pyproject.toml
Rama main · réplica de lectura del repositorio original.
[project]
name = "skyvern"
version = "1.0.57"
description = ""
authors = [{ name = "Skyvern AI", email = "info@skyvern.com" }]
requires-python = ">=3.11,<3.15"
readme = "README.md"
dependencies = [
"python-dotenv>=1.0.0,<2",
"pydantic>=2.13.4,<3",
"pydantic-settings>=2.15.0,<3",
"cachetools>=5.3.2,<6",
"orjson>=3.12.0,<4",
"structlog>=23.2.0,<24",
"typer>=0.16.0,<0.26",
"click>=8.4.2,<9",
"httpx[socks]>=0.27.0",
"rich>=13.7.0,<14",
]
[project.optional-dependencies]
# Embedded local mode is currently a Forge-backed compatibility bridge. It is
# smaller than the full server install because it excludes backend process,
# Postgres, MCP server, and cloud product packages, but it is not a minimal
# browser-only runtime until local stops importing Forge internals.
local = [
"azure-storage-blob>=12.30.0",
"google-cloud-storage>=3.13.1,<4",
"openai>=1.68.2",
"sqlalchemy>=2.0.29,<3",
"aiohttp>=3.14.3,<4",
"python-multipart>=0.0.30,<1",
"toml>=0.10.2,<0.11",
"jinja2>=3.1.6,<4",
"litellm>=1.85.0",
"playwright==1.61.0",
"greenlet>=3.1.1",
"pillow>=13.0.0",
"starlette-context>=0.3.6,<0.6",
"fastapi>=0.136.1,<0.137",
"alembic>=1.19.1,<2",
"PyJWT[crypto]>=2.15.1,<3",
"aioboto3>=14.3.0,<15",
"asyncssh>=2.14.2,<3",
"asyncache>=0.3.1,<0.4",
"filetype>=1.2.0,<2",
"fuzzysearch>=0.8,<1",
"tldextract>=5.3.2,<6",
"websockets>=14.0,<15.1",
"email-validator>=2.2.0,<3",
"requests-toolbelt>=1.0.0,<2",
"aiofiles>=24.1.0,<25",
"pyotp>=2.9.0,<3",
"json5>=0.15.0,<1",
"json-repair>=0.63.2,<0.64",
"pypdf>=6.21.1,<7",
"pdfplumber>=0.11.10,<0.12",
"beautifulsoup4>=4.14.3,<5",
"psutil>=7.0.0",
"tiktoken>=0.13.0",
"anthropic>=0.122.0,<0.123",
"google-cloud-aiplatform>=1.164.0,<2",
"google-auth>=2.56.3,<3",
"google-auth-oauthlib>=1.4.0,<2",
"onepassword-sdk==0.4.1",
"lark>=1.2.2,<2",
"libcst>=1.9.0,<2",
"curlparser>=0.1.0,<0.2",
"pandas>=3.0.5,<4",
"pyarrow>=18.0.0,<24",
"azure-identity>=1.24.0,<2",
"azure-keyvault-secrets>=4.11.1,<5",
"google-cloud-secret-manager>=2.30.0,<3",
"jsonschema>=4.23.0",
"python-calamine>=0.8.2",
"python-docx>=1.1.0",
"urllib3>=2.8.0",
"zstandard>=0.25.0",
"sse-starlette>=3.4.8,<4",
"opentelemetry-api>=1.45.1,<2",
"croniter>=1.3.8,<4",
"authlib>=1.7.2",
"pyasn1>=0.6.4",
"tornado>=6.5.10",
"cryptography>=48.0.1",
"starlette>=1.3.1",
"aiosqlite>=0.21.0,<0.23",
]
