PraisonAI 4.6.39__tar.gz → 4.6.41__tar.gz

{praisonai-4.6.39 → praisonai-4.6.41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PraisonAI
-Version: 4.6.39
+Version: 4.6.41
 Summary: PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.
 Author: Mervin Praison
 License: MIT
@@ -11,7 +11,7 @@ Description-Content-Type: text/markdown
 Requires-Dist: rich>=13.7
 Requires-Dist: markdown>=3.5
 Requires-Dist: pyparsing>=3.0.0
-Requires-Dist: praisonaiagents>=1.6.39
+Requires-Dist: praisonaiagents>=1.6.41
 Requires-Dist: python-dotenv>=0.19.0
 Requires-Dist: litellm<2,>=1.83.14
 Requires-Dist: PyYAML>=6.0

{praisonai-4.6.39 → praisonai-4.6.41}/PraisonAI.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PraisonAI
-Version: 4.6.39
+Version: 4.6.41
 Summary: PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.
 Author: Mervin Praison
 License: MIT
@@ -11,7 +11,7 @@ Description-Content-Type: text/markdown
 Requires-Dist: rich>=13.7
 Requires-Dist: markdown>=3.5
 Requires-Dist: pyparsing>=3.0.0
-Requires-Dist: praisonaiagents>=1.6.39
+Requires-Dist: praisonaiagents>=1.6.41
 Requires-Dist: python-dotenv>=0.19.0
 Requires-Dist: litellm<2,>=1.83.14
 Requires-Dist: PyYAML>=6.0

{praisonai-4.6.39 → praisonai-4.6.41}/PraisonAI.egg-info/SOURCES.txt

@@ -671,6 +671,7 @@ praisonai/sandbox/_compat.py
 praisonai/sandbox/_shell.py
 praisonai/sandbox/daytona.py
 praisonai/sandbox/docker.py
+praisonai/sandbox/e2b.py
 praisonai/sandbox/modal.py
 praisonai/sandbox/sandlock.py
 praisonai/sandbox/ssh.py

{praisonai-4.6.39 → praisonai-4.6.41}/PraisonAI.egg-info/requires.txt

@@ -1,7 +1,7 @@
 rich>=13.7
 markdown>=3.5
 pyparsing>=3.0.0
-praisonaiagents>=1.6.39
+praisonaiagents>=1.6.41
 python-dotenv>=0.19.0
 litellm<2,>=1.83.14
 PyYAML>=6.0

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/api/agent_invoke.py

@@ -29,14 +29,26 @@ logger = logging.getLogger(__name__)
 # Authentication
 import os
 CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')
+_CALL_AUTH_DISABLED = os.getenv('PRAISONAI_CALL_AUTH', '').lower() == 'disabled'
+
 
 async def verify_token(
     request: Request, 
     authorization: Optional[str] = Header(None)
 ) -> None:
     """Verify API token for authentication."""
-    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:
-        return  # No authentication if FastAPI unavailable or no token set
+    if not FASTAPI_AVAILABLE:
+        return
+    if _CALL_AUTH_DISABLED:
+        return
+    if not CALL_SERVER_TOKEN:
+        raise HTTPException(
+            status_code=503,
+            detail=(
+                "CALL_SERVER_TOKEN is not configured. Set CALL_SERVER_TOKEN or "
+                "PRAISONAI_CALL_AUTH=disabled to run without authentication."
+            ),
+        )
         
     token = None
     

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/cli/commands/port.py

@@ -73,48 +73,52 @@ def _get_process_using_port(port: int) -> Optional[Dict]:
         elif sys.platform == "win32":
             # Use netstat on Windows
             result = subprocess.run(
-                ["netstat", "-ano", "|", "findstr", f":{port}"],
+                ["netstat", "-ano"],
                 capture_output=True,
                 text=True,
-                shell=True,
-                timeout=5
+                timeout=10
             )
             
