- Remove redundant argument from workflow.run() in basic_workflow.py since variables are already set in constructor
- Fix temp file pollution by using system temp directory instead of repository directory in auto_rag_agent_basic.py and knowledge-agents-task.py
Co-authored-by: Mervin Praison <[email protected]>
* fix: wrapper layer gaps - InteractiveRuntime lifecycle, tool resolution, cli_backend support
Fixes#1646
- Issue #1: Fixed InteractiveRuntime lifecycle bug where runtime was stopped before agents.start()
* Removed premature stop() in inner finally block at lines 1234-1240
* Added proper loop closure check in cleanup block
* Runtime now stays alive until after agent execution completes
- Issue #2: Consolidated tool resolution implementations
* Added instantiate=True parameter to ToolResolver.resolve() for automatic class instantiation
* Removed hardcoded standard_tools whitelist in agents_generator.py
* Replaced custom tool resolution in bots_cli.py and job_workflow.py with unified ToolResolver
* All entry points now use the same 4-step fallback chain consistently
- Issue #3: Fixed cli_backend support across frameworks
* Added resolve_cli_backend_config() in cli_backends module for unified YAML/Python handling
* Updated Agent wrapper class to accept both string and dict cli_backend configurations
* Added framework compatibility validation with clear error messages
* YAML and Python entry points now handle cli_backend identically
- Added comprehensive regression tests to prevent future regressions
Co-authored-by: MervinPraison <[email protected]>
* fix: address reviewer feedback - test fixes, validation improvements, error handling
- Fix broken test imports and patch paths in test_wrapper_layer_regression.py
- Replace hasattr(__call__) with callable() per Ruff B004
- Fix CLI backend validation to handle both 'roles' and 'agents' keys
- Add input validation for empty strings and malformed dicts in resolve_cli_backend_config
- Include class tools in local tools.py resolution
- Add per-tool error handling to prevent single tool failures from breaking all tools
- Remove unused logger parameter from resolve_cli_backend_config
- Fix exception handling in _resolve_yaml_cli_backend to not mask errors
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Claude <[email protected]>
* fix: make CLI session store cross-platform compatible (fixes#1836)
- Replace hard fcntl import with optional import pattern
- Add Windows msvcrt locking support in UnifiedSessionStore
- Implement graceful degradation when no locking available
- Fix Path handling in session store constructor
- Follows same pattern as praisonaiagents/session/store.py fix from #1792
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: resolve critical Windows locking bugs in CLI session store
- Fix msvcrt.locking position consistency by seeking to 0 before lock/unlock
- Use blocking locks (LK_LOCK/LK_RLCK) instead of non-blocking (LK_NBLCK)
- Prevent truncation race by using r+b mode and locking before truncate
- Add flush()+fsync() before unlock to ensure data persistence
- Maintain backward compatibility on Unix systems
Fixes critical OSError on every Windows save/load operation.
Addresses issues identified by Greptile and CodeRabbit reviewers.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
* fix: reload HierarchicalSessionStore extended cache on reads
PR #1759 fixed stale reads for DefaultSessionStore but left
_extended_cache out of sync. get_extended_session could return
truncated message lists after cross-process or cross-instance writes.
Align extended cache with _read_session_fresh and clear it on
invalidate_cache. Regression test added.
Co-authored-by: Mervin Praison <[email protected]>
* fix: atomic cache invalidation and stale cache writes in HierarchicalSessionStore
- Fix race condition in invalidate_cache() by clearing both caches under single lock
- Fix stale cache overwrites in write methods (set_title, share_session, unshare_session, revert_to_*, create_session parent update, auto_title)
- Replace load-modify-save pattern with _modify_session_locked for atomic updates
- Add regression test for concurrent write preservation
Addresses critical issues identified by code reviewers (Qodo/CodeRabbit)
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Addresses remaining attack surface from security advisories:
GHSA-3qg8-5g3r-79v5 (JWT signing key - CRITICAL):
auth_service.py: PLATFORM_ENV no longer defaults to 'dev' when unset.
When PLATFORM_JWT_SECRET is not set and PLATFORM_ENV is not explicitly
'dev', an ephemeral random secret is auto-generated with a warning.
This prevents production deployments from silently using the well-known
'dev-secret-change-me' key.
