fastworkflow 2.17.35__tar.gz → 2.18.2__tar.gz

fastworkflow-2.17.35/README.md → fastworkflow-2.18.2/PKG-INFO

@@ -1,3 +1,55 @@
+Metadata-Version: 2.1
+Name: fastworkflow
+Version: 2.18.2
+Summary: A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX
+License: Apache-2.0
+Keywords: fastworkflow,ai,workflow,llm,openai
+Author: Dhar Rawal
+Author-email: drawal@radiantlogic.com
+Requires-Python: >=3.11,<3.14
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Provides-Extra: fastapi
+Provides-Extra: server
+Provides-Extra: training
+Requires-Dist: aiohttp (>=3.13.4)
+Requires-Dist: colorama (>=0.4.6,<0.5.0)
+Requires-Dist: cryptography (>=46.0.7)
+Requires-Dist: datasets (>=4.0.0,<5.0.0) ; extra == "training"
+Requires-Dist: dspy (>=3.0.1,<4.0.0)
+Requires-Dist: fastapi (>=0.120.1) ; extra == "server" or extra == "fastapi"
+Requires-Dist: fastapi-mcp (>=0.4.0,<0.5.0) ; extra == "server" or extra == "fastapi"
+Requires-Dist: filelock (>=3.20.1)
+Requires-Dist: idna (>=3.15)
+Requires-Dist: libcst (>=1.8.2,<2.0.0)
+Requires-Dist: litellm (>=1.83.7,<2.0.0)
+Requires-Dist: mmh3 (>=5.1.0,<6.0.0)
+Requires-Dist: openai (>=2.8.0)
+Requires-Dist: orjson (>=3.11.6)
+Requires-Dist: prompt_toolkit (>=3.0.43,<4.0.0)
+Requires-Dist: pyarrow (>=23.0.1)
+Requires-Dist: pyasn1 (>=0.6.3)
+Requires-Dist: pydantic (>=2.9.2,<3.0.0)
+Requires-Dist: pygments (>=2.20.0)
+Requires-Dist: pyjwt[crypto] (>=2.13.0) ; extra == "server" or extra == "fastapi"
+Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
+Requires-Dist: python-levenshtein (>=0.27.1,<0.28.0)
+Requires-Dist: python-multipart (>=0.0.27) ; extra == "server" or extra == "fastapi"
+Requires-Dist: requests (>=2.33.0)
+Requires-Dist: scikit-learn (>=1.6.1,<2.0.0)
+Requires-Dist: sentencepiece (>=0.2.0,<0.3.0)
+Requires-Dist: speedict (>=0.3.12,<0.4.0)
+Requires-Dist: starlette (>=0.49.1) ; extra == "server" or extra == "fastapi"
+Requires-Dist: torch (>=2.7.1,<3.0.0)
+Requires-Dist: transformers (>=4.48.2,<6.0.0)
+Requires-Dist: urllib3 (>=2.7.0)
+Requires-Dist: uvicorn (>=0.33.0) ; extra == "server" or extra == "fastapi"
+Project-URL: homepage, https://github.com/radiantlogicinc/fastworkflow
+Project-URL: repository, https://github.com/radiantlogicinc/fastworkflow
+Description-Content-Type: text/markdown
+
 <!-- Logo and Title -->
 <img src="logo.png" height="64" alt="fastWorkflow Logo and Title">
 
@@ -149,6 +201,33 @@ uv pip install fastworkflow
 - `fastWorkflow` requires Python 3.11+ or higher.
 - Training (`fastworkflow train`) also expects the optional Hugging Face `datasets` package. Install it by including the dev group when using Poetry.
 
