PraisonAI 4.5.82__tar.gz → 4.5.85__tar.gz

{praisonai-4.5.82 → praisonai-4.5.85}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PraisonAI
-Version: 4.5.82
+Version: 4.5.85
 Summary: PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.
 Author: Mervin Praison
 License: MIT
@@ -11,9 +11,9 @@ Description-Content-Type: text/markdown
 Requires-Dist: rich>=13.7
 Requires-Dist: markdown>=3.5
 Requires-Dist: pyparsing>=3.0.0
-Requires-Dist: praisonaiagents>=1.5.82
+Requires-Dist: praisonaiagents>=1.5.85
 Requires-Dist: python-dotenv>=0.19.0
-Requires-Dist: litellm>=1.81.0
+Requires-Dist: litellm<=1.82.6,>=1.81.0
 Requires-Dist: PyYAML>=6.0
 Requires-Dist: mcp>=1.20.0
 Requires-Dist: typer>=0.9.0
@@ -195,7 +195,7 @@ PraisonAI 🦞 — Automate and solve complex challenges with AI agent teams tha
 > - 📦 **Installing?** → [Installation](#-installation)
 > - 🐍 **Python SDK?** → [Python Examples](#-using-python-code)
 > - 🎯 **CLI user?** → [CLI Quick Reference](#cli-quick-reference)
-> - 🤝 **Contributing?** → [Development](#-development)
+> - 🤝 **Contributing?** → [Contributing](#-contributing)
 
 ---
 

{praisonai-4.5.82 → praisonai-4.5.85}/PraisonAI.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PraisonAI
-Version: 4.5.82
+Version: 4.5.85
 Summary: PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.
 Author: Mervin Praison
 License: MIT
@@ -11,9 +11,9 @@ Description-Content-Type: text/markdown
 Requires-Dist: rich>=13.7
 Requires-Dist: markdown>=3.5
 Requires-Dist: pyparsing>=3.0.0
-Requires-Dist: praisonaiagents>=1.5.82
+Requires-Dist: praisonaiagents>=1.5.85
 Requires-Dist: python-dotenv>=0.19.0
-Requires-Dist: litellm>=1.81.0
+Requires-Dist: litellm<=1.82.6,>=1.81.0
 Requires-Dist: PyYAML>=6.0
 Requires-Dist: mcp>=1.20.0
 Requires-Dist: typer>=0.9.0
@@ -195,7 +195,7 @@ PraisonAI 🦞 — Automate and solve complex challenges with AI agent teams tha
 > - 📦 **Installing?** → [Installation](#-installation)
 > - 🐍 **Python SDK?** → [Python Examples](#-using-python-code)
 > - 🎯 **CLI user?** → [CLI Quick Reference](#cli-quick-reference)
-> - 🤝 **Contributing?** → [Development](#-development)
+> - 🤝 **Contributing?** → [Contributing](#-contributing)
 
 ---
 

{praisonai-4.5.82 → praisonai-4.5.85}/PraisonAI.egg-info/requires.txt

@@ -1,9 +1,9 @@
 rich>=13.7
 markdown>=3.5
 pyparsing>=3.0.0
-praisonaiagents>=1.5.82
+praisonaiagents>=1.5.85
 python-dotenv>=0.19.0
-litellm>=1.81.0
+litellm<=1.82.6,>=1.81.0
 PyYAML>=6.0
 mcp>=1.20.0
 typer>=0.9.0

{praisonai-4.5.82 → praisonai-4.5.85}/README.md

@@ -44,7 +44,7 @@ PraisonAI 🦞 — Automate and solve complex challenges with AI agent teams tha
 > - 📦 **Installing?** → [Installation](#-installation)
 > - 🐍 **Python SDK?** → [Python Examples](#-using-python-code)
 > - 🎯 **CLI user?** → [CLI Quick Reference](#cli-quick-reference)
-> - 🤝 **Contributing?** → [Development](#-development)
+> - 🤝 **Contributing?** → [Contributing](#-contributing)
 
 ---
 

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/cli/features/job_workflow.py

