pyproject.toml

[build-system]
requires = ["setuptools>=68,<75", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "openprogram"
version = "0.7.1"
description = "OpenProgram: Self-Programming AI Agent Framework"
readme = "README.md"
requires-python = ">=3.11"
license = {text = "AGPL-3.0-or-later"}
authors = [
    {name = "Fzkuji"},
]
keywords = ["llm", "agentic", "agentic-programming", "self-programming", "multi-agent", "ai-agent", "agent-framework", "workflow-automation", "autonomous-agents", "ai", "function", "decorator", "context"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "Intended Audience :: Science/Research",
    "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Typing :: Typed",
]
dependencies = [
    # Used by `openprogram providers setup` / `login` for an interactive
    # arrow-key menu. Falls back to plain input() when not installed,
    # so this is officially optional in source-development environments.
    "questionary>=2.0.0",
    # Web UI is a first-class entry point alongside the TUI (the
    # whole platform pitch is "TUI or browser, same backend"), so the
    # FastAPI/uvicorn/websockets stack ships with the core package
    # instead of being a `[web]` extra. Complete product runtimes always
    # include it. The TUI itself needs no Python
    # dep: it is the Ink renderer (cli/, TypeScript) with a Rich-based
    # REPL fallback.
    "fastapi>=0.110.0",
    "uvicorn[standard]>=0.29.0",
    "websockets>=12.0",
    # PKCE OAuth login (used by `openprogram providers login` against
    # ChatGPT/Codex, Anthropic, etc.) starts a localhost callback
    # server to receive the redirect. Implementation lives in
    # ``openprogram.auth.methods.pkce_oauth`` and uses ``aiohttp.web``.
    # Was previously a lazy import that raised a missing-dependency hint at
    # login time — moved into base deps so the
    # ChatGPT subscription flow works out of the box.
    "aiohttp>=3.9.0",
    # Model Context Protocol Python SDK. ``webui/routes/mcp.py`` does
    # ``from mcp.types import ...`` at module top, which is reached
    # during FastAPI app construction. Without this dep,
    # ``/api/providers/list`` (and the whole MCP page) raise
    # ``ModuleNotFoundError: No module named 'mcp'`` and the LLM
    # Providers settings panel renders empty. MCP is also a headline
    # feature of OpenProgram, not an optional extra.
    # Capped below 2.0: mcp 2.0 reworked the client auth API —
    # ``OAuthClientProvider`` lost its ``timeout`` kwarg and no longer
    # satisfies httpx's ``auth=`` protocol, which breaks
    # ``PersistentOAuthProvider`` (see openprogram/mcp/token_storage.py).
    # Lift the cap once that module is ported to the 2.x auth API.
    "mcp>=1.0.0,<2.0.0",
    # ── LLM provider SDKs ─────────────────────────────────────────
    # The transport for every provider routes through just these three
    # wire SDKs: Anthropic Messages (anthropic — used by anthropic AND
    # third-party anthropic-wire providers like minimax / kimi / vercel),
    # OpenAI (openai — used by openai AND every openai-compatible
    # provider), and Google. "Any LLM" is the product pitch, so these
    # ship with the core package — installed by default, no separate
    # extra. Otherwise picking a provider in the UI works but the first
    # turn raises ``No module named 'anthropic'``.
    "anthropic>=0.30.0",
    "openai>=1.30.0",
    "google-genai>=1.0.0",
    # ── Imported at module load on core paths ─────────────────────
    # These are unguarded top-level imports reached during normal
    # startup / CLI use, so a base install MUST carry them or the import
    # itself tracebacks (not a graceful "install the extra" message):
    #   typer    — the ``openprogram providers`` CLI (providers/cli.py)
    #   PyYAML   — skill / command frontmatter parsing (commands/)
    #   requests — channel transport + misc HTTP
    #   httpx    — the MCP client + provider SDKs' HTTP layer
    #   pydantic — agent/types + FastAPI models (also a FastAPI dep, but
    #              used directly so we pin it explicitly)
    "typer>=0.12.0",
    "PyYAML>=6.0",
    "requests>=2.31.0",
    # [socks]: a socks5:// ALL_PROXY in the user's shell makes httpx demand
    # socksio at client construction, even for requests routed elsewhere
    "httpx[socks]>=0.27.0",
    "pydantic>=2.0",
    "jsonschema>=4.23",
    # Built-in terminal chat falls back to the Python Rich REPL when the Ink
    # bundle or Node runtime is unavailable (including managed releases).
    "rich>=13.0",
    # Built-in `pdf` and `read` tools extract text with pypdf. This is a
    # complete-product capability, so release runtimes must always carry it.
    "pypdf>=5.0",
    # Windows ConPTY binding (import name ``winpty``). Drives the interactive
    # Claude-account browser login through a pseudo-terminal on Windows, where
    # stdlib ``pty`` doesn't exist (POSIX reuses ``pty``). Windows-only marker;
    # a no-op install on macOS/Linux. Optional in practice — the claude-code
    # account flow falls back to the token-paste method when it's unavailable
    # (see openprogram/_compat.py::InteractivePty).
    "pywinpty>=2.0; sys_platform == 'win32'",
    # Memory counts tokens to decide when a batch is worth writing and to
    # keep core.md inside the budget it is injected under. Reading and
    # searching memory need this; only writing needs the agent SDK, which
    # is imported where a writer is actually constructed.
    "tiktoken>=0.7",
    # BM25 ranking for memory search. The embedding backend stays
    # optional — search reports that it is unavailable rather than
    # silently returning something else.
    "rank-bm25>=0.2.2",
    # Managed memory-tool schema plus the legacy Claude Code adapter used by
    # benchmark paths. The product writer itself follows OpenProgram's default
    # chat provider through AgentSession.
    # 0.1.51 is where `permission_mode="dontAsk"` became a permission mode;
    # an older SDK sends the writer's runs with a mode the CLI rejects.
    "claude-agent-sdk>=0.1.51",
]