+### Optional extras
+
+The core install depends on **plain** `litellm` (used only as a client via `dspy.LM`) and pulls **no** proxy-server packages, so it stays lean and co-installs cleanly with downstream apps that pin a plain `litellm` (e.g. `litellm>=1.83.11,<1.84.0`). Server- and training-only dependencies are gated behind extras:
+
+| Extra | Install | Provides |
+| --- | --- | --- |
+| `server` | `pip install "fastworkflow[server]"` | The FastAPI-MCP HTTP service (`fastworkflow run_fastapi_mcp`): `fastapi`, `uvicorn`, `fastapi-mcp`, `pyjwt[crypto]`, `python-multipart`, `starlette` (with security-patched floors). |
+| `training` | `pip install "fastworkflow[training]"` | The Hugging Face `datasets` package required by `fastworkflow train` for synthetic-utterance / parameter-example generation. |
+
+The `server` extra is only needed to *host* the FastAPI-MCP service.
+
+### Dependency compatibility
+
+`fastWorkflow` is designed to co-install with modern ML/LLM stacks. The key supported ranges are:
+
+| Package | Supported range | Notes |
+| --- | --- | --- |
+| `transformers` | `>=4.48.2,<6.0.0` | Works on transformers 5.x. The intent-detection base models are BERT/DistilBERT checkpoints that load natively on 5.x (no slow→fast tokenizer conversion required). |
+| `dspy` | `>=3.0.1,<4.0.0` | Migrated off the dspy 2.x API. |
+| `openai` | `>=2.8.0` | Compatible with openai 2.x. |
+| `litellm` | `>=1.83.7,<2.0.0` | Core depends on **plain** `litellm` (client only, no `[proxy]` extra), so downstreams can pin e.g. `litellm>=1.83.11,<1.84.0` without pulling the proxy server stack. The FastAPI-MCP server deps live in the optional `fastworkflow[server]` extra. |
+| `sentence-transformers` | not a dependency | `fastWorkflow` does not depend on `sentence-transformers`, so it imposes no constraint (use any 5.x version downstream). |
+
+`sentencepiece` is bundled as a dependency because transformers 5.x can require it to instantiate certain tokenizers.
+
+The intent-detection base models are configurable via environment variables (`INTENT_DETECTION_TINY_MODEL`, `INTENT_DETECTION_LARGE_MODEL`); see `fastworkflow.env`.
+
 ---
 
 ## Quick Start: Running an Example in 5 Minutes
@@ -551,6 +630,9 @@ For workflows with complex initialization requirements, creating a dedicated sta
 
 For production deployments and integrations, fastWorkflow provides a FastAPI-based HTTP service via the `run_fastapi_mcp` module. This exposes your workflow as REST endpoints with JWT authentication, SSE streaming, and MCP (Model Context Protocol) support.
 