             if result.returncode != 0 or not result.stdout:
                 return None
             
-            # Parse netstat output
+            # Parse netstat output and filter by exact port
             lines = result.stdout.strip().split("\n")
             for line in lines:
-                if f":{port}" in line and "LISTENING" in line:
-                    parts = line.split()
-                    if len(parts) >= 5:
-                        pid = parts[-1]
-                        # Get process name from PID
-                        try:
-                            proc_result = subprocess.run(
-                                ["tasklist", "/FI", f"PID eq {pid}"],
-                                capture_output=True,
-                                text=True,
-                                timeout=5
-                            )
-                            name = "unknown"
-                            if proc_result.returncode == 0:
-                                proc_lines = proc_result.stdout.strip().split("\n")
-                                if len(proc_lines) >= 2:
-                                    name = proc_lines[1].split()[0]
-                            
-                            return {
-                                "name": name,
-                                "pid": pid,
-                                "user": "unknown",
-                                "type": "IPv4",
-                                "protocol": "TCP",
-                                "port": port,
-                                "raw": line
-                            }
-                        except Exception:
-                            pass
+                parts = line.split()
+                if len(parts) >= 5 and "LISTENING" in line:
+                    local_addr = parts[1]
+                    # Extract port from address, handle IPv6 format [::]:port and IPv4 format host:port
+                    port_match = re.search(r":(\d+)$", local_addr)
+                    if not port_match or int(port_match.group(1)) != port:
+                        continue
+                    
+                    pid = parts[-1]
+                    # Get process name from PID
+                    try:
+                        proc_result = subprocess.run(
+                            ["tasklist", "/FI", f"PID eq {pid}"],
+                            capture_output=True,
+                            text=True,
+                            timeout=5
+                        )
+                        name = "unknown"
+                        if proc_result.returncode == 0:
+                            proc_lines = proc_result.stdout.strip().split("\n")
+                            if len(proc_lines) >= 2:
+                                name = proc_lines[1].split()[0]
+                        
+                        return {
+                            "name": name,
+                            "pid": pid,
+                            "user": "unknown",
+                            "type": "IPv4",
+                            "protocol": "TCP",
+                            "port": port,
+                            "raw": line
+                        }
+                    except Exception:
+                        pass
     
     except subprocess.TimeoutExpired:
         pass
@@ -166,7 +170,6 @@ def _get_all_ports() -> List[Dict]:
                 ["netstat", "-ano"],
                 capture_output=True,
                 text=True,
-                shell=True,
                 timeout=10
             )
             

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/code/tools/write_file.py

@@ -58,9 +58,10 @@ def write_file(
         >>> if result['success']:
         ...     print(f"Wrote to {result['path']}")
     """
-    # Resolve path
-    if workspace and not os.path.isabs(path):
-        abs_path = os.path.abspath(os.path.join(workspace, path))
+    # Resolve path — default workspace is cwd so relative paths cannot escape
+    effective_workspace = workspace or os.getcwd()
+    if not os.path.isabs(path):
+        abs_path = os.path.abspath(os.path.join(effective_workspace, path))
     else:
         abs_path = os.path.abspath(path)
     
@@ -73,14 +74,12 @@ def write_file(
             'path': path,
         }
 
-    # Security check - ensure path is within workspace if specified
-    if workspace:
-        if not is_path_within_directory(abs_path, workspace):
-            return {
-                'success': False,
-                'error': f"Path '{path}' is outside the workspace",
-                'path': path,
-            }
+    if not is_path_within_directory(abs_path, effective_workspace):
+        return {
+            'success': False,
+            'error': f"Path '{path}' is outside the workspace",
+            'path': path,
+        }
     
     # Process content
     processed_content = content

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/deploy.py

@@ -57,7 +57,7 @@ class CloudDeployer:
             file.write("FROM python:3.11-slim\n")
             file.write("WORKDIR /app\n")
             file.write("COPY . .\n")
-            file.write("RUN pip install flask praisonai==4.6.39 gunicorn markdown\n")
+            file.write("RUN pip install flask praisonai==4.6.41 gunicorn markdown\n")
             file.write("EXPOSE 8080\n")
             file.write('CMD ["gunicorn", "-b", "0.0.0.0:8080", "api:app"]\n')
             
@@ -76,7 +76,8 @@ class CloudDeployer:
         with open("api.py", "w") as file:
             file.write("from flask import Flask\n")
             file.write("from praisonai import PraisonAI\n")
-            file.write("import markdown\n\n")
+            file.write("import markdown\n")
+            file.write("import bleach\n\n")
             file.write("app = Flask(__name__)\n\n")
             file.write("def basic():\n")
             file.write("    praisonai = PraisonAI(agent_file=\"agents.yaml\")\n")
@@ -84,8 +85,9 @@ class CloudDeployer:
             file.write("@app.route('/')\n")
             file.write("def home():\n")
             file.write("    output = basic()\n")
-            file.write("    html_output = markdown.markdown(output)\n")
-            file.write("    return f'<html><body>{html_output}</body></html>'\n\n")
+            file.write("    rendered = markdown.markdown(str(output))\n")
+            file.write("    safe_html = bleach.clean(rendered, tags=bleach.sanitizer.ALLOWED_TAGS, attributes=bleach.sanitizer.ALLOWED_ATTRIBUTES)\n")
+            file.write("    return f'<html><body>{safe_html}</body></html>'\n\n")
             file.write("if __name__ == \"__main__\":\n")
             file.write("    import os\n")
             file.write("    app.run(debug=os.environ.get('DEBUG', 'false').lower() == 'true')\n")

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/mcp_server/adapters/cli_tools.py

