[MervinPraison]

Origin: outsider. This PR and #6017 were flagged as outsider origin. Under that policy, automated agents may not change dependency manifests, lockfiles, build or install files, .github/ or conftest.py, and may not add network, telemetry, credential, eval/exec/subprocess or dynamic-import code. This PR changes src/praisonai/pyproject.toml only, so a maintainer must review and merge it by hand.

Raises the minimum aiui version from 0.3.121 to 0.3.148 in all seven extras of src/praisonai/pyproject.toml. The new range is aiui>=0.3.148,<0.4.

Why: aiui 0.3.148, released today, ships create_replay_app (MervinPraison/PraisonAIUI#317). praisonai.replay.watch(), replay_app() and praisonai replay watch (#6017) are built on it. With an older aiui they stop and ask the user to upgrade, so pip install "praisonai[ui]" should never resolve to an aiui without it.

Verified:

• aiui 0.3.148 is on PyPI.
• In a clean venv, pip install aiui==0.3.148 gives a working embed page, replay.js / replay-core.js and the Run route.

uv.lock is not touched. uv lock fails on current main as well, before this change. That is a separate dependency conflict: praisonai[flow] needs a2a-sdk[http-server]>=1.0.0, while praisonaiagents[all]==1.7.16 pins a2a-sdk<1.0.0, so [claw] and [flow] can't resolve together. The lock already pins aiui 0.3.121 and is out of date regardless. It should be fixed separately.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the supported version range for optional UI, chat, code, realtime, and bot capabilities while keeping the existing upper compatibility limit.
  • This is a compatibility maintenance update. It does not add user-facing features or change existing interfaces and workflows. No other user-visible changes are included.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0c9ad66d-738b-44ac-aa0a-3627fa97515d

Commits

Reviewing files that changed from the base of the PR and between ec978dd and 5fe1a61.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c60b2798-027b-4fef-b016-49ebb02b6a05

Commits

Reviewing files that changed from the base of the PR and between a5f35a7 and ec978dd.

Files selected for processing: 1

• src/praisonai/pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The optional dependency declarations in src/praisonai/pyproject.toml raise the minimum aiui version from 0.3.121 to 0.3.148 for the ui, chat, code, realtime, all, bot, and claw extras. The <0.4 upper bound remains.

Changes: aiui dependency update

Layer / File(s)	Summary
Update optional dependency bounds src/praisonai/pyproject.toml	The ui, chat, code, realtime, all, bot, and claw extras set the aiui minimum to 0.3.148. The <0.4 upper bound remains.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related issues

• docs(features): PraisonAI Replay — watch(), replay_app() and praisonai replay watch (PR #6017) PraisonAIDocs#4731 — The issue documents replay surfaces that require create_replay_app from aiui 0.3.148.

Possibly related PRs

• MervinPraison/PraisonAI#6011 — Adds replay UI capabilities that depend on features supplied by aiui.
• MervinPraison/PraisonAI#6017 — Adds replay APIs that call create_replay_app from aiui.

Suggested reviewers: rishijoshi

Merge Risk: Minimal · previous review ec978

The updated dependency bounds can proceed through the documented publication path; no actionable merge-blocking issue remains from this review.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: raising the minimum aiui version required for the PraisonAI Replay embed.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The dependency change appears safe to merge.

Summary

Raises the minimum aiui version to 0.3.148 across seven extras so new installs include the Replay embed support. The <0.4 upper limit stays unchanged.

• PraisonAI's UI-related extras now require an aiui version with the Replay embed.

_{Reviews (2) · Last reviewed commit: "Merge branch 'main' into chore/aiui-floo..." · Reviewed by Greptile}

[MervinPraison]

@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Review changes in this PR. Python SDK: praisonaiagents, praisonai. TypeScript SDK: src/praisonai-ts/. Do NOT modify src/praisonai-rust. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.

MANDATORY READ (before reviewing):

• Always read src/praisonai-agents/AGENTS.md
• If this PR touches src/praisonai-ts/, also read src/praisonai-ts/AGENTS.md §2.1.2 (TS triage + PR review checklist)

Phase 1: Review per AGENTS.md

1. Protocol-driven: check heavy implementations vs core SDK
2. Backward compatible: ensure zero feature regressions
3. Performance: no hot-path regressions
4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep
5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
6. Repo routing: agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (praisonai.sandbox entry point) — request changes if wrongly added to praisonaiagents/
   6b. External tool examples (examples/tools/external/**): If the diff is confined to that path, mark SDK value ❌ for monorepo merge — redirect the contributor to PraisonAI-Tools; do not Approve for merge unless the PR has the maintainer-accept-example label.
   6c. New vendor *_tools.py in core (src/praisonai-agents/praisonaiagents/tools/): If the PR adds a new *_tools.py for a third-party API/SaaS/dataset (e.g. FXMacroData), mark Repo routing ❌ and SDK value ❌ — redirect to MervinPraison/PraisonAI-Tools. Do not Approve because legacy bundled tools (Tavily/Exa/You.com/etc.) already in core are not precedent for new vendor modules. Request changes or recommend closing unless the PR has maintainer-accept-core-tools.