[project.optional-dependencies]
dev = [
    "build>=1.2",
    # Exercises the optional Amazon Bedrock adapter without AWS credentials.
    "boto3>=1.34",
    # Wheel-content tests invoke the active interpreter's pip module to
    # install the built artifact into an isolated target directory.
    "pip>=24",
    # test_wheel_contains_both_runtime_shims builds with --no-isolation, so
    # the backend must be importable in the dev env (not bundled on 3.12+)
    "setuptools>=68,<75",
    "pytest>=8.0.0",
    "pytest-timeout>=2.3",
    # full-suite runs go 126s -> 27s with -n auto; keep serial default so
    # single-file debugging stays overhead-free
    "pytest-xdist>=3.5",
    "coverage>=7.6",
    "cryptography>=42",
    "trio>=0.30",
    "ruff>=0.16",
]
# The LLM SDKs (anthropic / openai / google-genai) and the web stack are
# in the base `dependencies` above — installed by default, no separate
# provider extra; there is intentionally no ``[anthropic]`` /
# ``[openai]`` / ``[gemini]`` extra.
# Semantic + lexical code search (tree-sitter chunks + Model2Vec static
# embeddings + BM25) behind the `semble_search` / `semble_find_related`
# tools. Heavy transitive deps for one leaf tool, so it is opt-in; the
# tools answer with the install hint when the package is absent.
search = ["semble>=0.5.3"]
# Runtime deps for the GUI program (gui_agent / gui_harness). The
# NOTE: the agentic *programs* (gui / research / wiki harnesses) no
# longer have extras here. Each harness is self-describing — its own
# pyproject.toml declares its third-party deps, and ``openprogram
# programs install <name>`` clones it and prepares its isolated environment, so
# its deps come from the harness, not from OpenProgram. OpenProgram does
# not carry per-harness dependencies.
channels = [
    # WeChat (iLink bot) QR login renders a QR code in the terminal
    # from the server-provided URL. Pure Python, tiny. No Pillow
    # needed for print_ascii() rendering.
    "qrcode>=7.0",
    # Discord channel bot.
    "discord.py>=2.3.0",
    # Slack Socket Mode bot.
    "slack_sdk>=3.27.0",
]
# Browser automation tool (tools/browser). Source developers also
# run `playwright install chromium` to fetch the browser binary
# (~150MB, into ~/Library/Caches/ms-playwright/ on macOS).
browser = [
    "playwright>=1.45.0",
]
# `agent_browser` tool — LLM-friendly ariaSnapshot + ref-id interface.
# Pure Python (subprocess wrapper); the npm package itself is the
# install the npm package when enabling this optional backend:
#   npm install -g agent-browser
#   agent-browser install
agent-browser = []
# Stealth-patched browser backends for sites with bot protection
# (Cloudflare Turnstile, DataDome, etc.). After install also run
# `patchright install chromium` and/or `camoufox fetch`.
browser-stealth = [
    "playwright>=1.45.0",
    "patchright>=1.40",
    "camoufox>=0.4.0",
]
all = [
    # LLM provider SDKs are in base `dependencies` now — not repeated here.
    # Channels
    "qrcode>=7.0",
    "discord.py>=2.3.0",
    "slack_sdk>=3.27.0",
    # Browser tool (run `playwright install chromium` after install)
    "playwright>=1.45.0",
    # NOTE: agentic programs (gui/research/wiki) are NOT here — they're
    # installed via ``openprogram programs install <name>``, which pulls
    # each harness's own declared deps. See the note by ``channels``.
]

[project.scripts]
openprogram = "openprogram_cli:main"

[project.urls]
Homepage = "https://openprogram.io/"
Repository = "https://github.com/Fzkuji/OpenProgram"
Documentation = "https://openprogram.io/docs/"
Issues = "https://github.com/Fzkuji/OpenProgram/issues"
Changelog = "https://github.com/Fzkuji/OpenProgram/releases"
Discussions = "https://github.com/Fzkuji/OpenProgram/discussions"
Paper = "https://arxiv.org/abs/2606.15874"

[tool.setuptools.packages.find]
where = [".", "apps/server", "apps/cli/python"]
include = ["openprogram*", "openprogram_server*", "openprogram_cli*"]
namespaces = false
# Core agentic functions such as ask_user and goal are imported by the worker
# and must ship in the wheel. External Programs live under the gitignored
# programs/applications directory and are not discovered as release packages.

