original media parser. Fully
backward compatible: existing uppercase single-line responses parse identically,
and score clamping to [1, 10] is retained. Benefits all callers (accuracy,
criteria, comparison, media).
Co-authored-by: Mervin Praison <[email protected]>
The async _atrigger_after_agent_hook still built AfterAgentInput (incl.
os.getcwd()) and called execute unconditionally on every achat() turn.
Mirror the sync AFTER_AGENT / BEFORE_AGENT guards so the work is skipped
when no AFTER_AGENT hook is registered.
Co-authored-by: Mervin Praison <[email protected]>
Mem0Adapter and MongoDBKnowledgeAdapter constructors did not accept the
`verbose` keyword passed by Knowledge.memory via the registry, raising a
TypeError that was swallowed and silently replaced with SQLiteKnowledgeAdapter.
- Add `verbose`/`**kwargs` to both adapter constructors
- Raise the fallback log from debug to warning so silent quality
regressions are visible
- Add regression tests asserting adapters accept `verbose` and the
configured provider is constructed instead of degraded
Co-authored-by: MervinPraison <[email protected]>
The no-workspace fallback in EditTools._validate_path only rejected the
literal '..' substring, so an absolute path like /etc/passwd resolved
straight through, letting read_file/search_files/edit_file reach any file
the host process could access. Mirror file_tools.py's containment: confine
resolution to a base directory (defaulting to cwd, overridable via a new
`root` argument) and reject paths that escape it. Adds regression tests.
Co-authored-by: MervinPraison <[email protected]>
Collapse the three secondary rag/ token-estimation helpers to reuse the
single exported implementation in rag/budget.py:
- summarizer.py and compressor.py now import budget.estimate_tokens
(identical output; both had the +1 heuristic with empty-text guard).
- context.py delegates its private _estimate_tokens to budget while
preserving its historical empty-text behaviour (returns 1, whereas
budget returns 0) to keep output identical.
Public rag.estimate_tokens export unchanged. compaction/ left untouched.
Co-authored-by: MervinPraison <[email protected]>
MemoryCoreMixin's async storage methods (store_short_term_async,
store_long_term_async) internally called self.compute_quality_score(content,
metadata) expecting the mixin's 2-arg content scorer. On a Memory instance this
resolved via the MRO to Memory's unrelated 4-required-arg weighted scorer,
raising TypeError on every call.
Call MemoryCoreMixin.compute_quality_score(self, ...) explicitly at all five
mixin call sites so the mixin always uses its own scorer regardless of subclass
shadowing. Preserves the documented public Memory.compute_quality_score 4-arg API.
Co-authored-by: MervinPraison <[email protected]>
Delete the duplicate _parse_score_response in eval/media.py and call the
canonical parse_score_reasoning from grader.py, matching accuracy/criteria/
comparison evaluators. This adds the missing [1,10] score clamp for
out-of-range model outputs, ensuring consistent grades across evaluators.
Co-authored-by: MervinPraison <[email protected]>
Mirror the tool-level hook pattern: only build BeforeAgentInput/
AfterAgentInput (including os.getcwd() and the tools list comprehension)
when a BEFORE_AGENT/AFTER_AGENT hook is actually registered. The
auto-memory / auto-learning / nudge side-effects in the after-agent path
stay outside the guard and continue to run unconditionally.
Co-authored-by: MervinPraison <[email protected]>
get_dimensions() lowercases the input model name but compared it against the
raw MODEL_DIMENSIONS keys. The only mixed-case key, "all-MiniLM-L6-v2" (384),
therefore matched neither the exact-match nor the substring check and fell
through to the 1536 default. That model is the most common local
sentence-transformers embedder (and the default in knowledge/chunking.py), so
memory.py sized the vector store to 1536 while the model emits 384-dim vectors.
Lowercase the key in the substring comparison. Add a regression test.
Consolidate the wrapper's hand-rolled OpenAI/AsyncOpenAI client lifecycle and
beta.chat.completions.parse fallback onto the core-owned
praisonaiagents.llm.openai_client.OpenAIClient. The LiteLLM-first orchestration,
sync/async bridging, lifecycle (close/aclose, context managers), and 3-way
CLI+YAML+Python surface are preserved; only the duplicated OpenAI leg is removed.
Co-authored-by: MervinPraison <[email protected]>
test_cache_integration.py asserted the old empty-string contract, which
contradicted test_cache_optimization.py. Update it to validate the current
contract: boundary equals CACHE_BOUNDARY when enabled, empty when disabled.
Co-authored-by: Leebana <[email protected]>
Addresses Greptile review feedback on PR #2961:
- P2: skip registering the built-in /automations and /blueprint Telegram
handlers when a custom @bot.on_command handler of the same name already
exists, so these generic names no longer unconditionally shadow user
commands (an improvement over the blanket-shadow behaviour of all builtins).
- P1: document that the underlying SuggestionStore is a single global
single-tenant store with no per-user field (mirrors the CLI); per-user
scoping is a core data-model change, out of scope for this wrapper wiring.
Access remains gated by CommandAccessPolicy, re-checked on every tap.
Co-authored-by: Mervin Praison <[email protected]>
Surfaces the already-built consent-first SuggestionEngine + BlueprintCatalogue
through the conversational gateway. Adds a shared _automations helper module
(list/accept/dismiss/blueprint-materialize) and wires it into the Telegram
adapter with inline Accept/Dismiss buttons via the existing callback-query path.
Nothing is auto-created; MAX_PENDING_CAP and dedup are inherited from the store.
