pyproject.toml

[project]
name = "skyvern"
version = "1.0.52"
description = ""
authors = [{ name = "Skyvern AI", email = "info@skyvern.com" }]
requires-python = ">=3.11,<3.15"
readme = "README.md"

dependencies = [
    "python-dotenv>=1.0.0,<2",
    "pydantic>=2.13.4,<3",
    "pydantic-settings>=2.15.0,<3",
    "cachetools>=5.3.2,<6",
    "orjson>=3.12.0,<4",
    "structlog>=23.2.0,<24",
    "typer>=0.16.0,<0.26",
    "click>=8.4.2,<9",
    "httpx[socks]>=0.27.0",
    "rich>=13.7.0,<14",
]

[project.optional-dependencies]
# Embedded local mode is currently a Forge-backed compatibility bridge. It is
# smaller than the full server install because it excludes backend process,
# Postgres, MCP server, and cloud product packages, but it is not a minimal
# browser-only runtime until local stops importing Forge internals.
local = [
    "azure-storage-blob>=12.30.0",
    "google-cloud-storage>=3.13.1,<4",
    "openai>=1.68.2",
    "yutori>=0.8.1",
    "sqlalchemy>=2.0.29,<3",
    "aiohttp>=3.14.3,<4",
    "python-multipart>=0.0.30,<1",
    "toml>=0.10.2,<0.11",
    "jinja2>=3.1.6,<4",
    "litellm>=1.84.0",
    "playwright>1.46.0 ; python_version >= '3.12'",
    "playwright==1.46.0 ; python_version >= '3.11' and python_version < '3.12'",
    "greenlet>3.0.3 ; python_version >= '3.12'",
    "greenlet==3.0.3 ; python_version >= '3.11' and python_version < '3.12'",
    "pillow>=12.3.0",
    "starlette-context>=0.3.6,<0.6",
    "fastapi>=0.136.1,<0.137",
    "alembic>=1.19.1,<2",
    "PyJWT[crypto]>=2.13.0,<3",
    "aioboto3>=14.3.0,<15",
    "asyncssh>=2.14.2,<3",
    "asyncache>=0.3.1,<0.4",
    "filetype>=1.2.0,<2",
    "fuzzysearch>=0.8,<1",
    "tldextract>=5.3.2,<6",
    "websockets>=14.0,<15.1",
    "email-validator>=2.2.0,<3",
    "requests-toolbelt>=1.0.0,<2",
    "aiofiles>=24.1.0,<25",
    "pyotp>=2.9.0,<3",
    "json5>=0.15.0,<1",
    "json-repair>=0.63.2,<0.64",
    "pypdf>=6.16.1,<7",
    "pdfplumber>=0.11.10,<0.12",
    "psutil>=7.0.0",
    "tiktoken>=0.13.0",
    "anthropic>=0.122.0,<0.123",
    "google-cloud-aiplatform>=1.164.0,<2",
    "google-auth>=2.56.3,<3",
    "google-auth-oauthlib>=1.4.0,<2",
    "onepassword-sdk==0.4.1",
    "lark>=1.2.2,<2",
    "libcst>=1.9.0,<2",
    "curlparser>=0.1.0,<0.2",
    "pandas>=3.0.5,<4",
    "pyarrow>=18.0.0,<24",
    "azure-identity>=1.24.0,<2",
    "azure-keyvault-secrets>=4.11.1,<5",
    "google-cloud-secret-manager>=2.30.0,<3",
    "jsonschema>=4.23.0",
    "python-calamine>=0.8.2",
    "python-docx>=1.1.0",
    "urllib3>=2.7.0",
    "zstandard>=0.25.0",
    "sse-starlette>=3.4.8,<4",
    "opentelemetry-api>=1.44.0,<2",
    "croniter>=1.3.8,<4",
    "authlib>=1.7.2",
    "pyasn1>=0.6.4",
    "tornado>=6.5.8",
    "cryptography>=48.0.1",
    "starlette>=1.3.1",
    "aiosqlite>=0.21.0,<0.23",
]
