Stéphane Tailland
afe8f1103a
Two bugs from review, the second in both agents because identity.py is a copy. The exchanged-token cache grew for the life of the process. It is keyed on (subject token, scope) and the subject token is minted fresh every turn, so every turn added keys nothing would ever read again — and expiry was checked on read but never collected. A slow leak that only shows in a pod up for days, which is the worst way to find one. It now drops expired entries first and evicts oldest beyond a bound. Expired first on purpose: an expired entry is dead weight wherever it sits in the ordering, so evicting by age alone would keep it while discarding a live one. The docstring was wrong before the code was: it claimed the cache lasted one turn. It never did. Corrected rather than quietly made true. message_id reused the context id, which is the conversation — and a conversation makes several calls to the same peer, relaying an approval being exactly that. A peer treating the second call as a replay of the first would surface as a stale answer rather than an error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
1.6 KiB
TOML
43 lines
1.6 KiB
TOML
[project]
|
|
name = "classic-models-agent-catalogue"
|
|
version = "0.3.2"
|
|
description = "Product management agent for the Classic Models catalog domain"
|
|
requires-python = ">=3.12"
|
|
|
|
# Pinned to what was current on 2026-08-28 and resolved together in one
|
|
# environment. Ranges rather than exact pins so patch-level security fixes are
|
|
# picked up, capped below the next major so an upgrade is a deliberate act.
|
|
dependencies = [
|
|
# The A2A facade. The official SDK rather than FastA2A: this estate exists
|
|
# to prove A2A interoperability across five runtimes, so the reference
|
|
# implementation is the safer base for the others to interoperate with.
|
|
"a2a-sdk[http-server]>=1.1.2,<2",
|
|
# Reasoning and tool calling. -slim keeps the dependency surface to the
|
|
# providers actually used; [openai] because the LLM endpoint speaks the
|
|
# OpenAI protocol, [mcp] for the MCP client.
|
|
"pydantic-ai-slim[openai,mcp]>=2.35.3,<3",
|
|
"httpx2>=2.12.0,<3",
|
|
# httpx 0.x as well, and not redundantly: fastmcp builds its own
|
|
# transport client and hands us an httpx.AsyncClient to configure.
|
|
"httpx>=0.28.1,<1",
|
|
"pydantic-settings>=2.7",
|
|
# pydantic_ai.retries ships in pydantic-ai-slim but imports tenacity,
|
|
# which the slim extras do not pull. Needed for the LLM gateway's 429s.
|
|
"tenacity>=9.1,<10",
|
|
"uvicorn>=0.52.4",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = ["pytest>=8", "pytest-asyncio>=0.24", "pydantic-evals>=2.35.3,<3"]
|
|
|
|
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/catalogue_agent"]
|
|
|
|
[tool.pytest.ini_options]
|
|
asyncio_mode = "auto"
|
|
testpaths = ["tests"]
|