Co-authored-by: MervinPraison <[email protected]>
The executor accepted timeout_ms/cancel_token but the tool-calling loop in
llm.py never forwarded them, leaving the feature as dead code. Read an
optional tool_timeout_ms from extra_settings (no new required param, no Agent
bloat) and forward it at both execute_batch call sites. Defaults to None for
zero regression. Adds a regression test guarding the wiring.
Co-authored-by: Mervin Praison <[email protected]>
Close a migration gap in SqliteSessionStore: a store upgraded from a
prior release has session_meta populated but the new session_route table
empty, so backfill skipped those sessions and get_by_gateway_session
returned None instead of resolving them (Greptile P1). _indexed_ids now
requires a session to be present in both session_meta AND session_route
before treating it as fully indexed, forcing route rows to be backfilled
on first read. Adds a regression test.
Co-authored-by: Mervin Praison <[email protected]>
Run each tool via a cancellable boundary that enforces timeout_ms and
returns a typed, discriminated result (timeout/cancelled/error) instead
of hanging the turn or flattening failures to an opaque string.
Co-authored-by: MervinPraison <[email protected]>
Override get_by_gateway_session and list_sessions_by_gateway_agent in
SqliteSessionStore with an indexed session_route table so inbound routing
is an O(1)/O(log n) lookup instead of an O(N) os.listdir + JSON-parse of
every stored session. The route table is populated at write time and
backfilled from existing JSON transcripts; falls back to the parent scan
if the index is unavailable.
Co-authored-by: MervinPraison <[email protected]>
Address two P1 security findings on the managed-config layer:
- SSRF: managed URLs are now validated before fetch. Only http(s) schemes
resolving to a public host are allowed (http restricted to loopback), so a
configured URL can no longer coerce the CLI into hitting localhost, internal
services, cloud metadata (169.254.169.254), or file:// paths. Rejected URLs
fall through to the existing fail-soft cache path.
- Policy enforcement: enforced managed-policy keys (permissions,
model_allowlist) now REPLACE their local counterparts wholesale via
_enforce_policy instead of deep-merging, so local nested sub-keys
(permissions.default/rules) can no longer survive a narrowing org policy.
Adds regression tests for both.
Co-authored-by: Mervin Praison <[email protected]>
Addresses reviewer feedback on PR #2954:
- install.sh: fail loudly if uv bootstrap download is empty/failed and verify
uv is on PATH afterwards (no more masked "uv: command not found").
- install.sh (bash): also wire the applicable login profile
(.bash_profile/.bash_login/.profile) so login shells find praisonai.
- install.sh (fish): guard fish_add_path with a POSIX-safe fallback for
older fish versions.
- self_manage/app: schedule a detached, non-blocking background refresh of the
update-check cache on start-up so the "update available" hint is actually
populated (never performs network I/O in the caller, never blocks/raises).
Co-authored-by: Mervin Praison <[email protected]>
The subagent resolver passed a definition's declarative `permissions` block
straight into `Agent(**config)`, which has no `permissions` kwarg, so any
delegated named agent carrying a permission/mode restriction raised TypeError
at construction. Mirror the primary-run path (_run_custom_agent): pop
`permissions` and translate it into an `approval` config so the delegated
agent runs under its intended restrictions.
Co-authored-by: Mervin Praison <[email protected]>
Adds an optional, opt-in managed configuration layer to ConfigResolver so an
organisation can distribute defaults and enforce policy across many machines
from one source of truth (remote URL and/or managed/enterprise directory).
- Managed non-policy defaults sit BELOW local config (teams suggest, not clobber)
- Managed policy keys (permissions, model_allowlist) enforced ABOVE local config
- Remote fetch: short timeout + on-disk cache under ~/.praison/state/, fail-soft
to last-good copy or skips the layer offline (never blocks a run)
- resolve_with_provenance labels managed:/managed-policy: origins and marks
enforced keys non-overridable
- Fully backward-compatible: no managed source => resolution unchanged
Co-authored-by: MervinPraison <[email protected]>
Add a backward-compatible agent_resolver seam to create_subagent_tool so a
running agent can delegate sub-tasks to user-defined .praisonai/agents/*.md
named agents by name, each running under its own model/tools/permissions.
- Core: create_subagent_tool accepts agent_resolver + resolvable_agents; the
resolver runs a named agent when agent_name matches, else falls back to the
existing generic spawn. Description lists the delegatable named agents.
- Wrapper: custom_definitions gains list_delegatable_agents /
build_subagent_resolver (mode: subagent marker or --subagents allow-list) and
_agent_config_from_definition; mode: subagent is treated as a marker, not a
permission mode.
- run.py: adds --subagents and wires the resolver into _run_custom_agent.
Co-authored-by: MervinPraison <[email protected]>
- install.sh (repo root): POSIX installer that provisions an isolated managed
env via uv tool / pipx (auto-detects, bootstraps uv when absent), wires PATH
for bash/zsh/fish idempotently, supports PRAISONAI_VERSION pin and
non-interactive/CI mode. pip install praisonai remains untouched.
- praisonai upgrade: updates the managed install in place using the detected
tool manager; --check reports whether a newer release exists without mutating.
- praisonai uninstall: cleanly removes the managed env/shim (--yes for CI).
- self_manage helper: install detection (uv/pipx/pip) + non-blocking, cached,
time-boxed "update available" hint, opt-out via PRAISONAI_NO_UPDATE_CHECK.
- Registered both commands in app.py:_LAZY_COMMANDS and the Get started help
panel. No changes to praisonaiagents (CLI self-management only).
Co-authored-by: MervinPraison <[email protected]>
1. scoped_telemetry_disable now shadows the per-instance telemetry object
(race-free by construction) and falls back to a locked + reference-counted
class-level patch, eliminating the concurrent CrewAI class-corruption race.
