c9b76057d4
Adds upper-bound version pins (<next_major) to all dependencies in pyproject.toml — both core and optional. Previously most deps were unpinned or had only floor bounds, meaning fresh installs would pull whatever version was latest on PyPI. This limits blast radius from supply chain attacks like the litellm 1.82.7/1.82.8 credential stealer (BerriAI/litellm#24512). With bounded ranges, a compromised major version bump won't be pulled automatically. Floors are set to current known-good installed versions.
104 lines
3.4 KiB
TOML
104 lines
3.4 KiB
TOML
[build-system]
|
|
requires = ["setuptools>=61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "hermes-agent"
|
|
version = "0.4.0"
|
|
description = "The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
authors = [{ name = "Nous Research" }]
|
|
license = { text = "MIT" }
|
|
dependencies = [
|
|
# Core — pinned to known-good ranges to limit supply chain attack surface
|
|
"openai>=2.21.0,<3",
|
|
"anthropic>=0.39.0,<1",
|
|
"python-dotenv>=1.2.1,<2",
|
|
"fire>=0.7.1,<1",
|
|
"httpx>=0.28.1,<1",
|
|
"rich>=14.3.3,<15",
|
|
"tenacity>=9.1.4,<10",
|
|
"pyyaml>=6.0.2,<7",
|
|
"requests>=2.32.3,<3",
|
|
"jinja2>=3.1.5,<4",
|
|
"pydantic>=2.12.5,<3",
|
|
# Interactive CLI (prompt_toolkit is used directly by cli.py)
|
|
"prompt_toolkit>=3.0.52,<4",
|
|
# Tools
|
|
"firecrawl-py>=4.16.0,<5",
|
|
"parallel-web>=0.4.2,<1",
|
|
"fal-client>=0.13.1,<1",
|
|
# Text-to-speech (Edge TTS is free, no API key needed)
|
|
"edge-tts>=7.2.7,<8",
|
|
"faster-whisper>=1.0.0,<2",
|
|
# Skills Hub (GitHub App JWT auth — optional, only needed for bot identity)
|
|
"PyJWT[crypto]>=2.10.1,<3",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
modal = ["swe-rex[modal]>=1.4.0,<2"]
|
|
daytona = ["daytona>=0.148.0,<1"]
|
|
dev = ["pytest>=9.0.2,<10", "pytest-asyncio>=1.3.0,<2", "pytest-xdist>=3.0,<4", "mcp>=1.2.0,<2"]
|
|
messaging = ["python-telegram-bot>=22.6,<23", "discord.py[voice]>=2.7.1,<3", "aiohttp>=3.13.3,<4", "slack-bolt>=1.18.0,<2", "slack-sdk>=3.27.0,<4"]
|
|
cron = ["croniter>=6.0.0,<7"]
|
|
slack = ["slack-bolt>=1.18.0,<2", "slack-sdk>=3.27.0,<4"]
|
|
matrix = ["matrix-nio[e2e]>=0.24.0,<1"]
|
|
cli = ["simple-term-menu>=1.0,<2"]
|
|
tts-premium = ["elevenlabs>=1.0,<2"]
|
|
voice = ["sounddevice>=0.4.6,<1", "numpy>=1.24.0,<3"]
|
|
pty = [
|
|
"ptyprocess>=0.7.0,<1; sys_platform != 'win32'",
|
|
"pywinpty>=2.0.0,<3; sys_platform == 'win32'",
|
|
]
|
|
honcho = ["honcho-ai>=2.0.1,<3"]
|
|
mcp = ["mcp>=1.2.0,<2"]
|
|
homeassistant = ["aiohttp>=3.9.0,<4"]
|
|
sms = ["aiohttp>=3.9.0,<4"]
|
|
acp = ["agent-client-protocol>=0.8.1,<1.0"]
|
|
dingtalk = ["dingtalk-stream>=0.1.0,<1"]
|
|
rl = [
|
|
"atroposlib @ git+https://github.com/NousResearch/atropos.git",
|
|
"tinker @ git+https://github.com/thinking-machines-lab/tinker.git",
|
|
"fastapi>=0.104.0,<1",
|
|
"uvicorn[standard]>=0.24.0,<1",
|
|
"wandb>=0.15.0,<1",
|
|
]
|
|
yc-bench = ["yc-bench @ git+https://github.com/collinear-ai/yc-bench.git"]
|
|
all = [
|
|
"hermes-agent[modal]",
|
|
"hermes-agent[daytona]",
|
|
"hermes-agent[messaging]",
|
|
"hermes-agent[cron]",
|
|
"hermes-agent[cli]",
|
|
"hermes-agent[dev]",
|
|
"hermes-agent[tts-premium]",
|
|
"hermes-agent[slack]",
|
|
"hermes-agent[pty]",
|
|
"hermes-agent[honcho]",
|
|
"hermes-agent[mcp]",
|
|
"hermes-agent[homeassistant]",
|
|
"hermes-agent[sms]",
|
|
"hermes-agent[acp]",
|
|
"hermes-agent[voice]",
|
|
"hermes-agent[dingtalk]",
|
|
]
|
|
|
|
[project.scripts]
|
|
hermes = "hermes_cli.main:main"
|
|
hermes-agent = "run_agent:main"
|
|
hermes-acp = "acp_adapter.entry:main"
|
|
|
|
[tool.setuptools]
|
|
py-modules = ["run_agent", "model_tools", "toolsets", "batch_runner", "trajectory_compressor", "toolset_distributions", "cli", "hermes_constants", "hermes_state", "hermes_time", "rl_cli", "utils"]
|
|
|
|
[tool.setuptools.packages.find]
|
|
include = ["agent", "tools", "tools.*", "hermes_cli", "gateway", "gateway.*", "cron", "honcho_integration", "acp_adapter"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
markers = [
|
|
"integration: marks tests requiring external services (API keys, Modal, etc.)",
|
|
]
|
|
addopts = "-m 'not integration' -n auto"
|