# Server is intentionally a superset of local. Keep shared runtime deps in sync
# with local until the embedded runtime is separated from Forge/server internals.
server = [
    "azure-storage-blob>=12.30.0",
    "google-cloud-storage>=3.13.1,<4",
    "openai>=1.68.2",
    "yutori>=0.8.1",
    # Plain pip sees LiteLLM's exact openai pin and therefore resolves this
    # range to openai-agents 0.10.x. Cloud/source installs include the cloud
    # group below, where uv overrides let the newer 0.14.x SDK resolve.
    "openai-agents>=0.10.5,<0.15",
    "python-dotenv==1.2.2",
    "sqlalchemy[mypy]>=2.0.29,<3",
    "aiohttp>=3.14.3,<4",
    "python-multipart>=0.0.30,<1",
    "toml>=0.10.2,<0.11",
    "jinja2>=3.1.6,<4",
    "uvicorn[standard]>=0.44.0",
    "litellm>=1.84.0",
    "playwright>1.46.0 ; python_version >= '3.12'",
    "playwright==1.46.0 ; python_version >= '3.11' and python_version < '3.12'",
    "greenlet>3.0.3 ; python_version >= '3.12'",
    "greenlet==3.0.3 ; python_version >= '3.11' and python_version < '3.12'",
    "pillow>=12.3.0",
    "starlette-context>=0.3.6,<0.6",
    "fastapi>=0.136.1,<0.137",
    "psycopg[binary, pool]>=3.2.10,<3.3.0",
    "alembic>=1.19.1,<2",
    "PyJWT[crypto]>=2.13.0,<3",
    "aioboto3>=14.3.0,<15",
    "asyncssh>=2.14.2,<3",
    "asyncache>=0.3.1,<0.4",
    "types-toml>=0.10.8.7,<0.11",
    "filetype>=1.2.0,<2",
    "fuzzysearch>=0.8,<1",
    "aioredlock>=0.7.3,<0.8",
    "tldextract>=5.3.2,<6",
    "websockets>=14.0,<15.1",
    "email-validator>=2.2.0,<3",
    "requests-toolbelt>=1.0.0,<2",
    "posthog>=3.7.0,<4",
    "aiofiles>=24.1.0,<25",
    "pyotp>=2.9.0,<3",
    "asyncpg>=0.30.0,<0.32",
    "json5>=0.15.0,<1",
    "json-repair>=0.63.2,<0.64",
    "pypdf>=6.16.1,<7",
    "pdfplumber>=0.11.10,<0.12",
    "beautifulsoup4>=4.14.3,<5",
    # <3.4: 3.4.3 enables HostOriginGuardMiddleware by default (421 on public hosts, SKY-12003).
    # cloud_app passes allowed_hosts/allowed_origins when supported; validate against 3.4.x before raising.
    "fastmcp>=3.4.7,<3.5",
    "psutil>=7.0.0",
    "tiktoken>=0.13.0",
    "anthropic>=0.122.0,<0.123",
    "google-cloud-aiplatform>=1.164.0,<2",
    "google-auth>=2.56.3,<3",
    "google-auth-oauthlib>=1.4.0,<2",
    "onepassword-sdk==0.4.1",
    "types-boto3[full]>=1.38.31,<2",
    "lark>=1.2.2,<2",
    "libcst>=1.9.0,<2",
    "curlparser>=0.1.0,<0.2",
    "pandas>=3.0.5,<4",
    "pyarrow>=18.0.0,<24",
    "azure-identity>=1.24.0,<2",
    "azure-keyvault-secrets>=4.11.1,<5",
    "google-cloud-secret-manager>=2.30.0,<3",
    "jsonschema>=4.23.0",
    "python-calamine>=0.8.2",
    "python-docx>=1.1.0",
    "urllib3>=2.7.0",
    "zstandard>=0.25.0",
    "sse-starlette>=3.4.8,<4",
    "opentelemetry-api>=1.44.0,<2",
    "croniter>=1.3.8,<4",
    "authlib>=1.7.2",
    "pyasn1>=0.6.4",
    "tornado>=6.5.8",
    "cryptography>=48.0.1",
    "starlette>=1.3.1",
    "aiosqlite>=0.21.0,<0.23",
]