@@ -21,6 +21,31 @@ from ..registry import register_tool
 logger = logging.getLogger(__name__)
 
 
+def _resolve_cwd_yaml_path(file_path: str) -> "Path":
+    """Resolve a YAML path strictly inside the current working directory."""
+    from pathlib import Path
+
+    if not isinstance(file_path, str) or not file_path:
+        raise ValueError("file_path must be a non-empty string")
+    if (
+        "/" in file_path
+        or "\\" in file_path
+        or "\x00" in file_path
+        or file_path.startswith(".")
+        or file_path in ("..", ".")
+    ):
+        raise ValueError(f"invalid file_path: {file_path!r}")
+    if not file_path.endswith((".yaml", ".yml")):
+        raise ValueError("file_path must be a .yaml or .yml file")
+    base = Path.cwd().resolve()
+    candidate = (base / file_path).resolve()
+    try:
+        candidate.relative_to(base)
+    except ValueError as exc:
+        raise ValueError(f"invalid file_path: {file_path!r}") from exc
+    return candidate
+
+
 def register_cli_tools() -> None:
     """Register CLI-based MCP tools."""
     
@@ -44,7 +69,8 @@ def register_cli_tools() -> None:
         """Validate a workflow YAML file."""
         try:
             import yaml
-            with open(file_path, 'r') as f:
+            yaml_path = _resolve_cwd_yaml_path(file_path)
+            with open(yaml_path, 'r') as f:
                 config = yaml.safe_load(f)
             
             required = ["framework", "topic"]
@@ -64,9 +90,10 @@ def register_cli_tools() -> None:
     def workflow_show(file_path: str) -> str:
         """Show workflow configuration."""
         try:
-            with open(file_path, 'r') as f:
-                content = f.read()
-            return content
+            yaml_path = _resolve_cwd_yaml_path(file_path)
+            return yaml_path.read_text()
+        except ValueError as e:
+            return f"Error: {e}"
         except FileNotFoundError:
             return f"File not found: {file_path}"
         except Exception as e:
@@ -417,7 +444,8 @@ def register_cli_tools() -> None:
         """Validate deployment configuration."""
         try:
             import yaml
-            with open(config_path, 'r') as f:
+            yaml_path = _resolve_cwd_yaml_path(config_path)
+            with open(yaml_path, 'r') as f:
                 config = yaml.safe_load(f)
             
             required = ["name", "type"]

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/persistence/knowledge/clickhouse.py

@@ -8,7 +8,7 @@ Install: pip install clickhouse-connect
 import logging
 from typing import Any, Dict, List, Optional
 
-from .base import KnowledgeStore, KnowledgeDocument
+from .base import KnowledgeStore, KnowledgeDocument, validate_identifier
 
 logger = logging.getLogger(__name__)
 
@@ -40,6 +40,7 @@ class ClickHouseKnowledgeStore(KnowledgeStore):
                 "clickhouse-connect is required for ClickHouse support. "
                 "Install with: pip install clickhouse-connect"
             )
+        validate_identifier(database, "database")
         
         self._client = clickhouse_connect.get_client(
             host=host,
@@ -56,6 +57,8 @@ class ClickHouseKnowledgeStore(KnowledgeStore):
         logger.info(f"Connected to ClickHouse database: {database}")
     
     def _table_name(self, collection: str) -> str:
+        # Validate collection name to prevent SQL injection
+        validate_identifier(collection, "collection")
         return f"{self.database}.praison_vec_{collection}"
     
     def create_collection(
@@ -195,7 +198,8 @@ class ClickHouseKnowledgeStore(KnowledgeStore):
         """Get documents by IDs."""
         table = self._table_name(collection)
         
-        id_list = ", ".join([f"'{i}'" for i in ids])
+        # Escape single quotes to prevent SQL injection
+        id_list = ", ".join([f"'{i.replace(chr(39), chr(39)+chr(39))}'" for i in ids])
         result = self._client.query(f"""
             SELECT id, content, content_hash, created_at, embedding
             FROM {table} WHERE id IN ({id_list})
@@ -225,7 +229,8 @@ class ClickHouseKnowledgeStore(KnowledgeStore):
         table = self._table_name(collection)
         
         if ids:
-            id_list = ", ".join([f"'{i}'" for i in ids])
+            # Escape single quotes to prevent SQL injection
+            id_list = ", ".join([f"'{i.replace(chr(39), chr(39)+chr(39))}'" for i in ids])
             self._client.command(f"ALTER TABLE {table} DELETE WHERE id IN ({id_list})")
             return len(ids)
         return 0

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/persistence/knowledge/surrealdb_vector.py

@@ -8,7 +8,7 @@ Install: pip install surrealdb
 import logging
 from typing import Any, Dict, List, Optional
 