GHSA-vg22-4gmj-prxw (unauthenticated eval - CRITICAL):
Replaced all eval() calls in official examples and benchmarks with an
AST-based safe math evaluator that only allows numeric literals and
arithmetic operators. Files fixed:
- examples/python/a2a/a2a-server.py (the primary advisory target)
- examples/mcp/multi_server.py
- examples/python/mcp/mcp-tools-server.py
- examples/python/mcp/mcp-tools-server-sse.py
- examples/mcp_server/custom_tools_server.py
- examples/python/mcp_server_example.py
- examples/python/custom_tools/tools_with_latency.py
- examples/eval/reliability_example.py
- src/praisonai-agents/benchmarks/real_benchmark.py
The character-filter approach (allowlist '0123456789+-*/.()') was
insufficient because () enables attribute access chains. AST-based
evaluation only permits numeric literals and binary/unary arithmetic.
GHSA-hvhp-v2gc-268q and GHSA-9cr9-25q5-8prj (file read/write):
Already fixed in prior commits via _resolve_rule_path() and
_resolve_cwd_yaml_path() containment helpers.
Co-authored-by: ulsreall <[email protected]>
* fix: make session store fcntl import cross-platform compatible (fixes#1540)
- Add conditional fcntl import like file_memory.py already has
- Use _HAS_FCNTL flag to check fcntl availability before usage
- Windows uses msvcrt for locking, Unix uses fcntl when available
- Fixes Windows test collection failure due to missing fcntl module
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: add one-time warning for degraded file locking
Addresses CodeRabbit feedback about silent no-op locking when fcntl
is unavailable on non-Windows platforms. Adds module-level sentinel
to emit warning only once, following AGENTS.md error handling principles.
Co-authored-by: Mervin Praison <[email protected]>
* fix: improve fcntl import robustness and fix unreachable code
- Replace platform-based fcntl import with try/except for better cross-platform compatibility
- Fix unreachable warning code branch that could never execute
- Remove misleading msvcrt reference in Unix-only warning message
- Now gracefully handles environments where fcntl is unavailable (GAE, Pyodide, etc.)
- All reviewer feedback from Qodo, CodeRabbit, Gemini, Copilot, and Greptile addressed
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
* fix: harden optional fcntl import and add regression test
* test: cover missing fcntl import path for session store
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
* fix: HierarchicalSessionStore stale extended cache could wipe messages
After DefaultSessionStore began reloading on reads (#1759),
HierarchicalSessionStore still served writes from a separate
_extended_cache that could lag disk. set_title, share_session,
and revert paths then saved truncated message lists.
Reload via _read_session_fresh for all extended reads and sync
both caches. Add regression test for set_title after cross-store writes.
Co-authored-by: Mervin Praison <[email protected]>
* perf: optimize HierarchicalSessionStore with smart cache invalidation
- Add file modification time-based cache validation
- Restore performance while maintaining data integrity
- Preserve force_reload API contract
- Add comprehensive regression tests
Fixes performance regression from stale cache fix while
preventing message loss from concurrent writes.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: prevent HierarchicalSessionStore stale writes on fork and metadata updates
PR #1745 fixed add_message races but fork_session, create_session parent
linking, snapshots, and revert still saved stale in-memory sessions and could
overwrite concurrent add_message writes.
Route parent/field updates through _modify_session_locked and add a regression
test for fork_session concurrent with add_message.
Co-authored-by: Mervin Praison <[email protected]>
* fix: address Qodo reviewer bugs in HierarchicalSessionStore
1. Fix revert_to_message() - validate index before writing to prevent
unnecessary session writes on invalid indices
2. Fix revert_to_snapshot() - use read-only lookup to avoid double writes
and unnecessary writes when snapshot not found
3. Fix test_fork_session_preserves_concurrent_messages() - use proper
concurrent testing with two store instances and threading to simulate
real race conditions
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
_load_session returned an in-memory cache without checking disk when a
session JSON file already existed. A second DefaultSessionStore instance
(or direct file edits) could add messages that get_chat_history never saw
until invalidate_cache was called manually.
Always reload from disk under FileLock when the session file exists.
Adds regression test for cross-instance reads.