+> [!note]
+> The FastAPI-MCP service requires the optional `server` extra: `pip install "fastworkflow[server]"` (or `poetry install --extras server`). Running `fastworkflow run_fastapi_mcp` without it fails fast with a clear install hint.
+
 ```sh
 # Run the FastAPI service
 python -m fastworkflow.run_fastapi_mcp \
@@ -684,6 +766,8 @@ This single command will generate the `greet.py` command, `get_properties` and `
 | `LLM_AGENT` | LiteLLM model string for the DSPy agent | `run` (agent mode) | `mistral/mistral-small-latest` |
 | `LLM_CONVERSATION_STORE` | LiteLLM model string for conversation topic/summary generation | FastAPI service | `mistral/mistral-small-latest` |
 | `LITELLM_PROXY_API_BASE` | URL of your LiteLLM Proxy server | When using `litellm_proxy/` models | *not set* |
+| `INTENT_DETECTION_TINY_MODEL` | HuggingFace model id for the small intent-detection model | `train` (optional) | `google/bert_uncased_L-4_H-128_A-2` |
+| `INTENT_DETECTION_LARGE_MODEL` | HuggingFace model id for the large intent-detection model | `train` (optional) | `distilbert-base-uncased` |
 | `NOT_FOUND` | Placeholder value for missing parameters during extraction | Always | `"NOT_FOUND"` |
 | `MISSING_INFORMATION_ERRMSG` | Error message prefix for missing parameters | Always | `"Missing required..."` |
 | `INVALID_INFORMATION_ERRMSG` | Error message prefix for invalid parameters | Always | `"Invalid information..."` |
@@ -762,4 +846,4 @@ Interested in contributing to `fastWorkflow` itself? Great!
 
 ## License
 
-`fastWorkflow` is released under the Apache License 2.0
+`fastWorkflow` is released under the Apache License 2.0

fastworkflow-2.17.35/PKG-INFO → fastworkflow-2.18.2/README.md

@@ -1,48 +1,3 @@
-Metadata-Version: 2.1
-Name: fastworkflow
-Version: 2.17.35
-Summary: A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX
-License: Apache-2.0
-Keywords: fastworkflow,ai,workflow,llm,openai
-Author: Dhar Rawal
-Author-email: drawal@radiantlogic.com
-Requires-Python: >=3.11,<3.14
-Classifier: License :: OSI Approved :: Apache Software License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Provides-Extra: fastapi
-Provides-Extra: training
-Requires-Dist: aiohttp (>=3.13.3)
-Requires-Dist: colorama (>=0.4.6,<0.5.0)
-Requires-Dist: datasets (>=4.0.0,<5.0.0) ; extra == "training"
-Requires-Dist: dspy (>=3.0.1,<4.0.0)
-Requires-Dist: fastapi (>=0.120.1) ; extra == "fastapi"
-Requires-Dist: fastapi-mcp (>=0.4.0,<0.5.0) ; extra == "fastapi"
-Requires-Dist: filelock (>=3.20.1)
-Requires-Dist: libcst (>=1.8.2,<2.0.0)
-Requires-Dist: litellm[proxy] (>=1.81.4,<2.0.0)
-Requires-Dist: mmh3 (>=5.1.0,<6.0.0)
-Requires-Dist: openai (>=2.8.0)
-Requires-Dist: orjson (>=3.9.15)
-Requires-Dist: prompt_toolkit (>=3.0.43,<4.0.0)
-Requires-Dist: pyasn1 (>=0.6.2)
-Requires-Dist: pydantic (>=2.9.2,<3.0.0)
-Requires-Dist: pyjwt[crypto] (>=2.4.0) ; extra == "fastapi"
-Requires-Dist: pynacl (>=1.6.2)
-Requires-Dist: python-dotenv (>=1.0.1,<2.0.0)
-Requires-Dist: python-levenshtein (>=0.27.1,<0.28.0)
-Requires-Dist: scikit-learn (>=1.6.1,<2.0.0)
-Requires-Dist: speedict (>=0.3.12,<0.4.0)
-Requires-Dist: starlette (>=0.49.1)
-Requires-Dist: torch (>=2.7.1,<3.0.0)
-Requires-Dist: transformers (>=4.48.2,<5.0.0)
-Requires-Dist: urllib3 (>=2.6.0)
-Requires-Dist: uvicorn (>=0.31.1,<0.32.0) ; extra == "fastapi"
-Project-URL: homepage, https://github.com/radiantlogicinc/fastworkflow
-Project-URL: repository, https://github.com/radiantlogicinc/fastworkflow
-Description-Content-Type: text/markdown
-
 <!-- Logo and Title -->
 <img src="logo.png" height="64" alt="fastWorkflow Logo and Title">
 
@@ -194,6 +149,33 @@ uv pip install fastworkflow
 - `fastWorkflow` requires Python 3.11+ or higher.
 - Training (`fastworkflow train`) also expects the optional Hugging Face `datasets` package. Install it by including the dev group when using Poetry.
 
+### Optional extras
+
