PraisonAI has an Arbitrary File Write in Python API

@@ -181,12 +181,15 @@ jobs:
 
       - name: Fetch PR branch and Setup Remote
         if: github.event.issue.pull_request
+        env:
+          PR_BRANCH: ${{ steps.check_fork.outputs.pr_branch }}
+          IS_FORK: ${{ steps.check_fork.outputs.is_fork }}
         run: |
           # Fetch PR head from base repo and put it into local branch
-          git fetch origin pull/${{ github.event.issue.number }}/head:${{ steps.check_fork.outputs.pr_branch }}
+          git fetch origin pull/${{ github.event.issue.number }}/head:"${PR_BRANCH}"
           
           # If it's a fork, make origin point to local to trick claude-code-action's `git fetch origin <branch>`
-          if [ "${{ steps.check_fork.outputs.is_fork }}" == "true" ]; then
+          if [ "${IS_FORK}" = "true" ]; then
             git remote set-url origin file://$(pwd)
           fi
 

@@ -268,6 +268,11 @@ def _process_rule_mention(self, rule_name: str) -> Optional[str]:
     def _process_url_mention(self, url: str) -> Optional[str]:
         """Process @url:https://... mention."""
         try:
+            from praisonaiagents.tools.spider_tools import SpiderTools
+
+            if not SpiderTools()._validate_url(url):
+                return f"# URL: {url}\n[Blocked: URL is not allowed]"
+
             import urllib.request
             
             req = urllib.request.Request(

@@ -36,6 +36,30 @@ def _safe_getattr(obj, name, *default):
     return getattr(obj, name, *default) if default else getattr(obj, name)
 
 
+_SANDBOX_BLOCKED_ATTRS = frozenset({
+    '__subclasses__', '__bases__', '__mro__', '__globals__',
+    '__code__', '__class__', '__dict__', '__builtins__',
+    '__import__', '__loader__', '__spec__', '__init_subclass__',
+    '__set_name__', '__reduce__', '__reduce_ex__',
+    '__traceback__', '__qualname__', '__module__',
+    '__wrapped__', '__closure__', '__annotations__',
+    '__self__',  # C builtins leak real builtins module (GHSA-4mr5-g6f9-cfrh)
+    # Frame/code object introspection
+    'gi_frame', 'gi_code', 'cr_frame', 'cr_code',
+    'ag_frame', 'ag_code', 'tb_frame', 'tb_next',
+    'f_globals', 'f_locals', 'f_builtins', 'f_code',
+    'co_consts', 'co_names',
+    '__getattribute__', '__getattr__', '__setattr__', '__delattr__',
+    '__dir__', '__get__', '__set__', '__delete__',
+})
+
+_SANDBOX_BLOCKED_CALLS = frozenset({
+    'exec', 'eval', 'compile', '__import__',
+    'open', 'input', 'breakpoint',
+    'setattr', 'delattr', 'dir', 'vars',
+})
+
+
 def _validate_code_ast(code: str):
     """Validate code using AST — catches attacks that bypass text checks.
 
@@ -48,52 +72,33 @@ def _validate_code_ast(code: str):
     except SyntaxError:
         return None  # let compile() handle syntax errors later
 
-    # Dangerous dunder attributes attackers use for sandbox escape
-    _blocked_attrs = frozenset({
-        '__subclasses__', '__bases__', '__mro__', '__globals__',
-        '__code__', '__class__', '__dict__', '__builtins__',
-        '__import__', '__loader__', '__spec__', '__init_subclass__',
-        '__set_name__', '__reduce__', '__reduce_ex__',
-        '__traceback__', '__qualname__', '__module__',
-        '__wrapped__', '__closure__', '__annotations__',
-        # Frame/code object introspection
-        'gi_frame', 'gi_code', 'cr_frame', 'cr_code',
-        'ag_frame', 'ag_code', 'tb_frame', 'tb_next',
-        'f_globals', 'f_locals', 'f_builtins', 'f_code',
-        'co_consts', 'co_names',
-        '__getattribute__', '__getattr__', '__setattr__', '__delattr__',
-        '__dir__', '__get__', '__set__', '__delete__',
-    })
-
     for node in ast.walk(tree):
         # Block import statements
         if isinstance(node, (ast.Import, ast.ImportFrom)):
             return f"Import statements are not allowed"
 
         # Block attribute access to dangerous dunders
         if isinstance(node, ast.Attribute):
-            if node.attr in _blocked_attrs:
+            if node.attr in _SANDBOX_BLOCKED_ATTRS:
                 return (
                     f"Access to attribute '{node.attr}' is restricted"
                 )
 
-        # Block calls to dangerous builtins by name
+        # Block calls to dangerous builtins (bare name or attribute access)
         if isinstance(node, ast.Call):
             func = node.func
-            if isinstance(func, ast.Name) and func.id in (
-                'exec', 'eval', 'compile', '__import__',
-                'open', 'input', 'breakpoint',
-                'setattr', 'delattr', 'dir',
-            ):
+            if isinstance(func, ast.Name) and func.id in _SANDBOX_BLOCKED_CALLS:
                 return f"Call to '{func.id}' is not allowed"
+            if isinstance(func, ast.Attribute) and func.attr in _SANDBOX_BLOCKED_CALLS:
+                return f"Call to '{func.attr}' is not allowed"
                 
         # Block dangerous constants (strings containing dunders)
         # Fallback for Python 3.7 ast.Str
         if isinstance(node, ast.Constant) and isinstance(node.value, str):
-            if any(attr in node.value for attr in _blocked_attrs):
+            if any(attr in node.value for attr in _SANDBOX_BLOCKED_ATTRS):
                 return f"String constant contains restricted attribute name"
         elif type(node).__name__ == 'Str':
-            if any(attr in getattr(node, 's', '') for attr in _blocked_attrs):
+            if any(attr in getattr(node, 's', '') for attr in _SANDBOX_BLOCKED_ATTRS):
                 return f"String constant contains restricted attribute name"
 
     return None
@@ -112,7 +117,16 @@ def _execute_code_sandboxed(
     """
     if limits is None:
         limits = ResourceLimits.minimal()
-    
+
+    ast_error = _validate_code_ast(code)
+    if ast_error:
+        return {
+            'result': None,
+            'stdout': '',
+            'stderr': f'Security Error: {ast_error}',
+            'success': False,
+        }
+
     try:
         # Create temporary file for the code
         with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
@@ -151,21 +165,8 @@ def safe_execute():
             }}
         
         # Block dangerous patterns
-        blocked_attrs = {{
-            '__subclasses__', '__bases__', '__mro__', '__globals__',
-            '__code__', '__class__', '__dict__', '__builtins__',
-            '__import__', '__loader__', '__spec__', '__init_subclass__',
-            '__set_name__', '__reduce__', '__reduce_ex__',
-            '__traceback__', '__qualname__', '__module__',
-            '__wrapped__', '__closure__', '__annotations__',
-            # Frame/code object introspection
-            'gi_frame', 'gi_code', 'cr_frame', 'cr_code',
-            'ag_frame', 'ag_code', 'tb_frame', 'tb_next',
-            'f_globals', 'f_locals', 'f_builtins', 'f_code',
-            'co_consts', 'co_names',
-            '__getattribute__', '__getattr__', '__setattr__', '__delattr__',
-            '__dir__', '__get__', '__set__', '__delete__',
-        }}
+        blocked_attrs = {set(_SANDBOX_BLOCKED_ATTRS)!r}
+        blocked_calls = {set(_SANDBOX_BLOCKED_CALLS)!r}
         
         for node in ast.walk(tree):
             if isinstance(node, (ast.Import, ast.ImportFrom)):
@@ -182,14 +183,20 @@ def safe_execute():
                     "stderr": f"Access to attribute '{{node.attr}}' is restricted",
                     "success": False
                 }}
-            if isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
-                if node.func.id in ('exec', 'eval', 'compile', '__import__',
-                                     'open', 'input', 'breakpoint',
-                                     'setattr', 'delattr', 'dir'):
+            if isinstance(node, ast.Call):
+                func = node.func
+                if isinstance(func, ast.Name) and func.id in blocked_calls:
+                    return {{
+                        "result": None,
+                        "stdout": "",
+                        "stderr": f"Call to '{{func.id}}' is not allowed",
+                        "success": False
+                    }}
+                if isinstance(func, ast.Attribute) and func.attr in blocked_calls:
                     return {{
                         "result": None,
                         "stdout": "",
-                        "stderr": f"Call to '{{node.func.id}}' is not allowed",
+                        "stderr": f"Call to '{{func.attr}}' is not allowed",
                         "success": False
                     }}
             if isinstance(node, ast.Constant) and isinstance(node.value, str):
@@ -481,7 +488,7 @@ def _execute_code_direct(
             '__import__', 'import ', 'from ', 'exec', 'eval',
             'compile', 'open(', 'file(', 'input(', 'raw_input',
             '__subclasses__', '__bases__', '__globals__', '__code__',
-            '__class__', 'globals(', 'locals(', 'vars('
+            '__class__', '__self__', 'globals(', 'locals(', 'vars('
         ]
 
         code_lower = code.lower()

@@ -11,6 +11,8 @@
 """
 
 import logging
+import ipaddress
+import socket
 from typing import List, Dict, Union, Optional, Any
 from importlib import util
 import json
@@ -20,6 +22,48 @@
 import hashlib
 import time
 
+
+def _host_is_blocked(hostname: str) -> bool:
+    """Return True when hostname resolves to loopback/private/internal targets."""
+    if not hostname:
+        return True
+    host = hostname.lower().rstrip(".")
+    if host in ("localhost", "0.0.0.0", "::1") or host.endswith(".localhost"):
+        return True
+    if host in ("169.254.169.254", "metadata.google.internal"):
+        return True
+    if any(host.endswith(suffix) for suffix in (".local", ".internal", ".localdomain")):
+        return True
+
+    def _ip_blocked(ip: ipaddress._BaseAddress) -> bool:
+        return bool(
+            ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local
+        )
+
+    if host.isdigit():
+        try:
+            return _ip_blocked(ipaddress.ip_address(int(host)))
+        except (ValueError, OverflowError):
+            return True
+
+    if host.startswith("0x"):
+        try:
+            return _ip_blocked(ipaddress.ip_address(int(host, 16)))
+        except (ValueError, OverflowError):
+            return True
+
+    try:
+        return _ip_blocked(ipaddress.ip_address(host))
+    except ValueError:
+        pass
+
+    try:
+        return _ip_blocked(ipaddress.ip_address(socket.inet_aton(host)))
+    except OSError:
+        pass
+
+    return False
+
 class SpiderTools:
     """Tools for web scraping and crawling."""
     
@@ -59,31 +103,9 @@ def _validate_url(self, url: str) -> bool:
             if not parsed.hostname:
                 return False
             
-            # Reject local/internal addresses
-            hostname = parsed.hostname.lower()
-            
-            # Block localhost and loopback
-            if hostname in ['localhost', '127.0.0.1', '0.0.0.0', '::1']:
-                return False
-            
-            # Block private IP ranges
-            import ipaddress
-            try:
-                ip = ipaddress.ip_address(hostname)
-                if ip.is_private or ip.is_reserved or ip.is_loopback or ip.is_link_local:
-                    return False
-            except ValueError:
-                # Not an IP address, continue with domain validation
-                pass
-            
-            # Block common internal domains
-            if any(hostname.endswith(domain) for domain in ['.local', '.internal', '.localdomain']):
-                return False
-            
-            # Block metadata service endpoints
-            if hostname in ['169.254.169.254', 'metadata.google.internal']:
+            if _host_is_blocked(parsed.hostname):
                 return False
-            
+
             return True
             
         except Exception:

@@ -0,0 +1,10 @@
+"""@url mentions must not fetch loopback targets."""
+
+from praisonaiagents.tools.mentions import MentionsParser
+
+
+def test_url_mention_blocks_loopback():
+    parser = MentionsParser()
+    result = parser._process_url_mention("http://127.0.0.1:8765/")
+    assert result is not None
+    assert "Blocked" in result

@@ -112,6 +112,22 @@ def test_dunder_import_blocked(self, sandbox):
         result = sandbox.run("__import__('os')")
         assert result["success"] is False
 
+    def test_print_self_blocked(self, sandbox):
+        """print.__self__ leaks real builtins module (GHSA-4mr5-g6f9-cfrh)."""
+        result = sandbox.run("b = print.__self__")
+        assert result["success"] is False
+        assert "restricted" in result["stderr"].lower()
+
+    def test_vars_call_blocked(self, sandbox):
+        """vars() can expose builtins.__dict__ after __self__ leak."""
+        result = sandbox.run("vars({})")
+        assert result["success"] is False
+
+    def test_attribute_dunder_call_blocked(self, sandbox):
+        """Attribute calls bypass bare-name Call checks."""
+        result = sandbox.run("(1).__class__.__mro__")
+        assert result["success"] is False
+
 
 # ── Legitimate Code (all must PASS) ─────────────────────────────────────────
 

@@ -38,6 +38,16 @@ def test_still_blocks_loopback():
     assert spider._validate_url("http://localhost/") is False
 
 
+def test_blocks_alternate_loopback_encodings():
+    """GHSA-5c6w-wwfq-7qqm: non-canonical loopback host forms."""
+    spider = SpiderTools()
+    assert spider._validate_url("http://localhost.:8765/") is False
+    assert spider._validate_url("http://127.1:8765/") is False
+    assert spider._validate_url("http://0177.0.0.1:8765/") is False
+    assert spider._validate_url("http://0x7f000001:8765/") is False
+    assert spider._validate_url("http://2130706433:8765/") is False
+
+
 def test_rejects_non_string_input():
     spider = SpiderTools()
     assert spider._validate_url(None) is False  # type: ignore[arg-type]

@@ -71,3 +71,39 @@ async def require_workspace_member(
         )
     user.workspace_id = workspace_id
     return user
+
+
+async def require_workspace_admin(
+    workspace_id: str,
+    user: AuthIdentity = Depends(get_current_user),
+    session: AsyncSession = Depends(get_db),
+) -> AuthIdentity:
+    """Require admin or owner role in the workspace."""
+    return await require_workspace_member(
+        workspace_id, user, session, min_role="admin"
+    )
+
+
+async def require_workspace_owner(
+    workspace_id: str,
+    user: AuthIdentity = Depends(get_current_user),
+    session: AsyncSession = Depends(get_db),
+) -> AuthIdentity:
+    """Require owner role in the workspace."""
+    return await require_workspace_member(
+        workspace_id, user, session, min_role="owner"
+    )
+
+
+def ensure_resource_in_workspace(
+    resource_workspace_id: str | None,
+    workspace_id: str,
+    *,
+    label: str = "Resource",
+) -> None:
+    """Reject cross-workspace access (IDOR) with a generic 404."""
+    if resource_workspace_id != workspace_id:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"{label} not found",
+        )

@@ -9,7 +9,7 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import get_db, require_workspace_member
+from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
 from ..schemas import AgentCreate, AgentResponse, AgentUpdate
 from ...services.agent_service import AgentService
 
@@ -61,6 +61,7 @@ async def get_agent(
     agent = await svc.get(agent_id)
     if agent is None:
         raise HTTPException(status_code=404, detail="Agent not found")
+    ensure_resource_in_workspace(agent.workspace_id, workspace_id, label="Agent")
     return AgentResponse.model_validate(agent)
 