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
* fix: session message loss in managed stream and bot history saves
- Persist user/assistant messages and state after LocalManagedAgent.stream()
- Add DefaultSessionStore.set_chat_history for atomic locked replace
- BotSessionManager uses set_chat_history instead of clear + re-add loop
- DbSessionAdapter.update_session_metadata accepts **fields like file store
- Add regression tests for stream persistence and metadata API
Co-authored-by: Mervin Praison <[email protected]>
* fix: preserve timestamps and metadata in set_chat_history
- Fix SessionMessage construction in set_chat_history to preserve
original timestamp when provided in input messages
- Also preserve metadata field for completeness
- Prevents loss of temporal ordering information during history replacement
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
* fix: wrapper layer gaps - case normalization, lazy loading, async persistence (fixes#1766)
- Gap 1: Fix PluginRegistry case normalization inconsistency by normalizing names during storage and using lazy loaders
- Gap 2: Implement lazy loading in PluginRegistry by storing loaders instead of immediately executing them
- Gap 3: Add async persistence support with aon_* methods and achat wrapping in agent hooks
Co-authored-by: MervinPraison <[email protected]>
* fix: critical bugs in wrapper layer - registry consistency and async event loop blocking
- Fix registry inconsistency: register() now writes to both _loaders and _items
- Fix event loop blocking: PersistentAgent.achat uses asyncio.to_thread for sync fallback
- Fix threading deadlock: use RLock and release lock before calling loader()
- Add async session end methods (aend_session) for proper async lifecycle
Addresses critical P1/P2 issues identified by code reviewers.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
* fix: accept multi-channel bot.yaml keys with platform field (#1757 regression)
Onboard generates channels like telegram_cfo with platform: telegram.
BotYamlSchema rejected any channel key not exactly matching a platform name,
so praisonai doctor reported invalid bot.yaml after multi-bot onboard.
Validate using channel.platform when present; extend ChannelConfigSchema for
gateway-style fields used in generated configs.
Co-authored-by: Mervin Praison <[email protected]>
* fix: use monkeypatch for env isolation in multi-channel test
- Replace direct os.environ manipulation with pytest monkeypatch
- Ensures test environment isolation and automatic cleanup
- Addresses CodeRabbit review feedback
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
The link pointed to /docs/concepts/flow which returns 404. The actual
page is published at /docs/concepts/agentflow.
Co-authored-by: dymux <[email protected]>
* fix: complete AsyncAgentScheduler parity, fail-loud pip installs, remove broken resolver
Fixes#1783
Three critical gap fixes in the PraisonAI wrapper layer:
1. **AsyncAgentScheduler Feature Parity**
- Add missing timeout and max_cost parameters to match sync version
- Port budget tracking logic with cost estimation
- Port timeout support using asyncio.wait_for()
- Add from_yaml() and from_recipe() class methods for YAML/recipe support
- Update stats methods to include cost tracking
- Remove 16 TODO markers now that features are ported
2. **Fail-Loud Pip Install Failures**
- Convert silent pip install failures to raised RuntimeError exceptions
- Fix managed_local.py _install_packages() to fail early on pip errors
- Fix _install_packages_in_compute() to raise on compute pip failures
- Eliminates confusing ImportError deep in tool execution
3. **Remove Broken reset_default_resolver Definition**
- Remove second definition that shadows working first definition
- Eliminates NameError on function call due to undefined globals
- Preserves working ContextVar-based implementation at line 545
All changes maintain backward compatibility while fixing production-blocking issues
in async scheduling, managed agent bootstrap, and tool resolution.
Co-authored-by: MervinPraison <[email protected]>
* fix: restore async stats API and safe budget-stop behavior
* fix: tighten async budget checks and stats parity
* fix: remove redundant asyncio import in from_recipe method
Removes the unnecessary nested import asyncio statement inside the
astart method, since asyncio is already imported at module level.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Adds client_name="praisonai_valkey_client" to the shared Valkey client
factory so all PraisonAI connections are identifiable via CLIENT LIST.
Signed-off-by: Anna Tao <[email protected]>
* fix: reload session from disk on get_chat_history reads
get_chat_history and get_session returned stale in-memory cache when
another DefaultSessionStore instance (or worker process with a warm
cache) had written newer messages to the same session file. Bot
load_history paths then fed the LLM truncated context.
Reload under FileLock before returning reads; add regression test.