+The core install depends on **plain** `litellm` (used only as a client via `dspy.LM`) and pulls **no** proxy-server packages, so it stays lean and co-installs cleanly with downstream apps that pin a plain `litellm` (e.g. `litellm>=1.83.11,<1.84.0`). Server- and training-only dependencies are gated behind extras:
+
+| Extra | Install | Provides |
+| --- | --- | --- |
+| `server` | `pip install "fastworkflow[server]"` | The FastAPI-MCP HTTP service (`fastworkflow run_fastapi_mcp`): `fastapi`, `uvicorn`, `fastapi-mcp`, `pyjwt[crypto]`, `python-multipart`, `starlette` (with security-patched floors). |
+| `training` | `pip install "fastworkflow[training]"` | The Hugging Face `datasets` package required by `fastworkflow train` for synthetic-utterance / parameter-example generation. |
+
+The `server` extra is only needed to *host* the FastAPI-MCP service.
+
+### Dependency compatibility
+
+`fastWorkflow` is designed to co-install with modern ML/LLM stacks. The key supported ranges are:
+
+| Package | Supported range | Notes |
+| --- | --- | --- |
+| `transformers` | `>=4.48.2,<6.0.0` | Works on transformers 5.x. The intent-detection base models are BERT/DistilBERT checkpoints that load natively on 5.x (no slow→fast tokenizer conversion required). |
+| `dspy` | `>=3.0.1,<4.0.0` | Migrated off the dspy 2.x API. |
+| `openai` | `>=2.8.0` | Compatible with openai 2.x. |
+| `litellm` | `>=1.83.7,<2.0.0` | Core depends on **plain** `litellm` (client only, no `[proxy]` extra), so downstreams can pin e.g. `litellm>=1.83.11,<1.84.0` without pulling the proxy server stack. The FastAPI-MCP server deps live in the optional `fastworkflow[server]` extra. |
+| `sentence-transformers` | not a dependency | `fastWorkflow` does not depend on `sentence-transformers`, so it imposes no constraint (use any 5.x version downstream). |
+
+`sentencepiece` is bundled as a dependency because transformers 5.x can require it to instantiate certain tokenizers.
+
+The intent-detection base models are configurable via environment variables (`INTENT_DETECTION_TINY_MODEL`, `INTENT_DETECTION_LARGE_MODEL`); see `fastworkflow.env`.
+
 ---
 
 ## Quick Start: Running an Example in 5 Minutes
@@ -596,6 +578,9 @@ For workflows with complex initialization requirements, creating a dedicated sta
 
 For production deployments and integrations, fastWorkflow provides a FastAPI-based HTTP service via the `run_fastapi_mcp` module. This exposes your workflow as REST endpoints with JWT authentication, SSE streaming, and MCP (Model Context Protocol) support.
 
+> [!note]
+> The FastAPI-MCP service requires the optional `server` extra: `pip install "fastworkflow[server]"` (or `poetry install --extras server`). Running `fastworkflow run_fastapi_mcp` without it fails fast with a clear install hint.
+
 ```sh
 # Run the FastAPI service
 python -m fastworkflow.run_fastapi_mcp \
@@ -729,6 +714,8 @@ This single command will generate the `greet.py` command, `get_properties` and `
 | `LLM_AGENT` | LiteLLM model string for the DSPy agent | `run` (agent mode) | `mistral/mistral-small-latest` |
 | `LLM_CONVERSATION_STORE` | LiteLLM model string for conversation topic/summary generation | FastAPI service | `mistral/mistral-small-latest` |
 | `LITELLM_PROXY_API_BASE` | URL of your LiteLLM Proxy server | When using `litellm_proxy/` models | *not set* |
+| `INTENT_DETECTION_TINY_MODEL` | HuggingFace model id for the small intent-detection model | `train` (optional) | `google/bert_uncased_L-4_H-128_A-2` |
+| `INTENT_DETECTION_LARGE_MODEL` | HuggingFace model id for the large intent-detection model | `train` (optional) | `distilbert-base-uncased` |
 | `NOT_FOUND` | Placeholder value for missing parameters during extraction | Always | `"NOT_FOUND"` |
 | `MISSING_INFORMATION_ERRMSG` | Error message prefix for missing parameters | Always | `"Missing required..."` |
 | `INVALID_INFORMATION_ERRMSG` | Error message prefix for invalid parameters | Always | `"Invalid information..."` |
@@ -807,4 +794,4 @@ Interested in contributing to `fastWorkflow` itself? Great!
 