@@ -267,12 +267,24 @@ class JobWorkflowExecutor:
 
     def _exec_inline_python(self, code: str, step: Dict, flags: Dict) -> Dict:
         """Execute inline Python code in an isolated namespace."""
+        _safe_builtins = {
+            "True": True, "False": False, "None": None,
+            "int": int, "float": float, "str": str, "bool": bool,
+            "list": list, "dict": dict, "tuple": tuple, "set": set,
+            "len": len, "range": range, "enumerate": enumerate,
+            "zip": zip, "map": map, "filter": filter,
+            "sorted": sorted, "reversed": reversed,
+            "min": min, "max": max, "sum": sum, "abs": abs, "round": round,
+            "isinstance": isinstance, "type": type,
+            "print": print, "repr": repr,
+            "hasattr": hasattr, "getattr": getattr, "setattr": setattr,
+        }
         namespace = {
             "flags": flags,
             "vars": {k: self._resolve_var_value(v) for k, v in self._vars.items()},
             "env": os.environ.copy(),
             "cwd": self._cwd,
-            "__builtins__": __builtins__,
+            "__builtins__": _safe_builtins,
         }
         try:
             exec(code, namespace)

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/cli/main.py

@@ -67,6 +67,56 @@ import importlib
 # REMOVED: from praisonai.inbuilt_tools import * - causes ~3200ms crewai import
 # REMOVED: from praisonai.inc.config import generate_config - causes ~3500ms langchain import
 
+
+# Security: blocklist of environment variable keys that must not be set from
+# untrusted YAML config files. These keys can alter code-loading behaviour
+# (LD_PRELOAD, PYTHONPATH, …) or redirect subprocesses (PATH) and are
+# therefore a vector for arbitrary code execution (CWE-78).
+_BLOCKED_ENV_KEYS = frozenset({
+    # Dynamic linker injection
+    "LD_PRELOAD", "LD_LIBRARY_PATH", "LD_AUDIT",
+    "DYLD_INSERT_LIBRARIES", "DYLD_LIBRARY_PATH", "DYLD_FRAMEWORK_PATH",
+    "DYLD_FALLBACK_LIBRARY_PATH",
+    # Executable / module search paths
+    "PATH",
+    "PYTHONPATH", "PYTHONHOME", "PYTHONSTARTUP",
+    "NODE_PATH", "NODE_OPTIONS",
+    "RUBYLIB", "PERL5LIB", "PERL5OPT",
+    "CLASSPATH",
+    # Proxy / redirect (could exfiltrate traffic)
+    "HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY",
+    # Miscellaneous dangerous keys
+    "BASH_ENV", "ENV", "CDPATH",
+    "PROMPT_COMMAND",
+    "SHLVL",
+})
+
+# Pre-compute uppercase lookup set once at module load (avoids rebuilding per call)
+_BLOCKED_ENV_KEYS_UPPER = frozenset(k.upper() for k in _BLOCKED_ENV_KEYS)
+
+
+def _validate_env_key(key) -> None:
+    """Raise ``ValueError`` if *key* is a blocked environment variable name.
+
+    The check is case-insensitive so that ``ld_preload`` is caught as well as
+    ``LD_PRELOAD``.  Non-string keys (e.g. YAML integer or null keys) are
+    rejected with a clear validation error.
+    """
+    if not isinstance(key, str):
+        raise ValueError(
+            f"Environment variable key must be a string, got {type(key).__name__}: {key!r}"
+        )
+    if not key or "=" in key or "\x00" in key:
+        raise ValueError(
+            "Environment variable key must be a non-empty string without '=' or NUL characters."
+        )
+    if key.upper() in _BLOCKED_ENV_KEYS_UPPER:
+        raise ValueError(
+            f"Setting environment variable '{key}' is not allowed in schedule "
+            f"config files because it can be used to execute arbitrary code."
+        )
+
+
 # Lazy import helpers for inbuilt_tools and config
 def _get_inbuilt_tools():
     """Lazy import inbuilt_tools only when crewai/autogen features are used."""
@@ -444,21 +494,38 @@ class PraisonAI:
                     try:
                         with open(args.schedule_config, 'r') as f:
                             file_config = yaml.safe_load(f)
+                        if file_config is None:
+                            file_config = {}
+                        if not isinstance(file_config, dict):
+                            raise ValueError("Schedule config must be a YAML mapping")
                         
                         # Extract deployment config
                         deploy_config = file_config.get('deployment', {})
+                        if deploy_config is None:
+                            deploy_config = {}
+                        if not isinstance(deploy_config, dict):
+                            raise ValueError("'deployment' must be a mapping")
                         schedule_expr = schedule_expr or deploy_config.get('schedule')
                         provider = deploy_config.get('provider', provider)
                         config['max_retries'] = deploy_config.get('max_retries', config['max_retries'])
                         
