Removes the deprecated examples/python/12-agent-dashboard/ directory
which contained XSS vulnerabilities via innerHTML usage. This example
was marked for removal in v0.5.0 due to unsafe rendering patterns.
- Deleted examples/python/12-agent-dashboard/ entirely
- Updated examples/README.md to redirect to secure alternatives (15-dashboard-test)
- Removed obsolete reference in 13-real-dashboard docstring
The example used innerHTML with API-derived data in 7+ locations,
creating stored XSS risks. Users should use examples 13 or 15 which
implement secure component-based rendering.
* feat: deprecate unsafe innerHTML examples and fix XSS vulnerabilities (fixes#59)
- Add deprecation warning to example 12-agent-dashboard with runtime DeprecationWarning
- Replace innerHTML usage in plugin.js with safe DOM APIs (textContent, createElement)
- Example 12 now warns users to migrate to examples/15-dashboard-test/ or examples/13-real-dashboard/
- Prevents XSS injection through API responses in admin dashboard
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
* fix: replace innerHTML with safe DOM methods to prevent XSS (fixes#59)
- Fixed renderApiPageData function XSS in error handling
- Fixed renderComponents function XSS in JSON viewer
- Fixed renderCard function XSS in title, value, footer fields
- Fixed renderChart function XSS in title field
- Fixed renderTable function XSS in headers and cell data
- Fixed aiui.createBoard error handler XSS in error messages
- Fixed navigation items XSS in page titles and icons
- Fixed header branding XSS in site title and logo
- Fixed A2UI surface fallback XSS in JSON output
- Fixed component default case XSS in JSON output
- Fixed key-value list XSS in labels and values
All innerHTML usage with user-controlled API data has been replaced
with safe DOM methods (createElement, textContent, appendChild) to
prevent XSS vulnerabilities in the admin dashboard.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
* fix: update tutorial namespace references in examples
- Fixed stale chat-yaml-* references to use current yaml/* paths
- Updated 12-playground title to clarify agents style usage
- Ensures curriculum progression comments are accurate
Fixes#73
* fix: resolve namespace collisions in tutorial examples (fixes#73)
- Move yaml/02-clean-chat to yaml/03-clean-chat to resolve collision with yaml/02-profiles
- Move python/19-email-bot to python/20-email-bot to resolve collision with python/19-components-showcase
- Shift all subsequent numbered examples to maintain monotonic progression
- Update stale comments referencing chat-yaml-* namespaces to proper yaml/* paths
- Fix cross-references between YAML and Python examples
Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
* feat: add StreamBridge for thread-safe async streaming (fixes#68)
- Create StreamBridge abstraction in examples/_shared/ with thread-safe async-sync bridge
- Fix examples 07, 08, 13 to use call_soon_threadsafe instead of unsafe put_nowait
- Fix example 07 lifecycle ordering bug by concurrent event draining
- Add comprehensive unit tests for StreamBridge functionality
- All examples now use consistent thread-safe streaming pattern
Co-authored-by: Mervin Praison <[email protected]>
* fix: resolve thread-safety and performance issues in StreamBridge
- Initialize asyncio.Queue in __init__ to ensure thread-safe creation
- Remove race condition by eliminating lazy initialization
- Fix 1.0-second performance delay in provider example using sentinel pattern
- Remove unused imports and StreamBridge instance in provider
- Update tests to match new initialization behavior
- All tests pass and linting clean
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
* feat: implement channel config secret security validation (fixes#58)
- Add secret field detection to prevent inline API keys/passwords in channel configs
- Implement config validation that rejects secrets, requires env:VAR_NAME references
- Add response redaction to hide secrets from GET endpoints
- Update examples 20, 22 and seed data to use secure env: pattern
- Covers major secret types: api_key, bot_token, app_password, etc.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
* fix: resolve _ref keys in bot startup and add defensive validation
- Add _get_config_secret() helper to resolve bot_token_ref, api_key_ref, app_token_ref
- Update _start_channel_bot() to use new helper for token resolution
- Add defensive input validation to _validate_config_security() and _redact_config_secrets()
- Fix defensive dictionary access in API endpoints (_list, _get)
- Update _resolve_slack_app_token() and test endpoint to use new helper
Fixes critical issue where bots configured with _ref keys could not start.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
* feat: implement set_pages() in example 18 to fix curriculum duplication (fixes#57)
- Add aiui.set_pages(["chat", "sessions", "agents", "usage", "config"]) call
- This implements the page curation functionality promised in the docstring
- Resolves pedagogical architecture issue where example 18 was duplicate of 17
- Now example 18 genuinely teaches aiui.set_pages() API as advertised
Co-authored-by: Mervin Praison <[email protected]>
* feat: implement set_pages() in example 18 to demonstrate page curation
- Add aiui.set_pages() call to show only essential pages (chat, sessions, agents, usage, config)
- Update docstring to clarify difference from example 17 (all pages vs curated pages)
- Fix import ordering and remove unused imports per ruff
- Resolves curriculum duplication where 18 was identical to 17 but claimed different functionality
Fixes#57
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
* fix: default python app.py examples to 127.0.0.1 (fixes#66)
Bind loopback by default in 11 examples that call uvicorn or AIUIGateway
directly. HOST env var overrides for Docker/LAN demos.