 
@@ -84,6 +85,7 @@ async def update_agent(
     )
     if agent is None:
         raise HTTPException(status_code=404, detail="Agent not found")
+    ensure_resource_in_workspace(agent.workspace_id, workspace_id, label="Agent")
     return AgentResponse.model_validate(agent)
 
 
@@ -95,6 +97,10 @@ async def delete_agent(
     session: AsyncSession = Depends(get_db),
 ):
     svc = AgentService(session)
+    agent = await svc.get(agent_id)
+    if agent is None:
+        raise HTTPException(status_code=404, detail="Agent not found")
+    ensure_resource_in_workspace(agent.workspace_id, workspace_id, label="Agent")
     deleted = await svc.delete(agent_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Agent not found")

@@ -9,7 +9,7 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import get_db, require_workspace_member
+from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
 from ..schemas import (
     CommentCreate,
     CommentResponse,
@@ -90,6 +90,7 @@ async def get_issue(
     issue = await svc.get(issue_id)
     if issue is None:
         raise HTTPException(status_code=404, detail="Issue not found")
+    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
     return IssueResponse.model_validate(issue)
 
 
@@ -114,6 +115,7 @@ async def update_issue(
     )
     if issue is None:
         raise HTTPException(status_code=404, detail="Issue not found")
+    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
     act_svc = ActivityService(session)
     await act_svc.log(
         workspace_id, "issue.updated", "issue", issue.id,
@@ -132,6 +134,10 @@ async def delete_issue(
     session: AsyncSession = Depends(get_db),
 ):
     svc = IssueService(session)
+    issue = await svc.get(issue_id)
+    if issue is None:
+        raise HTTPException(status_code=404, detail="Issue not found")
+    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
     deleted = await svc.delete(issue_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Issue not found")
@@ -148,6 +154,11 @@ async def add_comment(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    issue_svc = IssueService(session)
+    issue = await issue_svc.get(issue_id)
+    if issue is None:
+        raise HTTPException(status_code=404, detail="Issue not found")
+    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
     svc = CommentService(session)
     comment = await svc.create(
         issue_id=issue_id,
@@ -166,6 +177,11 @@ async def list_comments(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    issue_svc = IssueService(session)
+    issue = await issue_svc.get(issue_id)
+    if issue is None:
+        raise HTTPException(status_code=404, detail="Issue not found")
+    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
     svc = CommentService(session)
     comments = await svc.list_for_issue(issue_id)
     return [CommentResponse.model_validate(c) for c in comments]

@@ -9,7 +9,13 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import get_current_user, get_db, require_workspace_member
+from ..deps import (
+    get_current_user,
+    get_db,
+    require_workspace_admin,
+    require_workspace_member,
+    require_workspace_owner,
+)
 from ..schemas import (
     MemberAdd,
     MemberResponse,
@@ -64,7 +70,7 @@ async def get_workspace(
 async def update_workspace(
     workspace_id: str,
     body: WorkspaceUpdate,
-    user: AuthIdentity = Depends(require_workspace_member),
+    user: AuthIdentity = Depends(require_workspace_admin),
     session: AsyncSession = Depends(get_db),
 ):
     ws_svc = WorkspaceService(session)
@@ -77,7 +83,7 @@ async def update_workspace(
 @router.delete("/{workspace_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_workspace(
     workspace_id: str,
-    user: AuthIdentity = Depends(require_workspace_member),
+    user: AuthIdentity = Depends(require_workspace_owner),
     session: AsyncSession = Depends(get_db),
 ):
     ws_svc = WorkspaceService(session)
@@ -93,10 +99,16 @@ async def delete_workspace(
 async def add_member(
     workspace_id: str,
     body: MemberAdd,
-    user: AuthIdentity = Depends(require_workspace_member),
+    user: AuthIdentity = Depends(require_workspace_admin),
     session: AsyncSession = Depends(get_db),
 ):
     member_svc = MemberService(session)
+    if body.role == "owner":
+        if not await member_svc.has_role(workspace_id, user.id, "owner"):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Only owners can add another owner",
+            )
     member = await member_svc.add(workspace_id, body.user_id, body.role)
     return MemberResponse.model_validate(member)
 
@@ -117,10 +129,32 @@ async def update_member_role(
     workspace_id: str,
     user_id: str,
     body: MemberUpdate,
-    user: AuthIdentity = Depends(require_workspace_member),
+    user: AuthIdentity = Depends(require_workspace_admin),
     session: AsyncSession = Depends(get_db),
 ):
     member_svc = MemberService(session)
+    target = await member_svc.get(workspace_id, user_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="Member not found")
+    if user_id == user.id and body.role != target.role:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Cannot change your own role",
+        )
+    if body.role == "owner" and not await member_svc.has_role(
+        workspace_id, user.id, "owner"
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only owners can assign the owner role",
+        )
+    if target.role == "owner" and not await member_svc.has_role(
+        workspace_id, user.id, "owner"
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only owners can change an owner's role",
+        )
     member = await member_svc.update_role(workspace_id, user_id, body.role)
     if member is None:
         raise HTTPException(status_code=404, detail="Member not found")
@@ -131,10 +165,25 @@ async def update_member_role(
 async def remove_member(
     workspace_id: str,
     user_id: str,
-    user: AuthIdentity = Depends(require_workspace_member),
+    user: AuthIdentity = Depends(require_workspace_admin),
     session: AsyncSession = Depends(get_db),
 ):
     member_svc = MemberService(session)
+    if user_id == user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Cannot remove yourself from the workspace",
+        )
+    target = await member_svc.get(workspace_id, user_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="Member not found")
+    if target.role == "owner" and not await member_svc.has_role(
+        workspace_id, user.id, "owner"
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only owners can remove an owner",
+        )
     removed = await member_svc.remove(workspace_id, user_id)
     if not removed:
         raise HTTPException(status_code=404, detail="Member not found")

@@ -113,6 +113,10 @@ async def login(self, email: str, password: str) -> Optional[tuple[User, str]]:
 
     def _issue_token(self, user: User) -> str:
         """Issue a JWT for a user."""
+        if JWT_SECRET == _DEFAULT_SECRET and os.environ.get("PLATFORM_ENV", "dev") != "dev":
+            raise RuntimeError(
+                "Refusing to issue JWT with default PLATFORM_JWT_SECRET outside dev"
+            )
         now = datetime.now(timezone.utc)
         payload = {
             "sub": user.id,

@@ -0,0 +1,18 @@
+"""Workspace member RBAC and cross-workspace IDOR guards."""
+
+from __future__ import annotations
+
+import pytest
+from fastapi import HTTPException
+
+from praisonai_platform.api.deps import ensure_resource_in_workspace
+
+
+def test_ensure_resource_in_workspace_rejects_mismatch():
+    with pytest.raises(HTTPException) as exc:
+        ensure_resource_in_workspace("ws-a", "ws-b", label="Issue")
+    assert exc.value.status_code == 404
+
+
+def test_ensure_resource_in_workspace_allows_match():
+    ensure_resource_in_workspace("ws-a", "ws-a", label="Issue")

@@ -29,14 +29,26 @@
 # Authentication
 import os
 CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')
+_CALL_AUTH_DISABLED = os.getenv('PRAISONAI_CALL_AUTH', '').lower() == 'disabled'
+
 
 async def verify_token(
     request: Request, 
     authorization: Optional[str] = Header(None)
 ) -> None:
     """Verify API token for authentication."""
-    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:
-        return  # No authentication if FastAPI unavailable or no token set
+    if not FASTAPI_AVAILABLE:
+        return
+    if _CALL_AUTH_DISABLED:
+        return
+    if not CALL_SERVER_TOKEN:
+        raise HTTPException(
+            status_code=503,
+            detail=(
+                "CALL_SERVER_TOKEN is not configured. Set CALL_SERVER_TOKEN or "
+                "PRAISONAI_CALL_AUTH=disabled to run without authentication."
+            ),
+        )
         
     token = None
     

@@ -58,9 +58,10 @@ def write_file(
         >>> if result['success']:
         ...     print(f"Wrote to {result['path']}")
     """
-    # Resolve path
-    if workspace and not os.path.isabs(path):
-        abs_path = os.path.abspath(os.path.join(workspace, path))
+    # Resolve path — default workspace is cwd so relative paths cannot escape
+    effective_workspace = workspace or os.getcwd()
+    if not os.path.isabs(path):
+        abs_path = os.path.abspath(os.path.join(effective_workspace, path))
     else:
         abs_path = os.path.abspath(path)
     
@@ -73,14 +74,12 @@ def write_file(
             'path': path,
         }
 
-    # Security check - ensure path is within workspace if specified
-    if workspace:
-        if not is_path_within_directory(abs_path, workspace):
-            return {
-                'success': False,
-                'error': f"Path '{path}' is outside the workspace",
-                'path': path,
-            }
+    if not is_path_within_directory(abs_path, effective_workspace):
+        return {
+            'success': False,
+            'error': f"Path '{path}' is outside the workspace",
+            'path': path,
+        }
     
     # Process content
     processed_content = content

@@ -21,6 +21,31 @@
 logger = logging.getLogger(__name__)
 
 
+def _resolve_cwd_yaml_path(file_path: str) -> "Path":
+    """Resolve a YAML path strictly inside the current working directory."""
+    from pathlib import Path
+
+    if not isinstance(file_path, str) or not file_path:
+        raise ValueError("file_path must be a non-empty string")
+    if (
+        "/" in file_path
+        or "\\" in file_path
+        or "\x00" in file_path
+        or file_path.startswith(".")
+        or file_path in ("..", ".")
+    ):
+        raise ValueError(f"invalid file_path: {file_path!r}")
+    if not file_path.endswith((".yaml", ".yml")):
+        raise ValueError("file_path must be a .yaml or .yml file")
+    base = Path.cwd().resolve()
+    candidate = (base / file_path).resolve()
+    try:
+        candidate.relative_to(base)
+    except ValueError as exc:
+        raise ValueError(f"invalid file_path: {file_path!r}") from exc
+    return candidate
+
+
 def register_cli_tools() -> None:
     """Register CLI-based MCP tools."""
     
@@ -44,7 +69,8 @@ def workflow_validate(file_path: str) -> str:
         """Validate a workflow YAML file."""
         try:
             import yaml
-            with open(file_path, 'r') as f:
+            yaml_path = _resolve_cwd_yaml_path(file_path)
+            with open(yaml_path, 'r') as f:
                 config = yaml.safe_load(f)
             
             required = ["framework", "topic"]
@@ -64,9 +90,10 @@ def workflow_validate(file_path: str) -> str:
     def workflow_show(file_path: str) -> str:
         """Show workflow configuration."""
         try:
-            with open(file_path, 'r') as f:
-                content = f.read()
-            return content
+            yaml_path = _resolve_cwd_yaml_path(file_path)
+            return yaml_path.read_text()
+        except ValueError as e:
+            return f"Error: {e}"
         except FileNotFoundError:
             return f"File not found: {file_path}"
         except Exception as e:
@@ -417,7 +444,8 @@ def deploy_validate(config_path: str = "deploy.yaml") -> str:
         """Validate deployment configuration."""
         try:
             import yaml
-            with open(config_path, 'r') as f:
+            yaml_path = _resolve_cwd_yaml_path(config_path)
+            with open(yaml_path, 'r') as f:
                 config = yaml.safe_load(f)
             
             required = ["name", "type"]

@@ -0,0 +1,23 @@
+"""write_file must constrain paths when workspace is omitted."""
+
+from __future__ import annotations
+
+import os
+
+from praisonai.code.tools.write_file import write_file
+
+
+def test_write_file_without_workspace_stays_in_cwd(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    ok = write_file("out.txt", "hello", workspace=None)
+    assert ok["success"] is True
+    assert (tmp_path / "out.txt").read_text() == "hello"
+
+
+def test_write_file_without_workspace_blocks_escape(tmp_path, monkeypatch):
+    project = tmp_path / "project"
+    project.mkdir()
+    monkeypatch.chdir(project)
+    result = write_file("../outside.txt", "nope", workspace=None)
+    assert result["success"] is False
+    assert "outside" in result["error"].lower()

@@ -0,0 +1,21 @@
+"""MCP CLI tools must not read arbitrary filesystem paths."""
+
+from __future__ import annotations
+
+import pytest
+
+
+def test_resolve_cwd_yaml_rejects_traversal(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    from praisonai.mcp_server.adapters import cli_tools
+
+    (tmp_path / "workflow.yaml").write_text("framework: test\ntopic: t\n")
+
+    path = cli_tools._resolve_cwd_yaml_path("workflow.yaml")
+    assert path.name == "workflow.yaml"
+
+    with pytest.raises(ValueError):
+        cli_tools._resolve_cwd_yaml_path("../../etc/passwd")
+
+    with pytest.raises(ValueError):
+        cli_tools._resolve_cwd_yaml_path("/etc/passwd")

@@ -0,0 +1,40 @@
+"""Call server agent API must not fail open without CALL_SERVER_TOKEN."""
+
+from __future__ import annotations
+
+import importlib
+import os
+
+import pytest
+
+pytest.importorskip("fastapi")
+
+
+@pytest.mark.asyncio
+async def test_verify_token_requires_token_by_default(monkeypatch):
+    monkeypatch.delenv("CALL_SERVER_TOKEN", raising=False)
+    monkeypatch.delenv("PRAISONAI_CALL_AUTH", raising=False)
+
+    mod = importlib.import_module("praisonai.api.agent_invoke")
+    importlib.reload(mod)
+
+    class _Req:
+        query_params = {}
+
+    with pytest.raises(Exception) as exc:
+        await mod.verify_token(_Req(), authorization=None)
+    assert "CALL_SERVER_TOKEN" in str(exc.value)
+
+
+@pytest.mark.asyncio
+async def test_verify_token_optout(monkeypatch):
+    monkeypatch.delenv("CALL_SERVER_TOKEN", raising=False)
+    monkeypatch.setenv("PRAISONAI_CALL_AUTH", "disabled")
+
+    mod = importlib.import_module("praisonai.api.agent_invoke")
+    importlib.reload(mod)
+
+    class _Req:
+        query_params = {}
+
+    await mod.verify_token(_Req(), authorization=None)

@@ -113,7 +113,9 @@ all = [
     "praisonaiagents[mongodb]",
     "praisonaiagents[auth]",
     "praisonaiagents[search]",
-    "praisonaiagents[crawl]"
+    "praisonaiagents[crawl]",
+    "praisonaiagents[autonomy]",
+    "praisonaiagents[os]"
 ]
 
 [tool.setuptools.packages.find]

@@ -255,7 +255,11 @@ async def stop(self) -> bool:
     
     def get_stats(self) -> Dict[str, Any]:
         """
-        Get execution statistics.
+        Get current execution statistics (synchronous, best-effort).
+        
+        Warning: This method provides a best-effort view of stats without
+        guaranteeing atomicity. For consistent snapshots in async context,
+        use get_stats_async() instead.
         