                         # Apply environment variables if specified
                         env_vars = file_config.get('environment', {})
+                        if not isinstance(env_vars, dict):
+                            raise ValueError("'environment' must be a mapping of KEY: value pairs")
+                        # Validate all keys first (fail-closed) before mutating os.environ
+                        validated_env = {}
                         for key, value in env_vars.items():
-                            os.environ[key] = str(value)
+                            _validate_env_key(key)
+                            validated_env[key] = str(value)
+                        os.environ.update(validated_env)
                             
                     except FileNotFoundError:
                         print(f"Configuration file not found: {args.schedule_config}")
                         sys.exit(1)
+                    except ValueError as e:
+                        print(f"Invalid schedule configuration: {e}")
+                        sys.exit(1)
                     except yaml.YAMLError as e:
                         print(f"Error parsing configuration file: {e}")
                         sys.exit(1)

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/deploy.py

@@ -57,7 +57,7 @@ class CloudDeployer:
             file.write("FROM python:3.11-slim\n")
             file.write("WORKDIR /app\n")
             file.write("COPY . .\n")
-            file.write("RUN pip install flask praisonai==4.5.82 gunicorn markdown\n")
+            file.write("RUN pip install flask praisonai==4.5.85 gunicorn markdown\n")
             file.write("EXPOSE 8080\n")
             file.write('CMD ["gunicorn", "-b", "0.0.0.0:8080", "api:app"]\n')
             
@@ -87,7 +87,8 @@ class CloudDeployer:
             file.write("    html_output = markdown.markdown(output)\n")
             file.write("    return f'<html><body>{html_output}</body></html>'\n\n")
             file.write("if __name__ == \"__main__\":\n")
-            file.write("    app.run(debug=True)\n")
+            file.write("    import os\n")
+            file.write("    app.run(debug=os.environ.get('DEBUG', 'false').lower() == 'true')\n")
     
     def set_environment_variables(self):
         """Sets environment variables with fallback to .env values or defaults."""