2. _entrypoint.arun resolves the framework and builds config_list off the
event loop via asyncio.to_thread, and both run/arun share one resolver.
3. MCP dispatcher enforces per-method OPERATION_SCOPES: handle_message accepts
granted_scopes, the HTTP transport plumbs APIKeyAuth (with a --keys-file CLI
flag), and insufficient_scope surfaces as 403 with a WWW-Authenticate
challenge. Backward compatible: no auth configured => allow all.
Co-authored-by: Mervin Praison <[email protected]>
Use is_loopback() instead of a 3-string exact match for the client host
so local peers reported as 127.0.0.2, 127.255.255.255 or the expanded
IPv6 0:0:0:0:0:0:0:1 no longer get a spurious 401 on loopback-bound
gateways (Greptile #2945). Adds test coverage for semantic loopback
clients and non-loopback rejection.
Co-authored-by: Mervin Praison <[email protected]>
The now-truthy CACHE_BOUNDARY marker was being appended directly to the
system prompt in chat_mixin when a prompt-caching-capable model is used.
No provider consumes it as structured cache metadata, so this only
polluted the outgoing system prompt with a literal "--- CACHE_BOUNDARY ---"
string. Stop appending the raw sentinel while keeping the constant defined
for future structured-cache use.
Co-authored-by: Mervin Praison <[email protected]>
The deferred `wrap_if_external` import in the non-multimodal tool-result
branch was unguarded, so a partial/broken install where
`praisonaiagents.tools.trust` is unavailable would raise during plain-text
tool execution and abort the agent. Wrap it in try/except to match the
sibling `_fence_external_text` site, falling through with the raw result.
Addresses Greptile P2 review feedback.
Co-authored-by: Mervin Praison <[email protected]>
Deduplicate the context-truncation summariser and effective-worker-count
clamp/log that were copied verbatim between _execute_parallel and
_execute_loop. Both are now single private helpers
(_truncate_context_for_branches, _effective_workers) with byte-for-byte
identical runtime behaviour.
Co-authored-by: MervinPraison <[email protected]>
Move `wrap_if_external` import from module top level in
agent/tool_execution.py to its two lazy call sites, matching the
existing lazy-import pattern already used for `is_external_tool` and
`artifact_tools` in the same file. This prevents `from praisonaiagents
import Agent` from eagerly loading `tools.trust`. No behaviour or API
changes.
Co-authored-by: MervinPraison <[email protected]>
The file-loading path is now consolidated onto
ToolResolver.load_functions_from_module, so ToolResolver is legitimately
instantiated for file paths. Update the smoke test to assert file paths
use load_functions_from_module and never the name-based resolve().
Co-authored-by: Mervin Praison <[email protected]>
The consolidated load_functions_from_module returns empty both when local
tool loading is disabled/missing AND when a valid module has no public
functions. The if-funcs else-branch previously asserted loading disabled
and told users to set PRAISONAI_ALLOW_LOCAL_TOOLS, misdiagnosing a valid
but empty module. Reword the warning across all 4 CLI sites to cover both
causes without falsely blaming the env var (fixes greptile review regression).
Co-authored-by: Mervin Praison <[email protected]>
Route the four hand-rolled load_user_module + inspect.getmembers copies in
the legacy CLI handlers through the canonical
ToolResolver.load_functions_from_module, eliminating silent behaviour drift.
Add optional functions_only / skip_private / module_name arguments to the
canonical method so the CLI's existing "functions-only, exclude underscore"
semantics are preserved through a single owner instead of re-implemented.
Co-authored-by: MervinPraison <[email protected]>
- fold thread_id into delivery idempotency key so two threads in the same
chat do not dedup-collapse (router itself does not thread-route)
- wire delivery into async execute_once() one-time path
- forward --deliver into the daemon child command (start + restart) and
persist it in scheduler state; also fix restart dropping recipe_name
- thread deliver= through build_from_recipe / from_recipe and honour a
recipe schedule-config deliver default
- give symbolic origin/all targets a clear, actionable single warning in
the lightweight delivery path
Co-authored-by: Mervin Praison <[email protected]>
The interval AgentScheduler accepted a deliver= token but never sent
anywhere — it only printed the result. Wire the deliver token through the
existing DeliveryTarget / DeliveryRouter machinery (rate limiting,
idempotency dedup, dead-target self-heal) so a scheduled/interval agent
can message a chat target without the full gateway, from Python, YAML and
CLI.
- core: add DeliveryTarget.parse() token parser (no new protocol)
- wrapper: SchedulerDelivery helper builds a lightweight single-channel
router; graceful no-op when praisonai-bot isn't installed
- wire deliver= into AgentScheduler / AsyncAgentScheduler success paths,
from_blueprint, YAML (schedule.deliver / every alias) and CLI (--deliver)
Co-authored-by: MervinPraison <[email protected]>
Address reviewer feedback on the durable run ledger:
- recover_orphans() now transitions active runs to LOST via a single
atomic conditional UPDATE (WHERE status IN active) so a concurrently
completed run is never overwritten with LOST.
- SQLite connection opened with busy_timeout + WAL so overlapping gateway
processes wait instead of failing with "database is locked".
- Metadata serialisation falls back to json default=str so a run with
datetime/set/bytes/custom metadata is still durably recorded.
- Unknown persisted status maps to a new non-terminal UNKNOWN sentinel
(neither active nor terminal) instead of terminal LOST, so a status a
newer writer introduced is not wrongly finalised or dropped.
Added tests for each; all 16 run-ledger tests pass.