[dependency-groups]
cloud = [
    # Remote-browser vendor SDKs used only by cloud-side factories.
    "browser-use-sdk>=3.11.0,<4",
    "anchorbrowser>=0.11,<0.12",
    # Keep workflow-copilot on the newer Agents SDK for cloud/source installs.
    # uv's override-dependencies below relax LiteLLM's exact transitive pins,
    # but those overrides do not ship in public wheel metadata.
    "openai-agents>=0.14.8,<0.15",
    "stripe>=15.5.0,<16",
    "temporalio[opentelemetry]>=1.6.0,<2",
    "temporalio>=1.6.0,<2",
    "redis>=5.0.3,<6",
    "pyrate-limiter>=3.7.0,<4",
    "opentelemetry-exporter-otlp-proto-grpc>=1.41.1,<2",
    "kr8s>=0.20.14,<1",
    # OpenTelemetry instrumentation
    "opentelemetry-distro>=0.60b1,<1",
    "opentelemetry-instrumentation-fastapi>=0.60b1,<1",
    "opentelemetry-instrumentation-asyncpg>=0.60b1,<1",
    "opentelemetry-instrumentation-sqlalchemy>=0.60b1,<1",
    "opentelemetry-instrumentation-redis>=0.60b1,<1",
    "opentelemetry-instrumentation-httpx>=0.60b1,<1",
    "opentelemetry-instrumentation-aiohttp-client>=0.60b1,<1",
    "opentelemetry-instrumentation-logging>=0.60b1,<1",
    "opentelemetry-instrumentation-asyncio>=0.60b1,<1",
    "opentelemetry-instrumentation-botocore>=0.60b1,<1",
    "opentelemetry-instrumentation-grpc>=0.60b1,<1",
    "opentelemetry-instrumentation-requests>=0.60b1,<1",
    "opentelemetry-instrumentation-urllib3>=0.60b1,<1",
    "guarddog>=3.0.2,<3.1",
]
dev = [
    "grpcio-tools==1.80.0",
    "isort>=5.13.2",
    "mypy>=1.18.2,<2",
    "types-requests>=2.31.0.2,<3",
    "pytest>=9.1.1,<10",
    "pytest-asyncio>=0.21.1,<0.22",
    "pytest-split>=0.10.0,<1",
    # Needed by tests/unit/test_llm_handler_tracing.py which exercises the LLM
    # chokepoint's OTEL instrumentation. Cloud runtime also uses this via
    # cloud/observability/, but that ships via the `cloud` group's transitive
    # closure (opentelemetry-distro, instrumentation-*). Placing it here keeps
    # the test collectable in OSS envs, which only sync the `dev` group.
    "opentelemetry-sdk>=1.39.0,<2",
    "autoflake>=2.2.0,<3",
    "pydevd-pycharm>=233.6745.319,<234",
    "ipython>=8.17.2,<9",
    "ipykernel>=7.3.0,<8",
    "notebook>=7.6.2,<8",
    "freezegun>=1.2.2,<2",
    "fpdf>=1.7.2,<2",
    "twine>=6.1.0,<7",
    "build>=1.5.0,<2",
    # 4.6.1+ installs language:node hooks via git, which CI's npm 11 rejects (EALLOWGIT)
    "pre-commit>=4.6.0,<4.6.1",
    "ruff>=0.16.3,<0.17",
    "aiosqlite>=0.21.0,<0.23",
    "moto[s3, server]>=5.1.5,<6",
    "curlify>=3.0.0",
    "openpyxl>=3.1.0",
    "gspread>=6",
    "python-pptx>=1.0.2",
    "pyinstrument>=5.1.3",
    "pip-audit>=2.10.1",
    "import-linter>=2.1,<3",
]
# Non-default group: rustwright never enters the default/server/local/cloud/dev
# install sets. `uv export --no-default-groups --group rustwright` is an isolation probe;
# the shared worker image resolves it via `uv export --extra server --group cloud --group rustwright --no-dev`.
rustwright = [
    "rustwright==0.2.0",
]