         Returns:
             Dictionary with execution stats
@@ -268,6 +272,40 @@ def get_stats(self) -> Dict[str, Any]:
             "success_rate": (self._success_count / self._execution_count * 100) if self._execution_count > 0 else 0
         }
     
+    async def get_stats_async(self) -> Dict[str, Any]:
+        """
+        Get current execution statistics with atomic snapshot (async).
+        
+        Returns:
+            Dictionary with execution stats
+        """
+        if self._stats_lock is None:
+            # Not yet started: stats are all zero, no lock needed
+            execs, success, failed = 0, 0, 0
+        else:
+            # Take atomic snapshot of all counters
+            async with self._stats_lock:
+                execs = self._execution_count
+                success = self._success_count
+                failed = self._failure_count
+        
+        return {
+            "is_running": self.is_running,
+            "total_executions": execs,
+            "successful_executions": success,
+            "failed_executions": failed,
+            "success_rate": (success / execs * 100) if execs > 0 else 0
+        }
+    
+    def get_stats_sync(self) -> Dict[str, Any]:
+        """
+        Alias for get_stats() for clarity.
+        
+        Returns:
+            Dictionary with execution stats
+        """
+        return self.get_stats()
+    
     async def _run_schedule(self, interval: int, max_retries: int):
         """Internal method to run scheduled agent executions."""
         try:
@@ -289,7 +327,13 @@ async def _run_schedule(self, interval: int, max_retries: int):
     
     async def _execute_with_retry(self, max_retries: int):
         """Execute agent with retry logic."""
-        self._execution_count += 1
+        # Ensure async primitives are available
+        if self._stats_lock is None:
+            self._ensure_async_primitives()
+        
+        # Atomically increment execution count
+        async with self._stats_lock:
+            self._execution_count += 1
         
         last_exc: Optional[Exception] = None
         for attempt in range(max_retries):
@@ -300,7 +344,9 @@ async def _execute_with_retry(self, max_retries: int):
                 logger.info(f"Async agent execution successful on attempt {attempt + 1}")
                 logger.info(f"Result: {result}")
                 
-                self._success_count += 1
+                # Atomically increment success count
+                async with self._stats_lock:
+                    self._success_count += 1
                 safe_call(self.on_success, result)
                 return
                 
@@ -313,7 +359,9 @@ async def _execute_with_retry(self, max_retries: int):
                     logger.info(f"Waiting {wait_time}s before async retry...")
                     await asyncio.sleep(wait_time)
         
-        self._failure_count += 1
+        # Atomically increment failure count
+        async with self._stats_lock:
+            self._failure_count += 1
         logger.error(f"Async agent execution failed after {max_retries} attempts")
         safe_call(
             self.on_failure,

@@ -7,7 +7,9 @@
 
 import logging
 import time
+import threading
 import uuid
+from copy import deepcopy
 from typing import Any, Dict, List, Optional, TYPE_CHECKING
 
 from .conversation.base import ConversationStore, ConversationSession, ConversationMessage
@@ -78,6 +80,7 @@ def __init__(
         
         self._current_session: Optional[ConversationSession] = None
         self._session_cache: Dict[str, ConversationSession] = {}
+        self._cache_lock = threading.RLock()  # RLock allows re-entrant access
     
     @classmethod
     def from_config(cls, config: PersistenceConfig) -> "PersistenceOrchestrator":
@@ -90,6 +93,31 @@ def from_env(cls) -> "PersistenceOrchestrator":
         config = PersistenceConfig.from_env()
         return cls(config=config)
     
+    # =========================================================================
+    # Thread-Safe Cache Operations
+    # =========================================================================
+    
+    def _cache_put(self, session: ConversationSession) -> None:
+        """Store session in cache with thread safety."""
+        with self._cache_lock:
+            self._session_cache[session.session_id] = session
+    
+    def _cache_get(self, session_id: str) -> Optional[ConversationSession]:
+        """Get session from cache with thread safety and defensive copying."""
+        with self._cache_lock:
+            cached = self._session_cache.get(session_id)
+            return deepcopy(cached) if cached is not None else None
+    
+    def _cache_delete(self, session_id: str) -> Optional[ConversationSession]:
+        """Remove session from cache with thread safety."""
+        with self._cache_lock:
+            return self._session_cache.pop(session_id, None)
+    
+    def _cache_clear(self) -> None:
+        """Clear all sessions from cache with thread safety."""
+        with self._cache_lock:
+            self._session_cache.clear()
+    
     # =========================================================================
     # Agent Lifecycle Hooks
     # =========================================================================
@@ -128,7 +156,7 @@ def on_agent_start(
         if session:
             logger.info(f"Resuming session: {session_id}")
             self._current_session = session
-            self._session_cache[session_id] = session
+            self._cache_put(session)
             
             # Load previous messages
             messages = self.conversation.get_messages(session_id)
@@ -146,7 +174,7 @@ def on_agent_start(
             self.conversation.create_session(session)
             logger.info(f"Created new session: {session_id}")
             self._current_session = session
-            self._session_cache[session_id] = session
+            self._cache_put(session)
             return []
     
     def on_message(
@@ -206,12 +234,14 @@ def on_agent_end(
         if not self.conversation:
             return
         
-        session = self._session_cache.get(session_id) or self.conversation.get_session(session_id)
+        session = self._cache_get(session_id) or self.conversation.get_session(session_id)
         if session:
             session.updated_at = time.time()
             if metadata:
                 session.metadata = {**(session.metadata or {}), **metadata}
             self.conversation.update_session(session)
+            # Update cache with the modified session
+            self._cache_put(session)
             logger.debug(f"Updated session metadata: {session_id}")
     
     # =========================================================================
@@ -315,8 +345,8 @@ def delete_session(self, session_id: str) -> bool:
         if not self.conversation:
             return False
         
-        if session_id in self._session_cache:
-            del self._session_cache[session_id]
+        # Remove from cache using thread-safe method
+        self._cache_delete(session_id)
         
         return self.conversation.delete_session(session_id)
     
@@ -395,7 +425,8 @@ def close(self) -> None:
         if self.state:
             self.state.close()
         
-        self._session_cache.clear()
+        # Clear cache using thread-safe method
+        self._cache_clear()
         logger.info("Persistence orchestrator closed")
     
     def __enter__(self):

@@ -9,6 +9,7 @@
 import asyncio
 import logging
 import os
+import shlex
 import tempfile
 import time
 import uuid
@@ -226,18 +227,34 @@ async def run_command(
         limits: Optional[ResourceLimits] = None,
         env: Optional[Dict[str, str]] = None,
         working_dir: Optional[str] = None,
+        shell: bool = False,
     ) -> SandboxResult:
-        """Run a shell command in the sandbox."""
+        """Run a command in the sandbox.
+        
+        Args:
+            command: String command or list of arguments
+            limits: Resource limits to apply
+            env: Environment variables
+            working_dir: Working directory
+            shell: If True, explicitly use shell. If False (default), execute safely without shell.
+        """
         if not self._is_running:
             await self.start()
         
         limits = limits or self.config.resource_limits
         execution_id = str(uuid.uuid4())
         
         if isinstance(command, list):
-            cmd_str = " ".join(command)
+            # Always quote list elements to prevent shell injection
+            cmd_str = " ".join(shlex.quote(arg) for arg in command)
         else:
-            cmd_str = command
+            if shell:
+                # Caller explicitly requested shell evaluation
+                cmd_str = command
+            else:
+                # Parse string safely then re-quote each part
+                cmd_parts = shlex.split(command)
+                cmd_str = " ".join(shlex.quote(part) for part in cmd_parts)
         
         docker_cmd = [
             "docker", "run", "--rm",

@@ -0,0 +1,38 @@
+"""Shared utilities for safe shell command handling across sandbox backends."""
+
+import shlex
+from typing import List, Union
+
+
+def build_argv(command: Union[str, List[str]], shell: bool = False) -> List[str]:
+    """
+    Safely build command argv with explicit shell control.
+    
+    Args:
+        command: String command or list of arguments
+        shell: If True, explicitly use shell. If False, parse safely without shell.
+    
+    Returns:
+        List of command arguments safe for subprocess execution
+        
+    Security:
+        - shell=False (default): No shell injection possible
+        - shell=True: Caller explicitly opts into shell evaluation
+    """
+    if isinstance(command, str):
+        if not shell:
+            # Safe parse: convert string to argv without invoking shell
+            return shlex.split(command)
+        else:
+            # Explicit shell: caller has opted in
+            return ["sh", "-c", command]
+    else:
+        # List input
+        cmd_list = list(command)
+        if shell:
+            # Quote each element when combining into shell command
+            quoted_cmd = " ".join(shlex.quote(arg) for arg in cmd_list)
+            return ["sh", "-c", quoted_cmd]
+        else:
+            # Direct argv execution - no shell
+            return cmd_list

@@ -277,24 +277,52 @@ async def run_command(
         limits: Optional[ResourceLimits] = None,
         env: Optional[Dict[str, str]] = None,
         working_dir: Optional[str] = None,
+        shell: bool = False,
     ) -> SandboxResult:
-        """Run a shell command on the remote server."""
+        """Run a command on the remote server.
+        
+        Args:
+            command: String command or list of arguments
+            limits: Resource limits to apply
+            env: Environment variables
+            working_dir: Working directory
+            shell: If True, explicitly use shell. If False (default), execute safely without shell.
+        """
         if not self._is_running:
             await self.start()
         
         execution_id = str(uuid.uuid4())
         started_at = time.time()
         
         try:
-            # Convert command to string if needed
+            # Convert command to string safely based on shell parameter
             if isinstance(command, list):
-                command = shlex.join(command)
+                if shell:
+                    # Shell mode: join with proper quoting
+                    command_str = " ".join(shlex.quote(arg) for arg in command)
+                else:
+                    # Non-shell mode: use shlex.join for proper escaping
+                    command_str = shlex.join(command)
+            else:
+                # String command
+                if not shell:
+                    # Parse then re-join to ensure safe execution
+                    try:
+                        parts = shlex.split(command)
+                        command_str = shlex.join(parts)
+                    except ValueError:
+                        # If parsing fails, quote the whole thing
+                        command_str = shlex.quote(command)
+                else:
+                    # Shell mode: use as-is (caller explicitly opted in)
+                    command_str = command
             
             # Execute command
             result = await self._run_command_with_limits(
-                command, 
+                command_str, 
                 limits, 
-                working_dir or self.working_dir
+                working_dir or self.working_dir,
+                shell
             )
             
             completed_at = time.time()
@@ -491,10 +519,12 @@ async def _run_command_with_limits(
         self,
         command: str,
         limits: Optional[ResourceLimits],
-        working_dir: str
+        working_dir: str,
+        shell: bool = False
     ):
         """Run command with resource limits."""
-        # Change to working directory
+        # Change to working directory and execute command
+        # Note: The command has already been processed for shell safety by the caller
         full_command = f"cd {shlex.quote(working_dir)} && {command}"
         
         # Set timeout

@@ -190,18 +190,26 @@ async def run_command(
         limits: Optional[ResourceLimits] = None,
         env: Optional[Dict[str, str]] = None,
         working_dir: Optional[str] = None,
+        shell: bool = False,
     ) -> SandboxResult:
-        """Run a shell command in the sandbox."""
+        """Run a command in the sandbox.
+        
+        Args:
+            command: String command or list of arguments
+            limits: Resource limits to apply
+            env: Environment variables
+            working_dir: Working directory
+            shell: If True, explicitly use shell. If False (default), execute safely without shell.
+        """
         if not self._is_running:
             await self.start()
         
         limits = limits or self.config.resource_limits
         execution_id = str(uuid.uuid4())
         
-        if isinstance(command, str):
-            cmd = ["sh", "-c", command]
-        else:
-            cmd = command
+        # Import here to avoid circular import
+        from ._shell import build_argv
+        cmd = build_argv(command, shell=shell)
         
         process_env = os.environ.copy()
         if env:

@@ -16,7 +16,12 @@
 | GHSA-6xj3-927j-6pqw | fixed batch 2 | deploy.py bleach sanitize |
 | GHSA-8444-4fhq-fxpq | already-fixed | APIConfig.auth_enabled default True |
 | GHSA-78r8-wwqv-r299 | already-fixed | load_user_module gate |
-| GHSA-gv23, h8q5, 6h6v, h37g | partial/defer | broader platform audit |
+| GHSA-gv23, h8q5, 6h6v, h37g, 6h6v-7vxx | fixed batch 3 | service-layer workspace_id on get/update/delete |
+| GHSA-h37g-4h4p-9x97, c2m8, 8g2p | fixed batch 3 | only owner assigns admin/owner |
+| GHSA-h8q5-cp56-rr65 | fixed batch 3 | bind default 127.0.0.1 (+ PLATFORM_HOST) |
+| GHSA-6xj3-927j-6pqw | not-applicable | Open WebUI path; not in this repo |
 | GHSA-gmjg, 9q28 | published | prior release |
 
+**Code fixed on main; GHSA state still triage until PyPI publish + advisory publish.**
+
 Resources: https://github.com/MervinPraison/PraisonAI · https://docs.praison.ai · https://praison.ai

@@ -9,7 +9,7 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
+from ..deps import get_db, require_workspace_member
 from ..schemas import AgentCreate, AgentResponse, AgentUpdate
 from ...services.agent_service import AgentService
 
@@ -58,10 +58,9 @@ async def get_agent(
     session: AsyncSession = Depends(get_db),
 ):
     svc = AgentService(session)
-    agent = await svc.get(agent_id)
+    agent = await svc.get(agent_id, workspace_id=workspace_id)
     if agent is None:
         raise HTTPException(status_code=404, detail="Agent not found")
-    ensure_resource_in_workspace(agent.workspace_id, workspace_id, label="Agent")
     return AgentResponse.model_validate(agent)
 
 
@@ -76,6 +75,7 @@ async def update_agent(
     svc = AgentService(session)
     agent = await svc.update(
         agent_id,
+        workspace_id=workspace_id,
         name=body.name,
         status=body.status,
         instructions=body.instructions,
@@ -85,7 +85,6 @@ async def update_agent(
     )
     if agent is None:
         raise HTTPException(status_code=404, detail="Agent not found")
-    ensure_resource_in_workspace(agent.workspace_id, workspace_id, label="Agent")
     return AgentResponse.model_validate(agent)
 
 
@@ -97,10 +96,6 @@ async def delete_agent(
     session: AsyncSession = Depends(get_db),
 ):
     svc = AgentService(session)
-    agent = await svc.get(agent_id)
-    if agent is None:
-        raise HTTPException(status_code=404, detail="Agent not found")
-    ensure_resource_in_workspace(agent.workspace_id, workspace_id, label="Agent")
-    deleted = await svc.delete(agent_id)
+    deleted = await svc.delete(agent_id, workspace_id=workspace_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Agent not found")

@@ -62,6 +62,8 @@ async def delete_dependency(
     dep = await svc.get(dep_id)
     if dep is None:
         raise HTTPException(status_code=404, detail="Dependency not found")
+    if dep.issue_id != issue_id and dep.depends_on_issue_id != issue_id:
+        raise HTTPException(status_code=404, detail="Dependency not found")
     deleted = await svc.delete(dep_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Dependency not found")

@@ -87,10 +87,9 @@ async def get_issue(
     session: AsyncSession = Depends(get_db),
 ):
     svc = IssueService(session)
-    issue = await svc.get(issue_id)
+    issue = await svc.get(issue_id, workspace_id=workspace_id)
     if issue is None:
         raise HTTPException(status_code=404, detail="Issue not found")
-    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
     return IssueResponse.model_validate(issue)
 