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/recipe/serve.py

@@ -40,6 +40,7 @@ trace_exporter: none      # none, otlp, jaeger, zipkin
 ```
 """
 
+import hmac
 import json
 import os
 import time
@@ -332,7 +333,7 @@ def create_auth_middleware(auth_type: str, api_key: Optional[str] = None, jwt_se
                 # No key configured, allow request
                 return await call_next(request)
             
-            if provided_key != expected_key:
+            if not provided_key or not hmac.compare_digest(provided_key, expected_key):
                 return JSONResponse(
                     {"error": {"code": "unauthorized", "message": "Invalid or missing API key"}},
                     status_code=401

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/ui/agents.py

@@ -583,10 +583,12 @@ print(f"[DEBUG] tools_dict: {tools_dict}")
 with open(agent_file, 'r') as f:
     config = yaml.safe_load(f)
 
+import secrets
 AUTH_PASSWORD_ENABLED = os.getenv("AUTH_PASSWORD_ENABLED", "true").lower() == "true"
 CHAINLIT_AUTH_SECRET = os.getenv("CHAINLIT_AUTH_SECRET")
 if not CHAINLIT_AUTH_SECRET:
-    os.environ["CHAINLIT_AUTH_SECRET"] = "p8BPhQChpg@J>jBz$wGxqLX2V>yTVgP*7Ky9H$aV:axW~ANNX-7_T:o@lnyCBu^U"
+    os.environ["CHAINLIT_AUTH_SECRET"] = secrets.token_hex(32)
+    logger.warning("CHAINLIT_AUTH_SECRET not set; generated a random secret for this session.")
 
 username_env = os.getenv("CHAINLIT_USERNAME", "admin")
 password_env = os.getenv("CHAINLIT_PASSWORD", "admin")

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/ui/bot.py

@@ -25,9 +25,13 @@ logger = logging.getLogger(__name__)
 log_level = os.getenv("LOGLEVEL", "INFO").upper() or "INFO"
 logging.basicConfig(level=log_level, format="%(asctime)s - %(levelname)s - %(message)s")
 
+import secrets
+
 # Auth secret (required by Chainlit)
 if not os.getenv("CHAINLIT_AUTH_SECRET"):
-    os.environ["CHAINLIT_AUTH_SECRET"] = "p8BPhQChpg@J>jBz$wGxqLX2V>yTVgP*7Ky9H$aV:axW~ANNX-7_T:o@lnyCBu^U"
+    os.environ["CHAINLIT_AUTH_SECRET"] = secrets.token_hex(32)
+    logger.warning("CHAINLIT_AUTH_SECRET not set; generated a random secret for this session.")
+
 
 # ---------------------------------------------------------------------------
 # Lazy imports

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/ui/chat.py

@@ -194,10 +194,13 @@ def _ensure_env_loaded():
         _cached_modules['env_loaded'] = True
 
 # Auth secret setup (required early)
+import secrets
 CHAINLIT_AUTH_SECRET = os.getenv("CHAINLIT_AUTH_SECRET")
 if not CHAINLIT_AUTH_SECRET:
-    os.environ["CHAINLIT_AUTH_SECRET"] = "p8BPhQChpg@J>jBz$wGxqLX2V>yTVgP*7Ky9H$aV:axW~ANNX-7_T:o@lnyCBu^U"
-    CHAINLIT_AUTH_SECRET = os.getenv("CHAINLIT_AUTH_SECRET")
+    CHAINLIT_AUTH_SECRET = secrets.token_hex(32)
+    os.environ["CHAINLIT_AUTH_SECRET"] = CHAINLIT_AUTH_SECRET
+    logger.warning("CHAINLIT_AUTH_SECRET not set; generated a random secret for this session.")
+
 
 def save_setting(key: str, value: str):
     """Save a setting to the database"""

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/ui/code.py

@@ -193,10 +193,13 @@ def _ensure_env_loaded():
         _cached_modules['env_loaded'] = True
 
 # Auth secret setup (required early)
+import secrets
 CHAINLIT_AUTH_SECRET = os.getenv("CHAINLIT_AUTH_SECRET")
 if not CHAINLIT_AUTH_SECRET:
-    os.environ["CHAINLIT_AUTH_SECRET"] = "p8BPhQChpg@J>jBz$wGxqLX2V>yTVgP*7Ky9H$aV:axW~ANNX-7_T:o@lnyCBu^U"
-    CHAINLIT_AUTH_SECRET = os.getenv("CHAINLIT_AUTH_SECRET")
+    CHAINLIT_AUTH_SECRET = secrets.token_hex(32)
+    os.environ["CHAINLIT_AUTH_SECRET"] = CHAINLIT_AUTH_SECRET
+    logger.warning("CHAINLIT_AUTH_SECRET not set; generated a random secret for this session.")
+
 
 def save_setting(key: str, value: str):
     """Save a setting to the database"""

{praisonai-4.5.82 → praisonai-4.5.85}/praisonai/ui/realtime.py

@@ -36,11 +36,13 @@ logger.addHandler(console_handler)
 logger.setLevel(log_level)
 
 # Set up CHAINLIT_AUTH_SECRET
+import secrets
 CHAINLIT_AUTH_SECRET = os.getenv("CHAINLIT_AUTH_SECRET")
-
 if not CHAINLIT_AUTH_SECRET:
-    os.environ["CHAINLIT_AUTH_SECRET"] = "p8BPhQChpg@J>jBz$wGxqLX2V>yTVgP*7Ky9H$aV:axW~ANNX-7_T:o@lnyCBu^U"
-    CHAINLIT_AUTH_SECRET = os.getenv("CHAINLIT_AUTH_SECRET")
+    CHAINLIT_AUTH_SECRET = secrets.token_hex(32)
+    os.environ["CHAINLIT_AUTH_SECRET"] = CHAINLIT_AUTH_SECRET
+    logger.warning("CHAINLIT_AUTH_SECRET not set; generated a random secret for this session.")
+
 
 # Database path
 DB_PATH = os.path.expanduser("~/.praison/database.sqlite")

praisonai-4.5.85/praisonai/version.py

@@ -0,0 +1 @@
+__version__ = "4.5.85"

{praisonai-4.5.82 → praisonai-4.5.85}/pyproject.toml

@@ -12,9 +12,9 @@ dependencies = [
     "rich>=13.7",
     "markdown>=3.5",
     "pyparsing>=3.0.0",
-    "praisonaiagents>=1.5.82",
+    "praisonaiagents>=1.5.85",
     "python-dotenv>=0.19.0",
-    "litellm>=1.81.0",
+    "litellm>=1.81.0,<=1.82.6",
     "PyYAML>=6.0",
     "mcp>=1.20.0",
     "typer>=0.9.0",

praisonai-4.5.82/praisonai/version.py

@@ -1 +0,0 @@
-__version__ = "4.5.82"