Co-authored-by: Cursor <[email protected]>
* fix: make host variable consistent across all examples
Move HOST env var from global scope to local scope in main block
for consistency with other 10 examples.
Co-authored-by: Mervin Praison <[email protected]>
---------
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Cursor <[email protected]>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Mervin Praison <[email protected]>
- Updated `praisonaiagents` and `praisonai` versions in `pyproject.toml`.
- Added integration smoke tests to the CI workflow for better backend validation.
- Improved documentation on platform integration and SDK gaps.
- Enhanced the UI for issues and sessions with new toolbar components.
- Refactored backend integration checks and tool resolution logic for better maintainability.
Introduced documentation for a new feature allowing inline media rendering
of agent-generated images during chat. This update includes architecture
details, data flow paths, and examples for seamless integration with
existing backends. Updated related documentation to link to new feature.
- Added support for inline media (images, videos, files) in chat messages
- Updated `ChatArea`, `ChatMessages`, and `ToolCallDisplay` components to render media
- Introduced `ImagePreviewProvider` example demonstrating dynamic image rendering
- Enhanced documentation on provider media capabilities
- Updated integration and unit tests to cover new media functionality
- Implemented A2UI surfaces for agent-driven UI in chat/canvas.
- Enhanced documentation for architecture and agent UI features.
- Introduced new example demonstrating A2UI canvas integration.
- Updated various frontend components to support new features.
- Improved tests for A2UI and related functionalities.
Introduced Video Studio integration with PraisonAI Video engine.
Added documentation, example app, and multiple backend routes for project management, scene processing, and rendering.
Updated version in pyproject.toml for release.
This commit introduces comprehensive documentation for the Agent UI host, detailing the architecture, quick start guide, extension API, layout components, optional dashboard modules, and third-party plugin development. Additionally, it includes a minimal example of an external agent hosted on the PraisonAIUI dashboard shell.
Removes 41 direct mentions of a peer framework across 10 files
(src, docs, examples, tests). Comparison-style sections are
deleted rather than paraphrased; migration tables dropped.
Also fixes examples/02-chat-app template that had an invalid
'style: chainlit' value \u2014 replaced with 'style: chat'.
No behavioural changes. 673 unit tests still pass.
Closes 5 documented gaps from how-to-add-a-feature.md:
- aiui.set_custom_js(path) — inject client JS from Python (new /custom.js route, <script> after plugin-loader). Tests: 10/10
- name= kwarg on all 8 form inputs — stable submit-keys for form_action, avoids label collisions. Tests: 18/18
- Component schema registry — aiui.register_component_schema() + GET /api/components/schemas. Built-in schemas auto-derived from ui.py. Tests: 9/9
- /api/features parallelized via asyncio.gather (warm calls now instant)
- mkdocs build fixed for pygments 2.20 via docs_hooks.py
Other:
- form inputs now emit name + data-label attrs so form_action submit handler collects values correctly (bug fix)
- radio submit handler only stores the checked radio's value
- switch now has hidden checkbox mirror so form_action sees its state
- mkdocs --strict passes
- Example 28 uses the new APIs (no more DevTools console workaround)
- Bump aiui 0.3.107 -> 0.3.108; sync __version__.py
Tests: 542/545 pass (3 pre-existing test-isolation failures unrelated).
Added a new example demonstrating the Multica-inspired UI features in
PraisonAIUI. This includes a floating, resizable chat window, a
collapsible sidebar, custom branding options, and a multi-page dashboard
layout. Updated relevant files and the package version in `pyproject.toml`.
Introduced a new example for a dashboard chat using a dynamically
registered custom teal/cyan theme. Updated README to include
instructions for running the example and added necessary functions
for handling messages and starters. Updated version in pyproject.toml
and made minor adjustments in the server.py and dashboard.js for
theme support.
Introduced a new example app that implements a chat interface without the sidebar navigation, offering a cleaner dashboard experience. Updated the README to include this new example. Various changes in frontend components to support this functionality and maintain overall application structure.