 ## License
 
-`fastWorkflow` is released under the Apache License 2.0
+`fastWorkflow` is released under the Apache License 2.0

{fastworkflow-2.17.35 → fastworkflow-2.18.2}/fastworkflow/cli.py

@@ -381,8 +381,41 @@ def run_with_defaults(args):  # sourcery skip: extract-duplicate-method
     from .run.__main__ import run_main as _run_main
     return _run_main(args)
 
+def _require_server_extra():
+    """Ensure the optional `server` extra is installed before launching the FastAPI-MCP service.
+
+    The FastAPI-MCP server (`fastworkflow run_fastapi_mcp`) is the only feature that
+    needs the server-only dependencies (fastapi, uvicorn, fastapi-mcp, pyjwt). These
+    live behind the optional `fastworkflow[server]` extra so that the core/client
+    install (and `fastworkflow train`) stays lean. Fail early with a clear, actionable
+    message instead of letting the subprocess die with a bare ImportError.
+    """
+    import importlib.util
+
+    if missing := [
+        pkg
+        for pkg, mod in (
+            ("fastapi", "fastapi"),
+            ("uvicorn", "uvicorn"),
+            ("fastapi-mcp", "fastapi_mcp"),
+            ("pyjwt", "jwt"),
+        )
+        if importlib.util.find_spec(mod) is None
+    ]:
+        rprint(
+            "[bold red]Error:[/bold red] the FastAPI-MCP server requires the optional "
+            "'server' extra, which is not installed.\n"
+            f"Missing packages: {', '.join(missing)}\n\n"
+            "Install it with one of:\n"
+            "  pip install \"fastworkflow[server]\"\n"
+            "  poetry install --extras server"
+        )
+        sys.exit(1)
+
+
 def run_fastapi_mcp_with_defaults(args):  # sourcery skip: extract-duplicate-method
     """Wrapper for fastapi mcp server that sets default env file paths based on context."""
+    _require_server_extra()
     if args.env_file_path is None or args.passwords_file_path is None:
         default_env, default_passwords = find_default_env_files(args.workflow_path)
     if args.env_file_path is None:

{fastworkflow-2.17.35 → fastworkflow-2.18.2}/fastworkflow/examples/fastworkflow.env

@@ -21,6 +21,15 @@ LLM_CONVERSATION_STORE=mistral/mistral-small-latest
 # The proxy API key should be set in fastworkflow.passwords.env
 # LITELLM_PROXY_API_BASE=http://127.0.0.1:4000
 
+# ============================================================================
+# Intent-detection base models (Optional)
+# ============================================================================
+# The intent-detection trainer uses two small HuggingFace models. These defaults
+# are BERT/DistilBERT checkpoints that are natively compatible with transformers
+# 4.48+ and 5.x (they ship a model_type and a loadable tokenizer).
+# INTENT_DETECTION_TINY_MODEL=google/bert_uncased_L-4_H-128_A-2
+# INTENT_DETECTION_LARGE_MODEL=distilbert-base-uncased
+
 # ============================================================================
 # Workflow Configuration
 # ============================================================================

{fastworkflow-2.17.35 → fastworkflow-2.18.2}/fastworkflow/model_pipeline_training.py

@@ -1,5 +1,5 @@
 import os
-from typing import Optional, ClassVar
+from typing import ClassVar
 from transformers import AutoTokenizer, AutoModel, AutoModelForSequenceClassification
 from torch.optim import AdamW
 from sklearn.decomposition import PCA
@@ -23,9 +23,19 @@ from fastworkflow.command_routing import RoutingDefinition
 
 device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
 
+# transformers 5.x emits a tqdm "Loading weights" progress bar on every
+# from_pretrained() call. fastWorkflow loads one intent-detection model per
+# context, so these bars are noise when running/training a workflow. Suppress them.
+try:
+    from transformers.utils.logging import disable_progress_bar
+    disable_progress_bar()
+except Exception:  # noqa: BLE001 - older transformers may not expose this
+    pass
+
 dataset=None
 label_encoder=LabelEncoder()
 
+
 def save_label_encoder(filepath):
     global label_encoder
     with open(filepath, 'wb') as f:
@@ -823,12 +833,20 @@ def train(workflow: fastworkflow.Workflow):
         X, y = zip(*utterance_command_tuples)
         num= len(set(y))
         k_val = 3 if num>2 else 2
-        model_name = "prajjwal1/bert-tiny"
+        # Base models are configurable so downstream apps can swap them without
+        # code changes. The defaults are transformers 5.x-compatible BERT/DistilBERT
+        # checkpoints that ship a `model_type` and a loadable tokenizer.
+        tiny_model_name = fastworkflow.get_env_var(
+            "INTENT_DETECTION_TINY_MODEL", default="google/bert_uncased_L-4_H-128_A-2")
+        large_model_name = fastworkflow.get_env_var(
+            "INTENT_DETECTION_LARGE_MODEL", default="distilbert-base-uncased")
+
+        model_name = tiny_model_name
         print(f"\nLoading {model_name}...")
         tiny_tokenizer = AutoTokenizer.from_pretrained(model_name)
         tiny_model = AutoModelForSequenceClassification.from_pretrained(model_name, num_labels=num).to(device)
 
