pyproject.toml

[project]
name = "superlocalmemory"
version = "4.2.11"
description = "The governed memory brain for AI agents: one local memory for Claude Code, Codex, Cursor, Copilot, ChatGPT and any MCP client"
readme = "README.md"
license = "AGPL-3.0-or-later"
license-files = ["LICENSE", "NOTICE"]
requires-python = ">=3.12,<3.15"
authors = [
    {name = "Varun Pratap Bhardwaj", email = "admin@superlocalmemory.com"},
]
keywords = [
    "ai-memory", "agent-memory", "mcp-server", "mcp", "claude-code", "codex",
    "cursor", "chatgpt", "rag", "knowledge-graph", "local-first", "privacy-first",
    "gdpr", "eu-ai-act", "information-geometry", "multimodal-memory",
    "gemma", "embeddinggemma", "ollama", "local-llm", "jev", "answer-verification",
    "hallucination-prevention", "ai-reliability-engineering", "agent-to-agent",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Operating System :: MacOS",
    "Operating System :: Microsoft :: Windows",
    "Operating System :: POSIX :: Linux",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
    "Topic :: Software Development :: Libraries :: Python Modules",
]

dependencies = [
    # All versions hard-pinned to the verified-good combination.
    # Mixing versions outside these pins triggers per-batch memory
    # blow-up in the embedding worker on Apple Silicon and breaks
    # recall/remember latency targets. Update only after benchmarking.
    "httpx==0.28.1",
    "numpy==2.4.4",
    "scipy==1.17.1",
    "networkx==3.6.1",
    "mcp==2.2.0",
    "jsonschema==4.26.0",
    "python-dateutil==2.9.0.post0",
    "rank-bm25==0.2.2",
    "vadersentiment==3.3.2",
    "einops==0.8.2",
    "fastapi[all]==0.139.2",
    "uvicorn==0.46.0",
    "websockets==16.0",
    "keyring==25.7.0",
    "zeroconf>=0.140",
    "lightgbm==4.6.0",
    "orjson==3.11.9",
    # TOML writer for portable-kit IDE config (codex uses .codex/config.toml).
    # stdlib tomllib is read-only; without this, connect_ide('codex') silently
    # fails to write the MCP server block.
    "tomli-w==1.2.0",
    "tree-sitter==0.25.2",
    "tree-sitter-language-pack==0.13.0",
    "rustworkx==0.17.1",
    "watchdog==5.0.3",
    "psutil==7.2.2",
    "structlog==25.5.0",
    "portalocker==3.2.0",
    # Capture-file ACLs are applied through the verified Windows file handle.
    # Keep this direct: portalocker also needs pywin32 today, but capture must
    # not depend on that transitive implementation detail.
    "pywin32==311; sys_platform == 'win32'",
    "cryptography==50.0.0",
    # Semantic search + cross-encoder reranker. Do NOT use
    # sentence-transformers[onnx] — its extras pull optimum which
    # overrides the sentence-transformers pin via transitive deps.
    # Pin all three explicitly instead.
    # 4.1.18: moved to the oldest release lines that carry the published
    # security fixes (latest patch of each). Benchmarked against the previous
    # pins on the same cached models: embeddings are bit-identical (existing
    # stores keep matching), reranker orderings are unchanged, and worker peak
    # memory is lower. transformers 5.17+ removes get_extended_attention_mask,
    # which nomic-embed's remote modeling code calls: re-test before moving.
    "sentence-transformers==5.6.1",
    "optimum==2.1.0",
    "onnxruntime==1.24.4",
    "transformers==5.10.4",
    "huggingface_hub==1.5.0",
    "torch==2.13.0",
    "scikit-learn==1.8.0",
    # Vector KNN extension for the semantic channel.
    "sqlite-vec==0.1.9",
    # Scale Engine projections.  These ship with the base install so every
    # fresh Python user can prepare them on day one.  They remain inactive
    # until `slm db scale prepare -> verify -> promote` proves parity with
    # canonical SQLite; dependency installation never migrates user data.
    "lancedb==0.30.2",
    # Cozo's on-disk format is not forward-compatible across these native
    # bindings. Existing SLM graph stores were created by 0.3.0; upgrading the
    # wheel without an export/import migration makes daemon startup panic.
    # 64-bit ARM Linux is the one exception: 0.3.0 ships no wheel there (pip cannot
    # install SLM at all), and the 0.7.6 series is the only one built for it - and
    # the one 3.8.6 gave those computers, so their stores already match it.
    "pycozo[embedded]==0.3.0; sys_platform != 'linux' or platform_machine != 'aarch64'",
    "pycozo[embedded]==0.7.6; sys_platform == 'linux' and platform_machine == 'aarch64'",
    # v3.6.10: LLMLingua-2 prose compression (aggressive mode, opt-in at runtime).
    # Hard dependency so `pip install superlocalmemory` ships compression-ready;
    # the ~560MB model downloads on first setup/warmup (fail-open). Verified the
    # pin does NOT disturb the transformers/torch/numpy pins above.
    "llmlingua==0.2.2",
    # LLMLingua pulls NLTK transitively. Pin above the disclosed traversal
    # advisories so clean installs cannot resolve to a vulnerable release.
    "nltk==3.10.3",
    # Security floors for packages SuperLocalMemory does not import directly.
    # `pip install --upgrade` keeps an already-installed transitive version
    # when it still satisfies the dependents' ranges, so without these floors
    # an existing install would keep the vulnerable release. Floors, not
    # exact pins, so they never conflict with the packages that pull them in.
    "accelerate>=1.15.0",   # via llmlingua
    "anyio>=4.14.2",        # via mcp, httpx, starlette
    "fsspec>=2026.6.0",     # via huggingface_hub, torch
    "httpx2>=2.12.0",       # via mcp; carries the patched httpcore2
    "pyjwt>=2.15.0",        # via mcp
    "setuptools>=83.0.0",   # via torch
    "urllib3>=2.8.0",       # via requests, lancedb
]

