pyproject.toml

# UV workspace configuration
[tool.uv.workspace]
members = ["openhands-sdk", "openhands-tools", "openhands-workspace", "openhands-agent-server"]

# Security: Apply workspace-wide dependency guardrails.
[tool.uv]
exclude-newer = "7 days"  # Avoid packages uploaded in the last 7 days.
exclude-newer-package = { litellm = "2026-07-20T00:00:00Z" }  # Bump or remove when upgrading litellm past 1.93.0
constraint-dependencies = [
    "starlette>=0.49.1",  # CVE-2025-62727
    "aiohttp>=3.13.3",  # CVE-2025-69223 + 7 others
    "urllib3>=2.6.3",  # CVE-2026-21441, CVE-2025-66471, CVE-2025-66418
    "protobuf>=6.33.5",  # CVE-2026-0994
    "pillow>=12.1.1",  # CVE-2026-25990
    "orjson>=3.11.7",  # CVE-2025-67221
    "rich>=14.3.3", # Version 14.3.2 essentially has a denial-of-service vulnerability which is outlined in https://github.com/Textualize/rich/issues/3958
    "lupa>=2.8",  # CVE-2026-34444
    "litellm==1.93.0",  # Workspace lock target for the requested LiteLLM upgrade
]

# Workspace sources for intra-repo dependencies
[tool.uv.sources]
openhands-sdk = { workspace = true }
openhands-tools = { workspace = true }
openhands-workspace = { workspace = true }
openhands-agent-server = { workspace = true }

[dependency-groups]
dev = [
    "pre-commit>=4.3.0",
    "packaging>=24.2",
    "pillow>=12.1.1",
    "psutil>=7.0.0",
    "pyright[nodejs]>=1.1.405",
    "pytest>=9.0.3",
    "pytest-cov>=5.0.0",
    "ruff>=0.12.10",
    "pycodestyle>=2.12.0",
    "pytest-asyncio>=1.1.0",
    "pytest-forked>=1.6.0",
    "pytest-xdist>=3.6.0",
    "tabulate>=0.9.0",
    "pyinstaller>=6.16.0",
    "streamlit>=1.49.1",
    "pytest-timeout>=2.4.0",
    "griffe[pypi]>=2.0.0",
]

# Ruff configuration
[tool.ruff]
target-version = "py313"
line-length = 88

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

[tool.ruff.lint]
select = [
    "E",    # pycodestyle errors
    "F",    # pyflakes (includes F841: unused-variable)
    "I",    # isort
    "UP",   # pyupgrade
    "ARG",  # flake8-unused-arguments
]
# Enforce rules that catch mutable defaults and related pitfalls
# - B006: mutable-argument-default
# - B008: function-call-in-default-argument
# - B039: mutable-contextvar-default
# - RUF012: mutable-class-default
extend-select = ["B006", "B008", "B039", "RUF012"]

[tool.ruff.lint.per-file-ignores]
# Test files often have unused arguments (fixtures, mocks, interface implementations)
"tests/**/*.py" = ["ARG"]


# Allowlist safe default calls for flake8-bugbear rules (e.g., FastAPI Depends)
[tool.ruff.lint.flake8-bugbear]
extend-immutable-calls = [
    "fastapi.Depends",
    "fastapi.params.Depends",
]

[tool.ruff.lint.isort]
known-first-party = ["openhands"]
combine-as-imports = true
force-single-line = false
lines-after-imports = 2

# Pytest configuration
[tool.pytest.ini_options]
testpaths = [
    "tests"
]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
addopts = "-v --tb=short -m 'not stress'"
asyncio_mode = "auto"
markers = [
    "stress: stress / scale tests, deselected by default. Run with `pytest -m stress` (see tests/agent_server/stress/__init__.py for details).",
]

# Pyright configuration for PEP 420 namespace packages
# This is needed for VSCode to properly resolve imports across multiple packages in the monorepo
[tool.pyright]
include = [
    "openhands-sdk",
    "openhands-tools",
    "openhands-workspace",
    "openhands-agent-server",
    "examples",
    "tests",
    "scripts"
]
extraPaths = [
    "openhands-sdk",
    "openhands-tools",
    "openhands-workspace",
    "openhands-agent-server"
]
venvPath = "."
venv = ".venv"
pythonVersion = "3.13"
useLibraryCodeForTypes = true
typeCheckingMode = "standard"

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true