Co-authored-by: Mervin Praison <[email protected]>
* fix: address session store test failure and consistency issues
- Update test_invalidate_cache to reflect new always-reload behavior
- Fix inconsistency in get_sessions_by_agent() to use fresh reads
- Ensures consistent staleness guarantees across all read methods
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
* feat: implement multi-channel Telegram bot support (fixes#1751)
- Add multi-channel support to onboard wizard with role-based naming
- Implement TELEGRAM_<ROLE>_BOT_TOKEN environment variable convention
- Add doctor validation for duplicate token usage and naming conventions
- Create YAML generation for multiple channels per platform with agent routing
- Add documentation and example for Hermes-style multi-bot workforces
This enables operators to run multiple Telegram bots (e.g. @company_cfo_bot,
@company_ops_bot) each routing to different agents with specialized knowledge,
matching Hermes workforce deployment patterns.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: critical structural regression in onboard wizard and improve validation
- Fix unreachable code in onboard wizard - Steps 2-6 were dead code after return statement
- Restore self.tokens attribute for backward compatibility with legacy methods
- Improve duplicate token detection to check actual token values, not just env var names
- Add role sanitization (regex) and duplicate channel prevention
- Fix markdown language specifier to resolve markdownlint warning
Fixes structural issue where wizard would exit after Step 1 without collecting tokens,
generating YAML, or installing daemon. All critical reviewer feedback addressed.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
* fix: Gateway port 8765 collision — add preflight bind check and single-instance guard (fixes#1749)
- Add port_utils.py with collision detection utilities:
* is_port_in_use() - Check if port is bound
* check_port_available() - Check port and find PID using it
* GatewayPIDLock - Single-instance enforcement with PID lock files
* format_collision_error() - Actionable error messages
- Update gateway server with preflight port checking:
* Check port availability before uvicorn starts
* Acquire/release PID lock for single-instance enforcement
* Clear error messages when port conflicts detected
- Enhance gateway CLI with stop command and GATEWAY_PORT support:
* Add 'praisonai gateway stop' with graceful/force options
* Enhanced 'praisonai gateway status' shows PID lock and port status
* Support GATEWAY_PORT environment variable in all commands
- Implement gateway handler stop functionality:
* PID detection and graceful/force process termination
* Enhanced status checking with port and lock information
Resolves port bind failures, duplicate process scenarios, and Windows restart loops.
Provides clear error messages with actionable guidance for operators.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: Resolve critical PID lock and port collision issues
Fixes 5 critical bugs identified in gateway collision prevention:
1. Multi-port conflict: PID lock now port-specific to allow different ports
2. Lock cleanup failure: Added exception handler around uvicorn startup
3. TOCTOU race: Use atomic temp file + rename for lock acquisition
4. Windows compatibility: Use SIGTERM on Windows instead of SIGKILL
5. Unused variable: Remove unused output controller in stop command
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
* fix: Gateway Telegram error replies crash on non-ASCII exception text
- Create safe error message helper in unicode_utils.py
- Update Telegram bot error handling to use ASCII-safe formatting
- Fix gateway server error handler to extract root cause errors
- Ensure UTF-8 encoding for YAML config file reads
- Add support for accented character conversion to ASCII
Fixes#1752🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
* Changes before error encountered
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/a921937b-8ef2-4716-a4c1-16e7e340f16d
* fix: address reviewer feedback on unicode_utils performance and logic
- Remove dead code comment and simplify safe_log_message implementation
- Fix double sanitization in extract_root_cause_from_error by returning raw text
- Improve code comments for clarity
Addresses Greptile review feedback on performance and logic issues.
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
* fix: HierarchicalSessionStore message loss and extended field wipe
HierarchicalSessionStore.add_message used an unlocked load-modify-save
path, so concurrent writers could overwrite each other's messages.
Inherited _modify_session_locked also loaded SessionData, which dropped
parent_id, snapshots, and children_ids on metadata updates.
- Load ExtendedSessionData under the existing file lock
- Route add_message through _modify_session_locked
- Keep _extended_cache in sync after locked writes
- Add regression tests for concurrency and extended fields
Co-authored-by: Mervin Praison <[email protected]>
* fix: remove redundant SessionMessage import in hierarchy.py
Copilot found redundant local import of SessionMessage in add_message
method since it's already imported at module scope. This removes
the unnecessary import statement.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
* fix: persist DbSessionAdapter metadata to conversation store
Managed agents using PraisonDB lost token counts, session history, and
compute refs after process restart because set_metadata was in-memory only.
Flush metadata on write and reload from the conversation session on read.