Co-authored-by: Mervin Praison <[email protected]>
Addresses the three P1/P2 issues raised by Greptile:
1. direct_prompt.py: _run_direct_prompt_via_adapter no longer rebuilds
llm_config with only {"model": ...}, which dropped base_url/api_key/
api_type from self.config_list. It now copies the full first config
entry and only overrides model when --llm is given, so the adapter's
_resolve_llm (which reads base_url/api_key) and the AutoGen config_list
keep custom endpoints and credentials.
2. observability/hooks.py: the process-global trace emitter swap/restore is
now serialised under a process-wide lock and tracks each run's own
installed emitter. Restore only reclaims the global slot when this run is
still the live top; otherwise it re-parents the newer run's prev_emitter
onto this run's prev, so overlapping cross-thread runs and out-of-order
(non-LIFO) finalizes never route traces through the wrong or a closed sink.
Add a first-class run ledger so long-running/async agent runs survive a
gateway restart. Core gains a thin RunLedgerProtocol + RunRecord/RunStatus
contract plus a zero-dependency SQLite default store that reconciles orphaned
runs on boot via recover_orphans().
Co-authored-by: MervinPraison <[email protected]>
1. Route the direct-prompt CrewAI/AutoGen path through FrameworkAdapterRegistry
so default selection and the adapter contract (scoped_telemetry_disable,
_resolve_llm, expected_output, cli_config/callbacks, entry-point plugins)
are honoured instead of a hardcoded chain that bypassed every adapter.
2. Preserve framework BaseTool schema/name/description when applying
tool_timeout: detect framework tool objects and wrap only their execution
method in place; only bare callables get function-level wrapping.
3. Scope observability sinks and the trace emitter per-run via a thread-local
stack + ObservabilityRun handle so concurrent runs no longer close each
other's sinks or leave the global emitter in a Fanout state. Backward
compatible: init returns a handle and finalize accepts an optional handle.
Co-authored-by: MervinPraison <[email protected]>
- Agent toolset expansion now calls resolve_toolsets_for_model so the
advertised edit primitive order matches the harness prompt (Greptile P1).
- Add ToolsetRegistry.resolve_toolsets_for_model + module-level helper; extract
shared _apply_preferred_edit_order (DRY with resolve_toolset_for_model).
- chat_mixin/_resolve_harness_base_prompt and agent.py pass the string model id
only, so object-based LLMs no longer silently disable the harness.
- Add test coverage for the runtime multi-toolset path.
Co-authored-by: Mervin Praison <[email protected]>
Address reviewer feedback on #2920:
- cached-id: use exclusive create; losers of a concurrent first-run re-read
the persisted winner instead of returning an unpersisted id (Greptile P1)
- normalize_git_remote: accept host-less remotes (file:///... , bare paths)
by yielding a path-only identity instead of falling through (Greptile P2)
- root-commit: enumerate root commits across all refs and pick the smallest
SHA so orphan-branch switches keep a stable identity (Greptile P2)
- add regression tests for all three cases
Co-authored-by: Mervin Praison <[email protected]>
Add praisonaiagents/model_harness with a data-driven, overridable
HarnessProfile registry that resolves, from the model id, an optional
base-prompt fragment and a preferred file-edit format. _build_system_prompt
prepends the fragment; the coding toolset can advertise the preferred edit
primitive first via resolve_toolset_for_model. Unknown models fall back to a
behaviour-preserving default (no fragment, unchanged ordering). Resolution is
lazy with zero import-time cost.
Co-authored-by: MervinPraison <[email protected]>
Derive project identity from the repository (git remote -> root commit ->
cached id) instead of the absolute git-root path, so session history follows
the repo across directory moves/renames, second checkouts, and git worktrees.
Falls back to the legacy resolved-path hash for non-git dirs, and transparently
migrates pre-existing path-scoped sessions so no history is lost.
Co-authored-by: MervinPraison <[email protected]>
The older-core fallback in _load_edit_tools only preserved YAML-approved
tools that were in TOOL_GROUPS["interactive"], silently dropping any other
approved tool (e.g. workflow tools) when merging in edit_file/apply_patch.
Read the current approved set directly from the registry contextvar so the
merge is non-clobbering regardless of installed praisonaiagents version.
Co-authored-by: Mervin Praison <[email protected]>
- Fix stale test_interactive_group_is_union to include the new `edit` group
in the interactive union (root cause of CI failure — feature intentionally
folded `edit` into `interactive`).
- Fail closed in _load_edit_tools: if Workspace containment cannot be built,
do not expose edit_file/apply_patch (the engine's no-workspace fallback
accepts absolute paths, which under auto-approval could escape the
workspace). (Greptile P1 security)
- Add ApprovalRegistry.add_yaml_approved_tools() to merge into the
context-local YAML-approved set instead of replacing it; use it so
auto-approving edit tools no longer clobbers previously approved tools.
(Greptile P1)
- Add regression tests for both behaviours.
Co-authored-by: Mervin Praison <[email protected]>
Register the existing praisonaiagents edit_tools engine (edit_file,
apply_patch) into the default interactive TOOL_GROUPS so the CLI coding
agent performs targeted string-replace edits with a fuzzy fallback and
atomic multi-file patches instead of whole-file rewrites. Whole-file
creation (write_file/acp_create_file) remains available and
--tools/PRAISON_TOOLS_DISABLE overrides are honoured. Auto approval mode
context-approves the high-risk edit tools to match ACP behaviour.
Co-authored-by: MervinPraison <[email protected]>
The package-level lazy loader silently converted real ImportError/
AttributeError into a cached None, masking genuine import bugs and stale
mapping entries as confusing NoneType errors far from the root cause.