-        model_name = "distilbert-base-uncased"
+        model_name = large_model_name
         print(f"Loading {model_name}...")
         distil_tokenizer = AutoTokenizer.from_pretrained(model_name)
         #large_model = AutoModel.from_pretrained(model_name).to(device)

{fastworkflow-2.17.35 → fastworkflow-2.18.2}/fastworkflow/utils/dspy_logger.py

@@ -160,7 +160,7 @@ def _how_to_use():
 
             self.generate_answer = dspy.Predict("topic, question -> answer")
 
-        gpt3_turbo = dspy.OpenAI(model="gpt-3.5-turbo", api_key="<YOUR_API_KEY>")
+        gpt3_turbo = dspy.LM(model="openai/gpt-3.5-turbo", api_key="<YOUR_API_KEY>")
 
         @DSPyForward.intercept
         def forward(self, topic, question):

fastworkflow-2.18.2/pyproject.toml

@@ -0,0 +1,117 @@
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry.urls]
+homepage = "https://github.com/radiantlogicinc/fastworkflow"
+repository = "https://github.com/radiantlogicinc/fastworkflow"
+# documentation = "https://fastworkflow.ai/readthedocs"
+
+[tool.poetry]
+name = "fastworkflow"
+version = "2.18.2"
+description = "A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX"
+authors = ["Dhar Rawal <drawal@radiantlogic.com>"]
+license = "Apache-2.0"
+readme = "README.md"
+keywords = ["fastworkflow", "ai", "workflow", "llm", "openai"]
+include = [
+    "fastworkflow/examples/fastworkflow.env",
+    "fastworkflow/examples/fastworkflow.passwords.env",
+    "fastworkflow/_commands/.gitkeep"
+]
+exclude = [
+    "**/___command_info",
+    "**/___workflow_contexts",
+    "./.env",
+    "**/simple_workflow_template/tests"
+]
+
+[tool.poetry.scripts]
+fastworkflow = "fastworkflow.cli:main"
+
+[tool.poetry.dependencies]
+python = ">=3.11,<3.14"
+pydantic = "^2.9.2"
+speedict = "^0.3.12"
+python-dotenv = "^1.2.2"  # CVE-2026-28684 (set_key/unset_key symlink overwrite)
+scikit-learn = "^1.6.1"
+# Allow transformers 5.x (downstream apps pin >=5,<6). The intent-detection
+# trainer no longer relies on the slow->fast tokenizer conversion path that
+# transformers 5.x removed (see model_pipeline_training._load_tokenizer).
+transformers = ">=4.48.2,<6.0.0"
+# sentencepiece is required by transformers 5.x to instantiate some tokenizers
+# (it replaced the in-tree slow->fast conversion path). Declared here so users
+# never have to add it manually.
+sentencepiece = "^0.2.0"
+mmh3 = "^5.1.0"
+python-levenshtein = "^0.27.1"
+colorama = "^0.4.6"
+dspy = "^3.0.1"
+torch = "^2.7.1"
+prompt_toolkit = "^3.0.43"
+libcst = "^1.8.2"
+openai = ">=2.8.0"
+# CORE depends on PLAIN litellm (no proxy extra). fastworkflow uses litellm only
+# as a client (via dspy.LM and litellm.completion); it never runs a litellm proxy
+# SERVER. The old `litellm[proxy]` extra dragged in the full proxy stack
+# (fastapi-sso, gunicorn, apscheduler, litellm-enterprise, mcp, ...) AND pinned
+# python-multipart, which combined with our python-multipart>=0.0.27 floor forced
+# a prerelease (1.88.0rc1). Plain litellm lets the resolver pick a STABLE release
+# and lets downstreams pin e.g. litellm>=1.83.11,<1.84.0 without the proxy extra.
+# CVE coverage (CVE-2026-35029/35030/42203/42271 + GHSA-69x8-hrgq-fjj8) is satisfied
+# by stable litellm >=1.83.7. Proxy-server deps now live in the optional `server` extra.
+litellm = ">=1.83.7,<2.0.0"