# Server is intentionally a superset of local. Keep shared runtime deps in sync
# with local until the embedded runtime is separated from Forge/server internals.
server = [
"azure-storage-blob>=12.30.0",
"google-cloud-storage>=3.13.1,<4",
"openai>=1.68.2",
# The server imports Copilot at startup, and Copilot uses names added after 0.14 (run error handlers).
"openai-agents>=0.19.4,<0.20",
"python-dotenv==1.2.2",
"sqlalchemy[mypy]>=2.0.29,<3",
"aiohttp>=3.14.3,<4",
"python-multipart>=0.0.30,<1",
"toml>=0.10.2,<0.11",
"jinja2>=3.1.6,<4",
"uvicorn[standard]>=0.44.0",
"litellm>=1.85.0",
"playwright==1.61.0",
"greenlet>=3.1.1",
"pillow>=13.0.0",
"starlette-context>=0.3.6,<0.6",
"fastapi>=0.136.1,<0.137",
"psycopg[binary, pool]>=3.2.10,<3.3.0",
"alembic>=1.19.1,<2",
"PyJWT[crypto]>=2.15.1,<3",
"aioboto3>=14.3.0,<15",
"asyncssh>=2.14.2,<3",
"asyncache>=0.3.1,<0.4",
"types-toml>=0.10.8.7,<0.11",
"filetype>=1.2.0,<2",
"fuzzysearch>=0.8,<1",
"aioredlock>=0.7.3,<0.8",
"tldextract>=5.3.2,<6",
"websockets>=14.0,<15.1",
"email-validator>=2.2.0,<3",
"requests-toolbelt>=1.0.0,<2",
"posthog>=3.7.0,<4",
"aiofiles>=24.1.0,<25",
"pyotp>=2.9.0,<3",
"asyncpg>=0.30.0,<0.32",
"json5>=0.15.0,<1",
"json-repair>=0.63.2,<0.64",
"pypdf>=6.21.1,<7",
"pdfplumber>=0.11.10,<0.12",
"beautifulsoup4>=4.14.3,<5",
# <3.4: 3.4.3 enables HostOriginGuardMiddleware by default (421 on public hosts, SKY-12003).
# cloud_app passes allowed_hosts/allowed_origins when supported; validate against 3.4.x before raising.
"fastmcp>=3.4.7,<3.5",
"psutil>=7.0.0",
"tiktoken>=0.13.0",
"anthropic>=0.122.0,<0.123",
"google-cloud-aiplatform>=1.164.0,<2",
"google-auth>=2.56.3,<3",
"google-auth-oauthlib>=1.4.0,<2",
"onepassword-sdk==0.4.1",
"types-boto3[full]>=1.38.31,<2",
"lark>=1.2.2,<2",
"libcst>=1.9.0,<2",
"curlparser>=0.1.0,<0.2",
"pandas>=3.0.5,<4",
"pyarrow>=18.0.0,<24",
"azure-identity>=1.24.0,<2",
"azure-keyvault-secrets>=4.11.1,<5",
"google-cloud-secret-manager>=2.30.0,<3",
"jsonschema>=4.23.0",
"python-calamine>=0.8.2",
"python-docx>=1.1.0",
"urllib3>=2.8.0",
"zstandard>=0.25.0",
"sse-starlette>=3.4.8,<4",
"opentelemetry-api>=1.45.1,<2",
"croniter>=1.3.8,<4",
"authlib>=1.7.2",
"pyasn1>=0.6.4",
"tornado>=6.5.10",
"cryptography>=48.0.1",
"starlette>=1.3.1",
"aiosqlite>=0.21.0,<0.23",
]
[dependency-groups]
cloud = [
# Remote-browser vendor SDKs used only by cloud-side factories.
"browser-use-sdk>=3.11.0,<4",
"anchorbrowser>=0.11,<0.12",
"openai-agents>=0.19.4,<0.20",
"stripe>=15.5.0,<16",
"temporalio[opentelemetry]>=1.6.0,<2",
"temporalio>=1.6.0,<2",
"redis>=5.0.3,<6",
"pyrate-limiter>=3.7.0,<4",
"opentelemetry-exporter-otlp-proto-grpc>=1.41.1,<2",
"opentelemetry-exporter-otlp-proto-http>=1.41.1,<2",
"kr8s>=0.20.14,<1",
# OpenTelemetry instrumentation
"opentelemetry-distro>=0.60b1,<1",
"opentelemetry-instrumentation-fastapi>=0.60b1,<1",
"opentelemetry-instrumentation-asyncpg>=0.60b1,<1",
"opentelemetry-instrumentation-sqlalchemy>=0.60b1,<1",
"opentelemetry-instrumentation-redis>=0.60b1,<1",
"opentelemetry-instrumentation-httpx>=0.60b1,<1",
"opentelemetry-instrumentation-aiohttp-client>=0.60b1,<1",
"opentelemetry-instrumentation-logging>=0.60b1,<1",
"opentelemetry-instrumentation-asyncio>=0.60b1,<1",
"opentelemetry-instrumentation-botocore>=0.60b1,<1",
"opentelemetry-instrumentation-grpc>=0.60b1,<1",
"opentelemetry-instrumentation-requests>=0.60b1,<1",
"opentelemetry-instrumentation-urllib3>=0.60b1,<1",
"guarddog>=3.0.2,<3.1",
"xlsxwriter>=3.2.9,<4",
"fpdf2>=2.8.8,<3",
]
