9 Commits

Include renames

Author	SHA1	Message	Date
João MouraandClaude Opus 5.5	0b84f8e18b	fix(core): send AMP requests through the proxy the environment names (#8186) ... * fix(core): send AMP requests through the proxy the environment names PlusAPI built its httpx clients with trust_env=False, so HTTP(S)_PROXY, NO_PROXY and SSL_CERT_FILE were ignored and every AMP call tried a direct connection. On a corporate network or inside a coding-agent sandbox (Claude Code, Codex), which only allow traffic through that proxy, deploy, eval, org, triggers, trace upload, skills and repository agents all failed with "[Errno 8] nodename nor servname provided", while `crewai login` (module-level httpx.post) worked. trust_env=False dates from #1455, when the client used requests, where it also stopped ~/.netrc credentials from replacing the AMP bearer token. httpx 0.28 no longer reads .netrc, so the flag now only disables proxy and CA-bundle variables. Remove it from the three clients (core request and multipart, and the CLI's multipart override). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(core): keep the direct-request proxy test off the OS proxy settings With no proxy variables set, httpx falls back to urllib's getproxies(), which reads the macOS or Windows system proxy settings. On a machine with a system proxy configured, the "no proxy variables" test would have routed through it. Model a machine with none configured. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): keep a project's .env from choosing how crewai eval sends the login crewai eval already refuses to send the saved login to an AMP host that only the project's .env names. With AMP requests now honoring proxy and CA variables, the same .env could still pick the route: its own proxy and its own CA bundle, past that check. eval and eval --models now leave *_proxy, SSL_CERT_FILE and SSL_CERT_DIR out when they load the project's .env, say so, and keep the machine's own settings (shell exports, OS proxy). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(core): take AMP's proxy and CA from the machine, not a project's .env AMP requests carry the saved login. Honoring HTTP(S)_PROXY and SSL_CERT_FILE from the live environment let a cloned project's .env choose both: `crewai run` on a JSON crew or a declarative flow loads it with override=True, and `crewai.llm` loads it again on import, which also undid the filter `crewai eval` applied to its own loader. PlusAPI now pins the proxy and CA variables when crewai_core.plus_api is first imported, which the CLI does at startup, and hands them to httpx explicitly with trust_env=False. With none set, the OS proxy settings apply, read live. The eval loader goes back to main's, since the client now covers every command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): pin AMP's proxy and CA in the JSON-crew runner too `crewai run` runs a JSON crew in a fresh `uv run python -c` interpreter that never imports cli.py, and `_run_json_crew` loads the project's .env with override=True before tracing first imports crewai_core.plus_api, so the pin recorded the project's proxy and CA. The runner now imports plus_api before anything else. Declarative flows re-run through `uv run crewai run`, which already pins in cli.py. Also keeps `_requests_sent_by` off machine and OS proxies, so a developer's proxy can't mount a real transport ahead of its MockTransport. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(core): keep urllib's CGI proxy rule, and surface a broken plus_api import The pinned proxy map dropped urllib's REQUEST_METHOD rule: in a CGI process an uppercase HTTP_PROXY can come from a client's Proxy header, and AMP's login and deployment ZIPs would follow it. REQUEST_METHOD is now pinned with the other transport variables, and the map is read exactly as urllib reads it. The JSON-crew runner skipped any ImportError from crewai_core.plus_api. It now skips only a crewai-core too old to have the module; any other failure stops the run with its own error instead of running with nothing pinned. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): import the proxy pin with the project folder off sys.path `python -c` puts the working directory, the project, first on sys.path, so a project folder named crewai_core could supply the module that pins where the saved login travels. The JSON-crew runner now imports the pin with the project off the path and restores the path right after, so project code (custom tools importing their neighbours) still finds its own modules. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(core): pin AMP's proxy and CA first thing in `import crewai` A crew run in its own process (`uv run run_crew`) never imports the CLI, so `import crewai` is where the pin happens there. It already preceded the project's .env, loaded by crewai.llm on import, but only by import order. The pin is now the first import in crewai/__init__.py, and a test runs a fresh interpreter in a project whose .env names a proxy and CA: the .env loads, and the pin still holds only what the machine set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): keep the machine's proxy and CA for the crew `crewai eval` runs `crewai eval` loads the project's .env into its own process and then runs the crew in a child that inherits that environment. The child pins what it inherits, so a .env naming HTTPS_PROXY and SSL_CERT_FILE became the run's machine transport, and that run's traces carry the saved login. The proxy and CA variables go back to the machine's pin right after the .env loads; the rest of the .env still applies, and the run loads the .env itself after its own pin, as under `crewai run`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(core): keep a project's UV_ENV_FILE out of the crew `crewai eval` runs `crewai eval` loads the project's .env and starts the crew with `uv run`. A .env naming itself as UV_ENV_FILE had uv load it into the run before Python started, so the run pinned the project's proxy and CA anyway. UV_ENV_FILE now counts among the variables restored to the machine's. The pin test starts the run through `uv run`, as the CLI does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 12:28:26 -03:00
João MouraandClaude Opus 5.5	1410318b2e	feat(cli): crewai eval export downloads an evaluation as files (#8187) ... * crewai eval export downloads an evaluation's full data as files A coding agent that is asked to act on an evaluation needs more than the brief: the report, every setup's outputs, every check with the judge's words, and the traces. AMP serves them as one export; this writes them into ./crewai-eval-<id>/ with a .gitignore of `*`, so customer data is never committed by accident. `crewai eval` becomes a group so the subcommand can live under it; every existing invocation is unchanged. The paths come from whichever AMP answered, so only plain relative paths that resolve inside the folder are written; the rest are skipped and counted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * A .gitignore link already in the export folder is replaced, never followed Writing through it would have put `*` into whatever file it points at, outside the folder. The tests also read the export as UTF-8, as it is written, so a Windows locale cannot misread its dashes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * The export writes through folder handles and refuses Windows device names A name Windows keeps for a device (CON, PRN, AUX, NUL, COM0-9, LPT0-9, with any extension) is skipped like any other unsafe path, on every platform: on Windows `NUL.md` is the null device, and the export would report a file written that nobody can read. On Linux and macOS each folder of a path is opened inside the one before it, never through a link, and the file inside the last: no path is checked and then opened again, so a link another process swaps in while the export runs is never gone through. A link where a folder goes skips that file; a link at a file's own place, symbolic or hard, is removed and the file made anew; the export folder itself being a link stops the export with one sentence. Windows keeps the resolved-path check. Reading an evaluation sends `can_export=1`, so the brief names `crewai eval export` only when the CLI, AMP and the evaluation service all serve it. An AMP without the export route (a 404 that is not AMP's `not_found`) says it needs an update; AMP's `export_unsupported` and `export_too_large` answers are printed in AMP's own words. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * A folder where an exported file goes is skipped; the path writer replaces hard links and refuses a junction - A folder already standing where an exported file goes is skipped and counted, as a file where a folder goes already was, instead of stopping the export. - On the path writer (Windows), whatever is at a file's place is removed and the file created anew. A hard link there is no longer written through. - The export folder must resolve to itself. A Windows junction, which `is_symlink` does not see, stops the export like a link. - The file handle is closed if wrapping it fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Say why a missing file is no error before the export makes it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * A folder where the export's .gitignore goes stops the export before any data The data never goes into the folder without the .gitignore that keeps it out of git. The Windows path writer's comment now states the race it leaves open, and why that loss is bounded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-18 22:46:13 -07:00
João MouraandClaude Opus 5.5	8dcb00584f	feat(cli): crewai deploy push --force, and why AMP held a push back (#8150) ... * feat(cli): crewai deploy push --force, and why AMP held a push back AMP now holds back a redeploy while a models comparison is running on the deployment (crewAIInc/crewai-plus#4776): a redeploy restarts the workers and the comparison loses its runs (pr_security_reviewer, 2026-10-14). It answers 409 {"error": "comparison_running", "message": ...