MANDATORY COMMENT FORMAT — include this Phase 1 table in your review comment:

Phase 1 — AGENTS.md review

Check	Result
Protocol-driven / no heavy impl in core	✅ or ❌ + one-line rationale
Backward compatible	✅ or ❌ + one-line rationale
Performance (hot path)	✅ or ❌ + one-line rationale
SDK value	✅ or ❌ + one-line rationale (explicitly judge whether the change strengthens the SDK)
No Agent param bloat	✅ or ❌ + one-line rationale
Repo routing	✅ or ❌ + one-line rationale

For TypeScript PRs (src/praisonai-ts/), also add:
| TS types / parity / tests | ✅ or ❌ + one-line rationale (npm run build && npm test) |

Phase 2: FIX Valid Issues
7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix
8. Also independently identify and fix any gaps or issues you find in the changed code — do not rely only on prior reviewer feedback
9. Push all code fixes directly to THIS branch (do NOT create a new PR)
10. Comment a summary of exact files modified and what you skipped

Phase 3: Final Verdict
11. Never Approve or write “Approve for merge” if any Phase 1 row is ❌, if rule 6b/6c applies, or if the change belongs in PraisonAI-Tools/PraisonAI-Plugins. Use Request changes, redirect to the external repo, and recommend closing the monorepo PR when routing is wrong.
12. Approve only when every Phase 1 row is ✅ (including Repo routing and SDK value) and blocking issues are resolved; otherwise request changes with clear action items

[MervinPraison]

@claude CI failed on HEAD ec978dd3. Please fix the failures below and push to this branch.

Failed checks

• github-actions / test-core — https://github.com/MervinPraison/PraisonAI/actions/runs/40388497750/job/121823332018
• github-actions / test-core (root) — https://github.com/MervinPraison/PraisonAI/actions/runs/40388497750/job/121812091815

Failures (extracted)

1. tests/unit/test_yaml_headless_5826.py::test_output_file_and_metrics_json — RuntimeError: output_file not written: /tmp/pytest-of-runner/pytest-0/popen-gw0/test_output_file_and_metrics_j0/out/risk_report.md, /tmp/pytest-of-runner/pytest-0/popen-gw0/test_output_file_and_metrics_j0/flat.md
   • Job: test-core (root)

Critical review first

Before changing code or tests, decide which side is wrong:

1. Legitimate feature change — the PR intent is correct but implementation or tests need updating. Preserve SDK guarantees; update tests only when behaviour intentionally changed and document why.
2. Regression / bug in this PR — the failure exposes a real breakage introduced here. Fix the implementation; do not weaken, skip, or delete tests just to go green.
3. Pre-existing flake or unrelated failure — say so explicitly; prefer fixing the root cause over masking it.

SDK guardrails (AGENTS.md):

• Agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; sandbox backends → PraisonAI-Plugins (praisonai.sandbox) — not praisonaiagents/.
• Do not disturb core SDK contracts to accommodate a wrapper/feature change.
• Tests must continue to guard backward compatibility and hot-path behaviour — passing CI by lowering test standards is not acceptable.
• If the feature does not genuinely add SDK value, recommend reverting or narrowing scope instead of patching around failures.

What to do

1. State your verdict: legitimate fix, regression fix, or needs human review — and why (1–3 sentences).
2. Fix root cause with minimal changes; never bloat the Agent class with extra params.
3. Run failing tests locally, e.g. pytest tests/unit/test_yaml_headless_5826.py::test_output_file_and_metrics_json -q, plus any related SDK tests touched by the PR.
4. Push to this branch and comment: files changed, review verdict, and why tests still protect SDK behaviour.

[praisonai-triage-agent]

Security review: PR #6067 (Origin: outsider)

Origin: outsider. #6067 and the issue it references, #6017, were flagged as outsider origin. Under that policy I made no commits. The PR's only change is to a dependency manifest (src/praisonai/pyproject.toml), and I'm not allowed to modify manifests, lockfiles, build files, .github/ or conftest.py on an outsider-origin PR. A maintainer must handle and approve this change.