This additive change preserves the graceful None fallback but logs the
swallowed exception: DEBUG for a genuinely-absent optional module and
WARNING for a missing attribute (which usually signals a stale mapping).
Co-authored-by: MervinPraison <[email protected]>
The OnRetryInput hook dataclass declared the `attempt` field twice with
conflicting defaults (1 then 0), so the intended 1-based default was
silently shadowed by 0. The to_dict() also wrote the "attempt" key twice.
Removed the shadowing declaration and the duplicate dict key, keeping a
single `attempt` field with the intended 1-based default. All production
constructors pass attempt= explicitly, so runtime behaviour is unchanged.
Co-authored-by: MervinPraison <[email protected]>
Greptile P1: capitalized candidates were ranked entirely before lowercase
action candidates, so a repeated greeting (e.g. 'Hello') could win over a
more-frequently-discussed lowercase topic. Now all repeated candidates are
scored by frequency, with capitalization used only as a tie-breaker. Also
bound the action/focus object capture to a short noun phrase so real topics
survive the length filter instead of being swallowed by a greedy match.
Co-authored-by: Mervin Praison <[email protected]>
Run the capitalized-phrase regex on original-case text instead of a
lowercased copy so acronyms/proper nouns like "REST API" are preserved.
Action/focus patterns still run on lowercase text. Capitalized candidates
are preferred over lowercase action-object fragments.
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
2026-07-10 10:04:03 +00:00
650 changed files with 54898 additions and 10269 deletions
<p><strong>v4.6.113</strong> — three Python packages, strict dependency direction, and <strong>C8 complete</strong>: reverse wrapper imports eliminated from <code>praisonai-code</code>. Tap the diagrams; tables hold the rules.</p>
<!-- /wp:paragraph -->
<!-- wp:quote -->
<blockquoteclass="wp-block-quote"><p><strong>One rule (unchanged):</strong><code>praisonai-code</code> never lists <code>praisonai</code> in <code>pyproject.toml</code>. Wrapper access is <strong>bridge-only</strong> via <code>_wrapper_bridge</code> — zero direct <code>from praisonai</code> imports remain.</p></blockquote>
<blockquoteclass="wp-block-quote"><p><strong>C8 change:</strong> 30+ commands are <code>_WRAPPER_RESIDENT</code> — implementation lives only in the wrapper; code package routes lazily with no duplicate modules.</p></blockquote>
<figureclass="wp-block-table"><table><thead><tr><th>Gate</th><th>Check</th><th>Status</th></tr></thead><tbody><tr><td>Hot path</td><td>No module-level wrapper import in main/app/run/chat/code</td><td>✅</td></tr><tr><td>Strict</td><td>Zero wrapper imports in app/run/chat/code</td><td>✅</td></tr><tr><td>Baseline</td><td>≤ <strong>50</strong> direct import lines (current: <strong>0</strong>)</td><td>✅</td></tr><tr><td>Allowlist</td><td>Any offender must be listed (list is empty)</td><td>✅</td></tr><tr><td>Smoke</td><td>Standalone <code>praisonai-code run</code></td><td>✅</td></tr></tbody></table></figure>
<figureclass="wp-block-table"><table><thead><tr><th>Milestone</th><th>State</th><th>Release</th></tr></thead><tbody><tr><td>C7 hot path</td><td>✅ Complete</td><td>—</td></tr><tr><td>C7.1 boundaries</td><td>✅ Complete</td><td>v4.6.110</td></tr><tr><td><strong>C8 reverse imports</strong></td><td>✅ Complete</td><td><strong>v4.6.113</strong></td></tr><tr><td>C8.4 full main.py split</td><td>⏳ Deferred</td><td>Future</td></tr><tr><td>PyPI splits (bot / frameworks)</td><td>⏳ Out of scope</td><td>—</td></tr></tbody></table></figure>
<p>praisonai-mcp is Tier 2e — the heavy MCP server host: full <code>MCPServer</code>, tool/resource/prompt registries, recipe bridge, HTTP-stream auth, and MCP client config management. Depends only on <code>praisonaiagents</code>. v0.0.2. Protocol: MCP 2025-11-25.</p>
<figureclass="wp-block-table"><table><thead><tr><th>Registry</th><th>Commands</th><th>Gate</th></tr></thead><tbody><tr><td>MCP-resident Typer</td><td>list, add, remove, sync, test, serve, doctor</td><td><code>mcp_package_available()</code></td></tr><tr><td>MCPServerCLI host</td><td>serve, list-tools, list-resources, config-generate, tasks, auth</td><td>Direct via <code>praisonai-mcp <cmd></code></td></tr><tr><td>Code-resident light</td><td><code>serve mcp</code></td><td>Always available with code + agents</td></tr><tr><td>Wrapper-resident</td><td>dashboard, schedule, langfuse</td><td><code>wrapper_package_available()</code></td></tr></tbody></table></figure>
<!-- /wp:table -->
<!-- wp:paragraph -->
<p>Standalone <code>praisonai-code</code> hides <code>mcp</code> from <code>--help</code> when <code>praisonai-mcp</code> is not installed. Host commands like <code>praisonai-mcp serve</code> skip the <code>mcp</code> prefix; <code>praisonai mcp serve</code> goes through the Typer group.</p>
<p>Heavy MCP hosting needs only <code>praisonaiagents</code> + <code>praisonai-mcp</code>. Full capability registry (workflows, deploy, extended tools) activates when the wrapper is co-installed via <code>_wrapper_bridge</code>.</p>
<!-- /wp:paragraph -->
<!-- wp:heading -->
<h2class="wp-block-heading">Bridges (no PyPI cycles)</h2>
<p>Wrapper pins <code>praisonai-mcp>=X</code> after mcp is on PyPI. CI: <code>.github/workflows/pypi-release.yml</code>. Import gate: <code>scripts/check_c12_mcp_imports.sh</code>.</p>
<p>praisonai is Tier 3 — the integration wrapper that wires <code>praisonaiagents</code> + five Tier-2 packages (<code>praisonai-code</code>, <code>praisonai-bot</code>, <code>praisonai-train</code>, <code>praisonai-browser</code>, <code>praisonai-mcp</code>) into one install, with dashboard, framework adapters, jobs API, serve orchestration, and backward-compat shims. v4.6.150.</p>