 
@@ -105,6 +104,7 @@ async def update_issue(
     svc = IssueService(session)
     issue = await svc.update(
         issue_id,
+        workspace_id=workspace_id,
         title=body.title,
         description=body.description,
         status=body.status,
@@ -115,7 +115,6 @@ async def update_issue(
     )
     if issue is None:
         raise HTTPException(status_code=404, detail="Issue not found")
-    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
     act_svc = ActivityService(session)
     await act_svc.log(
         workspace_id, "issue.updated", "issue", issue.id,
@@ -134,11 +133,7 @@ async def delete_issue(
     session: AsyncSession = Depends(get_db),
 ):
     svc = IssueService(session)
-    issue = await svc.get(issue_id)
-    if issue is None:
-        raise HTTPException(status_code=404, detail="Issue not found")
-    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
-    deleted = await svc.delete(issue_id)
+    deleted = await svc.delete(issue_id, workspace_id=workspace_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Issue not found")
 

@@ -9,7 +9,7 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
+from ..deps import get_db, require_workspace_member
 from ..schemas import ProjectCreate, ProjectResponse, ProjectUpdate
 from ...services.project_service import ProjectService
 
@@ -56,10 +56,9 @@ async def get_project(
     session: AsyncSession = Depends(get_db),
 ):
     svc = ProjectService(session)
-    project = await svc.get(project_id)
+    project = await svc.get(project_id, workspace_id=workspace_id)
     if project is None:
         raise HTTPException(status_code=404, detail="Project not found")
-    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
     return ProjectResponse.model_validate(project)
 
 
@@ -74,6 +73,7 @@ async def update_project(
     svc = ProjectService(session)
     project = await svc.update(
         project_id,
+        workspace_id=workspace_id,
         title=body.title,
         description=body.description,
         status=body.status,
@@ -82,7 +82,6 @@ async def update_project(
     )
     if project is None:
         raise HTTPException(status_code=404, detail="Project not found")
-    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
     return ProjectResponse.model_validate(project)
 
 
@@ -94,11 +93,7 @@ async def delete_project(
     session: AsyncSession = Depends(get_db),
 ):
     svc = ProjectService(session)
-    project = await svc.get(project_id)
-    if project is None:
-        raise HTTPException(status_code=404, detail="Project not found")
-    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
-    deleted = await svc.delete(project_id)
+    deleted = await svc.delete(project_id, workspace_id=workspace_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Project not found")
 
@@ -111,8 +106,7 @@ async def project_stats(
     session: AsyncSession = Depends(get_db),
 ):
     svc = ProjectService(session)
-    project = await svc.get(project_id)
+    project = await svc.get(project_id, workspace_id=workspace_id)
     if project is None:
         raise HTTPException(status_code=404, detail="Project not found")
-    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
     return await svc.get_stats(project_id)

@@ -103,11 +103,11 @@ async def add_member(
     session: AsyncSession = Depends(get_db),
 ):
     member_svc = MemberService(session)
-    if body.role == "owner":
+    if body.role in ("owner", "admin"):
         if not await member_svc.has_role(workspace_id, user.id, "owner"):
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
-                detail="Only owners can add another owner",
+                detail="Only owners can add admin or owner roles",
             )
     member = await member_svc.add(workspace_id, body.user_id, body.role)
     return MemberResponse.model_validate(member)
@@ -141,12 +141,12 @@ async def update_member_role(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Cannot change your own role",
         )
-    if body.role == "owner" and not await member_svc.has_role(
+    if body.role in ("owner", "admin") and not await member_svc.has_role(
         workspace_id, user.id, "owner"
     ):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
-            detail="Only owners can assign the owner role",
+            detail="Only owners can assign admin or owner roles",
         )
     if target.role == "owner" and not await member_svc.has_role(
         workspace_id, user.id, "owner"

@@ -7,12 +7,18 @@
 """
 
 import argparse
+import os
 import sys
 
 
 def main() -> None:
+    default_host = os.environ.get("PLATFORM_HOST", "127.0.0.1")
     parser = argparse.ArgumentParser(description="PraisonAI Platform Server")
-    parser.add_argument("--host", default="0.0.0.0", help="Bind host (default: 0.0.0.0)")
+    parser.add_argument(
+        "--host",
+        default=default_host,
+        help="Bind host (default: 127.0.0.1, or PLATFORM_HOST env)",
+    )
     parser.add_argument("--port", type=int, default=8000, help="Bind port (default: 8000)")
     parser.add_argument("--reload", action="store_true", help="Enable auto-reload for development")
     args = parser.parse_args()

@@ -50,9 +50,16 @@ async def create(
         await self._session.flush()
         return agent
 
-    async def get(self, agent_id: str) -> Optional[Agent]:
-        """Get agent by ID."""
-        return await self._session.get(Agent, agent_id)
+    async def get(
+        self, agent_id: str, *, workspace_id: Optional[str] = None
+    ) -> Optional[Agent]:
+        """Get agent by ID, optionally scoped to a workspace."""
+        agent = await self._session.get(Agent, agent_id)
+        if agent is None:
+            return None
+        if workspace_id is not None and agent.workspace_id != workspace_id:
+            return None
+        return agent
 
     async def list_for_workspace(
         self,
@@ -72,6 +79,8 @@ async def list_for_workspace(
     async def update(
         self,
         agent_id: str,
+        *,
+        workspace_id: Optional[str] = None,
         name: Optional[str] = None,
         status: Optional[str] = None,
         instructions: Optional[str] = None,
@@ -80,7 +89,7 @@ async def update(
         max_concurrent_tasks: Optional[int] = None,
     ) -> Optional[Agent]:
         """Update agent fields."""
-        agent = await self.get(agent_id)
+        agent = await self.get(agent_id, workspace_id=workspace_id)
         if agent is None:
             return None
         if name is not None:
@@ -102,9 +111,11 @@ async def update(
         await self._session.flush()
         return agent
 
-    async def delete(self, agent_id: str) -> bool:
+    async def delete(
+        self, agent_id: str, *, workspace_id: Optional[str] = None
+    ) -> bool:
         """Delete an agent."""
-        agent = await self.get(agent_id)
+        agent = await self.get(agent_id, workspace_id=workspace_id)
         if agent is None:
             return False
         await self._session.delete(agent)

@@ -69,9 +69,16 @@ async def create(
         await self._session.flush()
         return issue
 
-    async def get(self, issue_id: str) -> Optional[Issue]:
-        """Get issue by ID."""
-        return await self._session.get(Issue, issue_id)
+    async def get(
+        self, issue_id: str, *, workspace_id: Optional[str] = None
+    ) -> Optional[Issue]:
+        """Get issue by ID, optionally scoped to a workspace."""
+        issue = await self._session.get(Issue, issue_id)
+        if issue is None:
+            return None
+        if workspace_id is not None and issue.workspace_id != workspace_id:
+            return None
+        return issue
 
     async def list_for_workspace(
         self,
@@ -97,6 +104,8 @@ async def list_for_workspace(
     async def update(
         self,
         issue_id: str,
+        *,
+        workspace_id: Optional[str] = None,
         title: Optional[str] = None,
         description: Optional[str] = None,
         status: Optional[str] = None,
@@ -106,7 +115,7 @@ async def update(
         project_id: Optional[str] = None,
     ) -> Optional[Issue]:
         """Update issue fields."""
-        issue = await self.get(issue_id)
+        issue = await self.get(issue_id, workspace_id=workspace_id)
         if issue is None:
             return None
         if title is not None:
@@ -147,9 +156,11 @@ async def transition(self, issue_id: str, new_status: str) -> Optional[Issue]:
         """Transition an issue to a new status."""
         return await self.update(issue_id, status=new_status)
 
-    async def delete(self, issue_id: str) -> bool:
+    async def delete(
+        self, issue_id: str, *, workspace_id: Optional[str] = None
+    ) -> bool:
         """Delete an issue."""
-        issue = await self.get(issue_id)
+        issue = await self.get(issue_id, workspace_id=workspace_id)
         if issue is None:
             return False
         await self._session.delete(issue)

@@ -44,9 +44,16 @@ async def create(
         await self._session.flush()
         return project
 
-    async def get(self, project_id: str) -> Optional[Project]:
-        """Get project by ID."""
-        return await self._session.get(Project, project_id)
+    async def get(
+        self, project_id: str, *, workspace_id: Optional[str] = None
+    ) -> Optional[Project]:
+        """Get project by ID, optionally scoped to a workspace."""
+        project = await self._session.get(Project, project_id)
+        if project is None:
+            return None
+        if workspace_id is not None and project.workspace_id != workspace_id:
+            return None
+        return project
 
     async def list_for_workspace(
         self,
@@ -62,14 +69,16 @@ async def list_for_workspace(
     async def update(
         self,
         project_id: str,
+        *,
+        workspace_id: Optional[str] = None,
         title: Optional[str] = None,
         description: Optional[str] = None,
         status: Optional[str] = None,
         lead_type: Optional[str] = None,
         lead_id: Optional[str] = None,
     ) -> Optional[Project]:
         """Update project fields."""
-        project = await self.get(project_id)
+        project = await self.get(project_id, workspace_id=workspace_id)
         if project is None:
             return None
         if title is not None:
@@ -85,9 +94,11 @@ async def update(
         await self._session.flush()
         return project
 
-    async def delete(self, project_id: str) -> bool:
+    async def delete(
+        self, project_id: str, *, workspace_id: Optional[str] = None
+    ) -> bool:
         """Delete a project."""
-        project = await self.get(project_id)
+        project = await self.get(project_id, workspace_id=workspace_id)
         if project is None:
             return False
         await self._session.delete(project)

@@ -0,0 +1,38 @@
+"""Service-layer workspace scoping for issues and projects."""
+
+from __future__ import annotations
+
+import pytest
+
+from praisonai_platform.services.auth_service import AuthService
+from praisonai_platform.services.issue_service import IssueService
+from praisonai_platform.services.project_service import ProjectService
+from praisonai_platform.services.workspace_service import WorkspaceService
+
+
+@pytest.mark.asyncio
+async def test_issue_get_rejects_wrong_workspace(session):
+    auth = AuthService(session)
+    user, _ = await auth.register("scope@test.com", "pass")
+    ws_a = await WorkspaceService(session).create("A", user.id)
+    ws_b = await WorkspaceService(session).create("B", user.id)
+    issue_svc = IssueService(session)
+    issue = await issue_svc.create(
+        workspace_id=ws_a.id,
+        title="secret",
+        creator_id=user.id,
+    )
+    assert await issue_svc.get(issue.id, workspace_id=ws_a.id) is not None
+    assert await issue_svc.get(issue.id, workspace_id=ws_b.id) is None
+
+
+@pytest.mark.asyncio
+async def test_project_delete_scoped_to_workspace(session):
+    auth = AuthService(session)
+    user, _ = await auth.register("proj_scope@test.com", "pass")
+    ws_a = await WorkspaceService(session).create("PA", user.id)
+    ws_b = await WorkspaceService(session).create("PB", user.id)
+    proj_svc = ProjectService(session)
+    project = await proj_svc.create(workspace_id=ws_a.id, title="p1")
+    assert await proj_svc.delete(project.id, workspace_id=ws_b.id) is False
+    assert await proj_svc.delete(project.id, workspace_id=ws_a.id) is True

@@ -23,12 +23,39 @@
 result = agent.start("What is 123 + 456?", stream=True)
 
 # ── 3. Custom tool ──
-def handle_calculator(tool_name, tool_input):
-    expr = tool_input.get("expression", "0")
+def _safe_calc(expr: str) -> str:
+    import ast
+    allowed = set("0123456789+-*/.() ")
+    if not all(c in allowed for c in expr):
+        return "error"
     try:
-        val = eval(expr, {"__builtins__": {}})
+        tree = ast.parse(expr, mode="eval")
+        for node in ast.walk(tree):
+            if not isinstance(
+                node,
+                (
+                    ast.Expression,
+                    ast.BinOp,
+                    ast.UnaryOp,
+                    ast.Constant,
+                    ast.Add,
+                    ast.Sub,
+                    ast.Mult,
+                    ast.Div,
+                    ast.USub,
+                    ast.UAdd,
+                ),
+            ):
+                return "error"
+        val = eval(compile(tree, "<expr>", "eval"), {"__builtins__": {}})
+        return str(val)
     except Exception:
-        val = "error"
+        return "error"
+
+
+def handle_calculator(tool_name, tool_input):
+    expr = tool_input.get("expression", "0")
+    val = _safe_calc(str(expr))
     print(f"  [Calculator: {expr} = {val}]")
     return str(val)
 

@@ -44,12 +44,33 @@ def search(query: str) -> str:
     
     def calculate(expression: str) -> str:
         """Calculate a math expression safely."""
-        try:
-            # Safe eval for basic math
-            allowed = set("0123456789+-*/.() ")
-            if all(c in allowed for c in expression):
-                return str(eval(expression))
+        import ast
+
+        allowed = set("0123456789+-*/.() ")
+        if not all(c in allowed for c in expression):
             return "Error: Invalid expression"
+        try:
+            tree = ast.parse(expression, mode="eval")
+            for node in ast.walk(tree):
+                if not isinstance(
+                    node,
+                    (
+                        ast.Expression,
+                        ast.BinOp,
+                        ast.UnaryOp,
+                        ast.Constant,
+                        ast.Add,
+                        ast.Sub,
+                        ast.Mult,
+                        ast.Div,
+                        ast.USub,
+                        ast.UAdd,
+                    ),
+                ):
+                    return "Error: Invalid expression"
+            return str(
+                eval(compile(tree, "<expr>", "eval"), {"__builtins__": {}})
+            )
         except Exception as e:
             return f"Error: {e}"
     

@@ -0,0 +1,22 @@
+# Security advisory triage (maintainer)
+
+| GHSA | Status after batch 1+2 | Notes |
+|------|------------------------|-------|
+| GHSA-4mr5-g6f9-cfrh | fixed batch 1 | Sandbox AST |
+| GHSA-5c6w-wwfq-7qqm | fixed batch 1 | spider_tools SSRF |
+| GHSA-9cr9-25q5-8prj | fixed batch 1 | MCP yaml paths |
+| GHSA-86qc-r5v2-v6x6 | fixed batch 1 | call server auth |
+| GHSA-hvhp-v2gc-268q | fixed batch 1 | write_file cwd |
+| GHSA-5cxw-77wg-jrf3 | fixed batch 1 | @url mentions |
+| GHSA-xp85-6wwf-r67c | fixed batch 1 | GHA branch quote |
+| GHSA-3qg8-5g3r-79v5 | fixed batch 1+2 | JWT + issue guard |
+| GHSA-xwq8, 7p8g, c2m8, 8g2p, w388, g8rr | fixed batch 1 | platform RBAC/IDOR partial |
+| GHSA-943m, 5jx9, 4x6r, 27p4, cp4f | fixed batch 2 | platform IDOR completion |
+| GHSA-vg22-4gmj-prxw | fixed batch 2 | example eval hardening |
+| GHSA-6xj3-927j-6pqw | fixed batch 2 | deploy.py bleach sanitize |
+| GHSA-8444-4fhq-fxpq | already-fixed | APIConfig.auth_enabled default True |
+| GHSA-78r8-wwqv-r299 | already-fixed | load_user_module gate |
+| GHSA-gv23, h8q5, 6h6v, h37g | partial/defer | broader platform audit |
+| GHSA-gmjg, 9q28 | published | prior release |
+
+Resources: https://github.com/MervinPraison/PraisonAI · https://docs.praison.ai · https://praison.ai

