pyproject.toml

[project]
name = "agentwire-dev"
dynamic = ["version"]
description = "Multi-session voice web interface for AI coding agents"
readme = "README.md"
license = { file = "LICENSE" }
requires-python = ">=3.10"
authors = [
    { name = "dotdev", email = "dev@dotdev.dev" }
]
keywords = ["ai", "voice", "agent", "claude", "tmux", "tts", "stt"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Environment :: Web Environment",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Operating System :: MacOS",
    "Operating System :: POSIX :: Linux",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Software Development :: User Interfaces",
]
dependencies = [
    "aiohttp>=3.13.4",  # >=3.13.4 clears CVE-2026-34515 + CVE-2026-34513 (portal-facing)
    "aiohttp-jinja2>=1.6",
    "jinja2>=3.1.0",
    "pyyaml>=6.0",
    "python-dotenv>=1.2.2",  # >=1.2.2 clears CVE-2026-28684
    "requests>=2.33.0",  # >=2.33.0 clears CVE-2026-25645
    # <2 is load-bearing: MCP SDK 2.x removed `mcp.server.fastmcp`, which
    # agentwire/mcp_core.py imports. Unbounded, any `agentwire rebuild` after
    # the 2.x release resolves it and every mcp__agentwire__* tool silently
    # disappears from every session (#874). Lift only with a 2.x port.
    "mcp>=1.2.0,<2",
    "resend>=2.0.0",
    "markdown>=3.5",
    # In-process WebM/Opus decoding for /transcribe (avoids ffmpeg subprocess startup).
    "av>=12.0.0",
    # Default TTS tier: Kokoro-82M in-process (CPU ONNX, no torch, espeak bundled
    # in espeakng-loader wheels). Marker is mandatory — kokoro-onnx pins <3.14;
    # on 3.14+ the portal falls back to browser speechSynthesis.
    "kokoro-onnx>=0.4.9; python_version < '3.14'",
    # Default STT engine: Moonshine ONNX in-process (CPU ONNX, no torch, models
    # pulled from HuggingFace on first boot). Marker mirrors kokoro — onnxruntime
    # pins <3.14; on 3.14+ the portal falls back to browser speech recognition.
    "useful-moonshine-onnx>=20250101; python_version < '3.14'",
    # Used by agentwire.tts.base (TTSRequest); explicit rather than transitive via mcp.
    "pydantic>=2.0.0",
    # Default-tier voice shim wrappers (#634): `agentwire kokoro start` /
    # `agentwire stt start` run kokoro_server / stt_server with the installed
    # package's own interpreter on a pip/uv-tool install, so their FastAPI
    # wrapper (plus multipart uploads and the Moonshine warm-up's soundfile)
    # must ship in the base install for the advertised out-of-the-box voice.
    # All lightweight; starlette/uvicorn are already transitive via mcp.
    "fastapi>=0.104.0",
    "uvicorn>=0.24.0",
    "python-multipart>=0.0.6",
    "soundfile>=0.12.0; python_version < '3.14'",
    # Device-pairing QR codes in the terminal (`agentwire portal pair`). Pure
    # Python; ASCII output needs no Pillow. Import is guarded so it degrades to
    # a printed URL if absent.
    "qrcode>=7.4",
    # Web Push (#483): signs VAPID pushes to the browser Push API so portal
    # notifications reach a backgrounded/locked phone. Inactive until the owner
    # sets channels.push.enabled + VAPID keys; the import is guarded so a missing
    # wheel degrades to "push disabled", never a crash. Pulls in cryptography
    # (used directly by `agentwire push keygen`).
    "pywebpush>=1.14.0",
]

[project.optional-dependencies]
dev = [
    "pytest>=7.0",
    "pytest-asyncio>=0.23.0",
    "pytest-cov>=4.1.0",
    "ruff>=0.1.0",
]
# STT shim server dependencies. Moonshine (the default engine) ships in the
# base install — see dependencies[] above — so the standalone `agentwire stt
# start` shim only needs the FastAPI wrapper plus soundfile for its warm-up.
# faster-whisper is the higher-accuracy fallback for `stt.engine: whisper`.
stt = [
    "fastapi>=0.104.0",
    "uvicorn>=0.24.0",
    "python-multipart>=0.0.6",
    "soundfile>=0.12.0",
    "faster-whisper>=1.0.0",
]
# TTS server dependencies (for GPU machines running the TTS backend)
tts = [
    "fastapi>=0.104.0",
    "uvicorn>=0.24.0",
    "python-multipart>=0.0.6",
    "pydantic>=2.0.0",
    "torch>=2.0.0",
    "torchaudio>=2.0.0",
    "faster-whisper>=1.0.0",
    # chatterbox-tts pins numpy<2 on Python <=3.12, which conflicts with the
    # base install's kokoro-onnx (numpy>=2.0.2). Chatterbox venvs need py3.13+.
    "chatterbox-tts>=0.1.6; python_version >= '3.13'",
]