<p>Each Tier-2 package is installable standalone with its own console script. The wrapper pins all of them and preserves every old import path via shims. Use the wrapper when you need several surfaces together — HTTP serve, dashboard, framework YAML, jobs/recipe — without managing tier pins yourself.</p>
<p>Protocols live in <code>praisonaiagents/frameworks/</code>; adapter implementations in wrapper <code>framework_adapters/</code>. Entry-point group: <code>praisonai.framework_adapters</code>.</p>
<figureclass="wp-block-table"><table><thead><tr><th>Package</th><th>Status</th><th>Choose when…</th><th>Standalone install (planned)</th></tr></thead><tbody><tr><td><code>praisonai-sandbox</code></td><td><strong>C13 preferred</strong> (execution goal)</td><td>Isolated agent code execution — Docker/E2B/Modal/Daytona/Sandlock</td><td><code>pip install praisonai-sandbox[docker]</code></td></tr><tr><td><code>praisonai-deploy</code></td><td><strong>C13 alt</strong> (deploy goal)</td><td>Ship <code>agents.yaml</code> to Docker/AWS/GCP/Azure</td><td><code>pip install praisonai-deploy</code></td></tr><tr><td><code>praisonai-replay</code></td><td>Conditional C14+</td><td>Deterministic replay from run ledger / traces</td><td>After product sign-off</td></tr><tr><td><code>praisonai-serve</code></td><td>Deferred C15</td><td>HTTP API hosting without full umbrella (~14k LOC)</td><td>With recipe/jobs decision</td></tr><tr><td><code>praisonai-recipe</code></td><td>Deferred</td><td>NL → agent YAML without jobs UI</td><td>Tied to jobs + serve</td></tr><tr><td><code>praisonai-jobs</code></td><td>Deferred</td><td>Async long-running agent jobs API</td><td>Extract with serve or stay wrapper</td></tr></tbody></table></figure>
<!-- /wp:table -->
<!-- wp:paragraph -->
<p>C13 decision rule: <strong>sandbox</strong> = where code runs; <strong>deploy</strong> = where the agent service lives. Ship one first after product sign-off.</p>
<figureclass="wp-block-table"><table><thead><tr><th>Criterion</th><th>Pass (browser/MCP)</th><th>Fail (example)</th></tr></thead><tbody><tr><td>Named user goal without full <code>praisonai</code></td><td><code>pip install praisonai-browser</code> → automate Chrome</td><td><code>pip install praisonai-persist</code> → ???</td></tr><tr><td>Coherent product boundary</td><td>One Typer group / one console script</td><td>Whole <code>cli/features/</code> orchestration layer</td></tr><tr><td>PyPI deps: <code>praisonaiagents</code> only</td><td>Tier-2 + lazy <code>_wrapper_bridge</code></td><td>Hard <code>import praisonai</code> at module level</td></tr><tr><td>Worth a separate install</td><td>User who never wants dashboard/serve/bots</td><td>Internal docs tooling</td></tr><tr><td>Extraction shape</td><td>C10 single PR (~3–11k LOC)</td><td>Mega-epic without product sign-off</td></tr></tbody></table></figure>
<!-- /wp:table -->
<!-- wp:heading -->
<h2class="wp-block-heading">When to use which tier</h2>
<!-- /wp:heading -->
<!-- wp:table -->
<figureclass="wp-block-table"><table><thead><tr><th>Scenario</th><th>Install</th></tr></thead><tbody><tr><td>Pure Python agents, minimal deps</td><td><code>pip install praisonaiagents</code></td></tr><tr><td>Terminal coding agent, CI, headless</td><td><code>pip install praisonai-code</code></td></tr><tr><td>Telegram/Discord gateway only</td><td><code>pip install "praisonai-bot[gateway,bot]"</code></td></tr><tr><td>Agent training (no GPU)</td><td><code>pip install praisonai-train</code></td></tr><tr><td>LLM fine-tuning (GPU)</td><td><code>pip install "praisonai-train[llm]"</code></td></tr><tr><td>MCP server for Cursor/Claude</td><td><code>pip install "praisonai-mcp[all]"</code></td></tr><tr><td>Browser automation (extension/CDP)</td><td><code>pip install "praisonai-browser[all]"</code></td></tr><tr><td>CrewAI/AutoGen YAML</td><td><code>pip install "praisonai[crewai]"</code></td></tr><tr><td>Full ops + channels + dashboard</td><td><code>pip install "praisonai[claw]"</code></td></tr><tr><td>Everything in one install</td><td><code>pip install praisonai</code></td></tr><tr><td>Library author / embedding</td><td><code>praisonaiagents</code> only</td></tr></tbody></table></figure>
@@ -267,7 +269,7 @@ function finalClaudeCompletedOnSha(comments, headPushedAt) {
}
constFINAL_CLAUDE_REVIEW_BODY=
'@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep\n5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.\n6. Repo routing: agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (`praisonai.sandbox` entry point) — request changes if wrongly added to praisonaiagents/\n\n**Phase 2: FIX Valid Issues**\n7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n8. Push all code fixes directly to THIS branch (do NOT create a new PR)\n9. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n10. If all issues are resolved, approve the PR / close the Issue\n11. If blocking issues remain, request changes / leave clear action items';
'@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify praisonai-rust or praisonai-ts. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.\n\n**Phase 1: Review per AGENTS.md**\n1. Protocol-driven: check heavy implementations vs core SDK\n2. Backward compatible: ensure zero feature regressions\n3. Performance: no hot-path regressions\n4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep\n5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.\n6. Repo routing: agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (`praisonai.sandbox` entry point) — request changes if wrongly added to praisonaiagents/\n\n**Phase 2: FIX Valid Issues**\n7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix\n8. Also independently identify and fix any gaps or issues you find in the changed code — do not rely only on prior reviewer feedback\n9. Push all code fixes directly to THIS branch (do NOT create a new PR)\n10. Comment a summary of exact files modified and what you skipped\n\n**Phase 3: Final Verdict**\n11. If all issues are resolved, approve the PR / close the Issue\n12. If blocking issues remain, request changes / leave clear action items';