-from .base import KnowledgeStore, KnowledgeDocument
+from .base import KnowledgeStore, KnowledgeDocument, validate_identifier
 from ..._async_bridge import run_sync
 
 logger = logging.getLogger(__name__)
@@ -33,8 +33,8 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
         url: str = "ws://localhost:8000/rpc",
         namespace: str = "praisonai",
         database: str = "vectors",
-        username: str = "root",
-        password: str = "root",
+        username: str | None = None,
+        password: str | None = None,
         embedding_dim: int = 1536,
     ):
         """
@@ -44,10 +44,19 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
             url: SurrealDB WebSocket URL
             namespace: SurrealDB namespace
             database: SurrealDB database
-            username: Authentication username
-            password: Authentication password
+            username: Authentication username (required for security)
+            password: Authentication password (required for security)
             embedding_dim: Embedding dimension
+            
+        Raises:
+            ValueError: If username or password is None (default credentials not allowed)
         """
+        if username is None or password is None:
+            raise ValueError(
+                "SurrealDB username and password must be provided explicitly. "
+                "Default credentials are not allowed for security reasons."
+            )
+        
         self.url = url
         self.namespace = namespace
         self.database = database
@@ -96,12 +105,20 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
     ) -> None:
         """Create a collection (SurrealDB creates tables on insert)."""
         self._init_client()
+        
+        # Validate collection name to prevent SQL injection
+        validate_identifier(name, "collection name")
+        
         # SurrealDB creates tables automatically
         logger.info(f"Collection '{name}' will be created on first insert")
     
     def delete_collection(self, name: str) -> bool:
         """Delete a collection."""
         self._init_client()
+        
+        # Validate collection name to prevent SQL injection
+        validate_identifier(name, "collection name")
+        
         try:
             self._run_async(self._client.query(f"REMOVE TABLE {name}"))
             return True
@@ -112,6 +129,10 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
     def collection_exists(self, name: str) -> bool:
         """Check if collection exists."""
         self._init_client()
+        
+        # Validate collection name to prevent SQL injection
+        validate_identifier(name, "collection name")
+        
         try:
             result = self._run_async(self._client.query(f"INFO FOR TABLE {name}"))
             return bool(result)
@@ -139,6 +160,9 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
         """Insert documents."""
         self._init_client()
         
+        # Validate collection name to prevent SQL injection
+        validate_identifier(collection, "collection")
+        
         ids = []
         for doc in documents:
             record = {
@@ -167,6 +191,9 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
         """Upsert documents."""
         self._init_client()
         
+        # Validate collection name to prevent SQL injection
+        validate_identifier(collection, "collection")
+        
         ids = []
         for doc in documents:
             record = {
@@ -198,6 +225,9 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
         """Search for similar documents using vector search."""
         self._init_client()
         
+        # Validate collection name to prevent SQL injection
+        validate_identifier(collection, "collection")
+        
         # SurrealDB vector search query
         embedding_str = str(query_embedding)
         query = f"""
@@ -238,6 +268,9 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
         ids: List[str]
     ) -> List[KnowledgeDocument]:
         """Get documents by IDs."""
+        # Validate collection name to prevent SQL injection
+        validate_identifier(collection, "collection")
+
         self._init_client()
         
         documents = []
@@ -268,6 +301,9 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
         """Delete documents."""
         self._init_client()
         
+        # Validate collection name to prevent SQL injection
+        validate_identifier(collection, "collection")
+        
         count = 0
         if ids:
             for doc_id in ids:
@@ -289,6 +325,9 @@ class SurrealDBVectorKnowledgeStore(KnowledgeStore):
         """Count documents."""
         self._init_client()
         
+        # Validate collection name to prevent SQL injection
+        validate_identifier(collection, "collection")
+        
         try:
             result = self._run_async(
                 self._client.query(f"SELECT count() FROM {collection} GROUP ALL")

{praisonai-4.6.39 → praisonai-4.6.41}/praisonai/sandbox/__init__.py

@@ -13,6 +13,7 @@ if TYPE_CHECKING:
     from .ssh import SSHSandbox
     from .modal import ModalSandbox
     from .daytona import DaytonaSandbox
+    from .e2b import E2BSandbox
 
 def __getattr__(name: str):
     """Lazy loading of sandbox components."""
@@ -34,6 +35,9 @@ def __getattr__(name: str):
     if name == "DaytonaSandbox":
         from .daytona import DaytonaSandbox
         return DaytonaSandbox
+    if name == "E2BSandbox":
+        from .e2b import E2BSandbox
+        return E2BSandbox
     raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
 
 __all__ = [
@@ -42,5 +46,6 @@ __all__ = [
     "SandlockSandbox",
     "SSHSandbox",
     "ModalSandbox", 
-    "DaytonaSandbox"
+    "DaytonaSandbox",
+    "E2BSandbox",
 ]