+# ---- Optional `server` extra (FastAPI-MCP service: `fastworkflow run_fastapi_mcp`) ----
+uvicorn = {version = ">=0.33.0", optional = true}
+fastapi = {version = ">=0.120.1", optional = true}
+fastapi-mcp = {version = "^0.4.0", optional = true}
+pyjwt = {extras = ["crypto"], version = ">=2.13.0", optional = true}  # Replaces python-jose (CVE-2024-23342); >=2.13.0 fixes alg allow-list bypass (PYSEC-2026-176) + DoS (PYSEC-2026-175/177/178/179)
+python-multipart = {version = ">=0.0.27", optional = true}  # CVE-2026-40347, CVE-2026-42561 (multipart parsing DoS). Only pulled by the `server` extra (FastAPI form parsing); not needed by the client/core install.
+starlette = {version = ">=0.49.1", optional = true}  # CVE-2025-62727, CVE-2025-54121 (Range header DoS). Pulled transitively by fastapi in the `server` extra.
+datasets = {version = "^4.0.0", optional = true}
+
+# Security floor constraints for transitive dependencies of the CORE (client) install.
+# These ensure users get patched versions even though these are not direct deps.
+# NOTE: floors that only applied to the litellm proxy SERVER (python-multipart,
+# pyjwt, uvicorn, starlette) are scoped to the `server` extra above. Floors that
+# only existed because `litellm[proxy]` pulled the package (mako -> alembic,
+# pynacl, fastapi-sso) have been dropped: with the proxy extra gone those packages
+# are no longer in the dependency graph for any fastworkflow install (core OR
+# server), so there is nothing to patch and no CVE regression.
+orjson = ">=3.11.6"      # CVE-2024-27454 (loads recursion) + CVE-2025-67221 (dumps recursion DoS, fixed in 3.11.6)
+urllib3 = ">=2.7.0"      # CVE-2025-66418, CVE-2025-66471 (decompression chain) + PYSEC-2026-141/142
+aiohttp = ">=3.13.4"     # CVE-2025-69223 + 7 others (zip bomb, DoS) + CVE-2026-22815/34513-34525 (3.13.4)
+pyasn1 = ">=0.6.3"       # CVE-2026-23490 + CVE-2026-30922 (decoder DoS)
+filelock = ">=3.20.1"    # CVE-2025-68146 (TOCTOU symlink)
+cryptography = ">=46.0.7"  # CVE-2026-26007 + PYSEC-2026-35/36
+requests = ">=2.33.0"    # CVE-2026-25645 (extract_zipped_paths temp reuse)
+idna = ">=3.15"          # CVE-2026-45409
+pygments = ">=2.20.0"    # CVE-2026-4539 (ReDoS in AdlLexer)
+pyarrow = ">=23.0.1"     # PYSEC-2026-113 (use-after-free; only via datasets/training extra)
+
+[tool.poetry.group.dev.dependencies]
+isort = "^5.13.2"
+black = "^26.3.1"  # CVE-2026-32274
+flake8 = "^7.1.1"
+pylint = "^3.3.1"
+mypy = "^1.13.0"
+bandit = "^1.7.10"
+
+[tool.poetry.group.test.dependencies]
+pytest = "^9.0.3"  # CVE-2025-71176 (tmp dir privilege/DoS)
+requests-mock = "^1.12.1"
+pytest-cov = "^6.2.1"
+
+# poetry install --with aws if you are using AWS Bedrock for LLM or LLM_AGENT
+[tool.poetry.group.aws.dependencies]
+boto3 = {version = ">=1.36.0", optional = true}
+
+[tool.poetry.extras]
+training = ["datasets"]
+# Full FastAPI-MCP server feature set (`fastworkflow run_fastapi_mcp`) with the
+# security-patched server deps. `litellm_proxy/` client routing does NOT require
+# this extra (plain litellm handles it via api_base).
+server = ["uvicorn", "fastapi", "fastapi-mcp", "pyjwt", "python-multipart", "starlette"]
+# Backward-compatible alias for the pre-2.18.2 extra name.
+fastapi = ["uvicorn", "fastapi", "fastapi-mcp", "pyjwt", "python-multipart", "starlette"]

