software-agent-sdk/pyproject.toml at main · OpenHands/software-agent-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
# UV workspace configuration
[tool.uv.workspace]
members = ["openhands-sdk", "openhands-tools", "openhands-workspace", "openhands-agent-server"]

# Security: Apply workspace-wide dependency guardrails.
[tool.uv]
exclude-newer = "7 days"  # Avoid packages uploaded in the last 7 days.
exclude-newer-package = { litellm = "2026-07-20T00:00:00Z", lmnr = "2026-08-23T00:00:00Z" }  # lmnr: allow 0.7.60 streaming-token fix through the 7-day guardrail
constraint-dependencies = [
    "nodejs-wheel-binaries>=24,<25",
    "starlette>=0.49.1",
    "aiohttp>=3.13.3",
    "urllib3>=2.8.0",
    "protobuf>=6.33.5",
    "pillow>=12.3.0",
    "orjson>=3.11.7",
    "rich>=14.3.3", # Version 14.3.2 essentially has a denial-of-service vulnerability which is outlined in https://github.com/Textualize/rich/issues/3958
    "lupa>=2.8",
    "cryptography<49; sys_platform == 'darwin' and platform_machine == 'x86_64'",  # 49.0.0 dropped x86_64 macOS wheels; release-binaries.yml still builds on macos-15-intel
    "litellm==1.93.0",  # Workspace lock target for the requested LiteLLM upgrade
    "anyio>=4.14.2",
    "pyjwt>=2.14.0",
]

# Workspace sources for intra-repo dependencies
[tool.uv.sources]
openhands-sdk = { workspace = true }
openhands-tools = { workspace = true }
openhands-workspace = { workspace = true }
openhands-agent-server = { workspace = true }

[dependency-groups]
dev = [
    "pre-commit>=4.3.0",
    "packaging>=26.3",
    "pillow>=12.3.0",
    "psutil>=7.2.2",
    "pyright[nodejs]>=1.1.405",
    "pytest>=9.0.3",
    "pytest-cov>=5.0.0",
    "ruff>=0.12.10",
    "pycodestyle>=2.12.0",
    "pytest-asyncio>=1.1.0",
    "pytest-forked>=1.6.0",
    "pytest-xdist>=3.6.0",
    "tabulate>=0.9.0",
    "pyinstaller>=6.22.2",
    "streamlit>=1.49.1",
    "pytest-timeout>=2.4.0",
    "griffe[pypi]>=2.3.0",
]

# Ruff configuration
[tool.ruff]
target-version = "py313"
line-length = 88

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

[tool.ruff.lint]
select = [
    "E",    # pycodestyle errors
    "F",    # pyflakes (includes F841: unused-variable)
    "I",    # isort
    "UP",   # pyupgrade
    "ARG",  # flake8-unused-arguments
]
# Enforce rules that catch mutable defaults and related pitfalls
# - B006: mutable-argument-default
# - B008: function-call-in-default-argument
# - B039: mutable-contextvar-default
# - RUF012: mutable-class-default
extend-select = ["B006", "B008", "B039", "RUF012"]

[tool.ruff.lint.per-file-ignores]
# Test files often have unused arguments (fixtures, mocks, interface implementations)
"tests/**/*.py" = ["ARG"]


# Allowlist safe default calls for flake8-bugbear rules (e.g., FastAPI Depends)
[tool.ruff.lint.flake8-bugbear]
extend-immutable-calls = [
    "fastapi.Depends",
    "fastapi.params.Depends",
]

[tool.ruff.lint.isort]
known-first-party = ["openhands"]
combine-as-imports = true
force-single-line = false
lines-after-imports = 2

# Pytest configuration
[tool.pytest.ini_options]
testpaths = [
    "tests"
]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
addopts = "-v --tb=short -m 'not stress and not acp_live and not docker_live'"
asyncio_mode = "auto"
markers = [
    "stress: stress / scale tests, deselected by default. Run with `pytest -m stress` (see tests/agent_server/stress/__init__.py for details).",
    "acp_live: live ACP conformance/pin-installability tests that launch real npx subprocesses and hit the npm registry, deselected by default. Run with `pytest -m acp_live` (see tests/sdk/agent/test_acp_conformance.py).",
    "docker_live: scenarios against a real Docker daemon and agent-server image, deselected by default. Run with `pytest -m docker_live` (see tests/agent_server/docker_runtime/STORAGE_SCENARIO.md).",
]

# Pyright configuration for PEP 420 namespace packages
# This is needed for VSCode to properly resolve imports across multiple packages in the monorepo
[tool.pyright]
include = [
    "openhands-sdk",
    "openhands-tools",
    "openhands-workspace",
    "openhands-agent-server",
    "examples",
    "tests",
    "scripts"
]
extraPaths = [
    "openhands-sdk",
    "openhands-tools",
    "openhands-workspace",
    "openhands-agent-server"
]
venvPath = "."
venv = ".venv"
pythonVersion = "3.13"
useLibraryCodeForTypes = true
typeCheckingMode = "standard"

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true