[project.scripts]
agentwire = "agentwire.__main__:main"

[project.urls]
Homepage = "https://agentwire.dev"
Repository = "https://github.com/dotdevdotdev/agentwire-dev"
Documentation = "https://agentwire.dev"
Issues = "https://github.com/dotdevdotdev/agentwire-dev/issues"
Changelog = "https://github.com/dotdevdotdev/agentwire-dev/releases"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["agentwire"]
include = [
    # Web assets and templates required at runtime
    "agentwire/templates/**/*.html",
    "agentwire/templates/**/*.html.j2",
    "agentwire/templates/**/*.css.j2",
    "agentwire/templates/**/*.txt",
    "agentwire/templates/**/*.conf",
    "agentwire/templates/**/*.sh",
    "agentwire/static/**/*",
    # Role/prompt content bundled with the CLI
    "agentwire/roles/*.md",
    "agentwire/commands/*.md",
    # Hooks and auxiliary scripts/configs
    "agentwire/hooks/**/*.py",
    "agentwire/hooks/**/*.yaml",
    "agentwire/hooks/**/*.sh",
    # Top-level docs to ship in wheel
    "LICENSE",
    "README.md",
]
artifacts = [
    "agentwire/hooks/**/*.py",
    "agentwire/hooks/**/*.yaml",
    "agentwire/hooks/**/*.sh",
]
exclude = [
    # Never-served source art kept in-repo for regen only. The portal serves
    # WebP exclusively (server.py list_images suffix filter), so the heavyweight
    # .jpeg session icons and full-res custom .png originals are pure regen
    # source — don't ship them in the wheel.
    "agentwire/static/icons/**/*.jpeg",
    "agentwire/static/icons/**/custom/*.png",
    # Unreferenced root splash/Echo/banner source PNGs (0 refs across
    # templates/static/js/css/server.py). The wallpaper uses only the 5
    # decomposed --tree/--telephone/--echo/--echo-claw-fg/--agentwire-text
    # layers; email banner/Echo default to config-driven PUBLIC urls, not
    # these local copies. Kept in-repo as source, not shipped.
    "agentwire/static/agentwire-Echo.png",
    "agentwire/static/agentwire-Echo--black.png",
    "agentwire/static/agentwire-Echo--transparent.png",
    "agentwire/static/agentwire-email-banner.png",
    "agentwire/static/agentwire-splash-logo-layers.png",
    "agentwire/static/agentwire-splash-logo-layers--full--transparent-top.png",
    "agentwire/static/agentwire-splash-logo-layers--full-black.png",
    "agentwire/static/agentwire-splash-logo-layers--telephone-fg.png",
    "agentwire/static/agentwire-splash-logo-layers--transparent-top.png",
    "agentwire/static/agentwire-splash-logo-layers--transparent.png",
]

# Ship the agentwire-owned GLOBAL skill into the package so get_skills_source()
# resolves it and `hooks install` can symlink ~/.claude/skills/wiki at it. SSOT:
# the source lives at .claude/skills/wiki (also the project-scoped copy); this
# maps it to agentwire/skills/wiki in the wheel, so it is auto-current on every
# rebuild — the same posture as hooks/roles/prompts bundled inside the package.
[tool.hatch.build.targets.wheel.force-include]
".claude/skills/wiki" = "agentwire/skills/wiki"
".claude/commands/handoff.md" = "agentwire/commands/handoff.md"

[tool.hatch.version]
path = "agentwire/__init__.py"