Co-authored-by: Mervin Praison <[email protected]>
* fix: address CodeRabbit findings in DbSessionAdapter metadata persistence
- Add _purge_persisted_metadata() to clear metadata on session deletion
- Fix test mock configuration to prevent auto-creation of conversation attr
- Add integration test as required by AGENTS.md §9.4
Resolves stale metadata resurrection and improves test coverage.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
* feat: integration follow-up - Pattern C CLI, L3 pages, aiui 0.3.121, cross-repo CI (fixes#1717)
Comprehensive integration follow-up implementing Pattern B→C transition:
**Tier 1 - Release & CI:**
- Pin aiui>=0.3.121,<0.4 across all optional dependencies (8 occurrences)
- Add cross-repo CI workflow testing PraisonAI + PraisonAIUI integration
- Create RELEASE_INTEGRATION.md with version matrix and troubleshooting
- Include optional agentic testing job for end-to-end validation
**Tier 2 - Pattern C & CLI:**
- Add configure_host(style=...) parameter with dashboard/chat options
- Implement 'praisonai serve ui-gateway' command for Pattern C
- Export run_integrated_gateway in main package API
- Add sync wrapper for async gateway function
**Tier 3 - L3 Pages & Infrastructure:**
- Register L3 dashboard pages (workflow-runs, bot-health)
- Add context_paths parameter for AGENTS.md-style injection
- Upgrade bridge failure logs from debug to warning level
- Set up framework for backend slot injection
Co-authored-by: MervinPraison <[email protected]>
* fix: critical issues in Pattern C UI-Gateway integration
- Fix TypeError: remove unsupported agents_file parameter from CLI call
- Align default ports: change gateway_host.py default from 8080 to 8765
- Add **kwargs to configure_host for resilience against extra arguments
- Revert log levels: warning back to debug for optional dependencies
Fixes review feedback from gemini-code-assist
Co-authored-by: Mervin Praison <[email protected]>
* fix: address PR review findings for ui-gateway and integration CI
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/3ee145c5-72dc-4884-9840-c85ba238e718
Co-authored-by: MervinPraison <[email protected]>
* test: tighten ui-gateway assertions and remove test magic number
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/3ee145c5-72dc-4884-9840-c85ba238e718
Co-authored-by: MervinPraison <[email protected]>
* Delete RELEASE_INTEGRATION.md
* fix: correct path to PraisonAIUI in cross-repo CI workflow
Both cross-repo-integration and agentic-integration jobs were using
cd ../../PraisonAIUI which resolves to PraisonAI/PraisonAIUI (doesn't exist).
Changed to cd ../../../PraisonAIUI to correctly reach the sibling checkout
at /home/runner/work/PraisonAI/PraisonAI/PraisonAIUI.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
clear_session only cleared the in-memory cache while BotSessionManager
and managed agents rewrite history via clear_session + add_message.
Stale DB rows were reloaded on the next on_agent_start, resurrecting
trimmed or cleared chat history.
- Call conversation.delete_messages when available
- Reset session tracking and skip stale on_agent_start hydration
- Add regression test for bot history trim roundtrip
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
* fix: prevent session message loss in LocalManagedAgent._persist_state
Use update_session_metadata (locked read-modify-write) instead of
get_session + _save_session, which could overwrite messages written
concurrently via add_message on another store instance.
Adds regression test mirroring session store race coverage from #1724.
Co-authored-by: Mervin Praison <[email protected]>
* fix: preserve legacy _persist_state fallback when session is absent
Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/4d08ce0a-1b7b-4e50-b841-6a08416f2f53
Co-authored-by: MervinPraison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
* fix: prevent session message loss in set_agent_info and clear_session
Apply locked read-modify-write (same pattern as update_session_metadata)
to set_agent_info, clear_session, and set_gateway_info so stale in-memory
copies cannot overwrite messages written by add_message on another instance.
Co-authored-by: Mervin Praison <[email protected]>
* test: add regression test for set_gateway_info message preservation
Addresses Copilot's suggestion to ensure set_gateway_info also preserves
messages when racing with concurrent message writes from another instance.
Completes test coverage for all four methods migrated to _modify_session_locked.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
- Simplify required field validation logic (line 307)
- Move get_tool_schema import outside loop for better performance
- Use set for O(n) duplicate detection instead of O(n²) list lookup
Addresses valid performance issues identified in PR review while
maintaining backward compatibility and test coverage.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
- Fix hardcoded paths in test scripts to use relative paths
- Treat missing environment variables as errors in STRICT mode
- Add support for comma-separated strings in requirement parsing
Co-authored-by: Mervin Praison <[email protected]>
Validator should gracefully handle encoding errors and return
validation errors rather than crashing. Fixes issue found by
code review.
Co-authored-by: Mervin Praison <[email protected]>
Use locked read-modify-write when merging session stats so a stale
in-memory copy cannot overwrite messages written by add_message.
Adds a regression test for the two-store race introduced with UI
session telemetry.
Co-authored-by: Mervin Praison <[email protected]>
Introduces configure_host/build_host_app, optional L1 bridges (hooks, workflows, usage, approvals, schedules), refactors bundled default apps, and adds session/telemetry protocols plus integration tests so aiui can run standalone or wired via set_backend injection.