1. Read AGENTS.md and the PR diff on the current branch.
2. Read all PR comments and reviews (FINAL architecture reviewer / Lead Engineer must have run).
3. Confirm SDK value gate: change strengthens praisonaiagents (no scope creep).
3. Confirm SDK value gate: change strengthens praisonaiagents (no scope creep). The aim is a LIGHTWEIGHT AND POWERFUL package — BLOCK changes that add params/modules/exports duplicating existing Agent capabilities (instructions/backstory/tools/hooks/memory), or add knobs/fields with no live consumer, i.e. scope creep for the sake of it.
4. Repo routing: BLOCK if agent-callable tools (→ PraisonAI-Tools), lifecycle plugins (→ PraisonAI-Plugins), or optional sandbox backends (→ PraisonAI-Plugins via `praisonai.sandbox`) were added to praisonaiagents/ instead of the external repo.
5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
6. If agent.py adds >100 lines or new Agent __init__ params, respond MERGE_GATE_VERDICT: BLOCK (manual review required).
Read AGENTS.md to understand the architecture rules.
SCOPE: Focus ONLY on Python packages (praisonaiagents, praisonai). Do NOT modify or touch praisonai-rust or praisonai-ts packages.
AIM: This package must stay LIGHTWEIGHT AND POWERFUL. Do a CRITICAL REVIEW at each stage (issue triage, fix planning, PR review/implementation) and reject scope creep for the sake of adding features. Prefer existing Agent capabilities (instructions/backstory/tools/hooks/memory) over new params/modules/exports. Even when fixing a raised issue, keep the fix minimal and lightweight — do NOT expand the surface area or add knobs with no live consumer.
Before implementing anything, answer these questions:
@@ -284,7 +303,7 @@ jobs:
5. Plugins → MervinPraison/PraisonAI-Plugins: framework lifecycle extensions (tracing, logging, metrics, hooks, guardrails). Not agent tools — use STEP 3-ALT.
6. Sandbox backends (optional/niche, e.g. Capsule) → PraisonAI-Plugins via `praisonai.sandbox` entry point; core keeps protocol/config/manager only.
For items routed to an EXTERNAL repository (Tools, Docs, Plugins), follow STEP 3-ALT below.
- Does it duplicate existing functionality? Check if Agent already supports this via existing params (reflection, planning, tools, hooks, memory).
- Does it duplicate existing functionality? Check if Agent already supports this via existing params (reflection, planning, tools, hooks, memory). If it does, reject the change as scope creep and prefer the existing capability — the aim is lightweight and powerful, not more knobs.
- Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
- Does it inherit from Agent properly? New agent types MUST inherit Agent, not wrap it with composition.
- Does it add new dependencies? Only optional deps allowed, must be lazy-imported.
@@ -7,5 +7,9 @@ You are working on the PraisonAI project.
- Be concise and helpful in responses
- Test implementation thoroughly
- Ensure backward compatibility with existing APIs
- Follow protocol-driven design: core protocols in `praisonaiagents/`, agentic terminal CLI in `praisonai-code/`, bot/channel and heavy implementations in`praisonai/`
- Preserve old `praisonai.cli.*` import paths via shims when changing moved CLI code (see §2.3 in `src/praisonai-agents/AGENTS.md`)
- Follow protocol-driven design across the eight packages: core protocols in `praisonaiagents/`, agentic terminal CLI in `praisonai-code/`, bots/gateway in `praisonai-bot/`, LLM fine-tuning + agent training in `praisonai-train/`, browser automation in `praisonai-browser/`, MCP server host in `praisonai-mcp/`, sandbox backends in `praisonai-sandbox/`, integrations/serve/dashboard in the`praisonai/` wrapper
- Preserve old `praisonai.*` import paths via shims when moving code between packages (see §2.3 in `src/praisonai-agents/AGENTS.md`; shim helpers in `src/praisonai/praisonai/cli/_shim.py`)
- Package boundaries and dependency rules: `ARCHITECTURE.md` §2 (Tier 2 packages must never PyPI-depend on the wrapper; cross-tier access goes through lazy `_*_bridge` modules)
- When reviewing a PR or an issue, evaluate whether the change addresses a framework concern or a user goal, and design its surface (params, naming, defaults) accordingly
- The aim of this package is to stay **lightweight and powerful**. Do a critical review at each stage — when triaging an issue, when planning a fix, and when reviewing/implementing a PR. Reject scope creep for the sake of adding features: if a capability already exists (e.g. via existing Agent params like `instructions`/`backstory`/`tools`/`hooks`/`memory`), prefer it over a new API surface. A change must genuinely strengthen the SDK (simpler, more robust, more user-friendly) — do not add knobs, params, modules, or exports that have no live consumer or that merely duplicate existing behaviour.