[tool.hatch.build.targets.sdist]
exclude = [
    # Git artifacts
    ".git",
    ".gitignore",
    # Virtual environments
    ".venv*/",
    # Dev/local config files
    ".claude/",
    ".agentwire.yml",
    "uv.lock",
    "CLAUDE.md",
    # Build artifacts
    "dist/",
    # Dev docs
    "docs/research/",
    "docs/testing/",
    # Dev examples and scripts
    "examples/",
    "scripts/",
    # Never-served source art (see wheel exclude above): .jpeg session icons
    # and full-res custom .png originals are regen source, not shipped.
    "agentwire/static/icons/**/*.jpeg",
    "agentwire/static/icons/**/custom/*.png",
    # Unreferenced root splash/Echo/banner source PNGs (see wheel exclude).
    "agentwire/static/agentwire-Echo.png",
    "agentwire/static/agentwire-Echo--black.png",
    "agentwire/static/agentwire-Echo--transparent.png",
    "agentwire/static/agentwire-email-banner.png",
    "agentwire/static/agentwire-splash-logo-layers.png",
    "agentwire/static/agentwire-splash-logo-layers--full--transparent-top.png",
    "agentwire/static/agentwire-splash-logo-layers--full-black.png",
    "agentwire/static/agentwire-splash-logo-layers--telephone-fg.png",
    "agentwire/static/agentwire-splash-logo-layers--transparent-top.png",
    "agentwire/static/agentwire-splash-logo-layers--transparent.png",
]

# The sdist excludes .claude/, but the wheel force-includes .claude/skills/wiki
# (-> agentwire/skills/wiki). Carry it into the sdist too, otherwise building the
# wheel *from* the sdist (`uv build`, or `pip install` from the sdist) can't
# resolve the wheel's force-include and fails.
[tool.hatch.build.targets.sdist.force-include]
".claude/skills/wiki" = ".claude/skills/wiki"
".claude/commands/handoff.md" = ".claude/commands/handoff.md"

[tool.pytest.ini_options]
testpaths = ["tests"]
markers = [
    "slow: marks tests as slow",
    "integration: requires subprocess mocking",
    "e2e: end-to-end portal tests",
    # Spawns a real tmux binary (WS connect / speak paths PTY-pipe through tmux).
    # Deselected in the hermetic CI gate via `-m 'not requires_tmux'` (#323);
    # still runs locally where tmux is on PATH.
    "requires_tmux: spawns a real tmux process; deselected in hermetic CI (#323)",
    # Opts a test out of the ~/.agentwire redirect so it can assert on the REAL
    # deployment paths (#893). READ-ONLY by intent — the session-scoped backstop
    # still fails the run if an opted-out test writes anything.
    "real_agentwire_home: sees the real ~/.agentwire paths instead of the tmp redirect (#893)",
]
asyncio_mode = "auto"

[tool.bandit]
# Make bandit a meaningful green gate rather than perpetual red noise. CI runs
# `bandit -c pyproject.toml -r agentwire --severity-level high --confidence-level high`,
# so the build only fails on NEW high-severity high-confidence findings. The
# skips below are test-IDs that are intentional-by-design for this codebase —
# suppressed here (with justification) instead of via scattered `# nosec`:
#
#   B101 assert_used                  — asserts in non-test helpers are sanity checks.
#   B404 import subprocess            — driving subprocesses (tmux, git, claude) IS the product.
#   B602/B603/B607 subprocess/shell   — scheduler gates, service healthchecks and task
#                                       pre-commands run user-authored shell commands by
#                                       design; the threat model is the user's own machine,
#                                       and damage-control hooks gate dangerous ops upstream.
#   B501 request verify=False         — every site targets the LOCAL portal over its
#                                       self-signed cert (localhost only); there is no
#                                       remote TLS trust decision to get wrong here.
#
# Genuine weak-crypto (B324 hashlib) was FIXED, not skipped (usedforsecurity=False).
skips = ["B101", "B404", "B602", "B603", "B607", "B501"]

[tool.ruff]
line-length = 100
target-version = "py310"
# Generated files: the damage-control hooks inline `agentwire/safety/_core.py`
# verbatim between BEGIN/END markers (regen via
# scripts/regen_damage_control_hooks.py). Linting the inlined copy fights the
# generator — `_core.py` itself is the linted source of truth.
extend-exclude = ["agentwire/hooks/damage-control/*.py"]

[tool.ruff.lint]
select = ["E", "F", "I", "N", "W"]
ignore = ["E501"]