c2ac7d0440
* feat: support vertex as llm provider * fix * fix: add uv index-strategy to resolve dependency conflicts with pytorch index When using pytorch index for faster torch downloads in CI, filelock dependency resolution was failing because pytorch index only has older versions. Adding unsafe-best-match strategy allows uv to search all configured indexes. Also fix type checking warnings from ty. * fix: add index-strategy to root pyproject.toml for workspace-level uv resolution * chore: regenerate client SDKs after Vertex AI support
173 lines
5 KiB
TOML
173 lines
5 KiB
TOML
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project]
|
|
name = "hindsight-api"
|
|
version = "0.4.2"
|
|
description = "Hindsight: Agent Memory That Works Like Human Memory"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"asyncpg>=0.29.0",
|
|
"python-dotenv>=1.0.0",
|
|
"openai>=1.0.0",
|
|
"pydantic>=2.0.0",
|
|
"rich>=13.0.0",
|
|
"langchain-text-splitters>=0.3.0",
|
|
"fastapi[standard]>=0.120.3",
|
|
"uvicorn>=0.38.0",
|
|
"wsproto>=1.0.0",
|
|
"sqlalchemy>=2.0.44",
|
|
"alembic>=1.17.1",
|
|
"pgvector>=0.4.1",
|
|
"greenlet>=3.2.4",
|
|
"psycopg2-binary>=2.9.11",
|
|
"tiktoken>=0.12.0",
|
|
"httpx>=0.27.0",
|
|
"fastmcp>=2.14.0", # CVE-2025-66416
|
|
"pg0-embedded>=0.11.0",
|
|
"python-dateutil>=2.8.0",
|
|
"opentelemetry-api>=1.20.0",
|
|
"opentelemetry-sdk>=1.20.0",
|
|
"opentelemetry-instrumentation-fastapi>=0.41b0",
|
|
"opentelemetry-exporter-prometheus>=0.41b0",
|
|
"dateparser>=1.2.2",
|
|
"google-genai>=1.0.0",
|
|
"google-auth>=2.0.0",
|
|
"anthropic>=0.40.0",
|
|
"typer>=0.9.0",
|
|
"cohere>=5.0.0",
|
|
"flashrank>=0.2.0",
|
|
# Local ML models for embeddings/reranking - can be excluded in Docker with INCLUDE_LOCAL_MODELS=false
|
|
"sentence-transformers>=3.3.0",
|
|
"transformers>=4.53.0", # Security fixes for ReDoS vulnerabilities
|
|
"torch>=2.6.0", # CVE fix for remote code execution
|
|
"uvloop>=0.22.1",
|
|
# Transitive dependency security fixes
|
|
"pyasn1>=0.6.2", # DoS vulnerability fix
|
|
"urllib3>=2.6.3", # Decompression-bomb safeguards bypass fix
|
|
"langchain-core>=1.2.5", # Serialization injection vulnerability fix
|
|
"filelock>=3.20.1", # TOCTOU race condition fix
|
|
"authlib>=1.6.6", # Account takeover vulnerability fix
|
|
"aiohttp>=3.13.3", # Multiple DoS vulnerabilities
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
test = [
|
|
"pytest>=7.0.0",
|
|
"pytest-asyncio>=0.21.0",
|
|
"pytest-timeout>=2.4.0",
|
|
"pytest-xdist>=3.0.0",
|
|
"filelock>=3.20.1", # TOCTOU race condition fix
|
|
]
|
|
|
|
[project.scripts]
|
|
hindsight-api = "hindsight_api.main:main"
|
|
hindsight-worker = "hindsight_api.worker.main:main"
|
|
hindsight-local-mcp = "hindsight_api.mcp_local:main"
|
|
hindsight-admin = "hindsight_api.admin.cli:main"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["hindsight_api"]
|
|
|
|
[tool.hatch.build.targets.wheel.sources]
|
|
"hindsight_api" = "hindsight_api"
|
|
|
|
[tool.hatch.build.targets.sdist]
|
|
include = [
|
|
"hindsight_api/**/*",
|
|
]
|
|
|
|
[tool.hatch.build]
|
|
include = [
|
|
"hindsight_api/**/*.py",
|
|
"hindsight_api/alembic/**/*",
|
|
]
|
|
|
|
[tool.pytest.ini_options]
|
|
log_cli = true
|
|
log_cli_level = "INFO"
|
|
log_cli_format = "%(asctime)s - %(levelname)s - %(name)s - %(message)s"
|
|
log_cli_date_format = "%Y-%m-%d %H:%M:%S"
|
|
addopts = "--timeout 120 -n 8 --dist loadgroup --durations=10 -v"
|
|
asyncio_mode = "auto"
|
|
asyncio_default_fixture_loop_scope = "function"
|
|
log_auto_indent = true
|
|
filterwarnings = [
|
|
"ignore:The @wait_container_is_ready decorator is deprecated:DeprecationWarning",
|
|
"ignore::RuntimeWarning:asyncio",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"pytest>=9.0.0",
|
|
"pytest-asyncio>=1.3.0",
|
|
"pytest-timeout>=2.4.0",
|
|
"pytest-xdist>=3.8.0",
|
|
"python-dotenv>=1.2.1",
|
|
"filelock>=3.20.1", # TOCTOU race condition fix
|
|
"ruff>=0.8.0",
|
|
"ty>=0.0.1",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 120
|
|
target-version = "py311"
|
|
exclude = [
|
|
"tests/",
|
|
"**/tests/",
|
|
]
|
|
|
|
[tool.ruff.lint]
|
|
select = [
|
|
"E", # pycodestyle errors
|
|
"W", # pycodestyle warnings
|
|
"F", # Pyflakes
|
|
"I", # isort
|
|
]
|
|
ignore = [
|
|
"E501", # line too long (handled by formatter)
|
|
"E402", # module import not at top of file
|
|
"F401", # unused import (too noisy during development)
|
|
"F841", # unused variable (too noisy during development)
|
|
"F811", # redefined while unused
|
|
"F821", # undefined name (forward references in type hints)
|
|
]
|
|
|
|
[tool.ruff.lint.isort]
|
|
known-third-party = ["alembic"]
|
|
|
|
[tool.ruff.format]
|
|
quote-style = "double"
|
|
indent-style = "space"
|
|
|
|
[tool.uv]
|
|
# Allow uv to search all configured indexes for packages, not just the first one
|
|
# This prevents dependency resolution failures when using pytorch index + PyPI
|
|
index-strategy = "unsafe-best-match"
|
|
|
|
[tool.ty]
|
|
# Type checking configuration
|
|
# ty is an extremely fast Python type checker from Astral (same team as ruff/uv)
|
|
|
|
[tool.ty.environment]
|
|
python-version = "3.11"
|
|
|
|
[tool.ty.src]
|
|
exclude = [
|
|
"tests/",
|
|
"hindsight_api/alembic/",
|
|
]
|
|
|
|
[tool.ty.rules]
|
|
# Disable noisy rules while keeping important ones
|
|
invalid-argument-type = "ignore" # False positives with **kwargs patterns
|
|
invalid-return-type = "ignore" # Often intentional in async code
|
|
invalid-parameter-default = "ignore" # Optional params with None default
|
|
possibly-missing-attribute = "ignore" # Common with Optional types
|
|
invalid-raise = "ignore" # False positives with exception tracking
|
|
call-non-callable = "ignore" # False positives with Optional types
|
|
invalid-key = "ignore" # Pydantic ConfigDict not understood
|
|
invalid-method-override = "ignore" # Intentional signature differences
|
|
unresolved-reference = "ignore" # Forward references not always resolved
|