[project.optional-dependencies]
# `search` is now a no-op alias kept for backwards compatibility; the deps
# moved into core in v3.4.18. ``pip install superlocalmemory[search]`` still
# works but installs nothing extra.
search = [
    # Same hard pin as core deps — no [onnx] extra.
    "sentence-transformers==5.6.1",
    "optimum==2.1.0",
    "einops==0.8.2",
    "torch==2.13.0",
    "scikit-learn==1.8.0",
    "onnxruntime==1.24.4",
]
ui = [
    "fastapi[all]>=0.135.1",
    "uvicorn>=0.42.0",
    "python-multipart>=0.0.6,<1.0.0",
]
injection = [
    "tiktoken>=0.8.0",
]
learning = [
    "lightgbm>=4.0.0",
]
performance = [
    "orjson>=3.9.0",
]
lancedb = [
    "lancedb==0.30.2",
]
cozo = [
    "pycozo[embedded]==0.3.0; sys_platform != 'linux' or platform_machine != 'aarch64'",
    "pycozo[embedded]==0.7.6; sys_platform == 'linux' and platform_machine == 'aarch64'",
]
# Backwards-compatible explicit install target for automation and docs.  The
# packages are also base dependencies from v3.7 onward.
scale = [
    "lancedb==0.30.2",
    "pycozo[embedded]==0.3.0; sys_platform != 'linux' or platform_machine != 'aarch64'",
    "pycozo[embedded]==0.7.6; sys_platform == 'linux' and platform_machine == 'aarch64'",
]
ingestion = [
    "keyring>=25.0.0",
    "google-auth-oauthlib>=1.2.0",
    "google-api-python-client>=2.100.0",
    "icalendar>=6.0.0",
]
# 4.1.18: lets recall say "nothing here answers that". Apple Silicon only —
# laya-mlx ships no other wheels, so the markers make this a no-op elsewhere.
# Pinned to the release that was measured; newer releases need re-measuring.
laya = [
    "laya-mlx>=0.2.0,<0.3; sys_platform == 'darwin' and platform_machine == 'arm64'",
]
full = [
    "superlocalmemory[search,ui,learning,performance,ingestion,injection,scale,laya]",
]
dev = [
    "pytest>=8.0",
    "pytest-cov>=4.1",
    "pytest-asyncio>=0.21",
    "sqlite-vec>=0.1.6",
    # Starlette TestClient's maintained synchronous backend. Test-only: the
    # product runtime continues to use the separately pinned httpx client.
    "httpx2==2.12.0",
    # Architecture contracts live in .importlinter; CI and tests run lint-imports.
    "import-linter==2.15",
]

[project.urls]
Homepage = "https://superlocalmemory.com"
Repository = "https://github.com/qualixar/superlocalmemory"
Documentation = "https://github.com/qualixar/superlocalmemory/wiki"
Issues = "https://github.com/qualixar/superlocalmemory/issues"