@@ -107,3 +107,21 @@ def ensure_resource_in_workspace(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f"{label} not found",
         )
+
+
+async def require_issue_in_workspace(
+    workspace_id: str,
+    issue_id: str,
+    session: AsyncSession,
+):
+    """Load an issue and verify it belongs to the URL workspace."""
+    from ..db.models import Issue
+
+    issue = await session.get(Issue, issue_id)
+    if issue is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Issue not found",
+        )
+    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
+    return issue

@@ -9,7 +9,7 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import get_db, require_workspace_member
+from ..deps import get_db, require_issue_in_workspace, require_workspace_member
 from ..schemas import ActivityLogResponse
 from ...services.activity_service import ActivityService
 
@@ -38,6 +38,7 @@ async def list_issue_activity(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    await require_issue_in_workspace(workspace_id, issue_id, session)
     svc = ActivityService(session)
     logs = await svc.list_for_issue(issue_id, limit=limit, offset=offset)
     return [ActivityLogResponse.model_validate(log) for log in logs]

@@ -9,9 +9,9 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import get_db, require_workspace_member
-from ..schemas import DependencyCreate, DependencyResponse
+from ..deps import get_db, require_issue_in_workspace, require_workspace_member
 from ...services.dependency_service import DependencyService
+from ..schemas import DependencyCreate, DependencyResponse
 
 router = APIRouter(
     prefix="/workspaces/{workspace_id}/issues/{issue_id}/dependencies",
@@ -27,6 +27,10 @@ async def create_dependency(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    await require_issue_in_workspace(workspace_id, issue_id, session)
+    await require_issue_in_workspace(
+        workspace_id, body.depends_on_issue_id, session
+    )
     svc = DependencyService(session)
     dep = await svc.create(issue_id, body.depends_on_issue_id, body.type)
     return DependencyResponse.model_validate(dep)
@@ -39,6 +43,7 @@ async def list_dependencies(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    await require_issue_in_workspace(workspace_id, issue_id, session)
     svc = DependencyService(session)
     deps = await svc.list_for_issue(issue_id)
     return [DependencyResponse.model_validate(d) for d in deps]
@@ -52,7 +57,11 @@ async def delete_dependency(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    await require_issue_in_workspace(workspace_id, issue_id, session)
     svc = DependencyService(session)
+    dep = await svc.get(dep_id)
+    if dep is None:
+        raise HTTPException(status_code=404, detail="Dependency not found")
     deleted = await svc.delete(dep_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Dependency not found")

@@ -9,7 +9,12 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import get_db, require_workspace_member
+from ..deps import (
+    ensure_resource_in_workspace,
+    get_db,
+    require_issue_in_workspace,
+    require_workspace_member,
+)
 from ..schemas import LabelCreate, LabelResponse, LabelUpdate
 from ...services.label_service import LabelService
 
@@ -48,6 +53,10 @@ async def update_label(
     session: AsyncSession = Depends(get_db),
 ):
     svc = LabelService(session)
+    label = await svc.get(label_id)
+    if label is None:
+        raise HTTPException(status_code=404, detail="Label not found")
+    ensure_resource_in_workspace(label.workspace_id, workspace_id, label="Label")
     label = await svc.update(label_id, body.name, body.color)
     if label is None:
         raise HTTPException(status_code=404, detail="Label not found")
@@ -62,6 +71,10 @@ async def delete_label(
     session: AsyncSession = Depends(get_db),
 ):
     svc = LabelService(session)
+    label = await svc.get(label_id)
+    if label is None:
+        raise HTTPException(status_code=404, detail="Label not found")
+    ensure_resource_in_workspace(label.workspace_id, workspace_id, label="Label")
     deleted = await svc.delete(label_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Label not found")
@@ -78,7 +91,12 @@ async def add_label_to_issue(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    await require_issue_in_workspace(workspace_id, issue_id, session)
     svc = LabelService(session)
+    label = await svc.get(label_id)
+    if label is None:
+        raise HTTPException(status_code=404, detail="Label not found")
+    ensure_resource_in_workspace(label.workspace_id, workspace_id, label="Label")
     await svc.add_to_issue(issue_id, label_id)
 
 
@@ -90,7 +108,12 @@ async def remove_label_from_issue(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    await require_issue_in_workspace(workspace_id, issue_id, session)
     svc = LabelService(session)
+    label = await svc.get(label_id)
+    if label is None:
+        raise HTTPException(status_code=404, detail="Label not found")
+    ensure_resource_in_workspace(label.workspace_id, workspace_id, label="Label")
     await svc.remove_from_issue(issue_id, label_id)
 
 
@@ -101,6 +124,7 @@ async def list_issue_labels(
     user: AuthIdentity = Depends(require_workspace_member),
     session: AsyncSession = Depends(get_db),
 ):
+    await require_issue_in_workspace(workspace_id, issue_id, session)
     svc = LabelService(session)
     labels = await svc.list_for_issue(issue_id)
     return [LabelResponse.model_validate(l) for l in labels]

@@ -9,7 +9,7 @@
 
 from praisonaiagents.auth import AuthIdentity
 
-from ..deps import get_db, require_workspace_member
+from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
 from ..schemas import ProjectCreate, ProjectResponse, ProjectUpdate
 from ...services.project_service import ProjectService
 
@@ -59,6 +59,7 @@ async def get_project(
     project = await svc.get(project_id)
     if project is None:
         raise HTTPException(status_code=404, detail="Project not found")
+    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
     return ProjectResponse.model_validate(project)
 
 
@@ -81,6 +82,7 @@ async def update_project(
     )
     if project is None:
         raise HTTPException(status_code=404, detail="Project not found")
+    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
     return ProjectResponse.model_validate(project)
 
 
@@ -92,6 +94,10 @@ async def delete_project(
     session: AsyncSession = Depends(get_db),
 ):
     svc = ProjectService(session)
+    project = await svc.get(project_id)
+    if project is None:
+        raise HTTPException(status_code=404, detail="Project not found")
+    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
     deleted = await svc.delete(project_id)
     if not deleted:
         raise HTTPException(status_code=404, detail="Project not found")
@@ -105,4 +111,8 @@ async def project_stats(
     session: AsyncSession = Depends(get_db),
 ):
     svc = ProjectService(session)
+    project = await svc.get(project_id)
+    if project is None:
+        raise HTTPException(status_code=404, detail="Project not found")
+    ensure_resource_in_workspace(project.workspace_id, workspace_id, label="Project")
     return await svc.get_stats(project_id)

@@ -10,7 +10,7 @@
 import re
 from typing import Optional
 
-from sqlalchemy import select
+from sqlalchemy import delete, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from ..db.models import Member, Workspace
@@ -98,10 +98,13 @@ async def update(
         return ws
 
     async def delete(self, workspace_id: str) -> bool:
-        """Delete a workspace."""
+        """Delete a workspace and its memberships."""
         ws = await self.get(workspace_id)
         if ws is None:
             return False
+        await self._session.execute(
+            delete(Member).where(Member.workspace_id == workspace_id)
+        )
         await self._session.delete(ws)
         await self._session.flush()
         return True

@@ -0,0 +1,20 @@
+"""Cross-workspace IDOR guards for platform resources."""
+
+from __future__ import annotations
+
+import pytest
+from fastapi import HTTPException
+
+from praisonai_platform.api.deps import ensure_resource_in_workspace
+
+
+def test_project_workspace_mismatch():
+    with pytest.raises(HTTPException) as exc:
+        ensure_resource_in_workspace("ws-other", "ws-mine", label="Project")
+    assert exc.value.status_code == 404
+
+
+def test_label_workspace_mismatch():
+    with pytest.raises(HTTPException) as exc:
+        ensure_resource_in_workspace("ws-other", "ws-mine", label="Label")
+    assert exc.value.status_code == 404

@@ -76,16 +76,18 @@ def create_api_file(self):
         with open("api.py", "w") as file:
             file.write("from flask import Flask\n")
             file.write("from praisonai import PraisonAI\n")
-            file.write("import markdown\n\n")
+            file.write("import markdown\n")
+            file.write("import bleach\n\n")
             file.write("app = Flask(__name__)\n\n")
             file.write("def basic():\n")
             file.write("    praisonai = PraisonAI(agent_file=\"agents.yaml\")\n")
             file.write("    return praisonai.run()\n\n")
             file.write("@app.route('/')\n")
             file.write("def home():\n")
             file.write("    output = basic()\n")
-            file.write("    html_output = markdown.markdown(output)\n")
-            file.write("    return f'<html><body>{html_output}</body></html>'\n\n")
+            file.write("    rendered = markdown.markdown(str(output))\n")
+            file.write("    safe_html = bleach.clean(rendered, tags=bleach.sanitizer.ALLOWED_TAGS, attributes=bleach.sanitizer.ALLOWED_ATTRIBUTES)\n")
+            file.write("    return f'<html><body>{safe_html}</body></html>'\n\n")
             file.write("if __name__ == \"__main__\":\n")
             file.write("    import os\n")
             file.write("    app.run(debug=os.environ.get('DEBUG', 'false').lower() == 'true')\n")

@@ -0,0 +1,19 @@
+"""Generated deploy API servers must enable auth by default."""
+
+from praisonai.deploy.api import generate_api_server_code
+from praisonai.deploy.models import APIConfig
+
+
+def test_generate_api_server_auth_enabled_by_default():
+    code = generate_api_server_code("agents.yaml", APIConfig())
+    assert "AUTH_ENABLED" in code
+    assert "'enabled'" in code or '"enabled"' in code
+    assert "check_auth" in code
+    assert "compare_digest" in code
+
+
+def test_generate_api_server_respects_disabled_config():
+    code = generate_api_server_code(
+        "agents.yaml", APIConfig(auth_enabled=False)
+    )
+    assert "'disabled'" in code or '"disabled"' in code

@@ -0,0 +1,17 @@
+"""load_tools_from_module must use gated safe loader."""
+
+from __future__ import annotations
+
+from unittest.mock import patch
+
+import pytest
+
+
+def test_load_tools_from_module_returns_empty_when_blocked():
+    from praisonai.agents_generator import AgentsGenerator
+
+    gen = object.__new__(AgentsGenerator)
+    with patch(
+        "praisonai._safe_loader.load_user_module", return_value=None
+    ):
+        assert gen.load_tools_from_module("/tmp/evil_tools.py") == {}

@@ -294,8 +294,35 @@ def search(query: str) -> str:
 
 @tool
 def calculate(expression: str) -> float:
-    """Evaluate a math expression."""
-    return eval(expression)
+    """Safely evaluate a numeric arithmetic expression."""
+    import ast
+    import operator
+    
+    # Define allowed operations
+    _OPS = {
+        ast.Add: operator.add,
+        ast.Sub: operator.sub,
+        ast.Mult: operator.mul,
+        ast.Div: operator.truediv,
+        ast.Pow: operator.pow,
+        ast.USub: operator.neg,
+        ast.UAdd: operator.pos,
+    }
+    
+    def _safe_eval(node):
+        if isinstance(node, ast.Constant) and isinstance(node.value, (int, float)):
+            return node.value
+        elif isinstance(node, ast.BinOp) and type(node.op) in _OPS:
+            return _OPS[type(node.op)](_safe_eval(node.left), _safe_eval(node.right))
+        elif isinstance(node, ast.UnaryOp) and type(node.op) in _OPS:
+            return _OPS[type(node.op)](_safe_eval(node.operand))
+        else:
+            raise ValueError("Unsupported expression")
+    
+    try:
+        return _safe_eval(ast.parse(expression, mode="eval").body)
+    except (ValueError, SyntaxError, TypeError, ZeroDivisionError, OverflowError):
+        raise ValueError("Invalid arithmetic expression")
 