dev = [
"grpcio-tools==1.80.0",
"isort>=5.13.2",
"mypy>=1.18.2,<2",
"types-requests>=2.31.0.2,<3",
"pytest>=9.1.1,<10",
"pytest-asyncio>=0.21.1,<0.22",
"pytest-split>=0.10.0,<1",
# Needed by tests/unit/test_llm_handler_tracing.py which exercises the LLM
# chokepoint's OTEL instrumentation. Cloud runtime also uses this via
# cloud/observability/, but that ships via the `cloud` group's transitive
# closure (opentelemetry-distro, instrumentation-*). Placing it here keeps
# the test collectable in OSS envs, which only sync the `dev` group.
"opentelemetry-sdk>=1.39.0,<2",
"autoflake>=2.2.0,<3",
"pydevd-pycharm>=233.6745.319,<234",
"ipython>=8.17.2,<9",
"ipykernel>=7.3.0,<8",
"notebook>=7.6.3,<8",
"freezegun>=1.2.2,<2",
"twine>=6.1.0,<7",
"build>=1.5.0,<2",
# 4.6.1+ installs language:node hooks via git, which CI's npm 11 rejects (EALLOWGIT)
"pre-commit>=4.6.0,<4.6.1",
"ruff>=0.16.3,<0.17",
"aiosqlite>=0.21.0,<0.23",
"moto[s3, server]>=5.1.5,<6",
"curlify>=3.0.0",
"openpyxl>=3.1.0",
"gspread>=6",
"python-pptx>=1.0.2",
"pyinstrument>=5.1.3",
"pip-audit>=2.10.1",
"import-linter>=2.5,<3",
]
# Non-default group: rustwright never enters the default/server/local/cloud/dev
# install sets. `uv export --no-default-groups --group rustwright` is an isolation probe;
# the shared worker image resolves it via `uv export --extra server --group cloud --group rustwright --no-dev`.
rustwright = [
"rustwright==0.2.0",
]
[tool.hatch.build]
packages = ["skyvern"]
[tool.hatch.build.targets.sdist]
include = [
"skyvern",
"alembic",
]
exclude = [
"skyvern-frontend/.env",
"skyvern-frontend/.env.*",
"skyvern-frontend/node_modules",
"skyvern-frontend/dist",
]
[tool.hatch.build.targets.sdist.force-include]
"alembic" = "alembic"
[tool.hatch.build.targets.wheel]
include = [
"skyvern",
]
[tool.hatch.build.targets.wheel.force-include]
"alembic" = "alembic"
[tool.uv]
# Supply chain quarantine: block packages published less than 7 days ago.
# Override for urgent cases: uv add <pkg> --exclude-newer ""
# exclude-newer = "7 days"
override-dependencies = [
# litellm 1.83.7+ pins these exactly; relax so they coexist with our deps
# (fastmcp needs python-dotenv>=1.1).
"jsonschema>=4.23.0",
"python-dotenv>=1.0.0",
# An override replaces every package's openai requirement, the SDK's and LiteLLM's
# included, so it carries openai-agents 0.19's floor and LiteLLM's <3 cap itself.
"openai>=2.45.0,<3",
# litellm exact-pins aiohttp; relax so the security-patched
# 3.14.x resolves for cloud/source installs (plain pip keeps litellm's pin).
"aiohttp>=3.14.0",
]
constraint-dependencies = [
"authlib>=1.7.2",
"cryptography>=48.0.1",
"flask>=3.1.3",
"fsspec>=2026.6.0",
"idna>=3.15",
"joserfc>=1.6.8",
"jupyter-server>=2.21.0",
"mako>=1.4.2",
"mistune>=3.2.1",
"msgpack>=1.2.1",
"multidict>=6.9.1",
"pyasn1>=0.6.4",
"starlette>=1.3.1",
"tornado>=6.5.10",
"virtualenv>=21.7.13",
"werkzeug>=3.1.9",
]
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
[tool.ruff]
exclude = [
# vendored third-party judge, kept byte-identical to upstream on purpose
"scripts/benchmark/evaluators/_odysseys_upstream_full_traj.py",
".bzr",
".direnv",
".eggs",
".git",
".git-rewrite",
".hg",
".ipynb_checkpoints",
".mypy_cache",
".nox",
".pants.d",
".pyenv",
".pytest_cache",
".pytype",
".ruff_cache",
".svn",
".tox",
".venv",
".vscode",
"__pypackages__",
"_build",
"buck-out",
"build",
"dist",
"node_modules",
"site-packages",
"venv",
"alembic/env.py",
"cloud/extensions",
"skyvern-frontend",
"skyvern/client",
"codeblock/proto",
"notebooks",
"internal",
]
line-length = 120
target-version = "py311"
[tool.ruff.lint]
extend-select = ["B009", "B010"] # flake8-bugbear: no getattr/setattr with a constant attribute name
[tool.isort]
profile = "black"
multi_line_output = 3
include_trailing_comma = true
force_grid_wrap = 0
use_parentheses = true
ensure_newline_before_comments = true
line_length = 120
sections = ["FUTURE", "STDLIB", "THIRDPARTY", "FIRSTPARTY", "LOCALFOLDER"]
skip_glob = [".tox", "__pycache__", "*.pyc", "venv*/*", "reports", "venv", "env", "node_modules", ".env", ".venv", "dist"]
skip = ["webeye/actions/__init__.py", "forge/sdk/__init__.py"]
[tool.mypy]
plugins = "sqlalchemy.ext.mypy.plugin"
[project.scripts]
skyvern = "skyvern.__main__:main"