[tool.hatch.build]
packages = ["skyvern"]

[tool.hatch.build.targets.sdist]
include = [
    "skyvern",
    "alembic",
]
exclude = [
    "skyvern-frontend/.env",
    "skyvern-frontend/.env.*",
    "skyvern-frontend/node_modules",
    "skyvern-frontend/dist",
]
[tool.hatch.build.targets.sdist.force-include]
"alembic" = "alembic"
[tool.hatch.build.targets.wheel]
include = [
    "skyvern",
]
[tool.hatch.build.targets.wheel.force-include]
"alembic" = "alembic"

[tool.uv]
# Supply chain quarantine: block packages published less than 7 days ago.
# Override for urgent cases: uv add <pkg> --exclude-newer ""
# exclude-newer = "7 days"
override-dependencies = [
    # litellm 1.83.7+ pins these exactly; relax so they coexist with our deps
    # (openai-agents needs openai>=2.26, fastmcp needs python-dotenv>=1.1).
    "jsonschema>=4.23.0",
    "python-dotenv>=1.0.0",
    "openai>=2.24.0",
    # yutori SDK pins httpx<0.28 but skyvern's fastmcp needs >=0.28.1
    "httpx[socks]>=0.26.0",
    # litellm exact-pins aiohttp; relax so the security-patched
    # 3.14.x resolves for cloud/source installs (plain pip keeps litellm's pin).
    "aiohttp>=3.14.0",
    # A remote-browser vendor SDK declares playwright>=1.55, but the local/server
    # groups pin playwright==1.46.0 on python<3.12 for binary-compat. Skyvern
    # connects to the remote session via its own playwright, so the SDK's
    # playwright dep is unused at runtime. Relax it to match.
    "playwright>=1.46.0",
]
constraint-dependencies = [
    "authlib>=1.7.2",
    "cryptography>=48.0.1",
    "flask>=3.1.3",
    "idna>=3.15",
    "joserfc>=1.6.8",
    "jupyter-server>=2.20.0",
    "mako>=1.3.12",
    "mistune>=3.2.1",
    "msgpack>=1.2.1",
    "pyasn1>=0.6.4",
    "starlette>=1.3.1",
    "tornado>=6.5.8",
    "werkzeug>=3.1.6",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.ruff]
exclude = [
    # vendored third-party judge, kept byte-identical to upstream on purpose
    "scripts/benchmark/evaluators/_odysseys_upstream_full_traj.py",
    ".bzr",
    ".direnv",
    ".eggs",
    ".git",
    ".git-rewrite",
    ".hg",
    ".ipynb_checkpoints",
    ".mypy_cache",
    ".nox",
    ".pants.d",
    ".pyenv",
    ".pytest_cache",
    ".pytype",
    ".ruff_cache",
    ".svn",
    ".tox",
    ".venv",
    ".vscode",
    "__pypackages__",
    "_build",
    "buck-out",
    "build",
    "dist",
    "node_modules",
    "site-packages",
    "venv",
    "alembic/env.py",
    "cloud/extensions",
    "skyvern-frontend",
    "skyvern/client",
    "codeblock/proto",
    "notebooks",
    "internal",
]
line-length = 120
target-version = "py311"

[tool.ruff.lint]
extend-select = ["B009", "B010"]  # flake8-bugbear: no getattr/setattr with a constant attribute name

[tool.isort]
profile = "black"
multi_line_output = 3
include_trailing_comma = true
force_grid_wrap = 0
use_parentheses = true
ensure_newline_before_comments = true
line_length = 120
sections = ["FUTURE", "STDLIB", "THIRDPARTY", "FIRSTPARTY", "LOCALFOLDER"]
skip_glob = [".tox", "__pycache__", "*.pyc", "venv*/*", "reports", "venv", "env", "node_modules", ".env", ".venv", "dist"]
skip = ["webeye/actions/__init__.py", "forge/sdk/__init__.py"]

[tool.mypy]
plugins = "sqlalchemy.ext.mypy.plugin"

[project.scripts]
skyvern = "skyvern.__main__:main"