 agent = Agent(
     instructions="You are a helpful assistant",
@@ -304,6 +331,7 @@ agent = Agent(
 agent.start("Search for AI news and calculate 15*4")
 ```
 
+> ⚠️ **Security Note:** Never use `eval()`, `exec()`, or `subprocess` in tool functions that process LLM-generated or user-supplied input. Always validate and sanitize inputs to prevent code injection attacks.
 > 📖 [Full tools docs](https://docs.praison.ai/docs/tools/tools) — BaseTool, tool packages, 100+ built-in tools
 
 ### 5. Persistence (Databases)

@@ -43,10 +43,12 @@
 # Check for additional framework availability
 AG2_AVAILABLE = False
 PRAISONAI_AVAILABLE = False
+AGENTOPS_AVAILABLE = False
 try:
     import importlib.util
     AG2_AVAILABLE = importlib.util.find_spec("ag2") is not None
     PRAISONAI_AVAILABLE = importlib.util.find_spec("praisonaiagents") is not None
+    AGENTOPS_AVAILABLE = importlib.util.find_spec("agentops") is not None
 except ImportError:
     pass
 
@@ -375,20 +377,19 @@ def is_function_or_decorated(self, obj):
 
     def load_tools_from_module(self, module_path):
         """
-        Loads tools from a specified module path.
+        Load function tools from a user-supplied module (gated by PRAISONAI_ALLOW_LOCAL_TOOLS).
 
         Parameters:
             module_path (str): The path to the module containing the tools.
 
         Returns:
             dict: A dictionary containing the names of the tools as keys and the corresponding functions or objects as values.
-
-        Raises:
-            FileNotFoundError: If the specified module path does not exist.
+                  Returns an empty dict if the module cannot be loaded (path missing, loading blocked by PRAISONAI_ALLOW_LOCAL_TOOLS, or any other load error).
         """
-        spec = importlib.util.spec_from_file_location("tools_module", module_path)
-        module = importlib.util.module_from_spec(spec)
-        spec.loader.exec_module(module)
+        from ._safe_loader import load_user_module
+        module = load_user_module(module_path, name="tools_module")
+        if module is None:
+            return {}
         return {name: obj for name, obj in inspect.getmembers(module, self.is_function_or_decorated)}
     
     def _extract_tool_classes(self, module):
@@ -411,21 +412,13 @@ def _extract_tool_classes(self, module):
     
     def load_tools_from_module_class(self, module_path):
         """
-        Loads tools from a specified module path containing classes that inherit from BaseTool 
-        or are part of langchain_community.tools package.
+        Load BaseTool / langchain tool classes from a user-supplied module (gated by PRAISONAI_ALLOW_LOCAL_TOOLS).
         """
-        spec = importlib.util.spec_from_file_location("tools_module", module_path)
-        module = importlib.util.module_from_spec(spec)
-        try:
-            spec.loader.exec_module(module)
-            return {name: obj() for name, obj in inspect.getmembers(module, 
-                lambda x: inspect.isclass(x) and (
-                    x.__module__.startswith('langchain_community.tools') or 
-                    (PRAISONAI_TOOLS_AVAILABLE and BaseTool and issubclass(x, BaseTool))
-                ) and x is not BaseTool)}
-        except ImportError as e:
-            self.logger.warning(f"Error loading tools from {module_path}: {e}")
+        from ._safe_loader import load_user_module
+        module = load_user_module(module_path, name="tools_module")
+        if module is None:
             return {}
+        return self._extract_tool_classes(module)
 
     def load_tools_from_package(self, package_path):
         """
@@ -784,7 +777,11 @@ def _run_autogen(self, config, topic, tools_dict):
         result = "### Output ###\n" + response[-1].summary if hasattr(response[-1], 'summary') else ""
         
         if AGENTOPS_AVAILABLE:
-            agentops.end_session("Success")
+            import agentops
+            try:
+                agentops.end_session("Success")
+            except Exception as e:  # noqa: BLE001 -- agentops errors must not crash the caller
+                self.logger.warning(f"agentops.end_session failed: {e}")
             
         return result
 
@@ -1171,7 +1168,11 @@ def _run_crewai(self, config, topic, tools_dict):
         result = f"### Task Output ###\n{response}"
         
         if AGENTOPS_AVAILABLE:
-            agentops.end_session("Success")
+            import agentops
+            try:
+                agentops.end_session("Success")
+            except Exception as e:  # noqa: BLE001 -- agentops errors must not crash the caller
+                self.logger.warning(f"agentops.end_session failed: {e}")
             
         return result
 
@@ -1479,6 +1480,10 @@ def _run_praisonai(self, config, topic, tools_dict):
                     self.logger.error(f"Error stopping InteractiveRuntime: {e}")
         
         if AGENTOPS_AVAILABLE:
-            agentops.end_session("Success")
+            import agentops
+            try:
+                agentops.end_session("Success")
+            except Exception as e:  # noqa: BLE001 -- agentops errors must not crash the caller
+                self.logger.warning(f"agentops.end_session failed: {e}")
             
         return result

@@ -250,10 +250,21 @@ async def stop(self) -> bool:
             self.is_running = False
         
         logger.info("Async agent scheduler stopped")
-        logger.info(f"Execution stats - Total: {self._execution_count}, Success: {self._success_count}, Failed: {self._failure_count}")
+        
+        # Log final stats with consistent snapshot
+        if self._stats_lock is not None:
+            async with self._stats_lock:
+                total = self._execution_count
+                ok = self._success_count
+                fail = self._failure_count
+        else:
+            total = self._execution_count
+            ok = self._success_count
+            fail = self._failure_count
+        logger.info(f"Execution stats - Total: {total}, Success: {ok}, Failed: {fail}")
         return True
     
-    def get_stats(self) -> Dict[str, Any]:
+    async def get_stats(self) -> Dict[str, Any]:
         """
         Get current execution statistics (synchronous, best-effort).
         
@@ -264,12 +275,26 @@ def get_stats(self) -> Dict[str, Any]:
         Returns:
             Dictionary with execution stats
         """
+        # Primitives are created lazily in _ensure_async_primitives(); if not yet
+        # initialized there are no concurrent writers, so a direct read is safe.
+        if self._stats_lock is not None:
+            async with self._stats_lock:
+                total = self._execution_count
+                ok = self._success_count
+                fail = self._failure_count
+                running = self.is_running
+        else:
+            total = self._execution_count
+            ok = self._success_count
+            fail = self._failure_count
+            running = self.is_running
+            
         return {
-            "is_running": self.is_running,
-            "total_executions": self._execution_count,
-            "successful_executions": self._success_count,
-            "failed_executions": self._failure_count,
-            "success_rate": (self._success_count / self._execution_count * 100) if self._execution_count > 0 else 0
+            "is_running": running,
+            "total_executions": total,
+            "successful_executions": ok,
+            "failed_executions": fail,
+            "success_rate": (ok / total * 100) if total > 0 else 0
         }
     
     async def get_stats_async(self) -> Dict[str, Any]:
@@ -327,11 +352,8 @@ async def _run_schedule(self, interval: int, max_retries: int):
     
     async def _execute_with_retry(self, max_retries: int):
         """Execute agent with retry logic."""
-        # Ensure async primitives are available
-        if self._stats_lock is None:
-            self._ensure_async_primitives()
-        
-        # Atomically increment execution count
+        self._ensure_async_primitives()  # guarantees _stats_lock is bound to current loop
+
         async with self._stats_lock:
             self._execution_count += 1
         
@@ -344,7 +366,6 @@ async def _execute_with_retry(self, max_retries: int):
                 logger.info(f"Async agent execution successful on attempt {attempt + 1}")
                 logger.info(f"Result: {result}")
                 
-                # Atomically increment success count
                 async with self._stats_lock:
                     self._success_count += 1
                 safe_call(self.on_success, result)
@@ -359,7 +380,6 @@ async def _execute_with_retry(self, max_retries: int):
                     logger.info(f"Waiting {wait_time}s before async retry...")
                     await asyncio.sleep(wait_time)
         
-        # Atomically increment failure count
         async with self._stats_lock:
             self._failure_count += 1
         logger.error(f"Async agent execution failed after {max_retries} attempts")

@@ -170,7 +170,7 @@ async def test_stop_logs_non_cancelled_exception_from_cancelled_task(self):
         scheduler._ensure_async_primitives()
 
         # Simulate a task that raises a plain Exception when awaited after cancel
-        future = asyncio.get_event_loop().create_future()
+        future = asyncio.get_running_loop().create_future()
         future.set_exception(RuntimeError("task blew up"))
         scheduler._task = future
         scheduler._stop_event.set()
@@ -273,7 +273,7 @@ async def test_start_invalid_schedule_returns_false(self):
     @pytest.mark.asyncio
     async def test_get_stats_initial_state(self):
         scheduler = _make_scheduler()
-        stats = scheduler.get_stats()
+        stats = await scheduler.get_stats()
         assert stats["is_running"] is False
         assert stats["total_executions"] == 0
         assert stats["successful_executions"] == 0

@@ -0,0 +1,68 @@
+"""
+Linear Agent Example for PraisonAI.
+
+Demonstrates how to create a Linear bot that responds to issue mentions
+and assignments with full coding capabilities.
+"""
+
+import asyncio
+from praisonaiagents import Agent
+from praisonai.bots import LinearBot
+
+# Create an agent with Linear tools and coding capabilities
+agent = Agent(
+    name="PraisonAI Coder",
+    instructions="""
+    You are an autonomous coding agent integrated with Linear.
+    
+    When you are mentioned or assigned an issue:
+    1. Analyze the issue description and requirements
+    2. Break down complex tasks into smaller steps  
+    3. Use available tools to implement solutions
+    4. Update the issue with progress comments
+    5. Create GitHub pull requests when code changes are needed
+    
+    Focus on being helpful, thorough, and providing clear updates.
+    """,
+    llm="gpt-4o-mini",
+    tools=[
+        "linear_search_issues",
+        "linear_get_issue", 
+        "linear_add_comment",
+        "linear_update_issue",
+        "linear_list_teams",
+        "linear_list_issue_states",
+        "github_create_branch",
+        "github_commit_and_push", 
+        "github_create_pull_request",
+        "read_file",
+        "write_file",
+        "execute_command"
+    ],
+    memory=True,
+    web_search=True,
+    auto_approve_tools=True,
+)
+
+# Create Linear bot
+bot = LinearBot(
+    token="your-linear-oauth-token",  # or set LINEAR_OAUTH_TOKEN env var
+    signing_secret="your-webhook-secret",  # or set LINEAR_WEBHOOK_SECRET env var
+    agent=agent,
+    webhook_port=8080,
+)
+
+async def main():
+    """Start the Linear bot."""
+    print("Starting Linear bot...")
+    print("Set up your Linear webhook to point to: http://your-host:8080/webhook")
+    print("Configure AgentSession and Comment events in Linear webhook settings")
+    
+    try:
+        await bot.start()
+    except KeyboardInterrupt:
+        print("\nStopping bot...")
+        await bot.stop()
+
+if __name__ == "__main__":
+    asyncio.run(main())
\ No newline at end of file

@@ -0,0 +1,35 @@
+platform: linear
+token: ${LINEAR_OAUTH_TOKEN}
+signing_secret: ${LINEAR_WEBHOOK_SECRET}
+webhook_port: 8080
+
+agent:
+  name: "PraisonAI Coder"
+  instructions: |
+    You are an autonomous coding agent integrated with Linear.
+    
+    When you are mentioned or assigned an issue:
+    1. Analyze the issue description and requirements
+    2. Break down complex tasks into smaller steps
+    3. Use available tools to implement solutions
+    4. Update the issue with progress comments
+    5. Create GitHub pull requests when code changes are needed
+    
+    Focus on being helpful, thorough, and providing clear updates.
+  llm: gpt-4o-mini
+  tools:
+    - linear_search_issues
+    - linear_get_issue
+    - linear_add_comment
+    - linear_update_issue
+    - linear_list_teams
+    - linear_list_issue_states
+    - github_create_branch
+    - github_commit_and_push
+    - github_create_pull_request
+    - read_file
+    - write_file
+    - execute_command
+  memory: true
+  web_search: true
+  auto_approve_tools: true
\ No newline at end of file

@@ -45,6 +45,7 @@
     "discord": "DISCORD_BOT_TOKEN",
     "slack": "SLACK_BOT_TOKEN",
     "whatsapp": "WHATSAPP_ACCESS_TOKEN",
+    "linear": "LINEAR_OAUTH_TOKEN",
     "email": "EMAIL_APP_PASSWORD",
     "agentmail": "AGENTMAIL_API_KEY",
 }
@@ -53,6 +54,7 @@
 _EXTRA_ENV_MAP = {
     "slack": {"app_token": "SLACK_APP_TOKEN"},
     "whatsapp": {"phone_number_id": "WHATSAPP_PHONE_NUMBER_ID"},
+    "linear": {"signing_secret": "LINEAR_WEBHOOK_SECRET"},
     "email": {
         "email_address": "EMAIL_ADDRESS",
         "imap_server": "EMAIL_IMAP_SERVER",

@@ -12,6 +12,7 @@
     from .discord import DiscordBot
     from .slack import SlackBot
     from .whatsapp import WhatsAppBot
+    from .linear import LinearBot
     from .email import EmailBot
     from .agentmail import AgentMailBot
     from .bot import Bot
@@ -36,6 +37,9 @@ def __getattr__(name: str):
     if name == "WhatsAppBot":
         from .whatsapp import WhatsAppBot
         return WhatsAppBot
+    if name == "LinearBot":
+        from .linear import LinearBot
+        return LinearBot
     if name == "EmailBot":
         from .email import EmailBot
         return EmailBot
@@ -66,7 +70,7 @@ def __getattr__(name: str):
     raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
 
 __all__ = [
-    "TelegramBot", "DiscordBot", "SlackBot", "WhatsAppBot", "EmailBot", "AgentMailBot",
+    "TelegramBot", "DiscordBot", "SlackBot", "WhatsAppBot", "LinearBot", "EmailBot", "AgentMailBot",
     "Bot", "BotOS",
     "SlackApproval", "TelegramApproval", "DiscordApproval",
     "WebhookApproval", "HTTPApproval",

@@ -0,0 +1,534 @@
+"""
+Linear Bot implementation for PraisonAI.
+
+Supports Linear agent integration via AgentSession webhooks.
+
+Usage:
+    bot = LinearBot(token="linear-oauth-token", agent=agent, 
+                   signing_secret="webhook-secret")
+    await bot.start()
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import hmac
+import json
+import logging
+import os
+import time
+from typing import Any, Callable, Dict, List, Optional, TYPE_CHECKING, Union
+
+if TYPE_CHECKING:
+    from praisonaiagents import Agent
+
+from praisonai.bots._protocol_mixin import ChatCommandMixin, MessageHookMixin
+from praisonaiagents.bots import (
+    BotConfig,
+    BotMessage,
+    BotUser,
+    BotChannel,
+    MessageType,
+)
+
+from ._commands import format_status, format_help
+from ._session import BotSessionManager
+from ._rate_limit import RateLimiter
+from ._ack import AckReactor
+
+logger = logging.getLogger(__name__)
+
+# Linear GraphQL endpoint
+LINEAR_API_BASE = "https://api.linear.app/graphql"
+
+
+class LinearBot(ChatCommandMixin, MessageHookMixin):
+    """Linear bot runtime for PraisonAI agents.
+
+    Connects an agent to Linear via AgentSession webhooks, handling
+    mentions, assignments, and providing full bot functionality.
+
+    Example:
+        from praisonai.bots import LinearBot
+        from praisonaiagents import Agent
+
+        agent = Agent(name="assistant")
+        bot = LinearBot(
+            token="YOUR_OAUTH_TOKEN",
+            signing_secret="YOUR_WEBHOOK_SECRET",
+            agent=agent,
+        )
+
+        await bot.start()
+    """
+
+    def __init__(
+        self,
+        token: str = "",
+        agent: Optional["Agent"] = None,
+        config: Optional[BotConfig] = None,
+        signing_secret: str = "",
+        webhook_port: int = 8080,
+        webhook_path: str = "/webhook",
+        **kwargs,
+    ):
+        # Store extra kwargs for forward compatibility
+        self._extra_kwargs = kwargs
+        
+        # Determine token source for proper authorization format
+        self._oauth_token = token or os.environ.get("LINEAR_OAUTH_TOKEN", "")
+        self._api_key = os.environ.get("LINEAR_API_KEY", "") if not self._oauth_token else ""
+        self._token = self._oauth_token or self._api_key
+        self._is_oauth = bool(self._oauth_token)
+        self._agent = agent
+        self.config = config or BotConfig(token=self._token, mode="webhook")
+        self._signing_secret = signing_secret or os.environ.get("LINEAR_WEBHOOK_SECRET", "")
+        self._webhook_port = webhook_port
+        self._webhook_path = webhook_path
+
+        self._is_running = False
+        self._started_at: Optional[float] = None