This example showcases all design customization options available in PraisonAIUI, allowing users to tweak values and redesign their chat without any frontend code. It includes functionalities like branding, theme setting, custom CSS, layout modes, and custom pages.
docs(api/components): enhance API documentation and add new examples
Updated the components API reference to include 36 organized components.
Introduced essential component examples such as metric cards, progress bars,
alerts, and more for clarity and usage guidance.
```
feat(components): expand UI component showcase to 54 components
Enhanced the component showcase to demonstrate all 54 UI components,
added system info, new input types, pagination, and improved captions
for better user experience and detailed insights.
```
feat(examples): add new email bot and email channel examples
Added two new examples: an Email Bot demonstrating IMAP/SMTP
features and an Email Channel for using Email as an AIUI dashboard
channel. Updated README to include links to these new examples.
```
Introduced a new example application demonstrating the use of agents
(Researcher, Writer, Coder) and a custom Feature Explorer page
within the dashboard. Updated main app to include agent registration
and streamlined the app structure for improved usability.
- Changed `register_agent` and `unregister_agent` to use agent IDs instead of names for better tracking and management.
- Updated the `get_agent` method to reflect the use of agent IDs.
- Added defensive serialization in agent responses to ensure JSON safety.
- Enhanced websocket route for log streaming.
- Incremented version to 0.3.52 in `pyproject.toml`.
- Updated channel status to use a combination of bot status and task completion.
- Enhanced the guardrail registration process to support LLM-based guardrails.
- Updated project version to 0.3.45.
- Added comprehensive integration tests for new features and functionalities.
Expanded documentation on the agent registration API, detailing the new
method using the Protocol ABC. Added important notes on frontend
manifest requirements and common pitfalls to ensure proper
functionality. Updated related example integration scripts to
reflect these changes.
Added functionality for a gateway mode, allowing real agent execution
and WebSocket interaction. Updated usage instructions and introduced
multiple agent definitions for enhanced user experience. Improved
fallback to standalone mode for REST APIs only.
Introduced a new three-column layout in the demo application, showcasing
clickable feature and endpoint lists, a live request/response activity log,
and formatted JSON output. Updated version in pyproject.toml and modified
dashboard.js to include the new explorer view.
This example demonstrates the PrasionAIUI Gateway integration using the
AIUIGateway, featuring real agent execution, WebSocket streaming, a
full dashboard, and live agent interaction from the browser. It also
includes agent definitions and custom analytics page registration.
Updated the dashboard example to illustrate a protocol-first page registration system. Enhanced documentation for better understanding and added new features, including custom page registration via the API. Updates also include a version bump in `pyproject.toml` to 0.3.22 and various route improvements across multiple files.
Refactored the example dashboard application to demonstrate a settings-driven
interface showcasing all 16 features of PraisonAIUI. Reduced complexity by
removing hardcoded elements. Added custom page registrations for analytics
and metrics, while significantly improving code structure and maintainability.
Included a detailed API testing guide in `docs/api/testing.md`, providing
curl commands and descriptions for testing all 16 PraisonAIUI feature APIs.
This serves as a resource for developers to quickly understand and test
the available API endpoints. Also updated example usage in `examples/python/15-dashboard-test/app.py` and made minor adjustments in other files.
- Refactored navigation in `aiui.template.yaml` for improved
organization, adding an "API Reference" tab.
- Updated `features-api.md` with new endpoints and examples,
including enhanced approval management and session handling features.
- Improved clarity and consistency in API request/response examples.
- Enhanced the Real Agent Dashboard to support live metrics.
- Introduced real PraisonAI agents for enhanced interaction.
- Updated navigation and documentation to reflect the changes in examples.
Added detailed references for Python examples, outlining each example's unique concept and run instructions for better clarity and usability. Updated the examples README for improved navigation.
Removed outdated demo data functions in the full dashboard example and consolidated shared seed data usage. Updated the README to reflect changes in dashboards and documentation structure. Reduced overall lines of code by eliminating unnecessary files and code blocks.
- Vibrant teal (#0d9488) node backgrounds with white text for max contrast
- CSS force-override for node labels (color/fill #ffffff !important)
- Fixed faded h1 title by overriding gradient/opacity/-webkit-text-fill-color
- Dark container background (rgba 0f172a 0.5) for diagram framing
- mermaid.js & toc.js now track URL and only tear down on navigation
- Repeated notify calls skip if content already rendered
- Reduced staggered notify from 3 to 2 calls (300ms + 3s)
MervinPraison