| 2a | `src/praisonai-code/` | `run`/`chat`/`code`, Typer, runtime, LLM, tool resolution | **`praisonai` as a PyPI dependency** (optional lazy imports via `_wrapper_bridge` only) |
| 2b | `src/praisonai-bot/` | Bots, gateway, channel CLI, OS daemon, gateway scheduler tick | **`praisonai` as a PyPI dependency** (optional lazy `_wrapper_bridge` for jobs/UI) |
| 3 | `src/praisonai/` | `framework_adapters/`, train, serve, dashboard, async jobs API | — |
| 2c | `src/praisonai-train/` | LLM fine-tuning (Unsloth), agent training, `train` CLI, conda env setup | **`praisonai` as a PyPI dependency** (lazy `_code_bridge` for legacy dispatch) |
| 2d | `src/praisonai-browser/` | Extension bridge, CDP/hybrid automation, `browser` CLI | **`praisonai` as a PyPI dependency** (none required; depends on `praisonaiagents` only) |
| 2e | `src/praisonai-mcp/` | MCP server host, auth, transports, `mcp` CLI | **`praisonai` as a PyPI dependency** (lazy `_wrapper_bridge` for full capability registry) |
| 2f | `src/praisonai-sandbox/` | Sandbox backends (Docker, E2B, Modal, Sandlock, SSH), `SandboxRegistry` | **`praisonai` as a PyPI dependency** (lazy `_code_bridge` for `PluginRegistry`) |
| 3 | `src/praisonai/` | `framework_adapters/`, serve, dashboard, async jobs API | — |
**Config kernel:** Phase 0 `praisonai/common/` was skipped; shared config lives in
`praisonai_code/cli/configuration/` and is reached by the bot tier via lazy
This directory contains examples for integrating PraisonAI Agents with**Terminal-Bench 2.0** via the **Harbor framework** for AI agent benchmarking.
This directory contains adapters for benchmarking PraisonAI on**Terminal-Bench 2.1** via the **Harbor framework**. Everything lives in the examples/benchmark layer + CI — there are **zero changes to the `praisonaiagents` / `praisonai` SDK surface**.
## Overview
[Terminal-Bench 2.0](https://tbench.ai) is a Stanford/Laude Institute benchmark that has become the gold standard for evaluating AI coding agents in real terminal environments. The [Harbor framework](https://harborframework.com) is the official evaluation harness that abstracts container lifecycle, parallelization, and cloud providers.
[Terminal-Bench 2.1](https://www.tbench.ai/docs/run-terminal-bench-2-1) is the current release of the Laude Institute benchmark for evaluating AI coding agents in real terminal environments. The [Harbor framework](https://github.com/laude-institute/harbor) is the official evaluation harness that abstracts container lifecycle, parallelization, and cloud providers.
## Setup
Install Harbor and PraisonAI into **one venv** and run from the repo root with `PYTHONPATH=.` so the adapter import path resolves:
@@ -26,6 +26,8 @@ Simpler than competitors • More extensible • Faster • Agent-centric
Powerful, lightweight, highly reliable and robust.
Easy and developer-friendly for non-developers.
Each feature runs 3 ways: **CLI, YAML, Python**.
> **Lightweight & powerful — no scope creep.** The aim of this package is to stay lightweight and powerful. Do a critical review at **each stage** — issue triage, fix planning, and PR review/implementation. Reject scope creep for the sake of adding features: prefer existing Agent capabilities (`instructions`/`backstory`/`tools`/`hooks`/`memory`) over new params, modules, or exports. A change must genuinely strengthen the SDK; never add a knob with no live consumer or that duplicates existing behaviour. Even when fixing a raised issue, keep the fix minimal and lightweight rather than expanding surface area.
The **agentic terminal CLI** (`run`, `chat`, `code`, warm runtime, CLI backends, Typer app) lives in **`praisonai-code`** (`praisonai_code`). **Bots, gateway, and channel CLI** live in **`praisonai-bot`** (`praisonai_bot`) after C9. The **`praisonai`** wrapper keeps integrations, framework adapters, train, serve, and dashboard. **`pip install praisonai`** still installs everything; old import paths are preserved via shims.
The **agentic terminal CLI** (`run`, `chat`, `code`, warm runtime, CLI backends, Typer app) lives in **`praisonai-code`** (`praisonai_code`). **Bots, gateway, and channel CLI** live in **`praisonai-bot`** (`praisonai_bot`) after C9.**LLM fine-tuning and agent training** live in **`praisonai-train`** (`praisonai_train`) after C10. The **`praisonai`** wrapper keeps integrations, framework adapters, serve, and dashboard. **`pip install praisonai`** still installs everything; old import paths are preserved via shims.
| Product | Location | Stays out of |
|---------|----------|--------------|
@@ -191,7 +194,7 @@ C6 is the **sign-off step** after C0–C5 file moves: no further moves, only reg
**C7 (hot path complete):** Core agentic CLI imports no longer require the `praisonai`
wrapper at module level. Remaining lazy wrapper imports (~211, regression-gated) are optional commands
and features (train, capabilities, bots, framework adapters) — use
and features (capabilities, bots, framework adapters) — use
`praisonai_code._wrapper_bridge` or `pip install praisonai`. See
`src/praisonai/tests/C7_VERIFICATION.md`. CI gate: `scripts/check_c7_imports.sh`.
@@ -201,7 +204,9 @@ and features (train, capabilities, bots, framework adapters) — use
Loaded 100 of 650 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