[tool.setuptools.package-data]
# Non-.py files the package reads at RUNTIME. Without these the wheel
# installs but blows up on first use: `openprogram providers` finds zero
# providers or the web UI 404s its own assets.
"openprogram" = [
    "sandbox/shims/*.cjs",
    "sandbox/shims/*.py",
    "programs/functions/agentic/browser_agent/*.cjs",
    # Provider registry — endpoints/model metadata read by
    # providers/_provider_meta.py and enabled_models.py.
    "providers/provider.json",
    "providers/*/provider.json",
    "providers/claude_models.json",
    "providers/*/claude_models.json",
]
"openprogram_server" = [
    # Generated by scripts/release/stage-release-assets.sh before wheel builds.
    "_webui/_frontend/*",
    "_webui/_frontend/**/*",
]

[tool.setuptools.exclude-package-data]
"openprogram.webui" = [
    # Mutable per-profile state. Older installations are read once for
    # migration, but new wheels must never seed or overwrite user settings.
    "functions_meta.json",
    "programs_meta.json",
]

[tool.pytest.ini_options]
testpaths = ["tests"]
pythonpath = [".", "apps/server", "apps/cli/python"]
markers = [
    "slow: tests whose expected runtime is materially longer than the layer default",
    "browser: tests that require the built Web and Playwright test environment",
    "sandbox: tests that require the host sandbox implementation",
    "live: tests that require external services, network access, or credentials",
    "macos: tests that require macOS system tools",
]
addopts = "-m 'not live and not browser' --strict-markers --strict-config"
xfail_strict = true
filterwarnings = [
    "error::pytest.PytestUnhandledThreadExceptionWarning",
]
# Any single test that runs 120 s is hung, not slow — fail it instead of
# freezing the whole suite (a blind ws receive_text did exactly that once).
timeout = 120
timeout_method = "thread"

[tool.ruff]
# Ruff enforces the exception-handling gate described in
# docs/reference/design/error-handling.md. It is not a general style gate —
# formatting and import order are deliberately left alone.
target-version = "py311"

[tool.ruff.lint]
# E722  bare `except:` — swallows KeyboardInterrupt and SystemExit too.
# S110  `try`/`except`/`pass` — an exception discarded with no log, no
#       comment, and no fallback. This is the rule that finds hidden bugs.
select = ["E722", "S110"]

[tool.ruff.lint.per-file-ignores]
# The gate is enforced on the three core paths — openprogram/store/,
# openprogram/context/ and openprogram/agent/dispatcher/ — which are clean.
# Everywhere else still carries several hundred pre-existing sites; turning
# the rules on globally would produce a gate nobody can pass, so those paths
# are muted here and cleaned up path by path. To extend the gate, clean a
# directory and delete its line below.
#
# Every pattern here matches whole paths, and `*` crosses `/` — so
# "openprogram/*.py" would mute the entire package including the three gated
# paths, and did until the top-level modules were named one by one below.
# Check a new pattern against a nested file before trusting it.
"openprogram/agent/agent.py" = ["E722", "S110"]
"openprogram/agent/internals/*" = ["E722", "S110"]
"openprogram/agent/task/*" = ["E722", "S110"]
"openprogram/agent/tools/*" = ["E722", "S110"]
"openprogram/agent/[!d]*" = ["E722", "S110"]
"openprogram/agentic_programming/*" = ["E722", "S110"]
"openprogram/auth/*" = ["E722", "S110"]
"openprogram/channels/*" = ["E722", "S110"]
"openprogram/cli/*" = ["E722", "S110"]
"openprogram/commands/*" = ["E722", "S110"]
"openprogram/context/git/*" = ["E722", "S110"]
"openprogram/events/*" = ["E722", "S110"]
"openprogram/programs/*" = ["E722", "S110"]
"openprogram/mcp/*" = ["E722", "S110"]
"openprogram/memory/*" = ["E722", "S110"]
"openprogram/plugins/*" = ["E722", "S110"]
"openprogram/providers/*" = ["E722", "S110"]
"openprogram/skills/*" = ["E722", "S110"]
"openprogram/usage/*" = ["E722", "S110"]
"openprogram/webui/*" = ["E722", "S110"]
"apps/server/openprogram_server/*" = ["E722", "S110"]
"apps/cli/python/openprogram_cli/*" = ["E722", "S110"]
"openprogram/worker/*" = ["E722", "S110"]
"openprogram/worktree/*" = ["E722", "S110"]
"openprogram/{__init__,__main__,_compat,_ports,config_schema,paths,setup,tts}.py" = ["E722", "S110"]
"tests/*" = ["E722", "S110"]
"scripts/*" = ["E722", "S110"]