[project.scripts]
slm = "superlocalmemory.cli.main:main"
# Same CLI under the package name, so `uvx superlocalmemory mcp` (what MCP
# registry clients run for a PyPI entry) finds a command.
superlocalmemory = "superlocalmemory.cli.main:main"

[build-system]
requires = ["setuptools>=77.0.3", "wheel"]
build-backend = "setuptools.build_meta"

[tool.setuptools.packages.find]
where = ["src"]

[tool.setuptools.package-data]
superlocalmemory = ["ui/**/*", "optimize/NOTICE", "contracts/schemas/*.json", "runtimes/locks/*.txt",
                    "encoding/data/*.txt"]

[tool.setuptools.data-files]
"share/superlocalmemory/codex/skills/slm-bot-memory" = ["plugin-src/skills/slm-bot-memory/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-cache" = ["plugin-src/skills/slm-cache/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-compress" = ["plugin-src/skills/slm-compress/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-getting-started-bot" = ["plugin-src/skills/slm-getting-started-bot/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-governance" = ["plugin-src/skills/slm-governance/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-graph" = ["plugin-src/skills/slm-graph/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-loop" = ["plugin-src/skills/slm-loop/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-media" = ["plugin-src/skills/slm-media/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-mesh" = ["plugin-src/skills/slm-mesh/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-profile" = ["plugin-src/skills/slm-profile/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-recall" = ["plugin-src/skills/slm-recall/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-remember" = ["plugin-src/skills/slm-remember/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-scope" = ["plugin-src/skills/slm-scope/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-session" = ["plugin-src/skills/slm-session/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-status" = ["plugin-src/skills/slm-status/SKILL.md"]
"share/superlocalmemory/codex/skills/slm-web-access" = ["plugin-src/skills/slm-web-access/SKILL.md"]
"share/superlocalmemory/codex/agents" = [
    "plugin-src/agents/slm-memory-advisor.md",
    "plugin-src/agents/slm-optimize-advisor.md",
    "plugin-src/agents/slm-governance-advisor.md",
    "plugin-src/agents/slm-loop-runner.md",
]
"share/superlocalmemory/portable-kit/rules" = ["plugin-src/rules/AGENTS.md", "plugin-src/rules/CLAUDE.md.fragment"]

[tool.pytest.ini_options]
testpaths = ["tests"]
pythonpath = ["src", "."]  # "." so `-p tests._isolation_plugin` imports under bare `pytest`
addopts = "-p tests._isolation_plugin -p no:cacheprovider -p no:subtests -m 'not slow and not ollama and not benchmark and not native'"
asyncio_mode = "auto"
faulthandler_timeout = 0
markers = [
    "latency_budget: model-free synthetic recall regression budget; runs in the default gate",
    "slow: marks tests as slow — real engine/model loading (run with: pytest -m slow)",
    "ollama: marks tests that require a running Ollama instance",
    "benchmark: marks CI-only evo-memory benchmark tests (run with: pytest tests/test_benchmarks/ -m benchmark)",
    "native: marks optional native-backend tests that run in a dedicated process lane",
    "e2e_remote: two real daemons over TLS (opt-in: SLM_E2E_REMOTE=1)",
    "asyncio: marks tests as async — runs via pytest-asyncio (auto-mode in this project)",
]
filterwarnings = [
    "ignore::DeprecationWarning:vaderSentiment",
]

[tool.coverage.run]
source = ["superlocalmemory"]
omit = [
    "*/tests/*",
    "*/ui/*",
    "*/cli/*",
    "*/__main__.py",
]

[tool.coverage.report]
fail_under = 0
show_missing = true
exclude_lines = [
    "pragma: no cover",
    "if TYPE_CHECKING:",
    "if __name__ ==",
    "@overload",
]

[tool.coverage.html]
directory = "htmlcov"

[tool.ruff]
target-version = "py312"
line-length = 100
src = ["src"]

[tool.ruff.lint]
select = ["E", "F", "I", "W"]

[dependency-groups]
dev = [
    "build>=1.4.0",
    "httpx2==2.12.0",
    "pytest>=9.0.2",
    "pytest-asyncio>=0.21",
    # The release gate runs the ~22k-test suite in parallel (-n); serial it needs
    # more than the job's whole time budget. Dev group only, never published.
    "pytest-xdist>=3.6",
    "twine>=6.2.0",
    "wheel==0.46.3",
]