+        self._bot_user: Optional[BotUser] = None
+        
+        try:
+            from praisonaiagents.session import get_default_session_store
+            _store = get_default_session_store()
+        except Exception:
+            _store = None
+            
+        self._session_mgr = BotSessionManager(
+            store=_store,
+            platform="linear",
+        )
+        self._message_handlers: List[Callable] = []
+        self._runner: Any = None
+        self._site: Any = None
+        self._http_session: Any = None
+        self._background_tasks: set = set()
+        self._rate_limiter = RateLimiter.for_platform("linear")
+        self._ack: AckReactor = AckReactor(
+            ack_emoji=self.config.ack_emoji,
+            done_emoji=self.config.done_emoji,
+        )
+
+        # ChatCommandMixin setup
+        self._command_handlers: Dict[str, Callable] = {}
+        self._command_info: Dict[str, Dict[str, Any]] = {}
+
+        # Register built-in commands
+        self._register_builtins()
+
+    def _register_builtins(self) -> None:
+        """Register built-in /status, /new, /help commands."""
+
+        async def _status(msg):
+            return format_status(self._agent, "linear", self._started_at, self._is_running)
+
+        async def _new(msg):
+            user_id = msg.sender.user_id if msg.sender else "unknown"
+            self._session_mgr.reset(user_id)
+            return "Session reset. Send a message to start a new conversation."
+
+        async def _help(msg):
+            extra = {
+                name: info.get("description", "")
+                for name, info in self._command_info.items()
+                if name not in ("status", "new", "help")
+            }
+            return format_help(self._agent, "linear", extra or None)
+
+        self.register_command("status", _status, description="Show bot status and info")
+        self.register_command("new", _new, description="Reset conversation session")
+        self.register_command("help", _help, description="Show this help message")
+
+    # ── Properties ──────────────────────────────────────────────────
+
+    @property
+    def is_running(self) -> bool:
+        return self._is_running
+
+    @property
+    def platform(self) -> str:
+        return "linear"
+
+    @property
+    def bot_user(self) -> Optional[BotUser]:
+        return self._bot_user
+
+    # ── Lifecycle ───────────────────────────────────────────────────
+
+    async def start(self) -> None:
+        """Start the Linear webhook server."""
+        if self._is_running:
+            return
+
+        if not self._token:
+            raise ValueError("LINEAR_OAUTH_TOKEN or LINEAR_API_KEY required")
+            
+        if not self._signing_secret:
+            logger.warning("LINEAR_WEBHOOK_SECRET not set - webhook signatures will not be verified")
+
+        logger.info(f"Starting Linear bot on port {self._webhook_port}")
+        
+        try:
+            import aiohttp
+            from aiohttp import web
+        except ImportError:
+            raise ImportError("aiohttp required: pip install aiohttp")
+
+        # Create HTTP session for API calls
+        self._http_session = aiohttp.ClientSession()
+
+        # Create webhook server
+        app = web.Application()
+        app.router.add_post(self._webhook_path, self._handle_webhook)
+        app.router.add_get(self._webhook_path, self._handle_webhook_verify)
+        
+        self._runner = web.AppRunner(app)
+        await self._runner.setup()
+        
+        self._site = web.TCPSite(self._runner, "0.0.0.0", self._webhook_port)
+        await self._site.start()
+
+        self._is_running = True
+        self._started_at = time.time()
+        
+        # Get bot user info
+        await self._fetch_bot_user()
+        
+        logger.info(f"Linear bot started on http://0.0.0.0:{self._webhook_port}{self._webhook_path}")
+
+    async def stop(self) -> None:
+        """Stop the Linear webhook server."""
+        if not self._is_running:
+            return
+
+        logger.info("Stopping Linear bot...")
+        
+        # Wait for background tasks to complete
+        if self._background_tasks:
+            logger.info(f"Waiting for {len(self._background_tasks)} background tasks...")
+            await asyncio.gather(*self._background_tasks, return_exceptions=True)
+
+        # Stop HTTP server
+        if self._site:
+            await self._site.stop()
+        if self._runner:
+            await self._runner.cleanup()
+            
+        # Close HTTP session
+        if self._http_session:
+            await self._http_session.close()
+
+        self._is_running = False
+        self._started_at = None
+        logger.info("Linear bot stopped")
+
+    # ── Webhook Handling ─────────────────────────────────────────────
+
+    async def _handle_webhook_verify(self, request) -> Any:
+        """Handle webhook verification (GET request)."""
+        from aiohttp import web
+        return web.Response(status=200, text="Linear webhook endpoint")
+
+    async def _handle_webhook(self, request) -> Any:
+        """Handle incoming Linear webhooks."""
+        from aiohttp import web
+        
+        try:
+            # Read raw body for signature verification
+            raw_body = await request.read()
+            
+            # Verify signature if secret is configured
+            if self._signing_secret:
+                signature = request.headers.get("Linear-Signature", "")
+                if not self._verify_signature(raw_body, signature):
+                    logger.warning("Invalid webhook signature")
+                    return web.Response(status=401, text="Invalid signature")
+            
+            # Parse JSON body
+            try:
+                body = json.loads(raw_body.decode('utf-8'))
+            except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                logger.error(f"Invalid JSON payload: {e}")
+                return web.Response(status=400, text="Invalid JSON")
+                
+            # Check timestamp for replay protection (Linear recommendation: 60s window)
+            webhook_timestamp = body.get("webhookTimestamp", 0)
+            if webhook_timestamp:
+                time_diff = abs(time.time() * 1000 - webhook_timestamp)
+                if time_diff > 60_000:  # 60 seconds in milliseconds
+                    logger.warning(f"Webhook timestamp too old: {time_diff}ms")
+                    return web.Response(status=401, text="Timestamp too old")
+            
+            # Get event type
+            event_type = request.headers.get("Linear-Event", "")
+            
+            # Process webhook in background to avoid blocking
+            task = asyncio.create_task(self._process_webhook(event_type, body))
+            self._background_tasks.add(task)
+            task.add_done_callback(self._background_tasks.discard)
+            
+            return web.Response(status=200, text="OK")
+            
+        except Exception as e:
+            logger.error(f"Webhook handling error: {e}")
+            return web.Response(status=500, text="Internal error")
+
+    def _verify_signature(self, body: bytes, signature: str) -> bool:
+        """Verify Linear webhook signature using HMAC-SHA256."""
+        if not self._signing_secret or not signature:
+            return False
+            
+        expected = hmac.new(
+            self._signing_secret.encode(),
+            body,
+            hashlib.sha256
+        ).hexdigest()
+        
+        return hmac.compare_digest(expected, signature)
+
+    async def _process_webhook(self, event_type: str, body: Dict[str, Any]) -> None:
+        """Process webhook events."""
+        try:
+            logger.debug(f"Processing {event_type} event")
+            
+            if event_type == "AgentSession":
+                await self._handle_agent_session(body)
+            elif event_type == "Comment":
+                await self._handle_comment(body)
+            elif event_type == "Issue":
+                await self._handle_issue(body)
+            else:
+                logger.debug(f"Ignoring {event_type} event")
+                
+        except Exception as e:
+            logger.error(f"Error processing {event_type} webhook: {e}")
+
+    async def _handle_agent_session(self, body: Dict[str, Any]) -> None:
+        """Handle AgentSession events (mentions, assignments)."""
+        action = body.get("action")
+        data = body.get("data", {})
+        
+        if action == "create":
+            # New agent session created (mention or assignment)
+            session_id = data.get("id")
+            issue_data = data.get("issue", {})
+            
+            if not session_id or not issue_data:
+                logger.warning("Missing session or issue data")
+                return
+                
+            # Create bot message from issue
+            issue_id = issue_data.get("id", "")
+            issue_title = issue_data.get("title", "")
+            issue_description = issue_data.get("description", "")
+            
+            message_text = f"Issue: {issue_title}"
+            if issue_description:
+                message_text += f"\n\n{issue_description}"
+                
+            bot_message = BotMessage(
+                message_id=session_id,
+                content=message_text,
+                message_type=MessageType.TEXT,
+                channel=BotChannel(channel_id=issue_id, name=f"Issue {issue_data.get('identifier', '')}"),
+                sender=BotUser(user_id="linear-system", display_name="Linear"),
+                timestamp=time.time(),
+                metadata={"issue": issue_data, "session_id": session_id}
+            )
+            
+            # Process with agent
+            await self._handle_agent_message(bot_message)
+
+    async def _handle_comment(self, body: Dict[str, Any]) -> None:
+        """Handle Comment events."""
+        # For future implementation - comment threads
+        logger.debug("Comment event received")
+
+    async def _handle_issue(self, body: Dict[str, Any]) -> None:
+        """Handle Issue events."""
+        # For future implementation - issue updates
+        logger.debug("Issue event received")
+
+    async def _handle_agent_message(self, message: BotMessage) -> None:
+        """Process message with the agent."""
+        if not self._agent:
+            logger.warning("No agent configured")
+            return
+
+        try:
+            user_id = message.sender.user_id if message.sender else "unknown"
+            session_id = message.metadata.get("session_id") if message.metadata else None
+
+            # Use BotSessionManager.chat() which handles history isolation and run_in_executor
+            response = await self._session_mgr.chat(self._agent, user_id, message.content)
+
+            # Send response back to Linear
+            if response and message.metadata:
+                await self._send_comment(
+                    issue_id=message.metadata.get("issue", {}).get("id", ""),
+                    comment=response,
+                    session_id=session_id,
+                )
+
+        except Exception as e:
+            logger.error(f"Error processing agent message: {e}")
+
+    # ── Linear API Methods ──────────────────────────────────────────
+
+    async def _fetch_bot_user(self) -> None:
+        """Fetch bot user information from Linear API."""
+        try:
+            query = """query {
+              viewer { id name email }
+            }"""
+            
+            data = await self._gql_query(query)
+            viewer = data.get("viewer", {})
+            
+            if viewer:
+                self._bot_user = BotUser(
+                    user_id=viewer.get("id", ""),
+                    display_name=viewer.get("name", "Linear Bot"),
+                    metadata=viewer
+                )
+                logger.info(f"Connected as: {self._bot_user.display_name}")
+            
+        except Exception as e:
+            logger.warning(f"Could not fetch bot user: {e}")
+
+    async def _send_comment(self, issue_id: str, comment: str, session_id: Optional[str] = None) -> None:
+        """Send a comment to a Linear issue."""
+        try:
+            mutation = """mutation($input: CommentCreateInput!) {
+              commentCreate(input: $input) {
+                success
+                comment { id url }
+              }
+            }"""
+            
+            variables = {
+                "input": {
+                    "issueId": issue_id,
+                    "body": comment
+                }
+            }
+            
+            data = await self._gql_query(mutation, variables)
+            
+            if data.get("commentCreate", {}).get("success"):
+                logger.info(f"Comment posted to issue {issue_id}")
+                
+                # Optionally update agent session status
+                if session_id:
+                    await self._update_agent_session(session_id, "response", comment)
+            else:
+                logger.error("Failed to post comment to Linear")
+                
+        except Exception as e:
+            logger.error(f"Error sending comment: {e}")
+
+    async def _update_agent_session(self, session_id: str, activity_type: str, content: str) -> None:
+        """Update agent session with activity."""
+        try:
+            mutation = """mutation($input: AgentActivityCreateInput!) {
+              agentActivityCreate(input: $input) {
+                success
+              }
+            }"""
+            
+            variables = {
+                "input": {
+                    "agentSessionId": session_id,
+                    "type": activity_type,
+                    "content": content
+                }
+            }
+            
+            await self._gql_query(mutation, variables)
+            
+        except Exception as e:
+            logger.debug(f"Could not update agent session: {e}")
+
+    async def _gql_query(self, query: str, variables: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+        """Execute GraphQL query against Linear API."""
+        if not self._http_session:
+            raise RuntimeError("HTTP session not initialized")
+            
+        # OAuth tokens require Bearer prefix, API keys are sent raw
+        auth_header = f"Bearer {self._token}" if self._is_oauth else self._token
+        headers = {
+            "Authorization": auth_header,
+            "Content-Type": "application/json"
+        }
+        
+        payload = {
+            "query": query,
+            "variables": variables or {}
+        }
+        
+        import aiohttp
+        async with self._http_session.post(
+            LINEAR_API_BASE,
+            headers=headers,
+            data=json.dumps(payload),
+            timeout=aiohttp.ClientTimeout(total=30),
+        ) as response:
+            data = await response.json()
+            
+            if "errors" in data:
+                raise RuntimeError(f"Linear API error: {data['errors']}")
+                
+            return data.get("data", {})
+
+    # ── Agent Integration ───────────────────────────────────────────
+
+    def set_agent(self, agent: "Agent") -> None:
+        """Set the agent that handles messages."""
+        self._agent = agent
+
+    def get_agent(self) -> Optional["Agent"]:
+        """Get the current agent."""
+        return self._agent
+
+    # ── Message Sending ─────────────────────────────────────────────
+
+    async def send_message(
+        self,
+        channel_id: str,
+        content: Union[str, Dict[str, Any]],
+        reply_to: Optional[str] = None,
+        thread_id: Optional[str] = None,
+        **kwargs
+    ) -> BotMessage:
+        """Send a message (comment) to a Linear issue."""
+        text = content if isinstance(content, str) else str(content)
+        try:
+            await self._send_comment(channel_id, text)
+            return BotMessage(
+                message_id=f"linear-{channel_id}-{int(time.time())}",
+                content=text,
+                message_type=MessageType.TEXT,
+                channel=BotChannel(channel_id=channel_id, name="Linear Issue"),
+                sender=self._bot_user or BotUser(user_id="linear-bot", display_name="Linear Bot"),
+                timestamp=time.time(),
+                reply_to=reply_to,
+                thread_id=thread_id,
+                metadata={"linear_channel": channel_id}
+            )
+        except Exception as e:
+            logger.error(f"Failed to send message: {e}")
+            # Return a failed message rather than None to maintain protocol
+            return BotMessage(
+                message_id=f"linear-failed-{int(time.time())}",
+                content=text,
+                message_type=MessageType.TEXT,
+                channel=BotChannel(channel_id=channel_id, name="Linear Issue"),
+                sender=self._bot_user or BotUser(user_id="linear-bot", display_name="Linear Bot"),
+                timestamp=time.time(),
+                reply_to=reply_to,
+                thread_id=thread_id,
+                metadata={"error": str(e), "linear_channel": channel_id}
+            )
\ No newline at end of file

@@ -15,6 +15,7 @@
     "discord": ("praisonai.bots.discord", "DiscordBot"),
