Jaroslav Beneš
d4cefb066a
A row in custom_tools becomes a ToolDef like any built-in, offered beside the thirteen. The registry had to stop being an import-time constant for that: `resolve_tools` now returns the schemas *and* the runners together, carried to the loop on the ToolContext. That closes a hole on the way. `run_tool` looked names up in the global REGISTRY with no reference to what had been offered, so a model naming a tool its chat was gated out of -- a family switched off, a permission the reader lacks -- had it run anyway. The resolved set is now authoritative. Arguments come from a model, so an argument may fill a hole but never move the target: the scheme and host of a URL template are literal, values are escaped for where they land, and the origin is pinned afterwards. Every redirect hop is checked the way services/fetch.py checks one, and the secret is dropped if a hop leaves the origin it was issued for. Also fixes the tool-activity block claiming every library tool had "searched the web", which it has done since the second family landed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
75 lines
2.0 KiB
TOML
75 lines
2.0 KiB
TOML
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project]
|
|
name = "lembas"
|
|
version = "0.4.0"
|
|
description = "LLeMbas - a Middle-earth themed web UI for OpenAI-compatible LLM endpoints"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
license = { file = "LICENSE" }
|
|
authors = [{ name = "Jaroslav Benes", email = "admin@ecoposta.sk" }]
|
|
keywords = ["llm", "webui", "openai", "chat", "self-hosted"]
|
|
classifiers = [
|
|
"License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
|
|
"Programming Language :: Python :: 3",
|
|
"Topic :: Communications :: Chat",
|
|
]
|
|
|
|
dependencies = [
|
|
"fastapi>=0.115",
|
|
"uvicorn[standard]>=0.32",
|
|
"jinja2>=3.1",
|
|
"sqlalchemy>=2.0",
|
|
"pydantic>=2.9",
|
|
"pydantic-settings>=2.6",
|
|
"httpx>=0.27",
|
|
"python-multipart>=0.0.12",
|
|
"argon2-cffi>=23.1",
|
|
"cryptography>=43.0",
|
|
"markdown-it-py>=3.0",
|
|
"mdit-py-plugins>=0.4",
|
|
"linkify-it-py>=2.0", # bare URLs in model output become links
|
|
"pygments>=2.18",
|
|
"nh3>=0.2.18",
|
|
"pypdf>=5.1", # PDF text extraction for attachments
|
|
"pillow>=11.0", # image validation and downscaling for vision
|
|
"typer>=0.12",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = [
|
|
"pytest>=8.3",
|
|
"pytest-asyncio>=0.24",
|
|
"ruff>=0.7",
|
|
]
|
|
# DuckDuckGo search. Optional because it brings a compiled HTTP client and an
|
|
# XML parser with it, and the other two search providers need only httpx, which
|
|
# is already a core dependency. Without this the provider is offered in the
|
|
# admin UI with an install hint rather than silently missing.
|
|
search = ["ddgs>=9.0"]
|
|
|
|
[project.scripts]
|
|
lembas = "lembas.cli:app"
|
|
|
|
[project.urls]
|
|
Homepage = "https://github.com/homer/LLeMbas"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/lembas"]
|
|
|
|
[tool.ruff]
|
|
line-length = 100
|
|
target-version = "py311"
|
|
src = ["src", "tests"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "I", "UP", "B", "SIM", "C4"]
|
|
ignore = ["B008"] # FastAPI Depends() in defaults is idiomatic
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
asyncio_mode = "auto"
|
|
filterwarnings = ["ignore::DeprecationWarning"]
|