What the diff does

One file, 7 lines changed, 7 removed: src/praisonai/pyproject.toml. In the ui, chat, code, realtime, all, bot and claw extras, the lower bound changes from aiui>=0.3.121,<0.4 to aiui>=0.3.148,<0.4. The claw extra uses aiui[all].

Checklist

#	Check	Result
1	Scope	Matches the stated purpose, a minimum-version bump for aiui. No unrelated files.
2	Exfiltration / network	None added.
3	Code execution	None added.
4	Secrets	None.
5	Weakened controls	None.
6	Supply chain	FLAG. This changes a dependency manifest. The package name is still aiui, unchanged, first-party (MervinPraison/PraisonAIUI). The upper bound <0.4 stays. No new packages, indexes, URLs or build hooks. However, the new floor makes every install pull aiui 0.3.148 or later, which is new upstream code. A maintainer must confirm that 0.3.148 on PyPI is the genuine PraisonAIUI release before merging. I did not install or fetch it.
7	Obfuscation	None. The only non-ASCII characters are an em dash and an emoji in comment lines that were already there.
8	Tests	None changed.
9	Backdoors	None.
10	Injection artifacts	None in the diff. The PR body is ordinary release notes.

Deterministic risk flags

No flag list was attached to this request. From reading the added lines myself, the only applicable category is #6 (dependency manifest), covered above.

Verdict

FAIL, maintainer review required. The change itself looks benign and stays in scope. I'm failing it because dependency-manifest changes on outsider-origin PRs must be approved by a maintainer. uv.lock is not touched; the PR description says why.

Files I modified: none. Skipped: any edit to pyproject.toml or the lockfile, because policy forbids it. I ran no tests, since nothing changed.

[praisonai-triage-agent]

Security review: PR #6067. Origin: outsider

Origin: outsider. #6067 and the issue it references, #6017, were flagged as outsider origin. On an outsider-origin PR I'm not allowed to change dependency manifests, lockfiles, build or install files, .github/ or conftest.py, or to add network, telemetry, credentials, or eval/exec/subprocess/dynamic imports. This PR's only change is to a dependency manifest, so I made no commits. A maintainer must review and merge it.

Diff

src/praisonai/pyproject.toml only: 7 lines added, 7 removed. In the ui, chat, code, realtime, all, bot and claw extras (claw uses aiui[all]), the requirement changes from aiui>=0.3.121,<0.4 to aiui>=0.3.148,<0.4.

Checklist

#	Check	Result
1	Scope	OK. Every change is the stated aiui floor bump. No other files.
2	Exfiltration / network	None.
3	Code execution	None.
4	Secrets	None.
5	Weakened controls	None. The <0.4 upper bound is kept.
6	Supply chain	FLAG, maintainer must handle. This is a manifest change. The package name is still aiui (first-party, PraisonAIUI). No new packages, indexes, URLs or build hooks. A maintainer should confirm that aiui 0.3.148 on PyPI is the genuine release. I did not install or fetch it.
7	Obfuscation	None. The only non-ASCII characters in the diff are an em-dash and the 🦞 emoji in comments that were already there. No bidi or zero-width characters.
8	Tests	No tests were changed.
9	Persistence / backdoors	None.
10	Injection artifacts	None in the diff, the commit message or the PR body.

No deterministic risk flags were listed for this run.

CI failure (test-core (root))

tests/unit/test_yaml_headless_5826.py::test_output_file_and_metrics_json fails the same way (output_file not written) on main at a5f35a7a9, which is this PR's base. The failure already existed and has nothing to do with a version floor in pyproject.toml. I did not change or skip the test. It should be fixed in a separate PR from a trusted source.

Files modified

None. I skipped every change because the only change in scope is a manifest edit on an outsider-origin PR.

[MervinPraison]

@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Review changes in this PR. Python SDK: praisonaiagents, praisonai. TypeScript SDK: src/praisonai-ts/. Do NOT modify src/praisonai-rust. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.