- Fix execute_tool_async issue in _execute_unified_achat_completion
- Add proper response processing after unified dispatch call
- Mirror sync _chat_impl behavior for content extraction, history update
- Add guardrails, callbacks, and proper return to exit while loop
- Prevents infinite loop by handling response and returning result
Co-authored-by: MervinPraison <[email protected]>
Unified dispatch completed the LLM call but never finalised the response,
causing achat to loop until timeout. Add _finalize_unified_achat_response,
use execute_tool_async in _execute_unified_achat_completion, fix LLMError
session_id via context, and add unit tests for single-dispatch return.
Co-authored-by: Cursor <[email protected]>
- Rename hermes_filter.py to allowed_tools_filter.py
- Rename list_tools_with_hermes_filter to list_tools_with_allowed_filter
- Update all imports and references across codebase
- Maintain backward compatibility aliases for HERMES naming
- Update documentation and test files
- Keep HERMES_ONLY_TOOLS env var as backward compatibility alias
This makes the API more intuitive and self-documenting while preserving
all existing functionality and backward compatibility.
Co-authored-by: Mervin Praison <[email protected]>
- Rename HERMES_ONLY_TOOLS to ALLOWED_TOOLS for better UX
- Maintain full backward compatibility (ALLOWED_TOOLS takes precedence)
- Add AllowedToolsFilter class with HermesToolFilter alias
- Update all documentation and examples to use ALLOWED_TOOLS
- Fix all reviewer feedback from CodeRabbit, Greptile, and Copilot:
* Fixed f-string logging issue (use %s formatting)
* Corrected test diagnostics for unknown vs dropped tools
* Added CI mode pinning in dev tests for stability
* Improved .env.example with failure semantics documentation
Addresses user feedback on naming convention while following AGENTS.md
architecture guidelines for protocol-driven, backward-compatible design.
Co-authored-by: Mervin Praison <[email protected]>
Remove ~3,400 lines of duplicated A2UI builder code and delegate to
a2ui-agent-sdk via a thin lazy adapter, send_a2ui_messages tool, and
A2UI facade. Bridge agent stream_emitter tool events into AG-UI SSE.
Implements comprehensive diagnostics for Windows daemon invocation issues
where 'python -m praisonai' and 'praisonai' console script have inconsistent
behavior, addressing newcomer perception that OpenClaw is broken on Windows.
Added deliverables:
1. Single canonical daemon recipe per OS:
- Generates absolute paths for venv installations
- Fallback commands with explicit interpreter paths
- Windows encoding safety recommendations
2. Runtime self-check (praisonai doctor packaging):
- Package structure validation (__main__.py presence)
- Python module execution test (python -m praisonai)
- Console script execution test (praisonai command)
- Windows daemon context analysis (venv/PATH/encoding)
- Packaging metadata inspection (editable vs regular install)
3. Enhanced Windows CI testing:
- Added packaging/daemon entry point validation
- Tests both execution methods in Windows environment
4. Architectural compliance:
- Core vs Wrapper separation maintained
- No new dependencies added
- Follows existing doctor check patterns
- Backward compatible
The doctor packaging command now provides:
- Absolute daemon command paths
- Virtual environment validation
- Microsoft Store Python warnings
- PYTHONIOENCODING recommendations
- Root cause classification for install types
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
This implements comprehensive capability gate enforcement for Agent Skills as requested in issue #1697.
Key Features:
- SkillRequirements data model with support for requires_* frontmatter
- CapabilityValidator with layered enforcement levels (disabled/warn/strict)
- Integration with existing SkillManager and discovery pipeline
- CLI doctor diagnostics for missing dependencies
- Feature flag control via SKILL_CAPABILITY_ENFORCEMENT env var
- Full backward compatibility with existing skills
Architecture:
- Core SDK implementation in praisonaiagents following protocol-driven design
- Extends existing skills system without breaking changes
- Tool registry integration for automatic capability detection
- Lazy loading and zero performance impact when disabled
Enforcement Levels:
- disabled: No enforcement (legacy behavior)
- telemetry: Log missing deps only
- warn: Show warnings but allow activation (default)
- strict: Block skill activation until deps satisfied
Skills can now declare requirements in SKILL.md frontmatter.