}. - `crewai deploy push --force` goes ahead anyway: deploy_by_uuid / deploy_by_name send {"force": true} and update_crew_from_zip a force field (crewai-core and the CLI's own copy), only when asked — an unforced push sends exactly what it always did, and an older AMP ignores the field. - A push AMP held back prints AMP's sentence (which names --force) and "Nothing was deployed.", and exits 1 — not the bare error code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(llms): Claude 3.5 Sonnet v2 on Bedrock has a 200k window in the refreshed catalog The 1.15.28 release refreshed the packaged LiteLLM catalog, which now lists anthropic.claude-3-5-sonnet-20241022-v2:0 at 200,000 input tokens (it had 1,000,000), the model's documented window. The test still expected 1M, so every PR's test job failed on main's own catalog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): AMP's hold-back sentence is printed literally Review on #8150: the comparison_running message went through Rich markup, so a bracketed word in it vanished and a stray closing tag raised MarkupError before "Nothing was deployed." could print. It is printed with markup=False now; a test sends one with both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 09:58:28 -03:00
João MouraandClaude Opus 5.5	6b9e62180e	fix(core): give trigger list and payload requests a 60s timeout (#8081) ... `crewai triggers list` timed out on every real organization: the apps listing takes about 11s and these two calls fell back to httpx's 5s default. Other PlusAPI calls keep their current timeouts. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-12 18:55:48 +00:00
João MouraandClaude Opus 5.5	1b9bbccbed	feat(cli): crewai eval --models, and llm_overlay swaps models as well as roles (#7811) ... * feat(llm): llm_overlay maps models too, not only agent roles A key `model:<provider/model>` maps every LLM built from that model string inside the block, and `model:*` every LLM built from any model string. That reaches what a role cannot: a flow step's own `LLM(...).call()`. The key is read in `LLM.__new__` (and so `create_llm` and an agent's `llm="..."`), and on an agent's declared llm built outside the block; a role key still wins for that agent. The caller's settings follow the mapped model by the rule a declared llm's do. `MODEL_KEY_PREFIX` is public so another package can feature-detect the form. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(telemetry): allow-list cli_usage:eval_models attributes The span `crewai eval --models` records carries whether the caller was logged in, the models compared (provider/model names) and how many, in both telemetry classes. Nothing about the run, its output or the organization. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(cli): crewai eval --models compares models on the deployment `crewai eval --models "a,b"` (and `--deployment UUID` when AMP cannot tell the deployment from the project id) asks AMP for a models evaluation: the project id, the models from one comma-separated list (stripped, repeats dropped, provider/model required, 1-5) and the project's eval.jsonc. It needs the login, prints and opens the report link, says where the comparison is while it runs, then prints one row per model (goal, tasks, agents, tools, cost, time; the deployed one marked, the best per column starred) and the top three suggestions. Exit 0 when it finished, 1 when it failed or could not start. Everything from the wire is printed as Text. The comparison is counted as `cli_usage:eval_models` once AMP accepts it. Mode 1 now sends the project id with `create_evaluation` too, so every evaluation is filed under the project it is about. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(cli): crewai deploy create and push send the project id Every create (git or ZIP) and every push (redeploy by name or uuid, or a ZIP update) carries `[tool.crewai].project_id` when the project has one, so AMP knows which project a deployment runs and `crewai eval --models` can find it. The id is read, never minted: a deploy does not rewrite pyproject.toml. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): a model key maps an LLM whose declared SDK is not installed Nothing is built on the declared model, so a missing SDK for it is no reason to fail the mapped build; its credentials cannot be matched to the new provider, so none are carried. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(cli): crewai eval --models leaves its criteria behind as eval.jsonc When the comparison's answer carries `eval_config` and the project has no eval.jsonc, it is written through `write_eval_config` and the same one line Mode 1 prints says so. An existing file is never overwritten. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): a model key compares providers by provider, not by class `_same_route_provider` now follows `_same_provider`'s rule case for case: a LiteLLM-routed `LLM(...)` is on the same provider as a native route when its provider names that native class, so its key and endpoint follow a model key to another model of the same provider. Another provider still gets none. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(llm): say why mark_mapped may skip an object, and one import form in its tests Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(cli): usage stats name a compared model only when it is a public one `cli_usage:eval_models` carried the `--models` strings as typed, and those can identify a customer: a fine-tune id, an Azure deployment name, a self-hosted model or host. A model is now sent by name only when it is an exact entry of crewAI's model catalog (`LLM_CONTEXT_WINDOW_SIZES`), else as `<provider>/other`, and a provider crewAI does not route as `other/other`. An `ft:` id is never sent. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(cli): a refused comparison's test no longer keeps a None return Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(llms): re-importing OpenAI's completion module restores its package attribute `test_openai_completion_module_is_imported` deletes the module from sys.modules and lets `LLM(...)` import it again, which binds the new module on `crewai.llms.providers.openai` as well. monkeypatch restored only the sys.modules entry, so every later test on that worker saw two module objects for one name: `patch("crewai.llms.providers.openai.completion.X")` patched the attribute's module while `from ... import X` read sys.modules'. On Python 3.10 that made tests/llms/azure/test_azure_responses.py fail whenever it shared a worker with test_openai.py and test_crew_loader.py, which the new tests' even split now did. The attribute is restored too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): model keys strip only a model's own prefix; a role builds from the declaration Two review findings on the model-for-model overlay: - `overlay_model_for_model` took the text after the first slash as another name for the model, so an aggregator's route (`openrouter/openai/gpt-4o`) matched a `model:openai/gpt-4o` or `model:gpt-4o` key meant for the native model. A prefix is now stripped only when it is a native provider's own and what remains has no slash; an instance on an aggregator is compared as `<provider>/<its model id>`. - With a role key and a model key both active, the model key mapped the declared llm first and the role's model was built like that mapped instance, losing the caller's key and endpoint. The overlay now remembers what the caller declared for every llm it built, and a role key is built from that declaration. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(llm): model keys read a provider's other names; a LiteLLM choice survives a missing SDK - The router's provider aliases are now one table, `crewai.llm.PROVIDER_ALIASES`, and `llm_overlay` compares model names through it: `google/x` and `gemini/x` are one model whether the llm is built in the block or was built before it (a prebuilt instance records `gemini`). An exact key still wins, and an aggregator's route is still compared whole. - When the declared model's SDK is missing, a caller's explicit `is_litellm=True` is kept for the mapped model instead of dropping to a native route. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(deploy): a git create sends the project id once, at the top level AMP reads project_id at the top level on every deploy route, so the git create no longer repeats it inside `deploy`. The redeploy docstring records why its optional body is safe on an AMP that predates project ids. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-30 10:53:42 -07:00
João MouraandClaude Fable 5.1	0a3b8912b3	feat(cli): crewai eval evaluates the last traced run through AMP (#7649) ... * feat(cli): crewai eval evaluates the last traced run through AMP `crewai eval` reads `.crewai/last_run.json` — the record crewAI writes when a traced run's spans reach Wharf — and asks AMP to evaluate that run: POST /crewai_plus/api/v1/tracing/evaluations with the execution id, sending the saved `crewai login` when there is one and nothing otherwise. AMP answers with an evaluation id and a URL; the command prints the URL, opens it, waits for the verdict and prints it (goal gate and the four grades), exit 1 only when the evaluation itself failed. `--run EXECUTION_ID` evaluates another run. With no traced run recorded it offers to turn tracing on for the project (`CREWAI_TRACING_ENABLED=true` in .env, set_key so nothing else in the file moves) and run the crew now with `crewai run`; without a terminal, or declined, it prints the three steps instead. A run that leaves no record behind is explained, never guessed at. AMP's refusals are printed in its own words: a run that needs an account (401 account_required), a refused credential (then `crewai login`), a run AMP does not hold (404), rate limiting (429 with Retry-After), and any other status with AMP's message. The two AMP calls live on the CLI's PlusAPI subclass, so no crewai-core release is needed. Who may evaluate what is AMP's decision, not the command's: an anonymous run once without an account, then it needs one; a run traced while logged in for that organization's members; a deployment execution for members who may see its traces. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(cli): crewai eval — guard the project, survive AMP blips, name the right subject, read the whole record Review findings, each reproduced before the fix: - The run-it-now offer wrote CREWAI_TRACING_ENABLED into ./.env before checking the directory is a crewAI project, then run_crew() died on a missing pyproject.toml with a traceback. Now: no pyproject.toml → one sentence, exit 1, nothing written. - httpx errors (AMP unreachable, a timeout) surfaced as tracebacks. Now the start says "Could not reach AMP to start the evaluation: …"; while waiting, an unreachable AMP or a 5xx is retried up to POLL_RETRIES consecutive times, then reported with the URL — the evaluation keeps running server-side either way. - The POST now carries a 120 s timeout (AMP reads the run's spans inside it), the poll 30 s. - A 200 whose body has no known status (a non-dict, no status, a status outside queued/running/done/failed) polled forever. Now it stops with the status it saw and the URL. - A 404 without a JSON message read "AMP holds no run <evaluation id>" while polling. _refused takes "run <id>" / "evaluation <id>" and says "AMP answered 404 for <subject>" — AMP's own message still wins. - The record's amp_base_url was ignored; the CLI now evaluates the run at the AMP it was traced to. --run keeps the configured AMP. - The post-run explanation names the third cause: a crewai older than the version that records the last run. Tests for each, plus the previously untested paths: Ctrl-C exits 130, a 2xx without an id, a refusal mid-poll, DMN opens no browser, --run skips the offer. 51 passed in lib/cli/tests (eval + plus_api). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(cli): crewai eval — the credential goes only to the configured AMP; an explicit yes before running the crew; a done answer needs a well-formed verdict Review findings (CodeRabbit, the PR gate): - The record's amp_base_url was handed to PlusAPI beside the saved login, so a modified .crewai/last_run.json could send the token to any origin. The client is now built from the configured AMP only (CREWAI_PLUS_URL, the saved settings, app.crewai.com); the project's .env is loaded first, as `crewai run` loads it, so the configured AMP is the one the run was traced to. A record naming another address gets a one-line note and no credential. - The offer to turn tracing on and run the crew defaults to no and says the .env change stays; Enter no longer spends a crew run. - A `done` answer whose verdict is missing or malformed (no gate, grades not an object, a grade not an int or null) is a protocol error, exit 1, instead of an INCONCLUSIVE line with exit 0 or an AttributeError. Tests for each: a foreign origin in the record with a saved token, the .env-loaded same-AMP case, seven malformed verdicts, the prompt's text and default. 59 passed (eval + plus_api); ruff and mypy clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(cli): crewai eval — Enter accepts the offer to run the crew (y/n, Y default; the prompt names both effects) João's call (2026-09-20): the confirm is y/n with Y as the default. The prompt still says tracing stays on in .env and that the crew runs now. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-21 18:34:04 +00:00
Vinicius Brasil	2b90117e88	Add repository agents to flow definitions (#6437) ... Inline agent and crew actions can now use repository-backed agents without duplicating role, goal, and backstory in each definition. Examples: * `agent.with.from_repository: support_specialist` * `crew.with.agents.researcher.from_repository: researcher` `PlusAPI.get_agent` now uses the shared synchronous request path so project loaders can fetch repository agents without nested event loops.	2026-07-02 14:28:01 -07:00
João Moura	53c2284484	Support ZIP deployment fallback and JSON crew project env runs (#6166) ... * Update crewAI CLI with various enhancements and fixes - Updated `create_json_crew.py` to require `crewai[tools]>=1.14.7`. - Enhanced `git.py` with improved repository initialization, including automatic initial commit creation and exclusion patterns for initial commits. - Modified `install_crew.py` to allow error handling during installation with an optional `raise_on_error` parameter. - Expanded `plus_api.py` to include methods for creating and updating crews from ZIP files. - Introduced a new `archive.py` for creating deployable ZIP archives of CrewAI projects, ensuring local artifacts are excluded. - Updated `run_crew.py` to manage JSON crew dependencies and run crews in the project's environment. - Enhanced deployment logic in `main.py` to handle ZIP uploads and improve user feedback during deployment processes. - Added tests for new functionalities and ensured existing tests reflect recent changes in behavior and requirements. * fix(cli): address deploy zip review feedback * fix(cli): sync missing lockfile before deploy * fix(cli): preserve remote deploy on git setup warnings * test(cli): use single deploy main import style * fix(cli): skip project install for json crew sync * fix(cli): load json runner from source checkout * fix(cli): skip json crew sync when locked * fix(cli): address deploy zip review feedback * fix(cli): pass env on zip redeploy * fix(cli): harden json run and zip fallback * fix(cli): validate before deploy lock install * fix(cli): respect poetry lock for json runs * fix(cli): align json zip wrapper detection * fix(deps): bump starlette audit floor * fix(cli): avoid auth retry for deploy exits * fix(cli): update json zip script entrypoints	2026-06-15 18:46:54 -03:00
Greyson LaLonde	93e786d263	refactor: extract CLI into standalone crewai-cli package	2026-05-06 20:46:46 +08:00