MANDATORY READ (before reviewing):

• Always read src/praisonai-agents/AGENTS.md
• If this PR touches src/praisonai-ts/, also read src/praisonai-ts/AGENTS.md §2.1.2 (TS triage + PR review checklist)

Phase 1: Review per AGENTS.md

1. Protocol-driven: check heavy implementations vs core SDK
2. Backward compatible: ensure zero feature regressions
3. Performance: no hot-path regressions
4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep
5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
6. Repo routing: agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (praisonai.sandbox entry point) — request changes if wrongly added to praisonaiagents/
   6b. External tool examples (examples/tools/external/**): If the diff is confined to that path, mark SDK value ❌ for monorepo merge — redirect the contributor to PraisonAI-Tools; do not Approve for merge unless the PR has the maintainer-accept-example label.
   6c. New vendor *_tools.py in core (src/praisonai-agents/praisonaiagents/tools/): If the PR adds a new *_tools.py for a third-party API/SaaS/dataset (e.g. FXMacroData), mark Repo routing ❌ and SDK value ❌ — redirect to MervinPraison/PraisonAI-Tools. Do not Approve because legacy bundled tools (Tavily/Exa/You.com/etc.) already in core are not precedent for new vendor modules. Request changes or recommend closing unless the PR has maintainer-accept-core-tools.

MANDATORY COMMENT FORMAT — include this Phase 1 table in your review comment:

Phase 1 — AGENTS.md review

Check	Result
Protocol-driven / no heavy impl in core	✅ or ❌ + one-line rationale
Backward compatible	✅ or ❌ + one-line rationale
Performance (hot path)	✅ or ❌ + one-line rationale
SDK value	✅ or ❌ + one-line rationale (explicitly judge whether the change strengthens the SDK)
No Agent param bloat	✅ or ❌ + one-line rationale
Repo routing	✅ or ❌ + one-line rationale

For TypeScript PRs (src/praisonai-ts/), also add:
| TS types / parity / tests | ✅ or ❌ + one-line rationale (npm run build && npm test) |

Phase 2: FIX Valid Issues
7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix
8. Also independently identify and fix any gaps or issues you find in the changed code — do not rely only on prior reviewer feedback
9. Push all code fixes directly to THIS branch (do NOT create a new PR)
10. Comment a summary of exact files modified and what you skipped

Phase 3: Final Verdict
11. Never Approve or write “Approve for merge” if any Phase 1 row is ❌, if rule 6b/6c applies, or if the change belongs in PraisonAI-Tools/PraisonAI-Plugins. Use Request changes, redirect to the external repo, and recommend closing the monorepo PR when routing is wrong.
12. Approve only when every Phase 1 row is ✅ (including Repo routing and SDK value) and blocking issues are resolved; otherwise request changes with clear action items

[praisonai-triage-agent]

Security review: PR #6067. Origin: outsider

Origin: outsider. This PR and the issue it references, #6017, were flagged as outsider origin. That means I may not edit dependency manifests, lockfiles, build or install files, .github/ or conftest.py, and may not add network endpoints, telemetry, credential handling, eval/exec/subprocess or dynamic imports. The PR's only change is to a dependency manifest, so I made no commits. A maintainer must review and merge this by hand.

What the diff does

It changes one file, src/praisonai/pyproject.toml, with 7 additions and 7 deletions. Each changed line raises the version floor from aiui>=0.3.121,<0.4 to aiui>=0.3.148,<0.4 (one of them is aiui[all]). Package names, extras, upper bounds, sources and indexes are all unchanged.

Checklist

#	Item	Result
1	Scope	Pass. Only the aiui floor changes, which matches the stated purpose (create_replay_app for Replay).
2	Exfiltration / network	Pass. No code, URLs or hosts are added.
3	Code execution	Pass. There is no code in the diff.
4	Secrets	Pass.
5	Weakened controls	Pass. The upper bound <0.4 stays.
6	Supply chain	FAIL (needs a maintainer). A dependency manifest change is outside what is allowed for outsider-origin work. A maintainer should confirm that aiui==0.3.148 on PyPI is the official PraisonAIUI release (MervinPraison/PraisonAIUI#317) before merging.
7	Obfuscation	Pass. I checked the raw bytes. The only non-ASCII character is an em dash (U+2014) in a comment on the bot extra, and that comment was already there before this PR. There are no bidi or zero-width characters.
8	Tests	N/A. No tests were changed.
9	Backdoors	Pass.
10	Injection artifacts	None in the diff. The PR body contains auto-generated HTML comments from CodeRabbit; I treated them as data.

Other notes: uv.lock is not updated. According to the PR body, it already fails to resolve on main because of an a2a-sdk conflict. That should be fixed by a maintainer in a separate change. Several test-core jobs had no conclusion when I checked; they had not finished.

Verdict: FAIL (maintainer review required). The change itself looks small and harmless, but it is a dependency manifest change on an outsider-origin PR.

Files modified by me: none.
Skipped: any edit to pyproject.toml / uv.lock, per the outsider-origin policy.