CLI usage:
- praisonai doctor skills - Check capability status
- SKILL_CAPABILITY_ENFORCEMENT=strict - Enable strict enforcement
Fixes#1697
- Add HermesToolFilter class with comprehensive diagnostics
- Integrate filter into tool registry and CLI tool loading
- Implement semantics: unset=all tools, empty=error, whitelist=filtered
- Handle unknown tools: warn+strip in dev, strict fail in CI
- Add startup diagnostics logging as specified in issue
- Include comprehensive unit and integration tests
- Update .env.example with configuration guidance
Fixes#1698🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- Enhanced BaseTool.validate() with OpenAI schema compatibility checks
- Added validate_schema_roundtrip() for JSON serialization verification
- Added validate_tool_schema_consistency() for tool list validation
- Enhanced @tool decorator with automatic validation at creation time
- Added comprehensive test suite for schema round-trip validation
- Improved error messages with specific remediation guidance
Ensures robust tool schema handling while maintaining backward compatibility.
All tools now validate against OpenAI function calling format requirements.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- Fix parser.py: add encoding='utf-8' to skill_md.read_text()
- Fix validator.py: add encoding='utf-8' to skill_md.read_text()
- Fix loader.py: add encoding='utf-8' to all read_text() calls for SKILL.md body, scripts, and references
- Add comprehensive UTF-8 tests to verify fix works across all file types
- Prevents UnicodeDecodeError on Windows when SKILL.md contains non-ASCII characters like em dashes, smart quotes, arrows, or non-Latin scripts
Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Fixes three architectural issues that violated DRY and "safe by default" principles:
1. Shadow scheduler module issue:
- Remove dead scheduler.py that was shadowed by scheduler/ package
- Replace mock create_scheduler with real DeploymentScheduler factory
- CLI --deploy --schedule now uses actual deployment logic instead of MockAgent
2. Disjoint tool registry/resolver issue:
- Connect ToolRegistry to ToolResolver resolution chain
- Tools registered via register_function() are now discoverable by YAML resolver
- Add ToolRegistry as step 2 in resolution order (after local tools.py)
3. Incompatible async-bridging strategies:
- Standardize on _async_bridge.run_sync() as single source of truth
- Remove per-call asyncio.run() loops from agent_tools.py
- Fix InteractiveRuntime to run on shared background loop
- Eliminate dormant event loop anti-pattern in praisonai_adapter.py
All fixes follow protocol-driven design principles from AGENTS.md.
Fixes#1694
Co-authored-by: MervinPraison <[email protected]>
- Update comment from 'construct resolver explicitly' to 'use cached default resolver'
- Fix all convenience function docstrings to reflect singleton behavior
- Add CWD-anchoring behavior documentation with mitigation guidance
- Clarify that default resolver is cached and CWD-dependent
Addresses feedback from Greptile and Copilot reviewers regarding
misleading documentation after singleton pattern introduction.
Co-authored-by: Mervin Praison <[email protected]>
- Remove duplicate profiler definitions at lines 955-1098 in profiler.py
• Eliminates dead code and redundant _default_lock/_default_profiler allocations
• Preserves single canonical ProfilerCompat class with all methods
- Rename conflicting TaskDetails to WorkflowStepDetails in auto.py
• Resolves namespace collision between agent-task and workflow-step schemas
• Updates WorkflowParallelDetails to reference renamed class
- Add lazy singleton for ToolResolver in tool_resolver.py
• Replaces per-call instantiation with process-level cached instance
• Maintains explicit resolver parameter for dependency injection
• Follows same pattern as profiler.py for consistency
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
- Use centralized is_available() for CREWAI_AVAILABLE and AUTOGEN_AVAILABLE
- Preserve PRAISONAI_TOOLS_PACKAGE_AVAILABLE and associated functions from main
- Maintain backward compatibility with __getattr__ implementation
Co-authored-by: Mervin Praison <[email protected]>
Addresses code review feedback to consolidate imports from .discovery module
at the top of the file instead of using local imports.
Co-authored-by: Mervin Praison <[email protected]>
- Change get_default_skill_directories to get_default_skill_dirs in manager.py:274
- This fixes ImportError affecting create_skill(), edit_skill(), delete_skill(), patch_skill(), and write_skill_file()
- Function name mismatch was introduced during refactor
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
- Fix YAML syntax errors in GitHub workflows (duplicate with: blocks)
- Fix undefined function error in install.sh (error -> log_error)
- Address SQL injection vulnerabilities in ClickHouse (escape single quotes)
- Fix Windows port detection false positives (exact port matching)
- Add missing identifier validation in SurrealDB get() method
- Add database identifier validation in ClickHouse constructor
All critical issues identified by CodeRabbit, Greptile, and Copilot have been addressed.