     "slack": ("praisonai.bots.slack", "SlackBot"),
     "whatsapp": ("praisonai.bots.whatsapp", "WhatsAppBot"),
+    "linear": ("praisonai.bots.linear", "LinearBot"),
     "email": ("praisonai.bots.email", "EmailBot"),
     "agentmail": ("praisonai.bots.agentmail", "AgentMailBot"),
 }

@@ -363,6 +363,74 @@ def bot_whatsapp(
     )
 
 
+@app.command("linear")
+def bot_linear(
+    token: Optional[str] = typer.Option(None, "--token", "-t", help="Linear OAuth token", envvar="LINEAR_OAUTH_TOKEN"),
+    signing_secret: Optional[str] = typer.Option(None, "--signing-secret", help="Linear webhook signing secret", envvar="LINEAR_WEBHOOK_SECRET"),
+    port: int = typer.Option(8080, "--port", "-p", help="Webhook server port"),
+    agent: Optional[str] = typer.Option(None, "--agent", "-a", help="Agent YAML configuration file"),
+    model: Optional[str] = typer.Option(None, "--model", "-m", help="LLM model to use"),
+    browser: bool = typer.Option(False, "--browser", help="Enable browser control"),
+    browser_profile: str = typer.Option("default", "--browser-profile", help="Browser profile name"),
+    browser_headless: bool = typer.Option(False, "--browser-headless", help="Run browser headless"),
+    tools: Optional[List[str]] = typer.Option(None, "--tools", help="Tools to enable"),
+    skills: Optional[List[str]] = typer.Option(None, "--skills", help="Skills to enable"),
+    skills_dir: Optional[str] = typer.Option(None, "--skills-dir", help="Custom skills directory"),
+    memory: bool = typer.Option(False, "--memory", help="Enable memory"),
+    memory_provider: str = typer.Option("default", "--memory-provider", help="Memory provider"),
+    knowledge: bool = typer.Option(False, "--knowledge", help="Enable knowledge/RAG"),
+    knowledge_sources: Optional[List[str]] = typer.Option(None, "--knowledge-sources", help="Knowledge sources"),
+    web_search: bool = typer.Option(False, "--web", "--web-search", help="Enable web search"),
+    web_provider: str = typer.Option("duckduckgo", "--web-provider", help="Web search provider"),
+    sandbox: bool = typer.Option(False, "--sandbox", help="Enable sandbox mode"),
+    exec_enabled: bool = typer.Option(False, "--exec", help="Enable exec tool"),
+    auto_approve: bool = typer.Option(False, "--auto-approve", help="Auto-approve all tool executions"),
+    session_id: Optional[str] = typer.Option(None, "--session-id", help="Session ID"),
+    user_id: Optional[str] = typer.Option(None, "--user-id", help="User ID for memory isolation"),
+    thinking: Optional[str] = typer.Option(None, "--thinking", help="Thinking mode (off, minimal, low, medium, high)"),
+):
+    """Start a Linear bot with full agent capabilities.
+    
+    Handles Linear AgentSession webhooks for issue mentions and assignments.
+    
+    Examples:
+        praisonai bot linear --token $LINEAR_OAUTH_TOKEN --signing-secret $LINEAR_WEBHOOK_SECRET
+        praisonai bot linear --agent agents.yaml --memory --web --tools linear_tools
+    """
+    from ..features.bots_cli import BotHandler, BotCapabilities
+    
+    capabilities = BotCapabilities(
+        model=model,
+        browser=browser,
+        browser_profile=browser_profile,
+        browser_headless=browser_headless,
+        tools=tools or [],
+        skills=skills or [],
+        skills_dir=skills_dir,
+        memory=memory,
+        memory_provider=memory_provider,
+        knowledge=knowledge,
+        knowledge_sources=knowledge_sources or [],
+        web_search=web_search,
+        web_search_provider=web_provider,
+        sandbox=sandbox,
+        exec_enabled=exec_enabled,
+        auto_approve=auto_approve,
+        session_id=session_id,
+        user_id=user_id,
+        thinking=thinking,
+    )
+    
+    handler = BotHandler()
+    handler.start_linear(
+        token=token,
+        signing_secret=signing_secret,
+        webhook_port=port,
+        agent_file=agent,
+        capabilities=capabilities,
+    )
+
+
 @app.command("email")
 def bot_email(
     token: Optional[str] = typer.Option(None, "--token", "-t", help="Email app password", envvar="EMAIL_APP_PASSWORD"),
@@ -502,6 +570,7 @@ def bot_callback(ctx: typer.Context):
   [green]discord[/green]     Discord Bot API  
   [green]slack[/green]       Slack Socket Mode
   [green]whatsapp[/green]    WhatsApp Cloud API or Web mode (QR scan)
+  [green]linear[/green]      Linear AgentSession webhooks
   [green]email[/green]       Email via IMAP/SMTP
   [green]agentmail[/green]   AgentMail API (API-first email for AI agents)
 
@@ -531,6 +600,7 @@ def bot_callback(ctx: typer.Context):
   praisonai bot discord --tools DuckDuckGoTool --memory --model gpt-4o
   praisonai bot whatsapp --token $WHATSAPP_ACCESS_TOKEN --phone-id $WHATSAPP_PHONE_NUMBER_ID
   praisonai bot whatsapp --mode web
+  praisonai bot linear --token $LINEAR_OAUTH_TOKEN --signing-secret $LINEAR_WEBHOOK_SECRET
 """
         try:
             from rich import print as rprint

@@ -557,6 +557,74 @@ def start_whatsapp(
             except Exception:
                 pass  # neonize Go threads may already be gone
 
+    def start_linear(
+        self,
+        token: Optional[str] = None,
+        signing_secret: Optional[str] = None,
+        webhook_port: int = 8080,
+        agent_file: Optional[str] = None,
+        capabilities: Optional[BotCapabilities] = None,
+        agent_config_dict: Optional[Dict[str, Any]] = None,
+    ) -> None:
+        """Start a Linear bot.
+        
+        Args:
+            token: Linear OAuth token (or LINEAR_OAUTH_TOKEN env var)
+            signing_secret: Webhook signing secret (or LINEAR_WEBHOOK_SECRET env var)
+            webhook_port: Port for webhook server (default 8080)
+            agent_file: Optional path to agent configuration file
+            capabilities: Optional capabilities configuration
+            agent_config_dict: Optional agent config dict from bot YAML
+        """
+        self._load_dotenv()
+        
+        # Environment variable fallbacks
+        token = token or os.environ.get("LINEAR_OAUTH_TOKEN") or os.environ.get("LINEAR_API_KEY")
+        signing_secret = signing_secret or os.environ.get("LINEAR_WEBHOOK_SECRET", "")
+        
+        if not token:
+            print("Error: Linear token required")
+            print("Provide via --token or LINEAR_OAUTH_TOKEN environment variable")
+            print("For personal API key, set LINEAR_API_KEY instead")
+            return
+        
+        if not signing_secret:
+            print("Warning: LINEAR_WEBHOOK_SECRET not set - webhook signatures will not be verified")
+        
+        # Set auto-approve if enabled
+        if capabilities and capabilities.auto_approve:
+            os.environ["PRAISONAI_AUTO_APPROVE"] = "true"
+            logger.info("Auto-approve enabled for all tool executions")
+        
+        try:
+            from praisonai.bots import LinearBot
+        except ImportError as e:
+            print(f"Error: LinearBot import failed. {e}")
+            print("Install with: pip install aiohttp")
+            return
+        
+        agent = self._load_agent(agent_file, capabilities, agent_config_dict=agent_config_dict)
+        bot = LinearBot(
+            token=token,
+            agent=agent,
+            signing_secret=signing_secret,
+            webhook_port=webhook_port,
+        )
+        
+        self._print_startup_info("Linear", capabilities)
+        print(f"Webhook server on port {webhook_port}")
+        print(f"Webhook endpoint: http://0.0.0.0:{webhook_port}/webhook")
+        if signing_secret:
+            print("Webhook signature verification: enabled")
+        else:
+            print("Webhook signature verification: disabled (set LINEAR_WEBHOOK_SECRET)")
+        
+        try:
+            asyncio.run(bot.start())
+        except KeyboardInterrupt:
+            print("\nStopping bot...")
+            asyncio.run(bot.stop())
+
     def start_email(
         self,
         token: Optional[str] = None,

@@ -1694,6 +1694,16 @@ def _create_bot(
                 mode=wa_mode,
                 creds_dir=ch_cfg.get("creds_dir"),
             )
+        elif channel_type == "linear":
+            from praisonai.bots import LinearBot
+            linear_token = token or os.environ.get("LINEAR_OAUTH_TOKEN", "") or os.environ.get("LINEAR_API_KEY", "")
+            return LinearBot(
+                token=linear_token,
+                agent=agent,
+                config=config,
+                signing_secret=ch_cfg.get("signing_secret", "") or os.environ.get("LINEAR_WEBHOOK_SECRET", ""),
+                webhook_port=int(ch_cfg.get("webhook_port", 8080)),
+            )
         elif channel_type == "email":
             from praisonai.bots import EmailBot
             email_token = token or os.environ.get("EMAIL_APP_PASSWORD", "")
@@ -1736,8 +1746,8 @@ async def _run_bot_safe(self, name: str, bot: Any) -> None:
                 # Use the lower-level API instead.
                 if self._is_telegram_bot(bot):
                     await self._start_telegram_bot_polling(name, bot)
-                elif type(bot).__name__ == "WhatsAppBot":
-                    # WhatsApp runs its own aiohttp webhook server
+                elif type(bot).__name__ in ("WhatsAppBot", "LinearBot"):
+                    # WhatsApp/Linear run their own aiohttp webhook servers
                     self._inject_routing_handler(name, bot)
                     await bot.start()
                 else:

@@ -16,7 +16,7 @@ RUN mkdir -p /root/.praison
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.39" \
+    "praisonai>=4.6.40" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"
 

@@ -20,7 +20,7 @@ RUN mkdir -p /root/.praison
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.39" \
+    "praisonai>=4.6.40" \
     "praisonai[ui]" \
     "praisonai[chat]" \
     "praisonai[realtime]" \

@@ -16,7 +16,7 @@ RUN mkdir -p /root/.praison
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.39" \
+    "praisonai>=4.6.40" \
     "praisonai[ui]" \
     "praisonai[crewai]"
 

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "praisonaiagents"
-version = "1.6.39"
+version = "1.6.40"
 description = "Praison AI agents for completing complex tasks with Self Reflection Agents"
 readme = "README.md"
 requires-python = ">=3.10"

@@ -2992,7 +2992,7 @@ wheels = [
 
 [[package]]
 name = "praisonaiagents"
-version = "1.6.39"
+version = "1.6.40"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "praisonai-platform"
-version = "0.1.2"
+version = "0.1.4"
 description = "Platform layer for PraisonAI — workspace, auth, issues, projects"
 readme = "README.md"
 requires-python = ">=3.10"

@@ -1208,7 +1208,7 @@ wheels = [
 
 [[package]]
 name = "praisonai-platform"
-version = "0.1.2"
+version = "0.1.4"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },

@@ -57,7 +57,7 @@ def create_dockerfile(self):
             file.write("FROM python:3.11-slim\n")
             file.write("WORKDIR /app\n")
             file.write("COPY . .\n")
-            file.write("RUN pip install flask praisonai==4.6.39 gunicorn markdown\n")
+            file.write("RUN pip install flask praisonai==4.6.40 gunicorn markdown\n")
             file.write("EXPOSE 8080\n")
             file.write('CMD ["gunicorn", "-b", "0.0.0.0:8080", "api:app"]\n')
             

@@ -3,8 +3,8 @@ class Praisonai < Formula
   
     desc "AI tools for various AI applications"
     homepage "https://github.com/MervinPraison/PraisonAI"
-    url "https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.39.tar.gz"
-    sha256 `curl -sL https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.39.tar.gz | shasum -a 256`.split.first
+    url "https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.40.tar.gz"
+    sha256 `curl -sL https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.40.tar.gz | shasum -a 256`.split.first
     license "MIT"
   
     depends_on "python@3.11"

@@ -1 +1 @@
-__version__ = "4.6.39"
\ No newline at end of file
+__version__ = "4.6.40"
\ No newline at end of file

@@ -12,7 +12,7 @@ dependencies = [
     "rich>=13.7",
     "markdown>=3.5",
     "pyparsing>=3.0.0",
-    "praisonaiagents>=1.6.39",
+    "praisonaiagents>=1.6.40",
     "python-dotenv>=0.19.0",
     "litellm>=1.83.14,<2",
     "PyYAML>=6.0",

@@ -4841,7 +4841,7 @@ wheels = [
 
 [[package]]
 name = "praisonaiagents"
-version = "1.6.39"
+version = "1.6.40"
 source = { directory = "../praisonai-agents" }
 dependencies = [
     { name = "aiohttp" },

@@ -16,7 +16,7 @@ RUN mkdir -p /root/.praison
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.37" \
+    "praisonai>=4.6.38" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"
 

@@ -20,7 +20,7 @@ RUN mkdir -p /root/.praison
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.37" \
+    "praisonai>=4.6.38" \
     "praisonai[ui]" \
     "praisonai[chat]" \
     "praisonai[realtime]" \

@@ -16,7 +16,7 @@ RUN mkdir -p /root/.praison
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.37" \
+    "praisonai>=4.6.38" \
     "praisonai[ui]" \
     "praisonai[crewai]"
 

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "praisonaiagents"
-version = "1.6.37"
+version = "1.6.38"
 description = "Praison AI agents for completing complex tasks with Self Reflection Agents"
 readme = "README.md"
 requires-python = ">=3.10"

@@ -57,7 +57,7 @@ def create_dockerfile(self):
             file.write("FROM python:3.11-slim\n")
             file.write("WORKDIR /app\n")
             file.write("COPY . .\n")
-            file.write("RUN pip install flask praisonai==4.6.37 gunicorn markdown\n")
+            file.write("RUN pip install flask praisonai==4.6.38 gunicorn markdown\n")
             file.write("EXPOSE 8080\n")
             file.write('CMD ["gunicorn", "-b", "0.0.0.0:8080", "api:app"]\n')
             

@@ -3,8 +3,8 @@ class Praisonai < Formula
   
     desc "AI tools for various AI applications"
     homepage "https://github.com/MervinPraison/PraisonAI"
-    url "https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.37.tar.gz"
-    sha256 `curl -sL https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.37.tar.gz | shasum -a 256`.split.first
+    url "https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.38.tar.gz"
+    sha256 `curl -sL https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v4.6.38.tar.gz | shasum -a 256`.split.first
     license "MIT"
   
     depends_on "python@3.11"

@@ -1 +1 @@
-__version__ = "4.6.37"
\ No newline at end of file
+__version__ = "4.6.38"
\ No newline at end of file

@@ -12,9 +12,9 @@ dependencies = [
     "rich>=13.7",
     "markdown>=3.5",
     "pyparsing>=3.0.0",
-    "praisonaiagents>=1.6.37",
+    "praisonaiagents>=1.6.38",
     "python-dotenv>=0.19.0",
-    "litellm>=1.81.0,<=1.82.6",
+    "litellm>=1.83.14,<2",
     "PyYAML>=6.0",
     "mcp>=1.20.0",
     "typer>=0.9.0",

@@ -294,8 +294,35 @@ def search(query: str) -> str:
 
 @tool
 def calculate(expression: str) -> float:
-    """Evaluate a math expression."""
-    return eval(expression)
+    """Safely evaluate a numeric arithmetic expression."""
+    import ast
+    import operator
+    
+    # Define allowed operations
+    _OPS = {
+        ast.Add: operator.add,
+        ast.Sub: operator.sub,
+        ast.Mult: operator.mul,
+        ast.Div: operator.truediv,
+        ast.Pow: operator.pow,
+        ast.USub: operator.neg,
+        ast.UAdd: operator.pos,
+    }
+    
+    def _safe_eval(node):
+        if isinstance(node, ast.Constant) and isinstance(node.value, (int, float)):
+            return node.value
+        elif isinstance(node, ast.BinOp) and type(node.op) in _OPS:
+            return _OPS[type(node.op)](_safe_eval(node.left), _safe_eval(node.right))
+        elif isinstance(node, ast.UnaryOp) and type(node.op) in _OPS:
+            return _OPS[type(node.op)](_safe_eval(node.operand))
+        else:
+            raise ValueError("Unsupported expression")
+    
+    try:
+        return _safe_eval(ast.parse(expression, mode="eval").body)
+    except (ValueError, SyntaxError, TypeError, ZeroDivisionError, OverflowError):
+        raise ValueError("Invalid arithmetic expression")
 
 agent = Agent(
     instructions="You are a helpful assistant",
@@ -304,6 +331,7 @@ agent = Agent(
 agent.start("Search for AI news and calculate 15*4")
 ```
 
+> ⚠️ **Security Note:** Never use `eval()`, `exec()`, or `subprocess` in tool functions that process LLM-generated or user-supplied input. Always validate and sanitize inputs to prevent code injection attacks.
 > 📖 [Full tools docs](https://docs.praison.ai/docs/tools/tools) — BaseTool, tool packages, 100+ built-in tools
 
 ### 5. Persistence (Databases)
@@ -330,6 +358,15 @@ pip install "praisonai[claw]"
 praisonai claw
 ```
 
+#### Required Environment Variables
+
+Copy `.env.example` to `.env` and configure the following variables:
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `OPENAI_API_KEY` | Yes | OpenAI API key for all LLM calls |
+| `TAVILY_API_KEY` | Yes (Claw) | Tavily key for the built-in web-search tool. Get one free at https://app.tavily.com |
+
 Open **http://localhost:8082** — the dashboard comes with 13 built-in pages: Chat, Agents, Memory, Knowledge, Channels, Guardrails, Cron, and more. Add messaging channels directly from the UI.
 
 > 📖 [Full Claw docs](https://docs.praison.ai/docs/concepts/claw) — platform tokens, CLI options, Docker, and YAML agent mode