fastworkflow-2.17.35/pyproject.toml

@@ -1,85 +0,0 @@
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
-
-[tool.poetry.urls]
-homepage = "https://github.com/radiantlogicinc/fastworkflow"
-repository = "https://github.com/radiantlogicinc/fastworkflow"
-# documentation = "https://fastworkflow.ai/readthedocs"
-
-[tool.poetry]
-name = "fastworkflow"
-version = "2.17.35"
-description = "A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX"
-authors = ["Dhar Rawal <drawal@radiantlogic.com>"]
-license = "Apache-2.0"
-readme = "README.md"
-keywords = ["fastworkflow", "ai", "workflow", "llm", "openai"]
-include = [
-    "fastworkflow/examples/fastworkflow.env",
-    "fastworkflow/examples/fastworkflow.passwords.env",
-    "fastworkflow/_commands/.gitkeep"
-]
-exclude = [
-    "**/___command_info",
-    "**/___workflow_contexts",
-    "./.env",
-    "**/simple_workflow_template/tests"
-]
-
-[tool.poetry.scripts]
-fastworkflow = "fastworkflow.cli:main"
-
-[tool.poetry.dependencies]
-python = ">=3.11,<3.14"
-pydantic = "^2.9.2"
-speedict = "^0.3.12"
-python-dotenv = "^1.0.1"
-scikit-learn = "^1.6.1"
-transformers = "^4.48.2"
-mmh3 = "^5.1.0"
-python-levenshtein = "^0.27.1"
-colorama = "^0.4.6"
-dspy = "^3.0.1"
-torch = "^2.7.1"
-prompt_toolkit = "^3.0.43"
-libcst = "^1.8.2"
-openai = ">=2.8.0"
-litellm = {extras = ["proxy"], version = "^1.81.4"}
-uvicorn = {version = ">=0.31.1,<0.32.0", optional = true}
-fastapi = {version = ">=0.120.1", optional = true}
-fastapi-mcp = {version = "^0.4.0", optional = true}
-pyjwt = {extras = ["crypto"], version = ">=2.4.0", optional = true}  # Replaces python-jose (CVE-2024-23342 in ecdsa dep)
-datasets = {version = "^4.0.0", optional = true}
-
-# Security floor constraints for transitive dependencies
-# These ensure users get patched versions even though these are not direct deps
-orjson = ">=3.9.15"      # CVE-2024-27454 (loads recursion) - NOTE: dumps recursion DoS <=3.11.4, no upstream patch
-urllib3 = ">=2.6.0"      # CVE-2025-66418, CVE-2025-66471 (decompression chain)
-aiohttp = ">=3.13.3"     # CVE-2025-69223 + 7 others (zip bomb, DoS)
-starlette = ">=0.49.1"   # CVE-2025-62727, CVE-2025-54121 (Range header DoS)
-pyasn1 = ">=0.6.2"       # CVE-2026-23490 (decoder DoS)
-filelock = ">=3.20.1"    # CVE-2025-68146 (TOCTOU symlink)
-pynacl = ">=1.6.2"       # CVE-2025-69277 (libsodium validation)
-# NOTE: fastapi-sso CSRF vuln (needs >=0.19.0) blocked by litellm pinning to <0.17.0 - upstream issue
-
-[tool.poetry.group.dev.dependencies]
-isort = "^5.13.2"
-black = "^24.10.0"
-flake8 = "^7.1.1"
-pylint = "^3.3.1"
-mypy = "^1.13.0"
-bandit = "^1.7.10"
-
-[tool.poetry.group.test.dependencies]
-pytest = "^8.3.3"
-requests-mock = "^1.12.1"
-pytest-cov = "^6.2.1"
-
-# poetry install --with aws if you are using AWS Bedrock for LLM or LLM_AGENT
-[tool.poetry.group.aws.dependencies]
-boto3 = {version = ">=1.36.0", optional = true}
-
-[tool.poetry.extras]
-training = ["datasets"]
-fastapi = ["uvicorn", "fastapi", "fastapi-mcp", "pyjwt"]