Melvin StroblandClaude Fable 5
8d82d6c4ec
Playwright Tests / test-playwright (1, 2) (push) Canceled after 0s
Playwright Tests / test-playwright (2, 2) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Test Backend / test-backend (push) Canceled after 0s
Compose Smoke Test / test-compose (push) Canceled after 0s
Playwright Tests / merge-reports (push) Canceled after 0s
The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
103 lines
2.8 KiB
TOML
103 lines
2.8 KiB
TOML
[project]
|
|
name = "app"
|
|
version = "0.1.0"
|
|
description = ""
|
|
# Capped below 3.14: the MCP SDK wants a newer starlette there than the
|
|
# pinned sentry-sdk allows. Lift it when sentry-sdk moves to 2.x.
|
|
requires-python = ">=3.10,<3.14"
|
|
dependencies = [
|
|
"fastapi[standard]<1.0.0,>=0.114.2",
|
|
"python-multipart<1.0.0,>=0.0.7",
|
|
"email-validator<3.0.0.0,>=2.1.0.post1",
|
|
"tenacity<9.0.0,>=8.2.3",
|
|
"pydantic>2.0",
|
|
"emails<1.0,>=0.6",
|
|
"jinja2<4.0.0,>=3.1.4",
|
|
"alembic<2.0.0,>=1.12.1",
|
|
"httpx<1.0.0,>=0.25.1",
|
|
"psycopg[binary]<4.0.0,>=3.1.13",
|
|
"sqlmodel<1.0.0,>=0.0.21",
|
|
"pydantic-settings<3.0.0,>=2.2.1",
|
|
"sentry-sdk[fastapi]<2.0.0,>=1.40.6",
|
|
"pyjwt<3.0.0,>=2.8.0",
|
|
"pwdlib[argon2,bcrypt]>=0.3.0",
|
|
"numpy>=2.2.6",
|
|
"redis>=7.1.0",
|
|
"cryptography>=44.0.0",
|
|
"aiomqtt>=2.0.0",
|
|
"influxdb-client[async]>=1.40.0",
|
|
"croniter>=1.3.0",
|
|
"mcp>=1.29,<2",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"pytest<8.0.0,>=7.4.3",
|
|
"mypy<2.0.0,>=1.8.0",
|
|
"ruff<1.0.0,>=0.2.2",
|
|
"prek>=0.2.24,<1.0.0",
|
|
"coverage<8.0.0,>=7.4.3",
|
|
]
|
|
|
|
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[tool.mypy]
|
|
strict = true
|
|
exclude = ["venv", ".venv", "alembic"]
|
|
|
|
# app/flow/nodes.py still carries the prototype's node classes: the integration
|
|
# nodes need annotations of their own, plus stubs for croniter and influxdb_client.
|
|
# It is being revisited per integration; every module around it is checked strictly.
|
|
[[tool.mypy.overrides]]
|
|
module = ["app.flow.nodes"]
|
|
ignore_errors = true
|
|
|
|
[tool.ruff]
|
|
target-version = "py310"
|
|
exclude = ["alembic"]
|
|
|
|
[tool.ruff.lint]
|
|
select = [
|
|
"E", # pycodestyle errors
|
|
"W", # pycodestyle warnings
|
|
"F", # pyflakes
|
|
"I", # isort
|
|
"B", # flake8-bugbear
|
|
"C4", # flake8-comprehensions
|
|
"UP", # pyupgrade
|
|
"ARG001", # unused arguments in functions
|
|
"T201", # print statements are not allowed
|
|
]
|
|
ignore = [
|
|
"E501", # line too long, handled by black
|
|
"B008", # do not perform function calls in argument defaults
|
|
"W191", # indentation contains tabs
|
|
"B904", # Allow raising exceptions without from e, for HTTPException
|
|
]
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
# Node functions take `params` whether or not they use it — that is the
|
|
# contract the engine calls them with.
|
|
"app/flow/nodes.py" = ["ARG001", "ARG002"]
|
|
"tests/flow/*" = ["ARG001"]
|
|
# Printing is what this one is about: node code is user code, and `print` is
|
|
# how it says things.
|
|
"tests/flow/test_logs.py" = ["ARG001", "T201"]
|
|
|
|
[tool.ruff.lint.pyupgrade]
|
|
# Preserve types, even if a file imports `from __future__ import annotations`.
|
|
keep-runtime-typing = true
|
|
|
|
[tool.coverage.run]
|
|
source = ["app"]
|
|
dynamic_context = "test_function"
|
|
|
|
[tool.coverage.report]
|
|
show_missing = true
|
|
sort = "-Cover"
|
|
|
|
[tool.coverage.html]
|
|
show_contexts = true
|