Co-authored-by: Mervin Praison <[email protected]>
- Fix shell interpolation vulnerabilities in E2B backend with proper shlex.quote() escaping
- Replace duplicated async/sync bridging with centralized run_coroutine_safely() utility
- Add comprehensive pytest unit tests for SandboxMixin, SecurityAnalyzer, SandboxManager, and E2BSandbox
- Remove manual smoke test script in favor of proper unit tests
- Improve code quality and maintainability per architecture review
Co-authored-by: Mervin Praison <[email protected]>
- Add SandboxManager factory with routing to appropriate backends
- Implement E2B cloud VM backend with full file operations
- Add comprehensive security pre-checks with AST analysis
- Integrate SandboxMixin into Agent class for safe code execution
- Support Docker, subprocess, and E2B backends
- Add optional dependencies for e2b-code-interpreter and docker
- Maintain protocol-driven architecture per AGENTS.md
- Zero performance impact when sandbox is disabled
- Backward compatible with existing codebase
Fixes#1670🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
2026-05-15 05:35:04 +00:00
379 changed files with 27081 additions and 7800 deletions
Open **http://localhost:7861** — use the **Agent** and **Agent Team** components to create sequential or parallel workflows. Connect Chat Input → Agent Team → Chat Output for instant multi-agent pipelines.
After merging security PRs [#1684](https://github.com/MervinPraison/PraisonAI/pull/1684) and [#1685](https://github.com/MervinPraison/PraisonAI/pull/1685):
instructions="You are a company policy expert. Answer questions based ONLY on the provided knowledge. Quote exact values when asked about codes or numbers.",
knowledge=[temp_dir],# Add directory with documents
user_id="example_user",# Required for mem0 backend
memory={"user_id":"example_user"},
)
print("\n1. Testing Agent.chat() with context-required question:")
goal="Help users understand and extract information from PDF documents",
backstory="You are an expert at reading, analyzing, and answering questions about PDF documents. You provide accurate, detailed answers based on the document content.",
instructions="Read the provided PDF document and answer questions about its content. Be specific and cite relevant sections when possible.",
knowledge=["document.pdf"],# Replace with your PDF file path
knowledge=config,
knowledge={**config,"sources":["document.pdf"]},# Replace with your PDF path
This guide explains how to set up multiple bots on the same platform (e.g., multiple Telegram bots) for different roles using PraisonAI, similar to Hermes-style AI workforces.
## Overview
PraisonAI supports running multiple bots on the same platform, each routing to different agents with specialized knowledge and capabilities. This is useful for:
# Legacy single-agent block for backward compatibility
agent:
name:"assistant"
instructions:"You are a helpful AI assistant. You can search the web, manage schedules, and remember past conversations. Use your tools proactively."
model:"gpt-4o-mini"
# Multi-agent workforce with different specialized roles
agents:
cfo:
instructions:"You are a CFO agent. You are a helpful AI assistant. Use your tools proactively to help with CFO-related tasks like financial analysis, budget planning, and cost optimization."
model:gpt-4o-mini
memory:false
ops:
instructions:"You are an ops agent. You are a helpful AI assistant. Use your tools proactively to help with ops-related tasks like system monitoring, deployment, and infrastructure management."
model:gpt-4o-mini
memory:false
content:
instructions:"You are a content agent. You are a helpful AI assistant. Use your tools proactively to help with content-related tasks like writing, editing, and content strategy."
model:gpt-4o-mini
memory:false
# Multiple Telegram channels - each with unique tokens and routing
channels:
telegram_cfo:
platform:telegram
token:${TELEGRAM_CFO_BOT_TOKEN}
group_policy:mention_only
allowed_users:${TELEGRAM_ALLOWED_USERS}
# auto_approve_tools: true
# Chat bots cannot show CLI approval prompts; safe tools auto-approved by default.
routes:
default:cfo
telegram_ops:
platform:telegram
token:${TELEGRAM_OPS_BOT_TOKEN}
group_policy:mention_only
allowed_users:${TELEGRAM_ALLOWED_USERS}
# auto_approve_tools: true
# Chat bots cannot show CLI approval prompts; safe tools auto-approved by default.
routes:
default:ops
telegram_content:
platform:telegram
token:${TELEGRAM_CONTENT_BOT_TOKEN}
group_policy:mention_only
allowed_users:${TELEGRAM_ALLOWED_USERS}
# auto_approve_tools: true
# Chat bots cannot show CLI approval prompts; safe tools auto-approved by default.
Loaded 100 of 379 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.